diff --git a/CHANGELOG.md b/CHANGELOG.md
index d058a89f2..52f198c85 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,179 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.13.0] - 2026-10-06
+
+### BREAKING
+
+- C ABI: `fm_cell_xf` grows from 88 to 128 bytes (apply flags, `quotePrefix`
+  and protection) and `fm_row_layout_t` from 32 to 40 bytes (`has_height`,
+  `custom_height`). Callers built against the old layouts must rebuild.
+- C ABI: `fm_styles_set_cell_style` takes one `fm_cell_style_record_t` (name,
+  `xf_id`, `builtin_id`, `i_level`, `hidden`, `custom_builtin`). The JS
+  `setCellStyle` and Python `set_cell_style` take the matching record.
+- The native Node addon and WASM validate arguments strictly before entering
+  native code: a wrongly typed or out-of-range positional or nested argument
+  throws `TypeError` / `RangeError` instead of being coerced. String fields
+  take a string (or, on Node, a one-byte buffer), and 64-bit cursors are
+  bounded by `Number.MAX_SAFE_INTEGER` on both surfaces.
+
+### Added
+
+Everything below is available through the C ABI, WASM, native Node and Python.
+
+- Sheet geometry: default column width and row height can be read and set,
+  and a row height cleared back to auto. Cell rectangles, column widths and
+  row heights are reported in points in display or print mode, with the
+  width model and chars/points conversion.
+- Pagination results carry paper, margins, printable area, scale, page order,
+  print titles, per-page layout and manual-break flags.
+- Cells and formulas in a range are enumerated through a handle with a
+  resumable cursor, and merges in a range are listed.
+- A cell's formula in A1 and R1C1 notation, and its display text (or any
+  value under a format code) with an `ok` / overflow / invalid status.
+- The workbook theme: the 12 colours and the major and minor fonts can be
+  read and set, including on a workbook with no theme part. Any colour spec
+  (theme and tint, indexed, auto, RGB) resolves to ARGB for a font, fill or
+  border context, and a cell's effective style reports its resolved fonts,
+  fills and borders.
+- Named cell styles can be removed, and built-in style ids 48..53 are
+  accepted. `setCellStyle` is now available on the native Node addon.
+- Typed AutoFilters for sheets and tables: filter columns (values, date
+  groups, custom, top 10, dynamic, colour, icon) and sort state can be read,
+  set, removed, cleared, evaluated to visible rows and applied. Applying a
+  filter hides and unhides rows and recalculates `SUBTOTAL` and `AGGREGATE`.
+  A typed set keeps `xr:uid`, `calendarType`, `extLst` and unknown
+  attributes.
+- Data-validation evaluation: whether a proposed value satisfies the rule
+  that applies to a cell, which rule applied and its error style, plus a
+  resumable listing of invalid cells.
+- Threaded comments with replies, mentions, resolved state and the
+  workbook's person list can be read, added, edited and removed. Each thread
+  keeps Excel's legacy note stub in sync, and row and column edits move or
+  remove threads with their anchors.
+- Images: PNG, JPEG, GIF and BMP bytes are probed for format and pixel size,
+  a sheet's drawing objects (pictures, charts, shapes, groups) are listed
+  with anchors, and pictures can be read, inserted with a one-cell, two-cell
+  or absolute anchor, and removed. Row and column edits move anchors the way
+  Excel does.
+- Enum constants mirroring the C enums on every surface: `GeometryMode`,
+  `DisplayStatus`, `ColorContext`, `ColorResolution`, `ThemeSource`,
+  `EffectiveStyleSource`, `FilterKind`, `FilterOperator`,
+  `DynamicFilterType`, `SortBy`, `SortMethod`, `DateTimeGrouping`,
+  `ValidationErrorStyle`, `ImageFormat`, `DrawingObjectKind`, `AnchorKind`
+  and `AnchorEditAs`.
+
+### Changed
+
+- `SUBTOTAL` and `AGGREGATE` (options 0..3 and the array form 14..19) skip a
+  referenced cell whose own formula calls `SUBTOTAL` or `AGGREGATE`,
+  including inside `LET` / `LAMBDA` bodies and unevaluated `IF` branches,
+  and every cell of a spilled or CSE array whose anchor qualifies. A name,
+  `INDIRECT` or a plain reference to such a cell does not count. A
+  `SUBTOTAL` whose cells are all excluded returns its empty-set value
+  instead of `#VALUE!`.
+- `SUBTOTAL` 1..11 treat hidden rows as filtered only when a sheet or table
+  AutoFilter on that sheet has a criterion, and then skip every hidden row
+  on the sheet. 101..111 keep skipping every hidden row.
+- Rows with an auto height are no longer written with `customHeight`; only
+  explicit heights are.
+- `TEXT` renderings match Excel for fraction padding on whole numbers,
+  `[DBNum1]` with General, serial 0 as 1900/1/0, negative 1904-system dates
+  and times, and the 1904 upper serial bound.
+- The WASM size report's ceilings moved to 3.50 MiB / 896 KiB Brotli soft
+  and 3.75 MiB / 928 KiB Brotli hard, keeping the 0.25 MiB and 32 KiB gap
+  between each soft and hard ceiling.
+- Number formats are validated the way Excel validates them: more than four
+  sections, a condition in the third section or later, `@` mixed with
+  numeric or date tokens, and an unterminated quote, bracket, escape, `_`
+  or `*` are rejected. Conditional sections take Excel's implicit sign
+  arms, and a value no arm accepts is `#VALUE!` in `TEXT` and `#####` in
+  display text. A text-only section shows numbers as General.
+- Fractions are rendered by a continued-fraction search with fixed and
+  zero-prefixed denominators and `%` applied first; scientific formats
+  support engineering grouping, and commas before the decimal point scale.
+  Dates render from one rounded second with midnight carry.
+- A cell with an explicit style 0 is distinct from an unstyled cell and
+  overrides its row or column style; the distinction round-trips through
+  `.xlsx` and `.xlsb`. `CELL()` and display text read the effective
+  cell, row or column format, and spilled cells are saved with their
+  effective style.
+- Formulas that call a sheet- or workbook-qualified built-in are rejected at
+  every entry point (cells, conditional formats, defined names, validation),
+  not only `set_cell_formula`.
+- Pivot fields named ambiguously (a name shared by distinct fields) are
+  rejected by filters and the C API without mutation, and `GETPIVOTDATA`
+  returns `#REF!` for them. Value filters on an unknown field are rejected
+  at authoring time.
+- A row or column insert removes a pivot table pushed wholly off the grid;
+  a `GETPIVOTDATA` reading it becomes `#REF!`.
+- `TIME` caps each component at 32767 as Excel does, and the date and time
+  functions return `#NUM!` for non-finite or out-of-range inputs.
+
+### Performance
+
+- The WASM module no longer links libc `printf`: numbers are formatted by a
+  byte-identical in-tree formatter built on double-conversion.
+- Loading a sheet with many dynamic-array anchors is no longer quadratic:
+  committed spills are indexed by row band.
+- Adding formulas under whole-column watchers no longer costs quadratic
+  time during dirty marking.
+- Duplicated function preludes and out-of-line paths are shared, shrinking
+  the WASM module (`.wasm` 3,292,036 bytes raw, 901,702 bytes Brotli).
+
+### Fixed
+
+- Stored number formats with English colour names (`[Red]`, `[ColorN]`) no
+  longer render as `########` in display text and `CELL`.
+- `FIXED` and `DOLLAR` accept the full Excel decimals range.
+- `RANDBETWEEN` and `RANDARRAY` stay finite and in range when the bounds are
+  huge or span beyond the 64-bit integer range.
+- Dates past month 12 were computed two days off in the civil-date
+  conversion.
+- ISO `t="d"` date cells are rebased onto the 1904 date system when the
+  workbook uses it, and date-only ISO strings with a `Z` or `+hh:mm` suffix
+  are accepted.
+- Toggling the 1904 date system keeps the saved `<workbookPr>` in step with
+  the model; package-root parts such as `customXml` get correct relationship
+  targets in `.xlsx` and `.xlsb`; unknown relationship types are
+  attribute-escaped.
+- Formulas referencing a missing sheet recalculate when that sheet is added
+  or renamed into existence. Changing iteration, the profile, the 1904 date
+  system or the pinned clock dirties every formula (and clears pivot
+  results where they depend on it). A partial recalc marks dependents
+  outside its closure dirty, so a later full recalc refreshes them.
+- Row and column edits rewrite defined names and unowned table and pivot
+  cache ranges, dirty committed spill anchors, drop data validations and
+  ranges pushed wholly off the grid, and no longer overflow drawing anchors
+  near the grid edge. Removing or moving a sheet remaps the active and
+  first visible tab.
+- Pivot authoring edits dirty dependent formulas so `GETPIVOTDATA`
+  refreshes; custom subtotals re-aggregate with their own function after a
+  value filter; invalid date serials stay out of date groups.
+- `INDIRECT` and `OFFSET` fill a clamped expansion shorter than its
+  rectangle with blanks instead of uninitialised cells.
+- Conditional-format theme, indexed and auto colours no longer render black:
+  they resolve against the workbook theme and palette in the engine and in
+  the C API payloads, and survive an XLSB save and load.
+- Table AutoFilters follow row and column inserts and deletes, and
+  AutoFilter `colId`s shift when columns are inserted or deleted inside the
+  filter.
+
+### Known limitations
+
+- Saving as XLSB does not write threaded comments, inserted images or typed
+  AutoFilter edits; each is reported as a diagnostic. AutoFilters loaded
+  from XLSB are not visible to the typed API.
+- Custom data-validation formulas and rule bounds evaluate against the
+  stored workbook, not the proposed value.
+- AutoFilter evaluation approximates Excel's text ordering for custom `<`
+  and `>` text comparisons, and computes top N and average filters over all
+  body rows.
+- Display text does not depend on column width: narrow columns never show
+  `####` and repeat fills contribute nothing.
+- The legacy note text of a threaded comment and the regenerated comment VML
+  geometry approximate Excel's.
+
 ## [0.12.0] - 2026-09-30
 
 ### Added
@@ -1832,7 +2005,8 @@ See the
 [GitHub release page](https://github.com/libraz/formulon/releases/tag/v0.9.0)
 for the full auto-generated change list.
 
-[Unreleased]: https://github.com/libraz/formulon/compare/v0.12.0...HEAD
+[Unreleased]: https://github.com/libraz/formulon/compare/v0.13.0...HEAD
+[0.13.0]: https://github.com/libraz/formulon/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/libraz/formulon/compare/v0.11.1...v0.12.0
 [0.11.1]: https://github.com/libraz/formulon/compare/v0.11.0...v0.11.1
 [0.11.0]: https://github.com/libraz/formulon/compare/v0.10.0...v0.11.0
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 98778ce4c..c45c6cc40 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.20)
-project(formulon VERSION 0.12.0 LANGUAGES CXX)
+project(formulon VERSION 0.13.0 LANGUAGES CXX)
 
 # ---------------------------------------------------------------------------
 # Language standard and global settings
@@ -112,12 +112,18 @@ set(FORMULON_CORE_SOURCES
   src/utils/double_parse.cpp
   src/utils/index_sort.cpp
   src/utils/japanese_era.cpp
+  src/utils/number_text.cpp
   src/utils/structured_log.cpp
   src/utils/text_ops.cpp
   src/utils/thread_launch.cpp
   src/utils/utf8_length.cpp
   src/external_book.cpp
+  src/auto_filter.cpp
   src/styles.cpp
+  src/threaded_comment.cpp
+  src/style_resolve.cpp
+  src/theme.cpp
+  src/color_resolve.cpp
   src/value.cpp
   src/sheet.cpp
   src/sheet_name.cpp
@@ -125,9 +131,12 @@ set(FORMULON_CORE_SOURCES
   src/sheet_name_casefold_data.cpp
   src/workbook.cpp
   src/workbook_ref_rewrite.cpp
+  src/io/auto_filter_xml.cpp
   src/io/cell_parser.cpp
   src/io/cf_overlay.cpp
   src/io/cf_reader.cpp
+  src/io/color_spec_xml.cpp
+  src/io/threaded_comments_io.cpp
   src/io/cf_writer.cpp
   src/io/comments_reader.cpp
   src/io/comments_writer.cpp
@@ -140,6 +149,7 @@ set(FORMULON_CORE_SOURCES
   src/io/ooxml/external_link_reader.cpp
   src/io/ooxml/package_validator.cpp
   src/io/ooxml/pivot_target_reader.cpp
+  src/io/ooxml/part_dom.cpp
   src/io/ooxml/print_settings_parse.cpp
   src/io/ooxml/sheet_aux_rels_reader.cpp
   src/io/ooxml/workbook_rels_reader.cpp
@@ -158,11 +168,14 @@ set(FORMULON_CORE_SOURCES
   src/io/pivot_table_writer.cpp
   src/io/format_detect.cpp
   src/io/sax_xml_reader.cpp
+  src/io/sheet_layout_reader.cpp
+  src/io/sheet_overlay_reader.cpp
   src/io/sheet_reader.cpp
   src/io/sst_reader.cpp
   src/io/styles_reader.cpp
   src/io/styles_writer.cpp
   src/io/tables_reader.cpp
+  src/io/theme_part.cpp
   src/io/xml_escape.cpp
   src/io/xml_utils.cpp
   src/io/xsd_double.cpp
@@ -175,6 +188,7 @@ set(FORMULON_CORE_SOURCES
   src/io/xlsb/func_id_table.cpp
   src/io/xlsb/metadata_bin.cpp
   src/io/xlsb/ptg.cpp
+  src/io/xlsb/ptg_declarations.cpp
   src/io/xlsb/ptg_reader.cpp
   src/io/xlsb/ptg_writer.cpp
   src/io/xlsb/pivot_reader.cpp
@@ -190,19 +204,28 @@ set(FORMULON_CORE_SOURCES
   src/io/xlsb/styles_reader.cpp
   src/io/xlsb/styles_writer.cpp
   src/io/xlsb/tail_refs.cpp
+  src/io/xlsb/workbook_bin_reader.cpp
+  src/io/xlsb/workbook_bin_writer.cpp
   src/io/xlsb/writer.cpp
+  src/cf/auto_filter_eval.cpp
   src/cf/cf_evaluator.cpp
   src/cf/cf_helpers.cpp
   src/cf/rule_match.cpp
   src/cf/scale_evaluator.cpp
+  src/cf/validation_eval.cpp
   src/parser/tokenizer.cpp
   src/parser/ast.cpp
+  src/parser/reference.cpp
   src/parser/ast_dump.cpp
   src/parser/ast_format.cpp
+  src/parser/ast_format_r1c1.cpp
+  src/parser/formula_prefix.cpp
   src/parser/ast_shift.cpp
+  src/parser/parse_error.cpp
   src/parser/parser.cpp
   src/parser/parser_atoms.cpp
   src/parser/parser_reference.cpp
+  src/parser/parser_let_lambda.cpp
   src/parser/ref_transforms.cpp
   src/pivot/aggregator.cpp
   src/pivot/filter_engine.cpp
@@ -215,6 +238,10 @@ set(FORMULON_CORE_SOURCES
   src/print/page_setup.cpp
   src/print/print_area.cpp
   src/print/pagination.cpp
+  src/print/sheet_geometry.cpp
+  src/drawing/drawing_xml.cpp
+  src/drawing/image_header.cpp
+  src/drawing/drawing_edit.cpp
   src/eval/array_alloc.cpp
   src/eval/coerce.cpp
   src/eval/rng.cpp
@@ -285,6 +312,7 @@ set(FORMULON_CORE_SOURCES
   src/eval/builtins/text_format.cpp
   src/eval/builtins/text_width.cpp
   src/eval/builtins/web.cpp
+  src/eval/text_format/display_text.cpp
   src/eval/text_format/number_format.cpp
   src/eval/text_format/number_format_scanner.cpp
   src/eval/text_format/number_format_section.cpp
@@ -294,14 +322,17 @@ set(FORMULON_CORE_SOURCES
   src/eval/text_format/render_date.cpp
   src/eval/text_format/render_fraction.cpp
   src/eval/stats/special_functions.cpp
+  src/eval/tree_walker/binding_source.cpp
   src/eval/tree_walker/broadcast.cpp
   src/eval/tree_walker/dispatch.cpp
+  src/eval/tree_walker/lambda_invoke.cpp
   src/eval/tree_walker/walker.cpp
   src/eval/tree_walker_lazy_table.cpp
   src/eval/eval_context.cpp
   src/eval/external_ref.cpp
   src/eval/eval_state.cpp
   src/eval/criteria.cpp
+  src/eval/wildcard.cpp
   src/eval/jp_fold.cpp
   src/eval/jp_kana_table.cpp
   src/eval/jis0208_table.cpp
@@ -315,7 +346,7 @@ set(FORMULON_CORE_SOURCES
   src/eval/spill_committer.cpp
   src/eval/special_forms_lazy.cpp
   src/eval/structured_ref.cpp
-  src/eval/aggregate_kernels.cpp
+  src/numeric_aggregate_kernels.cpp
 src/eval/aggregate_lazy.cpp
   src/eval/areas_lazy.cpp
   src/eval/cell_lazy.cpp
@@ -337,11 +368,14 @@ src/eval/aggregate_lazy.cpp
   src/eval/workdays_lazy.cpp
   src/eval/financial_lazy.cpp
   src/eval/forecast_ets_lazy.cpp
+  src/eval/ets_series.cpp
+  src/eval/holt_winters.cpp
   src/eval/getpivotdata_lazy.cpp
   src/eval/linest_lazy.cpp
   src/eval/textjoin_lazy.cpp
   src/eval/textsplit_lazy.cpp
   src/eval/trimrange_lazy.cpp
+  src/eval/a1_parse.cpp
   src/eval/reference/common.cpp
   src/eval/reference/indirect.cpp
   src/eval/reference/intersection.cpp
@@ -357,12 +391,15 @@ src/eval/aggregate_lazy.cpp
   src/eval/lookups/common.cpp
   src/eval/lookups/index.cpp
   src/eval/lookups/xlookup.cpp
+  src/c_api/parts/auto_filter.cpp
   src/c_api/parts/cells.cpp
   src/c_api/parts/cf_eval.cpp
   src/c_api/parts/eval_adhoc.cpp
   src/c_api/parts/cf_mutate.cpp
   src/c_api/parts/common.cpp
   src/c_api/parts/diagnostics.cpp
+  src/c_api/parts/drawing.cpp
+  src/c_api/parts/display.cpp
   src/c_api/parts/external_links.cpp
   src/c_api/parts/function_catalog.cpp
   src/c_api/parts/pivot_cache.cpp
@@ -370,16 +407,21 @@ src/eval/aggregate_lazy.cpp
   src/c_api/parts/pivot_layout.cpp
   src/c_api/parts/pivot_table.cpp
   src/c_api/parts/pagination.cpp
+  src/c_api/parts/print_area_titles.cpp
   src/c_api/parts/print_settings.cpp
   src/c_api/parts/xml_fragment.cpp
   src/c_api/parts/sheet_layout.cpp
   src/c_api/parts/sheets_ui.cpp
   src/c_api/parts/styles.cpp
+  src/c_api/parts/styles_mutate.cpp
   src/c_api/parts/trace.cpp
   src/c_api/parts/version.cpp
   src/c_api/parts/workbook.cpp
   src/c_api/parts/recalc.cpp
   src/c_api/parts/tables.cpp
+  src/c_api/parts/theme.cpp
+  src/c_api/parts/threaded_comments.cpp
+  src/c_api/parts/validation.cpp
   src/c_api/generated/sheet_counts.cpp
   src/c_api/generated/styles_counts.cpp
   src/c_api/generated/workbook_counts.cpp
diff --git a/Makefile b/Makefile
index 437273cf0..1648985af 100644
--- a/Makefile
+++ b/Makefile
@@ -46,6 +46,10 @@ BIOME_PATHS := packages/npm packages/npm-native tests/wasm src/wasm
 # walk through the ~10k oracle parametric tests.
 CTEST_JOBS ?= 0
 
+# Build parallelism for every `cmake --build` recipe. Empty lets the
+# generator pick; `make wasm JOBS=2` caps a build on a shared host.
+JOBS ?=
+
 SRC_DIRS := src tests
 CPP_GLOB := $(shell find $(SRC_DIRS) -type f \( -name '*.cpp' -o -name '*.h' \) 2>/dev/null)
 
@@ -66,11 +70,11 @@ all: build
 
 build:
 	$(CMAKE) -B $(BUILD_DIR) -DCMAKE_BUILD_TYPE=Debug
-	$(CMAKE) --build $(BUILD_DIR) --parallel
+	$(CMAKE) --build $(BUILD_DIR) --parallel $(JOBS)
 
 release:
 	$(CMAKE) -B build-release -DCMAKE_BUILD_TYPE=Release
-	$(CMAKE) --build build-release --parallel
+	$(CMAKE) --build build-release --parallel $(JOBS)
 
 # A gate result is only a claim about the tree it ran in, and that tree's
 # configuration can change without this file being touched: any
@@ -271,7 +275,7 @@ wasm:
 	fi
 	$(EM_CMAKE) -B $(WASM_BUILD_DIR) -DCMAKE_BUILD_TYPE=Release \
 	  -DFM_BUILD_WASM=ON -DFM_BUILD_TESTING=OFF -DFM_BUILD_CLI=OFF
-	$(CMAKE) --build $(WASM_BUILD_DIR) --parallel \
+	$(CMAKE) --build $(WASM_BUILD_DIR) --parallel $(JOBS) \
 	  --target formulon_wasm formulon_wasm_stack_probe
 	@echo ""
 	@echo "wasm artifacts:"
@@ -286,7 +290,7 @@ wasm-threads:
 	$(EM_CMAKE) -B $(WASM_THREADS_BUILD_DIR) -DCMAKE_BUILD_TYPE=Release \
 	  -DFM_BUILD_WASM=ON -DFM_WASM_THREADS=ON \
 	  -DFM_BUILD_TESTING=OFF -DFM_BUILD_CLI=OFF
-	$(CMAKE) --build $(WASM_THREADS_BUILD_DIR) --parallel \
+	$(CMAKE) --build $(WASM_THREADS_BUILD_DIR) --parallel $(JOBS) \
 	  --target formulon_wasm formulon_wasm_stack_probe
 	@echo ""
 	@echo "wasm-threads artifacts:"
@@ -300,7 +304,7 @@ wasm-debug:
 	fi
 	$(EM_CMAKE) -B $(WASM_DEBUG_BUILD_DIR) -DCMAKE_BUILD_TYPE=Debug \
 	  -DFM_BUILD_WASM=ON -DFM_BUILD_TESTING=OFF -DFM_BUILD_CLI=OFF
-	$(CMAKE) --build $(WASM_DEBUG_BUILD_DIR) --parallel --target formulon_wasm
+	$(CMAKE) --build $(WASM_DEBUG_BUILD_DIR) --parallel $(JOBS) --target formulon_wasm
 
 # capi WASM: standalone reactor build consumed by wasmtime-py. No JS
 # glue, no pthread, exports the curated fm_* list from
@@ -313,7 +317,7 @@ wasm-capi:
 	$(EM_CMAKE) -B $(WASM_CAPI_BUILD_DIR) -DCMAKE_BUILD_TYPE=Release \
 	  -DFM_BUILD_WASM=ON -DFM_WASM_VARIANT=capi \
 	  -DFM_BUILD_TESTING=OFF -DFM_BUILD_CLI=OFF
-	$(CMAKE) --build $(WASM_CAPI_BUILD_DIR) --parallel --target formulon_wasm
+	$(CMAKE) --build $(WASM_CAPI_BUILD_DIR) --parallel $(JOBS) --target formulon_wasm
 	@echo ""
 	@echo "wasm-capi artifact:"
 	@ls -la $(WASM_CAPI_BUILD_DIR)/formulon_capi.wasm 2>/dev/null || \
@@ -455,7 +459,7 @@ NODE_NATIVE_BUILD_DIR ?= build
 
 node-native:
 	$(CMAKE) -B $(NODE_NATIVE_BUILD_DIR) -DCMAKE_BUILD_TYPE=Release -DFM_BUILD_NODE_ADDON=ON
-	$(CMAKE) --build $(NODE_NATIVE_BUILD_DIR) --target formulon_node --parallel
+	$(CMAKE) --build $(NODE_NATIVE_BUILD_DIR) --target formulon_node --parallel $(JOBS)
 
 node-package: node-native
 	@if ! command -v $(NODE) >/dev/null 2>&1; then \
@@ -618,8 +622,8 @@ oracle-verify:
 	@if [ ! -f $(BUILD_DIR)/CMakeCache.txt ]; then \
 	  echo "oracle-verify: run 'make build' first"; exit 1; \
 	fi
-	@$(CMAKE) --build $(BUILD_DIR) --target formulon_oracle_tests --parallel
-	@$(CMAKE) --build $(BUILD_DIR) --target formulon_workbook_oracle_tests --parallel
+	@$(CMAKE) --build $(BUILD_DIR) --target formulon_oracle_tests --parallel $(JOBS)
+	@$(CMAKE) --build $(BUILD_DIR) --target formulon_workbook_oracle_tests --parallel $(JOBS)
 	@# gtest_discover_tests caches the parameter list keyed by binary
 	@# timestamp, but our goldens aren't a build input. Force
 	@# rediscovery so newly regenerated golden*/*.golden.json files land
@@ -667,7 +671,7 @@ ironcalc-verify:
 	@if [ ! -f $(BUILD_DIR)/CMakeCache.txt ]; then \
 	  echo "ironcalc-verify: run 'make build' first"; exit 1; \
 	fi
-	@$(CMAKE) --build $(BUILD_DIR) --target formulon_ironcalc_oracle_tests --parallel
+	@$(CMAKE) --build $(BUILD_DIR) --target formulon_ironcalc_oracle_tests --parallel $(JOBS)
 	@# Force ctest to rediscover parameter list; the goldens aren't a
 	@# build input so the cache would otherwise stick.
 	@rm -f $(BUILD_DIR)/tests/oracle/formulon_ironcalc_oracle_tests*_tests.cmake
@@ -699,7 +703,7 @@ fuzz:
 	$(CMAKE) -B $(FUZZ_BUILD_DIR) -DCMAKE_BUILD_TYPE=Debug -DFM_BUILD_FUZZ=ON \
 	  -DFM_FUZZ_SANITIZERS="$(FUZZ_SANITIZERS)" \
 	  -DCMAKE_C_COMPILER="$(FUZZ_CC)" -DCMAKE_CXX_COMPILER="$(FUZZ_CXX)"
-	$(CMAKE) --build $(FUZZ_BUILD_DIR) --parallel
+	$(CMAKE) --build $(FUZZ_BUILD_DIR) --parallel $(JOBS)
 	@(cd $(FUZZ_BUILD_DIR) && $(CTEST) -R Fuzz --output-on-failure --timeout 300)
 
 # The same harnesses under a wall-clock budget instead of an iteration cap.
@@ -724,7 +728,7 @@ fuzz-long: fuzz
 # threshold is tunable, so it is run on demand rather than gated.
 bench:
 	$(CMAKE) -B $(BUILD_DIR) -DCMAKE_BUILD_TYPE=Release
-	$(CMAKE) --build $(BUILD_DIR) --parallel
+	$(CMAKE) --build $(BUILD_DIR) --parallel $(JOBS)
 	@(cd $(BUILD_DIR) && $(CTEST) -L BENCH --output-on-failure --timeout 600)
 
 # Local coverage diagnostic. Builds with the gcov-instrumented preset,
diff --git a/README.md b/README.md
index 5b167e8cc..7a066f632 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ CLI binaries are available from [GitHub Releases](https://github.com/libraz/form
 
 - **Checked against real Excel.** The runtime default is `win-365-ja_JP`, and profile-specific oracle suites pin observed Excel behavior. Formula results are pinned against Mac Excel 365 (ja-JP); pivot tables and print layout are pinned against Windows Excel 365 (ja-JP), because creating PivotTables by automation requires Windows COM. Both come from a verified Microsoft 365 install. Outputs are checked for bit-level parity against golden data regenerated from the real product; every accepted divergence (transcendental ulp drift, volatile-function snapshots, Excel quirks where Formulon deliberately keeps a saner answer) is recorded case-by-case in [`tests/divergence.yaml`](tests/divergence.yaml) with a reason and the last verified Excel build.
 - **One C++ core, identical results everywhere.** The browser, Python, and CLI builds all ship the same engine rather than separate calculation logic, so there is no second implementation for results to drift against.
-- **WASM size budget.** CI enforces a **3.25 MiB** uncompressed and **864 KiB** Brotli hard ceiling, and reports **3.00 MiB** / **832 KiB** soft ceilings. Brotli is the wire size that actually binds, so it gates on equal footing. Run `make size-check` to measure the current artifact.
+- **WASM size budget.** CI enforces a **3.75 MiB** uncompressed and **928 KiB** Brotli hard ceiling, and reports **3.50 MiB** / **896 KiB** soft ceilings. Brotli is the wire size that actually binds, so it gates on equal footing. Run `make size-check` to measure the current artifact.
 - **Small dependency set.** Engine deps: `miniz` (zip/deflate), `pugixml` (XML + XPath 1.0), `PCRE2` (Excel-compatible regex for `REGEX*`), `double-conversion` (Grisu3 shortest-roundtrip `dtoa`). Linear algebra, UTF-8 handling, and most number coercion are in-tree.
 - **C++ written for auditability.** `Expected<T, Error>` error handling, RAII, `-fno-exceptions -fno-rtti`, Google C++ style.
 
@@ -52,7 +52,7 @@ Formulon deliberately does **not** cover:
 | Chart / drawing rendering | Belongs to a rendering layer, not the engine. |
 | PowerQuery (M) / DAX | Separate engine, separate problem domain. |
 | Pivot cache regeneration | The stored `pivotCacheRecords` snapshot is preserved as-is, never rebuilt from the source range. PivotTable *results* are evaluated on demand through the API. |
-| Spreadsheet UI | Rendering belongs to the caller. The engine exposes what a UI needs to drive it — viewport recalc (`partialRecalc`), conditional-format evaluation over a range, spill info. |
+| Spreadsheet UI | Rendering belongs to the caller. The engine exposes what a UI needs to drive it — viewport recalc (`partialRecalc`), conditional-format evaluation over a range, spill info, cell geometry and display text, effective styles with resolved colours, and AutoFilter and data-validation evaluation. |
 
 These are **permanent** non-goals, not "not yet." The scope is finite on purpose.
 
@@ -125,20 +125,20 @@ additional category (508 + 15 = 523, not 525).
 |-------|--------|
 | `ctest -LE "SLOW\|BENCH\|TSAN"` — `make test`, the PR gate | all passing |
 | `ctest -LE "BENCH\|TSAN"` — `make test-slow`, adds the `SLOW` tier | all passing |
-| Primary formula oracle | `4546/4546` passing, `125` documented skips |
+| Primary formula oracle | `4768/4768` passing, `133` documented skips |
 | Conditional-formatting oracle | `23/23` |
-| Workbook oracle (pivot + print) | `73/73` passing, `9` documented skips |
+| Workbook oracle (pivot + print) | `83/83` passing, `10` documented skips |
 | Imported third-party engine corpus (cross-check) | `12510/12510` passing, `168` documented divergences |
 
 Three labels partition the CTest suite: `SLOW` (minutes-scale integration and concurrency cases), `TSAN` (thread-sanitizer runs), and `BENCH` (microbenchmark regression checks, whose threshold is tunable, so they run on demand). Everything else is the unlabeled fast tier that CI gates on; there is no separate load-test tier. The libFuzzer harnesses also carry the `SLOW` label, but they exist only in a build configured with `-DFM_BUILD_FUZZ=ON` (`make fuzz`), not in a default build or in CI. They need a Clang that ships the libFuzzer runtime, which the Apple toolchain does not, so macOS needs a separate LLVM. AddressSanitizer is off by default there as well — it deadlocks in its own shadow-memory setup against recent macOS dynamic linkers — so a macOS fuzz run detects crashes, timeouts and undefined behaviour but not heap corruption.
 
 Every skip is an explicit divergence, host-service dependency, volatile/environment-bound case, or driver limitation, not a silent stub. Of the 523 catalogued functions, `519` satisfy all six closure conditions (`behaviors_declared` / `cases_cover_behaviors` / `golden_present` / `divergence_documented` / `not_in_pilot` / `behavior_drift`); the remaining `4` (`ARRAYTOTEXT`, `FILTERXML`, `GETPIVOTDATA`, `PHONETIC`) fail only `behaviors_declared` — their behavior taxonomy is under-specified. `JIS` closes as a declared alias of `DBCS`: Excel rewrites that ja-JP formula-bar spelling before it stores or evaluates a formula, so no oracle case can name it, and the closure harness resolves the alias to the function it defers to rather than taking the declaration on trust.
 
-Beyond formula results, **pivot tables and print areas / pagination** have a dedicated **workbook oracle track**, captured through a WSL2 → Windows COM bridge. Its nine remaining skips are all the same Excel quirk: at a print scale or zoom of 50% or less, Excel's page-break preview emits column auto-breaks that do not follow geometric pagination, so the observed break set stops shrinking with the scale and grows again at 25%. Each skipped case records the Microsoft 365 observation it was measured against.
+Beyond formula results, **pivot tables and print areas / pagination** have a dedicated **workbook oracle track**, captured through a WSL2 → Windows COM bridge. Nine of its ten skips are the same Excel quirk: at a print scale or zoom of 50% or less, Excel's page-break preview emits column auto-breaks that do not follow geometric pagination, so the observed break set stops shrinking with the scale and grows again at 25%. Each of those nine records the Microsoft 365 observation it was measured against. The tenth is a smoke case that only checks the case-file shape and has nothing to compare.
 
 New workbooks use the `win-365-ja_JP` formula profile by default; callers can switch with the profile-id API (`mac-365-ja_JP`, `win-365-ja_JP`). English-locale profiles are intentionally not exposed until matching EN oracle data and verified locale-specific behavior are available.
 
-The OOXML reader/writer round-trips sheets, styles, conditional formatting, comments, hyperlinks, merges, data validations, defined names, tables, and pivot tables; an MS-XLSB reader/writer covers cell values, styles, cross-sheet 3-D references, and common tokenized formulas, with array-constant literals and post-2007 "future function" IDs still limited compared to the OOXML path. Workbook operations are available through the C ABI and language bindings; the CLI deliberately exposes only `eval`, `recalc`, `dump`, and `paginate`.
+The OOXML reader/writer round-trips sheets, styles, conditional formatting, comments (including threaded comments), hyperlinks, merges, data validations, defined names, tables, pivot tables, images and drawings, and the theme; an MS-XLSB reader/writer covers cell values, styles, cross-sheet 3-D references, and common tokenized formulas, with array-constant literals and post-2007 "future function" IDs still limited compared to the OOXML path. Threaded comments, inserted images and typed AutoFilter edits are not written to XLSB. Workbook operations are available through the C ABI and language bindings; the CLI deliberately exposes only `eval`, `recalc`, `dump`, and `paginate`.
 
 Feedback, issue reports, and oracle divergence reports are very welcome.
 
diff --git a/README_ja.md b/README_ja.md
index 880ac69ef..279a74770 100644
--- a/README_ja.md
+++ b/README_ja.md
@@ -26,7 +26,7 @@ CLI バイナリは [GitHub Releases](https://github.com/libraz/formulon/release
 
 - **互換性は実際の Excel と照合して確かめています。** 既定の profile は `win-365-ja_JP` です。数式の結果は Mac Excel 365 (ja-JP)、ピボットテーブルと印刷レイアウトは Windows Excel 365 (ja-JP) を基準に固定しています。ピボットテーブルの作成を自動化するには Windows COM が必要なためです。いずれも検証済みの Microsoft 365 環境から採取しています。出力は実 Excel から再生成した golden と照合します。許容している差分、たとえば超越関数の ulp 差、揮発関数、Excel 側の不整合を Formulon が意図的に採らないケースは、[`tests/divergence.yaml`](tests/divergence.yaml) に理由と確認済み Excel ビルドを記録します。
 - **どの環境でも同じ C++ コアが計算します。** ブラウザ、Python、CLI で別々の計算ロジックを持たず、同じエンジンを配布しています。実装が分かれないので、環境ごとに結果がずれることもありません。
-- **WASM のサイズに上限を設けています。** CI は非圧縮 **3.25 MiB**、Brotli **864 KiB** を超えると失敗し、**3.00 MiB** / **832 KiB** を超えると警告を出します。実際に効いてくるのは配信時の Brotli サイズなので、非圧縮と対等に検査します。現在値は `make size-check` で確認できます。
+- **WASM のサイズに上限を設けています。** CI は非圧縮 **3.75 MiB**、Brotli **928 KiB** を超えると失敗し、**3.50 MiB** / **896 KiB** を超えると警告を出します。実際に効いてくるのは配信時の Brotli サイズなので、非圧縮と対等に検査します。現在値は `make size-check` で確認できます。
 - **依存は小さく保っています。** ランタイム依存は `miniz` (zip/deflate)、`pugixml` (XML + XPath 1.0)、`PCRE2` (`REGEX*`)、`double-conversion` (Grisu3 `dtoa`) の 4 つです。線形代数、UTF-8 処理、数値変換の多くはリポジトリ内で実装しています。
 - **C++ は監査しやすさを優先して書いています。** `Expected<T, Error>` ベースのエラー処理、RAII、`-fno-exceptions -fno-rtti`、Google C++ Style を採用しています。
 
@@ -52,7 +52,7 @@ Formulon は以下を **意図的にサポートしません**。
 | グラフ / 図形のレンダリング | 描画レイヤの責務。計算エンジンの仕事ではありません。 |
 | PowerQuery (M) / DAX | 別のエンジンが扱う別の問題領域です。 |
 | Pivot キャッシュの再生成 | 保存済み `pivotCacheRecords` はそのまま保持し、ソース範囲から作り直すことはしません。PivotTable の計算結果自体は API から都度評価できます。 |
-| スプレッドシート UI 本体 | 描画は呼び出し側の責任です。UI から使うための API(ビューポート単位の再計算 `partialRecalc`、範囲単位の条件付き書式評価、spill 情報など)はエンジン側で提供しています。 |
+| スプレッドシート UI 本体 | 描画は呼び出し側の責任です。UI から使うための API(ビューポート単位の再計算 `partialRecalc`、範囲単位の条件付き書式評価、spill 情報、セルの位置・サイズと表示テキスト、色を解決済みの実効スタイル、AutoFilter と入力規則の評価など)はエンジン側で提供しています。 |
 
 これらは「まだやっていない」機能ではなく、スコープ外として固定しています。
 
@@ -102,20 +102,20 @@ oracle は **104 カテゴリ** あります。数式 track と条件付き書
 |------|------|
 | `ctest -LE "SLOW\|BENCH\|TSAN"` — `make test`、PR ゲート | すべて passed |
 | `ctest -LE "BENCH\|TSAN"` — `make test-slow`、`SLOW` 層を追加 | すべて passed |
-| primary formula oracle | `4546/4546` passed / `125` documented skips |
+| primary formula oracle | `4768/4768` passed / `133` documented skips |
 | 条件付き書式 oracle | `23/23` |
-| workbook oracle (pivot + print) | `73/73` passed / `9` documented skips |
+| workbook oracle (pivot + print) | `83/83` passed / `10` documented skips |
 | 取り込み済み外部エンジンコーパス (クロスチェック) | `12510/12510` passed / `168` documented divergences |
 
 CTest スイートを分けているラベルは 3 つです。`SLOW`（数分かかる結合・並行性テスト）、`TSAN`（ThreadSanitizer での実行）、`BENCH`（しきい値を調整できるマイクロベンチの回帰チェックで、必要なときだけ実行）です。ラベルのないテストはすべて高速層で、CI はこれを合否判定に使います。負荷試験専用の層はありません。libFuzzer ハーネスも `SLOW` ラベルを持ちますが、`-DFM_BUILD_FUZZ=ON` を指定したビルド (`make fuzz`) にしか存在せず、既定ビルドにも CI にも含まれません。libFuzzer ランタイムを同梱する Clang が必要で、Apple の toolchain はこれを持たないため、macOS では別途 LLVM が要ります。macOS では AddressSanitizer も既定で無効です。最近の macOS の動的リンカと組み合わせると、shadow memory の初期化中にデッドロックするためです。そのため macOS での fuzz 実行で検出できるのはクラッシュ・タイムアウト・未定義動作までで、ヒープ破壊は検出できません。
 
 残っている skip は、明示済みの divergence、ホストサービス依存、揮発・環境依存ケース、またはドライバ制約です。黙って未実装 stub に落としているものではありません。523 関数のうち `519` は closure 6 条件 (`behaviors_declared` / `cases_cover_behaviors` / `golden_present` / `divergence_documented` / `not_in_pilot` / `behavior_drift`) を全て満たします。残る 4 件 (`ARRAYTOTEXT`, `FILTERXML`, `GETPIVOTDATA`, `PHONETIC`) が満たさないのは `behaviors_declared` だけで、挙動の分類がまだ書き切れていないためです。`JIS` は `DBCS` の別名として宣言し、closure を満たしています。Excel は ja-JP の数式バーで入力された `JIS` を保存・評価の前に `DBCS` へ書き換えるため、`JIS` を直接呼ぶ oracle case は作れません。closure harness は宣言をそのまま信用せず、別名の参照先の関数を実際に評価して判定します。
 
-数式の結果に加えて、**ピボットテーブルと印刷範囲・改ページ**には専用の **workbook oracle track** があり、WSL2 から Windows COM へ渡すブリッジ経由で採取します。残る 9 件の skip はいずれも同じ Excel の癖です。印刷倍率またはズームが 50% 以下のとき、Excel の改ページプレビューは幾何的なページ分割に従わない列の自動改ページを出すため、観測される改ページ位置は倍率を下げても縮まらず、25% では逆に増えます。skip した各ケースには、照合した Microsoft 365 の観測値を記録しています。
+数式の結果に加えて、**ピボットテーブルと印刷範囲・改ページ**には専用の **workbook oracle track** があり、WSL2 から Windows COM へ渡すブリッジ経由で採取します。skip は 10 件あり、そのうち 9 件は同じ Excel の癖によるものです。印刷倍率またはズームが 50% 以下のとき、Excel の改ページプレビューは幾何的なページ分割に従わない列の自動改ページを出すため、観測される改ページ位置は倍率を下げても縮まらず、25% では逆に増えます。この 9 件には、照合した Microsoft 365 の観測値を記録しています。残る 1 件はケースファイルの形だけを確かめるスモーク用のケースで、照合する値を持ちません。
 
 新規ワークブックはデフォルトで `win-365-ja_JP` profile を使います。必要に応じて profile-id API (`mac-365-ja_JP` / `win-365-ja_JP`) で切り替えられます。英語ロケール profile は、対応する EN oracle データとロケール固有挙動の検証が揃うまで公開しません。
 
-OOXML reader / writer はシート、スタイル、条件付き書式、コメント、ハイパーリンク、結合セル、入力規則、定義済み名前、テーブル、ピボットテーブルを round-trip します。MS-XLSB reader / writer はセル値、スタイル、シート間 3-D 参照、および一般的なトークン化数式をカバーします。配列定数リテラルと 2007 年以降の future function ID は、OOXML 経路に比べてまだ限定的です。ワークブック操作は C ABI と各言語バインディングから利用できます。CLI は意図的に `eval` / `recalc` / `dump` / `paginate` のみを公開します。
+OOXML reader / writer はシート、スタイル、条件付き書式、コメント (スレッド形式を含む)、ハイパーリンク、結合セル、入力規則、定義済み名前、テーブル、ピボットテーブル、画像と図形、テーマを round-trip します。MS-XLSB reader / writer はセル値、スタイル、シート間 3-D 参照、および一般的なトークン化数式をカバーします。配列定数リテラルと 2007 年以降の future function ID は、OOXML 経路に比べてまだ限定的です。スレッド形式のコメント、挿入した画像、型付き AutoFilter の編集は XLSB へ書き出しません。ワークブック操作は C ABI と各言語バインディングから利用できます。CLI は意図的に `eval` / `recalc` / `dump` / `paginate` のみを公開します。
 
 不具合報告・oracle 差分レポート・ご意見はいつでも歓迎しています。
 
diff --git a/cmake/FormulonNodeAddon.cmake b/cmake/FormulonNodeAddon.cmake
index 0d785215c..bff240f07 100644
--- a/cmake/FormulonNodeAddon.cmake
+++ b/cmake/FormulonNodeAddon.cmake
@@ -68,12 +68,15 @@ endif()
 add_library(formulon_node MODULE
   src/node_addon/addon.cc
   src/node_addon/parts/addon_common.cc
+  src/node_addon/parts/cells.cc
+  src/node_addon/parts/conditional_format.cc
   src/node_addon/parts/free_funcs.cc
   src/node_addon/parts/lifecycle.cc
   src/node_addon/parts/pivot_cache.cc
   src/node_addon/parts/pivot_table.cc
   src/node_addon/parts/print.cc
   src/node_addon/parts/sheet.cc
+  src/node_addon/parts/sheet_ui.cc
   src/node_addon/parts/sheet_view.cc
   src/node_addon/parts/styles.cc
   src/node_addon/parts/trace_catalog.cc
diff --git a/cmake/FormulonWasm.cmake b/cmake/FormulonWasm.cmake
index 6ade913be..bbe562cfe 100644
--- a/cmake/FormulonWasm.cmake
+++ b/cmake/FormulonWasm.cmake
@@ -36,9 +36,9 @@
 # ---------------------------------------
 #
 # * Engine is built `-fno-exceptions -fno-rtti`. We keep that here
-#   (`-sDISABLE_EXCEPTION_CATCHING=1`); the embind binding never throws
-#   because `JsWorkbook` and friends route every failure through a
-#   `{ ok, status, message }` envelope.
+#   (`-sDISABLE_EXCEPTION_CATCHING=1`). Native methods return failures
+#   through result envelopes; JS argument guards can throw before entry.
+#   Caller-owned getters are caught in JS before returning to C++.
 #
 # * `MODULARIZE=1 + EXPORT_NAME=createFormulon + EXPORT_ES6=1` produces
 #   an ES module factory: `import createFormulon from './formulon.js'`.
@@ -135,6 +135,37 @@ else()
   target_link_libraries(formulon_wasm PRIVATE formulon_static)
 endif()
 
+# The N-API registration table is the canonical declaration of primitive
+# positional argument types. Generate the embind pre-js from that table so
+# both JavaScript surfaces reject coercing values before embind enters a
+# native method. The generated file is glue only and is therefore kept out
+# of the wasm link itself.
+if(FM_WASM_VARIANT STREQUAL "embind")
+  find_package(Python3 COMPONENTS Interpreter REQUIRED)
+  set(_FM_WASM_POSITIONAL_GUARD_SCRIPT
+    "${CMAKE_CURRENT_SOURCE_DIR}/tools/codegen/gen_wasm_positional_guards.py")
+  set(_FM_WASM_POSITIONAL_GUARD_PRE_JS
+    "${CMAKE_CURRENT_BINARY_DIR}/generated/checked_arguments.pre.js")
+  add_custom_command(
+    OUTPUT "${_FM_WASM_POSITIONAL_GUARD_PRE_JS}"
+    COMMAND "${Python3_EXECUTABLE}" "${_FM_WASM_POSITIONAL_GUARD_SCRIPT}"
+            --node-source "${CMAKE_CURRENT_SOURCE_DIR}/src/node_addon/parts/workbook_class.cc"
+            --wasm-source "${CMAKE_CURRENT_SOURCE_DIR}/src/wasm/parts/bindings_register.cpp"
+            --output "${_FM_WASM_POSITIONAL_GUARD_PRE_JS}"
+    DEPENDS
+      "${_FM_WASM_POSITIONAL_GUARD_SCRIPT}"
+      "${CMAKE_CURRENT_SOURCE_DIR}/src/node_addon/parts/workbook_class.cc"
+      "${CMAKE_CURRENT_SOURCE_DIR}/src/wasm/parts/bindings_register.cpp"
+    COMMENT "Generating WASM positional argument guards"
+    VERBATIM
+  )
+  add_custom_target(formulon_wasm_positional_guards
+    DEPENDS "${_FM_WASM_POSITIONAL_GUARD_PRE_JS}")
+  add_dependencies(formulon_wasm formulon_wasm_positional_guards)
+  set_property(TARGET formulon_wasm APPEND PROPERTY LINK_DEPENDS
+    "${_FM_WASM_POSITIONAL_GUARD_PRE_JS}")
+endif()
+
 # Shared optimisation flags.
 if(CMAKE_BUILD_TYPE STREQUAL "Debug")
   set(_FM_WASM_OPT_FLAGS "-O0;-g")
@@ -205,6 +236,8 @@ if(FM_WASM_VARIANT STREQUAL "embind")
     "-sSTACK_SIZE=${_FM_WASM_STACK_SIZE}"
     "--closure=0"
   )
+  list(APPEND _FM_WASM_COMMON_LINK_FLAGS
+    "--pre-js=${_FM_WASM_POSITIONAL_GUARD_PRE_JS}")
 
   # Compile flags for the embind TU only. formulon_core is built
   # -fno-exceptions -fno-rtti (the project-wide stance). embind, however,
@@ -369,15 +402,18 @@ set_target_properties(formulon_wasm_stack_probe PROPERTIES
 # always-active SAX). Native builds keep the threshold at 256 KiB.
 target_compile_definitions(formulon_core PRIVATE FORMULON_WASM=1)
 
-# pugixml parses numbers with strtod. Wrapping the symbol routes those calls
-# to the engine's decimal parser (`__wrap_strtod` in src/utils/double_parse.cpp),
-# which keeps libc's scanner and the 128-bit float routines it needs out of
-# the module: ~10 KB uncompressed, ~5 KB Brotli.
+# pugixml parses numbers with strtod and prints them with snprintf. Wrapping
+# the symbols routes those calls to the engine's decimal parser
+# (`__wrap_strtod` in src/utils/double_parse.cpp) and formatter
+# (`__wrap_snprintf` in src/utils/number_text.cpp), which keeps libc's scanner,
+# its printf machinery and the 128-bit float routines they need out of the
+# module.
 target_link_options(formulon_wasm PRIVATE
   ${_FM_WASM_OPT_FLAGS}
   ${_FM_WASM_LINK_OPT_FLAGS}
   ${_FM_WASM_COMMON_LINK_FLAGS}
   "-Wl,--wrap=strtod"
+  "-Wl,--wrap=snprintf"
 )
 
 # Land the artifact at <build>/<base>.{js,wasm}. Emscripten infers the
diff --git a/docs/releases/README.md b/docs/releases/README.md
index 40a23cf24..0928d7749 100644
--- a/docs/releases/README.md
+++ b/docs/releases/README.md
@@ -6,7 +6,8 @@ The high-level summary lives in [`CHANGELOG.md`](../../CHANGELOG.md).
 
 ## Available Versions
 
-- [v0.12.0](https://github.com/libraz/formulon/releases/tag/v0.12.0) — Latest release (2026-09-30) — a single-threaded default npm build with pthreads moved to `@libraz/formulon/threads`, conditional formatting, data validation and protection carried through `.xlsb`, formulas encoded and marked the way Excel saves them, cycles judged by the reads evaluation makes, lifted `*IF`/`*IFS` criteria, `USDOLLAR`, Excel's day-interval pivot grouping in place of the week bucket, and broad evaluation / I/O correctness work.
+- [v0.13.0](https://github.com/libraz/formulon/releases/tag/v0.13.0) — Latest release (2026-10-06) — workbook-level APIs across every binding (sheet geometry and pagination detail, cell display text and R1C1 formulas, the workbook theme and effective styles, typed AutoFilters, data-validation evaluation, threaded comments and images), Excel-exact number-format validation and rendering, strict argument validation on the Node addon and WASM, a printf-free WASM module, and broad recalc / structural-edit / pivot correctness work.
+- [v0.12.0](https://github.com/libraz/formulon/releases/tag/v0.12.0) — 2026-09-30 — a single-threaded default npm build with pthreads moved to `@libraz/formulon/threads`, conditional formatting, data validation and protection carried through `.xlsb`, formulas encoded and marked the way Excel saves them, cycles judged by the reads evaluation makes, lifted `*IF`/`*IFS` criteria, `USDOLLAR`, Excel's day-interval pivot grouping in place of the week bucket, and broad evaluation / I/O correctness work.
 - [v0.11.1](https://github.com/libraz/formulon/releases/tag/v0.11.1) — 2026-08-22 — a phonetic-guide authoring surface across every binding (run spans with the text they annotate, and the font, kana form and distribution that render them), a declarable workbook default font, a font's `<scheme>` theme link and a guide's `<phoneticPr>` block round-tripping through both containers, and furigana carried through the MS-XLSB shared-string table.
 - [v0.11.0](https://github.com/libraz/formulon/releases/tag/v0.11.0) — 2026-08-22 — a print-settings authoring API across the C ABI, WASM, the native Node addon and Python, the Excel minimum style table seeded on workbook creation, cross-workbook reference resolution and XLSB pivot decoding, the range operator composed to any depth, spill anchors that are computed rather than written out, and phonetic run spans preserved end to end.
 - [v0.10.0](https://github.com/libraz/formulon/releases/tag/v0.10.0) — 2026-08-18 — C ABI entry-point consolidation (the `_ex` variants folded into their base names, a binary break against v0.9.7), pivot report-filter rendering, a verified Windows Excel 365 primary oracle for the workbook track, and broad evaluation / I/O correctness work.
diff --git a/packages/npm-native/README.md b/packages/npm-native/README.md
index cbd4e4f18..49a5dc312 100644
--- a/packages/npm-native/README.md
+++ b/packages/npm-native/README.md
@@ -38,19 +38,19 @@ Why prefer the native build:
 This package exposes the shared `Workbook` surface of the WASM-backed
 `@libraz/formulon` package, all marshalling to the identical C-ABI
 functions. Its TypeScript declarations and its native class table
-register 225 instance methods plus the three static factories. Of those
-instance methods, 223 are shared with WASM; seven remain WASM-only, while
+register 274 instance methods plus the three static factories. Of those
+instance methods, 272 are shared with WASM; six remain WASM-only, while
 `dispose()` and `memoryUsage()` are native-only lifecycle helpers.
 The shared `Workbook` methods use the same status-bearing result envelopes
 and field shapes; switching packages still requires updating the module
 import and validating the target platform's native prebuild. The additional
-native-only methods are operational helpers; the seven
+native-only methods are operational helpers; the six
 WASM-only methods remain available through the WASM package.
 
 The WASM-only methods are, in full:
 
 ```
-addCellStyleXf, setCellStyle
+addCellStyleXf
 createTable, updateTable, removeTable
 getSheetAutoFilterXml, setSheetAutoFilterXml
 ```
@@ -113,7 +113,8 @@ Styles
   getFont, getFill, getBorder, getNumFmt
   addFont, addFill, addBorder, addNumFmt, addXf
   fontCount, fillCount, borderCount, xfCount
-  cellStyleCount, cellStyleXfCount, getCellStyle, getCellStyleXf
+  cellStyleCount, cellStyleXfCount, getCellStyle, getCellStyleXf, setCellStyle, removeCellStyle
+  getTheme, setThemeColors, setThemeFonts, resolveColor, getEffectiveStyle
 
 Merges / comments / hyperlinks / validations
   addMerge, removeMerge, removeMergeAt, clearMerges, getMerges
diff --git a/packages/npm-native/index.d.ts b/packages/npm-native/index.d.ts
index 7f93c8e1b..f2e45047d 100644
--- a/packages/npm-native/index.d.ts
+++ b/packages/npm-native/index.d.ts
@@ -31,7 +31,8 @@ export const ValueKind: Readonly<{
   Lambda: 7;
 }>;
 
-/** Result envelope returned by every fallible binding call. */
+/** Status carried by binding result envelopes. Argument validation may
+ *  throw `TypeError` or `RangeError` before returning a result. */
 export interface Status {
   /** True when the underlying C ABI returned `kOk`. */
   ok: boolean;
@@ -51,7 +52,7 @@ export interface Status {
 /** Flattened mirror of `fm_value_t`. Only the field selected by `kind`
  *  is meaningful; the others carry default-zero values. */
 export interface Value {
-  kind: number;
+  kind: FilterKind;
   /** Active when `kind === ValueKind.Number`. */
   number: number;
   /** Active when `kind === ValueKind.Bool` (0 or 1). */
@@ -221,7 +222,7 @@ export interface PivotCell {
   /** Absolute 0-based sheet column. */
   col: number;
   value: Value;
-  kind: number;
+  kind: FilterKind;
   /** Header nesting depth; 0 for data cells. */
   depth: number;
   /** Source field name when known. */
@@ -543,7 +544,7 @@ export interface CfValueObjectInput {
 /** Resolved CF match. Active fields depend on `kind`; the others carry
  *  default-zero values. */
 export interface CfMatch {
-  kind: number;
+  kind: FilterKind;
   priority: number;
   /** `1` when `dxfId` is meaningful; `0` otherwise. */
   dxfIdEngaged: number;
@@ -591,6 +592,78 @@ export interface PaginationResult {
   horizontalBreaks: number[];
   verticalBreaks: number[];
   pageCount: number;
+  /** Paper size after the orientation swap. */
+  paper: PaginationPaper;
+  margins: PaginationMargins;
+  /** Cell-body rectangle before print-title reservation, from the page's top-left corner. */
+  printable: RectPt;
+  /** Effective scale as a factor (1.0 is 100%). */
+  scale: number;
+  /** 0 down-then-over (OOXML default), 1 over-then-down. */
+  pageOrder: number;
+  printTitles: PaginationPrintTitles;
+  /** One entry per physical page, in print order. */
+  pages: PaginationPage[];
+  /** Per horizontal break (same index as `horizontalBreaks`): true when the break is manual. */
+  horizontalBreakManual: boolean[];
+  /** Per vertical break (same index as `verticalBreaks`): true when the break is manual. */
+  verticalBreakManual: boolean[];
+}
+
+/** A rectangle in points. Sheet geometry measures from the top-left of cell
+ *  A1; pagination measures from the page's top-left corner. */
+export interface RectPt {
+  x: number;
+  y: number;
+  width: number;
+  height: number;
+}
+
+/** `PaginationResult.paper`. `known` is false when `paperSize` was
+ *  unrecognised and A4 was substituted. */
+export interface PaginationPaper {
+  widthPt: number;
+  heightPt: number;
+  landscape: boolean;
+  known: boolean;
+}
+
+/** `PaginationResult.margins`, in points; `header` / `footer` are measured
+ *  from the page edge to the header / footer band. */
+export interface PaginationMargins {
+  left: number;
+  right: number;
+  top: number;
+  bottom: number;
+  header: number;
+  footer: number;
+}
+
+/** `PaginationResult.printTitles`: repeat rows / columns (0-based,
+ *  inclusive). A span is meaningful only when its `has*` flag is true. */
+export interface PaginationPrintTitles {
+  hasRows: boolean;
+  firstRow: number;
+  lastRow: number;
+  hasCols: boolean;
+  firstCol: number;
+  lastCol: number;
+}
+
+/** One physical page. `areaIndex` indexes `printArea` (0 for the used-range
+ *  fallback); `widthPt` / `heightPt` are the scaled extent of the page's own
+ *  cell block (repeated titles excluded) and `originXPt` / `originYPt` its
+ *  top-left corner on the paper. */
+export interface PaginationPage {
+  areaIndex: number;
+  firstRow: number;
+  lastRow: number;
+  firstCol: number;
+  lastCol: number;
+  originXPt: number;
+  originYPt: number;
+  widthPt: number;
+  heightPt: number;
 }
 
 /** Result of the five raw print-settings getters. The empty `xml` string
@@ -749,6 +822,237 @@ export const SheetVisibility: Readonly<{
 }>;
 export type SheetVisibility = 0 | 1 | 2;
 
+/** Which Windows column-width figure a geometry call uses. Mirrors
+ *  `fm_geometry_mode_t`; row heights are identical in both modes. */
+export const GeometryMode: Readonly<{
+  Display: 0;
+  Print: 1;
+}>;
+export type GeometryMode = 0 | 1;
+
+/** Outcome of a display-text rendering. Mirrors `fm_display_status_t`:
+ *  `Overflow` text is `########`, `InvalidFormat` text is the General
+ *  rendering. */
+export const DisplayStatus: Readonly<{
+  Ok: 0;
+  Overflow: 1;
+  InvalidFormat: 2;
+}>;
+export type DisplayStatus = 0 | 1 | 2;
+
+/** Criterion of an AutoFilter column. Mirrors `fm_filter_kind_t`. */
+export const FilterKind: Readonly<{
+  None: 0;
+  Values: 1;
+  Custom: 2;
+  Top10: 3;
+  Dynamic: 4;
+  Color: 5;
+  Icon: 6;
+}>;
+export type FilterKind = 0 | 1 | 2 | 3 | 4 | 5 | 6;
+
+/** Comparison operator of a custom AutoFilter condition. Mirrors `fm_filter_operator_t`. */
+export const FilterOperator: Readonly<{
+  Equal: 0;
+  LessThan: 1;
+  LessThanOrEqual: 2;
+  NotEqual: 3;
+  GreaterThanOrEqual: 4;
+  GreaterThan: 5;
+}>;
+export type FilterOperator = 0 | 1 | 2 | 3 | 4 | 5;
+
+/** Dynamic AutoFilter type, in `ST_DynamicFilterType` schema order. Mirrors `fm_dynamic_filter_type_t`. */
+export const DynamicFilterType: Readonly<{
+  Null: 0;
+  AboveAverage: 1;
+  BelowAverage: 2;
+  Tomorrow: 3;
+  Today: 4;
+  Yesterday: 5;
+  NextWeek: 6;
+  ThisWeek: 7;
+  LastWeek: 8;
+  NextMonth: 9;
+  ThisMonth: 10;
+  LastMonth: 11;
+  NextQuarter: 12;
+  ThisQuarter: 13;
+  LastQuarter: 14;
+  NextYear: 15;
+  ThisYear: 16;
+  LastYear: 17;
+  YearToDate: 18;
+  Q1: 19;
+  Q2: 20;
+  Q3: 21;
+  Q4: 22;
+  M1: 23;
+  M2: 24;
+  M3: 25;
+  M4: 26;
+  M5: 27;
+  M6: 28;
+  M7: 29;
+  M8: 30;
+  M9: 31;
+  M10: 32;
+  M11: 33;
+  M12: 34;
+}>;
+export type DynamicFilterType =
+  | 0
+  | 1
+  | 2
+  | 3
+  | 4
+  | 5
+  | 6
+  | 7
+  | 8
+  | 9
+  | 10
+  | 11
+  | 12
+  | 13
+  | 14
+  | 15
+  | 16
+  | 17
+  | 18
+  | 19
+  | 20
+  | 21
+  | 22
+  | 23
+  | 24
+  | 25
+  | 26
+  | 27
+  | 28
+  | 29
+  | 30
+  | 31
+  | 32
+  | 33
+  | 34;
+
+/** What a sort condition sorts by. Mirrors `fm_sort_by_t`. */
+export const SortBy: Readonly<{
+  Value: 0;
+  CellColor: 1;
+  FontColor: 2;
+  Icon: 3;
+}>;
+export type SortBy = 0 | 1 | 2 | 3;
+
+/** Sort method of an AutoFilter sort state. Mirrors `fm_sort_method_t`. */
+export const SortMethod: Readonly<{
+  None: 0;
+  PinYin: 1;
+  Stroke: 2;
+}>;
+export type SortMethod = 0 | 1 | 2;
+
+/** Granularity of an AutoFilter date-group item. Mirrors `fm_date_time_grouping_t`. */
+export const DateTimeGrouping: Readonly<{
+  Year: 0;
+  Month: 1;
+  Day: 2;
+  Hour: 3;
+  Minute: 4;
+  Second: 5;
+}>;
+export type DateTimeGrouping = 0 | 1 | 2 | 3 | 4 | 5;
+
+/** Data-validation error style. Mirrors `fm_validation_error_style_t`. */
+export const ValidationErrorStyle: Readonly<{
+  Stop: 0;
+  Warning: 1;
+  Information: 2;
+}>;
+export type ValidationErrorStyle = 0 | 1 | 2;
+
+/** Raster format of an image. Mirrors `fm_image_format_t`; `Unknown` marks "no image bytes found". */
+export const ImageFormat: Readonly<{
+  Unknown: 0;
+  Png: 1;
+  Jpeg: 2;
+  Gif: 3;
+  Bmp: 4;
+}>;
+export type ImageFormat = 0 | 1 | 2 | 3 | 4;
+
+/** What a drawing anchor holds. Mirrors `fm_drawing_object_kind_t`. */
+export const DrawingObjectKind: Readonly<{
+  Picture: 0;
+  Shape: 1;
+  Chart: 2;
+  Group: 3;
+  Connector: 4;
+  GraphicFrame: 5;
+  Other: 6;
+}>;
+export type DrawingObjectKind = 0 | 1 | 2 | 3 | 4 | 5 | 6;
+
+/** The anchor element type of a drawing object. Mirrors `fm_anchor_kind_t`. */
+export const AnchorKind: Readonly<{
+  OneCell: 0;
+  TwoCell: 1;
+  Absolute: 2;
+}>;
+export type AnchorKind = 0 | 1 | 2;
+
+/** How a drawing object follows row and column edits. Mirrors `fm_anchor_edit_as_t`. */
+export const AnchorEditAs: Readonly<{
+  TwoCell: 0;
+  OneCell: 1;
+  Absolute: 2;
+}>;
+export type AnchorEditAs = 0 | 1 | 2;
+
+/** Where a colour is used; decides what an automatic colour means. Mirrors
+ *  `fm_color_context_t`. */
+export const ColorContext: Readonly<{
+  Font: 0;
+  FillForeground: 1;
+  FillBackground: 2;
+  Border: 3;
+}>;
+export type ColorContext = 0 | 1 | 2 | 3;
+
+/** How a colour was resolved. Mirrors `fm_color_resolution_t`: `Exact` is a
+ *  literal or a theme / palette colour from the workbook's own data;
+ *  `DefaultTheme` and `ThemeUnparseable` resolved against the default theme;
+ *  `IndexOutOfRange` is black; `AutoContext` is an automatic colour chosen by
+ *  context (black for font and border, white for fills). */
+export const ColorResolution: Readonly<{
+  Exact: 0;
+  DefaultTheme: 1;
+  IndexOutOfRange: 2;
+  ThemeUnparseable: 3;
+  AutoContext: 4;
+}>;
+export type ColorResolution = 0 | 1 | 2 | 3 | 4;
+
+/** Where `getTheme` read the theme from. Mirrors the C `out_source` values. */
+export const ThemeSource: Readonly<{
+  Part: 0;
+  Default: 1;
+  Unparseable: 2;
+}>;
+export type ThemeSource = 0 | 1 | 2;
+
+/** Where `getEffectiveStyle` took its xf from. */
+export const EffectiveStyleSource: Readonly<{
+  Cell: 0;
+  Row: 1;
+  Column: 2;
+  Default: 3;
+}>;
+export type EffectiveStyleSource = 0 | 1 | 2 | 3;
+
 /** Per-sheet view: zoom (10..400, default 100), frozen-pane row/col
  *  counts, tab visibility, and the display / orientation flags mirrored
  *  from OOXML `<sheetView>`. Booleans are encoded as `0`/`1` to match
@@ -852,6 +1156,10 @@ export interface RowLayout {
   /** Whether OOXML customFormat=1 makes the row style effective. */
   hasStyle: number;
   styleXf: number;
+  /** Whether a height is stored (0/1); `height` is meaningful only then. */
+  hasHeight: number;
+  /** Whether the height is an explicit override (`customHeight="1"`, 0/1) rather than a cached auto height. */
+  customHeight: number;
 }
 
 /** Return type of `Workbook.getSheetRowOverrides(sheet)`. */
@@ -868,6 +1176,297 @@ export interface MergeRange {
   lastCol: number;
 }
 
+/** Return type of `Workbook.getSheetFormatDefaults(sheet)`; also the
+ *  argument shape of `setSheetFormatDefaults`. `defaultColWidth` is in
+ *  character units and `defaultRowHeight` in points, each meaningful only
+ *  when its `has*` flag is set. `baseColWidth` is in characters (OOXML
+ *  default 8). */
+export interface SheetFormatDefaults {
+  defaultColWidth: number;
+  defaultRowHeight: number;
+  baseColWidth: number;
+  hasDefaultColWidth: boolean;
+  hasDefaultRowHeight: boolean;
+}
+
+/** Return type of `Workbook.getSheetFormatDefaults(sheet)`. */
+export interface SheetFormatDefaultsResult extends SheetFormatDefaults {
+  status: Status;
+}
+
+/** Return type of `Workbook.getCellRectPt(sheet, range, mode)`: the
+ *  rectangle in points from the top-left of cell A1. Hidden rows and
+ *  columns contribute zero extent. */
+export interface CellRectResult extends RectPt {
+  status: Status;
+}
+
+/** Return type of `Workbook.getWidthModel(sheet, mode)`. `calibrated` is
+ *  false when the Normal font is not a measured calibration point and the
+ *  Calibri 11 figure was extrapolated. */
+export interface WidthModelResult {
+  status: Status;
+  pointsPerChar: number;
+  paddingPt: number;
+  normalFontSize: number;
+  calibrated: boolean;
+  normalFontName: string;
+  platform: string;
+}
+
+/** Return type of `Workbook.getFormula` / `getFormulaR1C1`. `formula` is
+ *  `null` when the cell holds no formula (and on failure). */
+export interface FormulaResult {
+  status: Status;
+  formula: string | null;
+}
+
+/** One `<dateGroupItem>` of a values filter. `grouping` is the granularity
+ *  the item matches at (a `DateTimeGrouping`); fields finer than `grouping` are zero. */
+export interface AutoFilterDateGroup {
+  year: number;
+  month: number;
+  day: number;
+  hour: number;
+  minute: number;
+  second: number;
+  grouping: DateTimeGrouping;
+}
+
+/** One `<filterColumn>`. `colId` is the 0-based offset from the first column
+ *  of the AutoFilter range. `kind` selects the criterion and only that
+ *  criterion's fields are read on input (a `FilterKind`); on output every other criterion's
+ *  fields are zero. Custom operators `op1` / `op2` are
+ *  `FilterOperator`s; `dynamicType` is a `DynamicFilterType`.
+ *  `dxfId` of `4294967295` means absent. `iconSet` is the conditional-format
+ *  icon-set ordinal. Omitted input fields read as zero / false / empty,
+ *  except `showButton` (true) and `dxfId` (absent). */
+export interface AutoFilterColumn {
+  colId: number;
+  hiddenButton: boolean;
+  showButton: boolean;
+  kind: FilterKind;
+  filterBlank: boolean;
+  values: string[];
+  dateGroups: AutoFilterDateGroup[];
+  customAnd: boolean;
+  customCount: number;
+  op1: FilterOperator;
+  val1: string;
+  op2: FilterOperator;
+  val2: string;
+  top: boolean;
+  percent: boolean;
+  hasFilterVal: boolean;
+  topVal: number;
+  filterVal: number;
+  dynamicType: DynamicFilterType;
+  hasDynVal: boolean;
+  hasDynMaxVal: boolean;
+  dynVal: number;
+  dynMaxVal: number;
+  valIso: string;
+  maxValIso: string;
+  dxfId: number;
+  cellColor: boolean;
+  iconSet: number;
+  iconId: number;
+  hasIconId: boolean;
+}
+
+/** One `<sortCondition>`. `sortBy` is a `SortBy`. `dxfId` is read only when `hasDxfId`, `iconId` only when
+ *  `hasIconId`. */
+export interface AutoFilterSortCondition {
+  ref: MergeRange;
+  descending: boolean;
+  sortBy: SortBy;
+  customList: string;
+  dxfId: number;
+  hasDxfId: boolean;
+  iconSet: number;
+  iconId: number;
+  hasIconId: boolean;
+}
+
+/** The `<sortState>` of an AutoFilter. `sortMethod` is a
+ *  `SortMethod`. */
+export interface AutoFilterSortState {
+  ref: MergeRange;
+  columnSort: boolean;
+  caseSensitive: boolean;
+  sortMethod: SortMethod;
+  conditions: AutoFilterSortCondition[];
+}
+
+/** A sheet or table AutoFilter. `range` includes the header row; `columns`
+ *  must be in strictly ascending `colId` order inside it. */
+export interface AutoFilter {
+  range: MergeRange;
+  columns: AutoFilterColumn[];
+  sort: AutoFilterSortState | null;
+}
+
+/** Return type of `Workbook.getAutoFilter` / `getTableAutoFilter`. `autoFilter` is
+ *  `null` when there is none. */
+export interface AutoFilterResult {
+  status: Status;
+  autoFilter: AutoFilter | null;
+}
+
+/** Return type of `Workbook.evaluateAutoFilter` / `evaluateTableAutoFilter`.
+ *  `match[i]` tells whether body row `firstRow + i` satisfies the criteria. */
+export interface AutoFilterEvalResult {
+  status: Status;
+  firstRow: number;
+  match: boolean[];
+}
+
+/** Return type of `Workbook.validateValue`. `hasRule` is false when no rule
+ *  covers the cell, and `valid` is then true. `ruleIndex` is the
+ *  `getValidations` index of the applied rule and `errorStyle` its style
+ *  (a `ValidationErrorStyle`). */
+export interface ValidationOutcomeResult {
+  status: Status;
+  hasRule: boolean;
+  valid: boolean;
+  ruleIndex: number;
+  errorStyle: ValidationErrorStyle;
+}
+
+/** One `@person` mention in a threaded comment's text; `start` and `length`
+ *  are in UTF-16 code units. */
+export interface Mention {
+  personId: string;
+  mentionId: string;
+  start: number;
+  length: number;
+}
+
+/** One threaded comment: a thread's opening comment, or a reply when
+ *  `parentId` is non-empty. Ids are brace-wrapped uppercase GUIDs and
+ *  `created` is `YYYY-MM-DDTHH:MM:SS.ss`; the caller supplies both. `done`
+ *  is the thread's resolved state, meaningful on the opening comment only. */
+export interface ThreadedComment {
+  id: string;
+  row: number;
+  col: number;
+  personId: string;
+  created: string;
+  text: string;
+  parentId: string;
+  done: boolean;
+  mentions: Mention[];
+}
+
+/** One entry of the workbook's person list. */
+export interface Person {
+  id: string;
+  displayName: string;
+  userId: string;
+  providerId: string;
+}
+
+/** Result of `Workbook.getThreadedComments`, in file order: each thread's
+ *  opening comment followed by its replies. */
+export interface ThreadedCommentsResult {
+  status: Status;
+  comments: ThreadedComment[];
+}
+
+/** Result of `Workbook.getPersons`. */
+export interface PersonsResult {
+  status: Status;
+  persons: Person[];
+}
+
+/** Format and pixel size of an image; zeroed when `status` is not ok. */
+export interface ImageInfoResult {
+  status: Status;
+  format: ImageFormat;
+  pxWidth: number;
+  pxHeight: number;
+}
+
+/** Result of `Workbook.getImage`. `bytes` is a copy, empty on failure. */
+export interface ImageResult extends ImageInfoResult {
+  bytes: Uint8Array;
+}
+
+/** Result of `Workbook.insertImage`; `objectId` is zero on failure. */
+export interface InsertImageResult {
+  status: Status;
+  objectId: number;
+}
+
+/** One anchored object of a sheet's drawing. An absolute anchor reports its position from A1 as
+ *  `fromColOff` (x) and `fromRowOff` (y); `toRow`/`toCol` and the `to*Off` fields are zero unless the anchor is
+ *  two-cell. Offsets and `cx`/`cy` are in EMU. `imageFormat` is non-zero for a picture whose media part is present;
+ *  `mediaPath` is empty for a non-picture. */
+export interface DrawingObject {
+  objectId: number;
+  kind: DrawingObjectKind;
+  anchorKind: AnchorKind;
+  editAs: AnchorEditAs;
+  fromRow: number;
+  fromCol: number;
+  fromRowOff: number;
+  fromColOff: number;
+  toRow: number;
+  toCol: number;
+  toRowOff: number;
+  toColOff: number;
+  cx: number;
+  cy: number;
+  imageFormat: ImageFormat;
+  name: string;
+  descr: string;
+  mediaPath: string;
+}
+
+/** Placement of an inserted image. `anchorKind` is `OneCell` (default) or
+ *  `TwoCell`; `editAs` applies to a two-cell anchor only. `row` / `col` is
+ *  the 0-based top-left cell and `rowOffEmu` / `colOffEmu` the offset inside
+ *  it. A zero `widthEmu` / `heightEmu` means the pixel size times 9525. An
+ *  empty `name` becomes `Picture <id>`. */
+export interface ImageInsertOptions {
+  name?: string;
+  descr?: string;
+  anchorKind?: AnchorKind;
+  editAs?: AnchorEditAs;
+  row?: number;
+  col?: number;
+  rowOffEmu?: number;
+  colOffEmu?: number;
+  widthEmu?: number;
+  heightEmu?: number;
+}
+
+/** One populated cell in `getCellsInRange`. `formula` is the stored A1
+ *  formula, or `null` when the cell holds none. */
+export interface RangeCell {
+  row: number;
+  col: number;
+  formula: string | null;
+  value: Value;
+}
+
+/** Return type of `Workbook.getCellsInRange`. `nextCursor` resumes the
+ *  enumeration and is `null` when the rectangle holds no further populated
+ *  cell. */
+export interface CellsInRangeResult {
+  status: Status;
+  cells: ReadonlyArray<RangeCell>;
+  nextCursor: number | null;
+}
+
+/** Return type of `Workbook.getDisplayText` / `formatValue`. */
+export interface DisplayTextResult {
+  status: Status;
+  text: string;
+  /** 0 ok; 1 overflow (the value cannot be shown in the format; the text is `"########"`); 2 invalid format (the text is the General rendering). */
+  displayStatus: DisplayStatus;
+}
+
 /** Sheet hyperlink entry as returned by `getHyperlinks(sheet)`. */
 export interface HyperlinkEntry {
   row: number;
@@ -924,13 +1523,13 @@ export interface DataValidationRange {
  *    * `op`          — 0 between, 1 notBetween, 2 equal, 3 notEqual,
  *                       4 greaterThan, 5 lessThan,
  *                       6 greaterThanOrEqual, 7 lessThanOrEqual.
- *    * `errorStyle`  — 0 stop, 1 warning, 2 information.
+ *    * `errorStyle`  — a `ValidationErrorStyle`.
  */
 export interface DataValidationEntry {
   readonly ranges: ReadonlyArray<DataValidationRange>;
   readonly type: number;
   readonly op: number;
-  readonly errorStyle: number;
+  readonly errorStyle: ValidationErrorStyle;
   readonly allowBlank: boolean;
   readonly showInputMessage: boolean;
   readonly showErrorMessage: boolean;
@@ -953,7 +1552,7 @@ export interface DataValidationInput {
   ranges?: ReadonlyArray<DataValidationRange>;
   type: number;
   op?: number;
-  errorStyle?: number;
+  errorStyle?: ValidationErrorStyle;
   allowBlank?: boolean;
   showInputMessage?: boolean;
   showErrorMessage?: boolean;
@@ -1011,6 +1610,20 @@ export interface CellXfResult {
   readingOrder?: number;
   /** Index into `<cellStyleXfs>` for this cell format. */
   xfId?: number;
+  /** `<xf applyNumberFormat>`: the number format overrides the parent named style. */
+  applyNumberFormat: boolean;
+  applyFont: boolean;
+  applyFill: boolean;
+  applyBorder: boolean;
+  applyAlignment: boolean;
+  applyProtection: boolean;
+  /** OOXML `quotePrefix`: the cell text is shown as typed text. */
+  quotePrefix: boolean;
+  /** Whether the `<protection>` child is present; otherwise `locked` / `hidden` take the defaults. */
+  hasProtection: boolean;
+  /** Cell is locked; true when no `<protection>` child is present. */
+  locked: boolean;
+  hidden: boolean;
 }
 
 /** How an OOXML `<color>` element expressed its value.
@@ -1024,7 +1637,7 @@ export interface CellXfResult {
  *  the writer emits the sibling `*Argb` as `rgb`. */
 export interface ColorSpec {
   /** 0=none, 1=rgb, 2=theme, 3=indexed, 4=auto. */
-  kind: number;
+  kind: FilterKind;
   /** AARRGGBB; meaningful when `kind` is 1. */
   rgb: number;
   /** Theme index; meaningful when `kind` is 2. */
@@ -1140,6 +1753,20 @@ export interface CellXf {
   readingOrder?: number;
   /** Index of the named style in `<cellStyleXfs>` this format inherits from. */
   xfId?: number;
+  /** `<xf applyNumberFormat>`: the number format overrides the parent named style. */
+  applyNumberFormat?: boolean;
+  applyFont?: boolean;
+  applyFill?: boolean;
+  applyBorder?: boolean;
+  applyAlignment?: boolean;
+  applyProtection?: boolean;
+  /** OOXML `quotePrefix`: the cell text is shown as typed text. */
+  quotePrefix?: boolean;
+  /** Whether the `<protection>` child is present; otherwise `locked` / `hidden` take the defaults. */
+  hasProtection?: boolean;
+  /** Cell is locked (default true). Ignored on insertion unless `hasProtection` is set or inferred from `locked` / `hidden`. */
+  locked?: boolean;
+  hidden?: boolean;
 }
 
 /** One `<rPh>` block: `text` reads the half-open span `[sb, eb)` of the
@@ -1248,6 +1875,75 @@ export interface CellStyleResult {
   customBuiltin: boolean;
 }
 
+/** Argument of `Workbook.setCellStyle`. Mirrors `CellStyleResult` without the status. */
+export interface CellStyleRecord {
+  /** Display name of the style. */
+  name: string;
+  /** Index into the `<cellStyleXfs>` table; defaults to 0. */
+  xfId?: number;
+  /** OOXML built-in ordinal (`0..53`); defaults to `0xFFFFFFFF` (custom). */
+  builtinId?: number;
+  /** Outline level of the `RowLevel_n` / `ColLevel_n` styles; defaults to 0. */
+  iLevel?: number;
+  hidden?: boolean;
+  customBuiltin?: boolean;
+}
+
+/** Theme typefaces. `*EastAsian` is the `a:ea` face, else the Jpan script face. */
+export interface ThemeFonts {
+  majorLatin: string;
+  majorEastAsian: string;
+  minorLatin: string;
+  minorEastAsian: string;
+}
+
+/** Return type of `Workbook.getTheme()`. */
+export interface ThemeResult {
+  status: Status;
+  /** One of `ThemeSource.*`. */
+  source: ThemeSource;
+  /** The 12 scheme colours as 0xFFRRGGBB in `a:clrScheme` order: dk1, lt1,
+   *  dk2, lt2, accent1..6, hlink, folHlink. */
+  colors: number[];
+  fonts: ThemeFonts;
+}
+
+/** A resolved colour: 0xAARRGGBB as Excel renders it, plus how it was obtained. */
+export interface ResolvedColor {
+  argb: number;
+  resolution: ColorResolution;
+}
+
+/** Return type of `Workbook.resolveColor(spec, context)`. */
+export interface ResolvedColorResult extends ResolvedColor {
+  status: Status;
+}
+
+/** Return type of `Workbook.getEffectiveStyle(sheet, row, col)`. Named-style
+ *  inheritance is not recomputed and conditional formatting is not applied. */
+export interface EffectiveStyleResult {
+  status: Status;
+  xfIndex: number;
+  /** One of `EffectiveStyleSource.*`. */
+  source: EffectiveStyleSource;
+  fontIndex: number;
+  fillIndex: number;
+  borderIndex: number;
+  font: ResolvedColor;
+  fillForeground: ResolvedColor;
+  fillBackground: ResolvedColor;
+  borders: {
+    left: ResolvedColor;
+    right: ResolvedColor;
+    top: ResolvedColor;
+    bottom: ResolvedColor;
+    diagonal: ResolvedColor;
+  };
+  locked: boolean;
+  hidden: boolean;
+  numFmtCode: string;
+}
+
 /** Element type returned by `Workbook.getExternalLinks()`. Mirrors
  *  `formulon::io::ExternalLinkRecord`. The body part itself is not
  *  exposed (it round-trips through the OOXML passthrough mechanism);
@@ -1269,7 +1965,7 @@ export interface ExternalLinkRecord {
    *  `TargetMode="External"` (the common case). */
   targetExternal: boolean;
   /** External-link kind: 0 unknown, 1 externalBook, 2 ole, 3 dde. */
-  kind: number;
+  kind: FilterKind;
 }
 
 /** One inclusive cell-range entry inside a CF rule's `sqref` union. */
@@ -1794,6 +2490,16 @@ export interface Workbook {
   // Iteration / metadata.
   cellCount(sheet: number): NumberResult;
   cellAt(sheet: number, idx: number): CellEntry;
+  /** Reads the cell's stored formula in A1 notation (leading `=` included); `formula` is `null` for a non-formula cell. */
+  getFormula(sheet: number, row: number, col: number): FormulaResult;
+  /** Reads the cell's formula in R1C1 notation relative to the cell (no leading `=`); `null` for a non-formula cell. */
+  getFormulaR1C1(sheet: number, row: number, col: number): FormulaResult;
+  /** Enumerates the populated cells of `range` row-major, one page at a time. Pass the previous `nextCursor` as `cursor` to resume; `limit` 0 / omitted means the maximum (65,536). */
+  getCellsInRange(sheet: number, range: MergeRange, cursor?: number | null, limit?: number | null): CellsInRangeResult;
+  /** Reads the text Excel displays for the cell, from its value and XF number format under the workbook's date system. */
+  getDisplayText(sheet: number, row: number, col: number): DisplayTextResult;
+  /** Renders `value` under the stored-form number format `formatCode` (empty means General). */
+  formatValue(value: Value, formatCode: string): DisplayTextResult;
   definedNameCount(): NumberResult;
   definedNameAt(idx: number): DefinedNameEntry;
   tableCount(): NumberResult;
@@ -2134,6 +2840,24 @@ export interface Workbook {
   getSheetRowOverrides(sheet: number): RowsResult;
   /** Sets / replaces the row height override at `row`. */
   setRowHeight(sheet: number, row: number, height: number): Status;
+  /** Removes the height override at `row`, returning it to the sheet default height. */
+  clearRowHeight(sheet: number, row: number): Status;
+  /** Reads the sheet's default column / row metrics (`<sheetFormatPr>`). */
+  getSheetFormatDefaults(sheet: number): SheetFormatDefaultsResult;
+  /** Replaces the sheet's default column / row metrics. A `has*` flag left out is inferred from the matching value. */
+  setSheetFormatDefaults(sheet: number, defaults: Partial<SheetFormatDefaults>): Status;
+  /** Reads the rectangle covering `range` in points from the top-left of A1. `mode` is a geometry mode: 0 display (screen figure, 96 DPI), 1 print (the DPI-stable figure pagination breaks on). */
+  getCellRectPt(sheet: number, range: MergeRange, mode: GeometryMode): CellRectResult;
+  /** Effective width of column `col` in points; 0 when hidden. */
+  getColumnWidthPt(sheet: number, col: number, mode: GeometryMode): NumberResult;
+  /** Effective height of row `row` in points; 0 when hidden. */
+  getRowHeightPt(sheet: number, row: number): NumberResult;
+  /** Reads the character-unit to point conversion for the workbook's Normal font. */
+  getWidthModel(sheet: number, mode: GeometryMode): WidthModelResult;
+  /** Converts a column width in characters to points. */
+  columnCharsToPt(sheet: number, mode: GeometryMode, chars: number): NumberResult;
+  /** Inverse of `columnCharsToPt`. */
+  columnPtToChars(sheet: number, mode: GeometryMode, pt: number): NumberResult;
   /** Sets / replaces the row hidden flag at `row`. */
   setRowHidden(sheet: number, row: number, hidden: boolean): Status;
   /** Sets / replaces the row outline level at `row` (clamped to 0..255). */
@@ -2224,6 +2948,24 @@ export interface Workbook {
   /** Returns the named-style xf record at `index`. Output shape mirrors
    *  `getCellXf`. */
   getCellStyleXf(index: number): CellXfResult;
+  /** Adds or replaces the `<cellStyle>` entry named `record.name`. Absent
+   *  fields default to `xfId` 0, a custom style (`0xFFFFFFFF`), level 0 and
+   *  both flags false. */
+  setCellStyle(record: CellStyleRecord): Status;
+  /** Removes the named cell style; cell formats that used it fall back to Normal. */
+  removeCellStyle(name: string): Status;
+
+  // Theme, colour resolution, effective style.
+  /** Reads the theme's 12 scheme colours and typefaces. */
+  getTheme(): ThemeResult;
+  /** Writes the theme's 12 scheme colours (0xFFRRGGBB, `a:clrScheme` order; alpha ignored). */
+  setThemeColors(colors: number[]): Status;
+  /** Writes the theme's major / minor typefaces. */
+  setThemeFonts(fonts: ThemeFonts): Status;
+  /** Resolves a colour specification to the colour Excel renders. */
+  resolveColor(spec: ColorSpec, context: ColorContext): ResolvedColorResult;
+  /** Reads the formatting a cell shows: its xf with colours resolved against the theme and palette. */
+  getEffectiveStyle(sheet: number, row: number, col: number): EffectiveStyleResult;
 
   // Sheet UI features (merges, comments, hyperlinks, validations).
   /** Adds a merge range to `sheet`. */
@@ -2236,6 +2978,8 @@ export interface Workbook {
   clearMerges(sheet: number): Status;
   /** Returns every merge range on `sheet` as a JS array. */
   getMerges(sheet: number): ListResult<MergeRange>;
+  /** Returns every merge on `sheet` that intersects `range` (inclusive), in storage order. */
+  getMergesInRange(sheet: number, range: MergeRange): ListResult<MergeRange>;
   /** Returns the cell comment at `(sheet, row, col)`, or `null` when absent. */
   getComment(sheet: number, row: number, col: number): CommentEntry | null;
   /** Returns a comment lookup result that distinguishes absence from an invalid sheet or handle. */
@@ -2286,6 +3030,57 @@ export interface Workbook {
   removeValidationAt(sheet: number, index: number): Status;
   /** Drops every validation rule on `sheet`. */
   clearValidations(sheet: number): Status;
+  /** Checks `value` against the data-validation rule covering `(row, col)` without storing it. */
+  validateValue(sheet: number, row: number, col: number, value: Value): ValidationOutcomeResult;
+  /** Enumerates the populated cells whose value fails their validation rule, one page at a time; `cursor` and `limit` follow `getCellsInRange`. */
+  listInvalidCells(sheet: number, cursor?: number | null, limit?: number | null): CellsInRangeResult;
+
+  /** Reads the sheet AutoFilter; `autoFilter` is `null` when the sheet has none. */
+  getAutoFilter(sheet: number): AutoFilterResult;
+  /** Replaces the sheet AutoFilter. Row visibility is unchanged until `applyAutoFilter`. */
+  setAutoFilter(sheet: number, autoFilter: AutoFilter): Status;
+  /** Removes the sheet AutoFilter; a no-op when there is none. */
+  removeAutoFilter(sheet: number): Status;
+  /** Hides the body rows the criteria exclude and shows the ones they match. */
+  applyAutoFilter(sheet: number): Status;
+  /** Drops every column criterion and shows all body rows. */
+  clearAutoFilter(sheet: number): Status;
+  /** Evaluates the sheet AutoFilter without changing the sheet. */
+  evaluateAutoFilter(sheet: number): AutoFilterEvalResult;
+  /** Table counterpart of `getAutoFilter`; `tableIdx` is the `tableAt` index. */
+  getTableAutoFilter(table: number): AutoFilterResult;
+  setTableAutoFilter(table: number, autoFilter: AutoFilter): Status;
+  removeTableAutoFilter(table: number): Status;
+  applyTableAutoFilter(table: number): Status;
+  clearTableAutoFilter(table: number): Status;
+  evaluateTableAutoFilter(table: number): AutoFilterEvalResult;
+
+  /** Returns every threaded comment on `sheet` in file order: each thread's opening comment followed by its replies. */
+  getThreadedComments(sheet: number): ThreadedCommentsResult;
+  /** Adds a threaded comment. An empty `parentId` opens a new thread at `row`/`col`; otherwise it replies to that thread. */
+  addThreadedComment(sheet: number, comment: Partial<ThreadedComment> & Pick<ThreadedComment, 'id' | 'text'>): Status;
+  /** Replaces the text and mentions of the comment with `id`. */
+  editThreadedComment(sheet: number, id: string, text: string, mentions: Mention[]): Status;
+  /** Sets the resolved state of the thread opened by `threadId`. */
+  setThreadResolved(sheet: number, threadId: string, done: boolean): Status;
+  /** Removes the comment with `id`; removing an opening comment removes its whole thread. */
+  removeThreadedComment(sheet: number, id: string): Status;
+  /** Returns the workbook's person list in file order. */
+  getPersons(): PersonsResult;
+  addPerson(person: Person): Status;
+  /** Removes the person with `id`; rejected while a comment or mention still names them. */
+  removePerson(id: string): Status;
+
+  /** Sniffs the format and pixel size of PNG, JPEG, GIF or BMP bytes from the header alone. */
+  probeImage(bytes: Uint8Array): ImageInfoResult;
+  /** Lists the anchored objects of the sheet's drawing in document order. */
+  listDrawingObjects(sheet: number): ListResult<DrawingObject>;
+  /** Returns a copy of the media bytes of the picture `objectId`. */
+  getImage(sheet: number, objectId: number): ImageResult;
+  /** Inserts an image as a new anchored picture and returns its object id. */
+  insertImage(sheet: number, bytes: Uint8Array, opts?: ImageInsertOptions): InsertImageResult;
+  /** Removes the picture `objectId`; other drawing content is kept. */
+  removeImage(sheet: number, objectId: number): Status;
 
   // Conditional formatting (read / mutate).
   /** Returns every CF rule on `sheet` in flattened priority order. The
@@ -2462,6 +3257,23 @@ declare const _default: {
   LogLevel: typeof LogLevel;
   CalcMode: typeof CalcMode;
   SheetVisibility: typeof SheetVisibility;
+  GeometryMode: typeof GeometryMode;
+  DisplayStatus: typeof DisplayStatus;
+  ColorContext: typeof ColorContext;
+  ImageFormat: typeof ImageFormat;
+  DrawingObjectKind: typeof DrawingObjectKind;
+  AnchorKind: typeof AnchorKind;
+  AnchorEditAs: typeof AnchorEditAs;
+  FilterKind: typeof FilterKind;
+  FilterOperator: typeof FilterOperator;
+  DynamicFilterType: typeof DynamicFilterType;
+  SortBy: typeof SortBy;
+  SortMethod: typeof SortMethod;
+  DateTimeGrouping: typeof DateTimeGrouping;
+  ValidationErrorStyle: typeof ValidationErrorStyle;
+  ColorResolution: typeof ColorResolution;
+  ThemeSource: typeof ThemeSource;
+  EffectiveStyleSource: typeof EffectiveStyleSource;
   ExternalLinkKind: typeof ExternalLinkKind;
   ErrorCode: typeof ErrorCode;
   WorkbookFormat: typeof WorkbookFormat;
diff --git a/packages/npm-native/index.mjs b/packages/npm-native/index.mjs
index a722c5589..9e476f116 100644
--- a/packages/npm-native/index.mjs
+++ b/packages/npm-native/index.mjs
@@ -207,6 +207,114 @@ export const CalcMode = Object.freeze({ Auto: 0, Manual: 1, AutoNoTable: 2 });
 /** `fm_sheet_visibility_t` ordinals (mirror of OOXML `<sheet state>`). */
 export const SheetVisibility = Object.freeze({ Visible: 0, Hidden: 1, VeryHidden: 2 });
 
+/** `fm_geometry_mode_t` ordinals: which column-width figure a geometry call uses. */
+export const GeometryMode = Object.freeze({ Display: 0, Print: 1 });
+
+/** `fm_display_status_t` ordinals for `getDisplayText` / `formatValue`. */
+export const DisplayStatus = Object.freeze({ Ok: 0, Overflow: 1, InvalidFormat: 2 });
+
+/** `fm_filter_kind_t` ordinals: criterion of an AutoFilter column. */
+export const FilterKind = Object.freeze({ None: 0, Values: 1, Custom: 2, Top10: 3, Dynamic: 4, Color: 5, Icon: 6 });
+
+/** `fm_filter_operator_t` ordinals: comparison operator of a custom AutoFilter condition. */
+export const FilterOperator = Object.freeze({
+  Equal: 0,
+  LessThan: 1,
+  LessThanOrEqual: 2,
+  NotEqual: 3,
+  GreaterThanOrEqual: 4,
+  GreaterThan: 5,
+});
+
+/** `fm_dynamic_filter_type_t` ordinals: dynamic AutoFilter type, in `ST_DynamicFilterType` schema order. */
+export const DynamicFilterType = Object.freeze({
+  Null: 0,
+  AboveAverage: 1,
+  BelowAverage: 2,
+  Tomorrow: 3,
+  Today: 4,
+  Yesterday: 5,
+  NextWeek: 6,
+  ThisWeek: 7,
+  LastWeek: 8,
+  NextMonth: 9,
+  ThisMonth: 10,
+  LastMonth: 11,
+  NextQuarter: 12,
+  ThisQuarter: 13,
+  LastQuarter: 14,
+  NextYear: 15,
+  ThisYear: 16,
+  LastYear: 17,
+  YearToDate: 18,
+  Q1: 19,
+  Q2: 20,
+  Q3: 21,
+  Q4: 22,
+  M1: 23,
+  M2: 24,
+  M3: 25,
+  M4: 26,
+  M5: 27,
+  M6: 28,
+  M7: 29,
+  M8: 30,
+  M9: 31,
+  M10: 32,
+  M11: 33,
+  M12: 34,
+});
+
+/** `fm_sort_by_t` ordinals: what a sort condition sorts by. */
+export const SortBy = Object.freeze({ Value: 0, CellColor: 1, FontColor: 2, Icon: 3 });
+
+/** `fm_sort_method_t` ordinals: sort method of an AutoFilter sort state. */
+export const SortMethod = Object.freeze({ None: 0, PinYin: 1, Stroke: 2 });
+
+/** `fm_date_time_grouping_t` ordinals: granularity of an AutoFilter date-group item. */
+export const DateTimeGrouping = Object.freeze({ Year: 0, Month: 1, Day: 2, Hour: 3, Minute: 4, Second: 5 });
+
+/** `fm_validation_error_style_t` ordinals: data-validation error style. */
+export const ValidationErrorStyle = Object.freeze({ Stop: 0, Warning: 1, Information: 2 });
+
+/** `fm_image_format_t` ordinals: raster format of an image; `Unknown` marks "no image bytes found". */
+export const ImageFormat = Object.freeze({ Unknown: 0, Png: 1, Jpeg: 2, Gif: 3, Bmp: 4 });
+
+/** `fm_drawing_object_kind_t` ordinals: what a drawing anchor holds. */
+export const DrawingObjectKind = Object.freeze({
+  Picture: 0,
+  Shape: 1,
+  Chart: 2,
+  Group: 3,
+  Connector: 4,
+  GraphicFrame: 5,
+  Other: 6,
+});
+
+/** `fm_anchor_kind_t` ordinals: the anchor element type of a drawing object. */
+export const AnchorKind = Object.freeze({ OneCell: 0, TwoCell: 1, Absolute: 2 });
+
+/** `fm_anchor_edit_as_t` ordinals: how a drawing object follows row and column edits. */
+export const AnchorEditAs = Object.freeze({ TwoCell: 0, OneCell: 1, Absolute: 2 });
+
+/** `fm_color_context_t` ordinals: where a colour is used. */
+export const ColorContext = Object.freeze({ Font: 0, FillForeground: 1, FillBackground: 2, Border: 3 });
+
+/** `fm_color_resolution_t` ordinals: how a colour was resolved. */
+export const ColorResolution = Object.freeze({
+  Exact: 0,
+  DefaultTheme: 1,
+  IndexOutOfRange: 2,
+  ThemeUnparseable: 3,
+  AutoContext: 4,
+});
+
+/** Where `getTheme` read the theme from (the C `out_source` values). */
+export const ThemeSource = Object.freeze({ Part: 0, Default: 1, Unparseable: 2 });
+
+/** Where `getEffectiveStyle` took its xf from. */
+export const EffectiveStyleSource = Object.freeze({ Cell: 0, Row: 1, Column: 2, Default: 3 });
+
 /** External-link kinds (mirror of `formulon::io::ExternalLinkRecord::Kind`). */
 export const ExternalLinkKind = Object.freeze({ Unknown: 0, ExternalBook: 1, Ole: 2, Dde: 3 });
 
@@ -262,6 +370,23 @@ export default {
   LogLevel,
   CalcMode,
   SheetVisibility,
+  GeometryMode,
+  DisplayStatus,
+  ColorContext,
+  ImageFormat,
+  DrawingObjectKind,
+  AnchorKind,
+  AnchorEditAs,
+  FilterKind,
+  FilterOperator,
+  DynamicFilterType,
+  SortBy,
+  SortMethod,
+  DateTimeGrouping,
+  ValidationErrorStyle,
+  ColorResolution,
+  ThemeSource,
+  EffectiveStyleSource,
   ExternalLinkKind,
   ErrorCode,
   WorkbookFormat,
diff --git a/packages/npm-native/package.json b/packages/npm-native/package.json
index fc27f470d..6334d4c7f 100644
--- a/packages/npm-native/package.json
+++ b/packages/npm-native/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@libraz/formulon-native",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Excel 365 calculation engine -- native N-API binding",
   "license": "Apache-2.0",
   "author": "libraz",
diff --git a/packages/npm-native/test/input_validation.test.mjs b/packages/npm-native/test/input_validation.test.mjs
new file mode 100644
index 000000000..40cf0c17b
--- /dev/null
+++ b/packages/npm-native/test/input_validation.test.mjs
@@ -0,0 +1,182 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const testDir = path.dirname(fileURLToPath(import.meta.url));
+const addonPath =
+  process.env.FORMULON_NODE_ADDON ??
+  [
+    path.resolve(testDir, '..', 'dist', 'prebuilds', `${process.platform}-${process.arch}`, 'formulon.node'),
+    path.resolve(testDir, '..', 'dist', 'formulon.node'),
+    path.resolve(testDir, '..', 'formulon.node'),
+  ].find((candidate) => existsSync(candidate));
+assert.ok(addonPath, 'native addon not found; set FORMULON_NODE_ADDON or stage dist/formulon.node');
+const requireAddon = createRequire(import.meta.url);
+const addon = requireAddon(addonPath);
+
+function cellNumber(wb, row = 0, col = 0) {
+  const result = wb.getValue(0, row, col);
+  assert.equal(result.status.ok, true, JSON.stringify(result.status));
+  assert.equal(result.value.kind, 1);
+  return result.value.number;
+}
+
+test('coercion objects and symbols are rejected before mutating a cell', () => {
+  const source = `
+    const addon = require(process.env.FORMULON_NODE_ADDON);
+    const wb = addon.Workbook.createDefault();
+    const failures = [];
+    function probe(label, call) {
+      try {
+        call();
+        failures.push(label + ':returned');
+      } catch (error) {
+        if (!(error instanceof TypeError)) failures.push(label + ':' + error.name);
+      }
+      const cell = wb.getValue(0, 0, 0);
+      if (!cell.status.ok || cell.value.kind !== 1 || cell.value.number !== 42) {
+        failures.push(label + ':mutated');
+      }
+    }
+    if (!wb.setNumber(0, 0, 0, 42).ok) failures.push('setup');
+    probe('valueOf', () => wb.setNumber(0, 0, 0, { valueOf() { throw new Error('valueOf'); } }));
+    probe('symbol-number', () => wb.setNumber(0, 0, 0, Symbol('number')));
+    probe('toString', () => wb.setText(0, 0, 0, { toString() { throw new Error('toString'); } }));
+    probe('symbol-string', () => wb.setText(0, 0, 0, Symbol('string')));
+    probe('detached', () => wb.setNumber.call({}, 0, 0, 0, 7));
+    const forged = Object.create(addon.Workbook.prototype);
+    probe('forged', () => wb.setNumber.call(forged, 0, 0, 0, 7));
+    wb.dispose();
+    if (failures.length) {
+      console.error(JSON.stringify(failures));
+      process.exitCode = 1;
+    }
+  `;
+  const result = spawnSync(process.execPath, ['--input-type=commonjs', '-e', source], {
+    env: { ...process.env, FORMULON_NODE_ADDON: addonPath },
+    encoding: 'utf8',
+  });
+  assert.equal(result.status, 0, `subprocess exited ${result.status}: ${result.stderr}`);
+});
+
+test('module-level numeric and string positions reject coercion and overflow', () => {
+  const source = `
+    const addon = require(process.env.FORMULON_NODE_ADDON);
+    const failures = [];
+    function probe(label, expected, call) {
+      try {
+        call();
+        failures.push(label + ':returned');
+      } catch (error) {
+        if (!(error instanceof expected)) failures.push(label + ':' + error.name);
+      }
+    }
+    probe('status-symbol', TypeError, () => addon.statusString(Symbol('status')));
+    probe('status-fraction', RangeError, () => addon.statusString(1.5));
+    probe('status-overflow', RangeError, () => addon.statusString(2 ** 31));
+    probe('error-symbol', TypeError, () => addon.errorDisplayName(Symbol('error')));
+    probe('error-nan', RangeError, () => addon.errorDisplayName(Number.NaN));
+    probe('log-symbol', TypeError, () => addon.setLogMinLevel(Symbol('log')));
+    probe('log-underflow', RangeError, () => addon.setLogMinLevel(-(2 ** 31) - 1));
+    probe('formula-symbol', TypeError, () => addon.evalFormula(Symbol('formula')));
+    probe('formula-object', TypeError, () => addon.evalFormula({ toString() { throw new Error('toString'); } }));
+    if (failures.length) {
+      console.error(JSON.stringify(failures));
+      process.exitCode = 1;
+    }
+  `;
+  const result = spawnSync(process.execPath, ['--input-type=commonjs', '-e', source], {
+    env: { ...process.env, FORMULON_NODE_ADDON: addonPath },
+    encoding: 'utf8',
+  });
+  assert.equal(result.status, 0, `subprocess exited ${result.status}: ${result.stderr}`);
+});
+
+test('integer positional arguments reject wrapping and non-finite values', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.equal(wb.setNumber(0, 0, 0, 42).ok, true);
+    for (const value of [2 ** 32, -1, 1.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+      assert.throws(() => wb.setNumber(value, 0, 0, 7), RangeError, `sheet=${String(value)}`);
+      assert.equal(cellNumber(wb), 42, `invalid sheet changed A1 for ${String(value)}`);
+    }
+    for (const value of [2 ** 32, 2 ** 31, -(2 ** 31) - 1, 1.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+      assert.throws(() => wb.setError(0, 0, 0, value), RangeError, `errorCode=${String(value)}`);
+      assert.equal(cellNumber(wb), 42, `invalid error code changed A1 for ${String(value)}`);
+    }
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('sheet, structural, enum, and read positions reject non-number primitives', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.throws(() => wb.sheetName(Symbol('sheet')), TypeError);
+    assert.throws(() => wb.insertRows(0, 0, 1.5), RangeError);
+    assert.throws(() => wb.setCalcMode(1.5), RangeError);
+    assert.throws(() => wb.getValue(Symbol('sheet'), 0, 0), TypeError);
+    assert.throws(() => wb.functionMetadata('SUM', 1.5), RangeError);
+    assert.throws(() => wb.resolveColor({ kind: 1, rgb: 0 }, 2 ** 31), RangeError);
+    assert.throws(
+      () => wb.getCellsInRange(0, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }, Symbol('cursor')),
+      TypeError,
+    );
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('paging cursor and limit reject values outside native integer ranges', () => {
+  const wb = addon.Workbook.createDefault();
+  const range = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
+  try {
+    for (const value of [-1, 1.5, Number.NaN, Number.POSITIVE_INFINITY, 2 ** 53, 2 ** 64]) {
+      assert.throws(() => wb.getCellsInRange(0, range, value), RangeError, `get cursor=${String(value)}`);
+      assert.throws(() => wb.listInvalidCells(0, value), RangeError, `invalid cursor=${String(value)}`);
+    }
+    for (const value of [2 ** 32, -1, 1.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+      assert.throws(() => wb.getCellsInRange(0, range, undefined, value), RangeError, `get limit=${String(value)}`);
+      assert.throws(() => wb.listInvalidCells(0, undefined, value), RangeError, `invalid limit=${String(value)}`);
+    }
+    assert.doesNotThrow(() => wb.getCellsInRange(0, range, Number.MAX_SAFE_INTEGER));
+    assert.doesNotThrow(() => wb.listInvalidCells(0, Number.MAX_SAFE_INTEGER));
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('missing optional positional arguments retain their existing defaults', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.equal(wb.setIterative(true).ok, true);
+    assert.equal(wb.setSheetVisibility(0).ok, true);
+    assert.equal(wb.functionMetadata('SUM').ok, true);
+    const range = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
+    assert.doesNotThrow(() => wb.getCellsInRange(0, range, undefined, undefined));
+    assert.doesNotThrow(() => wb.listInvalidCells(0, undefined, undefined));
+    assert.doesNotThrow(() => wb.getCellsInRange(0, range, null, null));
+    assert.doesNotThrow(() => wb.listInvalidCells(0, null, null));
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('getCellsInRange reads its range argument like the merge methods', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.equal(wb.setNumber(0, 0, 0, 7).ok, true);
+    const nullish = wb.getCellsInRange(0, null);
+    assert.equal(nullish.status.ok, true);
+    assert.equal(nullish.cells.length, 1);
+    assert.equal(wb.getMergesInRange(0, null).status.ok, true);
+    assert.throws(() => wb.getCellsInRange(0, 5), TypeError);
+    assert.throws(() => wb.getMergesInRange(0, 5), TypeError);
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/nested_cells_validation.test.mjs b/packages/npm-native/test/nested_cells_validation.test.mjs
new file mode 100644
index 000000000..b31558c00
--- /dev/null
+++ b/packages/npm-native/test/nested_cells_validation.test.mjs
@@ -0,0 +1,161 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+function withWorkbook(Workbook, fn) {
+  const wb = Workbook.createDefault();
+  try {
+    return fn(wb);
+  } finally {
+    wb.dispose();
+  }
+}
+
+function validRuns() {
+  return [
+    { sb: 0, eb: 2, text: 'トウキョウ' },
+    { sb: 2, eb: 3, text: 'ト' },
+  ];
+}
+
+function validRange() {
+  return { firstRow: 0, firstCol: 0, lastRow: 4, lastCol: 4 };
+}
+
+test('cell phonetic run integers reject narrowing before replacing existing runs', async () => {
+  const mod = await getModule();
+  const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY];
+  for (const value of invalid) {
+    withWorkbook(mod.Workbook, (wb) => {
+      assert.ok(wb.setText(0, 0, 0, '東京都').ok);
+      assert.ok(wb.setCellPhoneticRuns(0, 0, 0, validRuns()).ok);
+      const before = wb.getCellPhoneticRuns(0, 0, 0).runs;
+      for (const key of ['sb', 'eb']) {
+        assert.throws(
+          () => wb.setCellPhoneticRuns(0, 0, 0, [{ ...validRuns()[0], [key]: value }, validRuns()[1]]),
+          RangeError,
+          `setCellPhoneticRuns ${key}=${String(value)}`,
+        );
+        assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, before);
+      }
+    });
+  }
+});
+
+test('cell phonetic run text rejects coercible non-strings like the WASM surface', async () => {
+  const mod = await getModule();
+  withWorkbook(mod.Workbook, (wb) => {
+    assert.ok(wb.setText(0, 0, 0, '東京都').ok);
+    assert.ok(wb.setCellPhoneticRuns(0, 0, 0, validRuns()).ok);
+    const before = wb.getCellPhoneticRuns(0, 0, 0).runs;
+    for (const value of [42, true, { toString: () => 'ト' }]) {
+      assert.throws(
+        () => wb.setCellPhoneticRuns(0, 0, 0, [{ ...validRuns()[0], text: value }, validRuns()[1]]),
+        TypeError,
+        `setCellPhoneticRuns text=${String(value)}`,
+      );
+      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, before);
+    }
+    const bytes = new TextEncoder().encode('トウキョウ');
+    assert.ok(wb.setCellPhoneticRuns(0, 0, 0, [{ ...validRuns()[0], text: bytes }, validRuns()[1]]).ok);
+    assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, before);
+  });
+});
+
+test('cell phonetic properties reject narrowing before changing the stored properties', async () => {
+  const mod = await getModule();
+  const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY];
+  for (const value of invalid) {
+    withWorkbook(mod.Workbook, (wb) => {
+      assert.ok(wb.setText(0, 0, 0, '大阪').ok);
+      assert.ok(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 3, type: 2, alignment: 2 }).ok);
+      const before = wb.getCellPhoneticProperties(0, 0, 0);
+      for (const key of ['fontId', 'type', 'alignment']) {
+        assert.throws(
+          () => wb.setCellPhoneticProperties(0, 0, 0, { fontId: 3, type: 2, alignment: 2, [key]: value }),
+          RangeError,
+          `setCellPhoneticProperties ${key}=${String(value)}`,
+        );
+        const after = wb.getCellPhoneticProperties(0, 0, 0);
+        assert.deepEqual(
+          { fontId: after.fontId, type: after.type, alignment: after.alignment },
+          { fontId: before.fontId, type: before.type, alignment: before.alignment },
+        );
+      }
+    });
+  }
+});
+
+test('cell nested value integers reject narrowing before formatValue reads them', async () => {
+  const mod = await getModule();
+  const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY];
+  for (const value of invalid) {
+    withWorkbook(mod.Workbook, (wb) => {
+      assert.throws(
+        () => wb.formatValue({ kind: value, number: 1, boolean: 0, text: '', errorCode: 0 }, 'General'),
+        RangeError,
+        `formatValue kind=${String(value)}`,
+      );
+      assert.throws(
+        () => wb.formatValue({ kind: 2, number: 0, boolean: value, text: '', errorCode: 0 }, 'General'),
+        RangeError,
+        `formatValue boolean=${String(value)}`,
+      );
+      assert.throws(
+        () => wb.formatValue({ kind: 4, number: 0, boolean: 0, text: '', errorCode: value }, 'General'),
+        RangeError,
+        `formatValue errorCode=${String(value)}`,
+      );
+    });
+  }
+});
+
+test('cell nested value symbols are rejected before formatValue', async () => {
+  const mod = await getModule();
+  withWorkbook(mod.Workbook, (wb) => {
+    const symbol = Symbol('cell value integer');
+    assert.throws(
+      () => wb.formatValue({ kind: symbol, number: 1, boolean: 0, text: '', errorCode: 0 }, 'General'),
+      TypeError,
+    );
+    assert.throws(
+      () => wb.formatValue({ kind: 2, number: 0, boolean: symbol, text: '', errorCode: 0 }, 'General'),
+      TypeError,
+    );
+    assert.throws(
+      () => wb.formatValue({ kind: 4, number: 0, boolean: 0, text: '', errorCode: symbol }, 'General'),
+      TypeError,
+    );
+  });
+});
+
+test('cell range integers reject narrowing before getCellsInRange touches the workbook', async () => {
+  const mod = await getModule();
+  const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY];
+  for (const value of invalid) {
+    withWorkbook(mod.Workbook, (wb) => {
+      assert.ok(wb.setNumber(0, 0, 0, 7).ok);
+      for (const key of ['firstRow', 'firstCol', 'lastRow', 'lastCol']) {
+        assert.throws(
+          () => wb.getCellsInRange(0, { ...validRange(), [key]: value }),
+          RangeError,
+          `getCellsInRange ${key}=${String(value)}`,
+        );
+      }
+    });
+  }
+});
+
+test('cell range getters stop before getCellsInRange calls the C API', async () => {
+  const mod = await getModule();
+  withWorkbook(mod.Workbook, (wb) => {
+    assert.ok(wb.setNumber(0, 0, 0, 7).ok);
+    const range = validRange();
+    Object.defineProperty(range, 'firstRow', {
+      enumerable: true,
+      get() {
+        throw new Error('cell range getter');
+      },
+    });
+    assert.throws(() => wb.getCellsInRange(0, range), /cell range getter/);
+  });
+});
diff --git a/packages/npm-native/test/nested_layout_validation.test.mjs b/packages/npm-native/test/nested_layout_validation.test.mjs
new file mode 100644
index 000000000..c0427894b
--- /dev/null
+++ b/packages/npm-native/test/nested_layout_validation.test.mjs
@@ -0,0 +1,137 @@
+import assert from 'node:assert/strict';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const testDir = path.dirname(fileURLToPath(import.meta.url));
+const addonPath =
+  process.env.FORMULON_NODE_ADDON ??
+  [
+    path.resolve(testDir, '..', 'dist', 'prebuilds', `${process.platform}-${process.arch}`, 'formulon.node'),
+    path.resolve(testDir, '..', 'dist', 'formulon.node'),
+    path.resolve(testDir, '..', 'formulon.node'),
+  ].find((candidate) => existsSync(candidate));
+assert.ok(addonPath, 'native addon not found; set FORMULON_NODE_ADDON or stage dist/formulon.node');
+const addon = createRequire(import.meta.url)(addonPath);
+
+const RANGE = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
+
+function protectionSnapshot(wb) {
+  const result = wb.getSheetProtection(0);
+  assert.equal(result.status.ok, true, JSON.stringify(result.status));
+  return structuredClone(result.protection);
+}
+
+test('sheet protection rejects every narrow nested integer before mutation', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    const keys = [
+      'enabled',
+      'sheet',
+      'objects',
+      'scenarios',
+      'formatCells',
+      'formatColumns',
+      'formatRows',
+      'insertColumns',
+      'insertRows',
+      'insertHyperlinks',
+      'deleteColumns',
+      'deleteRows',
+      'selectLockedCells',
+      'selectUnlockedCells',
+      'sort',
+      'autoFilter',
+      'pivotTables',
+    ];
+    for (const key of keys) {
+      const before = protectionSnapshot(wb);
+      assert.throws(() => wb.setSheetProtection(0, { [key]: 1.5 }), RangeError, key);
+      assert.deepEqual(protectionSnapshot(wb), before, `${key} changed protection`);
+    }
+    const beforeSpin = protectionSnapshot(wb);
+    assert.throws(() => wb.setSheetProtection(0, { spinCount: 2 ** 32 }), RangeError);
+    assert.deepEqual(protectionSnapshot(wb), beforeSpin);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('sheet protection stops at a throwing nested getter before native mutation', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    const before = protectionSnapshot(wb);
+    const spec = { enabled: 1, algorithmName: 'SHA-512' };
+    Object.defineProperty(spec, 'formatRows', {
+      enumerable: true,
+      get() {
+        throw new Error('protection getter');
+      },
+    });
+    assert.throws(() => wb.setSheetProtection(0, spec), /protection getter/);
+    assert.deepEqual(protectionSnapshot(wb), before);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('sheet format defaults stops at a throwing nested getter before native mutation', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    const before = wb.getSheetFormatDefaults(0);
+    const spec = { defaultColWidth: 12.5 };
+    Object.defineProperty(spec, 'defaultRowHeight', {
+      enumerable: true,
+      get() {
+        throw new Error('format getter');
+      },
+    });
+    assert.throws(() => wb.setSheetFormatDefaults(0, spec), /format getter/);
+    assert.deepEqual(wb.getSheetFormatDefaults(0), before);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('cell geometry rejects fractional nested range coordinates before the query', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.throws(() => wb.getCellRectPt(0, { ...RANGE, firstRow: 1.5 }, 0), RangeError);
+    assert.throws(() => wb.getCellRectPt(0, { ...RANGE, lastCol: Number.NaN }, 0), RangeError);
+    const range = {};
+    Object.defineProperty(range, 'firstRow', {
+      enumerable: true,
+      get() {
+        throw new Error('geometry getter');
+      },
+    });
+    assert.throws(() => wb.getCellRectPt(0, range, 0), /geometry getter/);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('partial recalc rejects fractional nested viewport coordinates before recalc', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+    assert.ok(wb.setFormula(0, 0, 1, '=A1+1').ok);
+    assert.throws(() => wb.partialRecalc({ ...RANGE, sheet: 0, firstRow: 1.5 }), RangeError);
+    const viewport = { sheet: 0, firstRow: 0, lastRow: 0, firstCol: 0, lastCol: 0 };
+    Object.defineProperty(viewport, 'lastCol', {
+      enumerable: true,
+      get() {
+        throw new Error('viewport getter');
+      },
+    });
+    assert.throws(() => wb.partialRecalc(viewport), /viewport getter/);
+    const value = wb.getValue(0, 0, 1);
+    assert.equal(value.status.ok, true, JSON.stringify(value.status));
+    assert.equal(value.value.kind, 0);
+    assert.equal(value.value.number, 0);
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/nested_numeric_validation.test.mjs b/packages/npm-native/test/nested_numeric_validation.test.mjs
new file mode 100644
index 000000000..36e5d8e84
--- /dev/null
+++ b/packages/npm-native/test/nested_numeric_validation.test.mjs
@@ -0,0 +1,274 @@
+import test from 'node:test';
+import { pathToFileURL } from 'node:url';
+import { assert, getModule } from './smoke_support.mjs';
+
+const RANGE = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
+
+function dataBarRule(overrides = {}) {
+  return {
+    sqref: [RANGE],
+    type: 3,
+    dataBar: {
+      min: { type: 3 },
+      max: { type: 4 },
+      ...overrides,
+    },
+  };
+}
+
+async function getValidationModule() {
+  if (process.env.FORMULON_NODE_ADDON) {
+    const addon = await import(pathToFileURL(process.env.FORMULON_NODE_ADDON).href);
+    return addon.default ?? addon;
+  }
+  return getModule();
+}
+
+test('nested style integers reject narrowing before addXf mutates the workbook', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const before = wb.xfCount().value;
+    assert.throws(() => wb.addXf({ horizontalAlign: 256 }), RangeError);
+    assert.equal(wb.xfCount().value, before);
+
+    assert.throws(() => wb.addXf({ numFmtId: 65536 }), RangeError);
+    assert.equal(wb.xfCount().value, before);
+
+    assert.throws(() => wb.addXf({ fontIndex: 2 ** 32 }), RangeError);
+    assert.equal(wb.xfCount().value, before);
+
+    const beforeFonts = wb.fontCount().value;
+    assert.throws(() => wb.addFont({ underline: 256 }), RangeError);
+    assert.equal(wb.fontCount().value, beforeFonts);
+
+    const beforeFills = wb.fillCount().value;
+    assert.throws(() => wb.addFill({ pattern: 256 }), RangeError);
+    assert.equal(wb.fillCount().value, beforeFills);
+
+    const beforeBorders = wb.borderCount().value;
+    assert.throws(() => wb.addBorder({ left: { style: 256 } }), RangeError);
+    assert.equal(wb.borderCount().value, beforeBorders);
+
+    for (const value of [Number.NaN, Number.POSITIVE_INFINITY, 1.5, -1]) {
+      assert.throws(() => wb.addXf({ horizontalAlign: value }), RangeError, `horizontalAlign=${String(value)}`);
+      assert.equal(wb.xfCount().value, before);
+    }
+
+    const omitted = wb.addXf({ horizontalAlign: null, verticalAlign: undefined });
+    assert.ok(omitted.status.ok, JSON.stringify(omitted.status));
+    assert.equal(wb.xfCount().value, before);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('nested conditional-format integers reject narrowing before addConditionalFormat mutates', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const beforeDxfs = wb.dxfCount().value;
+    assert.throws(() => wb.addDxf({ numFmt: { numFmtId: 65536 } }), RangeError);
+    assert.equal(wb.dxfCount().value, beforeDxfs);
+
+    assert.equal(wb.getConditionalFormats(0).length, 0);
+    assert.throws(() => wb.addConditionalFormat(0, dataBarRule({ minLengthPct: 256 })), RangeError);
+    assert.equal(wb.getConditionalFormats(0).length, 0);
+
+    for (const value of [Number.NaN, Number.POSITIVE_INFINITY, 1.5, -1]) {
+      assert.throws(
+        () => wb.addConditionalFormat(0, dataBarRule({ minLengthPct: value })),
+        RangeError,
+        `minLengthPct=${String(value)}`,
+      );
+      assert.equal(wb.getConditionalFormats(0).length, 0);
+    }
+
+    const omitted = wb.addConditionalFormat(0, dataBarRule({ minLengthPct: null, maxLengthPct: undefined }));
+    assert.ok(omitted.status.ok, JSON.stringify(omitted));
+    const stored = wb.getConditionalFormats(0);
+    assert.equal(stored.length, 1);
+    assert.equal(stored[0].dataBar.minLengthPct, 10);
+    assert.equal(stored[0].dataBar.maxLengthPct, 90);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('nested style and conditional-format fields require primitive numeric values', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const beforeXfs = wb.xfCount().value;
+    assert.throws(() => wb.addXf({ horizontalAlign: '1' }), TypeError);
+    assert.equal(wb.xfCount().value, beforeXfs);
+
+    assert.throws(() => wb.addXf({ horizontalAlign: Symbol('numeric') }), TypeError);
+    assert.equal(wb.xfCount().value, beforeXfs);
+
+    assert.throws(() => wb.addConditionalFormat(0, dataBarRule({ minLengthPct: '10' })), TypeError);
+    assert.equal(wb.getConditionalFormats(0).length, 0);
+
+    assert.throws(() => wb.addConditionalFormat(0, dataBarRule({ minLengthPct: Symbol('numeric') })), TypeError);
+    assert.equal(wb.getConditionalFormats(0).length, 0);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('nested readers preserve the original getter error and abort the whole mutation', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const beforeXfs = wb.xfCount().value;
+    const style = {};
+    Object.defineProperty(style, 'horizontalAlign', {
+      enumerable: true,
+      get() {
+        throw new Error('style getter');
+      },
+    });
+    assert.throws(() => wb.addXf(style), /style getter/);
+    assert.equal(wb.xfCount().value, beforeXfs);
+
+    const rule = dataBarRule();
+    Object.defineProperty(rule.dataBar, 'minLengthPct', {
+      enumerable: true,
+      get() {
+        throw new Error('conditional-format getter');
+      },
+    });
+    assert.throws(() => wb.addConditionalFormat(0, rule), /conditional-format getter/);
+    assert.equal(wb.getConditionalFormats(0).length, 0);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('style and conditional-format readers snapshot stateful fields once', async () => {
+  const mod = await getValidationModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    let horizontalReads = 0;
+    const statefulXf = {};
+    Object.defineProperty(statefulXf, 'horizontalAlign', {
+      get() {
+        horizontalReads += 1;
+        return horizontalReads === 1 ? 1 : undefined;
+      },
+    });
+    const xf = wb.addXf(statefulXf);
+    assert.ok(xf.status.ok, JSON.stringify(xf.status));
+    assert.equal(horizontalReads, 1);
+    const storedXf = wb.getCellXf(xf.index);
+    assert.equal(storedXf.horizontalAlign, 1);
+    assert.equal(storedXf.hasHorizontalAlign, true);
+
+    const firstDxf = wb.addDxf({ font: { name: 'first' } });
+    const secondDxf = wb.addDxf({ font: { name: 'second' } });
+    assert.ok(firstDxf.status.ok, JSON.stringify(firstDxf.status));
+    assert.ok(secondDxf.status.ok, JSON.stringify(secondDxf.status));
+    let dxfReads = 0;
+    const rule = dataBarRule();
+    Object.defineProperty(rule, 'dxfId', {
+      get() {
+        dxfReads += 1;
+        return dxfReads === 1 ? secondDxf.index : undefined;
+      },
+    });
+    const cf = wb.addConditionalFormat(0, rule);
+    assert.ok(cf.status.ok, JSON.stringify(cf.status));
+    assert.equal(dxfReads, 1);
+    assert.equal(wb.getConditionalFormats(0)[0].dxfId, secondDxf.index);
+
+    const beforeMemory = wb.memoryUsage();
+    const lateFont = { name: 'late font '.repeat(1024), bold: true };
+    Object.defineProperty(lateFont, 'color', {
+      get() {
+        throw new Error('late font getter');
+      },
+    });
+    const beforeFonts = wb.fontCount().value;
+    for (let i = 0; i < 8; i += 1) {
+      assert.throws(() => wb.addFont(lateFont), /late font getter/);
+    }
+    assert.equal(wb.fontCount().value, beforeFonts);
+    assert.equal(wb.memoryUsage(), beforeMemory);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('conditional-format arrays skip nullish entries and keep later records', async () => {
+  const mod = await getValidationModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const added = wb.addConditionalFormat(0, {
+      // Include null, undefined, and a hole before the valid range. The old
+      // reader skipped those entries and still passed the later range to C.
+      sqref: Object.assign(new Array(4), { 0: null, 1: undefined, 3: RANGE }),
+      type: 3,
+      dataBar: { min: { type: 3 }, max: { type: 4 } },
+    });
+    assert.ok(added.status.ok, JSON.stringify(added.status));
+    const stored = wb.getConditionalFormats(0);
+    assert.equal(stored.length, 1);
+    assert.equal(stored[0].sqref.length, 1);
+    assert.deepEqual(stored[0].sqref[0], RANGE);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('named-style and theme integer fields reject before their C mutations', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const styleCount = wb.cellStyleCount().value;
+    for (const value of [2 ** 32, Number.NaN, 1.5, -1]) {
+      assert.throws(() => wb.setCellStyle({ name: 'invalid', xfId: value }), RangeError);
+      assert.equal(wb.cellStyleCount().value, styleCount);
+    }
+
+    const before = wb.getTheme().colors;
+    for (const value of [Symbol('theme'), Number.NaN, 1.5, -1, 2 ** 32]) {
+      const values = Array.from({ length: 12 }, (_, i) => (i === 0 ? value : before[i]));
+      assert.throws(
+        () => wb.setThemeColors(values),
+        typeof value === 'symbol' ? TypeError : /must be a number|outside uint32/,
+      );
+      assert.deepEqual(wb.getTheme().colors, before);
+    }
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('style and CF reader defaults survive nullish fields and valid u8 boundaries', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const font = wb.addFont({ name: 'Reader defaults', size: null, colorArgb: undefined, underline: null });
+    assert.ok(font.status.ok, JSON.stringify(font.status));
+    const storedFont = wb.getFont(font.index);
+    assert.equal(storedFont.size, 11);
+    assert.equal(storedFont.colorArgb >>> 0, 0xff000000);
+
+    const cf = wb.addConditionalFormat(
+      0,
+      dataBarRule({
+        fill: { r: 255, g: 0, b: 1 },
+        minLengthPct: 0,
+        maxLengthPct: 100,
+      }),
+    );
+    assert.ok(cf.status.ok, JSON.stringify(cf));
+    const stored = wb.getConditionalFormats(0)[0].dataBar;
+    assert.equal(stored.fill.r, 255);
+    assert.equal(stored.fill.a, 255);
+    assert.equal(stored.minLengthPct, 0);
+    assert.equal(stored.maxLengthPct, 100);
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/nested_pivot_validation.test.mjs b/packages/npm-native/test/nested_pivot_validation.test.mjs
new file mode 100644
index 000000000..00f46b691
--- /dev/null
+++ b/packages/npm-native/test/nested_pivot_validation.test.mjs
@@ -0,0 +1,270 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+function statusOf(result) {
+  return typeof result?.ok === 'boolean' ? result : result?.status;
+}
+
+function must(result, what) {
+  const status = statusOf(result);
+  assert.ok(status?.ok, `${what}: ${JSON.stringify(status)}`);
+  return result;
+}
+
+function makePivot(Workbook) {
+  const wb = Workbook.createDefault();
+  const cache = must(wb.pivotCacheCreate(0), 'pivotCacheCreate').index;
+  must(
+    wb.pivotCacheSetWorksheetSource(cache, { present: true, ref: 'A1:B3', sheet: 'Sheet1' }),
+    'pivotCacheSetWorksheetSource',
+  );
+  must(wb.pivotCacheFieldAdd(cache, 'Region'), 'pivotCacheFieldAdd Region');
+  must(wb.pivotCacheFieldAdd(cache, 'Amount'), 'pivotCacheFieldAdd Amount');
+  for (const [region, amount] of [
+    ['East', 10],
+    ['West', 30],
+  ]) {
+    const record = must(wb.pivotCacheRecordAdd(cache), 'pivotCacheRecordAdd').index;
+    must(wb.pivotCacheRecordSetText(cache, record, 0, region), 'pivotCacheRecordSetText');
+    must(wb.pivotCacheRecordSetNumber(cache, record, 1, amount), 'pivotCacheRecordSetNumber');
+  }
+  const pivot = must(wb.pivotCreate(0, 'Pivot1', cache, 0, 4), 'pivotCreate').index;
+  const region = must(wb.pivotFieldAdd(0, pivot, { sourceName: 'Region', axis: 0 }), 'region field').index;
+  const amount = must(wb.pivotFieldAdd(0, pivot, { sourceName: 'Amount', axis: 2 }), 'amount field').index;
+  must(wb.pivotSetRowFieldOrder(0, pivot, [region]), 'pivotSetRowFieldOrder');
+  must(
+    wb.pivotDataFieldAdd(0, pivot, { name: 'Sum of Amount', fieldIndex: amount, aggregation: 0 }),
+    'pivotDataFieldAdd',
+  );
+  return { wb, pivot, region, amount };
+}
+
+function withPivot(Workbook, fn) {
+  const fixture = makePivot(Workbook);
+  try {
+    return fn(fixture);
+  } finally {
+    fixture.wb.dispose();
+  }
+}
+
+function pivotGrid(wb, pivot) {
+  const layout = wb.pivotLayout(0, pivot);
+  assert.ok(layout.status.ok, JSON.stringify(layout.status));
+  const rows = new Map();
+  for (const cell of layout.cells) {
+    const value = cell.value;
+    const text = value.kind === 1 ? String(value.number) : value.kind === 3 ? value.text : '';
+    if (!rows.has(cell.row)) rows.set(cell.row, new Array(layout.cols).fill(''));
+    rows.get(cell.row)[cell.col - layout.left] = text;
+  }
+  return [...rows.keys()].sort((a, b) => a - b).map((row) => rows.get(row).join('|'));
+}
+
+const BASE_GRID = ['行ラベル|Sum of Amount', 'East|10', 'West|30', '総計|40'];
+
+test('pivot nested integer fields reject narrowing before their C mutations', async () => {
+  const mod = await getModule();
+  const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY];
+
+  for (const value of invalid) {
+    withPivot(mod.Workbook, ({ wb, pivot }) => {
+      const before = wb.pivotFieldCount(0, pivot).value;
+      assert.throws(
+        () => wb.pivotFieldAdd(0, pivot, { sourceName: 'Region', axis: value }),
+        RangeError,
+        `pivotFieldAdd axis=${String(value)}`,
+      );
+      assert.equal(wb.pivotFieldCount(0, pivot).value, before);
+    });
+
+    withPivot(mod.Workbook, ({ wb, pivot, amount }) => {
+      const before = wb.pivotDataFieldCount(0, pivot).value;
+      assert.throws(
+        () => wb.pivotDataFieldAdd(0, pivot, { name: 'Bad', fieldIndex: value, aggregation: 0 }),
+        RangeError,
+        `pivotDataFieldAdd fieldIndex=${String(value)}`,
+      );
+      assert.equal(wb.pivotDataFieldCount(0, pivot).value, before);
+
+      assert.throws(
+        () => wb.pivotDataFieldSet(0, pivot, 0, { name: 'Bad', fieldIndex: amount, aggregation: value }),
+        RangeError,
+        `pivotDataFieldSet aggregation=${String(value)}`,
+      );
+      assert.equal(wb.pivotDataFieldCount(0, pivot).value, before);
+      assert.deepEqual(pivotGrid(wb, pivot), BASE_GRID);
+
+      for (const key of ['showAs', 'showAsBaseField', 'showAsBaseItem']) {
+        assert.throws(
+          () =>
+            wb.pivotDataFieldSet(0, pivot, 0, {
+              name: 'Bad',
+              fieldIndex: amount,
+              aggregation: 0,
+              [key]: value,
+            }),
+          RangeError,
+          `pivotDataFieldSet ${key}=${String(value)}`,
+        );
+        assert.equal(wb.pivotDataFieldCount(0, pivot).value, before);
+        assert.deepEqual(pivotGrid(wb, pivot), BASE_GRID);
+      }
+    });
+  }
+});
+
+test('pivot nested integer fields reject wrong primitives without changing the pivot', async () => {
+  const mod = await getModule();
+  const symbol = Symbol('pivot numeric');
+  withPivot(mod.Workbook, ({ wb, pivot }) => {
+    const fieldCount = wb.pivotFieldCount(0, pivot).value;
+    assert.throws(() => wb.pivotFieldAdd(0, pivot, { sourceName: 'Region', axis: symbol }), TypeError);
+    assert.equal(wb.pivotFieldCount(0, pivot).value, fieldCount);
+
+    const dataFieldCount = wb.pivotDataFieldCount(0, pivot).value;
+    assert.throws(() => wb.pivotDataFieldAdd(0, pivot, { name: 'Bad', fieldIndex: symbol, aggregation: 0 }), TypeError);
+    assert.equal(wb.pivotDataFieldCount(0, pivot).value, dataFieldCount);
+
+    const filterCount = wb.pivotFilterCount(0, pivot).value;
+    assert.throws(
+      () =>
+        wb.pivotFilterAdd(0, pivot, {
+          axis: 0,
+          fieldName: 'Region',
+          type: 1,
+          valueKind: symbol,
+          valueDouble: 15,
+        }),
+      TypeError,
+    );
+    assert.equal(wb.pivotFilterCount(0, pivot).value, filterCount);
+  });
+});
+
+test('pivot filters validate axis, value kind, and data-field index before mutation', async () => {
+  const mod = await getModule();
+  const invalidSpecs = [
+    { axis: 2 ** 32 },
+    { type: 2 ** 32 },
+    { valueKind: 1.5 },
+    { valueInt: 1.5 },
+    { valueHighKind: Number.NaN },
+    { valueHighInt: Number.POSITIVE_INFINITY },
+    { dataFieldIndex: 2 ** 32 },
+  ];
+  for (const override of invalidSpecs) {
+    withPivot(mod.Workbook, ({ wb, pivot }) => {
+      const before = wb.pivotFilterCount(0, pivot).value;
+      assert.throws(
+        () =>
+          wb.pivotFilterAdd(0, pivot, {
+            axis: 0,
+            fieldName: 'Region',
+            type: 1,
+            valueKind: 1,
+            valueDouble: 15,
+            ...override,
+          }),
+        RangeError,
+        `pivotFilterAdd ${JSON.stringify(override)}`,
+      );
+      assert.equal(wb.pivotFilterCount(0, pivot).value, before);
+      assert.deepEqual(pivotGrid(wb, pivot), BASE_GRID);
+    });
+  }
+});
+
+test('pivot order arrays validate every element before replacing the order', async () => {
+  const mod = await getModule();
+  const invalid = [2 ** 32 + 1, 1.5, Number.NaN, Number.POSITIVE_INFINITY, Symbol('pivot order')];
+  for (const value of invalid) {
+    withPivot(mod.Workbook, ({ wb, pivot }) => {
+      assert.deepEqual(pivotGrid(wb, pivot), BASE_GRID);
+      assert.throws(
+        () => wb.pivotSetRowFieldOrder(0, pivot, [value]),
+        typeof value === 'symbol' ? TypeError : RangeError,
+        `pivotSetRowFieldOrder element=${String(value)}`,
+      );
+      assert.deepEqual(pivotGrid(wb, pivot), BASE_GRID);
+    });
+  }
+
+  withPivot(mod.Workbook, ({ wb, pivot, region }) => {
+    assert.ok(wb.pivotSetRowFieldOrder(0, pivot, [region]).ok);
+    assert.deepEqual(pivotGrid(wb, pivot), BASE_GRID);
+  });
+});
+
+test('pivot order stops at a throwing array getter before changing the report', async () => {
+  const mod = await getModule();
+  withPivot(mod.Workbook, ({ wb, pivot }) => {
+    const indices = [];
+    Object.defineProperty(indices, 0, {
+      enumerable: true,
+      get() {
+        throw new Error('pivot order getter');
+      },
+    });
+    assert.throws(() => wb.pivotSetRowFieldOrder(0, pivot, indices), /pivot order getter/);
+    assert.deepEqual(pivotGrid(wb, pivot), BASE_GRID);
+  });
+});
+
+test('pivot nested string getters stop before changing the report', async () => {
+  const mod = await getModule();
+  withPivot(mod.Workbook, ({ wb, pivot }) => {
+    const fieldCount = wb.pivotFieldCount(0, pivot).value;
+    const spec = { axis: 0 };
+    Object.defineProperty(spec, 'sourceName', {
+      enumerable: true,
+      get() {
+        throw new Error('pivot field getter');
+      },
+    });
+    assert.throws(() => wb.pivotFieldAdd(0, pivot, spec), /pivot field getter/);
+    assert.equal(wb.pivotFieldCount(0, pivot).value, fieldCount);
+    assert.deepEqual(pivotGrid(wb, pivot), BASE_GRID);
+  });
+});
+
+test('pivot cache source snapshots each nested getter once before mutation', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const cache = wb.pivotCacheCreate(0).index;
+    let reads = 0;
+    const source = { present: true, sheet: 'Sheet1' };
+    Object.defineProperty(source, 'ref', {
+      enumerable: true,
+      get() {
+        reads += 1;
+        if (reads > 1) throw new Error('pivot cache source getter read twice');
+        return 'A1:B3';
+      },
+    });
+    const result = wb.pivotCacheSetWorksheetSource(cache, source);
+    assert.ok(result.ok, JSON.stringify(result));
+    assert.equal(reads, 1);
+    assert.equal(wb.pivotCacheGetWorksheetSource(cache).ref, 'A1:B3');
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('pivot optional strings and nullish numeric defaults keep the valid contract', async () => {
+  const mod = await getModule();
+  withPivot(mod.Workbook, ({ wb, pivot, amount }) => {
+    const result = wb.pivotDataFieldAdd(0, pivot, {
+      name: 'Count of Amount',
+      fieldIndex: amount,
+      aggregation: 1,
+      numberFormat: null,
+      showAs: undefined,
+      showAsBaseField: null,
+      showAsBaseItem: undefined,
+    });
+    assert.ok(result.status.ok, JSON.stringify(result.status));
+    assert.equal(wb.pivotDataFieldCount(0, pivot).value, 2);
+  });
+});
diff --git a/packages/npm-native/test/nested_print_validation.test.mjs b/packages/npm-native/test/nested_print_validation.test.mjs
new file mode 100644
index 000000000..7fc1451bb
--- /dev/null
+++ b/packages/npm-native/test/nested_print_validation.test.mjs
@@ -0,0 +1,200 @@
+import assert from 'node:assert/strict';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const testDir = path.dirname(fileURLToPath(import.meta.url));
+const addonPath =
+  process.env.FORMULON_NODE_ADDON ??
+  [
+    path.resolve(testDir, '..', 'dist', 'prebuilds', `${process.platform}-${process.arch}`, 'formulon.node'),
+    path.resolve(testDir, '..', 'dist', 'formulon.node'),
+    path.resolve(testDir, '..', 'formulon.node'),
+  ].find((candidate) => existsSync(candidate));
+assert.ok(addonPath, 'native addon not found; set FORMULON_NODE_ADDON or stage dist/formulon.node');
+const addon = createRequire(import.meta.url)(addonPath);
+
+function readSetup(wb) {
+  const result = wb.getSheetPageSetup(0);
+  assert.equal(result.status.ok, true, JSON.stringify(result.status));
+  return result;
+}
+
+function readMargins(wb) {
+  const result = wb.getSheetPageMargins(0);
+  assert.equal(result.status.ok, true, JSON.stringify(result.status));
+  return result;
+}
+
+test('page setup narrow fields reject lossy values before native mutation', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.equal(wb.setSheetPageSetup(0, { scale: 125 }).ok, true);
+    for (const value of [2 ** 32 + 100, 100.5, Number.NaN, Number.POSITIVE_INFINITY, -1]) {
+      assert.throws(() => wb.setSheetPageSetup(0, { scale: value }), RangeError, `scale=${String(value)}`);
+      assert.equal(readSetup(wb).scale, 125, `invalid scale changed the stored value: ${String(value)}`);
+    }
+    assert.throws(() => wb.setSheetPageSetup(0, { scale: Symbol('scale') }), TypeError);
+    assert.equal(readSetup(wb).scale, 125);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('all page setup integer fields share the checked reader', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.equal(wb.setSheetPageSetup(0, { scale: 125 }).ok, true);
+    const before = readSetup(wb);
+    for (const key of ['orientation', 'paperSize', 'fitToWidth', 'fitToHeight']) {
+      assert.throws(() => wb.setSheetPageSetup(0, { [key]: 2 ** 32 + 1 }), RangeError, key);
+      assert.equal(readSetup(wb)[key], before[key], `${key} failure changed the stored value`);
+    }
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('reader preserves fractional doubles and rejects pending getters before C mutation', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.ok(wb.setSheetPageMargins(0, { left: 0.25, top: 1.5 }).ok);
+    const margins = readMargins(wb);
+    assert.equal(margins.left, 0.25);
+    assert.equal(margins.top, 1.5);
+
+    const setup = {};
+    Object.defineProperty(setup, 'scale', {
+      enumerable: true,
+      get() {
+        throw new Error('scale getter');
+      },
+    });
+    assert.throws(() => wb.setSheetPageSetup(0, setup), /scale getter/);
+    assert.equal(readSetup(wb).scale, 100);
+
+    const marginsWithGetter = {};
+    Object.defineProperty(marginsWithGetter, 'left', {
+      enumerable: true,
+      get() {
+        throw new Error('left getter');
+      },
+    });
+    assert.throws(() => wb.setSheetPageMargins(0, marginsWithGetter), /left getter/);
+    const unchanged = readMargins(wb);
+    assert.equal(unchanged.left, 0.25);
+    assert.equal(unchanged.top, 1.5);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('print option and header/footer readers stop before native mutation on getter failure', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    const options = {};
+    Object.defineProperty(options, 'gridLines', {
+      enumerable: true,
+      get() {
+        throw new Error('gridLines getter');
+      },
+    });
+    assert.throws(() => wb.setSheetPrintOptions(0, options), /gridLines getter/);
+
+    const headerFooter = {};
+    Object.defineProperty(headerFooter, 'oddHeader', {
+      enumerable: true,
+      get() {
+        throw new Error('oddHeader getter');
+      },
+    });
+    assert.throws(() => wb.setSheetHeaderFooter(0, headerFooter), /oddHeader getter/);
+    assert.equal(wb.getSheetHeaderFooterXml(0).xml, '');
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('nested print readers snapshot each stateful getter once', () => {
+  const wb = addon.Workbook.createDefault();
+  try {
+    assert.equal(wb.setSheetPageSetup(0, { paperSize: 42 }).ok, true);
+    let paperSizeReads = 0;
+    const firstPaperSize = {};
+    Object.defineProperty(firstPaperSize, 'paperSize', {
+      get() {
+        paperSizeReads += 1;
+        return paperSizeReads === 1 ? 9 : undefined;
+      },
+    });
+    assert.equal(wb.setSheetPageSetup(0, firstPaperSize).ok, true);
+    assert.equal(paperSizeReads, 1);
+    assert.equal(readSetup(wb).paperSize, 9);
+    assert.equal(readSetup(wb).paperSizeStated, true);
+
+    let omittedPaperSizeReads = 0;
+    const omittedPaperSize = {};
+    Object.defineProperty(omittedPaperSize, 'paperSize', {
+      get() {
+        omittedPaperSizeReads += 1;
+        return omittedPaperSizeReads === 1 ? undefined : 9;
+      },
+    });
+    assert.equal(wb.setSheetPageSetup(0, omittedPaperSize).ok, true);
+    assert.equal(omittedPaperSizeReads, 1);
+    assert.equal(readSetup(wb).paperSize, 9);
+    assert.equal(readSetup(wb).paperSizeStated, true);
+
+    let leftReads = 0;
+    const firstMargin = {};
+    Object.defineProperty(firstMargin, 'left', {
+      get() {
+        leftReads += 1;
+        return leftReads === 1 ? 0.75 : undefined;
+      },
+    });
+    assert.equal(wb.setSheetPageMargins(0, firstMargin).ok, true);
+    assert.equal(leftReads, 1);
+    assert.equal(readMargins(wb).left, 0.75);
+
+    let gridReads = 0;
+    const firstGrid = {};
+    Object.defineProperty(firstGrid, 'gridLines', {
+      get() {
+        gridReads += 1;
+        return gridReads === 1;
+      },
+    });
+    assert.equal(wb.setSheetPrintOptions(0, firstGrid).ok, true);
+    assert.equal(gridReads, 1);
+    assert.match(wb.getSheetPrintOptionsXml(0).xml, /gridLines="true"/);
+
+    let omittedGridReads = 0;
+    const omittedGrid = {};
+    Object.defineProperty(omittedGrid, 'gridLines', {
+      get() {
+        omittedGridReads += 1;
+        return omittedGridReads === 1 ? undefined : false;
+      },
+    });
+    assert.equal(wb.setSheetPrintOptions(0, omittedGrid).ok, true);
+    assert.equal(omittedGridReads, 1);
+    assert.match(wb.getSheetPrintOptionsXml(0).xml, /gridLines="true"/);
+
+    let headerFlagReads = 0;
+    const headerFlag = {};
+    Object.defineProperty(headerFlag, 'differentFirst', {
+      get() {
+        headerFlagReads += 1;
+        return headerFlagReads === 1;
+      },
+    });
+    assert.equal(wb.setSheetHeaderFooter(0, headerFlag).ok, true);
+    assert.equal(headerFlagReads, 1);
+    assert.match(wb.getSheetHeaderFooterXml(0).xml, /differentFirst="true"/);
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/nested_ui_validation.test.mjs b/packages/npm-native/test/nested_ui_validation.test.mjs
new file mode 100644
index 000000000..f6a063873
--- /dev/null
+++ b/packages/npm-native/test/nested_ui_validation.test.mjs
@@ -0,0 +1,167 @@
+import { spawnSync } from 'node:child_process';
+import test from 'node:test';
+import { assert, getModule, pkgRoot } from './smoke_support.mjs';
+
+const RANGE = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
+
+function statusOf(result) {
+  return typeof result.ok === 'boolean' ? result : result.status;
+}
+
+test('validation and merge range integers reject narrowing before mutation', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const before = wb.getValidations(0).length;
+    for (const value of [256, Number.NaN, Number.POSITIVE_INFINITY, 1.5, -1]) {
+      assert.throws(
+        () => wb.addValidation(0, { ranges: [RANGE], type: value }),
+        RangeError,
+        `validation type=${String(value)}`,
+      );
+      assert.equal(wb.getValidations(0).length, before);
+    }
+
+    assert.throws(
+      () => wb.addValidation(0, { ranges: [{ ...RANGE, firstRow: 2 ** 32 }] }),
+      RangeError,
+      'validation range firstRow',
+    );
+    assert.equal(wb.getValidations(0).length, before);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('filter kind is validated without aborting and date-group bytes do not wrap', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const before = wb.getAutoFilter(0).autoFilter;
+    assert.throws(
+      () =>
+        wb.setAutoFilter(0, {
+          range: RANGE,
+          columns: [{ colId: 0, kind: 1, dateGroups: [{ month: 257 }] }],
+        }),
+      RangeError,
+    );
+    assert.deepEqual(wb.getAutoFilter(0).autoFilter, before);
+
+    const keep = wb.setAutoFilter(0, { range: RANGE, columns: [{ colId: 0, kind: 0 }] });
+    assert.ok(statusOf(keep).ok, JSON.stringify(keep));
+    assert.equal(wb.getAutoFilter(0).autoFilter.columns[0].kind, 0);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('filter wrong primitive is caught in a child process instead of aborting Node', async () => {
+  await getModule();
+  const moduleUrl = new URL('../dist/index.mjs', import.meta.url).href;
+  const script = `
+    import mod from ${JSON.stringify(moduleUrl)};
+    const wb = mod.Workbook.createDefault();
+    try {
+      wb.setAutoFilter(0, { range: { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }, columns: [{ kind: 'bad' }] });
+      process.exitCode = 2;
+    } catch (error) {
+      if (!(error instanceof TypeError)) process.exitCode = 3;
+      else if (wb.getAutoFilter(0).autoFilter !== null) process.exitCode = 4;
+      else console.log('caught');
+    } finally {
+      wb.dispose();
+    }
+  `;
+  const child = spawnSync(process.execPath, ['--input-type=module', '--eval', script], {
+    cwd: pkgRoot,
+    encoding: 'utf8',
+  });
+  assert.equal(child.signal, null, `child signal=${child.signal}\n${child.stderr}`);
+  assert.equal(child.status, 0, `child status=${child.status}\n${child.stderr}`);
+  assert.match(child.stdout, /caught/);
+});
+
+test('threaded mention and image integer fields reject before C mutation', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const beforeComments = wb.getThreadedComments(0).comments.length;
+    assert.throws(
+      () =>
+        wb.addThreadedComment(0, {
+          id: '{AAAAAAAA-0000-0000-0000-000000000001}',
+          personId: '{11111111-1111-1111-1111-111111111111}',
+          row: 2 ** 32,
+          mentions: [{ personId: 'p', mentionId: 'm', start: 2 ** 32 }],
+        }),
+      RangeError,
+    );
+    assert.equal(wb.getThreadedComments(0).comments.length, beforeComments);
+
+    assert.throws(() => wb.insertImage(0, new Uint8Array([1, 2, 3]), { rowOffEmu: Number.NaN }), RangeError);
+    assert.equal(wb.listDrawingObjects(0).length, 0);
+
+    assert.doesNotThrow(() =>
+      wb.insertImage(0, new Uint8Array([1, 2, 3]), {
+        rowOffEmu: -(2 ** 63),
+        colOffEmu: 2 ** 63 - 1024,
+      }),
+    );
+
+    assert.throws(() => wb.insertImage(0, new Uint8Array([1, 2, 3]), { widthEmu: 2 ** 63 }), RangeError);
+    assert.equal(wb.listDrawingObjects(0).length, 0);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('UI reader stops at a throwing getter and leaves the workbook unchanged', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const filter = { range: RANGE, columns: [{}] };
+    Object.defineProperty(filter.columns[0], 'kind', {
+      enumerable: true,
+      get() {
+        throw new Error('filter getter');
+      },
+    });
+    assert.throws(() => wb.setAutoFilter(0, filter), /filter getter/);
+    assert.equal(wb.getAutoFilter(0).autoFilter, null);
+
+    const validation = { ranges: [RANGE] };
+    Object.defineProperty(validation, 'type', {
+      enumerable: true,
+      get() {
+        throw new Error('validation getter');
+      },
+    });
+    assert.throws(() => wb.addValidation(0, validation), /validation getter/);
+    assert.equal(wb.getValidations(0).length, 0);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('nullish UI fields retain their defaults', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const result = wb.setAutoFilter(0, {
+      range: { ...RANGE, lastCol: 1 },
+      columns: [
+        { colId: null, kind: undefined },
+        { colId: 1, kind: 1, dateGroups: [{ month: null }] },
+      ],
+      sort: null,
+    });
+    assert.ok(statusOf(result).ok, JSON.stringify(result));
+    const stored = wb.getAutoFilter(0).autoFilter;
+    assert.equal(stored.columns[0].colId, 0);
+    assert.equal(stored.columns[0].kind, 0);
+    assert.equal(stored.columns[1].dateGroups[0].month, 0);
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/smoke.test.mjs b/packages/npm-native/test/smoke.test.mjs
index 1efa6b505..ae25d6522 100644
--- a/packages/npm-native/test/smoke.test.mjs
+++ b/packages/npm-native/test/smoke.test.mjs
@@ -1,3727 +1,16 @@
-//
 // Smoke tests for the staged @libraz/formulon-native npm package.
-//
-// These tests intentionally import the *staged* dist/ artefacts (resolved
-// via the package's own package.json "main" field), not the raw build/
-// output. That way we catch staging mistakes -- missing files, wrong
-// relative paths, broken "exports" entries -- before the tarball ships.
-//
-// Run via `make node-test` (which runs `make node-package` first).
-
-import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-import test from 'node:test';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { inflateRawSync } from 'node:zlib';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const pkgRoot = path.resolve(__dirname, '..');
-const pkgJsonPath = path.join(pkgRoot, 'package.json');
-
-// Resolve the staged entry point through the package's own package.json
-// "main" field. Fails (rather than skips) if the package isn't staged --
-// that's the whole point of running these tests against dist/.
-async function loadStagedModule() {
-  const raw = await readFile(pkgJsonPath, 'utf8');
-  const pkg = JSON.parse(raw);
-  const main = pkg.main;
-  if (!main) {
-    throw new Error(`package.json is missing "main": ${pkgJsonPath}`);
-  }
-  const mainPath = path.resolve(pkgRoot, main);
-  // Node ESM requires file:// URLs for absolute paths on Windows;
-  // pathToFileURL is the portable form.
-  return import(pathToFileURL(mainPath).href);
-}
-
-let modPromise;
-function getModule() {
-  if (!modPromise) {
-    modPromise = loadStagedModule();
-  }
-  return modPromise;
-}
-
-function appendEmptyZipEntry(bytes, name) {
-  const input = new Uint8Array(bytes);
-  const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
-  let eocd = input.length - 22;
-  while (eocd >= 0 && view.getUint32(eocd, true) !== 0x06054b50) eocd -= 1;
-  assert.ok(eocd >= 0, 'missing ZIP end record');
-  const count = view.getUint16(eocd + 10, true);
-  const centralSize = view.getUint32(eocd + 12, true);
-  const centralOffset = view.getUint32(eocd + 16, true);
-  const encodedName = new TextEncoder().encode(name);
-  const u16 = (out, n) => out.push(n & 0xff, (n >>> 8) & 0xff);
-  const u32 = (out, n) => out.push(n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
-  const bytesTo = (out, source) => {
-    source.forEach((b) => {
-      out.push(b);
-    });
-  };
-  const local = [];
-  u32(local, 0x04034b50);
-  u16(local, 20);
-  u16(local, 0);
-  u16(local, 0);
-  u16(local, 0);
-  u16(local, 0);
-  u32(local, 0);
-  u32(local, 0);
-  u32(local, 0);
-  u16(local, encodedName.length);
-  u16(local, 0);
-  bytesTo(local, encodedName);
-  const central = [];
-  u32(central, 0x02014b50);
-  u16(central, 20);
-  u16(central, 20);
-  u16(central, 0);
-  u16(central, 0);
-  u16(central, 0);
-  u16(central, 0);
-  u32(central, 0);
-  u32(central, 0);
-  u32(central, 0);
-  u16(central, encodedName.length);
-  u16(central, 0);
-  u16(central, 0);
-  u16(central, 0);
-  u16(central, 0);
-  u32(central, 0);
-  u32(central, centralOffset);
-  bytesTo(central, encodedName);
-  const out = [];
-  bytesTo(out, input.slice(0, centralOffset));
-  bytesTo(out, local);
-  bytesTo(out, input.slice(centralOffset, centralOffset + centralSize));
-  bytesTo(out, central);
-  u32(out, 0x06054b50);
-  u16(out, 0);
-  u16(out, 0);
-  u16(out, count + 1);
-  u16(out, count + 1);
-  u32(out, centralSize + central.length);
-  u32(out, centralOffset + local.length);
-  u16(out, 0);
-  return Uint8Array.from(out);
-}
-
-test('default export exposes Workbook + evalFormula + version', async () => {
-  const mod = await getModule();
-  assert.equal(typeof mod.Workbook, 'function');
-  assert.equal(typeof mod.evalFormula, 'function');
-  assert.equal(typeof mod.version, 'function');
-  assert.equal(typeof mod.statusString, 'function');
-  assert.equal(typeof mod.ValueKind, 'object');
-  assert.equal(typeof mod.PivotCellKind, 'object');
-});
-
-test('all declared runtime constants resolve from the staged ESM entry point', async () => {
-  const mod = await getModule();
-  const declarations = await readFile(path.join(pkgRoot, 'index.d.ts'), 'utf8');
-  const names = [...declarations.matchAll(/^export const (\w+)/gm)].map((match) => match[1]);
-  assert.ok(names.length > 0, 'expected runtime constant declarations');
-  for (const name of names) {
-    assert.ok(name in mod, `missing runtime export declared in index.d.ts: ${name}`);
-  }
-  assert.equal(mod.PivotAxis.Row, 0);
-  assert.equal(mod.PIVOT_SHOW_AS_BASE_PREVIOUS, 1048828);
-  // Named constants a consumer needs in order to interpret shared record
-  // fields (`Value.errorCode`, `ExternalLinkRecord.kind`) or to drive the
-  // calc policy. The WASM package exports the same names and ordinals;
-  // `check_binding_drift dts-enums` holds the two in step.
-  assert.equal(mod.ErrorCode.Div0, 1);
-  assert.equal(mod.ErrorCode.Unknown, 16);
-  assert.equal(mod.CalcMode.Manual, 1);
-  assert.equal(mod.ExternalLinkKind.Dde, 3);
-  for (const name of ['ErrorCode', 'CalcMode', 'ExternalLinkKind']) {
-    assert.ok(Object.isFrozen(mod[name]), `${name} must be frozen`);
-  }
-});
-
-test('default export type and runtime default export declare the same keys', async () => {
-  const mod = await getModule();
-  const declarations = await readFile(path.join(pkgRoot, 'index.d.ts'), 'utf8');
-  const typeBlock = declarations.match(/declare const _default: \{([\s\S]*?)\n\};/);
-  assert.ok(typeBlock, 'expected a `declare const _default: {...}` block in index.d.ts');
-  const declared = new Set([...typeBlock[1].matchAll(/^\s{2}(\w+):/gm)].map((match) => match[1]));
-  const runtime = new Set(Object.keys(mod.default));
-  const missingFromType = [...runtime].filter((key) => !declared.has(key));
-  const missingFromRuntime = [...declared].filter((key) => !runtime.has(key));
-  assert.deepEqual(missingFromType, [], 'runtime default export keys absent from the _default type');
-  assert.deepEqual(missingFromRuntime, [], '_default type keys absent from the runtime default export');
-  assert.equal(mod.default.PivotAxis.Row, 0);
-  assert.equal(typeof mod.default.errorDisplayName, 'function');
-});
-
-test('every named export is reachable through the default export', async () => {
-  const mod = await getModule();
-  const named = Object.keys(mod).filter((key) => key !== 'default');
-  const missing = named.filter((key) => !(key in mod.default));
-  assert.deepEqual(missing, [], 'named exports absent from the default export object');
-});
-
-test('setLogMinLevel is a module-level control and validates its ordinal', async () => {
-  const mod = await getModule();
-  assert.equal(typeof mod.setLogMinLevel, 'function');
-  assert.equal(typeof mod.setLogSink, 'function');
-  // Process-wide state, so it must not be a Workbook method.
-  const wb = mod.Workbook.createDefault();
-  assert.equal(typeof wb.setLogMinLevel, 'undefined');
-  wb.dispose();
-
-  for (const level of Object.values(mod.LogLevel)) {
-    assert.ok(mod.setLogMinLevel(level).ok, `level=${level}`);
-  }
-  for (const bad of [-1, 5, 99]) {
-    const r = mod.setLogMinLevel(bad);
-    assert.equal(r.ok, false, `level=${bad} should be rejected`);
-    assert.equal(r.status, 2);
-  }
-  assert.ok(mod.setLogMinLevel(mod.LogLevel.Off).ok);
-});
-
-test('setLogSink accepts a function and null, and rejects a non-function', async () => {
-  const mod = await getModule();
-  assert.ok(mod.setLogSink(() => {}).ok);
-  assert.ok(mod.setLogSink(null).ok);
-  assert.ok(mod.setLogSink().ok);
-  const bad = mod.setLogSink(42);
-  assert.equal(bad.ok, false);
-  assert.equal(bad.status, 7001);
-  assert.ok(mod.setLogSink(null).ok);
-});
-
-// Sink delivery goes through a thread-safe function, so records land on a
-// later turn of the libuv loop rather than inside the native call. Poll
-// with a bounded budget instead of guessing a single turn.
-const SINK_SETTLE_MS = 500;
-
-async function waitForRecords(records, wanted) {
-  const deadline = Date.now() + SINK_SETTLE_MS;
-  while (records.length < wanted && Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, 5));
-  }
-  return records;
-}
-
-test('a registered sink receives the record as raw bytes', async () => {
-  const mod = await getModule();
-  const records = [];
-  assert.ok(mod.setLogSink((record) => records.push(record)).ok);
-  assert.ok(mod.setLogMinLevel(mod.LogLevel.Warn).ok);
-  try {
-    const wb = mod.Workbook.createDefault();
-    // A structured reference the XLSB encoder cannot lower,
-    // which makes the writer emit a per-cell warn record.
-    assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
-    assert.ok(wb.recalc().ok);
-    assert.ok(wb.saveAs(mod.WorkbookFormat.Xlsb).status.ok);
-    wb.dispose();
-    await waitForRecords(records, 1);
-    assert.ok(records.length > 0, 'expected at least one record');
-    for (const record of records) {
-      assert.ok(ArrayBuffer.isView(record), 'record must be a byte view');
-    }
-    const text = records.map((r) => new TextDecoder().decode(r)).join('');
-    assert.match(text, /xlsb\.writer\.formula_downgraded/);
-    assert.match(text, /"level":"warn"/);
-  } finally {
-    assert.ok(mod.setLogMinLevel(mod.LogLevel.Off).ok);
-    assert.ok(mod.setLogSink(null).ok);
-  }
-});
-
-test('the default threshold delivers nothing to a registered sink', async () => {
-  const mod = await getModule();
-  const records = [];
-  assert.ok(mod.setLogSink((record) => records.push(record)).ok);
-  try {
-    const wb = mod.Workbook.createDefault();
-    assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
-    assert.ok(wb.recalc().ok);
-    assert.ok(wb.saveAs(mod.WorkbookFormat.Xlsb).status.ok);
-    wb.dispose();
-    // Wait the same budget the positive case needs, so silence here is a
-    // result rather than an artefact of not having waited long enough.
-    await new Promise((resolve) => setTimeout(resolve, SINK_SETTLE_MS));
-    assert.deepEqual(records, []);
-  } finally {
-    assert.ok(mod.setLogSink(null).ok);
-  }
-});
-
-test('a throwing log sink does not leave a pending exception at the ThreadSafeFunction boundary', async () => {
-  const mod = await getModule();
-  let calls = 0;
-  assert.ok(
-    mod.setLogSink(() => {
-      calls += 1;
-      throw new Error('sink failure');
-    }).ok,
-  );
-  assert.ok(mod.setLogMinLevel(mod.LogLevel.Warn).ok);
-  try {
-    const wb = mod.Workbook.createDefault();
-    assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
-    assert.ok(wb.recalc().ok);
-    assert.ok(wb.saveAs(mod.WorkbookFormat.Xlsb).status.ok);
-    wb.dispose();
-    // Wait for the ThreadSafeFunction drain to run the sink.
-    await new Promise((resolve) => setTimeout(resolve, SINK_SETTLE_MS));
-    assert.ok(calls > 0, 'expected the sink to have been invoked');
-  } finally {
-    assert.ok(mod.setLogMinLevel(mod.LogLevel.Off).ok);
-    assert.ok(mod.setLogSink(null).ok);
-  }
-
-  // An uncaught exception at the drain boundary would have crashed the
-  // process by now; the engine must still be usable afterwards.
-  const wb2 = mod.Workbook.createDefault();
-  try {
-    assert.ok(wb2.setFormula(0, 0, 0, '=1+1').ok);
-    assert.ok(wb2.recalc().ok);
-    assert.equal(wb2.getValue(0, 0, 0).value.number, 2);
-  } finally {
-    wb2.dispose();
-  }
-});
-
-test('memoryUsage and the Python wheel agree that the estimate grows', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const empty = wb.memoryUsage();
-  for (let row = 0; row < 2000; row += 1) {
-    wb.setNumber(0, row, 0, row);
-  }
-  assert.ok(wb.memoryUsage() > empty);
-  wb.dispose();
-});
-
-// Parses the staged `export const X: Readonly<{ A: 0; ... }>` declarations
-// into {name: {member: ordinal}}. Name presence alone is not enough: a
-// staged bundle carrying a stale ordinal ships a constant that silently
-// means something else, and nothing upstream of dist/ can see that.
-function declaredOrdinalTables(dts) {
-  const tables = {};
-  const blocks = dts.matchAll(/^export const (\w+): Readonly<\{([^}]*)\}>;/gm);
-  for (const [, name, body] of blocks) {
-    const members = {};
-    for (const [, member, value] of body.matchAll(/(\w+):\s*(-?\d+)/g)) {
-      members[member] = Number(value);
-    }
-    tables[name] = members;
-  }
-  return tables;
-}
-
-test('staged constant tables carry the ordinals the staged .d.ts declares', async () => {
-  const mod = await getModule();
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
-  const tables = declaredOrdinalTables(dts);
-  assert.ok(Object.keys(tables).length > 0, 'expected declared ordinal tables');
-  for (const [name, members] of Object.entries(tables)) {
-    const runtime = mod[name];
-    assert.ok(runtime, `missing runtime table ${name}`);
-    assert.deepEqual({ ...runtime }, members, `${name} ordinals differ from dist/index.d.ts`);
-    assert.ok(Object.isFrozen(runtime), `${name} must be frozen`);
-  }
-});
-
-test('version() returns a non-empty string', async () => {
-  const mod = await getModule();
-  const v = mod.version();
-  assert.equal(typeof v, 'string');
-  assert.ok(v.length > 0, `expected non-empty version, got ${JSON.stringify(v)}`);
-});
-
-test('errorDisplayName returns Excel literals', async () => {
-  const mod = await getModule();
-  assert.equal(mod.errorDisplayName(1), '#DIV/0!');
-  assert.equal(mod.errorDisplayName(999), '#UNKNOWN!');
-});
-
-// One-shot evaluation is anchored at Sheet1!A1 and read-only on every
-// shipped surface, so these must agree value-for-value with the WASM
-// package and the Python wheel. The anchor-referencing cases are the ones
-// that diverge if a surface writes the formula into A1 and recalcs.
-const ONE_SHOT_CASES = [
-  { formula: '=1+2', kind: 1, number: 3 },
-  { formula: '=A1', kind: 1, number: 0 },
-  { formula: '=COUNTA(A1)', kind: 1, number: 0 },
-  { formula: '=ISBLANK(A1)', kind: 2, boolean: 1 },
-  { formula: '=SUM(A1:A3)', kind: 1, number: 0 },
-  { formula: '=SEQUENCE(3)', kind: 1, number: 1 },
-  { formula: '=ROWS(SEQUENCE(3))', kind: 1, number: 3 },
-];
-test('evalFormula evaluates read-only against a blank anchor', async () => {
-  const mod = await getModule();
-  for (const spec of ONE_SHOT_CASES) {
-    const r = mod.evalFormula(spec.formula);
-    assert.ok(r.status.ok, `${spec.formula}: ${JSON.stringify(r.status)}`);
-    assert.equal(r.value.kind, spec.kind, spec.formula);
-    if (spec.number !== undefined) {
-      assert.equal(r.value.number, spec.number, spec.formula);
-    }
-    if (spec.boolean !== undefined) {
-      assert.equal(r.value.boolean, spec.boolean, spec.formula);
-    }
-    // Writing into the anchor and recalcing would make these #REF!.
-    assert.equal(r.value.errorCode, 0, spec.formula);
-  }
-});
-
-test("evalFormula('=1+2') returns NUMBER 3", async () => {
-  const mod = await getModule();
-  const r = mod.evalFormula('=1+2');
-  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-  assert.equal(r.value.kind, mod.ValueKind.Number);
-  assert.equal(r.value.number, 3);
-});
-
-test("evalFormula('=#REF!') surfaces ERROR value (not failed status)", async () => {
-  const mod = await getModule();
-  const r = mod.evalFormula('=#REF!');
-  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-  assert.equal(r.value.kind, mod.ValueKind.Error);
-});
-
-test('Workbook.createDefault + setNumber + getValue round-trip', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.equal(wb.sheetCount().value, 1);
-  const setRc = wb.setNumber(0, 0, 0, 42);
-  assert.ok(setRc.ok, `setNumber: ${JSON.stringify(setRc)}`);
-  const r = wb.getValue(0, 0, 0);
-  assert.ok(r.status.ok, `getValue: ${JSON.stringify(r.status)}`);
-  assert.equal(r.value.kind, mod.ValueKind.Number);
-  assert.equal(r.value.number, 42);
-});
-
-test('paginate exposes a status envelope and page geometry', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Asserts the envelope's shape, not the page geometry: how many rows fit a
-  // page is the print engine's business and is pinned by the native print
-  // suite against Excel. Row 400 is far enough down to force a break under
-  // any plausible body height.
-  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-  assert.ok(wb.setNumber(0, 400, 0, 2).ok);
-  const result = wb.paginate(0);
-  assert.ok(result.status.ok, `paginate: ${JSON.stringify(result.status)}`);
-  assert.ok(result.pageCount >= 2, `pageCount: ${result.pageCount}`);
-  assert.deepEqual(result.printArea, []);
-  assert.ok(result.horizontalBreaks.length > 0);
-  assert.deepEqual(
-    result.horizontalBreaks,
-    [...new Set(result.horizontalBreaks)].sort((a, b) => a - b),
-  );
-  assert.deepEqual(result.verticalBreaks, []);
-});
-
-test('print settings: raw XML round-trips and rejects malformed fragments', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // An absent element reads back as the empty string, never null.
-  assert.equal(wb.getSheetPageSetupXml(0).xml, '');
-
-  const fragment = '<pageSetup paperSize="9" orientation="portrait" scale="85"/>';
-  assert.ok(wb.setSheetPageSetupXml(0, fragment).ok);
-  assert.equal(wb.getSheetPageSetupXml(0).xml, fragment);
-
-  // Two top-level elements, the wrong root name, and a truncated fragment
-  // are all rejected at set time rather than producing a file Excel repairs.
-  for (const bad of ['<pageSetup/><pageSetup/>', '<pageMargins left="1"/>', '<pageSetup orientation="portrait"']) {
-    const rejected = wb.setSheetPageSetupXml(0, bad);
-    assert.equal(rejected.ok, false, `expected rejection for ${bad}`);
-  }
-  assert.equal(wb.getSheetPageSetupXml(0).xml, fragment);
-
-  // The empty string removes the element and restores the defaults.
-  assert.ok(wb.setSheetPageSetupXml(0, '').ok);
-  assert.equal(wb.getSheetPageSetupXml(0).xml, '');
-  const cleared = wb.getSheetPageSetup(0);
-  assert.ok(cleared.status.ok);
-  assert.equal(cleared.scale, 100);
-  assert.equal(cleared.scaleStated, false);
-});
-
-test('print settings: typed patch touches only the keys it states', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(
-    wb.setSheetPageSetupXml(0, '<pageSetup paperSize="9" orientation="portrait" horizontalDpi="600" copies="3"/>').ok,
-  );
-  assert.ok(wb.setSheetPageSetup(0, { orientation: 2 }).ok);
-
-  const xml = wb.getSheetPageSetupXml(0).xml;
-  assert.match(xml, /orientation="landscape"/);
-  // Attributes the engine does not model must survive a patch.
-  assert.match(xml, /horizontalDpi="600"/);
-  assert.match(xml, /copies="3"/);
-  assert.match(xml, /paperSize="9"/);
-
-  const read = wb.getSheetPageSetup(0);
-  assert.ok(read.status.ok);
-  assert.equal(read.orientation, 2);
-  assert.equal(read.paperSize, 9);
-  assert.equal(read.orientationStated, true);
-
-  assert.ok(wb.setSheetPageMargins(0, { left: 0.25, top: 1.5 }).ok);
-  const margins = wb.getSheetPageMargins(0);
-  assert.ok(margins.status.ok);
-  assert.equal(margins.left, 0.25);
-  assert.equal(margins.leftStated, true);
-  // An unstated margin reports the OOXML default with its flag clear.
-  assert.equal(margins.right, 0.7);
-  assert.equal(margins.rightStated, false);
-});
-
-test('print settings: fitToPage keeps the rest of sheetPr', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setSheetSheetPrXml(0, '<sheetPr codeName="Sheet1"><tabColor rgb="FFFF0000"/></sheetPr>').ok);
-  assert.ok(wb.setSheetFitToPage(0, true).ok);
-  const xml = wb.getSheetSheetPrXml(0).xml;
-  assert.match(xml, /codeName="Sheet1"/);
-  assert.match(xml, /<tabColor rgb="FFFF0000"\/>/);
-  assert.match(xml, /fitToPage="true"/);
-});
-
-test('print settings: header/footer sections take decoded text', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setSheetHeaderFooter(0, { oddHeader: '&C\u5e33\u7968', oddFooter: '&R&P / &N' }).ok);
-  // The codes reach the file escaped; a parser hands back `&C...`.
-  assert.equal(
-    wb.getSheetHeaderFooterXml(0).xml,
-    '<headerFooter><oddHeader>&amp;C\u5e33\u7968</oddHeader><oddFooter>&amp;R&amp;P / &amp;N</oddFooter></headerFooter>',
-  );
-
-  // Omitting a key leaves that section alone; an empty string clears it.
-  assert.ok(wb.setSheetHeaderFooter(0, { oddFooter: '' }).ok);
-  assert.equal(
-    wb.getSheetHeaderFooterXml(0).xml,
-    '<headerFooter><oddHeader>&amp;C\u5e33\u7968</oddHeader></headerFooter>',
-  );
-});
-
-test('print settings: print area, titles and manual breaks', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setSheetPrintArea(0, 'A1:F8').ok);
-  assert.equal(wb.getSheetPrintArea(0).ranges, 'A1:F8');
-  assert.equal(wb.setSheetPrintArea(0, 'not-a-range').ok, false);
-  assert.equal(wb.getSheetPrintArea(0).ranges, 'A1:F8');
-  assert.ok(wb.setSheetPrintArea(0, '').ok);
-  assert.equal(wb.getSheetPrintArea(0).ranges, '');
-
-  assert.ok(wb.setSheetPrintTitles(0, '1:2', 'A:A').ok);
-  const titles = wb.getSheetPrintTitles(0);
-  assert.equal(titles.repeatRows, '1:2');
-  assert.equal(titles.repeatCols, 'A:A');
-
-  assert.ok(wb.addSheetRowBreak(0, 40, true).ok);
-  assert.ok(wb.addSheetRowBreak(0, 10, true).ok);
-  const breaks = wb.getSheetRowBreaks(0);
-  assert.ok(breaks.status.ok);
-  // Kept sorted by index regardless of insertion order.
-  assert.deepEqual(
-    breaks.breaks.map((b) => b.id),
-    [10, 40],
-  );
-  assert.equal(breaks.breaks[0].max, 16383);
-  assert.equal(breaks.breaks[0].manual, true);
-
-  assert.ok(wb.removeSheetRowBreak(0, 10).ok);
-  assert.equal(wb.getSheetRowBreaks(0).breaks.length, 1);
-  assert.ok(wb.clearSheetBreaks(0).ok);
-  assert.equal(wb.getSheetRowBreaks(0).breaks.length, 0);
-});
-
-test('print settings: a change is visible to paginate without a save cycle', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  for (let row = 0; row < 200; row += 1) {
-    for (let col = 0; col < 20; col += 1) {
-      assert.ok(wb.setNumber(0, row, col, 1).ok);
-    }
-  }
-  const portrait = wb.paginate(0).pageCount;
-  assert.ok(wb.setSheetPageSetup(0, { orientation: 2 }).ok);
-  assert.notEqual(wb.paginate(0).pageCount, portrait);
-});
-
-test('setRangeXfIndex applies one xf across a rectangle', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const border = wb.addBorder({
-    left: { style: 1, colorArgb: 0xff000000 },
-    right: { style: 1, colorArgb: 0xff000000 },
-    top: { style: 1, colorArgb: 0xff000000 },
-    bottom: { style: 1, colorArgb: 0xff000000 },
-    diagonal: { style: 0, colorArgb: 0 },
-    diagonalUp: false,
-    diagonalDown: false,
-  });
-  assert.ok(border.status.ok);
-  const xf = wb.addXf({ fontIndex: 0, fillIndex: 0, borderIndex: border.index, numFmtId: 0 });
-  assert.ok(xf.status.ok);
-
-  assert.ok(wb.setRangeXfIndex(0, 0, 0, 2, 2, xf.index).ok);
-  // Every cell in the rectangle is materialised, including ones that held
-  // no value, so the box renders.
-  for (const [row, col] of [
-    [0, 0],
-    [1, 1],
-    [2, 2],
-  ]) {
-    assert.equal(wb.getCellXfIndex(0, row, col).xfIndex, xf.index);
-  }
-  assert.equal(wb.getCellXfIndex(0, 3, 3).xfIndex, 0);
-});
-
-test('pivotCount + pivotLayout expose PivotTable projection status', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.equal(wb.pivotCount(0).value, 0);
-
-  const missing = wb.pivotLayout(0, 0);
-  assert.equal(missing.status.ok, false);
-  assert.notEqual(missing.status.status, 0);
-  assert.equal(missing.top, 0);
-  assert.equal(missing.left, 0);
-  assert.equal(missing.rows, 0);
-  assert.equal(missing.cols, 0);
-  assert.deepEqual(missing.cells, []);
-});
-
-test("Workbook.createDefault + setFormula '=1+2' + recalc -> 3", async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setFormula(0, 0, 0, '=1+2').ok);
-  assert.ok(wb.recalc().ok);
-  const r = wb.getValue(0, 0, 0);
-  assert.ok(r.status.ok);
-  assert.equal(r.value.kind, mod.ValueKind.Number);
-  assert.equal(r.value.number, 3);
-});
-
-test('recalcParallel evaluates a wide DAG and reports bounded telemetry', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const width = 128;
-  for (let row = 0; row < width; row += 1) {
-    assert.ok(wb.setNumber(0, row, 0, row + 1).ok);
-    assert.ok(wb.setFormula(0, row, 1, `=A${row + 1}*2`).ok);
-  }
-
-  const serial = wb.recalcParallel(1);
-  assert.ok(serial.status.ok, `recalcParallel(1): ${JSON.stringify(serial.status)}`);
-  assert.equal(serial.stats.workerThreadsStarted, 0);
-  assert.equal(serial.stats.workerThreadsUsed, 0);
-  assert.equal(serial.stats.cellsEvaluated, width);
-  for (let row = 0; row < width; row += 1) {
-    const value = wb.getValue(0, row, 1);
-    assert.ok(value.status.ok, `serial value row ${row}: ${JSON.stringify(value.status)}`);
-    assert.equal(value.value.kind, mod.ValueKind.Number);
-    assert.equal(value.value.number, (row + 1) * 2);
-  }
-
-  for (let row = 0; row < width; row += 1) {
-    assert.ok(wb.setNumber(0, row, 0, row + 2).ok);
-  }
-  const parallel = wb.recalcParallel(8);
-  assert.ok(parallel.status.ok, `recalcParallel(8): ${JSON.stringify(parallel.status)}`);
-  if (parallel.stats.workerThreadsStarted <= 1) {
-    assert.equal(parallel.stats.workerThreadsUsed, 0);
-    assert.equal(parallel.stats.parallelSteps, 0);
-    assert.ok(parallel.stats.serialFallbackSteps > 0, `expected serial fallback: ${JSON.stringify(parallel)}`);
-  } else {
-    assert.ok(parallel.stats.parallelSteps > 0, `expected parallel steps: ${JSON.stringify(parallel)}`);
-    assert.ok(parallel.stats.workerThreadsUsed > 0, `expected an effective worker: ${JSON.stringify(parallel)}`);
-    assert.ok(parallel.stats.workerThreadsStarted <= 8);
-    assert.ok(parallel.stats.workerThreadsUsed <= parallel.stats.workerThreadsStarted);
-  }
-  assert.equal(parallel.stats.cellsEvaluated, width);
-  for (let row = 0; row < width; row += 1) {
-    const value = wb.getValue(0, row, 1);
-    assert.ok(value.status.ok, `parallel value row ${row}: ${JSON.stringify(value.status)}`);
-    assert.equal(value.value.kind, mod.ValueKind.Number);
-    assert.equal(value.value.number, (row + 2) * 2);
-  }
-
-  const assertInvalid = (input, label) => {
-    const invalid = input === undefined ? wb.recalcParallel() : wb.recalcParallel(input);
-    assert.equal(invalid.status.ok, false, label);
-    assert.notEqual(invalid.status.status, 0, label);
-    assert.equal(invalid.stats.cellsEvaluated, 0, label);
-    assert.equal(invalid.stats.sccsProcessed, 0, label);
-    assert.equal(invalid.stats.parallelSteps, 0, label);
-    assert.equal(invalid.stats.serialFallbackSteps, 0, label);
-    assert.equal(invalid.stats.cycleRecoveries, 0, label);
-    assert.equal(invalid.stats.workerThreadsStarted, 0, label);
-    assert.equal(invalid.stats.workerThreadsUsed, 0, label);
-    return invalid;
-  };
-  assertInvalid(undefined, 'missing threadCount');
-  assertInvalid(null, 'null threadCount');
-  assertInvalid(NaN, 'NaN threadCount');
-  assertInvalid(Infinity, 'Infinity threadCount');
-  assertInvalid(-Infinity, '-Infinity threadCount');
-  assertInvalid(1.5, 'fractional threadCount');
-  assertInvalid(-1, 'negative threadCount');
-  // Rejected by the binding itself, before any C ABI call: the message is
-  // binding-authored and the context is empty, never a value built from
-  // the threadCount the caller passed (the Status contract's promise for
-  // a binding-raised failure).
-  const invalid = assertInvalid(9, 'threadCount above cap');
-  assert.equal(invalid.status.message, 'recalcParallel: `threadCount` must be an integer in 0..8');
-  assert.equal(invalid.status.context, '');
-  wb.dispose();
-});
-
-test("evaluateFormulaArray('=SEQUENCE(2,3)') returns a 2x3 grid", async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const r = wb.evaluateFormulaArray(0, 0, 0, '=SEQUENCE(2,3)');
-  assert.ok(r.status.ok);
-  assert.equal(r.rows, 2);
-  assert.equal(r.cols, 3);
-  assert.equal(r.cells.length, 2);
-  assert.equal(r.cells[0].length, 3);
-  // Row-major 1..6.
-  assert.equal(r.cells[0][0].kind, mod.ValueKind.Number);
-  assert.equal(r.cells[0][0].number, 1);
-  assert.equal(r.cells[1][2].number, 6);
-});
-
-test("evaluateFormulaArray('=1+2') reports a 1x1 scalar array", async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const r = wb.evaluateFormulaArray(0, 0, 0, '=1+2');
-  assert.ok(r.status.ok);
-  assert.equal(r.rows, 1);
-  assert.equal(r.cols, 1);
-  assert.equal(r.cells[0][0].kind, mod.ValueKind.Number);
-  assert.equal(r.cells[0][0].number, 3);
-});
-
-test('Workbook.createEmpty + addSheet -> sheetCount/sheetName work', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createEmpty();
-  assert.ok(wb.addSheet('Sheet1').ok);
-  assert.equal(wb.sheetCount().value, 1);
-  const sn = wb.sheetName(0);
-  assert.ok(sn.status.ok);
-  assert.equal(sn.value, 'Sheet1');
-});
-
-test('Unicode sheet identity rejects folded duplicate and permits casing rename', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createEmpty();
-  assert.ok(wb.addSheet('Ä').ok);
-  assert.ok(wb.addSheet('Ö').ok);
-  assert.equal(wb.addSheet('ä').ok, false);
-  const collision = wb.renameSheet(1, 'ä');
-  assert.equal(collision.ok, false);
-  assert.notEqual(collision.status, 0);
-  assert.equal(wb.sheetName(0).value, 'Ä');
-  assert.equal(wb.sheetName(1).value, 'Ö');
-  assert.ok(wb.renameSheet(0, 'ä').ok);
-  const sn = wb.sheetName(0);
-  assert.ok(sn.status.ok);
-  assert.equal(sn.value, 'ä');
-  assert.equal(wb.sheetName(1).value, 'Ö');
-  wb.dispose();
-});
-
-test('save() returns Uint8Array; loadBytes round-trips the value', async () => {
-  const mod = await getModule();
-  const wb1 = mod.Workbook.createDefault();
-  assert.ok(wb1.setNumber(0, 0, 0, 42).ok);
-  const sr = wb1.save();
-  assert.ok(sr.status.ok, `save: ${JSON.stringify(sr.status)}`);
-  assert.ok(sr.bytes instanceof Uint8Array, 'expected Uint8Array');
-  assert.ok(sr.bytes.length > 0, 'expected non-empty save buffer');
-
-  const wb2 = mod.Workbook.loadBytes(sr.bytes);
-  const r = wb2.getValue(0, 0, 0);
-  assert.ok(r.status.ok, `loaded getValue: ${JSON.stringify(r.status)}`);
-  assert.equal(r.value.kind, mod.ValueKind.Number);
-  assert.equal(r.value.number, 42);
-});
-
-test('loadBytes rejects invalid input with a fresh diagnostic', async () => {
-  const mod = await getModule();
-  const loaded = mod.Workbook.loadBytes(new Uint16Array([1]));
-  assert.equal(loaded.isValid(), false);
-  assert.match(mod.lastErrorMessage(), /NULL or empty input/);
-});
-
-// -- Expanded surface coverage -----------------------------------------
-// These tests exercise the methods the addon mirrors from the embind
-// binding. They are deliberately shallow: each call should round-trip
-// some observable state without crashing the Node process.
-
-test('isValid returns true for a live workbook', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.equal(wb.isValid(), true);
-});
-
-test('dispose deterministically releases a workbook and is idempotent', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.equal(wb.isValid(), true);
-  assert.equal(wb.dispose(), undefined);
-  assert.equal(wb.isValid(), false);
-  assert.equal(wb.getValue(0, 0, 0).status.ok, false);
-  assert.equal(wb.dispose(), undefined);
-});
-
-test('memoryUsage grows with the workbook and reads zero after dispose', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-
-  const empty = wb.memoryUsage();
-  assert.ok(empty > 0, `an empty workbook still owns storage, got ${empty}`);
-
-  // Distinct strings so the shared-string storage cannot fold them into
-  // one entry and hide the growth.
-  for (let row = 0; row < 2000; row += 1) {
-    wb.setText(0, row, 0, `payload-${row}-${'x'.repeat(64)}`);
-  }
-  const filled = wb.memoryUsage();
-  assert.ok(filled > empty, `expected growth, got ${empty} -> ${filled}`);
-
-  wb.dispose();
-  assert.equal(wb.memoryUsage(), 0);
-});
-
-test('memoryUsage is stable across repeated calls and survives a recalc', async () => {
-  // The external-memory report is computed as a delta against the last
-  // reported figure, so a repeated call on an unchanged workbook must be
-  // a no-op rather than double-counting, and the operations that trigger
-  // their own report must not disturb the estimate either.
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  for (let row = 0; row < 500; row += 1) {
-    wb.setFormula(0, row, 0, `=${row}+1`);
-  }
-
-  const first = wb.memoryUsage();
-  assert.equal(wb.memoryUsage(), first);
-
-  assert.equal(wb.recalc().ok, true);
-  const afterRecalc = wb.memoryUsage();
-  assert.ok(afterRecalc >= first, `recalc must not shrink the estimate: ${first} -> ${afterRecalc}`);
-  assert.equal(wb.memoryUsage(), afterRecalc);
-
-  wb.dispose();
-});
-
-test('Workbook factories return instances of the exported Workbook class', async () => {
-  const mod = await getModule();
-  const defaultBook = mod.Workbook.createDefault();
-  const emptyBook = mod.Workbook.createEmpty();
-  assert.ok(defaultBook instanceof mod.Workbook);
-  assert.ok(emptyBook instanceof mod.Workbook);
-});
-
-test('addMerge + getMerges round-trip a single range', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const range = { firstRow: 1, firstCol: 1, lastRow: 2, lastCol: 3 };
-  const ar = wb.addMerge(0, range);
-  assert.ok(ar.ok, `addMerge: ${JSON.stringify(ar)}`);
-  const list = wb.getMerges(0);
-  assert.ok(Array.isArray(list), `expected Array, got ${typeof list}`);
-  assert.equal(list.length, 1);
-  assert.deepEqual(
-    {
-      firstRow: list[0].firstRow,
-      firstCol: list[0].firstCol,
-      lastRow: list[0].lastRow,
-      lastCol: list[0].lastCol,
-    },
-    range,
-  );
-});
-
-test('addHyperlink + getHyperlinks round-trip', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.equal(wb.getHyperlinks(0).length, 0);
-  // Three entries with progressively more optional fields populated.
-  assert.ok(wb.addHyperlink(0, 1, 2, 'https://example.com/', '', '', '').ok);
-  assert.ok(wb.addHyperlink(0, 3, 4, 'mailto:hello@example.com', 'Hello', '', '').ok);
-  assert.ok(wb.addHyperlink(0, 5, 6, '', 'See X', 'Internal link', 'Sheet1!A1').ok);
-  assert.ok(wb.addHyperlinkRange(0, 7, 8, 9, 10, 'https://example.com/range', 'Range', 'Range tip', '').ok);
-  const list = wb.getHyperlinks(0);
-  assert.equal(list.length, 4);
-  assert.equal(list[0].row, 1);
-  assert.equal(list[0].col, 2);
-  assert.equal(list[0].lastRow, 1);
-  assert.equal(list[0].lastCol, 2);
-  assert.equal(list[0].target, 'https://example.com/');
-  assert.equal(list[0].display, '');
-  assert.equal(list[0].tooltip, '');
-  assert.equal(list[1].target, 'mailto:hello@example.com');
-  assert.equal(list[1].display, 'Hello');
-  assert.equal(list[2].display, 'See X');
-  assert.equal(list[2].tooltip, 'Internal link');
-  assert.equal(list[2].location, 'Sheet1!A1');
-  assert.deepEqual(
-    {
-      row: list[3].row,
-      col: list[3].col,
-      lastRow: list[3].lastRow,
-      lastCol: list[3].lastCol,
-      target: list[3].target,
-      display: list[3].display,
-      tooltip: list[3].tooltip,
-    },
-    {
-      row: 7,
-      col: 8,
-      lastRow: 9,
-      lastCol: 10,
-      target: 'https://example.com/range',
-      display: 'Range',
-      tooltip: 'Range tip',
-    },
-  );
-  // Sheet-out-of-range is rejected.
-  assert.ok(!wb.addHyperlink(999, 0, 0, 'https://x/', '', '', '').ok);
-  // clearHyperlinks drops everything.
-  assert.ok(wb.clearHyperlinks(0).ok);
-  assert.equal(wb.getHyperlinks(0).length, 0);
-});
-
-test('removeHyperlink / removeHyperlinkAt / clearHyperlinks surface on an empty sheet', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // No-op variants on an empty list still return kOk.
-  assert.ok(wb.removeHyperlink(0, 0, 0).ok);
-  assert.ok(wb.clearHyperlinks(0).ok);
-  // Out-of-range index is rejected.
-  assert.ok(!wb.removeHyperlinkAt(0, 0).ok);
-  // Sheet-index-out-of-range is rejected on every variant.
-  assert.ok(!wb.removeHyperlink(999, 0, 0).ok);
-  assert.ok(!wb.removeHyperlinkAt(999, 0).ok);
-  assert.ok(!wb.clearHyperlinks(999).ok);
-  // The hyperlink list is still empty afterwards.
-  assert.equal(wb.getHyperlinks(0).length, 0);
-});
-
-test('removeMerge + removeMergeAt + clearMerges step-wise prune the merge list', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const a = { firstRow: 0, firstCol: 0, lastRow: 1, lastCol: 1 };
-  const b = { firstRow: 4, firstCol: 4, lastRow: 5, lastCol: 5 };
-  assert.ok(wb.addMerge(0, a).ok);
-  assert.ok(wb.addMerge(0, b).ok);
-  // removeMerge with an overlap that hits `a` only.
-  const overlap = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
-  assert.ok(wb.removeMerge(0, overlap).ok);
-  let list = wb.getMerges(0);
-  assert.equal(list.length, 1);
-  assert.equal(list[0].firstRow, 4);
-  // removeMergeAt drops the survivor by index.
-  assert.ok(wb.removeMergeAt(0, 0).ok);
-  list = wb.getMerges(0);
-  assert.equal(list.length, 0);
-  // clearMerges is a no-op on an empty list and stays kOk.
-  assert.ok(wb.addMerge(0, a).ok);
-  assert.ok(wb.addMerge(0, b).ok);
-  assert.ok(wb.clearMerges(0).ok);
-  list = wb.getMerges(0);
-  assert.equal(list.length, 0);
-});
-
-test('setSheetZoom + getSheetView surface the new zoom', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setSheetZoom(0, 175).ok);
-  const v = wb.getSheetView(0);
-  assert.ok(v.status.ok, `getSheetView: ${JSON.stringify(v.status)}`);
-  assert.equal(v.view.zoomScale, 175);
-  // Default freeze / tab-hidden state survives a zoom change.
-  assert.equal(v.view.freezeRows, 0);
-  assert.equal(v.view.freezeCols, 0);
-  assert.equal(v.view.tabHidden, 0);
-});
-
-test('sheet layout getters preserve explicit width presence flags', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setColumnWidth(0, 0, 0, 0).ok);
-  assert.ok(wb.setColumnHidden(0, 1, 1, true).ok);
-  assert.ok(wb.setRowHeight(0, 3, 30).ok);
-
-  const columns = wb.getSheetColumns(0);
-  assert.ok(columns.status.ok, `getSheetColumns: ${JSON.stringify(columns.status)}`);
-  const widthZero = columns.columns.find((column) => column.first === 0 && column.last === 0);
-  assert.ok(widthZero);
-  assert.equal(widthZero.width, 0);
-  assert.equal(widthZero.hasWidth, 1);
-  assert.equal(widthZero.hasStyle, 0);
-  const hidden = columns.columns.find((column) => column.first === 1 && column.last === 1);
-  assert.ok(hidden);
-  assert.equal(hidden.hidden, 1);
-  assert.equal(hidden.hasWidth, 0);
-
-  const rows = wb.getSheetRowOverrides(0);
-  assert.ok(rows.status.ok, `getSheetRowOverrides: ${JSON.stringify(rows.status)}`);
-  const row = rows.rows.find((entry) => entry.row === 3);
-  assert.ok(row);
-  assert.equal(row.height, 30);
-  assert.equal(row.hasStyle, 0);
-  assert.equal(row.styleXf, 0);
-});
-
-test('getSheetView surfaces display / orientation defaults', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const v = wb.getSheetView(0);
-  assert.ok(v.status.ok, `getSheetView: ${JSON.stringify(v.status)}`);
-  assert.equal(v.view.showGridLines, 1);
-  assert.equal(v.view.showRowColHeaders, 1);
-  assert.equal(v.view.showZeros, 1);
-  assert.equal(v.view.rightToLeft, 0);
-  assert.equal(v.view.tabSelected, 0);
-  assert.equal(v.view.viewMode, '');
-});
-
-test('setSheetShowGridLines / setSheetRightToLeft / setSheetTabSelected / setSheetViewMode round-trip', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setSheetShowGridLines(0, false).ok);
-  assert.ok(wb.setSheetShowRowColHeaders(0, false).ok);
-  assert.ok(wb.setSheetShowZeros(0, false).ok);
-  assert.ok(wb.setSheetRightToLeft(0, true).ok);
-  assert.ok(wb.setSheetTabSelected(0, true).ok);
-  assert.ok(wb.setSheetViewMode(0, 'pageBreakPreview').ok);
-  const v = wb.getSheetView(0);
-  assert.ok(v.status.ok, `getSheetView: ${JSON.stringify(v.status)}`);
-  assert.equal(v.view.showGridLines, 0);
-  assert.equal(v.view.showRowColHeaders, 0);
-  assert.equal(v.view.showZeros, 0);
-  assert.equal(v.view.rightToLeft, 1);
-  assert.equal(v.view.tabSelected, 1);
-  assert.equal(v.view.viewMode, 'pageBreakPreview');
-});
-
-test('insertRows shifts an existing literal forward', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Populate row 0; insert one row at row 0; the literal is now at row 1.
-  assert.ok(wb.setNumber(0, 0, 0, 99).ok);
-  assert.ok(wb.insertRows(0, 0, 1).ok);
-  const r0 = wb.getValue(0, 0, 0);
-  assert.ok(r0.status.ok);
-  // The freshly-inserted row 0 is blank.
-  assert.equal(r0.value.kind, mod.ValueKind.Blank);
-  const r1 = wb.getValue(0, 1, 0);
-  assert.ok(r1.status.ok);
-  assert.equal(r1.value.kind, mod.ValueKind.Number);
-  assert.equal(r1.value.number, 99);
-});
-
-test('setCellXfIndex + getCellXfIndex round-trip the xf id', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Seed the cell so the xf attaches to a stored slot.
-  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-  // xfIndex 0 is always the default xf and is guaranteed to be valid.
-  assert.ok(wb.setCellXfIndex(0, 0, 0, 0).ok);
-  const r = wb.getCellXfIndex(0, 0, 0);
-  assert.ok(r.status.ok, `getCellXfIndex: ${JSON.stringify(r.status)}`);
-  assert.equal(typeof r.xfIndex, 'number');
-  assert.equal(r.xfIndex, 0);
-});
-
-test('style building blocks: addFont -> addXf -> setCellXfIndex -> getXf', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // A fresh workbook seeds Excel's minimum style table: one default font,
-  // one empty border, one default xf, and the two fills Excel reserves at
-  // the front of every file (`none`, `gray125`). A caller's first record
-  // therefore lands after them instead of displacing `none`.
-  assert.equal(wb.fontCount().value, 1);
-  assert.equal(wb.fillCount().value, 2);
-  assert.equal(wb.borderCount().value, 1);
-  assert.equal(wb.xfCount().value, 1);
-
-  const fontResult = wb.addFont({
-    name: 'Arial',
-    size: 12,
-    bold: true,
-    italic: false,
-    strike: false,
-    underline: 0,
-    colorArgb: 0xff112233,
-  });
-  assert.ok(fontResult.status.ok, `addFont: ${JSON.stringify(fontResult.status)}`);
-  // Linear-search dedup: the second call with the same payload returns the same index.
-  const fontDup = wb.addFont({
-    name: 'Arial',
-    size: 12,
-    bold: true,
-    italic: false,
-    strike: false,
-    underline: 0,
-    colorArgb: 0xff112233,
-  });
-  assert.equal(fontDup.index, fontResult.index);
-  assert.equal(wb.fontCount().value, 2);
-
-  const fill = wb.addFill({ pattern: 1, fgArgb: 0xffff0000, bgArgb: 0xff000000 });
-  assert.ok(fill.status.ok);
-  const border = wb.addBorder({
-    left: { style: 1, colorArgb: 0xff000000 },
-    right: { style: 1, colorArgb: 0xff000000 },
-    top: { style: 1, colorArgb: 0xff000000 },
-    bottom: { style: 1, colorArgb: 0xff000000 },
-    diagonal: { style: 0, colorArgb: 0 },
-    diagonalUp: false,
-    diagonalDown: false,
-  });
-  assert.ok(border.status.ok);
-
-  const builtin = wb.addNumFmt('General');
-  assert.ok(builtin.status.ok);
-  assert.equal(builtin.numFmtId, 0);
-
-  const custom = wb.addNumFmt('"USD" #,##0');
-  assert.ok(custom.status.ok);
-  assert.ok(custom.numFmtId >= 164, `expected custom id >= 164, got ${custom.numFmtId}`);
-
-  const xf = wb.addXf({
-    fontIndex: fontResult.index,
-    fillIndex: fill.index,
-    borderIndex: border.index,
-    numFmtId: custom.numFmtId,
-    horizontalAlign: 1,
-    verticalAlign: 2,
-    wrapText: true,
-  });
-  assert.ok(xf.status.ok, `addXf: ${JSON.stringify(xf.status)}`);
-
-  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-  assert.ok(wb.setCellXfIndex(0, 0, 0, xf.index).ok);
-
-  const reread = wb.getCellXf(xf.index);
-  assert.ok(reread.status.ok);
-  assert.equal(reread.fontIndex, fontResult.index);
-  assert.equal(reread.numFmtId, custom.numFmtId);
-  assert.equal(reread.wrapText, true);
-  assert.equal(reread.hasAlignment, true);
-  assert.equal(reread.hasHorizontalAlign, true);
-  assert.equal(reread.hasVerticalAlign, true);
-  assert.equal(reread.hasWrapText, true);
-  assert.equal(reread.hasJustifyLastLine, false);
-
-  const optional = wb.addXf({
-    fontIndex: fontResult.index,
-    fillIndex: fill.index,
-    borderIndex: border.index,
-    numFmtId: custom.numFmtId,
-    textRotation: 255,
-    indent: 0,
-    relativeIndent: -3,
-    shrinkToFit: false,
-    readingOrder: 0,
-    justifyLastLine: true,
-  });
-  assert.ok(optional.status.ok, `optional alignment: ${JSON.stringify(optional.status)}`);
-  const optionalRead = wb.getCellXf(optional.index);
-  assert.ok(optionalRead.status.ok);
-  assert.equal(optionalRead.textRotation, 255);
-  assert.equal(optionalRead.indent, 0);
-  assert.equal(optionalRead.relativeIndent, -3);
-  assert.equal(optionalRead.shrinkToFit, false);
-  assert.equal(optionalRead.readingOrder, 0);
-  assert.equal(optionalRead.justifyLastLine, true);
-  assert.equal(optionalRead.hasAlignment, true);
-  assert.equal(optionalRead.hasJustifyLastLine, true);
-  assert.equal(wb.addXf(optionalRead).index, optional.index);
-
-  const omitted = wb.addXf({
-    fontIndex: fontResult.index,
-    fillIndex: fill.index,
-    borderIndex: border.index,
-    numFmtId: custom.numFmtId,
-  });
-  assert.ok(omitted.status.ok);
-  const omittedRead = wb.getCellXf(omitted.index);
-  assert.ok(omittedRead.status.ok);
-  assert.equal(omittedRead.hasAlignment, false);
-
-  const explicitEmpty = wb.addXf({
-    fontIndex: fontResult.index,
-    fillIndex: fill.index,
-    borderIndex: border.index,
-    numFmtId: custom.numFmtId,
-    hasAlignment: true,
-  });
-  assert.ok(explicitEmpty.status.ok);
-  assert.notEqual(explicitEmpty.index, omitted.index);
-  const explicitEmptyRead = wb.getCellXf(explicitEmpty.index);
-  assert.ok(explicitEmptyRead.status.ok);
-  assert.equal(explicitEmptyRead.hasAlignment, true);
-
-  const rfont = wb.getFont(fontResult.index);
-  assert.ok(rfont.status.ok);
-  assert.equal(rfont.name, 'Arial');
-  assert.equal(rfont.bold, true);
-
-  const rfill = wb.getFill(fill.index);
-  assert.ok(rfill.status.ok);
-  assert.equal(rfill.pattern, 1);
-
-  const rborder = wb.getBorder(border.index);
-  assert.ok(rborder.status.ok);
-  assert.equal(rborder.left.style, 1);
-  assert.equal(rborder.diagonalUp, false);
-
-  const rfmt = wb.getNumFmt(custom.numFmtId);
-  assert.ok(rfmt.status.ok);
-  assert.equal(rfmt.formatCode, '"USD" #,##0');
-});
-
-test('selector colours survive get/add identity and save/load', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const theme = { kind: 2, rgb: 0, theme: 3, tint: 0.5, indexed: 0 };
-  const indexed = { kind: 3, rgb: 0, theme: 0, tint: 0, indexed: 9 };
-  const automatic = { kind: 4, rgb: 0, theme: 0, tint: 0, indexed: 0 };
-
-  const font = wb.addFont({ name: 'SelectorFont', size: 11, colorArgb: 0x01020304, color: theme });
-  assert.ok(font.status.ok);
-  const gotFont = wb.getFont(font.index);
-  assert.ok(gotFont.status.ok);
-  assert.equal(gotFont.color.kind, 2);
-  assert.equal(gotFont.color.theme, 3);
-  assert.equal(gotFont.color.tint, 0.5);
-  assert.equal(gotFont.colorArgb, 0x01020304);
-  const fontAgain = wb.addFont(gotFont);
-  assert.ok(fontAgain.status.ok);
-  assert.equal(fontAgain.index, font.index);
-
-  const fill = wb.addFill({
-    pattern: 1,
-    fgArgb: 0x05060708,
-    bgArgb: 0x090a0b0c,
-    fg: indexed,
-    bg: automatic,
-  });
-  assert.ok(fill.status.ok);
-  const gotFill = wb.getFill(fill.index);
-  assert.ok(gotFill.status.ok);
-  assert.equal(gotFill.fg.kind, 3);
-  assert.equal(gotFill.fg.indexed, 9);
-  assert.equal(gotFill.bg.kind, 4);
-  const fillAgain = wb.addFill(gotFill);
-  assert.ok(fillAgain.status.ok);
-  assert.equal(fillAgain.index, fill.index);
-
-  const border = wb.addBorder({
-    left: { style: 1, colorArgb: 0x01020304, color: theme },
-    right: { style: 1, colorArgb: 0x05060708, color: indexed },
-    top: { style: 1, colorArgb: 0x090a0b0c, color: automatic },
-    bottom: { style: 0, colorArgb: 0 },
-    diagonal: { style: 0, colorArgb: 0 },
-  });
-  assert.ok(border.status.ok);
-  const gotBorder = wb.getBorder(border.index);
-  assert.ok(gotBorder.status.ok);
-  assert.equal(gotBorder.left.color.kind, 2);
-  assert.equal(gotBorder.left.color.theme, 3);
-  assert.equal(gotBorder.right.color.kind, 3);
-  assert.equal(gotBorder.right.color.indexed, 9);
-  assert.equal(gotBorder.top.color.kind, 4);
-  const borderAgain = wb.addBorder(gotBorder);
-  assert.ok(borderAgain.status.ok);
-  assert.equal(borderAgain.index, border.index);
-
-  const dxf = wb.addDxf({
-    font: { name: 'DxfSelector', size: 9, colorArgb: 0x11121314, color: automatic },
-    fill: { pattern: 1, fgArgb: 0x15161718, fg: indexed },
-    border: { left: { style: 1, colorArgb: 0x191a1b1c, color: theme } },
-  });
-  assert.ok(dxf.status.ok);
-  const gotDxf = wb.getDxf(dxf.index);
-  assert.ok(gotDxf.status.ok);
-  assert.equal(gotDxf.font.color.kind, 4);
-  assert.equal(gotDxf.fill.fg.kind, 3);
-  assert.equal(gotDxf.border.left.color.kind, 2);
-  const dxfAgain = wb.addDxf(gotDxf);
-  assert.ok(dxfAgain.status.ok);
-  assert.equal(dxfAgain.index, dxf.index);
-
-  const saved = wb.save();
-  assert.ok(saved.status.ok);
-  const loaded = mod.Workbook.loadBytes(saved.bytes);
-  const loadedFont = loaded.getFont(font.index);
-  const loadedFill = loaded.getFill(fill.index);
-  const loadedBorder = loaded.getBorder(border.index);
-  const loadedDxf = loaded.getDxf(dxf.index);
-  assert.ok(loadedFont.status.ok);
-  assert.ok(loadedFill.status.ok);
-  assert.ok(loadedBorder.status.ok);
-  assert.ok(loadedDxf.status.ok);
-  assert.equal(loadedFont.color.kind, 2);
-  assert.equal(loadedFill.fg.kind, 3);
-  assert.equal(loadedBorder.left.color.kind, 2);
-  assert.equal(loadedDxf.font.color.kind, 4);
-  loaded.dispose();
-  wb.dispose();
-});
-
-test('dxf alignment and protection XML survive get/add identity and save/load', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const alignmentXml = '<alignment horizontal="center" wrapText="1"/>';
-  const protectionXml = '<protection locked="0" hidden="1"/>';
-  const alignment = wb.addDxf({ alignmentXml });
-  assert.ok(alignment.status.ok);
-  const protection = wb.addDxf({ protectionXml });
-  assert.ok(protection.status.ok);
-  assert.notEqual(alignment.index, protection.index);
-
-  const gotAlignment = wb.getDxf(alignment.index);
-  assert.ok(gotAlignment.status.ok);
-  assert.equal(gotAlignment.alignmentXml, alignmentXml);
-  assert.equal(gotAlignment.protectionXml, undefined);
-  const gotProtection = wb.getDxf(protection.index);
-  assert.ok(gotProtection.status.ok);
-  assert.equal(gotProtection.alignmentXml, undefined);
-  assert.equal(gotProtection.protectionXml, protectionXml);
-
-  const alignmentAgain = wb.addDxf(gotAlignment);
-  assert.ok(alignmentAgain.status.ok);
-  assert.equal(alignmentAgain.index, alignment.index);
-  const protectionAgain = wb.addDxf(gotProtection);
-  assert.ok(protectionAgain.status.ok);
-  assert.equal(protectionAgain.index, protection.index);
-
-  const saved = wb.save();
-  assert.ok(saved.status.ok);
-  const loaded = mod.Workbook.loadBytes(saved.bytes);
-  assert.ok(loaded.isValid());
-  const loadedAlignment = loaded.getDxf(alignment.index);
-  assert.ok(loadedAlignment.status.ok);
-  assert.equal(loadedAlignment.alignmentXml, alignmentXml);
-  assert.equal(loadedAlignment.protectionXml, undefined);
-  const loadedProtection = loaded.getDxf(protection.index);
-  assert.ok(loadedProtection.status.ok);
-  assert.equal(loadedProtection.alignmentXml, undefined);
-  assert.equal(loadedProtection.protectionXml, protectionXml);
-  const loadedAlignmentAgain = loaded.addDxf(loadedAlignment);
-  assert.ok(loadedAlignmentAgain.status.ok);
-  assert.equal(loadedAlignmentAgain.index, alignment.index);
-  const loadedProtectionAgain = loaded.addDxf(loadedProtection);
-  assert.ok(loadedProtectionAgain.status.ok);
-  assert.equal(loadedProtectionAgain.index, protection.index);
-  loaded.dispose();
-  wb.dispose();
-});
-
-test('addFont / getFont preserve superscript and round-trip to the same index', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const superscript = wb.addFont({ name: 'Arial', size: 12, vertAlign: 1, colorArgb: 0xff112233 });
-  assert.ok(superscript.status.ok, `addFont: ${JSON.stringify(superscript.status)}`);
-  assert.equal(wb.getFont(superscript.index).vertAlign, 1);
-
-  const before = wb.fontCount().value;
-  const again = wb.addFont(wb.getFont(superscript.index));
-  assert.ok(again.status.ok);
-  assert.equal(again.index, superscript.index);
-  assert.equal(wb.fontCount().value, before);
-
-  const edited = wb.getFont(superscript.index);
-  edited.colorArgb = 0xff00ff00;
-  const recolored = wb.addFont(edited);
-  assert.ok(recolored.status.ok);
-  assert.notEqual(recolored.index, superscript.index);
-  const reread = wb.getFont(recolored.index);
-  assert.equal(reread.vertAlign, 1);
-  assert.equal(reread.colorArgb, 0xff00ff00);
-});
-
-test('addFont/setFont with a non-numeric field throws and does not commit a coerced value', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-
-  const before = wb.fontCount().value;
-  assert.throws(() => wb.addFont({ name: 'Arial', size: 'not a number' }), TypeError);
-  assert.equal(wb.fontCount().value, before, 'no font must have been added for the rejected call');
-
-  const font = wb.addFont({ name: 'Arial', size: 12 });
-  assert.ok(font.status.ok);
-  assert.throws(() => wb.setFont(font.index, { name: 'Arial', size: 'not a number' }), TypeError);
-  // The font slot must still hold its original size, not a coerced 0.
-  assert.equal(wb.getFont(font.index).size, 12);
-});
-
-test('phonetic runs keep their spans through a save/load round trip', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  wb.setText(0, 0, 0, '東京都');
-  assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, []);
-
-  const runs = [
-    { sb: 0, eb: 2, text: 'トウキョウ' },
-    { sb: 2, eb: 3, text: 'ト' },
-  ];
-  const stored = wb.setCellPhoneticRuns(0, 0, 0, runs);
-  assert.ok(stored.ok, `setCellPhoneticRuns: ${JSON.stringify(stored)}`);
-  assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, runs);
-  // The flattening getter still reports the concatenation.
-  assert.equal(wb.getCellPhonetic(0, 0, 0).value, 'トウキョウト');
-
-  const saved = wb.save();
-  assert.ok(saved.status.ok, `save: ${JSON.stringify(saved.status)}`);
-  const loaded = mod.Workbook.loadBytes(saved.bytes);
-  assert.deepEqual(loaded.getCellPhoneticRuns(0, 0, 0).runs, runs);
-
-  // Writing the flattened reading back is the collapse the run API avoids.
-  wb.setCellPhonetic(0, 0, 0, 'トウキョウト');
-  assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, [{ sb: 0, eb: 3, text: 'トウキョウト' }]);
-
-  const rejected = wb.setCellPhoneticRuns(0, 0, 0, [
-    { sb: 2, eb: 3, text: 'ト' },
-    { sb: 0, eb: 2, text: 'トウ' },
-  ]);
-  assert.equal(rejected.ok, false);
-
-  loaded.dispose();
-  wb.dispose();
-});
-
-test('phonetic properties are independent of the runs and survive a round trip', async () => {
-  const mod = await getModule();
-  // The result carries a `status` alongside the triple; compare the triple
-  // alone so a status-shape change does not read as a value change.
-  const props = (book) => {
-    const { fontId, type, alignment } = book.getCellPhoneticProperties(0, 0, 0);
-    return { fontId, type, alignment };
-  };
-  const wb = mod.Workbook.createDefault();
-  wb.setText(0, 0, 0, '大阪');
-  assert.deepEqual(props(wb), { fontId: 0, type: 0, alignment: 0 });
-
-  assert.ok(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 3, type: 2, alignment: 2 }).ok);
-  // Setting the readings must not reset the rendering.
-  assert.ok(wb.setCellPhoneticRuns(0, 0, 0, [{ sb: 0, eb: 2, text: 'おおさか' }]).ok);
-  assert.deepEqual(props(wb), { fontId: 3, type: 2, alignment: 2 });
-
-  const saved = wb.save();
-  assert.ok(saved.status.ok, `save: ${JSON.stringify(saved.status)}`);
-  const loaded = mod.Workbook.loadBytes(saved.bytes);
-  assert.deepEqual(props(loaded), { fontId: 3, type: 2, alignment: 2 });
-
-  // Two bits each on the binary side, so a wider ordinal is refused.
-  assert.equal(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 0, type: 4, alignment: 0 }).ok, false);
-  assert.deepEqual(props(wb), { fontId: 3, type: 2, alignment: 2 });
-
-  loaded.dispose();
-  wb.dispose();
-});
-
-test('setDefaultFont declares what an unstyled cell is saved as', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.equal(wb.getFont(0).name, 'Calibri');
-
-  // addFont can only ever append beside the seeded default.
-  const appended = wb.addFont({ name: '游ゴシック', size: 11 });
-  assert.ok(appended.status.ok);
-  assert.ok(appended.index > 0);
-  assert.equal(wb.getFont(0).name, 'Calibri');
-
-  const declared = wb.setDefaultFont({ name: '游ゴシック', size: 11, hasCharset: true, charset: 128 });
-  assert.ok(declared.ok, `setDefaultFont: ${JSON.stringify(declared)}`);
-  assert.equal(wb.getFont(0).name, '游ゴシック');
-  assert.equal(wb.getFont(0).charset, 128);
-
-  wb.dispose();
-});
-
-test('setFont overwrites an existing slot and refuses an absent index', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const added = wb.addFont({ name: 'Meiryo', size: 12 });
-  assert.ok(added.status.ok);
-
-  const replaced = wb.setFont(added.index, { name: 'MS Gothic', size: 9 });
-  assert.ok(replaced.ok, `setFont: ${JSON.stringify(replaced)}`);
-  assert.equal(wb.getFont(added.index).name, 'MS Gothic');
-
-  const before = wb.fontCount().value;
-  assert.equal(wb.setFont(before, { name: 'MS Gothic', size: 9 }).ok, false);
-  assert.equal(wb.fontCount().value, before);
-
-  wb.dispose();
-});
-
-test('addDxf / getDxf round-trip a superscript differential font', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const added = wb.addDxf({ font: { name: 'Calibri', size: 9, vertAlign: 1 } });
-  assert.ok(added.status.ok, `addDxf: ${JSON.stringify(added.status)}`);
-  const readBack = wb.getDxf(added.index);
-  assert.ok(readBack.status.ok);
-  assert.equal(readBack.font.vertAlign, 1);
-
-  const before = wb.dxfCount().value;
-  const again = wb.addDxf(readBack);
-  assert.ok(again.status.ok);
-  assert.equal(again.index, added.index);
-  assert.equal(wb.dxfCount().value, before);
-});
-
-test('addXf rejects out-of-range font_index', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const r = wb.addXf({
-    fontIndex: 99,
-    fillIndex: 0,
-    borderIndex: 0,
-    numFmtId: 0,
-    horizontalAlign: 0,
-    verticalAlign: 0,
-    wrapText: false,
-  });
-  assert.ok(!r.status.ok, 'expected addXf to reject out-of-range font_index');
-});
-
-test('setIterativeProgress accepts a function and accepts null to clear', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Registration roundtrip; we don't assert the callback fires because
-  // a non-iterative recalc never invokes the trampoline. The smoke
-  // signal we want is "the addon does not crash on register / clear".
-  const cb = () => true;
-  const reg = wb.setIterativeProgress(cb);
-  assert.ok(reg.ok, `setIterativeProgress(fn): ${JSON.stringify(reg)}`);
-  const clr = wb.setIterativeProgress(null);
-  assert.ok(clr.ok, `setIterativeProgress(null): ${JSON.stringify(clr)}`);
-});
-
-test('setIterativeProgress keeps callbacks isolated per Workbook', async () => {
-  const mod = await getModule();
-  const first = mod.Workbook.createDefault();
-  const second = mod.Workbook.createDefault();
-  let firstCalls = 0;
-  let secondCalls = 0;
-
-  for (const wb of [first, second]) {
-    assert.ok(wb.setIterative(true, 10, 0.001).ok);
-    assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
-  }
-  assert.ok(
-    first.setIterativeProgress(() => {
-      firstCalls += 1;
-      return true;
-    }).ok,
-  );
-  assert.ok(
-    second.setIterativeProgress(() => {
-      secondCalls += 1;
-      return true;
-    }).ok,
-  );
-
-  assert.ok(first.recalc().ok);
-  assert.ok(firstCalls > 0);
-  assert.equal(secondCalls, 0);
-});
-
-test('dispose is rejected while this workbook is executing its progress callback', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setIterative(true, 10, 0.001).ok);
-  assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
-  let calls = 0;
-  assert.ok(
-    wb.setIterativeProgress(() => {
-      calls += 1;
-      assert.throws(() => wb.dispose(), /cannot dispose a Workbook/);
-      return true;
-    }).ok,
-  );
-  assert.ok(wb.recalc().ok);
-  assert.ok(calls > 0);
-  assert.equal(wb.isValid(), true);
-  wb.dispose();
-});
-
-test('evaluateCfRange returns ok envelope with empty cells for a CF-less workbook', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // The default workbook has no CF rules, so the call should succeed
-  // and return an empty cell list. NaN disables `TimePeriod` rules.
-  const r = wb.evaluateCfRange(0, 0, 0, 4, 4, Number.NaN);
-  assert.ok(r.status.ok, `evaluateCfRange: ${JSON.stringify(r.status)}`);
-  assert.ok(Array.isArray(r.cells));
-  assert.equal(r.cells.length, 0);
-});
-
-test('evaluateCfRange with todaySerial omitted disables timePeriod rules', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // timePeriod rule (type 15) for "today" (period 0) over A1. The cell
-  // holds the serial for 1899-12-30, which a 0.0 basis would match.
-  assert.ok(wb.setNumber(0, 0, 0, 0).ok);
-  const dxf = wb.addDxf({ font: { bold: true } });
-  assert.ok(dxf.status.ok, JSON.stringify(dxf.status));
-  const add = wb.addConditionalFormat(0, {
-    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
-    type: 15,
-    timePeriod: 0,
-    dxfId: dxf.index,
-  });
-  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
-  assert.ok(wb.recalc().ok);
-
-  // Omitting todaySerial must behave like passing NaN (the documented
-  // disabling value), not like passing 0 -- which is the valid serial for
-  // 1899-12-30 and would make the rule match.
-  const omitted = wb.evaluateCfRange(0, 0, 0, 0, 0);
-  assert.ok(omitted.status.ok, `evaluateCfRange: ${JSON.stringify(omitted.status)}`);
-  const explicitNaN = wb.evaluateCfRange(0, 0, 0, 0, 0, Number.NaN);
-  assert.ok(explicitNaN.status.ok, `evaluateCfRange: ${JSON.stringify(explicitNaN.status)}`);
-  assert.equal(omitted.cells.length, explicitNaN.cells.length);
-  assert.equal(omitted.cells.length, 0);
-
-  // A concrete basis of 0 does engage the rule, proving the default is
-  // not merely a no-op for this workbook.
-  const zeroBasis = wb.evaluateCfRange(0, 0, 0, 0, 0, 0);
-  assert.ok(zeroBasis.status.ok, `evaluateCfRange: ${JSON.stringify(zeroBasis.status)}`);
-  assert.equal(zeroBasis.cells.length, 1);
-});
-
-// Builds a workbook with one pivot, ready for the filter-contract cases.
-// `dispose` is the caller's job; the WASM package uses `delete` instead.
-function makePivotWorkbook(Workbook) {
-  const wb = Workbook.createDefault();
-  const cacheId = wb.pivotCacheCreate(0).index;
-  // A cache with no declared source cannot be saved: Excel offers to repair
-  // any package containing one, so the writer refuses rather than emit it.
-  assert.ok(wb.pivotCacheSetWorksheetSource(cacheId, { present: true, ref: 'A1:B3', sheet: 'Sheet1' }).ok);
-  assert.ok(wb.pivotCacheFieldAdd(cacheId, 'Region').status.ok);
-  assert.ok(wb.pivotCacheFieldAdd(cacheId, 'Amount').status.ok);
-  for (const [region, amount] of [
-    ['East', 10],
-    ['West', 30],
-  ]) {
-    const rec = wb.pivotCacheRecordAdd(cacheId).index;
-    assert.ok(wb.pivotCacheRecordSetText(cacheId, rec, 0, region).ok);
-    assert.ok(wb.pivotCacheRecordSetNumber(cacheId, rec, 1, amount).ok);
-  }
-  const pivot = wb.pivotCreate(0, 'Pivot1', cacheId, 0, 4);
-  assert.ok(pivot.status.ok, JSON.stringify(pivot.status));
-  assert.ok(wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Region', axis: 0 }).status.ok);
-  const amountField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Amount', axis: 2 });
-  assert.ok(amountField.status.ok);
-  assert.ok(
-    wb.pivotDataFieldAdd(0, pivot.index, {
-      name: 'Sum of Amount',
-      fieldIndex: amountField.index,
-      aggregation: 0,
-    }).status.ok,
-  );
-  return { wb, pivot: pivot.index };
-}
-
-// greaterThan on a double payload: the shape pivotFilterAt must read back.
-const PIVOT_FILTER = Object.freeze({
-  axis: 0,
-  fieldName: 'Region',
-  type: 1,
-  valueKind: 1,
-  valueDouble: 15,
-});
-
-test('pivotFilterAt reads back an added filter field for field', async () => {
-  const mod = await getModule();
-  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
-  try {
-    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
-    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
-    const got = wb.pivotFilterAt(0, pivot, 0);
-    assert.ok(got.status.ok, JSON.stringify(got.status));
-    assert.equal(got.axis, PIVOT_FILTER.axis);
-    assert.equal(got.fieldName, PIVOT_FILTER.fieldName);
-    assert.equal(got.type, PIVOT_FILTER.type);
-    assert.equal(got.valueKind, PIVOT_FILTER.valueKind);
-    assert.equal(got.valueDouble, PIVOT_FILTER.valueDouble);
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('pivotFilterCount reports only what this session added', async () => {
-  const mod = await getModule();
-  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
-  try {
-    assert.equal(wb.pivotFilterCount(0, pivot).value, 0);
-    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
-    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('active filters are session state and do not survive save/load', async () => {
-  const mod = await getModule();
-  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
-  let bytes;
-  try {
-    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
-    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
-    const saved = wb.save();
-    assert.ok(saved.status.ok, JSON.stringify(saved.status));
-    bytes = saved.bytes;
-  } finally {
-    wb.dispose();
-  }
-  const reloaded = mod.Workbook.loadBytes(bytes);
-  try {
-    assert.equal(reloaded.pivotCount(0).value, 1);
-    // The pivot round-trips; its active-filter list deliberately does not.
-    assert.equal(reloaded.pivotFilterCount(0, 0).value, 0);
-  } finally {
-    reloaded.dispose();
-  }
-});
-
-test('pivotFilterAt rejects an out-of-range index', async () => {
-  const mod = await getModule();
-  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
-  try {
-    const got = wb.pivotFilterAt(0, pivot, 99);
-    assert.equal(got.status.ok, false);
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('a required pivot spec string field left out of the object is rejected, not coerced to "undefined"', async () => {
-  const mod = await getModule();
-  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
-  try {
-    const fieldCountBefore = wb.pivotFieldCount(0, pivot).value;
-    const field = wb.pivotFieldAdd(0, pivot, { axis: 0 }); // no `sourceName`
-    assert.equal(field.status.ok, false);
-    assert.equal(field.status.status, 7001);
-    assert.equal(wb.pivotFieldCount(0, pivot).value, fieldCountBefore, 'no field must have been added');
-
-    const dataFieldCountBefore = wb.pivotDataFieldCount(0, pivot).value;
-    const dataField = wb.pivotDataFieldAdd(0, pivot, { fieldIndex: 0, aggregation: 0 }); // no `name`
-    assert.equal(dataField.status.ok, false);
-    assert.equal(dataField.status.status, 7001);
-    assert.equal(wb.pivotDataFieldCount(0, pivot).value, dataFieldCountBefore, 'no data field must have been added');
-
-    const filterCountBefore = wb.pivotFilterCount(0, pivot).value;
-    const filter = wb.pivotFilterAdd(0, pivot, { axis: 0, type: 1, valueKind: 1, valueDouble: 15 }); // no `fieldName`
-    assert.equal(filter.ok, false);
-    assert.equal(filter.status, 7001);
-    assert.equal(wb.pivotFilterCount(0, pivot).value, filterCountBefore, 'no filter must have been added');
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('comments round-trip: setComment + getComment', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Pre-existing cell so the comment attaches to a stored slot.
-  assert.ok(wb.setNumber(0, 1, 1, 7).ok);
-  const sc = wb.setComment(0, 1, 1, 'libraz', 'hello world');
-  assert.ok(sc.ok, `setComment: ${JSON.stringify(sc)}`);
-  const c = wb.getComment(0, 1, 1);
-  assert.ok(c !== null, 'expected non-null CommentEntry');
-  assert.equal(c.author, 'libraz');
-  assert.equal(c.text, 'hello world');
-  // Removing surfaces null on the next read.
-  assert.ok(wb.setComment(0, 1, 1, '', '').ok);
-  assert.equal(wb.getComment(0, 1, 1), null);
-});
-
-test('getCommentResult distinguishes absence from an invalid sheet', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const missing = wb.getCommentResult(0, 1, 1);
-  assert.equal(missing.status.ok, false);
-  assert.equal(missing.comment, null);
-  const invalid = wb.getCommentResult(99, 1, 1);
-  assert.equal(invalid.status.ok, false);
-  assert.equal(invalid.comment, null);
-  assert.notEqual(missing.status.status, invalid.status.status);
-  assert.ok(wb.setComment(0, 1, 1, 'libraz', 'hello').ok);
-  const found = wb.getCommentResult(0, 1, 1);
-  assert.equal(found.status.ok, true);
-  assert.equal(found.comment.author, 'libraz');
-  assert.equal(found.comment.text, 'hello');
-});
-
-test('cellCount + cellAt enumerate stored cells', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-  assert.ok(wb.setNumber(0, 0, 1, 2).ok);
-  assert.ok(wb.setFormula(0, 1, 0, '=A1+B1').ok);
-  assert.ok(wb.recalc().ok);
-  const n = wb.cellCount(0).value;
-  assert.equal(typeof n, 'number');
-  assert.ok(n >= 3, `expected >= 3 stored cells, got ${n}`);
-  // Iterate; one of the entries should carry our formula.
-  let foundFormula = false;
-  for (let i = 0; i < n; ++i) {
-    const e = wb.cellAt(0, i);
-    assert.ok(e.status.ok, `cellAt(${i}): ${JSON.stringify(e.status)}`);
-    assert.equal(typeof e.row, 'number');
-    assert.equal(typeof e.col, 'number');
-    if (e.formula === '=A1+B1') {
-      foundFormula = true;
-      assert.equal(e.value.kind, mod.ValueKind.Number);
-      assert.equal(e.value.number, 3);
-    }
-  }
-  assert.ok(foundFormula, 'expected to find the =A1+B1 cell during iteration');
-});
-
-test('default export exposes CfMatchKind ordinals', async () => {
-  const mod = await getModule();
-  assert.equal(typeof mod.CfMatchKind, 'object');
-  assert.equal(mod.CfMatchKind.DifferentialFormat, 0);
-  assert.equal(mod.CfMatchKind.ColorScale, 1);
-  assert.equal(mod.CfMatchKind.DataBar, 2);
-  assert.equal(mod.CfMatchKind.IconSet, 3);
-});
-
-test('default export exposes ErrorCode ordinals and versionString alias', async () => {
-  const mod = await getModule();
-  assert.equal(typeof mod.ErrorCode, 'object');
-  assert.equal(mod.ErrorCode.Div0, 1);
-  assert.equal(mod.ErrorCode.Ref, 3);
-  assert.equal(mod.ErrorCode.NA, 6);
-  assert.equal(typeof mod.versionString, 'function');
-  assert.equal(mod.versionString(), mod.version());
-});
-
-test('setError() rejects a missing errorCode argument', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.throws(() => wb.setError(0, 0, 0), TypeError);
-});
-
-test('setError() rejects a non-number errorCode before mutating the cell', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setNumber(0, 0, 0, 7).ok);
-  assert.throws(() => wb.setError(0, 0, 0, 'not a number'), TypeError);
-  // The rejected call must not have overwritten the cell.
-  const got = wb.getValue(0, 0, 0);
-  assert.ok(got.status.ok, JSON.stringify(got.status));
-  assert.equal(got.value.number, 7);
-});
-
-test('saveAs() writes xlsx and xlsb bytes; rejects a missing format argument', async () => {
-  const mod = await getModule();
-  assert.equal(typeof mod.WorkbookFormat, 'object');
-  const wb = mod.Workbook.createDefault();
-  const xlsx = wb.saveAs(mod.WorkbookFormat.Xlsx);
-  assert.ok(xlsx.status.ok, JSON.stringify(xlsx.status));
-  assert.ok(xlsx.bytes.length > 0);
-  const xlsb = wb.saveAs(mod.WorkbookFormat.Xlsb);
-  assert.ok(xlsb.status.ok, JSON.stringify(xlsb.status));
-  assert.ok(xlsb.bytes.length > 0);
-  assert.throws(() => wb.saveAs(), TypeError);
-});
-
-test('saveWithDiagnostics() reports counters and readDiagnostics keeps a stable shape', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
-  assert.ok(
-    wb.addValidation(0, {
-      ranges: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
-      type: 3,
-      formula1: '"Yes,No"',
-    }).ok,
-  );
-  // A CF rule's dxfId must resolve against a registered dxf.
-  const dxf = wb.addDxf({ font: { bold: true } });
-  assert.ok(dxf.status.ok, JSON.stringify(dxf.status));
-  assert.ok(
-    wb.addConditionalFormat(0, {
-      sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
-      type: 1,
-      op: 5,
-      formula1: '10',
-      dxfId: dxf.index,
-      stopIfTrue: false,
-    }).status.ok,
-  );
-
-  const xlsx = wb.saveWithDiagnostics(mod.WorkbookFormat.Xlsx);
-  assert.ok(xlsx.status.ok, JSON.stringify(xlsx.status));
-  assert.ok(xlsx.bytes instanceof Uint8Array);
-  assert.equal(xlsx.downgradedFormulaCount, 0);
-  assert.equal(xlsx.deferredFeatureCount, 0);
-  assert.equal(xlsx.droppedPartCount, 0);
-  assert.equal(xlsx.droppedRelationshipCount, 0);
-  assert.equal(xlsx.renumberedPartCount, 0);
-
-  const xlsb = wb.saveWithDiagnostics(mod.WorkbookFormat.Xlsb);
-  assert.ok(xlsb.status.ok, JSON.stringify(xlsb.status));
-  assert.ok(xlsb.bytes instanceof Uint8Array);
-  assert.equal(xlsb.downgradedFormulaCount, 1);
-  // The validation and the CF rule, with its dxf, are both written.
-  assert.equal(xlsb.deferredFeatureCount, 0);
-  // The binary writer never reassigns a part id.
-  assert.equal(xlsb.renumberedPartCount, 0);
-
-  const loaded = mod.Workbook.loadBytes(xlsb.bytes);
-  const read = loaded.readDiagnostics();
-  assert.ok(read.status.ok, JSON.stringify(read.status));
-  assert.equal(read.undecodedFormulaCount, 0);
-  assert.equal(read.undecodedDefinedNameCount, 0);
-  assert.equal(read.undecodedPartCount, 0);
-  assert.equal(read.skippedFeatureCount, 0);
-  assert.equal(read.unknownContentTypeCount, 0);
-  const preservedLoaded = mod.Workbook.loadBytes(appendEmptyZipEntry(xlsb.bytes, 'xl/preserved.bin'));
-  const preserved = preservedLoaded.readDiagnostics();
-  assert.ok(preserved.status.ok, JSON.stringify(preserved.status));
-  assert.equal(preserved.undecodedPartCount, 0);
-  preservedLoaded.dispose();
-  const invalidSave = wb.saveWithDiagnostics(0);
-  assert.ok(!invalidSave.status.ok, JSON.stringify(invalidSave));
-  assert.equal(invalidSave.bytes, null);
-  assert.equal(invalidSave.downgradedFormulaCount, 0);
-  assert.equal(invalidSave.deferredFeatureCount, 0);
-  assert.equal(invalidSave.droppedPartCount, 0);
-  assert.equal(invalidSave.droppedRelationshipCount, 0);
-  assert.equal(invalidSave.renumberedPartCount, 0);
-  assert.ok(wb.saveAs(mod.WorkbookFormat.Xlsb).bytes instanceof Uint8Array);
-});
-
-test('invalid workbook read diagnostics return a zeroed failure envelope', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.loadBytes(new Uint8Array());
-  const read = wb.readDiagnostics();
-  assert.ok(!read.status.ok, JSON.stringify(read));
-  assert.equal(read.undecodedFormulaCount, 0);
-  assert.equal(read.undecodedDefinedNameCount, 0);
-  assert.equal(read.undecodedPartCount, 0);
-  assert.equal(read.skippedFeatureCount, 0);
-  assert.equal(read.unknownContentTypeCount, 0);
-  wb.dispose();
-});
-
-test('addValidation / getValidations / removeValidationAt / clearValidations round-trip', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Empty by default.
-  assert.equal(wb.getValidations(0).length, 0);
-
-  // List-type validation at A1:B3.
-  const listRule = {
-    ranges: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 1 }],
-    type: 3,
-    op: 0,
-    errorStyle: 1,
-    allowBlank: true,
-    showInputMessage: true,
-    showErrorMessage: true,
-    formula1: '"Yes,No,Maybe"',
-    promptTitle: 'Choose',
-    promptMessage: 'Pick one',
-    errorTitle: 'Bad value',
-    errorMessage: 'Pick from the list',
-  };
-  assert.ok(wb.addValidation(0, listRule).ok);
-
-  // Decimal between [0, 100] across two rectangles.
-  const decimalRule = {
-    ranges: [
-      { firstRow: 4, firstCol: 0, lastRow: 4, lastCol: 0 },
-      { firstRow: 6, firstCol: 0, lastRow: 9, lastCol: 0 },
-    ],
-    type: 2,
-    op: 0,
-    formula1: '0',
-    formula2: '100',
-    allowBlank: false,
-  };
-  assert.ok(wb.addValidation(0, decimalRule).ok);
-
-  const list = wb.getValidations(0);
-  assert.equal(list.length, 2);
-  // Booleans must arrive as JS booleans, not 0/1.
-  assert.equal(typeof list[0].allowBlank, 'boolean');
-  assert.equal(list[0].allowBlank, true);
-  assert.equal(typeof list[0].showInputMessage, 'boolean');
-  assert.equal(list[0].showInputMessage, true);
-  assert.equal(typeof list[1].allowBlank, 'boolean');
-  assert.equal(list[1].allowBlank, false);
-  assert.equal(list[0].formula1, '"Yes,No,Maybe"');
-  assert.equal(list[1].formula1, '0');
-  assert.equal(list[1].formula2, '100');
-  assert.equal(list[1].ranges.length, 2);
-  assert.equal(list[1].ranges[1].firstRow, 6);
-
-  // removeValidationAt removes the first rule.
-  assert.ok(wb.removeValidationAt(0, 0).ok);
-  const after = wb.getValidations(0);
-  assert.equal(after.length, 1);
-  assert.equal(after[0].type, 2);
-
-  // Out-of-range index is rejected.
-  assert.ok(!wb.removeValidationAt(0, 99).ok);
-  // Sheet-out-of-range is rejected on every entry.
-  assert.ok(!wb.addValidation(999, listRule).ok);
-  assert.ok(!wb.removeValidationAt(999, 0).ok);
-  assert.ok(!wb.clearValidations(999).ok);
-
-  // clearValidations drops everything; safe to call again.
-  assert.ok(wb.clearValidations(0).ok);
-  assert.equal(wb.getValidations(0).length, 0);
-  assert.ok(wb.clearValidations(0).ok);
-});
-
-// -- Newly wired surface (audit parity with the WASM binding) ----------
-// These tests exercise the methods that were previously only reachable
-// from the WASM package. They assert sensible return shapes rather than
-// deep semantics; the point is "the addon wires them and does not throw".
-
-test('addConditionalFormat + getConditionalFormats + clearConditionalFormats round-trip', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.equal(wb.getConditionalFormats(0).length, 0);
-  // A CF rule's dxfId must resolve against a registered dxf.
-  const dxf = wb.addDxf({ font: { bold: true } });
-  assert.ok(dxf.status.ok, JSON.stringify(dxf.status));
-  // cellIs rule (type 1) comparing the cell to a literal.
-  const add = wb.addConditionalFormat(0, {
-    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 4, lastCol: 0 }],
-    type: 1,
-    op: 5,
-    formula1: '10',
-    dxfId: dxf.index,
-    stopIfTrue: false,
-  });
-  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
-  assert.equal(typeof add.index, 'number');
-  const list = wb.getConditionalFormats(0);
-  assert.equal(list.length, 1);
-  assert.equal(list[0].type, 1);
-  assert.equal(typeof list[0].id, 'string');
-  assert.equal(list[0].sqref.length, 1);
-  assert.equal(list[0].sqref[0].lastRow, 4);
-  assert.equal(list[0].formula1, '10');
-  // removeConditionalFormatAt drops the only rule.
-  assert.ok(wb.removeConditionalFormatAt(0, 0).ok);
-  assert.equal(wb.getConditionalFormats(0).length, 0);
-  // clearConditionalFormats is a safe no-op on an empty sheet.
-  assert.ok(wb.clearConditionalFormats(0).ok);
-  // Sheet-out-of-range is rejected.
-  assert.ok(!wb.clearConditionalFormats(999).ok);
-});
-
-test('data bar x14 fields survive save and load', async () => {
-  // The six live in the `x14` extension rather than the legacy `<dataBar>`
-  // element, so an in-session round-trip would still pass with a writer
-  // that never emits the extension -- which is exactly how they used to be
-  // lost. Only a save/load cycle pins them.
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const add = wb.addConditionalFormat(0, {
-    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
-    type: 3,
-    dataBar: {
-      min: { type: 3 },
-      max: { type: 4 },
-      fill: { r: 0, g: 0, b: 255 },
-      gradient: false,
-      axisPosition: 1,
-      negativeFill: { r: 255, g: 0, b: 0 },
-      border: { r: 9, g: 9, b: 9 },
-      negativeBorder: { r: 8, g: 8, b: 8 },
-      axisColor: { r: 1, g: 2, b: 3 },
-      direction: 2,
-    },
-  });
-  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
-
-  const saved = wb.save();
-  assert.ok(saved.status.ok);
-  const loaded = mod.Workbook.loadBytes(saved.bytes);
-  const bar = loaded.getConditionalFormats(0)[0].dataBar;
-  assert.equal(bar.gradient, false);
-  assert.equal(bar.axisPosition, 1);
-  assert.equal(bar.negativeFill.r, 255);
-  assert.equal(bar.border.r, 9);
-  assert.equal(bar.negativeBorder.r, 8);
-  assert.equal(bar.axisColor.b, 3);
-  assert.equal(bar.direction, 2);
-
-  // The decoded bar fed straight back must reproduce the same rule.
-  const again = loaded.addConditionalFormat(0, {
-    sqref: [{ firstRow: 4, firstCol: 0, lastRow: 6, lastCol: 0 }],
-    type: 3,
-    dataBar: bar,
-  });
-  assert.ok(again.status.ok, `re-add: ${JSON.stringify(again)}`);
-  const reread = loaded.getConditionalFormats(0)[1].dataBar;
-  assert.equal(reread.gradient, false);
-  assert.equal(reread.axisPosition, 1);
-  assert.equal(reread.axisColor.b, 3);
-  assert.equal(reread.direction, 2);
-
-  loaded.dispose();
-  wb.dispose();
-});
-
-test('icon set floor survives save and load', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const add = wb.addConditionalFormat(0, {
-    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 9, lastCol: 0 }],
-    type: 4,
-    iconSet: {
-      name: 2,
-      thresholds: [
-        { type: 0, value: '7' },
-        { type: 0, value: '9' },
-      ],
-      floor: { type: 0, value: '5', gte: false },
-    },
-  });
-  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
-  const saved = wb.save();
-  assert.ok(saved.status.ok);
-  const loaded = mod.Workbook.loadBytes(saved.bytes);
-  const floor = loaded.getConditionalFormats(0)[0].iconSet.floor;
-  assert.equal(floor.type, 0);
-  assert.equal(floor.value, '5');
-  assert.equal(floor.gte, false);
-  loaded.dispose();
-  wb.dispose();
-});
-
-test('omitted data bar x14 fields keep the model defaults', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const add = wb.addConditionalFormat(0, {
-    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
-    type: 3,
-    dataBar: { min: { type: 3 }, max: { type: 4 }, fill: { r: 0, g: 0, b: 255 } },
-  });
-  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
-  const bar = wb.getConditionalFormats(0)[0].dataBar;
-  // The getter engages all six, so they read back as the defaults rather
-  // than as absent keys.
-  assert.equal(bar.gradient, true);
-  assert.equal(bar.axisPosition, 0);
-  assert.equal(bar.negativeFill.b, 255);
-  wb.dispose();
-});
-
-test('named cell styles: cellStyleCount / getCellStyle / cellStyleXfCount', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // A fresh workbook may carry zero named styles; the accessors must
-  // still return well-formed values rather than throwing.
-  const count = wb.cellStyleCount().value;
-  assert.equal(typeof count, 'number');
-  assert.ok(count >= 0);
-  assert.equal(typeof wb.cellStyleXfCount().value, 'number');
-  if (count > 0) {
-    const cs = wb.getCellStyle(0);
-    assert.ok(cs.status.ok, `getCellStyle: ${JSON.stringify(cs.status)}`);
-    assert.equal(typeof cs.name, 'string');
-    assert.equal(typeof cs.xfId, 'number');
-  } else {
-    // Out-of-range index surfaces an error status, not a throw.
-    const cs = wb.getCellStyle(0);
-    assert.equal(cs.status.ok, false);
-  }
-});
-
-test('setCalcMode / calcMode round-trip the calc policy', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Default is automatic (0).
-  assert.equal(wb.calcMode().value, 0);
-  assert.ok(wb.setCalcMode(1).ok);
-  assert.equal(wb.calcMode().value, 1);
-  assert.ok(wb.setCalcMode(2).ok);
-  assert.equal(wb.calcMode().value, 2);
-});
-
-test('setPinnedNow / pinnedNow / clearPinnedNow drive the clock seam', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Unpinned by default: the workbook follows the host clock.
-  assert.equal(wb.pinnedNow().now, null);
-
-  assert.ok(wb.setPinnedNow(2026, 4, 23, 15, 30, 45).ok);
-  assert.deepEqual(wb.pinnedNow().now, {
-    year: 2026,
-    month: 4,
-    day: 23,
-    hour: 15,
-    minute: 30,
-    second: 45,
-  });
-
-  // 2026-04-23 is serial 46135 under the 1900 date system.
-  const today = wb.evaluateFormulaText(0, 0, 0, '=TODAY()');
-  assert.ok(today.status.ok, `evaluateFormulaText: ${JSON.stringify(today.status)}`);
-  assert.equal(today.value.number, 46135);
-
-  // The pin is a calendar instant, not a normalising constructor.
-  assert.equal(wb.setPinnedNow(2026, 13, 1, 0, 0, 0).ok, false);
-  assert.equal(wb.setPinnedNow(2025, 2, 29, 0, 0, 0).ok, false);
-
-  assert.ok(wb.clearPinnedNow().ok);
-  assert.equal(wb.pinnedNow().now, null);
-});
-
-test('excelProfileId / setExcelProfileId round-trip the profile id', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const def = wb.excelProfileId().value;
-  assert.equal(typeof def, 'string');
-  assert.ok(def.length > 0);
-  assert.ok(wb.setExcelProfileId('mac-365-ja_JP').ok);
-  assert.equal(wb.excelProfileId().value, 'mac-365-ja_JP');
-});
-
-test('functionNames + functionMetadata expose the catalog', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const names = wb.functionNames();
-  assert.ok(Array.isArray(names));
-  assert.ok(names.length > 0, 'expected a non-empty function catalog');
-  assert.ok(names.includes('SUM'), 'expected SUM in the catalog');
-  const md = wb.functionMetadata('SUM', 0);
-  assert.equal(md.ok, true);
-  assert.equal(md.name, 'SUM');
-  assert.equal(typeof md.minArity, 'number');
-  // Unknown function returns { ok: false }.
-  const miss = wb.functionMetadata('NOT_A_REAL_FUNCTION_XYZ', 0);
-  assert.equal(miss.ok, false);
-});
-
-test('mergeFunctionMetadata overlays provider metadata; is identity without a provider', async () => {
-  const mod = await getModule();
-  assert.equal(typeof mod.mergeFunctionMetadata, 'function');
-  const base = mod.Workbook.createDefault().functionMetadata('XLOOKUP', 0);
-  assert.equal(base.ok, true);
-  // The engine leaves display metadata empty.
-  assert.equal(base.signatureTemplate, undefined);
-  assert.equal(base.description, undefined);
-
-  const entry = {
-    signature: 'XLOOKUP(lookup_value, lookup_array, return_array)',
-    description: 'Searches a range or an array.',
-    aliases: { 'fr-FR': 'RECHERCHEX' },
-    localized: {
-      'fr-FR': { signature: 'RECHERCHEX(...)', description: 'Recherche.' },
-    },
-  };
-
-  // Localized override wins for the matching locale.
-  const fr = mod.mergeFunctionMetadata(base, entry, 'fr-FR');
-  assert.equal(fr.signatureTemplate, 'RECHERCHEX(...)');
-  assert.equal(fr.description, 'Recherche.');
-  assert.equal(fr.localizedName, 'RECHERCHEX');
-  // Structural fields survive the merge.
-  assert.equal(fr.ok, true);
-  assert.equal(fr.name, 'XLOOKUP');
-
-  // A locale with no localized/alias entry falls back to the default
-  // signature/description and the canonical display name.
-  const de = mod.mergeFunctionMetadata(base, entry, 'de-DE');
-  assert.equal(de.signatureTemplate, 'XLOOKUP(lookup_value, lookup_array, return_array)');
-  assert.equal(de.description, 'Searches a range or an array.');
-  assert.equal(de.localizedName, 'XLOOKUP');
-
-  // No provider entry -> base returned verbatim, display metadata stays NULL.
-  const none = mod.mergeFunctionMetadata(base, undefined, 'fr-FR');
-  assert.equal(none, base);
-  assert.equal(none.signatureTemplate, undefined);
-  assert.equal(none.description, undefined);
-});
-
-test('localizeFunctionName / canonicalizeFunctionName round-trip', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // en-US locale (0): the localized name is the canonical name itself.
-  assert.equal(wb.localizeFunctionName('SUM', 0).value, 'SUM');
-  assert.equal(wb.canonicalizeFunctionName('SUM', 0).value, 'SUM');
-  // An unknown name returns the empty string.
-  assert.equal(wb.canonicalizeFunctionName('NOPE_XYZ', 0).value, '');
-});
-
-test('precedents / dependents return arrays for a small formula graph', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  assert.ok(wb.setNumber(0, 0, 0, 1).ok); // A1
-  assert.ok(wb.setNumber(0, 0, 1, 2).ok); // B1
-  assert.ok(wb.setFormula(0, 1, 0, '=A1+B1').ok); // A2 = A1 + B1
-  assert.ok(wb.recalc().ok);
-  // A2 reads A1 and B1.
-  const prec = wb.precedents(0, 1, 0, 1);
-  assert.ok(Array.isArray(prec));
-  assert.equal(prec.length, 2);
-  for (const node of prec) {
-    assert.equal(typeof node.sheet, 'number');
-    assert.equal(typeof node.row, 'number');
-    assert.equal(typeof node.col, 'number');
-  }
-  // A1 is read by A2.
-  const dep = wb.dependents(0, 0, 0, 1);
-  assert.ok(Array.isArray(dep));
-  assert.equal(dep.length, 1);
-  assert.equal(dep[0].row, 1);
-  assert.equal(dep[0].col, 0);
-});
-
-test('spillInfo reports a dynamic-array region', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // Non-spill cell: engaged is false, fields zeroed.
-  const none = wb.spillInfo(0, 0, 0);
-  assert.equal(typeof none.engaged, 'boolean');
-  assert.equal(none.engaged, false);
-  // A spilling dynamic array anchored at A1.
-  assert.ok(wb.setFormula(0, 0, 0, '=SEQUENCE(3,1)').ok);
-  assert.ok(wb.recalc().ok);
-  const info = wb.spillInfo(0, 0, 0);
-  assert.equal(info.engaged, true);
-  assert.equal(info.anchorRow, 0);
-  assert.equal(info.anchorCol, 0);
-  assert.equal(info.rows, 3);
-  assert.equal(info.cols, 1);
-});
-
-test('getLambdaText is wired and reports the documented contract', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  // A bare top-level LAMBDA renders as #CALC! in Excel 365 and does not
-  // retain a renderable closure; the engine mirrors that, so the lambda
-  // text surface returns an error status (not a throw). A plain number
-  // cell is likewise not a lambda. Both prove the method marshals
-  // arguments and propagates the Expected failure as a JS error status.
-  assert.ok(wb.setFormula(0, 0, 0, '=LAMBDA(x,x+1)').ok);
-  assert.ok(wb.recalc().ok);
-  const bare = wb.getLambdaText(0, 0, 0);
-  assert.equal(bare.status.ok, false);
-  assert.equal(typeof bare.text, 'string');
-  assert.equal(bare.text, '');
-
-  assert.ok(wb.setNumber(0, 1, 0, 5).ok);
-  const num = wb.getLambdaText(0, 1, 0);
-  assert.equal(num.status.ok, false);
-});
-
-test('getExternalLinks returns an array (empty for a fresh workbook)', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const links = wb.getExternalLinks();
-  assert.ok(Array.isArray(links));
-  assert.equal(links.length, 0);
-});
-
-test('getSheetProtection / setSheetProtection round-trip the protection flags', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  const before = wb.getSheetProtection(0);
-  assert.ok(before.status.ok, `getSheetProtection: ${JSON.stringify(before.status)}`);
-  assert.equal(before.protection.enabled, 0);
-  // Enable protection and lock cell selection.
-  const next = {
-    ...before.protection,
-    enabled: 1,
-    selectLockedCells: 1,
-    sort: 1,
-  };
-  assert.ok(wb.setSheetProtection(0, next).ok);
-  const after = wb.getSheetProtection(0);
-  assert.ok(after.status.ok);
-  assert.equal(after.protection.enabled, 1);
-  assert.equal(after.protection.selectLockedCells, 1);
-  assert.equal(after.protection.sort, 1);
-  // Sheet-out-of-range is rejected.
-  assert.ok(!wb.getSheetProtection(999).status.ok);
-  assert.ok(!wb.setSheetProtection(999, next).ok);
-});
-
-// ---- Result-envelope key sets ------------------------------------------
-//
-// A result type whose payload key is declared non-optional must carry that
-// key on every exit path, or `r.name.toUpperCase()` type-checks and then
-// throws at runtime for a caller who skipped the status check. The probe
-// table is checked for completeness against the declaration file, so a new
-// result type cannot be added without a failure-path probe. The WASM
-// package runs the mirror image of this test.
-
-function interfaceBody(dts, name) {
-  const m = dts.match(new RegExp(`^export interface ${name}\\b[^{]*\\{`, 'm'));
-  if (!m) return null;
-  let depth = 0;
-  const open = dts.indexOf('{', m.index);
-  for (let i = open; i < dts.length; i += 1) {
-    if (dts[i] === '{') depth += 1;
-    else if (dts[i] === '}') {
-      depth -= 1;
-      if (depth === 0) return dts.slice(open + 1, i);
-    }
-  }
-  return null;
-}
-
-function interfaceBases(dts, name) {
-  const m = dts.match(new RegExp(`^export interface ${name}\\b([^{]*)\\{`, 'm'));
-  if (!m) return [];
-  const clause = m[1].trim();
-  if (!clause.startsWith('extends')) return [];
-  return clause
-    .slice('extends'.length)
-    .split(',')
-    .map((s) => s.trim())
-    .filter(Boolean);
-}
-
-function interfaceMembers(dts, name, seen = new Set()) {
-  if (seen.has(name)) return [];
-  seen.add(name);
-  const body = interfaceBody(dts, name);
-  if (body === null) return [];
-  const out = [];
-  for (const base of interfaceBases(dts, name)) out.push(...interfaceMembers(dts, base, seen));
-  for (const m of body.matchAll(/^ {2}(?:readonly\s+)?([A-Za-z_$][\w$]*)(\??)\s*:/gm)) {
-    out.push([m[1], m[2] === '']);
-  }
-  return out;
-}
-
-function resultTypesWithRequiredPayload(dts) {
-  const out = new Map();
-  for (const m of dts.matchAll(/^export interface ([A-Za-z0-9_]+)/gm)) {
-    const name = m[1];
-    if (name === 'Status') continue;
-    const members = interfaceMembers(dts, name);
-    if (!members.some(([key]) => key === 'status')) continue;
-    const required = members.filter(([key, req]) => req && key !== 'status').map(([key]) => key);
-    if (required.length > 0) out.set(name, required);
-  }
-  return out;
-}
-
-// `fails: false` marks a call whose only failure path is a disposed
-// handle, which is not usable to probe.
-function envelopeProbes(wb) {
-  return [
-    ['ParallelRecalcResult', true, () => wb.recalcParallel(9)],
-    ['CellResult', true, () => wb.getValue(99, 0, 0)],
-    ['EvalResult', true, () => wb.evaluateFormulaText(99, 0, 0, '=1')],
-    ['EvalArrayResult', true, () => wb.evaluateFormulaArray(99, 0, 0, '=1')],
-    ['SaveResult', true, () => wb.saveAs(99)],
-    ['SaveDiagnosticsResult', true, () => wb.saveWithDiagnostics(99)],
-    ['ReadDiagnosticsResult', false, () => wb.readDiagnostics()],
-    ['StringResult', true, () => wb.sheetName(99)],
-    ['PivotLayoutResult', true, () => wb.pivotLayout(99, 0)],
-    ['PivotWorksheetSourceResult', true, () => wb.pivotCacheGetWorksheetSource(9999)],
-    ['PivotReportLayoutResult', true, () => wb.pivotGetLayout(99, 0)],
-    ['PivotFilterResult', true, () => wb.pivotFilterAt(99, 0, 0)],
-    ['CfRangeResult', true, () => wb.evaluateCfRange(99, 0, 0, 1, 1, Number.NaN)],
-    ['PaginationResult', true, () => wb.paginate(99)],
-    ['SheetViewResult', true, () => wb.getSheetView(99)],
-    ['SheetProtectionResult', true, () => wb.getSheetProtection(99)],
-    ['ColumnsResult', true, () => wb.getSheetColumns(99)],
-    ['RowsResult', true, () => wb.getSheetRowOverrides(99)],
-    ['CommentResult', true, () => wb.getCommentResult(99, 0, 0)],
-    ['CellXfIndexResult', true, () => wb.getCellXfIndex(99, 0, 0)],
-    ['CellXfResult', true, () => wb.getCellXf(9999)],
-    ['FontResult', true, () => wb.getFont(9999)],
-    ['FillResult', true, () => wb.getFill(9999)],
-    ['BorderResult', true, () => wb.getBorder(9999)],
-    ['NumFmtResult', true, () => wb.getNumFmt(59999)],
-    ['LambdaTextResult', true, () => wb.getLambdaText(99, 0, 0)],
-    ['PhoneticRunsResult', true, () => wb.getCellPhoneticRuns(99, 0, 0)],
-    ['PhoneticPropertiesResult', true, () => wb.getCellPhoneticProperties(99, 0, 0)],
-    ['CellStyleResult', true, () => wb.getCellStyle(9999)],
-    ['AddStyleResult', true, () => wb.addXf({ fontIndex: 9999 })],
-    ['AddNumFmtResult', false, () => wb.addNumFmt('0.00')],
-    ['IterativeSettingsResult', false, () => wb.getIterative()],
-    [
-      'PartialRecalcResult',
-      true,
-      () => wb.partialRecalc({ sheet: 99, firstRow: 0, lastRow: 1, firstCol: 0, lastCol: 1 }),
-    ],
-    ['SheetPrintXmlResult', true, () => wb.getSheetPageSetupXml(99)],
-    ['SheetPrintAreaResult', true, () => wb.getSheetPrintArea(99)],
-    ['SheetPrintTitlesResult', true, () => wb.getSheetPrintTitles(99)],
-    // `getSheetRowBreaks` / `getSheetColBreaks` answer an out-of-range
-    // sheet with an empty list rather than an error, unlike every sibling
-    // print getter, so no failure path is reachable from here.
-    ['SheetPageBreaksResult', false, () => wb.getSheetRowBreaks(99)],
-    ['SheetPageSetupResult', true, () => wb.getSheetPageSetup(99)],
-    ['SheetPageMarginsResult', true, () => wb.getSheetPageMargins(99)],
-    ['NumberResult', true, () => wb.cellCount(99)],
-    // A released handle is the only failure path, which is not usable here.
-    ['PinnedNowResult', false, () => wb.pinnedNow()],
-    ['SpillInfo', true, () => wb.spillInfo(99, 0, 0)],
-  ];
-}
-
-test('every declared result type is probed for its key set', async () => {
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
-  const declared = resultTypesWithRequiredPayload(dts);
-  const probed = new Set(envelopeProbes({}).map(([name]) => name));
-  const unprobed = [...declared.keys()].filter((name) => !probed.has(name));
-  assert.deepEqual(unprobed, [], 'result types with no failure-path probe');
-  const stale = [...probed].filter((name) => !declared.has(name));
-  assert.deepEqual(stale, [], 'probes for result types that no longer declare a required payload');
-});
-
-test('result envelopes keep their declared keys on failure paths', async () => {
-  const mod = await getModule();
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
-  const declared = resultTypesWithRequiredPayload(dts);
-  const wb = mod.Workbook.createDefault();
-  try {
-    for (const [typeName, expectFailure, call] of envelopeProbes(wb)) {
-      const r = call();
-      if (expectFailure) {
-        assert.equal(r.status.ok, false, `${typeName}: probe was expected to fail`);
-      }
-      const missing = declared.get(typeName).filter((key) => !(key in r));
-      assert.deepEqual(missing, [], `${typeName} dropped declared keys`);
-    }
-  } finally {
-    wb.dispose();
-  }
-});
-
-// ---- Pivot mutator marshalling -----------------------------------------
-//
-// Every pivot mutator is driven once against a small pivot and checked
-// through a read of the result -- the projected grid wherever the mutation
-// reaches it -- so an argument dropped, reordered or mis-converted on the
-// way to the C ABI shows up as a wrong grid rather than a green `.ok`. The
-// completeness test below keeps the table in step with the declaration
-// file.
-
-// Region / Product carry shared items and their records store item
-// indices; Amount and Date are plain numbers. Only Region is laid out, so
-// the baseline grid is two regions, their sums and the grand total.
-function buildPivot(mod) {
-  const wb = mod.Workbook.createDefault();
-  const must = (r, what) => {
-    const status = typeof r.ok === 'boolean' ? r : r.status;
-    assert.ok(status.ok, `${what}: ${JSON.stringify(status)}`);
-    return r;
-  };
-  const cacheId = must(wb.pivotCacheCreate(0), 'pivotCacheCreate').index;
-  must(wb.pivotCacheSetWorksheetSource(cacheId, { present: true, ref: 'A1:D5', sheet: 'Sheet1' }), 'source');
-  for (const name of ['Region', 'Product', 'Amount', 'Date']) must(wb.pivotCacheFieldAdd(cacheId, name), name);
-  for (const item of ['East', 'West']) must(wb.pivotCacheFieldAddSharedItemText(cacheId, 0, item), item);
-  for (const item of ['Apple', 'Pear']) must(wb.pivotCacheFieldAddSharedItemText(cacheId, 1, item), item);
-  for (const values of [
-    [0, 0, 10, 45292],
-    [1, 0, 30, 45323],
-    [0, 1, 5, 45658],
-    [1, 1, 7, 45689],
-  ]) {
-    const rec = must(wb.pivotCacheRecordAdd(cacheId), 'record').index;
-    for (const [field, v] of values.entries())
-      must(wb.pivotCacheRecordSetNumber(cacheId, rec, field, v), 'record value');
-  }
-  const pivot = must(wb.pivotCreate(0, 'Pivot1', cacheId, 0, 6), 'pivotCreate').index;
-  const addField = (spec) => must(wb.pivotFieldAdd(0, pivot, spec), spec.sourceName).index;
-  const region = addField({ sourceName: 'Region', axis: 0 });
-  must(wb.pivotFieldAddItem(0, pivot, region, 'East', true), 'item');
-  must(wb.pivotFieldAddItem(0, pivot, region, 'West', true), 'item');
-  const product = addField({ sourceName: 'Product', axis: 2 });
-  must(wb.pivotFieldAddItem(0, pivot, product, 'Apple', true), 'item');
-  must(wb.pivotFieldAddItem(0, pivot, product, 'Pear', true), 'item');
-  const amount = addField({ sourceName: 'Amount', axis: 2 });
-  const date = addField({ sourceName: 'Date', axis: 2 });
-  must(wb.pivotSetRowFieldOrder(0, pivot, [region]), 'row order');
-  must(wb.pivotDataFieldAdd(0, pivot, { name: 'Sum of Amount', fieldIndex: amount, aggregation: 0 }), 'data field');
-  return { wb, cacheId, pivot, region, product, amount, date };
-}
-
-// The projected grid as one `|`-joined string per sheet row.
-function pivotGrid(wb, pivot = 0) {
-  const layout = wb.pivotLayout(0, pivot);
-  assert.ok(layout.status.ok, JSON.stringify(layout.status));
-  const rows = new Map();
-  for (const cell of layout.cells) {
-    const v = cell.value;
-    const text = v.kind === 1 ? String(v.number) : v.kind === 3 ? v.text : v.kind === 4 ? `#${v.errorCode}` : '';
-    if (!rows.has(cell.row)) rows.set(cell.row, new Array(layout.cols).fill(''));
-    rows.get(cell.row)[cell.col - layout.left] = text;
-  }
-  return [...rows.keys()].sort((a, b) => a - b).map((row) => rows.get(row).join('|'));
-}
-
-const BASE_GRID = ['行ラベル|Sum of Amount', 'East|15', 'West|37', '総計|52'];
-const TWO_LEVEL_GRID = [
-  '行ラベル|Sum of Amount',
-  'Apple|10',
-  'Pear|5',
-  'East|15',
-  'Apple|30',
-  'Pear|7',
-  'West|37',
-  '総計|52',
-];
-const DATE_SERIAL_GRID = ['行ラベル|Sum of Amount', '45292|10', '45323|30', '45658|5', '45689|7', '総計|52'];
-const twoLevels = (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.region, b.product]);
-const dateRows = (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.date]);
-const hideEast = (b) => b.wb.pivotFieldSetItemVisible(0, b.pivot, b.region, 0, false);
-const WEST_ONLY = ['行ラベル|Sum of Amount', 'West|37', '総計|37'];
-const GREATER_THAN_20 = Object.freeze({ axis: 0, fieldName: 'Region', type: 1, valueKind: 1, valueDouble: 20 });
-const BETWEEN_10_20 = Object.freeze({
-  axis: 0,
-  fieldName: 'Region',
-  type: 2,
-  valueKind: 1,
-  valueDouble: 10,
-  valueHighKind: 1,
-  valueHighDouble: 20,
-});
-// Points record 0's Region at the shared item a row has just appended.
-const pointAtNewItem = (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 0, 2);
-
-// The raw text of one stored part of a saved package.
-function packagePart(bytes, name) {
-  const buf = Buffer.from(bytes);
-  let eocd = buf.length - 22;
-  while (eocd >= 0 && buf.readUInt32LE(eocd) !== 0x06054b50) eocd -= 1;
-  assert.ok(eocd >= 0, 'missing ZIP end record');
-  let at = buf.readUInt32LE(eocd + 16);
-  for (let i = buf.readUInt16LE(eocd + 10); i > 0; i -= 1) {
-    const method = buf.readUInt16LE(at + 10);
-    const size = buf.readUInt32LE(at + 20);
-    const nameLen = buf.readUInt16LE(at + 28);
-    const next = at + 46 + nameLen + buf.readUInt16LE(at + 30) + buf.readUInt16LE(at + 32);
-    if (buf.toString('utf8', at + 46, at + 46 + nameLen) === name) {
-      const local = buf.readUInt32LE(at + 42);
-      const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
-      const raw = buf.subarray(start, start + size);
-      return (method === 0 ? raw : inflateRawSync(raw)).toString('utf8');
-    }
-    at = next;
-  }
-  assert.fail(`${name} not in the package`);
-}
-
-// [method, { setup, act, after, expect }]. `act` performs the one call
-// under test; `expect` reads the result back.
-const PIVOT_MUTATORS = [
-  [
-    'pivotCacheCreate',
-    {
-      act: (b) => b.wb.pivotCacheCreate(77),
-      expect: (b, r) => {
-        assert.equal(r.index, 77);
-        assert.equal(b.wb.pivotCacheCount().value, 2);
-      },
-    },
-  ],
-  ['pivotCacheIdAt', { act: (b) => b.wb.pivotCacheIdAt(0), expect: (b, r) => assert.equal(r.index, b.cacheId) }],
-  [
-    'pivotCacheRemove',
-    {
-      setup: (b) => {
-        b.spare = b.wb.pivotCacheCreate(0).index;
-      },
-      act: (b) => b.wb.pivotCacheRemove(b.spare),
-      expect: (b) => {
-        assert.equal(b.wb.pivotCacheCount().value, 1);
-        assert.equal(b.wb.pivotCacheIdAt(0).index, b.cacheId);
-      },
-    },
-  ],
-  [
-    'pivotCacheSetWorksheetSource',
-    {
-      act: (b) => b.wb.pivotCacheSetWorksheetSource(b.cacheId, { present: true, ref: 'B2:E6', sheet: 'Data' }),
-      expect: (b) => {
-        const source = b.wb.pivotCacheGetWorksheetSource(b.cacheId);
-        assert.equal(source.ref, 'B2:E6');
-        assert.equal(source.sheet, 'Data');
-        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotCacheFieldAdd',
-    {
-      act: (b) => b.wb.pivotCacheFieldAdd(b.cacheId, 'Extra'),
-      expect: (b, r) => {
-        assert.equal(r.index, 4);
-        assert.equal(b.wb.pivotCacheFieldName(b.cacheId, 4).value, 'Extra');
-      },
-    },
-  ],
-  [
-    'pivotCacheFieldClear',
-    {
-      act: (b) => b.wb.pivotCacheFieldClear(b.cacheId),
-      expect: (b) => {
-        assert.equal(b.wb.pivotCacheFieldCount(b.cacheId).value, 0);
-        // The data field now names a cache field that no longer exists.
-        assert.equal(b.wb.pivotLayout(0, b.pivot).status.ok, false);
-      },
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemNumber',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemNumber(b.cacheId, 0, 42.5),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '42.5|10', 'East|5', 'West|37', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemText',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemText(b.cacheId, 0, 'North'),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'North|10', 'West|37', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemBool',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemBool(b.cacheId, 0, true),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', 'TRUE|10', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemBlank',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemBlank(b.cacheId, 0),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '(空白)|10', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemError',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemError(b.cacheId, 0, 6),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '#N/A|10', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldClearSharedItems',
-    {
-      act: (b) => b.wb.pivotCacheFieldClearSharedItems(b.cacheId, 0),
-      // With no shared items the records' indices render as themselves.
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '0|15', '1|37', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheRecordAdd',
-    {
-      act: (b) => b.wb.pivotCacheRecordAdd(b.cacheId),
-      expect: (b, r) => {
-        assert.equal(r.index, 4);
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|15', 'West|37', '(空白)|0', '総計|52']);
-      },
-    },
-  ],
-  [
-    'pivotCacheRecordClear',
-    {
-      act: (b) => b.wb.pivotCacheRecordClear(b.cacheId),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '総計|0']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetNumber',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 2, 1000),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|1005', 'West|37', '総計|1042']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetText',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetText(b.cacheId, 0, 0, 'West'),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|47', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetBool',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetBool(b.cacheId, 0, 2, true),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|6', 'West|37', '総計|43']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetBlank',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetBlank(b.cacheId, 0, 2),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '総計|42']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetError',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetError(b.cacheId, 0, 2, 1),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|#1', 'West|37', '総計|#1']),
-    },
-  ],
-  [
-    'pivotCreate',
-    {
-      act: (b) => b.wb.pivotCreate(0, 'Pivot2', b.cacheId, 20, 1),
-      expect: (b, r) => {
-        assert.equal(r.index, 1);
-        const layout = b.wb.pivotLayout(0, 1);
-        assert.equal(layout.top, 20);
-        assert.equal(layout.left, 1);
-        assert.deepEqual(pivotGrid(b.wb, 0), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotRemove',
-    {
-      act: (b) => b.wb.pivotRemove(0, b.pivot),
-      expect: (b) => {
-        assert.equal(b.wb.pivotCount(0).value, 0);
-        assert.equal(b.wb.pivotLayout(0, 0).status.ok, false);
-      },
-    },
-  ],
-  [
-    'pivotSetName',
-    {
-      act: (b) => b.wb.pivotSetName(0, b.pivot, 'Renamed'),
-      // A pivot's name is only observable in the part the writer emits.
-      expect: (b) => {
-        const saved = b.wb.save();
-        assert.ok(saved.status.ok, JSON.stringify(saved.status));
-        assert.match(
-          packagePart(saved.bytes, 'xl/pivotTables/pivotTable1.xml'),
-          /<pivotTableDefinition [^>]*name="Renamed"/,
-        );
-      },
-    },
-  ],
-  [
-    'pivotSetAnchor',
-    {
-      act: (b) => b.wb.pivotSetAnchor(0, b.pivot, 10, 2, 4, 2),
-      expect: (b) => {
-        const layout = b.wb.pivotLayout(0, b.pivot);
-        assert.equal(layout.top, 10);
-        assert.equal(layout.left, 2);
-        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotSetGrandTotals',
-    {
-      setup: (b) => b.wb.pivotSetColFieldOrder(0, b.pivot, [b.product]),
-      // Rows off drops the per-row total column; columns on keeps the
-      // bottom total row, so a swapped pair would show the opposite.
-      act: (b) => b.wb.pivotSetGrandTotals(0, b.pivot, false, true),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), [
-          'Sum of Amount|列ラベル|',
-          '行ラベル|Apple|Pear',
-          'East|10|5',
-          'West|30|7',
-          '総計|40|12',
-        ]),
-    },
-  ],
-  [
-    'pivotSetLayout',
-    {
-      act: (b) => b.wb.pivotSetLayout(0, b.pivot, 1),
-      expect: (b) => {
-        assert.equal(b.wb.pivotGetLayout(0, b.pivot).layout, 1);
-        assert.deepEqual(pivotGrid(b.wb), ['Region|Sum of Amount', 'East|15', 'West|37', '総計|52']);
-      },
-    },
-  ],
-  [
-    'pivotFieldAdd',
-    {
-      act: (b) => b.wb.pivotFieldAdd(0, b.pivot, { sourceName: 'Product', customName: 'Fruit', axis: 3 }),
-      expect: (b, r) => {
-        assert.equal(r.index, 4);
-        assert.deepEqual(pivotGrid(b.wb), ['Fruit|(すべて)', '|', ...BASE_GRID]);
-      },
-    },
-  ],
-  [
-    'pivotFieldClear',
-    {
-      setup: hideEast,
-      act: (b) => b.wb.pivotFieldClear(0, b.pivot),
-      expect: (b) => {
-        assert.equal(b.wb.pivotFieldCount(0, b.pivot).value, 0);
-        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotFieldSetAxis',
-    {
-      act: (b) => b.wb.pivotFieldSetAxis(0, b.pivot, b.product, 3),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['Product|(すべて)', '|', ...BASE_GRID]),
-    },
-  ],
-  [
-    'pivotFieldSetSort',
-    {
-      // East now outsums West, so sorting ascending by the data field
-      // differs from both label orders.
-      setup: (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 2, 40),
-      act: (b) => b.wb.pivotFieldSetSort(0, b.pivot, b.region, true, 'Sum of Amount'),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'West|37', 'East|45', '総計|82']),
-    },
-  ],
-  [
-    'pivotFieldSetSubtotalTop',
-    {
-      setup: twoLevels,
-      act: (b) => b.wb.pivotFieldSetSubtotalTop(0, b.pivot, b.region, true),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), [
-          '行ラベル|Sum of Amount',
-          'East|15',
-          'Apple|10',
-          'Pear|5',
-          'West|37',
-          'Apple|30',
-          'Pear|7',
-          '総計|52',
-        ]),
-    },
-  ],
-  [
-    'pivotFieldAddItem',
-    {
-      act: (b) => b.wb.pivotFieldAddItem(0, b.pivot, b.region, 'East', false),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
-    },
-  ],
-  [
-    'pivotFieldAddItemAt',
-    {
-      // Only the index-addressed form can name the blank item.
-      setup: (b) => {
-        b.wb.pivotCacheFieldAddSharedItemBlank(b.cacheId, 0);
-        b.wb.pivotCacheRecordSetBlank(b.cacheId, 0, 0);
-      },
-      act: (b) => b.wb.pivotFieldAddItemAt(0, b.pivot, b.region, 2, false),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '総計|42']),
-    },
-  ],
-  [
-    'pivotFieldClearItems',
-    {
-      setup: hideEast,
-      act: (b) => b.wb.pivotFieldClearItems(0, b.pivot, b.region),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), BASE_GRID),
-    },
-  ],
-  [
-    'pivotFieldSetItemVisible',
-    {
-      act: (b) => b.wb.pivotFieldSetItemVisible(0, b.pivot, b.region, 1, false),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|15', '総計|15']),
-    },
-  ],
-  [
-    'pivotFieldAddSubtotalFn',
-    {
-      setup: twoLevels,
-      act: (b) => b.wb.pivotFieldAddSubtotalFn(0, b.pivot, b.region, 3),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), [
-          '行ラベル|Sum of Amount',
-          'Apple|10',
-          'Pear|5',
-          'East|10',
-          'Apple|30',
-          'Pear|7',
-          'West|30',
-          '総計|52',
-        ]),
-    },
-  ],
-  [
-    'pivotFieldClearSubtotalFns',
-    {
-      setup: (b) => {
-        twoLevels(b);
-        b.wb.pivotFieldAddSubtotalFn(0, b.pivot, b.region, 3);
-      },
-      act: (b) => b.wb.pivotFieldClearSubtotalFns(0, b.pivot, b.region),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), TWO_LEVEL_GRID),
-    },
-  ],
-  [
-    'pivotFieldSetDateGroup',
-    {
-      setup: dateRows,
-      act: (b) => b.wb.pivotFieldSetDateGroup(0, b.pivot, b.date, 3, 1, -1, -1),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '令和6年|40', '令和7年|12', '総計|52']),
-    },
-  ],
-  [
-    'pivotFieldClearDateGroup',
-    {
-      setup: (b) => {
-        dateRows(b);
-        b.wb.pivotFieldSetDateGroup(0, b.pivot, b.date, 3, 0, -1, -1);
-      },
-      act: (b) => b.wb.pivotFieldClearDateGroup(0, b.pivot, b.date),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), DATE_SERIAL_GRID),
-    },
-  ],
-  [
-    'pivotFieldSetNumberFormat',
-    {
-      act: (b) => b.wb.pivotFieldSetNumberFormat(0, b.pivot, b.amount, '4'),
-      // A field's numFmtId is only observable in the part the writer emits.
-      expect: (b) => {
-        assert.equal(b.wb.pivotFieldSetNumberFormat(0, b.pivot, 99, '4').status, 2);
-        assert.equal(b.wb.pivotFieldSetNumberFormat(0, b.pivot, b.amount, '0.00').status, 2);
-        const saved = b.wb.save();
-        assert.ok(saved.status.ok, JSON.stringify(saved.status));
-        assert.match(packagePart(saved.bytes, 'xl/pivotTables/pivotTable1.xml'), /<pivotField [^>]*numFmtId="4"/);
-        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotSetRowFieldOrder',
-    {
-      act: (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.product]),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'Apple|40', 'Pear|12', '総計|52']),
-    },
-  ],
-  [
-    'pivotSetColFieldOrder',
-    {
-      act: (b) => b.wb.pivotSetColFieldOrder(0, b.pivot, [b.product]),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), [
-          'Sum of Amount|列ラベル||',
-          '行ラベル|Apple|Pear|総計',
-          'East|10|5|15',
-          'West|30|7|37',
-          '総計|40|12|52',
-        ]),
-    },
-  ],
-  [
-    'pivotDataFieldAdd',
-    {
-      act: (b) => b.wb.pivotDataFieldAdd(0, b.pivot, { name: 'Max of Amount', fieldIndex: b.amount, aggregation: 3 }),
-      expect: (b, r) => {
-        assert.equal(r.index, 1);
-        assert.deepEqual(pivotGrid(b.wb), [
-          '行ラベル|Sum of Amount|Max of Amount',
-          'East|15|10',
-          'West|37|30',
-          '総計|52|30',
-        ]);
-      },
-    },
-  ],
-  [
-    'pivotDataFieldClear',
-    {
-      act: (b) => b.wb.pivotDataFieldClear(0, b.pivot),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル', 'East', 'West', '総計']),
-    },
-  ],
-  [
-    'pivotDataFieldSet',
-    {
-      act: (b) =>
-        b.wb.pivotDataFieldSet(0, b.pivot, 0, {
-          name: 'Count of Amount',
-          fieldIndex: b.amount,
-          aggregation: 1,
-          numberFormat: '2',
-        }),
-      expect: (b) => {
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Count of Amount', 'East|2', 'West|2', '総計|4']);
-        const counts = b.wb.pivotLayout(0, b.pivot).cells.filter((c) => c.value.kind === 1);
-        assert.deepEqual(
-          counts.map((c) => c.numberFormat),
-          ['2', '2', '2'],
-        );
-      },
-    },
-  ],
-  [
-    'pivotFilterAdd',
-    {
-      act: (b) => b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
-    },
-  ],
-  [
-    'pivotFilterClear',
-    {
-      setup: (b) => b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20),
-      act: (b) => b.wb.pivotFilterClear(0, b.pivot),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), BASE_GRID),
-    },
-  ],
-  [
-    'pivotFilterRemoveAt',
-    {
-      // Each filter alone keeps a different region, so removing the wrong
-      // index leaves the wrong one.
-      setup: (b) => {
-        b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20);
-        b.wb.pivotFilterAdd(0, b.pivot, BETWEEN_10_20);
-      },
-      act: (b) => b.wb.pivotFilterRemoveAt(0, b.pivot, 1),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
-    },
-  ],
-];
-
-test('the pivot mutator table covers every declared pivot mutator', async () => {
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
-  const declared = [...dts.matchAll(/^ {2}(pivot\w*)\([^)]*\): (?:Status|AddStyleResult);/gm)].map((m) => m[1]);
-  assert.ok(declared.length > 40, `expected the pivot mutator family, found ${declared.length}`);
-  const covered = PIVOT_MUTATORS.map(([name]) => name);
-  assert.deepEqual(
-    declared.filter((name) => !covered.includes(name)),
-    [],
-    'pivot mutators without a row',
-  );
-  assert.deepEqual(
-    covered.filter((name) => !declared.includes(name)),
-    [],
-    'rows for methods that are not declared pivot mutators',
-  );
-});
-
-test('pivot mutators forward their arguments to the C ABI', async () => {
-  const mod = await getModule();
-  const base = buildPivot(mod);
-  try {
-    assert.deepEqual(pivotGrid(base.wb), BASE_GRID);
-  } finally {
-    base.wb.dispose();
-  }
-  for (const [name, row] of PIVOT_MUTATORS) {
-    const b = buildPivot(mod);
-    try {
-      row.setup?.(b);
-      const r = row.act(b);
-      const status = typeof r.ok === 'boolean' ? r : r.status;
-      assert.ok(status.ok, `${name}: ${JSON.stringify(status)}`);
-      row.after?.(b);
-      row.expect(b, r);
-    } catch (err) {
-      err.message = `${name}: ${err.message}`;
-      throw err;
-    } finally {
-      b.wb.dispose();
-    }
-  }
-});
-
-// ---- Status on the fallible accessors ----------------------------------
-//
-// Every accessor backed by a status-returning C ABI call carries that
-// status, so a rejected argument or a released handle cannot read as a
-// legitimate zero count, empty name, or unspilled cell. Each row is
-// [method, args that succeed, args the engine rejects (or null when only
-// a released handle can fail it)].
-const STATUS_ACCESSORS = [
-  ['sheetCount', [], null],
-  ['cellCount', [0], [99]],
-  ['definedNameCount', [], null],
-  ['tableCount', [], null],
-  ['passthroughCount', [], null],
-  ['pivotCount', [0], [99]],
-  ['pivotCacheCount', [], null],
-  ['pivotCacheFieldCount', null, [9999]],
-  ['pivotCacheFieldSharedItemCount', null, [9999, 0]],
-  ['pivotCacheRecordCount', null, [9999]],
-  ['pivotFieldCount', null, [99, 0]],
-  ['pivotDataFieldCount', null, [99, 0]],
-  ['pivotFilterCount', null, [99, 0]],
-  ['fontCount', [], null],
-  ['fillCount', [], null],
-  ['borderCount', [], null],
-  ['xfCount', [], null],
-  ['dxfCount', [], null],
-  ['cellStyleCount', [], null],
-  ['cellStyleXfCount', [], null],
-  ['calcMode', [], null],
-  ['excelProfileId', [], null],
-  ['localizeFunctionName', ['SUM', 0], ['NOPE_XYZ', 0]],
-  ['canonicalizeFunctionName', ['SUM', 0], ['NOPE_XYZ', 0]],
-  ['pinnedNow', [], null],
-  ['spillInfo', [0, 0, 0], [99, 0, 0]],
-  ['precedents', [0, 0, 0, 1], [99, 0, 0, 1]],
-  ['dependents', [0, 0, 0, 1], [99, 0, 0, 1]],
-  ['functionNames', [], null],
-];
-
-// The payload a failed call must fall back to, keyed by what it returns.
-function assertFailurePayload(name, r) {
-  if (Array.isArray(r)) assert.equal(r.length, 0, name);
-  else if ('now' in r) assert.equal(r.now, null, name);
-  else if ('engaged' in r) assert.equal(r.engaged, false, name);
-  else if (typeof r.value === 'string') assert.equal(r.value, '', name);
-  else assert.equal(r.value, 0, name);
-}
-
-test('every NumberResult accessor is covered by the status table', async () => {
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
-  const declared = [...dts.matchAll(/^ {2}([A-Za-z]\w*)\([^)]*\): NumberResult\b/gm)].map((m) => m[1]);
-  const covered = new Set(STATUS_ACCESSORS.map(([name]) => name));
-  assert.deepEqual(
-    declared.filter((name) => !covered.has(name)),
-    [],
-    'NumberResult accessors missing from STATUS_ACCESSORS',
-  );
-});
-
-test('fallible accessors report their status on success, rejection and a released handle', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  for (const [name, okArgs, badArgs] of STATUS_ACCESSORS) {
-    if (okArgs !== null) {
-      const r = wb[name](...okArgs);
-      assert.ok(r.status.ok, `${name}: ${JSON.stringify(r.status)}`);
-    }
-    if (badArgs !== null) {
-      const r = wb[name](...badArgs);
-      assert.equal(r.status.ok, false, `${name} must report the rejected arguments`);
-      assert.notEqual(r.status.status, 0, name);
-      assertFailurePayload(name, r);
-    }
-  }
-  assert.equal(wb.sheetCount().value, 1);
-  assert.equal(wb.excelProfileId().value, 'win-365-ja_JP');
-  assert.equal(wb.localizeFunctionName('SUM', 1).value, 'SUM');
-  assert.equal(wb.localizeFunctionName('SUM', 99).status.ok, false);
-
-  wb.dispose();
-  const dead = wb;
-  // Every accessor, including the ones no argument can fail, reports the
-  // released handle instead of a default reading.
-  for (const [name, okArgs, badArgs] of STATUS_ACCESSORS) {
-    if (name.endsWith('FunctionName') || name === 'functionNames') continue;
-    const r = dead[name](...(okArgs ?? badArgs));
-    assert.equal(r.status.ok, false, `${name} after release`);
-    assert.equal(r.status.status, 7000, name);
-    assertFailurePayload(name, r);
-  }
-});
-
-test('list getters carry a status and stop at the first element failure', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    // A readable sheet: every list is empty but the enumeration succeeded,
-    // which is what distinguishes it from a sheet that could not be read.
-    for (const [name, call] of [
-      ['getMerges', () => wb.getMerges(0)],
-      ['getComments', () => wb.getComments(0)],
-      ['getHyperlinks', () => wb.getHyperlinks(0)],
-      ['getValidations', () => wb.getValidations(0)],
-      ['getConditionalFormats', () => wb.getConditionalFormats(0)],
-      ['getExternalLinks', () => wb.getExternalLinks()],
-    ]) {
-      const list = call();
-      assert.ok(Array.isArray(list), `${name} must stay an array`);
-      assert.equal(list.length, 0, name);
-      assert.ok(list.status.ok, `${name}: ${JSON.stringify(list.status)}`);
-    }
-
-    // An unreadable sheet is reported, not silently rendered as "empty".
-    for (const [name, call] of [
-      ['getMerges', () => wb.getMerges(99)],
-      ['getComments', () => wb.getComments(99)],
-      ['getHyperlinks', () => wb.getHyperlinks(99)],
-      ['getValidations', () => wb.getValidations(99)],
-      ['getConditionalFormats', () => wb.getConditionalFormats(99)],
-    ]) {
-      const list = call();
-      assert.ok(Array.isArray(list), `${name} must stay an array`);
-      assert.equal(list.status.ok, false, `${name} must signal an unreadable sheet`);
-      assert.notEqual(list.status.status, 0, name);
-    }
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('a throwing iterative progress callback aborts the solve and reports a status', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    assert.ok(wb.setIterative(true, 100, 0.0001).ok);
-    assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
-    let calls = 0;
-    assert.ok(
-      wb.setIterativeProgress(() => {
-        calls += 1;
-        throw new Error('callback failure');
-      }).ok,
-    );
-
-    // Reported as a status rather than propagated, and with the same
-    // ordinal the WASM binding uses (`kBindingCallbackException`).
-    const aborted = wb.recalc();
-    assert.equal(aborted.ok, false, `expected a failure envelope: ${JSON.stringify(aborted)}`);
-    assert.equal(aborted.status, 7003);
-    // The engine reported success (it only saw a cancellation), so there
-    // is no thread-local diagnostic to read here -- this must be the
-    // binding's own message, matching the WASM package's, not the residue
-    // of an earlier call.
-    assert.equal(aborted.message, 'the iterative progress callback threw; the solve was aborted');
-    assert.equal(aborted.context, 'Workbook.setIterativeProgress');
-    assert.equal(calls, 1, 'the solve must stop at the first throw');
-
-    const mid = wb.getValue(0, 0, 0);
-    assert.ok(mid.status.ok, JSON.stringify(mid.status));
-
-    assert.ok(wb.setIterativeProgress(null).ok);
-    assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
-    const recovered = wb.recalc();
-    assert.ok(recovered.ok, `recalc after the throwing callback: ${JSON.stringify(recovered)}`);
-    const converged = wb.getValue(0, 0, 0);
-    assert.ok(Math.abs(converged.value.number - 10) < 0.001, `A1=${converged.value.number}`);
-  } finally {
-    wb.setIterativeProgress(null);
-    wb.dispose();
-  }
-});
-
-// `CfValueObjectInput.type`: 0 num, 1 percent, 2 percentile, 3 min,
-// 4 max, 5 formula, 6 autoMin, 7 autoMax. Every threshold below states a
-// `value`, which is what puts a borrowed string behind each CFVO.
-const COLOR_SCALE_RULE = Object.freeze({
-  sqref: [{ firstRow: 0, firstCol: 0, lastRow: 4, lastCol: 0 }],
-  type: 2,
-  colorScale: {
-    thresholds: [
-      { type: 0, value: '0' },
-      { type: 1, value: '50' },
-      { type: 0, value: '100' },
-    ],
-    colors: [
-      { r: 248, g: 105, b: 107, a: 255 },
-      { r: 255, g: 235, b: 132, a: 255 },
-      { r: 99, g: 190, b: 123, a: 255 },
-    ],
-  },
-});
-
-const DATA_BAR_RULE = Object.freeze({
-  sqref: [{ firstRow: 0, firstCol: 1, lastRow: 4, lastCol: 1 }],
-  type: 3,
-  dataBar: {
-    min: { type: 0, value: '5' },
-    max: { type: 0, value: '95' },
-    fill: { r: 0, g: 112, b: 192, a: 255 },
-  },
-});
-
-const ICON_SET_RULE = Object.freeze({
-  sqref: [{ firstRow: 0, firstCol: 2, lastRow: 4, lastCol: 2 }],
-  type: 4,
-  iconSet: {
-    name: 0,
-    thresholds: [
-      { type: 1, value: '0' },
-      { type: 1, value: '33' },
-      { type: 1, value: '67' },
-    ],
-  },
-});
-
-const EXPECTED_CFVO_VALUES = Object.freeze(['0', '50', '100', '5', '95', '0', '33', '67']);
-
-// The threshold value strings of the three visual rules, flattened.
-function cfvoValues(rules) {
-  const byType = new Map(rules.map((rule) => [rule.type, rule]));
-  const colorScale = byType.get(2);
-  const dataBar = byType.get(3);
-  const iconSet = byType.get(4);
-  assert.ok(colorScale?.colorScale, 'colorScale payload missing');
-  assert.ok(dataBar?.dataBar, 'dataBar payload missing');
-  assert.ok(iconSet?.iconSet, 'iconSet payload missing');
-  return [
-    ...colorScale.colorScale.thresholds.map((t) => t.value),
-    dataBar.dataBar.min.value,
-    dataBar.dataBar.max.value,
-    ...iconSet.iconSet.thresholds.map((t) => t.value),
-  ];
-}
-
-test('CFVO value strings survive getConditionalFormats and a save/load cycle', async () => {
-  // Each CFVO `value` crosses the C ABI as a borrowed `const char*`. A
-  // store that relocates while the later thresholds are pulled publishes
-  // a pointer into freed bytes, so the strings come back wrong or empty
-  // even though the rule count and colors still look right. Rules whose
-  // thresholds are all `min` / `max` never take that path, because those
-  // types carry no value string.
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  let bytes;
-  try {
-    for (const rule of [COLOR_SCALE_RULE, DATA_BAR_RULE, ICON_SET_RULE]) {
-      const added = wb.addConditionalFormat(0, rule);
-      assert.ok(added.status.ok, `addConditionalFormat type=${rule.type}: ${JSON.stringify(added.status)}`);
-    }
-
-    const inSession = wb.getConditionalFormats(0);
-    assert.ok(inSession.status.ok, JSON.stringify(inSession.status));
-    assert.equal(inSession.length, 3);
-    assert.deepEqual(cfvoValues(inSession), EXPECTED_CFVO_VALUES);
-    const byType = new Map(inSession.map((rule) => [rule.type, rule]));
-    // The type travels with the value: a percent threshold read back as
-    // type 0 would mean an absolute number instead.
-    assert.deepEqual(
-      byType.get(2).colorScale.thresholds.map((t) => t.type),
-      [0, 1, 0],
-    );
-    assert.deepEqual(
-      byType.get(4).iconSet.thresholds.map((t) => t.type),
-      [1, 1, 1],
-    );
-    assert.equal(byType.get(2).colorScale.colors.length, 3);
-    assert.equal(byType.get(2).colorScale.colors[2].g, 190);
-    assert.equal(byType.get(3).dataBar.fill.b, 192);
-
-    const saved = wb.save();
-    assert.ok(saved.status.ok, JSON.stringify(saved.status));
-    bytes = saved.bytes;
-  } finally {
-    wb.dispose();
-  }
-
-  const reloaded = mod.Workbook.loadBytes(bytes);
-  try {
-    const rules = reloaded.getConditionalFormats(0);
-    assert.equal(rules.length, 3);
-    assert.deepEqual(cfvoValues(rules), EXPECTED_CFVO_VALUES);
-  } finally {
-    reloaded.dispose();
-  }
-});
-
-test('getIterative reads back what setIterative stored', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    const initial = wb.getIterative();
-    assert.ok(initial.status.ok, `getIterative: ${JSON.stringify(initial.status)}`);
-    assert.equal(typeof initial.enabled, 'boolean');
-    assert.equal(typeof initial.maxIterations, 'number');
-    assert.equal(typeof initial.maxChange, 'number');
-
-    assert.ok(wb.setIterative(true, 42, 0.25).ok);
-    const enabled = wb.getIterative();
-    assert.ok(enabled.status.ok);
-    assert.equal(enabled.enabled, true);
-    assert.equal(enabled.maxIterations, 42);
-    assert.equal(enabled.maxChange, 0.25);
-
-    // The cap and threshold survive switching iteration back off, which is
-    // what lets a host render the dialog with the stored values.
-    assert.ok(wb.setIterative(false, 42, 0.25).ok);
-    const disabled = wb.getIterative();
-    assert.ok(disabled.status.ok);
-    assert.equal(disabled.enabled, false);
-    assert.equal(disabled.maxIterations, 42);
-    assert.equal(disabled.maxChange, 0.25);
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('addValidation defaults allowBlank to false', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    assert.ok(
-      wb.addValidation(0, {
-        ranges: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
-        type: 3,
-        formula1: '"a,b"',
-      }).ok,
-    );
-    const list = wb.getValidations(0);
-    assert.equal(list.length, 1);
-    assert.equal(list[0].allowBlank, false);
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('getCellStyleXf reports xfId alongside the cell-format fields', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    const read = wb.getCellStyleXf(0);
-    assert.ok(read.status.ok, `getCellStyleXf: ${JSON.stringify(read.status)}`);
-    // A named-style xf is its own parent, so it never inherits one.
-    assert.equal(read.xfId, 0);
-    // The record shape matches `getCellXf`, which the documented
-    // read / edit / addCellStyleXf round-trip depends on.
-    const cellXf = wb.getCellXf(0);
-    assert.ok(cellXf.status.ok);
-    for (const key of Object.keys(cellXf)) {
-      assert.ok(key in read, `getCellStyleXf is missing '${key}'`);
-    }
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('pivotFieldAddItemAt hides the blank item an empty label cannot name', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    const cache = wb.pivotCacheCreate(0);
-    assert.ok(cache.status.ok, `pivotCacheCreate: ${JSON.stringify(cache.status)}`);
-    const region = wb.pivotCacheFieldAdd(cache.index, 'Region');
-    assert.ok(region.status.ok);
-    const amount = wb.pivotCacheFieldAdd(cache.index, 'Amount');
-    assert.ok(amount.status.ok);
-    // Shared item 0 renders as "North"; shared item 1 is the blank, which
-    // carries no label of its own and can only be named by its index.
-    assert.ok(wb.pivotCacheFieldAddSharedItemText(cache.index, region.index, 'North').ok);
-    assert.ok(wb.pivotCacheFieldAddSharedItemBlank(cache.index, region.index).ok);
-
-    const first = wb.pivotCacheRecordAdd(cache.index);
-    assert.ok(first.status.ok);
-    assert.ok(wb.pivotCacheRecordSetNumber(cache.index, first.index, region.index, 0).ok);
-    assert.ok(wb.pivotCacheRecordSetNumber(cache.index, first.index, amount.index, 100).ok);
-    const second = wb.pivotCacheRecordAdd(cache.index);
-    assert.ok(second.status.ok);
-    assert.ok(wb.pivotCacheRecordSetBlank(cache.index, second.index, region.index).ok);
-    assert.ok(wb.pivotCacheRecordSetNumber(cache.index, second.index, amount.index, 200).ok);
-
-    const pivot = wb.pivotCreate(0, 'PT', cache.index, 0, 0);
-    assert.ok(pivot.status.ok, `pivotCreate: ${JSON.stringify(pivot.status)}`);
-    const regionField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Region', axis: 0 });
-    assert.ok(regionField.status.ok);
-    const amountField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Amount', axis: 2 });
-    assert.ok(amountField.status.ok);
-    assert.ok(wb.pivotSetRowFieldOrder(0, pivot.index, [regionField.index]).ok);
-    assert.ok(
-      wb.pivotDataFieldAdd(0, pivot.index, {
-        name: 'Sum of Amount',
-        fieldIndex: amountField.index,
-        aggregation: 0,
-      }).status.ok,
-    );
-
-    const sumDataCells = () => {
-      const layout = wb.pivotLayout(0, pivot.index);
-      assert.ok(layout.status.ok, `pivotLayout: ${JSON.stringify(layout.status)}`);
-      let total = 0;
-      for (const cell of layout.cells) {
-        if (cell.kind === mod.PivotCellKind.Data && cell.value.kind === mod.ValueKind.Number) {
-          total += cell.value.number;
-        }
-      }
-      return total;
-    };
-    assert.equal(sumDataCells(), 300);
-
-    assert.ok(wb.pivotFieldAddItem(0, pivot.index, regionField.index, 'North', true).ok);
-    assert.ok(wb.pivotFieldAddItemAt(0, pivot.index, regionField.index, 1, false).ok);
-    assert.equal(sumDataCells(), 100);
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('a rejected argument reports its own diagnostic, not the previous call', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    // Leave a failure of a different call in the thread-local diagnostics.
-    const stale = wb.getValue(99, 0, 0);
-    assert.equal(stale.status.ok, false);
-    assert.ok(stale.status.message.length > 0);
-
-    // An argument the binding rejects before any C call carries its own
-    // message, and a code that names an argument fault rather than the
-    // destroyed-handle code.
-    const missingSpec = wb.pivotFieldAdd(0, 0);
-    assert.equal(missingSpec.status.ok, false);
-    assert.equal(missingSpec.status.status, 7001);
-    assert.match(missingSpec.status.message, /pivotFieldAdd/);
-    assert.notEqual(missingSpec.status.message, stale.status.message);
-    assert.equal(missingSpec.status.context, '');
-
-    const badCallback = wb.setIterativeProgress(42);
-    assert.equal(badCallback.ok, false);
-    assert.equal(badCallback.status, 7001);
-    assert.match(badCallback.message, /callback/);
-  } finally {
-    wb.setIterativeProgress(null);
-    wb.dispose();
-  }
-});
-
-test('a call on a disposed workbook names the destroyed handle', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  wb.dispose();
-  // 7000 is reserved for this: an argument fault reports 7001 instead, so
-  // "make a new workbook" stays the correct recovery for exactly this code.
-  const after = wb.recalc();
-  assert.equal(after.ok, false);
-  assert.equal(after.status, 7000);
-  assert.ok(after.message.length > 0, 'the destroyed-handle status must carry a message');
-});
-
-test('sheet-layout setters refuse coordinates and metrics Excel cannot open', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    // These six setters marshal straight to the C ABI, which is where the
-    // validation lives. The assertions below are what keeps that true: a
-    // binding that grew its own path to the model would still pass every
-    // round-trip test while quietly authoring a file Excel refuses, since
-    // NaN and Infinity serialise to an empty string -- `<col width=""/>`
-    // is not a lexical xsd:double at all, and a repair prompt rather than
-    // an out-of-range value.
-    const kInvalidArgument = 2;
-    // The message is pinned, not just the code. Both JS bindings route
-    // these calls to one set of C ABI helpers, so both report that shared
-    // wording; a binding that grew its own check would keep returning
-    // `kInvalidArgument` while the text stopped matching. The status code
-    // alone cannot tell a shared implementation from two that agree today.
-    const kSpanRefused = 'column span out of range';
-    const kRowRefused = 'row index out of range';
-    const kMetricRefused = 'value must be finite and non-negative';
-    // These six setters answer with a bare Status, not a `{status}`
-    // envelope, so the diagnostics are read off the returned object.
-    const refused = (status, expectedMessage, label) => {
-      assert.equal(status.ok, false, `${label} should have been refused`);
-      assert.equal(status.status, kInvalidArgument, `${label}: ${JSON.stringify(status)}`);
-      assert.equal(status.message, expectedMessage, `${label}: ${JSON.stringify(status)}`);
-    };
-
-    // One past Excel's last column / row.
-    refused(wb.setColumnWidth(0, 0, 16384, 10), kSpanRefused, 'setColumnWidth past the grid');
-    refused(wb.setColumnHidden(0, 0, 16384, true), kSpanRefused, 'setColumnHidden past the grid');
-    refused(wb.setColumnOutline(0, 0, 16384, 1), kSpanRefused, 'setColumnOutline past the grid');
-    refused(wb.setRowHeight(0, 1048576, 10), kRowRefused, 'setRowHeight past the grid');
-    refused(wb.setRowHidden(0, 1048576, true), kRowRefused, 'setRowHidden past the grid');
-    refused(wb.setRowOutline(0, 1048576, 1), kRowRefused, 'setRowOutline past the grid');
-
-    for (const bad of [Number.NaN, Number.POSITIVE_INFINITY, Number.NEGATIVE_INFINITY, -1]) {
-      refused(wb.setColumnWidth(0, 0, 2, bad), kMetricRefused, `setColumnWidth(${bad})`);
-      refused(wb.setRowHeight(0, 1, bad), kMetricRefused, `setRowHeight(${bad})`);
-    }
-
-    // The context names the C ABI entry point that refused the call and
-    // the values it saw, which is what makes a rejection actionable.
-    const span = wb.setColumnWidth(0, 0, 16384, 10);
-    assert.match(span.context, /fm_sheet_set_column_width: first=0 last=16384/);
-    const metric = wb.setRowHeight(0, 1, Number.NaN);
-    assert.match(metric.context, /fm_sheet_set_row_height: height=/);
-
-    // Zero is a real width and a real height, not a rejected one.
-    assert.ok(wb.setColumnWidth(0, 0, 2, 0).ok);
-    assert.ok(wb.setRowHeight(0, 1, 0).ok);
-
-    // The last coordinates Excel does address stay accepted -- an
-    // off-by-one in either bound would refuse them.
-    assert.ok(wb.setColumnWidth(0, 16383, 16383, 10).ok);
-    assert.ok(wb.setColumnHidden(0, 16383, 16383, true).ok);
-    assert.ok(wb.setColumnOutline(0, 16383, 16383, 1).ok);
-    assert.ok(wb.setRowHeight(0, 1048575, 10).ok);
-    assert.ok(wb.setRowHidden(0, 1048575, true).ok);
-    assert.ok(wb.setRowOutline(0, 1048575, 1).ok);
-  } finally {
-    wb.dispose();
-  }
-});
-
-test('setSheetVisibility states veryHidden, which the bool setter cannot', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  try {
-    const read = () => {
-      const r = wb.getSheetView(0);
-      assert.ok(r.status.ok, `getSheetView: ${JSON.stringify(r.status)}`);
-      return r.view;
-    };
-    assert.equal(read().visibility, mod.SheetVisibility.Visible);
-    assert.equal(read().tabHidden, 0);
-
-    assert.ok(wb.setSheetVisibility(0, mod.SheetVisibility.VeryHidden).ok);
-    // The two-state view stays consistent: a very-hidden sheet reads as
-    // hidden to a caller that knows only the bool, never as visible.
-    assert.equal(read().visibility, mod.SheetVisibility.VeryHidden);
-    assert.equal(read().tabHidden, 1);
-
-    // Asking for plain "hidden" must not weaken the stronger state.
-    assert.ok(wb.setSheetTabHidden(0, true).ok);
-    assert.equal(read().visibility, mod.SheetVisibility.VeryHidden);
-
-    // Demotion is the other direction the bool cannot express.
-    assert.ok(wb.setSheetVisibility(0, mod.SheetVisibility.Hidden).ok);
-    assert.equal(read().visibility, mod.SheetVisibility.Hidden);
-    assert.equal(read().tabHidden, 1);
-
-    // Showing the sheet clears either hidden state.
-    assert.ok(wb.setSheetTabHidden(0, false).ok);
-    assert.equal(read().visibility, mod.SheetVisibility.Visible);
-    assert.equal(read().tabHidden, 0);
-
-    // An unknown ordinal is refused and leaves the sheet alone.
-    assert.ok(wb.setSheetVisibility(0, mod.SheetVisibility.VeryHidden).ok);
-    assert.equal(wb.setSheetVisibility(0, 3).ok, false);
-    assert.equal(read().visibility, mod.SheetVisibility.VeryHidden);
-  } finally {
-    wb.dispose();
-  }
-});
+// Topic modules are statically imported in the original registration order.
+
+import './smoke_surface_log_eval_print.mjs';
+import './smoke_lifecycle_recalc.mjs';
+import './smoke_layout_styles.mjs';
+import './smoke_callbacks_cf.mjs';
+import './smoke_pivot_surfaces.mjs';
+import './smoke_cells_io_catalog.mjs';
+import './smoke_result_contracts.mjs';
+import './smoke_pivot_mutators_status.mjs';
+import './smoke_regressions.mjs';
+import './smoke_cell_geometry_display.mjs';
+import './smoke_theme_styles.mjs';
+import './smoke_filter_validation_comments.mjs';
+import './smoke_drawing.mjs';
diff --git a/packages/npm-native/test/smoke_callbacks_cf.mjs b/packages/npm-native/test/smoke_callbacks_cf.mjs
new file mode 100644
index 000000000..be0efbe90
--- /dev/null
+++ b/packages/npm-native/test/smoke_callbacks_cf.mjs
@@ -0,0 +1,108 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+test('setIterativeProgress accepts a function and accepts null to clear', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Registration roundtrip; we don't assert the callback fires because
+  // a non-iterative recalc never invokes the trampoline. The smoke
+  // signal we want is "the addon does not crash on register / clear".
+  const cb = () => true;
+  const reg = wb.setIterativeProgress(cb);
+  assert.ok(reg.ok, `setIterativeProgress(fn): ${JSON.stringify(reg)}`);
+  const clr = wb.setIterativeProgress(null);
+  assert.ok(clr.ok, `setIterativeProgress(null): ${JSON.stringify(clr)}`);
+});
+
+test('setIterativeProgress keeps callbacks isolated per Workbook', async () => {
+  const mod = await getModule();
+  const first = mod.Workbook.createDefault();
+  const second = mod.Workbook.createDefault();
+  let firstCalls = 0;
+  let secondCalls = 0;
+
+  for (const wb of [first, second]) {
+    assert.ok(wb.setIterative(true, 10, 0.001).ok);
+    assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
+  }
+  assert.ok(
+    first.setIterativeProgress(() => {
+      firstCalls += 1;
+      return true;
+    }).ok,
+  );
+  assert.ok(
+    second.setIterativeProgress(() => {
+      secondCalls += 1;
+      return true;
+    }).ok,
+  );
+
+  assert.ok(first.recalc().ok);
+  assert.ok(firstCalls > 0);
+  assert.equal(secondCalls, 0);
+});
+
+test('dispose is rejected while this workbook is executing its progress callback', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setIterative(true, 10, 0.001).ok);
+  assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
+  let calls = 0;
+  assert.ok(
+    wb.setIterativeProgress(() => {
+      calls += 1;
+      assert.throws(() => wb.dispose(), /cannot dispose a Workbook/);
+      return true;
+    }).ok,
+  );
+  assert.ok(wb.recalc().ok);
+  assert.ok(calls > 0);
+  assert.equal(wb.isValid(), true);
+  wb.dispose();
+});
+
+test('evaluateCfRange returns ok envelope with empty cells for a CF-less workbook', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // The default workbook has no CF rules, so the call should succeed
+  // and return an empty cell list. NaN disables `TimePeriod` rules.
+  const r = wb.evaluateCfRange(0, 0, 0, 4, 4, Number.NaN);
+  assert.ok(r.status.ok, `evaluateCfRange: ${JSON.stringify(r.status)}`);
+  assert.ok(Array.isArray(r.cells));
+  assert.equal(r.cells.length, 0);
+});
+
+test('evaluateCfRange with todaySerial omitted disables timePeriod rules', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // timePeriod rule (type 15) for "today" (period 0) over A1. The cell
+  // holds the serial for 1899-12-30, which a 0.0 basis would match.
+  assert.ok(wb.setNumber(0, 0, 0, 0).ok);
+  const dxf = wb.addDxf({ font: { bold: true } });
+  assert.ok(dxf.status.ok, JSON.stringify(dxf.status));
+  const add = wb.addConditionalFormat(0, {
+    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+    type: 15,
+    timePeriod: 0,
+    dxfId: dxf.index,
+  });
+  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
+  assert.ok(wb.recalc().ok);
+
+  // Omitting todaySerial must behave like passing NaN (the documented
+  // disabling value), not like passing 0 -- which is the valid serial for
+  // 1899-12-30 and would make the rule match.
+  const omitted = wb.evaluateCfRange(0, 0, 0, 0, 0);
+  assert.ok(omitted.status.ok, `evaluateCfRange: ${JSON.stringify(omitted.status)}`);
+  const explicitNaN = wb.evaluateCfRange(0, 0, 0, 0, 0, Number.NaN);
+  assert.ok(explicitNaN.status.ok, `evaluateCfRange: ${JSON.stringify(explicitNaN.status)}`);
+  assert.equal(omitted.cells.length, explicitNaN.cells.length);
+  assert.equal(omitted.cells.length, 0);
+
+  // A concrete basis of 0 does engage the rule, proving the default is
+  // not merely a no-op for this workbook.
+  const zeroBasis = wb.evaluateCfRange(0, 0, 0, 0, 0, 0);
+  assert.ok(zeroBasis.status.ok, `evaluateCfRange: ${JSON.stringify(zeroBasis.status)}`);
+  assert.equal(zeroBasis.cells.length, 1);
+});
diff --git a/packages/npm-native/test/smoke_cell_geometry_display.mjs b/packages/npm-native/test/smoke_cell_geometry_display.mjs
new file mode 100644
index 000000000..fa4ddfad7
--- /dev/null
+++ b/packages/npm-native/test/smoke_cell_geometry_display.mjs
@@ -0,0 +1,266 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+const A1_B2 = { firstRow: 0, firstCol: 0, lastRow: 1, lastCol: 1 };
+
+test('getCellXf carries apply flags, quotePrefix and protection', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const added = wb.addXf({
+    fontIndex: 0,
+    fillIndex: 0,
+    borderIndex: 0,
+    numFmtId: 0,
+    horizontalAlign: 0,
+    verticalAlign: 2,
+    wrapText: false,
+    applyNumberFormat: true,
+    applyFont: true,
+    applyProtection: true,
+    quotePrefix: true,
+    locked: false,
+    hidden: true,
+  });
+  assert.ok(added.status.ok, JSON.stringify(added.status));
+  const xf = wb.getCellXf(added.index);
+  assert.ok(xf.status.ok);
+  assert.equal(xf.applyNumberFormat, true);
+  assert.equal(xf.applyFont, true);
+  assert.equal(xf.applyFill, false);
+  assert.equal(xf.applyBorder, false);
+  assert.equal(xf.applyAlignment, false);
+  assert.equal(xf.applyProtection, true);
+  assert.equal(xf.quotePrefix, true);
+  assert.equal(xf.hasProtection, true);
+  assert.equal(xf.locked, false);
+  assert.equal(xf.hidden, true);
+
+  const plain = wb.getCellXf(0);
+  assert.equal(plain.hasProtection, false);
+  assert.equal(plain.locked, true);
+  assert.equal(plain.hidden, false);
+  assert.equal(plain.quotePrefix, false);
+
+  const failed = wb.getCellXf(99999);
+  assert.equal(failed.status.ok, false);
+  assert.equal(failed.quotePrefix, false);
+  assert.equal(failed.locked, true);
+});
+
+test('row overrides report hasHeight / customHeight and clearRowHeight drops the height', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setRowHeight(0, 3, 30).ok);
+  let rows = wb.getSheetRowOverrides(0).rows;
+  const row = rows.find((r) => r.row === 3);
+  assert.ok(row);
+  assert.equal(row.height, 30);
+  assert.equal(row.hasHeight, 1);
+  assert.equal(row.customHeight, 1);
+  assert.ok(wb.clearRowHeight(0, 3).ok);
+  rows = wb.getSheetRowOverrides(0).rows;
+  assert.equal(
+    rows.find((r) => r.row === 3),
+    undefined,
+  );
+  assert.equal(wb.clearRowHeight(0, 2000000).ok, false);
+});
+
+test('sheet format defaults round-trip', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const set = wb.setSheetFormatDefaults(0, { defaultColWidth: 12.5, defaultRowHeight: 18, baseColWidth: 10 });
+  assert.ok(set.ok, JSON.stringify(set));
+  const d = wb.getSheetFormatDefaults(0);
+  assert.ok(d.status.ok);
+  assert.equal(d.defaultColWidth, 12.5);
+  assert.equal(d.defaultRowHeight, 18);
+  assert.equal(d.baseColWidth, 10);
+  assert.equal(d.hasDefaultColWidth, true);
+  assert.equal(d.hasDefaultRowHeight, true);
+  assert.equal(wb.setSheetFormatDefaults(0, { defaultColWidth: -1 }).ok, false);
+  assert.equal(wb.getSheetFormatDefaults(99).status.ok, false);
+  assert.equal(wb.getSheetFormatDefaults(99).hasDefaultColWidth, false);
+});
+
+test('geometry accessors agree with each other', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setRowHeight(0, 0, 20).ok);
+  assert.ok(wb.setRowHeight(0, 1, 30).ok);
+  const model = wb.getWidthModel(0, 0);
+  assert.ok(model.status.ok, JSON.stringify(model.status));
+  assert.equal(typeof model.pointsPerChar, 'number');
+  assert.equal(typeof model.calibrated, 'boolean');
+  assert.equal(typeof model.normalFontName, 'string');
+  assert.equal(model.platform, 'win');
+
+  const c0 = wb.getColumnWidthPt(0, 0, 0);
+  const c1 = wb.getColumnWidthPt(0, 1, 0);
+  assert.ok(c0.status.ok);
+  assert.ok(c0.value > 0);
+  assert.equal(wb.getRowHeightPt(0, 1).value, 30);
+
+  const rect = wb.getCellRectPt(0, A1_B2, 0);
+  assert.ok(rect.status.ok);
+  assert.equal(rect.x, 0);
+  assert.equal(rect.y, 0);
+  assert.ok(Math.abs(rect.width - (c0.value + c1.value)) < 1e-9);
+  assert.equal(rect.height, 50);
+  assert.equal(wb.getCellRectPt(0, { firstRow: 1, firstCol: 0, lastRow: 0, lastCol: 0 }, 0).status.ok, false);
+  assert.equal(wb.getCellRectPt(0, A1_B2, 7).status.ok, false);
+  assert.ok(wb.getColumnWidthPt(0, 0, 1).status.ok);
+
+  const pt = wb.columnCharsToPt(0, 0, 8.43);
+  assert.ok(pt.status.ok);
+  assert.ok(pt.value > 0);
+  const chars = wb.columnPtToChars(0, 0, pt.value);
+  assert.ok(chars.status.ok);
+  assert.ok(Math.abs(chars.value - 8.43) < 1e-6);
+  assert.equal(wb.columnCharsToPt(0, 0, 0).value, 0);
+  assert.equal(wb.columnCharsToPt(0, 0, -1).status.ok, false);
+  assert.equal(wb.getRowHeightPt(99, 0).status.ok, false);
+});
+
+test('getFormula / getFormulaR1C1 return null for non-formula cells', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setNumber(0, 0, 0, 5).ok);
+  assert.ok(wb.setFormula(0, 1, 1, '=A1+1').ok);
+  const a1 = wb.getFormula(0, 1, 1);
+  assert.ok(a1.status.ok);
+  assert.equal(a1.formula, '=A1+1');
+  assert.equal(wb.getFormulaR1C1(0, 1, 1).formula, 'R[-1]C[-1]+1');
+  assert.equal(wb.getFormula(0, 0, 0).formula, null);
+  assert.equal(wb.getFormulaR1C1(0, 5, 5).formula, null);
+  const bad = wb.getFormula(99, 0, 0);
+  assert.equal(bad.status.ok, false);
+  assert.equal(bad.formula, null);
+});
+
+test('getCellsInRange pages through populated cells with a cursor', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+  assert.ok(wb.setText(0, 0, 2, 'x').ok);
+  assert.ok(wb.setFormula(0, 1, 1, '=A1+1').ok);
+  assert.ok(wb.setNumber(0, 5, 5, 9).ok);
+  const range = { firstRow: 0, firstCol: 0, lastRow: 3, lastCol: 3 };
+
+  const all = wb.getCellsInRange(0, range);
+  assert.ok(all.status.ok, JSON.stringify(all.status));
+  assert.equal(all.nextCursor, null);
+  assert.deepEqual(
+    all.cells.map((c) => [c.row, c.col]),
+    [
+      [0, 0],
+      [0, 2],
+      [1, 1],
+    ],
+  );
+  assert.equal(all.cells[0].formula, null);
+  assert.equal(all.cells[0].value.number, 1);
+  assert.equal(all.cells[1].value.text, 'x');
+  assert.equal(all.cells[2].formula, '=A1+1');
+
+  const first = wb.getCellsInRange(0, range, 0, 2);
+  assert.equal(first.cells.length, 2);
+  assert.equal(typeof first.nextCursor, 'number');
+  const rest = wb.getCellsInRange(0, range, first.nextCursor, 2);
+  assert.ok(rest.status.ok);
+  assert.deepEqual(
+    [...first.cells, ...rest.cells].map((c) => [c.row, c.col]),
+    all.cells.map((c) => [c.row, c.col]),
+  );
+  assert.equal(rest.nextCursor, null);
+
+  const bad = wb.getCellsInRange(0, { firstRow: 3, firstCol: 0, lastRow: 0, lastCol: 0 });
+  assert.equal(bad.status.ok, false);
+  assert.deepEqual(bad.cells, []);
+  assert.equal(bad.nextCursor, null);
+});
+
+test('getMergesInRange lists only intersecting merges', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.addMerge(0, { firstRow: 0, firstCol: 0, lastRow: 1, lastCol: 1 }).ok);
+  assert.ok(wb.addMerge(0, { firstRow: 10, firstCol: 10, lastRow: 11, lastCol: 11 }).ok);
+  const hit = wb.getMergesInRange(0, { firstRow: 1, firstCol: 1, lastRow: 5, lastCol: 5 });
+  assert.ok(hit.status.ok);
+  assert.equal(hit.length, 1);
+  assert.equal(hit[0].firstRow, 0);
+  assert.equal(hit[0].lastCol, 1);
+  assert.equal(wb.getMergesInRange(0, { firstRow: 4, firstCol: 4, lastRow: 5, lastCol: 5 }).length, 0);
+  assert.equal(wb.getMergesInRange(99, A1_B2).status.ok, false);
+});
+
+test('getDisplayText and formatValue render through the number format', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const fmt = wb.addNumFmt('0.00');
+  assert.ok(fmt.status.ok);
+  const xf = wb.addXf({
+    fontIndex: 0,
+    fillIndex: 0,
+    borderIndex: 0,
+    numFmtId: fmt.numFmtId,
+    horizontalAlign: 0,
+    verticalAlign: 2,
+    wrapText: false,
+  });
+  assert.ok(wb.setNumber(0, 0, 0, 3.14159).ok);
+  assert.ok(wb.setCellXfIndex(0, 0, 0, xf.index).ok);
+  const shown = wb.getDisplayText(0, 0, 0);
+  assert.ok(shown.status.ok, JSON.stringify(shown.status));
+  assert.equal(shown.text, '3.14');
+  assert.equal(shown.displayStatus, 0);
+  assert.equal(wb.getDisplayText(0, 7, 7).text, '');
+  assert.equal(wb.getDisplayText(99, 0, 0).status.ok, false);
+
+  const num = (n) => ({ kind: mod.ValueKind.Number, number: n, boolean: 0, text: '', errorCode: 0 });
+  const fixed = wb.formatValue(num(1234.5), '#,##0.0');
+  assert.ok(fixed.status.ok);
+  assert.equal(fixed.text, '1,234.5');
+  assert.equal(fixed.displayStatus, 0);
+  assert.equal(wb.formatValue(num(7), '').text, '7');
+  const overflow = wb.formatValue(num(-1), 'yyyy-mm-dd');
+  assert.ok(overflow.status.ok);
+  assert.equal(overflow.displayStatus, 1);
+  assert.equal(overflow.text, '########');
+  const text = wb.formatValue({ kind: mod.ValueKind.Text, number: 0, boolean: 0, text: 'abc', errorCode: 0 }, '@');
+  assert.equal(text.text, 'abc');
+  assert.equal(wb.formatValue({ kind: 99 }, '').status.ok, false);
+});
+
+test('paginate reports paper, margins, printable area, pages and break provenance', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+  assert.ok(wb.setNumber(0, 99, 5, 1).ok);
+  const p = wb.paginate(0);
+  assert.ok(p.status.ok, JSON.stringify(p.status));
+  assert.ok(p.paper.widthPt > 0 && p.paper.heightPt > 0);
+  assert.equal(typeof p.paper.landscape, 'boolean');
+  assert.equal(typeof p.paper.known, 'boolean');
+  assert.ok(p.margins.left > 0);
+  assert.ok(p.printable.width > 0 && p.printable.height > 0);
+  assert.ok(p.scale > 0);
+  assert.ok(p.pageOrder === 0 || p.pageOrder === 1);
+  assert.equal(p.printTitles.hasRows, false);
+  assert.equal(p.printTitles.hasCols, false);
+  assert.equal(p.pages.length, p.pageCount);
+  assert.ok(p.pages.length >= 1);
+  assert.equal(p.pages[0].firstRow, 0);
+  assert.equal(p.pages[0].firstCol, 0);
+  assert.ok(p.pages[0].widthPt > 0 && p.pages[0].heightPt > 0);
+  assert.equal(p.horizontalBreakManual.length, p.horizontalBreaks.length);
+  assert.equal(p.verticalBreakManual.length, p.verticalBreaks.length);
+  assert.ok(p.horizontalBreakManual.every((m) => typeof m === 'boolean'));
+
+  const failed = wb.paginate(99);
+  assert.equal(failed.status.ok, false);
+  assert.deepEqual(failed.pages, []);
+  assert.equal(failed.paper.known, false);
+  assert.equal(failed.printTitles.hasRows, false);
+  assert.deepEqual(failed.horizontalBreakManual, []);
+});
diff --git a/packages/npm-native/test/smoke_cells_io_catalog.mjs b/packages/npm-native/test/smoke_cells_io_catalog.mjs
new file mode 100644
index 000000000..72b9be59c
--- /dev/null
+++ b/packages/npm-native/test/smoke_cells_io_catalog.mjs
@@ -0,0 +1,631 @@
+import test from 'node:test';
+import { appendEmptyZipEntry, assert, getModule } from './smoke_support.mjs';
+
+test('comments round-trip: setComment + getComment', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Pre-existing cell so the comment attaches to a stored slot.
+  assert.ok(wb.setNumber(0, 1, 1, 7).ok);
+  const sc = wb.setComment(0, 1, 1, 'libraz', 'hello world');
+  assert.ok(sc.ok, `setComment: ${JSON.stringify(sc)}`);
+  const c = wb.getComment(0, 1, 1);
+  assert.ok(c !== null, 'expected non-null CommentEntry');
+  assert.equal(c.author, 'libraz');
+  assert.equal(c.text, 'hello world');
+  // Removing surfaces null on the next read.
+  assert.ok(wb.setComment(0, 1, 1, '', '').ok);
+  assert.equal(wb.getComment(0, 1, 1), null);
+});
+
+test('getCommentResult distinguishes absence from an invalid sheet', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const missing = wb.getCommentResult(0, 1, 1);
+  assert.equal(missing.status.ok, false);
+  assert.equal(missing.comment, null);
+  const invalid = wb.getCommentResult(99, 1, 1);
+  assert.equal(invalid.status.ok, false);
+  assert.equal(invalid.comment, null);
+  assert.notEqual(missing.status.status, invalid.status.status);
+  assert.ok(wb.setComment(0, 1, 1, 'libraz', 'hello').ok);
+  const found = wb.getCommentResult(0, 1, 1);
+  assert.equal(found.status.ok, true);
+  assert.equal(found.comment.author, 'libraz');
+  assert.equal(found.comment.text, 'hello');
+});
+
+test('cellCount + cellAt enumerate stored cells', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+  assert.ok(wb.setNumber(0, 0, 1, 2).ok);
+  assert.ok(wb.setFormula(0, 1, 0, '=A1+B1').ok);
+  assert.ok(wb.recalc().ok);
+  const n = wb.cellCount(0).value;
+  assert.equal(typeof n, 'number');
+  assert.ok(n >= 3, `expected >= 3 stored cells, got ${n}`);
+  // Iterate; one of the entries should carry our formula.
+  let foundFormula = false;
+  for (let i = 0; i < n; ++i) {
+    const e = wb.cellAt(0, i);
+    assert.ok(e.status.ok, `cellAt(${i}): ${JSON.stringify(e.status)}`);
+    assert.equal(typeof e.row, 'number');
+    assert.equal(typeof e.col, 'number');
+    if (e.formula === '=A1+B1') {
+      foundFormula = true;
+      assert.equal(e.value.kind, mod.ValueKind.Number);
+      assert.equal(e.value.number, 3);
+    }
+  }
+  assert.ok(foundFormula, 'expected to find the =A1+B1 cell during iteration');
+});
+
+test('default export exposes CfMatchKind ordinals', async () => {
+  const mod = await getModule();
+  assert.equal(typeof mod.CfMatchKind, 'object');
+  assert.equal(mod.CfMatchKind.DifferentialFormat, 0);
+  assert.equal(mod.CfMatchKind.ColorScale, 1);
+  assert.equal(mod.CfMatchKind.DataBar, 2);
+  assert.equal(mod.CfMatchKind.IconSet, 3);
+});
+
+test('default export exposes ErrorCode ordinals and versionString alias', async () => {
+  const mod = await getModule();
+  assert.equal(typeof mod.ErrorCode, 'object');
+  assert.equal(mod.ErrorCode.Div0, 1);
+  assert.equal(mod.ErrorCode.Ref, 3);
+  assert.equal(mod.ErrorCode.NA, 6);
+  assert.equal(typeof mod.versionString, 'function');
+  assert.equal(mod.versionString(), mod.version());
+});
+
+test('setError() rejects a missing errorCode argument', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.throws(() => wb.setError(0, 0, 0), TypeError);
+});
+
+test('setError() rejects a non-number errorCode before mutating the cell', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setNumber(0, 0, 0, 7).ok);
+  assert.throws(() => wb.setError(0, 0, 0, 'not a number'), TypeError);
+  // The rejected call must not have overwritten the cell.
+  const got = wb.getValue(0, 0, 0);
+  assert.ok(got.status.ok, JSON.stringify(got.status));
+  assert.equal(got.value.number, 7);
+});
+
+test('saveAs() writes xlsx and xlsb bytes; rejects a missing format argument', async () => {
+  const mod = await getModule();
+  assert.equal(typeof mod.WorkbookFormat, 'object');
+  const wb = mod.Workbook.createDefault();
+  const xlsx = wb.saveAs(mod.WorkbookFormat.Xlsx);
+  assert.ok(xlsx.status.ok, JSON.stringify(xlsx.status));
+  assert.ok(xlsx.bytes.length > 0);
+  const xlsb = wb.saveAs(mod.WorkbookFormat.Xlsb);
+  assert.ok(xlsb.status.ok, JSON.stringify(xlsb.status));
+  assert.ok(xlsb.bytes.length > 0);
+  assert.throws(() => wb.saveAs(), TypeError);
+});
+
+test('saveWithDiagnostics() reports counters and readDiagnostics keeps a stable shape', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
+  assert.ok(
+    wb.addValidation(0, {
+      ranges: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+      type: 3,
+      formula1: '"Yes,No"',
+    }).ok,
+  );
+  // A CF rule's dxfId must resolve against a registered dxf.
+  const dxf = wb.addDxf({ font: { bold: true } });
+  assert.ok(dxf.status.ok, JSON.stringify(dxf.status));
+  assert.ok(
+    wb.addConditionalFormat(0, {
+      sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+      type: 1,
+      op: 5,
+      formula1: '10',
+      dxfId: dxf.index,
+      stopIfTrue: false,
+    }).status.ok,
+  );
+
+  const xlsx = wb.saveWithDiagnostics(mod.WorkbookFormat.Xlsx);
+  assert.ok(xlsx.status.ok, JSON.stringify(xlsx.status));
+  assert.ok(xlsx.bytes instanceof Uint8Array);
+  assert.equal(xlsx.downgradedFormulaCount, 0);
+  assert.equal(xlsx.deferredFeatureCount, 0);
+  assert.equal(xlsx.droppedPartCount, 0);
+  assert.equal(xlsx.droppedRelationshipCount, 0);
+  assert.equal(xlsx.renumberedPartCount, 0);
+
+  const xlsb = wb.saveWithDiagnostics(mod.WorkbookFormat.Xlsb);
+  assert.ok(xlsb.status.ok, JSON.stringify(xlsb.status));
+  assert.ok(xlsb.bytes instanceof Uint8Array);
+  assert.equal(xlsb.downgradedFormulaCount, 1);
+  // The validation and the CF rule, with its dxf, are both written.
+  assert.equal(xlsb.deferredFeatureCount, 0);
+  // The binary writer never reassigns a part id.
+  assert.equal(xlsb.renumberedPartCount, 0);
+
+  const loaded = mod.Workbook.loadBytes(xlsb.bytes);
+  const read = loaded.readDiagnostics();
+  assert.ok(read.status.ok, JSON.stringify(read.status));
+  assert.equal(read.undecodedFormulaCount, 0);
+  assert.equal(read.undecodedDefinedNameCount, 0);
+  assert.equal(read.undecodedPartCount, 0);
+  assert.equal(read.skippedFeatureCount, 0);
+  assert.equal(read.unknownContentTypeCount, 0);
+  const preservedLoaded = mod.Workbook.loadBytes(appendEmptyZipEntry(xlsb.bytes, 'xl/preserved.bin'));
+  const preserved = preservedLoaded.readDiagnostics();
+  assert.ok(preserved.status.ok, JSON.stringify(preserved.status));
+  assert.equal(preserved.undecodedPartCount, 0);
+  preservedLoaded.dispose();
+  const invalidSave = wb.saveWithDiagnostics(0);
+  assert.ok(!invalidSave.status.ok, JSON.stringify(invalidSave));
+  assert.equal(invalidSave.bytes, null);
+  assert.equal(invalidSave.downgradedFormulaCount, 0);
+  assert.equal(invalidSave.deferredFeatureCount, 0);
+  assert.equal(invalidSave.droppedPartCount, 0);
+  assert.equal(invalidSave.droppedRelationshipCount, 0);
+  assert.equal(invalidSave.renumberedPartCount, 0);
+  assert.ok(wb.saveAs(mod.WorkbookFormat.Xlsb).bytes instanceof Uint8Array);
+});
+
+test('invalid workbook read diagnostics return a zeroed failure envelope', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.loadBytes(new Uint8Array());
+  const read = wb.readDiagnostics();
+  assert.ok(!read.status.ok, JSON.stringify(read));
+  assert.equal(read.undecodedFormulaCount, 0);
+  assert.equal(read.undecodedDefinedNameCount, 0);
+  assert.equal(read.undecodedPartCount, 0);
+  assert.equal(read.skippedFeatureCount, 0);
+  assert.equal(read.unknownContentTypeCount, 0);
+  wb.dispose();
+});
+
+test('addValidation / getValidations / removeValidationAt / clearValidations round-trip', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Empty by default.
+  assert.equal(wb.getValidations(0).length, 0);
+
+  // List-type validation at A1:B3.
+  const listRule = {
+    ranges: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 1 }],
+    type: 3,
+    op: 0,
+    errorStyle: 1,
+    allowBlank: true,
+    showInputMessage: true,
+    showErrorMessage: true,
+    formula1: '"Yes,No,Maybe"',
+    promptTitle: 'Choose',
+    promptMessage: 'Pick one',
+    errorTitle: 'Bad value',
+    errorMessage: 'Pick from the list',
+  };
+  assert.ok(wb.addValidation(0, listRule).ok);
+
+  // Decimal between [0, 100] across two rectangles.
+  const decimalRule = {
+    ranges: [
+      { firstRow: 4, firstCol: 0, lastRow: 4, lastCol: 0 },
+      { firstRow: 6, firstCol: 0, lastRow: 9, lastCol: 0 },
+    ],
+    type: 2,
+    op: 0,
+    formula1: '0',
+    formula2: '100',
+    allowBlank: false,
+  };
+  assert.ok(wb.addValidation(0, decimalRule).ok);
+
+  const list = wb.getValidations(0);
+  assert.equal(list.length, 2);
+  // Booleans must arrive as JS booleans, not 0/1.
+  assert.equal(typeof list[0].allowBlank, 'boolean');
+  assert.equal(list[0].allowBlank, true);
+  assert.equal(typeof list[0].showInputMessage, 'boolean');
+  assert.equal(list[0].showInputMessage, true);
+  assert.equal(typeof list[1].allowBlank, 'boolean');
+  assert.equal(list[1].allowBlank, false);
+  assert.equal(list[0].formula1, '"Yes,No,Maybe"');
+  assert.equal(list[1].formula1, '0');
+  assert.equal(list[1].formula2, '100');
+  assert.equal(list[1].ranges.length, 2);
+  assert.equal(list[1].ranges[1].firstRow, 6);
+
+  // removeValidationAt removes the first rule.
+  assert.ok(wb.removeValidationAt(0, 0).ok);
+  const after = wb.getValidations(0);
+  assert.equal(after.length, 1);
+  assert.equal(after[0].type, 2);
+
+  // Out-of-range index is rejected.
+  assert.ok(!wb.removeValidationAt(0, 99).ok);
+  // Sheet-out-of-range is rejected on every entry.
+  assert.ok(!wb.addValidation(999, listRule).ok);
+  assert.ok(!wb.removeValidationAt(999, 0).ok);
+  assert.ok(!wb.clearValidations(999).ok);
+
+  // clearValidations drops everything; safe to call again.
+  assert.ok(wb.clearValidations(0).ok);
+  assert.equal(wb.getValidations(0).length, 0);
+  assert.ok(wb.clearValidations(0).ok);
+});
+
+// -- Newly wired surface (audit parity with the WASM binding) ----------
+// These tests exercise the methods that were previously only reachable
+// from the WASM package. They assert sensible return shapes rather than
+// deep semantics; the point is "the addon wires them and does not throw".
+
+test('addConditionalFormat + getConditionalFormats + clearConditionalFormats round-trip', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.equal(wb.getConditionalFormats(0).length, 0);
+  // A CF rule's dxfId must resolve against a registered dxf.
+  const dxf = wb.addDxf({ font: { bold: true } });
+  assert.ok(dxf.status.ok, JSON.stringify(dxf.status));
+  // cellIs rule (type 1) comparing the cell to a literal.
+  const add = wb.addConditionalFormat(0, {
+    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 4, lastCol: 0 }],
+    type: 1,
+    op: 5,
+    formula1: '10',
+    dxfId: dxf.index,
+    stopIfTrue: false,
+  });
+  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
+  assert.equal(typeof add.index, 'number');
+  const list = wb.getConditionalFormats(0);
+  assert.equal(list.length, 1);
+  assert.equal(list[0].type, 1);
+  assert.equal(typeof list[0].id, 'string');
+  assert.equal(list[0].sqref.length, 1);
+  assert.equal(list[0].sqref[0].lastRow, 4);
+  assert.equal(list[0].formula1, '10');
+  // removeConditionalFormatAt drops the only rule.
+  assert.ok(wb.removeConditionalFormatAt(0, 0).ok);
+  assert.equal(wb.getConditionalFormats(0).length, 0);
+  // clearConditionalFormats is a safe no-op on an empty sheet.
+  assert.ok(wb.clearConditionalFormats(0).ok);
+  // Sheet-out-of-range is rejected.
+  assert.ok(!wb.clearConditionalFormats(999).ok);
+});
+
+test('data bar x14 fields survive save and load', async () => {
+  // The six live in the `x14` extension rather than the legacy `<dataBar>`
+  // element, so an in-session round-trip would still pass with a writer
+  // that never emits the extension -- which is exactly how they used to be
+  // lost. Only a save/load cycle pins them.
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const add = wb.addConditionalFormat(0, {
+    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
+    type: 3,
+    dataBar: {
+      min: { type: 3 },
+      max: { type: 4 },
+      fill: { r: 0, g: 0, b: 255 },
+      gradient: false,
+      axisPosition: 1,
+      negativeFill: { r: 255, g: 0, b: 0 },
+      border: { r: 9, g: 9, b: 9 },
+      negativeBorder: { r: 8, g: 8, b: 8 },
+      axisColor: { r: 1, g: 2, b: 3 },
+      direction: 2,
+    },
+  });
+  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
+
+  const saved = wb.save();
+  assert.ok(saved.status.ok);
+  const loaded = mod.Workbook.loadBytes(saved.bytes);
+  const bar = loaded.getConditionalFormats(0)[0].dataBar;
+  assert.equal(bar.gradient, false);
+  assert.equal(bar.axisPosition, 1);
+  assert.equal(bar.negativeFill.r, 255);
+  assert.equal(bar.border.r, 9);
+  assert.equal(bar.negativeBorder.r, 8);
+  assert.equal(bar.axisColor.b, 3);
+  assert.equal(bar.direction, 2);
+
+  // The decoded bar fed straight back must reproduce the same rule.
+  const again = loaded.addConditionalFormat(0, {
+    sqref: [{ firstRow: 4, firstCol: 0, lastRow: 6, lastCol: 0 }],
+    type: 3,
+    dataBar: bar,
+  });
+  assert.ok(again.status.ok, `re-add: ${JSON.stringify(again)}`);
+  const reread = loaded.getConditionalFormats(0)[1].dataBar;
+  assert.equal(reread.gradient, false);
+  assert.equal(reread.axisPosition, 1);
+  assert.equal(reread.axisColor.b, 3);
+  assert.equal(reread.direction, 2);
+
+  loaded.dispose();
+  wb.dispose();
+});
+
+test('icon set floor survives save and load', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const add = wb.addConditionalFormat(0, {
+    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 9, lastCol: 0 }],
+    type: 4,
+    iconSet: {
+      name: 2,
+      thresholds: [
+        { type: 0, value: '7' },
+        { type: 0, value: '9' },
+      ],
+      floor: { type: 0, value: '5', gte: false },
+    },
+  });
+  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
+  const saved = wb.save();
+  assert.ok(saved.status.ok);
+  const loaded = mod.Workbook.loadBytes(saved.bytes);
+  const floor = loaded.getConditionalFormats(0)[0].iconSet.floor;
+  assert.equal(floor.type, 0);
+  assert.equal(floor.value, '5');
+  assert.equal(floor.gte, false);
+  loaded.dispose();
+  wb.dispose();
+});
+
+test('omitted data bar x14 fields keep the model defaults', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const add = wb.addConditionalFormat(0, {
+    sqref: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
+    type: 3,
+    dataBar: { min: { type: 3 }, max: { type: 4 }, fill: { r: 0, g: 0, b: 255 } },
+  });
+  assert.ok(add.status.ok, `addConditionalFormat: ${JSON.stringify(add)}`);
+  const bar = wb.getConditionalFormats(0)[0].dataBar;
+  // The getter engages all six, so they read back as the defaults rather
+  // than as absent keys.
+  assert.equal(bar.gradient, true);
+  assert.equal(bar.axisPosition, 0);
+  assert.equal(bar.negativeFill.b, 255);
+  wb.dispose();
+});
+
+test('named cell styles: cellStyleCount / getCellStyle / cellStyleXfCount', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // A fresh workbook may carry zero named styles; the accessors must
+  // still return well-formed values rather than throwing.
+  const count = wb.cellStyleCount().value;
+  assert.equal(typeof count, 'number');
+  assert.ok(count >= 0);
+  assert.equal(typeof wb.cellStyleXfCount().value, 'number');
+  if (count > 0) {
+    const cs = wb.getCellStyle(0);
+    assert.ok(cs.status.ok, `getCellStyle: ${JSON.stringify(cs.status)}`);
+    assert.equal(typeof cs.name, 'string');
+    assert.equal(typeof cs.xfId, 'number');
+  } else {
+    // Out-of-range index surfaces an error status, not a throw.
+    const cs = wb.getCellStyle(0);
+    assert.equal(cs.status.ok, false);
+  }
+});
+
+test('setCalcMode / calcMode round-trip the calc policy', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Default is automatic (0).
+  assert.equal(wb.calcMode().value, 0);
+  assert.ok(wb.setCalcMode(1).ok);
+  assert.equal(wb.calcMode().value, 1);
+  assert.ok(wb.setCalcMode(2).ok);
+  assert.equal(wb.calcMode().value, 2);
+});
+
+test('setPinnedNow / pinnedNow / clearPinnedNow drive the clock seam', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Unpinned by default: the workbook follows the host clock.
+  assert.equal(wb.pinnedNow().now, null);
+
+  assert.ok(wb.setPinnedNow(2026, 4, 23, 15, 30, 45).ok);
+  assert.deepEqual(wb.pinnedNow().now, {
+    year: 2026,
+    month: 4,
+    day: 23,
+    hour: 15,
+    minute: 30,
+    second: 45,
+  });
+
+  // 2026-04-23 is serial 46135 under the 1900 date system.
+  const today = wb.evaluateFormulaText(0, 0, 0, '=TODAY()');
+  assert.ok(today.status.ok, `evaluateFormulaText: ${JSON.stringify(today.status)}`);
+  assert.equal(today.value.number, 46135);
+
+  // The pin is a calendar instant, not a normalising constructor.
+  assert.equal(wb.setPinnedNow(2026, 13, 1, 0, 0, 0).ok, false);
+  assert.equal(wb.setPinnedNow(2025, 2, 29, 0, 0, 0).ok, false);
+
+  assert.ok(wb.clearPinnedNow().ok);
+  assert.equal(wb.pinnedNow().now, null);
+});
+
+test('excelProfileId / setExcelProfileId round-trip the profile id', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const def = wb.excelProfileId().value;
+  assert.equal(typeof def, 'string');
+  assert.ok(def.length > 0);
+  assert.ok(wb.setExcelProfileId('mac-365-ja_JP').ok);
+  assert.equal(wb.excelProfileId().value, 'mac-365-ja_JP');
+});
+
+test('functionNames + functionMetadata expose the catalog', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const names = wb.functionNames();
+  assert.ok(Array.isArray(names));
+  assert.ok(names.length > 0, 'expected a non-empty function catalog');
+  assert.ok(names.includes('SUM'), 'expected SUM in the catalog');
+  const md = wb.functionMetadata('SUM', 0);
+  assert.equal(md.ok, true);
+  assert.equal(md.name, 'SUM');
+  assert.equal(typeof md.minArity, 'number');
+  // Unknown function returns { ok: false }.
+  const miss = wb.functionMetadata('NOT_A_REAL_FUNCTION_XYZ', 0);
+  assert.equal(miss.ok, false);
+});
+
+test('mergeFunctionMetadata overlays provider metadata; is identity without a provider', async () => {
+  const mod = await getModule();
+  assert.equal(typeof mod.mergeFunctionMetadata, 'function');
+  const base = mod.Workbook.createDefault().functionMetadata('XLOOKUP', 0);
+  assert.equal(base.ok, true);
+  // The engine leaves display metadata empty.
+  assert.equal(base.signatureTemplate, undefined);
+  assert.equal(base.description, undefined);
+
+  const entry = {
+    signature: 'XLOOKUP(lookup_value, lookup_array, return_array)',
+    description: 'Searches a range or an array.',
+    aliases: { 'fr-FR': 'RECHERCHEX' },
+    localized: {
+      'fr-FR': { signature: 'RECHERCHEX(...)', description: 'Recherche.' },
+    },
+  };
+
+  // Localized override wins for the matching locale.
+  const fr = mod.mergeFunctionMetadata(base, entry, 'fr-FR');
+  assert.equal(fr.signatureTemplate, 'RECHERCHEX(...)');
+  assert.equal(fr.description, 'Recherche.');
+  assert.equal(fr.localizedName, 'RECHERCHEX');
+  // Structural fields survive the merge.
+  assert.equal(fr.ok, true);
+  assert.equal(fr.name, 'XLOOKUP');
+
+  // A locale with no localized/alias entry falls back to the default
+  // signature/description and the canonical display name.
+  const de = mod.mergeFunctionMetadata(base, entry, 'de-DE');
+  assert.equal(de.signatureTemplate, 'XLOOKUP(lookup_value, lookup_array, return_array)');
+  assert.equal(de.description, 'Searches a range or an array.');
+  assert.equal(de.localizedName, 'XLOOKUP');
+
+  // No provider entry -> base returned verbatim, display metadata stays NULL.
+  const none = mod.mergeFunctionMetadata(base, undefined, 'fr-FR');
+  assert.equal(none, base);
+  assert.equal(none.signatureTemplate, undefined);
+  assert.equal(none.description, undefined);
+});
+
+test('localizeFunctionName / canonicalizeFunctionName round-trip', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // en-US locale (0): the localized name is the canonical name itself.
+  assert.equal(wb.localizeFunctionName('SUM', 0).value, 'SUM');
+  assert.equal(wb.canonicalizeFunctionName('SUM', 0).value, 'SUM');
+  // An unknown name returns the empty string.
+  assert.equal(wb.canonicalizeFunctionName('NOPE_XYZ', 0).value, '');
+});
+
+test('precedents / dependents return arrays for a small formula graph', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setNumber(0, 0, 0, 1).ok); // A1
+  assert.ok(wb.setNumber(0, 0, 1, 2).ok); // B1
+  assert.ok(wb.setFormula(0, 1, 0, '=A1+B1').ok); // A2 = A1 + B1
+  assert.ok(wb.recalc().ok);
+  // A2 reads A1 and B1.
+  const prec = wb.precedents(0, 1, 0, 1);
+  assert.ok(Array.isArray(prec));
+  assert.equal(prec.length, 2);
+  for (const node of prec) {
+    assert.equal(typeof node.sheet, 'number');
+    assert.equal(typeof node.row, 'number');
+    assert.equal(typeof node.col, 'number');
+  }
+  // A1 is read by A2.
+  const dep = wb.dependents(0, 0, 0, 1);
+  assert.ok(Array.isArray(dep));
+  assert.equal(dep.length, 1);
+  assert.equal(dep[0].row, 1);
+  assert.equal(dep[0].col, 0);
+});
+
+test('spillInfo reports a dynamic-array region', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Non-spill cell: engaged is false, fields zeroed.
+  const none = wb.spillInfo(0, 0, 0);
+  assert.equal(typeof none.engaged, 'boolean');
+  assert.equal(none.engaged, false);
+  // A spilling dynamic array anchored at A1.
+  assert.ok(wb.setFormula(0, 0, 0, '=SEQUENCE(3,1)').ok);
+  assert.ok(wb.recalc().ok);
+  const info = wb.spillInfo(0, 0, 0);
+  assert.equal(info.engaged, true);
+  assert.equal(info.anchorRow, 0);
+  assert.equal(info.anchorCol, 0);
+  assert.equal(info.rows, 3);
+  assert.equal(info.cols, 1);
+});
+
+test('getLambdaText is wired and reports the documented contract', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // A bare top-level LAMBDA renders as #CALC! in Excel 365 and does not
+  // retain a renderable closure; the engine mirrors that, so the lambda
+  // text surface returns an error status (not a throw). A plain number
+  // cell is likewise not a lambda. Both prove the method marshals
+  // arguments and propagates the Expected failure as a JS error status.
+  assert.ok(wb.setFormula(0, 0, 0, '=LAMBDA(x,x+1)').ok);
+  assert.ok(wb.recalc().ok);
+  const bare = wb.getLambdaText(0, 0, 0);
+  assert.equal(bare.status.ok, false);
+  assert.equal(typeof bare.text, 'string');
+  assert.equal(bare.text, '');
+
+  assert.ok(wb.setNumber(0, 1, 0, 5).ok);
+  const num = wb.getLambdaText(0, 1, 0);
+  assert.equal(num.status.ok, false);
+});
+
+test('getExternalLinks returns an array (empty for a fresh workbook)', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const links = wb.getExternalLinks();
+  assert.ok(Array.isArray(links));
+  assert.equal(links.length, 0);
+});
+
+test('getSheetProtection / setSheetProtection round-trip the protection flags', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const before = wb.getSheetProtection(0);
+  assert.ok(before.status.ok, `getSheetProtection: ${JSON.stringify(before.status)}`);
+  assert.equal(before.protection.enabled, 0);
+  // Enable protection and lock cell selection.
+  const next = {
+    ...before.protection,
+    enabled: 1,
+    selectLockedCells: 1,
+    sort: 1,
+  };
+  assert.ok(wb.setSheetProtection(0, next).ok);
+  const after = wb.getSheetProtection(0);
+  assert.ok(after.status.ok);
+  assert.equal(after.protection.enabled, 1);
+  assert.equal(after.protection.selectLockedCells, 1);
+  assert.equal(after.protection.sort, 1);
+  // Sheet-out-of-range is rejected.
+  assert.ok(!wb.getSheetProtection(999).status.ok);
+  assert.ok(!wb.setSheetProtection(999, next).ok);
+});
diff --git a/packages/npm-native/test/smoke_drawing.mjs b/packages/npm-native/test/smoke_drawing.mjs
new file mode 100644
index 000000000..7a785f016
--- /dev/null
+++ b/packages/npm-native/test/smoke_drawing.mjs
@@ -0,0 +1,124 @@
+import test from 'node:test';
+import zlib from 'node:zlib';
+import { assert, getModule } from './smoke_support.mjs';
+
+function must(r, what) {
+  const status = typeof r.ok === 'boolean' ? r : r.status;
+  assert.ok(status.ok, `${what}: ${JSON.stringify(status)}`);
+  return r;
+}
+
+function crc32(buf) {
+  let c = ~0;
+  for (const b of buf) {
+    c ^= b;
+    for (let k = 0; k < 8; k += 1) c = (c >>> 1) ^ (0xedb88320 & -(c & 1));
+  }
+  return ~c >>> 0;
+}
+
+function chunk(type, data) {
+  const out = Buffer.alloc(12 + data.length);
+  out.writeUInt32BE(data.length, 0);
+  out.write(type, 4, 'latin1');
+  data.copy(out, 8);
+  out.writeUInt32BE(crc32(out.subarray(4, 8 + data.length)), 8 + data.length);
+  return out;
+}
+
+// A valid width x 1 RGB PNG.
+function makePng(width) {
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(width, 0);
+  ihdr.writeUInt32BE(1, 4);
+  ihdr[8] = 8;
+  ihdr[9] = 2;
+  const raw = Buffer.alloc(1 + width * 3, width);
+  raw[0] = 0;
+  return new Uint8Array(
+    Buffer.concat([
+      Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+      chunk('IHDR', ihdr),
+      chunk('IDAT', zlib.deflateSync(raw)),
+      chunk('IEND', Buffer.alloc(0)),
+    ]),
+  );
+}
+
+test('drawing enums keep their C ordinals', async () => {
+  const mod = await getModule();
+  assert.equal(mod.ImageFormat.Png, 1);
+  assert.equal(mod.ImageFormat.Bmp, 4);
+  assert.equal(mod.DrawingObjectKind.Picture, 0);
+  assert.equal(mod.DrawingObjectKind.Other, 6);
+  assert.equal(mod.AnchorKind.Absolute, 2);
+  assert.equal(mod.AnchorEditAs.OneCell, 1);
+});
+
+test('images probe, insert, list, read back, survive save and load, and remove', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const png = makePng(4);
+    const probe = must(wb.probeImage(png), 'probeImage');
+    assert.equal(probe.format, mod.ImageFormat.Png);
+    assert.equal(probe.pxWidth, 4);
+    assert.equal(probe.pxHeight, 1);
+    assert.equal(wb.probeImage(new Uint8Array([1, 2, 3])).status.ok, false);
+
+    const empty = wb.listDrawingObjects(0);
+    assert.ok(empty.status.ok);
+    assert.equal(empty.length, 0);
+
+    const ins = must(
+      wb.insertImage(0, png, { name: 'logo', descr: 'alt', anchorKind: mod.AnchorKind.OneCell, row: 2, col: 3 }),
+      'insertImage',
+    );
+    assert.ok(ins.objectId > 0);
+
+    const check = (book) => {
+      const list = book.listDrawingObjects(0);
+      assert.ok(list.status.ok, JSON.stringify(list.status));
+      assert.equal(list.length, 1);
+      const o = list[0];
+      assert.equal(o.kind, mod.DrawingObjectKind.Picture);
+      assert.equal(o.anchorKind, mod.AnchorKind.OneCell);
+      assert.equal(o.fromRow, 2);
+      assert.equal(o.fromCol, 3);
+      assert.equal(o.cx, 4 * 9525);
+      assert.equal(o.cy, 9525);
+      assert.equal(o.imageFormat, mod.ImageFormat.Png);
+      assert.equal(o.name, 'logo');
+      assert.equal(o.descr, 'alt');
+      assert.ok(o.mediaPath.length > 0);
+      const img = must(book.getImage(0, o.objectId), 'getImage');
+      assert.ok(img.bytes instanceof Uint8Array);
+      assert.deepEqual([...img.bytes], [...png]);
+      assert.equal(img.format, mod.ImageFormat.Png);
+      assert.equal(img.pxWidth, 4);
+      assert.equal(img.pxHeight, 1);
+      return o.objectId;
+    };
+    check(wb);
+
+    const saved = must(wb.save(), 'save');
+    const wb2 = mod.Workbook.loadBytes(saved.bytes ?? saved);
+    try {
+      const id = check(wb2);
+      must(wb2.removeImage(0, id), 'removeImage');
+      assert.equal(wb2.listDrawingObjects(0).length, 0);
+      assert.equal(wb2.getImage(0, id).status.ok, false);
+      assert.equal(wb2.removeImage(0, id).ok, false);
+    } finally {
+      wb2.dispose();
+    }
+
+    // `opts` is optional: defaults place the picture at A1.
+    const plain = must(wb.insertImage(0, png), 'insertImage without opts');
+    assert.notEqual(plain.objectId, ins.objectId);
+    assert.equal(wb.getImage(99, 1).status.ok, false);
+    assert.equal(wb.insertImage(0, new Uint8Array([1, 2, 3]), {}).status.ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/smoke_filter_validation_comments.mjs b/packages/npm-native/test/smoke_filter_validation_comments.mjs
new file mode 100644
index 000000000..dcdf2a9bf
--- /dev/null
+++ b/packages/npm-native/test/smoke_filter_validation_comments.mjs
@@ -0,0 +1,321 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+const ANN = '{11111111-1111-1111-1111-111111111111}';
+const BOB = '{22222222-2222-2222-2222-222222222222}';
+const THREAD = '{AAAAAAAA-0000-0000-0000-000000000001}';
+const REPLY = '{AAAAAAAA-0000-0000-0000-000000000002}';
+const MENTION = '{BBBBBBBB-0000-0000-0000-000000000001}';
+
+function must(r, what) {
+  const status = typeof r.ok === 'boolean' ? r : r.status;
+  assert.ok(status.ok, `${what}: ${JSON.stringify(status)}`);
+  return r;
+}
+
+function hiddenRows(wb) {
+  return wb
+    .getSheetRowOverrides(0)
+    .rows.filter((r) => r.hidden)
+    .map((r) => r.row);
+}
+
+function seedColumn(wb) {
+  for (const [row, text] of ['h', 'a', 'b', 'a'].entries()) must(wb.setText(0, row, 0, text), 'setText');
+}
+
+const RANGE = { firstRow: 0, firstCol: 0, lastRow: 3, lastCol: 0 };
+
+test('filter, sort and validation enums keep their C ordinals', async () => {
+  const mod = await getModule();
+  assert.equal(mod.FilterKind.Icon, 6);
+  assert.equal(mod.FilterOperator.GreaterThan, 5);
+  assert.equal(mod.DynamicFilterType.YearToDate, 18);
+  assert.equal(mod.DynamicFilterType.M12, 34);
+  assert.equal(mod.SortBy.Icon, 3);
+  assert.equal(mod.SortMethod.Stroke, 2);
+  assert.equal(mod.DateTimeGrouping.Second, 5);
+  assert.equal(mod.ValidationErrorStyle.Information, 2);
+});
+
+test('AutoFilter round-trips and its criteria evaluate, apply and clear', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    seedColumn(wb);
+    const absent = wb.getAutoFilter(0);
+    assert.ok(absent.status.ok);
+    assert.equal(absent.autoFilter, null);
+
+    const filter = {
+      range: RANGE,
+      columns: [
+        {
+          colId: 0,
+          kind: mod.FilterKind.Values,
+          values: ['a'],
+          dateGroups: [{ year: 2026, month: 3, grouping: mod.DateTimeGrouping.Month }],
+        },
+      ],
+    };
+    must(wb.setAutoFilter(0, filter), 'setAutoFilter');
+    const got = wb.getAutoFilter(0);
+    must(got, 'getAutoFilter');
+    assert.deepEqual(got.autoFilter.range, RANGE);
+    assert.equal(got.autoFilter.columns.length, 1);
+    const col = got.autoFilter.columns[0];
+    assert.equal(col.kind, 1);
+    assert.deepEqual(col.values, ['a']);
+    assert.equal(col.showButton, true);
+    assert.equal(col.hiddenButton, false);
+    assert.equal(col.dateGroups.length, 1);
+    assert.equal(col.dateGroups[0].year, 2026);
+    assert.equal(col.dateGroups[0].month, 3);
+    assert.equal(col.dateGroups[0].grouping, mod.DateTimeGrouping.Month);
+    assert.equal(col.dxfId, 0);
+    assert.equal(got.autoFilter.sort, null);
+    // Setting the unchanged record back is accepted.
+    must(wb.setAutoFilter(0, got.autoFilter), 'set round trip');
+    assert.deepEqual(wb.getAutoFilter(0).autoFilter, got.autoFilter);
+
+    // Replace the date group with a plain value filter: dateGroups drops out.
+    must(
+      wb.setAutoFilter(0, { range: RANGE, columns: [{ colId: 0, kind: mod.FilterKind.Values, values: ['a'] }] }),
+      'set values',
+    );
+
+    const ev = wb.evaluateAutoFilter(0);
+    must(ev, 'evaluateAutoFilter');
+    assert.equal(ev.firstRow, 1);
+    assert.deepEqual(ev.match, [true, false, true]);
+    assert.deepEqual(hiddenRows(wb), []);
+
+    must(wb.applyAutoFilter(0), 'applyAutoFilter');
+    assert.deepEqual(hiddenRows(wb), [2]);
+    must(wb.clearAutoFilter(0), 'clearAutoFilter');
+    assert.deepEqual(hiddenRows(wb), []);
+    assert.equal(wb.getAutoFilter(0).autoFilter.columns.length, 0);
+
+    // A custom criterion and a sort state survive a round trip.
+    must(
+      wb.setAutoFilter(0, {
+        range: RANGE,
+        columns: [
+          { colId: 0, kind: mod.FilterKind.Custom, customCount: 1, op1: mod.FilterOperator.NotEqual, val1: 'b' },
+        ],
+        sort: {
+          ref: { firstRow: 1, firstCol: 0, lastRow: 3, lastCol: 0 },
+          conditions: [{ ref: { firstRow: 1, firstCol: 0, lastRow: 3, lastCol: 0 }, descending: true }],
+        },
+      }),
+      'set custom',
+    );
+    const custom = wb.getAutoFilter(0).autoFilter;
+    assert.equal(custom.columns[0].kind, 2);
+    assert.equal(custom.columns[0].op1, mod.FilterOperator.NotEqual);
+    assert.equal(custom.columns[0].val1, 'b');
+    assert.equal(custom.sort.conditions.length, 1);
+    assert.equal(custom.sort.conditions[0].descending, true);
+    assert.equal(custom.sort.columnSort, false);
+    assert.deepEqual(wb.evaluateAutoFilter(0).match, [true, false, true]);
+
+    must(wb.removeAutoFilter(0), 'removeAutoFilter');
+    assert.equal(wb.getAutoFilter(0).autoFilter, null);
+    const none = wb.evaluateAutoFilter(0);
+    assert.equal(none.status.ok, false);
+    assert.deepEqual(none.match, []);
+
+    // An out-of-range column id is rejected and leaves the sheet unchanged.
+    const bad = wb.setAutoFilter(0, {
+      range: RANGE,
+      columns: [{ colId: 5, kind: mod.FilterKind.Values, values: ['a'] }],
+    });
+    assert.equal(bad.ok, false);
+    assert.equal(wb.getAutoFilter(0).autoFilter, null);
+    assert.equal(wb.setAutoFilter(0, null).ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('table AutoFilter entry points reject a table index that does not exist', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    assert.equal(wb.tableCount().value, 0);
+    const got = wb.getTableAutoFilter(0);
+    assert.equal(got.status.ok, false);
+    assert.equal(got.autoFilter, null);
+    const ev = wb.evaluateTableAutoFilter(0);
+    assert.equal(ev.status.ok, false);
+    assert.deepEqual(ev.match, []);
+    assert.equal(wb.setTableAutoFilter(0, { range: RANGE, columns: [] }).ok, false);
+    assert.equal(wb.removeTableAutoFilter(0).ok, false);
+    assert.equal(wb.applyTableAutoFilter(0).ok, false);
+    assert.equal(wb.clearTableAutoFilter(0).ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('validateValue and listInvalidCells follow the rule covering a cell', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const free = wb.validateValue(0, 0, 1, { kind: mod.ValueKind.Number, number: 99 });
+    must(free, 'validateValue without rule');
+    assert.equal(free.hasRule, false);
+    assert.equal(free.valid, true);
+
+    must(
+      wb.addValidation(0, {
+        ranges: [{ firstRow: 0, lastRow: 3, firstCol: 1, lastCol: 1 }],
+        type: 1,
+        op: 0,
+        errorStyle: mod.ValidationErrorStyle.Warning,
+        formula1: '1',
+        formula2: '10',
+        showErrorMessage: true,
+      }),
+      'addValidation',
+    );
+    const ok = wb.validateValue(0, 0, 1, { kind: mod.ValueKind.Number, number: 5 });
+    must(ok, 'validateValue in range');
+    assert.deepEqual(
+      { hasRule: ok.hasRule, valid: ok.valid, ruleIndex: ok.ruleIndex, errorStyle: ok.errorStyle },
+      { hasRule: true, valid: true, ruleIndex: 0, errorStyle: mod.ValidationErrorStyle.Warning },
+    );
+    const bad = wb.validateValue(0, 0, 1, { kind: mod.ValueKind.Number, number: 50 });
+    assert.equal(bad.valid, false);
+    assert.equal(bad.hasRule, true);
+    const text = wb.validateValue(0, 0, 1, { kind: mod.ValueKind.Text, text: '5' });
+    assert.equal(text.valid, false, 'text "5" is text, not a number');
+    assert.equal(wb.validateValue(99, 0, 0, { kind: mod.ValueKind.Number, number: 1 }).status.ok, false);
+    assert.equal(wb.validateValue(0, 0, 0, null).status.ok, false);
+
+    must(wb.setNumber(0, 0, 1, 5), 'setNumber');
+    must(wb.setNumber(0, 1, 1, 50), 'setNumber');
+    must(wb.setNumber(0, 2, 1, 70), 'setNumber');
+    const page = wb.listInvalidCells(0);
+    must(page, 'listInvalidCells');
+    assert.deepEqual(
+      page.cells.map((c) => [c.row, c.col, c.value.number]),
+      [
+        [1, 1, 50],
+        [2, 1, 70],
+      ],
+    );
+    assert.equal(page.nextCursor, null);
+
+    const first = wb.listInvalidCells(0, 0, 1);
+    assert.equal(first.cells.length, 1);
+    assert.equal(typeof first.nextCursor, 'number');
+    const second = wb.listInvalidCells(0, first.nextCursor, 1);
+    assert.deepEqual(
+      second.cells.map((c) => c.row),
+      [2],
+    );
+    assert.equal(wb.listInvalidCells(99).status.ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('threaded comments cover a thread, a reply with a mention, resolution and removal', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    assert.equal(wb.getPersons().persons.length, 0);
+    assert.ok(wb.getPersons().status.ok);
+    must(wb.addPerson({ id: ANN, displayName: 'Ann', userId: 'ann@example.com', providerId: 'AD' }), 'addPerson Ann');
+    must(wb.addPerson({ id: BOB, displayName: 'Bob', userId: '', providerId: 'None' }), 'addPerson Bob');
+    assert.equal(wb.addPerson({ id: ANN, displayName: 'Ann again' }).ok, false);
+    const persons = wb.getPersons();
+    assert.deepEqual(
+      persons.persons.map((p) => [p.id, p.displayName, p.userId, p.providerId]),
+      [
+        [ANN, 'Ann', 'ann@example.com', 'AD'],
+        [BOB, 'Bob', '', 'None'],
+      ],
+    );
+
+    must(
+      wb.addThreadedComment(0, {
+        id: THREAD,
+        row: 2,
+        col: 3,
+        personId: ANN,
+        created: '2026-01-01T10:00:00.00',
+        text: 'Review this',
+      }),
+      'open thread',
+    );
+    must(
+      wb.addThreadedComment(0, {
+        id: REPLY,
+        personId: BOB,
+        created: '2026-01-01T11:00:00.00',
+        text: '@Ann done',
+        parentId: THREAD,
+        mentions: [{ personId: ANN, mentionId: MENTION, start: 0, length: 4 }],
+      }),
+      'reply',
+    );
+    const result = wb.getThreadedComments(0);
+    must(result, 'getThreadedComments');
+    const list = result.comments;
+    assert.equal(list.length, 2);
+    assert.equal(list[0].id, THREAD);
+    assert.equal(list[0].parentId, '');
+    assert.equal(list[0].row, 2);
+    assert.equal(list[0].col, 3);
+    assert.equal(list[0].done, false);
+    assert.deepEqual(list[0].mentions, []);
+    assert.equal(list[1].id, REPLY);
+    assert.equal(list[1].parentId, THREAD);
+    assert.equal(list[1].personId, BOB);
+    assert.deepEqual(list[1].mentions, [{ personId: ANN, mentionId: MENTION, start: 0, length: 4 }]);
+
+    must(
+      wb.editThreadedComment(0, REPLY, '@Ann fixed', [{ personId: ANN, mentionId: MENTION, start: 0, length: 4 }]),
+      'edit',
+    );
+    assert.equal(wb.getThreadedComments(0).comments[1].text, '@Ann fixed');
+    must(wb.editThreadedComment(0, REPLY, 'plain', []), 'edit without mentions');
+    assert.deepEqual(wb.getThreadedComments(0).comments[1].mentions, []);
+
+    must(wb.setThreadResolved(0, THREAD, true), 'resolve');
+    assert.equal(wb.getThreadedComments(0).comments[0].done, true);
+    must(wb.setThreadResolved(0, THREAD, false), 'reopen');
+    assert.equal(wb.getThreadedComments(0).comments[0].done, false);
+
+    assert.equal(wb.removePerson(ANN).ok, false, 'a person with comments stays');
+    assert.equal(wb.editThreadedComment(0, '{00000000-0000-0000-0000-000000000000}', 'x', []).ok, false);
+    assert.equal(wb.setThreadResolved(0, REPLY, true).ok, false, 'a reply is not a thread');
+    assert.equal(wb.addThreadedComment(0, null).ok, false);
+    assert.equal(wb.getThreadedComments(99).status.ok, false);
+
+    must(wb.removeThreadedComment(0, REPLY), 'remove reply');
+    assert.equal(wb.getThreadedComments(0).comments.length, 1);
+    must(wb.removeThreadedComment(0, THREAD), 'remove thread');
+    assert.equal(wb.getThreadedComments(0).comments.length, 0);
+    must(wb.removePerson(ANN), 'removePerson');
+    assert.equal(wb.getPersons().persons.length, 1);
+    assert.equal(wb.removePerson(ANN).ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('the new accessors report a released handle', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  wb.dispose();
+  assert.equal(wb.getAutoFilter(0).status.status, 7000);
+  assert.equal(wb.evaluateAutoFilter(0).status.status, 7000);
+  assert.equal(wb.validateValue(0, 0, 0, { kind: 0 }).status.status, 7000);
+  assert.equal(wb.listInvalidCells(0).status.status, 7000);
+  assert.equal(wb.getThreadedComments(0).status.status, 7000);
+  assert.equal(wb.getPersons().status.status, 7000);
+  assert.equal(wb.addPerson({ id: ANN, displayName: 'Ann' }).status, 7000);
+});
diff --git a/packages/npm-native/test/smoke_layout_styles.mjs b/packages/npm-native/test/smoke_layout_styles.mjs
new file mode 100644
index 000000000..17bc21929
--- /dev/null
+++ b/packages/npm-native/test/smoke_layout_styles.mjs
@@ -0,0 +1,672 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+test('addMerge + getMerges round-trip a single range', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const range = { firstRow: 1, firstCol: 1, lastRow: 2, lastCol: 3 };
+  const ar = wb.addMerge(0, range);
+  assert.ok(ar.ok, `addMerge: ${JSON.stringify(ar)}`);
+  const list = wb.getMerges(0);
+  assert.ok(Array.isArray(list), `expected Array, got ${typeof list}`);
+  assert.equal(list.length, 1);
+  assert.deepEqual(
+    {
+      firstRow: list[0].firstRow,
+      firstCol: list[0].firstCol,
+      lastRow: list[0].lastRow,
+      lastCol: list[0].lastCol,
+    },
+    range,
+  );
+});
+
+test('addHyperlink + getHyperlinks round-trip', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.equal(wb.getHyperlinks(0).length, 0);
+  // Three entries with progressively more optional fields populated.
+  assert.ok(wb.addHyperlink(0, 1, 2, 'https://example.com/', '', '', '').ok);
+  assert.ok(wb.addHyperlink(0, 3, 4, 'mailto:hello@example.com', 'Hello', '', '').ok);
+  assert.ok(wb.addHyperlink(0, 5, 6, '', 'See X', 'Internal link', 'Sheet1!A1').ok);
+  assert.ok(wb.addHyperlinkRange(0, 7, 8, 9, 10, 'https://example.com/range', 'Range', 'Range tip', '').ok);
+  const list = wb.getHyperlinks(0);
+  assert.equal(list.length, 4);
+  assert.equal(list[0].row, 1);
+  assert.equal(list[0].col, 2);
+  assert.equal(list[0].lastRow, 1);
+  assert.equal(list[0].lastCol, 2);
+  assert.equal(list[0].target, 'https://example.com/');
+  assert.equal(list[0].display, '');
+  assert.equal(list[0].tooltip, '');
+  assert.equal(list[1].target, 'mailto:hello@example.com');
+  assert.equal(list[1].display, 'Hello');
+  assert.equal(list[2].display, 'See X');
+  assert.equal(list[2].tooltip, 'Internal link');
+  assert.equal(list[2].location, 'Sheet1!A1');
+  assert.deepEqual(
+    {
+      row: list[3].row,
+      col: list[3].col,
+      lastRow: list[3].lastRow,
+      lastCol: list[3].lastCol,
+      target: list[3].target,
+      display: list[3].display,
+      tooltip: list[3].tooltip,
+    },
+    {
+      row: 7,
+      col: 8,
+      lastRow: 9,
+      lastCol: 10,
+      target: 'https://example.com/range',
+      display: 'Range',
+      tooltip: 'Range tip',
+    },
+  );
+  // Sheet-out-of-range is rejected.
+  assert.ok(!wb.addHyperlink(999, 0, 0, 'https://x/', '', '', '').ok);
+  // clearHyperlinks drops everything.
+  assert.ok(wb.clearHyperlinks(0).ok);
+  assert.equal(wb.getHyperlinks(0).length, 0);
+});
+
+test('removeHyperlink / removeHyperlinkAt / clearHyperlinks surface on an empty sheet', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // No-op variants on an empty list still return kOk.
+  assert.ok(wb.removeHyperlink(0, 0, 0).ok);
+  assert.ok(wb.clearHyperlinks(0).ok);
+  // Out-of-range index is rejected.
+  assert.ok(!wb.removeHyperlinkAt(0, 0).ok);
+  // Sheet-index-out-of-range is rejected on every variant.
+  assert.ok(!wb.removeHyperlink(999, 0, 0).ok);
+  assert.ok(!wb.removeHyperlinkAt(999, 0).ok);
+  assert.ok(!wb.clearHyperlinks(999).ok);
+  // The hyperlink list is still empty afterwards.
+  assert.equal(wb.getHyperlinks(0).length, 0);
+});
+
+test('removeMerge + removeMergeAt + clearMerges step-wise prune the merge list', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const a = { firstRow: 0, firstCol: 0, lastRow: 1, lastCol: 1 };
+  const b = { firstRow: 4, firstCol: 4, lastRow: 5, lastCol: 5 };
+  assert.ok(wb.addMerge(0, a).ok);
+  assert.ok(wb.addMerge(0, b).ok);
+  // removeMerge with an overlap that hits `a` only.
+  const overlap = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
+  assert.ok(wb.removeMerge(0, overlap).ok);
+  let list = wb.getMerges(0);
+  assert.equal(list.length, 1);
+  assert.equal(list[0].firstRow, 4);
+  // removeMergeAt drops the survivor by index.
+  assert.ok(wb.removeMergeAt(0, 0).ok);
+  list = wb.getMerges(0);
+  assert.equal(list.length, 0);
+  // clearMerges is a no-op on an empty list and stays kOk.
+  assert.ok(wb.addMerge(0, a).ok);
+  assert.ok(wb.addMerge(0, b).ok);
+  assert.ok(wb.clearMerges(0).ok);
+  list = wb.getMerges(0);
+  assert.equal(list.length, 0);
+});
+
+test('setSheetZoom + getSheetView surface the new zoom', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setSheetZoom(0, 175).ok);
+  const v = wb.getSheetView(0);
+  assert.ok(v.status.ok, `getSheetView: ${JSON.stringify(v.status)}`);
+  assert.equal(v.view.zoomScale, 175);
+  // Default freeze / tab-hidden state survives a zoom change.
+  assert.equal(v.view.freezeRows, 0);
+  assert.equal(v.view.freezeCols, 0);
+  assert.equal(v.view.tabHidden, 0);
+});
+
+test('sheet layout getters preserve explicit width presence flags', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setColumnWidth(0, 0, 0, 0).ok);
+  assert.ok(wb.setColumnHidden(0, 1, 1, true).ok);
+  assert.ok(wb.setRowHeight(0, 3, 30).ok);
+
+  const columns = wb.getSheetColumns(0);
+  assert.ok(columns.status.ok, `getSheetColumns: ${JSON.stringify(columns.status)}`);
+  const widthZero = columns.columns.find((column) => column.first === 0 && column.last === 0);
+  assert.ok(widthZero);
+  assert.equal(widthZero.width, 0);
+  assert.equal(widthZero.hasWidth, 1);
+  assert.equal(widthZero.hasStyle, 0);
+  const hidden = columns.columns.find((column) => column.first === 1 && column.last === 1);
+  assert.ok(hidden);
+  assert.equal(hidden.hidden, 1);
+  assert.equal(hidden.hasWidth, 0);
+
+  const rows = wb.getSheetRowOverrides(0);
+  assert.ok(rows.status.ok, `getSheetRowOverrides: ${JSON.stringify(rows.status)}`);
+  const row = rows.rows.find((entry) => entry.row === 3);
+  assert.ok(row);
+  assert.equal(row.height, 30);
+  assert.equal(row.hasStyle, 0);
+  assert.equal(row.styleXf, 0);
+});
+
+test('getSheetView surfaces display / orientation defaults', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const v = wb.getSheetView(0);
+  assert.ok(v.status.ok, `getSheetView: ${JSON.stringify(v.status)}`);
+  assert.equal(v.view.showGridLines, 1);
+  assert.equal(v.view.showRowColHeaders, 1);
+  assert.equal(v.view.showZeros, 1);
+  assert.equal(v.view.rightToLeft, 0);
+  assert.equal(v.view.tabSelected, 0);
+  assert.equal(v.view.viewMode, '');
+});
+
+test('setSheetShowGridLines / setSheetRightToLeft / setSheetTabSelected / setSheetViewMode round-trip', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setSheetShowGridLines(0, false).ok);
+  assert.ok(wb.setSheetShowRowColHeaders(0, false).ok);
+  assert.ok(wb.setSheetShowZeros(0, false).ok);
+  assert.ok(wb.setSheetRightToLeft(0, true).ok);
+  assert.ok(wb.setSheetTabSelected(0, true).ok);
+  assert.ok(wb.setSheetViewMode(0, 'pageBreakPreview').ok);
+  const v = wb.getSheetView(0);
+  assert.ok(v.status.ok, `getSheetView: ${JSON.stringify(v.status)}`);
+  assert.equal(v.view.showGridLines, 0);
+  assert.equal(v.view.showRowColHeaders, 0);
+  assert.equal(v.view.showZeros, 0);
+  assert.equal(v.view.rightToLeft, 1);
+  assert.equal(v.view.tabSelected, 1);
+  assert.equal(v.view.viewMode, 'pageBreakPreview');
+});
+
+test('insertRows shifts an existing literal forward', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Populate row 0; insert one row at row 0; the literal is now at row 1.
+  assert.ok(wb.setNumber(0, 0, 0, 99).ok);
+  assert.ok(wb.insertRows(0, 0, 1).ok);
+  const r0 = wb.getValue(0, 0, 0);
+  assert.ok(r0.status.ok);
+  // The freshly-inserted row 0 is blank.
+  assert.equal(r0.value.kind, mod.ValueKind.Blank);
+  const r1 = wb.getValue(0, 1, 0);
+  assert.ok(r1.status.ok);
+  assert.equal(r1.value.kind, mod.ValueKind.Number);
+  assert.equal(r1.value.number, 99);
+});
+
+test('setCellXfIndex + getCellXfIndex round-trip the xf id', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Seed the cell so the xf attaches to a stored slot.
+  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+  // xfIndex 0 is always the default xf and is guaranteed to be valid.
+  assert.ok(wb.setCellXfIndex(0, 0, 0, 0).ok);
+  const r = wb.getCellXfIndex(0, 0, 0);
+  assert.ok(r.status.ok, `getCellXfIndex: ${JSON.stringify(r.status)}`);
+  assert.equal(typeof r.xfIndex, 'number');
+  assert.equal(r.xfIndex, 0);
+});
+
+test('style building blocks: addFont -> addXf -> setCellXfIndex -> getXf', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // A fresh workbook seeds Excel's minimum style table: one default font,
+  // one empty border, one default xf, and the two fills Excel reserves at
+  // the front of every file (`none`, `gray125`). A caller's first record
+  // therefore lands after them instead of displacing `none`.
+  assert.equal(wb.fontCount().value, 1);
+  assert.equal(wb.fillCount().value, 2);
+  assert.equal(wb.borderCount().value, 1);
+  assert.equal(wb.xfCount().value, 1);
+
+  const fontResult = wb.addFont({
+    name: 'Arial',
+    size: 12,
+    bold: true,
+    italic: false,
+    strike: false,
+    underline: 0,
+    colorArgb: 0xff112233,
+  });
+  assert.ok(fontResult.status.ok, `addFont: ${JSON.stringify(fontResult.status)}`);
+  // Linear-search dedup: the second call with the same payload returns the same index.
+  const fontDup = wb.addFont({
+    name: 'Arial',
+    size: 12,
+    bold: true,
+    italic: false,
+    strike: false,
+    underline: 0,
+    colorArgb: 0xff112233,
+  });
+  assert.equal(fontDup.index, fontResult.index);
+  assert.equal(wb.fontCount().value, 2);
+
+  const fill = wb.addFill({ pattern: 1, fgArgb: 0xffff0000, bgArgb: 0xff000000 });
+  assert.ok(fill.status.ok);
+  const border = wb.addBorder({
+    left: { style: 1, colorArgb: 0xff000000 },
+    right: { style: 1, colorArgb: 0xff000000 },
+    top: { style: 1, colorArgb: 0xff000000 },
+    bottom: { style: 1, colorArgb: 0xff000000 },
+    diagonal: { style: 0, colorArgb: 0 },
+    diagonalUp: false,
+    diagonalDown: false,
+  });
+  assert.ok(border.status.ok);
+
+  const builtin = wb.addNumFmt('General');
+  assert.ok(builtin.status.ok);
+  assert.equal(builtin.numFmtId, 0);
+
+  const custom = wb.addNumFmt('"USD" #,##0');
+  assert.ok(custom.status.ok);
+  assert.ok(custom.numFmtId >= 164, `expected custom id >= 164, got ${custom.numFmtId}`);
+
+  const xf = wb.addXf({
+    fontIndex: fontResult.index,
+    fillIndex: fill.index,
+    borderIndex: border.index,
+    numFmtId: custom.numFmtId,
+    horizontalAlign: 1,
+    verticalAlign: 2,
+    wrapText: true,
+  });
+  assert.ok(xf.status.ok, `addXf: ${JSON.stringify(xf.status)}`);
+
+  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+  assert.ok(wb.setCellXfIndex(0, 0, 0, xf.index).ok);
+
+  const reread = wb.getCellXf(xf.index);
+  assert.ok(reread.status.ok);
+  assert.equal(reread.fontIndex, fontResult.index);
+  assert.equal(reread.numFmtId, custom.numFmtId);
+  assert.equal(reread.wrapText, true);
+  assert.equal(reread.hasAlignment, true);
+  assert.equal(reread.hasHorizontalAlign, true);
+  assert.equal(reread.hasVerticalAlign, true);
+  assert.equal(reread.hasWrapText, true);
+  assert.equal(reread.hasJustifyLastLine, false);
+
+  const optional = wb.addXf({
+    fontIndex: fontResult.index,
+    fillIndex: fill.index,
+    borderIndex: border.index,
+    numFmtId: custom.numFmtId,
+    textRotation: 255,
+    indent: 0,
+    relativeIndent: -3,
+    shrinkToFit: false,
+    readingOrder: 0,
+    justifyLastLine: true,
+  });
+  assert.ok(optional.status.ok, `optional alignment: ${JSON.stringify(optional.status)}`);
+  const optionalRead = wb.getCellXf(optional.index);
+  assert.ok(optionalRead.status.ok);
+  assert.equal(optionalRead.textRotation, 255);
+  assert.equal(optionalRead.indent, 0);
+  assert.equal(optionalRead.relativeIndent, -3);
+  assert.equal(optionalRead.shrinkToFit, false);
+  assert.equal(optionalRead.readingOrder, 0);
+  assert.equal(optionalRead.justifyLastLine, true);
+  assert.equal(optionalRead.hasAlignment, true);
+  assert.equal(optionalRead.hasJustifyLastLine, true);
+  assert.equal(wb.addXf(optionalRead).index, optional.index);
+
+  const omitted = wb.addXf({
+    fontIndex: fontResult.index,
+    fillIndex: fill.index,
+    borderIndex: border.index,
+    numFmtId: custom.numFmtId,
+  });
+  assert.ok(omitted.status.ok);
+  const omittedRead = wb.getCellXf(omitted.index);
+  assert.ok(omittedRead.status.ok);
+  assert.equal(omittedRead.hasAlignment, false);
+
+  const explicitEmpty = wb.addXf({
+    fontIndex: fontResult.index,
+    fillIndex: fill.index,
+    borderIndex: border.index,
+    numFmtId: custom.numFmtId,
+    hasAlignment: true,
+  });
+  assert.ok(explicitEmpty.status.ok);
+  assert.notEqual(explicitEmpty.index, omitted.index);
+  const explicitEmptyRead = wb.getCellXf(explicitEmpty.index);
+  assert.ok(explicitEmptyRead.status.ok);
+  assert.equal(explicitEmptyRead.hasAlignment, true);
+
+  const rfont = wb.getFont(fontResult.index);
+  assert.ok(rfont.status.ok);
+  assert.equal(rfont.name, 'Arial');
+  assert.equal(rfont.bold, true);
+
+  const rfill = wb.getFill(fill.index);
+  assert.ok(rfill.status.ok);
+  assert.equal(rfill.pattern, 1);
+
+  const rborder = wb.getBorder(border.index);
+  assert.ok(rborder.status.ok);
+  assert.equal(rborder.left.style, 1);
+  assert.equal(rborder.diagonalUp, false);
+
+  const rfmt = wb.getNumFmt(custom.numFmtId);
+  assert.ok(rfmt.status.ok);
+  assert.equal(rfmt.formatCode, '"USD" #,##0');
+});
+
+test('selector colours survive get/add identity and save/load', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const theme = { kind: 2, rgb: 0, theme: 3, tint: 0.5, indexed: 0 };
+  const indexed = { kind: 3, rgb: 0, theme: 0, tint: 0, indexed: 9 };
+  const automatic = { kind: 4, rgb: 0, theme: 0, tint: 0, indexed: 0 };
+
+  const font = wb.addFont({ name: 'SelectorFont', size: 11, colorArgb: 0x01020304, color: theme });
+  assert.ok(font.status.ok);
+  const gotFont = wb.getFont(font.index);
+  assert.ok(gotFont.status.ok);
+  assert.equal(gotFont.color.kind, 2);
+  assert.equal(gotFont.color.theme, 3);
+  assert.equal(gotFont.color.tint, 0.5);
+  assert.equal(gotFont.colorArgb, 0x01020304);
+  const fontAgain = wb.addFont(gotFont);
+  assert.ok(fontAgain.status.ok);
+  assert.equal(fontAgain.index, font.index);
+
+  const fill = wb.addFill({
+    pattern: 1,
+    fgArgb: 0x05060708,
+    bgArgb: 0x090a0b0c,
+    fg: indexed,
+    bg: automatic,
+  });
+  assert.ok(fill.status.ok);
+  const gotFill = wb.getFill(fill.index);
+  assert.ok(gotFill.status.ok);
+  assert.equal(gotFill.fg.kind, 3);
+  assert.equal(gotFill.fg.indexed, 9);
+  assert.equal(gotFill.bg.kind, 4);
+  const fillAgain = wb.addFill(gotFill);
+  assert.ok(fillAgain.status.ok);
+  assert.equal(fillAgain.index, fill.index);
+
+  const border = wb.addBorder({
+    left: { style: 1, colorArgb: 0x01020304, color: theme },
+    right: { style: 1, colorArgb: 0x05060708, color: indexed },
+    top: { style: 1, colorArgb: 0x090a0b0c, color: automatic },
+    bottom: { style: 0, colorArgb: 0 },
+    diagonal: { style: 0, colorArgb: 0 },
+  });
+  assert.ok(border.status.ok);
+  const gotBorder = wb.getBorder(border.index);
+  assert.ok(gotBorder.status.ok);
+  assert.equal(gotBorder.left.color.kind, 2);
+  assert.equal(gotBorder.left.color.theme, 3);
+  assert.equal(gotBorder.right.color.kind, 3);
+  assert.equal(gotBorder.right.color.indexed, 9);
+  assert.equal(gotBorder.top.color.kind, 4);
+  const borderAgain = wb.addBorder(gotBorder);
+  assert.ok(borderAgain.status.ok);
+  assert.equal(borderAgain.index, border.index);
+
+  const dxf = wb.addDxf({
+    font: { name: 'DxfSelector', size: 9, colorArgb: 0x11121314, color: automatic },
+    fill: { pattern: 1, fgArgb: 0x15161718, fg: indexed },
+    border: { left: { style: 1, colorArgb: 0x191a1b1c, color: theme } },
+  });
+  assert.ok(dxf.status.ok);
+  const gotDxf = wb.getDxf(dxf.index);
+  assert.ok(gotDxf.status.ok);
+  assert.equal(gotDxf.font.color.kind, 4);
+  assert.equal(gotDxf.fill.fg.kind, 3);
+  assert.equal(gotDxf.border.left.color.kind, 2);
+  const dxfAgain = wb.addDxf(gotDxf);
+  assert.ok(dxfAgain.status.ok);
+  assert.equal(dxfAgain.index, dxf.index);
+
+  const saved = wb.save();
+  assert.ok(saved.status.ok);
+  const loaded = mod.Workbook.loadBytes(saved.bytes);
+  const loadedFont = loaded.getFont(font.index);
+  const loadedFill = loaded.getFill(fill.index);
+  const loadedBorder = loaded.getBorder(border.index);
+  const loadedDxf = loaded.getDxf(dxf.index);
+  assert.ok(loadedFont.status.ok);
+  assert.ok(loadedFill.status.ok);
+  assert.ok(loadedBorder.status.ok);
+  assert.ok(loadedDxf.status.ok);
+  assert.equal(loadedFont.color.kind, 2);
+  assert.equal(loadedFill.fg.kind, 3);
+  assert.equal(loadedBorder.left.color.kind, 2);
+  assert.equal(loadedDxf.font.color.kind, 4);
+  loaded.dispose();
+  wb.dispose();
+});
+
+test('dxf alignment and protection XML survive get/add identity and save/load', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const alignmentXml = '<alignment horizontal="center" wrapText="1"/>';
+  const protectionXml = '<protection locked="0" hidden="1"/>';
+  const alignment = wb.addDxf({ alignmentXml });
+  assert.ok(alignment.status.ok);
+  const protection = wb.addDxf({ protectionXml });
+  assert.ok(protection.status.ok);
+  assert.notEqual(alignment.index, protection.index);
+
+  const gotAlignment = wb.getDxf(alignment.index);
+  assert.ok(gotAlignment.status.ok);
+  assert.equal(gotAlignment.alignmentXml, alignmentXml);
+  assert.equal(gotAlignment.protectionXml, undefined);
+  const gotProtection = wb.getDxf(protection.index);
+  assert.ok(gotProtection.status.ok);
+  assert.equal(gotProtection.alignmentXml, undefined);
+  assert.equal(gotProtection.protectionXml, protectionXml);
+
+  const alignmentAgain = wb.addDxf(gotAlignment);
+  assert.ok(alignmentAgain.status.ok);
+  assert.equal(alignmentAgain.index, alignment.index);
+  const protectionAgain = wb.addDxf(gotProtection);
+  assert.ok(protectionAgain.status.ok);
+  assert.equal(protectionAgain.index, protection.index);
+
+  const saved = wb.save();
+  assert.ok(saved.status.ok);
+  const loaded = mod.Workbook.loadBytes(saved.bytes);
+  assert.ok(loaded.isValid());
+  const loadedAlignment = loaded.getDxf(alignment.index);
+  assert.ok(loadedAlignment.status.ok);
+  assert.equal(loadedAlignment.alignmentXml, alignmentXml);
+  assert.equal(loadedAlignment.protectionXml, undefined);
+  const loadedProtection = loaded.getDxf(protection.index);
+  assert.ok(loadedProtection.status.ok);
+  assert.equal(loadedProtection.alignmentXml, undefined);
+  assert.equal(loadedProtection.protectionXml, protectionXml);
+  const loadedAlignmentAgain = loaded.addDxf(loadedAlignment);
+  assert.ok(loadedAlignmentAgain.status.ok);
+  assert.equal(loadedAlignmentAgain.index, alignment.index);
+  const loadedProtectionAgain = loaded.addDxf(loadedProtection);
+  assert.ok(loadedProtectionAgain.status.ok);
+  assert.equal(loadedProtectionAgain.index, protection.index);
+  loaded.dispose();
+  wb.dispose();
+});
+
+test('addFont / getFont preserve superscript and round-trip to the same index', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const superscript = wb.addFont({ name: 'Arial', size: 12, vertAlign: 1, colorArgb: 0xff112233 });
+  assert.ok(superscript.status.ok, `addFont: ${JSON.stringify(superscript.status)}`);
+  assert.equal(wb.getFont(superscript.index).vertAlign, 1);
+
+  const before = wb.fontCount().value;
+  const again = wb.addFont(wb.getFont(superscript.index));
+  assert.ok(again.status.ok);
+  assert.equal(again.index, superscript.index);
+  assert.equal(wb.fontCount().value, before);
+
+  const edited = wb.getFont(superscript.index);
+  edited.colorArgb = 0xff00ff00;
+  const recolored = wb.addFont(edited);
+  assert.ok(recolored.status.ok);
+  assert.notEqual(recolored.index, superscript.index);
+  const reread = wb.getFont(recolored.index);
+  assert.equal(reread.vertAlign, 1);
+  assert.equal(reread.colorArgb, 0xff00ff00);
+});
+
+test('addFont/setFont with a non-numeric field throws and does not commit a coerced value', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+
+  const before = wb.fontCount().value;
+  assert.throws(() => wb.addFont({ name: 'Arial', size: 'not a number' }), TypeError);
+  assert.equal(wb.fontCount().value, before, 'no font must have been added for the rejected call');
+
+  const font = wb.addFont({ name: 'Arial', size: 12 });
+  assert.ok(font.status.ok);
+  assert.throws(() => wb.setFont(font.index, { name: 'Arial', size: 'not a number' }), TypeError);
+  // The font slot must still hold its original size, not a coerced 0.
+  assert.equal(wb.getFont(font.index).size, 12);
+});
+
+test('phonetic runs keep their spans through a save/load round trip', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  wb.setText(0, 0, 0, '東京都');
+  assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, []);
+
+  const runs = [
+    { sb: 0, eb: 2, text: 'トウキョウ' },
+    { sb: 2, eb: 3, text: 'ト' },
+  ];
+  const stored = wb.setCellPhoneticRuns(0, 0, 0, runs);
+  assert.ok(stored.ok, `setCellPhoneticRuns: ${JSON.stringify(stored)}`);
+  assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, runs);
+  // The flattening getter still reports the concatenation.
+  assert.equal(wb.getCellPhonetic(0, 0, 0).value, 'トウキョウト');
+
+  const saved = wb.save();
+  assert.ok(saved.status.ok, `save: ${JSON.stringify(saved.status)}`);
+  const loaded = mod.Workbook.loadBytes(saved.bytes);
+  assert.deepEqual(loaded.getCellPhoneticRuns(0, 0, 0).runs, runs);
+
+  // Writing the flattened reading back is the collapse the run API avoids.
+  wb.setCellPhonetic(0, 0, 0, 'トウキョウト');
+  assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, [{ sb: 0, eb: 3, text: 'トウキョウト' }]);
+
+  const rejected = wb.setCellPhoneticRuns(0, 0, 0, [
+    { sb: 2, eb: 3, text: 'ト' },
+    { sb: 0, eb: 2, text: 'トウ' },
+  ]);
+  assert.equal(rejected.ok, false);
+
+  loaded.dispose();
+  wb.dispose();
+});
+
+test('phonetic properties are independent of the runs and survive a round trip', async () => {
+  const mod = await getModule();
+  // The result carries a `status` alongside the triple; compare the triple
+  // alone so a status-shape change does not read as a value change.
+  const props = (book) => {
+    const { fontId, type, alignment } = book.getCellPhoneticProperties(0, 0, 0);
+    return { fontId, type, alignment };
+  };
+  const wb = mod.Workbook.createDefault();
+  wb.setText(0, 0, 0, '大阪');
+  assert.deepEqual(props(wb), { fontId: 0, type: 0, alignment: 0 });
+
+  assert.ok(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 3, type: 2, alignment: 2 }).ok);
+  // Setting the readings must not reset the rendering.
+  assert.ok(wb.setCellPhoneticRuns(0, 0, 0, [{ sb: 0, eb: 2, text: 'おおさか' }]).ok);
+  assert.deepEqual(props(wb), { fontId: 3, type: 2, alignment: 2 });
+
+  const saved = wb.save();
+  assert.ok(saved.status.ok, `save: ${JSON.stringify(saved.status)}`);
+  const loaded = mod.Workbook.loadBytes(saved.bytes);
+  assert.deepEqual(props(loaded), { fontId: 3, type: 2, alignment: 2 });
+
+  // Two bits each on the binary side, so a wider ordinal is refused.
+  assert.equal(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 0, type: 4, alignment: 0 }).ok, false);
+  assert.deepEqual(props(wb), { fontId: 3, type: 2, alignment: 2 });
+
+  loaded.dispose();
+  wb.dispose();
+});
+
+test('setDefaultFont declares what an unstyled cell is saved as', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.equal(wb.getFont(0).name, 'Calibri');
+
+  // addFont can only ever append beside the seeded default.
+  const appended = wb.addFont({ name: '游ゴシック', size: 11 });
+  assert.ok(appended.status.ok);
+  assert.ok(appended.index > 0);
+  assert.equal(wb.getFont(0).name, 'Calibri');
+
+  const declared = wb.setDefaultFont({ name: '游ゴシック', size: 11, hasCharset: true, charset: 128 });
+  assert.ok(declared.ok, `setDefaultFont: ${JSON.stringify(declared)}`);
+  assert.equal(wb.getFont(0).name, '游ゴシック');
+  assert.equal(wb.getFont(0).charset, 128);
+
+  wb.dispose();
+});
+
+test('setFont overwrites an existing slot and refuses an absent index', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const added = wb.addFont({ name: 'Meiryo', size: 12 });
+  assert.ok(added.status.ok);
+
+  const replaced = wb.setFont(added.index, { name: 'MS Gothic', size: 9 });
+  assert.ok(replaced.ok, `setFont: ${JSON.stringify(replaced)}`);
+  assert.equal(wb.getFont(added.index).name, 'MS Gothic');
+
+  const before = wb.fontCount().value;
+  assert.equal(wb.setFont(before, { name: 'MS Gothic', size: 9 }).ok, false);
+  assert.equal(wb.fontCount().value, before);
+
+  wb.dispose();
+});
+
+test('addDxf / getDxf round-trip a superscript differential font', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const added = wb.addDxf({ font: { name: 'Calibri', size: 9, vertAlign: 1 } });
+  assert.ok(added.status.ok, `addDxf: ${JSON.stringify(added.status)}`);
+  const readBack = wb.getDxf(added.index);
+  assert.ok(readBack.status.ok);
+  assert.equal(readBack.font.vertAlign, 1);
+
+  const before = wb.dxfCount().value;
+  const again = wb.addDxf(readBack);
+  assert.ok(again.status.ok);
+  assert.equal(again.index, added.index);
+  assert.equal(wb.dxfCount().value, before);
+});
+
+test('addXf rejects out-of-range font_index', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const r = wb.addXf({
+    fontIndex: 99,
+    fillIndex: 0,
+    borderIndex: 0,
+    numFmtId: 0,
+    horizontalAlign: 0,
+    verticalAlign: 0,
+    wrapText: false,
+  });
+  assert.ok(!r.status.ok, 'expected addXf to reject out-of-range font_index');
+});
diff --git a/packages/npm-native/test/smoke_lifecycle_recalc.mjs b/packages/npm-native/test/smoke_lifecycle_recalc.mjs
new file mode 100644
index 000000000..4218c34fc
--- /dev/null
+++ b/packages/npm-native/test/smoke_lifecycle_recalc.mjs
@@ -0,0 +1,235 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+test("Workbook.createDefault + setFormula '=1+2' + recalc -> 3", async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setFormula(0, 0, 0, '=1+2').ok);
+  assert.ok(wb.recalc().ok);
+  const r = wb.getValue(0, 0, 0);
+  assert.ok(r.status.ok);
+  assert.equal(r.value.kind, mod.ValueKind.Number);
+  assert.equal(r.value.number, 3);
+});
+
+test('recalcParallel evaluates a wide DAG and reports bounded telemetry', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const width = 128;
+  for (let row = 0; row < width; row += 1) {
+    assert.ok(wb.setNumber(0, row, 0, row + 1).ok);
+    assert.ok(wb.setFormula(0, row, 1, `=A${row + 1}*2`).ok);
+  }
+
+  const serial = wb.recalcParallel(1);
+  assert.ok(serial.status.ok, `recalcParallel(1): ${JSON.stringify(serial.status)}`);
+  assert.equal(serial.stats.workerThreadsStarted, 0);
+  assert.equal(serial.stats.workerThreadsUsed, 0);
+  assert.equal(serial.stats.cellsEvaluated, width);
+  for (let row = 0; row < width; row += 1) {
+    const value = wb.getValue(0, row, 1);
+    assert.ok(value.status.ok, `serial value row ${row}: ${JSON.stringify(value.status)}`);
+    assert.equal(value.value.kind, mod.ValueKind.Number);
+    assert.equal(value.value.number, (row + 1) * 2);
+  }
+
+  for (let row = 0; row < width; row += 1) {
+    assert.ok(wb.setNumber(0, row, 0, row + 2).ok);
+  }
+  const parallel = wb.recalcParallel(8);
+  assert.ok(parallel.status.ok, `recalcParallel(8): ${JSON.stringify(parallel.status)}`);
+  if (parallel.stats.workerThreadsStarted <= 1) {
+    assert.equal(parallel.stats.workerThreadsUsed, 0);
+    assert.equal(parallel.stats.parallelSteps, 0);
+    assert.ok(parallel.stats.serialFallbackSteps > 0, `expected serial fallback: ${JSON.stringify(parallel)}`);
+  } else {
+    assert.ok(parallel.stats.parallelSteps > 0, `expected parallel steps: ${JSON.stringify(parallel)}`);
+    assert.ok(parallel.stats.workerThreadsUsed > 0, `expected an effective worker: ${JSON.stringify(parallel)}`);
+    assert.ok(parallel.stats.workerThreadsStarted <= 8);
+    assert.ok(parallel.stats.workerThreadsUsed <= parallel.stats.workerThreadsStarted);
+  }
+  assert.equal(parallel.stats.cellsEvaluated, width);
+  for (let row = 0; row < width; row += 1) {
+    const value = wb.getValue(0, row, 1);
+    assert.ok(value.status.ok, `parallel value row ${row}: ${JSON.stringify(value.status)}`);
+    assert.equal(value.value.kind, mod.ValueKind.Number);
+    assert.equal(value.value.number, (row + 2) * 2);
+  }
+
+  const assertInvalid = (input, label) => {
+    const invalid = input === undefined ? wb.recalcParallel() : wb.recalcParallel(input);
+    assert.equal(invalid.status.ok, false, label);
+    assert.notEqual(invalid.status.status, 0, label);
+    assert.equal(invalid.stats.cellsEvaluated, 0, label);
+    assert.equal(invalid.stats.sccsProcessed, 0, label);
+    assert.equal(invalid.stats.parallelSteps, 0, label);
+    assert.equal(invalid.stats.serialFallbackSteps, 0, label);
+    assert.equal(invalid.stats.cycleRecoveries, 0, label);
+    assert.equal(invalid.stats.workerThreadsStarted, 0, label);
+    assert.equal(invalid.stats.workerThreadsUsed, 0, label);
+    return invalid;
+  };
+  assertInvalid(undefined, 'missing threadCount');
+  assertInvalid(null, 'null threadCount');
+  assertInvalid(NaN, 'NaN threadCount');
+  assertInvalid(Infinity, 'Infinity threadCount');
+  assertInvalid(-Infinity, '-Infinity threadCount');
+  assertInvalid(1.5, 'fractional threadCount');
+  assertInvalid(-1, 'negative threadCount');
+  // Rejected by the binding itself, before any C ABI call: the message is
+  // binding-authored and the context is empty, never a value built from
+  // the threadCount the caller passed (the Status contract's promise for
+  // a binding-raised failure).
+  const invalid = assertInvalid(9, 'threadCount above cap');
+  assert.equal(invalid.status.message, 'recalcParallel: `threadCount` must be an integer in 0..8');
+  assert.equal(invalid.status.context, '');
+  wb.dispose();
+});
+
+test("evaluateFormulaArray('=SEQUENCE(2,3)') returns a 2x3 grid", async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const r = wb.evaluateFormulaArray(0, 0, 0, '=SEQUENCE(2,3)');
+  assert.ok(r.status.ok);
+  assert.equal(r.rows, 2);
+  assert.equal(r.cols, 3);
+  assert.equal(r.cells.length, 2);
+  assert.equal(r.cells[0].length, 3);
+  // Row-major 1..6.
+  assert.equal(r.cells[0][0].kind, mod.ValueKind.Number);
+  assert.equal(r.cells[0][0].number, 1);
+  assert.equal(r.cells[1][2].number, 6);
+});
+
+test("evaluateFormulaArray('=1+2') reports a 1x1 scalar array", async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const r = wb.evaluateFormulaArray(0, 0, 0, '=1+2');
+  assert.ok(r.status.ok);
+  assert.equal(r.rows, 1);
+  assert.equal(r.cols, 1);
+  assert.equal(r.cells[0][0].kind, mod.ValueKind.Number);
+  assert.equal(r.cells[0][0].number, 3);
+});
+
+test('Workbook.createEmpty + addSheet -> sheetCount/sheetName work', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createEmpty();
+  assert.ok(wb.addSheet('Sheet1').ok);
+  assert.equal(wb.sheetCount().value, 1);
+  const sn = wb.sheetName(0);
+  assert.ok(sn.status.ok);
+  assert.equal(sn.value, 'Sheet1');
+});
+
+test('Unicode sheet identity rejects folded duplicate and permits casing rename', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createEmpty();
+  assert.ok(wb.addSheet('Ä').ok);
+  assert.ok(wb.addSheet('Ö').ok);
+  assert.equal(wb.addSheet('ä').ok, false);
+  const collision = wb.renameSheet(1, 'ä');
+  assert.equal(collision.ok, false);
+  assert.notEqual(collision.status, 0);
+  assert.equal(wb.sheetName(0).value, 'Ä');
+  assert.equal(wb.sheetName(1).value, 'Ö');
+  assert.ok(wb.renameSheet(0, 'ä').ok);
+  const sn = wb.sheetName(0);
+  assert.ok(sn.status.ok);
+  assert.equal(sn.value, 'ä');
+  assert.equal(wb.sheetName(1).value, 'Ö');
+  wb.dispose();
+});
+
+test('save() returns Uint8Array; loadBytes round-trips the value', async () => {
+  const mod = await getModule();
+  const wb1 = mod.Workbook.createDefault();
+  assert.ok(wb1.setNumber(0, 0, 0, 42).ok);
+  const sr = wb1.save();
+  assert.ok(sr.status.ok, `save: ${JSON.stringify(sr.status)}`);
+  assert.ok(sr.bytes instanceof Uint8Array, 'expected Uint8Array');
+  assert.ok(sr.bytes.length > 0, 'expected non-empty save buffer');
+
+  const wb2 = mod.Workbook.loadBytes(sr.bytes);
+  const r = wb2.getValue(0, 0, 0);
+  assert.ok(r.status.ok, `loaded getValue: ${JSON.stringify(r.status)}`);
+  assert.equal(r.value.kind, mod.ValueKind.Number);
+  assert.equal(r.value.number, 42);
+});
+
+test('loadBytes rejects invalid input with a fresh diagnostic', async () => {
+  const mod = await getModule();
+  const loaded = mod.Workbook.loadBytes(new Uint16Array([1]));
+  assert.equal(loaded.isValid(), false);
+  assert.match(mod.lastErrorMessage(), /NULL or empty input/);
+});
+
+// -- Expanded surface coverage -----------------------------------------
+// These tests exercise the methods the addon mirrors from the embind
+// binding. They are deliberately shallow: each call should round-trip
+// some observable state without crashing the Node process.
+
+test('isValid returns true for a live workbook', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.equal(wb.isValid(), true);
+});
+
+test('dispose deterministically releases a workbook and is idempotent', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.equal(wb.isValid(), true);
+  assert.equal(wb.dispose(), undefined);
+  assert.equal(wb.isValid(), false);
+  assert.equal(wb.getValue(0, 0, 0).status.ok, false);
+  assert.equal(wb.dispose(), undefined);
+});
+
+test('memoryUsage grows with the workbook and reads zero after dispose', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+
+  const empty = wb.memoryUsage();
+  assert.ok(empty > 0, `an empty workbook still owns storage, got ${empty}`);
+
+  // Distinct strings so the shared-string storage cannot fold them into
+  // one entry and hide the growth.
+  for (let row = 0; row < 2000; row += 1) {
+    wb.setText(0, row, 0, `payload-${row}-${'x'.repeat(64)}`);
+  }
+  const filled = wb.memoryUsage();
+  assert.ok(filled > empty, `expected growth, got ${empty} -> ${filled}`);
+
+  wb.dispose();
+  assert.equal(wb.memoryUsage(), 0);
+});
+
+test('memoryUsage is stable across repeated calls and survives a recalc', async () => {
+  // The external-memory report is computed as a delta against the last
+  // reported figure, so a repeated call on an unchanged workbook must be
+  // a no-op rather than double-counting, and the operations that trigger
+  // their own report must not disturb the estimate either.
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  for (let row = 0; row < 500; row += 1) {
+    wb.setFormula(0, row, 0, `=${row}+1`);
+  }
+
+  const first = wb.memoryUsage();
+  assert.equal(wb.memoryUsage(), first);
+
+  assert.equal(wb.recalc().ok, true);
+  const afterRecalc = wb.memoryUsage();
+  assert.ok(afterRecalc >= first, `recalc must not shrink the estimate: ${first} -> ${afterRecalc}`);
+  assert.equal(wb.memoryUsage(), afterRecalc);
+
+  wb.dispose();
+});
+
+test('Workbook factories return instances of the exported Workbook class', async () => {
+  const mod = await getModule();
+  const defaultBook = mod.Workbook.createDefault();
+  const emptyBook = mod.Workbook.createEmpty();
+  assert.ok(defaultBook instanceof mod.Workbook);
+  assert.ok(emptyBook instanceof mod.Workbook);
+});
diff --git a/packages/npm-native/test/smoke_pivot_mutators_status.mjs b/packages/npm-native/test/smoke_pivot_mutators_status.mjs
new file mode 100644
index 000000000..cff814530
--- /dev/null
+++ b/packages/npm-native/test/smoke_pivot_mutators_status.mjs
@@ -0,0 +1,786 @@
+import test from 'node:test';
+import { inflateRawSync } from 'node:zlib';
+import { assert, getModule, path, pkgRoot, readFile } from './smoke_support.mjs';
+
+// ---- Pivot mutator marshalling -----------------------------------------
+//
+// Every pivot mutator is driven once against a small pivot and checked
+// through a read of the result -- the projected grid wherever the mutation
+// reaches it -- so an argument dropped, reordered or mis-converted on the
+// way to the C ABI shows up as a wrong grid rather than a green `.ok`. The
+// completeness test below keeps the table in step with the declaration
+// file.
+
+// Region / Product carry shared items and their records store item
+// indices; Amount and Date are plain numbers. Only Region is laid out, so
+// the baseline grid is two regions, their sums and the grand total.
+function buildPivot(mod) {
+  const wb = mod.Workbook.createDefault();
+  const must = (r, what) => {
+    const status = typeof r.ok === 'boolean' ? r : r.status;
+    assert.ok(status.ok, `${what}: ${JSON.stringify(status)}`);
+    return r;
+  };
+  const cacheId = must(wb.pivotCacheCreate(0), 'pivotCacheCreate').index;
+  must(wb.pivotCacheSetWorksheetSource(cacheId, { present: true, ref: 'A1:D5', sheet: 'Sheet1' }), 'source');
+  for (const name of ['Region', 'Product', 'Amount', 'Date']) must(wb.pivotCacheFieldAdd(cacheId, name), name);
+  for (const item of ['East', 'West']) must(wb.pivotCacheFieldAddSharedItemText(cacheId, 0, item), item);
+  for (const item of ['Apple', 'Pear']) must(wb.pivotCacheFieldAddSharedItemText(cacheId, 1, item), item);
+  for (const values of [
+    [0, 0, 10, 45292],
+    [1, 0, 30, 45323],
+    [0, 1, 5, 45658],
+    [1, 1, 7, 45689],
+  ]) {
+    const rec = must(wb.pivotCacheRecordAdd(cacheId), 'record').index;
+    for (const [field, v] of values.entries())
+      must(wb.pivotCacheRecordSetNumber(cacheId, rec, field, v), 'record value');
+  }
+  const pivot = must(wb.pivotCreate(0, 'Pivot1', cacheId, 0, 6), 'pivotCreate').index;
+  const addField = (spec) => must(wb.pivotFieldAdd(0, pivot, spec), spec.sourceName).index;
+  const region = addField({ sourceName: 'Region', axis: 0 });
+  must(wb.pivotFieldAddItem(0, pivot, region, 'East', true), 'item');
+  must(wb.pivotFieldAddItem(0, pivot, region, 'West', true), 'item');
+  const product = addField({ sourceName: 'Product', axis: 2 });
+  must(wb.pivotFieldAddItem(0, pivot, product, 'Apple', true), 'item');
+  must(wb.pivotFieldAddItem(0, pivot, product, 'Pear', true), 'item');
+  const amount = addField({ sourceName: 'Amount', axis: 2 });
+  const date = addField({ sourceName: 'Date', axis: 2 });
+  must(wb.pivotSetRowFieldOrder(0, pivot, [region]), 'row order');
+  must(wb.pivotDataFieldAdd(0, pivot, { name: 'Sum of Amount', fieldIndex: amount, aggregation: 0 }), 'data field');
+  return { wb, cacheId, pivot, region, product, amount, date };
+}
+
+// The projected grid as one `|`-joined string per sheet row.
+function pivotGrid(wb, pivot = 0) {
+  const layout = wb.pivotLayout(0, pivot);
+  assert.ok(layout.status.ok, JSON.stringify(layout.status));
+  const rows = new Map();
+  for (const cell of layout.cells) {
+    const v = cell.value;
+    const text = v.kind === 1 ? String(v.number) : v.kind === 3 ? v.text : v.kind === 4 ? `#${v.errorCode}` : '';
+    if (!rows.has(cell.row)) rows.set(cell.row, new Array(layout.cols).fill(''));
+    rows.get(cell.row)[cell.col - layout.left] = text;
+  }
+  return [...rows.keys()].sort((a, b) => a - b).map((row) => rows.get(row).join('|'));
+}
+
+const BASE_GRID = ['行ラベル|Sum of Amount', 'East|15', 'West|37', '総計|52'];
+const TWO_LEVEL_GRID = [
+  '行ラベル|Sum of Amount',
+  'Apple|10',
+  'Pear|5',
+  'East|15',
+  'Apple|30',
+  'Pear|7',
+  'West|37',
+  '総計|52',
+];
+const DATE_SERIAL_GRID = ['行ラベル|Sum of Amount', '45292|10', '45323|30', '45658|5', '45689|7', '総計|52'];
+const twoLevels = (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.region, b.product]);
+const dateRows = (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.date]);
+const hideEast = (b) => b.wb.pivotFieldSetItemVisible(0, b.pivot, b.region, 0, false);
+const WEST_ONLY = ['行ラベル|Sum of Amount', 'West|37', '総計|37'];
+const GREATER_THAN_20 = Object.freeze({ axis: 0, fieldName: 'Region', type: 1, valueKind: 1, valueDouble: 20 });
+const BETWEEN_10_20 = Object.freeze({
+  axis: 0,
+  fieldName: 'Region',
+  type: 2,
+  valueKind: 1,
+  valueDouble: 10,
+  valueHighKind: 1,
+  valueHighDouble: 20,
+});
+// Points record 0's Region at the shared item a row has just appended.
+const pointAtNewItem = (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 0, 2);
+
+// The raw text of one stored part of a saved package.
+function packagePart(bytes, name) {
+  const buf = Buffer.from(bytes);
+  let eocd = buf.length - 22;
+  while (eocd >= 0 && buf.readUInt32LE(eocd) !== 0x06054b50) eocd -= 1;
+  assert.ok(eocd >= 0, 'missing ZIP end record');
+  let at = buf.readUInt32LE(eocd + 16);
+  for (let i = buf.readUInt16LE(eocd + 10); i > 0; i -= 1) {
+    const method = buf.readUInt16LE(at + 10);
+    const size = buf.readUInt32LE(at + 20);
+    const nameLen = buf.readUInt16LE(at + 28);
+    const next = at + 46 + nameLen + buf.readUInt16LE(at + 30) + buf.readUInt16LE(at + 32);
+    if (buf.toString('utf8', at + 46, at + 46 + nameLen) === name) {
+      const local = buf.readUInt32LE(at + 42);
+      const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
+      const raw = buf.subarray(start, start + size);
+      return (method === 0 ? raw : inflateRawSync(raw)).toString('utf8');
+    }
+    at = next;
+  }
+  assert.fail(`${name} not in the package`);
+}
+
+// [method, { setup, act, after, expect }]. `act` performs the one call
+// under test; `expect` reads the result back.
+const PIVOT_MUTATORS = [
+  [
+    'pivotCacheCreate',
+    {
+      act: (b) => b.wb.pivotCacheCreate(77),
+      expect: (b, r) => {
+        assert.equal(r.index, 77);
+        assert.equal(b.wb.pivotCacheCount().value, 2);
+      },
+    },
+  ],
+  ['pivotCacheIdAt', { act: (b) => b.wb.pivotCacheIdAt(0), expect: (b, r) => assert.equal(r.index, b.cacheId) }],
+  [
+    'pivotCacheRemove',
+    {
+      setup: (b) => {
+        b.spare = b.wb.pivotCacheCreate(0).index;
+      },
+      act: (b) => b.wb.pivotCacheRemove(b.spare),
+      expect: (b) => {
+        assert.equal(b.wb.pivotCacheCount().value, 1);
+        assert.equal(b.wb.pivotCacheIdAt(0).index, b.cacheId);
+      },
+    },
+  ],
+  [
+    'pivotCacheSetWorksheetSource',
+    {
+      act: (b) => b.wb.pivotCacheSetWorksheetSource(b.cacheId, { present: true, ref: 'B2:E6', sheet: 'Data' }),
+      expect: (b) => {
+        const source = b.wb.pivotCacheGetWorksheetSource(b.cacheId);
+        assert.equal(source.ref, 'B2:E6');
+        assert.equal(source.sheet, 'Data');
+        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotCacheFieldAdd',
+    {
+      act: (b) => b.wb.pivotCacheFieldAdd(b.cacheId, 'Extra'),
+      expect: (b, r) => {
+        assert.equal(r.index, 4);
+        assert.equal(b.wb.pivotCacheFieldName(b.cacheId, 4).value, 'Extra');
+      },
+    },
+  ],
+  [
+    'pivotCacheFieldClear',
+    {
+      act: (b) => b.wb.pivotCacheFieldClear(b.cacheId),
+      expect: (b) => {
+        assert.equal(b.wb.pivotCacheFieldCount(b.cacheId).value, 0);
+        // The data field now names a cache field that no longer exists.
+        assert.equal(b.wb.pivotLayout(0, b.pivot).status.ok, false);
+      },
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemNumber',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemNumber(b.cacheId, 0, 42.5),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '42.5|10', 'East|5', 'West|37', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemText',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemText(b.cacheId, 0, 'North'),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'North|10', 'West|37', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemBool',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemBool(b.cacheId, 0, true),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', 'TRUE|10', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemBlank',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemBlank(b.cacheId, 0),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '(空白)|10', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemError',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemError(b.cacheId, 0, 6),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '#N/A|10', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldClearSharedItems',
+    {
+      act: (b) => b.wb.pivotCacheFieldClearSharedItems(b.cacheId, 0),
+      // With no shared items the records' indices render as themselves.
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '0|15', '1|37', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheRecordAdd',
+    {
+      act: (b) => b.wb.pivotCacheRecordAdd(b.cacheId),
+      expect: (b, r) => {
+        assert.equal(r.index, 4);
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|15', 'West|37', '(空白)|0', '総計|52']);
+      },
+    },
+  ],
+  [
+    'pivotCacheRecordClear',
+    {
+      act: (b) => b.wb.pivotCacheRecordClear(b.cacheId),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '総計|0']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetNumber',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 2, 1000),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|1005', 'West|37', '総計|1042']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetText',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetText(b.cacheId, 0, 0, 'West'),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|47', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetBool',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetBool(b.cacheId, 0, 2, true),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|6', 'West|37', '総計|43']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetBlank',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetBlank(b.cacheId, 0, 2),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '総計|42']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetError',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetError(b.cacheId, 0, 2, 1),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|#1', 'West|37', '総計|#1']),
+    },
+  ],
+  [
+    'pivotCreate',
+    {
+      act: (b) => b.wb.pivotCreate(0, 'Pivot2', b.cacheId, 20, 1),
+      expect: (b, r) => {
+        assert.equal(r.index, 1);
+        const layout = b.wb.pivotLayout(0, 1);
+        assert.equal(layout.top, 20);
+        assert.equal(layout.left, 1);
+        assert.deepEqual(pivotGrid(b.wb, 0), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotRemove',
+    {
+      act: (b) => b.wb.pivotRemove(0, b.pivot),
+      expect: (b) => {
+        assert.equal(b.wb.pivotCount(0).value, 0);
+        assert.equal(b.wb.pivotLayout(0, 0).status.ok, false);
+      },
+    },
+  ],
+  [
+    'pivotSetName',
+    {
+      act: (b) => b.wb.pivotSetName(0, b.pivot, 'Renamed'),
+      // A pivot's name is only observable in the part the writer emits.
+      expect: (b) => {
+        const saved = b.wb.save();
+        assert.ok(saved.status.ok, JSON.stringify(saved.status));
+        assert.match(
+          packagePart(saved.bytes, 'xl/pivotTables/pivotTable1.xml'),
+          /<pivotTableDefinition [^>]*name="Renamed"/,
+        );
+      },
+    },
+  ],
+  [
+    'pivotSetAnchor',
+    {
+      act: (b) => b.wb.pivotSetAnchor(0, b.pivot, 10, 2, 4, 2),
+      expect: (b) => {
+        const layout = b.wb.pivotLayout(0, b.pivot);
+        assert.equal(layout.top, 10);
+        assert.equal(layout.left, 2);
+        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotSetGrandTotals',
+    {
+      setup: (b) => b.wb.pivotSetColFieldOrder(0, b.pivot, [b.product]),
+      // Rows off drops the per-row total column; columns on keeps the
+      // bottom total row, so a swapped pair would show the opposite.
+      act: (b) => b.wb.pivotSetGrandTotals(0, b.pivot, false, true),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), [
+          'Sum of Amount|列ラベル|',
+          '行ラベル|Apple|Pear',
+          'East|10|5',
+          'West|30|7',
+          '総計|40|12',
+        ]),
+    },
+  ],
+  [
+    'pivotSetLayout',
+    {
+      act: (b) => b.wb.pivotSetLayout(0, b.pivot, 1),
+      expect: (b) => {
+        assert.equal(b.wb.pivotGetLayout(0, b.pivot).layout, 1);
+        assert.deepEqual(pivotGrid(b.wb), ['Region|Sum of Amount', 'East|15', 'West|37', '総計|52']);
+      },
+    },
+  ],
+  [
+    'pivotFieldAdd',
+    {
+      act: (b) => b.wb.pivotFieldAdd(0, b.pivot, { sourceName: 'Product', customName: 'Fruit', axis: 3 }),
+      expect: (b, r) => {
+        assert.equal(r.index, 4);
+        assert.deepEqual(pivotGrid(b.wb), ['Fruit|(すべて)', '|', ...BASE_GRID]);
+      },
+    },
+  ],
+  [
+    'pivotFieldClear',
+    {
+      setup: hideEast,
+      act: (b) => b.wb.pivotFieldClear(0, b.pivot),
+      expect: (b) => {
+        assert.equal(b.wb.pivotFieldCount(0, b.pivot).value, 0);
+        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotFieldSetAxis',
+    {
+      act: (b) => b.wb.pivotFieldSetAxis(0, b.pivot, b.product, 3),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['Product|(すべて)', '|', ...BASE_GRID]),
+    },
+  ],
+  [
+    'pivotFieldSetSort',
+    {
+      // East now outsums West, so sorting ascending by the data field
+      // differs from both label orders.
+      setup: (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 2, 40),
+      act: (b) => b.wb.pivotFieldSetSort(0, b.pivot, b.region, true, 'Sum of Amount'),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'West|37', 'East|45', '総計|82']),
+    },
+  ],
+  [
+    'pivotFieldSetSubtotalTop',
+    {
+      setup: twoLevels,
+      act: (b) => b.wb.pivotFieldSetSubtotalTop(0, b.pivot, b.region, true),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), [
+          '行ラベル|Sum of Amount',
+          'East|15',
+          'Apple|10',
+          'Pear|5',
+          'West|37',
+          'Apple|30',
+          'Pear|7',
+          '総計|52',
+        ]),
+    },
+  ],
+  [
+    'pivotFieldAddItem',
+    {
+      act: (b) => b.wb.pivotFieldAddItem(0, b.pivot, b.region, 'East', false),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
+    },
+  ],
+  [
+    'pivotFieldAddItemAt',
+    {
+      // Only the index-addressed form can name the blank item.
+      setup: (b) => {
+        b.wb.pivotCacheFieldAddSharedItemBlank(b.cacheId, 0);
+        b.wb.pivotCacheRecordSetBlank(b.cacheId, 0, 0);
+      },
+      act: (b) => b.wb.pivotFieldAddItemAt(0, b.pivot, b.region, 2, false),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '総計|42']),
+    },
+  ],
+  [
+    'pivotFieldClearItems',
+    {
+      setup: hideEast,
+      act: (b) => b.wb.pivotFieldClearItems(0, b.pivot, b.region),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), BASE_GRID),
+    },
+  ],
+  [
+    'pivotFieldSetItemVisible',
+    {
+      act: (b) => b.wb.pivotFieldSetItemVisible(0, b.pivot, b.region, 1, false),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|15', '総計|15']),
+    },
+  ],
+  [
+    'pivotFieldAddSubtotalFn',
+    {
+      setup: twoLevels,
+      act: (b) => b.wb.pivotFieldAddSubtotalFn(0, b.pivot, b.region, 3),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), [
+          '行ラベル|Sum of Amount',
+          'Apple|10',
+          'Pear|5',
+          'East|10',
+          'Apple|30',
+          'Pear|7',
+          'West|30',
+          '総計|52',
+        ]),
+    },
+  ],
+  [
+    'pivotFieldClearSubtotalFns',
+    {
+      setup: (b) => {
+        twoLevels(b);
+        b.wb.pivotFieldAddSubtotalFn(0, b.pivot, b.region, 3);
+      },
+      act: (b) => b.wb.pivotFieldClearSubtotalFns(0, b.pivot, b.region),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), TWO_LEVEL_GRID),
+    },
+  ],
+  [
+    'pivotFieldSetDateGroup',
+    {
+      setup: dateRows,
+      act: (b) => b.wb.pivotFieldSetDateGroup(0, b.pivot, b.date, 3, 1, -1, -1),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '令和6年|40', '令和7年|12', '総計|52']),
+    },
+  ],
+  [
+    'pivotFieldClearDateGroup',
+    {
+      setup: (b) => {
+        dateRows(b);
+        b.wb.pivotFieldSetDateGroup(0, b.pivot, b.date, 3, 0, -1, -1);
+      },
+      act: (b) => b.wb.pivotFieldClearDateGroup(0, b.pivot, b.date),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), DATE_SERIAL_GRID),
+    },
+  ],
+  [
+    'pivotFieldSetNumberFormat',
+    {
+      act: (b) => b.wb.pivotFieldSetNumberFormat(0, b.pivot, b.amount, '4'),
+      // A field's numFmtId is only observable in the part the writer emits.
+      expect: (b) => {
+        assert.equal(b.wb.pivotFieldSetNumberFormat(0, b.pivot, 99, '4').status, 2);
+        assert.equal(b.wb.pivotFieldSetNumberFormat(0, b.pivot, b.amount, '0.00').status, 2);
+        const saved = b.wb.save();
+        assert.ok(saved.status.ok, JSON.stringify(saved.status));
+        assert.match(packagePart(saved.bytes, 'xl/pivotTables/pivotTable1.xml'), /<pivotField [^>]*numFmtId="4"/);
+        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotSetRowFieldOrder',
+    {
+      act: (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.product]),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'Apple|40', 'Pear|12', '総計|52']),
+    },
+  ],
+  [
+    'pivotSetColFieldOrder',
+    {
+      act: (b) => b.wb.pivotSetColFieldOrder(0, b.pivot, [b.product]),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), [
+          'Sum of Amount|列ラベル||',
+          '行ラベル|Apple|Pear|総計',
+          'East|10|5|15',
+          'West|30|7|37',
+          '総計|40|12|52',
+        ]),
+    },
+  ],
+  [
+    'pivotDataFieldAdd',
+    {
+      act: (b) => b.wb.pivotDataFieldAdd(0, b.pivot, { name: 'Max of Amount', fieldIndex: b.amount, aggregation: 3 }),
+      expect: (b, r) => {
+        assert.equal(r.index, 1);
+        assert.deepEqual(pivotGrid(b.wb), [
+          '行ラベル|Sum of Amount|Max of Amount',
+          'East|15|10',
+          'West|37|30',
+          '総計|52|30',
+        ]);
+      },
+    },
+  ],
+  [
+    'pivotDataFieldClear',
+    {
+      act: (b) => b.wb.pivotDataFieldClear(0, b.pivot),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル', 'East', 'West', '総計']),
+    },
+  ],
+  [
+    'pivotDataFieldSet',
+    {
+      act: (b) =>
+        b.wb.pivotDataFieldSet(0, b.pivot, 0, {
+          name: 'Count of Amount',
+          fieldIndex: b.amount,
+          aggregation: 1,
+          numberFormat: '2',
+        }),
+      expect: (b) => {
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Count of Amount', 'East|2', 'West|2', '総計|4']);
+        const counts = b.wb.pivotLayout(0, b.pivot).cells.filter((c) => c.value.kind === 1);
+        assert.deepEqual(
+          counts.map((c) => c.numberFormat),
+          ['2', '2', '2'],
+        );
+      },
+    },
+  ],
+  [
+    'pivotFilterAdd',
+    {
+      act: (b) => b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
+    },
+  ],
+  [
+    'pivotFilterClear',
+    {
+      setup: (b) => b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20),
+      act: (b) => b.wb.pivotFilterClear(0, b.pivot),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), BASE_GRID),
+    },
+  ],
+  [
+    'pivotFilterRemoveAt',
+    {
+      // Each filter alone keeps a different region, so removing the wrong
+      // index leaves the wrong one.
+      setup: (b) => {
+        b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20);
+        b.wb.pivotFilterAdd(0, b.pivot, BETWEEN_10_20);
+      },
+      act: (b) => b.wb.pivotFilterRemoveAt(0, b.pivot, 1),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
+    },
+  ],
+];
+
+test('the pivot mutator table covers every declared pivot mutator', async () => {
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
+  const declared = [...dts.matchAll(/^ {2}(pivot\w*)\([^)]*\): (?:Status|AddStyleResult);/gm)].map((m) => m[1]);
+  assert.ok(declared.length > 40, `expected the pivot mutator family, found ${declared.length}`);
+  const covered = PIVOT_MUTATORS.map(([name]) => name);
+  assert.deepEqual(
+    declared.filter((name) => !covered.includes(name)),
+    [],
+    'pivot mutators without a row',
+  );
+  assert.deepEqual(
+    covered.filter((name) => !declared.includes(name)),
+    [],
+    'rows for methods that are not declared pivot mutators',
+  );
+});
+
+test('pivot mutators forward their arguments to the C ABI', async () => {
+  const mod = await getModule();
+  const base = buildPivot(mod);
+  try {
+    assert.deepEqual(pivotGrid(base.wb), BASE_GRID);
+  } finally {
+    base.wb.dispose();
+  }
+  for (const [name, row] of PIVOT_MUTATORS) {
+    const b = buildPivot(mod);
+    try {
+      row.setup?.(b);
+      const r = row.act(b);
+      const status = typeof r.ok === 'boolean' ? r : r.status;
+      assert.ok(status.ok, `${name}: ${JSON.stringify(status)}`);
+      row.after?.(b);
+      row.expect(b, r);
+    } catch (err) {
+      err.message = `${name}: ${err.message}`;
+      throw err;
+    } finally {
+      b.wb.dispose();
+    }
+  }
+});
+
+// ---- Status on the fallible accessors ----------------------------------
+//
+// Every accessor backed by a status-returning C ABI call carries that
+// status, so a rejected argument or a released handle cannot read as a
+// legitimate zero count, empty name, or unspilled cell. Each row is
+// [method, args that succeed, args the engine rejects (or null when only
+// a released handle can fail it)].
+const STATUS_ACCESSORS = [
+  ['sheetCount', [], null],
+  ['cellCount', [0], [99]],
+  ['definedNameCount', [], null],
+  ['tableCount', [], null],
+  ['passthroughCount', [], null],
+  ['pivotCount', [0], [99]],
+  ['pivotCacheCount', [], null],
+  ['pivotCacheFieldCount', null, [9999]],
+  ['pivotCacheFieldSharedItemCount', null, [9999, 0]],
+  ['pivotCacheRecordCount', null, [9999]],
+  ['pivotFieldCount', null, [99, 0]],
+  ['pivotDataFieldCount', null, [99, 0]],
+  ['pivotFilterCount', null, [99, 0]],
+  ['fontCount', [], null],
+  ['fillCount', [], null],
+  ['borderCount', [], null],
+  ['xfCount', [], null],
+  ['dxfCount', [], null],
+  ['cellStyleCount', [], null],
+  ['cellStyleXfCount', [], null],
+  ['calcMode', [], null],
+  ['excelProfileId', [], null],
+  ['localizeFunctionName', ['SUM', 0], ['NOPE_XYZ', 0]],
+  ['canonicalizeFunctionName', ['SUM', 0], ['NOPE_XYZ', 0]],
+  ['pinnedNow', [], null],
+  ['spillInfo', [0, 0, 0], [99, 0, 0]],
+  ['getColumnWidthPt', [0, 0, 0], [99, 0, 0]],
+  ['getRowHeightPt', [0, 0], [99, 0]],
+  ['columnCharsToPt', [0, 0, 8], [99, 0, 8]],
+  ['columnPtToChars', [0, 0, 10], [99, 0, 10]],
+  ['precedents', [0, 0, 0, 1], [99, 0, 0, 1]],
+  ['dependents', [0, 0, 0, 1], [99, 0, 0, 1]],
+  ['functionNames', [], null],
+];
+
+// The payload a failed call must fall back to, keyed by what it returns.
+function assertFailurePayload(name, r) {
+  if (Array.isArray(r)) assert.equal(r.length, 0, name);
+  else if ('now' in r) assert.equal(r.now, null, name);
+  else if ('engaged' in r) assert.equal(r.engaged, false, name);
+  else if (typeof r.value === 'string') assert.equal(r.value, '', name);
+  else assert.equal(r.value, 0, name);
+}
+
+test('every NumberResult accessor is covered by the status table', async () => {
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
+  const declared = [...dts.matchAll(/^ {2}([A-Za-z]\w*)\([^)]*\): NumberResult\b/gm)].map((m) => m[1]);
+  const covered = new Set(STATUS_ACCESSORS.map(([name]) => name));
+  assert.deepEqual(
+    declared.filter((name) => !covered.has(name)),
+    [],
+    'NumberResult accessors missing from STATUS_ACCESSORS',
+  );
+});
+
+test('fallible accessors report their status on success, rejection and a released handle', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  for (const [name, okArgs, badArgs] of STATUS_ACCESSORS) {
+    if (okArgs !== null) {
+      const r = wb[name](...okArgs);
+      assert.ok(r.status.ok, `${name}: ${JSON.stringify(r.status)}`);
+    }
+    if (badArgs !== null) {
+      const r = wb[name](...badArgs);
+      assert.equal(r.status.ok, false, `${name} must report the rejected arguments`);
+      assert.notEqual(r.status.status, 0, name);
+      assertFailurePayload(name, r);
+    }
+  }
+  assert.equal(wb.sheetCount().value, 1);
+  assert.equal(wb.excelProfileId().value, 'win-365-ja_JP');
+  assert.equal(wb.localizeFunctionName('SUM', 1).value, 'SUM');
+  assert.equal(wb.localizeFunctionName('SUM', 99).status.ok, false);
+
+  wb.dispose();
+  const dead = wb;
+  // Every accessor, including the ones no argument can fail, reports the
+  // released handle instead of a default reading.
+  for (const [name, okArgs, badArgs] of STATUS_ACCESSORS) {
+    if (name.endsWith('FunctionName') || name === 'functionNames') continue;
+    const r = dead[name](...(okArgs ?? badArgs));
+    assert.equal(r.status.ok, false, `${name} after release`);
+    assert.equal(r.status.status, 7000, name);
+    assertFailurePayload(name, r);
+  }
+});
+
+test('list getters carry a status and stop at the first element failure', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    // A readable sheet: every list is empty but the enumeration succeeded,
+    // which is what distinguishes it from a sheet that could not be read.
+    for (const [name, call] of [
+      ['getMerges', () => wb.getMerges(0)],
+      ['getComments', () => wb.getComments(0)],
+      ['getHyperlinks', () => wb.getHyperlinks(0)],
+      ['getValidations', () => wb.getValidations(0)],
+      ['getConditionalFormats', () => wb.getConditionalFormats(0)],
+      ['getExternalLinks', () => wb.getExternalLinks()],
+      ['listDrawingObjects', () => wb.listDrawingObjects(0)],
+    ]) {
+      const list = call();
+      assert.ok(Array.isArray(list), `${name} must stay an array`);
+      assert.equal(list.length, 0, name);
+      assert.ok(list.status.ok, `${name}: ${JSON.stringify(list.status)}`);
+    }
+
+    // An unreadable sheet is reported, not silently rendered as "empty".
+    for (const [name, call] of [
+      ['getMerges', () => wb.getMerges(99)],
+      ['getComments', () => wb.getComments(99)],
+      ['getHyperlinks', () => wb.getHyperlinks(99)],
+      ['getValidations', () => wb.getValidations(99)],
+      ['getConditionalFormats', () => wb.getConditionalFormats(99)],
+      ['listDrawingObjects', () => wb.listDrawingObjects(99)],
+    ]) {
+      const list = call();
+      assert.ok(Array.isArray(list), `${name} must stay an array`);
+      assert.equal(list.status.ok, false, `${name} must signal an unreadable sheet`);
+      assert.notEqual(list.status.status, 0, name);
+    }
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/smoke_pivot_surfaces.mjs b/packages/npm-native/test/smoke_pivot_surfaces.mjs
new file mode 100644
index 000000000..5dcf2ff93
--- /dev/null
+++ b/packages/npm-native/test/smoke_pivot_surfaces.mjs
@@ -0,0 +1,134 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+// Builds a workbook with one pivot, ready for the filter-contract cases.
+// `dispose` is the caller's job; the WASM package uses `delete` instead.
+function makePivotWorkbook(Workbook) {
+  const wb = Workbook.createDefault();
+  const cacheId = wb.pivotCacheCreate(0).index;
+  // A cache with no declared source cannot be saved: Excel offers to repair
+  // any package containing one, so the writer refuses rather than emit it.
+  assert.ok(wb.pivotCacheSetWorksheetSource(cacheId, { present: true, ref: 'A1:B3', sheet: 'Sheet1' }).ok);
+  assert.ok(wb.pivotCacheFieldAdd(cacheId, 'Region').status.ok);
+  assert.ok(wb.pivotCacheFieldAdd(cacheId, 'Amount').status.ok);
+  for (const [region, amount] of [
+    ['East', 10],
+    ['West', 30],
+  ]) {
+    const rec = wb.pivotCacheRecordAdd(cacheId).index;
+    assert.ok(wb.pivotCacheRecordSetText(cacheId, rec, 0, region).ok);
+    assert.ok(wb.pivotCacheRecordSetNumber(cacheId, rec, 1, amount).ok);
+  }
+  const pivot = wb.pivotCreate(0, 'Pivot1', cacheId, 0, 4);
+  assert.ok(pivot.status.ok, JSON.stringify(pivot.status));
+  assert.ok(wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Region', axis: 0 }).status.ok);
+  const amountField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Amount', axis: 2 });
+  assert.ok(amountField.status.ok);
+  assert.ok(
+    wb.pivotDataFieldAdd(0, pivot.index, {
+      name: 'Sum of Amount',
+      fieldIndex: amountField.index,
+      aggregation: 0,
+    }).status.ok,
+  );
+  return { wb, pivot: pivot.index };
+}
+
+// greaterThan on a double payload: the shape pivotFilterAt must read back.
+const PIVOT_FILTER = Object.freeze({
+  axis: 0,
+  fieldName: 'Region',
+  type: 1,
+  valueKind: 1,
+  valueDouble: 15,
+});
+
+test('pivotFilterAt reads back an added filter field for field', async () => {
+  const mod = await getModule();
+  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
+  try {
+    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
+    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
+    const got = wb.pivotFilterAt(0, pivot, 0);
+    assert.ok(got.status.ok, JSON.stringify(got.status));
+    assert.equal(got.axis, PIVOT_FILTER.axis);
+    assert.equal(got.fieldName, PIVOT_FILTER.fieldName);
+    assert.equal(got.type, PIVOT_FILTER.type);
+    assert.equal(got.valueKind, PIVOT_FILTER.valueKind);
+    assert.equal(got.valueDouble, PIVOT_FILTER.valueDouble);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('pivotFilterCount reports only what this session added', async () => {
+  const mod = await getModule();
+  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
+  try {
+    assert.equal(wb.pivotFilterCount(0, pivot).value, 0);
+    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
+    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('active filters are session state and do not survive save/load', async () => {
+  const mod = await getModule();
+  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
+  let bytes;
+  try {
+    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
+    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
+    const saved = wb.save();
+    assert.ok(saved.status.ok, JSON.stringify(saved.status));
+    bytes = saved.bytes;
+  } finally {
+    wb.dispose();
+  }
+  const reloaded = mod.Workbook.loadBytes(bytes);
+  try {
+    assert.equal(reloaded.pivotCount(0).value, 1);
+    // The pivot round-trips; its active-filter list deliberately does not.
+    assert.equal(reloaded.pivotFilterCount(0, 0).value, 0);
+  } finally {
+    reloaded.dispose();
+  }
+});
+
+test('pivotFilterAt rejects an out-of-range index', async () => {
+  const mod = await getModule();
+  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
+  try {
+    const got = wb.pivotFilterAt(0, pivot, 99);
+    assert.equal(got.status.ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('a required pivot spec string field left out of the object is rejected, not coerced to "undefined"', async () => {
+  const mod = await getModule();
+  const { wb, pivot } = makePivotWorkbook(mod.Workbook);
+  try {
+    const fieldCountBefore = wb.pivotFieldCount(0, pivot).value;
+    const field = wb.pivotFieldAdd(0, pivot, { axis: 0 }); // no `sourceName`
+    assert.equal(field.status.ok, false);
+    assert.equal(field.status.status, 7001);
+    assert.equal(wb.pivotFieldCount(0, pivot).value, fieldCountBefore, 'no field must have been added');
+
+    const dataFieldCountBefore = wb.pivotDataFieldCount(0, pivot).value;
+    const dataField = wb.pivotDataFieldAdd(0, pivot, { fieldIndex: 0, aggregation: 0 }); // no `name`
+    assert.equal(dataField.status.ok, false);
+    assert.equal(dataField.status.status, 7001);
+    assert.equal(wb.pivotDataFieldCount(0, pivot).value, dataFieldCountBefore, 'no data field must have been added');
+
+    const filterCountBefore = wb.pivotFilterCount(0, pivot).value;
+    const filter = wb.pivotFilterAdd(0, pivot, { axis: 0, type: 1, valueKind: 1, valueDouble: 15 }); // no `fieldName`
+    assert.equal(filter.ok, false);
+    assert.equal(filter.status, 7001);
+    assert.equal(wb.pivotFilterCount(0, pivot).value, filterCountBefore, 'no filter must have been added');
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/smoke_regressions.mjs b/packages/npm-native/test/smoke_regressions.mjs
new file mode 100644
index 000000000..38a08a903
--- /dev/null
+++ b/packages/npm-native/test/smoke_regressions.mjs
@@ -0,0 +1,434 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+test('a throwing iterative progress callback aborts the solve and reports a status', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    assert.ok(wb.setIterative(true, 100, 0.0001).ok);
+    assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
+    let calls = 0;
+    assert.ok(
+      wb.setIterativeProgress(() => {
+        calls += 1;
+        throw new Error('callback failure');
+      }).ok,
+    );
+
+    // Reported as a status rather than propagated, and with the same
+    // ordinal the WASM binding uses (`kBindingCallbackException`).
+    const aborted = wb.recalc();
+    assert.equal(aborted.ok, false, `expected a failure envelope: ${JSON.stringify(aborted)}`);
+    assert.equal(aborted.status, 7003);
+    // The engine reported success (it only saw a cancellation), so there
+    // is no thread-local diagnostic to read here -- this must be the
+    // binding's own message, matching the WASM package's, not the residue
+    // of an earlier call.
+    assert.equal(aborted.message, 'the iterative progress callback threw; the solve was aborted');
+    assert.equal(aborted.context, 'Workbook.setIterativeProgress');
+    assert.equal(calls, 1, 'the solve must stop at the first throw');
+
+    const mid = wb.getValue(0, 0, 0);
+    assert.ok(mid.status.ok, JSON.stringify(mid.status));
+
+    assert.ok(wb.setIterativeProgress(null).ok);
+    assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
+    const recovered = wb.recalc();
+    assert.ok(recovered.ok, `recalc after the throwing callback: ${JSON.stringify(recovered)}`);
+    const converged = wb.getValue(0, 0, 0);
+    assert.ok(Math.abs(converged.value.number - 10) < 0.001, `A1=${converged.value.number}`);
+  } finally {
+    wb.setIterativeProgress(null);
+    wb.dispose();
+  }
+});
+
+// `CfValueObjectInput.type`: 0 num, 1 percent, 2 percentile, 3 min,
+// 4 max, 5 formula, 6 autoMin, 7 autoMax. Every threshold below states a
+// `value`, which is what puts a borrowed string behind each CFVO.
+const COLOR_SCALE_RULE = Object.freeze({
+  sqref: [{ firstRow: 0, firstCol: 0, lastRow: 4, lastCol: 0 }],
+  type: 2,
+  colorScale: {
+    thresholds: [
+      { type: 0, value: '0' },
+      { type: 1, value: '50' },
+      { type: 0, value: '100' },
+    ],
+    colors: [
+      { r: 248, g: 105, b: 107, a: 255 },
+      { r: 255, g: 235, b: 132, a: 255 },
+      { r: 99, g: 190, b: 123, a: 255 },
+    ],
+  },
+});
+
+const DATA_BAR_RULE = Object.freeze({
+  sqref: [{ firstRow: 0, firstCol: 1, lastRow: 4, lastCol: 1 }],
+  type: 3,
+  dataBar: {
+    min: { type: 0, value: '5' },
+    max: { type: 0, value: '95' },
+    fill: { r: 0, g: 112, b: 192, a: 255 },
+  },
+});
+
+const ICON_SET_RULE = Object.freeze({
+  sqref: [{ firstRow: 0, firstCol: 2, lastRow: 4, lastCol: 2 }],
+  type: 4,
+  iconSet: {
+    name: 0,
+    thresholds: [
+      { type: 1, value: '0' },
+      { type: 1, value: '33' },
+      { type: 1, value: '67' },
+    ],
+  },
+});
+
+const EXPECTED_CFVO_VALUES = Object.freeze(['0', '50', '100', '5', '95', '0', '33', '67']);
+
+// The threshold value strings of the three visual rules, flattened.
+function cfvoValues(rules) {
+  const byType = new Map(rules.map((rule) => [rule.type, rule]));
+  const colorScale = byType.get(2);
+  const dataBar = byType.get(3);
+  const iconSet = byType.get(4);
+  assert.ok(colorScale?.colorScale, 'colorScale payload missing');
+  assert.ok(dataBar?.dataBar, 'dataBar payload missing');
+  assert.ok(iconSet?.iconSet, 'iconSet payload missing');
+  return [
+    ...colorScale.colorScale.thresholds.map((t) => t.value),
+    dataBar.dataBar.min.value,
+    dataBar.dataBar.max.value,
+    ...iconSet.iconSet.thresholds.map((t) => t.value),
+  ];
+}
+
+test('CFVO value strings survive getConditionalFormats and a save/load cycle', async () => {
+  // Each CFVO `value` crosses the C ABI as a borrowed `const char*`. A
+  // store that relocates while the later thresholds are pulled publishes
+  // a pointer into freed bytes, so the strings come back wrong or empty
+  // even though the rule count and colors still look right. Rules whose
+  // thresholds are all `min` / `max` never take that path, because those
+  // types carry no value string.
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  let bytes;
+  try {
+    for (const rule of [COLOR_SCALE_RULE, DATA_BAR_RULE, ICON_SET_RULE]) {
+      const added = wb.addConditionalFormat(0, rule);
+      assert.ok(added.status.ok, `addConditionalFormat type=${rule.type}: ${JSON.stringify(added.status)}`);
+    }
+
+    const inSession = wb.getConditionalFormats(0);
+    assert.ok(inSession.status.ok, JSON.stringify(inSession.status));
+    assert.equal(inSession.length, 3);
+    assert.deepEqual(cfvoValues(inSession), EXPECTED_CFVO_VALUES);
+    const byType = new Map(inSession.map((rule) => [rule.type, rule]));
+    // The type travels with the value: a percent threshold read back as
+    // type 0 would mean an absolute number instead.
+    assert.deepEqual(
+      byType.get(2).colorScale.thresholds.map((t) => t.type),
+      [0, 1, 0],
+    );
+    assert.deepEqual(
+      byType.get(4).iconSet.thresholds.map((t) => t.type),
+      [1, 1, 1],
+    );
+    assert.equal(byType.get(2).colorScale.colors.length, 3);
+    assert.equal(byType.get(2).colorScale.colors[2].g, 190);
+    assert.equal(byType.get(3).dataBar.fill.b, 192);
+
+    const saved = wb.save();
+    assert.ok(saved.status.ok, JSON.stringify(saved.status));
+    bytes = saved.bytes;
+  } finally {
+    wb.dispose();
+  }
+
+  const reloaded = mod.Workbook.loadBytes(bytes);
+  try {
+    const rules = reloaded.getConditionalFormats(0);
+    assert.equal(rules.length, 3);
+    assert.deepEqual(cfvoValues(rules), EXPECTED_CFVO_VALUES);
+  } finally {
+    reloaded.dispose();
+  }
+});
+
+test('getIterative reads back what setIterative stored', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const initial = wb.getIterative();
+    assert.ok(initial.status.ok, `getIterative: ${JSON.stringify(initial.status)}`);
+    assert.equal(typeof initial.enabled, 'boolean');
+    assert.equal(typeof initial.maxIterations, 'number');
+    assert.equal(typeof initial.maxChange, 'number');
+
+    assert.ok(wb.setIterative(true, 42, 0.25).ok);
+    const enabled = wb.getIterative();
+    assert.ok(enabled.status.ok);
+    assert.equal(enabled.enabled, true);
+    assert.equal(enabled.maxIterations, 42);
+    assert.equal(enabled.maxChange, 0.25);
+
+    // The cap and threshold survive switching iteration back off, which is
+    // what lets a host render the dialog with the stored values.
+    assert.ok(wb.setIterative(false, 42, 0.25).ok);
+    const disabled = wb.getIterative();
+    assert.ok(disabled.status.ok);
+    assert.equal(disabled.enabled, false);
+    assert.equal(disabled.maxIterations, 42);
+    assert.equal(disabled.maxChange, 0.25);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('addValidation defaults allowBlank to false', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    assert.ok(
+      wb.addValidation(0, {
+        ranges: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+        type: 3,
+        formula1: '"a,b"',
+      }).ok,
+    );
+    const list = wb.getValidations(0);
+    assert.equal(list.length, 1);
+    assert.equal(list[0].allowBlank, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('getCellStyleXf reports xfId alongside the cell-format fields', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const read = wb.getCellStyleXf(0);
+    assert.ok(read.status.ok, `getCellStyleXf: ${JSON.stringify(read.status)}`);
+    // A named-style xf is its own parent, so it never inherits one.
+    assert.equal(read.xfId, 0);
+    // The record shape matches `getCellXf`, which the documented
+    // read / edit / addCellStyleXf round-trip depends on.
+    const cellXf = wb.getCellXf(0);
+    assert.ok(cellXf.status.ok);
+    for (const key of Object.keys(cellXf)) {
+      assert.ok(key in read, `getCellStyleXf is missing '${key}'`);
+    }
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('pivotFieldAddItemAt hides the blank item an empty label cannot name', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const cache = wb.pivotCacheCreate(0);
+    assert.ok(cache.status.ok, `pivotCacheCreate: ${JSON.stringify(cache.status)}`);
+    const region = wb.pivotCacheFieldAdd(cache.index, 'Region');
+    assert.ok(region.status.ok);
+    const amount = wb.pivotCacheFieldAdd(cache.index, 'Amount');
+    assert.ok(amount.status.ok);
+    // Shared item 0 renders as "North"; shared item 1 is the blank, which
+    // carries no label of its own and can only be named by its index.
+    assert.ok(wb.pivotCacheFieldAddSharedItemText(cache.index, region.index, 'North').ok);
+    assert.ok(wb.pivotCacheFieldAddSharedItemBlank(cache.index, region.index).ok);
+
+    const first = wb.pivotCacheRecordAdd(cache.index);
+    assert.ok(first.status.ok);
+    assert.ok(wb.pivotCacheRecordSetNumber(cache.index, first.index, region.index, 0).ok);
+    assert.ok(wb.pivotCacheRecordSetNumber(cache.index, first.index, amount.index, 100).ok);
+    const second = wb.pivotCacheRecordAdd(cache.index);
+    assert.ok(second.status.ok);
+    assert.ok(wb.pivotCacheRecordSetBlank(cache.index, second.index, region.index).ok);
+    assert.ok(wb.pivotCacheRecordSetNumber(cache.index, second.index, amount.index, 200).ok);
+
+    const pivot = wb.pivotCreate(0, 'PT', cache.index, 0, 0);
+    assert.ok(pivot.status.ok, `pivotCreate: ${JSON.stringify(pivot.status)}`);
+    const regionField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Region', axis: 0 });
+    assert.ok(regionField.status.ok);
+    const amountField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Amount', axis: 2 });
+    assert.ok(amountField.status.ok);
+    assert.ok(wb.pivotSetRowFieldOrder(0, pivot.index, [regionField.index]).ok);
+    assert.ok(
+      wb.pivotDataFieldAdd(0, pivot.index, {
+        name: 'Sum of Amount',
+        fieldIndex: amountField.index,
+        aggregation: 0,
+      }).status.ok,
+    );
+
+    const sumDataCells = () => {
+      const layout = wb.pivotLayout(0, pivot.index);
+      assert.ok(layout.status.ok, `pivotLayout: ${JSON.stringify(layout.status)}`);
+      let total = 0;
+      for (const cell of layout.cells) {
+        if (cell.kind === mod.PivotCellKind.Data && cell.value.kind === mod.ValueKind.Number) {
+          total += cell.value.number;
+        }
+      }
+      return total;
+    };
+    assert.equal(sumDataCells(), 300);
+
+    assert.ok(wb.pivotFieldAddItem(0, pivot.index, regionField.index, 'North', true).ok);
+    assert.ok(wb.pivotFieldAddItemAt(0, pivot.index, regionField.index, 1, false).ok);
+    assert.equal(sumDataCells(), 100);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('a rejected argument reports its own diagnostic, not the previous call', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    // Leave a failure of a different call in the thread-local diagnostics.
+    const stale = wb.getValue(99, 0, 0);
+    assert.equal(stale.status.ok, false);
+    assert.ok(stale.status.message.length > 0);
+
+    // An argument the binding rejects before any C call carries its own
+    // message, and a code that names an argument fault rather than the
+    // destroyed-handle code.
+    const missingSpec = wb.pivotFieldAdd(0, 0);
+    assert.equal(missingSpec.status.ok, false);
+    assert.equal(missingSpec.status.status, 7001);
+    assert.match(missingSpec.status.message, /pivotFieldAdd/);
+    assert.notEqual(missingSpec.status.message, stale.status.message);
+    assert.equal(missingSpec.status.context, '');
+
+    const badCallback = wb.setIterativeProgress(42);
+    assert.equal(badCallback.ok, false);
+    assert.equal(badCallback.status, 7001);
+    assert.match(badCallback.message, /callback/);
+  } finally {
+    wb.setIterativeProgress(null);
+    wb.dispose();
+  }
+});
+
+test('a call on a disposed workbook names the destroyed handle', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  wb.dispose();
+  // 7000 is reserved for this: an argument fault reports 7001 instead, so
+  // "make a new workbook" stays the correct recovery for exactly this code.
+  const after = wb.recalc();
+  assert.equal(after.ok, false);
+  assert.equal(after.status, 7000);
+  assert.ok(after.message.length > 0, 'the destroyed-handle status must carry a message');
+});
+
+test('sheet-layout setters refuse coordinates and metrics Excel cannot open', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    // These six setters marshal straight to the C ABI, which is where the
+    // validation lives. The assertions below are what keeps that true: a
+    // binding that grew its own path to the model would still pass every
+    // round-trip test while quietly authoring a file Excel refuses, since
+    // NaN and Infinity serialise to an empty string -- `<col width=""/>`
+    // is not a lexical xsd:double at all, and a repair prompt rather than
+    // an out-of-range value.
+    const kInvalidArgument = 2;
+    // The message is pinned, not just the code. Both JS bindings route
+    // these calls to one set of C ABI helpers, so both report that shared
+    // wording; a binding that grew its own check would keep returning
+    // `kInvalidArgument` while the text stopped matching. The status code
+    // alone cannot tell a shared implementation from two that agree today.
+    const kSpanRefused = 'column span out of range';
+    const kRowRefused = 'row index out of range';
+    const kMetricRefused = 'value must be finite and non-negative';
+    // These six setters answer with a bare Status, not a `{status}`
+    // envelope, so the diagnostics are read off the returned object.
+    const refused = (status, expectedMessage, label) => {
+      assert.equal(status.ok, false, `${label} should have been refused`);
+      assert.equal(status.status, kInvalidArgument, `${label}: ${JSON.stringify(status)}`);
+      assert.equal(status.message, expectedMessage, `${label}: ${JSON.stringify(status)}`);
+    };
+
+    // One past Excel's last column / row.
+    refused(wb.setColumnWidth(0, 0, 16384, 10), kSpanRefused, 'setColumnWidth past the grid');
+    refused(wb.setColumnHidden(0, 0, 16384, true), kSpanRefused, 'setColumnHidden past the grid');
+    refused(wb.setColumnOutline(0, 0, 16384, 1), kSpanRefused, 'setColumnOutline past the grid');
+    refused(wb.setRowHeight(0, 1048576, 10), kRowRefused, 'setRowHeight past the grid');
+    refused(wb.setRowHidden(0, 1048576, true), kRowRefused, 'setRowHidden past the grid');
+    refused(wb.setRowOutline(0, 1048576, 1), kRowRefused, 'setRowOutline past the grid');
+
+    for (const bad of [Number.NaN, Number.POSITIVE_INFINITY, Number.NEGATIVE_INFINITY, -1]) {
+      refused(wb.setColumnWidth(0, 0, 2, bad), kMetricRefused, `setColumnWidth(${bad})`);
+      refused(wb.setRowHeight(0, 1, bad), kMetricRefused, `setRowHeight(${bad})`);
+    }
+
+    // The context names the C ABI entry point that refused the call and
+    // the values it saw, which is what makes a rejection actionable.
+    const span = wb.setColumnWidth(0, 0, 16384, 10);
+    assert.match(span.context, /fm_sheet_set_column_width: first=0 last=16384/);
+    const metric = wb.setRowHeight(0, 1, Number.NaN);
+    assert.match(metric.context, /fm_sheet_set_row_height: height=/);
+
+    // Zero is a real width and a real height, not a rejected one.
+    assert.ok(wb.setColumnWidth(0, 0, 2, 0).ok);
+    assert.ok(wb.setRowHeight(0, 1, 0).ok);
+
+    // The last coordinates Excel does address stay accepted -- an
+    // off-by-one in either bound would refuse them.
+    assert.ok(wb.setColumnWidth(0, 16383, 16383, 10).ok);
+    assert.ok(wb.setColumnHidden(0, 16383, 16383, true).ok);
+    assert.ok(wb.setColumnOutline(0, 16383, 16383, 1).ok);
+    assert.ok(wb.setRowHeight(0, 1048575, 10).ok);
+    assert.ok(wb.setRowHidden(0, 1048575, true).ok);
+    assert.ok(wb.setRowOutline(0, 1048575, 1).ok);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('setSheetVisibility states veryHidden, which the bool setter cannot', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const read = () => {
+      const r = wb.getSheetView(0);
+      assert.ok(r.status.ok, `getSheetView: ${JSON.stringify(r.status)}`);
+      return r.view;
+    };
+    assert.equal(read().visibility, mod.SheetVisibility.Visible);
+    assert.equal(read().tabHidden, 0);
+
+    assert.ok(wb.setSheetVisibility(0, mod.SheetVisibility.VeryHidden).ok);
+    // The two-state view stays consistent: a very-hidden sheet reads as
+    // hidden to a caller that knows only the bool, never as visible.
+    assert.equal(read().visibility, mod.SheetVisibility.VeryHidden);
+    assert.equal(read().tabHidden, 1);
+
+    // Asking for plain "hidden" must not weaken the stronger state.
+    assert.ok(wb.setSheetTabHidden(0, true).ok);
+    assert.equal(read().visibility, mod.SheetVisibility.VeryHidden);
+
+    // Demotion is the other direction the bool cannot express.
+    assert.ok(wb.setSheetVisibility(0, mod.SheetVisibility.Hidden).ok);
+    assert.equal(read().visibility, mod.SheetVisibility.Hidden);
+    assert.equal(read().tabHidden, 1);
+
+    // Showing the sheet clears either hidden state.
+    assert.ok(wb.setSheetTabHidden(0, false).ok);
+    assert.equal(read().visibility, mod.SheetVisibility.Visible);
+    assert.equal(read().tabHidden, 0);
+
+    // An unknown ordinal is refused and leaves the sheet alone.
+    assert.ok(wb.setSheetVisibility(0, mod.SheetVisibility.VeryHidden).ok);
+    assert.equal(wb.setSheetVisibility(0, 3).ok, false);
+    assert.equal(read().visibility, mod.SheetVisibility.VeryHidden);
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/smoke_result_contracts.mjs b/packages/npm-native/test/smoke_result_contracts.mjs
new file mode 100644
index 000000000..424a73fa0
--- /dev/null
+++ b/packages/npm-native/test/smoke_result_contracts.mjs
@@ -0,0 +1,168 @@
+import test from 'node:test';
+import { assert, getModule, path, pkgRoot, readFile } from './smoke_support.mjs';
+
+// ---- Result-envelope key sets ------------------------------------------
+//
+// A result type whose payload key is declared non-optional must carry that
+// key on every exit path, or `r.name.toUpperCase()` type-checks and then
+// throws at runtime for a caller who skipped the status check. The probe
+// table is checked for completeness against the declaration file, so a new
+// result type cannot be added without a failure-path probe. The WASM
+// package runs the mirror image of this test.
+
+function interfaceBody(dts, name) {
+  const m = dts.match(new RegExp(`^export interface ${name}\\b[^{]*\\{`, 'm'));
+  if (!m) return null;
+  let depth = 0;
+  const open = dts.indexOf('{', m.index);
+  for (let i = open; i < dts.length; i += 1) {
+    if (dts[i] === '{') depth += 1;
+    else if (dts[i] === '}') {
+      depth -= 1;
+      if (depth === 0) return dts.slice(open + 1, i);
+    }
+  }
+  return null;
+}
+
+function interfaceBases(dts, name) {
+  const m = dts.match(new RegExp(`^export interface ${name}\\b([^{]*)\\{`, 'm'));
+  if (!m) return [];
+  const clause = m[1].trim();
+  if (!clause.startsWith('extends')) return [];
+  return clause
+    .slice('extends'.length)
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+function interfaceMembers(dts, name, seen = new Set()) {
+  if (seen.has(name)) return [];
+  seen.add(name);
+  const body = interfaceBody(dts, name);
+  if (body === null) return [];
+  const out = [];
+  for (const base of interfaceBases(dts, name)) out.push(...interfaceMembers(dts, base, seen));
+  for (const m of body.matchAll(/^ {2}(?:readonly\s+)?([A-Za-z_$][\w$]*)(\??)\s*:/gm)) {
+    out.push([m[1], m[2] === '']);
+  }
+  return out;
+}
+
+function resultTypesWithRequiredPayload(dts) {
+  const out = new Map();
+  for (const m of dts.matchAll(/^export interface ([A-Za-z0-9_]+)/gm)) {
+    const name = m[1];
+    if (name === 'Status') continue;
+    const members = interfaceMembers(dts, name);
+    if (!members.some(([key]) => key === 'status')) continue;
+    const required = members.filter(([key, req]) => req && key !== 'status').map(([key]) => key);
+    if (required.length > 0) out.set(name, required);
+  }
+  return out;
+}
+
+// `fails: false` marks a call whose only failure path is a disposed
+// handle, which is not usable to probe.
+function envelopeProbes(wb) {
+  return [
+    ['ParallelRecalcResult', true, () => wb.recalcParallel(9)],
+    ['CellResult', true, () => wb.getValue(99, 0, 0)],
+    ['EvalResult', true, () => wb.evaluateFormulaText(99, 0, 0, '=1')],
+    ['EvalArrayResult', true, () => wb.evaluateFormulaArray(99, 0, 0, '=1')],
+    ['SaveResult', true, () => wb.saveAs(99)],
+    ['SaveDiagnosticsResult', true, () => wb.saveWithDiagnostics(99)],
+    ['ReadDiagnosticsResult', false, () => wb.readDiagnostics()],
+    ['StringResult', true, () => wb.sheetName(99)],
+    ['PivotLayoutResult', true, () => wb.pivotLayout(99, 0)],
+    ['PivotWorksheetSourceResult', true, () => wb.pivotCacheGetWorksheetSource(9999)],
+    ['PivotReportLayoutResult', true, () => wb.pivotGetLayout(99, 0)],
+    ['PivotFilterResult', true, () => wb.pivotFilterAt(99, 0, 0)],
+    ['CfRangeResult', true, () => wb.evaluateCfRange(99, 0, 0, 1, 1, Number.NaN)],
+    ['PaginationResult', true, () => wb.paginate(99)],
+    ['SheetViewResult', true, () => wb.getSheetView(99)],
+    ['SheetProtectionResult', true, () => wb.getSheetProtection(99)],
+    ['ColumnsResult', true, () => wb.getSheetColumns(99)],
+    ['RowsResult', true, () => wb.getSheetRowOverrides(99)],
+    ['CommentResult', true, () => wb.getCommentResult(99, 0, 0)],
+    ['CellXfIndexResult', true, () => wb.getCellXfIndex(99, 0, 0)],
+    ['CellXfResult', true, () => wb.getCellXf(9999)],
+    ['FontResult', true, () => wb.getFont(9999)],
+    ['FillResult', true, () => wb.getFill(9999)],
+    ['BorderResult', true, () => wb.getBorder(9999)],
+    ['NumFmtResult', true, () => wb.getNumFmt(59999)],
+    ['LambdaTextResult', true, () => wb.getLambdaText(99, 0, 0)],
+    ['PhoneticRunsResult', true, () => wb.getCellPhoneticRuns(99, 0, 0)],
+    ['PhoneticPropertiesResult', true, () => wb.getCellPhoneticProperties(99, 0, 0)],
+    ['CellStyleResult', true, () => wb.getCellStyle(9999)],
+    ['AddStyleResult', true, () => wb.addXf({ fontIndex: 9999 })],
+    ['AddNumFmtResult', false, () => wb.addNumFmt('0.00')],
+    ['IterativeSettingsResult', false, () => wb.getIterative()],
+    [
+      'PartialRecalcResult',
+      true,
+      () => wb.partialRecalc({ sheet: 99, firstRow: 0, lastRow: 1, firstCol: 0, lastCol: 1 }),
+    ],
+    ['SheetPrintXmlResult', true, () => wb.getSheetPageSetupXml(99)],
+    ['SheetPrintAreaResult', true, () => wb.getSheetPrintArea(99)],
+    ['SheetPrintTitlesResult', true, () => wb.getSheetPrintTitles(99)],
+    // `getSheetRowBreaks` / `getSheetColBreaks` answer an out-of-range
+    // sheet with an empty list rather than an error, unlike every sibling
+    // print getter, so no failure path is reachable from here.
+    ['SheetPageBreaksResult', false, () => wb.getSheetRowBreaks(99)],
+    ['SheetPageSetupResult', true, () => wb.getSheetPageSetup(99)],
+    ['SheetPageMarginsResult', true, () => wb.getSheetPageMargins(99)],
+    ['NumberResult', true, () => wb.cellCount(99)],
+    // A released handle is the only failure path, which is not usable here.
+    ['PinnedNowResult', false, () => wb.pinnedNow()],
+    ['SpillInfo', true, () => wb.spillInfo(99, 0, 0)],
+    ['SheetFormatDefaultsResult', true, () => wb.getSheetFormatDefaults(99)],
+    ['CellRectResult', true, () => wb.getCellRectPt(99, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }, 0)],
+    ['WidthModelResult', true, () => wb.getWidthModel(99, 0)],
+    ['FormulaResult', true, () => wb.getFormula(99, 0, 0)],
+    ['CellsInRangeResult', true, () => wb.getCellsInRange(99, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 })],
+    ['DisplayTextResult', true, () => wb.getDisplayText(99, 0, 0)],
+    // A released handle is the only failure path of `getTheme`.
+    ['ThemeResult', false, () => wb.getTheme()],
+    ['ResolvedColorResult', true, () => wb.resolveColor({ kind: 0 }, 99)],
+    ['EffectiveStyleResult', true, () => wb.getEffectiveStyle(99, 0, 0)],
+    ['AutoFilterResult', true, () => wb.getAutoFilter(99)],
+    ['AutoFilterEvalResult', true, () => wb.evaluateAutoFilter(99)],
+    ['ThreadedCommentsResult', true, () => wb.getThreadedComments(99)],
+    ['PersonsResult', false, () => wb.getPersons()],
+    ['ImageInfoResult', true, () => wb.probeImage(new Uint8Array(0))],
+    ['ImageResult', true, () => wb.getImage(99, 1)],
+    ['InsertImageResult', true, () => wb.insertImage(99, new Uint8Array(0), {})],
+    ['ValidationOutcomeResult', true, () => wb.validateValue(99, 0, 0, { kind: 1, number: 1 })],
+  ];
+}
+
+test('every declared result type is probed for its key set', async () => {
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
+  const declared = resultTypesWithRequiredPayload(dts);
+  const probed = new Set(envelopeProbes({}).map(([name]) => name));
+  const unprobed = [...declared.keys()].filter((name) => !probed.has(name));
+  assert.deepEqual(unprobed, [], 'result types with no failure-path probe');
+  const stale = [...probed].filter((name) => !declared.has(name));
+  assert.deepEqual(stale, [], 'probes for result types that no longer declare a required payload');
+});
+
+test('result envelopes keep their declared keys on failure paths', async () => {
+  const mod = await getModule();
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
+  const declared = resultTypesWithRequiredPayload(dts);
+  const wb = mod.Workbook.createDefault();
+  try {
+    for (const [typeName, expectFailure, call] of envelopeProbes(wb)) {
+      const r = call();
+      if (expectFailure) {
+        assert.equal(r.status.ok, false, `${typeName}: probe was expected to fail`);
+      }
+      const missing = declared.get(typeName).filter((key) => !(key in r));
+      assert.deepEqual(missing, [], `${typeName} dropped declared keys`);
+    }
+  } finally {
+    wb.dispose();
+  }
+});
diff --git a/packages/npm-native/test/smoke_support.mjs b/packages/npm-native/test/smoke_support.mjs
new file mode 100644
index 000000000..4c9980ddc
--- /dev/null
+++ b/packages/npm-native/test/smoke_support.mjs
@@ -0,0 +1,102 @@
+// Shared staged-module loader and ZIP helper for the native smoke-test topics.
+
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const pkgRoot = path.resolve(__dirname, '..');
+const pkgJsonPath = path.join(pkgRoot, 'package.json');
+
+// Resolve the staged entry point through the package's own package.json
+// "main" field. Fails (rather than skips) if the package isn't staged --
+// that's the whole point of running these tests against dist/.
+async function loadStagedModule() {
+  const raw = await readFile(pkgJsonPath, 'utf8');
+  const pkg = JSON.parse(raw);
+  const main = pkg.main;
+  if (!main) {
+    throw new Error(`package.json is missing "main": ${pkgJsonPath}`);
+  }
+  const mainPath = path.resolve(pkgRoot, main);
+  // Node ESM requires file:// URLs for absolute paths on Windows;
+  // pathToFileURL is the portable form.
+  return import(pathToFileURL(mainPath).href);
+}
+
+let modPromise;
+function getModule() {
+  if (!modPromise) {
+    modPromise = loadStagedModule();
+  }
+  return modPromise;
+}
+
+function appendEmptyZipEntry(bytes, name) {
+  const input = new Uint8Array(bytes);
+  const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+  let eocd = input.length - 22;
+  while (eocd >= 0 && view.getUint32(eocd, true) !== 0x06054b50) eocd -= 1;
+  assert.ok(eocd >= 0, 'missing ZIP end record');
+  const count = view.getUint16(eocd + 10, true);
+  const centralSize = view.getUint32(eocd + 12, true);
+  const centralOffset = view.getUint32(eocd + 16, true);
+  const encodedName = new TextEncoder().encode(name);
+  const u16 = (out, n) => out.push(n & 0xff, (n >>> 8) & 0xff);
+  const u32 = (out, n) => out.push(n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
+  const bytesTo = (out, source) => {
+    source.forEach((b) => {
+      out.push(b);
+    });
+  };
+  const local = [];
+  u32(local, 0x04034b50);
+  u16(local, 20);
+  u16(local, 0);
+  u16(local, 0);
+  u16(local, 0);
+  u16(local, 0);
+  u32(local, 0);
+  u32(local, 0);
+  u32(local, 0);
+  u16(local, encodedName.length);
+  u16(local, 0);
+  bytesTo(local, encodedName);
+  const central = [];
+  u32(central, 0x02014b50);
+  u16(central, 20);
+  u16(central, 20);
+  u16(central, 0);
+  u16(central, 0);
+  u16(central, 0);
+  u16(central, 0);
+  u32(central, 0);
+  u32(central, 0);
+  u32(central, 0);
+  u16(central, encodedName.length);
+  u16(central, 0);
+  u16(central, 0);
+  u16(central, 0);
+  u16(central, 0);
+  u32(central, 0);
+  u32(central, centralOffset);
+  bytesTo(central, encodedName);
+  const out = [];
+  bytesTo(out, input.slice(0, centralOffset));
+  bytesTo(out, local);
+  bytesTo(out, input.slice(centralOffset, centralOffset + centralSize));
+  bytesTo(out, central);
+  u32(out, 0x06054b50);
+  u16(out, 0);
+  u16(out, 0);
+  u16(out, count + 1);
+  u16(out, count + 1);
+  u32(out, centralSize + central.length);
+  u32(out, centralOffset + local.length);
+  u16(out, 0);
+  return Uint8Array.from(out);
+}
+
+export { appendEmptyZipEntry, assert, getModule, loadStagedModule, path, pkgRoot, readFile };
diff --git a/packages/npm-native/test/smoke_surface_log_eval_print.mjs b/packages/npm-native/test/smoke_surface_log_eval_print.mjs
new file mode 100644
index 000000000..3ded61049
--- /dev/null
+++ b/packages/npm-native/test/smoke_surface_log_eval_print.mjs
@@ -0,0 +1,492 @@
+import test from 'node:test';
+import { assert, getModule, path, pkgRoot, readFile } from './smoke_support.mjs';
+
+test('default export exposes Workbook + evalFormula + version', async () => {
+  const mod = await getModule();
+  assert.equal(typeof mod.Workbook, 'function');
+  assert.equal(typeof mod.evalFormula, 'function');
+  assert.equal(typeof mod.version, 'function');
+  assert.equal(typeof mod.statusString, 'function');
+  assert.equal(typeof mod.ValueKind, 'object');
+  assert.equal(typeof mod.PivotCellKind, 'object');
+});
+
+test('all declared runtime constants resolve from the staged ESM entry point', async () => {
+  const mod = await getModule();
+  const declarations = await readFile(path.join(pkgRoot, 'index.d.ts'), 'utf8');
+  const names = [...declarations.matchAll(/^export const (\w+)/gm)].map((match) => match[1]);
+  assert.ok(names.length > 0, 'expected runtime constant declarations');
+  for (const name of names) {
+    assert.ok(name in mod, `missing runtime export declared in index.d.ts: ${name}`);
+  }
+  assert.equal(mod.PivotAxis.Row, 0);
+  assert.equal(mod.PIVOT_SHOW_AS_BASE_PREVIOUS, 1048828);
+  // Named constants a consumer needs in order to interpret shared record
+  // fields (`Value.errorCode`, `ExternalLinkRecord.kind`) or to drive the
+  // calc policy. The WASM package exports the same names and ordinals;
+  // `check_binding_drift dts-enums` holds the two in step.
+  assert.equal(mod.ErrorCode.Div0, 1);
+  assert.equal(mod.ErrorCode.Unknown, 16);
+  assert.equal(mod.CalcMode.Manual, 1);
+  assert.equal(mod.ExternalLinkKind.Dde, 3);
+  for (const name of ['ErrorCode', 'CalcMode', 'ExternalLinkKind']) {
+    assert.ok(Object.isFrozen(mod[name]), `${name} must be frozen`);
+  }
+});
+
+test('default export type and runtime default export declare the same keys', async () => {
+  const mod = await getModule();
+  const declarations = await readFile(path.join(pkgRoot, 'index.d.ts'), 'utf8');
+  const typeBlock = declarations.match(/declare const _default: \{([\s\S]*?)\n\};/);
+  assert.ok(typeBlock, 'expected a `declare const _default: {...}` block in index.d.ts');
+  const declared = new Set([...typeBlock[1].matchAll(/^\s{2}(\w+):/gm)].map((match) => match[1]));
+  const runtime = new Set(Object.keys(mod.default));
+  const missingFromType = [...runtime].filter((key) => !declared.has(key));
+  const missingFromRuntime = [...declared].filter((key) => !runtime.has(key));
+  assert.deepEqual(missingFromType, [], 'runtime default export keys absent from the _default type');
+  assert.deepEqual(missingFromRuntime, [], '_default type keys absent from the runtime default export');
+  assert.equal(mod.default.PivotAxis.Row, 0);
+  assert.equal(typeof mod.default.errorDisplayName, 'function');
+});
+
+test('every named export is reachable through the default export', async () => {
+  const mod = await getModule();
+  const named = Object.keys(mod).filter((key) => key !== 'default');
+  const missing = named.filter((key) => !(key in mod.default));
+  assert.deepEqual(missing, [], 'named exports absent from the default export object');
+});
+
+test('setLogMinLevel is a module-level control and validates its ordinal', async () => {
+  const mod = await getModule();
+  assert.equal(typeof mod.setLogMinLevel, 'function');
+  assert.equal(typeof mod.setLogSink, 'function');
+  // Process-wide state, so it must not be a Workbook method.
+  const wb = mod.Workbook.createDefault();
+  assert.equal(typeof wb.setLogMinLevel, 'undefined');
+  wb.dispose();
+
+  for (const level of Object.values(mod.LogLevel)) {
+    assert.ok(mod.setLogMinLevel(level).ok, `level=${level}`);
+  }
+  for (const bad of [-1, 5, 99]) {
+    const r = mod.setLogMinLevel(bad);
+    assert.equal(r.ok, false, `level=${bad} should be rejected`);
+    assert.equal(r.status, 2);
+  }
+  assert.ok(mod.setLogMinLevel(mod.LogLevel.Off).ok);
+});
+
+test('setLogSink accepts a function and null, and rejects a non-function', async () => {
+  const mod = await getModule();
+  assert.ok(mod.setLogSink(() => {}).ok);
+  assert.ok(mod.setLogSink(null).ok);
+  assert.ok(mod.setLogSink().ok);
+  const bad = mod.setLogSink(42);
+  assert.equal(bad.ok, false);
+  assert.equal(bad.status, 7001);
+  assert.ok(mod.setLogSink(null).ok);
+});
+
+// Sink delivery goes through a thread-safe function, so records land on a
+// later turn of the libuv loop rather than inside the native call. Poll
+// with a bounded budget instead of guessing a single turn.
+const SINK_SETTLE_MS = 500;
+
+async function waitForRecords(records, wanted) {
+  const deadline = Date.now() + SINK_SETTLE_MS;
+  while (records.length < wanted && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 5));
+  }
+  return records;
+}
+
+test('a registered sink receives the record as raw bytes', async () => {
+  const mod = await getModule();
+  const records = [];
+  assert.ok(mod.setLogSink((record) => records.push(record)).ok);
+  assert.ok(mod.setLogMinLevel(mod.LogLevel.Warn).ok);
+  try {
+    const wb = mod.Workbook.createDefault();
+    // A structured reference the XLSB encoder cannot lower,
+    // which makes the writer emit a per-cell warn record.
+    assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
+    assert.ok(wb.recalc().ok);
+    assert.ok(wb.saveAs(mod.WorkbookFormat.Xlsb).status.ok);
+    wb.dispose();
+    await waitForRecords(records, 1);
+    assert.ok(records.length > 0, 'expected at least one record');
+    for (const record of records) {
+      assert.ok(ArrayBuffer.isView(record), 'record must be a byte view');
+    }
+    const text = records.map((r) => new TextDecoder().decode(r)).join('');
+    assert.match(text, /xlsb\.writer\.formula_downgraded/);
+    assert.match(text, /"level":"warn"/);
+  } finally {
+    assert.ok(mod.setLogMinLevel(mod.LogLevel.Off).ok);
+    assert.ok(mod.setLogSink(null).ok);
+  }
+});
+
+test('the default threshold delivers nothing to a registered sink', async () => {
+  const mod = await getModule();
+  const records = [];
+  assert.ok(mod.setLogSink((record) => records.push(record)).ok);
+  try {
+    const wb = mod.Workbook.createDefault();
+    assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
+    assert.ok(wb.recalc().ok);
+    assert.ok(wb.saveAs(mod.WorkbookFormat.Xlsb).status.ok);
+    wb.dispose();
+    // Wait the same budget the positive case needs, so silence here is a
+    // result rather than an artefact of not having waited long enough.
+    await new Promise((resolve) => setTimeout(resolve, SINK_SETTLE_MS));
+    assert.deepEqual(records, []);
+  } finally {
+    assert.ok(mod.setLogSink(null).ok);
+  }
+});
+
+test('a throwing log sink does not leave a pending exception at the ThreadSafeFunction boundary', async () => {
+  const mod = await getModule();
+  let calls = 0;
+  assert.ok(
+    mod.setLogSink(() => {
+      calls += 1;
+      throw new Error('sink failure');
+    }).ok,
+  );
+  assert.ok(mod.setLogMinLevel(mod.LogLevel.Warn).ok);
+  try {
+    const wb = mod.Workbook.createDefault();
+    assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
+    assert.ok(wb.recalc().ok);
+    assert.ok(wb.saveAs(mod.WorkbookFormat.Xlsb).status.ok);
+    wb.dispose();
+    // Wait for the ThreadSafeFunction drain to run the sink.
+    await new Promise((resolve) => setTimeout(resolve, SINK_SETTLE_MS));
+    assert.ok(calls > 0, 'expected the sink to have been invoked');
+  } finally {
+    assert.ok(mod.setLogMinLevel(mod.LogLevel.Off).ok);
+    assert.ok(mod.setLogSink(null).ok);
+  }
+
+  // An uncaught exception at the drain boundary would have crashed the
+  // process by now; the engine must still be usable afterwards.
+  const wb2 = mod.Workbook.createDefault();
+  try {
+    assert.ok(wb2.setFormula(0, 0, 0, '=1+1').ok);
+    assert.ok(wb2.recalc().ok);
+    assert.equal(wb2.getValue(0, 0, 0).value.number, 2);
+  } finally {
+    wb2.dispose();
+  }
+});
+
+test('memoryUsage and the Python wheel agree that the estimate grows', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const empty = wb.memoryUsage();
+  for (let row = 0; row < 2000; row += 1) {
+    wb.setNumber(0, row, 0, row);
+  }
+  assert.ok(wb.memoryUsage() > empty);
+  wb.dispose();
+});
+
+// Parses the staged `export const X: Readonly<{ A: 0; ... }>` declarations
+// into {name: {member: ordinal}}. Name presence alone is not enough: a
+// staged bundle carrying a stale ordinal ships a constant that silently
+// means something else, and nothing upstream of dist/ can see that.
+function declaredOrdinalTables(dts) {
+  const tables = {};
+  const blocks = dts.matchAll(/^export const (\w+): Readonly<\{([^}]*)\}>;/gm);
+  for (const [, name, body] of blocks) {
+    const members = {};
+    for (const [, member, value] of body.matchAll(/(\w+):\s*(-?\d+)/g)) {
+      members[member] = Number(value);
+    }
+    tables[name] = members;
+  }
+  return tables;
+}
+
+test('staged constant tables carry the ordinals the staged .d.ts declares', async () => {
+  const mod = await getModule();
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'index.d.ts'), 'utf8');
+  const tables = declaredOrdinalTables(dts);
+  assert.ok(Object.keys(tables).length > 0, 'expected declared ordinal tables');
+  for (const [name, members] of Object.entries(tables)) {
+    const runtime = mod[name];
+    assert.ok(runtime, `missing runtime table ${name}`);
+    assert.deepEqual({ ...runtime }, members, `${name} ordinals differ from dist/index.d.ts`);
+    assert.ok(Object.isFrozen(runtime), `${name} must be frozen`);
+  }
+});
+
+test('version() returns a non-empty string', async () => {
+  const mod = await getModule();
+  const v = mod.version();
+  assert.equal(typeof v, 'string');
+  assert.ok(v.length > 0, `expected non-empty version, got ${JSON.stringify(v)}`);
+});
+
+test('errorDisplayName returns Excel literals', async () => {
+  const mod = await getModule();
+  assert.equal(mod.errorDisplayName(1), '#DIV/0!');
+  assert.equal(mod.errorDisplayName(999), '#UNKNOWN!');
+});
+
+// One-shot evaluation is anchored at Sheet1!A1 and read-only on every
+// shipped surface, so these must agree value-for-value with the WASM
+// package and the Python wheel. The anchor-referencing cases are the ones
+// that diverge if a surface writes the formula into A1 and recalcs.
+const ONE_SHOT_CASES = [
+  { formula: '=1+2', kind: 1, number: 3 },
+  { formula: '=A1', kind: 1, number: 0 },
+  { formula: '=COUNTA(A1)', kind: 1, number: 0 },
+  { formula: '=ISBLANK(A1)', kind: 2, boolean: 1 },
+  { formula: '=SUM(A1:A3)', kind: 1, number: 0 },
+  { formula: '=SEQUENCE(3)', kind: 1, number: 1 },
+  { formula: '=ROWS(SEQUENCE(3))', kind: 1, number: 3 },
+];
+test('evalFormula evaluates read-only against a blank anchor', async () => {
+  const mod = await getModule();
+  for (const spec of ONE_SHOT_CASES) {
+    const r = mod.evalFormula(spec.formula);
+    assert.ok(r.status.ok, `${spec.formula}: ${JSON.stringify(r.status)}`);
+    assert.equal(r.value.kind, spec.kind, spec.formula);
+    if (spec.number !== undefined) {
+      assert.equal(r.value.number, spec.number, spec.formula);
+    }
+    if (spec.boolean !== undefined) {
+      assert.equal(r.value.boolean, spec.boolean, spec.formula);
+    }
+    // Writing into the anchor and recalcing would make these #REF!.
+    assert.equal(r.value.errorCode, 0, spec.formula);
+  }
+});
+
+test("evalFormula('=1+2') returns NUMBER 3", async () => {
+  const mod = await getModule();
+  const r = mod.evalFormula('=1+2');
+  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+  assert.equal(r.value.kind, mod.ValueKind.Number);
+  assert.equal(r.value.number, 3);
+});
+
+test("evalFormula('=#REF!') surfaces ERROR value (not failed status)", async () => {
+  const mod = await getModule();
+  const r = mod.evalFormula('=#REF!');
+  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+  assert.equal(r.value.kind, mod.ValueKind.Error);
+});
+
+test('Workbook.createDefault + setNumber + getValue round-trip', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.equal(wb.sheetCount().value, 1);
+  const setRc = wb.setNumber(0, 0, 0, 42);
+  assert.ok(setRc.ok, `setNumber: ${JSON.stringify(setRc)}`);
+  const r = wb.getValue(0, 0, 0);
+  assert.ok(r.status.ok, `getValue: ${JSON.stringify(r.status)}`);
+  assert.equal(r.value.kind, mod.ValueKind.Number);
+  assert.equal(r.value.number, 42);
+});
+
+test('paginate exposes a status envelope and page geometry', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // Asserts the envelope's shape, not the page geometry: how many rows fit a
+  // page is the print engine's business and is pinned by the native print
+  // suite against Excel. Row 400 is far enough down to force a break under
+  // any plausible body height.
+  assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+  assert.ok(wb.setNumber(0, 400, 0, 2).ok);
+  const result = wb.paginate(0);
+  assert.ok(result.status.ok, `paginate: ${JSON.stringify(result.status)}`);
+  assert.ok(result.pageCount >= 2, `pageCount: ${result.pageCount}`);
+  assert.deepEqual(result.printArea, []);
+  assert.ok(result.horizontalBreaks.length > 0);
+  assert.deepEqual(
+    result.horizontalBreaks,
+    [...new Set(result.horizontalBreaks)].sort((a, b) => a - b),
+  );
+  assert.deepEqual(result.verticalBreaks, []);
+});
+
+test('print settings: raw XML round-trips and rejects malformed fragments', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  // An absent element reads back as the empty string, never null.
+  assert.equal(wb.getSheetPageSetupXml(0).xml, '');
+
+  const fragment = '<pageSetup paperSize="9" orientation="portrait" scale="85"/>';
+  assert.ok(wb.setSheetPageSetupXml(0, fragment).ok);
+  assert.equal(wb.getSheetPageSetupXml(0).xml, fragment);
+
+  // Two top-level elements, the wrong root name, and a truncated fragment
+  // are all rejected at set time rather than producing a file Excel repairs.
+  for (const bad of ['<pageSetup/><pageSetup/>', '<pageMargins left="1"/>', '<pageSetup orientation="portrait"']) {
+    const rejected = wb.setSheetPageSetupXml(0, bad);
+    assert.equal(rejected.ok, false, `expected rejection for ${bad}`);
+  }
+  assert.equal(wb.getSheetPageSetupXml(0).xml, fragment);
+
+  // The empty string removes the element and restores the defaults.
+  assert.ok(wb.setSheetPageSetupXml(0, '').ok);
+  assert.equal(wb.getSheetPageSetupXml(0).xml, '');
+  const cleared = wb.getSheetPageSetup(0);
+  assert.ok(cleared.status.ok);
+  assert.equal(cleared.scale, 100);
+  assert.equal(cleared.scaleStated, false);
+});
+
+test('print settings: typed patch touches only the keys it states', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(
+    wb.setSheetPageSetupXml(0, '<pageSetup paperSize="9" orientation="portrait" horizontalDpi="600" copies="3"/>').ok,
+  );
+  assert.ok(wb.setSheetPageSetup(0, { orientation: 2 }).ok);
+
+  const xml = wb.getSheetPageSetupXml(0).xml;
+  assert.match(xml, /orientation="landscape"/);
+  // Attributes the engine does not model must survive a patch.
+  assert.match(xml, /horizontalDpi="600"/);
+  assert.match(xml, /copies="3"/);
+  assert.match(xml, /paperSize="9"/);
+
+  const read = wb.getSheetPageSetup(0);
+  assert.ok(read.status.ok);
+  assert.equal(read.orientation, 2);
+  assert.equal(read.paperSize, 9);
+  assert.equal(read.orientationStated, true);
+
+  assert.ok(wb.setSheetPageMargins(0, { left: 0.25, top: 1.5 }).ok);
+  const margins = wb.getSheetPageMargins(0);
+  assert.ok(margins.status.ok);
+  assert.equal(margins.left, 0.25);
+  assert.equal(margins.leftStated, true);
+  // An unstated margin reports the OOXML default with its flag clear.
+  assert.equal(margins.right, 0.7);
+  assert.equal(margins.rightStated, false);
+});
+
+test('print settings: fitToPage keeps the rest of sheetPr', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setSheetSheetPrXml(0, '<sheetPr codeName="Sheet1"><tabColor rgb="FFFF0000"/></sheetPr>').ok);
+  assert.ok(wb.setSheetFitToPage(0, true).ok);
+  const xml = wb.getSheetSheetPrXml(0).xml;
+  assert.match(xml, /codeName="Sheet1"/);
+  assert.match(xml, /<tabColor rgb="FFFF0000"\/>/);
+  assert.match(xml, /fitToPage="true"/);
+});
+
+test('print settings: header/footer sections take decoded text', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setSheetHeaderFooter(0, { oddHeader: '&C\u5e33\u7968', oddFooter: '&R&P / &N' }).ok);
+  // The codes reach the file escaped; a parser hands back `&C...`.
+  assert.equal(
+    wb.getSheetHeaderFooterXml(0).xml,
+    '<headerFooter><oddHeader>&amp;C\u5e33\u7968</oddHeader><oddFooter>&amp;R&amp;P / &amp;N</oddFooter></headerFooter>',
+  );
+
+  // Omitting a key leaves that section alone; an empty string clears it.
+  assert.ok(wb.setSheetHeaderFooter(0, { oddFooter: '' }).ok);
+  assert.equal(
+    wb.getSheetHeaderFooterXml(0).xml,
+    '<headerFooter><oddHeader>&amp;C\u5e33\u7968</oddHeader></headerFooter>',
+  );
+});
+
+test('print settings: print area, titles and manual breaks', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.ok(wb.setSheetPrintArea(0, 'A1:F8').ok);
+  assert.equal(wb.getSheetPrintArea(0).ranges, 'A1:F8');
+  assert.equal(wb.setSheetPrintArea(0, 'not-a-range').ok, false);
+  assert.equal(wb.getSheetPrintArea(0).ranges, 'A1:F8');
+  assert.ok(wb.setSheetPrintArea(0, '').ok);
+  assert.equal(wb.getSheetPrintArea(0).ranges, '');
+
+  assert.ok(wb.setSheetPrintTitles(0, '1:2', 'A:A').ok);
+  const titles = wb.getSheetPrintTitles(0);
+  assert.equal(titles.repeatRows, '1:2');
+  assert.equal(titles.repeatCols, 'A:A');
+
+  assert.ok(wb.addSheetRowBreak(0, 40, true).ok);
+  assert.ok(wb.addSheetRowBreak(0, 10, true).ok);
+  const breaks = wb.getSheetRowBreaks(0);
+  assert.ok(breaks.status.ok);
+  // Kept sorted by index regardless of insertion order.
+  assert.deepEqual(
+    breaks.breaks.map((b) => b.id),
+    [10, 40],
+  );
+  assert.equal(breaks.breaks[0].max, 16383);
+  assert.equal(breaks.breaks[0].manual, true);
+
+  assert.ok(wb.removeSheetRowBreak(0, 10).ok);
+  assert.equal(wb.getSheetRowBreaks(0).breaks.length, 1);
+  assert.ok(wb.clearSheetBreaks(0).ok);
+  assert.equal(wb.getSheetRowBreaks(0).breaks.length, 0);
+});
+
+test('print settings: a change is visible to paginate without a save cycle', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  for (let row = 0; row < 200; row += 1) {
+    for (let col = 0; col < 20; col += 1) {
+      assert.ok(wb.setNumber(0, row, col, 1).ok);
+    }
+  }
+  const portrait = wb.paginate(0).pageCount;
+  assert.ok(wb.setSheetPageSetup(0, { orientation: 2 }).ok);
+  assert.notEqual(wb.paginate(0).pageCount, portrait);
+});
+
+test('setRangeXfIndex applies one xf across a rectangle', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  const border = wb.addBorder({
+    left: { style: 1, colorArgb: 0xff000000 },
+    right: { style: 1, colorArgb: 0xff000000 },
+    top: { style: 1, colorArgb: 0xff000000 },
+    bottom: { style: 1, colorArgb: 0xff000000 },
+    diagonal: { style: 0, colorArgb: 0 },
+    diagonalUp: false,
+    diagonalDown: false,
+  });
+  assert.ok(border.status.ok);
+  const xf = wb.addXf({ fontIndex: 0, fillIndex: 0, borderIndex: border.index, numFmtId: 0 });
+  assert.ok(xf.status.ok);
+
+  assert.ok(wb.setRangeXfIndex(0, 0, 0, 2, 2, xf.index).ok);
+  // Every cell in the rectangle is materialised, including ones that held
+  // no value, so the box renders.
+  for (const [row, col] of [
+    [0, 0],
+    [1, 1],
+    [2, 2],
+  ]) {
+    assert.equal(wb.getCellXfIndex(0, row, col).xfIndex, xf.index);
+  }
+  assert.equal(wb.getCellXfIndex(0, 3, 3).xfIndex, 0);
+});
+
+test('pivotCount + pivotLayout expose PivotTable projection status', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  assert.equal(wb.pivotCount(0).value, 0);
+
+  const missing = wb.pivotLayout(0, 0);
+  assert.equal(missing.status.ok, false);
+  assert.notEqual(missing.status.status, 0);
+  assert.equal(missing.top, 0);
+  assert.equal(missing.left, 0);
+  assert.equal(missing.rows, 0);
+  assert.equal(missing.cols, 0);
+  assert.deepEqual(missing.cells, []);
+});
diff --git a/packages/npm-native/test/smoke_theme_styles.mjs b/packages/npm-native/test/smoke_theme_styles.mjs
new file mode 100644
index 000000000..0997c6bfc
--- /dev/null
+++ b/packages/npm-native/test/smoke_theme_styles.mjs
@@ -0,0 +1,165 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+const DEFAULT_ACCENT1 = 0xff4472c4;
+
+test('getTheme reads the default theme of a fresh workbook', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const theme = wb.getTheme();
+    assert.ok(theme.status.ok, JSON.stringify(theme.status));
+    assert.ok([0, 1].includes(theme.source), `source ${theme.source}`);
+    assert.equal(theme.colors.length, 12);
+    assert.equal(typeof theme.fonts.majorLatin, 'string');
+    assert.equal(typeof theme.fonts.minorEastAsian, 'string');
+    assert.ok(theme.fonts.minorLatin.length > 0);
+    assert.equal(theme.colors[4] >>> 0, DEFAULT_ACCENT1 >>> 0);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('setThemeColors and setThemeFonts round-trip through getTheme', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const colors = Array.from({ length: 12 }, (_, i) => (0xff000000 | (0x112233 + i * 0x010101)) >>> 0);
+    assert.ok(wb.setThemeColors(colors).ok);
+    assert.ok(
+      wb.setThemeFonts({
+        majorLatin: 'Aptos Display',
+        majorEastAsian: 'Yu Gothic',
+        minorLatin: 'Aptos',
+        minorEastAsian: 'Yu Mincho',
+      }).ok,
+    );
+    const theme = wb.getTheme();
+    assert.ok(theme.status.ok);
+    assert.equal(theme.source, 0);
+    assert.deepEqual(theme.colors, colors);
+    assert.equal(theme.fonts.majorLatin, 'Aptos Display');
+    assert.equal(theme.fonts.majorEastAsian, 'Yu Gothic');
+    assert.equal(theme.fonts.minorLatin, 'Aptos');
+    assert.equal(theme.fonts.minorEastAsian, 'Yu Mincho');
+
+    const bad = wb.setThemeColors([1, 2, 3]);
+    assert.equal(bad.ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('resolveColor resolves literal, theme and automatic colours by context', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const rgb = wb.resolveColor({ kind: 1, rgb: 0xff112233 }, mod.ColorContext.Font);
+    assert.ok(rgb.status.ok);
+    assert.equal(rgb.argb >>> 0, 0xff112233);
+    assert.equal(rgb.resolution, mod.ColorResolution.Exact);
+
+    const theme = wb.resolveColor({ kind: 2, theme: 4, tint: 0 }, mod.ColorContext.FillForeground);
+    assert.ok(theme.status.ok);
+    assert.ok([mod.ColorResolution.Exact, mod.ColorResolution.DefaultTheme].includes(theme.resolution));
+
+    const fontAuto = wb.resolveColor({ kind: 4 }, mod.ColorContext.Font);
+    assert.equal(fontAuto.argb >>> 0, 0xff000000);
+    assert.equal(fontAuto.resolution, mod.ColorResolution.AutoContext);
+    const fillAuto = wb.resolveColor({ kind: 4 }, mod.ColorContext.FillBackground);
+    assert.equal(fillAuto.argb >>> 0, 0xffffffff);
+
+    const bad = wb.resolveColor({ kind: 1, rgb: 1 }, 99);
+    assert.equal(bad.status.ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('getEffectiveStyle reports the cell xf with resolved colours', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const font = wb.addFont({ name: 'Arial', size: 11, colorArgb: 0xffff0000 });
+    assert.ok(font.status.ok);
+    const xf = wb.addXf({ fontIndex: font.index, fillIndex: 0, borderIndex: 0, numFmtId: 0, applyFont: true });
+    assert.ok(xf.status.ok);
+    assert.ok(wb.setCellXfIndex(0, 2, 3, xf.index).ok);
+
+    const eff = wb.getEffectiveStyle(0, 2, 3);
+    assert.ok(eff.status.ok, JSON.stringify(eff.status));
+    assert.equal(eff.xfIndex, xf.index);
+    assert.equal(eff.source, 0);
+    assert.equal(eff.fontIndex, font.index);
+    assert.equal(eff.font.argb >>> 0, 0xffff0000);
+    assert.equal(typeof eff.borders.diagonal.argb, 'number');
+    assert.equal(eff.locked, true);
+    assert.equal(typeof eff.numFmtCode, 'string');
+
+    const plain = wb.getEffectiveStyle(0, 50, 50);
+    assert.ok(plain.status.ok);
+    assert.equal(plain.xfIndex, 0);
+    assert.equal(plain.source, 3);
+
+    const failed = wb.getEffectiveStyle(99, 0, 0);
+    assert.equal(failed.status.ok, false);
+    assert.equal(failed.numFmtCode, '');
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('setCellStyle round-trips a record and validates its fields', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const before = wb.cellStyleCount().value;
+    const rec = { name: 'Probe Style', xfId: 0, builtinId: 53, iLevel: 0, hidden: true, customBuiltin: true };
+    assert.ok(wb.setCellStyle(rec).ok);
+    assert.equal(wb.cellStyleCount().value, before + 1);
+    const read = wb.getCellStyle(before);
+    assert.equal(read.name, 'Probe Style');
+    assert.equal(read.builtinId, 53);
+    assert.equal(read.hidden, true);
+    assert.equal(read.customBuiltin, true);
+
+    assert.ok(wb.setCellStyle({ name: 'Probe Style' }).ok);
+    assert.equal(wb.cellStyleCount().value, before + 1);
+    assert.equal(wb.getCellStyle(before).builtinId, 0xffffffff);
+
+    assert.equal(wb.setCellStyle({ name: 'Bad Level', iLevel: 3 }).ok, false);
+    assert.equal(wb.setCellStyle({ name: '' }).ok, false);
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('removeCellStyle rejects the Normal style and an unknown name', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  try {
+    const normal = wb.getCellStyle(0);
+    assert.ok(normal.status.ok);
+    assert.equal(wb.removeCellStyle(normal.name).ok, false);
+    assert.equal(wb.removeCellStyle('No Such Style').ok, false);
+    if (wb.cellStyleCount().value > 1) {
+      const other = wb.getCellStyle(1);
+      const before = wb.cellStyleCount().value;
+      assert.ok(wb.removeCellStyle(other.name).ok);
+      assert.equal(wb.cellStyleCount().value, before - 1);
+    }
+  } finally {
+    wb.dispose();
+  }
+});
+
+test('theme and colour enums carry the C ABI ordinals', async () => {
+  const mod = await getModule();
+  assert.deepEqual({ ...mod.ColorContext }, { Font: 0, FillForeground: 1, FillBackground: 2, Border: 3 });
+  assert.deepEqual(
+    { ...mod.ColorResolution },
+    { Exact: 0, DefaultTheme: 1, IndexOutOfRange: 2, ThemeUnparseable: 3, AutoContext: 4 },
+  );
+  assert.deepEqual({ ...mod.ThemeSource }, { Part: 0, Default: 1, Unparseable: 2 });
+  assert.deepEqual({ ...mod.EffectiveStyleSource }, { Cell: 0, Row: 1, Column: 2, Default: 3 });
+});
diff --git a/packages/npm/common.mjs b/packages/npm/common.mjs
index 4c2623812..1b76fda9a 100644
--- a/packages/npm/common.mjs
+++ b/packages/npm/common.mjs
@@ -95,6 +95,80 @@ export const ErrorCode = Object.freeze({
 });
 export const CalcMode = Object.freeze({ Auto: 0, Manual: 1, AutoNoTable: 2 });
 export const SheetVisibility = Object.freeze({ Visible: 0, Hidden: 1, VeryHidden: 2 });
+export const GeometryMode = Object.freeze({ Display: 0, Print: 1 });
+export const FilterKind = Object.freeze({ None: 0, Values: 1, Custom: 2, Top10: 3, Dynamic: 4, Color: 5, Icon: 6 });
+export const FilterOperator = Object.freeze({
+  Equal: 0,
+  LessThan: 1,
+  LessThanOrEqual: 2,
+  NotEqual: 3,
+  GreaterThanOrEqual: 4,
+  GreaterThan: 5,
+});
+export const DynamicFilterType = Object.freeze({
+  Null: 0,
+  AboveAverage: 1,
+  BelowAverage: 2,
+  Tomorrow: 3,
+  Today: 4,
+  Yesterday: 5,
+  NextWeek: 6,
+  ThisWeek: 7,
+  LastWeek: 8,
+  NextMonth: 9,
+  ThisMonth: 10,
+  LastMonth: 11,
+  NextQuarter: 12,
+  ThisQuarter: 13,
+  LastQuarter: 14,
+  NextYear: 15,
+  ThisYear: 16,
+  LastYear: 17,
+  YearToDate: 18,
+  Q1: 19,
+  Q2: 20,
+  Q3: 21,
+  Q4: 22,
+  M1: 23,
+  M2: 24,
+  M3: 25,
+  M4: 26,
+  M5: 27,
+  M6: 28,
+  M7: 29,
+  M8: 30,
+  M9: 31,
+  M10: 32,
+  M11: 33,
+  M12: 34,
+});
+export const SortBy = Object.freeze({ Value: 0, CellColor: 1, FontColor: 2, Icon: 3 });
+export const SortMethod = Object.freeze({ None: 0, PinYin: 1, Stroke: 2 });
+export const DateTimeGrouping = Object.freeze({ Year: 0, Month: 1, Day: 2, Hour: 3, Minute: 4, Second: 5 });
+export const ValidationErrorStyle = Object.freeze({ Stop: 0, Warning: 1, Information: 2 });
+export const ColorContext = Object.freeze({ Font: 0, FillForeground: 1, FillBackground: 2, Border: 3 });
+export const ColorResolution = Object.freeze({
+  Exact: 0,
+  DefaultTheme: 1,
+  IndexOutOfRange: 2,
+  ThemeUnparseable: 3,
+  AutoContext: 4,
+});
+export const ImageFormat = Object.freeze({ Unknown: 0, Png: 1, Jpeg: 2, Gif: 3, Bmp: 4 });
+export const DrawingObjectKind = Object.freeze({
+  Picture: 0,
+  Shape: 1,
+  Chart: 2,
+  Group: 3,
+  Connector: 4,
+  GraphicFrame: 5,
+  Other: 6,
+});
+export const AnchorKind = Object.freeze({ OneCell: 0, TwoCell: 1, Absolute: 2 });
+export const AnchorEditAs = Object.freeze({ TwoCell: 0, OneCell: 1, Absolute: 2 });
+export const ThemeSource = Object.freeze({ Part: 0, Default: 1, Unparseable: 2 });
+export const EffectiveStyleSource = Object.freeze({ Cell: 0, Row: 1, Column: 2, Default: 3 });
+export const DisplayStatus = Object.freeze({ Ok: 0, Overflow: 1, InvalidFormat: 2 });
 export const ExternalLinkKind = Object.freeze({ Unknown: 0, ExternalBook: 1, Ole: 2, Dde: 3 });
 export const LogLevel = Object.freeze({ Debug: 0, Info: 1, Warn: 2, Error: 3, Off: 4 });
 
diff --git a/packages/npm/package.json b/packages/npm/package.json
index 7d16af158..df4fbcd55 100644
--- a/packages/npm/package.json
+++ b/packages/npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@libraz/formulon",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Excel 365 calculation engine -- WASM binding",
   "license": "Apache-2.0",
   "author": "libraz",
diff --git a/packages/npm/test/smoke.test.mjs b/packages/npm/test/smoke.test.mjs
index c19e49037..30e9335d0 100644
--- a/packages/npm/test/smoke.test.mjs
+++ b/packages/npm/test/smoke.test.mjs
@@ -1,2073 +1,8 @@
-//
 // Smoke tests for the staged @libraz/formulon npm package.
-//
-// These tests intentionally import the *staged* dist/ artefacts (resolved
-// via the package's own package.json "main" field), not the raw
-// build-wasm/ output. That way we catch staging mistakes -- missing
-// files, wrong relative paths, broken "exports" entries -- before the
-// tarball ships.
-//
-// Run via `make npm-test` (which runs `make npm-package` first).
+// Topic modules are statically imported in the original registration order.
 
-import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-import test from 'node:test';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { inflateRawSync } from 'node:zlib';
-
-// fm_value_kind_t mirror (see src/c_api/formulon_c.h).
-const VAL = Object.freeze({
-  BLANK: 0,
-  NUMBER: 1,
-  BOOL: 2,
-  TEXT: 3,
-  ERROR: 4,
-  ARRAY: 5,
-  REF: 6,
-  LAMBDA: 7,
-});
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const pkgRoot = path.resolve(__dirname, '..');
-const pkgJsonPath = path.join(pkgRoot, 'package.json');
-
-// Resolve the staged entry point through the package's own "exports" map,
-// so a broken entry fails here rather than in a consumer. FORMULON_NPM_ENTRY
-// selects the subpath: "." (single-threaded, default) or "./threads".
-// Fails (rather than skips) if the package isn't staged -- that's the whole
-// point of running these tests against dist/.
-const entry = process.env.FORMULON_NPM_ENTRY ?? '.';
-const threadsEntry = entry === './threads';
-
-async function loadStagedModule() {
-  const raw = await readFile(pkgJsonPath, 'utf8');
-  const pkg = JSON.parse(raw);
-  const target = pkg.exports?.[entry]?.import;
-  if (!target) {
-    throw new Error(`package.json "exports" has no import target for ${entry}: ${pkgJsonPath}`);
-  }
-  // Node ESM requires file:// URLs for absolute paths on Windows;
-  // pathToFileURL is the portable form.
-  return import(pathToFileURL(path.resolve(pkgRoot, target)).href);
-}
-
-async function loadStagedFactory() {
-  const mod = await loadStagedModule();
-  if (typeof mod.default !== 'function') {
-    throw new Error(`expected default export to be a factory, got ${typeof mod.default}`);
-  }
-  return mod.default;
-}
-
-// The pthread workers must boot from the core, whose top level starts the
-// runtime; a bundler can empty the entry shim when it is used as a worker.
-test('threads build spawns its workers from the core, not the entry shim', async () => {
-  const glue = await readFile(path.join(pkgRoot, 'dist', 'formulon_threads_core.js'), 'utf8');
-  assert.match(glue, /new Worker\(new URL\("formulon_threads_core\.js",import\.meta\.url\)/);
-  assert.doesNotMatch(glue, /"formulon_threads\.js"/);
-  const pkg = JSON.parse(await readFile(pkgJsonPath, 'utf8'));
-  assert.ok(pkg.sideEffects.includes('./dist/formulon_threads_core.js'));
-});
-
-// Load once and reuse across tests; the factory itself is cheap, but the
-// underlying WASM instantiation costs ~30ms per invocation.
-let modulePromise;
-function getModule() {
-  if (!modulePromise) {
-    modulePromise = (async () => {
-      const factory = await loadStagedFactory();
-      return factory();
-    })();
-  }
-  return modulePromise;
-}
-
-// A structured reference the XLSB encoder cannot lower, which
-// makes the writer emit one per-cell warn record.
-function emitXlsbWarning(Module, xlsbFormat) {
-  const wb = Module.Workbook.createDefault();
-  try {
-    assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
-    assert.ok(wb.recalc().ok);
-    assert.ok(wb.saveAs(xlsbFormat).status.ok);
-  } finally {
-    wb.delete();
-  }
-}
-
-test('default export is callable factory returning a Module', async () => {
-  const factory = await loadStagedFactory();
-  assert.equal(typeof factory, 'function');
-  const Module = await factory();
-  assert.ok(Module && typeof Module === 'object');
-  assert.equal(typeof Module.versionString, 'function');
-});
-
-test('all declared enum and constant exports resolve at runtime', async () => {
-  const mod = await loadStagedModule();
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
-  const names = [...dts.matchAll(/^export (?:const )?(?:enum|const) (\w+)/gm)].map((match) => match[1]);
-  for (const name of names) {
-    assert.ok(name in mod, `missing runtime export ${name}`);
-  }
-  assert.equal(mod.ValueKind.Error, 4);
-  assert.equal(mod.PivotAxis.Row, 0);
-  assert.equal(mod.ExternalLinkKind.Dde, 3);
-  // Named constants a consumer needs in order to interpret shared record
-  // fields (`Value.errorCode`, `ExternalLinkRecord.kind`) or to drive the
-  // calc policy. The native package exports the same names and ordinals;
-  // `check_binding_drift dts-enums` holds the two in step.
-  assert.equal(mod.ErrorCode.Div0, 1);
-  assert.equal(mod.ErrorCode.Unknown, 16);
-  assert.equal(mod.CalcMode.Manual, 1);
-  for (const name of ['ErrorCode', 'CalcMode', 'ExternalLinkKind']) {
-    assert.ok(Object.isFrozen(mod[name]), `${name} must be frozen`);
-  }
-});
-
-test('setLogMinLevel / setLogSink are module-level controls on the Module', async () => {
-  const Module = await getModule();
-  assert.equal(typeof Module.setLogMinLevel, 'function');
-  assert.equal(typeof Module.setLogSink, 'function');
-  const mod = await loadStagedModule();
-  for (const level of Object.values(mod.LogLevel)) {
-    assert.ok(Module.setLogMinLevel(level).ok, `level=${level}`);
-  }
-  for (const bad of [-1, 5, 99]) {
-    const r = Module.setLogMinLevel(bad);
-    assert.equal(r.ok, false, `level=${bad} should be rejected`);
-    assert.equal(r.status, 2);
-  }
-  assert.ok(Module.setLogMinLevel(mod.LogLevel.Off).ok);
-});
-
-test('a registered sink receives records only once the threshold admits them', async () => {
-  const Module = await getModule();
-  const mod = await loadStagedModule();
-  const records = [];
-  assert.ok(Module.setLogSink((record) => records.push(new Uint8Array(record))).ok);
-  try {
-    // Default threshold is Off: the same save must produce nothing.
-    emitXlsbWarning(Module, mod.WorkbookFormat.Xlsb);
-    assert.deepEqual(records, []);
-
-    assert.ok(Module.setLogMinLevel(mod.LogLevel.Warn).ok);
-    emitXlsbWarning(Module, mod.WorkbookFormat.Xlsb);
-    assert.ok(records.length > 0, 'expected at least one record');
-    for (const r of records) {
-      // The sink must receive a copy, never a live view into the WASM
-      // instance's own memory: the /threads build backs that memory with
-      // a `SharedArrayBuffer`, over which most browsers' `TextDecoder`
-      // refuses to operate -- a failure this suite cannot reproduce under
-      // Node, so the buffer identity is what it checks instead.
-      assert.ok(!(r.buffer instanceof SharedArrayBuffer), 'log sink record must not be SharedArrayBuffer-backed');
-    }
-    const text = records.map((r) => new TextDecoder().decode(r)).join('');
-    assert.match(text, /xlsb\.writer\.formula_downgraded/);
-    assert.match(text, /"level":"warn"/);
-  } finally {
-    assert.ok(Module.setLogMinLevel(mod.LogLevel.Off).ok);
-    assert.ok(Module.setLogSink(null).ok);
-  }
-});
-
-test('a throwing log sink is dropped and leaves the engine usable', async () => {
-  const Module = await getModule();
-  const mod = await loadStagedModule();
-  let calls = 0;
-  assert.ok(
-    Module.setLogSink(() => {
-      calls += 1;
-      throw new Error('sink failure');
-    }).ok,
-  );
-  try {
-    assert.ok(Module.setLogMinLevel(mod.LogLevel.Warn).ok);
-    // The sink runs from deep inside the writer. If its exception reached
-    // the C++ frames it would tear them down without running a single
-    // destructor, because the binary is linked without exception support.
-    emitXlsbWarning(Module, mod.WorkbookFormat.Xlsb);
-    assert.ok(calls > 0, 'expected the sink to be invoked');
-  } finally {
-    assert.ok(Module.setLogMinLevel(mod.LogLevel.Off).ok);
-    assert.ok(Module.setLogSink(null).ok);
-  }
-
-  const wb = Module.Workbook.createDefault();
-  try {
-    assert.ok(wb.setFormula(0, 0, 0, '=1+1').ok);
-    const after = wb.recalc();
-    assert.ok(after.ok, `recalc after a throwing sink: ${JSON.stringify(after)}`);
-    assert.equal(wb.getValue(0, 0, 0).value.number, 2);
-  } finally {
-    wb.delete();
-  }
-});
-
-// One-shot evaluation is anchored at Sheet1!A1 and read-only on every
-// shipped surface, so these must agree value-for-value with the WASM
-// package and the Python wheel. The anchor-referencing cases are the ones
-// that diverge if a surface writes the formula into A1 and recalcs.
-const ONE_SHOT_CASES = [
-  { formula: '=1+2', kind: 1, number: 3 },
-  { formula: '=A1', kind: 1, number: 0 },
-  { formula: '=COUNTA(A1)', kind: 1, number: 0 },
-  { formula: '=ISBLANK(A1)', kind: 2, boolean: 1 },
-  { formula: '=SUM(A1:A3)', kind: 1, number: 0 },
-  { formula: '=SEQUENCE(3)', kind: 1, number: 1 },
-  { formula: '=ROWS(SEQUENCE(3))', kind: 1, number: 3 },
-];
-test('evalFormula evaluates read-only against a blank anchor', async () => {
-  const Module = await getModule();
-  for (const spec of ONE_SHOT_CASES) {
-    const r = Module.evalFormula(spec.formula);
-    assert.ok(r.status.ok, `${spec.formula}: ${JSON.stringify(r.status)}`);
-    assert.equal(r.value.kind, spec.kind, spec.formula);
-    if (spec.number !== undefined) {
-      assert.equal(r.value.number, spec.number, spec.formula);
-    }
-    if (spec.boolean !== undefined) {
-      assert.equal(r.value.boolean, spec.boolean, spec.formula);
-    }
-    assert.equal(r.value.errorCode, 0, spec.formula);
-  }
-});
-
-// Parses the staged `export enum X { A = 0, ... }` declarations into
-// {name: {member: ordinal}}. Name presence alone is not enough: a staged
-// bundle carrying a stale ordinal ships a constant that silently means
-// something else, and nothing upstream of dist/ can see that.
-function declaredOrdinalTables(dts) {
-  const tables = {};
-  const blocks = dts.matchAll(/^export enum (\w+) \{([^}]*)\}/gm);
-  for (const [, name, body] of blocks) {
-    const members = {};
-    let next = 0;
-    for (const line of body.split(',')) {
-      const m = line.trim().match(/^(\w+)\s*(?:=\s*(-?\d+))?$/);
-      if (!m) continue;
-      if (m[2] !== undefined) next = Number(m[2]);
-      members[m[1]] = next;
-      next += 1;
-    }
-    tables[name] = members;
-  }
-  return tables;
-}
-
-test('staged constant tables carry the ordinals the staged .d.ts declares', async () => {
-  const mod = await loadStagedModule();
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
-  const tables = declaredOrdinalTables(dts);
-  assert.ok(Object.keys(tables).length > 0, 'expected declared ordinal tables');
-  for (const [name, members] of Object.entries(tables)) {
-    const runtime = mod[name];
-    assert.ok(runtime, `missing runtime table ${name}`);
-    assert.deepEqual({ ...runtime }, members, `${name} ordinals differ from dist/formulon.d.ts`);
-    assert.ok(Object.isFrozen(runtime), `${name} must be frozen`);
-  }
-});
-
-// Builds a workbook with one pivot, ready for the filter-contract cases.
-// `delete` is embind's auto-added finaliser; the caller must call it.
-function makePivotWorkbook(Workbook) {
-  const wb = Workbook.createDefault();
-  const cacheId = wb.pivotCacheCreate(0).index;
-  // A cache without a worksheet source cannot be saved, so the fixture
-  // declares the range its two fields and two records occupy.
-  assert.ok(wb.pivotCacheSetWorksheetSource(cacheId, { present: true, ref: 'A1:B3', sheet: 'Sheet1' }).ok);
-  assert.ok(wb.pivotCacheFieldAdd(cacheId, 'Region').status.ok);
-  assert.ok(wb.pivotCacheFieldAdd(cacheId, 'Amount').status.ok);
-  for (const [region, amount] of [
-    ['East', 10],
-    ['West', 30],
-  ]) {
-    const rec = wb.pivotCacheRecordAdd(cacheId).index;
-    assert.ok(wb.pivotCacheRecordSetText(cacheId, rec, 0, region).ok);
-    assert.ok(wb.pivotCacheRecordSetNumber(cacheId, rec, 1, amount).ok);
-  }
-  const pivot = wb.pivotCreate(0, 'Pivot1', cacheId, 0, 4);
-  assert.ok(pivot.status.ok, JSON.stringify(pivot.status));
-  assert.ok(wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Region', axis: 0 }).status.ok);
-  const amountField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Amount', axis: 2 });
-  assert.ok(amountField.status.ok);
-  assert.ok(
-    wb.pivotDataFieldAdd(0, pivot.index, {
-      name: 'Sum of Amount',
-      fieldIndex: amountField.index,
-      aggregation: 0,
-    }).status.ok,
-  );
-  return { wb, pivot: pivot.index };
-}
-
-// greaterThan on a double payload: the shape pivotFilterAt must read back.
-const PIVOT_FILTER = Object.freeze({
-  axis: 0,
-  fieldName: 'Region',
-  type: 1,
-  valueKind: 1,
-  valueDouble: 15,
-});
-
-test('pivotFilterAt reads back an added filter field for field', async () => {
-  const Module = await getModule();
-  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
-  try {
-    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
-    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
-    const got = wb.pivotFilterAt(0, pivot, 0);
-    assert.ok(got.status.ok, JSON.stringify(got.status));
-    assert.equal(got.axis, PIVOT_FILTER.axis);
-    assert.equal(got.fieldName, PIVOT_FILTER.fieldName);
-    assert.equal(got.type, PIVOT_FILTER.type);
-    assert.equal(got.valueKind, PIVOT_FILTER.valueKind);
-    assert.equal(got.valueDouble, PIVOT_FILTER.valueDouble);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('pivotFilterCount reports only what this session added', async () => {
-  const Module = await getModule();
-  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
-  try {
-    assert.equal(wb.pivotFilterCount(0, pivot).value, 0);
-    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
-    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('active filters are session state and do not survive save/load', async () => {
-  const Module = await getModule();
-  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
-  let bytes;
-  try {
-    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
-    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
-    const saved = wb.save();
-    assert.ok(saved.status.ok, JSON.stringify(saved.status));
-    bytes = saved.bytes;
-  } finally {
-    wb.delete();
-  }
-  const reloaded = Module.Workbook.loadBytes(bytes);
-  try {
-    assert.equal(reloaded.pivotCount(0).value, 1);
-    // The pivot round-trips; its active-filter list deliberately does not.
-    assert.equal(reloaded.pivotFilterCount(0, 0).value, 0);
-  } finally {
-    reloaded.delete();
-  }
-});
-
-test('pivotFilterAt rejects an out-of-range index', async () => {
-  const Module = await getModule();
-  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
-  try {
-    const got = wb.pivotFilterAt(0, pivot, 99);
-    assert.equal(got.status.ok, false);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('a required pivot spec string field left out of the object is rejected, not silently empty', async () => {
-  const Module = await getModule();
-  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
-  try {
-    const fieldCountBefore = wb.pivotFieldCount(0, pivot).value;
-    const field = wb.pivotFieldAdd(0, pivot, { axis: 0 }); // no `sourceName`
-    assert.equal(field.status.ok, false);
-    assert.equal(field.status.status, 7001);
-    assert.equal(wb.pivotFieldCount(0, pivot).value, fieldCountBefore, 'no field must have been added');
-
-    const dataFieldCountBefore = wb.pivotDataFieldCount(0, pivot).value;
-    const dataField = wb.pivotDataFieldAdd(0, pivot, { fieldIndex: 0, aggregation: 0 }); // no `name`
-    assert.equal(dataField.status.ok, false);
-    assert.equal(dataField.status.status, 7001);
-    assert.equal(wb.pivotDataFieldCount(0, pivot).value, dataFieldCountBefore, 'no data field must have been added');
-
-    const filterCountBefore = wb.pivotFilterCount(0, pivot).value;
-    const filter = wb.pivotFilterAdd(0, pivot, { axis: 0, type: 1, valueKind: 1, valueDouble: 15 }); // no `fieldName`
-    assert.equal(filter.ok, false);
-    assert.equal(filter.status, 7001);
-    assert.equal(wb.pivotFilterCount(0, pivot).value, filterCountBefore, 'no filter must have been added');
-  } finally {
-    wb.delete();
-  }
-});
-
-test('versionString returns a non-empty string', async () => {
-  const Module = await getModule();
-  const v = Module.versionString();
-  assert.equal(typeof v, 'string');
-  assert.ok(v.length > 0, `expected non-empty version, got ${JSON.stringify(v)}`);
-});
-
-test('evalFormula(=SUM(1,2,3)) returns NUMBER 6', async () => {
-  const Module = await getModule();
-  const r = Module.evalFormula('=SUM(1,2,3)');
-  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-  assert.equal(r.value.kind, VAL.NUMBER);
-  assert.equal(r.value.number, 6);
-});
-
-test('evalFormula(=1/0) surfaces Excel error as a value (not failed status)', async () => {
-  const Module = await getModule();
-  const r = Module.evalFormula('=1/0');
-  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-  assert.equal(r.value.kind, VAL.ERROR);
-});
-
-test('evalFormula uses read-only evaluation for the intersection operator', async () => {
-  const Module = await getModule();
-  const r = Module.evalFormula('=A1 B1');
-  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-  assert.equal(r.value.kind, VAL.ERROR);
-  assert.equal(r.value.errorCode, 0); // ErrorCode::Null / #NULL!
-});
-
-test('Workbook.createDefault produces a valid single-sheet workbook', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    assert.ok(wb.isValid());
-    assert.equal(wb.sheetCount().value, 1);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('print settings: raw XML round-trips and rejects malformed fragments', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    // An absent element reads back as the empty string, never null.
-    assert.equal(wb.getSheetPageSetupXml(0).xml, '');
-
-    const fragment = '<pageSetup paperSize="9" orientation="portrait" scale="85"/>';
-    assert.ok(wb.setSheetPageSetupXml(0, fragment).ok);
-    assert.equal(wb.getSheetPageSetupXml(0).xml, fragment);
-
-    for (const bad of [
-      '<pageSetup/><pageSetup/>',
-      '<pageMargins left="1"/>',
-      '<pageSetup orientation="portrait"',
-      '<x:pageSetup/>',
-    ]) {
-      assert.equal(wb.setSheetPageSetupXml(0, bad).ok, false, `expected rejection for ${bad}`);
-    }
-    // A rejected set leaves the stored fragment untouched.
-    assert.equal(wb.getSheetPageSetupXml(0).xml, fragment);
-
-    assert.ok(wb.setSheetPageSetupXml(0, '').ok);
-    assert.equal(wb.getSheetPageSetupXml(0).xml, '');
-    const cleared = wb.getSheetPageSetup(0);
-    assert.ok(cleared.status.ok);
-    assert.equal(cleared.scale, 100);
-    assert.equal(cleared.scaleStated, false);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('print settings: typed patch leaves unstated attributes alone', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    assert.ok(
-      wb.setSheetPageSetupXml(0, '<pageSetup paperSize="9" orientation="portrait" horizontalDpi="600" copies="3"/>').ok,
-    );
-    assert.ok(wb.setSheetPageSetup(0, { orientation: 2 }).ok);
-
-    const xml = wb.getSheetPageSetupXml(0).xml;
-    assert.match(xml, /orientation="landscape"/);
-    // Attributes the engine does not model must survive the patch, or the
-    // "open a template and change one thing" route loses data.
-    assert.match(xml, /horizontalDpi="600"/);
-    assert.match(xml, /copies="3"/);
-    assert.match(xml, /paperSize="9"/);
-
-    // A print scale outside Excel's range is rejected, not clamped.
-    assert.equal(wb.setSheetPageSetup(0, { scale: 9 }).ok, false);
-    assert.equal(wb.setSheetPageSetup(0, { scale: 401 }).ok, false);
-    assert.ok(wb.setSheetPageSetup(0, { scale: 400 }).ok);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('print settings: a change reaches paginate with no save cycle', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    for (let row = 0; row < 200; row += 1) {
-      for (let col = 0; col < 20; col += 1) {
-        assert.ok(wb.setNumber(0, row, col, 1).ok);
-      }
-    }
-    const portrait = wb.paginate(0).pageCount;
-    assert.ok(wb.setSheetPageSetup(0, { orientation: 2 }).ok);
-    assert.notEqual(wb.paginate(0).pageCount, portrait);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('print settings: an authored report survives save and load', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  let bytes;
-  try {
-    assert.ok(wb.setText(0, 0, 0, '売上').ok);
-    assert.ok(
-      wb.setSheetPageSetup(0, {
-        paperSize: 9,
-        orientation: 1,
-        fitToPage: true,
-        fitToWidth: 1,
-        fitToHeight: 0,
-      }).ok,
-    );
-    assert.ok(wb.setSheetPageMargins(0, { left: 0.5, right: 0.5, top: 0.8, bottom: 0.8 }).ok);
-    assert.ok(wb.setSheetPrintOptions(0, { horizontalCentered: true }).ok);
-    assert.ok(wb.setSheetHeaderFooter(0, { oddHeader: '&C月次報告', oddFooter: '&R&P / &N' }).ok);
-    assert.ok(wb.setSheetPrintArea(0, 'A1:F80').ok);
-    assert.ok(wb.setSheetPrintTitles(0, '1:2', '').ok);
-    assert.ok(wb.addSheetRowBreak(0, 39, true).ok);
-
-    const saved = wb.save();
-    assert.ok(saved.status.ok, JSON.stringify(saved.status));
-    bytes = saved.bytes;
-  } finally {
-    wb.delete();
-  }
-
-  const reloaded = Module.Workbook.loadBytes(bytes);
-  try {
-    const setup = reloaded.getSheetPageSetup(0);
-    assert.ok(setup.status.ok);
-    assert.equal(setup.paperSize, 9);
-    assert.equal(setup.orientation, 1);
-    assert.equal(setup.fitToPage, true);
-    assert.equal(setup.fitToHeight, 0);
-    assert.equal(reloaded.getSheetPageMargins(0).left, 0.5);
-    assert.equal(reloaded.getSheetPrintArea(0).ranges, 'A1:F80');
-    const titles = reloaded.getSheetPrintTitles(0);
-    assert.equal(titles.repeatRows, '1:2');
-    assert.equal(titles.repeatCols, '');
-    // The header code is stored escaped and decodes back to `&C...`.
-    assert.match(reloaded.getSheetHeaderFooterXml(0).xml, /<oddHeader>&amp;C月次報告<\/oddHeader>/);
-    const breaks = reloaded.getSheetRowBreaks(0);
-    assert.deepEqual(
-      breaks.breaks.map((b) => b.id),
-      [39],
-    );
-    assert.equal(breaks.breaks[0].manual, true);
-  } finally {
-    reloaded.delete();
-  }
-});
-
-test('setRangeXfIndex applies one xf across a rectangle', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    const xf = wb.addXf({ fontIndex: 0, fillIndex: 0, borderIndex: 0, numFmtId: 0, wrapText: true, hasWrapText: true });
-    assert.ok(xf.status.ok, JSON.stringify(xf.status));
-    assert.ok(wb.setRangeXfIndex(0, 0, 0, 2, 2, xf.index).ok);
-    // Cells that held nothing are materialised so the ruled box renders.
-    for (const [row, col] of [
-      [0, 0],
-      [1, 1],
-      [2, 2],
-    ]) {
-      assert.equal(wb.getCellXfIndex(0, row, col).xfIndex, xf.index);
-    }
-    assert.equal(wb.getCellXfIndex(0, 3, 3).xfIndex, 0);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('sheet layout getters preserve explicit width presence flags', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    assert.ok(wb.setColumnWidth(0, 0, 0, 0).ok);
-    assert.ok(wb.setColumnHidden(0, 1, 1, true).ok);
-    assert.ok(wb.setRowHeight(0, 3, 30).ok);
-
-    const columns = wb.getSheetColumns(0);
-    assert.ok(columns.status.ok, `getSheetColumns: ${JSON.stringify(columns.status)}`);
-    const widthZero = columns.columns.find((column) => column.first === 0 && column.last === 0);
-    assert.ok(widthZero);
-    assert.equal(widthZero.width, 0);
-    assert.equal(typeof widthZero.hasWidth, 'number');
-    assert.equal(widthZero.hasWidth, 1);
-    assert.equal(typeof widthZero.hasStyle, 'number');
-    assert.equal(widthZero.hasStyle, 0);
-    const hidden = columns.columns.find((column) => column.first === 1 && column.last === 1);
-    assert.ok(hidden);
-    assert.equal(hidden.hidden, 1);
-    assert.equal(typeof hidden.hasWidth, 'number');
-    assert.equal(hidden.hasWidth, 0);
-
-    const rows = wb.getSheetRowOverrides(0);
-    assert.ok(rows.status.ok, `getSheetRowOverrides: ${JSON.stringify(rows.status)}`);
-    const row = rows.rows.find((entry) => entry.row === 3);
-    assert.ok(row);
-    assert.equal(row.height, 30);
-    assert.equal(row.hasStyle, 0);
-    assert.equal(row.styleXf, 0);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('Unicode sheet identity rejects folded duplicate and permits casing rename', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createEmpty();
-  try {
-    assert.ok(wb.addSheet('Ä').ok);
-    assert.ok(wb.addSheet('Ö').ok);
-    assert.equal(wb.addSheet('ä').ok, false);
-    const collision = wb.renameSheet(1, 'ä');
-    assert.equal(collision.ok, false);
-    assert.notEqual(collision.status, 0);
-    assert.equal(wb.sheetName(0).value, 'Ä');
-    assert.equal(wb.sheetName(1).value, 'Ö');
-    assert.ok(wb.renameSheet(0, 'ä').ok);
-    const sn = wb.sheetName(0);
-    assert.ok(sn.status.ok);
-    assert.equal(sn.value, 'ä');
-    assert.equal(wb.sheetName(1).value, 'Ö');
-  } finally {
-    wb.delete();
-  }
-});
-
-test('setNumber + getValue round-trips bit-exactly', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    const x = 3.141592653589793;
-    assert.ok(wb.setNumber(0, 0, 0, x).ok);
-    assert.ok(wb.recalc().ok);
-    const r = wb.getValue(0, 0, 0);
-    assert.ok(r.status.ok);
-    assert.equal(r.value.kind, VAL.NUMBER);
-    assert.equal(r.value.number, x);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('setFormula + recalc computes 41 + 1 == 42 in B1', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    assert.ok(wb.setNumber(0, 0, 0, 41).ok);
-    assert.ok(wb.setFormula(0, 0, 1, '=A1+1').ok);
-    assert.ok(wb.recalc().ok);
-    const b1 = wb.getValue(0, 0, 1);
-    assert.ok(b1.status.ok);
-    assert.equal(b1.value.kind, VAL.NUMBER);
-    assert.equal(b1.value.number, 42);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('Workbook.recalcParallel evaluates a wide DAG and reports bounded telemetry', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  const branchCount = 32;
-  try {
-    assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-    for (let i = 0; i < branchCount; i += 1) {
-      const row = i + 1;
-      assert.ok(wb.setFormula(0, row, 1, `=A1+${i + 2}`).ok);
-      assert.ok(wb.setFormula(0, row, 2, `=B${row + 1}*2`).ok);
-    }
-
-    const parallel = wb.recalcParallel(4);
-    assert.ok(parallel.status.ok, `status=${JSON.stringify(parallel.status)}`);
-    assert.equal(typeof parallel.stats.cellsEvaluated, 'number');
-    assert.equal(typeof parallel.stats.sccsProcessed, 'number');
-    assert.equal(typeof parallel.stats.parallelSteps, 'number');
-    assert.ok(parallel.stats.cellsEvaluated > 0);
-    assert.ok(parallel.stats.sccsProcessed > 0);
-    if (!threadsEntry) {
-      // Without pthreads every launch is refused, so the pass runs serially.
-      assert.equal(parallel.stats.workerThreadsStarted, 0);
-    }
-    if (parallel.stats.workerThreadsStarted <= 1) {
-      // OS launch refusal or a partial launch of one worker is a documented
-      // successful serial degradation.
-      assert.equal(parallel.stats.workerThreadsUsed, 0);
-      assert.equal(parallel.stats.parallelSteps, 0);
-      assert.ok(parallel.stats.serialFallbackSteps > 0, `stats=${JSON.stringify(parallel.stats)}`);
-    } else {
-      assert.ok(parallel.stats.parallelSteps > 0, `stats=${JSON.stringify(parallel.stats)}`);
-      assert.ok(parallel.stats.workerThreadsStarted >= 2);
-      assert.ok(parallel.stats.workerThreadsStarted <= 4);
-      assert.ok(parallel.stats.workerThreadsUsed > 0);
-      assert.ok(parallel.stats.workerThreadsUsed <= parallel.stats.workerThreadsStarted);
-    }
-
-    const first = wb.getValue(0, 1, 1);
-    const last = wb.getValue(0, branchCount, 2);
-    assert.ok(first.status.ok);
-    assert.ok(last.status.ok);
-    assert.equal(first.value.kind, VAL.NUMBER);
-    assert.equal(last.value.kind, VAL.NUMBER);
-    assert.equal(first.value.number, 3);
-    assert.equal(last.value.number, (1 + branchCount + 1) * 2);
-
-    assert.ok(wb.setNumber(0, 0, 0, 5).ok);
-    const callerOnly = wb.recalcParallel(1);
-    assert.ok(callerOnly.status.ok, `status=${JSON.stringify(callerOnly.status)}`);
-    assert.equal(callerOnly.stats.parallelSteps, 0);
-    assert.ok(callerOnly.stats.serialFallbackSteps > 0);
-    assert.equal(callerOnly.stats.workerThreadsStarted, 0);
-    assert.equal(callerOnly.stats.workerThreadsUsed, 0);
-    assert.equal(wb.getValue(0, branchCount, 2).value.number, (5 + branchCount + 1) * 2);
-
-    const invalid = wb.recalcParallel(9);
-    assert.equal(invalid.status.ok, false);
-    assert.notEqual(invalid.status.status, 0);
-    // Rejected by the binding itself, before any C ABI call: the context
-    // is empty, never a value built from the threadCount the caller
-    // passed (the Status contract's promise for a binding-raised
-    // failure).
-    assert.equal(invalid.status.context, '');
-    assert.equal(invalid.stats.cellsEvaluated, 0);
-    assert.equal(invalid.stats.sccsProcessed, 0);
-    assert.equal(invalid.stats.parallelSteps, 0);
-    assert.equal(invalid.stats.serialFallbackSteps, 0);
-    assert.equal(invalid.stats.cycleRecoveries, 0);
-    assert.equal(invalid.stats.workerThreadsStarted, 0);
-    assert.equal(invalid.stats.workerThreadsUsed, 0);
-
-    for (const invalidThreadCount of [
-      -0.5,
-      1.5,
-      Number.NaN,
-      Number.POSITIVE_INFINITY,
-      Number.NEGATIVE_INFINITY,
-      2 ** 32 + 1,
-      null,
-      undefined,
-    ]) {
-      const invalidShape = wb.recalcParallel(invalidThreadCount);
-      assert.equal(invalidShape.status.ok, false, `threadCount=${String(invalidThreadCount)}`);
-      assert.notEqual(invalidShape.status.status, 0);
-      assert.equal(invalidShape.stats.cellsEvaluated, 0);
-      assert.equal(invalidShape.stats.sccsProcessed, 0);
-      assert.equal(invalidShape.stats.parallelSteps, 0);
-      assert.equal(invalidShape.stats.serialFallbackSteps, 0);
-      assert.equal(invalidShape.stats.cycleRecoveries, 0);
-      assert.equal(invalidShape.stats.workerThreadsStarted, 0);
-      assert.equal(invalidShape.stats.workerThreadsUsed, 0);
-    }
-  } finally {
-    wb.delete();
-  }
-});
-
-// Status ordinals the callback contract is stated in terms of; see
-// `src/utils/error.h`. Spelled out here because the binding does not
-// export a status enum.
-const STATUS = Object.freeze({
-  RECALC_REENTRANT: 4005,
-  CALLBACK_EXCEPTION: 7003,
-});
-
-// A self-referential average: from a blank A1 the iterative solver walks
-// towards 10, and the progress callback fires after every sweep.
-function makeIterativeWorkbook(Module) {
-  const wb = Module.Workbook.createDefault();
-  assert.ok(wb.setIterative(true, 100, 0.0001).ok);
-  assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
-  return wb;
-}
-
-test('a throwing iterative progress callback aborts the solve and reports a status', async () => {
-  const Module = await getModule();
-  const wb = makeIterativeWorkbook(Module);
-  try {
-    let calls = 0;
-    assert.ok(
-      wb.setIterativeProgress(() => {
-        calls += 1;
-        throw new Error('callback failure');
-      }).ok,
-    );
-
-    // The binding never lets an exception cross back into WASM, where no
-    // landing pad exists to restore the engine's RAII state: the throw
-    // comes back as a status on the same envelope every other call uses.
-    const aborted = wb.recalc();
-    assert.equal(aborted.ok, false, `expected a failure envelope: ${JSON.stringify(aborted)}`);
-    assert.equal(aborted.status, STATUS.CALLBACK_EXCEPTION);
-    assert.equal(calls, 1, 'the solve must stop at the first throw');
-
-    // The workbook is still readable, and the recalc re-entry guard was
-    // released on the way out.
-    const mid = wb.getValue(0, 0, 0);
-    assert.ok(mid.status.ok, JSON.stringify(mid.status));
-    assert.equal(mid.value.kind, VAL.NUMBER);
-
-    const second = wb.recalc();
-    assert.notEqual(second.status, STATUS.RECALC_REENTRANT, 'the re-entry flag stayed set');
-
-    assert.ok(wb.setIterativeProgress(null).ok);
-    assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
-    const recovered = wb.recalc();
-    assert.ok(recovered.ok, `recalc after the throwing callback: ${JSON.stringify(recovered)}`);
-    const converged = wb.getValue(0, 0, 0);
-    assert.ok(converged.status.ok, JSON.stringify(converged.status));
-    assert.equal(converged.value.kind, VAL.NUMBER);
-    assert.ok(Math.abs(converged.value.number - 10) < 0.001, `A1=${converged.value.number}`);
-  } finally {
-    wb.setIterativeProgress(null);
-    wb.delete();
-  }
-});
-
-test('delete() from inside its own progress callback throws instead of crashing', async () => {
-  const Module = await getModule();
-  const wb = makeIterativeWorkbook(Module);
-  let calls = 0;
-  let caught = null;
-  assert.ok(
-    wb.setIterativeProgress(() => {
-      calls += 1;
-      try {
-        wb.delete();
-      } catch (e) {
-        caught = e;
-      }
-      return false;
-    }).ok,
-  );
-
-  const result = wb.recalc();
-  assert.equal(calls, 1, 'the callback must run exactly once');
-  assert.ok(caught instanceof Error, 'delete() inside the callback must throw, not free the handle');
-  assert.match(String(caught.message), /iterative progress callback/);
-  // The handle survived: delete() never reached fm_workbook_destroy, so
-  // the workbook is still usable after the (deliberately cancelled) solve.
-  assert.ok(result.ok, `recalc after a cancelled solve: ${JSON.stringify(result)}`);
-  assert.ok(wb.isValid());
-
-  wb.setIterativeProgress(null);
-  wb.delete();
-});
-
-test('an uncaught delete() inside the progress callback aborts the solve like any other throw', async () => {
-  const Module = await getModule();
-  const wb = makeIterativeWorkbook(Module);
-  let calls = 0;
-  assert.ok(
-    wb.setIterativeProgress(() => {
-      calls += 1;
-      wb.delete(); // not caught here -- propagates the same as a plain `throw`
-    }).ok,
-  );
-
-  const result = wb.recalc();
-  assert.equal(calls, 1);
-  assert.equal(result.ok, false, `expected a failure envelope: ${JSON.stringify(result)}`);
-  assert.equal(result.status, STATUS.CALLBACK_EXCEPTION);
-  assert.ok(wb.isValid(), 'the handle must still be alive: delete() never completed');
-
-  wb.setIterativeProgress(null);
-  wb.delete();
-});
-
-test('an iterative progress callback returning a non-boolean is read by truthiness', async () => {
-  const Module = await getModule();
-  for (const [returned, expectedSweeps] of [
-    ['keep going', 0],
-    [0, 1],
-    [undefined, 0],
-  ]) {
-    const wb = makeIterativeWorkbook(Module);
-    try {
-      let calls = 0;
-      assert.ok(
-        wb.setIterativeProgress(() => {
-          calls += 1;
-          return returned;
-        }).ok,
-      );
-      assert.ok(wb.recalc().ok);
-      // A falsy return aborts after the first sweep; anything else lets
-      // the solve run to convergence.
-      if (expectedSweeps === 1) {
-        assert.equal(calls, 1, `returned=${String(returned)}`);
-      } else {
-        assert.ok(calls > 1, `returned=${String(returned)}, calls=${calls}`);
-      }
-    } finally {
-      wb.setIterativeProgress(null);
-      wb.delete();
-    }
-  }
-});
-
-// ---- Result-envelope key sets ------------------------------------------
-//
-// A result type whose payload key is declared non-optional must carry that
-// key on every exit path, or `r.name.toUpperCase()` type-checks and then
-// throws at runtime for a caller who skipped the status check. The probe
-// table below is checked for completeness against the declaration file, so
-// a new result type cannot be added without a failure-path probe.
-
-function interfaceBody(dts, name) {
-  const m = dts.match(new RegExp(`^export interface ${name}\\b[^{]*\\{`, 'm'));
-  if (!m) return null;
-  let depth = 0;
-  const open = dts.indexOf('{', m.index);
-  for (let i = open; i < dts.length; i += 1) {
-    if (dts[i] === '{') depth += 1;
-    else if (dts[i] === '}') {
-      depth -= 1;
-      if (depth === 0) return dts.slice(open + 1, i);
-    }
-  }
-  return null;
-}
-
-function interfaceBases(dts, name) {
-  const m = dts.match(new RegExp(`^export interface ${name}\\b([^{]*)\\{`, 'm'));
-  if (!m) return [];
-  const clause = m[1].trim();
-  if (!clause.startsWith('extends')) return [];
-  return clause
-    .slice('extends'.length)
-    .split(',')
-    .map((s) => s.trim())
-    .filter(Boolean);
-}
-
-// [name, required] for every member, following `extends`.
-function interfaceMembers(dts, name, seen = new Set()) {
-  if (seen.has(name)) return [];
-  seen.add(name);
-  const body = interfaceBody(dts, name);
-  if (body === null) return [];
-  const out = [];
-  for (const base of interfaceBases(dts, name)) out.push(...interfaceMembers(dts, base, seen));
-  for (const m of body.matchAll(/^ {2}(?:readonly\s+)?([A-Za-z_$][\w$]*)(\??)\s*:/gm)) {
-    out.push([m[1], m[2] === '']);
-  }
-  return out;
-}
-
-// Every declared result type that carries a `status` plus at least one
-// required payload key. `Status` itself is the envelope, not a result.
-function resultTypesWithRequiredPayload(dts) {
-  const out = new Map();
-  for (const m of dts.matchAll(/^export interface ([A-Za-z0-9_]+)/gm)) {
-    const name = m[1];
-    if (name === 'Status') continue;
-    const members = interfaceMembers(dts, name);
-    if (!members.some(([key]) => key === 'status')) continue;
-    const required = members.filter(([key, req]) => req && key !== 'status').map(([key]) => key);
-    if (required.length > 0) out.set(name, required);
-  }
-  return out;
-}
-
-// One failing (or, where no failure is reachable, succeeding) call per
-// result type. `fails: false` marks a call whose only failure path is a
-// destroyed handle, which `delete()` makes unusable to probe.
-function envelopeProbes(wb) {
-  return [
-    ['ParallelRecalcResult', true, () => wb.recalcParallel(9)],
-    ['CellResult', true, () => wb.getValue(99, 0, 0)],
-    ['EvalResult', true, () => wb.evaluateFormulaText(99, 0, 0, '=1')],
-    ['EvalArrayResult', true, () => wb.evaluateFormulaArray(99, 0, 0, '=1')],
-    ['SaveResult', true, () => wb.saveAs(99)],
-    ['SaveDiagnosticsResult', true, () => wb.saveWithDiagnostics(99)],
-    ['ReadDiagnosticsResult', false, () => wb.readDiagnostics()],
-    ['StringResult', true, () => wb.sheetName(99)],
-    ['PivotLayoutResult', true, () => wb.pivotLayout(99, 0)],
-    ['PivotWorksheetSourceResult', true, () => wb.pivotCacheGetWorksheetSource(9999)],
-    ['PivotReportLayoutResult', true, () => wb.pivotGetLayout(99, 0)],
-    ['PivotFilterResult', true, () => wb.pivotFilterAt(99, 0, 0)],
-    ['CfRangeResult', true, () => wb.evaluateCfRange(99, 0, 0, 1, 1, Number.NaN)],
-    ['PaginationResult', true, () => wb.paginate(99)],
-    ['SheetViewResult', true, () => wb.getSheetView(99)],
-    ['SheetProtectionResult', true, () => wb.getSheetProtection(99)],
-    ['ColumnsResult', true, () => wb.getSheetColumns(99)],
-    ['RowsResult', true, () => wb.getSheetRowOverrides(99)],
-    ['CommentResult', true, () => wb.getCommentResult(99, 0, 0)],
-    ['CellXfIndexResult', true, () => wb.getCellXfIndex(99, 0, 0)],
-    ['CellXfResult', true, () => wb.getCellXf(9999)],
-    ['FontResult', true, () => wb.getFont(9999)],
-    ['FillResult', true, () => wb.getFill(9999)],
-    ['BorderResult', true, () => wb.getBorder(9999)],
-    ['NumFmtResult', true, () => wb.getNumFmt(59999)],
-    ['LambdaTextResult', true, () => wb.getLambdaText(99, 0, 0)],
-    ['PhoneticRunsResult', true, () => wb.getCellPhoneticRuns(99, 0, 0)],
-    ['PhoneticPropertiesResult', true, () => wb.getCellPhoneticProperties(99, 0, 0)],
-    ['CellStyleResult', true, () => wb.getCellStyle(9999)],
-    ['AddStyleResult', true, () => wb.addXf({ fontIndex: 9999 })],
-    ['AddNumFmtResult', false, () => wb.addNumFmt('0.00')],
-    ['IterativeSettingsResult', false, () => wb.getIterative()],
-    [
-      'PartialRecalcResult',
-      true,
-      () => wb.partialRecalc({ sheet: 99, firstRow: 0, lastRow: 1, firstCol: 0, lastCol: 1 }),
-    ],
-    ['SheetAutoFilterXmlResult', true, () => wb.getSheetAutoFilterXml(99)],
-    ['SheetPrintXmlResult', true, () => wb.getSheetPageSetupXml(99)],
-    ['SheetPrintAreaResult', true, () => wb.getSheetPrintArea(99)],
-    ['SheetPrintTitlesResult', true, () => wb.getSheetPrintTitles(99)],
-    // `getSheetRowBreaks` / `getSheetColBreaks` answer an out-of-range
-    // sheet with an empty list rather than an error, unlike every sibling
-    // print getter, so no failure path is reachable from here.
-    ['SheetPageBreaksResult', false, () => wb.getSheetRowBreaks(99)],
-    ['SheetPageSetupResult', true, () => wb.getSheetPageSetup(99)],
-    ['SheetPageMarginsResult', true, () => wb.getSheetPageMargins(99)],
-    ['NumberResult', true, () => wb.cellCount(99)],
-    // A released handle is the only failure path, which is not usable here.
-    ['PinnedNowResult', false, () => wb.pinnedNow()],
-    ['SpillInfo', true, () => wb.spillInfo(99, 0, 0)],
-  ];
-}
-
-test('every declared result type is probed for its key set', async () => {
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
-  const declared = resultTypesWithRequiredPayload(dts);
-  const probed = new Set(envelopeProbes({}).map(([name]) => name));
-  const unprobed = [...declared.keys()].filter((name) => !probed.has(name));
-  assert.deepEqual(unprobed, [], 'result types with no failure-path probe');
-  const stale = [...probed].filter((name) => !declared.has(name));
-  assert.deepEqual(stale, [], 'probes for result types that no longer declare a required payload');
-});
-
-test('result envelopes keep their declared keys on failure paths', async () => {
-  const Module = await getModule();
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
-  const declared = resultTypesWithRequiredPayload(dts);
-  const wb = Module.Workbook.createDefault();
-  try {
-    for (const [typeName, expectFailure, call] of envelopeProbes(wb)) {
-      const r = call();
-      if (expectFailure) {
-        assert.equal(r.status.ok, false, `${typeName}: probe was expected to fail`);
-      }
-      const missing = declared.get(typeName).filter((key) => !(key in r));
-      assert.deepEqual(missing, [], `${typeName} dropped declared keys`);
-    }
-  } finally {
-    wb.delete();
-  }
-});
-
-// ---- Pivot mutator marshalling -----------------------------------------
-//
-// Every pivot mutator is driven once against a small pivot and checked
-// through a read of the result -- the projected grid wherever the mutation
-// reaches it -- so an argument dropped, reordered or mis-converted on the
-// way to the C ABI shows up as a wrong grid rather than a green `.ok`. The
-// completeness test below keeps the table in step with the declaration
-// file.
-
-// Region / Product carry shared items and their records store item
-// indices; Amount and Date are plain numbers. Only Region is laid out, so
-// the baseline grid is two regions, their sums and the grand total.
-function buildPivot(mod) {
-  const wb = mod.Workbook.createDefault();
-  const must = (r, what) => {
-    const status = typeof r.ok === 'boolean' ? r : r.status;
-    assert.ok(status.ok, `${what}: ${JSON.stringify(status)}`);
-    return r;
-  };
-  const cacheId = must(wb.pivotCacheCreate(0), 'pivotCacheCreate').index;
-  must(wb.pivotCacheSetWorksheetSource(cacheId, { present: true, ref: 'A1:D5', sheet: 'Sheet1' }), 'source');
-  for (const name of ['Region', 'Product', 'Amount', 'Date']) must(wb.pivotCacheFieldAdd(cacheId, name), name);
-  for (const item of ['East', 'West']) must(wb.pivotCacheFieldAddSharedItemText(cacheId, 0, item), item);
-  for (const item of ['Apple', 'Pear']) must(wb.pivotCacheFieldAddSharedItemText(cacheId, 1, item), item);
-  for (const values of [
-    [0, 0, 10, 45292],
-    [1, 0, 30, 45323],
-    [0, 1, 5, 45658],
-    [1, 1, 7, 45689],
-  ]) {
-    const rec = must(wb.pivotCacheRecordAdd(cacheId), 'record').index;
-    for (const [field, v] of values.entries())
-      must(wb.pivotCacheRecordSetNumber(cacheId, rec, field, v), 'record value');
-  }
-  const pivot = must(wb.pivotCreate(0, 'Pivot1', cacheId, 0, 6), 'pivotCreate').index;
-  const addField = (spec) => must(wb.pivotFieldAdd(0, pivot, spec), spec.sourceName).index;
-  const region = addField({ sourceName: 'Region', axis: 0 });
-  must(wb.pivotFieldAddItem(0, pivot, region, 'East', true), 'item');
-  must(wb.pivotFieldAddItem(0, pivot, region, 'West', true), 'item');
-  const product = addField({ sourceName: 'Product', axis: 2 });
-  must(wb.pivotFieldAddItem(0, pivot, product, 'Apple', true), 'item');
-  must(wb.pivotFieldAddItem(0, pivot, product, 'Pear', true), 'item');
-  const amount = addField({ sourceName: 'Amount', axis: 2 });
-  const date = addField({ sourceName: 'Date', axis: 2 });
-  must(wb.pivotSetRowFieldOrder(0, pivot, [region]), 'row order');
-  must(wb.pivotDataFieldAdd(0, pivot, { name: 'Sum of Amount', fieldIndex: amount, aggregation: 0 }), 'data field');
-  return { wb, cacheId, pivot, region, product, amount, date };
-}
-
-// The projected grid as one `|`-joined string per sheet row.
-function pivotGrid(wb, pivot = 0) {
-  const layout = wb.pivotLayout(0, pivot);
-  assert.ok(layout.status.ok, JSON.stringify(layout.status));
-  const rows = new Map();
-  for (const cell of layout.cells) {
-    const v = cell.value;
-    const text = v.kind === 1 ? String(v.number) : v.kind === 3 ? v.text : v.kind === 4 ? `#${v.errorCode}` : '';
-    if (!rows.has(cell.row)) rows.set(cell.row, new Array(layout.cols).fill(''));
-    rows.get(cell.row)[cell.col - layout.left] = text;
-  }
-  return [...rows.keys()].sort((a, b) => a - b).map((row) => rows.get(row).join('|'));
-}
-
-const BASE_GRID = ['行ラベル|Sum of Amount', 'East|15', 'West|37', '総計|52'];
-const TWO_LEVEL_GRID = [
-  '行ラベル|Sum of Amount',
-  'Apple|10',
-  'Pear|5',
-  'East|15',
-  'Apple|30',
-  'Pear|7',
-  'West|37',
-  '総計|52',
-];
-const DATE_SERIAL_GRID = ['行ラベル|Sum of Amount', '45292|10', '45323|30', '45658|5', '45689|7', '総計|52'];
-const twoLevels = (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.region, b.product]);
-const dateRows = (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.date]);
-const hideEast = (b) => b.wb.pivotFieldSetItemVisible(0, b.pivot, b.region, 0, false);
-const WEST_ONLY = ['行ラベル|Sum of Amount', 'West|37', '総計|37'];
-const GREATER_THAN_20 = Object.freeze({ axis: 0, fieldName: 'Region', type: 1, valueKind: 1, valueDouble: 20 });
-const BETWEEN_10_20 = Object.freeze({
-  axis: 0,
-  fieldName: 'Region',
-  type: 2,
-  valueKind: 1,
-  valueDouble: 10,
-  valueHighKind: 1,
-  valueHighDouble: 20,
-});
-// Points record 0's Region at the shared item a row has just appended.
-const pointAtNewItem = (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 0, 2);
-
-// The raw text of one stored part of a saved package.
-function packagePart(bytes, name) {
-  const buf = Buffer.from(bytes);
-  let eocd = buf.length - 22;
-  while (eocd >= 0 && buf.readUInt32LE(eocd) !== 0x06054b50) eocd -= 1;
-  assert.ok(eocd >= 0, 'missing ZIP end record');
-  let at = buf.readUInt32LE(eocd + 16);
-  for (let i = buf.readUInt16LE(eocd + 10); i > 0; i -= 1) {
-    const method = buf.readUInt16LE(at + 10);
-    const size = buf.readUInt32LE(at + 20);
-    const nameLen = buf.readUInt16LE(at + 28);
-    const next = at + 46 + nameLen + buf.readUInt16LE(at + 30) + buf.readUInt16LE(at + 32);
-    if (buf.toString('utf8', at + 46, at + 46 + nameLen) === name) {
-      const local = buf.readUInt32LE(at + 42);
-      const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
-      const raw = buf.subarray(start, start + size);
-      return (method === 0 ? raw : inflateRawSync(raw)).toString('utf8');
-    }
-    at = next;
-  }
-  assert.fail(`${name} not in the package`);
-}
-
-// [method, { setup, act, after, expect }]. `act` performs the one call
-// under test; `expect` reads the result back.
-const PIVOT_MUTATORS = [
-  [
-    'pivotCacheCreate',
-    {
-      act: (b) => b.wb.pivotCacheCreate(77),
-      expect: (b, r) => {
-        assert.equal(r.index, 77);
-        assert.equal(b.wb.pivotCacheCount().value, 2);
-      },
-    },
-  ],
-  ['pivotCacheIdAt', { act: (b) => b.wb.pivotCacheIdAt(0), expect: (b, r) => assert.equal(r.index, b.cacheId) }],
-  [
-    'pivotCacheRemove',
-    {
-      setup: (b) => {
-        b.spare = b.wb.pivotCacheCreate(0).index;
-      },
-      act: (b) => b.wb.pivotCacheRemove(b.spare),
-      expect: (b) => {
-        assert.equal(b.wb.pivotCacheCount().value, 1);
-        assert.equal(b.wb.pivotCacheIdAt(0).index, b.cacheId);
-      },
-    },
-  ],
-  [
-    'pivotCacheSetWorksheetSource',
-    {
-      act: (b) => b.wb.pivotCacheSetWorksheetSource(b.cacheId, { present: true, ref: 'B2:E6', sheet: 'Data' }),
-      expect: (b) => {
-        const source = b.wb.pivotCacheGetWorksheetSource(b.cacheId);
-        assert.equal(source.ref, 'B2:E6');
-        assert.equal(source.sheet, 'Data');
-        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotCacheFieldAdd',
-    {
-      act: (b) => b.wb.pivotCacheFieldAdd(b.cacheId, 'Extra'),
-      expect: (b, r) => {
-        assert.equal(r.index, 4);
-        assert.equal(b.wb.pivotCacheFieldName(b.cacheId, 4).value, 'Extra');
-      },
-    },
-  ],
-  [
-    'pivotCacheFieldClear',
-    {
-      act: (b) => b.wb.pivotCacheFieldClear(b.cacheId),
-      expect: (b) => {
-        assert.equal(b.wb.pivotCacheFieldCount(b.cacheId).value, 0);
-        // The data field now names a cache field that no longer exists.
-        assert.equal(b.wb.pivotLayout(0, b.pivot).status.ok, false);
-      },
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemNumber',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemNumber(b.cacheId, 0, 42.5),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '42.5|10', 'East|5', 'West|37', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemText',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemText(b.cacheId, 0, 'North'),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'North|10', 'West|37', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemBool',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemBool(b.cacheId, 0, true),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', 'TRUE|10', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemBlank',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemBlank(b.cacheId, 0),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '(空白)|10', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldAddSharedItemError',
-    {
-      act: (b) => b.wb.pivotCacheFieldAddSharedItemError(b.cacheId, 0, 6),
-      after: pointAtNewItem,
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '#N/A|10', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheFieldClearSharedItems',
-    {
-      act: (b) => b.wb.pivotCacheFieldClearSharedItems(b.cacheId, 0),
-      // With no shared items the records' indices render as themselves.
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '0|15', '1|37', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheRecordAdd',
-    {
-      act: (b) => b.wb.pivotCacheRecordAdd(b.cacheId),
-      expect: (b, r) => {
-        assert.equal(r.index, 4);
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|15', 'West|37', '(空白)|0', '総計|52']);
-      },
-    },
-  ],
-  [
-    'pivotCacheRecordClear',
-    {
-      act: (b) => b.wb.pivotCacheRecordClear(b.cacheId),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '総計|0']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetNumber',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 2, 1000),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|1005', 'West|37', '総計|1042']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetText',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetText(b.cacheId, 0, 0, 'West'),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|47', '総計|52']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetBool',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetBool(b.cacheId, 0, 2, true),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|6', 'West|37', '総計|43']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetBlank',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetBlank(b.cacheId, 0, 2),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '総計|42']),
-    },
-  ],
-  [
-    'pivotCacheRecordSetError',
-    {
-      act: (b) => b.wb.pivotCacheRecordSetError(b.cacheId, 0, 2, 1),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|#1', 'West|37', '総計|#1']),
-    },
-  ],
-  [
-    'pivotCreate',
-    {
-      act: (b) => b.wb.pivotCreate(0, 'Pivot2', b.cacheId, 20, 1),
-      expect: (b, r) => {
-        assert.equal(r.index, 1);
-        const layout = b.wb.pivotLayout(0, 1);
-        assert.equal(layout.top, 20);
-        assert.equal(layout.left, 1);
-        assert.deepEqual(pivotGrid(b.wb, 0), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotRemove',
-    {
-      act: (b) => b.wb.pivotRemove(0, b.pivot),
-      expect: (b) => {
-        assert.equal(b.wb.pivotCount(0).value, 0);
-        assert.equal(b.wb.pivotLayout(0, 0).status.ok, false);
-      },
-    },
-  ],
-  [
-    'pivotSetName',
-    {
-      act: (b) => b.wb.pivotSetName(0, b.pivot, 'Renamed'),
-      // A pivot's name is only observable in the part the writer emits.
-      expect: (b) => {
-        const saved = b.wb.save();
-        assert.ok(saved.status.ok, JSON.stringify(saved.status));
-        assert.match(
-          packagePart(saved.bytes, 'xl/pivotTables/pivotTable1.xml'),
-          /<pivotTableDefinition [^>]*name="Renamed"/,
-        );
-      },
-    },
-  ],
-  [
-    'pivotSetAnchor',
-    {
-      act: (b) => b.wb.pivotSetAnchor(0, b.pivot, 10, 2, 4, 2),
-      expect: (b) => {
-        const layout = b.wb.pivotLayout(0, b.pivot);
-        assert.equal(layout.top, 10);
-        assert.equal(layout.left, 2);
-        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotSetGrandTotals',
-    {
-      setup: (b) => b.wb.pivotSetColFieldOrder(0, b.pivot, [b.product]),
-      // Rows off drops the per-row total column; columns on keeps the
-      // bottom total row, so a swapped pair would show the opposite.
-      act: (b) => b.wb.pivotSetGrandTotals(0, b.pivot, false, true),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), [
-          'Sum of Amount|列ラベル|',
-          '行ラベル|Apple|Pear',
-          'East|10|5',
-          'West|30|7',
-          '総計|40|12',
-        ]),
-    },
-  ],
-  [
-    'pivotSetLayout',
-    {
-      act: (b) => b.wb.pivotSetLayout(0, b.pivot, 1),
-      expect: (b) => {
-        assert.equal(b.wb.pivotGetLayout(0, b.pivot).layout, 1);
-        assert.deepEqual(pivotGrid(b.wb), ['Region|Sum of Amount', 'East|15', 'West|37', '総計|52']);
-      },
-    },
-  ],
-  [
-    'pivotFieldAdd',
-    {
-      act: (b) => b.wb.pivotFieldAdd(0, b.pivot, { sourceName: 'Product', customName: 'Fruit', axis: 3 }),
-      expect: (b, r) => {
-        assert.equal(r.index, 4);
-        assert.deepEqual(pivotGrid(b.wb), ['Fruit|(すべて)', '|', ...BASE_GRID]);
-      },
-    },
-  ],
-  [
-    'pivotFieldClear',
-    {
-      setup: hideEast,
-      act: (b) => b.wb.pivotFieldClear(0, b.pivot),
-      expect: (b) => {
-        assert.equal(b.wb.pivotFieldCount(0, b.pivot).value, 0);
-        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotFieldSetAxis',
-    {
-      act: (b) => b.wb.pivotFieldSetAxis(0, b.pivot, b.product, 3),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['Product|(すべて)', '|', ...BASE_GRID]),
-    },
-  ],
-  [
-    'pivotFieldSetSort',
-    {
-      // East now outsums West, so sorting ascending by the data field
-      // differs from both label orders.
-      setup: (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 2, 40),
-      act: (b) => b.wb.pivotFieldSetSort(0, b.pivot, b.region, true, 'Sum of Amount'),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'West|37', 'East|45', '総計|82']),
-    },
-  ],
-  [
-    'pivotFieldSetSubtotalTop',
-    {
-      setup: twoLevels,
-      act: (b) => b.wb.pivotFieldSetSubtotalTop(0, b.pivot, b.region, true),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), [
-          '行ラベル|Sum of Amount',
-          'East|15',
-          'Apple|10',
-          'Pear|5',
-          'West|37',
-          'Apple|30',
-          'Pear|7',
-          '総計|52',
-        ]),
-    },
-  ],
-  [
-    'pivotFieldAddItem',
-    {
-      act: (b) => b.wb.pivotFieldAddItem(0, b.pivot, b.region, 'East', false),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
-    },
-  ],
-  [
-    'pivotFieldAddItemAt',
-    {
-      // Only the index-addressed form can name the blank item.
-      setup: (b) => {
-        b.wb.pivotCacheFieldAddSharedItemBlank(b.cacheId, 0);
-        b.wb.pivotCacheRecordSetBlank(b.cacheId, 0, 0);
-      },
-      act: (b) => b.wb.pivotFieldAddItemAt(0, b.pivot, b.region, 2, false),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '総計|42']),
-    },
-  ],
-  [
-    'pivotFieldClearItems',
-    {
-      setup: hideEast,
-      act: (b) => b.wb.pivotFieldClearItems(0, b.pivot, b.region),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), BASE_GRID),
-    },
-  ],
-  [
-    'pivotFieldSetItemVisible',
-    {
-      act: (b) => b.wb.pivotFieldSetItemVisible(0, b.pivot, b.region, 1, false),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|15', '総計|15']),
-    },
-  ],
-  [
-    'pivotFieldAddSubtotalFn',
-    {
-      setup: twoLevels,
-      act: (b) => b.wb.pivotFieldAddSubtotalFn(0, b.pivot, b.region, 3),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), [
-          '行ラベル|Sum of Amount',
-          'Apple|10',
-          'Pear|5',
-          'East|10',
-          'Apple|30',
-          'Pear|7',
-          'West|30',
-          '総計|52',
-        ]),
-    },
-  ],
-  [
-    'pivotFieldClearSubtotalFns',
-    {
-      setup: (b) => {
-        twoLevels(b);
-        b.wb.pivotFieldAddSubtotalFn(0, b.pivot, b.region, 3);
-      },
-      act: (b) => b.wb.pivotFieldClearSubtotalFns(0, b.pivot, b.region),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), TWO_LEVEL_GRID),
-    },
-  ],
-  [
-    'pivotFieldSetDateGroup',
-    {
-      setup: dateRows,
-      act: (b) => b.wb.pivotFieldSetDateGroup(0, b.pivot, b.date, 3, 1, -1, -1),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '令和6年|40', '令和7年|12', '総計|52']),
-    },
-  ],
-  [
-    'pivotFieldClearDateGroup',
-    {
-      setup: (b) => {
-        dateRows(b);
-        b.wb.pivotFieldSetDateGroup(0, b.pivot, b.date, 3, 0, -1, -1);
-      },
-      act: (b) => b.wb.pivotFieldClearDateGroup(0, b.pivot, b.date),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), DATE_SERIAL_GRID),
-    },
-  ],
-  [
-    'pivotFieldSetNumberFormat',
-    {
-      act: (b) => b.wb.pivotFieldSetNumberFormat(0, b.pivot, b.amount, '4'),
-      // A field's numFmtId is only observable in the part the writer emits.
-      expect: (b) => {
-        assert.equal(b.wb.pivotFieldSetNumberFormat(0, b.pivot, 99, '4').status, 2);
-        assert.equal(b.wb.pivotFieldSetNumberFormat(0, b.pivot, b.amount, '0.00').status, 2);
-        const saved = b.wb.save();
-        assert.ok(saved.status.ok, JSON.stringify(saved.status));
-        assert.match(packagePart(saved.bytes, 'xl/pivotTables/pivotTable1.xml'), /<pivotField [^>]*numFmtId="4"/);
-        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
-      },
-    },
-  ],
-  [
-    'pivotSetRowFieldOrder',
-    {
-      act: (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.product]),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'Apple|40', 'Pear|12', '総計|52']),
-    },
-  ],
-  [
-    'pivotSetColFieldOrder',
-    {
-      act: (b) => b.wb.pivotSetColFieldOrder(0, b.pivot, [b.product]),
-      expect: (b) =>
-        assert.deepEqual(pivotGrid(b.wb), [
-          'Sum of Amount|列ラベル||',
-          '行ラベル|Apple|Pear|総計',
-          'East|10|5|15',
-          'West|30|7|37',
-          '総計|40|12|52',
-        ]),
-    },
-  ],
-  [
-    'pivotDataFieldAdd',
-    {
-      act: (b) => b.wb.pivotDataFieldAdd(0, b.pivot, { name: 'Max of Amount', fieldIndex: b.amount, aggregation: 3 }),
-      expect: (b, r) => {
-        assert.equal(r.index, 1);
-        assert.deepEqual(pivotGrid(b.wb), [
-          '行ラベル|Sum of Amount|Max of Amount',
-          'East|15|10',
-          'West|37|30',
-          '総計|52|30',
-        ]);
-      },
-    },
-  ],
-  [
-    'pivotDataFieldClear',
-    {
-      act: (b) => b.wb.pivotDataFieldClear(0, b.pivot),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル', 'East', 'West', '総計']),
-    },
-  ],
-  [
-    'pivotDataFieldSet',
-    {
-      act: (b) =>
-        b.wb.pivotDataFieldSet(0, b.pivot, 0, {
-          name: 'Count of Amount',
-          fieldIndex: b.amount,
-          aggregation: 1,
-          numberFormat: '2',
-        }),
-      expect: (b) => {
-        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Count of Amount', 'East|2', 'West|2', '総計|4']);
-        const counts = b.wb.pivotLayout(0, b.pivot).cells.filter((c) => c.value.kind === 1);
-        assert.deepEqual(
-          counts.map((c) => c.numberFormat),
-          ['2', '2', '2'],
-        );
-      },
-    },
-  ],
-  [
-    'pivotFilterAdd',
-    {
-      act: (b) => b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
-    },
-  ],
-  [
-    'pivotFilterClear',
-    {
-      setup: (b) => b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20),
-      act: (b) => b.wb.pivotFilterClear(0, b.pivot),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), BASE_GRID),
-    },
-  ],
-  [
-    'pivotFilterRemoveAt',
-    {
-      // Each filter alone keeps a different region, so removing the wrong
-      // index leaves the wrong one.
-      setup: (b) => {
-        b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20);
-        b.wb.pivotFilterAdd(0, b.pivot, BETWEEN_10_20);
-      },
-      act: (b) => b.wb.pivotFilterRemoveAt(0, b.pivot, 1),
-      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
-    },
-  ],
-];
-
-test('the pivot mutator table covers every declared pivot mutator', async () => {
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
-  const declared = [...dts.matchAll(/^ {2}(pivot\w*)\([^)]*\): (?:Status|AddStyleResult);/gm)].map((m) => m[1]);
-  assert.ok(declared.length > 40, `expected the pivot mutator family, found ${declared.length}`);
-  const covered = PIVOT_MUTATORS.map(([name]) => name);
-  assert.deepEqual(
-    declared.filter((name) => !covered.includes(name)),
-    [],
-    'pivot mutators without a row',
-  );
-  assert.deepEqual(
-    covered.filter((name) => !declared.includes(name)),
-    [],
-    'rows for methods that are not declared pivot mutators',
-  );
-});
-
-test('pivot mutators forward their arguments to the C ABI', async () => {
-  const mod = await getModule();
-  const base = buildPivot(mod);
-  try {
-    assert.deepEqual(pivotGrid(base.wb), BASE_GRID);
-  } finally {
-    base.wb.delete();
-  }
-  for (const [name, row] of PIVOT_MUTATORS) {
-    const b = buildPivot(mod);
-    try {
-      row.setup?.(b);
-      const r = row.act(b);
-      const status = typeof r.ok === 'boolean' ? r : r.status;
-      assert.ok(status.ok, `${name}: ${JSON.stringify(status)}`);
-      row.after?.(b);
-      row.expect(b, r);
-    } catch (err) {
-      err.message = `${name}: ${err.message}`;
-      throw err;
-    } finally {
-      b.wb.delete();
-    }
-  }
-});
-
-// ---- Status on the fallible accessors ----------------------------------
-//
-// Every accessor backed by a status-returning C ABI call carries that
-// status, so a rejected argument or a released handle cannot read as a
-// legitimate zero count, empty name, or unspilled cell. Each row is
-// [method, args that succeed, args the engine rejects (or null when only
-// a released handle can fail it)].
-const STATUS_ACCESSORS = [
-  ['sheetCount', [], null],
-  ['cellCount', [0], [99]],
-  ['definedNameCount', [], null],
-  ['tableCount', [], null],
-  ['passthroughCount', [], null],
-  ['pivotCount', [0], [99]],
-  ['pivotCacheCount', [], null],
-  ['pivotCacheFieldCount', null, [9999]],
-  ['pivotCacheFieldSharedItemCount', null, [9999, 0]],
-  ['pivotCacheRecordCount', null, [9999]],
-  ['pivotFieldCount', null, [99, 0]],
-  ['pivotDataFieldCount', null, [99, 0]],
-  ['pivotFilterCount', null, [99, 0]],
-  ['fontCount', [], null],
-  ['fillCount', [], null],
-  ['borderCount', [], null],
-  ['xfCount', [], null],
-  ['dxfCount', [], null],
-  ['cellStyleCount', [], null],
-  ['cellStyleXfCount', [], null],
-  ['calcMode', [], null],
-  ['excelProfileId', [], null],
-  ['localizeFunctionName', ['SUM', 0], ['NOPE_XYZ', 0]],
-  ['canonicalizeFunctionName', ['SUM', 0], ['NOPE_XYZ', 0]],
-  ['pinnedNow', [], null],
-  ['spillInfo', [0, 0, 0], [99, 0, 0]],
-  ['precedents', [0, 0, 0, 1], [99, 0, 0, 1]],
-  ['dependents', [0, 0, 0, 1], [99, 0, 0, 1]],
-  ['functionNames', [], null],
-];
-
-// The payload a failed call must fall back to, keyed by what it returns.
-function assertFailurePayload(name, r) {
-  if (Array.isArray(r)) assert.equal(r.length, 0, name);
-  else if ('now' in r) assert.equal(r.now, null, name);
-  else if ('engaged' in r) assert.equal(r.engaged, false, name);
-  else if (typeof r.value === 'string') assert.equal(r.value, '', name);
-  else assert.equal(r.value, 0, name);
-}
-
-test('every NumberResult accessor is covered by the status table', async () => {
-  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
-  const declared = [...dts.matchAll(/^ {2}([A-Za-z]\w*)\([^)]*\): NumberResult\b/gm)].map((m) => m[1]);
-  const covered = new Set(STATUS_ACCESSORS.map(([name]) => name));
-  assert.deepEqual(
-    declared.filter((name) => !covered.has(name)),
-    [],
-    'NumberResult accessors missing from STATUS_ACCESSORS',
-  );
-});
-
-test('fallible accessors report their status on success, rejection and a released handle', async () => {
-  const mod = await getModule();
-  const wb = mod.Workbook.createDefault();
-  for (const [name, okArgs, badArgs] of STATUS_ACCESSORS) {
-    if (okArgs !== null) {
-      const r = wb[name](...okArgs);
-      assert.ok(r.status.ok, `${name}: ${JSON.stringify(r.status)}`);
-    }
-    if (badArgs !== null) {
-      const r = wb[name](...badArgs);
-      assert.equal(r.status.ok, false, `${name} must report the rejected arguments`);
-      assert.notEqual(r.status.status, 0, name);
-      assertFailurePayload(name, r);
-    }
-  }
-  assert.equal(wb.sheetCount().value, 1);
-  assert.equal(wb.excelProfileId().value, 'win-365-ja_JP');
-  assert.equal(wb.localizeFunctionName('SUM', 1).value, 'SUM');
-  assert.equal(wb.localizeFunctionName('SUM', 99).status.ok, false);
-
-  wb.delete();
-  // `delete()` detaches the embind wrapper outright; a failed load is the
-  // wrapper that outlives its handle on this surface.
-  const dead = mod.Workbook.loadBytes(new Uint8Array([0]));
-  assert.equal(dead.isValid(), false);
-  // Every accessor, including the ones no argument can fail, reports the
-  // released handle instead of a default reading.
-  for (const [name, okArgs, badArgs] of STATUS_ACCESSORS) {
-    if (name.endsWith('FunctionName') || name === 'functionNames') continue;
-    const r = dead[name](...(okArgs ?? badArgs));
-    assert.equal(r.status.ok, false, `${name} after release`);
-    assert.equal(r.status.status, 7000, name);
-    assertFailurePayload(name, r);
-  }
-  dead.delete();
-});
-
-test('iterative progress callbacks are per Workbook, not per module', async () => {
-  const Module = await getModule();
-  const first = makeIterativeWorkbook(Module);
-  const second = makeIterativeWorkbook(Module);
-  try {
-    let firstCalls = 0;
-    let secondCalls = 0;
-    assert.ok(
-      first.setIterativeProgress(() => {
-        firstCalls += 1;
-        return true;
-      }).ok,
-    );
-    // Installing on `second` must not displace the registration on `first`.
-    assert.ok(
-      second.setIterativeProgress(() => {
-        secondCalls += 1;
-        return true;
-      }).ok,
-    );
-
-    assert.ok(first.recalc().ok);
-    assert.ok(firstCalls > 0, 'the first workbook kept its own callback');
-    assert.equal(secondCalls, 0);
-
-    firstCalls = 0;
-    assert.ok(second.recalc().ok);
-    assert.ok(secondCalls > 0);
-    assert.equal(firstCalls, 0);
-  } finally {
-    first.setIterativeProgress(null);
-    second.setIterativeProgress(null);
-    first.delete();
-    second.delete();
-  }
-});
-
-// ---- Sheet-annotation surfaces -----------------------------------------
-//
-// Conditional formats, data validations, merges, comments and hyperlinks
-// are declared in dist/formulon.d.ts and reach the engine through the same
-// staged bundle as the calc core, so a staging or binding fault in any of
-// them is invisible to the cases above.
-
-// `CfValueObjectInput.type`: 0 num, 1 percent, 2 percentile, 3 min,
-// 4 max, 5 formula, 6 autoMin, 7 autoMax.
-const COLOR_SCALE_RULE = Object.freeze({
-  sqref: [{ firstRow: 0, firstCol: 0, lastRow: 4, lastCol: 0 }],
-  type: 2,
-  colorScale: {
-    thresholds: [
-      { type: 0, value: '0' },
-      { type: 1, value: '50' },
-      { type: 0, value: '100' },
-    ],
-    colors: [
-      { r: 248, g: 105, b: 107, a: 255 },
-      { r: 255, g: 235, b: 132, a: 255 },
-      { r: 99, g: 190, b: 123, a: 255 },
-    ],
-  },
-});
-
-const DATA_BAR_RULE = Object.freeze({
-  sqref: [{ firstRow: 0, firstCol: 1, lastRow: 4, lastCol: 1 }],
-  type: 3,
-  dataBar: {
-    min: { type: 0, value: '5' },
-    max: { type: 0, value: '95' },
-    fill: { r: 0, g: 112, b: 192, a: 255 },
-  },
-});
-
-const ICON_SET_RULE = Object.freeze({
-  sqref: [{ firstRow: 0, firstCol: 2, lastRow: 4, lastCol: 2 }],
-  type: 4,
-  iconSet: {
-    name: 0,
-    thresholds: [
-      { type: 1, value: '0' },
-      { type: 1, value: '33' },
-      { type: 1, value: '67' },
-    ],
-  },
-});
-
-// The threshold value strings, in rule order, as one flat list. Each one
-// is handed to the C ABI as a borrowed `const char*`, so a store that
-// relocates while the later thresholds are pulled publishes a pointer to
-// freed bytes and the strings come back wrong (or empty).
-function cfvoValues(rules) {
-  const byType = new Map(rules.map((rule) => [rule.type, rule]));
-  const colorScale = byType.get(2);
-  const dataBar = byType.get(3);
-  const iconSet = byType.get(4);
-  assert.ok(colorScale?.colorScale, 'colorScale payload missing');
-  assert.ok(dataBar?.dataBar, 'dataBar payload missing');
-  assert.ok(iconSet?.iconSet, 'iconSet payload missing');
-  return [
-    ...colorScale.colorScale.thresholds.map((t) => t.value),
-    dataBar.dataBar.min.value,
-    dataBar.dataBar.max.value,
-    ...iconSet.iconSet.thresholds.map((t) => t.value),
-  ];
-}
-
-const EXPECTED_CFVO_VALUES = Object.freeze(['0', '50', '100', '5', '95', '0', '33', '67']);
-
-test('CFVO value strings survive getConditionalFormats and a save/load cycle', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  let bytes;
-  try {
-    assert.equal(wb.getConditionalFormats(0).length, 0);
-    for (const rule of [COLOR_SCALE_RULE, DATA_BAR_RULE, ICON_SET_RULE]) {
-      const added = wb.addConditionalFormat(0, rule);
-      assert.ok(added.status.ok, `addConditionalFormat type=${rule.type}: ${JSON.stringify(added.status)}`);
-    }
-
-    const inSession = wb.getConditionalFormats(0);
-    assert.ok(inSession.status.ok, JSON.stringify(inSession.status));
-    assert.equal(inSession.length, 3);
-    assert.deepEqual(cfvoValues(inSession), EXPECTED_CFVO_VALUES);
-    // The threshold types travel with the values; a type read back as 0
-    // would make a percent threshold mean an absolute number.
-    const byType = new Map(inSession.map((rule) => [rule.type, rule]));
-    assert.deepEqual(
-      byType.get(2).colorScale.thresholds.map((t) => t.type),
-      [0, 1, 0],
-    );
-    assert.deepEqual(
-      byType.get(4).iconSet.thresholds.map((t) => t.type),
-      [1, 1, 1],
-    );
-    assert.equal(byType.get(2).colorScale.colors.length, 3);
-    assert.equal(byType.get(2).colorScale.colors[2].g, 190);
-    assert.equal(byType.get(3).dataBar.fill.b, 192);
-
-    const saved = wb.save();
-    assert.ok(saved.status.ok, JSON.stringify(saved.status));
-    bytes = saved.bytes;
-  } finally {
-    wb.delete();
-  }
-
-  const reloaded = Module.Workbook.loadBytes(bytes);
-  try {
-    const rules = reloaded.getConditionalFormats(0);
-    assert.equal(rules.length, 3);
-    assert.deepEqual(cfvoValues(rules), EXPECTED_CFVO_VALUES);
-  } finally {
-    reloaded.delete();
-  }
-});
-
-test('addValidation defaults every omitted boolean to false', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  try {
-    // A list rule stating only what it needs: the booleans are left out
-    // so the binding's own defaults are what is read back.
-    assert.ok(
-      wb.addValidation(0, {
-        ranges: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
-        type: 3,
-        formula1: '"Yes,No"',
-      }).ok,
-    );
-    const rules = wb.getValidations(0);
-    assert.ok(rules.status.ok, JSON.stringify(rules.status));
-    assert.equal(rules.length, 1);
-    const rule = rules[0];
-    assert.equal(typeof rule.allowBlank, 'boolean');
-    assert.equal(rule.allowBlank, false);
-    assert.equal(rule.showInputMessage, false);
-    assert.equal(rule.showErrorMessage, false);
-    // `showDropDown` is the documented exception: absent means the
-    // in-cell arrow is shown, which is what Excel does.
-    assert.equal(rule.showDropDown, true);
-    assert.equal(rule.type, 3);
-    assert.equal(rule.op, 0);
-    assert.equal(rule.errorStyle, 0);
-    assert.equal(rule.formula1, '"Yes,No"');
-    assert.equal(rule.formula2, '');
-    assert.equal(rule.ranges.length, 1);
-    assert.equal(rule.ranges[0].lastRow, 2);
-
-    // An explicit `true` is not overwritten by the default.
-    assert.ok(wb.addValidation(0, { type: 3, allowBlank: true, formula1: '"A,B"' }).ok);
-    assert.equal(wb.getValidations(0)[1].allowBlank, true);
-  } finally {
-    wb.delete();
-  }
-});
-
-test('merges, comments and hyperlinks round-trip through save and load', async () => {
-  const Module = await getModule();
-  const wb = Module.Workbook.createDefault();
-  let bytes;
-  try {
-    assert.ok(wb.setText(0, 0, 0, '見出し').ok);
-    assert.ok(wb.addMerge(0, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 3 }).ok);
-    assert.ok(wb.setComment(0, 2, 1, '校閲者', '要確認').ok);
-    assert.ok(wb.addHyperlink(0, 3, 0, 'https://example.com/', '例', 'ツールチップ', '').ok);
-
-    const merges = wb.getMerges(0);
-    assert.ok(merges.status.ok, JSON.stringify(merges.status));
-    assert.equal(merges.length, 1);
-    assert.equal(merges[0].lastCol, 3);
-
-    const comment = wb.getCommentResult(0, 2, 1);
-    assert.ok(comment.status.ok, JSON.stringify(comment.status));
-    assert.equal(comment.comment.author, '校閲者');
-    assert.equal(comment.comment.text, '要確認');
-    // An absent comment and an unreadable sheet both answer with a null
-    // comment, and are told apart by the status they carry.
-    const none = wb.getCommentResult(0, 9, 9);
-    assert.equal(none.status.ok, false);
-    assert.equal(none.comment, null);
-    const badSheet = wb.getCommentResult(99, 0, 0);
-    assert.equal(badSheet.status.ok, false);
-    assert.equal(badSheet.comment, null);
-    assert.notEqual(none.status.status, badSheet.status.status);
-
-    const saved = wb.save();
-    assert.ok(saved.status.ok, JSON.stringify(saved.status));
-    bytes = saved.bytes;
-  } finally {
-    wb.delete();
-  }
-
-  const reloaded = Module.Workbook.loadBytes(bytes);
-  try {
-    assert.equal(reloaded.getMerges(0).length, 1);
-    assert.equal(reloaded.getMerges(0)[0].lastCol, 3);
-
-    const comments = reloaded.getComments(0);
-    assert.ok(comments.status.ok, JSON.stringify(comments.status));
-    assert.equal(comments.length, 1);
-    assert.equal(comments[0].row, 2);
-    assert.equal(comments[0].col, 1);
-    assert.equal(comments[0].text, '要確認');
-
-    const links = reloaded.getHyperlinks(0);
-    assert.ok(links.status.ok, JSON.stringify(links.status));
-    assert.equal(links.length, 1);
-    assert.equal(links[0].row, 3);
-    assert.equal(links[0].target, 'https://example.com/');
-    assert.equal(links[0].tooltip, 'ツールチップ');
-  } finally {
-    reloaded.delete();
-  }
-});
+import './smoke_surface_log_eval.mjs';
+import './smoke_print_recalc_callbacks.mjs';
+import './smoke_result_contracts.mjs';
+import './smoke_pivot_mutators_status.mjs';
+import './smoke_cf_validation_roundtrip.mjs';
diff --git a/packages/npm/test/smoke_cf_validation_roundtrip.mjs b/packages/npm/test/smoke_cf_validation_roundtrip.mjs
new file mode 100644
index 000000000..e6b714d57
--- /dev/null
+++ b/packages/npm/test/smoke_cf_validation_roundtrip.mjs
@@ -0,0 +1,219 @@
+import test from 'node:test';
+import { assert, getModule } from './smoke_support.mjs';
+
+// ---- Sheet-annotation surfaces -----------------------------------------
+//
+// Conditional formats, data validations, merges, comments and hyperlinks
+// are declared in dist/formulon.d.ts and reach the engine through the same
+// staged bundle as the calc core, so a staging or binding fault in any of
+// them is invisible to the cases above.
+
+// `CfValueObjectInput.type`: 0 num, 1 percent, 2 percentile, 3 min,
+// 4 max, 5 formula, 6 autoMin, 7 autoMax.
+const COLOR_SCALE_RULE = Object.freeze({
+  sqref: [{ firstRow: 0, firstCol: 0, lastRow: 4, lastCol: 0 }],
+  type: 2,
+  colorScale: {
+    thresholds: [
+      { type: 0, value: '0' },
+      { type: 1, value: '50' },
+      { type: 0, value: '100' },
+    ],
+    colors: [
+      { r: 248, g: 105, b: 107, a: 255 },
+      { r: 255, g: 235, b: 132, a: 255 },
+      { r: 99, g: 190, b: 123, a: 255 },
+    ],
+  },
+});
+
+const DATA_BAR_RULE = Object.freeze({
+  sqref: [{ firstRow: 0, firstCol: 1, lastRow: 4, lastCol: 1 }],
+  type: 3,
+  dataBar: {
+    min: { type: 0, value: '5' },
+    max: { type: 0, value: '95' },
+    fill: { r: 0, g: 112, b: 192, a: 255 },
+  },
+});
+
+const ICON_SET_RULE = Object.freeze({
+  sqref: [{ firstRow: 0, firstCol: 2, lastRow: 4, lastCol: 2 }],
+  type: 4,
+  iconSet: {
+    name: 0,
+    thresholds: [
+      { type: 1, value: '0' },
+      { type: 1, value: '33' },
+      { type: 1, value: '67' },
+    ],
+  },
+});
+
+// The threshold value strings, in rule order, as one flat list. Each one
+// is handed to the C ABI as a borrowed `const char*`, so a store that
+// relocates while the later thresholds are pulled publishes a pointer to
+// freed bytes and the strings come back wrong (or empty).
+function cfvoValues(rules) {
+  const byType = new Map(rules.map((rule) => [rule.type, rule]));
+  const colorScale = byType.get(2);
+  const dataBar = byType.get(3);
+  const iconSet = byType.get(4);
+  assert.ok(colorScale?.colorScale, 'colorScale payload missing');
+  assert.ok(dataBar?.dataBar, 'dataBar payload missing');
+  assert.ok(iconSet?.iconSet, 'iconSet payload missing');
+  return [
+    ...colorScale.colorScale.thresholds.map((t) => t.value),
+    dataBar.dataBar.min.value,
+    dataBar.dataBar.max.value,
+    ...iconSet.iconSet.thresholds.map((t) => t.value),
+  ];
+}
+
+const EXPECTED_CFVO_VALUES = Object.freeze(['0', '50', '100', '5', '95', '0', '33', '67']);
+
+test('CFVO value strings survive getConditionalFormats and a save/load cycle', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  let bytes;
+  try {
+    assert.equal(wb.getConditionalFormats(0).length, 0);
+    for (const rule of [COLOR_SCALE_RULE, DATA_BAR_RULE, ICON_SET_RULE]) {
+      const added = wb.addConditionalFormat(0, rule);
+      assert.ok(added.status.ok, `addConditionalFormat type=${rule.type}: ${JSON.stringify(added.status)}`);
+    }
+
+    const inSession = wb.getConditionalFormats(0);
+    assert.ok(inSession.status.ok, JSON.stringify(inSession.status));
+    assert.equal(inSession.length, 3);
+    assert.deepEqual(cfvoValues(inSession), EXPECTED_CFVO_VALUES);
+    // The threshold types travel with the values; a type read back as 0
+    // would make a percent threshold mean an absolute number.
+    const byType = new Map(inSession.map((rule) => [rule.type, rule]));
+    assert.deepEqual(
+      byType.get(2).colorScale.thresholds.map((t) => t.type),
+      [0, 1, 0],
+    );
+    assert.deepEqual(
+      byType.get(4).iconSet.thresholds.map((t) => t.type),
+      [1, 1, 1],
+    );
+    assert.equal(byType.get(2).colorScale.colors.length, 3);
+    assert.equal(byType.get(2).colorScale.colors[2].g, 190);
+    assert.equal(byType.get(3).dataBar.fill.b, 192);
+
+    const saved = wb.save();
+    assert.ok(saved.status.ok, JSON.stringify(saved.status));
+    bytes = saved.bytes;
+  } finally {
+    wb.delete();
+  }
+
+  const reloaded = Module.Workbook.loadBytes(bytes);
+  try {
+    const rules = reloaded.getConditionalFormats(0);
+    assert.equal(rules.length, 3);
+    assert.deepEqual(cfvoValues(rules), EXPECTED_CFVO_VALUES);
+  } finally {
+    reloaded.delete();
+  }
+});
+
+test('addValidation defaults every omitted boolean to false', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    // A list rule stating only what it needs: the booleans are left out
+    // so the binding's own defaults are what is read back.
+    assert.ok(
+      wb.addValidation(0, {
+        ranges: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
+        type: 3,
+        formula1: '"Yes,No"',
+      }).ok,
+    );
+    const rules = wb.getValidations(0);
+    assert.ok(rules.status.ok, JSON.stringify(rules.status));
+    assert.equal(rules.length, 1);
+    const rule = rules[0];
+    assert.equal(typeof rule.allowBlank, 'boolean');
+    assert.equal(rule.allowBlank, false);
+    assert.equal(rule.showInputMessage, false);
+    assert.equal(rule.showErrorMessage, false);
+    // `showDropDown` is the documented exception: absent means the
+    // in-cell arrow is shown, which is what Excel does.
+    assert.equal(rule.showDropDown, true);
+    assert.equal(rule.type, 3);
+    assert.equal(rule.op, 0);
+    assert.equal(rule.errorStyle, 0);
+    assert.equal(rule.formula1, '"Yes,No"');
+    assert.equal(rule.formula2, '');
+    assert.equal(rule.ranges.length, 1);
+    assert.equal(rule.ranges[0].lastRow, 2);
+
+    // An explicit `true` is not overwritten by the default.
+    assert.ok(wb.addValidation(0, { type: 3, allowBlank: true, formula1: '"A,B"' }).ok);
+    assert.equal(wb.getValidations(0)[1].allowBlank, true);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('merges, comments and hyperlinks round-trip through save and load', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  let bytes;
+  try {
+    assert.ok(wb.setText(0, 0, 0, '見出し').ok);
+    assert.ok(wb.addMerge(0, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 3 }).ok);
+    assert.ok(wb.setComment(0, 2, 1, '校閲者', '要確認').ok);
+    assert.ok(wb.addHyperlink(0, 3, 0, 'https://example.com/', '例', 'ツールチップ', '').ok);
+
+    const merges = wb.getMerges(0);
+    assert.ok(merges.status.ok, JSON.stringify(merges.status));
+    assert.equal(merges.length, 1);
+    assert.equal(merges[0].lastCol, 3);
+
+    const comment = wb.getCommentResult(0, 2, 1);
+    assert.ok(comment.status.ok, JSON.stringify(comment.status));
+    assert.equal(comment.comment.author, '校閲者');
+    assert.equal(comment.comment.text, '要確認');
+    // An absent comment and an unreadable sheet both answer with a null
+    // comment, and are told apart by the status they carry.
+    const none = wb.getCommentResult(0, 9, 9);
+    assert.equal(none.status.ok, false);
+    assert.equal(none.comment, null);
+    const badSheet = wb.getCommentResult(99, 0, 0);
+    assert.equal(badSheet.status.ok, false);
+    assert.equal(badSheet.comment, null);
+    assert.notEqual(none.status.status, badSheet.status.status);
+
+    const saved = wb.save();
+    assert.ok(saved.status.ok, JSON.stringify(saved.status));
+    bytes = saved.bytes;
+  } finally {
+    wb.delete();
+  }
+
+  const reloaded = Module.Workbook.loadBytes(bytes);
+  try {
+    assert.equal(reloaded.getMerges(0).length, 1);
+    assert.equal(reloaded.getMerges(0)[0].lastCol, 3);
+
+    const comments = reloaded.getComments(0);
+    assert.ok(comments.status.ok, JSON.stringify(comments.status));
+    assert.equal(comments.length, 1);
+    assert.equal(comments[0].row, 2);
+    assert.equal(comments[0].col, 1);
+    assert.equal(comments[0].text, '要確認');
+
+    const links = reloaded.getHyperlinks(0);
+    assert.ok(links.status.ok, JSON.stringify(links.status));
+    assert.equal(links.length, 1);
+    assert.equal(links[0].row, 3);
+    assert.equal(links[0].target, 'https://example.com/');
+    assert.equal(links[0].tooltip, 'ツールチップ');
+  } finally {
+    reloaded.delete();
+  }
+});
diff --git a/packages/npm/test/smoke_pivot_mutators_status.mjs b/packages/npm/test/smoke_pivot_mutators_status.mjs
new file mode 100644
index 000000000..8da39141a
--- /dev/null
+++ b/packages/npm/test/smoke_pivot_mutators_status.mjs
@@ -0,0 +1,787 @@
+import test from 'node:test';
+import { inflateRawSync } from 'node:zlib';
+import { assert, getModule, makeIterativeWorkbook, path, pkgRoot, readFile } from './smoke_support.mjs';
+
+// ---- Pivot mutator marshalling -----------------------------------------
+//
+// Every pivot mutator is driven once against a small pivot and checked
+// through a read of the result -- the projected grid wherever the mutation
+// reaches it -- so an argument dropped, reordered or mis-converted on the
+// way to the C ABI shows up as a wrong grid rather than a green `.ok`. The
+// completeness test below keeps the table in step with the declaration
+// file.
+
+// Region / Product carry shared items and their records store item
+// indices; Amount and Date are plain numbers. Only Region is laid out, so
+// the baseline grid is two regions, their sums and the grand total.
+function buildPivot(mod) {
+  const wb = mod.Workbook.createDefault();
+  const must = (r, what) => {
+    const status = typeof r.ok === 'boolean' ? r : r.status;
+    assert.ok(status.ok, `${what}: ${JSON.stringify(status)}`);
+    return r;
+  };
+  const cacheId = must(wb.pivotCacheCreate(0), 'pivotCacheCreate').index;
+  must(wb.pivotCacheSetWorksheetSource(cacheId, { present: true, ref: 'A1:D5', sheet: 'Sheet1' }), 'source');
+  for (const name of ['Region', 'Product', 'Amount', 'Date']) must(wb.pivotCacheFieldAdd(cacheId, name), name);
+  for (const item of ['East', 'West']) must(wb.pivotCacheFieldAddSharedItemText(cacheId, 0, item), item);
+  for (const item of ['Apple', 'Pear']) must(wb.pivotCacheFieldAddSharedItemText(cacheId, 1, item), item);
+  for (const values of [
+    [0, 0, 10, 45292],
+    [1, 0, 30, 45323],
+    [0, 1, 5, 45658],
+    [1, 1, 7, 45689],
+  ]) {
+    const rec = must(wb.pivotCacheRecordAdd(cacheId), 'record').index;
+    for (const [field, v] of values.entries())
+      must(wb.pivotCacheRecordSetNumber(cacheId, rec, field, v), 'record value');
+  }
+  const pivot = must(wb.pivotCreate(0, 'Pivot1', cacheId, 0, 6), 'pivotCreate').index;
+  const addField = (spec) => must(wb.pivotFieldAdd(0, pivot, spec), spec.sourceName).index;
+  const region = addField({ sourceName: 'Region', axis: 0 });
+  must(wb.pivotFieldAddItem(0, pivot, region, 'East', true), 'item');
+  must(wb.pivotFieldAddItem(0, pivot, region, 'West', true), 'item');
+  const product = addField({ sourceName: 'Product', axis: 2 });
+  must(wb.pivotFieldAddItem(0, pivot, product, 'Apple', true), 'item');
+  must(wb.pivotFieldAddItem(0, pivot, product, 'Pear', true), 'item');
+  const amount = addField({ sourceName: 'Amount', axis: 2 });
+  const date = addField({ sourceName: 'Date', axis: 2 });
+  must(wb.pivotSetRowFieldOrder(0, pivot, [region]), 'row order');
+  must(wb.pivotDataFieldAdd(0, pivot, { name: 'Sum of Amount', fieldIndex: amount, aggregation: 0 }), 'data field');
+  return { wb, cacheId, pivot, region, product, amount, date };
+}
+
+// The projected grid as one `|`-joined string per sheet row.
+function pivotGrid(wb, pivot = 0) {
+  const layout = wb.pivotLayout(0, pivot);
+  assert.ok(layout.status.ok, JSON.stringify(layout.status));
+  const rows = new Map();
+  for (const cell of layout.cells) {
+    const v = cell.value;
+    const text = v.kind === 1 ? String(v.number) : v.kind === 3 ? v.text : v.kind === 4 ? `#${v.errorCode}` : '';
+    if (!rows.has(cell.row)) rows.set(cell.row, new Array(layout.cols).fill(''));
+    rows.get(cell.row)[cell.col - layout.left] = text;
+  }
+  return [...rows.keys()].sort((a, b) => a - b).map((row) => rows.get(row).join('|'));
+}
+
+const BASE_GRID = ['行ラベル|Sum of Amount', 'East|15', 'West|37', '総計|52'];
+const TWO_LEVEL_GRID = [
+  '行ラベル|Sum of Amount',
+  'Apple|10',
+  'Pear|5',
+  'East|15',
+  'Apple|30',
+  'Pear|7',
+  'West|37',
+  '総計|52',
+];
+const DATE_SERIAL_GRID = ['行ラベル|Sum of Amount', '45292|10', '45323|30', '45658|5', '45689|7', '総計|52'];
+const twoLevels = (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.region, b.product]);
+const dateRows = (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.date]);
+const hideEast = (b) => b.wb.pivotFieldSetItemVisible(0, b.pivot, b.region, 0, false);
+const WEST_ONLY = ['行ラベル|Sum of Amount', 'West|37', '総計|37'];
+const GREATER_THAN_20 = Object.freeze({ axis: 0, fieldName: 'Region', type: 1, valueKind: 1, valueDouble: 20 });
+const BETWEEN_10_20 = Object.freeze({
+  axis: 0,
+  fieldName: 'Region',
+  type: 2,
+  valueKind: 1,
+  valueDouble: 10,
+  valueHighKind: 1,
+  valueHighDouble: 20,
+});
+// Points record 0's Region at the shared item a row has just appended.
+const pointAtNewItem = (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 0, 2);
+
+// The raw text of one stored part of a saved package.
+function packagePart(bytes, name) {
+  const buf = Buffer.from(bytes);
+  let eocd = buf.length - 22;
+  while (eocd >= 0 && buf.readUInt32LE(eocd) !== 0x06054b50) eocd -= 1;
+  assert.ok(eocd >= 0, 'missing ZIP end record');
+  let at = buf.readUInt32LE(eocd + 16);
+  for (let i = buf.readUInt16LE(eocd + 10); i > 0; i -= 1) {
+    const method = buf.readUInt16LE(at + 10);
+    const size = buf.readUInt32LE(at + 20);
+    const nameLen = buf.readUInt16LE(at + 28);
+    const next = at + 46 + nameLen + buf.readUInt16LE(at + 30) + buf.readUInt16LE(at + 32);
+    if (buf.toString('utf8', at + 46, at + 46 + nameLen) === name) {
+      const local = buf.readUInt32LE(at + 42);
+      const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
+      const raw = buf.subarray(start, start + size);
+      return (method === 0 ? raw : inflateRawSync(raw)).toString('utf8');
+    }
+    at = next;
+  }
+  assert.fail(`${name} not in the package`);
+}
+
+// [method, { setup, act, after, expect }]. `act` performs the one call
+// under test; `expect` reads the result back.
+const PIVOT_MUTATORS = [
+  [
+    'pivotCacheCreate',
+    {
+      act: (b) => b.wb.pivotCacheCreate(77),
+      expect: (b, r) => {
+        assert.equal(r.index, 77);
+        assert.equal(b.wb.pivotCacheCount().value, 2);
+      },
+    },
+  ],
+  ['pivotCacheIdAt', { act: (b) => b.wb.pivotCacheIdAt(0), expect: (b, r) => assert.equal(r.index, b.cacheId) }],
+  [
+    'pivotCacheRemove',
+    {
+      setup: (b) => {
+        b.spare = b.wb.pivotCacheCreate(0).index;
+      },
+      act: (b) => b.wb.pivotCacheRemove(b.spare),
+      expect: (b) => {
+        assert.equal(b.wb.pivotCacheCount().value, 1);
+        assert.equal(b.wb.pivotCacheIdAt(0).index, b.cacheId);
+      },
+    },
+  ],
+  [
+    'pivotCacheSetWorksheetSource',
+    {
+      act: (b) => b.wb.pivotCacheSetWorksheetSource(b.cacheId, { present: true, ref: 'B2:E6', sheet: 'Data' }),
+      expect: (b) => {
+        const source = b.wb.pivotCacheGetWorksheetSource(b.cacheId);
+        assert.equal(source.ref, 'B2:E6');
+        assert.equal(source.sheet, 'Data');
+        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotCacheFieldAdd',
+    {
+      act: (b) => b.wb.pivotCacheFieldAdd(b.cacheId, 'Extra'),
+      expect: (b, r) => {
+        assert.equal(r.index, 4);
+        assert.equal(b.wb.pivotCacheFieldName(b.cacheId, 4).value, 'Extra');
+      },
+    },
+  ],
+  [
+    'pivotCacheFieldClear',
+    {
+      act: (b) => b.wb.pivotCacheFieldClear(b.cacheId),
+      expect: (b) => {
+        assert.equal(b.wb.pivotCacheFieldCount(b.cacheId).value, 0);
+        // The data field now names a cache field that no longer exists.
+        assert.equal(b.wb.pivotLayout(0, b.pivot).status.ok, false);
+      },
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemNumber',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemNumber(b.cacheId, 0, 42.5),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '42.5|10', 'East|5', 'West|37', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemText',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemText(b.cacheId, 0, 'North'),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'North|10', 'West|37', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemBool',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemBool(b.cacheId, 0, true),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', 'TRUE|10', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemBlank',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemBlank(b.cacheId, 0),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '(空白)|10', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldAddSharedItemError',
+    {
+      act: (b) => b.wb.pivotCacheFieldAddSharedItemError(b.cacheId, 0, 6),
+      after: pointAtNewItem,
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '#N/A|10', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheFieldClearSharedItems',
+    {
+      act: (b) => b.wb.pivotCacheFieldClearSharedItems(b.cacheId, 0),
+      // With no shared items the records' indices render as themselves.
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '0|15', '1|37', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheRecordAdd',
+    {
+      act: (b) => b.wb.pivotCacheRecordAdd(b.cacheId),
+      expect: (b, r) => {
+        assert.equal(r.index, 4);
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|15', 'West|37', '(空白)|0', '総計|52']);
+      },
+    },
+  ],
+  [
+    'pivotCacheRecordClear',
+    {
+      act: (b) => b.wb.pivotCacheRecordClear(b.cacheId),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '総計|0']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetNumber',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 2, 1000),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|1005', 'West|37', '総計|1042']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetText',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetText(b.cacheId, 0, 0, 'West'),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|47', '総計|52']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetBool',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetBool(b.cacheId, 0, 2, true),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|6', 'West|37', '総計|43']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetBlank',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetBlank(b.cacheId, 0, 2),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '総計|42']),
+    },
+  ],
+  [
+    'pivotCacheRecordSetError',
+    {
+      act: (b) => b.wb.pivotCacheRecordSetError(b.cacheId, 0, 2, 1),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|#1', 'West|37', '総計|#1']),
+    },
+  ],
+  [
+    'pivotCreate',
+    {
+      act: (b) => b.wb.pivotCreate(0, 'Pivot2', b.cacheId, 20, 1),
+      expect: (b, r) => {
+        assert.equal(r.index, 1);
+        const layout = b.wb.pivotLayout(0, 1);
+        assert.equal(layout.top, 20);
+        assert.equal(layout.left, 1);
+        assert.deepEqual(pivotGrid(b.wb, 0), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotRemove',
+    {
+      act: (b) => b.wb.pivotRemove(0, b.pivot),
+      expect: (b) => {
+        assert.equal(b.wb.pivotCount(0).value, 0);
+        assert.equal(b.wb.pivotLayout(0, 0).status.ok, false);
+      },
+    },
+  ],
+  [
+    'pivotSetName',
+    {
+      act: (b) => b.wb.pivotSetName(0, b.pivot, 'Renamed'),
+      // A pivot's name is only observable in the part the writer emits.
+      expect: (b) => {
+        const saved = b.wb.save();
+        assert.ok(saved.status.ok, JSON.stringify(saved.status));
+        assert.match(
+          packagePart(saved.bytes, 'xl/pivotTables/pivotTable1.xml'),
+          /<pivotTableDefinition [^>]*name="Renamed"/,
+        );
+      },
+    },
+  ],
+  [
+    'pivotSetAnchor',
+    {
+      act: (b) => b.wb.pivotSetAnchor(0, b.pivot, 10, 2, 4, 2),
+      expect: (b) => {
+        const layout = b.wb.pivotLayout(0, b.pivot);
+        assert.equal(layout.top, 10);
+        assert.equal(layout.left, 2);
+        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotSetGrandTotals',
+    {
+      setup: (b) => b.wb.pivotSetColFieldOrder(0, b.pivot, [b.product]),
+      // Rows off drops the per-row total column; columns on keeps the
+      // bottom total row, so a swapped pair would show the opposite.
+      act: (b) => b.wb.pivotSetGrandTotals(0, b.pivot, false, true),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), [
+          'Sum of Amount|列ラベル|',
+          '行ラベル|Apple|Pear',
+          'East|10|5',
+          'West|30|7',
+          '総計|40|12',
+        ]),
+    },
+  ],
+  [
+    'pivotSetLayout',
+    {
+      act: (b) => b.wb.pivotSetLayout(0, b.pivot, 1),
+      expect: (b) => {
+        assert.equal(b.wb.pivotGetLayout(0, b.pivot).layout, 1);
+        assert.deepEqual(pivotGrid(b.wb), ['Region|Sum of Amount', 'East|15', 'West|37', '総計|52']);
+      },
+    },
+  ],
+  [
+    'pivotFieldAdd',
+    {
+      act: (b) => b.wb.pivotFieldAdd(0, b.pivot, { sourceName: 'Product', customName: 'Fruit', axis: 3 }),
+      expect: (b, r) => {
+        assert.equal(r.index, 4);
+        assert.deepEqual(pivotGrid(b.wb), ['Fruit|(すべて)', '|', ...BASE_GRID]);
+      },
+    },
+  ],
+  [
+    'pivotFieldClear',
+    {
+      setup: hideEast,
+      act: (b) => b.wb.pivotFieldClear(0, b.pivot),
+      expect: (b) => {
+        assert.equal(b.wb.pivotFieldCount(0, b.pivot).value, 0);
+        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotFieldSetAxis',
+    {
+      act: (b) => b.wb.pivotFieldSetAxis(0, b.pivot, b.product, 3),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['Product|(すべて)', '|', ...BASE_GRID]),
+    },
+  ],
+  [
+    'pivotFieldSetSort',
+    {
+      // East now outsums West, so sorting ascending by the data field
+      // differs from both label orders.
+      setup: (b) => b.wb.pivotCacheRecordSetNumber(b.cacheId, 0, 2, 40),
+      act: (b) => b.wb.pivotFieldSetSort(0, b.pivot, b.region, true, 'Sum of Amount'),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'West|37', 'East|45', '総計|82']),
+    },
+  ],
+  [
+    'pivotFieldSetSubtotalTop',
+    {
+      setup: twoLevels,
+      act: (b) => b.wb.pivotFieldSetSubtotalTop(0, b.pivot, b.region, true),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), [
+          '行ラベル|Sum of Amount',
+          'East|15',
+          'Apple|10',
+          'Pear|5',
+          'West|37',
+          'Apple|30',
+          'Pear|7',
+          '総計|52',
+        ]),
+    },
+  ],
+  [
+    'pivotFieldAddItem',
+    {
+      act: (b) => b.wb.pivotFieldAddItem(0, b.pivot, b.region, 'East', false),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
+    },
+  ],
+  [
+    'pivotFieldAddItemAt',
+    {
+      // Only the index-addressed form can name the blank item.
+      setup: (b) => {
+        b.wb.pivotCacheFieldAddSharedItemBlank(b.cacheId, 0);
+        b.wb.pivotCacheRecordSetBlank(b.cacheId, 0, 0);
+      },
+      act: (b) => b.wb.pivotFieldAddItemAt(0, b.pivot, b.region, 2, false),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|5', 'West|37', '総計|42']),
+    },
+  ],
+  [
+    'pivotFieldClearItems',
+    {
+      setup: hideEast,
+      act: (b) => b.wb.pivotFieldClearItems(0, b.pivot, b.region),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), BASE_GRID),
+    },
+  ],
+  [
+    'pivotFieldSetItemVisible',
+    {
+      act: (b) => b.wb.pivotFieldSetItemVisible(0, b.pivot, b.region, 1, false),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'East|15', '総計|15']),
+    },
+  ],
+  [
+    'pivotFieldAddSubtotalFn',
+    {
+      setup: twoLevels,
+      act: (b) => b.wb.pivotFieldAddSubtotalFn(0, b.pivot, b.region, 3),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), [
+          '行ラベル|Sum of Amount',
+          'Apple|10',
+          'Pear|5',
+          'East|10',
+          'Apple|30',
+          'Pear|7',
+          'West|30',
+          '総計|52',
+        ]),
+    },
+  ],
+  [
+    'pivotFieldClearSubtotalFns',
+    {
+      setup: (b) => {
+        twoLevels(b);
+        b.wb.pivotFieldAddSubtotalFn(0, b.pivot, b.region, 3);
+      },
+      act: (b) => b.wb.pivotFieldClearSubtotalFns(0, b.pivot, b.region),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), TWO_LEVEL_GRID),
+    },
+  ],
+  [
+    'pivotFieldSetDateGroup',
+    {
+      setup: dateRows,
+      act: (b) => b.wb.pivotFieldSetDateGroup(0, b.pivot, b.date, 3, 1, -1, -1),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', '令和6年|40', '令和7年|12', '総計|52']),
+    },
+  ],
+  [
+    'pivotFieldClearDateGroup',
+    {
+      setup: (b) => {
+        dateRows(b);
+        b.wb.pivotFieldSetDateGroup(0, b.pivot, b.date, 3, 0, -1, -1);
+      },
+      act: (b) => b.wb.pivotFieldClearDateGroup(0, b.pivot, b.date),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), DATE_SERIAL_GRID),
+    },
+  ],
+  [
+    'pivotFieldSetNumberFormat',
+    {
+      act: (b) => b.wb.pivotFieldSetNumberFormat(0, b.pivot, b.amount, '4'),
+      // A field's numFmtId is only observable in the part the writer emits.
+      expect: (b) => {
+        assert.equal(b.wb.pivotFieldSetNumberFormat(0, b.pivot, 99, '4').status, 2);
+        assert.equal(b.wb.pivotFieldSetNumberFormat(0, b.pivot, b.amount, '0.00').status, 2);
+        const saved = b.wb.save();
+        assert.ok(saved.status.ok, JSON.stringify(saved.status));
+        assert.match(packagePart(saved.bytes, 'xl/pivotTables/pivotTable1.xml'), /<pivotField [^>]*numFmtId="4"/);
+        assert.deepEqual(pivotGrid(b.wb), BASE_GRID);
+      },
+    },
+  ],
+  [
+    'pivotSetRowFieldOrder',
+    {
+      act: (b) => b.wb.pivotSetRowFieldOrder(0, b.pivot, [b.product]),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Sum of Amount', 'Apple|40', 'Pear|12', '総計|52']),
+    },
+  ],
+  [
+    'pivotSetColFieldOrder',
+    {
+      act: (b) => b.wb.pivotSetColFieldOrder(0, b.pivot, [b.product]),
+      expect: (b) =>
+        assert.deepEqual(pivotGrid(b.wb), [
+          'Sum of Amount|列ラベル||',
+          '行ラベル|Apple|Pear|総計',
+          'East|10|5|15',
+          'West|30|7|37',
+          '総計|40|12|52',
+        ]),
+    },
+  ],
+  [
+    'pivotDataFieldAdd',
+    {
+      act: (b) => b.wb.pivotDataFieldAdd(0, b.pivot, { name: 'Max of Amount', fieldIndex: b.amount, aggregation: 3 }),
+      expect: (b, r) => {
+        assert.equal(r.index, 1);
+        assert.deepEqual(pivotGrid(b.wb), [
+          '行ラベル|Sum of Amount|Max of Amount',
+          'East|15|10',
+          'West|37|30',
+          '総計|52|30',
+        ]);
+      },
+    },
+  ],
+  [
+    'pivotDataFieldClear',
+    {
+      act: (b) => b.wb.pivotDataFieldClear(0, b.pivot),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), ['行ラベル', 'East', 'West', '総計']),
+    },
+  ],
+  [
+    'pivotDataFieldSet',
+    {
+      act: (b) =>
+        b.wb.pivotDataFieldSet(0, b.pivot, 0, {
+          name: 'Count of Amount',
+          fieldIndex: b.amount,
+          aggregation: 1,
+          numberFormat: '2',
+        }),
+      expect: (b) => {
+        assert.deepEqual(pivotGrid(b.wb), ['行ラベル|Count of Amount', 'East|2', 'West|2', '総計|4']);
+        const counts = b.wb.pivotLayout(0, b.pivot).cells.filter((c) => c.value.kind === 1);
+        assert.deepEqual(
+          counts.map((c) => c.numberFormat),
+          ['2', '2', '2'],
+        );
+      },
+    },
+  ],
+  [
+    'pivotFilterAdd',
+    {
+      act: (b) => b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
+    },
+  ],
+  [
+    'pivotFilterClear',
+    {
+      setup: (b) => b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20),
+      act: (b) => b.wb.pivotFilterClear(0, b.pivot),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), BASE_GRID),
+    },
+  ],
+  [
+    'pivotFilterRemoveAt',
+    {
+      // Each filter alone keeps a different region, so removing the wrong
+      // index leaves the wrong one.
+      setup: (b) => {
+        b.wb.pivotFilterAdd(0, b.pivot, GREATER_THAN_20);
+        b.wb.pivotFilterAdd(0, b.pivot, BETWEEN_10_20);
+      },
+      act: (b) => b.wb.pivotFilterRemoveAt(0, b.pivot, 1),
+      expect: (b) => assert.deepEqual(pivotGrid(b.wb), WEST_ONLY),
+    },
+  ],
+];
+
+test('the pivot mutator table covers every declared pivot mutator', async () => {
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
+  const declared = [...dts.matchAll(/^ {2}(pivot\w*)\([^)]*\): (?:Status|AddStyleResult);/gm)].map((m) => m[1]);
+  assert.ok(declared.length > 40, `expected the pivot mutator family, found ${declared.length}`);
+  const covered = PIVOT_MUTATORS.map(([name]) => name);
+  assert.deepEqual(
+    declared.filter((name) => !covered.includes(name)),
+    [],
+    'pivot mutators without a row',
+  );
+  assert.deepEqual(
+    covered.filter((name) => !declared.includes(name)),
+    [],
+    'rows for methods that are not declared pivot mutators',
+  );
+});
+
+test('pivot mutators forward their arguments to the C ABI', async () => {
+  const mod = await getModule();
+  const base = buildPivot(mod);
+  try {
+    assert.deepEqual(pivotGrid(base.wb), BASE_GRID);
+  } finally {
+    base.wb.delete();
+  }
+  for (const [name, row] of PIVOT_MUTATORS) {
+    const b = buildPivot(mod);
+    try {
+      row.setup?.(b);
+      const r = row.act(b);
+      const status = typeof r.ok === 'boolean' ? r : r.status;
+      assert.ok(status.ok, `${name}: ${JSON.stringify(status)}`);
+      row.after?.(b);
+      row.expect(b, r);
+    } catch (err) {
+      err.message = `${name}: ${err.message}`;
+      throw err;
+    } finally {
+      b.wb.delete();
+    }
+  }
+});
+
+// ---- Status on the fallible accessors ----------------------------------
+//
+// Every accessor backed by a status-returning C ABI call carries that
+// status, so a rejected argument or a released handle cannot read as a
+// legitimate zero count, empty name, or unspilled cell. Each row is
+// [method, args that succeed, args the engine rejects (or null when only
+// a released handle can fail it)].
+const STATUS_ACCESSORS = [
+  ['sheetCount', [], null],
+  ['cellCount', [0], [99]],
+  ['definedNameCount', [], null],
+  ['tableCount', [], null],
+  ['passthroughCount', [], null],
+  ['pivotCount', [0], [99]],
+  ['pivotCacheCount', [], null],
+  ['pivotCacheFieldCount', null, [9999]],
+  ['pivotCacheFieldSharedItemCount', null, [9999, 0]],
+  ['pivotCacheRecordCount', null, [9999]],
+  ['pivotFieldCount', null, [99, 0]],
+  ['pivotDataFieldCount', null, [99, 0]],
+  ['pivotFilterCount', null, [99, 0]],
+  ['fontCount', [], null],
+  ['fillCount', [], null],
+  ['borderCount', [], null],
+  ['xfCount', [], null],
+  ['dxfCount', [], null],
+  ['cellStyleCount', [], null],
+  ['cellStyleXfCount', [], null],
+  ['calcMode', [], null],
+  ['excelProfileId', [], null],
+  ['localizeFunctionName', ['SUM', 0], ['NOPE_XYZ', 0]],
+  ['canonicalizeFunctionName', ['SUM', 0], ['NOPE_XYZ', 0]],
+  ['pinnedNow', [], null],
+  ['spillInfo', [0, 0, 0], [99, 0, 0]],
+  ['getColumnWidthPt', [0, 0, 0], [99, 0, 0]],
+  ['getRowHeightPt', [0, 0], [99, 0]],
+  ['columnCharsToPt', [0, 0, 8], [99, 0, 8]],
+  ['columnPtToChars', [0, 0, 10], [99, 0, 10]],
+  ['precedents', [0, 0, 0, 1], [99, 0, 0, 1]],
+  ['dependents', [0, 0, 0, 1], [99, 0, 0, 1]],
+  ['functionNames', [], null],
+];
+
+// The payload a failed call must fall back to, keyed by what it returns.
+function assertFailurePayload(name, r) {
+  if (Array.isArray(r)) assert.equal(r.length, 0, name);
+  else if ('now' in r) assert.equal(r.now, null, name);
+  else if ('engaged' in r) assert.equal(r.engaged, false, name);
+  else if (typeof r.value === 'string') assert.equal(r.value, '', name);
+  else assert.equal(r.value, 0, name);
+}
+
+test('every NumberResult accessor is covered by the status table', async () => {
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
+  const declared = [...dts.matchAll(/^ {2}([A-Za-z]\w*)\([^)]*\): NumberResult\b/gm)].map((m) => m[1]);
+  const covered = new Set(STATUS_ACCESSORS.map(([name]) => name));
+  assert.deepEqual(
+    declared.filter((name) => !covered.has(name)),
+    [],
+    'NumberResult accessors missing from STATUS_ACCESSORS',
+  );
+});
+
+test('fallible accessors report their status on success, rejection and a released handle', async () => {
+  const mod = await getModule();
+  const wb = mod.Workbook.createDefault();
+  for (const [name, okArgs, badArgs] of STATUS_ACCESSORS) {
+    if (okArgs !== null) {
+      const r = wb[name](...okArgs);
+      assert.ok(r.status.ok, `${name}: ${JSON.stringify(r.status)}`);
+    }
+    if (badArgs !== null) {
+      const r = wb[name](...badArgs);
+      assert.equal(r.status.ok, false, `${name} must report the rejected arguments`);
+      assert.notEqual(r.status.status, 0, name);
+      assertFailurePayload(name, r);
+    }
+  }
+  assert.equal(wb.sheetCount().value, 1);
+  assert.equal(wb.excelProfileId().value, 'win-365-ja_JP');
+  assert.equal(wb.localizeFunctionName('SUM', 1).value, 'SUM');
+  assert.equal(wb.localizeFunctionName('SUM', 99).status.ok, false);
+
+  wb.delete();
+  // `delete()` detaches the embind wrapper outright; a failed load is the
+  // wrapper that outlives its handle on this surface.
+  const dead = mod.Workbook.loadBytes(new Uint8Array([0]));
+  assert.equal(dead.isValid(), false);
+  // Every accessor, including the ones no argument can fail, reports the
+  // released handle instead of a default reading.
+  for (const [name, okArgs, badArgs] of STATUS_ACCESSORS) {
+    if (name.endsWith('FunctionName') || name === 'functionNames') continue;
+    const r = dead[name](...(okArgs ?? badArgs));
+    assert.equal(r.status.ok, false, `${name} after release`);
+    assert.equal(r.status.status, 7000, name);
+    assertFailurePayload(name, r);
+  }
+  dead.delete();
+});
+
+test('iterative progress callbacks are per Workbook, not per module', async () => {
+  const Module = await getModule();
+  const first = makeIterativeWorkbook(Module);
+  const second = makeIterativeWorkbook(Module);
+  try {
+    let firstCalls = 0;
+    let secondCalls = 0;
+    assert.ok(
+      first.setIterativeProgress(() => {
+        firstCalls += 1;
+        return true;
+      }).ok,
+    );
+    // Installing on `second` must not displace the registration on `first`.
+    assert.ok(
+      second.setIterativeProgress(() => {
+        secondCalls += 1;
+        return true;
+      }).ok,
+    );
+
+    assert.ok(first.recalc().ok);
+    assert.ok(firstCalls > 0, 'the first workbook kept its own callback');
+    assert.equal(secondCalls, 0);
+
+    firstCalls = 0;
+    assert.ok(second.recalc().ok);
+    assert.ok(secondCalls > 0);
+    assert.equal(firstCalls, 0);
+  } finally {
+    first.setIterativeProgress(null);
+    second.setIterativeProgress(null);
+    first.delete();
+    second.delete();
+  }
+});
diff --git a/packages/npm/test/smoke_print_recalc_callbacks.mjs b/packages/npm/test/smoke_print_recalc_callbacks.mjs
new file mode 100644
index 000000000..120a1383c
--- /dev/null
+++ b/packages/npm/test/smoke_print_recalc_callbacks.mjs
@@ -0,0 +1,484 @@
+import test from 'node:test';
+import { assert, getModule, makeIterativeWorkbook, threadsEntry, VAL } from './smoke_support.mjs';
+
+test('Workbook.createDefault produces a valid single-sheet workbook', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    assert.ok(wb.isValid());
+    assert.equal(wb.sheetCount().value, 1);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('print settings: raw XML round-trips and rejects malformed fragments', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    // An absent element reads back as the empty string, never null.
+    assert.equal(wb.getSheetPageSetupXml(0).xml, '');
+
+    const fragment = '<pageSetup paperSize="9" orientation="portrait" scale="85"/>';
+    assert.ok(wb.setSheetPageSetupXml(0, fragment).ok);
+    assert.equal(wb.getSheetPageSetupXml(0).xml, fragment);
+
+    for (const bad of [
+      '<pageSetup/><pageSetup/>',
+      '<pageMargins left="1"/>',
+      '<pageSetup orientation="portrait"',
+      '<x:pageSetup/>',
+    ]) {
+      assert.equal(wb.setSheetPageSetupXml(0, bad).ok, false, `expected rejection for ${bad}`);
+    }
+    // A rejected set leaves the stored fragment untouched.
+    assert.equal(wb.getSheetPageSetupXml(0).xml, fragment);
+
+    assert.ok(wb.setSheetPageSetupXml(0, '').ok);
+    assert.equal(wb.getSheetPageSetupXml(0).xml, '');
+    const cleared = wb.getSheetPageSetup(0);
+    assert.ok(cleared.status.ok);
+    assert.equal(cleared.scale, 100);
+    assert.equal(cleared.scaleStated, false);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('print settings: typed patch leaves unstated attributes alone', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    assert.ok(
+      wb.setSheetPageSetupXml(0, '<pageSetup paperSize="9" orientation="portrait" horizontalDpi="600" copies="3"/>').ok,
+    );
+    assert.ok(wb.setSheetPageSetup(0, { orientation: 2 }).ok);
+
+    const xml = wb.getSheetPageSetupXml(0).xml;
+    assert.match(xml, /orientation="landscape"/);
+    // Attributes the engine does not model must survive the patch, or the
+    // "open a template and change one thing" route loses data.
+    assert.match(xml, /horizontalDpi="600"/);
+    assert.match(xml, /copies="3"/);
+    assert.match(xml, /paperSize="9"/);
+
+    // A print scale outside Excel's range is rejected, not clamped.
+    assert.equal(wb.setSheetPageSetup(0, { scale: 9 }).ok, false);
+    assert.equal(wb.setSheetPageSetup(0, { scale: 401 }).ok, false);
+    assert.ok(wb.setSheetPageSetup(0, { scale: 400 }).ok);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('print settings: a change reaches paginate with no save cycle', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    for (let row = 0; row < 200; row += 1) {
+      for (let col = 0; col < 20; col += 1) {
+        assert.ok(wb.setNumber(0, row, col, 1).ok);
+      }
+    }
+    const portrait = wb.paginate(0).pageCount;
+    assert.ok(wb.setSheetPageSetup(0, { orientation: 2 }).ok);
+    assert.notEqual(wb.paginate(0).pageCount, portrait);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('print settings: an authored report survives save and load', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  let bytes;
+  try {
+    assert.ok(wb.setText(0, 0, 0, '売上').ok);
+    assert.ok(
+      wb.setSheetPageSetup(0, {
+        paperSize: 9,
+        orientation: 1,
+        fitToPage: true,
+        fitToWidth: 1,
+        fitToHeight: 0,
+      }).ok,
+    );
+    assert.ok(wb.setSheetPageMargins(0, { left: 0.5, right: 0.5, top: 0.8, bottom: 0.8 }).ok);
+    assert.ok(wb.setSheetPrintOptions(0, { horizontalCentered: true }).ok);
+    assert.ok(wb.setSheetHeaderFooter(0, { oddHeader: '&C月次報告', oddFooter: '&R&P / &N' }).ok);
+    assert.ok(wb.setSheetPrintArea(0, 'A1:F80').ok);
+    assert.ok(wb.setSheetPrintTitles(0, '1:2', '').ok);
+    assert.ok(wb.addSheetRowBreak(0, 39, true).ok);
+
+    const saved = wb.save();
+    assert.ok(saved.status.ok, JSON.stringify(saved.status));
+    bytes = saved.bytes;
+  } finally {
+    wb.delete();
+  }
+
+  const reloaded = Module.Workbook.loadBytes(bytes);
+  try {
+    const setup = reloaded.getSheetPageSetup(0);
+    assert.ok(setup.status.ok);
+    assert.equal(setup.paperSize, 9);
+    assert.equal(setup.orientation, 1);
+    assert.equal(setup.fitToPage, true);
+    assert.equal(setup.fitToHeight, 0);
+    assert.equal(reloaded.getSheetPageMargins(0).left, 0.5);
+    assert.equal(reloaded.getSheetPrintArea(0).ranges, 'A1:F80');
+    const titles = reloaded.getSheetPrintTitles(0);
+    assert.equal(titles.repeatRows, '1:2');
+    assert.equal(titles.repeatCols, '');
+    // The header code is stored escaped and decodes back to `&C...`.
+    assert.match(reloaded.getSheetHeaderFooterXml(0).xml, /<oddHeader>&amp;C月次報告<\/oddHeader>/);
+    const breaks = reloaded.getSheetRowBreaks(0);
+    assert.deepEqual(
+      breaks.breaks.map((b) => b.id),
+      [39],
+    );
+    assert.equal(breaks.breaks[0].manual, true);
+  } finally {
+    reloaded.delete();
+  }
+});
+
+test('setRangeXfIndex applies one xf across a rectangle', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    const xf = wb.addXf({ fontIndex: 0, fillIndex: 0, borderIndex: 0, numFmtId: 0, wrapText: true, hasWrapText: true });
+    assert.ok(xf.status.ok, JSON.stringify(xf.status));
+    assert.ok(wb.setRangeXfIndex(0, 0, 0, 2, 2, xf.index).ok);
+    // Cells that held nothing are materialised so the ruled box renders.
+    for (const [row, col] of [
+      [0, 0],
+      [1, 1],
+      [2, 2],
+    ]) {
+      assert.equal(wb.getCellXfIndex(0, row, col).xfIndex, xf.index);
+    }
+    assert.equal(wb.getCellXfIndex(0, 3, 3).xfIndex, 0);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('sheet layout getters preserve explicit width presence flags', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    assert.ok(wb.setColumnWidth(0, 0, 0, 0).ok);
+    assert.ok(wb.setColumnHidden(0, 1, 1, true).ok);
+    assert.ok(wb.setRowHeight(0, 3, 30).ok);
+
+    const columns = wb.getSheetColumns(0);
+    assert.ok(columns.status.ok, `getSheetColumns: ${JSON.stringify(columns.status)}`);
+    const widthZero = columns.columns.find((column) => column.first === 0 && column.last === 0);
+    assert.ok(widthZero);
+    assert.equal(widthZero.width, 0);
+    assert.equal(typeof widthZero.hasWidth, 'number');
+    assert.equal(widthZero.hasWidth, 1);
+    assert.equal(typeof widthZero.hasStyle, 'number');
+    assert.equal(widthZero.hasStyle, 0);
+    const hidden = columns.columns.find((column) => column.first === 1 && column.last === 1);
+    assert.ok(hidden);
+    assert.equal(hidden.hidden, 1);
+    assert.equal(typeof hidden.hasWidth, 'number');
+    assert.equal(hidden.hasWidth, 0);
+
+    const rows = wb.getSheetRowOverrides(0);
+    assert.ok(rows.status.ok, `getSheetRowOverrides: ${JSON.stringify(rows.status)}`);
+    const row = rows.rows.find((entry) => entry.row === 3);
+    assert.ok(row);
+    assert.equal(row.height, 30);
+    assert.equal(row.hasStyle, 0);
+    assert.equal(row.styleXf, 0);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('Unicode sheet identity rejects folded duplicate and permits casing rename', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createEmpty();
+  try {
+    assert.ok(wb.addSheet('Ä').ok);
+    assert.ok(wb.addSheet('Ö').ok);
+    assert.equal(wb.addSheet('ä').ok, false);
+    const collision = wb.renameSheet(1, 'ä');
+    assert.equal(collision.ok, false);
+    assert.notEqual(collision.status, 0);
+    assert.equal(wb.sheetName(0).value, 'Ä');
+    assert.equal(wb.sheetName(1).value, 'Ö');
+    assert.ok(wb.renameSheet(0, 'ä').ok);
+    const sn = wb.sheetName(0);
+    assert.ok(sn.status.ok);
+    assert.equal(sn.value, 'ä');
+    assert.equal(wb.sheetName(1).value, 'Ö');
+  } finally {
+    wb.delete();
+  }
+});
+
+test('setNumber + getValue round-trips bit-exactly', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    const x = 3.141592653589793;
+    assert.ok(wb.setNumber(0, 0, 0, x).ok);
+    assert.ok(wb.recalc().ok);
+    const r = wb.getValue(0, 0, 0);
+    assert.ok(r.status.ok);
+    assert.equal(r.value.kind, VAL.NUMBER);
+    assert.equal(r.value.number, x);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('setFormula + recalc computes 41 + 1 == 42 in B1', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  try {
+    assert.ok(wb.setNumber(0, 0, 0, 41).ok);
+    assert.ok(wb.setFormula(0, 0, 1, '=A1+1').ok);
+    assert.ok(wb.recalc().ok);
+    const b1 = wb.getValue(0, 0, 1);
+    assert.ok(b1.status.ok);
+    assert.equal(b1.value.kind, VAL.NUMBER);
+    assert.equal(b1.value.number, 42);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('Workbook.recalcParallel evaluates a wide DAG and reports bounded telemetry', async () => {
+  const Module = await getModule();
+  const wb = Module.Workbook.createDefault();
+  const branchCount = 32;
+  try {
+    assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+    for (let i = 0; i < branchCount; i += 1) {
+      const row = i + 1;
+      assert.ok(wb.setFormula(0, row, 1, `=A1+${i + 2}`).ok);
+      assert.ok(wb.setFormula(0, row, 2, `=B${row + 1}*2`).ok);
+    }
+
+    const parallel = wb.recalcParallel(4);
+    assert.ok(parallel.status.ok, `status=${JSON.stringify(parallel.status)}`);
+    assert.equal(typeof parallel.stats.cellsEvaluated, 'number');
+    assert.equal(typeof parallel.stats.sccsProcessed, 'number');
+    assert.equal(typeof parallel.stats.parallelSteps, 'number');
+    assert.ok(parallel.stats.cellsEvaluated > 0);
+    assert.ok(parallel.stats.sccsProcessed > 0);
+    if (!threadsEntry) {
+      // Without pthreads every launch is refused, so the pass runs serially.
+      assert.equal(parallel.stats.workerThreadsStarted, 0);
+    }
+    if (parallel.stats.workerThreadsStarted <= 1) {
+      // OS launch refusal or a partial launch of one worker is a documented
+      // successful serial degradation.
+      assert.equal(parallel.stats.workerThreadsUsed, 0);
+      assert.equal(parallel.stats.parallelSteps, 0);
+      assert.ok(parallel.stats.serialFallbackSteps > 0, `stats=${JSON.stringify(parallel.stats)}`);
+    } else {
+      assert.ok(parallel.stats.parallelSteps > 0, `stats=${JSON.stringify(parallel.stats)}`);
+      assert.ok(parallel.stats.workerThreadsStarted >= 2);
+      assert.ok(parallel.stats.workerThreadsStarted <= 4);
+      assert.ok(parallel.stats.workerThreadsUsed > 0);
+      assert.ok(parallel.stats.workerThreadsUsed <= parallel.stats.workerThreadsStarted);
+    }
+
+    const first = wb.getValue(0, 1, 1);
+    const last = wb.getValue(0, branchCount, 2);
+    assert.ok(first.status.ok);
+    assert.ok(last.status.ok);
+    assert.equal(first.value.kind, VAL.NUMBER);
+    assert.equal(last.value.kind, VAL.NUMBER);
+    assert.equal(first.value.number, 3);
+    assert.equal(last.value.number, (1 + branchCount + 1) * 2);
+
+    assert.ok(wb.setNumber(0, 0, 0, 5).ok);
+    const callerOnly = wb.recalcParallel(1);
+    assert.ok(callerOnly.status.ok, `status=${JSON.stringify(callerOnly.status)}`);
+    assert.equal(callerOnly.stats.parallelSteps, 0);
+    assert.ok(callerOnly.stats.serialFallbackSteps > 0);
+    assert.equal(callerOnly.stats.workerThreadsStarted, 0);
+    assert.equal(callerOnly.stats.workerThreadsUsed, 0);
+    assert.equal(wb.getValue(0, branchCount, 2).value.number, (5 + branchCount + 1) * 2);
+
+    const invalid = wb.recalcParallel(9);
+    assert.equal(invalid.status.ok, false);
+    assert.notEqual(invalid.status.status, 0);
+    // Rejected by the binding itself, before any C ABI call: the context
+    // is empty, never a value built from the threadCount the caller
+    // passed (the Status contract's promise for a binding-raised
+    // failure).
+    assert.equal(invalid.status.context, '');
+    assert.equal(invalid.stats.cellsEvaluated, 0);
+    assert.equal(invalid.stats.sccsProcessed, 0);
+    assert.equal(invalid.stats.parallelSteps, 0);
+    assert.equal(invalid.stats.serialFallbackSteps, 0);
+    assert.equal(invalid.stats.cycleRecoveries, 0);
+    assert.equal(invalid.stats.workerThreadsStarted, 0);
+    assert.equal(invalid.stats.workerThreadsUsed, 0);
+
+    for (const invalidThreadCount of [
+      -0.5,
+      1.5,
+      Number.NaN,
+      Number.POSITIVE_INFINITY,
+      Number.NEGATIVE_INFINITY,
+      2 ** 32 + 1,
+      null,
+      undefined,
+    ]) {
+      const invalidShape = wb.recalcParallel(invalidThreadCount);
+      assert.equal(invalidShape.status.ok, false, `threadCount=${String(invalidThreadCount)}`);
+      assert.notEqual(invalidShape.status.status, 0);
+      assert.equal(invalidShape.stats.cellsEvaluated, 0);
+      assert.equal(invalidShape.stats.sccsProcessed, 0);
+      assert.equal(invalidShape.stats.parallelSteps, 0);
+      assert.equal(invalidShape.stats.serialFallbackSteps, 0);
+      assert.equal(invalidShape.stats.cycleRecoveries, 0);
+      assert.equal(invalidShape.stats.workerThreadsStarted, 0);
+      assert.equal(invalidShape.stats.workerThreadsUsed, 0);
+    }
+  } finally {
+    wb.delete();
+  }
+});
+
+// Status ordinals the callback contract is stated in terms of; see
+// `src/utils/error.h`. Spelled out here because the binding does not
+// export a status enum.
+const STATUS = Object.freeze({
+  RECALC_REENTRANT: 4005,
+  CALLBACK_EXCEPTION: 7003,
+});
+
+test('a throwing iterative progress callback aborts the solve and reports a status', async () => {
+  const Module = await getModule();
+  const wb = makeIterativeWorkbook(Module);
+  try {
+    let calls = 0;
+    assert.ok(
+      wb.setIterativeProgress(() => {
+        calls += 1;
+        throw new Error('callback failure');
+      }).ok,
+    );
+
+    // The binding never lets an exception cross back into WASM, where no
+    // landing pad exists to restore the engine's RAII state: the throw
+    // comes back as a status on the same envelope every other call uses.
+    const aborted = wb.recalc();
+    assert.equal(aborted.ok, false, `expected a failure envelope: ${JSON.stringify(aborted)}`);
+    assert.equal(aborted.status, STATUS.CALLBACK_EXCEPTION);
+    assert.equal(calls, 1, 'the solve must stop at the first throw');
+
+    // The workbook is still readable, and the recalc re-entry guard was
+    // released on the way out.
+    const mid = wb.getValue(0, 0, 0);
+    assert.ok(mid.status.ok, JSON.stringify(mid.status));
+    assert.equal(mid.value.kind, VAL.NUMBER);
+
+    const second = wb.recalc();
+    assert.notEqual(second.status, STATUS.RECALC_REENTRANT, 'the re-entry flag stayed set');
+
+    assert.ok(wb.setIterativeProgress(null).ok);
+    assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
+    const recovered = wb.recalc();
+    assert.ok(recovered.ok, `recalc after the throwing callback: ${JSON.stringify(recovered)}`);
+    const converged = wb.getValue(0, 0, 0);
+    assert.ok(converged.status.ok, JSON.stringify(converged.status));
+    assert.equal(converged.value.kind, VAL.NUMBER);
+    assert.ok(Math.abs(converged.value.number - 10) < 0.001, `A1=${converged.value.number}`);
+  } finally {
+    wb.setIterativeProgress(null);
+    wb.delete();
+  }
+});
+
+test('delete() from inside its own progress callback throws instead of crashing', async () => {
+  const Module = await getModule();
+  const wb = makeIterativeWorkbook(Module);
+  let calls = 0;
+  let caught = null;
+  assert.ok(
+    wb.setIterativeProgress(() => {
+      calls += 1;
+      try {
+        wb.delete();
+      } catch (e) {
+        caught = e;
+      }
+      return false;
+    }).ok,
+  );
+
+  const result = wb.recalc();
+  assert.equal(calls, 1, 'the callback must run exactly once');
+  assert.ok(caught instanceof Error, 'delete() inside the callback must throw, not free the handle');
+  assert.match(String(caught.message), /iterative progress callback/);
+  // The handle survived: delete() never reached fm_workbook_destroy, so
+  // the workbook is still usable after the (deliberately cancelled) solve.
+  assert.ok(result.ok, `recalc after a cancelled solve: ${JSON.stringify(result)}`);
+  assert.ok(wb.isValid());
+
+  wb.setIterativeProgress(null);
+  wb.delete();
+});
+
+test('an uncaught delete() inside the progress callback aborts the solve like any other throw', async () => {
+  const Module = await getModule();
+  const wb = makeIterativeWorkbook(Module);
+  let calls = 0;
+  assert.ok(
+    wb.setIterativeProgress(() => {
+      calls += 1;
+      wb.delete(); // not caught here -- propagates the same as a plain `throw`
+    }).ok,
+  );
+
+  const result = wb.recalc();
+  assert.equal(calls, 1);
+  assert.equal(result.ok, false, `expected a failure envelope: ${JSON.stringify(result)}`);
+  assert.equal(result.status, STATUS.CALLBACK_EXCEPTION);
+  assert.ok(wb.isValid(), 'the handle must still be alive: delete() never completed');
+
+  wb.setIterativeProgress(null);
+  wb.delete();
+});
+
+test('an iterative progress callback returning a non-boolean is read by truthiness', async () => {
+  const Module = await getModule();
+  for (const [returned, expectedSweeps] of [
+    ['keep going', 0],
+    [0, 1],
+    [undefined, 0],
+  ]) {
+    const wb = makeIterativeWorkbook(Module);
+    try {
+      let calls = 0;
+      assert.ok(
+        wb.setIterativeProgress(() => {
+          calls += 1;
+          return returned;
+        }).ok,
+      );
+      assert.ok(wb.recalc().ok);
+      // A falsy return aborts after the first sweep; anything else lets
+      // the solve run to convergence.
+      if (expectedSweeps === 1) {
+        assert.equal(calls, 1, `returned=${String(returned)}`);
+      } else {
+        assert.ok(calls > 1, `returned=${String(returned)}, calls=${calls}`);
+      }
+    } finally {
+      wb.setIterativeProgress(null);
+      wb.delete();
+    }
+  }
+});
diff --git a/packages/npm/test/smoke_result_contracts.mjs b/packages/npm/test/smoke_result_contracts.mjs
new file mode 100644
index 000000000..4353accf5
--- /dev/null
+++ b/packages/npm/test/smoke_result_contracts.mjs
@@ -0,0 +1,173 @@
+import test from 'node:test';
+import { assert, getModule, path, pkgRoot, readFile } from './smoke_support.mjs';
+
+// ---- Result-envelope key sets ------------------------------------------
+//
+// A result type whose payload key is declared non-optional must carry that
+// key on every exit path, or `r.name.toUpperCase()` type-checks and then
+// throws at runtime for a caller who skipped the status check. The probe
+// table below is checked for completeness against the declaration file, so
+// a new result type cannot be added without a failure-path probe.
+
+function interfaceBody(dts, name) {
+  const m = dts.match(new RegExp(`^export interface ${name}\\b[^{]*\\{`, 'm'));
+  if (!m) return null;
+  let depth = 0;
+  const open = dts.indexOf('{', m.index);
+  for (let i = open; i < dts.length; i += 1) {
+    if (dts[i] === '{') depth += 1;
+    else if (dts[i] === '}') {
+      depth -= 1;
+      if (depth === 0) return dts.slice(open + 1, i);
+    }
+  }
+  return null;
+}
+
+function interfaceBases(dts, name) {
+  const m = dts.match(new RegExp(`^export interface ${name}\\b([^{]*)\\{`, 'm'));
+  if (!m) return [];
+  const clause = m[1].trim();
+  if (!clause.startsWith('extends')) return [];
+  return clause
+    .slice('extends'.length)
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+// [name, required] for every member, following `extends`.
+function interfaceMembers(dts, name, seen = new Set()) {
+  if (seen.has(name)) return [];
+  seen.add(name);
+  const body = interfaceBody(dts, name);
+  if (body === null) return [];
+  const out = [];
+  for (const base of interfaceBases(dts, name)) out.push(...interfaceMembers(dts, base, seen));
+  for (const m of body.matchAll(/^ {2}(?:readonly\s+)?([A-Za-z_$][\w$]*)(\??)\s*:/gm)) {
+    out.push([m[1], m[2] === '']);
+  }
+  return out;
+}
+
+// Every declared result type that carries a `status` plus at least one
+// required payload key. `Status` itself is the envelope, not a result.
+function resultTypesWithRequiredPayload(dts) {
+  const out = new Map();
+  for (const m of dts.matchAll(/^export interface ([A-Za-z0-9_]+)/gm)) {
+    const name = m[1];
+    if (name === 'Status') continue;
+    const members = interfaceMembers(dts, name);
+    if (!members.some(([key]) => key === 'status')) continue;
+    const required = members.filter(([key, req]) => req && key !== 'status').map(([key]) => key);
+    if (required.length > 0) out.set(name, required);
+  }
+  return out;
+}
+
+// One failing (or, where no failure is reachable, succeeding) call per
+// result type. `fails: false` marks a call whose only failure path is a
+// destroyed handle, which `delete()` makes unusable to probe.
+function envelopeProbes(wb) {
+  return [
+    ['ParallelRecalcResult', true, () => wb.recalcParallel(9)],
+    ['CellResult', true, () => wb.getValue(99, 0, 0)],
+    ['EvalResult', true, () => wb.evaluateFormulaText(99, 0, 0, '=1')],
+    ['EvalArrayResult', true, () => wb.evaluateFormulaArray(99, 0, 0, '=1')],
+    ['SaveResult', true, () => wb.saveAs(99)],
+    ['SaveDiagnosticsResult', true, () => wb.saveWithDiagnostics(99)],
+    ['ReadDiagnosticsResult', false, () => wb.readDiagnostics()],
+    ['StringResult', true, () => wb.sheetName(99)],
+    ['PivotLayoutResult', true, () => wb.pivotLayout(99, 0)],
+    ['PivotWorksheetSourceResult', true, () => wb.pivotCacheGetWorksheetSource(9999)],
+    ['PivotReportLayoutResult', true, () => wb.pivotGetLayout(99, 0)],
+    ['PivotFilterResult', true, () => wb.pivotFilterAt(99, 0, 0)],
+    ['CfRangeResult', true, () => wb.evaluateCfRange(99, 0, 0, 1, 1, Number.NaN)],
+    ['PaginationResult', true, () => wb.paginate(99)],
+    ['SheetViewResult', true, () => wb.getSheetView(99)],
+    ['SheetProtectionResult', true, () => wb.getSheetProtection(99)],
+    ['ColumnsResult', true, () => wb.getSheetColumns(99)],
+    ['RowsResult', true, () => wb.getSheetRowOverrides(99)],
+    ['CommentResult', true, () => wb.getCommentResult(99, 0, 0)],
+    ['CellXfIndexResult', true, () => wb.getCellXfIndex(99, 0, 0)],
+    ['CellXfResult', true, () => wb.getCellXf(9999)],
+    ['FontResult', true, () => wb.getFont(9999)],
+    ['FillResult', true, () => wb.getFill(9999)],
+    ['BorderResult', true, () => wb.getBorder(9999)],
+    ['NumFmtResult', true, () => wb.getNumFmt(59999)],
+    ['LambdaTextResult', true, () => wb.getLambdaText(99, 0, 0)],
+    ['PhoneticRunsResult', true, () => wb.getCellPhoneticRuns(99, 0, 0)],
+    ['PhoneticPropertiesResult', true, () => wb.getCellPhoneticProperties(99, 0, 0)],
+    ['CellStyleResult', true, () => wb.getCellStyle(9999)],
+    ['AddStyleResult', true, () => wb.addXf({ fontIndex: 9999 })],
+    ['AddNumFmtResult', false, () => wb.addNumFmt('0.00')],
+    ['IterativeSettingsResult', false, () => wb.getIterative()],
+    [
+      'PartialRecalcResult',
+      true,
+      () => wb.partialRecalc({ sheet: 99, firstRow: 0, lastRow: 1, firstCol: 0, lastCol: 1 }),
+    ],
+    ['SheetAutoFilterXmlResult', true, () => wb.getSheetAutoFilterXml(99)],
+    ['SheetPrintXmlResult', true, () => wb.getSheetPageSetupXml(99)],
+    ['SheetPrintAreaResult', true, () => wb.getSheetPrintArea(99)],
+    ['SheetPrintTitlesResult', true, () => wb.getSheetPrintTitles(99)],
+    // `getSheetRowBreaks` / `getSheetColBreaks` answer an out-of-range
+    // sheet with an empty list rather than an error, unlike every sibling
+    // print getter, so no failure path is reachable from here.
+    ['SheetPageBreaksResult', false, () => wb.getSheetRowBreaks(99)],
+    ['SheetPageSetupResult', true, () => wb.getSheetPageSetup(99)],
+    ['SheetPageMarginsResult', true, () => wb.getSheetPageMargins(99)],
+    ['NumberResult', true, () => wb.cellCount(99)],
+    // A released handle is the only failure path, which is not usable here.
+    ['PinnedNowResult', false, () => wb.pinnedNow()],
+    ['SpillInfo', true, () => wb.spillInfo(99, 0, 0)],
+    ['SheetFormatDefaultsResult', true, () => wb.getSheetFormatDefaults(99)],
+    ['CellRectResult', true, () => wb.getCellRectPt(99, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }, 0)],
+    ['WidthModelResult', true, () => wb.getWidthModel(99, 0)],
+    ['FormulaResult', true, () => wb.getFormula(99, 0, 0)],
+    ['CellsInRangeResult', true, () => wb.getCellsInRange(99, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 })],
+    ['AutoFilterResult', true, () => wb.getAutoFilter(99)],
+    ['AutoFilterEvalResult', true, () => wb.evaluateAutoFilter(99)],
+    ['ValidationOutcomeResult', true, () => wb.validateValue(99, 0, 0, { kind: 1, number: 1 })],
+    ['ThreadedCommentsResult', true, () => wb.getThreadedComments(99)],
+    // A released handle is the only failure path, which is not usable here.
+    ['PersonsResult', false, () => wb.getPersons()],
+    ['ImageInfoResult', true, () => wb.probeImage(new Uint8Array(4))],
+    ['ImageResult', true, () => wb.getImage(99, 1)],
+    ['InsertImageResult', true, () => wb.insertImage(99, new Uint8Array(4))],
+    ['DisplayTextResult', true, () => wb.getDisplayText(99, 0, 0)],
+    // A released handle is the only failure path, which is not usable here.
+    ['ThemeResult', false, () => wb.getTheme()],
+    ['ResolvedColorResult', true, () => wb.resolveColor({ kind: 2, theme: 0, tint: Number.NaN }, 0)],
+    ['EffectiveStyleResult', true, () => wb.getEffectiveStyle(99, 0, 0)],
+  ];
+}
+
+test('every declared result type is probed for its key set', async () => {
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
+  const declared = resultTypesWithRequiredPayload(dts);
+  const probed = new Set(envelopeProbes({}).map(([name]) => name));
+  const unprobed = [...declared.keys()].filter((name) => !probed.has(name));
+  assert.deepEqual(unprobed, [], 'result types with no failure-path probe');
+  const stale = [...probed].filter((name) => !declared.has(name));
+  assert.deepEqual(stale, [], 'probes for result types that no longer declare a required payload');
+});
+
+test('result envelopes keep their declared keys on failure paths', async () => {
+  const Module = await getModule();
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
+  const declared = resultTypesWithRequiredPayload(dts);
+  const wb = Module.Workbook.createDefault();
+  try {
+    for (const [typeName, expectFailure, call] of envelopeProbes(wb)) {
+      const r = call();
+      if (expectFailure) {
+        assert.equal(r.status.ok, false, `${typeName}: probe was expected to fail`);
+      }
+      const missing = declared.get(typeName).filter((key) => !(key in r));
+      assert.deepEqual(missing, [], `${typeName} dropped declared keys`);
+    }
+  } finally {
+    wb.delete();
+  }
+});
diff --git a/packages/npm/test/smoke_support.mjs b/packages/npm/test/smoke_support.mjs
new file mode 100644
index 000000000..d4e5b56af
--- /dev/null
+++ b/packages/npm/test/smoke_support.mjs
@@ -0,0 +1,102 @@
+// Shared staged-module loader and Module promise for the WASM smoke-test topics.
+
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+// fm_value_kind_t mirror (see src/c_api/formulon_c.h).
+const VAL = Object.freeze({
+  BLANK: 0,
+  NUMBER: 1,
+  BOOL: 2,
+  TEXT: 3,
+  ERROR: 4,
+  ARRAY: 5,
+  REF: 6,
+  LAMBDA: 7,
+});
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const pkgRoot = path.resolve(__dirname, '..');
+const pkgJsonPath = path.join(pkgRoot, 'package.json');
+
+// Resolve the staged entry point through the package's own "exports" map,
+// so a broken entry fails here rather than in a consumer. FORMULON_NPM_ENTRY
+// selects the subpath: "." (single-threaded, default) or "./threads".
+// Fails (rather than skips) if the package isn't staged -- that's the whole
+// point of running these tests against dist/.
+const entry = process.env.FORMULON_NPM_ENTRY ?? '.';
+const threadsEntry = entry === './threads';
+
+async function loadStagedModule() {
+  const raw = await readFile(pkgJsonPath, 'utf8');
+  const pkg = JSON.parse(raw);
+  const target = pkg.exports?.[entry]?.import;
+  if (!target) {
+    throw new Error(`package.json "exports" has no import target for ${entry}: ${pkgJsonPath}`);
+  }
+  // Node ESM requires file:// URLs for absolute paths on Windows;
+  // pathToFileURL is the portable form.
+  return import(pathToFileURL(path.resolve(pkgRoot, target)).href);
+}
+
+async function loadStagedFactory() {
+  const mod = await loadStagedModule();
+  if (typeof mod.default !== 'function') {
+    throw new Error(`expected default export to be a factory, got ${typeof mod.default}`);
+  }
+  return mod.default;
+}
+
+// Load once and reuse across tests; the factory itself is cheap, but the
+// underlying WASM instantiation costs ~30ms per invocation.
+let modulePromise;
+function getModule() {
+  if (!modulePromise) {
+    modulePromise = (async () => {
+      const factory = await loadStagedFactory();
+      return factory();
+    })();
+  }
+  return modulePromise;
+}
+
+// A self-referential average: from a blank A1 the iterative solver walks
+// towards 10, and the progress callback fires after every sweep.
+function makeIterativeWorkbook(Module) {
+  const wb = Module.Workbook.createDefault();
+  assert.ok(wb.setIterative(true, 100, 0.0001).ok);
+  assert.ok(wb.setFormula(0, 0, 0, '=(A1+10)/2').ok);
+  return wb;
+}
+
+// A structured reference the XLSB encoder cannot lower, which
+// makes the writer emit one per-cell warn record.
+function emitXlsbWarning(Module, xlsbFormat) {
+  const wb = Module.Workbook.createDefault();
+  try {
+    assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
+    assert.ok(wb.recalc().ok);
+    assert.ok(wb.saveAs(xlsbFormat).status.ok);
+  } finally {
+    wb.delete();
+  }
+}
+
+export {
+  assert,
+  emitXlsbWarning,
+  entry,
+  getModule,
+  loadStagedFactory,
+  loadStagedModule,
+  makeIterativeWorkbook,
+  path,
+  pkgJsonPath,
+  pkgRoot,
+  readFile,
+  threadsEntry,
+  VAL,
+};
diff --git a/packages/npm/test/smoke_surface_log_eval.mjs b/packages/npm/test/smoke_surface_log_eval.mjs
new file mode 100644
index 000000000..89364ee30
--- /dev/null
+++ b/packages/npm/test/smoke_surface_log_eval.mjs
@@ -0,0 +1,357 @@
+import test from 'node:test';
+import {
+  assert,
+  emitXlsbWarning,
+  getModule,
+  loadStagedFactory,
+  loadStagedModule,
+  path,
+  pkgJsonPath,
+  pkgRoot,
+  readFile,
+  VAL,
+} from './smoke_support.mjs';
+
+// The pthread workers must boot from the core, whose top level starts the
+// runtime; a bundler can empty the entry shim when it is used as a worker.
+test('threads build spawns its workers from the core, not the entry shim', async () => {
+  const glue = await readFile(path.join(pkgRoot, 'dist', 'formulon_threads_core.js'), 'utf8');
+  assert.match(glue, /new Worker\(new URL\("formulon_threads_core\.js",import\.meta\.url\)/);
+  assert.doesNotMatch(glue, /"formulon_threads\.js"/);
+  const pkg = JSON.parse(await readFile(pkgJsonPath, 'utf8'));
+  assert.ok(pkg.sideEffects.includes('./dist/formulon_threads_core.js'));
+});
+test('default export is callable factory returning a Module', async () => {
+  const factory = await loadStagedFactory();
+  assert.equal(typeof factory, 'function');
+  const Module = await factory();
+  assert.ok(Module && typeof Module === 'object');
+  assert.equal(typeof Module.versionString, 'function');
+});
+
+test('all declared enum and constant exports resolve at runtime', async () => {
+  const mod = await loadStagedModule();
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
+  const names = [...dts.matchAll(/^export (?:const )?(?:enum|const) (\w+)/gm)].map((match) => match[1]);
+  for (const name of names) {
+    assert.ok(name in mod, `missing runtime export ${name}`);
+  }
+  assert.equal(mod.ValueKind.Error, 4);
+  assert.equal(mod.PivotAxis.Row, 0);
+  assert.equal(mod.ExternalLinkKind.Dde, 3);
+  // Named constants a consumer needs in order to interpret shared record
+  // fields (`Value.errorCode`, `ExternalLinkRecord.kind`) or to drive the
+  // calc policy. The native package exports the same names and ordinals;
+  // `check_binding_drift dts-enums` holds the two in step.
+  assert.equal(mod.ErrorCode.Div0, 1);
+  assert.equal(mod.ErrorCode.Unknown, 16);
+  assert.equal(mod.CalcMode.Manual, 1);
+  for (const name of ['ErrorCode', 'CalcMode', 'ExternalLinkKind']) {
+    assert.ok(Object.isFrozen(mod[name]), `${name} must be frozen`);
+  }
+});
+
+test('setLogMinLevel / setLogSink are module-level controls on the Module', async () => {
+  const Module = await getModule();
+  assert.equal(typeof Module.setLogMinLevel, 'function');
+  assert.equal(typeof Module.setLogSink, 'function');
+  const mod = await loadStagedModule();
+  for (const level of Object.values(mod.LogLevel)) {
+    assert.ok(Module.setLogMinLevel(level).ok, `level=${level}`);
+  }
+  for (const bad of [-1, 5, 99]) {
+    const r = Module.setLogMinLevel(bad);
+    assert.equal(r.ok, false, `level=${bad} should be rejected`);
+    assert.equal(r.status, 2);
+  }
+  assert.ok(Module.setLogMinLevel(mod.LogLevel.Off).ok);
+});
+
+test('a registered sink receives records only once the threshold admits them', async () => {
+  const Module = await getModule();
+  const mod = await loadStagedModule();
+  const records = [];
+  assert.ok(Module.setLogSink((record) => records.push(new Uint8Array(record))).ok);
+  try {
+    // Default threshold is Off: the same save must produce nothing.
+    emitXlsbWarning(Module, mod.WorkbookFormat.Xlsb);
+    assert.deepEqual(records, []);
+
+    assert.ok(Module.setLogMinLevel(mod.LogLevel.Warn).ok);
+    emitXlsbWarning(Module, mod.WorkbookFormat.Xlsb);
+    assert.ok(records.length > 0, 'expected at least one record');
+    for (const r of records) {
+      // The sink must receive a copy, never a live view into the WASM
+      // instance's own memory: the /threads build backs that memory with
+      // a `SharedArrayBuffer`, over which most browsers' `TextDecoder`
+      // refuses to operate -- a failure this suite cannot reproduce under
+      // Node, so the buffer identity is what it checks instead.
+      assert.ok(!(r.buffer instanceof SharedArrayBuffer), 'log sink record must not be SharedArrayBuffer-backed');
+    }
+    const text = records.map((r) => new TextDecoder().decode(r)).join('');
+    assert.match(text, /xlsb\.writer\.formula_downgraded/);
+    assert.match(text, /"level":"warn"/);
+  } finally {
+    assert.ok(Module.setLogMinLevel(mod.LogLevel.Off).ok);
+    assert.ok(Module.setLogSink(null).ok);
+  }
+});
+
+test('a throwing log sink is dropped and leaves the engine usable', async () => {
+  const Module = await getModule();
+  const mod = await loadStagedModule();
+  let calls = 0;
+  assert.ok(
+    Module.setLogSink(() => {
+      calls += 1;
+      throw new Error('sink failure');
+    }).ok,
+  );
+  try {
+    assert.ok(Module.setLogMinLevel(mod.LogLevel.Warn).ok);
+    // The sink runs from deep inside the writer. If its exception reached
+    // the C++ frames it would tear them down without running a single
+    // destructor, because the binary is linked without exception support.
+    emitXlsbWarning(Module, mod.WorkbookFormat.Xlsb);
+    assert.ok(calls > 0, 'expected the sink to be invoked');
+  } finally {
+    assert.ok(Module.setLogMinLevel(mod.LogLevel.Off).ok);
+    assert.ok(Module.setLogSink(null).ok);
+  }
+
+  const wb = Module.Workbook.createDefault();
+  try {
+    assert.ok(wb.setFormula(0, 0, 0, '=1+1').ok);
+    const after = wb.recalc();
+    assert.ok(after.ok, `recalc after a throwing sink: ${JSON.stringify(after)}`);
+    assert.equal(wb.getValue(0, 0, 0).value.number, 2);
+  } finally {
+    wb.delete();
+  }
+});
+
+// One-shot evaluation is anchored at Sheet1!A1 and read-only on every
+// shipped surface, so these must agree value-for-value with the WASM
+// package and the Python wheel. The anchor-referencing cases are the ones
+// that diverge if a surface writes the formula into A1 and recalcs.
+const ONE_SHOT_CASES = [
+  { formula: '=1+2', kind: 1, number: 3 },
+  { formula: '=A1', kind: 1, number: 0 },
+  { formula: '=COUNTA(A1)', kind: 1, number: 0 },
+  { formula: '=ISBLANK(A1)', kind: 2, boolean: 1 },
+  { formula: '=SUM(A1:A3)', kind: 1, number: 0 },
+  { formula: '=SEQUENCE(3)', kind: 1, number: 1 },
+  { formula: '=ROWS(SEQUENCE(3))', kind: 1, number: 3 },
+];
+test('evalFormula evaluates read-only against a blank anchor', async () => {
+  const Module = await getModule();
+  for (const spec of ONE_SHOT_CASES) {
+    const r = Module.evalFormula(spec.formula);
+    assert.ok(r.status.ok, `${spec.formula}: ${JSON.stringify(r.status)}`);
+    assert.equal(r.value.kind, spec.kind, spec.formula);
+    if (spec.number !== undefined) {
+      assert.equal(r.value.number, spec.number, spec.formula);
+    }
+    if (spec.boolean !== undefined) {
+      assert.equal(r.value.boolean, spec.boolean, spec.formula);
+    }
+    assert.equal(r.value.errorCode, 0, spec.formula);
+  }
+});
+
+// Parses the staged `export enum X { A = 0, ... }` declarations into
+// {name: {member: ordinal}}. Name presence alone is not enough: a staged
+// bundle carrying a stale ordinal ships a constant that silently means
+// something else, and nothing upstream of dist/ can see that.
+function declaredOrdinalTables(dts) {
+  const tables = {};
+  const blocks = dts.matchAll(/^export enum (\w+) \{([^}]*)\}/gm);
+  for (const [, name, body] of blocks) {
+    const members = {};
+    let next = 0;
+    for (const line of body.split(',')) {
+      const m = line.trim().match(/^(\w+)\s*(?:=\s*(-?\d+))?$/);
+      if (!m) continue;
+      if (m[2] !== undefined) next = Number(m[2]);
+      members[m[1]] = next;
+      next += 1;
+    }
+    tables[name] = members;
+  }
+  return tables;
+}
+
+test('staged constant tables carry the ordinals the staged .d.ts declares', async () => {
+  const mod = await loadStagedModule();
+  const dts = await readFile(path.join(pkgRoot, 'dist', 'formulon.d.ts'), 'utf8');
+  const tables = declaredOrdinalTables(dts);
+  assert.ok(Object.keys(tables).length > 0, 'expected declared ordinal tables');
+  for (const [name, members] of Object.entries(tables)) {
+    const runtime = mod[name];
+    assert.ok(runtime, `missing runtime table ${name}`);
+    assert.deepEqual({ ...runtime }, members, `${name} ordinals differ from dist/formulon.d.ts`);
+    assert.ok(Object.isFrozen(runtime), `${name} must be frozen`);
+  }
+});
+
+// Builds a workbook with one pivot, ready for the filter-contract cases.
+// `delete` is embind's auto-added finaliser; the caller must call it.
+function makePivotWorkbook(Workbook) {
+  const wb = Workbook.createDefault();
+  const cacheId = wb.pivotCacheCreate(0).index;
+  // A cache without a worksheet source cannot be saved, so the fixture
+  // declares the range its two fields and two records occupy.
+  assert.ok(wb.pivotCacheSetWorksheetSource(cacheId, { present: true, ref: 'A1:B3', sheet: 'Sheet1' }).ok);
+  assert.ok(wb.pivotCacheFieldAdd(cacheId, 'Region').status.ok);
+  assert.ok(wb.pivotCacheFieldAdd(cacheId, 'Amount').status.ok);
+  for (const [region, amount] of [
+    ['East', 10],
+    ['West', 30],
+  ]) {
+    const rec = wb.pivotCacheRecordAdd(cacheId).index;
+    assert.ok(wb.pivotCacheRecordSetText(cacheId, rec, 0, region).ok);
+    assert.ok(wb.pivotCacheRecordSetNumber(cacheId, rec, 1, amount).ok);
+  }
+  const pivot = wb.pivotCreate(0, 'Pivot1', cacheId, 0, 4);
+  assert.ok(pivot.status.ok, JSON.stringify(pivot.status));
+  assert.ok(wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Region', axis: 0 }).status.ok);
+  const amountField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Amount', axis: 2 });
+  assert.ok(amountField.status.ok);
+  assert.ok(
+    wb.pivotDataFieldAdd(0, pivot.index, {
+      name: 'Sum of Amount',
+      fieldIndex: amountField.index,
+      aggregation: 0,
+    }).status.ok,
+  );
+  return { wb, pivot: pivot.index };
+}
+
+// greaterThan on a double payload: the shape pivotFilterAt must read back.
+const PIVOT_FILTER = Object.freeze({
+  axis: 0,
+  fieldName: 'Region',
+  type: 1,
+  valueKind: 1,
+  valueDouble: 15,
+});
+
+test('pivotFilterAt reads back an added filter field for field', async () => {
+  const Module = await getModule();
+  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
+  try {
+    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
+    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
+    const got = wb.pivotFilterAt(0, pivot, 0);
+    assert.ok(got.status.ok, JSON.stringify(got.status));
+    assert.equal(got.axis, PIVOT_FILTER.axis);
+    assert.equal(got.fieldName, PIVOT_FILTER.fieldName);
+    assert.equal(got.type, PIVOT_FILTER.type);
+    assert.equal(got.valueKind, PIVOT_FILTER.valueKind);
+    assert.equal(got.valueDouble, PIVOT_FILTER.valueDouble);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('pivotFilterCount reports only what this session added', async () => {
+  const Module = await getModule();
+  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
+  try {
+    assert.equal(wb.pivotFilterCount(0, pivot).value, 0);
+    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
+    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('active filters are session state and do not survive save/load', async () => {
+  const Module = await getModule();
+  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
+  let bytes;
+  try {
+    assert.ok(wb.pivotFilterAdd(0, pivot, PIVOT_FILTER).ok);
+    assert.equal(wb.pivotFilterCount(0, pivot).value, 1);
+    const saved = wb.save();
+    assert.ok(saved.status.ok, JSON.stringify(saved.status));
+    bytes = saved.bytes;
+  } finally {
+    wb.delete();
+  }
+  const reloaded = Module.Workbook.loadBytes(bytes);
+  try {
+    assert.equal(reloaded.pivotCount(0).value, 1);
+    // The pivot round-trips; its active-filter list deliberately does not.
+    assert.equal(reloaded.pivotFilterCount(0, 0).value, 0);
+  } finally {
+    reloaded.delete();
+  }
+});
+
+test('pivotFilterAt rejects an out-of-range index', async () => {
+  const Module = await getModule();
+  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
+  try {
+    const got = wb.pivotFilterAt(0, pivot, 99);
+    assert.equal(got.status.ok, false);
+  } finally {
+    wb.delete();
+  }
+});
+
+test('a required pivot spec string field left out of the object is rejected, not silently empty', async () => {
+  const Module = await getModule();
+  const { wb, pivot } = makePivotWorkbook(Module.Workbook);
+  try {
+    const fieldCountBefore = wb.pivotFieldCount(0, pivot).value;
+    const field = wb.pivotFieldAdd(0, pivot, { axis: 0 }); // no `sourceName`
+    assert.equal(field.status.ok, false);
+    assert.equal(field.status.status, 7001);
+    assert.equal(wb.pivotFieldCount(0, pivot).value, fieldCountBefore, 'no field must have been added');
+
+    const dataFieldCountBefore = wb.pivotDataFieldCount(0, pivot).value;
+    const dataField = wb.pivotDataFieldAdd(0, pivot, { fieldIndex: 0, aggregation: 0 }); // no `name`
+    assert.equal(dataField.status.ok, false);
+    assert.equal(dataField.status.status, 7001);
+    assert.equal(wb.pivotDataFieldCount(0, pivot).value, dataFieldCountBefore, 'no data field must have been added');
+
+    const filterCountBefore = wb.pivotFilterCount(0, pivot).value;
+    const filter = wb.pivotFilterAdd(0, pivot, { axis: 0, type: 1, valueKind: 1, valueDouble: 15 }); // no `fieldName`
+    assert.equal(filter.ok, false);
+    assert.equal(filter.status, 7001);
+    assert.equal(wb.pivotFilterCount(0, pivot).value, filterCountBefore, 'no filter must have been added');
+  } finally {
+    wb.delete();
+  }
+});
+
+test('versionString returns a non-empty string', async () => {
+  const Module = await getModule();
+  const v = Module.versionString();
+  assert.equal(typeof v, 'string');
+  assert.ok(v.length > 0, `expected non-empty version, got ${JSON.stringify(v)}`);
+});
+
+test('evalFormula(=SUM(1,2,3)) returns NUMBER 6', async () => {
+  const Module = await getModule();
+  const r = Module.evalFormula('=SUM(1,2,3)');
+  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+  assert.equal(r.value.kind, VAL.NUMBER);
+  assert.equal(r.value.number, 6);
+});
+
+test('evalFormula(=1/0) surfaces Excel error as a value (not failed status)', async () => {
+  const Module = await getModule();
+  const r = Module.evalFormula('=1/0');
+  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+  assert.equal(r.value.kind, VAL.ERROR);
+});
+
+test('evalFormula uses read-only evaluation for the intersection operator', async () => {
+  const Module = await getModule();
+  const r = Module.evalFormula('=A1 B1');
+  assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+  assert.equal(r.value.kind, VAL.ERROR);
+  assert.equal(r.value.errorCode, 0); // ErrorCode::Null / #NULL!
+});
diff --git a/packages/python/formulon/__init__.py b/packages/python/formulon/__init__.py
index 05057903c..61a7c0267 100644
--- a/packages/python/formulon/__init__.py
+++ b/packages/python/formulon/__init__.py
@@ -28,6 +28,13 @@
     merge_function_metadata,
 )
 from .workbook import (
+    AnchorEditAs,
+    AnchorKind,
+    AutoFilter,
+    AutoFilterColumn,
+    AutoFilterDateGroup,
+    AutoFilterSortCondition,
+    AutoFilterSortState,
     CalcMode,
     Cell,
     CellNode,
@@ -38,6 +45,8 @@
     CfMatch,
     CfValueObject,
     CivilTime,
+    ColorContext,
+    ColorResolution,
     ColorScale,
     ColorSpec,
     ColumnLayout,
@@ -48,25 +57,42 @@
     DataBar,
     DataValidation,
     DataValidationInput,
+    DateTimeGrouping,
     DefinedName,
     DifferentialFormat,
+    DisplayStatus,
+    DrawingObject,
+    DrawingObjectKind,
+    DynamicFilterType,
+    EffectiveStyle,
+    EffectiveStyleSource,
     ErrorCode,
     ExternalLink,
     ExternalLinkKind,
     FillRecord,
+    FilterKind,
+    FilterOperator,
     FontRecord,
     FormulonError,
     FunctionMetadata,
+    GeometryMode,
     Hyperlink,
     IconSet,
+    ImageFormat,
+    ImageInfo,
     IterativeSettings,
     LogLevel,
+    MarginsPt,
+    Mention,
     MergeRange,
     PageBreak,
+    PageLayout,
     PageMargins,
     PageSetup,
     PaginationResult,
+    PaperInfo,
     PassthroughPart,
+    Person,
     PhoneticProperties,
     PhoneticRun,
     PivotAggregation,
@@ -84,16 +110,29 @@
     PivotReportLayout,
     PivotShowValuesAs,
     PivotWorksheetSource,
+    PrintTitles,
     ReadDiagnostics,
+    RectPt,
+    ResolvedColor,
     RowLayout,
     SaveDiagnostics,
+    SheetFormatDefaults,
     SheetProtection,
     SheetView,
     SheetVisibility,
+    SortBy,
+    SortMethod,
     SpillInfo,
     StyleBatchIndices,
     Table,
+    Theme,
+    ThemeFonts,
+    ThemeSource,
+    ThreadedComment,
+    ValidationErrorStyle,
+    ValidationOutcome,
     Value,
+    WidthModel,
     Workbook,
     WorkbookFormat,
     _check,
@@ -150,6 +189,15 @@ def _resolve_version() -> str:
 __version__ = _resolve_version()
 
 __all__ = [
+    "AutoFilterDateGroup",
+    "AutoFilterColumn",
+    "AutoFilterSortCondition",
+    "AutoFilterSortState",
+    "AutoFilter",
+    "Mention",
+    "Person",
+    "ThreadedComment",
+    "ValidationOutcome",
     "CalcMode",
     "Cell",
     "CellNode",
@@ -221,6 +269,36 @@ def _resolve_version() -> str:
     "Table",
     "Value",
     "ValueKind",
+    "DisplayStatus",
+    "GeometryMode",
+    "MarginsPt",
+    "PageLayout",
+    "PaperInfo",
+    "PrintTitles",
+    "RectPt",
+    "SheetFormatDefaults",
+    "ColorContext",
+    "AnchorEditAs",
+    "AnchorKind",
+    "DrawingObject",
+    "DrawingObjectKind",
+    "ImageFormat",
+    "ImageInfo",
+    "FilterKind",
+    "FilterOperator",
+    "DynamicFilterType",
+    "SortBy",
+    "SortMethod",
+    "DateTimeGrouping",
+    "ValidationErrorStyle",
+    "ColorResolution",
+    "EffectiveStyle",
+    "ResolvedColor",
+    "EffectiveStyleSource",
+    "Theme",
+    "ThemeFonts",
+    "ThemeSource",
+    "WidthModel",
     "Workbook",
     "WorkbookFormat",
     "__version__",
diff --git a/packages/python/formulon/__init__.pyi b/packages/python/formulon/__init__.pyi
index c881d7576..b9ea0479e 100644
--- a/packages/python/formulon/__init__.pyi
+++ b/packages/python/formulon/__init__.pyi
@@ -70,6 +70,77 @@ class PaginationResult:
     print_area: List[tuple[int, int, int, int]]
     horizontal_breaks: List[int]
     vertical_breaks: List[int]
+    paper: PaperInfo
+    margins: MarginsPt
+    printable: RectPt
+    scale: float
+    page_order: int
+    print_titles: PrintTitles
+    pages: List[PageLayout]
+    horizontal_break_manual: List[bool]
+    vertical_break_manual: List[bool]
+
+class RectPt:
+    x: float
+    y: float
+    width: float
+    height: float
+
+class PaperInfo:
+    width_pt: float
+    height_pt: float
+    landscape: bool
+    known: bool
+
+class MarginsPt:
+    left: float
+    right: float
+    top: float
+    bottom: float
+    header: float
+    footer: float
+
+class PrintTitles:
+    has_rows: bool
+    first_row: int
+    last_row: int
+    has_cols: bool
+    first_col: int
+    last_col: int
+
+class PageLayout:
+    area_index: int
+    first_row: int
+    last_row: int
+    first_col: int
+    last_col: int
+    origin_x_pt: float
+    origin_y_pt: float
+    width_pt: float
+    height_pt: float
+
+class SheetFormatDefaults:
+    default_col_width: float
+    default_row_height: float
+    base_col_width: float
+    has_default_col_width: bool
+    has_default_row_height: bool
+    def __init__(
+        self,
+        default_col_width: float = ...,
+        default_row_height: float = ...,
+        base_col_width: float = ...,
+        has_default_col_width: bool = ...,
+        has_default_row_height: bool = ...,
+    ) -> None: ...
+
+class WidthModel:
+    points_per_char: float
+    padding_pt: float
+    normal_font_size: float
+    calibrated: bool
+    normal_font_name: str
+    platform: str
 
 class PageBreak:
     id: int
@@ -150,6 +221,143 @@ class ReadDiagnostics:
 # Enumerations
 # ---------------------------------------------------------------------------
 
+class GeometryMode(IntEnum):
+    DISPLAY = 0
+    PRINT = 1
+
+class DisplayStatus(IntEnum):
+    OK = 0
+    OVERFLOW = 1
+    INVALID_FORMAT = 2
+
+class FilterKind(IntEnum):
+    NONE = 0
+    VALUES = 1
+    CUSTOM = 2
+    TOP10 = 3
+    DYNAMIC = 4
+    COLOR = 5
+    ICON = 6
+
+class FilterOperator(IntEnum):
+    EQUAL = 0
+    LESS_THAN = 1
+    LESS_THAN_OR_EQUAL = 2
+    NOT_EQUAL = 3
+    GREATER_THAN_OR_EQUAL = 4
+    GREATER_THAN = 5
+
+class DynamicFilterType(IntEnum):
+    NULL = 0
+    ABOVE_AVERAGE = 1
+    BELOW_AVERAGE = 2
+    TOMORROW = 3
+    TODAY = 4
+    YESTERDAY = 5
+    NEXT_WEEK = 6
+    THIS_WEEK = 7
+    LAST_WEEK = 8
+    NEXT_MONTH = 9
+    THIS_MONTH = 10
+    LAST_MONTH = 11
+    NEXT_QUARTER = 12
+    THIS_QUARTER = 13
+    LAST_QUARTER = 14
+    NEXT_YEAR = 15
+    THIS_YEAR = 16
+    LAST_YEAR = 17
+    YEAR_TO_DATE = 18
+    Q1 = 19
+    Q2 = 20
+    Q3 = 21
+    Q4 = 22
+    M1 = 23
+    M2 = 24
+    M3 = 25
+    M4 = 26
+    M5 = 27
+    M6 = 28
+    M7 = 29
+    M8 = 30
+    M9 = 31
+    M10 = 32
+    M11 = 33
+    M12 = 34
+
+class SortBy(IntEnum):
+    VALUE = 0
+    CELL_COLOR = 1
+    FONT_COLOR = 2
+    ICON = 3
+
+class SortMethod(IntEnum):
+    NONE = 0
+    PIN_YIN = 1
+    STROKE = 2
+
+class DateTimeGrouping(IntEnum):
+    YEAR = 0
+    MONTH = 1
+    DAY = 2
+    HOUR = 3
+    MINUTE = 4
+    SECOND = 5
+
+class ValidationErrorStyle(IntEnum):
+    STOP = 0
+    WARNING = 1
+    INFORMATION = 2
+
+class ColorContext(IntEnum):
+    FONT = 0
+    FILL_FOREGROUND = 1
+    FILL_BACKGROUND = 2
+    BORDER = 3
+
+class ImageFormat(IntEnum):
+    UNKNOWN = 0
+    PNG = 1
+    JPEG = 2
+    GIF = 3
+    BMP = 4
+
+class DrawingObjectKind(IntEnum):
+    PICTURE = 0
+    SHAPE = 1
+    CHART = 2
+    GROUP = 3
+    CONNECTOR = 4
+    GRAPHIC_FRAME = 5
+    OTHER = 6
+
+class AnchorKind(IntEnum):
+    ONE_CELL = 0
+    TWO_CELL = 1
+    ABSOLUTE = 2
+
+class AnchorEditAs(IntEnum):
+    TWO_CELL = 0
+    ONE_CELL = 1
+    ABSOLUTE = 2
+
+class ColorResolution(IntEnum):
+    EXACT = 0
+    DEFAULT_THEME = 1
+    INDEX_OUT_OF_RANGE = 2
+    THEME_UNPARSEABLE = 3
+    AUTO_CONTEXT = 4
+
+class ThemeSource(IntEnum):
+    PART = 0
+    DEFAULT = 1
+    UNPARSEABLE = 2
+
+class EffectiveStyleSource(IntEnum):
+    CELL = 0
+    ROW = 1
+    COLUMN = 2
+    DEFAULT = 3
+
 class CalcMode(IntEnum):
     AUTO = 0
     MANUAL = 1
@@ -297,7 +505,7 @@ class DataValidation:
     ranges: List[MergeRange]
     type: int
     op: int
-    error_style: int
+    error_style: Union[ValidationErrorStyle, int]
     allow_blank: bool
     show_input_message: bool
     show_error_message: bool
@@ -309,11 +517,253 @@ class DataValidation:
     prompt_title: str
     prompt_message: str
 
+class AutoFilterDateGroup:
+    year: int
+    month: int
+    day: int
+    hour: int
+    minute: int
+    second: int
+    grouping: Union[DateTimeGrouping, int]
+    def __init__(
+        self,
+        year: int = ...,
+        month: int = ...,
+        day: int = ...,
+        hour: int = ...,
+        minute: int = ...,
+        second: int = ...,
+        grouping: Union[DateTimeGrouping, int] = ...,
+    ) -> None: ...
+
+class AutoFilterColumn:
+    col_id: int
+    hidden_button: bool
+    show_button: bool
+    kind: Union[FilterKind, int]
+    filter_blank: bool
+    values: List[str]
+    date_groups: List[AutoFilterDateGroup]
+    custom_and: bool
+    custom_count: int
+    op1: Union[FilterOperator, int]
+    val1: str
+    op2: Union[FilterOperator, int]
+    val2: str
+    top: bool
+    percent: bool
+    has_filter_val: bool
+    top_val: float
+    filter_val: float
+    dynamic_type: Union[DynamicFilterType, int]
+    has_dyn_val: bool
+    has_dyn_max_val: bool
+    dyn_val: float
+    dyn_max_val: float
+    val_iso: str
+    max_val_iso: str
+    dxf_id: int
+    cell_color: bool
+    icon_set: int
+    icon_id: int
+    has_icon_id: bool
+    def __init__(
+        self,
+        col_id: int,
+        hidden_button: bool = ...,
+        show_button: bool = ...,
+        kind: Union[FilterKind, int] = ...,
+        filter_blank: bool = ...,
+        values: List[str] = ...,
+        date_groups: List[AutoFilterDateGroup] = ...,
+        custom_and: bool = ...,
+        custom_count: int = ...,
+        op1: Union[FilterOperator, int] = ...,
+        val1: str = ...,
+        op2: Union[FilterOperator, int] = ...,
+        val2: str = ...,
+        top: bool = ...,
+        percent: bool = ...,
+        has_filter_val: bool = ...,
+        top_val: float = ...,
+        filter_val: float = ...,
+        dynamic_type: Union[DynamicFilterType, int] = ...,
+        has_dyn_val: bool = ...,
+        has_dyn_max_val: bool = ...,
+        dyn_val: float = ...,
+        dyn_max_val: float = ...,
+        val_iso: str = ...,
+        max_val_iso: str = ...,
+        dxf_id: int = ...,
+        cell_color: bool = ...,
+        icon_set: int = ...,
+        icon_id: int = ...,
+        has_icon_id: bool = ...,
+    ) -> None: ...
+
+class AutoFilterSortCondition:
+    ref: MergeRange
+    descending: bool
+    sort_by: Union[SortBy, int]
+    custom_list: str
+    dxf_id: int
+    has_dxf_id: bool
+    icon_set: int
+    icon_id: int
+    has_icon_id: bool
+    def __init__(
+        self,
+        ref: MergeRange,
+        descending: bool = ...,
+        sort_by: Union[SortBy, int] = ...,
+        custom_list: str = ...,
+        dxf_id: int = ...,
+        has_dxf_id: bool = ...,
+        icon_set: int = ...,
+        icon_id: int = ...,
+        has_icon_id: bool = ...,
+    ) -> None: ...
+
+class AutoFilterSortState:
+    ref: MergeRange
+    column_sort: bool
+    case_sensitive: bool
+    sort_method: Union[SortMethod, int]
+    conditions: List[AutoFilterSortCondition]
+    def __init__(
+        self,
+        ref: MergeRange,
+        column_sort: bool = ...,
+        case_sensitive: bool = ...,
+        sort_method: Union[SortMethod, int] = ...,
+        conditions: List[AutoFilterSortCondition] = ...,
+    ) -> None: ...
+
+class AutoFilter:
+    range: MergeRange
+    columns: List[AutoFilterColumn]
+    sort: Optional[AutoFilterSortState]
+    def __init__(
+        self,
+        range: MergeRange,
+        columns: List[AutoFilterColumn] = ...,
+        sort: Optional[AutoFilterSortState] = ...,
+    ) -> None: ...
+
+class ValidationOutcome:
+    has_rule: bool
+    valid: bool
+    rule_index: int
+    error_style: Union[ValidationErrorStyle, int]
+    def __init__(
+        self,
+        has_rule: bool,
+        valid: bool,
+        rule_index: int,
+        error_style: Union[ValidationErrorStyle, int],
+    ) -> None: ...
+
+class Mention:
+    person_id: str
+    mention_id: str
+    start: int
+    length: int
+    def __init__(
+        self,
+        person_id: str,
+        mention_id: str,
+        start: int,
+        length: int,
+    ) -> None: ...
+
+class ThreadedComment:
+    id: str
+    row: int
+    col: int
+    person_id: str
+    created: str
+    text: str
+    parent_id: str
+    done: bool
+    mentions: List[Mention]
+    def __init__(
+        self,
+        id: str,
+        row: int = ...,
+        col: int = ...,
+        person_id: str = ...,
+        created: str = ...,
+        text: str = ...,
+        parent_id: str = ...,
+        done: bool = ...,
+        mentions: List[Mention] = ...,
+    ) -> None: ...
+
+class ImageInfo:
+    format: Union[ImageFormat, int]
+    px_width: int
+    px_height: int
+    def __init__(self, format: Union[ImageFormat, int], px_width: int, px_height: int) -> None: ...
+
+class DrawingObject:
+    object_id: int
+    kind: Union[DrawingObjectKind, int]
+    anchor_kind: Union[AnchorKind, int]
+    edit_as: Union[AnchorEditAs, int]
+    from_row: int
+    from_col: int
+    from_row_off: int
+    from_col_off: int
+    to_row: int
+    to_col: int
+    to_row_off: int
+    to_col_off: int
+    cx: int
+    cy: int
+    image_format: Union[ImageFormat, int]
+    name: str
+    descr: str
+    media_path: str
+    def __init__(
+        self,
+        object_id: int,
+        kind: Union[DrawingObjectKind, int],
+        anchor_kind: Union[AnchorKind, int],
+        edit_as: Union[AnchorEditAs, int],
+        from_row: int,
+        from_col: int,
+        from_row_off: int,
+        from_col_off: int,
+        to_row: int,
+        to_col: int,
+        to_row_off: int,
+        to_col_off: int,
+        cx: int,
+        cy: int,
+        image_format: Union[ImageFormat, int],
+        name: str,
+        descr: str,
+        media_path: str,
+    ) -> None: ...
+
+class Person:
+    id: str
+    display_name: str
+    user_id: str
+    provider_id: str
+    def __init__(
+        self,
+        id: str,
+        display_name: str,
+        user_id: str = ...,
+        provider_id: str = ...,
+    ) -> None: ...
+
 class DataValidationInput:
     type: int
     ranges: List[MergeRange]
     op: int
-    error_style: int
+    error_style: Union[ValidationErrorStyle, int]
     allow_blank: bool
     show_input_message: bool
     show_error_message: bool
@@ -329,7 +779,7 @@ class DataValidationInput:
         type: int,
         ranges: List[MergeRange] = ...,
         op: int = ...,
-        error_style: int = ...,
+        error_style: Union[ValidationErrorStyle, int] = ...,
         allow_blank: bool = ...,
         show_input_message: bool = ...,
         show_error_message: bool = ...,
@@ -430,6 +880,8 @@ class RowLayout:
     outline_level: int
     has_style: bool
     style_xf: int
+    has_height: bool
+    custom_height: bool
 
 class CfMatch:
     kind: int
@@ -673,6 +1125,16 @@ class CellXf:
     has_vertical_align: Optional[bool]
     has_wrap_text: Optional[bool]
     has_justify_last_line: Optional[bool]
+    apply_number_format: bool
+    apply_font: bool
+    apply_fill: bool
+    apply_border: bool
+    apply_alignment: bool
+    apply_protection: bool
+    quote_prefix: bool
+    has_protection: bool
+    locked: bool
+    hidden: bool
     def __init__(
         self,
         font_index: int,
@@ -694,6 +1156,16 @@ class CellXf:
         has_vertical_align: Optional[bool] = ...,
         has_wrap_text: Optional[bool] = ...,
         has_justify_last_line: Optional[bool] = ...,
+        apply_number_format: bool = ...,
+        apply_font: bool = ...,
+        apply_fill: bool = ...,
+        apply_border: bool = ...,
+        apply_alignment: bool = ...,
+        apply_protection: bool = ...,
+        quote_prefix: bool = ...,
+        has_protection: bool = ...,
+        locked: bool = ...,
+        hidden: bool = ...,
     ) -> None: ...
 
 class ColorSpec:
@@ -810,6 +1282,68 @@ class CellStyle:
     i_level: int
     hidden: bool
     custom_builtin: bool
+    def __init__(
+        self,
+        name: str,
+        xf_id: int,
+        builtin_id: int = ...,
+        i_level: int = ...,
+        hidden: bool = ...,
+        custom_builtin: bool = ...,
+    ) -> None: ...
+
+class ThemeFonts:
+    major_latin: str
+    major_east_asian: str
+    minor_latin: str
+    minor_east_asian: str
+    def __init__(
+        self,
+        major_latin: str = ...,
+        major_east_asian: str = ...,
+        minor_latin: str = ...,
+        minor_east_asian: str = ...,
+    ) -> None: ...
+
+class Theme:
+    source: ThemeSource
+    colors: List[int]
+    fonts: ThemeFonts
+    def __init__(self, source: ThemeSource, colors: List[int], fonts: ThemeFonts) -> None: ...
+
+class ResolvedColor:
+    argb: int
+    resolution: ColorResolution
+    def __init__(self, argb: int, resolution: ColorResolution) -> None: ...
+
+class EffectiveStyle:
+    xf_index: int
+    source: EffectiveStyleSource
+    font_index: int
+    fill_index: int
+    border_index: int
+    font: ResolvedColor
+    fill_foreground: ResolvedColor
+    fill_background: ResolvedColor
+    borders: List[ResolvedColor]
+    locked: bool
+    hidden: bool
+    num_fmt_code: str
+    def __init__(
+        self,
+        xf_index: int,
+        source: EffectiveStyleSource,
+        font_index: int,
+        fill_index: int,
+        border_index: int,
+        font: ResolvedColor,
+        fill_foreground: ResolvedColor,
+        fill_background: ResolvedColor,
+        borders: List[ResolvedColor],
+        locked: bool,
+        hidden: bool,
+        num_fmt_code: str,
+    ) -> None: ...
 
 class ExternalLink:
     index: int
@@ -1175,6 +1709,76 @@ class Workbook:
     def set_column_outline(self, sheet: int, first: int, last: int, level: int) -> None: ...
     def get_sheet_row_overrides(self, sheet: int) -> List[RowLayout]: ...
     def set_row_height(self, sheet: int, row: int, height: float) -> None: ...
+    def clear_row_height(self, sheet: int, row: int) -> None: ...
+    def get_sheet_format_defaults(self, sheet: int) -> SheetFormatDefaults: ...
+    def set_sheet_format_defaults(self, sheet: int, defaults: SheetFormatDefaults) -> None: ...
+    def get_cell_rect_pt(self, sheet: int, cell_range: MergeRange, mode: Union[GeometryMode, int] = ...) -> RectPt: ...
+    def get_column_width_pt(self, sheet: int, col: int, mode: Union[GeometryMode, int] = ...) -> float: ...
+    def get_row_height_pt(self, sheet: int, row: int) -> float: ...
+    def get_width_model(self, sheet: int, mode: Union[GeometryMode, int] = ...) -> WidthModel: ...
+    def column_chars_to_pt(self, sheet: int, chars: float, mode: Union[GeometryMode, int] = ...) -> float: ...
+    def column_pt_to_chars(self, sheet: int, pt: float, mode: Union[GeometryMode, int] = ...) -> float: ...
+    def get_formula(self, sheet: int, row: int, col: int) -> Optional[str]: ...
+    def get_formula_r1c1(self, sheet: int, row: int, col: int) -> Optional[str]: ...
+    def get_cells_in_range(
+        self,
+        sheet: int,
+        cell_range: MergeRange,
+        cursor: Optional[int] = ...,
+        limit: Optional[int] = ...,
+    ) -> Tuple[List[Cell], Optional[int]]: ...
+    def get_auto_filter(self, sheet: int) -> Optional[AutoFilter]: ...
+    def set_auto_filter(self, sheet: int, auto_filter: AutoFilter) -> None: ...
+    def remove_auto_filter(self, sheet: int) -> None: ...
+    def apply_auto_filter(self, sheet: int) -> None: ...
+    def clear_auto_filter(self, sheet: int) -> None: ...
+    def evaluate_auto_filter(self, sheet: int) -> Tuple[int, List[bool]]: ...
+    def get_table_auto_filter(self, table_index: int) -> Optional[AutoFilter]: ...
+    def set_table_auto_filter(self, table_index: int, auto_filter: AutoFilter) -> None: ...
+    def remove_table_auto_filter(self, table_index: int) -> None: ...
+    def apply_table_auto_filter(self, table_index: int) -> None: ...
+    def clear_table_auto_filter(self, table_index: int) -> None: ...
+    def evaluate_table_auto_filter(self, table_index: int) -> Tuple[int, List[bool]]: ...
+    def validate_value(self, sheet: int, row: int, col: int, value: Value) -> ValidationOutcome: ...
+    def list_invalid_cells(
+        self,
+        sheet: int,
+        cursor: Optional[int] = ...,
+        limit: Optional[int] = ...,
+    ) -> Tuple[List[Cell], Optional[int]]: ...
+    def get_threaded_comments(self, sheet: int) -> List[ThreadedComment]: ...
+    def add_threaded_comment(self, sheet: int, comment: ThreadedComment) -> None: ...
+    def edit_threaded_comment(
+        self, sheet: int, comment_id: str, text: str, mentions: Sequence[Mention] = ...
+    ) -> None: ...
+    def set_thread_resolved(self, sheet: int, thread_id: str, done: bool) -> None: ...
+    def remove_threaded_comment(self, sheet: int, comment_id: str) -> None: ...
+    def probe_image(self, data: Union[bytes, bytearray, memoryview]) -> ImageInfo: ...
+    def list_drawing_objects(self, sheet: int) -> List[DrawingObject]: ...
+    def get_image(self, sheet: int, object_id: int) -> bytes: ...
+    def insert_image(
+        self,
+        sheet: int,
+        data: Union[bytes, bytearray, memoryview],
+        *,
+        name: str = ...,
+        descr: str = ...,
+        anchor_kind: Union[AnchorKind, int] = ...,
+        edit_as: Union[AnchorEditAs, int] = ...,
+        row: int = ...,
+        col: int = ...,
+        row_off_emu: int = ...,
+        col_off_emu: int = ...,
+        width_emu: int = ...,
+        height_emu: int = ...,
+    ) -> int: ...
+    def remove_image(self, sheet: int, object_id: int) -> None: ...
+    def get_persons(self) -> List[Person]: ...
+    def add_person(self, person: Person) -> None: ...
+    def remove_person(self, person_id: str) -> None: ...
+    def get_merges_in_range(self, sheet: int, cell_range: MergeRange) -> List[MergeRange]: ...
+    def get_display_text(self, sheet: int, row: int, col: int) -> Tuple[str, DisplayStatus]: ...
+    def format_value(self, value: Value, format_code: str = ...) -> Tuple[str, DisplayStatus]: ...
     def set_row_hidden(self, sheet: int, row: int, hidden: bool) -> None: ...
     def set_row_outline(self, sheet: int, row: int, level: int) -> None: ...
 
@@ -1232,7 +1836,13 @@ class Workbook:
         cell_xfs: Optional[Sequence[CellXf]] = ...,
     ) -> StyleBatchIndices: ...
     def add_dxf(self, record: DifferentialFormat) -> int: ...
-    def set_cell_style(self, name: str, xf_id: int, builtin_id: int = ...) -> None: ...
+    def set_cell_style(self, record: CellStyle) -> None: ...
+    def remove_cell_style(self, name: str) -> None: ...
+    def get_theme(self) -> Theme: ...
+    def set_theme_colors(self, colors: Sequence[int]) -> None: ...
+    def set_theme_fonts(self, fonts: ThemeFonts) -> None: ...
+    def resolve_color(self, spec: ColorSpec, context: Union[ColorContext, int] = ...) -> ResolvedColor: ...
+    def get_effective_style(self, sheet: int, row: int, col: int) -> EffectiveStyle: ...
     def get_cell_style(self, index: int) -> CellStyle: ...
     def get_cell_style_xf(self, index: int) -> CellXf: ...
 
diff --git a/packages/python/formulon/_c.py b/packages/python/formulon/_c.py
index 50cf4eb5c..9700b6ed4 100644
--- a/packages/python/formulon/_c.py
+++ b/packages/python/formulon/_c.py
@@ -181,6 +181,9 @@ def __init__(
 _STATUS_RETURNING_EXPORT_NAMES = (
     "fm_cell_get_xf_index",
     "fm_cell_nodes_at",
+    "fm_cell_range_at",
+    "fm_cell_range_count",
+    "fm_cell_range_next_cursor",
     "fm_cell_set_xf_index",
     "fm_cf_results_cell_at",
     "fm_cf_results_match_at",
@@ -189,36 +192,62 @@ def __init__(
     "fm_function_metadata",
     "fm_function_name_at",
     "fm_pagination_horizontal_break_at",
+    "fm_pagination_horizontal_break_is_manual",
+    "fm_pagination_margins",
+    "fm_pagination_page_at",
+    "fm_pagination_page_order",
+    "fm_pagination_paper",
     "fm_pagination_print_area_at",
+    "fm_pagination_print_titles",
+    "fm_pagination_printable",
+    "fm_pagination_scale",
     "fm_pagination_vertical_break_at",
+    "fm_pagination_vertical_break_is_manual",
     "fm_pivot_cells_at",
     "fm_pivot_cells_bounds",
     "fm_set_log_min_level",
     "fm_set_log_sink",
+    "fm_sheet_add_col_break",
     "fm_sheet_add_hyperlink",
     "fm_sheet_add_merge",
+    "fm_sheet_add_row_break",
+    "fm_sheet_add_threaded_comment",
     "fm_sheet_add_validation",
+    "fm_sheet_apply_auto_filter",
+    "fm_sheet_cell_rect_pt",
+    "fm_sheet_cells_in_range",
     "fm_sheet_cf_add_rule",
     "fm_sheet_cf_clear",
     "fm_sheet_cf_count",
     "fm_sheet_cf_get_at",
     "fm_sheet_cf_remove_at",
-    "fm_sheet_add_col_break",
-    "fm_sheet_add_row_break",
+    "fm_sheet_clear_auto_filter",
     "fm_sheet_clear_breaks",
     "fm_sheet_clear_hyperlinks",
     "fm_sheet_clear_merges",
+    "fm_sheet_clear_row_height",
     "fm_sheet_clear_validations",
     "fm_sheet_col_break_at",
+    "fm_sheet_column_chars_to_pt",
+    "fm_sheet_column_pt_to_chars",
+    "fm_sheet_column_width_pt",
+    "fm_sheet_drawing_object_at",
+    "fm_sheet_drawing_object_count",
+    "fm_sheet_edit_threaded_comment",
+    "fm_sheet_evaluate_auto_filter",
+    "fm_sheet_get_auto_filter",
     "fm_sheet_get_auto_filter_xml",
     "fm_sheet_get_column",
     "fm_sheet_get_column_count",
     "fm_sheet_get_comment_at",
     "fm_sheet_get_comment_at_index",
     "fm_sheet_get_comment_count",
+    "fm_sheet_get_effective_style",
+    "fm_sheet_get_format_defaults",
     "fm_sheet_get_header_footer_xml",
     "fm_sheet_get_hyperlink_at",
     "fm_sheet_get_hyperlink_count",
+    "fm_sheet_get_image",
     "fm_sheet_get_merge_at",
     "fm_sheet_get_merge_count",
     "fm_sheet_get_page_margins",
@@ -235,20 +264,29 @@ def __init__(
     "fm_sheet_get_validation_at",
     "fm_sheet_get_validation_count",
     "fm_sheet_get_view",
+    "fm_sheet_insert_image",
+    "fm_sheet_list_invalid_cells",
+    "fm_sheet_merges_in_range",
+    "fm_sheet_remove_auto_filter",
     "fm_sheet_remove_col_break",
     "fm_sheet_remove_hyperlink",
     "fm_sheet_remove_hyperlink_at",
+    "fm_sheet_remove_image",
     "fm_sheet_remove_merge",
     "fm_sheet_remove_merge_at",
     "fm_sheet_remove_row_break",
+    "fm_sheet_remove_threaded_comment",
     "fm_sheet_remove_validation_at",
     "fm_sheet_row_break_at",
+    "fm_sheet_row_height_pt",
+    "fm_sheet_set_auto_filter",
     "fm_sheet_set_auto_filter_xml",
     "fm_sheet_set_column_hidden",
     "fm_sheet_set_column_outline",
     "fm_sheet_set_column_width",
     "fm_sheet_set_comment",
     "fm_sheet_set_fit_to_page",
+    "fm_sheet_set_format_defaults",
     "fm_sheet_set_freeze",
     "fm_sheet_set_header_footer",
     "fm_sheet_set_header_footer_xml",
@@ -272,9 +310,14 @@ def __init__(
     "fm_sheet_set_show_zeros",
     "fm_sheet_set_tab_hidden",
     "fm_sheet_set_tab_selected",
+    "fm_sheet_set_thread_resolved",
     "fm_sheet_set_view_mode",
     "fm_sheet_set_visibility",
     "fm_sheet_set_zoom",
+    "fm_sheet_threaded_comment_at",
+    "fm_sheet_threaded_comment_count",
+    "fm_sheet_validate_value",
+    "fm_sheet_width_model",
     "fm_styles_add_batch",
     "fm_styles_add_border",
     "fm_styles_add_cell_style_xf",
@@ -298,14 +341,22 @@ def __init__(
     "fm_styles_get_font",
     "fm_styles_get_font_count",
     "fm_styles_get_num_fmt_string",
+    "fm_styles_remove_cell_style",
     "fm_styles_set_cell_style",
     "fm_styles_set_font",
+    "fm_table_apply_auto_filter",
+    "fm_table_clear_auto_filter",
+    "fm_table_evaluate_auto_filter",
+    "fm_table_get_auto_filter",
+    "fm_table_remove_auto_filter",
+    "fm_table_set_auto_filter",
+    "fm_workbook_add_person",
     "fm_workbook_add_sheet",
     "fm_workbook_calc_mode",
-    "fm_workbook_clear_pinned_now",
     "fm_workbook_cell_at",
     "fm_workbook_cell_count",
     "fm_workbook_cf_evaluate_range",
+    "fm_workbook_clear_pinned_now",
     "fm_workbook_create",
     "fm_workbook_create_empty",
     "fm_workbook_defined_name_at",
@@ -318,11 +369,17 @@ def __init__(
     "fm_workbook_excel_profile_id",
     "fm_workbook_external_link_at",
     "fm_workbook_external_link_count",
+    "fm_workbook_format_value",
     "fm_workbook_get_cell_phonetic",
     "fm_workbook_get_cell_phonetic_properties",
     "fm_workbook_get_cell_phonetic_run",
     "fm_workbook_get_cell_phonetic_run_count",
+    "fm_workbook_get_display_text",
+    "fm_workbook_get_formula",
+    "fm_workbook_get_formula_r1c1",
     "fm_workbook_get_iterative",
+    "fm_workbook_get_theme_colors",
+    "fm_workbook_get_theme_fonts",
     "fm_workbook_get_value",
     "fm_workbook_insert_cols",
     "fm_workbook_insert_rows",
@@ -333,6 +390,8 @@ def __init__(
     "fm_workbook_paginate",
     "fm_workbook_partial_recalc",
     "fm_workbook_passthrough_at",
+    "fm_workbook_person_at",
+    "fm_workbook_person_count",
     "fm_workbook_pinned_now",
     "fm_workbook_pivot_cache_count",
     "fm_workbook_pivot_cache_create",
@@ -395,10 +454,13 @@ def __init__(
     "fm_workbook_pivot_set_name",
     "fm_workbook_pivot_set_row_field_order",
     "fm_workbook_precedents",
+    "fm_workbook_probe_image",
     "fm_workbook_read_diagnostics",
     "fm_workbook_recalc",
+    "fm_workbook_remove_person",
     "fm_workbook_remove_sheet",
     "fm_workbook_rename_sheet",
+    "fm_workbook_resolve_color",
     "fm_workbook_save",
     "fm_workbook_save_as",
     "fm_workbook_save_with_diagnostics",
@@ -420,6 +482,8 @@ def __init__(
     "fm_workbook_set_number",
     "fm_workbook_set_pinned_now",
     "fm_workbook_set_text",
+    "fm_workbook_set_theme_colors",
+    "fm_workbook_set_theme_fonts",
     "fm_workbook_sheet_name",
     "fm_workbook_spill_info",
     "fm_workbook_table_at",
diff --git a/packages/python/formulon/_structs.py b/packages/python/formulon/_structs.py
index d17a01a57..387de0272 100644
--- a/packages/python/formulon/_structs.py
+++ b/packages/python/formulon/_structs.py
@@ -11,6 +11,7 @@
   * ``int32`` / ``uint32`` are 4 bytes, 4-aligned;
   * ``uint16`` is 2 bytes, 2-aligned;
   * ``uint8`` is 1 byte, 1-aligned;
+  * ``int64`` is 8 bytes, 8-aligned;
   * ``double`` is 8 bytes, 8-aligned;
   * a struct's size is rounded up to its largest member alignment.
 
@@ -29,6 +30,7 @@
 PTR = ("ptr", 4, 4)
 U32 = ("u32", 4, 4)
 I32 = ("i32", 4, 4)
+I64 = ("i64", 8, 8)
 U16 = ("u16", 2, 2)
 U8 = ("u8", 1, 1)
 F64 = ("f64", 8, 8)
@@ -41,6 +43,9 @@
 # :meth:`Struct.unpack`; callers who need the sub-fields read them at
 # ``ptr + offset`` with their own struct.unpack_from calls.
 CFVO_BLOB = ("blob_cfvo", 12, 4)
+# Opaque 16-byte, 4-aligned blob: an inline ``fm_merge_range``. Pack and
+# unpack it with :data:`MERGE_RANGE` against ``ptr + offset``.
+MERGE_RANGE_BLOB = ("blob_merge_range", 16, 4)
 # Opaque 4-byte, 1-aligned blob: an inline ``fm_cf_color_t`` (four
 # ``uint8_t`` channels). Not decoded by :meth:`Struct.unpack`.
 CF_COLOR_BLOB = ("blob_cf_color", 4, 1)
@@ -49,6 +54,7 @@
     "ptr": "<I",
     "u32": "<I",
     "i32": "<i",
+    "i64": "<q",
     "u16": "<H",
     "u8": "<B",
     "f64": "<d",
@@ -480,6 +486,81 @@ def zero_struct(lib, layout: Struct, ptr: int) -> None:
         ("outline_level", U8),
         ("has_style", I32),
         ("style_xf", U32),
+        ("has_height", I32),
+        ("custom_height", I32),
+    ],
+)
+
+SHEET_FORMAT_DEFAULTS = Struct(
+    "fm_sheet_format_defaults",
+    [
+        ("default_col_width", F64),
+        ("default_row_height", F64),
+        ("base_col_width", F64),
+        ("has_default_col_width", I32),
+        ("has_default_row_height", I32),
+    ],
+)
+
+RECT_PT = Struct(
+    "fm_rect_pt",
+    [("x", F64), ("y", F64), ("width", F64), ("height", F64)],
+)
+
+WIDTH_MODEL = Struct(
+    "fm_width_model",
+    [
+        ("points_per_char", F64),
+        ("padding_pt", F64),
+        ("normal_font_size", F64),
+        ("calibrated", I32),
+        ("_pad", I32),
+        ("normal_font_name", PTR),
+        ("platform", PTR),
+    ],
+)
+
+PAPER_INFO = Struct(
+    "fm_paper_info",
+    [("width_pt", F64), ("height_pt", F64), ("landscape", I32), ("known", I32)],
+)
+
+MARGINS_PT = Struct(
+    "fm_margins_pt",
+    [
+        ("left", F64),
+        ("right", F64),
+        ("top", F64),
+        ("bottom", F64),
+        ("header", F64),
+        ("footer", F64),
+    ],
+)
+
+PRINT_TITLES = Struct(
+    "fm_print_titles",
+    [
+        ("has_rows", I32),
+        ("first_row", U32),
+        ("last_row", U32),
+        ("has_cols", I32),
+        ("first_col", U32),
+        ("last_col", U32),
+    ],
+)
+
+PAGE_LAYOUT = Struct(
+    "fm_page_layout",
+    [
+        ("area_index", U32),
+        ("first_row", U32),
+        ("last_row", U32),
+        ("first_col", U32),
+        ("last_col", U32),
+        ("origin_x_pt", F64),
+        ("origin_y_pt", F64),
+        ("width_pt", F64),
+        ("height_pt", F64),
     ],
 )
 
@@ -512,6 +593,16 @@ def zero_struct(lib, layout: Struct, ptr: int) -> None:
         ("has_vertical_align", I32),
         ("has_wrap_text", I32),
         ("has_justify_last_line", I32),
+        ("apply_number_format", I32),
+        ("apply_font", I32),
+        ("apply_fill", I32),
+        ("apply_border", I32),
+        ("apply_alignment", I32),
+        ("apply_protection", I32),
+        ("quote_prefix", I32),
+        ("has_protection", I32),
+        ("locked", I32),
+        ("hidden", I32),
     ],
 )
 
@@ -635,6 +726,40 @@ def zero_struct(lib, layout: Struct, ptr: int) -> None:
     ],
 )
 
+THEME_COLORS = Struct("fm_theme_colors", [("argb", ("blob_u32x12", 48, 4))])
+
+THEME_FONTS = Struct(
+    "fm_theme_fonts",
+    [
+        ("major_latin", PTR),
+        ("major_east_asian", PTR),
+        ("minor_latin", PTR),
+        ("minor_east_asian", PTR),
+    ],
+)
+
+EFFECTIVE_STYLE = Struct(
+    "fm_effective_style",
+    [
+        ("xf_index", U32),
+        ("source", I32),
+        ("font_index", U32),
+        ("fill_index", U32),
+        ("border_index", U32),
+        ("font_argb", U32),
+        ("font_resolution", I32),
+        ("fill_fg_argb", U32),
+        ("fill_fg_resolution", I32),
+        ("fill_bg_argb", U32),
+        ("fill_bg_resolution", I32),
+        ("border_argb", ("blob_u32x5", 20, 4)),
+        ("border_resolution", ("blob_i32x5", 20, 4)),
+        ("locked", I32),
+        ("hidden", I32),
+        ("num_fmt_code", PTR),
+    ],
+)
+
 EXTERNAL_LINK_RECORD = Struct(
     "fm_external_link_record_t",
     [
@@ -767,3 +892,177 @@ def write_str_field(
     owned.append(ptr)
     kind, off = layout.offsets[field]
     lib.write_bytes(struct_ptr + off, struct.pack("<I", ptr))
+
+
+# ---------------------------------------------------------------------------
+# AutoFilter, validation outcome, threaded comments and persons
+# ---------------------------------------------------------------------------
+
+DATE_GROUP_ITEM = Struct(
+    "fm_date_group_item",
+    [
+        ("year", U16),
+        ("month", U8),
+        ("day", U8),
+        ("hour", U8),
+        ("minute", U8),
+        ("second", U8),
+        ("grouping", U8),
+    ],
+)
+
+FILTER_COLUMN = Struct(
+    "fm_filter_column",
+    [
+        ("col_id", U32),
+        ("hidden_button", I32),
+        ("show_button", I32),
+        ("kind", I32),
+        ("filter_blank", I32),
+        ("values", PTR),
+        ("value_count", U32),
+        ("date_groups", PTR),
+        ("date_group_count", U32),
+        ("custom_and", I32),
+        ("custom_count", I32),
+        ("op1", I32),
+        ("val1", PTR),
+        ("op2", I32),
+        ("val2", PTR),
+        ("top", I32),
+        ("percent", I32),
+        ("has_filter_val", I32),
+        ("top_val", F64),
+        ("filter_val", F64),
+        ("dynamic_type", I32),
+        ("has_dyn_val", I32),
+        ("has_dyn_max_val", I32),
+        ("dyn_val", F64),
+        ("dyn_max_val", F64),
+        ("val_iso", PTR),
+        ("max_val_iso", PTR),
+        ("dxf_id", U32),
+        ("cell_color", I32),
+        ("icon_set", I32),
+        ("icon_id", I32),
+        ("has_icon_id", I32),
+    ],
+)
+
+SORT_CONDITION = Struct(
+    "fm_sort_condition",
+    [
+        ("ref", MERGE_RANGE_BLOB),
+        ("descending", I32),
+        ("sort_by", I32),
+        ("custom_list", PTR),
+        ("dxf_id", U32),
+        ("has_dxf_id", I32),
+        ("icon_set", I32),
+        ("icon_id", I32),
+        ("has_icon_id", I32),
+    ],
+)
+
+AUTO_FILTER = Struct(
+    "fm_auto_filter",
+    [
+        ("range", MERGE_RANGE_BLOB),
+        ("columns", PTR),
+        ("column_count", U32),
+        ("has_sort", I32),
+        ("sort_ref", MERGE_RANGE_BLOB),
+        ("column_sort", I32),
+        ("case_sensitive", I32),
+        ("sort_method", I32),
+        ("conditions", PTR),
+        ("condition_count", U32),
+    ],
+)
+
+VALIDATION_OUTCOME = Struct(
+    "fm_validation_outcome",
+    [
+        ("has_rule", I32),
+        ("valid", I32),
+        ("rule_index", U32),
+        ("error_style", U8),
+        ("_pad", ("blob_pad3", 3, 1)),
+    ],
+)
+
+MENTION = Struct(
+    "fm_mention",
+    [("person_id", PTR), ("mention_id", PTR), ("start", U32), ("length", U32)],
+)
+
+THREADED_COMMENT = Struct(
+    "fm_threaded_comment",
+    [
+        ("id", PTR),
+        ("row", U32),
+        ("col", U32),
+        ("person_id", PTR),
+        ("created", PTR),
+        ("text", PTR),
+        ("parent_id", PTR),
+        ("done", I32),
+        ("mentions", PTR),
+        ("mention_count", U32),
+    ],
+)
+
+PERSON = Struct(
+    "fm_person",
+    [("id", PTR), ("display_name", PTR), ("user_id", PTR), ("provider_id", PTR)],
+)
+
+
+# ---------------------------------------------------------------------------
+# Drawing images
+# ---------------------------------------------------------------------------
+
+IMAGE_INFO = Struct(
+    "fm_image_info",
+    [("format", I32), ("px_width", U32), ("px_height", U32)],
+)
+
+DRAWING_OBJECT = Struct(
+    "fm_drawing_object",
+    [
+        ("object_id", U32),
+        ("kind", I32),
+        ("anchor_kind", I32),
+        ("edit_as", I32),
+        ("from_row", U32),
+        ("from_col", U32),
+        ("from_row_off", I64),
+        ("from_col_off", I64),
+        ("to_row", U32),
+        ("to_col", U32),
+        ("to_row_off", I64),
+        ("to_col_off", I64),
+        ("cx", I64),
+        ("cy", I64),
+        ("image_format", I32),
+        ("name", PTR),
+        ("descr", PTR),
+        ("media_path", PTR),
+    ],
+)
+
+IMAGE_INSERT = Struct(
+    "fm_image_insert",
+    [
+        ("name", PTR),
+        ("descr", PTR),
+        ("anchor_kind", I32),
+        ("edit_as", I32),
+        ("row", U32),
+        ("col", U32),
+        ("row_off_emu", I64),
+        ("col_off_emu", I64),
+        ("width_emu", I64),
+        ("height_emu", I64),
+    ],
+)
diff --git a/packages/python/formulon/workbook.py b/packages/python/formulon/workbook.py
index 3c805b5ab..87bed0fbe 100644
--- a/packages/python/formulon/workbook.py
+++ b/packages/python/formulon/workbook.py
@@ -41,6 +41,21 @@
     "CfColor",
     "CfMatch",
     "CfValueObject",
+    "ColorContext",
+    "ImageFormat",
+    "DrawingObjectKind",
+    "AnchorKind",
+    "AnchorEditAs",
+    "ImageInfo",
+    "DrawingObject",
+    "FilterKind",
+    "FilterOperator",
+    "DynamicFilterType",
+    "SortBy",
+    "SortMethod",
+    "DateTimeGrouping",
+    "ValidationErrorStyle",
+    "ColorResolution",
     "ColorSpec",
     "ColumnLayout",
     "Comment",
@@ -52,6 +67,8 @@
     "DataValidationInput",
     "DefinedName",
     "DifferentialFormat",
+    "DisplayStatus",
+    "EffectiveStyle",
     "ErrorCode",
     "ExternalLink",
     "ExternalLinkKind",
@@ -59,11 +76,15 @@
     "FontRecord",
     "FormulonError",
     "FunctionMetadata",
+    "GeometryMode",
     "Hyperlink",
     "IterativeSettings",
     "LogLevel",
     "IconSet",
+    "MarginsPt",
     "MergeRange",
+    "PageLayout",
+    "PaperInfo",
     "PassthroughPart",
     "PivotAggregation",
     "PivotAxis",
@@ -80,17 +101,35 @@
     "PivotReportLayout",
     "PivotShowValuesAs",
     "PivotWorksheetSource",
+    "PrintTitles",
     "ReadDiagnostics",
+    "RectPt",
     "RowLayout",
     "SaveDiagnostics",
+    "ResolvedColor",
+    "SheetFormatDefaults",
     "SheetProtection",
     "SheetView",
     "SheetVisibility",
     "SpillInfo",
+    "EffectiveStyleSource",
     "Table",
+    "Theme",
+    "ThemeFonts",
+    "ThemeSource",
     "Value",
     "ValueKind",
+    "WidthModel",
     "Workbook",
+    "AutoFilter",
+    "AutoFilterSortState",
+    "AutoFilterDateGroup",
+    "AutoFilterColumn",
+    "Mention",
+    "Person",
+    "AutoFilterSortCondition",
+    "ThreadedComment",
+    "ValidationOutcome",
 ]
 
 
@@ -106,6 +145,9 @@
 _STATUS_BINDING_INVALID_HANDLE = 7000
 _STATUS_BINDING_NULL_POINTER = 7001
 
+# `fm_cell_range_next_cursor` reports UINT64_MAX when no further cell exists.
+_CELL_RANGE_NO_CURSOR = (1 << 64) - 1
+
 # Inclusive bounds of `fm_locale_t` (0 = en-US, 1 = ja-JP).
 _LOCALE_MIN = 0
 _LOCALE_MAX = 1
@@ -289,6 +331,194 @@ class PassthroughPart(NamedTuple):
 # ---------------------------------------------------------------------------
 
 
+class GeometryMode(IntEnum):
+    """Which Windows column-width figure a geometry call uses."""
+
+    DISPLAY = 0
+    PRINT = 1
+
+
+class DisplayStatus(IntEnum):
+    """Outcome of a display-text rendering (``fm_display_status_t``)."""
+
+    OK = 0
+    OVERFLOW = 1
+    INVALID_FORMAT = 2
+
+
+class FilterKind(IntEnum):
+    """Criterion of an AutoFilter column (``fm_filter_kind_t``)."""
+
+    NONE = 0
+    VALUES = 1
+    CUSTOM = 2
+    TOP10 = 3
+    DYNAMIC = 4
+    COLOR = 5
+    ICON = 6
+
+
+class FilterOperator(IntEnum):
+    """Comparison operator of a custom AutoFilter condition (``fm_filter_operator_t``)."""
+
+    EQUAL = 0
+    LESS_THAN = 1
+    LESS_THAN_OR_EQUAL = 2
+    NOT_EQUAL = 3
+    GREATER_THAN_OR_EQUAL = 4
+    GREATER_THAN = 5
+
+
+class DynamicFilterType(IntEnum):
+    """Dynamic AutoFilter type, in `ST_DynamicFilterType` schema order (``fm_dynamic_filter_type_t``)."""
+
+    NULL = 0
+    ABOVE_AVERAGE = 1
+    BELOW_AVERAGE = 2
+    TOMORROW = 3
+    TODAY = 4
+    YESTERDAY = 5
+    NEXT_WEEK = 6
+    THIS_WEEK = 7
+    LAST_WEEK = 8
+    NEXT_MONTH = 9
+    THIS_MONTH = 10
+    LAST_MONTH = 11
+    NEXT_QUARTER = 12
+    THIS_QUARTER = 13
+    LAST_QUARTER = 14
+    NEXT_YEAR = 15
+    THIS_YEAR = 16
+    LAST_YEAR = 17
+    YEAR_TO_DATE = 18
+    Q1 = 19
+    Q2 = 20
+    Q3 = 21
+    Q4 = 22
+    M1 = 23
+    M2 = 24
+    M3 = 25
+    M4 = 26
+    M5 = 27
+    M6 = 28
+    M7 = 29
+    M8 = 30
+    M9 = 31
+    M10 = 32
+    M11 = 33
+    M12 = 34
+
+
+class SortBy(IntEnum):
+    """What a sort condition sorts by (``fm_sort_by_t``)."""
+
+    VALUE = 0
+    CELL_COLOR = 1
+    FONT_COLOR = 2
+    ICON = 3
+
+
+class SortMethod(IntEnum):
+    """Sort method of an AutoFilter sort state (``fm_sort_method_t``)."""
+
+    NONE = 0
+    PIN_YIN = 1
+    STROKE = 2
+
+
+class DateTimeGrouping(IntEnum):
+    """Granularity of an AutoFilter date-group item (``fm_date_time_grouping_t``)."""
+
+    YEAR = 0
+    MONTH = 1
+    DAY = 2
+    HOUR = 3
+    MINUTE = 4
+    SECOND = 5
+
+
+class ValidationErrorStyle(IntEnum):
+    """Data-validation error style (``fm_validation_error_style_t``)."""
+
+    STOP = 0
+    WARNING = 1
+    INFORMATION = 2
+
+
+class ColorContext(IntEnum):
+    """Where a colour is used (``fm_color_context_t``); decides what auto means."""
+
+    FONT = 0
+    FILL_FOREGROUND = 1
+    FILL_BACKGROUND = 2
+    BORDER = 3
+
+
+class ImageFormat(IntEnum):
+    """Raster format of an image (``fm_image_format_t``)."""
+
+    UNKNOWN = 0
+    PNG = 1
+    JPEG = 2
+    GIF = 3
+    BMP = 4
+
+
+class DrawingObjectKind(IntEnum):
+    """What a drawing anchor holds (``fm_drawing_object_kind_t``)."""
+
+    PICTURE = 0
+    SHAPE = 1
+    CHART = 2
+    GROUP = 3
+    CONNECTOR = 4
+    GRAPHIC_FRAME = 5
+    OTHER = 6
+
+
+class AnchorKind(IntEnum):
+    """Anchor element type of a drawing object (``fm_anchor_kind_t``)."""
+
+    ONE_CELL = 0
+    TWO_CELL = 1
+    ABSOLUTE = 2
+
+
+class AnchorEditAs(IntEnum):
+    """How a drawing object follows row and column edits (``fm_anchor_edit_as_t``)."""
+
+    TWO_CELL = 0
+    ONE_CELL = 1
+    ABSOLUTE = 2
+
+
+class ColorResolution(IntEnum):
+    """How a colour was resolved (``fm_color_resolution_t``)."""
+
+    EXACT = 0
+    DEFAULT_THEME = 1
+    INDEX_OUT_OF_RANGE = 2
+    THEME_UNPARSEABLE = 3
+    AUTO_CONTEXT = 4
+
+
+class ThemeSource(IntEnum):
+    """Where the reported theme colours came from."""
+
+    PART = 0
+    DEFAULT = 1
+    UNPARSEABLE = 2
+
+
+class EffectiveStyleSource(IntEnum):
+    """Which level supplied a cell's effective xf."""
+
+    CELL = 0
+    ROW = 1
+    COLUMN = 2
+    DEFAULT = 3
+
+
 class CalcMode(IntEnum):
     """Workbook-level calc mode (``<calcPr calcMode>`` policy).
 
@@ -545,7 +775,7 @@ class DataValidation:
     ranges: List[MergeRange]
     type: int
     op: int
-    error_style: int
+    error_style: Union[ValidationErrorStyle, int]
     allow_blank: bool
     show_input_message: bool
     show_error_message: bool
@@ -571,7 +801,7 @@ class DataValidationInput:
     type: int
     ranges: List[MergeRange] = field(default_factory=list)
     op: int = 0
-    error_style: int = 0
+    error_style: Union[ValidationErrorStyle, int] = ValidationErrorStyle.STOP
     allow_blank: bool = False
     show_input_message: bool = False
     show_error_message: bool = False
@@ -584,6 +814,177 @@ class DataValidationInput:
     prompt_message: str = ""
 
 
+# `dxf_id` value meaning "no differential format".
+_FILTER_DXF_ID_NONE = 0xFFFFFFFF
+
+
+@dataclass
+class AutoFilterDateGroup:
+    """One ``<dateGroupItem>`` of a values filter; finer fields than ``grouping`` are zero."""
+
+    year: int = 0
+    month: int = 0
+    day: int = 0
+    hour: int = 0
+    minute: int = 0
+    second: int = 0
+    grouping: Union[DateTimeGrouping, int] = DateTimeGrouping.YEAR
+
+
+@dataclass
+class AutoFilterColumn:
+    """One ``<filterColumn>``; only the fields of the criterion selected by ``kind`` are read."""
+
+    col_id: int
+    hidden_button: bool = False
+    show_button: bool = True
+    kind: Union[FilterKind, int] = FilterKind.NONE
+    filter_blank: bool = False
+    values: List[str] = field(default_factory=list)
+    date_groups: List[AutoFilterDateGroup] = field(default_factory=list)
+    custom_and: bool = False
+    custom_count: int = 0
+    op1: Union[FilterOperator, int] = FilterOperator.EQUAL
+    val1: str = ""
+    op2: Union[FilterOperator, int] = FilterOperator.EQUAL
+    val2: str = ""
+    top: bool = True
+    percent: bool = False
+    has_filter_val: bool = False
+    top_val: float = 0.0
+    filter_val: float = 0.0
+    dynamic_type: Union[DynamicFilterType, int] = DynamicFilterType.NULL
+    has_dyn_val: bool = False
+    has_dyn_max_val: bool = False
+    dyn_val: float = 0.0
+    dyn_max_val: float = 0.0
+    val_iso: str = ""
+    max_val_iso: str = ""
+    dxf_id: int = _FILTER_DXF_ID_NONE
+    cell_color: bool = False
+    icon_set: int = 0
+    icon_id: int = 0
+    has_icon_id: bool = False
+
+
+@dataclass
+class AutoFilterSortCondition:
+    """One ``<sortCondition>`` of an AutoFilter sort state."""
+
+    ref: MergeRange
+    descending: bool = False
+    sort_by: Union[SortBy, int] = SortBy.VALUE
+    custom_list: str = ""
+    dxf_id: int = 0
+    has_dxf_id: bool = False
+    icon_set: int = 0
+    icon_id: int = 0
+    has_icon_id: bool = False
+
+
+@dataclass
+class AutoFilterSortState:
+    """The ``<sortState>`` of an AutoFilter; ``sort_method`` is a :class:`SortMethod`."""
+
+    ref: MergeRange
+    column_sort: bool = False
+    case_sensitive: bool = False
+    sort_method: Union[SortMethod, int] = SortMethod.NONE
+    conditions: List[AutoFilterSortCondition] = field(default_factory=list)
+
+
+@dataclass
+class AutoFilter:
+    """A sheet or table AutoFilter; ``range`` includes the header row, ``sort`` may be ``None``."""
+
+    range: MergeRange
+    columns: List[AutoFilterColumn] = field(default_factory=list)
+    sort: Optional[AutoFilterSortState] = None
+
+
+@dataclass(frozen=True)
+class ValidationOutcome:
+    """Result of :meth:`Workbook.validate_value`.
+
+    ``has_rule`` is ``False`` (and ``valid`` ``True``) when no rule covers the
+    cell; otherwise ``rule_index`` and ``error_style`` (a
+    :class:`ValidationErrorStyle`) describe the applied rule.
+    """
+
+    has_rule: bool
+    valid: bool
+    rule_index: int
+    error_style: Union[ValidationErrorStyle, int]
+
+
+@dataclass
+class Mention:
+    """One ``@person`` mention; ``start`` and ``length`` are UTF-16 code units."""
+
+    person_id: str
+    mention_id: str
+    start: int
+    length: int
+
+
+@dataclass
+class ThreadedComment:
+    """A threaded comment: a thread opener, or a reply when ``parent_id`` is non-empty."""
+
+    id: str
+    row: int = 0
+    col: int = 0
+    person_id: str = ""
+    created: str = ""
+    text: str = ""
+    parent_id: str = ""
+    done: bool = False
+    mentions: List[Mention] = field(default_factory=list)
+
+
+@dataclass
+class Person:
+    """One entry of the workbook's person list."""
+
+    id: str
+    display_name: str
+    user_id: str = ""
+    provider_id: str = ""
+
+
+@dataclass
+class ImageInfo:
+    """Format and pixel size of an image."""
+
+    format: Union[ImageFormat, int]
+    px_width: int
+    px_height: int
+
+
+@dataclass
+class DrawingObject:
+    """One anchored object of a sheet's drawing; sizes and offsets are in EMU."""
+
+    object_id: int
+    kind: Union[DrawingObjectKind, int]
+    anchor_kind: Union[AnchorKind, int]
+    edit_as: Union[AnchorEditAs, int]
+    from_row: int
+    from_col: int
+    from_row_off: int
+    from_col_off: int
+    to_row: int
+    to_col: int
+    to_row_off: int
+    to_col_off: int
+    cx: int
+    cy: int
+    image_format: Union[ImageFormat, int]
+    name: str
+    descr: str
+    media_path: str
+
+
 @dataclass
 class SheetProtection:
     """Sheet ``<sheetProtection>`` flags. Booleans are real ``bool``."""
@@ -681,6 +1082,10 @@ class RowLayout:
     outline_level: int
     has_style: bool = False
     style_xf: int = 0
+    #: A stored height is present; ``height`` is meaningful only then.
+    has_height: bool = False
+    #: ``customHeight="1"``: an explicit override rather than a cached auto height.
+    custom_height: bool = False
 
 
 class IterativeSettings(NamedTuple):
@@ -708,6 +1113,107 @@ class PaginationResult:
     print_area: List[tuple[int, int, int, int]]
     horizontal_breaks: List[int]
     vertical_breaks: List[int]
+    paper: "PaperInfo"
+    margins: "MarginsPt"
+    printable: "RectPt"
+    #: Effective scale as a factor (1.0 is 100%).
+    scale: float
+    #: 0 down-then-over, 1 over-then-down.
+    page_order: int
+    print_titles: "PrintTitles"
+    pages: List["PageLayout"]
+    #: Per-break manual flags, parallel to ``horizontal_breaks``.
+    horizontal_break_manual: List[bool]
+    #: Per-break manual flags, parallel to ``vertical_breaks``.
+    vertical_break_manual: List[bool]
+
+
+@dataclass(frozen=True)
+class RectPt:
+    """A rectangle in points."""
+
+    x: float
+    y: float
+    width: float
+    height: float
+
+
+@dataclass(frozen=True)
+class PaperInfo:
+    """The paper a sheet prints on, after the orientation swap."""
+
+    width_pt: float
+    height_pt: float
+    landscape: bool
+    #: False when ``paperSize`` was unrecognised and A4 substituted.
+    known: bool
+
+
+@dataclass(frozen=True)
+class MarginsPt:
+    """Page margins in points."""
+
+    left: float
+    right: float
+    top: float
+    bottom: float
+    header: float
+    footer: float
+
+
+@dataclass(frozen=True)
+class PrintTitles:
+    """Repeat rows / columns (0-based, inclusive); a span is valid only with its flag."""
+
+    has_rows: bool
+    first_row: int
+    last_row: int
+    has_cols: bool
+    first_col: int
+    last_col: int
+
+
+@dataclass(frozen=True)
+class PageLayout:
+    """One physical page: the cell block it carries and where it sits."""
+
+    area_index: int
+    first_row: int
+    last_row: int
+    first_col: int
+    last_col: int
+    origin_x_pt: float
+    origin_y_pt: float
+    width_pt: float
+    height_pt: float
+
+
+@dataclass(frozen=True)
+class SheetFormatDefaults:
+    """Sheet default column / row metrics (``<sheetFormatPr>``).
+
+    ``default_col_width`` is in characters and ``default_row_height`` in
+    points; each is meaningful only when its ``has_*`` flag is set.
+    """
+
+    default_col_width: float = 0.0
+    default_row_height: float = 0.0
+    base_col_width: float = 8.0
+    has_default_col_width: bool = False
+    has_default_row_height: bool = False
+
+
+@dataclass(frozen=True)
+class WidthModel:
+    """Column-width conversion model for the workbook's Normal font."""
+
+    points_per_char: float
+    padding_pt: float
+    normal_font_size: float
+    #: False when the Normal font is not a measured calibration point.
+    calibrated: bool
+    normal_font_name: str
+    platform: str
 
 
 @dataclass(frozen=True)
@@ -1014,6 +1520,18 @@ class CellXf:
     has_vertical_align: Optional[bool] = None
     has_wrap_text: Optional[bool] = None
     has_justify_last_line: Optional[bool] = None
+    apply_number_format: bool = False
+    apply_font: bool = False
+    apply_fill: bool = False
+    apply_border: bool = False
+    apply_alignment: bool = False
+    apply_protection: bool = False
+    quote_prefix: bool = False
+    #: Presence of the ``<protection>`` child; ``locked`` / ``hidden`` are
+    #: ignored on insertion without it.
+    has_protection: bool = False
+    locked: bool = True
+    hidden: bool = False
 
 
 @dataclass
@@ -1028,7 +1546,7 @@ class ColorSpec:
     the default ``kind=0`` makes the writer emit ``*_argb`` as ``rgb``.
     """
 
-    kind: int = 0
+    kind: Union[FilterKind, int] = FilterKind.NONE
     rgb: int = 0
     theme: int = 0
     tint: float = 0.0
@@ -1289,10 +1807,58 @@ class CellStyle:
 
     name: str
     xf_id: int
-    builtin_id: int
-    i_level: int
+    builtin_id: int = CELL_STYLE_BUILTIN_ID_NONE
+    i_level: int = 0
+    hidden: bool = False
+    custom_builtin: bool = False
+
+
+@dataclass(frozen=True)
+class ThemeFonts:
+    """The theme's major (heading) and minor (body) typefaces."""
+
+    major_latin: str = ""
+    major_east_asian: str = ""
+    minor_latin: str = ""
+    minor_east_asian: str = ""
+
+
+@dataclass(frozen=True)
+class Theme:
+    """The theme read back: ``colors`` are 12 ``0xFFRRGGBB`` values in ``a:clrScheme`` order."""
+
+    source: ThemeSource
+    colors: List[int]
+    fonts: ThemeFonts
+
+
+@dataclass(frozen=True)
+class ResolvedColor:
+    """A colour resolved to ``0xAARRGGBB`` and how it was resolved."""
+
+    argb: int
+    resolution: ColorResolution
+
+
+@dataclass(frozen=True)
+class EffectiveStyle:
+    """The formatting a cell shows, read from its selected xf record.
+
+    ``borders`` holds left, right, top, bottom, diagonal.
+    """
+
+    xf_index: int
+    source: EffectiveStyleSource
+    font_index: int
+    fill_index: int
+    border_index: int
+    font: ResolvedColor
+    fill_foreground: ResolvedColor
+    fill_background: ResolvedColor
+    borders: List[ResolvedColor]
+    locked: bool
     hidden: bool
-    custom_builtin: bool
+    num_fmt_code: str
 
 
 @dataclass(frozen=True)
@@ -1424,6 +1990,16 @@ def _cell_xf_fields(record: CellXf) -> Dict[str, object]:
         "has_justify_last_line": 1
         if (record.has_justify_last_line if record.has_justify_last_line is not None else record.justify_last_line)
         else 0,
+        "apply_number_format": 1 if record.apply_number_format else 0,
+        "apply_font": 1 if record.apply_font else 0,
+        "apply_fill": 1 if record.apply_fill else 0,
+        "apply_border": 1 if record.apply_border else 0,
+        "apply_alignment": 1 if record.apply_alignment else 0,
+        "apply_protection": 1 if record.apply_protection else 0,
+        "quote_prefix": 1 if record.quote_prefix else 0,
+        "has_protection": 1 if record.has_protection else 0,
+        "locked": 1 if record.locked else 0,
+        "hidden": 1 if record.hidden else 0,
     }
 
 
@@ -1450,6 +2026,30 @@ def _alloc_out_ptr() -> int:
     return ptr
 
 
+def _alloc_out_u64() -> int:
+    """Allocate an 8-byte WASM scratch slot for an out-uint64."""
+    ptr = LIB.alloc(8)
+    LIB.write_bytes(ptr, b"\x00" * 8)
+    return ptr
+
+
+def _read_image_info(ptr: int) -> ImageInfo:
+    """Decode an ``fm_image_info`` block."""
+    d = S.IMAGE_INFO.unpack(LIB, ptr)
+    return ImageInfo(format=d["format"], px_width=d["px_width"], px_height=d["px_height"])
+
+
+def _alloc_struct_array(layout: S.Struct, count: int, owned: List[int]) -> int:
+    """Allocate a zeroed contiguous array of ``count`` ``layout`` structs.
+
+    The pointer is appended to ``owned`` for later release.
+    """
+    ptr = LIB.alloc(layout.size * count)
+    owned.append(ptr)
+    LIB.write_bytes(ptr, b"\x00" * (layout.size * count))
+    return ptr
+
+
 def _read_count(fn, *args) -> int:
     """Call a ``(... , out_count*)`` ABI function and return the count."""
     out = _alloc_out_ptr()
@@ -1494,6 +2094,244 @@ def _pack_merge_array(ranges: Sequence[MergeRange], owned: List[int]) -> int:
     return ptr
 
 
+def _write_value_input(value: Value, value_ptr: int, owned: List[int]) -> None:
+    """Write ``value`` as an ``fm_value_t`` at ``value_ptr``.
+
+    A text payload's buffer is appended to ``owned`` for later release.
+    """
+    payload = b"\x00" * 8
+    if value.kind is ValueKind.NUMBER:
+        payload = struct.pack("<d", float(value.number or 0.0))
+    elif value.kind is ValueKind.BOOL:
+        payload = struct.pack("<i", 1 if value.boolean else 0) + b"\x00" * 4
+    elif value.kind is ValueKind.ERROR:
+        payload = struct.pack("<i", int(value.error_code or 0)) + b"\x00" * 4
+    elif value.kind is ValueKind.TEXT:
+        text_buf, _ = LIB.alloc_utf8(value.text or "")
+        owned.append(text_buf)
+        payload = struct.pack("<I", text_buf) + b"\x00" * 4
+    LIB.write_bytes(value_ptr, struct.pack("<i", int(value.kind)) + b"\x00" * 4 + payload)
+
+
+def _pack_mentions(mentions: Sequence[Mention], owned: List[int]) -> int:
+    """Pack ``mentions`` into a contiguous ``fm_mention`` array (0 when empty)."""
+    if not mentions:
+        return 0
+    base = _alloc_struct_array(S.MENTION, len(mentions), owned)
+    for i, m in enumerate(mentions):
+        ptr = base + i * S.MENTION.size
+        S.MENTION.pack(LIB, ptr, {"start": _uint(m.start, "start"), "length": _uint(m.length, "length")})
+        S.write_str_field(LIB, ptr, S.MENTION, "person_id", m.person_id, owned)
+        S.write_str_field(LIB, ptr, S.MENTION, "mention_id", m.mention_id, owned)
+    return base
+
+
+def _write_mentions(struct_ptr: int, layout: S.Struct, mentions: Sequence[Mention], owned: List[int]) -> None:
+    """Store a mention array and its count into the ``mentions`` / ``mention_count`` fields."""
+    LIB.write_bytes(struct_ptr + layout.offsets["mentions"][1], struct.pack("<I", _pack_mentions(mentions, owned)))
+    LIB.write_bytes(struct_ptr + layout.offsets["mention_count"][1], struct.pack("<I", len(mentions)))
+
+
+def _decode_mentions(base: int, count: int) -> List[Mention]:
+    out: List[Mention] = []
+    for i in range(count):
+        d = S.MENTION.unpack(LIB, base + i * S.MENTION.size)
+        out.append(
+            Mention(
+                person_id=LIB.read_cstr(d["person_id"]),
+                mention_id=LIB.read_cstr(d["mention_id"]),
+                start=d["start"],
+                length=d["length"],
+            )
+        )
+    return out
+
+
+def _pack_merge_at(ptr: int, r: MergeRange) -> None:
+    S.MERGE_RANGE.pack(
+        LIB,
+        ptr,
+        {
+            "first_row": _uint(r.first_row, "first_row"),
+            "first_col": _uint(r.first_col, "first_col"),
+            "last_row": _uint(r.last_row, "last_row"),
+            "last_col": _uint(r.last_col, "last_col"),
+        },
+    )
+
+
+def _decode_merge_at(ptr: int) -> MergeRange:
+    d = S.MERGE_RANGE.unpack(LIB, ptr)
+    return MergeRange(d["first_row"], d["first_col"], d["last_row"], d["last_col"])
+
+
+_FILTER_COLUMN_BOOLS = (
+    "hidden_button",
+    "show_button",
+    "filter_blank",
+    "custom_and",
+    "top",
+    "percent",
+    "has_filter_val",
+    "has_dyn_val",
+    "has_dyn_max_val",
+    "cell_color",
+    "has_icon_id",
+)
+_FILTER_COLUMN_INTS = ("kind", "custom_count", "op1", "op2", "dynamic_type", "icon_set", "icon_id")
+_FILTER_COLUMN_DOUBLES = ("top_val", "filter_val", "dyn_val", "dyn_max_val")
+_FILTER_COLUMN_STRINGS = ("val1", "val2", "val_iso", "max_val_iso")
+
+
+def _pack_filter_column(ptr: int, col: AutoFilterColumn, owned: List[int]) -> None:
+    fields: Dict[str, object] = {
+        "col_id": _uint(col.col_id, "col_id"),
+        "dxf_id": _uint(col.dxf_id, "dxf_id"),
+    }
+    for name in _FILTER_COLUMN_BOOLS:
+        fields[name] = 1 if getattr(col, name) else 0
+    for name in _FILTER_COLUMN_INTS:
+        fields[name] = _sint(int(getattr(col, name)), name)
+    for name in _FILTER_COLUMN_DOUBLES:
+        fields[name] = float(getattr(col, name))
+    fields["value_count"] = _uint(len(col.values), "value_count")
+    fields["date_group_count"] = _uint(len(col.date_groups), "date_group_count")
+    S.FILTER_COLUMN.pack(LIB, ptr, fields)
+    for name in _FILTER_COLUMN_STRINGS:
+        S.write_str_field(LIB, ptr, S.FILTER_COLUMN, name, getattr(col, name), owned)
+    if col.values:
+        arr = LIB.alloc(4 * len(col.values))
+        owned.append(arr)
+        for i, text in enumerate(col.values):
+            text_ptr, _ = LIB.alloc_utf8(text)
+            owned.append(text_ptr)
+            LIB.write_bytes(arr + 4 * i, struct.pack("<I", text_ptr))
+        LIB.write_bytes(ptr + S.FILTER_COLUMN.offsets["values"][1], struct.pack("<I", arr))
+    if col.date_groups:
+        base = _alloc_struct_array(S.DATE_GROUP_ITEM, len(col.date_groups), owned)
+        for i, g in enumerate(col.date_groups):
+            S.DATE_GROUP_ITEM.pack(
+                LIB,
+                base + i * S.DATE_GROUP_ITEM.size,
+                {
+                    "year": _uint(g.year, "year", 16),
+                    "month": _uint(g.month, "month", 8),
+                    "day": _uint(g.day, "day", 8),
+                    "hour": _uint(g.hour, "hour", 8),
+                    "minute": _uint(g.minute, "minute", 8),
+                    "second": _uint(g.second, "second", 8),
+                    "grouping": _uint(int(g.grouping), "grouping", 8),
+                },
+            )
+        LIB.write_bytes(ptr + S.FILTER_COLUMN.offsets["date_groups"][1], struct.pack("<I", base))
+
+
+def _pack_sort_condition(ptr: int, cond: AutoFilterSortCondition, owned: List[int]) -> None:
+    S.SORT_CONDITION.pack(
+        LIB,
+        ptr,
+        {
+            "descending": 1 if cond.descending else 0,
+            "sort_by": _sint(int(cond.sort_by), "sort_by"),
+            "dxf_id": _uint(cond.dxf_id, "dxf_id"),
+            "has_dxf_id": 1 if cond.has_dxf_id else 0,
+            "icon_set": _sint(cond.icon_set, "icon_set"),
+            "icon_id": _sint(cond.icon_id, "icon_id"),
+            "has_icon_id": 1 if cond.has_icon_id else 0,
+        },
+    )
+    _pack_merge_at(ptr + S.SORT_CONDITION.offsets["ref"][1], cond.ref)
+    S.write_str_field(LIB, ptr, S.SORT_CONDITION, "custom_list", cond.custom_list, owned)
+
+
+def _pack_auto_filter(ptr: int, af: AutoFilter, owned: List[int]) -> None:
+    """Fill the ``fm_auto_filter`` at ``ptr``; every nested buffer is appended to ``owned``."""
+    S.AUTO_FILTER.pack(
+        LIB,
+        ptr,
+        {
+            "column_count": _uint(len(af.columns), "column_count"),
+        },
+    )
+    off = S.AUTO_FILTER.offsets
+    _pack_merge_at(ptr + off["range"][1], af.range)
+    if af.columns:
+        base = _alloc_struct_array(S.FILTER_COLUMN, len(af.columns), owned)
+        for i, col in enumerate(af.columns):
+            _pack_filter_column(base + i * S.FILTER_COLUMN.size, col, owned)
+        LIB.write_bytes(ptr + off["columns"][1], struct.pack("<I", base))
+    sort = af.sort
+    if sort is None:
+        return
+    fields = {
+        "has_sort": 1,
+        "column_sort": 1 if sort.column_sort else 0,
+        "case_sensitive": 1 if sort.case_sensitive else 0,
+        "sort_method": _sint(int(sort.sort_method), "sort_method"),
+        "condition_count": _uint(len(sort.conditions), "condition_count"),
+    }
+    for name, value in fields.items():
+        LIB.write_bytes(ptr + off[name][1], struct.pack("<i" if name != "condition_count" else "<I", value))
+    _pack_merge_at(ptr + off["sort_ref"][1], sort.ref)
+    if sort.conditions:
+        base = _alloc_struct_array(S.SORT_CONDITION, len(sort.conditions), owned)
+        for i, cond in enumerate(sort.conditions):
+            _pack_sort_condition(base + i * S.SORT_CONDITION.size, cond, owned)
+        LIB.write_bytes(ptr + off["conditions"][1], struct.pack("<I", base))
+
+
+def _decode_filter_column(ptr: int) -> AutoFilterColumn:
+    d = S.FILTER_COLUMN.unpack(LIB, ptr)
+    values: List[str] = []
+    if d["value_count"]:
+        raw = LIB.read_bytes(d["values"], 4 * d["value_count"])
+        values = [LIB.read_cstr(p) for p in struct.unpack(f"<{d['value_count']}I", raw)]
+    groups: List[AutoFilterDateGroup] = []
+    for i in range(d["date_group_count"]):
+        g = S.DATE_GROUP_ITEM.unpack(LIB, d["date_groups"] + i * S.DATE_GROUP_ITEM.size)
+        groups.append(AutoFilterDateGroup(**g))
+    kwargs: Dict[str, object] = {name: bool(d[name]) for name in _FILTER_COLUMN_BOOLS}
+    kwargs.update({name: d[name] for name in _FILTER_COLUMN_INTS + _FILTER_COLUMN_DOUBLES})
+    kwargs.update({name: LIB.read_cstr(d[name]) for name in _FILTER_COLUMN_STRINGS})
+    return AutoFilterColumn(col_id=d["col_id"], dxf_id=d["dxf_id"], values=values, date_groups=groups, **kwargs)  # type: ignore[arg-type]
+
+
+def _decode_sort_condition(ptr: int) -> AutoFilterSortCondition:
+    d = S.SORT_CONDITION.unpack(LIB, ptr)
+    return AutoFilterSortCondition(
+        ref=_decode_merge_at(ptr + S.SORT_CONDITION.offsets["ref"][1]),
+        descending=bool(d["descending"]),
+        sort_by=d["sort_by"],
+        custom_list=LIB.read_cstr(d["custom_list"]),
+        dxf_id=d["dxf_id"],
+        has_dxf_id=bool(d["has_dxf_id"]),
+        icon_set=d["icon_set"],
+        icon_id=d["icon_id"],
+        has_icon_id=bool(d["has_icon_id"]),
+    )
+
+
+def _decode_auto_filter(ptr: int) -> AutoFilter:
+    d = S.AUTO_FILTER.unpack(LIB, ptr)
+    off = S.AUTO_FILTER.offsets
+    sort = None
+    if d["has_sort"]:
+        sort = AutoFilterSortState(
+            ref=_decode_merge_at(ptr + off["sort_ref"][1]),
+            column_sort=bool(d["column_sort"]),
+            case_sensitive=bool(d["case_sensitive"]),
+            sort_method=d["sort_method"],
+            conditions=[
+                _decode_sort_condition(d["conditions"] + i * S.SORT_CONDITION.size) for i in range(d["condition_count"])
+            ],
+        )
+    return AutoFilter(
+        range=_decode_merge_at(ptr + off["range"][1]),
+        columns=[_decode_filter_column(d["columns"] + i * S.FILTER_COLUMN.size) for i in range(d["column_count"])],
+        sort=sort,
+    )
+
+
 def _pack_phonetic_run_array(runs: Sequence[PhoneticRun], owned: List[int]) -> int:
     """Pack a list of ``PhoneticRun`` into a contiguous WASM array.
 
@@ -3196,41 +4034,791 @@ def set_sheet_protection(self, sheet: int, protection: SheetProtection) -> None:
             for p in owned:
                 LIB.free(p)
 
-    # -- Sheet view / layout -----------------------------------------------
-    def paginate(self, sheet: int) -> PaginationResult:
-        """Resolve the worksheet's print area, page breaks, and page count.
+    # -- Geometry / display ------------------------------------------------
+    def clear_row_height(self, sheet: int, row: int) -> None:
+        """Remove the height override at ``row`` (back to the sheet default)."""
+        h = self._require()
+        _check(
+            LIB.fm_sheet_clear_row_height(h, _uint(sheet, "sheet_index"), _uint(row, "row")),
+            "fm_sheet_clear_row_height",
+        )
 
-        The result is a snapshot: later workbook or layout changes do not
-        mutate the returned lists.
-        """
+    def get_sheet_format_defaults(self, sheet: int) -> SheetFormatDefaults:
+        """Read the sheet's default column / row metrics (``<sheetFormatPr>``)."""
         h = self._require()
-        out = _alloc_out_ptr()
+        ptr = S.alloc_struct(LIB, S.SHEET_FORMAT_DEFAULTS)
         try:
-            _check(LIB.fm_workbook_paginate(h, _uint(sheet, "sheet_index"), out), "fm_workbook_paginate")
-            pagination = LIB.read_u32(out)
-            if pagination == 0:
-                raise FormulonError(
-                    _STATUS_BINDING_NULL_POINTER,
-                    op="fm_workbook_paginate",
-                    _diagnostic_override=("returned kOk with a null pagination handle", ""),
-                )
-            try:
-                page_count = int(LIB.fm_pagination_page_count(pagination))
-                range_count = int(LIB.fm_pagination_print_area_count(pagination))
-                break_count = int(LIB.fm_pagination_horizontal_break_count(pagination))
-                vertical_break_count = int(LIB.fm_pagination_vertical_break_count(pagination))
-                range_ptr = LIB.alloc(16)
-                value_ptr = _alloc_out_ptr()
-                try:
-                    print_area = []
-                    for i in range(range_count):
-                        _check(
-                            LIB.fm_pagination_print_area_at(pagination, _uint(i, "index"), range_ptr),
-                            "fm_pagination_print_area_at",
-                        )
-                        print_area.append(struct.unpack("<IIII", LIB.read_bytes(range_ptr, 16)))
-                    horizontal_breaks = []
-                    for i in range(break_count):
+            _check(
+                LIB.fm_sheet_get_format_defaults(h, _uint(sheet, "sheet_index"), ptr),
+                "fm_sheet_get_format_defaults",
+            )
+            d = S.SHEET_FORMAT_DEFAULTS.unpack(LIB, ptr)
+            return SheetFormatDefaults(
+                default_col_width=d["default_col_width"],
+                default_row_height=d["default_row_height"],
+                base_col_width=d["base_col_width"],
+                has_default_col_width=bool(d["has_default_col_width"]),
+                has_default_row_height=bool(d["has_default_row_height"]),
+            )
+        finally:
+            LIB.free(ptr)
+
+    def set_sheet_format_defaults(self, sheet: int, defaults: SheetFormatDefaults) -> None:
+        """Replace the sheet's default column / row metrics."""
+        h = self._require()
+        ptr = S.alloc_struct(LIB, S.SHEET_FORMAT_DEFAULTS)
+        try:
+            S.SHEET_FORMAT_DEFAULTS.pack(
+                LIB,
+                ptr,
+                {
+                    "default_col_width": float(defaults.default_col_width),
+                    "default_row_height": float(defaults.default_row_height),
+                    "base_col_width": float(defaults.base_col_width),
+                    "has_default_col_width": 1 if defaults.has_default_col_width else 0,
+                    "has_default_row_height": 1 if defaults.has_default_row_height else 0,
+                },
+            )
+            _check(
+                LIB.fm_sheet_set_format_defaults(h, _uint(sheet, "sheet_index"), ptr),
+                "fm_sheet_set_format_defaults",
+            )
+        finally:
+            LIB.free(ptr)
+
+    def _read_f64_out(self, fn, *args) -> float:
+        """Call a ``(..., double* out)`` ABI function and return the double."""
+        out = LIB.alloc(8)
+        try:
+            _check(fn(*args, out), getattr(fn, "__name__", "geometry"))
+            return LIB.read_f64(out)
+        finally:
+            LIB.free(out)
+
+    def get_cell_rect_pt(
+        self, sheet: int, cell_range: MergeRange, mode: Union[GeometryMode, int] = GeometryMode.DISPLAY
+    ) -> RectPt:
+        """Return the rectangle covering ``cell_range`` in points from the top-left of A1."""
+        h = self._require()
+        ptr = S.alloc_struct(LIB, S.RECT_PT)
+        try:
+            _check(
+                LIB.fm_sheet_cell_rect_pt(
+                    h,
+                    _uint(sheet, "sheet_index"),
+                    _uint(cell_range.first_row, "first_row"),
+                    _uint(cell_range.first_col, "first_col"),
+                    _uint(cell_range.last_row, "last_row"),
+                    _uint(cell_range.last_col, "last_col"),
+                    _sint(int(mode), "mode"),
+                    ptr,
+                ),
+                "fm_sheet_cell_rect_pt",
+            )
+            return RectPt(**S.RECT_PT.unpack(LIB, ptr))
+        finally:
+            LIB.free(ptr)
+
+    def get_column_width_pt(self, sheet: int, col: int, mode: Union[GeometryMode, int] = GeometryMode.DISPLAY) -> float:
+        """Return the effective width of ``col`` in points (0 when hidden)."""
+        h = self._require()
+        return self._read_f64_out(
+            LIB.fm_sheet_column_width_pt, h, _uint(sheet, "sheet_index"), _uint(col, "col"), _sint(int(mode), "mode")
+        )
+
+    def get_row_height_pt(self, sheet: int, row: int) -> float:
+        """Return the effective height of ``row`` in points (0 when hidden)."""
+        h = self._require()
+        return self._read_f64_out(LIB.fm_sheet_row_height_pt, h, _uint(sheet, "sheet_index"), _uint(row, "row"))
+
+    def get_width_model(self, sheet: int, mode: Union[GeometryMode, int] = GeometryMode.DISPLAY) -> WidthModel:
+        """Return the character-unit to point conversion model in ``mode``."""
+        h = self._require()
+        ptr = S.alloc_struct(LIB, S.WIDTH_MODEL)
+        try:
+            _check(
+                LIB.fm_sheet_width_model(h, _uint(sheet, "sheet_index"), _sint(int(mode), "mode"), ptr),
+                "fm_sheet_width_model",
+            )
+            d = S.WIDTH_MODEL.unpack(LIB, ptr)
+            return WidthModel(
+                points_per_char=d["points_per_char"],
+                padding_pt=d["padding_pt"],
+                normal_font_size=d["normal_font_size"],
+                calibrated=bool(d["calibrated"]),
+                normal_font_name=LIB.read_cstr(d["normal_font_name"]),
+                platform=LIB.read_cstr(d["platform"]),
+            )
+        finally:
+            LIB.free(ptr)
+
+    def column_chars_to_pt(
+        self, sheet: int, chars: float, mode: Union[GeometryMode, int] = GeometryMode.DISPLAY
+    ) -> float:
+        """Convert a column width in character units to points."""
+        h = self._require()
+        return self._read_f64_out(
+            LIB.fm_sheet_column_chars_to_pt, h, _uint(sheet, "sheet_index"), _sint(int(mode), "mode"), float(chars)
+        )
+
+    def column_pt_to_chars(self, sheet: int, pt: float, mode: Union[GeometryMode, int] = GeometryMode.DISPLAY) -> float:
+        """Convert a column width in points to character units."""
+        h = self._require()
+        return self._read_f64_out(
+            LIB.fm_sheet_column_pt_to_chars, h, _uint(sheet, "sheet_index"), _sint(int(mode), "mode"), float(pt)
+        )
+
+    def _read_formula_text(self, fn, op: str, sheet: int, row: int, col: int) -> Optional[str]:
+        h = self._require()
+        out = _alloc_out_ptr()
+        try:
+            _check(fn(h, _uint(sheet, "sheet_index"), _uint(row, "row"), _uint(col, "col"), out), op)
+            text = LIB.read_cstr(LIB.read_u32(out))
+        finally:
+            LIB.free(out)
+        return text or None
+
+    def get_formula(self, sheet: int, row: int, col: int) -> Optional[str]:
+        """Return the stored A1 formula (leading ``=`` included), or ``None`` for a non-formula cell."""
+        return self._read_formula_text(LIB.fm_workbook_get_formula, "fm_workbook_get_formula", sheet, row, col)
+
+    def get_formula_r1c1(self, sheet: int, row: int, col: int) -> Optional[str]:
+        """Return the formula in R1C1 notation relative to the cell, or ``None`` for a non-formula cell."""
+        return self._read_formula_text(
+            LIB.fm_workbook_get_formula_r1c1, "fm_workbook_get_formula_r1c1", sheet, row, col
+        )
+
+    def get_cells_in_range(
+        self,
+        sheet: int,
+        cell_range: MergeRange,
+        cursor: Optional[int] = None,
+        limit: Optional[int] = None,
+    ) -> "tuple[List[Cell], Optional[int]]":
+        """Return one page of the populated cells in ``cell_range`` (row-major).
+
+        Pass the returned cursor back to fetch the next page; it is ``None``
+        when the rectangle holds no further populated cell. ``limit`` of
+        ``None`` or ``0`` means the engine maximum.
+        """
+        h = self._require()
+        return self._read_cell_range_page(
+            "fm_sheet_cells_in_range",
+            LIB.fm_sheet_cells_in_range,
+            h,
+            _uint(sheet, "sheet_index"),
+            _uint(cell_range.first_row, "first_row"),
+            _uint(cell_range.first_col, "first_col"),
+            _uint(cell_range.last_row, "last_row"),
+            _uint(cell_range.last_col, "last_col"),
+            _uint(cursor or 0, "cursor", 64),
+            _uint(limit or 0, "limit"),
+        )
+
+    @staticmethod
+    def _read_cell_range_page(op: str, fn, *args) -> "tuple[List[Cell], Optional[int]]":
+        """Call a ``(..., fm_cell_range_t** out)`` ABI function and drain its page."""
+        out = _alloc_out_ptr()
+        try:
+            _check(fn(*args, out), op)
+            handle = LIB.read_u32(out)
+        finally:
+            LIB.free(out)
+        if handle == 0:
+            raise FormulonError(
+                _STATUS_BINDING_NULL_POINTER,
+                op=op,
+                _diagnostic_override=("returned kOk with a null cell-range handle", ""),
+            )
+        try:
+            count = _read_count(LIB.fm_cell_range_count, handle)
+            row_ptr = _alloc_out_ptr()
+            col_ptr = _alloc_out_ptr()
+            formula_ptr = _alloc_out_ptr()
+            cursor_ptr = _alloc_out_u64()
+            value_ptr = LIB.alloc(fm_value_t_size)
+            try:
+                cells: List[Cell] = []
+                for i in range(count):
+                    LIB.write_bytes(formula_ptr, b"\x00\x00\x00\x00")
+                    _check(
+                        LIB.fm_cell_range_at(handle, _uint(i, "idx"), row_ptr, col_ptr, formula_ptr, value_ptr),
+                        "fm_cell_range_at",
+                    )
+                    formula_addr = LIB.read_u32(formula_ptr)
+                    cells.append(
+                        Cell(
+                            row=LIB.read_u32(row_ptr),
+                            col=LIB.read_u32(col_ptr),
+                            formula=LIB.read_cstr(formula_addr) if formula_addr else None,
+                            value=Value._from_wasm(value_ptr),
+                        )
+                    )
+                _check(LIB.fm_cell_range_next_cursor(handle, cursor_ptr), "fm_cell_range_next_cursor")
+                next_cursor = struct.unpack("<Q", LIB.read_bytes(cursor_ptr, 8))[0]
+            finally:
+                LIB.free(row_ptr)
+                LIB.free(col_ptr)
+                LIB.free(formula_ptr)
+                LIB.free(cursor_ptr)
+                LIB.free(value_ptr)
+        finally:
+            LIB.fm_cell_range_destroy(handle)
+        return cells, (None if next_cursor == _CELL_RANGE_NO_CURSOR else next_cursor)
+
+    # -- AutoFilter ----------------------------------------------------------
+    def _read_auto_filter(self, fn, index: int, op: str, index_name: str) -> Optional[AutoFilter]:
+        h = self._require()
+        ptr = S.alloc_struct(LIB, S.AUTO_FILTER)
+        present = _alloc_out_ptr()
+        try:
+            _check(fn(h, _uint(index, index_name), ptr, present), op)
+            if LIB.read_u32(present) == 0:
+                return None
+            return _decode_auto_filter(ptr)
+        finally:
+            LIB.free(ptr)
+            LIB.free(present)
+
+    def _write_auto_filter(self, fn, index: int, auto_filter: AutoFilter, op: str, index_name: str) -> None:
+        h = self._require()
+        owned: List[int] = []
+        try:
+            ptr = _alloc_struct_array(S.AUTO_FILTER, 1, owned)
+            _pack_auto_filter(ptr, auto_filter, owned)
+            _check(fn(h, _uint(index, index_name), ptr), op)
+        finally:
+            for p in owned:
+                LIB.free(p)
+
+    def _evaluate_auto_filter(self, fn, index: int, op: str, index_name: str) -> "tuple[int, List[bool]]":
+        h = self._require()
+        len_ptr = _alloc_out_ptr()
+        first_ptr = _alloc_out_ptr()
+        buf = 0
+        try:
+            # Size the buffer first, then fetch.
+            _check(fn(h, _uint(index, index_name), 0, 0, len_ptr, first_ptr), op)
+            total = LIB.read_u32(len_ptr)
+            if total == 0:
+                return LIB.read_u32(first_ptr), []
+            buf = LIB.alloc(total)
+            _check(fn(h, _uint(index, index_name), buf, total, len_ptr, first_ptr), op)
+            flags = LIB.read_bytes(buf, total)
+            return LIB.read_u32(first_ptr), [b != 0 for b in flags]
+        finally:
+            LIB.free(len_ptr)
+            LIB.free(first_ptr)
+            if buf:
+                LIB.free(buf)
+
+    def get_auto_filter(self, sheet: int) -> Optional[AutoFilter]:
+        """Return the sheet AutoFilter, or ``None`` when the sheet has none."""
+        return self._read_auto_filter(LIB.fm_sheet_get_auto_filter, sheet, "fm_sheet_get_auto_filter", "sheet_index")
+
+    def set_auto_filter(self, sheet: int, auto_filter: AutoFilter) -> None:
+        """Replace the sheet AutoFilter. Row visibility is unchanged; see :meth:`apply_auto_filter`."""
+        self._write_auto_filter(
+            LIB.fm_sheet_set_auto_filter, sheet, auto_filter, "fm_sheet_set_auto_filter", "sheet_index"
+        )
+
+    def remove_auto_filter(self, sheet: int) -> None:
+        """Remove the sheet AutoFilter (no-op when absent). Row visibility is unchanged."""
+        h = self._require()
+        _check(LIB.fm_sheet_remove_auto_filter(h, _uint(sheet, "sheet_index")), "fm_sheet_remove_auto_filter")
+
+    def apply_auto_filter(self, sheet: int) -> None:
+        """Hide the body rows the sheet AutoFilter excludes and show the rest."""
+        h = self._require()
+        _check(LIB.fm_sheet_apply_auto_filter(h, _uint(sheet, "sheet_index")), "fm_sheet_apply_auto_filter")
+
+    def clear_auto_filter(self, sheet: int) -> None:
+        """Drop every column criterion of the sheet AutoFilter and show all its body rows."""
+        h = self._require()
+        _check(LIB.fm_sheet_clear_auto_filter(h, _uint(sheet, "sheet_index")), "fm_sheet_clear_auto_filter")
+
+    def evaluate_auto_filter(self, sheet: int) -> "tuple[int, List[bool]]":
+        """Evaluate the sheet AutoFilter without changing the sheet.
+
+        Returns ``(first_row, match)``: body row ``first_row + i`` matches when
+        ``match[i]`` is true.
+        """
+        return self._evaluate_auto_filter(
+            LIB.fm_sheet_evaluate_auto_filter, sheet, "fm_sheet_evaluate_auto_filter", "sheet_index"
+        )
+
+    def get_table_auto_filter(self, table_index: int) -> Optional[AutoFilter]:
+        """Return the AutoFilter of table ``table_index``, or ``None`` when it has none."""
+        return self._read_auto_filter(
+            LIB.fm_table_get_auto_filter, table_index, "fm_table_get_auto_filter", "table_index"
+        )
+
+    def set_table_auto_filter(self, table_index: int, auto_filter: AutoFilter) -> None:
+        """Replace the AutoFilter of table ``table_index``."""
+        self._write_auto_filter(
+            LIB.fm_table_set_auto_filter, table_index, auto_filter, "fm_table_set_auto_filter", "table_index"
+        )
+
+    def remove_table_auto_filter(self, table_index: int) -> None:
+        """Remove the AutoFilter of table ``table_index`` (no-op when absent)."""
+        h = self._require()
+        _check(LIB.fm_table_remove_auto_filter(h, _uint(table_index, "table_index")), "fm_table_remove_auto_filter")
+
+    def apply_table_auto_filter(self, table_index: int) -> None:
+        """Hide the body rows the table AutoFilter excludes and show the rest."""
+        h = self._require()
+        _check(LIB.fm_table_apply_auto_filter(h, _uint(table_index, "table_index")), "fm_table_apply_auto_filter")
+
+    def clear_table_auto_filter(self, table_index: int) -> None:
+        """Drop every column criterion of the table AutoFilter and show all its body rows."""
+        h = self._require()
+        _check(LIB.fm_table_clear_auto_filter(h, _uint(table_index, "table_index")), "fm_table_clear_auto_filter")
+
+    def evaluate_table_auto_filter(self, table_index: int) -> "tuple[int, List[bool]]":
+        """Evaluate the table AutoFilter; returns ``(first_row, match)`` as :meth:`evaluate_auto_filter`."""
+        return self._evaluate_auto_filter(
+            LIB.fm_table_evaluate_auto_filter, table_index, "fm_table_evaluate_auto_filter", "table_index"
+        )
+
+    # -- Validation checks -----------------------------------------------------
+    def validate_value(self, sheet: int, row: int, col: int, value: Value) -> ValidationOutcome:
+        """Check ``value`` against the data-validation rule covering ``(row, col)`` without storing it."""
+        h = self._require()
+        owned: List[int] = []
+        value_ptr = LIB.alloc(fm_value_t_size)
+        owned.append(value_ptr)
+        ptr = S.alloc_struct(LIB, S.VALIDATION_OUTCOME)
+        owned.append(ptr)
+        try:
+            _write_value_input(value, value_ptr, owned)
+            _check(
+                LIB.fm_sheet_validate_value(
+                    h, _uint(sheet, "sheet_index"), _uint(row, "row"), _uint(col, "col"), value_ptr, ptr
+                ),
+                "fm_sheet_validate_value",
+            )
+            d = S.VALIDATION_OUTCOME.unpack(LIB, ptr)
+        finally:
+            for p in owned:
+                LIB.free(p)
+        return ValidationOutcome(
+            has_rule=bool(d["has_rule"]),
+            valid=bool(d["valid"]),
+            rule_index=d["rule_index"],
+            error_style=d["error_style"],
+        )
+
+    def list_invalid_cells(
+        self, sheet: int, cursor: Optional[int] = None, limit: Optional[int] = None
+    ) -> "tuple[List[Cell], Optional[int]]":
+        """Return one page of the populated cells failing their data-validation rule (row-major).
+
+        Paging follows :meth:`get_cells_in_range`: pass the returned cursor back
+        for the next page; it is ``None`` once no further invalid cell exists.
+        """
+        h = self._require()
+        return self._read_cell_range_page(
+            "fm_sheet_list_invalid_cells",
+            LIB.fm_sheet_list_invalid_cells,
+            h,
+            _uint(sheet, "sheet_index"),
+            _uint(cursor or 0, "cursor", 64),
+            _uint(limit or 0, "limit"),
+        )
+
+    # -- Threaded comments and persons -------------------------------------------
+    def get_threaded_comments(self, sheet: int) -> List[ThreadedComment]:
+        """Return the sheet's threaded comments in file order (openers followed by their replies)."""
+        h = self._require()
+        n = _read_count(LIB.fm_sheet_threaded_comment_count, h, _uint(sheet, "sheet_index"))
+        ptr = S.alloc_struct(LIB, S.THREADED_COMMENT)
+        out: List[ThreadedComment] = []
+        try:
+            for i in range(n):
+                S.zero_struct(LIB, S.THREADED_COMMENT, ptr)
+                _check(
+                    LIB.fm_sheet_threaded_comment_at(h, _uint(sheet, "sheet_index"), _uint(i, "idx"), ptr),
+                    "fm_sheet_threaded_comment_at",
+                )
+                d = S.THREADED_COMMENT.unpack(LIB, ptr)
+                out.append(
+                    ThreadedComment(
+                        id=LIB.read_cstr(d["id"]),
+                        row=d["row"],
+                        col=d["col"],
+                        person_id=LIB.read_cstr(d["person_id"]),
+                        created=LIB.read_cstr(d["created"]),
+                        text=LIB.read_cstr(d["text"]),
+                        parent_id=LIB.read_cstr(d["parent_id"]),
+                        done=bool(d["done"]),
+                        mentions=_decode_mentions(d["mentions"], d["mention_count"]),
+                    )
+                )
+        finally:
+            LIB.free(ptr)
+        return out
+
+    def add_threaded_comment(self, sheet: int, comment: ThreadedComment) -> None:
+        """Add a threaded comment: a new thread when ``parent_id`` is empty, else a reply."""
+        h = self._require()
+        owned: List[int] = []
+        try:
+            ptr = _alloc_struct_array(S.THREADED_COMMENT, 1, owned)
+            S.THREADED_COMMENT.pack(
+                LIB,
+                ptr,
+                {
+                    "row": _uint(comment.row, "row"),
+                    "col": _uint(comment.col, "col"),
+                    "done": 1 if comment.done else 0,
+                },
+            )
+            for fld in ("id", "person_id", "created", "text", "parent_id"):
+                S.write_str_field(LIB, ptr, S.THREADED_COMMENT, fld, getattr(comment, fld), owned)
+            _write_mentions(ptr, S.THREADED_COMMENT, comment.mentions, owned)
+            _check(
+                LIB.fm_sheet_add_threaded_comment(h, _uint(sheet, "sheet_index"), ptr),
+                "fm_sheet_add_threaded_comment",
+            )
+        finally:
+            for p in owned:
+                LIB.free(p)
+
+    def edit_threaded_comment(self, sheet: int, comment_id: str, text: str, mentions: Sequence[Mention] = ()) -> None:
+        """Replace the text and mentions of the comment ``comment_id``."""
+        h = self._require()
+        owned: List[int] = []
+        try:
+            id_ptr, _ = LIB.alloc_utf8(comment_id)
+            owned.append(id_ptr)
+            text_ptr, _ = LIB.alloc_utf8(text)
+            owned.append(text_ptr)
+            mentions_ptr = _pack_mentions(mentions, owned)
+            _check(
+                LIB.fm_sheet_edit_threaded_comment(
+                    h, _uint(sheet, "sheet_index"), id_ptr, text_ptr, mentions_ptr, _uint(len(mentions), "count")
+                ),
+                "fm_sheet_edit_threaded_comment",
+            )
+        finally:
+            for p in owned:
+                LIB.free(p)
+
+    def set_thread_resolved(self, sheet: int, thread_id: str, done: bool) -> None:
+        """Set the resolved state of the thread opened by ``thread_id``."""
+        h = self._require()
+        id_ptr, _ = LIB.alloc_utf8(thread_id)
+        try:
+            _check(
+                LIB.fm_sheet_set_thread_resolved(h, _uint(sheet, "sheet_index"), id_ptr, 1 if done else 0),
+                "fm_sheet_set_thread_resolved",
+            )
+        finally:
+            LIB.free(id_ptr)
+
+    def remove_threaded_comment(self, sheet: int, comment_id: str) -> None:
+        """Remove the comment ``comment_id``; removing a thread opener removes its whole thread."""
+        h = self._require()
+        id_ptr, _ = LIB.alloc_utf8(comment_id)
+        try:
+            _check(
+                LIB.fm_sheet_remove_threaded_comment(h, _uint(sheet, "sheet_index"), id_ptr),
+                "fm_sheet_remove_threaded_comment",
+            )
+        finally:
+            LIB.free(id_ptr)
+
+    # -- Drawing images ------------------------------------------------------
+    def probe_image(self, data: Union[bytes, bytearray, memoryview]) -> ImageInfo:
+        """Sniff the format and pixel size of PNG, JPEG, GIF or BMP bytes without touching the workbook."""
+        h = self._require()
+        raw = bytes(data)
+        buf = LIB.alloc_bytes(raw)
+        info = S.alloc_struct(LIB, S.IMAGE_INFO)
+        try:
+            _check(LIB.fm_workbook_probe_image(h, buf, _uint(len(raw), "len"), info), "fm_workbook_probe_image")
+            return _read_image_info(info)
+        finally:
+            LIB.free(info)
+            LIB.free(buf)
+
+    def list_drawing_objects(self, sheet: int) -> List[DrawingObject]:
+        """Return the anchored objects of the sheet's drawing in document order."""
+        h = self._require()
+        n = _read_count(LIB.fm_sheet_drawing_object_count, h, _uint(sheet, "sheet_index"))
+        ptr = S.alloc_struct(LIB, S.DRAWING_OBJECT)
+        out: List[DrawingObject] = []
+        try:
+            for i in range(n):
+                S.zero_struct(LIB, S.DRAWING_OBJECT, ptr)
+                _check(
+                    LIB.fm_sheet_drawing_object_at(h, _uint(sheet, "sheet_index"), _uint(i, "idx"), ptr),
+                    "fm_sheet_drawing_object_at",
+                )
+                d = S.DRAWING_OBJECT.unpack(LIB, ptr)
+                out.append(
+                    DrawingObject(
+                        object_id=d["object_id"],
+                        kind=d["kind"],
+                        anchor_kind=d["anchor_kind"],
+                        edit_as=d["edit_as"],
+                        from_row=d["from_row"],
+                        from_col=d["from_col"],
+                        from_row_off=d["from_row_off"],
+                        from_col_off=d["from_col_off"],
+                        to_row=d["to_row"],
+                        to_col=d["to_col"],
+                        to_row_off=d["to_row_off"],
+                        to_col_off=d["to_col_off"],
+                        cx=d["cx"],
+                        cy=d["cy"],
+                        image_format=d["image_format"],
+                        name=LIB.read_cstr(d["name"]),
+                        descr=LIB.read_cstr(d["descr"]),
+                        media_path=LIB.read_cstr(d["media_path"]),
+                    )
+                )
+        finally:
+            LIB.free(ptr)
+        return out
+
+    def get_image(self, sheet: int, object_id: int) -> bytes:
+        """Return the bytes of the picture ``object_id`` (copied out of WASM memory)."""
+        h = self._require()
+        bytes_ptr = _alloc_out_ptr()
+        len_ptr = _alloc_out_ptr()
+        info = S.alloc_struct(LIB, S.IMAGE_INFO)
+        try:
+            _check(
+                LIB.fm_sheet_get_image(
+                    h, _uint(sheet, "sheet_index"), _uint(object_id, "object_id"), bytes_ptr, len_ptr, info
+                ),
+                "fm_sheet_get_image",
+            )
+            return LIB.read_bytes(LIB.read_u32(bytes_ptr), LIB.read_u32(len_ptr))
+        finally:
+            LIB.free(info)
+            LIB.free(len_ptr)
+            LIB.free(bytes_ptr)
+
+    def insert_image(
+        self,
+        sheet: int,
+        data: Union[bytes, bytearray, memoryview],
+        *,
+        name: str = "",
+        descr: str = "",
+        anchor_kind: Union[AnchorKind, int] = AnchorKind.ONE_CELL,
+        edit_as: Union[AnchorEditAs, int] = AnchorEditAs.TWO_CELL,
+        row: int = 0,
+        col: int = 0,
+        row_off_emu: int = 0,
+        col_off_emu: int = 0,
+        width_emu: int = 0,
+        height_emu: int = 0,
+    ) -> int:
+        """Insert an image anchored at ``(row, col)`` and return its object id.
+
+        A ``width_emu`` or ``height_emu`` of ``0`` means the image's pixel size
+        times 9525. ``edit_as`` is honoured for a two-cell anchor only.
+        """
+        h = self._require()
+        raw = bytes(data)
+        owned: List[int] = []
+        out = _alloc_out_ptr()
+        try:
+            owned.append(out)
+            buf = LIB.alloc_bytes(raw)
+            owned.append(buf)
+            ptr = _alloc_struct_array(S.IMAGE_INSERT, 1, owned)
+            S.IMAGE_INSERT.pack(
+                LIB,
+                ptr,
+                {
+                    "anchor_kind": _sint(anchor_kind, "anchor_kind"),
+                    "edit_as": _sint(edit_as, "edit_as"),
+                    "row": _uint(row, "row"),
+                    "col": _uint(col, "col"),
+                    "row_off_emu": int(row_off_emu),
+                    "col_off_emu": int(col_off_emu),
+                    "width_emu": int(width_emu),
+                    "height_emu": int(height_emu),
+                },
+            )
+            S.write_str_field(LIB, ptr, S.IMAGE_INSERT, "name", name, owned)
+            S.write_str_field(LIB, ptr, S.IMAGE_INSERT, "descr", descr, owned)
+            _check(
+                LIB.fm_sheet_insert_image(h, _uint(sheet, "sheet_index"), buf, _uint(len(raw), "len"), ptr, out),
+                "fm_sheet_insert_image",
+            )
+            return LIB.read_u32(out)
+        finally:
+            for p in owned:
+                LIB.free(p)
+
+    def remove_image(self, sheet: int, object_id: int) -> None:
+        """Remove the picture ``object_id``; other drawing content is kept."""
+        h = self._require()
+        _check(
+            LIB.fm_sheet_remove_image(h, _uint(sheet, "sheet_index"), _uint(object_id, "object_id")),
+            "fm_sheet_remove_image",
+        )
+
+    def get_persons(self) -> List[Person]:
+        """Return the workbook's person list in file order."""
+        h = self._require()
+        n = _read_count(LIB.fm_workbook_person_count, h)
+        ptr = S.alloc_struct(LIB, S.PERSON)
+        out: List[Person] = []
+        try:
+            for i in range(n):
+                S.zero_struct(LIB, S.PERSON, ptr)
+                _check(LIB.fm_workbook_person_at(h, _uint(i, "idx"), ptr), "fm_workbook_person_at")
+                d = S.PERSON.unpack(LIB, ptr)
+                out.append(
+                    Person(
+                        id=LIB.read_cstr(d["id"]),
+                        display_name=LIB.read_cstr(d["display_name"]),
+                        user_id=LIB.read_cstr(d["user_id"]),
+                        provider_id=LIB.read_cstr(d["provider_id"]),
+                    )
+                )
+        finally:
+            LIB.free(ptr)
+        return out
+
+    def add_person(self, person: Person) -> None:
+        """Append a person to the workbook's person list."""
+        h = self._require()
+        owned: List[int] = []
+        try:
+            ptr = _alloc_struct_array(S.PERSON, 1, owned)
+            for fld in ("id", "display_name", "user_id", "provider_id"):
+                S.write_str_field(LIB, ptr, S.PERSON, fld, getattr(person, fld), owned)
+            _check(LIB.fm_workbook_add_person(h, ptr), "fm_workbook_add_person")
+        finally:
+            for p in owned:
+                LIB.free(p)
+
+    def remove_person(self, person_id: str) -> None:
+        """Remove the person ``person_id`` (refused while a comment or mention still names them)."""
+        h = self._require()
+        id_ptr, _ = LIB.alloc_utf8(person_id)
+        try:
+            _check(LIB.fm_workbook_remove_person(h, id_ptr), "fm_workbook_remove_person")
+        finally:
+            LIB.free(id_ptr)
+
+    def get_merges_in_range(self, sheet: int, cell_range: MergeRange) -> List[MergeRange]:
+        """Return every merge range on ``sheet`` that intersects ``cell_range``."""
+        h = self._require()
+        owned: List[int] = []
+        range_ptr = _pack_merge_array([cell_range], owned)
+        count_ptr = _alloc_out_ptr()
+        try:
+            # Size the buffer first, then fetch.
+            _check(
+                LIB.fm_sheet_merges_in_range(h, _uint(sheet, "sheet_index"), range_ptr, 0, 0, count_ptr),
+                "fm_sheet_merges_in_range",
+            )
+            total = LIB.read_u32(count_ptr)
+            if total == 0:
+                return []
+            size = S.MERGE_RANGE.size
+            buf = _alloc_struct_array(S.MERGE_RANGE, total, owned)
+            _check(
+                LIB.fm_sheet_merges_in_range(
+                    h, _uint(sheet, "sheet_index"), range_ptr, buf, _uint(total, "capacity"), count_ptr
+                ),
+                "fm_sheet_merges_in_range",
+            )
+            out: List[MergeRange] = []
+            for i in range(min(total, LIB.read_u32(count_ptr))):
+                d = S.MERGE_RANGE.unpack(LIB, buf + i * size)
+                out.append(MergeRange(d["first_row"], d["first_col"], d["last_row"], d["last_col"]))
+            return out
+        finally:
+            LIB.free(count_ptr)
+            for p in owned:
+                LIB.free(p)
+
+    def get_display_text(self, sheet: int, row: int, col: int) -> "tuple[str, DisplayStatus]":
+        """Return the text Excel displays for the cell and the rendering outcome."""
+        h = self._require()
+        text_ptr = _alloc_out_ptr()
+        status_ptr = _alloc_out_ptr()
+        try:
+            _check(
+                LIB.fm_workbook_get_display_text(
+                    h, _uint(sheet, "sheet_index"), _uint(row, "row"), _uint(col, "col"), text_ptr, status_ptr
+                ),
+                "fm_workbook_get_display_text",
+            )
+            return LIB.read_cstr(LIB.read_u32(text_ptr)), DisplayStatus(LIB.read_i32(status_ptr))
+        finally:
+            LIB.free(text_ptr)
+            LIB.free(status_ptr)
+
+    def format_value(self, value: Value, format_code: str = "") -> "tuple[str, DisplayStatus]":
+        """Render ``value`` under the number format ``format_code`` (empty means General)."""
+        h = self._require()
+        owned: List[int] = []
+        value_ptr = LIB.alloc(fm_value_t_size)
+        owned.append(value_ptr)
+        text_ptr = _alloc_out_ptr()
+        status_ptr = _alloc_out_ptr()
+        owned.extend((text_ptr, status_ptr))
+        try:
+            _write_value_input(value, value_ptr, owned)
+            fmt_ptr, _ = LIB.alloc_utf8(format_code)
+            owned.append(fmt_ptr)
+            _check(
+                LIB.fm_workbook_format_value(h, value_ptr, fmt_ptr, text_ptr, status_ptr),
+                "fm_workbook_format_value",
+            )
+            return LIB.read_cstr(LIB.read_u32(text_ptr)), DisplayStatus(LIB.read_i32(status_ptr))
+        finally:
+            for p in owned:
+                LIB.free(p)
+
+    # -- Sheet view / layout -----------------------------------------------
+    def paginate(self, sheet: int) -> PaginationResult:
+        """Resolve the worksheet's print area, page breaks, and page count.
+
+        The result is a snapshot: later workbook or layout changes do not
+        mutate the returned lists.
+        """
+        h = self._require()
+        out = _alloc_out_ptr()
+        try:
+            _check(LIB.fm_workbook_paginate(h, _uint(sheet, "sheet_index"), out), "fm_workbook_paginate")
+            pagination = LIB.read_u32(out)
+            if pagination == 0:
+                raise FormulonError(
+                    _STATUS_BINDING_NULL_POINTER,
+                    op="fm_workbook_paginate",
+                    _diagnostic_override=("returned kOk with a null pagination handle", ""),
+                )
+            try:
+                page_count = int(LIB.fm_pagination_page_count(pagination))
+                range_count = int(LIB.fm_pagination_print_area_count(pagination))
+                break_count = int(LIB.fm_pagination_horizontal_break_count(pagination))
+                vertical_break_count = int(LIB.fm_pagination_vertical_break_count(pagination))
+                range_ptr = LIB.alloc(16)
+                value_ptr = _alloc_out_ptr()
+                scale_ptr = LIB.alloc(8)
+                # Sized for the largest pagination detail struct (fm_page_layout).
+                struct_ptr = S.alloc_struct(LIB, S.PAGE_LAYOUT)
+                try:
+                    print_area = []
+                    for i in range(range_count):
+                        _check(
+                            LIB.fm_pagination_print_area_at(pagination, _uint(i, "index"), range_ptr),
+                            "fm_pagination_print_area_at",
+                        )
+                        print_area.append(struct.unpack("<IIII", LIB.read_bytes(range_ptr, 16)))
+                    horizontal_breaks = []
+                    for i in range(break_count):
                         _check(
                             LIB.fm_pagination_horizontal_break_at(pagination, _uint(i, "index"), value_ptr),
                             "fm_pagination_horizontal_break_at",
@@ -3243,10 +4831,71 @@ def paginate(self, sheet: int) -> PaginationResult:
                             "fm_pagination_vertical_break_at",
                         )
                         vertical_breaks.append(LIB.read_u32(value_ptr))
+                    horizontal_break_manual = []
+                    for i in range(break_count):
+                        _check(
+                            LIB.fm_pagination_horizontal_break_is_manual(pagination, _uint(i, "index"), value_ptr),
+                            "fm_pagination_horizontal_break_is_manual",
+                        )
+                        horizontal_break_manual.append(bool(LIB.read_i32(value_ptr)))
+                    vertical_break_manual = []
+                    for i in range(vertical_break_count):
+                        _check(
+                            LIB.fm_pagination_vertical_break_is_manual(pagination, _uint(i, "index"), value_ptr),
+                            "fm_pagination_vertical_break_is_manual",
+                        )
+                        vertical_break_manual.append(bool(LIB.read_i32(value_ptr)))
+                    _check(LIB.fm_pagination_scale(pagination, scale_ptr), "fm_pagination_scale")
+                    scale = LIB.read_f64(scale_ptr)
+                    _check(LIB.fm_pagination_page_order(pagination, value_ptr), "fm_pagination_page_order")
+                    page_order = LIB.read_i32(value_ptr)
+
+                    def read_struct(layout: S.Struct, fn, op: str) -> Dict[str, int]:
+                        S.zero_struct(LIB, layout, struct_ptr)
+                        _check(fn(pagination, struct_ptr), op)
+                        return layout.unpack(LIB, struct_ptr)
+
+                    d = read_struct(S.PAPER_INFO, LIB.fm_pagination_paper, "fm_pagination_paper")
+                    paper = PaperInfo(d["width_pt"], d["height_pt"], bool(d["landscape"]), bool(d["known"]))
+                    margins = MarginsPt(**read_struct(S.MARGINS_PT, LIB.fm_pagination_margins, "fm_pagination_margins"))
+                    printable = RectPt(**read_struct(S.RECT_PT, LIB.fm_pagination_printable, "fm_pagination_printable"))
+                    d = read_struct(S.PRINT_TITLES, LIB.fm_pagination_print_titles, "fm_pagination_print_titles")
+                    print_titles = PrintTitles(
+                        has_rows=bool(d["has_rows"]),
+                        first_row=d["first_row"],
+                        last_row=d["last_row"],
+                        has_cols=bool(d["has_cols"]),
+                        first_col=d["first_col"],
+                        last_col=d["last_col"],
+                    )
+                    pages = []
+                    for i in range(page_count):
+                        S.zero_struct(LIB, S.PAGE_LAYOUT, struct_ptr)
+                        _check(
+                            LIB.fm_pagination_page_at(pagination, _uint(i, "index"), struct_ptr),
+                            "fm_pagination_page_at",
+                        )
+                        pages.append(PageLayout(**S.PAGE_LAYOUT.unpack(LIB, struct_ptr)))
                 finally:
                     LIB.free(range_ptr)
                     LIB.free(value_ptr)
-                return PaginationResult(page_count, print_area, horizontal_breaks, vertical_breaks)
+                    LIB.free(scale_ptr)
+                    LIB.free(struct_ptr)
+                return PaginationResult(
+                    page_count,
+                    print_area,
+                    horizontal_breaks,
+                    vertical_breaks,
+                    paper,
+                    margins,
+                    printable,
+                    scale,
+                    page_order,
+                    print_titles,
+                    pages,
+                    horizontal_break_manual,
+                    vertical_break_manual,
+                )
             finally:
                 LIB.fm_pagination_destroy(pagination)
         finally:
@@ -3949,6 +5598,8 @@ def get_sheet_row_overrides(self, sheet: int) -> List[RowLayout]:
                         outline_level=d["outline_level"],
                         has_style=bool(d["has_style"]),
                         style_xf=d["style_xf"],
+                        has_height=bool(d["has_height"]),
+                        custom_height=bool(d["custom_height"]),
                     )
                 )
         finally:
@@ -4442,6 +6093,16 @@ def _decode_cell_xf(ptr: int) -> CellXf:
             has_vertical_align=bool(d["has_vertical_align"]),
             has_wrap_text=bool(d["has_wrap_text"]),
             has_justify_last_line=bool(d["has_justify_last_line"]),
+            apply_number_format=bool(d["apply_number_format"]),
+            apply_font=bool(d["apply_font"]),
+            apply_fill=bool(d["apply_fill"]),
+            apply_border=bool(d["apply_border"]),
+            apply_alignment=bool(d["apply_alignment"]),
+            apply_protection=bool(d["apply_protection"]),
+            quote_prefix=bool(d["quote_prefix"]),
+            has_protection=bool(d["has_protection"]),
+            locked=bool(d["locked"]),
+            hidden=bool(d["hidden"]),
         )
 
     def get_cell_xf(self, xf_index: int) -> CellXf:
@@ -4843,23 +6504,157 @@ def add_dxf(self, record: DifferentialFormat) -> int:
             for owned_ptr in owned:
                 LIB.free(owned_ptr)
 
-    def set_cell_style(self, name: str, xf_id: int, builtin_id: int = CELL_STYLE_BUILTIN_ID_NONE) -> None:
-        """Add or replace a named ``<cellStyle>`` record.
+    def set_cell_style(self, record: CellStyle) -> None:
+        """Add or replace the named ``<cellStyle>`` record ``record.name``.
 
-        ``xf_id`` must reference an existing named-style xf -- register one
-        with :meth:`add_cell_style_xf` first. ``builtin_id`` is an Excel
-        built-in style ordinal (0..47); leave it at
+        ``record.xf_id`` must reference an existing named-style xf -- register
+        one with :meth:`add_cell_style_xf` first. ``builtin_id`` is an Excel
+        built-in style ordinal (0..53); leave it at
         ``CELL_STYLE_BUILTIN_ID_NONE`` for a custom style.
         """
         h = self._require()
+        ptr = S.alloc_struct(LIB, S.CELL_STYLE_RECORD)
+        owned: List[int] = []
+        try:
+            S.CELL_STYLE_RECORD.pack(
+                LIB,
+                ptr,
+                {
+                    "xf_id": _uint(record.xf_id, "xf_id"),
+                    "builtin_id": _uint(record.builtin_id, "builtin_id"),
+                    "i_level": _uint(record.i_level, "i_level"),
+                    "hidden": 1 if record.hidden else 0,
+                    "custom_builtin": 1 if record.custom_builtin else 0,
+                },
+            )
+            S.write_str_field(LIB, ptr, S.CELL_STYLE_RECORD, "name", record.name, owned, allow_empty=True)
+            _check(LIB.fm_styles_set_cell_style(h, ptr), "fm_styles_set_cell_style")
+        finally:
+            LIB.free(ptr)
+            for owned_ptr in owned:
+                LIB.free(owned_ptr)
+
+    def remove_cell_style(self, name: str) -> None:
+        """Remove the named cell style ``name``.
+
+        Cell xfs inheriting from it are repointed at Normal; no xf index
+        shifts. The Normal style and unknown names raise ``FormulonError``.
+        """
+        h = self._require()
         name_ptr, _ = LIB.alloc_utf8(name)
         try:
+            _check(LIB.fm_styles_remove_cell_style(h, name_ptr), "fm_styles_remove_cell_style")
+        finally:
+            LIB.free(name_ptr)
+
+    def get_theme(self) -> Theme:
+        """Read the theme's 12 scheme colours and typefaces.
+
+        The default theme is reported when the part is absent or unparseable;
+        ``Theme.source`` tells the cases apart.
+        """
+        h = self._require()
+        colors_ptr = S.alloc_struct(LIB, S.THEME_COLORS)
+        fonts_ptr = S.alloc_struct(LIB, S.THEME_FONTS)
+        source_ptr = _alloc_out_ptr()
+        try:
+            _check(LIB.fm_workbook_get_theme_colors(h, colors_ptr, source_ptr), "fm_workbook_get_theme_colors")
+            source = LIB.read_i32(source_ptr)
+            colors = list(struct.unpack("<12I", LIB.read_bytes(colors_ptr, S.THEME_COLORS.size)))
+            _check(LIB.fm_workbook_get_theme_fonts(h, fonts_ptr), "fm_workbook_get_theme_fonts")
+            f = S.THEME_FONTS.unpack(LIB, fonts_ptr)
+            fonts = ThemeFonts(
+                major_latin=LIB.read_cstr(f["major_latin"]),
+                major_east_asian=LIB.read_cstr(f["major_east_asian"]),
+                minor_latin=LIB.read_cstr(f["minor_latin"]),
+                minor_east_asian=LIB.read_cstr(f["minor_east_asian"]),
+            )
+            return Theme(source=ThemeSource(source), colors=colors, fonts=fonts)
+        finally:
+            LIB.free(colors_ptr)
+            LIB.free(fonts_ptr)
+            LIB.free(source_ptr)
+
+    def set_theme_colors(self, colors: Sequence[int]) -> None:
+        """Replace the theme's 12 scheme colours (``a:clrScheme`` order; alpha ignored)."""
+        h = self._require()
+        values = [_uint(c, "colors") for c in colors]
+        if len(values) != 12:
+            raise ValueError(f"formulon: colors must hold 12 entries, got {len(values)}")
+        ptr = S.alloc_struct(LIB, S.THEME_COLORS)
+        try:
+            LIB.write_bytes(ptr, struct.pack("<12I", *values))
+            _check(LIB.fm_workbook_set_theme_colors(h, ptr), "fm_workbook_set_theme_colors")
+        finally:
+            LIB.free(ptr)
+
+    def set_theme_fonts(self, fonts: ThemeFonts) -> None:
+        """Replace the theme's major and minor typefaces."""
+        h = self._require()
+        ptr = S.alloc_struct(LIB, S.THEME_FONTS)
+        owned: List[int] = []
+        try:
+            for fname in ("major_latin", "major_east_asian", "minor_latin", "minor_east_asian"):
+                S.write_str_field(LIB, ptr, S.THEME_FONTS, fname, getattr(fonts, fname), owned, allow_empty=True)
+            _check(LIB.fm_workbook_set_theme_fonts(h, ptr), "fm_workbook_set_theme_fonts")
+        finally:
+            LIB.free(ptr)
+            for owned_ptr in owned:
+                LIB.free(owned_ptr)
+
+    def resolve_color(self, spec: ColorSpec, context: Union[ColorContext, int] = ColorContext.FONT) -> ResolvedColor:
+        """Resolve ``spec`` to the ``0xAARRGGBB`` Excel renders.
+
+        ``context`` decides what an automatic or absent colour means (black
+        for font and border, white for fills).
+        """
+        h = self._require()
+        spec_ptr = S.alloc_struct(LIB, S.COLOR_SPEC)
+        argb_ptr = _alloc_out_ptr()
+        res_ptr = _alloc_out_ptr()
+        try:
+            _pack_color(spec_ptr, spec)
             _check(
-                LIB.fm_styles_set_cell_style(h, name_ptr, _uint(xf_id, "xf_id"), _uint(builtin_id, "builtin_id")),
-                "fm_styles_set_cell_style",
+                LIB.fm_workbook_resolve_color(h, spec_ptr, _sint(context, "context"), argb_ptr, res_ptr),
+                "fm_workbook_resolve_color",
             )
+            return ResolvedColor(LIB.read_u32(argb_ptr), ColorResolution(LIB.read_i32(res_ptr)))
         finally:
-            LIB.free(name_ptr)
+            LIB.free(spec_ptr)
+            LIB.free(argb_ptr)
+            LIB.free(res_ptr)
+
+    def get_effective_style(self, sheet: int, row: int, col: int) -> EffectiveStyle:
+        """Read the effective style of the cell at ``(row, col)``; the cell need not exist."""
+        h = self._require()
+        ptr = S.alloc_struct(LIB, S.EFFECTIVE_STYLE)
+        try:
+            _check(
+                LIB.fm_sheet_get_effective_style(
+                    h, _uint(sheet, "sheet_index"), _uint(row, "row"), _uint(col, "col"), ptr
+                ),
+                "fm_sheet_get_effective_style",
+            )
+            d = S.EFFECTIVE_STYLE.unpack(LIB, ptr)
+            offsets = S.EFFECTIVE_STYLE.offsets
+            border_argb = struct.unpack("<5I", LIB.read_bytes(ptr + offsets["border_argb"][1], 20))
+            border_res = struct.unpack("<5i", LIB.read_bytes(ptr + offsets["border_resolution"][1], 20))
+            return EffectiveStyle(
+                xf_index=d["xf_index"],
+                source=EffectiveStyleSource(d["source"]),
+                font_index=d["font_index"],
+                fill_index=d["fill_index"],
+                border_index=d["border_index"],
+                font=ResolvedColor(d["font_argb"], ColorResolution(d["font_resolution"])),
+                fill_foreground=ResolvedColor(d["fill_fg_argb"], ColorResolution(d["fill_fg_resolution"])),
+                fill_background=ResolvedColor(d["fill_bg_argb"], ColorResolution(d["fill_bg_resolution"])),
+                borders=[ResolvedColor(a, ColorResolution(r)) for a, r in zip(border_argb, border_res)],
+                locked=bool(d["locked"]),
+                hidden=bool(d["hidden"]),
+                num_fmt_code=LIB.read_cstr(d["num_fmt_code"]),
+            )
+        finally:
+            LIB.free(ptr)
 
     def get_cell_style(self, index: int) -> CellStyle:
         """Return the named cell style at ``index``."""
diff --git a/packages/python/pyproject.toml b/packages/python/pyproject.toml
index ad808f3d2..e64deb621 100644
--- a/packages/python/pyproject.toml
+++ b/packages/python/pyproject.toml
@@ -20,7 +20,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "formulon"
-version = "0.12.0"
+version = "0.13.0"
 description = "Excel 365 calculation engine -- Python binding"
 readme = "README.md"
 license = "Apache-2.0"
diff --git a/packages/python/tests/test_binding_contracts.py b/packages/python/tests/test_binding_contracts.py
index 261a9ecd6..cc42d444a 100644
--- a/packages/python/tests/test_binding_contracts.py
+++ b/packages/python/tests/test_binding_contracts.py
@@ -21,6 +21,7 @@
 import formulon
 from formulon import (
     CalcMode,
+    CellStyle,
     CellXf,
     ConditionalFormatInput,
     DifferentialFormat,
@@ -600,7 +601,7 @@ def test_named_cell_style_registration_reaches_the_reader(self) -> None:
         with Workbook.create_default() as wb:
             xf_id = wb.add_cell_style_xf(StyleAndCalcAccessorTests._xf())
             before = wb.cell_style_count()
-            wb.set_cell_style("MyStyle", xf_id)
+            wb.set_cell_style(CellStyle("MyStyle", xf_id))
             names = [wb.get_cell_style(i).name for i in range(wb.cell_style_count())]
         self.assertGreater(len(names), before)
         self.assertIn("MyStyle", names)
@@ -608,7 +609,7 @@ def test_named_cell_style_registration_reaches_the_reader(self) -> None:
     def test_named_cell_style_rejects_an_unregistered_xf_id(self) -> None:
         with Workbook.create_default() as wb:
             with self.assertRaises(FormulonError):
-                wb.set_cell_style("Bogus", 9999)
+                wb.set_cell_style(CellStyle("Bogus", 9999))
 
 
 class OneShotEvaluationTests(unittest.TestCase):
diff --git a/packages/python/tests/test_surface.py b/packages/python/tests/test_surface.py
deleted file mode 100644
index 0df64a0c6..000000000
--- a/packages/python/tests/test_surface.py
+++ /dev/null
@@ -1,2107 +0,0 @@
-"""Surface tests for the expanded Formulon Python Workbook API.
-
-These exercise a representative sample of every method group added on top
-of the load/edit/recalc/save core: pivots, conditional formats, styles,
-matrix edits, merges/comments/hyperlinks/validations, defined names,
-partial recalc, precedents/dependents, spill, function catalog, sheet
-view/protection, and external links.
-
-Run via ``make python-test`` (or ``python -m unittest`` with
-``PYTHONPATH=packages/python``). Uses stdlib ``unittest`` -- no pytest.
-"""
-
-from __future__ import annotations
-
-import inspect
-import io
-import json
-import struct
-import subprocess
-import unittest
-import zipfile
-from pathlib import Path
-from typing import Any, Dict, List, Tuple
-from unittest import mock
-
-import formulon
-from formulon import (
-    CalcMode,
-    CellXf,
-    CfColor,
-    CfValueObject,
-    CivilTime,
-    ColorScale,
-    ColorSpec,
-    ConditionalFormatInput,
-    DataBar,
-    DataValidationInput,
-    DifferentialFormat,
-    FillRecord,
-    FontRecord,
-    FormulonError,
-    IconSet,
-    MergeRange,
-    PivotAggregation,
-    PivotAxis,
-    PivotCalendar,
-    PivotDataFieldSpec,
-    PivotDateGrouping,
-    PivotFieldSpec,
-    PivotFilterSpec,
-    PivotFilterType,
-    PivotReportLayout,
-    PivotWorksheetSource,
-    ReadDiagnostics,
-    SaveDiagnostics,
-    SheetProtection,
-    SheetVisibility,
-    ValueKind,
-    Workbook,
-    WorkbookFormat,
-    _c,
-)
-from formulon import _structs as S
-
-
-def _append_empty_zip_entry(data: bytes, name: str) -> bytes:
-    """Add one deterministic, empty stored entry without recompressing XLSB."""
-    eocd = data.rfind(b"PK\x05\x06")
-    if eocd < 0:
-        raise AssertionError("missing ZIP end record")
-    _disk_count, count, central_size, central_offset = struct.unpack_from("<HHII", data, eocd + 8)
-    encoded_name = name.encode("utf-8")
-    local = struct.pack("<IHHHHHIIIHH", 0x04034B50, 20, 0, 0, 0, 0, 0, 0, 0, len(encoded_name), 0) + encoded_name
-    central = (
-        struct.pack(
-            "<IHHHHHHIIIHHHHHII",
-            0x02014B50,
-            20,
-            20,
-            0,
-            0,
-            0,
-            0,
-            0,
-            0,
-            0,
-            len(encoded_name),
-            0,
-            0,
-            0,
-            0,
-            0,
-            central_offset,
-        )
-        + encoded_name
-    )
-    new_eocd = struct.pack(
-        "<IHHHHIIH",
-        0x06054B50,
-        0,
-        0,
-        count + 1,
-        count + 1,
-        central_size + len(central),
-        central_offset + len(local),
-        0,
-    )
-    return data[:central_offset] + local + data[central_offset : central_offset + central_size] + central + new_eocd
-
-
-class StructLayoutTests(unittest.TestCase):
-    """Guards against silent field-reorder breakage in _structs.py."""
-
-    # One pinned wasm32 size per `Struct` in `_structs.py`. The values are
-    # deliberately literal rather than derived -- a derived table would agree
-    # with any layout and assert nothing. What binds them to the C header is
-    # `python-struct-layouts` below; this table's job is to make a silent
-    # *size* change loud, and `test_every_struct_has_a_pinned_size` is what
-    # stops a new struct from opting out by simply not being listed.
-    EXPECTED_SIZES = {
-        "MERGE_RANGE": 16,
-        "HYPERLINK": 32,
-        "COMMENT": 16,
-        "DATA_VALIDATION": 52,
-        "SHEET_PROTECTION": 88,
-        "VIEWPORT": 20,
-        "CELL_NODE": 12,
-        "PHONETIC_RUN": 12,
-        "CFVO": 12,
-        "CF_CELL_RANGE": 16,
-        "CF_COLOR": 4,
-        "CF_MATCH": 72,
-        "CF_RULE": 240,
-        "PIVOT_CELL": 40,
-        "PIVOT_FIELD_SPEC": 20,
-        "PIVOT_DATA_FIELD_SPEC": 28,
-        "PIVOT_FILTER_SPEC": 64,
-        "READ_DIAGNOSTICS": 20,
-        "SAVE_DIAGNOSTICS": 20,
-        "SPILL_INFO": 20,
-        "FUNCTION_METADATA": 24,
-        "CIVIL_TIME": 24,
-        "SHEET_VIEW": 44,
-        "COLUMN_LAYOUT": 40,
-        "ROW_LAYOUT": 32,
-        "CELL_XF": 88,
-        "COLOR_SPEC": 24,
-        "FONT_RECORD": 88,
-        "FILL_RECORD": 64,
-        "BORDER_SIDE": 32,
-        "BORDER_RECORD": 168,
-        "DXF_RECORD": 368,
-        # Fifteen pointer-or-`size_t` fields; both are four bytes on
-        # wasm32, so the whole record is 15 x 4.
-        "STYLES_BATCH": 60,
-        "CELL_STYLE_RECORD": 24,
-        "EXTERNAL_LINK_RECORD": 24,
-        "PAGE_BREAK": 16,
-        "PAGE_SETUP": 48,
-        # Six `double`s, each preceded by an `int32` flag: the flag's four
-        # bytes of tail padding are what makes this 96 rather than 72.
-        "PAGE_MARGINS": 96,
-        "PRINT_OPTIONS": 32,
-        "HEADER_FOOTER": 56,
-    }
-
-    def test_struct_sizes(self) -> None:
-        for name, expected in self.EXPECTED_SIZES.items():
-            layout = getattr(S, name)
-            self.assertEqual(layout.size, expected, f"{name} size drifted to {layout.size}")
-
-    def test_every_struct_has_a_pinned_size(self) -> None:
-        """No `Struct` may be absent from ``EXPECTED_SIZES``.
-
-        Without this the table degrades quietly: a struct added to
-        ``_structs.py`` and never listed here is not size-pinned, and nothing
-        says so. Both directions are checked so a removed struct cannot leave
-        a stale entry behind either.
-        """
-        declared = {name for name, value in vars(S).items() if isinstance(value, S.Struct)}
-        pinned = set(self.EXPECTED_SIZES)
-        self.assertEqual(
-            declared,
-            pinned,
-            f"not size-pinned: {sorted(declared - pinned)}; stale entries: {sorted(pinned - declared)}",
-        )
-
-    def test_pivot_cell_value_offset(self) -> None:
-        self.assertEqual(S.PIVOT_CELL_VALUE_OFFSET, 8)
-
-    # Records the wrapper marshals without a `Struct` entry, so they are
-    # invisible to `EXPECTED_SIZES` above. `fm_value_t` is passed around as
-    # the bare `fm_value_t_size` and as `VALUE_BLOB` when it sits inline in a
-    # larger record; `fm_print_range_t` is the literal 16 in
-    # `Workbook.paginate`. `python-inline-structs` binds these to the C
-    # header; pinning them here makes a size change loud on its own.
-    def test_hand_marshalled_record_sizes(self) -> None:
-        self.assertEqual(_c.fm_value_t_size, 16)
-        self.assertEqual(S.VALUE_BLOB, ("blob16", 16, 8))
-        source = inspect.getsource(Workbook.paginate)
-        self.assertIn('struct.unpack("<IIII", LIB.read_bytes(range_ptr, 16))', source)
-
-    def test_layouts_match_c_header(self) -> None:
-        """Every binding-drift check that reads the Python package.
-
-        Run as a group: the struct-layout check covers the `Struct` table,
-        the call-signature check covers what the wrapper passes to each
-        `fm_*` entry point, and the inline-struct check covers the records
-        decoded with a bare `struct.unpack`. A failure in any of them is a
-        Python-side ABI mismatch and belongs in this suite's result.
-        """
-        root = Path(__file__).resolve().parents[3]
-        for check in ("python-struct-layouts", "python-call-signatures", "python-inline-structs"):
-            with self.subTest(check=check):
-                result = subprocess.run(
-                    ["python3", str(root / "tools" / "dev" / "check_binding_drift.py"), check],
-                    cwd=root,
-                    text=True,
-                    capture_output=True,
-                    check=False,
-                )
-                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-
-
-class SheetStructureTests(unittest.TestCase):
-    def test_add_rename_remove_move_sheet(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.add_sheet("Second")
-            wb.add_sheet("Third")
-            self.assertEqual(wb.sheet_count(), 3)
-            wb.rename_sheet(1, "Renamed")
-            self.assertEqual(wb.sheet_name(1), "Renamed")
-            wb.move_sheet(2, 0)
-            self.assertEqual(wb.sheet_name(0), "Third")
-            wb.remove_sheet(0)
-            self.assertEqual(wb.sheet_count(), 2)
-
-
-class MatrixEditTests(unittest.TestCase):
-    def test_insert_row_shifts_value_down(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_number(0, 0, 0, 11.0)  # A1
-            wb.insert_rows(0, 0, 1)
-            wb.recalc()
-            # A1 is now blank; the value moved to A2.
-            self.assertEqual(wb.get_value(0, 0, 0).kind, ValueKind.BLANK)
-            self.assertEqual(wb.get_value(0, 1, 0).to_python(), 11.0)
-
-    def test_delete_col_shifts_value_left(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_number(0, 0, 0, 1.0)  # A1
-            wb.set_number(0, 0, 1, 2.0)  # B1
-            wb.delete_cols(0, 0, 1)
-            wb.recalc()
-            # The old B1 collapses into A1.
-            self.assertEqual(wb.get_value(0, 0, 0).to_python(), 2.0)
-
-
-class AdHocArrayEvalTests(unittest.TestCase):
-    def test_sequence_matrix_preserves_all_cells(self) -> None:
-        with Workbook.create_default() as wb:
-            grid = wb.evaluate_formula_array(0, 0, 0, "=SEQUENCE(2,3)")
-            self.assertEqual(len(grid), 2)
-            self.assertEqual(len(grid[0]), 3)
-            # Row-major 1..6.
-            self.assertEqual(grid[0][0].to_python(), 1.0)
-            self.assertEqual(grid[1][2].to_python(), 6.0)
-
-    def test_scalar_reported_as_one_by_one(self) -> None:
-        with Workbook.create_default() as wb:
-            grid = wb.evaluate_formula_array(0, 0, 0, "=1+2")
-            self.assertEqual(len(grid), 1)
-            self.assertEqual(len(grid[0]), 1)
-            self.assertEqual(grid[0][0].kind, ValueKind.NUMBER)
-            self.assertEqual(grid[0][0].to_python(), 3.0)
-
-
-class DefinedNameTests(unittest.TestCase):
-    def test_defined_name_set_get_remove(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_defined_name("MyRef", "Sheet1!$A$1")
-            names = {dn.name: dn.formula for dn in wb.iter_defined_names()}
-            self.assertIn("MyRef", names)
-            self.assertEqual(names["MyRef"], "Sheet1!$A$1")
-
-            # Updating in place replaces the formula text.
-            wb.set_defined_name("MyRef", "Sheet1!$B$2")
-            names = {dn.name: dn.formula for dn in wb.iter_defined_names()}
-            self.assertEqual(names["MyRef"], "Sheet1!$B$2")
-
-            # An empty formula removes the entry.
-            wb.set_defined_name("MyRef", "")
-            self.assertNotIn("MyRef", {dn.name for dn in wb.iter_defined_names()})
-
-    def test_scoped_defined_name_set_get_remove(self) -> None:
-        with Workbook.create_empty() as wb:
-            wb.add_sheet("Sheet1")
-            wb.add_sheet("Sheet2")
-            wb.set_defined_name("Rate", "=1")
-            wb.set_defined_name_scoped("Rate", "=2", 1)
-            names = {(dn.name, dn.local_sheet_id): dn.formula for dn in wb.iter_defined_names()}
-            self.assertEqual(names[("Rate", -1)], "=1")
-            self.assertEqual(names[("Rate", 1)], "=2")
-
-            wb.set_defined_name_scoped("Rate", "", 1)
-            self.assertNotIn(
-                ("Rate", 1),
-                {(dn.name, dn.local_sheet_id) for dn in wb.iter_defined_names()},
-            )
-
-
-class CalcPolicyTests(unittest.TestCase):
-    def test_calc_mode_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            self.assertEqual(wb.calc_mode(), CalcMode.AUTO)
-            wb.set_calc_mode(CalcMode.MANUAL)
-            self.assertEqual(wb.calc_mode(), CalcMode.MANUAL)
-
-    def test_pinned_now_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            # Unpinned by default: the workbook follows the host clock.
-            self.assertIsNone(wb.pinned_now())
-            wb.set_pinned_now(2026, 4, 23, 15, 30, 45)
-            self.assertEqual(wb.pinned_now(), CivilTime(2026, 4, 23, 15, 30, 45))
-            # 2026-04-23 is serial 46135 under the 1900 date system.
-            grid = wb.evaluate_formula_array(0, 0, 0, "=TODAY()")
-            self.assertEqual(grid[0][0].number, 46135.0)
-            wb.clear_pinned_now()
-            self.assertIsNone(wb.pinned_now())
-
-    def test_pinned_now_rejects_a_non_calendar_instant(self) -> None:
-        with Workbook.create_default() as wb:
-            # The pin is a calendar instant, not a normalising constructor.
-            with self.assertRaises(FormulonError):
-                wb.set_pinned_now(2026, 13, 1)
-            with self.assertRaises(FormulonError):
-                wb.set_pinned_now(2025, 2, 29)
-            self.assertIsNone(wb.pinned_now())
-
-    def test_excel_profile_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            self.assertTrue(wb.excel_profile_id())
-            wb.set_excel_profile_id("mac-365-ja_JP")
-            self.assertEqual(wb.excel_profile_id(), "mac-365-ja_JP")
-
-
-class PartialRecalcTests(unittest.TestCase):
-    def test_partial_recalc_recomputes_chain(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_number(0, 0, 0, 10.0)  # A1
-            wb.set_formula(0, 0, 1, "=A1*2")  # B1
-            recomputed = wb.partial_recalc(0, 0, 0, 1, 1)
-            self.assertGreater(recomputed, 0)
-            self.assertEqual(wb.get_value(0, 0, 1).to_python(), 20.0)
-
-
-class TraceTests(unittest.TestCase):
-    def test_precedents_and_dependents(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_number(0, 0, 0, 1.0)  # A1
-            wb.set_formula(0, 0, 1, "=A1")  # B1
-            wb.recalc()
-            prec = wb.precedents(0, 0, 1, 1)
-            self.assertIn((0, 0, 0), [(p.sheet, p.row, p.col) for p in prec])
-            deps = wb.dependents(0, 0, 0, 1)
-            self.assertIn((0, 0, 1), [(d.sheet, d.row, d.col) for d in deps])
-
-
-class SpillTests(unittest.TestCase):
-    def test_sequence_spills(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_formula(0, 0, 0, "=SEQUENCE(3)")
-            wb.recalc()
-            info = wb.spill_info(0, 0, 0)
-            self.assertTrue(info.engaged)
-            self.assertEqual(info.rows, 3)
-            self.assertEqual((info.anchor_row, info.anchor_col), (0, 0))
-
-
-class MergeCommentHyperlinkTests(unittest.TestCase):
-    def test_merge_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.add_merge(0, MergeRange(0, 0, 1, 1))
-            merges = wb.get_merges(0)
-            self.assertEqual(len(merges), 1)
-            self.assertEqual((merges[0].first_row, merges[0].last_col), (0, 1))
-            wb.clear_merges(0)
-            self.assertEqual(wb.get_merges(0), [])
-
-    def test_comment_roundtrip_and_absent(self) -> None:
-        with Workbook.create_default() as wb:
-            self.assertIsNone(wb.get_comment(0, 0, 0))
-            wb.set_comment(0, 0, 0, "alice", "see note")
-            c = wb.get_comment(0, 0, 0)
-            self.assertIsNotNone(c)
-            self.assertEqual(c.author, "alice")
-            self.assertEqual(c.text, "see note")
-
-    def test_comment_invalid_sheet_raises_instead_of_looking_absent(self) -> None:
-        with Workbook.create_default() as wb:
-            with self.assertRaises(formulon.FormulonError) as ctx:
-                wb.get_comment(99, 0, 0)
-            self.assertEqual(ctx.exception.status, 2)  # kInvalidArgument
-
-    def test_hyperlink_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.add_hyperlink(0, 2, 3, "https://example.com", "Example", "tip")
-            links = wb.get_hyperlinks(0)
-            self.assertEqual(len(links), 1)
-            self.assertEqual((links[0].row, links[0].col), (2, 3))
-            self.assertEqual((links[0].last_row, links[0].last_col), (2, 3))
-            self.assertEqual(links[0].target, "https://example.com")
-            self.assertEqual(links[0].display, "Example")
-
-    def test_hyperlink_range_roundtrip_at_nonzero_coordinate(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.add_hyperlink_range(0, 4, 6, 7, 9, "https://example.com", "Range", "tip")
-            links = wb.get_hyperlinks(0)
-            self.assertEqual(len(links), 1)
-            self.assertEqual((links[0].row, links[0].col), (4, 6))
-            self.assertEqual((links[0].last_row, links[0].last_col), (7, 9))
-
-
-class ValidationTests(unittest.TestCase):
-    def test_list_validation_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.add_validation(
-                0,
-                DataValidationInput(
-                    type=3,  # list
-                    ranges=[MergeRange(0, 0, 4, 0)],
-                    allow_blank=True,
-                    formula1='"a,b,c"',
-                ),
-            )
-            self.assertEqual(wb.validation_count(0), 1)
-            dv = wb.get_validation_at(0, 0)
-            self.assertEqual(dv.type, 3)
-            self.assertTrue(dv.allow_blank)
-            self.assertEqual(dv.formula1, '"a,b,c"')
-            self.assertEqual(len(dv.ranges), 1)
-            wb.clear_validations(0)
-            self.assertEqual(wb.validation_count(0), 0)
-
-
-class SheetViewProtectionTests(unittest.TestCase):
-    def test_view_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_sheet_zoom(0, 150)
-            wb.set_sheet_freeze(0, 1, 2)
-            view = wb.get_sheet_view(0)
-            self.assertEqual(view.zoom_scale, 150)
-            self.assertEqual((view.freeze_rows, view.freeze_cols), (1, 2))
-
-    def test_view_display_defaults(self) -> None:
-        with Workbook.create_default() as wb:
-            view = wb.get_sheet_view(0)
-            self.assertTrue(view.show_grid_lines)
-            self.assertTrue(view.show_row_col_headers)
-            self.assertTrue(view.show_zeros)
-            self.assertFalse(view.right_to_left)
-            self.assertFalse(view.tab_selected)
-            self.assertEqual(view.view_mode, "")
-
-    def test_view_display_setters_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_sheet_show_grid_lines(0, False)
-            wb.set_sheet_show_row_col_headers(0, False)
-            wb.set_sheet_show_zeros(0, False)
-            wb.set_sheet_right_to_left(0, True)
-            wb.set_sheet_tab_selected(0, True)
-            wb.set_sheet_view_mode(0, "pageBreakPreview")
-            view = wb.get_sheet_view(0)
-            self.assertFalse(view.show_grid_lines)
-            self.assertFalse(view.show_row_col_headers)
-            self.assertFalse(view.show_zeros)
-            self.assertTrue(view.right_to_left)
-            self.assertTrue(view.tab_selected)
-            self.assertEqual(view.view_mode, "pageBreakPreview")
-            # An empty mode is a meaningful value (the OOXML-default
-            # "normal" view), not a no-op -- it must round-trip too.
-            wb.set_sheet_view_mode(0, "")
-            self.assertEqual(wb.get_sheet_view(0).view_mode, "")
-
-    def test_visibility_states_very_hidden(self) -> None:
-        with Workbook.create_default() as wb:
-            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.VISIBLE)
-            self.assertFalse(wb.get_sheet_view(0).tab_hidden)
-
-            wb.set_sheet_visibility(0, SheetVisibility.VERY_HIDDEN)
-            view = wb.get_sheet_view(0)
-            self.assertEqual(view.visibility, SheetVisibility.VERY_HIDDEN)
-            # The two-state view stays consistent: a very-hidden sheet is
-            # hidden to code that reads only the bool, never visible.
-            self.assertTrue(view.tab_hidden)
-
-            # "Hidden" says nothing a very-hidden sheet does not already
-            # satisfy, so it must not weaken the author's stronger choice.
-            wb.set_sheet_tab_hidden(0, True)
-            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.VERY_HIDDEN)
-
-            # Demotion is the other direction the bool cannot express.
-            wb.set_sheet_visibility(0, SheetVisibility.HIDDEN)
-            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.HIDDEN)
-
-            wb.set_sheet_tab_hidden(0, False)
-            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.VISIBLE)
-
-    def test_visibility_rejects_unknown_state(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_sheet_visibility(0, SheetVisibility.VERY_HIDDEN)
-            with self.assertRaises(FormulonError):
-                wb.set_sheet_visibility(0, 3)
-            # A refused call leaves the sheet as it was.
-            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.VERY_HIDDEN)
-
-    def test_column_row_overrides(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_column_width(0, 0, 2, 18.5)
-            cols = wb.get_sheet_columns(0)
-            explicit = next(c for c in cols if abs(c.width - 18.5) < 1e-9)
-            self.assertTrue(explicit.has_width)
-            self.assertFalse(explicit.has_style)
-            wb.set_column_width(0, 4, 4, 0.0)
-            zero = next(c for c in wb.get_sheet_columns(0) if c.first == 4 and c.last == 4)
-            self.assertEqual(zero.width, 0.0)
-            self.assertTrue(zero.has_width)
-            wb.set_row_height(0, 0, 30.0)
-            rows = wb.get_sheet_row_overrides(0)
-            explicit_row = next(r for r in rows if abs(r.height - 30.0) < 1e-9)
-            self.assertFalse(explicit_row.has_style)
-            self.assertEqual(explicit_row.style_xf, 0)
-
-    def test_protection_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            prot = SheetProtection(enabled=True, sheet=True, format_cells=True)
-            wb.set_sheet_protection(0, prot)
-            got = wb.get_sheet_protection(0)
-            self.assertTrue(got.enabled)
-            self.assertTrue(got.sheet)
-            self.assertTrue(got.format_cells)
-
-
-class PrintSettingsTests(unittest.TestCase):
-    def test_raw_xml_roundtrip_and_removal(self) -> None:
-        with Workbook.create_default() as wb:
-            # An absent element reads back as "" rather than raising.
-            self.assertEqual(wb.get_page_setup_xml(0), "")
-            fragment = '<pageSetup paperSize="9" orientation="portrait" scale="85"/>'
-            wb.set_page_setup_xml(0, fragment)
-            self.assertEqual(wb.get_page_setup_xml(0), fragment)
-
-            setup = wb.get_page_setup(0)
-            self.assertEqual(setup.paper_size, 9)
-            self.assertEqual(setup.scale, 85)
-            self.assertTrue(setup.scale_stated)
-
-            # Empty removes the element and restores the defaults.
-            wb.set_page_setup_xml(0, "")
-            self.assertEqual(wb.get_page_setup_xml(0), "")
-            cleared = wb.get_page_setup(0)
-            self.assertEqual(cleared.scale, 100)
-            self.assertFalse(cleared.scale_stated)
-
-    def test_malformed_fragment_is_rejected_at_set_time(self) -> None:
-        with Workbook.create_default() as wb:
-            for bad in ("<pageSetup/><pageSetup/>", '<pageMargins left="1"/>', '<pageSetup orientation="p"'):
-                with self.assertRaises(FormulonError, msg=bad):
-                    wb.set_page_setup_xml(0, bad)
-            self.assertEqual(wb.get_page_setup_xml(0), "")
-
-    def test_fit_to_page_keeps_the_rest_of_sheet_pr(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_sheet_pr_xml(0, '<sheetPr codeName="Sheet1"><tabColor rgb="FFFF0000"/></sheetPr>')
-            wb.set_fit_to_page(0, True)
-            xml = wb.get_sheet_pr_xml(0)
-            # A VBA binding and a tab colour are not print settings, and
-            # toggling fit-to-page must not be how they get lost.
-            self.assertIn('codeName="Sheet1"', xml)
-            self.assertIn('<tabColor rgb="FFFF0000"/>', xml)
-            self.assertIn('fitToPage="true"', xml)
-            self.assertTrue(wb.get_page_setup(0).fit_to_page)
-
-    def test_typed_patch_preserves_unmodelled_attributes(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_page_setup_xml(0, '<pageSetup paperSize="9" orientation="portrait" horizontalDpi="600" copies="3"/>')
-            wb.set_page_setup(0, orientation=2)
-            xml = wb.get_page_setup_xml(0)
-            self.assertIn('orientation="landscape"', xml)
-            self.assertIn('horizontalDpi="600"', xml)
-            self.assertIn('copies="3"', xml)
-            self.assertIn('paperSize="9"', xml)
-
-    def test_scale_outside_excels_range_is_rejected(self) -> None:
-        with Workbook.create_default() as wb:
-            # Rejected rather than clamped: a mis-stated print scale lands
-            # on paper, unlike the on-screen zoom.
-            with self.assertRaises(FormulonError):
-                wb.set_page_setup(0, scale=9)
-            with self.assertRaises(FormulonError):
-                wb.set_page_setup(0, scale=401)
-            wb.set_page_setup(0, scale=400)
-            self.assertEqual(wb.get_page_setup(0).scale, 400)
-
-    def test_margins_patch_reports_presence_separately(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_page_margins(0, left=0.25, top=1.5)
-            margins = wb.get_page_margins(0)
-            self.assertAlmostEqual(margins.left, 0.25)
-            self.assertAlmostEqual(margins.top, 1.5)
-            self.assertTrue(margins.left_stated)
-            # An unstated margin still reports its effective default, with
-            # the flag clear so the caller can tell the two apart.
-            self.assertAlmostEqual(margins.right, 0.7)
-            self.assertFalse(margins.right_stated)
-
-    def test_negative_margin_is_rejected(self) -> None:
-        with Workbook.create_default() as wb:
-            with self.assertRaises(FormulonError):
-                wb.set_page_margins(0, bottom=-1.0)
-
-    def test_header_footer_sections_take_decoded_text(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_header_footer(0, odd_header="&C\u5e33\u7968", odd_footer="&R&P / &N")
-            # `&` introduces Excel's codes but lives in XML element text, so
-            # it reaches the file escaped and decodes back to `&C...`.
-            self.assertEqual(
-                wb.get_header_footer_xml(0),
-                "<headerFooter><oddHeader>&amp;C\u5e33\u7968</oddHeader>"
-                "<oddFooter>&amp;R&amp;P / &amp;N</oddFooter></headerFooter>",
-            )
-            # Omitting a section leaves it; "" clears it.
-            wb.set_header_footer(0, odd_footer="")
-            self.assertEqual(
-                wb.get_header_footer_xml(0),
-                "<headerFooter><oddHeader>&amp;C\u5e33\u7968</oddHeader></headerFooter>",
-            )
-
-    def test_print_options_patch(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_print_options(0, grid_lines=True, horizontal_centered=True)
-            self.assertEqual(
-                wb.get_print_options_xml(0),
-                '<printOptions gridLines="true" horizontalCentered="true"/>',
-            )
-
-    def test_print_area_and_titles(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_print_area(0, "A1:F8")
-            self.assertEqual(wb.get_print_area(0), "A1:F8")
-            with self.assertRaises(FormulonError):
-                wb.set_print_area(0, "not-a-range")
-            self.assertEqual(wb.get_print_area(0), "A1:F8")
-            wb.set_print_area(0, "")
-            self.assertEqual(wb.get_print_area(0), "")
-
-            wb.set_print_titles(0, "1:2", "A:A")
-            self.assertEqual(wb.get_print_titles(0), ("1:2", "A:A"))
-            wb.set_print_titles(0)
-            self.assertEqual(wb.get_print_titles(0), ("", ""))
-
-    def test_manual_breaks(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.add_row_break(0, 40)
-            wb.add_row_break(0, 10)
-            wb.add_col_break(0, 5)
-            rows = wb.get_row_breaks(0)
-            # Kept sorted by index regardless of insertion order.
-            self.assertEqual([b.id for b in rows], [10, 40])
-            self.assertEqual(rows[0].max, 16383)
-            self.assertTrue(rows[0].manual)
-            self.assertEqual(wb.get_col_breaks(0)[0].max, 1048575)
-
-            # Re-adding an existing index replaces rather than duplicates.
-            wb.add_row_break(0, 10, manual=False)
-            rows = wb.get_row_breaks(0)
-            self.assertEqual(len(rows), 2)
-            self.assertFalse(rows[0].manual)
-
-            # Removing an absent break is not an error.
-            wb.remove_row_break(0, 999)
-            wb.clear_breaks(0)
-            self.assertEqual(wb.get_row_breaks(0), [])
-            self.assertEqual(wb.get_col_breaks(0), [])
-
-    def test_settings_reach_paginate_without_a_save_cycle(self) -> None:
-        with Workbook.create_default() as wb:
-            for row in range(200):
-                for col in range(20):
-                    wb.set_number(0, row, col, 1.0)
-            portrait = wb.paginate(0).page_count
-            wb.set_page_setup(0, orientation=2)
-            self.assertNotEqual(wb.paginate(0).page_count, portrait)
-
-    def test_authored_report_survives_save_and_load(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_text(0, 0, 0, "\u58f2\u4e0a")
-            wb.set_page_setup(0, paper_size=9, orientation=1, fit_to_page=True, fit_to_width=1, fit_to_height=0)
-            wb.set_page_margins(0, left=0.5, right=0.5, top=0.8, bottom=0.8)
-            wb.set_header_footer(0, odd_header="&C\u6708\u6b21\u5831\u544a")
-            wb.set_print_area(0, "A1:F80")
-            wb.set_print_titles(0, "1:2")
-            wb.add_row_break(0, 39)
-            data = wb.save()
-
-        with Workbook.load(data) as reloaded:
-            setup = reloaded.get_page_setup(0)
-            self.assertEqual(setup.paper_size, 9)
-            self.assertEqual(setup.orientation, 1)
-            self.assertTrue(setup.fit_to_page)
-            self.assertEqual(setup.fit_to_height, 0)
-            self.assertAlmostEqual(reloaded.get_page_margins(0).left, 0.5)
-            self.assertEqual(reloaded.get_print_area(0), "A1:F80")
-            self.assertEqual(reloaded.get_print_titles(0), ("1:2", ""))
-            self.assertEqual([b.id for b in reloaded.get_row_breaks(0)], [39])
-
-    def test_set_range_xf_index_materialises_the_rectangle(self) -> None:
-        with Workbook.create_default() as wb:
-            # Something other than the seeded default xf, so the range
-            # write is observable rather than deduping to index 0.
-            xf = wb.add_cell_xf(
-                CellXf(
-                    font_index=0,
-                    fill_index=0,
-                    border_index=0,
-                    num_fmt_id=0,
-                    horizontal_align=0,
-                    vertical_align=2,
-                    wrap_text=True,
-                    has_wrap_text=True,
-                )
-            )
-            wb.set_range_xf_index(0, 0, 0, 2, 2, xf)
-            for row, col in ((0, 0), (1, 1), (2, 2)):
-                self.assertEqual(wb.get_cell_xf_index(0, row, col), xf)
-            self.assertEqual(wb.get_cell_xf_index(0, 3, 3), 0)
-
-
-class StyleTests(unittest.TestCase):
-    def test_font_numfmt_xf_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            fi = wb.add_font(FontRecord(name="Calibri", size=12.0, bold=True))
-            self.assertGreaterEqual(fi, 0)
-            font = wb.get_font(fi)
-            self.assertEqual(font.name, "Calibri")
-            self.assertTrue(font.bold)
-
-            fill = wb.add_fill(FillRecord(pattern=1, fg_argb=0xFFFF0000))
-            nf = wb.add_num_fmt("0.00")
-            self.assertGreater(nf, 0)
-            self.assertEqual(wb.get_num_fmt(nf), "0.00")
-
-            # add_cell_xf validates indices against the parallel tables, so a
-            # border must exist before it can be referenced.
-            border = wb.add_border({"left": {"style": 1, "color_argb": 0xFF000000}})
-
-            from formulon import CellXf
-
-            xf = wb.add_cell_xf(
-                CellXf(
-                    font_index=fi,
-                    fill_index=fill,
-                    border_index=border,
-                    num_fmt_id=nf,
-                    horizontal_align=0,
-                    vertical_align=0,
-                    wrap_text=False,
-                    text_rotation=255,
-                    indent=0,
-                    relative_indent=-3,
-                    shrink_to_fit=False,
-                    reading_order=0,
-                    justify_last_line=True,
-                )
-            )
-            wb.set_cell_xf_index(0, 0, 0, xf)
-            self.assertEqual(wb.get_cell_xf_index(0, 0, 0), xf)
-            resolved = wb.get_cell_xf(xf)
-            self.assertEqual(resolved.font_index, fi)
-            self.assertEqual(resolved.num_fmt_id, nf)
-            self.assertEqual(resolved.text_rotation, 255)
-            self.assertTrue(resolved.has_alignment)
-            self.assertEqual(resolved.indent, 0)
-            self.assertEqual(resolved.relative_indent, -3)
-            self.assertIs(resolved.shrink_to_fit, False)
-            self.assertEqual(resolved.reading_order, 0)
-            self.assertIs(resolved.justify_last_line, True)
-            self.assertFalse(resolved.has_horizontal_align)
-            self.assertTrue(resolved.has_vertical_align)
-            self.assertFalse(resolved.has_wrap_text)
-            self.assertTrue(resolved.has_justify_last_line)
-            self.assertEqual(wb.add_cell_xf(resolved), xf)
-
-            omitted = wb.add_cell_xf(
-                CellXf(
-                    font_index=fi,
-                    fill_index=fill,
-                    border_index=border,
-                    num_fmt_id=nf,
-                    horizontal_align=0,
-                    vertical_align=2,
-                    wrap_text=False,
-                )
-            )
-            self.assertFalse(wb.get_cell_xf(omitted).has_alignment)
-
-            explicit_empty = wb.add_cell_xf(
-                CellXf(
-                    font_index=fi,
-                    fill_index=fill,
-                    border_index=border,
-                    num_fmt_id=nf,
-                    horizontal_align=0,
-                    vertical_align=2,
-                    wrap_text=False,
-                    has_alignment=True,
-                )
-            )
-            self.assertNotEqual(explicit_empty, omitted)
-            self.assertTrue(wb.get_cell_xf(explicit_empty).has_alignment)
-
-    def test_font_vert_align_roundtrip_is_the_identity(self) -> None:
-        with Workbook.create_default() as wb:
-            index = wb.add_font(FontRecord(name="Arial", size=12.0, vert_align=1, color_argb=0xFF112233))
-            self.assertEqual(wb.get_font(index).vert_align, 1)
-
-            before = wb.font_count()
-            self.assertEqual(wb.add_font(wb.get_font(index)), index)
-            self.assertEqual(wb.font_count(), before)
-
-    def test_font_one_field_rewrite_preserves_the_superscript(self) -> None:
-        with Workbook.create_default() as wb:
-            index = wb.add_font(FontRecord(name="Arial", size=12.0, vert_align=1, color_argb=0xFF112233))
-            edited = wb.get_font(index)
-            edited.color_argb = 0xFF00FF00
-            recolored = wb.add_font(edited)
-            self.assertNotEqual(recolored, index)
-            reread = wb.get_font(recolored)
-            self.assertEqual(reread.vert_align, 1)
-            self.assertEqual(reread.color_argb, 0xFF00FF00)
-
-    def test_dxf_font_vert_align_roundtrip_is_the_identity(self) -> None:
-        with Workbook.create_default() as wb:
-            index = wb.add_dxf(DifferentialFormat(font=FontRecord(name="Calibri", size=9.0, vert_align=1)))
-            got = wb.get_dxf(index)
-            self.assertIsNotNone(got.font)
-            self.assertEqual(got.font.vert_align, 1)
-
-            before = wb.dxf_count()
-            self.assertEqual(wb.add_dxf(got), index)
-            self.assertEqual(wb.dxf_count(), before)
-
-    def test_dxf_roundtrip_and_dedup(self) -> None:
-        with Workbook.create_default() as wb:
-            record = DifferentialFormat(
-                font=FontRecord(name="Arial", size=12.0, bold=True, color_argb=0xFFFF0000),
-                fill=FillRecord(pattern=1, fg_argb=0xFFFFFF00),
-                num_fmt_id=164,
-                num_fmt_code="0.00",
-            )
-            index = wb.add_dxf(record)
-            self.assertEqual(wb.add_dxf(record), index)
-            self.assertEqual(wb.dxf_count(), 1)
-            got = wb.get_dxf(index)
-            self.assertIsNotNone(got.font)
-            self.assertEqual(got.font.name, "Arial")
-            self.assertTrue(got.font.bold)
-            self.assertIsNotNone(got.fill)
-            self.assertEqual(got.fill.fg_argb, 0xFFFFFF00)
-            self.assertEqual(got.num_fmt_id, 164)
-            self.assertEqual(got.num_fmt_code, "0.00")
-
-    def test_dxf_alignment_and_protection_xml_survive_get_add_and_save_load(self) -> None:
-        alignment_xml = '<alignment horizontal="center" wrapText="1"/>'
-        protection_xml = '<protection locked="0" hidden="1"/>'
-        with Workbook.create_default() as wb:
-            alignment_index = wb.add_dxf(DifferentialFormat(alignment_xml=alignment_xml))
-            protection_index = wb.add_dxf(DifferentialFormat(protection_xml=protection_xml))
-            self.assertNotEqual(alignment_index, protection_index)
-
-            got_alignment = wb.get_dxf(alignment_index)
-            self.assertEqual(got_alignment.alignment_xml, alignment_xml)
-            self.assertEqual(got_alignment.protection_xml, "")
-            got_protection = wb.get_dxf(protection_index)
-            self.assertEqual(got_protection.alignment_xml, "")
-            self.assertEqual(got_protection.protection_xml, protection_xml)
-            self.assertEqual(wb.add_dxf(got_alignment), alignment_index)
-            self.assertEqual(wb.add_dxf(got_protection), protection_index)
-
-            with Workbook.load(wb.save()) as reloaded:
-                reloaded_alignment = reloaded.get_dxf(alignment_index)
-                reloaded_protection = reloaded.get_dxf(protection_index)
-                self.assertEqual(reloaded_alignment.alignment_xml, alignment_xml)
-                self.assertEqual(reloaded_alignment.protection_xml, "")
-                self.assertEqual(reloaded_protection.alignment_xml, "")
-                self.assertEqual(reloaded_protection.protection_xml, protection_xml)
-                self.assertEqual(reloaded.add_dxf(reloaded_alignment), alignment_index)
-                self.assertEqual(reloaded.add_dxf(reloaded_protection), protection_index)
-
-    def test_selector_colours_survive_get_add_identity_and_save_load(self) -> None:
-        theme = ColorSpec(kind=2, theme=3, tint=0.5)
-        indexed = ColorSpec(kind=3, indexed=9)
-        automatic = ColorSpec(kind=4)
-        with Workbook.create_default() as wb:
-            font_index = wb.add_font(FontRecord(name="SelectorFont", size=11.0, color_argb=0x01020304, color=theme))
-            got_font = wb.get_font(font_index)
-            self.assertEqual(got_font.color, theme)
-            self.assertEqual(got_font.color_argb, 0x01020304)
-            self.assertEqual(wb.add_font(got_font), font_index)
-
-            fill_index = wb.add_fill(
-                FillRecord(
-                    pattern=1,
-                    fg_argb=0x05060708,
-                    bg_argb=0x090A0B0C,
-                    fg=indexed,
-                    bg=automatic,
-                )
-            )
-            got_fill = wb.get_fill(fill_index)
-            self.assertEqual(got_fill.fg, indexed)
-            self.assertEqual(got_fill.bg, automatic)
-            self.assertEqual(wb.add_fill(got_fill), fill_index)
-
-            border = {
-                "left": {"style": 1, "color_argb": 0x01020304, "color": theme},
-                "right": {"style": 1, "color_argb": 0x05060708, "color": indexed},
-                "top": {"style": 1, "color_argb": 0x090A0B0C, "color": automatic},
-            }
-            border_index = wb.add_border(border)
-            got_border = wb.get_border(border_index)
-            self.assertEqual(got_border["left"]["color"], theme)
-            self.assertEqual(got_border["right"]["color"], indexed)
-            self.assertEqual(got_border["top"]["color"], automatic)
-            self.assertEqual(wb.add_border(got_border), border_index)
-
-            dxf_index = wb.add_dxf(
-                DifferentialFormat(
-                    font=FontRecord(name="DxfSelector", size=9.0, color_argb=0x11121314, color=automatic),
-                    fill=FillRecord(pattern=1, fg_argb=0x15161718, fg=indexed),
-                    border={"left": {"style": 1, "color_argb": 0x191A1B1C, "color": theme}},
-                )
-            )
-            got_dxf = wb.get_dxf(dxf_index)
-            self.assertEqual(got_dxf.font.color, automatic)
-            self.assertEqual(got_dxf.fill.fg, indexed)
-            self.assertEqual(got_dxf.border["left"]["color"], theme)
-            self.assertEqual(wb.add_dxf(got_dxf), dxf_index)
-
-            with Workbook.load(wb.save()) as reloaded:
-                self.assertEqual(reloaded.get_font(font_index).color, theme)
-                self.assertEqual(reloaded.get_fill(fill_index).fg, indexed)
-                self.assertEqual(reloaded.get_border(border_index)["left"]["color"], theme)
-                self.assertEqual(reloaded.get_dxf(dxf_index).font.color, automatic)
-
-
-class ConditionalFormatTests(unittest.TestCase):
-    def test_cf_add_get_evaluate_clear(self) -> None:
-        with Workbook.create_default() as wb:
-            for r in range(3):
-                wb.set_number(0, r, 0, float(r * 5))  # A1=0, A2=5, A3=10
-            # A rule's dxf_id must resolve against a registered dxf.
-            dxf_index = wb.add_dxf(DifferentialFormat())
-            wb.add_conditional_format(
-                0,
-                ConditionalFormatInput(
-                    sqref=[MergeRange(0, 0, 2, 0)],
-                    type=1,  # cellIs
-                    op_engaged=True,
-                    op=4,  # greaterThan
-                    formula1="4",
-                    dxf_id_engaged=True,
-                    dxf_id=dxf_index,
-                ),
-            )
-            rules = wb.get_conditional_formats(0)
-            self.assertEqual(len(rules), 1)
-            self.assertEqual(rules[0].type, 1)
-            self.assertEqual(rules[0].formula1, "4")
-
-            wb.recalc()
-            cells = wb.evaluate_cf_range(0, 0, 0, 2, 0)
-            matched = {(c.row, c.col) for c in cells if c.matches}
-            # A2 (=5) and A3 (=10) exceed 4; A1 (=0) does not.
-            self.assertIn((1, 0), matched)
-            self.assertIn((2, 0), matched)
-            self.assertNotIn((0, 0), matched)
-
-            wb.clear_conditional_formats(0)
-            self.assertEqual(wb.get_conditional_formats(0), [])
-
-    def test_visual_rules_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            rules = [
-                ConditionalFormatInput(
-                    sqref=[MergeRange(0, 0, 2, 0)],
-                    type=2,
-                    color_scale=ColorScale(
-                        [CfValueObject(3), CfValueObject(4)],
-                        [CfColor(255, 0, 0), CfColor(0, 255, 0)],
-                    ),
-                ),
-                ConditionalFormatInput(
-                    sqref=[MergeRange(0, 1, 2, 1)],
-                    type=3,
-                    data_bar=DataBar(CfValueObject(3), CfValueObject(4), CfColor(0, 0, 255)),
-                ),
-                ConditionalFormatInput(
-                    sqref=[MergeRange(0, 2, 2, 2)],
-                    type=4,
-                    icon_set=IconSet(0, [CfValueObject(1, "33"), CfValueObject(1, "67")]),
-                ),
-            ]
-            for rule in rules:
-                wb.add_conditional_format(0, rule)
-            got = wb.get_conditional_formats(0)
-            self.assertEqual(got[0].color_scale.colors[1], CfColor(0, 255, 0))
-            self.assertEqual(got[1].data_bar.fill, CfColor(0, 0, 255))
-            self.assertEqual(got[2].icon_set.thresholds[1].value, "67")
-
-    # `CfValueObject.type`: 0 num, 1 percent, 2 percentile, 3 min, 4 max,
-    # 5 formula, 6 autoMin, 7 autoMax. Every threshold below states a
-    # `value`, which is what puts a borrowed string behind each CFVO.
-    EXPECTED_CFVO_VALUES = ["0", "50", "100", "5", "95", "0", "33", "67"]
-
-    @staticmethod
-    def _cfvo_rules() -> list[ConditionalFormatInput]:
-        """Build one color-scale, one data-bar and one icon-set rule."""
-        return [
-            ConditionalFormatInput(
-                sqref=[MergeRange(0, 0, 4, 0)],
-                type=2,
-                color_scale=ColorScale(
-                    [CfValueObject(0, "0"), CfValueObject(1, "50"), CfValueObject(0, "100")],
-                    [CfColor(248, 105, 107), CfColor(255, 235, 132), CfColor(99, 190, 123)],
-                ),
-            ),
-            ConditionalFormatInput(
-                sqref=[MergeRange(0, 1, 4, 1)],
-                type=3,
-                data_bar=DataBar(CfValueObject(0, "5"), CfValueObject(0, "95"), CfColor(0, 112, 192)),
-            ),
-            ConditionalFormatInput(
-                sqref=[MergeRange(0, 2, 4, 2)],
-                type=4,
-                icon_set=IconSet(0, [CfValueObject(1, "0"), CfValueObject(1, "33"), CfValueObject(1, "67")]),
-            ),
-        ]
-
-    @staticmethod
-    def _cfvo_values(rules: list) -> list[str]:
-        """Flatten the threshold value strings of the three visual rules."""
-        by_type = {rule.type: rule for rule in rules}
-        color_scale = by_type[2].color_scale
-        data_bar = by_type[3].data_bar
-        icon_set = by_type[4].icon_set
-        return (
-            [t.value for t in color_scale.thresholds]
-            + [data_bar.minimum.value, data_bar.maximum.value]
-            + [t.value for t in icon_set.thresholds]
-        )
-
-    def test_cfvo_value_strings_survive_read_back_and_a_save_load_cycle(self) -> None:
-        # Each CFVO `value` crosses the C ABI as a borrowed `const char*`.
-        # A store that relocates while the later thresholds are pulled
-        # publishes a pointer into freed bytes, so the strings come back
-        # wrong or empty even though the rule count and colors look right.
-        with Workbook.create_default() as wb:
-            for rule in self._cfvo_rules():
-                wb.add_conditional_format(0, rule)
-
-            in_session = wb.get_conditional_formats(0)
-            self.assertEqual(len(in_session), 3)
-            self.assertEqual(self._cfvo_values(in_session), self.EXPECTED_CFVO_VALUES)
-            by_type = {rule.type: rule for rule in in_session}
-            # The type travels with the value: a percent threshold read
-            # back as type 0 would mean an absolute number instead.
-            self.assertEqual([t.type for t in by_type[2].color_scale.thresholds], [0, 1, 0])
-            self.assertEqual([t.type for t in by_type[4].icon_set.thresholds], [1, 1, 1])
-            self.assertEqual(by_type[2].color_scale.colors[2], CfColor(99, 190, 123))
-            self.assertEqual(by_type[3].data_bar.fill, CfColor(0, 112, 192))
-            saved = wb.save()
-
-        with Workbook.load(saved) as reloaded:
-            rules = reloaded.get_conditional_formats(0)
-            self.assertEqual(len(rules), 3)
-            self.assertEqual(self._cfvo_values(rules), self.EXPECTED_CFVO_VALUES)
-
-    def test_data_bar_x14_fields_survive_save_and_load(self) -> None:
-        # These six live in the `x14` extension, not the legacy `<dataBar>`
-        # element. An in-session round-trip alone would not catch a writer
-        # that never emits the extension, which is how they were lost
-        # before: the values came back from the model and disappeared on
-        # the way through the file.
-        bar = DataBar(
-            CfValueObject(3),
-            CfValueObject(4),
-            CfColor(0, 0, 255),
-            gradient=False,
-            axis_position=1,
-            negative_fill=CfColor(255, 0, 0),
-            border=CfColor(9, 9, 9),
-            negative_border=CfColor(8, 8, 8),
-            axis_color=CfColor(1, 2, 3),
-            direction=2,
-        )
-        with Workbook.create_default() as wb:
-            wb.add_conditional_format(0, ConditionalFormatInput(sqref=[MergeRange(0, 0, 2, 0)], type=3, data_bar=bar))
-            saved = wb.save()
-
-        with Workbook.load(saved) as reloaded:
-            got = reloaded.get_conditional_formats(0)[0].data_bar
-            self.assertIs(got.gradient, False)
-            self.assertEqual(got.axis_position, 1)
-            self.assertEqual(got.negative_fill, CfColor(255, 0, 0))
-            self.assertEqual(got.border, CfColor(9, 9, 9))
-            self.assertEqual(got.negative_border, CfColor(8, 8, 8))
-            self.assertEqual(got.axis_color, CfColor(1, 2, 3))
-            self.assertEqual(got.direction, 2)
-            # Feeding the decoded bar straight back must reproduce it.
-            reloaded.add_conditional_format(
-                0, ConditionalFormatInput(sqref=[MergeRange(4, 0, 6, 0)], type=3, data_bar=got)
-            )
-            self.assertEqual(reloaded.get_conditional_formats(0)[1].data_bar, got)
-
-    def test_icon_set_floor_survives_save_and_load(self) -> None:
-        icons = IconSet(2, [CfValueObject(0, "7"), CfValueObject(0, "9")], floor=CfValueObject(0, "5", gte=False))
-        with Workbook.create_default() as wb:
-            wb.add_conditional_format(0, ConditionalFormatInput(sqref=[MergeRange(0, 0, 9, 0)], type=4, icon_set=icons))
-            saved = wb.save()
-        with Workbook.load(saved) as reloaded:
-            got = reloaded.get_conditional_formats(0)[0].icon_set
-            self.assertEqual(got.floor, CfValueObject(0, "5", gte=False))
-
-    def test_omitted_data_bar_x14_fields_keep_the_model_defaults(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.add_conditional_format(
-                0,
-                ConditionalFormatInput(
-                    sqref=[MergeRange(0, 0, 2, 0)],
-                    type=3,
-                    data_bar=DataBar(CfValueObject(3), CfValueObject(4), CfColor(0, 0, 255)),
-                ),
-            )
-            got = wb.get_conditional_formats(0)[0].data_bar
-            # The getter engages all six, so they read back as the defaults
-            # rather than as `None`.
-            self.assertIs(got.gradient, True)
-            self.assertEqual(got.axis_position, 0)
-            self.assertEqual(got.negative_fill, CfColor(0, 0, 255))
-
-
-class PivotTests(unittest.TestCase):
-    def test_build_and_project_pivot(self) -> None:
-        with Workbook.create_default() as wb:
-            cache_id = wb.pivot_cache_create()
-            wb.pivot_cache_field_add(cache_id, "Region")
-            wb.pivot_cache_field_add(cache_id, "Amount")
-            for region, amount in [("East", 10.0), ("East", 20.0), ("West", 30.0)]:
-                rec = wb.pivot_cache_record_add(cache_id)
-                wb.pivot_cache_record_set_text(cache_id, rec, 0, region)
-                wb.pivot_cache_record_set_number(cache_id, rec, 1, amount)
-            self.assertEqual(wb.pivot_cache_record_count(cache_id), 3)
-
-            pivot = wb.pivot_create(0, "Pivot1", cache_id, 0, 4)
-            region_field = wb.pivot_field_add(0, pivot, PivotFieldSpec(source_name="Region", axis=PivotAxis.ROW))
-            amount_field = wb.pivot_field_add(0, pivot, PivotFieldSpec(source_name="Amount", axis=PivotAxis.VALUE))
-            self.assertEqual(region_field, 0)
-            wb.pivot_data_field_add(
-                0,
-                pivot,
-                PivotDataFieldSpec(
-                    name="Sum of Amount",
-                    field_index=amount_field,
-                    aggregation=PivotAggregation.SUM,
-                ),
-            )
-
-            layout = wb.pivot_layout(0, pivot)
-            self.assertGreater(len(layout.cells), 0)
-            numbers = [c.value.to_python() for c in layout.cells if c.value.kind == ValueKind.NUMBER]
-            # The single grand total of 10 + 20 + 30 must appear.
-            self.assertIn(60.0, numbers)
-
-    def test_cache_source_and_report_layout_roundtrip(self) -> None:
-        with Workbook.create_default() as wb:
-            cache = wb.pivot_cache_create()
-            wb.set_pivot_cache_worksheet_source(cache, PivotWorksheetSource(ref="A1:B9", sheet="Sheet1"))
-            self.assertEqual(wb.get_pivot_cache_worksheet_source(cache).sheet, "Sheet1")
-            pivot = wb.pivot_create(0, "Layout", cache, 0, 0)
-            wb.set_pivot_report_layout(0, pivot, PivotReportLayout.TABULAR)
-            self.assertEqual(wb.get_pivot_report_layout(0, pivot), PivotReportLayout.TABULAR)
-            wb.set_pivot_cache_worksheet_source(cache, None)
-            self.assertIsNone(wb.get_pivot_cache_worksheet_source(cache))
-
-
-# ---- Pivot mutator marshalling ------------------------------------------
-#
-# Every pivot mutator is driven once against a small pivot and checked
-# through a read of the result -- the projected grid wherever the mutation
-# reaches it -- so an argument dropped, reordered or mis-converted on the
-# way to the C ABI shows up as a wrong grid rather than a silent success.
-# `test_table_covers_every_pivot_mutator` keeps the table in step with the
-# Workbook class.
-
-
-class _PivotFixture:
-    """Region / Product carry shared items their records index; Amount and
-    Date are plain numbers. Only Region is laid out."""
-
-    def __init__(self, wb: Workbook) -> None:
-        self.wb = wb
-        self.cache = wb.pivot_cache_create()
-        wb.set_pivot_cache_worksheet_source(self.cache, PivotWorksheetSource(ref="A1:D5", sheet="Sheet1"))
-        for name in ("Region", "Product", "Amount", "Date"):
-            wb.pivot_cache_field_add(self.cache, name)
-        for item in ("East", "West"):
-            wb.pivot_cache_field_add_shared_item_text(self.cache, 0, item)
-        for item in ("Apple", "Pear"):
-            wb.pivot_cache_field_add_shared_item_text(self.cache, 1, item)
-        for values in ((0, 0, 10, 45292), (1, 0, 30, 45323), (0, 1, 5, 45658), (1, 1, 7, 45689)):
-            rec = wb.pivot_cache_record_add(self.cache)
-            for field, value in enumerate(values):
-                wb.pivot_cache_record_set_number(self.cache, rec, field, value)
-        self.pivot = wb.pivot_create(0, "Pivot1", self.cache, 0, 6)
-        self.region = wb.pivot_field_add(0, self.pivot, PivotFieldSpec(source_name="Region", axis=PivotAxis.ROW))
-        wb.pivot_field_add_item(0, self.pivot, self.region, "East", True)
-        wb.pivot_field_add_item(0, self.pivot, self.region, "West", True)
-        self.product = wb.pivot_field_add(0, self.pivot, PivotFieldSpec(source_name="Product", axis=PivotAxis.VALUE))
-        wb.pivot_field_add_item(0, self.pivot, self.product, "Apple", True)
-        wb.pivot_field_add_item(0, self.pivot, self.product, "Pear", True)
-        self.amount = wb.pivot_field_add(0, self.pivot, PivotFieldSpec(source_name="Amount", axis=PivotAxis.VALUE))
-        self.date = wb.pivot_field_add(0, self.pivot, PivotFieldSpec(source_name="Date", axis=PivotAxis.VALUE))
-        wb.pivot_set_row_field_order(0, self.pivot, [self.region])
-        wb.pivot_data_field_add(
-            0, self.pivot, PivotDataFieldSpec(name="Sum of Amount", field_index=self.amount, aggregation=0)
-        )
-
-    def grid(self, pivot: int = 0) -> List[str]:
-        """The projected grid as one ``|``-joined string per sheet row."""
-        layout = self.wb.pivot_layout(0, pivot)
-        rows: Dict[int, List[str]] = {}
-        for cell in layout.cells:
-            v = cell.value
-            if v.kind == ValueKind.NUMBER:
-                text = "%.15g" % v.number
-            elif v.kind == ValueKind.TEXT:
-                text = v.text
-            elif v.kind == ValueKind.ERROR:
-                text = f"#{v.error_code}"
-            else:
-                text = ""
-            rows.setdefault(cell.row, [""] * layout.cols)[cell.col - layout.left] = text
-        return ["|".join(rows[r]) for r in sorted(rows)]
-
-
-_BASE_GRID = ["行ラベル|Sum of Amount", "East|15", "West|37", "総計|52"]
-_TWO_LEVEL_GRID = [
-    "行ラベル|Sum of Amount",
-    "Apple|10",
-    "Pear|5",
-    "East|15",
-    "Apple|30",
-    "Pear|7",
-    "West|37",
-    "総計|52",
-]
-_WEST_ONLY = ["行ラベル|Sum of Amount", "West|37", "総計|37"]
-_GREATER_THAN_20 = PivotFilterSpec(
-    axis=PivotAxis.ROW, field_name="Region", type=PivotFilterType.VALUE_GREATER_THAN, value_kind=1, value_double=20.0
-)
-_BETWEEN_10_20 = PivotFilterSpec(
-    axis=PivotAxis.ROW,
-    field_name="Region",
-    type=PivotFilterType.VALUE_BETWEEN,
-    value_kind=1,
-    value_double=10.0,
-    value_high_kind=1,
-    value_high_double=20.0,
-)
-
-# Readers that share the `pivot` prefix with the mutators.
-_PIVOT_READERS = {
-    "pivot_count",
-    "pivot_layout",
-    "pivot_cache_count",
-    "pivot_cache_field_count",
-    "pivot_cache_field_name",
-    "pivot_cache_field_shared_item_count",
-    "pivot_cache_record_count",
-    "pivot_field_count",
-    "pivot_data_field_count",
-    "pivot_filter_count",
-    "pivot_filter_at",
-    "get_pivot_cache_worksheet_source",
-    "get_pivot_report_layout",
-}
-
-
-def _two_levels(f: _PivotFixture) -> None:
-    f.wb.pivot_set_row_field_order(0, f.pivot, [f.region, f.product])
-
-
-def _date_rows(f: _PivotFixture) -> None:
-    f.wb.pivot_set_row_field_order(0, f.pivot, [f.date])
-
-
-def _hide_east(f: _PivotFixture) -> None:
-    f.wb.pivot_field_set_item_visible(0, f.pivot, f.region, 0, False)
-
-
-def _point_at_new_item(f: _PivotFixture) -> None:
-    f.wb.pivot_cache_record_set_number(f.cache, 0, 0, 2)
-
-
-def _package_part(data: bytes, name: str) -> str:
-    with zipfile.ZipFile(io.BytesIO(data)) as package:
-        return package.read(name).decode("utf-8")
-
-
-class PivotMutatorTableTests(unittest.TestCase):
-    # name -> (setup, act, after, expect). `act` is the one call under test
-    # and returns its result; `expect(test, fixture, result)` reads it back.
-    def _rows(self) -> Dict[str, Tuple[Any, Any, Any, Any]]:
-        eq = self.assertEqual
-
-        def grid_is(expected: List[str]) -> Any:
-            return lambda t, f, r: eq(f.grid(), expected)
-
-        def rejects(call: Any) -> None:
-            with self.assertRaises(FormulonError) as caught:
-                call()
-            eq(caught.exception.status, 2)
-
-        def cache_create(t: Any, f: _PivotFixture, r: int) -> None:
-            eq(r, 77)
-            eq(f.wb.pivot_cache_count(), 2)
-
-        def cache_remove_setup(f: _PivotFixture) -> None:
-            f.spare = f.wb.pivot_cache_create()  # type: ignore[attr-defined]
-
-        def cache_remove(t: Any, f: _PivotFixture, r: None) -> None:
-            eq(f.wb.pivot_cache_count(), 1)
-            eq(f.wb.pivot_cache_id_at(0), f.cache)
-
-        def cache_source(t: Any, f: _PivotFixture, r: None) -> None:
-            source = f.wb.get_pivot_cache_worksheet_source(f.cache)
-            eq((source.ref, source.sheet), ("B2:E6", "Data"))
-            eq(f.grid(), _BASE_GRID)
-
-        def cache_field_add(t: Any, f: _PivotFixture, r: int) -> None:
-            eq(r, 4)
-            eq(f.wb.pivot_cache_field_name(f.cache, 4), "Extra")
-
-        def cache_field_clear(t: Any, f: _PivotFixture, r: None) -> None:
-            eq(f.wb.pivot_cache_field_count(f.cache), 0)
-            # The data field now names a cache field that no longer exists.
-            with self.assertRaises(FormulonError):
-                f.wb.pivot_layout(0, f.pivot)
-
-        def record_add(t: Any, f: _PivotFixture, r: int) -> None:
-            eq(r, 4)
-            eq(f.grid(), ["行ラベル|Sum of Amount", "East|15", "West|37", "(空白)|0", "総計|52"])
-
-        def pivot_create(t: Any, f: _PivotFixture, r: int) -> None:
-            eq(r, 1)
-            layout = f.wb.pivot_layout(0, 1)
-            eq((layout.top, layout.left), (20, 1))
-            eq(f.grid(0), _BASE_GRID)
-
-        def pivot_remove(t: Any, f: _PivotFixture, r: None) -> None:
-            eq(f.wb.pivot_count(0), 0)
-            with self.assertRaises(FormulonError):
-                f.wb.pivot_layout(0, 0)
-
-        def set_name(t: Any, f: _PivotFixture, r: None) -> None:
-            # A pivot's name is only observable in the part the writer emits.
-            part = _package_part(f.wb.save(), "xl/pivotTables/pivotTable1.xml")
-            self.assertRegex(part, r'<pivotTableDefinition [^>]*name="Renamed"')
-
-        def set_anchor(t: Any, f: _PivotFixture, r: None) -> None:
-            layout = f.wb.pivot_layout(0, f.pivot)
-            eq((layout.top, layout.left), (10, 2))
-            eq(f.grid(), _BASE_GRID)
-
-        def set_layout(t: Any, f: _PivotFixture, r: None) -> None:
-            eq(f.wb.get_pivot_report_layout(0, f.pivot), PivotReportLayout.TABULAR)
-            eq(f.grid(), ["Region|Sum of Amount", "East|15", "West|37", "総計|52"])
-
-        def field_add(t: Any, f: _PivotFixture, r: int) -> None:
-            eq(r, 4)
-            eq(f.grid(), ["Fruit|(すべて)", "|", *_BASE_GRID])
-
-        def field_clear(t: Any, f: _PivotFixture, r: None) -> None:
-            eq(f.wb.pivot_field_count(0, f.pivot), 0)
-            eq(f.grid(), _BASE_GRID)
-
-        def add_item_at_setup(f: _PivotFixture) -> None:
-            # Only the index-addressed form can name the blank item.
-            f.wb.pivot_cache_field_add_shared_item_blank(f.cache, 0)
-            f.wb.pivot_cache_record_set_blank(f.cache, 0, 0)
-
-        def clear_subtotal_setup(f: _PivotFixture) -> None:
-            _two_levels(f)
-            f.wb.pivot_field_add_subtotal_fn(0, f.pivot, f.region, PivotAggregation.MAX)
-
-        def clear_date_group_setup(f: _PivotFixture) -> None:
-            _date_rows(f)
-            f.wb.pivot_field_set_date_group(0, f.pivot, f.date, PivotDateGrouping.YEAR, PivotCalendar.GREGORIAN)
-
-        def number_format(t: Any, f: _PivotFixture, r: None) -> None:
-            rejects(lambda: f.wb.pivot_field_set_number_format(0, f.pivot, 99, "4"))
-            rejects(lambda: f.wb.pivot_field_set_number_format(0, f.pivot, f.amount, "0.00"))
-            # A field's numFmtId is only observable in the part the writer emits.
-            part = _package_part(f.wb.save(), "xl/pivotTables/pivotTable1.xml")
-            self.assertRegex(part, r'<pivotField [^>]*numFmtId="4"')
-            eq(f.grid(), _BASE_GRID)
-
-        def data_field_add(t: Any, f: _PivotFixture, r: int) -> None:
-            eq(r, 1)
-            eq(
-                f.grid(),
-                ["行ラベル|Sum of Amount|Max of Amount", "East|15|10", "West|37|30", "総計|52|30"],
-            )
-
-        def data_field_set(t: Any, f: _PivotFixture, r: None) -> None:
-            eq(f.grid(), ["行ラベル|Count of Amount", "East|2", "West|2", "総計|4"])
-            formats = [c.number_format for c in f.wb.pivot_layout(0, f.pivot).cells if c.value.kind == ValueKind.NUMBER]
-            eq(formats, ["2", "2", "2"])
-
-        def filter_remove_setup(f: _PivotFixture) -> None:
-            # Each filter alone keeps a different region, so removing the
-            # wrong index leaves the wrong one.
-            f.wb.pivot_filter_add(0, f.pivot, _GREATER_THAN_20)
-            f.wb.pivot_filter_add(0, f.pivot, _BETWEEN_10_20)
-
-        W = PivotAggregation
-        return {
-            "pivot_cache_create": (None, lambda f: f.wb.pivot_cache_create(77), None, cache_create),
-            "pivot_cache_id_at": (None, lambda f: f.wb.pivot_cache_id_at(0), None, lambda t, f, r: eq(r, f.cache)),
-            "pivot_cache_remove": (cache_remove_setup, lambda f: f.wb.pivot_cache_remove(f.spare), None, cache_remove),
-            "set_pivot_cache_worksheet_source": (
-                None,
-                lambda f: f.wb.set_pivot_cache_worksheet_source(
-                    f.cache, PivotWorksheetSource(ref="B2:E6", sheet="Data")
-                ),
-                None,
-                cache_source,
-            ),
-            "pivot_cache_field_add": (
-                None,
-                lambda f: f.wb.pivot_cache_field_add(f.cache, "Extra"),
-                None,
-                cache_field_add,
-            ),
-            "pivot_cache_field_clear": (None, lambda f: f.wb.pivot_cache_field_clear(f.cache), None, cache_field_clear),
-            "pivot_cache_field_add_shared_item_number": (
-                None,
-                lambda f: f.wb.pivot_cache_field_add_shared_item_number(f.cache, 0, 42.5),
-                _point_at_new_item,
-                grid_is(["行ラベル|Sum of Amount", "42.5|10", "East|5", "West|37", "総計|52"]),
-            ),
-            "pivot_cache_field_add_shared_item_text": (
-                None,
-                lambda f: f.wb.pivot_cache_field_add_shared_item_text(f.cache, 0, "North"),
-                _point_at_new_item,
-                grid_is(["行ラベル|Sum of Amount", "East|5", "North|10", "West|37", "総計|52"]),
-            ),
-            "pivot_cache_field_add_shared_item_bool": (
-                None,
-                lambda f: f.wb.pivot_cache_field_add_shared_item_bool(f.cache, 0, True),
-                _point_at_new_item,
-                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "TRUE|10", "総計|52"]),
-            ),
-            "pivot_cache_field_add_shared_item_blank": (
-                None,
-                lambda f: f.wb.pivot_cache_field_add_shared_item_blank(f.cache, 0),
-                _point_at_new_item,
-                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "(空白)|10", "総計|52"]),
-            ),
-            "pivot_cache_field_add_shared_item_error": (
-                None,
-                lambda f: f.wb.pivot_cache_field_add_shared_item_error(f.cache, 0, 6),
-                _point_at_new_item,
-                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "#N/A|10", "総計|52"]),
-            ),
-            "pivot_cache_field_clear_shared_items": (
-                None,
-                lambda f: f.wb.pivot_cache_field_clear_shared_items(f.cache, 0),
-                None,
-                # With no shared items the records' indices render as themselves.
-                grid_is(["行ラベル|Sum of Amount", "0|15", "1|37", "総計|52"]),
-            ),
-            "pivot_cache_record_add": (None, lambda f: f.wb.pivot_cache_record_add(f.cache), None, record_add),
-            "pivot_cache_record_clear": (
-                None,
-                lambda f: f.wb.pivot_cache_record_clear(f.cache),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "総計|0"]),
-            ),
-            "pivot_cache_record_set_number": (
-                None,
-                lambda f: f.wb.pivot_cache_record_set_number(f.cache, 0, 2, 1000),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "East|1005", "West|37", "総計|1042"]),
-            ),
-            "pivot_cache_record_set_text": (
-                None,
-                lambda f: f.wb.pivot_cache_record_set_text(f.cache, 0, 0, "West"),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "East|5", "West|47", "総計|52"]),
-            ),
-            "pivot_cache_record_set_bool": (
-                None,
-                lambda f: f.wb.pivot_cache_record_set_bool(f.cache, 0, 2, True),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "East|6", "West|37", "総計|43"]),
-            ),
-            "pivot_cache_record_set_blank": (
-                None,
-                lambda f: f.wb.pivot_cache_record_set_blank(f.cache, 0, 2),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "総計|42"]),
-            ),
-            "pivot_cache_record_set_error": (
-                None,
-                lambda f: f.wb.pivot_cache_record_set_error(f.cache, 0, 2, 1),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "East|#1", "West|37", "総計|#1"]),
-            ),
-            "pivot_create": (None, lambda f: f.wb.pivot_create(0, "Pivot2", f.cache, 20, 1), None, pivot_create),
-            "pivot_remove": (None, lambda f: f.wb.pivot_remove(0, f.pivot), None, pivot_remove),
-            "pivot_set_name": (None, lambda f: f.wb.pivot_set_name(0, f.pivot, "Renamed"), None, set_name),
-            "pivot_set_anchor": (None, lambda f: f.wb.pivot_set_anchor(0, f.pivot, 10, 2, 4, 2), None, set_anchor),
-            "pivot_set_grand_totals": (
-                lambda f: f.wb.pivot_set_col_field_order(0, f.pivot, [f.product]),
-                # Rows off drops the per-row total column; columns on keeps
-                # the bottom total row, so a swapped pair shows the opposite.
-                lambda f: f.wb.pivot_set_grand_totals(0, f.pivot, False, True),
-                None,
-                grid_is(["Sum of Amount|列ラベル|", "行ラベル|Apple|Pear", "East|10|5", "West|30|7", "総計|40|12"]),
-            ),
-            "set_pivot_report_layout": (
-                None,
-                lambda f: f.wb.set_pivot_report_layout(0, f.pivot, PivotReportLayout.TABULAR),
-                None,
-                set_layout,
-            ),
-            "pivot_field_add": (
-                None,
-                lambda f: f.wb.pivot_field_add(
-                    0, f.pivot, PivotFieldSpec(source_name="Product", custom_name="Fruit", axis=PivotAxis.PAGE)
-                ),
-                None,
-                field_add,
-            ),
-            "pivot_field_clear": (_hide_east, lambda f: f.wb.pivot_field_clear(0, f.pivot), None, field_clear),
-            "pivot_field_set_axis": (
-                None,
-                lambda f: f.wb.pivot_field_set_axis(0, f.pivot, f.product, PivotAxis.PAGE),
-                None,
-                grid_is(["Product|(すべて)", "|", *_BASE_GRID]),
-            ),
-            "pivot_field_set_sort": (
-                # East now outsums West, so sorting ascending by the data
-                # field differs from both label orders.
-                lambda f: f.wb.pivot_cache_record_set_number(f.cache, 0, 2, 40),
-                lambda f: f.wb.pivot_field_set_sort(0, f.pivot, f.region, True, "Sum of Amount"),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "West|37", "East|45", "総計|82"]),
-            ),
-            "pivot_field_set_subtotal_top": (
-                _two_levels,
-                lambda f: f.wb.pivot_field_set_subtotal_top(0, f.pivot, f.region, True),
-                None,
-                grid_is(
-                    [
-                        "行ラベル|Sum of Amount",
-                        "East|15",
-                        "Apple|10",
-                        "Pear|5",
-                        "West|37",
-                        "Apple|30",
-                        "Pear|7",
-                        "総計|52",
-                    ]
-                ),
-            ),
-            "pivot_field_add_item": (
-                None,
-                lambda f: f.wb.pivot_field_add_item(0, f.pivot, f.region, "East", False),
-                None,
-                grid_is(_WEST_ONLY),
-            ),
-            "pivot_field_add_item_at": (
-                add_item_at_setup,
-                lambda f: f.wb.pivot_field_add_item_at(0, f.pivot, f.region, 2, False),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "総計|42"]),
-            ),
-            "pivot_field_clear_items": (
-                _hide_east,
-                lambda f: f.wb.pivot_field_clear_items(0, f.pivot, f.region),
-                None,
-                grid_is(_BASE_GRID),
-            ),
-            "pivot_field_set_item_visible": (
-                None,
-                lambda f: f.wb.pivot_field_set_item_visible(0, f.pivot, f.region, 1, False),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "East|15", "総計|15"]),
-            ),
-            "pivot_field_add_subtotal_fn": (
-                _two_levels,
-                lambda f: f.wb.pivot_field_add_subtotal_fn(0, f.pivot, f.region, W.MAX),
-                None,
-                grid_is(
-                    [
-                        "行ラベル|Sum of Amount",
-                        "Apple|10",
-                        "Pear|5",
-                        "East|10",
-                        "Apple|30",
-                        "Pear|7",
-                        "West|30",
-                        "総計|52",
-                    ]
-                ),
-            ),
-            "pivot_field_clear_subtotal_fns": (
-                clear_subtotal_setup,
-                lambda f: f.wb.pivot_field_clear_subtotal_fns(0, f.pivot, f.region),
-                None,
-                grid_is(_TWO_LEVEL_GRID),
-            ),
-            "pivot_field_set_date_group": (
-                _date_rows,
-                lambda f: f.wb.pivot_field_set_date_group(
-                    0, f.pivot, f.date, PivotDateGrouping.YEAR, PivotCalendar.JAPANESE, -1, -1
-                ),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "令和6年|40", "令和7年|12", "総計|52"]),
-            ),
-            "pivot_field_clear_date_group": (
-                clear_date_group_setup,
-                lambda f: f.wb.pivot_field_clear_date_group(0, f.pivot, f.date),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "45292|10", "45323|30", "45658|5", "45689|7", "総計|52"]),
-            ),
-            "pivot_field_set_number_format": (
-                None,
-                lambda f: f.wb.pivot_field_set_number_format(0, f.pivot, f.amount, "4"),
-                None,
-                number_format,
-            ),
-            "pivot_set_row_field_order": (
-                None,
-                lambda f: f.wb.pivot_set_row_field_order(0, f.pivot, [f.product]),
-                None,
-                grid_is(["行ラベル|Sum of Amount", "Apple|40", "Pear|12", "総計|52"]),
-            ),
-            "pivot_set_col_field_order": (
-                None,
-                lambda f: f.wb.pivot_set_col_field_order(0, f.pivot, [f.product]),
-                None,
-                grid_is(
-                    [
-                        "Sum of Amount|列ラベル||",
-                        "行ラベル|Apple|Pear|総計",
-                        "East|10|5|15",
-                        "West|30|7|37",
-                        "総計|40|12|52",
-                    ]
-                ),
-            ),
-            "pivot_data_field_add": (
-                None,
-                lambda f: f.wb.pivot_data_field_add(
-                    0, f.pivot, PivotDataFieldSpec(name="Max of Amount", field_index=f.amount, aggregation=W.MAX)
-                ),
-                None,
-                data_field_add,
-            ),
-            "pivot_data_field_clear": (
-                None,
-                lambda f: f.wb.pivot_data_field_clear(0, f.pivot),
-                None,
-                grid_is(["行ラベル", "East", "West", "総計"]),
-            ),
-            "pivot_data_field_set": (
-                None,
-                lambda f: f.wb.pivot_data_field_set(
-                    0,
-                    f.pivot,
-                    0,
-                    PivotDataFieldSpec(
-                        name="Count of Amount", field_index=f.amount, aggregation=W.COUNT, number_format="2"
-                    ),
-                ),
-                None,
-                data_field_set,
-            ),
-            "pivot_filter_add": (
-                None,
-                lambda f: f.wb.pivot_filter_add(0, f.pivot, _GREATER_THAN_20),
-                None,
-                grid_is(_WEST_ONLY),
-            ),
-            "pivot_filter_clear": (
-                lambda f: f.wb.pivot_filter_add(0, f.pivot, _GREATER_THAN_20),
-                lambda f: f.wb.pivot_filter_clear(0, f.pivot),
-                None,
-                grid_is(_BASE_GRID),
-            ),
-            "pivot_filter_remove_at": (
-                filter_remove_setup,
-                lambda f: f.wb.pivot_filter_remove_at(0, f.pivot, 1),
-                None,
-                grid_is(_WEST_ONLY),
-            ),
-        }
-
-    def test_table_covers_every_pivot_mutator(self) -> None:
-        declared = {
-            name
-            for name, member in inspect.getmembers(Workbook, inspect.isfunction)
-            if "pivot" in name and not name.startswith("_") and name not in _PIVOT_READERS
-        }
-        self.assertGreater(len(declared), 40)
-        self.assertEqual(sorted(declared - set(self._rows())), [], "pivot mutators without a row")
-        self.assertEqual(sorted(set(self._rows()) - declared), [], "rows for undeclared pivot mutators")
-
-    def test_pivot_mutators_forward_their_arguments(self) -> None:
-        with Workbook.create_default() as wb:
-            self.assertEqual(_PivotFixture(wb).grid(), _BASE_GRID)
-        for name, (setup, act, after, expect) in self._rows().items():
-            with self.subTest(name), Workbook.create_default() as wb:
-                fixture = _PivotFixture(wb)
-                if setup is not None:
-                    setup(fixture)
-                result = act(fixture)
-                if after is not None:
-                    after(fixture)
-                expect(self, fixture, result)
-
-
-class FunctionCatalogTests(unittest.TestCase):
-    def test_catalog_metadata(self) -> None:
-        self.assertGreater(Workbook.function_count(), 0)
-        meta = Workbook.function_metadata("SUM", 0)
-        self.assertIsNotNone(meta)
-        self.assertEqual(meta.name, "SUM")
-        self.assertGreaterEqual(meta.min_arity, 1)
-        # SUM is an unbounded variadic; the sentinel is normalized to None.
-        self.assertIsNone(meta.max_arity)
-        # Lazy-dispatch forms (not in the eager registry) still resolve.
-        xlookup = Workbook.function_metadata("XLOOKUP", 0)
-        self.assertIsNotNone(xlookup)
-        self.assertEqual(xlookup.name, "XLOOKUP")
-        names = {Workbook.function_name_at(i) for i in range(Workbook.function_count())}
-        self.assertIn("XLOOKUP", names)
-        self.assertIsNone(Workbook.function_metadata("NOT_A_REAL_FUNCTION", 0))
-
-    def test_function_name_at(self) -> None:
-        name = Workbook.function_name_at(0)
-        self.assertIsInstance(name, str)
-        self.assertGreater(len(name), 0)
-
-    def test_merge_function_metadata(self) -> None:
-        base = Workbook.function_metadata("XLOOKUP", 0)
-        self.assertIsNotNone(base)
-        # The engine leaves display metadata empty.
-        self.assertIsNone(base.signature_template)
-        self.assertIsNone(base.description)
-
-        entry = {
-            "signature": "XLOOKUP(lookup_value, lookup_array, return_array)",
-            "description": "Searches a range or an array.",
-            "aliases": {"fr-FR": "RECHERCHEX"},
-            "localized": {"fr-FR": {"signature": "RECHERCHEX(...)", "description": "Recherche."}},
-        }
-
-        # Localized override wins for the matching locale.
-        fr = formulon.merge_function_metadata(base, entry, "fr-FR")
-        self.assertEqual(fr.signature_template, "RECHERCHEX(...)")
-        self.assertEqual(fr.description, "Recherche.")
-        self.assertEqual(fr.localized_name, "RECHERCHEX")
-        # Structural fields survive the merge.
-        self.assertEqual(fr.name, "XLOOKUP")
-
-        # A locale with no localized/alias entry falls back to the default
-        # signature/description and the canonical display name.
-        de = formulon.merge_function_metadata(base, entry, "de-DE")
-        self.assertEqual(
-            de.signature_template,
-            "XLOOKUP(lookup_value, lookup_array, return_array)",
-        )
-        self.assertEqual(de.description, "Searches a range or an array.")
-        self.assertEqual(de.localized_name, "XLOOKUP")
-
-        # No provider entry -> base returned verbatim; display metadata NULL.
-        none = formulon.merge_function_metadata(base, None, "fr-FR")
-        self.assertIs(none, base)
-        self.assertIsNone(none.signature_template)
-        self.assertIsNone(none.description)
-
-    def test_shipped_example_document_conforms_to_the_engine(self) -> None:
-        """The example provider document must stay usable against this engine.
-
-        ``docs/examples/function-metadata.example.json`` is offered as a
-        ready-to-use starting point, but nothing else loads it, so a
-        function rename or a schema change would leave a broken example
-        shipped in the docs. Checking it here also pins the two claims the
-        schema doc makes about the keys -- canonical, uppercase, English --
-        against the engine that decides what canonical means.
-        """
-        path = Path(__file__).resolve().parents[3] / "docs" / "examples" / "function-metadata.example.json"
-        document = json.loads(path.read_text(encoding="utf-8"))
-        self.assertEqual(document["version"], 1)
-        functions = document["functions"]
-        self.assertTrue(functions, "the example document declares no functions")
-
-        for name, entry in functions.items():
-            self.assertEqual(name, name.upper(), f"{name} is not an uppercase key")
-            base = Workbook.function_metadata(name, 0)
-            self.assertIsNotNone(base, f"{name} is not a function this engine knows")
-            self.assertEqual(base.name, name, f"{name} is not the canonical spelling")
-            # Merging must actually reach the entry: an alias-only entry
-            # (VLOOKUP here) still has to resolve its display name, which is
-            # what distinguishes a real merge from returning `base` verbatim.
-            for locale in sorted(set(entry.get("aliases", {})) | set(entry.get("localized", {}))):
-                merged = formulon.merge_function_metadata(base, entry, locale)
-                self.assertEqual(merged.name, name)
-                alias = entry.get("aliases", {}).get(locale)
-                self.assertEqual(merged.localized_name, alias if alias is not None else name)
-
-
-class ExternalLinkTests(unittest.TestCase):
-    def test_fresh_workbook_has_no_external_links(self) -> None:
-        with Workbook.create_default() as wb:
-            self.assertEqual(wb.external_link_count(), 0)
-            self.assertEqual(wb.get_external_links(), [])
-
-
-class PackageDiagnosticsTests(unittest.TestCase):
-    def test_unknown_save_format_raises_formulon_error(self) -> None:
-        with Workbook.create_default() as wb:
-            with self.assertRaises(formulon.FormulonError) as ctx:
-                wb.save_with_diagnostics(WorkbookFormat.UNKNOWN)
-            self.assertIn("unsupported format", str(ctx.exception))
-
-    def test_save_and_read_diagnostics_report_every_counter(self) -> None:
-        with Workbook.create_default() as wb:
-            wb.set_formula(0, 0, 0, "=SUM(T[C])")
-            wb.add_validation(
-                0,
-                DataValidationInput(
-                    type=3,
-                    ranges=[MergeRange(0, 0, 0, 0)],
-                    formula1='"Yes,No"',
-                ),
-            )
-            wb.add_conditional_format(
-                0,
-                ConditionalFormatInput(
-                    sqref=[MergeRange(0, 0, 0, 0)],
-                    type=1,
-                    op_engaged=True,
-                    op=5,
-                    formula1="10",
-                ),
-            )
-
-            xlsx = wb.save_with_diagnostics(WorkbookFormat.XLSX)
-            self.assertIsInstance(xlsx, SaveDiagnostics)
-            self.assertIsInstance(xlsx.bytes, bytes)
-            self.assertEqual(xlsx.downgraded_formula_count, 0)
-            self.assertEqual(xlsx.deferred_feature_count, 0)
-            self.assertEqual(xlsx.dropped_part_count, 0)
-            self.assertEqual(xlsx.dropped_relationship_count, 0)
-            self.assertEqual(xlsx.renumbered_part_count, 0)
-
-            xlsb = wb.save_with_diagnostics(WorkbookFormat.XLSB)
-            self.assertEqual(xlsb.downgraded_formula_count, 1)
-            # The validation and the CF rule (no dxf) are both written.
-            self.assertEqual(xlsb.deferred_feature_count, 0)
-            # The binary writer never reassigns a part id.
-            self.assertEqual(xlsb.renumbered_part_count, 0)
-
-            # `save_as` remains a plain bytes return value.
-            self.assertIsInstance(wb.save_as(WorkbookFormat.XLSB), bytes)
-
-            with Workbook.load(xlsb.bytes) as loaded:
-                read = loaded.read_diagnostics()
-                self.assertIsInstance(read, ReadDiagnostics)
-                self.assertEqual(read.undecoded_formula_count, 0)
-                self.assertEqual(read.undecoded_defined_name_count, 0)
-                self.assertEqual(read.undecoded_part_count, 0)
-                self.assertEqual(read.skipped_feature_count, 0)
-                self.assertEqual(read.unknown_content_type_count, 0)
-
-            with Workbook.load(_append_empty_zip_entry(xlsb.bytes, "xl/preserved.bin")) as preserved_loaded:
-                preserved = preserved_loaded.read_diagnostics()
-                self.assertEqual(preserved.undecoded_part_count, 0)
-
-    def test_diagnostic_scratch_is_freed_when_a_later_allocation_fails(self) -> None:
-        # `save_with_diagnostics` takes three blocks (two out-pointers plus the
-        # counter struct). If the second allocation raises, the first must
-        # still be released rather than leaked into the WASM heap.
-        with Workbook.create_default() as wb:
-            original_alloc = formulon.workbook.LIB.alloc
-            calls = 0
-
-            def alloc_then_fail(size: int) -> int:
-                nonlocal calls
-                calls += 1
-                if calls == 2:
-                    raise RuntimeError("synthetic allocation failure")
-                return original_alloc(size)
-
-            with (
-                mock.patch.object(formulon.workbook.LIB, "alloc", side_effect=alloc_then_fail),
-                mock.patch.object(formulon.workbook.LIB, "free", wraps=formulon.workbook.LIB.free) as free,
-            ):
-                with self.assertRaises(RuntimeError):
-                    wb.save_with_diagnostics(WorkbookFormat.XLSB)
-            self.assertEqual(free.call_count, 1)
-
-
-class SurfaceParityTests(unittest.TestCase):
-    """Every advertised method must exist on the Workbook class."""
-
-    METHODS = [
-        "move_sheet",
-        "remove_sheet",
-        "rename_sheet",
-        "set_defined_name",
-        "set_defined_name_scoped",
-        "set_error",
-        "insert_rows",
-        "delete_rows",
-        "insert_cols",
-        "delete_cols",
-        "calc_mode",
-        "set_calc_mode",
-        "pinned_now",
-        "set_pinned_now",
-        "clear_pinned_now",
-        "excel_profile_id",
-        "set_excel_profile_id",
-        "partial_recalc",
-        "lambda_text_at",
-        "evaluate_formula_array",
-        "add_merge",
-        "remove_merge",
-        "remove_merge_at",
-        "clear_merges",
-        "get_merges",
-        "merge_count",
-        "add_hyperlink",
-        "remove_hyperlink",
-        "remove_hyperlink_at",
-        "clear_hyperlinks",
-        "get_hyperlinks",
-        "hyperlink_count",
-        "get_comment",
-        "set_comment",
-        "validation_count",
-        "get_validation_at",
-        "get_validations",
-        "add_validation",
-        "remove_validation_at",
-        "clear_validations",
-        "get_sheet_protection",
-        "set_sheet_protection",
-        "get_sheet_view",
-        "set_sheet_zoom",
-        "set_sheet_freeze",
-        "set_sheet_tab_hidden",
-        "set_sheet_visibility",
-        "set_sheet_show_grid_lines",
-        "set_sheet_show_row_col_headers",
-        "set_sheet_show_zeros",
-        "set_sheet_right_to_left",
-        "set_sheet_tab_selected",
-        "set_sheet_view_mode",
-        "get_sheet_columns",
-        "set_column_width",
-        "set_column_hidden",
-        "set_column_outline",
-        "get_sheet_row_overrides",
-        "set_row_height",
-        "set_row_hidden",
-        "set_row_outline",
-        "evaluate_cf_range",
-        "cf_count",
-        "get_conditional_format_at",
-        "get_conditional_formats",
-        "add_conditional_format",
-        "remove_conditional_format_at",
-        "clear_conditional_formats",
-        "get_cell_xf_index",
-        "set_cell_xf_index",
-        "get_cell_xf",
-        "get_font",
-        "get_fill",
-        "get_border",
-        "get_num_fmt",
-        "font_count",
-        "fill_count",
-        "border_count",
-        "cell_xf_count",
-        "cell_style_count",
-        "cell_style_xf_count",
-        "add_font",
-        "add_fill",
-        "add_border",
-        "add_num_fmt",
-        "add_cell_xf",
-        "get_cell_style",
-        "get_cell_style_xf",
-        "pivot_count",
-        "pivot_layout",
-        "pivot_cache_count",
-        "pivot_cache_id_at",
-        "pivot_cache_create",
-        "pivot_cache_remove",
-        "pivot_cache_field_count",
-        "pivot_cache_field_name",
-        "pivot_cache_field_add",
-        "pivot_cache_field_clear",
-        "pivot_cache_record_add",
-        "pivot_cache_record_set_number",
-        "pivot_cache_record_set_text",
-        "pivot_create",
-        "pivot_remove",
-        "pivot_set_name",
-        "pivot_set_anchor",
-        "pivot_set_grand_totals",
-        "pivot_field_add",
-        "pivot_field_add_item",
-        "pivot_field_add_item_at",
-        "pivot_field_set_axis",
-        "pivot_data_field_add",
-        "pivot_data_field_set",
-        "pivot_filter_add",
-        "pivot_set_row_field_order",
-        "pivot_set_col_field_order",
-        "precedents",
-        "dependents",
-        "spill_info",
-        "function_count",
-        "function_name_at",
-        "function_metadata",
-        "localize_function_name",
-        "canonicalize_function_name",
-        "external_link_count",
-        "get_external_link_at",
-        "get_external_links",
-        "save",
-        "save_as",
-        "save_with_diagnostics",
-        "read_diagnostics",
-    ]
-
-    def test_all_methods_present(self) -> None:
-        for name in self.METHODS:
-            self.assertTrue(hasattr(Workbook, name), f"Workbook missing method: {name}")
-
-    def test_public_types_exported(self) -> None:
-        for name in (
-            "MergeRange",
-            "Comment",
-            "Hyperlink",
-            "DataValidation",
-            "DataValidationInput",
-            "SheetProtection",
-            "SheetView",
-            "ConditionalFormat",
-            "ConditionalFormatInput",
-            "CfMatch",
-            "CfCellResult",
-            "CellNode",
-            "SpillInfo",
-            "FunctionMetadata",
-            "CellXf",
-            "ColorSpec",
-            "FontRecord",
-            "FillRecord",
-            "CellStyle",
-            "ExternalLink",
-            "PivotCell",
-            "PivotLayout",
-            "PivotFieldSpec",
-            "PivotDataFieldSpec",
-            "PivotFilterSpec",
-            "CalcMode",
-            "PivotAxis",
-            "PivotAggregation",
-            "MergedFunctionMetadata",
-            "merge_function_metadata",
-        ):
-            self.assertTrue(hasattr(formulon, name), f"formulon missing: {name}")
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/packages/python/tests/test_surface_catalog.py b/packages/python/tests/test_surface_catalog.py
new file mode 100644
index 000000000..cc5a71063
--- /dev/null
+++ b/packages/python/tests/test_surface_catalog.py
@@ -0,0 +1,107 @@
+"""Function catalog surface tests."""
+
+from __future__ import annotations
+
+import json
+import unittest
+from pathlib import Path
+
+import formulon
+from formulon import (
+    Workbook,
+)
+
+
+class FunctionCatalogTests(unittest.TestCase):
+    def test_catalog_metadata(self) -> None:
+        self.assertGreater(Workbook.function_count(), 0)
+        meta = Workbook.function_metadata("SUM", 0)
+        self.assertIsNotNone(meta)
+        self.assertEqual(meta.name, "SUM")
+        self.assertGreaterEqual(meta.min_arity, 1)
+        # SUM is an unbounded variadic; the sentinel is normalized to None.
+        self.assertIsNone(meta.max_arity)
+        # Lazy-dispatch forms (not in the eager registry) still resolve.
+        xlookup = Workbook.function_metadata("XLOOKUP", 0)
+        self.assertIsNotNone(xlookup)
+        self.assertEqual(xlookup.name, "XLOOKUP")
+        names = {Workbook.function_name_at(i) for i in range(Workbook.function_count())}
+        self.assertIn("XLOOKUP", names)
+        self.assertIsNone(Workbook.function_metadata("NOT_A_REAL_FUNCTION", 0))
+
+    def test_function_name_at(self) -> None:
+        name = Workbook.function_name_at(0)
+        self.assertIsInstance(name, str)
+        self.assertGreater(len(name), 0)
+
+    def test_merge_function_metadata(self) -> None:
+        base = Workbook.function_metadata("XLOOKUP", 0)
+        self.assertIsNotNone(base)
+        # The engine leaves display metadata empty.
+        self.assertIsNone(base.signature_template)
+        self.assertIsNone(base.description)
+
+        entry = {
+            "signature": "XLOOKUP(lookup_value, lookup_array, return_array)",
+            "description": "Searches a range or an array.",
+            "aliases": {"fr-FR": "RECHERCHEX"},
+            "localized": {"fr-FR": {"signature": "RECHERCHEX(...)", "description": "Recherche."}},
+        }
+
+        # Localized override wins for the matching locale.
+        fr = formulon.merge_function_metadata(base, entry, "fr-FR")
+        self.assertEqual(fr.signature_template, "RECHERCHEX(...)")
+        self.assertEqual(fr.description, "Recherche.")
+        self.assertEqual(fr.localized_name, "RECHERCHEX")
+        # Structural fields survive the merge.
+        self.assertEqual(fr.name, "XLOOKUP")
+
+        # A locale with no localized/alias entry falls back to the default
+        # signature/description and the canonical display name.
+        de = formulon.merge_function_metadata(base, entry, "de-DE")
+        self.assertEqual(
+            de.signature_template,
+            "XLOOKUP(lookup_value, lookup_array, return_array)",
+        )
+        self.assertEqual(de.description, "Searches a range or an array.")
+        self.assertEqual(de.localized_name, "XLOOKUP")
+
+        # No provider entry -> base returned verbatim; display metadata NULL.
+        none = formulon.merge_function_metadata(base, None, "fr-FR")
+        self.assertIs(none, base)
+        self.assertIsNone(none.signature_template)
+        self.assertIsNone(none.description)
+
+    def test_shipped_example_document_conforms_to_the_engine(self) -> None:
+        """The example provider document must stay usable against this engine.
+
+        ``docs/examples/function-metadata.example.json`` is offered as a
+        ready-to-use starting point, but nothing else loads it, so a
+        function rename or a schema change would leave a broken example
+        shipped in the docs. Checking it here also pins the two claims the
+        schema doc makes about the keys -- canonical, uppercase, English --
+        against the engine that decides what canonical means.
+        """
+        path = Path(__file__).resolve().parents[3] / "docs" / "examples" / "function-metadata.example.json"
+        document = json.loads(path.read_text(encoding="utf-8"))
+        self.assertEqual(document["version"], 1)
+        functions = document["functions"]
+        self.assertTrue(functions, "the example document declares no functions")
+
+        for name, entry in functions.items():
+            self.assertEqual(name, name.upper(), f"{name} is not an uppercase key")
+            base = Workbook.function_metadata(name, 0)
+            self.assertIsNotNone(base, f"{name} is not a function this engine knows")
+            self.assertEqual(base.name, name, f"{name} is not the canonical spelling")
+            # Merging must actually reach the entry: an alias-only entry
+            # (VLOOKUP here) still has to resolve its display name, which is
+            # what distinguishes a real merge from returning `base` verbatim.
+            for locale in sorted(set(entry.get("aliases", {})) | set(entry.get("localized", {}))):
+                merged = formulon.merge_function_metadata(base, entry, locale)
+                self.assertEqual(merged.name, name)
+                alias = entry.get("aliases", {}).get(locale)
+                self.assertEqual(merged.localized_name, alias if alias is not None else name)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_cell_geometry_display.py b/packages/python/tests/test_surface_cell_geometry_display.py
new file mode 100644
index 000000000..aceb5b772
--- /dev/null
+++ b/packages/python/tests/test_surface_cell_geometry_display.py
@@ -0,0 +1,242 @@
+"""Cell geometry, formula read-back, range enumeration and display-text surface tests."""
+
+from __future__ import annotations
+
+import unittest
+
+from formulon import CellXf, FormulonError, Value, ValueKind, Workbook
+from formulon.workbook import (
+    DisplayStatus,
+    GeometryMode,
+    MergeRange,
+    SheetFormatDefaults,
+)
+
+
+class GeometryTests(unittest.TestCase):
+    def test_format_defaults_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_sheet_format_defaults(
+                0,
+                SheetFormatDefaults(
+                    default_col_width=12.5,
+                    default_row_height=18.0,
+                    base_col_width=9.0,
+                    has_default_col_width=True,
+                    has_default_row_height=True,
+                ),
+            )
+            d = wb.get_sheet_format_defaults(0)
+            self.assertEqual(d.default_col_width, 12.5)
+            self.assertEqual(d.default_row_height, 18.0)
+            self.assertEqual(d.base_col_width, 9.0)
+            self.assertTrue(d.has_default_col_width)
+            self.assertTrue(d.has_default_row_height)
+            with self.assertRaises(FormulonError):
+                wb.set_sheet_format_defaults(0, SheetFormatDefaults(default_col_width=-1.0, has_default_col_width=True))
+
+    def test_row_height_override_and_clear(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_row_height(0, 2, 30.0)
+            rows = wb.get_sheet_row_overrides(0)
+            self.assertEqual(len(rows), 1)
+            self.assertTrue(rows[0].has_height)
+            self.assertTrue(rows[0].custom_height)
+            self.assertEqual(rows[0].height, 30.0)
+            self.assertEqual(wb.get_row_height_pt(0, 2), 30.0)
+            wb.clear_row_height(0, 2)
+            self.assertEqual(wb.get_sheet_row_overrides(0), [])
+            wb.clear_row_height(0, 2)
+
+    def test_cell_rect_and_widths(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_row_height(0, 0, 20.0)
+            wb.set_row_height(0, 1, 30.0)
+            wb.set_column_width(0, 0, 0, 10.0)
+            col0 = wb.get_column_width_pt(0, 0)
+            col0_print = wb.get_column_width_pt(0, 0, GeometryMode.PRINT)
+            self.assertGreater(col0, 0.0)
+            self.assertGreater(col0_print, 0.0)
+            rect = wb.get_cell_rect_pt(0, MergeRange(0, 0, 1, 0))
+            self.assertEqual(rect.x, 0.0)
+            self.assertEqual(rect.y, 0.0)
+            self.assertEqual(rect.width, col0)
+            self.assertEqual(rect.height, 50.0)
+            below = wb.get_cell_rect_pt(0, MergeRange(2, 0, 2, 0), GeometryMode.PRINT)
+            self.assertEqual(below.y, 50.0)
+            with self.assertRaises(FormulonError):
+                wb.get_cell_rect_pt(0, MergeRange(3, 0, 1, 0))
+            with self.assertRaises(FormulonError):
+                wb.get_column_width_pt(0, 0, 9)
+
+    def test_width_model_and_conversions(self) -> None:
+        with Workbook.create_default() as wb:
+            for mode in (GeometryMode.DISPLAY, GeometryMode.PRINT):
+                model = wb.get_width_model(0, mode)
+                self.assertGreater(model.points_per_char, 0.0)
+                self.assertGreater(model.normal_font_size, 0.0)
+                self.assertTrue(model.normal_font_name)
+                self.assertEqual(model.platform, "win")
+                pt = wb.column_chars_to_pt(0, 10.0, mode)
+                self.assertAlmostEqual(wb.column_pt_to_chars(0, pt, mode), 10.0, places=6)
+                self.assertEqual(wb.column_chars_to_pt(0, 0.0, mode), 0.0)
+            with self.assertRaises(FormulonError):
+                wb.column_chars_to_pt(0, -1.0)
+
+
+class FormulaAndRangeTests(unittest.TestCase):
+    def test_get_formula_variants(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_number(0, 0, 0, 1.0)
+            wb.set_formula(0, 1, 1, "=A1+1")
+            wb.recalc()
+            self.assertEqual(wb.get_formula(0, 1, 1), "=A1+1")
+            self.assertEqual(wb.get_formula_r1c1(0, 1, 1), "R[-1]C[-1]+1")
+            self.assertIsNone(wb.get_formula(0, 0, 0))
+            self.assertIsNone(wb.get_formula_r1c1(0, 5, 5))
+            with self.assertRaises(FormulonError):
+                wb.get_formula(5, 0, 0)
+
+    def test_cells_in_range_pages(self) -> None:
+        with Workbook.create_default() as wb:
+            for r in range(5):
+                wb.set_number(0, r, 0, float(r))
+            wb.set_formula(0, 2, 1, "=A3*2")
+            wb.recalc()
+            full = MergeRange(0, 0, 9, 3)
+            cells, nxt = wb.get_cells_in_range(0, full)
+            self.assertIsNone(nxt)
+            self.assertEqual([(c.row, c.col) for c in cells], [(0, 0), (1, 0), (2, 0), (2, 1), (3, 0), (4, 0)])
+            self.assertEqual(cells[3].formula, "=A3*2")
+            self.assertEqual(cells[3].value.number, 4.0)
+            self.assertIsNone(cells[0].formula)
+
+            seen = []
+            cursor = None
+            while True:
+                page, cursor = wb.get_cells_in_range(0, full, cursor, 2)
+                self.assertLessEqual(len(page), 2)
+                seen.extend((c.row, c.col) for c in page)
+                if cursor is None:
+                    break
+            self.assertEqual(seen, [(c.row, c.col) for c in cells])
+
+            sub, _ = wb.get_cells_in_range(0, MergeRange(3, 0, 4, 0))
+            self.assertEqual([(c.row, c.col) for c in sub], [(3, 0), (4, 0)])
+            with self.assertRaises(FormulonError):
+                wb.get_cells_in_range(0, MergeRange(4, 0, 1, 0))
+
+    def test_merges_in_range(self) -> None:
+        with Workbook.create_default() as wb:
+            a = MergeRange(0, 0, 1, 1)
+            b = MergeRange(5, 5, 6, 6)
+            wb.add_merge(0, a)
+            wb.add_merge(0, b)
+            self.assertEqual(wb.get_merges_in_range(0, MergeRange(1, 1, 3, 3)), [a])
+            self.assertEqual(wb.get_merges_in_range(0, MergeRange(0, 0, 10, 10)), [a, b])
+            self.assertEqual(wb.get_merges_in_range(0, MergeRange(8, 8, 9, 9)), [])
+            with self.assertRaises(FormulonError):
+                wb.get_merges_in_range(7, a)
+
+
+class DisplayTextTests(unittest.TestCase):
+    def test_display_text_uses_number_format(self) -> None:
+        with Workbook.create_default() as wb:
+            nf = wb.add_num_fmt("0.00")
+            xf = wb.add_cell_xf(
+                CellXf(
+                    font_index=0,
+                    fill_index=0,
+                    border_index=0,
+                    num_fmt_id=nf,
+                    horizontal_align=0,
+                    vertical_align=2,
+                    wrap_text=False,
+                )
+            )
+            wb.set_number(0, 0, 0, 3.14159)
+            wb.set_cell_xf_index(0, 0, 0, xf)
+            self.assertEqual(wb.get_display_text(0, 0, 0), ("3.14", DisplayStatus.OK))
+            self.assertEqual(wb.get_display_text(0, 9, 9), ("", DisplayStatus.OK))
+            with self.assertRaises(FormulonError):
+                wb.get_display_text(3, 0, 0)
+
+    def test_format_value(self) -> None:
+        with Workbook.create_default() as wb:
+            num = Value(kind=ValueKind.NUMBER, number=1234.5)
+            self.assertEqual(wb.format_value(num, "#,##0.00"), ("1,234.50", DisplayStatus.OK))
+            self.assertEqual(wb.format_value(num), ("1234.5", DisplayStatus.OK))
+            text = Value(kind=ValueKind.TEXT, text="abc")
+            self.assertEqual(wb.format_value(text, "General"), ("abc", DisplayStatus.OK))
+            boolean = Value(kind=ValueKind.BOOL, boolean=True)
+            self.assertEqual(wb.format_value(boolean)[0], "TRUE")
+            text_out, status = wb.format_value(num, "0.00[")
+            self.assertEqual(status, DisplayStatus.INVALID_FORMAT)
+            self.assertTrue(text_out)
+            with self.assertRaises(FormulonError):
+                wb.format_value(Value(kind=ValueKind.NUMBER, number=float("nan")))
+
+
+class CellXfFlagTests(unittest.TestCase):
+    def test_apply_and_protection_flags_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            xf = wb.add_cell_xf(
+                CellXf(
+                    font_index=0,
+                    fill_index=0,
+                    border_index=0,
+                    num_fmt_id=0,
+                    horizontal_align=0,
+                    vertical_align=2,
+                    wrap_text=False,
+                    apply_number_format=True,
+                    apply_font=True,
+                    apply_protection=True,
+                    quote_prefix=True,
+                    has_protection=True,
+                    locked=False,
+                    hidden=True,
+                )
+            )
+            got = wb.get_cell_xf(xf)
+            self.assertTrue(got.apply_number_format)
+            self.assertTrue(got.apply_font)
+            self.assertFalse(got.apply_fill)
+            self.assertFalse(got.apply_border)
+            self.assertFalse(got.apply_alignment)
+            self.assertTrue(got.apply_protection)
+            self.assertTrue(got.quote_prefix)
+            self.assertTrue(got.has_protection)
+            self.assertFalse(got.locked)
+            self.assertTrue(got.hidden)
+
+
+class PaginationDetailTests(unittest.TestCase):
+    def test_pagination_detail(self) -> None:
+        with Workbook.create_default() as wb:
+            for r in range(0, 120):
+                wb.set_number(0, r, 0, float(r))
+            wb.add_row_break(0, 10, True)
+            p = wb.paginate(0)
+            self.assertGreater(p.paper.width_pt, 0.0)
+            self.assertGreater(p.paper.height_pt, 0.0)
+            self.assertTrue(p.paper.known)
+            self.assertGreater(p.margins.left, 0.0)
+            self.assertGreater(p.printable.width, 0.0)
+            self.assertGreater(p.scale, 0.0)
+            self.assertIn(p.page_order, (0, 1))
+            self.assertFalse(p.print_titles.has_rows)
+            self.assertEqual(len(p.pages), p.page_count)
+            self.assertGreater(p.page_count, 1)
+            self.assertEqual(len(p.horizontal_break_manual), len(p.horizontal_breaks))
+            self.assertEqual(len(p.vertical_break_manual), len(p.vertical_breaks))
+            self.assertIn(10, p.horizontal_breaks)
+            self.assertTrue(p.horizontal_break_manual[p.horizontal_breaks.index(10)])
+            first = p.pages[0]
+            self.assertEqual(first.first_row, 0)
+            self.assertGreater(first.width_pt, 0.0)
+            self.assertGreater(first.height_pt, 0.0)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_cf.py b/packages/python/tests/test_surface_cf.py
new file mode 100644
index 000000000..bd57bfa3f
--- /dev/null
+++ b/packages/python/tests/test_surface_cf.py
@@ -0,0 +1,217 @@
+"""Conditional-format surface tests."""
+
+from __future__ import annotations
+
+import unittest
+
+from formulon import (
+    CfColor,
+    CfValueObject,
+    ColorScale,
+    ConditionalFormatInput,
+    DataBar,
+    DifferentialFormat,
+    IconSet,
+    MergeRange,
+    Workbook,
+)
+
+
+class ConditionalFormatTests(unittest.TestCase):
+    def test_cf_add_get_evaluate_clear(self) -> None:
+        with Workbook.create_default() as wb:
+            for r in range(3):
+                wb.set_number(0, r, 0, float(r * 5))  # A1=0, A2=5, A3=10
+            # A rule's dxf_id must resolve against a registered dxf.
+            dxf_index = wb.add_dxf(DifferentialFormat())
+            wb.add_conditional_format(
+                0,
+                ConditionalFormatInput(
+                    sqref=[MergeRange(0, 0, 2, 0)],
+                    type=1,  # cellIs
+                    op_engaged=True,
+                    op=4,  # greaterThan
+                    formula1="4",
+                    dxf_id_engaged=True,
+                    dxf_id=dxf_index,
+                ),
+            )
+            rules = wb.get_conditional_formats(0)
+            self.assertEqual(len(rules), 1)
+            self.assertEqual(rules[0].type, 1)
+            self.assertEqual(rules[0].formula1, "4")
+
+            wb.recalc()
+            cells = wb.evaluate_cf_range(0, 0, 0, 2, 0)
+            matched = {(c.row, c.col) for c in cells if c.matches}
+            # A2 (=5) and A3 (=10) exceed 4; A1 (=0) does not.
+            self.assertIn((1, 0), matched)
+            self.assertIn((2, 0), matched)
+            self.assertNotIn((0, 0), matched)
+
+            wb.clear_conditional_formats(0)
+            self.assertEqual(wb.get_conditional_formats(0), [])
+
+    def test_visual_rules_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            rules = [
+                ConditionalFormatInput(
+                    sqref=[MergeRange(0, 0, 2, 0)],
+                    type=2,
+                    color_scale=ColorScale(
+                        [CfValueObject(3), CfValueObject(4)],
+                        [CfColor(255, 0, 0), CfColor(0, 255, 0)],
+                    ),
+                ),
+                ConditionalFormatInput(
+                    sqref=[MergeRange(0, 1, 2, 1)],
+                    type=3,
+                    data_bar=DataBar(CfValueObject(3), CfValueObject(4), CfColor(0, 0, 255)),
+                ),
+                ConditionalFormatInput(
+                    sqref=[MergeRange(0, 2, 2, 2)],
+                    type=4,
+                    icon_set=IconSet(0, [CfValueObject(1, "33"), CfValueObject(1, "67")]),
+                ),
+            ]
+            for rule in rules:
+                wb.add_conditional_format(0, rule)
+            got = wb.get_conditional_formats(0)
+            self.assertEqual(got[0].color_scale.colors[1], CfColor(0, 255, 0))
+            self.assertEqual(got[1].data_bar.fill, CfColor(0, 0, 255))
+            self.assertEqual(got[2].icon_set.thresholds[1].value, "67")
+
+    # `CfValueObject.type`: 0 num, 1 percent, 2 percentile, 3 min, 4 max,
+    # 5 formula, 6 autoMin, 7 autoMax. Every threshold below states a
+    # `value`, which is what puts a borrowed string behind each CFVO.
+    EXPECTED_CFVO_VALUES = ["0", "50", "100", "5", "95", "0", "33", "67"]
+
+    @staticmethod
+    def _cfvo_rules() -> list[ConditionalFormatInput]:
+        """Build one color-scale, one data-bar and one icon-set rule."""
+        return [
+            ConditionalFormatInput(
+                sqref=[MergeRange(0, 0, 4, 0)],
+                type=2,
+                color_scale=ColorScale(
+                    [CfValueObject(0, "0"), CfValueObject(1, "50"), CfValueObject(0, "100")],
+                    [CfColor(248, 105, 107), CfColor(255, 235, 132), CfColor(99, 190, 123)],
+                ),
+            ),
+            ConditionalFormatInput(
+                sqref=[MergeRange(0, 1, 4, 1)],
+                type=3,
+                data_bar=DataBar(CfValueObject(0, "5"), CfValueObject(0, "95"), CfColor(0, 112, 192)),
+            ),
+            ConditionalFormatInput(
+                sqref=[MergeRange(0, 2, 4, 2)],
+                type=4,
+                icon_set=IconSet(0, [CfValueObject(1, "0"), CfValueObject(1, "33"), CfValueObject(1, "67")]),
+            ),
+        ]
+
+    @staticmethod
+    def _cfvo_values(rules: list) -> list[str]:
+        """Flatten the threshold value strings of the three visual rules."""
+        by_type = {rule.type: rule for rule in rules}
+        color_scale = by_type[2].color_scale
+        data_bar = by_type[3].data_bar
+        icon_set = by_type[4].icon_set
+        return (
+            [t.value for t in color_scale.thresholds]
+            + [data_bar.minimum.value, data_bar.maximum.value]
+            + [t.value for t in icon_set.thresholds]
+        )
+
+    def test_cfvo_value_strings_survive_read_back_and_a_save_load_cycle(self) -> None:
+        # Each CFVO `value` crosses the C ABI as a borrowed `const char*`.
+        # A store that relocates while the later thresholds are pulled
+        # publishes a pointer into freed bytes, so the strings come back
+        # wrong or empty even though the rule count and colors look right.
+        with Workbook.create_default() as wb:
+            for rule in self._cfvo_rules():
+                wb.add_conditional_format(0, rule)
+
+            in_session = wb.get_conditional_formats(0)
+            self.assertEqual(len(in_session), 3)
+            self.assertEqual(self._cfvo_values(in_session), self.EXPECTED_CFVO_VALUES)
+            by_type = {rule.type: rule for rule in in_session}
+            # The type travels with the value: a percent threshold read
+            # back as type 0 would mean an absolute number instead.
+            self.assertEqual([t.type for t in by_type[2].color_scale.thresholds], [0, 1, 0])
+            self.assertEqual([t.type for t in by_type[4].icon_set.thresholds], [1, 1, 1])
+            self.assertEqual(by_type[2].color_scale.colors[2], CfColor(99, 190, 123))
+            self.assertEqual(by_type[3].data_bar.fill, CfColor(0, 112, 192))
+            saved = wb.save()
+
+        with Workbook.load(saved) as reloaded:
+            rules = reloaded.get_conditional_formats(0)
+            self.assertEqual(len(rules), 3)
+            self.assertEqual(self._cfvo_values(rules), self.EXPECTED_CFVO_VALUES)
+
+    def test_data_bar_x14_fields_survive_save_and_load(self) -> None:
+        # These six live in the `x14` extension, not the legacy `<dataBar>`
+        # element. An in-session round-trip alone would not catch a writer
+        # that never emits the extension, which is how they were lost
+        # before: the values came back from the model and disappeared on
+        # the way through the file.
+        bar = DataBar(
+            CfValueObject(3),
+            CfValueObject(4),
+            CfColor(0, 0, 255),
+            gradient=False,
+            axis_position=1,
+            negative_fill=CfColor(255, 0, 0),
+            border=CfColor(9, 9, 9),
+            negative_border=CfColor(8, 8, 8),
+            axis_color=CfColor(1, 2, 3),
+            direction=2,
+        )
+        with Workbook.create_default() as wb:
+            wb.add_conditional_format(0, ConditionalFormatInput(sqref=[MergeRange(0, 0, 2, 0)], type=3, data_bar=bar))
+            saved = wb.save()
+
+        with Workbook.load(saved) as reloaded:
+            got = reloaded.get_conditional_formats(0)[0].data_bar
+            self.assertIs(got.gradient, False)
+            self.assertEqual(got.axis_position, 1)
+            self.assertEqual(got.negative_fill, CfColor(255, 0, 0))
+            self.assertEqual(got.border, CfColor(9, 9, 9))
+            self.assertEqual(got.negative_border, CfColor(8, 8, 8))
+            self.assertEqual(got.axis_color, CfColor(1, 2, 3))
+            self.assertEqual(got.direction, 2)
+            # Feeding the decoded bar straight back must reproduce it.
+            reloaded.add_conditional_format(
+                0, ConditionalFormatInput(sqref=[MergeRange(4, 0, 6, 0)], type=3, data_bar=got)
+            )
+            self.assertEqual(reloaded.get_conditional_formats(0)[1].data_bar, got)
+
+    def test_icon_set_floor_survives_save_and_load(self) -> None:
+        icons = IconSet(2, [CfValueObject(0, "7"), CfValueObject(0, "9")], floor=CfValueObject(0, "5", gte=False))
+        with Workbook.create_default() as wb:
+            wb.add_conditional_format(0, ConditionalFormatInput(sqref=[MergeRange(0, 0, 9, 0)], type=4, icon_set=icons))
+            saved = wb.save()
+        with Workbook.load(saved) as reloaded:
+            got = reloaded.get_conditional_formats(0)[0].icon_set
+            self.assertEqual(got.floor, CfValueObject(0, "5", gte=False))
+
+    def test_omitted_data_bar_x14_fields_keep_the_model_defaults(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.add_conditional_format(
+                0,
+                ConditionalFormatInput(
+                    sqref=[MergeRange(0, 0, 2, 0)],
+                    type=3,
+                    data_bar=DataBar(CfValueObject(3), CfValueObject(4), CfColor(0, 0, 255)),
+                ),
+            )
+            got = wb.get_conditional_formats(0)[0].data_bar
+            # The getter engages all six, so they read back as the defaults
+            # rather than as `None`.
+            self.assertIs(got.gradient, True)
+            self.assertEqual(got.axis_position, 0)
+            self.assertEqual(got.negative_fill, CfColor(0, 0, 255))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_core.py b/packages/python/tests/test_surface_core.py
new file mode 100644
index 000000000..6e53ede75
--- /dev/null
+++ b/packages/python/tests/test_surface_core.py
@@ -0,0 +1,287 @@
+"""Core Workbook surface tests."""
+
+from __future__ import annotations
+
+import inspect
+import subprocess
+import unittest
+from pathlib import Path
+
+from formulon import (
+    CalcMode,
+    CivilTime,
+    FormulonError,
+    ValueKind,
+    Workbook,
+    _c,
+)
+from formulon import _structs as S
+
+
+class StructLayoutTests(unittest.TestCase):
+    """Guards against silent field-reorder breakage in _structs.py."""
+
+    # One pinned wasm32 size per `Struct` in `_structs.py`. The values are
+    # deliberately literal rather than derived -- a derived table would agree
+    # with any layout and assert nothing. What binds them to the C header is
+    # `python-struct-layouts` below; this table's job is to make a silent
+    # *size* change loud, and `test_every_struct_has_a_pinned_size` is what
+    # stops a new struct from opting out by simply not being listed.
+    EXPECTED_SIZES = {
+        "MERGE_RANGE": 16,
+        "HYPERLINK": 32,
+        "COMMENT": 16,
+        "DATA_VALIDATION": 52,
+        "SHEET_PROTECTION": 88,
+        "VIEWPORT": 20,
+        "CELL_NODE": 12,
+        "PHONETIC_RUN": 12,
+        "CFVO": 12,
+        "CF_CELL_RANGE": 16,
+        "CF_COLOR": 4,
+        "CF_MATCH": 72,
+        "CF_RULE": 240,
+        "PIVOT_CELL": 40,
+        "PIVOT_FIELD_SPEC": 20,
+        "PIVOT_DATA_FIELD_SPEC": 28,
+        "PIVOT_FILTER_SPEC": 64,
+        "READ_DIAGNOSTICS": 20,
+        "SAVE_DIAGNOSTICS": 20,
+        "SPILL_INFO": 20,
+        "FUNCTION_METADATA": 24,
+        "CIVIL_TIME": 24,
+        "SHEET_VIEW": 44,
+        "COLUMN_LAYOUT": 40,
+        "ROW_LAYOUT": 40,
+        "CELL_XF": 128,
+        "COLOR_SPEC": 24,
+        "FONT_RECORD": 88,
+        "FILL_RECORD": 64,
+        "BORDER_SIDE": 32,
+        "BORDER_RECORD": 168,
+        "DXF_RECORD": 368,
+        # Fifteen pointer-or-`size_t` fields; both are four bytes on
+        # wasm32, so the whole record is 15 x 4.
+        "STYLES_BATCH": 60,
+        "CELL_STYLE_RECORD": 24,
+        "EXTERNAL_LINK_RECORD": 24,
+        "PAGE_BREAK": 16,
+        "PAGE_SETUP": 48,
+        # Six `double`s, each preceded by an `int32` flag: the flag's four
+        # bytes of tail padding are what makes this 96 rather than 72.
+        "PAGE_MARGINS": 96,
+        "PRINT_OPTIONS": 32,
+        "HEADER_FOOTER": 56,
+        "SHEET_FORMAT_DEFAULTS": 32,
+        "RECT_PT": 32,
+        "WIDTH_MODEL": 40,
+        "PAPER_INFO": 24,
+        "MARGINS_PT": 48,
+        "PRINT_TITLES": 24,
+        # Five `uint32`s, then four tail-aligned `double`s.
+        "PAGE_LAYOUT": 56,
+        "THEME_COLORS": 48,
+        "THEME_FONTS": 16,
+        "EFFECTIVE_STYLE": 96,
+        "DATE_GROUP_ITEM": 8,
+        "FILTER_COLUMN": 152,
+        # An inline `fm_merge_range` (16 bytes) leads the record.
+        "SORT_CONDITION": 48,
+        "AUTO_FILTER": 64,
+        "VALIDATION_OUTCOME": 16,
+        "MENTION": 16,
+        "THREADED_COMMENT": 40,
+        "PERSON": 16,
+        "IMAGE_INFO": 12,
+        "DRAWING_OBJECT": 96,
+        "IMAGE_INSERT": 56,
+    }
+
+    def test_struct_sizes(self) -> None:
+        for name, expected in self.EXPECTED_SIZES.items():
+            layout = getattr(S, name)
+            self.assertEqual(layout.size, expected, f"{name} size drifted to {layout.size}")
+
+    def test_every_struct_has_a_pinned_size(self) -> None:
+        """No `Struct` may be absent from ``EXPECTED_SIZES``.
+
+        Without this the table degrades quietly: a struct added to
+        ``_structs.py`` and never listed here is not size-pinned, and nothing
+        says so. Both directions are checked so a removed struct cannot leave
+        a stale entry behind either.
+        """
+        declared = {name for name, value in vars(S).items() if isinstance(value, S.Struct)}
+        pinned = set(self.EXPECTED_SIZES)
+        self.assertEqual(
+            declared,
+            pinned,
+            f"not size-pinned: {sorted(declared - pinned)}; stale entries: {sorted(pinned - declared)}",
+        )
+
+    def test_pivot_cell_value_offset(self) -> None:
+        self.assertEqual(S.PIVOT_CELL_VALUE_OFFSET, 8)
+
+    # Records the wrapper marshals without a `Struct` entry, so they are
+    # invisible to `EXPECTED_SIZES` above. `fm_value_t` is passed around as
+    # the bare `fm_value_t_size` and as `VALUE_BLOB` when it sits inline in a
+    # larger record; `fm_print_range_t` is the literal 16 in
+    # `Workbook.paginate`. `python-inline-structs` binds these to the C
+    # header; pinning them here makes a size change loud on its own.
+    def test_hand_marshalled_record_sizes(self) -> None:
+        self.assertEqual(_c.fm_value_t_size, 16)
+        self.assertEqual(S.VALUE_BLOB, ("blob16", 16, 8))
+        source = inspect.getsource(Workbook.paginate)
+        self.assertIn('struct.unpack("<IIII", LIB.read_bytes(range_ptr, 16))', source)
+
+    def test_layouts_match_c_header(self) -> None:
+        """Every binding-drift check that reads the Python package.
+
+        Run as a group: the struct-layout check covers the `Struct` table,
+        the call-signature check covers what the wrapper passes to each
+        `fm_*` entry point, and the inline-struct check covers the records
+        decoded with a bare `struct.unpack`. A failure in any of them is a
+        Python-side ABI mismatch and belongs in this suite's result.
+        """
+        root = Path(__file__).resolve().parents[3]
+        for check in ("python-struct-layouts", "python-call-signatures", "python-inline-structs"):
+            with self.subTest(check=check):
+                result = subprocess.run(
+                    ["python3", str(root / "tools" / "dev" / "check_binding_drift.py"), check],
+                    cwd=root,
+                    text=True,
+                    capture_output=True,
+                    check=False,
+                )
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+
+class AdHocArrayEvalTests(unittest.TestCase):
+    def test_sequence_matrix_preserves_all_cells(self) -> None:
+        with Workbook.create_default() as wb:
+            grid = wb.evaluate_formula_array(0, 0, 0, "=SEQUENCE(2,3)")
+            self.assertEqual(len(grid), 2)
+            self.assertEqual(len(grid[0]), 3)
+            # Row-major 1..6.
+            self.assertEqual(grid[0][0].to_python(), 1.0)
+            self.assertEqual(grid[1][2].to_python(), 6.0)
+
+    def test_scalar_reported_as_one_by_one(self) -> None:
+        with Workbook.create_default() as wb:
+            grid = wb.evaluate_formula_array(0, 0, 0, "=1+2")
+            self.assertEqual(len(grid), 1)
+            self.assertEqual(len(grid[0]), 1)
+            self.assertEqual(grid[0][0].kind, ValueKind.NUMBER)
+            self.assertEqual(grid[0][0].to_python(), 3.0)
+
+
+class DefinedNameTests(unittest.TestCase):
+    def test_defined_name_set_get_remove(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_defined_name("MyRef", "Sheet1!$A$1")
+            names = {dn.name: dn.formula for dn in wb.iter_defined_names()}
+            self.assertIn("MyRef", names)
+            self.assertEqual(names["MyRef"], "Sheet1!$A$1")
+
+            # Updating in place replaces the formula text.
+            wb.set_defined_name("MyRef", "Sheet1!$B$2")
+            names = {dn.name: dn.formula for dn in wb.iter_defined_names()}
+            self.assertEqual(names["MyRef"], "Sheet1!$B$2")
+
+            # An empty formula removes the entry.
+            wb.set_defined_name("MyRef", "")
+            self.assertNotIn("MyRef", {dn.name for dn in wb.iter_defined_names()})
+
+    def test_scoped_defined_name_set_get_remove(self) -> None:
+        with Workbook.create_empty() as wb:
+            wb.add_sheet("Sheet1")
+            wb.add_sheet("Sheet2")
+            wb.set_defined_name("Rate", "=1")
+            wb.set_defined_name_scoped("Rate", "=2", 1)
+            names = {(dn.name, dn.local_sheet_id): dn.formula for dn in wb.iter_defined_names()}
+            self.assertEqual(names[("Rate", -1)], "=1")
+            self.assertEqual(names[("Rate", 1)], "=2")
+
+            wb.set_defined_name_scoped("Rate", "", 1)
+            self.assertNotIn(
+                ("Rate", 1),
+                {(dn.name, dn.local_sheet_id) for dn in wb.iter_defined_names()},
+            )
+
+
+class CalcPolicyTests(unittest.TestCase):
+    def test_calc_mode_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            self.assertEqual(wb.calc_mode(), CalcMode.AUTO)
+            wb.set_calc_mode(CalcMode.MANUAL)
+            self.assertEqual(wb.calc_mode(), CalcMode.MANUAL)
+
+    def test_pinned_now_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            # Unpinned by default: the workbook follows the host clock.
+            self.assertIsNone(wb.pinned_now())
+            wb.set_pinned_now(2026, 4, 23, 15, 30, 45)
+            self.assertEqual(wb.pinned_now(), CivilTime(2026, 4, 23, 15, 30, 45))
+            # 2026-04-23 is serial 46135 under the 1900 date system.
+            grid = wb.evaluate_formula_array(0, 0, 0, "=TODAY()")
+            self.assertEqual(grid[0][0].number, 46135.0)
+            wb.clear_pinned_now()
+            self.assertIsNone(wb.pinned_now())
+
+    def test_pinned_now_rejects_a_non_calendar_instant(self) -> None:
+        with Workbook.create_default() as wb:
+            # The pin is a calendar instant, not a normalising constructor.
+            with self.assertRaises(FormulonError):
+                wb.set_pinned_now(2026, 13, 1)
+            with self.assertRaises(FormulonError):
+                wb.set_pinned_now(2025, 2, 29)
+            self.assertIsNone(wb.pinned_now())
+
+    def test_excel_profile_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            self.assertTrue(wb.excel_profile_id())
+            wb.set_excel_profile_id("mac-365-ja_JP")
+            self.assertEqual(wb.excel_profile_id(), "mac-365-ja_JP")
+
+
+class PartialRecalcTests(unittest.TestCase):
+    def test_partial_recalc_recomputes_chain(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_number(0, 0, 0, 10.0)  # A1
+            wb.set_formula(0, 0, 1, "=A1*2")  # B1
+            recomputed = wb.partial_recalc(0, 0, 0, 1, 1)
+            self.assertGreater(recomputed, 0)
+            self.assertEqual(wb.get_value(0, 0, 1).to_python(), 20.0)
+
+
+class TraceTests(unittest.TestCase):
+    def test_precedents_and_dependents(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_number(0, 0, 0, 1.0)  # A1
+            wb.set_formula(0, 0, 1, "=A1")  # B1
+            wb.recalc()
+            prec = wb.precedents(0, 0, 1, 1)
+            self.assertIn((0, 0, 0), [(p.sheet, p.row, p.col) for p in prec])
+            deps = wb.dependents(0, 0, 0, 1)
+            self.assertIn((0, 0, 1), [(d.sheet, d.row, d.col) for d in deps])
+
+
+class SpillTests(unittest.TestCase):
+    def test_sequence_spills(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_formula(0, 0, 0, "=SEQUENCE(3)")
+            wb.recalc()
+            info = wb.spill_info(0, 0, 0)
+            self.assertTrue(info.engaged)
+            self.assertEqual(info.rows, 3)
+            self.assertEqual((info.anchor_row, info.anchor_col), (0, 0))
+
+
+class ExternalLinkTests(unittest.TestCase):
+    def test_fresh_workbook_has_no_external_links(self) -> None:
+        with Workbook.create_default() as wb:
+            self.assertEqual(wb.external_link_count(), 0)
+            self.assertEqual(wb.get_external_links(), [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_diagnostics.py b/packages/python/tests/test_surface_diagnostics.py
new file mode 100644
index 000000000..e734fd77a
--- /dev/null
+++ b/packages/python/tests/test_surface_diagnostics.py
@@ -0,0 +1,152 @@
+"""Package diagnostics surface tests."""
+
+from __future__ import annotations
+
+import struct
+import unittest
+from unittest import mock
+
+import formulon
+from formulon import (
+    ConditionalFormatInput,
+    DataValidationInput,
+    MergeRange,
+    ReadDiagnostics,
+    SaveDiagnostics,
+    Workbook,
+    WorkbookFormat,
+)
+
+
+def _append_empty_zip_entry(data: bytes, name: str) -> bytes:
+    """Add one deterministic, empty stored entry without recompressing XLSB."""
+    eocd = data.rfind(b"PK\x05\x06")
+    if eocd < 0:
+        raise AssertionError("missing ZIP end record")
+    _disk_count, count, central_size, central_offset = struct.unpack_from("<HHII", data, eocd + 8)
+    encoded_name = name.encode("utf-8")
+    local = struct.pack("<IHHHHHIIIHH", 0x04034B50, 20, 0, 0, 0, 0, 0, 0, 0, len(encoded_name), 0) + encoded_name
+    central = (
+        struct.pack(
+            "<IHHHHHHIIIHHHHHII",
+            0x02014B50,
+            20,
+            20,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            len(encoded_name),
+            0,
+            0,
+            0,
+            0,
+            0,
+            central_offset,
+        )
+        + encoded_name
+    )
+    new_eocd = struct.pack(
+        "<IHHHHIIH",
+        0x06054B50,
+        0,
+        0,
+        count + 1,
+        count + 1,
+        central_size + len(central),
+        central_offset + len(local),
+        0,
+    )
+    return data[:central_offset] + local + data[central_offset : central_offset + central_size] + central + new_eocd
+
+
+class PackageDiagnosticsTests(unittest.TestCase):
+    def test_unknown_save_format_raises_formulon_error(self) -> None:
+        with Workbook.create_default() as wb:
+            with self.assertRaises(formulon.FormulonError) as ctx:
+                wb.save_with_diagnostics(WorkbookFormat.UNKNOWN)
+            self.assertIn("unsupported format", str(ctx.exception))
+
+    def test_save_and_read_diagnostics_report_every_counter(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_formula(0, 0, 0, "=SUM(T[C])")
+            wb.add_validation(
+                0,
+                DataValidationInput(
+                    type=3,
+                    ranges=[MergeRange(0, 0, 0, 0)],
+                    formula1='"Yes,No"',
+                ),
+            )
+            wb.add_conditional_format(
+                0,
+                ConditionalFormatInput(
+                    sqref=[MergeRange(0, 0, 0, 0)],
+                    type=1,
+                    op_engaged=True,
+                    op=5,
+                    formula1="10",
+                ),
+            )
+
+            xlsx = wb.save_with_diagnostics(WorkbookFormat.XLSX)
+            self.assertIsInstance(xlsx, SaveDiagnostics)
+            self.assertIsInstance(xlsx.bytes, bytes)
+            self.assertEqual(xlsx.downgraded_formula_count, 0)
+            self.assertEqual(xlsx.deferred_feature_count, 0)
+            self.assertEqual(xlsx.dropped_part_count, 0)
+            self.assertEqual(xlsx.dropped_relationship_count, 0)
+            self.assertEqual(xlsx.renumbered_part_count, 0)
+
+            xlsb = wb.save_with_diagnostics(WorkbookFormat.XLSB)
+            self.assertEqual(xlsb.downgraded_formula_count, 1)
+            # The validation and the CF rule (no dxf) are both written.
+            self.assertEqual(xlsb.deferred_feature_count, 0)
+            # The binary writer never reassigns a part id.
+            self.assertEqual(xlsb.renumbered_part_count, 0)
+
+            # `save_as` remains a plain bytes return value.
+            self.assertIsInstance(wb.save_as(WorkbookFormat.XLSB), bytes)
+
+            with Workbook.load(xlsb.bytes) as loaded:
+                read = loaded.read_diagnostics()
+                self.assertIsInstance(read, ReadDiagnostics)
+                self.assertEqual(read.undecoded_formula_count, 0)
+                self.assertEqual(read.undecoded_defined_name_count, 0)
+                self.assertEqual(read.undecoded_part_count, 0)
+                self.assertEqual(read.skipped_feature_count, 0)
+                self.assertEqual(read.unknown_content_type_count, 0)
+
+            with Workbook.load(_append_empty_zip_entry(xlsb.bytes, "xl/preserved.bin")) as preserved_loaded:
+                preserved = preserved_loaded.read_diagnostics()
+                self.assertEqual(preserved.undecoded_part_count, 0)
+
+    def test_diagnostic_scratch_is_freed_when_a_later_allocation_fails(self) -> None:
+        # `save_with_diagnostics` takes three blocks (two out-pointers plus the
+        # counter struct). If the second allocation raises, the first must
+        # still be released rather than leaked into the WASM heap.
+        with Workbook.create_default() as wb:
+            original_alloc = formulon.workbook.LIB.alloc
+            calls = 0
+
+            def alloc_then_fail(size: int) -> int:
+                nonlocal calls
+                calls += 1
+                if calls == 2:
+                    raise RuntimeError("synthetic allocation failure")
+                return original_alloc(size)
+
+            with (
+                mock.patch.object(formulon.workbook.LIB, "alloc", side_effect=alloc_then_fail),
+                mock.patch.object(formulon.workbook.LIB, "free", wraps=formulon.workbook.LIB.free) as free,
+            ):
+                with self.assertRaises(RuntimeError):
+                    wb.save_with_diagnostics(WorkbookFormat.XLSB)
+            self.assertEqual(free.call_count, 1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_drawing.py b/packages/python/tests/test_surface_drawing.py
new file mode 100644
index 000000000..07c8d4bc3
--- /dev/null
+++ b/packages/python/tests/test_surface_drawing.py
@@ -0,0 +1,117 @@
+"""Drawing-image surface tests: probe, insert, list, get, round trip and remove."""
+
+from __future__ import annotations
+
+import struct
+import unittest
+import zlib
+
+from formulon import (
+    AnchorEditAs,
+    AnchorKind,
+    DrawingObjectKind,
+    FormulonError,
+    ImageFormat,
+    ImageInfo,
+    Workbook,
+)
+
+
+def _png(width: int, height: int) -> bytes:
+    """Build a minimal valid RGB PNG of the given size."""
+
+    def chunk(tag: bytes, body: bytes) -> bytes:
+        return struct.pack(">I", len(body)) + tag + body + struct.pack(">I", zlib.crc32(tag + body))
+
+    rows = b"".join(b"\x00" + b"\xff\x00\x00" * width for _ in range(height))
+    return (
+        b"\x89PNG\r\n\x1a\n"
+        + chunk(b"IHDR", struct.pack(">IIBBBBB", width, height, 8, 2, 0, 0, 0))
+        + chunk(b"IDAT", zlib.compress(rows))
+        + chunk(b"IEND", b"")
+    )
+
+
+class DrawingEnumTests(unittest.TestCase):
+    def test_ordinals_match_the_c_header(self) -> None:
+        self.assertEqual((ImageFormat.PNG, ImageFormat.JPEG, ImageFormat.GIF, ImageFormat.BMP), (1, 2, 3, 4))
+        self.assertEqual((DrawingObjectKind.PICTURE, DrawingObjectKind.OTHER), (0, 6))
+        self.assertEqual((AnchorKind.ONE_CELL, AnchorKind.TWO_CELL, AnchorKind.ABSOLUTE), (0, 1, 2))
+        self.assertEqual((AnchorEditAs.TWO_CELL, AnchorEditAs.ONE_CELL, AnchorEditAs.ABSOLUTE), (0, 1, 2))
+
+
+class DrawingImageTests(unittest.TestCase):
+    def test_probe_image(self) -> None:
+        wb = Workbook.create_default()
+        try:
+            self.assertEqual(wb.probe_image(_png(3, 2)), ImageInfo(ImageFormat.PNG, 3, 2))
+            with self.assertRaises(FormulonError):
+                wb.probe_image(b"not an image")
+        finally:
+            wb.close()
+
+    def test_insert_list_get_save_load_remove(self) -> None:
+        png = _png(4, 3)
+        wb = Workbook.create_default()
+        try:
+            self.assertEqual(wb.list_drawing_objects(0), [])
+            oid = wb.insert_image(0, png, name="logo", descr="a logo", row=2, col=1, row_off_emu=100)
+            objs = wb.list_drawing_objects(0)
+            self.assertEqual(len(objs), 1)
+            obj = objs[0]
+            self.assertEqual(obj.object_id, oid)
+            self.assertEqual(obj.kind, DrawingObjectKind.PICTURE)
+            self.assertEqual(obj.anchor_kind, AnchorKind.ONE_CELL)
+            self.assertEqual((obj.from_row, obj.from_col, obj.from_row_off), (2, 1, 100))
+            self.assertEqual((obj.cx, obj.cy), (4 * 9525, 3 * 9525))
+            self.assertEqual((obj.name, obj.descr), ("logo", "a logo"))
+            self.assertEqual(obj.image_format, ImageFormat.PNG)
+            self.assertTrue(obj.media_path)
+            self.assertEqual(wb.get_image(0, oid), png)
+
+            loaded = Workbook.load(wb.save())
+            try:
+                again = loaded.list_drawing_objects(0)
+                self.assertEqual(len(again), 1)
+                self.assertEqual((again[0].name, again[0].cx, again[0].cy), ("logo", 4 * 9525, 3 * 9525))
+                self.assertEqual(loaded.get_image(0, again[0].object_id), png)
+            finally:
+                loaded.close()
+
+            wb.remove_image(0, oid)
+            self.assertEqual(wb.list_drawing_objects(0), [])
+            with self.assertRaises(FormulonError):
+                wb.remove_image(0, oid)
+        finally:
+            wb.close()
+
+    def test_two_cell_anchor_and_explicit_size(self) -> None:
+        wb = Workbook.create_default()
+        try:
+            wb.insert_image(
+                0,
+                _png(2, 2),
+                anchor_kind=AnchorKind.TWO_CELL,
+                edit_as=AnchorEditAs.ONE_CELL,
+                width_emu=1_000_000,
+                height_emu=2_000_000,
+            )
+            obj = wb.list_drawing_objects(0)[0]
+            self.assertEqual((obj.anchor_kind, obj.edit_as), (AnchorKind.TWO_CELL, AnchorEditAs.ONE_CELL))
+            self.assertEqual((obj.cx, obj.cy), (1_000_000, 2_000_000))
+        finally:
+            wb.close()
+
+    def test_invalid_inputs_raise(self) -> None:
+        wb = Workbook.create_default()
+        try:
+            with self.assertRaises(FormulonError):
+                wb.insert_image(0, b"junk")
+            with self.assertRaises(FormulonError):
+                wb.get_image(0, 12345)
+        finally:
+            wb.close()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_filter_validation_comments.py b/packages/python/tests/test_surface_filter_validation_comments.py
new file mode 100644
index 000000000..1d9b7400a
--- /dev/null
+++ b/packages/python/tests/test_surface_filter_validation_comments.py
@@ -0,0 +1,360 @@
+"""AutoFilter, data-validation check and threaded-comment surface tests."""
+
+from __future__ import annotations
+
+import unittest
+
+from formulon import (
+    AutoFilter,
+    AutoFilterColumn,
+    AutoFilterDateGroup,
+    AutoFilterSortCondition,
+    AutoFilterSortState,
+    DataValidationInput,
+    DateTimeGrouping,
+    DynamicFilterType,
+    FilterKind,
+    FilterOperator,
+    FormulonError,
+    Mention,
+    MergeRange,
+    Person,
+    SortBy,
+    SortMethod,
+    ThreadedComment,
+    ValidationErrorStyle,
+    ValidationOutcome,
+    Value,
+    ValueKind,
+    Workbook,
+)
+
+ALICE = "{11111111-1111-4111-8111-111111111111}"
+BOB = "{22222222-2222-4222-8222-222222222222}"
+THREAD = "{33333333-3333-4333-8333-333333333333}"
+REPLY = "{44444444-4444-4444-8444-444444444444}"
+STAMP = "2026-01-01T10:00:00.00"
+
+
+def _text(s: str) -> Value:
+    return Value(kind=ValueKind.TEXT, text=s)
+
+
+def _seed_numbers(wb: Workbook, col: int = 0, first_row: int = 0) -> None:
+    wb.set_text(0, first_row, col, "n")
+    for i, v in enumerate((1, 2, 3, 4, 5)):
+        wb.set_number(0, first_row + 1 + i, col, float(v))
+
+
+class EnumOrdinalTests(unittest.TestCase):
+    def test_ordinals_match_the_c_header(self) -> None:
+        self.assertEqual(
+            (FilterKind.ICON, FilterOperator.GREATER_THAN, DynamicFilterType.YEAR_TO_DATE, DynamicFilterType.M12),
+            (6, 5, 18, 34),
+        )
+        self.assertEqual(
+            (SortBy.ICON, SortMethod.STROKE, DateTimeGrouping.SECOND, ValidationErrorStyle.INFORMATION),
+            (3, 2, 5, 2),
+        )
+
+
+class AutoFilterTests(unittest.TestCase):
+    def test_absent_filter_reads_none(self) -> None:
+        with Workbook.create_default() as wb:
+            self.assertIsNone(wb.get_auto_filter(0))
+
+    def test_set_get_roundtrip_every_criterion(self) -> None:
+        with Workbook.create_default() as wb:
+            _seed_numbers(wb)
+            sort = AutoFilterSortState(
+                ref=MergeRange(1, 0, 5, 1),
+                column_sort=False,
+                case_sensitive=True,
+                sort_method=SortMethod.PIN_YIN,
+                conditions=[
+                    AutoFilterSortCondition(ref=MergeRange(1, 0, 5, 0), descending=True, custom_list="a,b"),
+                ],
+            )
+            af = AutoFilter(
+                range=MergeRange(0, 0, 5, 1),
+                columns=[
+                    AutoFilterColumn(
+                        col_id=0,
+                        hidden_button=True,
+                        kind=1,
+                        filter_blank=True,
+                        values=["1", "3"],
+                        date_groups=[AutoFilterDateGroup(year=2024, month=5, grouping=DateTimeGrouping.MONTH)],
+                    ),
+                    AutoFilterColumn(
+                        col_id=1,
+                        kind=FilterKind.CUSTOM,
+                        custom_and=True,
+                        custom_count=2,
+                        op1=FilterOperator.GREATER_THAN,
+                        val1="1",
+                        op2=FilterOperator.LESS_THAN,
+                        val2="9",
+                    ),
+                ],
+                sort=sort,
+            )
+            wb.set_auto_filter(0, af)
+            got = wb.get_auto_filter(0)
+            assert got is not None
+            self.assertEqual(got.range, af.range)
+            self.assertEqual(len(got.columns), 2)
+            c0, c1 = got.columns
+            self.assertTrue(c0.hidden_button)
+            self.assertTrue(c0.show_button)
+            self.assertTrue(c0.filter_blank)
+            self.assertEqual(c0.values, ["1", "3"])
+            self.assertEqual(c0.date_groups, [AutoFilterDateGroup(year=2024, month=5, grouping=DateTimeGrouping.MONTH)])
+            self.assertEqual(
+                (c1.kind, c1.custom_count, c1.op1, c1.val1, c1.op2, c1.val2),
+                (FilterKind.CUSTOM, 2, FilterOperator.GREATER_THAN, "1", FilterOperator.LESS_THAN, "9"),
+            )
+            self.assertTrue(c1.custom_and)
+            assert got.sort is not None
+            self.assertEqual(got.sort.ref, sort.ref)
+            self.assertTrue(got.sort.case_sensitive)
+            self.assertEqual(got.sort.sort_method, SortMethod.PIN_YIN)
+            self.assertEqual(got.sort.conditions[0].custom_list, "a,b")
+            self.assertTrue(got.sort.conditions[0].descending)
+            # A get followed by a set of the unchanged record is stable.
+            wb.set_auto_filter(0, got)
+            self.assertEqual(wb.get_auto_filter(0), got)
+
+    def test_top10_and_dynamic_fields_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            _seed_numbers(wb)
+            col = AutoFilterColumn(
+                col_id=0,
+                kind=FilterKind.TOP10,
+                top=False,
+                percent=True,
+                top_val=25.0,
+                has_filter_val=True,
+                filter_val=2.0,
+            )
+            dyn = AutoFilterColumn(
+                col_id=1,
+                kind=FilterKind.DYNAMIC,
+                dynamic_type=DynamicFilterType.ABOVE_AVERAGE,
+                has_dyn_val=True,
+                dyn_val=3.5,
+                val_iso="x",
+            )
+            wb.set_auto_filter(0, AutoFilter(range=MergeRange(0, 0, 5, 1), columns=[col, dyn]))
+            got = wb.get_auto_filter(0)
+            assert got is not None
+            self.assertFalse(got.columns[0].top)
+            self.assertTrue(got.columns[0].percent)
+            self.assertEqual((got.columns[0].top_val, got.columns[0].filter_val), (25.0, 2.0))
+            self.assertEqual(got.columns[1].dynamic_type, DynamicFilterType.ABOVE_AVERAGE)
+            self.assertEqual(got.columns[1].dyn_val, 3.5)
+
+    def test_evaluate_apply_clear_remove(self) -> None:
+        with Workbook.create_default() as wb:
+            _seed_numbers(wb)
+            wb.set_auto_filter(
+                0,
+                AutoFilter(
+                    range=MergeRange(0, 0, 5, 0),
+                    columns=[
+                        AutoFilterColumn(
+                            col_id=0, kind=FilterKind.CUSTOM, custom_count=1, op1=FilterOperator.GREATER_THAN, val1="2"
+                        )
+                    ],
+                ),
+            )
+            first_row, match = wb.evaluate_auto_filter(0)
+            self.assertEqual(first_row, 1)
+            self.assertEqual(match, [False, False, True, True, True])
+            wb.apply_auto_filter(0)
+            hidden = [r.row for r in wb.get_sheet_row_overrides(0) if r.hidden]
+            self.assertEqual(hidden, [1, 2])
+            wb.clear_auto_filter(0)
+            got = wb.get_auto_filter(0)
+            assert got is not None
+            self.assertEqual(got.columns, [])
+            self.assertEqual(wb.evaluate_auto_filter(0), (1, [True] * 5))
+            wb.remove_auto_filter(0)
+            self.assertIsNone(wb.get_auto_filter(0))
+            wb.remove_auto_filter(0)
+            with self.assertRaises(FormulonError):
+                wb.apply_auto_filter(0)
+            with self.assertRaises(FormulonError):
+                wb.evaluate_auto_filter(0)
+
+    def test_invalid_filter_is_rejected(self) -> None:
+        with Workbook.create_default() as wb:
+            with self.assertRaises(FormulonError):
+                wb.set_auto_filter(
+                    0,
+                    AutoFilter(range=MergeRange(0, 0, 3, 0), columns=[AutoFilterColumn(col_id=5)]),
+                )
+            with self.assertRaises(FormulonError):
+                wb.get_auto_filter(99)
+
+    def test_table_auto_filter(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_text(0, 0, 0, "n")
+            wb.set_text(0, 0, 1, "m")
+            for i in range(1, 4):
+                wb.set_number(0, i, 0, float(i))
+                wb.set_number(0, i, 1, 0.0)
+            idx = wb.table_create(0, "A1:B4", "T1", "T1", ["n", "m"])
+            wb.remove_table_auto_filter(idx)
+            self.assertIsNone(wb.get_table_auto_filter(idx))
+            wb.set_table_auto_filter(
+                idx,
+                AutoFilter(
+                    range=MergeRange(0, 0, 3, 1),
+                    columns=[
+                        AutoFilterColumn(
+                            col_id=0,
+                            kind=FilterKind.CUSTOM,
+                            custom_count=1,
+                            op1=FilterOperator.GREATER_THAN_OR_EQUAL,
+                            val1="2",
+                        )
+                    ],
+                ),
+            )
+            got = wb.get_table_auto_filter(idx)
+            assert got is not None
+            self.assertEqual(got.columns[0].val1, "2")
+            self.assertEqual(wb.evaluate_table_auto_filter(idx), (1, [False, True, True]))
+            wb.apply_table_auto_filter(idx)
+            wb.clear_table_auto_filter(idx)
+            self.assertEqual(wb.evaluate_table_auto_filter(idx), (1, [True, True, True]))
+            wb.remove_table_auto_filter(idx)
+            self.assertIsNone(wb.get_table_auto_filter(idx))
+            with self.assertRaises(FormulonError):
+                wb.get_table_auto_filter(idx + 5)
+
+
+class ValidationCheckTests(unittest.TestCase):
+    def _wb_with_list_rule(self) -> Workbook:
+        wb = Workbook.create_default()
+        wb.add_validation(
+            0,
+            DataValidationInput(
+                type=3, ranges=[MergeRange(0, 3, 9, 3)], formula1='"Yes,No"', error_style=ValidationErrorStyle.WARNING
+            ),
+        )
+        return wb
+
+    def test_validate_value(self) -> None:
+        with self._wb_with_list_rule() as wb:
+            ok = wb.validate_value(0, 0, 3, _text("Yes"))
+            self.assertEqual(
+                ok, ValidationOutcome(has_rule=True, valid=True, rule_index=0, error_style=ValidationErrorStyle.WARNING)
+            )
+            bad = wb.validate_value(0, 0, 3, _text("Maybe"))
+            self.assertTrue(bad.has_rule)
+            self.assertFalse(bad.valid)
+            self.assertEqual(bad.error_style, ValidationErrorStyle.WARNING)
+            none = wb.validate_value(0, 0, 0, Value(kind=ValueKind.NUMBER, number=1.0))
+            self.assertEqual(
+                none, ValidationOutcome(has_rule=False, valid=True, rule_index=0, error_style=ValidationErrorStyle.STOP)
+            )
+            with self.assertRaises(FormulonError):
+                wb.validate_value(99, 0, 3, _text("Yes"))
+
+    def test_list_invalid_cells_pages(self) -> None:
+        with self._wb_with_list_rule() as wb:
+            for r, v in enumerate(["Yes", "bad1", "No", "bad2", "bad3"]):
+                wb.set_text(0, r, 3, v)
+            cells, cursor = wb.list_invalid_cells(0)
+            self.assertEqual([c.row for c in cells], [1, 3, 4])
+            self.assertIsNone(cursor)
+            seen = []
+            cursor = None
+            pages = 0
+            while True:
+                page, cursor = wb.list_invalid_cells(0, cursor, 2)
+                pages += 1
+                seen += [(c.row, c.value.text) for c in page]
+                if cursor is None:
+                    break
+            self.assertEqual(seen, [(1, "bad1"), (3, "bad2"), (4, "bad3")])
+            self.assertGreaterEqual(pages, 2)
+            with self.assertRaises(FormulonError):
+                wb.list_invalid_cells(99)
+
+
+class ThreadedCommentTests(unittest.TestCase):
+    def _wb(self) -> Workbook:
+        wb = Workbook.create_default()
+        wb.add_person(Person(id=ALICE, display_name="Alice", user_id="alice@example.com", provider_id="AD"))
+        wb.add_person(Person(id=BOB, display_name="Bob", user_id="bob@example.com", provider_id="AD"))
+        return wb
+
+    def test_persons(self) -> None:
+        with self._wb() as wb:
+            persons = wb.get_persons()
+            self.assertEqual([p.display_name for p in persons], ["Alice", "Bob"])
+            self.assertEqual(persons[0], Person(ALICE, "Alice", "alice@example.com", "AD"))
+            wb.remove_person(BOB)
+            self.assertEqual([p.id for p in wb.get_persons()], [ALICE])
+            with self.assertRaises(FormulonError):
+                wb.remove_person(BOB)
+            with self.assertRaises(FormulonError):
+                wb.add_person(Person(id=ALICE, display_name="Dup"))
+
+    def test_thread_with_reply_and_mention(self) -> None:
+        with self._wb() as wb:
+            self.assertEqual(wb.get_threaded_comments(0), [])
+            opener = ThreadedComment(id=THREAD, row=2, col=1, person_id=ALICE, created=STAMP, text="Check this")
+            wb.add_threaded_comment(0, opener)
+            reply = ThreadedComment(
+                id=REPLY,
+                person_id=BOB,
+                created=STAMP,
+                text="@Alice done",
+                parent_id=THREAD,
+                mentions=[
+                    Mention(person_id=ALICE, mention_id="{55555555-5555-4555-8555-555555555555}", start=0, length=6)
+                ],
+            )
+            wb.add_threaded_comment(0, reply)
+            got = wb.get_threaded_comments(0)
+            self.assertEqual([c.id for c in got], [THREAD, REPLY])
+            self.assertEqual((got[0].row, got[0].col, got[0].text), (2, 1, "Check this"))
+            self.assertEqual((got[1].row, got[1].col, got[1].parent_id), (2, 1, THREAD))
+            self.assertEqual(got[1].mentions, reply.mentions)
+
+            with self.assertRaises(FormulonError):
+                wb.remove_person(ALICE)
+
+            wb.edit_threaded_comment(0, REPLY, "plain", [])
+            self.assertEqual(wb.get_threaded_comments(0)[1].text, "plain")
+            self.assertEqual(wb.get_threaded_comments(0)[1].mentions, [])
+
+            wb.set_thread_resolved(0, THREAD, True)
+            self.assertTrue(wb.get_threaded_comments(0)[0].done)
+            wb.set_thread_resolved(0, THREAD, False)
+            self.assertFalse(wb.get_threaded_comments(0)[0].done)
+
+            wb.remove_threaded_comment(0, REPLY)
+            self.assertEqual([c.id for c in wb.get_threaded_comments(0)], [THREAD])
+            wb.remove_threaded_comment(0, THREAD)
+            self.assertEqual(wb.get_threaded_comments(0), [])
+            wb.remove_person(ALICE)
+
+    def test_invalid_comment_is_rejected(self) -> None:
+        with self._wb() as wb:
+            with self.assertRaises(FormulonError):
+                wb.add_threaded_comment(0, ThreadedComment(id="not-a-guid", person_id=ALICE, created=STAMP, text="x"))
+            with self.assertRaises(FormulonError):
+                wb.edit_threaded_comment(0, THREAD, "x")
+            with self.assertRaises(FormulonError):
+                wb.set_thread_resolved(0, THREAD, True)
+            with self.assertRaises(FormulonError):
+                wb.remove_threaded_comment(0, THREAD)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_parity.py b/packages/python/tests/test_surface_parity.py
new file mode 100644
index 000000000..431665133
--- /dev/null
+++ b/packages/python/tests/test_surface_parity.py
@@ -0,0 +1,190 @@
+"""Python binding parity surface tests."""
+
+from __future__ import annotations
+
+import unittest
+
+import formulon
+from formulon import (
+    Workbook,
+)
+
+
+class SurfaceParityTests(unittest.TestCase):
+    """Every advertised method must exist on the Workbook class."""
+
+    METHODS = [
+        "move_sheet",
+        "remove_sheet",
+        "rename_sheet",
+        "set_defined_name",
+        "set_defined_name_scoped",
+        "set_error",
+        "insert_rows",
+        "delete_rows",
+        "insert_cols",
+        "delete_cols",
+        "calc_mode",
+        "set_calc_mode",
+        "pinned_now",
+        "set_pinned_now",
+        "clear_pinned_now",
+        "excel_profile_id",
+        "set_excel_profile_id",
+        "partial_recalc",
+        "lambda_text_at",
+        "evaluate_formula_array",
+        "add_merge",
+        "remove_merge",
+        "remove_merge_at",
+        "clear_merges",
+        "get_merges",
+        "merge_count",
+        "add_hyperlink",
+        "remove_hyperlink",
+        "remove_hyperlink_at",
+        "clear_hyperlinks",
+        "get_hyperlinks",
+        "hyperlink_count",
+        "get_comment",
+        "set_comment",
+        "validation_count",
+        "get_validation_at",
+        "get_validations",
+        "add_validation",
+        "remove_validation_at",
+        "clear_validations",
+        "get_sheet_protection",
+        "set_sheet_protection",
+        "get_sheet_view",
+        "set_sheet_zoom",
+        "set_sheet_freeze",
+        "set_sheet_tab_hidden",
+        "set_sheet_visibility",
+        "set_sheet_show_grid_lines",
+        "set_sheet_show_row_col_headers",
+        "set_sheet_show_zeros",
+        "set_sheet_right_to_left",
+        "set_sheet_tab_selected",
+        "set_sheet_view_mode",
+        "get_sheet_columns",
+        "set_column_width",
+        "set_column_hidden",
+        "set_column_outline",
+        "get_sheet_row_overrides",
+        "set_row_height",
+        "set_row_hidden",
+        "set_row_outline",
+        "evaluate_cf_range",
+        "cf_count",
+        "get_conditional_format_at",
+        "get_conditional_formats",
+        "add_conditional_format",
+        "remove_conditional_format_at",
+        "clear_conditional_formats",
+        "get_cell_xf_index",
+        "set_cell_xf_index",
+        "get_cell_xf",
+        "get_font",
+        "get_fill",
+        "get_border",
+        "get_num_fmt",
+        "font_count",
+        "fill_count",
+        "border_count",
+        "cell_xf_count",
+        "cell_style_count",
+        "cell_style_xf_count",
+        "add_font",
+        "add_fill",
+        "add_border",
+        "add_num_fmt",
+        "add_cell_xf",
+        "get_cell_style",
+        "get_cell_style_xf",
+        "pivot_count",
+        "pivot_layout",
+        "pivot_cache_count",
+        "pivot_cache_id_at",
+        "pivot_cache_create",
+        "pivot_cache_remove",
+        "pivot_cache_field_count",
+        "pivot_cache_field_name",
+        "pivot_cache_field_add",
+        "pivot_cache_field_clear",
+        "pivot_cache_record_add",
+        "pivot_cache_record_set_number",
+        "pivot_cache_record_set_text",
+        "pivot_create",
+        "pivot_remove",
+        "pivot_set_name",
+        "pivot_set_anchor",
+        "pivot_set_grand_totals",
+        "pivot_field_add",
+        "pivot_field_add_item",
+        "pivot_field_add_item_at",
+        "pivot_field_set_axis",
+        "pivot_data_field_add",
+        "pivot_data_field_set",
+        "pivot_filter_add",
+        "pivot_set_row_field_order",
+        "pivot_set_col_field_order",
+        "precedents",
+        "dependents",
+        "spill_info",
+        "function_count",
+        "function_name_at",
+        "function_metadata",
+        "localize_function_name",
+        "canonicalize_function_name",
+        "external_link_count",
+        "get_external_link_at",
+        "get_external_links",
+        "save",
+        "save_as",
+        "save_with_diagnostics",
+        "read_diagnostics",
+    ]
+
+    def test_all_methods_present(self) -> None:
+        for name in self.METHODS:
+            self.assertTrue(hasattr(Workbook, name), f"Workbook missing method: {name}")
+
+    def test_public_types_exported(self) -> None:
+        for name in (
+            "MergeRange",
+            "Comment",
+            "Hyperlink",
+            "DataValidation",
+            "DataValidationInput",
+            "SheetProtection",
+            "SheetView",
+            "ConditionalFormat",
+            "ConditionalFormatInput",
+            "CfMatch",
+            "CfCellResult",
+            "CellNode",
+            "SpillInfo",
+            "FunctionMetadata",
+            "CellXf",
+            "ColorSpec",
+            "FontRecord",
+            "FillRecord",
+            "CellStyle",
+            "ExternalLink",
+            "PivotCell",
+            "PivotLayout",
+            "PivotFieldSpec",
+            "PivotDataFieldSpec",
+            "PivotFilterSpec",
+            "CalcMode",
+            "PivotAxis",
+            "PivotAggregation",
+            "MergedFunctionMetadata",
+            "merge_function_metadata",
+        ):
+            self.assertTrue(hasattr(formulon, name), f"formulon missing: {name}")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_pivot.py b/packages/python/tests/test_surface_pivot.py
new file mode 100644
index 000000000..a6f4642af
--- /dev/null
+++ b/packages/python/tests/test_surface_pivot.py
@@ -0,0 +1,621 @@
+"""Pivot surface and marshalling tests."""
+
+from __future__ import annotations
+
+import inspect
+import io
+import unittest
+import zipfile
+from typing import Any, Dict, List, Tuple
+
+from formulon import (
+    FormulonError,
+    PivotAggregation,
+    PivotAxis,
+    PivotCalendar,
+    PivotDataFieldSpec,
+    PivotDateGrouping,
+    PivotFieldSpec,
+    PivotFilterSpec,
+    PivotFilterType,
+    PivotReportLayout,
+    PivotWorksheetSource,
+    ValueKind,
+    Workbook,
+)
+
+
+class PivotTests(unittest.TestCase):
+    def test_build_and_project_pivot(self) -> None:
+        with Workbook.create_default() as wb:
+            cache_id = wb.pivot_cache_create()
+            wb.pivot_cache_field_add(cache_id, "Region")
+            wb.pivot_cache_field_add(cache_id, "Amount")
+            for region, amount in [("East", 10.0), ("East", 20.0), ("West", 30.0)]:
+                rec = wb.pivot_cache_record_add(cache_id)
+                wb.pivot_cache_record_set_text(cache_id, rec, 0, region)
+                wb.pivot_cache_record_set_number(cache_id, rec, 1, amount)
+            self.assertEqual(wb.pivot_cache_record_count(cache_id), 3)
+
+            pivot = wb.pivot_create(0, "Pivot1", cache_id, 0, 4)
+            region_field = wb.pivot_field_add(0, pivot, PivotFieldSpec(source_name="Region", axis=PivotAxis.ROW))
+            amount_field = wb.pivot_field_add(0, pivot, PivotFieldSpec(source_name="Amount", axis=PivotAxis.VALUE))
+            self.assertEqual(region_field, 0)
+            wb.pivot_data_field_add(
+                0,
+                pivot,
+                PivotDataFieldSpec(
+                    name="Sum of Amount",
+                    field_index=amount_field,
+                    aggregation=PivotAggregation.SUM,
+                ),
+            )
+
+            layout = wb.pivot_layout(0, pivot)
+            self.assertGreater(len(layout.cells), 0)
+            numbers = [c.value.to_python() for c in layout.cells if c.value.kind == ValueKind.NUMBER]
+            # The single grand total of 10 + 20 + 30 must appear.
+            self.assertIn(60.0, numbers)
+
+    def test_cache_source_and_report_layout_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            cache = wb.pivot_cache_create()
+            wb.set_pivot_cache_worksheet_source(cache, PivotWorksheetSource(ref="A1:B9", sheet="Sheet1"))
+            self.assertEqual(wb.get_pivot_cache_worksheet_source(cache).sheet, "Sheet1")
+            pivot = wb.pivot_create(0, "Layout", cache, 0, 0)
+            wb.set_pivot_report_layout(0, pivot, PivotReportLayout.TABULAR)
+            self.assertEqual(wb.get_pivot_report_layout(0, pivot), PivotReportLayout.TABULAR)
+            wb.set_pivot_cache_worksheet_source(cache, None)
+            self.assertIsNone(wb.get_pivot_cache_worksheet_source(cache))
+
+
+class _PivotFixture:
+    """Region / Product carry shared items their records index; Amount and
+    Date are plain numbers. Only Region is laid out."""
+
+    def __init__(self, wb: Workbook) -> None:
+        self.wb = wb
+        self.cache = wb.pivot_cache_create()
+        wb.set_pivot_cache_worksheet_source(self.cache, PivotWorksheetSource(ref="A1:D5", sheet="Sheet1"))
+        for name in ("Region", "Product", "Amount", "Date"):
+            wb.pivot_cache_field_add(self.cache, name)
+        for item in ("East", "West"):
+            wb.pivot_cache_field_add_shared_item_text(self.cache, 0, item)
+        for item in ("Apple", "Pear"):
+            wb.pivot_cache_field_add_shared_item_text(self.cache, 1, item)
+        for values in ((0, 0, 10, 45292), (1, 0, 30, 45323), (0, 1, 5, 45658), (1, 1, 7, 45689)):
+            rec = wb.pivot_cache_record_add(self.cache)
+            for field, value in enumerate(values):
+                wb.pivot_cache_record_set_number(self.cache, rec, field, value)
+        self.pivot = wb.pivot_create(0, "Pivot1", self.cache, 0, 6)
+        self.region = wb.pivot_field_add(0, self.pivot, PivotFieldSpec(source_name="Region", axis=PivotAxis.ROW))
+        wb.pivot_field_add_item(0, self.pivot, self.region, "East", True)
+        wb.pivot_field_add_item(0, self.pivot, self.region, "West", True)
+        self.product = wb.pivot_field_add(0, self.pivot, PivotFieldSpec(source_name="Product", axis=PivotAxis.VALUE))
+        wb.pivot_field_add_item(0, self.pivot, self.product, "Apple", True)
+        wb.pivot_field_add_item(0, self.pivot, self.product, "Pear", True)
+        self.amount = wb.pivot_field_add(0, self.pivot, PivotFieldSpec(source_name="Amount", axis=PivotAxis.VALUE))
+        self.date = wb.pivot_field_add(0, self.pivot, PivotFieldSpec(source_name="Date", axis=PivotAxis.VALUE))
+        wb.pivot_set_row_field_order(0, self.pivot, [self.region])
+        wb.pivot_data_field_add(
+            0, self.pivot, PivotDataFieldSpec(name="Sum of Amount", field_index=self.amount, aggregation=0)
+        )
+
+    def grid(self, pivot: int = 0) -> List[str]:
+        """The projected grid as one ``|``-joined string per sheet row."""
+        layout = self.wb.pivot_layout(0, pivot)
+        rows: Dict[int, List[str]] = {}
+        for cell in layout.cells:
+            v = cell.value
+            if v.kind == ValueKind.NUMBER:
+                text = "%.15g" % v.number
+            elif v.kind == ValueKind.TEXT:
+                text = v.text
+            elif v.kind == ValueKind.ERROR:
+                text = f"#{v.error_code}"
+            else:
+                text = ""
+            rows.setdefault(cell.row, [""] * layout.cols)[cell.col - layout.left] = text
+        return ["|".join(rows[r]) for r in sorted(rows)]
+
+
+_BASE_GRID = ["行ラベル|Sum of Amount", "East|15", "West|37", "総計|52"]
+
+
+_TWO_LEVEL_GRID = [
+    "行ラベル|Sum of Amount",
+    "Apple|10",
+    "Pear|5",
+    "East|15",
+    "Apple|30",
+    "Pear|7",
+    "West|37",
+    "総計|52",
+]
+
+
+_WEST_ONLY = ["行ラベル|Sum of Amount", "West|37", "総計|37"]
+
+
+_GREATER_THAN_20 = PivotFilterSpec(
+    axis=PivotAxis.ROW, field_name="Region", type=PivotFilterType.VALUE_GREATER_THAN, value_kind=1, value_double=20.0
+)
+
+
+_BETWEEN_10_20 = PivotFilterSpec(
+    axis=PivotAxis.ROW,
+    field_name="Region",
+    type=PivotFilterType.VALUE_BETWEEN,
+    value_kind=1,
+    value_double=10.0,
+    value_high_kind=1,
+    value_high_double=20.0,
+)
+
+
+_PIVOT_READERS = {
+    "pivot_count",
+    "pivot_layout",
+    "pivot_cache_count",
+    "pivot_cache_field_count",
+    "pivot_cache_field_name",
+    "pivot_cache_field_shared_item_count",
+    "pivot_cache_record_count",
+    "pivot_field_count",
+    "pivot_data_field_count",
+    "pivot_filter_count",
+    "pivot_filter_at",
+    "get_pivot_cache_worksheet_source",
+    "get_pivot_report_layout",
+}
+
+
+def _two_levels(f: _PivotFixture) -> None:
+    f.wb.pivot_set_row_field_order(0, f.pivot, [f.region, f.product])
+
+
+def _date_rows(f: _PivotFixture) -> None:
+    f.wb.pivot_set_row_field_order(0, f.pivot, [f.date])
+
+
+def _hide_east(f: _PivotFixture) -> None:
+    f.wb.pivot_field_set_item_visible(0, f.pivot, f.region, 0, False)
+
+
+def _point_at_new_item(f: _PivotFixture) -> None:
+    f.wb.pivot_cache_record_set_number(f.cache, 0, 0, 2)
+
+
+def _package_part(data: bytes, name: str) -> str:
+    with zipfile.ZipFile(io.BytesIO(data)) as package:
+        return package.read(name).decode("utf-8")
+
+
+class PivotMutatorTableTests(unittest.TestCase):
+    # name -> (setup, act, after, expect). `act` is the one call under test
+    # and returns its result; `expect(test, fixture, result)` reads it back.
+    def _rows(self) -> Dict[str, Tuple[Any, Any, Any, Any]]:
+        eq = self.assertEqual
+
+        def grid_is(expected: List[str]) -> Any:
+            return lambda t, f, r: eq(f.grid(), expected)
+
+        def rejects(call: Any) -> None:
+            with self.assertRaises(FormulonError) as caught:
+                call()
+            eq(caught.exception.status, 2)
+
+        def cache_create(t: Any, f: _PivotFixture, r: int) -> None:
+            eq(r, 77)
+            eq(f.wb.pivot_cache_count(), 2)
+
+        def cache_remove_setup(f: _PivotFixture) -> None:
+            f.spare = f.wb.pivot_cache_create()  # type: ignore[attr-defined]
+
+        def cache_remove(t: Any, f: _PivotFixture, r: None) -> None:
+            eq(f.wb.pivot_cache_count(), 1)
+            eq(f.wb.pivot_cache_id_at(0), f.cache)
+
+        def cache_source(t: Any, f: _PivotFixture, r: None) -> None:
+            source = f.wb.get_pivot_cache_worksheet_source(f.cache)
+            eq((source.ref, source.sheet), ("B2:E6", "Data"))
+            eq(f.grid(), _BASE_GRID)
+
+        def cache_field_add(t: Any, f: _PivotFixture, r: int) -> None:
+            eq(r, 4)
+            eq(f.wb.pivot_cache_field_name(f.cache, 4), "Extra")
+
+        def cache_field_clear(t: Any, f: _PivotFixture, r: None) -> None:
+            eq(f.wb.pivot_cache_field_count(f.cache), 0)
+            # The data field now names a cache field that no longer exists.
+            with self.assertRaises(FormulonError):
+                f.wb.pivot_layout(0, f.pivot)
+
+        def record_add(t: Any, f: _PivotFixture, r: int) -> None:
+            eq(r, 4)
+            eq(f.grid(), ["行ラベル|Sum of Amount", "East|15", "West|37", "(空白)|0", "総計|52"])
+
+        def pivot_create(t: Any, f: _PivotFixture, r: int) -> None:
+            eq(r, 1)
+            layout = f.wb.pivot_layout(0, 1)
+            eq((layout.top, layout.left), (20, 1))
+            eq(f.grid(0), _BASE_GRID)
+
+        def pivot_remove(t: Any, f: _PivotFixture, r: None) -> None:
+            eq(f.wb.pivot_count(0), 0)
+            with self.assertRaises(FormulonError):
+                f.wb.pivot_layout(0, 0)
+
+        def set_name(t: Any, f: _PivotFixture, r: None) -> None:
+            # A pivot's name is only observable in the part the writer emits.
+            part = _package_part(f.wb.save(), "xl/pivotTables/pivotTable1.xml")
+            self.assertRegex(part, r'<pivotTableDefinition [^>]*name="Renamed"')
+
+        def set_anchor(t: Any, f: _PivotFixture, r: None) -> None:
+            layout = f.wb.pivot_layout(0, f.pivot)
+            eq((layout.top, layout.left), (10, 2))
+            eq(f.grid(), _BASE_GRID)
+
+        def set_layout(t: Any, f: _PivotFixture, r: None) -> None:
+            eq(f.wb.get_pivot_report_layout(0, f.pivot), PivotReportLayout.TABULAR)
+            eq(f.grid(), ["Region|Sum of Amount", "East|15", "West|37", "総計|52"])
+
+        def field_add(t: Any, f: _PivotFixture, r: int) -> None:
+            eq(r, 4)
+            eq(f.grid(), ["Fruit|(すべて)", "|", *_BASE_GRID])
+
+        def field_clear(t: Any, f: _PivotFixture, r: None) -> None:
+            eq(f.wb.pivot_field_count(0, f.pivot), 0)
+            eq(f.grid(), _BASE_GRID)
+
+        def add_item_at_setup(f: _PivotFixture) -> None:
+            # Only the index-addressed form can name the blank item.
+            f.wb.pivot_cache_field_add_shared_item_blank(f.cache, 0)
+            f.wb.pivot_cache_record_set_blank(f.cache, 0, 0)
+
+        def clear_subtotal_setup(f: _PivotFixture) -> None:
+            _two_levels(f)
+            f.wb.pivot_field_add_subtotal_fn(0, f.pivot, f.region, PivotAggregation.MAX)
+
+        def clear_date_group_setup(f: _PivotFixture) -> None:
+            _date_rows(f)
+            f.wb.pivot_field_set_date_group(0, f.pivot, f.date, PivotDateGrouping.YEAR, PivotCalendar.GREGORIAN)
+
+        def number_format(t: Any, f: _PivotFixture, r: None) -> None:
+            rejects(lambda: f.wb.pivot_field_set_number_format(0, f.pivot, 99, "4"))
+            rejects(lambda: f.wb.pivot_field_set_number_format(0, f.pivot, f.amount, "0.00"))
+            # A field's numFmtId is only observable in the part the writer emits.
+            part = _package_part(f.wb.save(), "xl/pivotTables/pivotTable1.xml")
+            self.assertRegex(part, r'<pivotField [^>]*numFmtId="4"')
+            eq(f.grid(), _BASE_GRID)
+
+        def data_field_add(t: Any, f: _PivotFixture, r: int) -> None:
+            eq(r, 1)
+            eq(
+                f.grid(),
+                ["行ラベル|Sum of Amount|Max of Amount", "East|15|10", "West|37|30", "総計|52|30"],
+            )
+
+        def data_field_set(t: Any, f: _PivotFixture, r: None) -> None:
+            eq(f.grid(), ["行ラベル|Count of Amount", "East|2", "West|2", "総計|4"])
+            formats = [c.number_format for c in f.wb.pivot_layout(0, f.pivot).cells if c.value.kind == ValueKind.NUMBER]
+            eq(formats, ["2", "2", "2"])
+
+        def filter_remove_setup(f: _PivotFixture) -> None:
+            # Each filter alone keeps a different region, so removing the
+            # wrong index leaves the wrong one.
+            f.wb.pivot_filter_add(0, f.pivot, _GREATER_THAN_20)
+            f.wb.pivot_filter_add(0, f.pivot, _BETWEEN_10_20)
+
+        W = PivotAggregation
+        return {
+            "pivot_cache_create": (None, lambda f: f.wb.pivot_cache_create(77), None, cache_create),
+            "pivot_cache_id_at": (None, lambda f: f.wb.pivot_cache_id_at(0), None, lambda t, f, r: eq(r, f.cache)),
+            "pivot_cache_remove": (cache_remove_setup, lambda f: f.wb.pivot_cache_remove(f.spare), None, cache_remove),
+            "set_pivot_cache_worksheet_source": (
+                None,
+                lambda f: f.wb.set_pivot_cache_worksheet_source(
+                    f.cache, PivotWorksheetSource(ref="B2:E6", sheet="Data")
+                ),
+                None,
+                cache_source,
+            ),
+            "pivot_cache_field_add": (
+                None,
+                lambda f: f.wb.pivot_cache_field_add(f.cache, "Extra"),
+                None,
+                cache_field_add,
+            ),
+            "pivot_cache_field_clear": (None, lambda f: f.wb.pivot_cache_field_clear(f.cache), None, cache_field_clear),
+            "pivot_cache_field_add_shared_item_number": (
+                None,
+                lambda f: f.wb.pivot_cache_field_add_shared_item_number(f.cache, 0, 42.5),
+                _point_at_new_item,
+                grid_is(["行ラベル|Sum of Amount", "42.5|10", "East|5", "West|37", "総計|52"]),
+            ),
+            "pivot_cache_field_add_shared_item_text": (
+                None,
+                lambda f: f.wb.pivot_cache_field_add_shared_item_text(f.cache, 0, "North"),
+                _point_at_new_item,
+                grid_is(["行ラベル|Sum of Amount", "East|5", "North|10", "West|37", "総計|52"]),
+            ),
+            "pivot_cache_field_add_shared_item_bool": (
+                None,
+                lambda f: f.wb.pivot_cache_field_add_shared_item_bool(f.cache, 0, True),
+                _point_at_new_item,
+                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "TRUE|10", "総計|52"]),
+            ),
+            "pivot_cache_field_add_shared_item_blank": (
+                None,
+                lambda f: f.wb.pivot_cache_field_add_shared_item_blank(f.cache, 0),
+                _point_at_new_item,
+                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "(空白)|10", "総計|52"]),
+            ),
+            "pivot_cache_field_add_shared_item_error": (
+                None,
+                lambda f: f.wb.pivot_cache_field_add_shared_item_error(f.cache, 0, 6),
+                _point_at_new_item,
+                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "#N/A|10", "総計|52"]),
+            ),
+            "pivot_cache_field_clear_shared_items": (
+                None,
+                lambda f: f.wb.pivot_cache_field_clear_shared_items(f.cache, 0),
+                None,
+                # With no shared items the records' indices render as themselves.
+                grid_is(["行ラベル|Sum of Amount", "0|15", "1|37", "総計|52"]),
+            ),
+            "pivot_cache_record_add": (None, lambda f: f.wb.pivot_cache_record_add(f.cache), None, record_add),
+            "pivot_cache_record_clear": (
+                None,
+                lambda f: f.wb.pivot_cache_record_clear(f.cache),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "総計|0"]),
+            ),
+            "pivot_cache_record_set_number": (
+                None,
+                lambda f: f.wb.pivot_cache_record_set_number(f.cache, 0, 2, 1000),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "East|1005", "West|37", "総計|1042"]),
+            ),
+            "pivot_cache_record_set_text": (
+                None,
+                lambda f: f.wb.pivot_cache_record_set_text(f.cache, 0, 0, "West"),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "East|5", "West|47", "総計|52"]),
+            ),
+            "pivot_cache_record_set_bool": (
+                None,
+                lambda f: f.wb.pivot_cache_record_set_bool(f.cache, 0, 2, True),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "East|6", "West|37", "総計|43"]),
+            ),
+            "pivot_cache_record_set_blank": (
+                None,
+                lambda f: f.wb.pivot_cache_record_set_blank(f.cache, 0, 2),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "総計|42"]),
+            ),
+            "pivot_cache_record_set_error": (
+                None,
+                lambda f: f.wb.pivot_cache_record_set_error(f.cache, 0, 2, 1),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "East|#1", "West|37", "総計|#1"]),
+            ),
+            "pivot_create": (None, lambda f: f.wb.pivot_create(0, "Pivot2", f.cache, 20, 1), None, pivot_create),
+            "pivot_remove": (None, lambda f: f.wb.pivot_remove(0, f.pivot), None, pivot_remove),
+            "pivot_set_name": (None, lambda f: f.wb.pivot_set_name(0, f.pivot, "Renamed"), None, set_name),
+            "pivot_set_anchor": (None, lambda f: f.wb.pivot_set_anchor(0, f.pivot, 10, 2, 4, 2), None, set_anchor),
+            "pivot_set_grand_totals": (
+                lambda f: f.wb.pivot_set_col_field_order(0, f.pivot, [f.product]),
+                # Rows off drops the per-row total column; columns on keeps
+                # the bottom total row, so a swapped pair shows the opposite.
+                lambda f: f.wb.pivot_set_grand_totals(0, f.pivot, False, True),
+                None,
+                grid_is(["Sum of Amount|列ラベル|", "行ラベル|Apple|Pear", "East|10|5", "West|30|7", "総計|40|12"]),
+            ),
+            "set_pivot_report_layout": (
+                None,
+                lambda f: f.wb.set_pivot_report_layout(0, f.pivot, PivotReportLayout.TABULAR),
+                None,
+                set_layout,
+            ),
+            "pivot_field_add": (
+                None,
+                lambda f: f.wb.pivot_field_add(
+                    0, f.pivot, PivotFieldSpec(source_name="Product", custom_name="Fruit", axis=PivotAxis.PAGE)
+                ),
+                None,
+                field_add,
+            ),
+            "pivot_field_clear": (_hide_east, lambda f: f.wb.pivot_field_clear(0, f.pivot), None, field_clear),
+            "pivot_field_set_axis": (
+                None,
+                lambda f: f.wb.pivot_field_set_axis(0, f.pivot, f.product, PivotAxis.PAGE),
+                None,
+                grid_is(["Product|(すべて)", "|", *_BASE_GRID]),
+            ),
+            "pivot_field_set_sort": (
+                # East now outsums West, so sorting ascending by the data
+                # field differs from both label orders.
+                lambda f: f.wb.pivot_cache_record_set_number(f.cache, 0, 2, 40),
+                lambda f: f.wb.pivot_field_set_sort(0, f.pivot, f.region, True, "Sum of Amount"),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "West|37", "East|45", "総計|82"]),
+            ),
+            "pivot_field_set_subtotal_top": (
+                _two_levels,
+                lambda f: f.wb.pivot_field_set_subtotal_top(0, f.pivot, f.region, True),
+                None,
+                grid_is(
+                    [
+                        "行ラベル|Sum of Amount",
+                        "East|15",
+                        "Apple|10",
+                        "Pear|5",
+                        "West|37",
+                        "Apple|30",
+                        "Pear|7",
+                        "総計|52",
+                    ]
+                ),
+            ),
+            "pivot_field_add_item": (
+                None,
+                lambda f: f.wb.pivot_field_add_item(0, f.pivot, f.region, "East", False),
+                None,
+                grid_is(_WEST_ONLY),
+            ),
+            "pivot_field_add_item_at": (
+                add_item_at_setup,
+                lambda f: f.wb.pivot_field_add_item_at(0, f.pivot, f.region, 2, False),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "East|5", "West|37", "総計|42"]),
+            ),
+            "pivot_field_clear_items": (
+                _hide_east,
+                lambda f: f.wb.pivot_field_clear_items(0, f.pivot, f.region),
+                None,
+                grid_is(_BASE_GRID),
+            ),
+            "pivot_field_set_item_visible": (
+                None,
+                lambda f: f.wb.pivot_field_set_item_visible(0, f.pivot, f.region, 1, False),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "East|15", "総計|15"]),
+            ),
+            "pivot_field_add_subtotal_fn": (
+                _two_levels,
+                lambda f: f.wb.pivot_field_add_subtotal_fn(0, f.pivot, f.region, W.MAX),
+                None,
+                grid_is(
+                    [
+                        "行ラベル|Sum of Amount",
+                        "Apple|10",
+                        "Pear|5",
+                        "East|10",
+                        "Apple|30",
+                        "Pear|7",
+                        "West|30",
+                        "総計|52",
+                    ]
+                ),
+            ),
+            "pivot_field_clear_subtotal_fns": (
+                clear_subtotal_setup,
+                lambda f: f.wb.pivot_field_clear_subtotal_fns(0, f.pivot, f.region),
+                None,
+                grid_is(_TWO_LEVEL_GRID),
+            ),
+            "pivot_field_set_date_group": (
+                _date_rows,
+                lambda f: f.wb.pivot_field_set_date_group(
+                    0, f.pivot, f.date, PivotDateGrouping.YEAR, PivotCalendar.JAPANESE, -1, -1
+                ),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "令和6年|40", "令和7年|12", "総計|52"]),
+            ),
+            "pivot_field_clear_date_group": (
+                clear_date_group_setup,
+                lambda f: f.wb.pivot_field_clear_date_group(0, f.pivot, f.date),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "45292|10", "45323|30", "45658|5", "45689|7", "総計|52"]),
+            ),
+            "pivot_field_set_number_format": (
+                None,
+                lambda f: f.wb.pivot_field_set_number_format(0, f.pivot, f.amount, "4"),
+                None,
+                number_format,
+            ),
+            "pivot_set_row_field_order": (
+                None,
+                lambda f: f.wb.pivot_set_row_field_order(0, f.pivot, [f.product]),
+                None,
+                grid_is(["行ラベル|Sum of Amount", "Apple|40", "Pear|12", "総計|52"]),
+            ),
+            "pivot_set_col_field_order": (
+                None,
+                lambda f: f.wb.pivot_set_col_field_order(0, f.pivot, [f.product]),
+                None,
+                grid_is(
+                    [
+                        "Sum of Amount|列ラベル||",
+                        "行ラベル|Apple|Pear|総計",
+                        "East|10|5|15",
+                        "West|30|7|37",
+                        "総計|40|12|52",
+                    ]
+                ),
+            ),
+            "pivot_data_field_add": (
+                None,
+                lambda f: f.wb.pivot_data_field_add(
+                    0, f.pivot, PivotDataFieldSpec(name="Max of Amount", field_index=f.amount, aggregation=W.MAX)
+                ),
+                None,
+                data_field_add,
+            ),
+            "pivot_data_field_clear": (
+                None,
+                lambda f: f.wb.pivot_data_field_clear(0, f.pivot),
+                None,
+                grid_is(["行ラベル", "East", "West", "総計"]),
+            ),
+            "pivot_data_field_set": (
+                None,
+                lambda f: f.wb.pivot_data_field_set(
+                    0,
+                    f.pivot,
+                    0,
+                    PivotDataFieldSpec(
+                        name="Count of Amount", field_index=f.amount, aggregation=W.COUNT, number_format="2"
+                    ),
+                ),
+                None,
+                data_field_set,
+            ),
+            "pivot_filter_add": (
+                None,
+                lambda f: f.wb.pivot_filter_add(0, f.pivot, _GREATER_THAN_20),
+                None,
+                grid_is(_WEST_ONLY),
+            ),
+            "pivot_filter_clear": (
+                lambda f: f.wb.pivot_filter_add(0, f.pivot, _GREATER_THAN_20),
+                lambda f: f.wb.pivot_filter_clear(0, f.pivot),
+                None,
+                grid_is(_BASE_GRID),
+            ),
+            "pivot_filter_remove_at": (
+                filter_remove_setup,
+                lambda f: f.wb.pivot_filter_remove_at(0, f.pivot, 1),
+                None,
+                grid_is(_WEST_ONLY),
+            ),
+        }
+
+    def test_table_covers_every_pivot_mutator(self) -> None:
+        declared = {
+            name
+            for name, member in inspect.getmembers(Workbook, inspect.isfunction)
+            if "pivot" in name and not name.startswith("_") and name not in _PIVOT_READERS
+        }
+        self.assertGreater(len(declared), 40)
+        self.assertEqual(sorted(declared - set(self._rows())), [], "pivot mutators without a row")
+        self.assertEqual(sorted(set(self._rows()) - declared), [], "rows for undeclared pivot mutators")
+
+    def test_pivot_mutators_forward_their_arguments(self) -> None:
+        with Workbook.create_default() as wb:
+            self.assertEqual(_PivotFixture(wb).grid(), _BASE_GRID)
+        for name, (setup, act, after, expect) in self._rows().items():
+            with self.subTest(name), Workbook.create_default() as wb:
+                fixture = _PivotFixture(wb)
+                if setup is not None:
+                    setup(fixture)
+                result = act(fixture)
+                if after is not None:
+                    after(fixture)
+                expect(self, fixture, result)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_print.py b/packages/python/tests/test_surface_print.py
new file mode 100644
index 000000000..4c9c8c782
--- /dev/null
+++ b/packages/python/tests/test_surface_print.py
@@ -0,0 +1,210 @@
+"""Print settings surface tests."""
+
+from __future__ import annotations
+
+import unittest
+
+from formulon import (
+    CellXf,
+    FormulonError,
+    Workbook,
+)
+
+
+class PrintSettingsTests(unittest.TestCase):
+    def test_raw_xml_roundtrip_and_removal(self) -> None:
+        with Workbook.create_default() as wb:
+            # An absent element reads back as "" rather than raising.
+            self.assertEqual(wb.get_page_setup_xml(0), "")
+            fragment = '<pageSetup paperSize="9" orientation="portrait" scale="85"/>'
+            wb.set_page_setup_xml(0, fragment)
+            self.assertEqual(wb.get_page_setup_xml(0), fragment)
+
+            setup = wb.get_page_setup(0)
+            self.assertEqual(setup.paper_size, 9)
+            self.assertEqual(setup.scale, 85)
+            self.assertTrue(setup.scale_stated)
+
+            # Empty removes the element and restores the defaults.
+            wb.set_page_setup_xml(0, "")
+            self.assertEqual(wb.get_page_setup_xml(0), "")
+            cleared = wb.get_page_setup(0)
+            self.assertEqual(cleared.scale, 100)
+            self.assertFalse(cleared.scale_stated)
+
+    def test_malformed_fragment_is_rejected_at_set_time(self) -> None:
+        with Workbook.create_default() as wb:
+            for bad in ("<pageSetup/><pageSetup/>", '<pageMargins left="1"/>', '<pageSetup orientation="p"'):
+                with self.assertRaises(FormulonError, msg=bad):
+                    wb.set_page_setup_xml(0, bad)
+            self.assertEqual(wb.get_page_setup_xml(0), "")
+
+    def test_fit_to_page_keeps_the_rest_of_sheet_pr(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_sheet_pr_xml(0, '<sheetPr codeName="Sheet1"><tabColor rgb="FFFF0000"/></sheetPr>')
+            wb.set_fit_to_page(0, True)
+            xml = wb.get_sheet_pr_xml(0)
+            # A VBA binding and a tab colour are not print settings, and
+            # toggling fit-to-page must not be how they get lost.
+            self.assertIn('codeName="Sheet1"', xml)
+            self.assertIn('<tabColor rgb="FFFF0000"/>', xml)
+            self.assertIn('fitToPage="true"', xml)
+            self.assertTrue(wb.get_page_setup(0).fit_to_page)
+
+    def test_typed_patch_preserves_unmodelled_attributes(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_page_setup_xml(0, '<pageSetup paperSize="9" orientation="portrait" horizontalDpi="600" copies="3"/>')
+            wb.set_page_setup(0, orientation=2)
+            xml = wb.get_page_setup_xml(0)
+            self.assertIn('orientation="landscape"', xml)
+            self.assertIn('horizontalDpi="600"', xml)
+            self.assertIn('copies="3"', xml)
+            self.assertIn('paperSize="9"', xml)
+
+    def test_scale_outside_excels_range_is_rejected(self) -> None:
+        with Workbook.create_default() as wb:
+            # Rejected rather than clamped: a mis-stated print scale lands
+            # on paper, unlike the on-screen zoom.
+            with self.assertRaises(FormulonError):
+                wb.set_page_setup(0, scale=9)
+            with self.assertRaises(FormulonError):
+                wb.set_page_setup(0, scale=401)
+            wb.set_page_setup(0, scale=400)
+            self.assertEqual(wb.get_page_setup(0).scale, 400)
+
+    def test_margins_patch_reports_presence_separately(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_page_margins(0, left=0.25, top=1.5)
+            margins = wb.get_page_margins(0)
+            self.assertAlmostEqual(margins.left, 0.25)
+            self.assertAlmostEqual(margins.top, 1.5)
+            self.assertTrue(margins.left_stated)
+            # An unstated margin still reports its effective default, with
+            # the flag clear so the caller can tell the two apart.
+            self.assertAlmostEqual(margins.right, 0.7)
+            self.assertFalse(margins.right_stated)
+
+    def test_negative_margin_is_rejected(self) -> None:
+        with Workbook.create_default() as wb:
+            with self.assertRaises(FormulonError):
+                wb.set_page_margins(0, bottom=-1.0)
+
+    def test_header_footer_sections_take_decoded_text(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_header_footer(0, odd_header="&C\u5e33\u7968", odd_footer="&R&P / &N")
+            # `&` introduces Excel's codes but lives in XML element text, so
+            # it reaches the file escaped and decodes back to `&C...`.
+            self.assertEqual(
+                wb.get_header_footer_xml(0),
+                "<headerFooter><oddHeader>&amp;C\u5e33\u7968</oddHeader>"
+                "<oddFooter>&amp;R&amp;P / &amp;N</oddFooter></headerFooter>",
+            )
+            # Omitting a section leaves it; "" clears it.
+            wb.set_header_footer(0, odd_footer="")
+            self.assertEqual(
+                wb.get_header_footer_xml(0),
+                "<headerFooter><oddHeader>&amp;C\u5e33\u7968</oddHeader></headerFooter>",
+            )
+
+    def test_print_options_patch(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_print_options(0, grid_lines=True, horizontal_centered=True)
+            self.assertEqual(
+                wb.get_print_options_xml(0),
+                '<printOptions gridLines="true" horizontalCentered="true"/>',
+            )
+
+    def test_print_area_and_titles(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_print_area(0, "A1:F8")
+            self.assertEqual(wb.get_print_area(0), "A1:F8")
+            with self.assertRaises(FormulonError):
+                wb.set_print_area(0, "not-a-range")
+            self.assertEqual(wb.get_print_area(0), "A1:F8")
+            wb.set_print_area(0, "")
+            self.assertEqual(wb.get_print_area(0), "")
+
+            wb.set_print_titles(0, "1:2", "A:A")
+            self.assertEqual(wb.get_print_titles(0), ("1:2", "A:A"))
+            wb.set_print_titles(0)
+            self.assertEqual(wb.get_print_titles(0), ("", ""))
+
+    def test_manual_breaks(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.add_row_break(0, 40)
+            wb.add_row_break(0, 10)
+            wb.add_col_break(0, 5)
+            rows = wb.get_row_breaks(0)
+            # Kept sorted by index regardless of insertion order.
+            self.assertEqual([b.id for b in rows], [10, 40])
+            self.assertEqual(rows[0].max, 16383)
+            self.assertTrue(rows[0].manual)
+            self.assertEqual(wb.get_col_breaks(0)[0].max, 1048575)
+
+            # Re-adding an existing index replaces rather than duplicates.
+            wb.add_row_break(0, 10, manual=False)
+            rows = wb.get_row_breaks(0)
+            self.assertEqual(len(rows), 2)
+            self.assertFalse(rows[0].manual)
+
+            # Removing an absent break is not an error.
+            wb.remove_row_break(0, 999)
+            wb.clear_breaks(0)
+            self.assertEqual(wb.get_row_breaks(0), [])
+            self.assertEqual(wb.get_col_breaks(0), [])
+
+    def test_settings_reach_paginate_without_a_save_cycle(self) -> None:
+        with Workbook.create_default() as wb:
+            for row in range(200):
+                for col in range(20):
+                    wb.set_number(0, row, col, 1.0)
+            portrait = wb.paginate(0).page_count
+            wb.set_page_setup(0, orientation=2)
+            self.assertNotEqual(wb.paginate(0).page_count, portrait)
+
+    def test_authored_report_survives_save_and_load(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_text(0, 0, 0, "\u58f2\u4e0a")
+            wb.set_page_setup(0, paper_size=9, orientation=1, fit_to_page=True, fit_to_width=1, fit_to_height=0)
+            wb.set_page_margins(0, left=0.5, right=0.5, top=0.8, bottom=0.8)
+            wb.set_header_footer(0, odd_header="&C\u6708\u6b21\u5831\u544a")
+            wb.set_print_area(0, "A1:F80")
+            wb.set_print_titles(0, "1:2")
+            wb.add_row_break(0, 39)
+            data = wb.save()
+
+        with Workbook.load(data) as reloaded:
+            setup = reloaded.get_page_setup(0)
+            self.assertEqual(setup.paper_size, 9)
+            self.assertEqual(setup.orientation, 1)
+            self.assertTrue(setup.fit_to_page)
+            self.assertEqual(setup.fit_to_height, 0)
+            self.assertAlmostEqual(reloaded.get_page_margins(0).left, 0.5)
+            self.assertEqual(reloaded.get_print_area(0), "A1:F80")
+            self.assertEqual(reloaded.get_print_titles(0), ("1:2", ""))
+            self.assertEqual([b.id for b in reloaded.get_row_breaks(0)], [39])
+
+    def test_set_range_xf_index_materialises_the_rectangle(self) -> None:
+        with Workbook.create_default() as wb:
+            # Something other than the seeded default xf, so the range
+            # write is observable rather than deduping to index 0.
+            xf = wb.add_cell_xf(
+                CellXf(
+                    font_index=0,
+                    fill_index=0,
+                    border_index=0,
+                    num_fmt_id=0,
+                    horizontal_align=0,
+                    vertical_align=2,
+                    wrap_text=True,
+                    has_wrap_text=True,
+                )
+            )
+            wb.set_range_xf_index(0, 0, 0, 2, 2, xf)
+            for row, col in ((0, 0), (1, 1), (2, 2)):
+                self.assertEqual(wb.get_cell_xf_index(0, row, col), xf)
+            self.assertEqual(wb.get_cell_xf_index(0, 3, 3), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_sheet_features.py b/packages/python/tests/test_surface_sheet_features.py
new file mode 100644
index 000000000..8a81955de
--- /dev/null
+++ b/packages/python/tests/test_surface_sheet_features.py
@@ -0,0 +1,218 @@
+"""Sheet structure and feature surface tests."""
+
+from __future__ import annotations
+
+import unittest
+
+import formulon
+from formulon import (
+    DataValidationInput,
+    FormulonError,
+    MergeRange,
+    SheetProtection,
+    SheetVisibility,
+    ValueKind,
+    Workbook,
+)
+
+
+class SheetStructureTests(unittest.TestCase):
+    def test_add_rename_remove_move_sheet(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.add_sheet("Second")
+            wb.add_sheet("Third")
+            self.assertEqual(wb.sheet_count(), 3)
+            wb.rename_sheet(1, "Renamed")
+            self.assertEqual(wb.sheet_name(1), "Renamed")
+            wb.move_sheet(2, 0)
+            self.assertEqual(wb.sheet_name(0), "Third")
+            wb.remove_sheet(0)
+            self.assertEqual(wb.sheet_count(), 2)
+
+
+class MatrixEditTests(unittest.TestCase):
+    def test_insert_row_shifts_value_down(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_number(0, 0, 0, 11.0)  # A1
+            wb.insert_rows(0, 0, 1)
+            wb.recalc()
+            # A1 is now blank; the value moved to A2.
+            self.assertEqual(wb.get_value(0, 0, 0).kind, ValueKind.BLANK)
+            self.assertEqual(wb.get_value(0, 1, 0).to_python(), 11.0)
+
+    def test_delete_col_shifts_value_left(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_number(0, 0, 0, 1.0)  # A1
+            wb.set_number(0, 0, 1, 2.0)  # B1
+            wb.delete_cols(0, 0, 1)
+            wb.recalc()
+            # The old B1 collapses into A1.
+            self.assertEqual(wb.get_value(0, 0, 0).to_python(), 2.0)
+
+
+class MergeCommentHyperlinkTests(unittest.TestCase):
+    def test_merge_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.add_merge(0, MergeRange(0, 0, 1, 1))
+            merges = wb.get_merges(0)
+            self.assertEqual(len(merges), 1)
+            self.assertEqual((merges[0].first_row, merges[0].last_col), (0, 1))
+            wb.clear_merges(0)
+            self.assertEqual(wb.get_merges(0), [])
+
+    def test_comment_roundtrip_and_absent(self) -> None:
+        with Workbook.create_default() as wb:
+            self.assertIsNone(wb.get_comment(0, 0, 0))
+            wb.set_comment(0, 0, 0, "alice", "see note")
+            c = wb.get_comment(0, 0, 0)
+            self.assertIsNotNone(c)
+            self.assertEqual(c.author, "alice")
+            self.assertEqual(c.text, "see note")
+
+    def test_comment_invalid_sheet_raises_instead_of_looking_absent(self) -> None:
+        with Workbook.create_default() as wb:
+            with self.assertRaises(formulon.FormulonError) as ctx:
+                wb.get_comment(99, 0, 0)
+            self.assertEqual(ctx.exception.status, 2)  # kInvalidArgument
+
+    def test_hyperlink_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.add_hyperlink(0, 2, 3, "https://example.com", "Example", "tip")
+            links = wb.get_hyperlinks(0)
+            self.assertEqual(len(links), 1)
+            self.assertEqual((links[0].row, links[0].col), (2, 3))
+            self.assertEqual((links[0].last_row, links[0].last_col), (2, 3))
+            self.assertEqual(links[0].target, "https://example.com")
+            self.assertEqual(links[0].display, "Example")
+
+    def test_hyperlink_range_roundtrip_at_nonzero_coordinate(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.add_hyperlink_range(0, 4, 6, 7, 9, "https://example.com", "Range", "tip")
+            links = wb.get_hyperlinks(0)
+            self.assertEqual(len(links), 1)
+            self.assertEqual((links[0].row, links[0].col), (4, 6))
+            self.assertEqual((links[0].last_row, links[0].last_col), (7, 9))
+
+
+class ValidationTests(unittest.TestCase):
+    def test_list_validation_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.add_validation(
+                0,
+                DataValidationInput(
+                    type=3,  # list
+                    ranges=[MergeRange(0, 0, 4, 0)],
+                    allow_blank=True,
+                    formula1='"a,b,c"',
+                ),
+            )
+            self.assertEqual(wb.validation_count(0), 1)
+            dv = wb.get_validation_at(0, 0)
+            self.assertEqual(dv.type, 3)
+            self.assertTrue(dv.allow_blank)
+            self.assertEqual(dv.formula1, '"a,b,c"')
+            self.assertEqual(len(dv.ranges), 1)
+            wb.clear_validations(0)
+            self.assertEqual(wb.validation_count(0), 0)
+
+
+class SheetViewProtectionTests(unittest.TestCase):
+    def test_view_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_sheet_zoom(0, 150)
+            wb.set_sheet_freeze(0, 1, 2)
+            view = wb.get_sheet_view(0)
+            self.assertEqual(view.zoom_scale, 150)
+            self.assertEqual((view.freeze_rows, view.freeze_cols), (1, 2))
+
+    def test_view_display_defaults(self) -> None:
+        with Workbook.create_default() as wb:
+            view = wb.get_sheet_view(0)
+            self.assertTrue(view.show_grid_lines)
+            self.assertTrue(view.show_row_col_headers)
+            self.assertTrue(view.show_zeros)
+            self.assertFalse(view.right_to_left)
+            self.assertFalse(view.tab_selected)
+            self.assertEqual(view.view_mode, "")
+
+    def test_view_display_setters_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_sheet_show_grid_lines(0, False)
+            wb.set_sheet_show_row_col_headers(0, False)
+            wb.set_sheet_show_zeros(0, False)
+            wb.set_sheet_right_to_left(0, True)
+            wb.set_sheet_tab_selected(0, True)
+            wb.set_sheet_view_mode(0, "pageBreakPreview")
+            view = wb.get_sheet_view(0)
+            self.assertFalse(view.show_grid_lines)
+            self.assertFalse(view.show_row_col_headers)
+            self.assertFalse(view.show_zeros)
+            self.assertTrue(view.right_to_left)
+            self.assertTrue(view.tab_selected)
+            self.assertEqual(view.view_mode, "pageBreakPreview")
+            # An empty mode is a meaningful value (the OOXML-default
+            # "normal" view), not a no-op -- it must round-trip too.
+            wb.set_sheet_view_mode(0, "")
+            self.assertEqual(wb.get_sheet_view(0).view_mode, "")
+
+    def test_visibility_states_very_hidden(self) -> None:
+        with Workbook.create_default() as wb:
+            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.VISIBLE)
+            self.assertFalse(wb.get_sheet_view(0).tab_hidden)
+
+            wb.set_sheet_visibility(0, SheetVisibility.VERY_HIDDEN)
+            view = wb.get_sheet_view(0)
+            self.assertEqual(view.visibility, SheetVisibility.VERY_HIDDEN)
+            # The two-state view stays consistent: a very-hidden sheet is
+            # hidden to code that reads only the bool, never visible.
+            self.assertTrue(view.tab_hidden)
+
+            # "Hidden" says nothing a very-hidden sheet does not already
+            # satisfy, so it must not weaken the author's stronger choice.
+            wb.set_sheet_tab_hidden(0, True)
+            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.VERY_HIDDEN)
+
+            # Demotion is the other direction the bool cannot express.
+            wb.set_sheet_visibility(0, SheetVisibility.HIDDEN)
+            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.HIDDEN)
+
+            wb.set_sheet_tab_hidden(0, False)
+            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.VISIBLE)
+
+    def test_visibility_rejects_unknown_state(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_sheet_visibility(0, SheetVisibility.VERY_HIDDEN)
+            with self.assertRaises(FormulonError):
+                wb.set_sheet_visibility(0, 3)
+            # A refused call leaves the sheet as it was.
+            self.assertEqual(wb.get_sheet_view(0).visibility, SheetVisibility.VERY_HIDDEN)
+
+    def test_column_row_overrides(self) -> None:
+        with Workbook.create_default() as wb:
+            wb.set_column_width(0, 0, 2, 18.5)
+            cols = wb.get_sheet_columns(0)
+            explicit = next(c for c in cols if abs(c.width - 18.5) < 1e-9)
+            self.assertTrue(explicit.has_width)
+            self.assertFalse(explicit.has_style)
+            wb.set_column_width(0, 4, 4, 0.0)
+            zero = next(c for c in wb.get_sheet_columns(0) if c.first == 4 and c.last == 4)
+            self.assertEqual(zero.width, 0.0)
+            self.assertTrue(zero.has_width)
+            wb.set_row_height(0, 0, 30.0)
+            rows = wb.get_sheet_row_overrides(0)
+            explicit_row = next(r for r in rows if abs(r.height - 30.0) < 1e-9)
+            self.assertFalse(explicit_row.has_style)
+            self.assertEqual(explicit_row.style_xf, 0)
+
+    def test_protection_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            prot = SheetProtection(enabled=True, sheet=True, format_cells=True)
+            wb.set_sheet_protection(0, prot)
+            got = wb.get_sheet_protection(0)
+            self.assertTrue(got.enabled)
+            self.assertTrue(got.sheet)
+            self.assertTrue(got.format_cells)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_styles.py b/packages/python/tests/test_surface_styles.py
new file mode 100644
index 000000000..c6b6dcd95
--- /dev/null
+++ b/packages/python/tests/test_surface_styles.py
@@ -0,0 +1,235 @@
+"""Style surface tests."""
+
+from __future__ import annotations
+
+import unittest
+
+from formulon import (
+    ColorSpec,
+    DifferentialFormat,
+    FillRecord,
+    FontRecord,
+    Workbook,
+)
+
+
+class StyleTests(unittest.TestCase):
+    def test_font_numfmt_xf_roundtrip(self) -> None:
+        with Workbook.create_default() as wb:
+            fi = wb.add_font(FontRecord(name="Calibri", size=12.0, bold=True))
+            self.assertGreaterEqual(fi, 0)
+            font = wb.get_font(fi)
+            self.assertEqual(font.name, "Calibri")
+            self.assertTrue(font.bold)
+
+            fill = wb.add_fill(FillRecord(pattern=1, fg_argb=0xFFFF0000))
+            nf = wb.add_num_fmt("0.00")
+            self.assertGreater(nf, 0)
+            self.assertEqual(wb.get_num_fmt(nf), "0.00")
+
+            # add_cell_xf validates indices against the parallel tables, so a
+            # border must exist before it can be referenced.
+            border = wb.add_border({"left": {"style": 1, "color_argb": 0xFF000000}})
+
+            from formulon import CellXf
+
+            xf = wb.add_cell_xf(
+                CellXf(
+                    font_index=fi,
+                    fill_index=fill,
+                    border_index=border,
+                    num_fmt_id=nf,
+                    horizontal_align=0,
+                    vertical_align=0,
+                    wrap_text=False,
+                    text_rotation=255,
+                    indent=0,
+                    relative_indent=-3,
+                    shrink_to_fit=False,
+                    reading_order=0,
+                    justify_last_line=True,
+                )
+            )
+            wb.set_cell_xf_index(0, 0, 0, xf)
+            self.assertEqual(wb.get_cell_xf_index(0, 0, 0), xf)
+            resolved = wb.get_cell_xf(xf)
+            self.assertEqual(resolved.font_index, fi)
+            self.assertEqual(resolved.num_fmt_id, nf)
+            self.assertEqual(resolved.text_rotation, 255)
+            self.assertTrue(resolved.has_alignment)
+            self.assertEqual(resolved.indent, 0)
+            self.assertEqual(resolved.relative_indent, -3)
+            self.assertIs(resolved.shrink_to_fit, False)
+            self.assertEqual(resolved.reading_order, 0)
+            self.assertIs(resolved.justify_last_line, True)
+            self.assertFalse(resolved.has_horizontal_align)
+            self.assertTrue(resolved.has_vertical_align)
+            self.assertFalse(resolved.has_wrap_text)
+            self.assertTrue(resolved.has_justify_last_line)
+            self.assertEqual(wb.add_cell_xf(resolved), xf)
+
+            omitted = wb.add_cell_xf(
+                CellXf(
+                    font_index=fi,
+                    fill_index=fill,
+                    border_index=border,
+                    num_fmt_id=nf,
+                    horizontal_align=0,
+                    vertical_align=2,
+                    wrap_text=False,
+                )
+            )
+            self.assertFalse(wb.get_cell_xf(omitted).has_alignment)
+
+            explicit_empty = wb.add_cell_xf(
+                CellXf(
+                    font_index=fi,
+                    fill_index=fill,
+                    border_index=border,
+                    num_fmt_id=nf,
+                    horizontal_align=0,
+                    vertical_align=2,
+                    wrap_text=False,
+                    has_alignment=True,
+                )
+            )
+            self.assertNotEqual(explicit_empty, omitted)
+            self.assertTrue(wb.get_cell_xf(explicit_empty).has_alignment)
+
+    def test_font_vert_align_roundtrip_is_the_identity(self) -> None:
+        with Workbook.create_default() as wb:
+            index = wb.add_font(FontRecord(name="Arial", size=12.0, vert_align=1, color_argb=0xFF112233))
+            self.assertEqual(wb.get_font(index).vert_align, 1)
+
+            before = wb.font_count()
+            self.assertEqual(wb.add_font(wb.get_font(index)), index)
+            self.assertEqual(wb.font_count(), before)
+
+    def test_font_one_field_rewrite_preserves_the_superscript(self) -> None:
+        with Workbook.create_default() as wb:
+            index = wb.add_font(FontRecord(name="Arial", size=12.0, vert_align=1, color_argb=0xFF112233))
+            edited = wb.get_font(index)
+            edited.color_argb = 0xFF00FF00
+            recolored = wb.add_font(edited)
+            self.assertNotEqual(recolored, index)
+            reread = wb.get_font(recolored)
+            self.assertEqual(reread.vert_align, 1)
+            self.assertEqual(reread.color_argb, 0xFF00FF00)
+
+    def test_dxf_font_vert_align_roundtrip_is_the_identity(self) -> None:
+        with Workbook.create_default() as wb:
+            index = wb.add_dxf(DifferentialFormat(font=FontRecord(name="Calibri", size=9.0, vert_align=1)))
+            got = wb.get_dxf(index)
+            self.assertIsNotNone(got.font)
+            self.assertEqual(got.font.vert_align, 1)
+
+            before = wb.dxf_count()
+            self.assertEqual(wb.add_dxf(got), index)
+            self.assertEqual(wb.dxf_count(), before)
+
+    def test_dxf_roundtrip_and_dedup(self) -> None:
+        with Workbook.create_default() as wb:
+            record = DifferentialFormat(
+                font=FontRecord(name="Arial", size=12.0, bold=True, color_argb=0xFFFF0000),
+                fill=FillRecord(pattern=1, fg_argb=0xFFFFFF00),
+                num_fmt_id=164,
+                num_fmt_code="0.00",
+            )
+            index = wb.add_dxf(record)
+            self.assertEqual(wb.add_dxf(record), index)
+            self.assertEqual(wb.dxf_count(), 1)
+            got = wb.get_dxf(index)
+            self.assertIsNotNone(got.font)
+            self.assertEqual(got.font.name, "Arial")
+            self.assertTrue(got.font.bold)
+            self.assertIsNotNone(got.fill)
+            self.assertEqual(got.fill.fg_argb, 0xFFFFFF00)
+            self.assertEqual(got.num_fmt_id, 164)
+            self.assertEqual(got.num_fmt_code, "0.00")
+
+    def test_dxf_alignment_and_protection_xml_survive_get_add_and_save_load(self) -> None:
+        alignment_xml = '<alignment horizontal="center" wrapText="1"/>'
+        protection_xml = '<protection locked="0" hidden="1"/>'
+        with Workbook.create_default() as wb:
+            alignment_index = wb.add_dxf(DifferentialFormat(alignment_xml=alignment_xml))
+            protection_index = wb.add_dxf(DifferentialFormat(protection_xml=protection_xml))
+            self.assertNotEqual(alignment_index, protection_index)
+
+            got_alignment = wb.get_dxf(alignment_index)
+            self.assertEqual(got_alignment.alignment_xml, alignment_xml)
+            self.assertEqual(got_alignment.protection_xml, "")
+            got_protection = wb.get_dxf(protection_index)
+            self.assertEqual(got_protection.alignment_xml, "")
+            self.assertEqual(got_protection.protection_xml, protection_xml)
+            self.assertEqual(wb.add_dxf(got_alignment), alignment_index)
+            self.assertEqual(wb.add_dxf(got_protection), protection_index)
+
+            with Workbook.load(wb.save()) as reloaded:
+                reloaded_alignment = reloaded.get_dxf(alignment_index)
+                reloaded_protection = reloaded.get_dxf(protection_index)
+                self.assertEqual(reloaded_alignment.alignment_xml, alignment_xml)
+                self.assertEqual(reloaded_alignment.protection_xml, "")
+                self.assertEqual(reloaded_protection.alignment_xml, "")
+                self.assertEqual(reloaded_protection.protection_xml, protection_xml)
+                self.assertEqual(reloaded.add_dxf(reloaded_alignment), alignment_index)
+                self.assertEqual(reloaded.add_dxf(reloaded_protection), protection_index)
+
+    def test_selector_colours_survive_get_add_identity_and_save_load(self) -> None:
+        theme = ColorSpec(kind=2, theme=3, tint=0.5)
+        indexed = ColorSpec(kind=3, indexed=9)
+        automatic = ColorSpec(kind=4)
+        with Workbook.create_default() as wb:
+            font_index = wb.add_font(FontRecord(name="SelectorFont", size=11.0, color_argb=0x01020304, color=theme))
+            got_font = wb.get_font(font_index)
+            self.assertEqual(got_font.color, theme)
+            self.assertEqual(got_font.color_argb, 0x01020304)
+            self.assertEqual(wb.add_font(got_font), font_index)
+
+            fill_index = wb.add_fill(
+                FillRecord(
+                    pattern=1,
+                    fg_argb=0x05060708,
+                    bg_argb=0x090A0B0C,
+                    fg=indexed,
+                    bg=automatic,
+                )
+            )
+            got_fill = wb.get_fill(fill_index)
+            self.assertEqual(got_fill.fg, indexed)
+            self.assertEqual(got_fill.bg, automatic)
+            self.assertEqual(wb.add_fill(got_fill), fill_index)
+
+            border = {
+                "left": {"style": 1, "color_argb": 0x01020304, "color": theme},
+                "right": {"style": 1, "color_argb": 0x05060708, "color": indexed},
+                "top": {"style": 1, "color_argb": 0x090A0B0C, "color": automatic},
+            }
+            border_index = wb.add_border(border)
+            got_border = wb.get_border(border_index)
+            self.assertEqual(got_border["left"]["color"], theme)
+            self.assertEqual(got_border["right"]["color"], indexed)
+            self.assertEqual(got_border["top"]["color"], automatic)
+            self.assertEqual(wb.add_border(got_border), border_index)
+
+            dxf_index = wb.add_dxf(
+                DifferentialFormat(
+                    font=FontRecord(name="DxfSelector", size=9.0, color_argb=0x11121314, color=automatic),
+                    fill=FillRecord(pattern=1, fg_argb=0x15161718, fg=indexed),
+                    border={"left": {"style": 1, "color_argb": 0x191A1B1C, "color": theme}},
+                )
+            )
+            got_dxf = wb.get_dxf(dxf_index)
+            self.assertEqual(got_dxf.font.color, automatic)
+            self.assertEqual(got_dxf.fill.fg, indexed)
+            self.assertEqual(got_dxf.border["left"]["color"], theme)
+            self.assertEqual(wb.add_dxf(got_dxf), dxf_index)
+
+            with Workbook.load(wb.save()) as reloaded:
+                self.assertEqual(reloaded.get_font(font_index).color, theme)
+                self.assertEqual(reloaded.get_fill(fill_index).fg, indexed)
+                self.assertEqual(reloaded.get_border(border_index)["left"]["color"], theme)
+                self.assertEqual(reloaded.get_dxf(dxf_index).font.color, automatic)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/tests/test_surface_theme_styles.py b/packages/python/tests/test_surface_theme_styles.py
new file mode 100644
index 000000000..c2cc66272
--- /dev/null
+++ b/packages/python/tests/test_surface_theme_styles.py
@@ -0,0 +1,127 @@
+"""Theme, colour resolution, effective style and named-style removal surface tests."""
+
+from __future__ import annotations
+
+import unittest
+
+from formulon import (
+    CellStyle,
+    CellXf,
+    ColorContext,
+    ColorResolution,
+    ColorSpec,
+    EffectiveStyleSource,
+    FontRecord,
+    FormulonError,
+    ThemeFonts,
+    ThemeSource,
+    Workbook,
+)
+
+_THEME_KIND = 2
+_RGB_KIND = 1
+_AUTO_KIND = 4
+
+
+def _xf(font_index: int) -> CellXf:
+    return CellXf(
+        font_index=font_index,
+        fill_index=0,
+        border_index=0,
+        num_fmt_id=0,
+        horizontal_align=0,
+        vertical_align=2,
+        wrap_text=False,
+    )
+
+
+class ThemeTests(unittest.TestCase):
+    def test_get_theme_reports_twelve_colors_and_fonts(self) -> None:
+        with Workbook.create_default() as wb:
+            theme = wb.get_theme()
+        self.assertIn(theme.source, (ThemeSource.PART, ThemeSource.DEFAULT))
+        self.assertEqual(len(theme.colors), 12)
+        self.assertTrue(theme.fonts.minor_latin)
+
+    def test_set_theme_colors_roundtrip(self) -> None:
+        colors = [0xFF000000 | (0x112233 * (i + 1) & 0xFFFFFF) for i in range(12)]
+        with Workbook.create_default() as wb:
+            wb.set_theme_colors(colors)
+            theme = wb.get_theme()
+            with self.assertRaises(ValueError):
+                wb.set_theme_colors(colors[:11])
+        self.assertEqual(theme.source, ThemeSource.PART)
+        self.assertEqual(theme.colors, colors)
+
+    def test_set_theme_fonts_roundtrip(self) -> None:
+        fonts = ThemeFonts("Arial", "MS Gothic", "Verdana", "Meiryo")
+        with Workbook.create_default() as wb:
+            wb.set_theme_fonts(fonts)
+            self.assertEqual(wb.get_theme().fonts, fonts)
+
+    def test_resolve_color(self) -> None:
+        with Workbook.create_default() as wb:
+            rgb = wb.resolve_color(ColorSpec(kind=_RGB_KIND, rgb=0xFF123456))
+            self.assertEqual(rgb.argb, 0xFF123456)
+            self.assertEqual(rgb.resolution, ColorResolution.EXACT)
+
+            colors = [0xFF000000 + i * 0x010101 for i in range(12)]
+            wb.set_theme_colors(colors)
+            # Theme index 1 is dk1, which is clrScheme slot 0.
+            theme = wb.resolve_color(ColorSpec(kind=_THEME_KIND, theme=1))
+            self.assertEqual(theme.argb, colors[0])
+            self.assertEqual(theme.resolution, ColorResolution.EXACT)
+
+            auto_font = wb.resolve_color(ColorSpec(kind=_AUTO_KIND), ColorContext.FONT)
+            auto_fill = wb.resolve_color(ColorSpec(kind=_AUTO_KIND), ColorContext.FILL_FOREGROUND)
+            self.assertEqual(auto_font.argb, 0xFF000000)
+            self.assertEqual(auto_fill.argb, 0xFFFFFFFF)
+            self.assertEqual(auto_font.resolution, ColorResolution.AUTO_CONTEXT)
+
+            with self.assertRaises(FormulonError):
+                wb.resolve_color(ColorSpec(kind=_RGB_KIND), 99)
+
+
+class EffectiveStyleTests(unittest.TestCase):
+    def test_default_cell_reads_default_xf(self) -> None:
+        with Workbook.create_default() as wb:
+            style = wb.get_effective_style(0, 4, 4)
+        self.assertEqual(style.xf_index, 0)
+        self.assertEqual(style.source, EffectiveStyleSource.DEFAULT)
+        self.assertEqual(len(style.borders), 5)
+        self.assertTrue(style.locked)
+        self.assertEqual(style.num_fmt_code, "General")
+
+    def test_cell_xf_is_reported(self) -> None:
+        with Workbook.create_default() as wb:
+            font = wb.add_font(FontRecord(name="Calibri", size=11.0, bold=True, color_argb=0xFFFF0000))
+            xf = wb.add_cell_xf(_xf(font))
+            wb.set_cell_xf_index(0, 1, 1, xf)
+            style = wb.get_effective_style(0, 1, 1)
+            with self.assertRaises(FormulonError):
+                wb.get_effective_style(99, 0, 0)
+        self.assertEqual(style.xf_index, xf)
+        self.assertEqual(style.source, EffectiveStyleSource.CELL)
+        self.assertEqual(style.font_index, font)
+
+
+class NamedStyleTests(unittest.TestCase):
+    def test_set_and_remove_cell_style(self) -> None:
+        with Workbook.create_default() as wb:
+            xf_id = wb.add_cell_style_xf(_xf(0))
+            wb.set_cell_style(CellStyle("Mine", xf_id, hidden=True))
+            names = {wb.get_cell_style(i).name: wb.get_cell_style(i) for i in range(wb.cell_style_count())}
+            self.assertIn("Mine", names)
+            self.assertEqual(names["Mine"].xf_id, xf_id)
+            self.assertTrue(names["Mine"].hidden)
+            wb.remove_cell_style("Mine")
+            after = [wb.get_cell_style(i).name for i in range(wb.cell_style_count())]
+            self.assertNotIn("Mine", after)
+            with self.assertRaises(FormulonError):
+                wb.remove_cell_style("Mine")
+            with self.assertRaises(FormulonError):
+                wb.set_cell_style(CellStyle("", xf_id))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/packages/python/uv.lock b/packages/python/uv.lock
index f3a44ab66..0afe6a781 100644
--- a/packages/python/uv.lock
+++ b/packages/python/uv.lock
@@ -4,7 +4,7 @@ requires-python = ">=3.9"
 
 [[package]]
 name = "formulon"
-version = "0.12.0"
+version = "0.13.0"
 source = { editable = "." }
 dependencies = [
     { name = "wasmtime" },
diff --git a/src/auto_filter.cpp b/src/auto_filter.cpp
new file mode 100644
index 000000000..8f44a0154
--- /dev/null
+++ b/src/auto_filter.cpp
@@ -0,0 +1,121 @@
+#include "auto_filter.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#include "sheet.h"
+#include "table.h"
+#include "utils/a1_column.h"
+#include "utils/a1_ref.h"
+#include "workbook.h"
+
+namespace formulon {
+
+namespace {
+
+Error invalid(std::string message) {
+  return make_error(FormulonErrorCode::kAutoFilterInvalid, std::move(message));
+}
+
+}  // namespace
+
+bool AutoFilter::has_criteria() const noexcept {
+  for (const FilterColumn& col : columns) {
+    if (col.kind != FilterKind::kNone) {
+      return true;
+    }
+  }
+  return false;
+}
+
+std::optional<MergeRange> parse_a1_rectangle(std::string_view text) noexcept {
+  const std::size_t colon = text.find(':');
+  MergeRange rect;
+  if (!a1::parse_a1_ref(text.substr(0, colon), &rect.first_row, &rect.first_col)) {
+    return std::nullopt;
+  }
+  if (colon == std::string_view::npos) {
+    rect.last_row = rect.first_row;
+    rect.last_col = rect.first_col;
+  } else if (!a1::parse_a1_ref(text.substr(colon + 1U), &rect.last_row, &rect.last_col)) {
+    return std::nullopt;
+  }
+  if (rect.first_row > rect.last_row || rect.first_col > rect.last_col) {
+    return std::nullopt;
+  }
+  return rect;
+}
+
+bool append_a1_rectangle(std::string& out, const MergeRange& rect) {
+  const auto append_cell = [&out](std::uint32_t row, std::uint32_t col) {
+    if (!a1::append_column_letters(out, col)) {
+      return false;
+    }
+    out += std::to_string(static_cast<std::uint64_t>(row) + 1U);
+    return true;
+  };
+  if (!append_cell(rect.first_row, rect.first_col)) {
+    return false;
+  }
+  if (rect.first_row == rect.last_row && rect.first_col == rect.last_col) {
+    return true;
+  }
+  out += ':';
+  return append_cell(rect.last_row, rect.last_col);
+}
+
+Expected<void, Error> validate_auto_filter(const AutoFilter& filter) {
+  if (filter.is_opaque()) {
+    return invalid("autoFilter: model holds an unparsed fragment");
+  }
+  std::string probe;
+  if (filter.range.first_row > filter.range.last_row || filter.range.first_col > filter.range.last_col ||
+      !append_a1_rectangle(probe, filter.range) || !parse_a1_rectangle(probe)) {
+    return invalid("autoFilter: range is not an in-grid rectangle");
+  }
+  const std::uint64_t width = static_cast<std::uint64_t>(filter.range.last_col) - filter.range.first_col + 1U;
+  for (std::size_t i = 0; i < filter.columns.size(); ++i) {
+    const FilterColumn& col = filter.columns[i];
+    if (col.col_id >= width || (i > 0U && col.col_id <= filter.columns[i - 1U].col_id)) {
+      return invalid("autoFilter: column ids must be ascending and inside the range");
+    }
+    if (col.kind == FilterKind::kCustom && (col.custom.filters.empty() || col.custom.filters.size() > 2U)) {
+      return invalid("autoFilter: a custom filter holds one or two conditions");
+    }
+    for (const DateGroupItem& item : col.values.date_groups) {
+      const auto level = static_cast<std::size_t>(item.grouping);
+      if (level > static_cast<std::size_t>(DateTimeGrouping::kSecond) || item.year > 9999U ||
+          (level >= 1U && (item.month < 1U || item.month > 12U)) ||
+          (level >= 2U && (item.day < 1U || item.day > 31U)) || item.hour > 23U || item.minute > 59U ||
+          item.second > 59U) {
+        return invalid("autoFilter: date group item fields do not fit its grouping");
+      }
+    }
+  }
+  return Expected<void, Error>::Ok();
+}
+
+bool sheet_has_filter_criteria(const Workbook* wb, const Sheet& sheet) noexcept {
+  if (const AutoFilter* own = sheet.auto_filter(); own != nullptr && own->has_criteria()) {
+    return true;
+  }
+  if (wb == nullptr) {
+    return false;
+  }
+  for (const TableMetadata& table : wb->tables()) {
+    const AutoFilter* f = table.auto_filter_xml.get();
+    if (f == nullptr || !f->has_criteria() || table.sheet_index >= wb->sheet_count()) {
+      continue;
+    }
+    if (&wb->sheet(table.sheet_index) == &sheet) {
+      return true;
+    }
+  }
+  return false;
+}
+
+}  // namespace formulon
diff --git a/src/auto_filter.h b/src/auto_filter.h
new file mode 100644
index 000000000..e60dec6e0
--- /dev/null
+++ b/src/auto_filter.h
@@ -0,0 +1,258 @@
+//
+// AutoFilter model: the typed filter columns and criteria of a sheet or table
+// AutoFilter (ECMA-376 §18.3.2, `CT_AutoFilter`).
+//
+// The typed model is the source of truth; `io/auto_filter_xml.h` reads and
+// writes the `<autoFilter>` element. Content the model does not name is kept
+// as raw XML on the owning record, and a fragment that does not parse into
+// the model at all is kept verbatim as `opaque_xml`.
+
+#ifndef FORMULON_AUTO_FILTER_H_
+#define FORMULON_AUTO_FILTER_H_
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "cf/cf_types.h"
+#include "merge_range.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon {
+
+class Sheet;
+class Workbook;
+
+/// Attributes retained verbatim as `(name, value)` pairs, in document order.
+using RawAttributes = std::vector<std::pair<std::string, std::string>>;
+
+/// Which criterion a filter column carries.
+enum class FilterKind : std::uint8_t {
+  kNone = 0,
+  kValues = 1,
+  kCustom = 2,
+  kTop10 = 3,
+  kDynamic = 4,
+  kColor = 5,
+  kIcon = 6,
+};
+
+/// `ST_DateTimeGrouping`: the granularity a date group item matches at.
+enum class DateTimeGrouping : std::uint8_t { kYear = 0, kMonth, kDay, kHour, kMinute, kSecond };
+
+/// One `<dateGroupItem>`. Fields finer than `grouping` are unused and zero.
+struct DateGroupItem {
+  std::uint16_t year = 0;
+  std::uint8_t month = 0;
+  std::uint8_t day = 0;
+  std::uint8_t hour = 0;
+  std::uint8_t minute = 0;
+  std::uint8_t second = 0;
+  DateTimeGrouping grouping = DateTimeGrouping::kYear;
+};
+
+/// `<filters>`: a list of displayed values, date groups and/or blanks.
+struct ValueFilters {
+  bool blank = false;
+  /// `calendarType`; empty means the schema default `none`.
+  std::string calendar_type;
+  std::vector<std::string> values;
+  std::vector<DateGroupItem> date_groups;
+};
+
+/// `ST_FilterOperator`.
+enum class FilterOperator : std::uint8_t {
+  kEqual = 0,
+  kLessThan,
+  kLessThanOrEqual,
+  kNotEqual,
+  kGreaterThanOrEqual,
+  kGreaterThan,
+};
+
+/// One `<customFilter>`.
+struct CustomFilter {
+  FilterOperator op = FilterOperator::kEqual;
+  std::string val;
+};
+
+/// `<customFilters>`: one or two conditions joined by and/or.
+struct CustomFilters {
+  bool and_join = false;
+  std::vector<CustomFilter> filters;
+};
+
+/// `<top10>`.
+struct Top10Filter {
+  bool top = true;
+  bool percent = false;
+  double val = 0.0;
+  std::optional<double> filter_val;
+};
+
+/// `ST_DynamicFilterType`, in schema order.
+enum class DynamicFilterType : std::uint8_t {
+  kNull = 0,
+  kAboveAverage,
+  kBelowAverage,
+  kTomorrow,
+  kToday,
+  kYesterday,
+  kNextWeek,
+  kThisWeek,
+  kLastWeek,
+  kNextMonth,
+  kThisMonth,
+  kLastMonth,
+  kNextQuarter,
+  kThisQuarter,
+  kLastQuarter,
+  kNextYear,
+  kThisYear,
+  kLastYear,
+  kYearToDate,
+  kQ1,
+  kQ2,
+  kQ3,
+  kQ4,
+  kM1,
+  kM2,
+  kM3,
+  kM4,
+  kM5,
+  kM6,
+  kM7,
+  kM8,
+  kM9,
+  kM10,
+  kM11,
+  kM12,
+};
+
+/// `<dynamicFilter>`. `val`/`max_val` are the bounds Excel stored when it
+/// last applied the filter; ISO strings are kept as written.
+struct DynamicFilter {
+  DynamicFilterType type = DynamicFilterType::kNull;
+  std::optional<double> val;
+  std::optional<double> max_val;
+  std::string val_iso;
+  std::string max_val_iso;
+};
+
+/// `<colorFilter>`: the dxf whose fill (`cell_color`) or font colour matches.
+struct ColorFilter {
+  std::optional<std::uint32_t> dxf_id;
+  bool cell_color = true;
+};
+
+/// `<iconFilter>`. An absent `icon_id` means "no icon".
+struct IconFilter {
+  cf::IconSetName icon_set = cf::IconSetName::Three_Arrows;
+  std::optional<std::uint32_t> icon_id;
+};
+
+/// One `<filterColumn>`. `col_id` is the 0-based offset from the AutoFilter
+/// range's first column. Only the member selected by `kind` is meaningful.
+struct FilterColumn {
+  std::uint32_t col_id = 0;
+  bool hidden_button = false;
+  bool show_button = true;
+  FilterKind kind = FilterKind::kNone;
+  ValueFilters values;
+  CustomFilters custom;
+  Top10Filter top10;
+  DynamicFilter dynamic;
+  ColorFilter color;
+  IconFilter icon;
+  RawAttributes extra_attrs;
+  /// Unknown child elements, emitted after the criterion.
+  std::string extra_xml;
+  /// `<ext>` children of the column's `<extLst>` other than the date-group
+  /// extension the model lifts into `values`.
+  std::string ext_xml;
+};
+
+/// `ST_SortBy`.
+enum class SortBy : std::uint8_t { kValue = 0, kCellColor, kFontColor, kIcon };
+
+/// `ST_SortMethod`.
+enum class SortMethod : std::uint8_t { kNone = 0, kPinYin, kStroke };
+
+/// One `<sortCondition>`.
+struct SortCondition {
+  MergeRange ref;
+  bool descending = false;
+  SortBy sort_by = SortBy::kValue;
+  std::string custom_list;
+  std::optional<std::uint32_t> dxf_id;
+  cf::IconSetName icon_set = cf::IconSetName::Three_Arrows;
+  std::optional<std::uint32_t> icon_id;
+};
+
+/// `<sortState>` nested in an AutoFilter.
+struct SortState {
+  MergeRange ref;
+  bool column_sort = false;
+  bool case_sensitive = false;
+  SortMethod sort_method = SortMethod::kNone;
+  std::vector<SortCondition> conditions;
+  RawAttributes extra_attrs;
+  /// Raw `<extLst>` element, or empty.
+  std::string ext_lst_xml;
+};
+
+/// A sheet or table AutoFilter. When `opaque_xml` is non-empty the element
+/// did not parse and every other field is meaningless.
+struct AutoFilter {
+  MergeRange range;
+  std::vector<FilterColumn> columns;
+  std::optional<SortState> sort;
+  /// Raw `<extLst>` element of the AutoFilter itself, or empty.
+  std::string ext_lst_xml;
+  RawAttributes extra_attrs;
+  std::string opaque_xml;
+
+  bool is_opaque() const noexcept { return !opaque_xml.empty(); }
+
+  /// True when at least one column carries a criterion.
+  bool has_criteria() const noexcept;
+};
+
+/// Parses an A1 rectangle (`B2:F12`, or a single cell `D6`) without `$`
+/// anchors or a sheet qualifier.
+std::optional<MergeRange> parse_a1_rectangle(std::string_view text) noexcept;
+
+/// Appends `rect` in A1 form, collapsing a single cell to one address.
+/// Returns false when a coordinate is outside the grid.
+bool append_a1_rectangle(std::string& out, const MergeRange& rect);
+
+/// Checks a caller-built model: a typed, in-grid range, column ids inside
+/// the range and strictly ascending, one or two custom conditions, and date
+/// groups whose fields fit their grouping. Returns `kAutoFilterInvalid`.
+Expected<void, Error> validate_auto_filter(const AutoFilter& filter);
+
+/// True when the sheet AutoFilter, or the AutoFilter of a table on the
+/// sheet, carries at least one criterion. Excel then treats every hidden row
+/// of the sheet as filtered, inside the filter range or not.
+bool sheet_has_filter_criteria(const Workbook* wb, const Sheet& sheet) noexcept;
+
+/// An optional AutoFilter held by a sheet or table.
+class AutoFilterSlot {
+ public:
+  bool empty() const noexcept { return !value_.has_value(); }
+  const AutoFilter* get() const noexcept { return value_ ? &*value_ : nullptr; }
+  AutoFilter* get() noexcept { return value_ ? &*value_ : nullptr; }
+  void set(AutoFilter filter) { value_ = std::move(filter); }
+  void reset() noexcept { value_.reset(); }
+
+ private:
+  std::optional<AutoFilter> value_;
+};
+
+}  // namespace formulon
+
+#endif  // FORMULON_AUTO_FILTER_H_
diff --git a/src/c_api/formulon_c.h b/src/c_api/formulon_c.h
index 6d0e9b84c..74b9050d0 100644
--- a/src/c_api/formulon_c.h
+++ b/src/c_api/formulon_c.h
@@ -1214,6 +1214,157 @@ FM_API fm_status_t fm_workbook_cell_count(const fm_workbook_t* wb, size_t sheet_
 FM_API fm_status_t fm_workbook_cell_at(const fm_workbook_t* wb, size_t sheet_index, size_t idx, uint32_t* out_row,
                                        uint32_t* out_col, const char** out_formula, fm_value_t* out_value);
 
+/**
+ * @brief Reads the formula of the cell at `(row, col)` in A1 notation.
+ *
+ * The text is the stored formula verbatim, leading `=` included, as
+ * `fm_workbook_cell_at` reports it. A cell that holds no formula (a literal,
+ * a spill phantom, or no cell at all) yields `""`.
+ *
+ * `*out_formula` is a read-scratch-backed view: valid until the next
+ * successful scratch-backed read, any mutation, or handle destruction.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or the
+ *         coordinate is outside the grid.
+ */
+FM_API fm_status_t fm_workbook_get_formula(const fm_workbook_t* wb, size_t sheet_index, uint32_t row, uint32_t col,
+                                           const char** out_formula);
+
+/**
+ * @brief Reads the formula of the cell at `(row, col)` in R1C1 notation,
+ *        relative to that cell.
+ *
+ * The text carries no leading `=`, and follows the A1 formatter's spacing
+ * and case rules. A cell that holds no formula yields `""`. Lifetime as
+ * `fm_workbook_get_formula`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or the
+ *         coordinate is outside the grid;
+ *         `kParserUnexpectedToken` (1000) when the stored formula does not
+ *         parse.
+ */
+FM_API fm_status_t fm_workbook_get_formula_r1c1(const fm_workbook_t* wb, size_t sheet_index, uint32_t row, uint32_t col,
+                                                const char** out_formula);
+
+/** @brief Opaque owned snapshot of one page of cells inside a rectangle. */
+typedef struct fm_cell_range fm_cell_range_t;
+
+/**
+ * @brief Enumerates the populated cells of an inclusive rectangle, one page
+ *        at a time.
+ *
+ * A cell is populated when it holds a formula or a non-blank value; spill
+ * phantoms are included with their spilled value. Cells come in row-major
+ * order. `cursor` is the position to resume from, encoded as
+ * `row * 16384 + col`: pass `0` for the first page and the value
+ * `fm_cell_range_next_cursor` reported for each following one. A page holds
+ * at most `limit` cells; `0` means the maximum, 65,536, and larger values
+ * are capped to it.
+ *
+ * On success `*out` is an owned handle the caller releases with
+ * `fm_cell_range_destroy`; it is a snapshot, so later mutations do not
+ * change it.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `out == NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range, the
+ *         rectangle is inverted or outside the grid, or `cursor` is past
+ *         the last cell of the grid.
+ */
+FM_API fm_status_t fm_sheet_cells_in_range(const fm_workbook_t* wb, size_t sheet_index, uint32_t first_row,
+                                           uint32_t first_col, uint32_t last_row, uint32_t last_col, uint64_t cursor,
+                                           uint32_t limit, fm_cell_range_t** out);
+
+/**
+ * @brief Number of cells in the page.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_cell_range_count(const fm_cell_range_t* range, size_t* out_count);
+
+/**
+ * @brief Reads cell `idx` of the page.
+ *
+ * `*out_formula` is the stored A1 formula (as `fm_workbook_get_formula`
+ * reports it), or `NULL` when the cell holds no formula; `out_formula` may
+ * be `NULL` to skip it. Both the formula and a `FM_VAL_TEXT` payload are
+ * owned by the handle and stay valid until `fm_cell_range_destroy`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `range`, `out_row`, `out_col`, or
+ *         `out_value` is `NULL`;
+ *         `kInvalidArgument` when `idx` is out of range.
+ */
+FM_API fm_status_t fm_cell_range_at(const fm_cell_range_t* range, size_t idx, uint32_t* out_row, uint32_t* out_col,
+                                    const char** out_formula, fm_value_t* out_value);
+
+/**
+ * @brief Reads the cursor that resumes after this page, or `UINT64_MAX` when
+ *        the rectangle holds no further populated cell.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_cell_range_next_cursor(const fm_cell_range_t* range, uint64_t* out_cursor);
+
+/** @brief Releases a page handle. `range == NULL` is a no-op. */
+FM_API void fm_cell_range_destroy(fm_cell_range_t* range);
+
+/* -------------------------------------------------------------------------- */
+/* Display text                                                               */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * @brief Outcome of a display-text rendering.
+ *
+ * `FM_DISPLAY_OVERFLOW`: the value cannot be shown in the format (a date
+ * serial outside the calendar, for one) and the text is `"########"`.
+ * `FM_DISPLAY_INVALID_FORMAT`: the format code is malformed and the text is
+ * the General rendering.
+ */
+typedef enum {
+  FM_DISPLAY_OK = 0,
+  FM_DISPLAY_OVERFLOW = 1,
+  FM_DISPLAY_INVALID_FORMAT = 2,
+} fm_display_status_t;
+
+/**
+ * @brief Reads the text Excel displays for the cell at `(row, col)`.
+ *
+ * Rendered from the resolved value and effective cell/row/column/default
+ * XF number format under the workbook's date system, independent of column
+ * width: a `*x` repeat fill contributes no characters and an overflow is
+ * reported through `*out_status` rather than as a width-dependent `#` run.
+ * A coordinate with no value or spill result is `""`. `*out_text` is a
+ * read-scratch-backed view.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or the
+ *         coordinate is outside the grid.
+ */
+FM_API fm_status_t fm_workbook_get_display_text(const fm_workbook_t* wb, size_t sheet_index, uint32_t row, uint32_t col,
+                                                const char** out_text, int32_t* out_status);
+
+/**
+ * @brief Renders `value` under the stored-form number format `format_code`
+ *        (`General`, `[Red]`, ...), using the workbook's date system.
+ *
+ * An empty `format_code` means General. `value` must be blank, a number,
+ * a boolean, text, or an error. `*out_text` is a read-scratch-backed view.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`, or a
+ *         `FM_VAL_TEXT` value carries a `NULL` text;
+ *         `kInvalidArgument` when the value kind is not one of the above,
+ *         a number is NaN or infinite, or an error code is out of range.
+ */
+FM_API fm_status_t fm_workbook_format_value(const fm_workbook_t* wb, const fm_value_t* value, const char* format_code,
+                                            const char** out_text, int32_t* out_status);
+
 /**
  * @brief Returns the number of defined names attached to the workbook.
  *
@@ -1515,6 +1666,23 @@ FM_API fm_status_t fm_sheet_get_merge_at(fm_workbook_t* wb, uint32_t sheet, uint
  */
 FM_API fm_status_t fm_sheet_get_merge_count(fm_workbook_t* wb, uint32_t sheet, uint32_t* out_count);
 
+/**
+ * @brief Copies every merge range on `sheet` that intersects `range` into
+ *        the caller's buffer, in storage order.
+ *
+ * `*out_count` always receives the total number of intersecting merges; at
+ * most `capacity` of them are written to `out`. Call with `capacity == 0`
+ * (and `out` may then be `NULL`) to size the buffer first. `range` corners
+ * are normalised, mirroring `fm_sheet_remove_merge`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb` or `out_count` is `NULL`, or `out`
+ *         is `NULL` while `capacity > 0`;
+ *         `kInvalidArgument` when `sheet` is out of range.
+ */
+FM_API fm_status_t fm_sheet_merges_in_range(fm_workbook_t* wb, uint32_t sheet, fm_merge_range range,
+                                            fm_merge_range* out, uint32_t capacity, uint32_t* out_count);
+
 /**
  * @brief Inserts or replaces the comment at `(row, col)` on `sheet`.
  *        Pass `text == NULL || text[0] == '\0'` to remove an existing
@@ -1524,11 +1692,21 @@ FM_API fm_status_t fm_sheet_get_merge_count(fm_workbook_t* wb, uint32_t sheet, u
  * @return `kOk` on success;
  *         `kBindingNullPointer` if `wb == NULL`;
  *         `kInvalidArgument` when `sheet` is out of range or the coordinate
- *         is outside the Excel grid.
+ *         is outside the Excel grid;
+ *         `kThreadedCommentInvalid` when the cell already holds a threaded
+ *         comment (a cell carries a note or a thread, never both).
+ *         Replacing a note keeps its `xr:uid`.
  */
 FM_API fm_status_t fm_sheet_set_comment(fm_workbook_t* wb, uint32_t sheet, uint32_t row, uint32_t col,
                                         const char* author, const char* text);
 
+/** @brief Data-validation error style (`fm_data_validation::error_style`, `fm_validation_outcome::error_style`). */
+typedef enum {
+  FM_VALIDATION_ERROR_STYLE_STOP = 0,
+  FM_VALIDATION_ERROR_STYLE_WARNING = 1,
+  FM_VALIDATION_ERROR_STYLE_INFORMATION = 2,
+} fm_validation_error_style_t;
+
 /**
  * @brief Data-validation rule descriptor.
  *
@@ -1544,7 +1722,7 @@ FM_API fm_status_t fm_sheet_set_comment(fm_workbook_t* wb, uint32_t sheet, uint3
  *     6 textLength, 7 custom.
  *   * `op`   — 0 between, 1 notBetween, 2 equal, 3 notEqual,
  *     4 greaterThan, 5 lessThan, 6 greaterThanOrEqual, 7 lessThanOrEqual.
- *   * `error_style` — 0 stop, 1 warning, 2 information.
+ *   * `error_style` — an `fm_validation_error_style_t`.
  *   * `allow_blank` / `show_input_message` / `show_error_message` /
  *     `show_dropdown` — 0 = false, 1 = true. `show_dropdown` is the
  *     user-facing "is the in-cell dropdown arrow shown" meaning for
@@ -1644,6 +1822,223 @@ FM_API fm_status_t fm_sheet_remove_validation_at(fm_workbook_t* wb, uint32_t she
  */
 FM_API fm_status_t fm_sheet_clear_validations(fm_workbook_t* wb, uint32_t sheet);
 
+/**
+ * @brief Result of checking a value against the data-validation rule that
+ *        covers a cell.
+ *
+ * `has_rule` is 0 when no rule covers the cell, and `valid` is then 1.
+ * Otherwise `rule_index` is the `fm_sheet_get_validation_at` index of the
+ * applied rule and `error_style` its error style (an
+ * `fm_validation_error_style_t`).
+ */
+typedef struct {
+  int32_t has_rule;
+  int32_t valid;
+  uint32_t rule_index;
+  uint8_t error_style;
+  uint8_t _pad[3];
+} fm_validation_outcome;
+
+/**
+ * @brief Checks `proposed` against the data-validation rule covering
+ *        `(row, col)`, without storing it.
+ *
+ * Excel applies one rule per cell: when sqrefs overlap, the first rule in
+ * `fm_sheet_get_validation_at` order wins. `proposed` is taken as the
+ * already-parsed value (text "5" is text, not a number). The rule's
+ * formulas, including a `custom` formula that refers to the cell itself,
+ * read the workbook as stored.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`, or a
+ *         `FM_VAL_TEXT` value carries a `NULL` text;
+ *         `kInvalidArgument` when `sheet_index` is out of range, the cell is
+ *         outside the grid, the number is not finite, the error code is out
+ *         of range, or the value kind is an array, reference or lambda.
+ */
+FM_API fm_status_t fm_sheet_validate_value(const fm_workbook_t* wb, size_t sheet_index, uint32_t row, uint32_t col,
+                                           const fm_value_t* proposed, fm_validation_outcome* out);
+
+/**
+ * @brief Enumerates, one page at a time, the cells whose current value fails
+ *        the data-validation rule that covers them.
+ *
+ * Only populated cells are considered, with the meaning
+ * `fm_sheet_cells_in_range` gives the word, in row-major order. `cursor`,
+ * `limit` and the returned handle follow `fm_sheet_cells_in_range`: pass `0`
+ * for the first page and `fm_cell_range_next_cursor`'s value for each
+ * following one, which is `UINT64_MAX` once no further invalid cell exists.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `out == NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or `cursor`
+ *         is past the last cell of the grid.
+ */
+FM_API fm_status_t fm_sheet_list_invalid_cells(const fm_workbook_t* wb, size_t sheet_index, uint64_t cursor,
+                                               uint32_t limit, fm_cell_range_t** out);
+
+/* -------------------------------------------------------------------------- */
+/* Threaded comments and persons                                              */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * @brief One `@person` mention inside a threaded comment's text.
+ *
+ * `start` and `length` are in UTF-16 code units of the text.
+ */
+typedef struct {
+  const char* person_id;
+  const char* mention_id;
+  uint32_t start;
+  uint32_t length;
+} fm_mention;
+
+/**
+ * @brief One threaded comment: a thread's opening comment, or a reply when
+ *        `parent_id` is non-empty.
+ *
+ * Ids are brace-wrapped uppercase GUIDs and `created` is
+ * `YYYY-MM-DDTHH:MM:SS.ss`; the caller supplies both, the engine never mints
+ * them. `done` is the thread's resolved state and is meaningful on the
+ * opening comment only. On input every `const char*` may be `NULL`, meaning
+ * empty, and `mentions` may be `NULL` only with a zero `mention_count`.
+ */
+typedef struct {
+  const char* id;
+  uint32_t row;
+  uint32_t col;
+  const char* person_id;
+  const char* created;
+  const char* text;
+  const char* parent_id;
+  int32_t done;
+  const fm_mention* mentions;
+  uint32_t mention_count;
+} fm_threaded_comment;
+
+/** @brief One entry of the workbook's person list. */
+typedef struct {
+  const char* id;
+  const char* display_name;
+  const char* user_id;
+  const char* provider_id;
+} fm_person;
+
+/**
+ * @brief Number of threaded comments on the sheet, replies included.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `out_count == NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range.
+ */
+FM_API fm_status_t fm_sheet_threaded_comment_count(const fm_workbook_t* wb, size_t sheet_index, size_t* out_count);
+
+/**
+ * @brief Reads comment `idx` of the sheet's flat list, in file order: each
+ *        thread's opening comment followed by its replies.
+ *
+ * Every string and the `mentions` array are read-scratch-backed views, with
+ * the lifetime `fm_sheet_get_auto_filter` describes.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `out == NULL`;
+ *         `kInvalidArgument` when `sheet_index` or `idx` is out of range.
+ */
+FM_API fm_status_t fm_sheet_threaded_comment_at(const fm_workbook_t* wb, size_t sheet_index, size_t idx,
+                                                fm_threaded_comment* out);
+
+/**
+ * @brief Adds a threaded comment. An empty `parent_id` opens a new thread at
+ *        `row`/`col`, which must hold neither a note nor a thread; a
+ *        non-empty one appends a reply to that thread, taking its anchor and
+ *        ignoring `row`, `col` and `done`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb` or `comment` is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range, a new
+ *         thread's cell is outside the grid, or `mentions` is `NULL` with a
+ *         non-zero count;
+ *         `kThreadedCommentInvalid` (9006) for a malformed id or timestamp,
+ *         a duplicate id, an unknown person or parent, a cell already
+ *         carrying a note or thread, or a mention outside the text. The
+ *         sheet is then unchanged.
+ */
+FM_API fm_status_t fm_sheet_add_threaded_comment(fm_workbook_t* wb, size_t sheet_index,
+                                                 const fm_threaded_comment* comment);
+
+/**
+ * @brief Replaces the text and mentions of the comment with `id`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb` or `id` is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or
+ *         `mentions` is `NULL` with a non-zero count;
+ *         `kThreadedCommentInvalid` (9006) when no comment has `id` or a
+ *         mention is invalid.
+ */
+FM_API fm_status_t fm_sheet_edit_threaded_comment(fm_workbook_t* wb, size_t sheet_index, const char* id,
+                                                  const char* text, const fm_mention* mentions, uint32_t mention_count);
+
+/**
+ * @brief Sets the resolved state of the thread opened by `thread_id`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb` or `thread_id` is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range;
+ *         `kThreadedCommentInvalid` (9006) when `thread_id` names no opening
+ *         comment.
+ */
+FM_API fm_status_t fm_sheet_set_thread_resolved(fm_workbook_t* wb, size_t sheet_index, const char* thread_id,
+                                                int32_t done);
+
+/**
+ * @brief Removes the comment with `id`; removing an opening comment removes
+ *        its whole thread.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb` or `id` is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range;
+ *         `kThreadedCommentInvalid` (9006) when no comment has `id`.
+ */
+FM_API fm_status_t fm_sheet_remove_threaded_comment(fm_workbook_t* wb, size_t sheet_index, const char* id);
+
+/**
+ * @brief Number of entries in the workbook's person list.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_workbook_person_count(const fm_workbook_t* wb, size_t* out_count);
+
+/**
+ * @brief Reads person `idx`, in file order. The strings are
+ *        read-scratch-backed views.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any argument is `NULL`;
+ *         `kInvalidArgument` when `idx` is out of range.
+ */
+FM_API fm_status_t fm_workbook_person_at(const fm_workbook_t* wb, size_t idx, fm_person* out);
+
+/**
+ * @brief Appends a person to the workbook's person list.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any argument is `NULL`;
+ *         `kThreadedCommentInvalid` (9006) when the id is malformed or
+ *         already listed, or the display name is empty.
+ */
+FM_API fm_status_t fm_workbook_add_person(fm_workbook_t* wb, const fm_person* person);
+
+/**
+ * @brief Removes the person with `id`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any argument is `NULL`;
+ *         `kThreadedCommentInvalid` (9006) when no person has `id`, or a
+ *         threaded comment or mention still names them.
+ */
+FM_API fm_status_t fm_workbook_remove_person(fm_workbook_t* wb, const char* id);
+
 /* -------------------------------------------------------------------------- */
 /* Recalc                                                                     */
 /* -------------------------------------------------------------------------- */
@@ -2170,6 +2565,143 @@ FM_API size_t fm_pagination_vertical_break_count(const fm_pagination_t* paginati
 /** @brief Reads a 0-based column index that a vertical break precedes. */
 FM_API fm_status_t fm_pagination_vertical_break_at(const fm_pagination_t* pagination, size_t index, uint32_t* out_col);
 
+/** @brief A rectangle in points. Sheet geometry measures from the top-left
+ *         of cell A1; pagination measures from the page's top-left corner. */
+typedef struct {
+  double x;
+  double y;
+  double width;
+  double height;
+} fm_rect_pt;
+
+/** @brief The paper a sheet prints on, after the orientation swap. */
+typedef struct {
+  double width_pt;
+  double height_pt;
+  int32_t landscape; /* 0/1 */
+  int32_t known;     /* 0 when `paperSize` was unrecognised and A4 substituted */
+} fm_paper_info;
+
+/** @brief Page margins in points; `header` / `footer` are measured from the
+ *         page edge to the header / footer band. */
+typedef struct {
+  double left;
+  double right;
+  double top;
+  double bottom;
+  double header;
+  double footer;
+} fm_margins_pt;
+
+/** @brief The repeat-rows / repeat-columns in effect (0-based, inclusive).
+ *         A span is meaningful only when its `has_*` flag is non-zero. */
+typedef struct {
+  int32_t has_rows; /* 0/1 */
+  uint32_t first_row;
+  uint32_t last_row;
+  int32_t has_cols; /* 0/1 */
+  uint32_t first_col;
+  uint32_t last_col;
+} fm_print_titles;
+
+/**
+ * @brief One physical page: the cell block it carries and where it sits.
+ *
+ * `area_index` indexes `fm_pagination_print_area_at` (0 for the used-range
+ * fallback). `width_pt` / `height_pt` are the scaled extent of the page's
+ * own cell block, repeated titles excluded; `origin_*_pt` is that block's
+ * top-left corner on the paper.
+ */
+typedef struct {
+  uint32_t area_index;
+  uint32_t first_row;
+  uint32_t last_row;
+  uint32_t first_col;
+  uint32_t last_col;
+  double origin_x_pt;
+  double origin_y_pt;
+  double width_pt;
+  double height_pt;
+} fm_page_layout;
+
+/**
+ * @brief Reads the paper size and orientation pagination laid out on.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_pagination_paper(const fm_pagination_t* pagination, fm_paper_info* out);
+
+/**
+ * @brief Reads the page margins in points.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_pagination_margins(const fm_pagination_t* pagination, fm_margins_pt* out);
+
+/**
+ * @brief Reads the cell-body rectangle before print-title reservation, in
+ *        points from the page's top-left corner.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_pagination_printable(const fm_pagination_t* pagination, fm_rect_pt* out);
+
+/**
+ * @brief Reads the effective scale as a factor (1.0 is 100%): the `scale`
+ *        percentage, or the fit-to-page factor.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_pagination_scale(const fm_pagination_t* pagination, double* out_scale);
+
+/**
+ * @brief Reads the page order: `0` down-then-over (the OOXML default), `1`
+ *        over-then-down.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_pagination_page_order(const fm_pagination_t* pagination, int32_t* out_order);
+
+/**
+ * @brief Reads the print-title rows / columns repeated on every page.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`.
+ */
+FM_API fm_status_t fm_pagination_print_titles(const fm_pagination_t* pagination, fm_print_titles* out);
+
+/**
+ * @brief Reads physical page `index`, in print order.
+ *
+ * The index domain is `[0, fm_pagination_page_count)`: one entry per
+ * physical page, ordered by the page order and, across several print
+ * areas, by declaration order.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`;
+ *         `kInvalidArgument` when `index` is out of range.
+ */
+FM_API fm_status_t fm_pagination_page_at(const fm_pagination_t* pagination, size_t index, fm_page_layout* out);
+
+/**
+ * @brief Reports whether horizontal break `index` (the domain of
+ *        `fm_pagination_horizontal_break_at`) is a manual break (`1`) rather
+ *        than one the page walk computed (`0`).
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`;
+ *         `kInvalidArgument` when `index` is out of range.
+ */
+FM_API fm_status_t fm_pagination_horizontal_break_is_manual(const fm_pagination_t* pagination, size_t index,
+                                                            int32_t* out_manual);
+
+/**
+ * @brief Vertical-break counterpart of
+ *        `fm_pagination_horizontal_break_is_manual`.
+ *
+ * @return `kOk` on success; `kBindingNullPointer` if any argument is `NULL`;
+ *         `kInvalidArgument` when `index` is out of range.
+ */
+FM_API fm_status_t fm_pagination_vertical_break_is_manual(const fm_pagination_t* pagination, size_t index,
+                                                          int32_t* out_manual);
+
 /* -------------------------------------------------------------------------- */
 /* Print settings - raw XML                                                   */
 /* -------------------------------------------------------------------------- */
@@ -3342,7 +3874,7 @@ FM_API fm_status_t fm_workbook_pivot_cache_id_at(const fm_workbook_t* wb, size_t
  * @return `kOk` on success;
  *         `kBindingNullPointer` if any pointer argument is `NULL`;
  *         `kInvalidArgument` when `requested_id` collides with an
- *         existing cache.
+ *         existing cache or auto-assignment would overflow.
  */
 FM_API fm_status_t fm_workbook_pivot_cache_create(fm_workbook_t* wb, uint32_t requested_id, uint32_t* out_cache_id);
 
@@ -3620,8 +4152,9 @@ FM_API fm_status_t fm_workbook_pivot_field_clear_subtotal_fns(fm_workbook_t* wb,
  *
  * @return `kInvalidArgument` for an unknown `granularity`/`calendar`,
  *         or -- when `granularity` is `FM_PIVOT_DATE_DAYS` -- for
- *         `interval_days == 0` or an explicit `start_serial_or_neg1` >
- *         an explicit `end_serial_or_neg1`.
+ *         `interval_days == 0`, invalid/non-finite explicit serial bounds,
+ *         or an explicit `start_serial_or_neg1` > an explicit
+ *         `end_serial_or_neg1` (the raw bounds are compared before flooring).
  */
 FM_API fm_status_t fm_workbook_pivot_field_set_date_group(fm_workbook_t* wb, size_t sheet_index, size_t pivot_index,
                                                           size_t field_idx, int32_t granularity, int32_t calendar,
@@ -4042,6 +4575,11 @@ typedef struct {
  * Mirrors `formulon::RowLayout`. The row index is 0-based; height is
  * in points (matches OOXML `<row ht=...>`). `has_style` is set only when
  * OOXML `customFormat="1"` makes the row `s` attribute effective.
+ *
+ * `has_height` is the presence of a stored height; `height` is meaningful
+ * only when it is set. `custom_height` separates an explicit override
+ * (`customHeight="1"`, the state `fm_sheet_set_row_height` produces) from an
+ * auto height that merely caches `ht`, which Excel recomputes on its own.
  */
 typedef struct {
   uint32_t row;
@@ -4052,6 +4590,8 @@ typedef struct {
   /* Row s= is effective only when customFormat=1 in OOXML. */
   int32_t has_style; /* 0/1 */
   uint32_t style_xf;
+  int32_t has_height;    /* 0/1 */
+  int32_t custom_height; /* 0/1 */
 } fm_row_layout_t;
 
 /**
@@ -4132,18 +4672,333 @@ FM_API fm_status_t fm_sheet_get_auto_filter_xml(const fm_workbook_t* wb, size_t
  */
 FM_API fm_status_t fm_sheet_set_auto_filter_xml(fm_workbook_t* wb, size_t sheet_index, const char* xml);
 
+/* -------------------------------------------------------------------------- */
+/* Typed AutoFilter                                                           */
+/* -------------------------------------------------------------------------- */
+
+/** @brief `<dateGroupItem>` granularity (`fm_date_group_item::grouping`); mirrors `ST_DateTimeGrouping`. */
+typedef enum {
+  FM_DATE_TIME_GROUPING_YEAR = 0,
+  FM_DATE_TIME_GROUPING_MONTH = 1,
+  FM_DATE_TIME_GROUPING_DAY = 2,
+  FM_DATE_TIME_GROUPING_HOUR = 3,
+  FM_DATE_TIME_GROUPING_MINUTE = 4,
+  FM_DATE_TIME_GROUPING_SECOND = 5,
+} fm_date_time_grouping_t;
+
+/** @brief Criterion selector (`fm_filter_column::kind`). */
+typedef enum {
+  FM_FILTER_KIND_NONE = 0,
+  FM_FILTER_KIND_VALUES = 1,
+  FM_FILTER_KIND_CUSTOM = 2,
+  FM_FILTER_KIND_TOP10 = 3,
+  FM_FILTER_KIND_DYNAMIC = 4,
+  FM_FILTER_KIND_COLOR = 5,
+  FM_FILTER_KIND_ICON = 6,
+} fm_filter_kind_t;
+
+/** @brief Custom-filter comparison operator (`fm_filter_column::op1` / `op2`); mirrors `ST_FilterOperator`. */
+typedef enum {
+  FM_FILTER_OPERATOR_EQUAL = 0,
+  FM_FILTER_OPERATOR_LESS_THAN = 1,
+  FM_FILTER_OPERATOR_LESS_THAN_OR_EQUAL = 2,
+  FM_FILTER_OPERATOR_NOT_EQUAL = 3,
+  FM_FILTER_OPERATOR_GREATER_THAN_OR_EQUAL = 4,
+  FM_FILTER_OPERATOR_GREATER_THAN = 5,
+} fm_filter_operator_t;
+
+/** @brief Dynamic-filter type (`fm_filter_column::dynamic_type`); `ST_DynamicFilterType` in schema order. */
+typedef enum {
+  FM_DYNAMIC_FILTER_NULL = 0,
+  FM_DYNAMIC_FILTER_ABOVE_AVERAGE = 1,
+  FM_DYNAMIC_FILTER_BELOW_AVERAGE = 2,
+  FM_DYNAMIC_FILTER_TOMORROW = 3,
+  FM_DYNAMIC_FILTER_TODAY = 4,
+  FM_DYNAMIC_FILTER_YESTERDAY = 5,
+  FM_DYNAMIC_FILTER_NEXT_WEEK = 6,
+  FM_DYNAMIC_FILTER_THIS_WEEK = 7,
+  FM_DYNAMIC_FILTER_LAST_WEEK = 8,
+  FM_DYNAMIC_FILTER_NEXT_MONTH = 9,
+  FM_DYNAMIC_FILTER_THIS_MONTH = 10,
+  FM_DYNAMIC_FILTER_LAST_MONTH = 11,
+  FM_DYNAMIC_FILTER_NEXT_QUARTER = 12,
+  FM_DYNAMIC_FILTER_THIS_QUARTER = 13,
+  FM_DYNAMIC_FILTER_LAST_QUARTER = 14,
+  FM_DYNAMIC_FILTER_NEXT_YEAR = 15,
+  FM_DYNAMIC_FILTER_THIS_YEAR = 16,
+  FM_DYNAMIC_FILTER_LAST_YEAR = 17,
+  FM_DYNAMIC_FILTER_YEAR_TO_DATE = 18,
+  FM_DYNAMIC_FILTER_Q1 = 19,
+  FM_DYNAMIC_FILTER_Q2 = 20,
+  FM_DYNAMIC_FILTER_Q3 = 21,
+  FM_DYNAMIC_FILTER_Q4 = 22,
+  FM_DYNAMIC_FILTER_M1 = 23,
+  FM_DYNAMIC_FILTER_M2 = 24,
+  FM_DYNAMIC_FILTER_M3 = 25,
+  FM_DYNAMIC_FILTER_M4 = 26,
+  FM_DYNAMIC_FILTER_M5 = 27,
+  FM_DYNAMIC_FILTER_M6 = 28,
+  FM_DYNAMIC_FILTER_M7 = 29,
+  FM_DYNAMIC_FILTER_M8 = 30,
+  FM_DYNAMIC_FILTER_M9 = 31,
+  FM_DYNAMIC_FILTER_M10 = 32,
+  FM_DYNAMIC_FILTER_M11 = 33,
+  FM_DYNAMIC_FILTER_M12 = 34,
+} fm_dynamic_filter_type_t;
+
+/** @brief Sort key source (`fm_sort_condition::sort_by`); mirrors `ST_SortBy`. */
+typedef enum {
+  FM_SORT_BY_VALUE = 0,
+  FM_SORT_BY_CELL_COLOR = 1,
+  FM_SORT_BY_FONT_COLOR = 2,
+  FM_SORT_BY_ICON = 3,
+} fm_sort_by_t;
+
+/** @brief Sort method (`fm_auto_filter::sort_method`); mirrors `ST_SortMethod`. */
+typedef enum {
+  FM_SORT_METHOD_NONE = 0,
+  FM_SORT_METHOD_PIN_YIN = 1,
+  FM_SORT_METHOD_STROKE = 2,
+} fm_sort_method_t;
+
 /**
- * @brief Sets or replaces the column width override for the inclusive
- *        column span `[first, last]`. Existing overrides whose span
- *        intersects the requested span are merged so the new width
- *        takes precedence on overlapping columns; non-overlapping
- *        portions of pre-existing entries are retained.
- *
- * `width` is in Excel's character-width unit. A rejected call leaves the
- * layout exactly as it was.
+ * @brief One `<dateGroupItem>` of a values filter.
  *
- * @return `kOk` on success;
- *         `kBindingNullPointer` if `wb == NULL`;
+ * `grouping` is the granularity the item matches at, an
+ * `fm_date_time_grouping_t`. Fields finer than `grouping` are zero.
+ */
+typedef struct {
+  uint16_t year;
+  uint8_t month;
+  uint8_t day;
+  uint8_t hour;
+  uint8_t minute;
+  uint8_t second;
+  uint8_t grouping;
+} fm_date_group_item;
+
+/**
+ * @brief One `<filterColumn>` of an AutoFilter.
+ *
+ * `col_id` is the 0-based offset from the AutoFilter range's first column.
+ * `kind` selects the criterion, and only that criterion's fields are read on
+ * input; on output the fields of every other criterion are zero.
+ *   * `kind` -- an `fm_filter_kind_t`.
+ *   * values -- `filter_blank` matches blank cells; `values` lists displayed
+ *     texts and `date_groups` date-group items.
+ *   * custom -- `custom_count` (1 or 2) conditions `op1`/`val1` and
+ *     `op2`/`val2`, joined by AND when `custom_and` is set. Operators
+ *     are `fm_filter_operator_t`.
+ *   * top10 -- `top` (else bottom), `percent`, the rank `top_val`, and the
+ *     `filter_val` threshold Excel last stored when `has_filter_val`.
+ *   * dynamic -- `dynamic_type` is an `fm_dynamic_filter_type_t`; `dyn_val` / `dyn_max_val` are the
+ *     stored bounds when their `has_` flag is set, and `val_iso` /
+ *     `max_val_iso` their ISO spellings.
+ *   * color -- `dxf_id` names the differential format whose fill
+ *     (`cell_color` set) or font colour matches; `UINT32_MAX` means absent.
+ *   * icon -- `icon_set` is the `formulon::cf::IconSetName` ordinal and
+ *     `icon_id` the icon index when `has_icon_id` (else "no icon").
+ *
+ * On input every `const char*` may be `NULL`, meaning empty, and an array
+ * pointer may be `NULL` only with a zero count.
+ */
+typedef struct {
+  uint32_t col_id;
+  int32_t hidden_button;
+  int32_t show_button;
+  int32_t kind;
+  int32_t filter_blank;
+  const char* const* values;
+  uint32_t value_count;
+  const fm_date_group_item* date_groups;
+  uint32_t date_group_count;
+  int32_t custom_and;
+  int32_t custom_count;
+  int32_t op1;
+  const char* val1;
+  int32_t op2;
+  const char* val2;
+  int32_t top;
+  int32_t percent;
+  int32_t has_filter_val;
+  double top_val;
+  double filter_val;
+  int32_t dynamic_type;
+  int32_t has_dyn_val;
+  int32_t has_dyn_max_val;
+  double dyn_val;
+  double dyn_max_val;
+  const char* val_iso;
+  const char* max_val_iso;
+  uint32_t dxf_id;
+  int32_t cell_color;
+  int32_t icon_set;
+  int32_t icon_id;
+  int32_t has_icon_id;
+} fm_filter_column;
+
+/**
+ * @brief One `<sortCondition>` of an AutoFilter's sort state.
+ *
+ * `sort_by` is an `fm_sort_by_t`. `dxf_id` is read
+ * only when `has_dxf_id`, `icon_id` only when `has_icon_id`; `icon_set` is
+ * the `formulon::cf::IconSetName` ordinal.
+ */
+typedef struct {
+  fm_merge_range ref;
+  int32_t descending;
+  int32_t sort_by;
+  const char* custom_list;
+  uint32_t dxf_id;
+  int32_t has_dxf_id;
+  int32_t icon_set;
+  int32_t icon_id;
+  int32_t has_icon_id;
+} fm_sort_condition;
+
+/**
+ * @brief A sheet or table AutoFilter.
+ *
+ * `range` includes the header row. `columns` must be in strictly ascending
+ * `col_id` order inside the range. The sort state is present when
+ * `has_sort`; `sort_method` is an `fm_sort_method_t`.
+ *
+ * Attributes and extensions the record does not carry (`xr:uid`, unknown
+ * `filterColumn` children, `extLst` payloads, a values filter's
+ * `calendarType`) are kept across a set: they are carried over from the
+ * AutoFilter being replaced, per column by `col_id`, so a get followed by a
+ * set of the unchanged record leaves the stored element as it was.
+ */
+typedef struct {
+  fm_merge_range range;
+  const fm_filter_column* columns;
+  uint32_t column_count;
+  int32_t has_sort;
+  fm_merge_range sort_ref;
+  int32_t column_sort;
+  int32_t case_sensitive;
+  int32_t sort_method;
+  const fm_sort_condition* conditions;
+  uint32_t condition_count;
+} fm_auto_filter;
+
+/**
+ * @brief Reads the sheet AutoFilter.
+ *
+ * `*out_present` is 0 and `*out` all-zero when the sheet has no AutoFilter.
+ * Every string and array reachable from `*out` is a read-scratch-backed view
+ * and may be invalidated by the next successful scratch-backed read on the
+ * same handle, by a mutation, or by handle destruction.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range;
+ *         `kAutoFilterInvalid` (8006) when the AutoFilter did not parse into
+ *         the typed model (only `fm_sheet_get_auto_filter_xml` reads it).
+ */
+FM_API fm_status_t fm_sheet_get_auto_filter(const fm_workbook_t* wb, size_t sheet_index, fm_auto_filter* out,
+                                            int32_t* out_present);
+
+/**
+ * @brief Replaces the sheet AutoFilter and maintains the sheet's hidden
+ *        `_xlnm._FilterDatabase` name over its range.
+ *
+ * Row visibility is not changed; call `fm_sheet_apply_auto_filter` to hide
+ * the rows the criteria exclude.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb` or `filter` is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range, an
+ *         enumeration field is outside the domain listed on the record, or an
+ *         array pointer is `NULL` with a non-zero count;
+ *         `kAutoFilterInvalid` (8006) when the range is outside the grid,
+ *         column ids are outside the range or not ascending, a custom filter
+ *         has other than one or two conditions, or a date group item does
+ *         not fit its grouping.
+ */
+FM_API fm_status_t fm_sheet_set_auto_filter(fm_workbook_t* wb, size_t sheet_index, const fm_auto_filter* filter);
+
+/**
+ * @brief Removes the sheet AutoFilter and its `_xlnm._FilterDatabase` name.
+ *        Row visibility is not changed. No-op when the sheet has none.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb == NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range.
+ */
+FM_API fm_status_t fm_sheet_remove_auto_filter(fm_workbook_t* wb, size_t sheet_index);
+
+/**
+ * @brief Evaluates the sheet AutoFilter and sets every body row's hidden flag
+ *        to the negation of its match, as Excel's Reapply does; a matching
+ *        row hidden by hand is shown again, and rows outside the body are
+ *        untouched.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb == NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range;
+ *         `kNotFound` when the sheet has no AutoFilter;
+ *         `kAutoFilterInvalid` (8006) when it did not parse into the model.
+ */
+FM_API fm_status_t fm_sheet_apply_auto_filter(fm_workbook_t* wb, size_t sheet_index);
+
+/**
+ * @brief Drops every column criterion of the sheet AutoFilter and shows all
+ *        of its body rows. The range, the drop-down buttons and the sort
+ *        state stay.
+ *
+ * @return as `fm_sheet_apply_auto_filter`.
+ */
+FM_API fm_status_t fm_sheet_clear_auto_filter(fm_workbook_t* wb, size_t sheet_index);
+
+/**
+ * @brief Evaluates the sheet AutoFilter without changing the sheet.
+ *
+ * Body row `*out_first_row + i` matches the criteria when `out_match[i]` is
+ * 1. `*out_len` always receives the number of body rows; at most `cap`
+ * flags are written. Call with `cap == 0` (`out_match` may then be `NULL`)
+ * to size the buffer first.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb`, `out_len` or `out_first_row` is
+ *         `NULL`, or `out_match` is `NULL` while `cap > 0`;
+ *         `kInvalidArgument` when `sheet_index` is out of range;
+ *         `kNotFound` when the sheet has no AutoFilter;
+ *         `kAutoFilterInvalid` (8006) when it did not parse into the model.
+ */
+FM_API fm_status_t fm_sheet_evaluate_auto_filter(const fm_workbook_t* wb, size_t sheet_index, uint8_t* out_match,
+                                                 size_t cap, size_t* out_len, uint32_t* out_first_row);
+
+/**
+ * @brief Table counterparts of the sheet AutoFilter entry points.
+ *
+ * `table_index` addresses the workbook table list as `fm_workbook_table_at`
+ * does, and the table's sheet is the one whose rows are evaluated and
+ * hidden. Tables carry no `_FilterDatabase` name. The contracts are those
+ * of the sheet functions, with `kInvalidArgument` for an out-of-range
+ * `table_index`.
+ */
+FM_API fm_status_t fm_table_get_auto_filter(const fm_workbook_t* wb, size_t table_index, fm_auto_filter* out,
+                                            int32_t* out_present);
+FM_API fm_status_t fm_table_set_auto_filter(fm_workbook_t* wb, size_t table_index, const fm_auto_filter* filter);
+FM_API fm_status_t fm_table_remove_auto_filter(fm_workbook_t* wb, size_t table_index);
+FM_API fm_status_t fm_table_apply_auto_filter(fm_workbook_t* wb, size_t table_index);
+FM_API fm_status_t fm_table_clear_auto_filter(fm_workbook_t* wb, size_t table_index);
+FM_API fm_status_t fm_table_evaluate_auto_filter(const fm_workbook_t* wb, size_t table_index, uint8_t* out_match,
+                                                 size_t cap, size_t* out_len, uint32_t* out_first_row);
+
+/**
+ * @brief Sets or replaces the column width override for the inclusive
+ *        column span `[first, last]`. Existing overrides whose span
+ *        intersects the requested span are merged so the new width
+ *        takes precedence on overlapping columns; non-overlapping
+ *        portions of pre-existing entries are retained.
+ *
+ * `width` is in Excel's character-width unit. A rejected call leaves the
+ * layout exactly as it was.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb == NULL`;
  *         `kInvalidArgument` when `sheet_index` is out of range,
  *         `last < first`, `last` is past the last column (16383), or
  *         `width` is negative, NaN, or infinite.
@@ -4211,6 +5066,163 @@ FM_API fm_status_t fm_sheet_set_row_hidden(fm_workbook_t* wb, size_t sheet_index
  */
 FM_API fm_status_t fm_sheet_set_row_outline(fm_workbook_t* wb, size_t sheet_index, uint32_t row, uint8_t level);
 
+/**
+ * @brief Removes the height override of `row`, returning it to the sheet
+ *        default height.
+ *
+ * Clears the stored height and its custom flag. A row override left with
+ * no other state (visible, outline level 0, no row style) is dropped. A
+ * row with no height override is a no-op.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb == NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or `row`
+ *         is past the last row (1048575).
+ */
+FM_API fm_status_t fm_sheet_clear_row_height(fm_workbook_t* wb, size_t sheet_index, uint32_t row);
+
+/**
+ * @brief Sheet default column / row metrics (`<sheetFormatPr>`).
+ *
+ * `default_col_width` is in character units and `default_row_height` in
+ * points; each is meaningful only when its `has_*` flag is non-zero, since
+ * an absent attribute and an explicit `0` are different states.
+ * `base_col_width` is in characters and always present (OOXML default 8).
+ */
+typedef struct {
+  double default_col_width;
+  double default_row_height;
+  double base_col_width;
+  int32_t has_default_col_width;  /* 0/1 */
+  int32_t has_default_row_height; /* 0/1 */
+} fm_sheet_format_defaults;
+
+/**
+ * @brief Reads the sheet's default column / row metrics.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range.
+ */
+FM_API fm_status_t fm_sheet_get_format_defaults(const fm_workbook_t* wb, size_t sheet_index,
+                                                fm_sheet_format_defaults* out);
+
+/**
+ * @brief Replaces the sheet's default column / row metrics.
+ *
+ * A value whose `has_*` flag is zero is ignored and stored as `0`. A
+ * rejected call leaves the sheet unchanged.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or a
+ *         stated value is negative, NaN, or infinite.
+ */
+FM_API fm_status_t fm_sheet_set_format_defaults(fm_workbook_t* wb, size_t sheet_index,
+                                                const fm_sheet_format_defaults* defaults);
+
+/**
+ * @brief Which Windows column-width figure a geometry call uses.
+ *
+ * `FM_GEOMETRY_DISPLAY` is the screen figure (`Range.Width` at 96 DPI);
+ * `FM_GEOMETRY_PRINT` is the DPI-stable figure pagination breaks on. Row
+ * heights are the same in both modes. Only Windows is calibrated.
+ */
+typedef enum {
+  FM_GEOMETRY_DISPLAY = 0,
+  FM_GEOMETRY_PRINT = 1,
+} fm_geometry_mode_t;
+
+/**
+ * @brief The character-unit to point conversion for the workbook's Normal
+ *        font in one mode.
+ *
+ * `calibrated` is `0` when the Normal font is not a measured calibration
+ * point and the Calibri 11 figure was extrapolated. `normal_font_name` is a
+ * read-scratch-backed view; `platform` is a static view (`"win"`).
+ */
+typedef struct {
+  double points_per_char;
+  double padding_pt;
+  double normal_font_size;
+  int32_t calibrated; /* 0/1 */
+  int32_t _pad;
+  const char* normal_font_name;
+  const char* platform;
+} fm_width_model;
+
+/**
+ * @brief Reads the rectangle covering the inclusive cell range, in points
+ *        from the top-left of cell A1.
+ *
+ * Hidden rows and columns contribute zero extent. `mode` is an
+ * `fm_geometry_mode_t` ordinal.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range, the range
+ *         is inverted or outside the grid, or `mode` is unknown.
+ */
+FM_API fm_status_t fm_sheet_cell_rect_pt(const fm_workbook_t* wb, size_t sheet_index, uint32_t first_row,
+                                         uint32_t first_col, uint32_t last_row, uint32_t last_col, int32_t mode,
+                                         fm_rect_pt* out);
+
+/**
+ * @brief Reads the effective width of column `col` in points; zero when the
+ *        column is hidden.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` or `col` is out of range or
+ *         `mode` is unknown.
+ */
+FM_API fm_status_t fm_sheet_column_width_pt(const fm_workbook_t* wb, size_t sheet_index, uint32_t col, int32_t mode,
+                                            double* out_pt);
+
+/**
+ * @brief Reads the effective height of row `row` in points; zero when the
+ *        row is hidden.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` or `row` is out of range.
+ */
+FM_API fm_status_t fm_sheet_row_height_pt(const fm_workbook_t* wb, size_t sheet_index, uint32_t row, double* out_pt);
+
+/**
+ * @brief Reads the column-width conversion model in `mode`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or `mode`
+ *         is unknown.
+ */
+FM_API fm_status_t fm_sheet_width_model(const fm_workbook_t* wb, size_t sheet_index, int32_t mode, fm_width_model* out);
+
+/**
+ * @brief Converts a column width in character units to points. Zero
+ *        characters is exactly zero points.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range, `mode` is
+ *         unknown, or `chars` is negative, NaN, or infinite.
+ */
+FM_API fm_status_t fm_sheet_column_chars_to_pt(const fm_workbook_t* wb, size_t sheet_index, int32_t mode, double chars,
+                                               double* out_pt);
+
+/**
+ * @brief Inverse of `fm_sheet_column_chars_to_pt`; a width at or below the
+ *        padding maps to zero characters.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range, `mode` is
+ *         unknown, or `pt` is negative, NaN, or infinite.
+ */
+FM_API fm_status_t fm_sheet_column_pt_to_chars(const fm_workbook_t* wb, size_t sheet_index, int32_t mode, double pt,
+                                               double* out_chars);
+
 /**
  * @brief Sets the sheet's zoom percentage. Values outside `[10, 400]`
  *        are clamped to the nearest endpoint.
@@ -4442,8 +5454,9 @@ FM_API fm_status_t fm_set_log_sink(fm_log_sink_cb sink, void* user_data);
 /**
  * @brief Plain-data projection of a `formulon::io::CellXf` record.
  *
- * This record is a fixed 88-byte C ABI layout carrying every optional
- * alignment attribute represented by Formulon's style model.
+ * This record is a fixed 128-byte C ABI layout carrying every optional
+ * alignment attribute represented by Formulon's style model, the six
+ * `apply*` flags, `quotePrefix`, and the `<protection>` child.
  * `has_alignment` is the presence of the `<alignment>` child itself, so an
  * explicit empty child is distinct from an omitted child.
  * Each `has_*` flag below distinguishes an omitted OOXML attribute from an
@@ -4456,6 +5469,13 @@ FM_API fm_status_t fm_set_log_sink(fm_log_sink_cb sink, void* user_data);
  * those canonical defaults. `relative_indent` is signed, matching the
  * OOXML `relativeIndent` attribute.
  *
+ * `apply_*` mirror the `<xf apply*>` attributes, which say whether the
+ * record's own value for that group overrides its parent named style.
+ * `has_protection` is the presence of the `<protection>` child; when it is
+ * zero `locked` / `hidden` are ignored on insertion and getters report the
+ * model defaults (`locked=1`, `hidden=0`). All of these take part in XF
+ * deduplication, so two records differing only in protection stay distinct.
+ *
  * Bindings copy the struct out of the workbook's styles table; subsequent
  * mutations to the workbook do not invalidate the copy.
  */
@@ -4484,6 +5504,16 @@ typedef struct {
   int32_t has_vertical_align;    /* 0=omitted, 1=explicit `vertical` */
   int32_t has_wrap_text;         /* 0=omitted, 1=explicit `wrapText` */
   int32_t has_justify_last_line; /* 0=omitted, 1=explicit `justifyLastLine` */
+  int32_t apply_number_format;   /* 0/1 */
+  int32_t apply_font;            /* 0/1 */
+  int32_t apply_fill;            /* 0/1 */
+  int32_t apply_border;          /* 0/1 */
+  int32_t apply_alignment;       /* 0/1 */
+  int32_t apply_protection;      /* 0/1 */
+  int32_t quote_prefix;          /* 0/1 */
+  int32_t has_protection;        /* 0= no `<protection>` child, 1= child present */
+  int32_t locked;                /* 0/1; ignored unless has_protection */
+  int32_t hidden;                /* 0/1; ignored unless has_protection */
 } fm_cell_xf;
 
 /** Discriminator for `fm_color_spec::kind`, mirroring
@@ -4673,22 +5703,22 @@ typedef struct {
  *
  * `name` is a NUL-terminated UTF-8 model-backed view into the workbook's
  * styles table; it is valid until the next mutation of the cell-style
- * list (`fm_styles_set_cell_style`) or until the handle is destroyed.
- * `xf_id` indexes into the parallel
+ * list (`fm_styles_set_cell_style`, `fm_styles_remove_cell_style`) or
+ * until the handle is destroyed. `xf_id` indexes into the parallel
  * `<cellStyleXfs>` table (queryable via
  * `fm_styles_get_cell_style_xf_count` / `fm_styles_get_cell_style_xf`).
  *
- * `builtin_id` carries the OOXML built-in style ordinal (`0..47`); the
+ * `builtin_id` carries the OOXML built-in style ordinal (`0..53`); the
  * sentinel `FM_CELL_STYLE_BUILTIN_ID_NONE` indicates the entry is
  * custom and the attribute was absent on the source document. `i_level`
- * is the outline level for built-in heading styles (`0` for everything
- * else). The boolean flags follow the wide-POD convention used
- * elsewhere on this surface.
+ * is the outline level of the `RowLevel_n` / `ColLevel_n` styles
+ * (`builtin_id` 1 / 2, `0..6`) and `0` for everything else. The boolean
+ * flags follow the wide-POD convention used elsewhere on this surface.
  */
 typedef struct {
   const char* name;       /* UTF-8, NUL-terminated; never NULL */
   uint32_t xf_id;         /* index into cell_style_xfs */
-  uint32_t builtin_id;    /* 0..47, or FM_CELL_STYLE_BUILTIN_ID_NONE */
+  uint32_t builtin_id;    /* 0..53, or FM_CELL_STYLE_BUILTIN_ID_NONE */
   uint32_t i_level;       /* outline level for heading styles */
   int32_t hidden;         /* 0=false, 1=true */
   int32_t custom_builtin; /* 0=false, 1=true */
@@ -5097,9 +6127,36 @@ FM_API fm_status_t fm_styles_add_cell_xf(fm_workbook_t* wb, fm_cell_xf record, u
  * Excel ranges return `kInvalidArgument`. */
 FM_API fm_status_t fm_styles_add_cell_style_xf(fm_workbook_t* wb, fm_cell_xf record, uint32_t* out_xf_id);
 
-/** Adds or replaces a named `<cellStyle>` record. `xf_id` must reference an
- * existing named-style xf. Pass `FM_CELL_STYLE_BUILTIN_ID_NONE` for custom styles. */
-FM_API fm_status_t fm_styles_set_cell_style(fm_workbook_t* wb, const char* name, uint32_t xf_id, uint32_t builtin_id);
+/**
+ * @brief Adds or replaces the named `<cellStyle>` record `record->name`.
+ *
+ * An existing style of that name is overwritten field for field; otherwise
+ * the record is appended. `record->name` is copied. `xf_id` must reference
+ * an existing named-style xf; `builtin_id` is `0..53` or
+ * `FM_CELL_STYLE_BUILTIN_ID_NONE` for a custom style; `i_level` is `0..6`
+ * for `builtin_id` 1 / 2 and must be `0` otherwise.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb`, `record` or `record->name` is `NULL`;
+ *         `kInvalidArgument` for an empty name or an out-of-range field.
+ */
+FM_API fm_status_t fm_styles_set_cell_style(fm_workbook_t* wb, const fm_cell_style_record_t* record);
+
+/**
+ * @brief Removes the named `<cellStyle>` record `name`.
+ *
+ * When no other named style shares the removed record's `xf_id`, every
+ * cell xf that inherits from it is repointed at Normal (`xf_id` 0), and each
+ * attribute group whose `apply_*` flag is zero takes Normal's value; groups
+ * whose flag is set keep their own. Neither `<cellXfs>` nor
+ * `<cellStyleXfs>` is compacted, so every xf index stays valid.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb` or `name` is `NULL`;
+ *         `kInvalidArgument` when no style has that name or it is the
+ *         Normal style (`builtin_id` 0).
+ */
+FM_API fm_status_t fm_styles_remove_cell_style(fm_workbook_t* wb, const char* name);
 
 /**
  * @brief Adds and deduplicates a batch of fonts, fills, borders, and cell xfs.
@@ -5115,6 +6172,172 @@ FM_API fm_status_t fm_styles_set_cell_style(fm_workbook_t* wb, const char* name,
  */
 FM_API fm_status_t fm_styles_add_batch(fm_workbook_t* wb, const fm_styles_batch* batch);
 
+/* -------------------------------------------------------------------------- */
+/* Theme, colour resolution and effective style                               */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * @brief The 12 theme colours as 0xFFRRGGBB, in `a:clrScheme` order:
+ *        dk1, lt1, dk2, lt2, accent1..accent6, hlink, folHlink.
+ *
+ * This is not the order of a spreadsheet colour's `theme` index
+ * (`fm_color_spec::theme`), which swaps the first two pairs
+ * (0=lt1, 1=dk1, 2=lt2, 3=dk2).
+ */
+typedef struct {
+  uint32_t argb[12];
+} fm_theme_colors;
+
+/**
+ * @brief The theme's major (heading) and minor (body) typefaces.
+ *
+ * `*_east_asian` is the `a:ea` face when it names one, otherwise the
+ * `a:font script="Jpan"` face. Getter strings are read-scratch-backed views.
+ */
+typedef struct {
+  const char* major_latin;
+  const char* major_east_asian;
+  const char* minor_latin;
+  const char* minor_east_asian;
+} fm_theme_fonts;
+
+/** @brief Where a colour is used; decides what an automatic colour means. */
+typedef enum {
+  FM_COLOR_CONTEXT_FONT = 0,
+  FM_COLOR_CONTEXT_FILL_FG = 1,
+  FM_COLOR_CONTEXT_FILL_BG = 2,
+  FM_COLOR_CONTEXT_BORDER = 3,
+} fm_color_context_t;
+
+/**
+ * @brief How a colour was resolved.
+ *
+ * `FM_COLOR_RESOLUTION_EXACT`: literal RGB, or a theme / palette colour
+ * resolved from the workbook's own data. `DEFAULT_THEME` /
+ * `THEME_UNPARSEABLE`: a theme colour resolved against the default
+ * (Office 2013-2022) theme because the theme part is absent / unparseable.
+ * `INDEX_OUT_OF_RANGE`: a theme or palette index beyond its table; the
+ * colour is black. `AUTO_CONTEXT`: an automatic or system colour (or no
+ * colour at all) chosen by context: black for font and border, white for
+ * fills.
+ */
+typedef enum {
+  FM_COLOR_RESOLUTION_EXACT = 0,
+  FM_COLOR_RESOLUTION_DEFAULT_THEME = 1,
+  FM_COLOR_RESOLUTION_INDEX_OUT_OF_RANGE = 2,
+  FM_COLOR_RESOLUTION_THEME_UNPARSEABLE = 3,
+  FM_COLOR_RESOLUTION_AUTO_CONTEXT = 4,
+} fm_color_resolution_t;
+
+/**
+ * @brief The formatting a cell shows, read from the selected `<cellXfs>`
+ *        record directly.
+ *
+ * `source` names the level that supplied `xf_index`: 0 the cell, 1 its row
+ * (a row style takes effect only with `customFormat`), 2 its column, 3 the
+ * default xf 0. An xf, font, fill or border index beyond its table reads as
+ * 0. Colours are resolved against the theme and `<indexedColors>`; each
+ * `*_resolution` is an `fm_color_resolution_t`. `border_*[5]` are left,
+ * right, top, bottom, diagonal. Named-style inheritance is not recomputed
+ * and conditional formatting is not applied. `num_fmt_code` is a
+ * read-scratch-backed view.
+ */
+typedef struct {
+  uint32_t xf_index;
+  int32_t source; /* 0=cell, 1=row, 2=column, 3=default */
+  uint32_t font_index;
+  uint32_t fill_index;
+  uint32_t border_index;
+  uint32_t font_argb;
+  int32_t font_resolution;
+  uint32_t fill_fg_argb;
+  int32_t fill_fg_resolution;
+  uint32_t fill_bg_argb;
+  int32_t fill_bg_resolution;
+  uint32_t border_argb[5];
+  int32_t border_resolution[5];
+  int32_t locked; /* 0/1 */
+  int32_t hidden; /* 0/1 */
+  const char* num_fmt_code;
+} fm_effective_style;
+
+/**
+ * @brief Reads the theme's 12 scheme colours.
+ *
+ * `*out_source` is 0 when they come from the workbook's theme part, 1 when
+ * the workbook has no theme part and 2 when its theme part cannot be
+ * parsed; in both latter cases the default theme's colours are reported.
+ * The theme is parsed on every call.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`.
+ */
+FM_API fm_status_t fm_workbook_get_theme_colors(const fm_workbook_t* wb, fm_theme_colors* out, int32_t* out_source);
+
+/**
+ * @brief Writes the theme's 12 scheme colours. The alpha byte is ignored.
+ *
+ * Only `a:clrScheme` of the existing theme part is rewritten. A workbook
+ * without a theme part first gets a minimal valid one carrying the default
+ * theme, registered with its content type and workbook relationship.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kIoXmlParse` when the existing theme part cannot be parsed (the
+ *         part is left untouched).
+ */
+FM_API fm_status_t fm_workbook_set_theme_colors(fm_workbook_t* wb, const fm_theme_colors* colors);
+
+/**
+ * @brief Reads the theme's major and minor typefaces. The default theme's
+ *        faces are reported when the theme part is absent or unparseable
+ *        (see `fm_workbook_get_theme_colors` for telling the cases apart).
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`.
+ */
+FM_API fm_status_t fm_workbook_get_theme_fonts(const fm_workbook_t* wb, fm_theme_fonts* out);
+
+/**
+ * @brief Writes the theme's major and minor typefaces. The strings are
+ *        copied. Part generation and failure rules match
+ *        `fm_workbook_set_theme_colors`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument or any face is `NULL`;
+ *         `kIoXmlParse` when the existing theme part cannot be parsed.
+ */
+FM_API fm_status_t fm_workbook_set_theme_fonts(fm_workbook_t* wb, const fm_theme_fonts* fonts);
+
+/**
+ * @brief Resolves a colour specification to the 0xAARRGGBB Excel renders.
+ *
+ * Theme colours take `spec.tint`; indexed colours read the workbook's
+ * `<indexedColors>` over the built-in palette; `kFmColorAuto`,
+ * `kFmColorNone` and the system indices 64 / 65 depend on `context`
+ * (an `fm_color_context_t`). `*out_resolution` is an
+ * `fm_color_resolution_t`.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` for an unknown `context` or `spec.kind`, or a
+ *         non-finite theme tint.
+ */
+FM_API fm_status_t fm_workbook_resolve_color(const fm_workbook_t* wb, fm_color_spec spec, int32_t context,
+                                             uint32_t* out_argb, int32_t* out_resolution);
+
+/**
+ * @brief Reads the effective style of the cell at `(row, col)`; see
+ *        `fm_effective_style`. The cell need not exist.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or the
+ *         coordinate is outside the grid.
+ */
+FM_API fm_status_t fm_sheet_get_effective_style(const fm_workbook_t* wb, size_t sheet_index, uint32_t row, uint32_t col,
+                                                fm_effective_style* out);
+
 /* -------------------------------------------------------------------------- */
 /* External links                                                             */
 /* -------------------------------------------------------------------------- */
@@ -5179,6 +6402,201 @@ FM_API fm_status_t fm_workbook_external_link_count(fm_workbook_t* wb, uint32_t*
  */
 FM_API fm_status_t fm_workbook_external_link_at(fm_workbook_t* wb, uint32_t index, fm_external_link_record_t* out);
 
+/* -------------------------------------------------------------------------- */
+/* Drawing images                                                             */
+/* -------------------------------------------------------------------------- */
+
+/** @brief Raster format of an image; `UNKNOWN` marks "no image bytes found". */
+typedef enum {
+  FM_IMAGE_FORMAT_UNKNOWN = 0,
+  FM_IMAGE_FORMAT_PNG = 1,
+  FM_IMAGE_FORMAT_JPEG = 2,
+  FM_IMAGE_FORMAT_GIF = 3,
+  FM_IMAGE_FORMAT_BMP = 4,
+} fm_image_format_t;
+
+/** @brief What a drawing anchor holds. */
+typedef enum {
+  FM_DRAWING_OBJECT_PICTURE = 0,
+  FM_DRAWING_OBJECT_SHAPE = 1,
+  FM_DRAWING_OBJECT_CHART = 2,
+  FM_DRAWING_OBJECT_GROUP = 3,
+  FM_DRAWING_OBJECT_CONNECTOR = 4,
+  FM_DRAWING_OBJECT_GRAPHIC_FRAME = 5,
+  FM_DRAWING_OBJECT_OTHER = 6,
+} fm_drawing_object_kind_t;
+
+/** @brief The anchor element type of a drawing object. */
+typedef enum {
+  FM_ANCHOR_KIND_ONE_CELL = 0,
+  FM_ANCHOR_KIND_TWO_CELL = 1,
+  FM_ANCHOR_KIND_ABSOLUTE = 2,
+} fm_anchor_kind_t;
+
+/** @brief How a drawing object follows row and column edits. */
+typedef enum {
+  FM_ANCHOR_EDIT_AS_TWO_CELL = 0,
+  FM_ANCHOR_EDIT_AS_ONE_CELL = 1,
+  FM_ANCHOR_EDIT_AS_ABSOLUTE = 2,
+} fm_anchor_edit_as_t;
+
+/**
+ * @brief Format and pixel size of an image. `format` is an
+ *        `fm_image_format_t`.
+ */
+typedef struct {
+  int32_t format;
+  uint32_t px_width;
+  uint32_t px_height;
+} fm_image_info;
+
+/**
+ * @brief One anchored object of a sheet's drawing.
+ *
+ * `kind` is an `fm_drawing_object_kind_t`, `anchor_kind` an
+ * `fm_anchor_kind_t` and `edit_as` an `fm_anchor_edit_as_t`. `from_*` is the
+ * top-left marker (an absolute anchor reports its position from A1 as
+ * `from_col_off` = x and `from_row_off` = y); `to_*` is the bottom-right
+ * marker of a two-cell anchor and zero otherwise. `cx` and `cy` are the size
+ * in EMU. `image_format` is an `fm_image_format_t`, non-zero for a picture
+ * whose media part is present. `name`, `descr` and `media_path` are
+ * read-scratch-backed views (the lifetime `fm_sheet_get_auto_filter`
+ * describes); `media_path` is empty for a non-picture.
+ */
+typedef struct {
+  uint32_t object_id;
+  int32_t kind;
+  int32_t anchor_kind;
+  int32_t edit_as;
+  uint32_t from_row;
+  uint32_t from_col;
+  int64_t from_row_off;
+  int64_t from_col_off;
+  uint32_t to_row;
+  uint32_t to_col;
+  int64_t to_row_off;
+  int64_t to_col_off;
+  int64_t cx;
+  int64_t cy;
+  int32_t image_format;
+  const char* name;
+  const char* descr;
+  const char* media_path;
+} fm_drawing_object;
+
+/**
+ * @brief Placement of an inserted image.
+ *
+ * `anchor_kind` is `FM_ANCHOR_KIND_ONE_CELL` or `FM_ANCHOR_KIND_TWO_CELL`;
+ * `edit_as` (an `fm_anchor_edit_as_t`) is honoured for a two-cell anchor
+ * only. `row`/`col` is the 0-based top-left cell and `*_off_emu` the offset
+ * inside it. A `width_emu` or `height_emu` of `0` means the image's pixel
+ * size times 9525. `name` and `descr` may be `NULL`, meaning empty; an empty
+ * name becomes `Picture <id>`.
+ */
+typedef struct {
+  const char* name;
+  const char* descr;
+  int32_t anchor_kind;
+  int32_t edit_as;
+  uint32_t row;
+  uint32_t col;
+  int64_t row_off_emu;
+  int64_t col_off_emu;
+  int64_t width_emu;
+  int64_t height_emu;
+} fm_image_insert;
+
+/**
+ * @brief Sniffs the format and pixel size of PNG, JPEG, GIF or BMP bytes
+ *        from the header alone, without touching the workbook.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kIoImageUnsupported` (5023) when the bytes are not a recognised
+ *         image, the header is truncated, or a dimension is zero.
+ */
+FM_API fm_status_t fm_workbook_probe_image(const fm_workbook_t* wb, const uint8_t* bytes, size_t len,
+                                           fm_image_info* out);
+
+/**
+ * @brief Number of anchored objects in the sheet's drawing; `0` for a sheet
+ *        without a drawing.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `out_count == NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range;
+ *         `kIoDrawingUnparseable` (5024) when the drawing part does not parse.
+ */
+FM_API fm_status_t fm_sheet_drawing_object_count(const fm_workbook_t* wb, size_t sheet_index, size_t* out_count);
+
+/**
+ * @brief Reads object `idx` of the sheet's drawing, in document order.
+ *
+ * The three strings are read-scratch-backed views.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `out == NULL`;
+ *         `kInvalidArgument` when `sheet_index` or `idx` is out of range;
+ *         `kIoDrawingUnparseable` (5024) when the drawing part does not parse.
+ */
+FM_API fm_status_t fm_sheet_drawing_object_at(const fm_workbook_t* wb, size_t sheet_index, size_t idx,
+                                              fm_drawing_object* out);
+
+/**
+ * @brief Returns the media bytes and header info of the picture `object_id`.
+ *
+ * `*out_bytes` points into the workbook's own storage and is not
+ * NUL-terminated: it stays valid until the next call that mutates the
+ * workbook (insert, remove, any edit) or the handle is destroyed; unrelated
+ * reads do not invalidate it. Copy it to keep it longer.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or the sheet
+ *         has no picture `object_id` with a present media part;
+ *         `kIoImageUnsupported` (5023) when the media bytes are not a
+ *         recognised image;
+ *         `kIoDrawingUnparseable` (5024) when the drawing part does not parse.
+ */
+FM_API fm_status_t fm_sheet_get_image(const fm_workbook_t* wb, size_t sheet_index, uint32_t object_id,
+                                      const uint8_t** out_bytes, size_t* out_len, fm_image_info* out_info);
+
+/**
+ * @brief Inserts `bytes` as a picture and returns its object id, unique
+ *        within the sheet's drawing.
+ *
+ * Existing charts, shapes and every other drawing content are kept. A sheet
+ * without a drawing gets a new one.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if any pointer argument is `NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range, an enum
+ *         field is outside its domain, the anchor kind is absolute, an
+ *         offset or size is negative or 2^31 EMU or more, the anchor lies
+ *         outside the sheet, the image exceeds 32 MiB, or the package would
+ *         exceed the reader's limits;
+ *         `kIoImageUnsupported` (5023) when `bytes` is not a recognised image;
+ *         `kIoDrawingUnparseable` (5024) when the drawing part does not parse
+ *         or was retained from an `.xlsb` package. The workbook is then
+ *         unchanged.
+ */
+FM_API fm_status_t fm_sheet_insert_image(fm_workbook_t* wb, size_t sheet_index, const uint8_t* bytes, size_t len,
+                                         const fm_image_insert* opts, uint32_t* out_object_id);
+
+/**
+ * @brief Removes the picture `object_id`, and its media part and
+ *        relationship once nothing else references them.
+ *
+ * @return `kOk` on success;
+ *         `kBindingNullPointer` if `wb == NULL`;
+ *         `kInvalidArgument` when `sheet_index` is out of range or the sheet
+ *         has no picture with that id;
+ *         `kIoDrawingUnparseable` (5024) when the drawing part does not parse
+ *         or was retained from an `.xlsb` package.
+ */
+FM_API fm_status_t fm_sheet_remove_image(fm_workbook_t* wb, size_t sheet_index, uint32_t object_id);
+
 /* -------------------------------------------------------------------------- */
 /* Version                                                                    */
 /* -------------------------------------------------------------------------- */
diff --git a/src/c_api/parts/auto_filter.cpp b/src/c_api/parts/auto_filter.cpp
new file mode 100644
index 000000000..2cc4951df
--- /dev/null
+++ b/src/c_api/parts/auto_filter.cpp
@@ -0,0 +1,683 @@
+//
+// C ABI - typed sheet and table AutoFilter: read, replace, remove, and the
+// apply / clear / evaluate operations over the filtered rows.
+
+#include "auto_filter.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "cf/auto_filter_eval.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+using formulon::c_api::parts::check_enum_domain;
+using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::clear_last_error;
+using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::set_last_error;
+
+namespace {
+
+static_assert(sizeof(fm_merge_range) == sizeof(formulon::MergeRange), "fm_merge_range / MergeRange size mismatch");
+
+// `fm_filter_column::dxf_id` of a colour filter that names no dxf.
+constexpr std::uint32_t kAbsentDxfId = std::numeric_limits<std::uint32_t>::max();
+
+// The AutoFilter an entry point operates on: the sheet's own, or a table's.
+struct Target {
+  std::size_t sheet = 0;
+  std::optional<std::size_t> table;
+  const formulon::AutoFilter* filter = nullptr;
+};
+
+fm_status_t resolve_sheet(const fm_workbook_t* wb, std::size_t sheet_index, const char* api, Target* out) {
+  if (auto rc = check_sheet_index(wb, sheet_index, api); rc != 0) {
+    return rc;
+  }
+  out->sheet = sheet_index;
+  out->filter = wb->workbook().sheet(sheet_index).auto_filter();
+  return 0;
+}
+
+fm_status_t resolve_table(const fm_workbook_t* wb, std::size_t table_index, const char* api, Target* out) {
+  if (wb == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, api, "wb=NULL");
+  }
+  const auto& tables = wb->workbook().tables();
+  if (table_index >= tables.size()) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             (std::string(api) + ": table index out of range").c_str(),
+                             "table_index=" + std::to_string(table_index) + " count=" + std::to_string(tables.size()));
+  }
+  out->sheet = tables[table_index].sheet_index;
+  out->table = table_index;
+  out->filter = tables[table_index].auto_filter_xml.get();
+  return 0;
+}
+
+// Rejects an AutoFilter the typed surface cannot operate on: absent, or kept
+// opaque because it did not parse into the model.
+fm_status_t require_typed(const Target& target, const char* api) {
+  if (target.filter == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kNotFound, (std::string(api) + ": no AutoFilter").c_str());
+  }
+  if (target.filter->is_opaque()) {
+    return set_binding_error(formulon::FormulonErrorCode::kAutoFilterInvalid,
+                             (std::string(api) + ": AutoFilter did not parse into the typed model").c_str());
+  }
+  return 0;
+}
+
+fm_merge_range to_fm(const formulon::MergeRange& r) {
+  return fm_merge_range{r.first_row, r.first_col, r.last_row, r.last_col};
+}
+
+formulon::MergeRange from_fm(const fm_merge_range& r) {
+  formulon::MergeRange out;
+  out.first_row = r.first_row;
+  out.first_col = r.first_col;
+  out.last_row = r.last_row;
+  out.last_col = r.last_col;
+  return out;
+}
+
+std::string text_or_empty(const char* text) {
+  return text != nullptr ? std::string(text) : std::string();
+}
+
+// --- model -> record --------------------------------------------------------
+
+// Publishes `filter` into `out`, with every string in the handle's read
+// scratch and every array in the handle's AutoFilter arenas.
+void publish(const fm_workbook_t* wb, const formulon::AutoFilter& filter, fm_auto_filter* out) {
+  fm_workbook_t* scratch = const_cast<fm_workbook_t*>(wb);
+  scratch->read_scratch.clear();
+  scratch->filter_column_scratch.clear();
+  scratch->filter_value_scratch.clear();
+  scratch->date_group_scratch.clear();
+  scratch->sort_condition_scratch.clear();
+  auto keep = [scratch](const std::string& text) {
+    scratch->read_scratch.emplace_back(text);
+    return scratch->read_scratch.back().c_str();
+  };
+
+  std::vector<fm_filter_column> columns;
+  columns.reserve(filter.columns.size());
+  for (const formulon::FilterColumn& in : filter.columns) {
+    fm_filter_column c{};
+    c.col_id = in.col_id;
+    c.hidden_button = in.hidden_button ? 1 : 0;
+    c.show_button = in.show_button ? 1 : 0;
+    c.kind = static_cast<int32_t>(in.kind);
+    switch (in.kind) {
+      case formulon::FilterKind::kValues: {
+        c.filter_blank = in.values.blank ? 1 : 0;
+        std::vector<const char*> values;
+        values.reserve(in.values.values.size());
+        for (const std::string& v : in.values.values) {
+          values.push_back(keep(v));
+        }
+        c.value_count = static_cast<uint32_t>(values.size());
+        c.values = scratch->filter_value_scratch.adopt(std::move(values));
+        std::vector<fm_date_group_item> groups;
+        groups.reserve(in.values.date_groups.size());
+        for (const formulon::DateGroupItem& g : in.values.date_groups) {
+          groups.push_back(
+              fm_date_group_item{g.year, g.month, g.day, g.hour, g.minute, g.second, static_cast<uint8_t>(g.grouping)});
+        }
+        c.date_group_count = static_cast<uint32_t>(groups.size());
+        c.date_groups = scratch->date_group_scratch.adopt(std::move(groups));
+        break;
+      }
+      case formulon::FilterKind::kCustom:
+        c.custom_and = in.custom.and_join ? 1 : 0;
+        c.custom_count = static_cast<int32_t>(in.custom.filters.size());
+        if (!in.custom.filters.empty()) {
+          c.op1 = static_cast<int32_t>(in.custom.filters[0].op);
+          c.val1 = keep(in.custom.filters[0].val);
+        }
+        if (in.custom.filters.size() > 1U) {
+          c.op2 = static_cast<int32_t>(in.custom.filters[1].op);
+          c.val2 = keep(in.custom.filters[1].val);
+        }
+        break;
+      case formulon::FilterKind::kTop10:
+        c.top = in.top10.top ? 1 : 0;
+        c.percent = in.top10.percent ? 1 : 0;
+        c.top_val = in.top10.val;
+        c.has_filter_val = in.top10.filter_val.has_value() ? 1 : 0;
+        c.filter_val = in.top10.filter_val.value_or(0.0);
+        break;
+      case formulon::FilterKind::kDynamic:
+        c.dynamic_type = static_cast<int32_t>(in.dynamic.type);
+        c.has_dyn_val = in.dynamic.val.has_value() ? 1 : 0;
+        c.dyn_val = in.dynamic.val.value_or(0.0);
+        c.has_dyn_max_val = in.dynamic.max_val.has_value() ? 1 : 0;
+        c.dyn_max_val = in.dynamic.max_val.value_or(0.0);
+        c.val_iso = keep(in.dynamic.val_iso);
+        c.max_val_iso = keep(in.dynamic.max_val_iso);
+        break;
+      case formulon::FilterKind::kColor:
+        c.dxf_id = in.color.dxf_id.value_or(kAbsentDxfId);
+        c.cell_color = in.color.cell_color ? 1 : 0;
+        break;
+      case formulon::FilterKind::kIcon:
+        c.icon_set = static_cast<int32_t>(in.icon.icon_set);
+        c.has_icon_id = in.icon.icon_id.has_value() ? 1 : 0;
+        c.icon_id = static_cast<int32_t>(in.icon.icon_id.value_or(0U));
+        break;
+      case formulon::FilterKind::kNone:
+        break;
+    }
+    columns.push_back(c);
+  }
+
+  *out = fm_auto_filter{};
+  out->range = to_fm(filter.range);
+  out->column_count = static_cast<uint32_t>(columns.size());
+  out->columns = scratch->filter_column_scratch.adopt(std::move(columns));
+  if (filter.sort.has_value()) {
+    const formulon::SortState& sort = *filter.sort;
+    out->has_sort = 1;
+    out->sort_ref = to_fm(sort.ref);
+    out->column_sort = sort.column_sort ? 1 : 0;
+    out->case_sensitive = sort.case_sensitive ? 1 : 0;
+    out->sort_method = static_cast<int32_t>(sort.sort_method);
+    std::vector<fm_sort_condition> conditions;
+    conditions.reserve(sort.conditions.size());
+    for (const formulon::SortCondition& in : sort.conditions) {
+      fm_sort_condition c{};
+      c.ref = to_fm(in.ref);
+      c.descending = in.descending ? 1 : 0;
+      c.sort_by = static_cast<int32_t>(in.sort_by);
+      c.custom_list = keep(in.custom_list);
+      c.has_dxf_id = in.dxf_id.has_value() ? 1 : 0;
+      c.dxf_id = in.dxf_id.value_or(0U);
+      c.icon_set = static_cast<int32_t>(in.icon_set);
+      c.has_icon_id = in.icon_id.has_value() ? 1 : 0;
+      c.icon_id = static_cast<int32_t>(in.icon_id.value_or(0U));
+      conditions.push_back(c);
+    }
+    out->condition_count = static_cast<uint32_t>(conditions.size());
+    out->conditions = scratch->sort_condition_scratch.adopt(std::move(conditions));
+  }
+}
+
+// --- record -> model --------------------------------------------------------
+
+fm_status_t check_array(const void* data, uint32_t count, const char* api, const char* field) {
+  if (data == nullptr && count != 0U) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             (std::string(api) + ": NULL array with a non-zero count").c_str(),
+                             std::string("field=") + field + " count=" + std::to_string(count));
+  }
+  return 0;
+}
+
+fm_status_t column_from_fm(const fm_filter_column& in, const char* api, formulon::FilterColumn* out) {
+  if (auto rc = check_enum_domain(in.kind, static_cast<int64_t>(formulon::FilterKind::kIcon), api, "kind"); rc != 0) {
+    return rc;
+  }
+  out->col_id = in.col_id;
+  out->hidden_button = in.hidden_button != 0;
+  out->show_button = in.show_button != 0;
+  out->kind = static_cast<formulon::FilterKind>(in.kind);
+  switch (out->kind) {
+    case formulon::FilterKind::kValues: {
+      if (auto rc = check_array(in.values, in.value_count, api, "values"); rc != 0) {
+        return rc;
+      }
+      if (auto rc = check_array(in.date_groups, in.date_group_count, api, "date_groups"); rc != 0) {
+        return rc;
+      }
+      out->values.blank = in.filter_blank != 0;
+      for (uint32_t i = 0; i < in.value_count; ++i) {
+        out->values.values.push_back(text_or_empty(in.values[i]));
+      }
+      for (uint32_t i = 0; i < in.date_group_count; ++i) {
+        const fm_date_group_item& g = in.date_groups[i];
+        if (auto rc = check_enum_domain(g.grouping, static_cast<int64_t>(formulon::DateTimeGrouping::kSecond), api,
+                                        "date_groups.grouping");
+            rc != 0) {
+          return rc;
+        }
+        formulon::DateGroupItem item;
+        item.year = g.year;
+        item.month = g.month;
+        item.day = g.day;
+        item.hour = g.hour;
+        item.minute = g.minute;
+        item.second = g.second;
+        item.grouping = static_cast<formulon::DateTimeGrouping>(g.grouping);
+        out->values.date_groups.push_back(item);
+      }
+      return 0;
+    }
+    case formulon::FilterKind::kCustom: {
+      if (in.custom_count < 0 || in.custom_count > 2) {
+        return set_binding_error(formulon::FormulonErrorCode::kAutoFilterInvalid,
+                                 (std::string(api) + ": custom filter needs one or two conditions").c_str(),
+                                 "custom_count=" + std::to_string(in.custom_count));
+      }
+      constexpr auto kLastOp = static_cast<int64_t>(formulon::FilterOperator::kGreaterThan);
+      out->custom.and_join = in.custom_and != 0;
+      if (in.custom_count >= 1) {
+        if (auto rc = check_enum_domain(in.op1, kLastOp, api, "op1"); rc != 0) {
+          return rc;
+        }
+        out->custom.filters.push_back(
+            formulon::CustomFilter{static_cast<formulon::FilterOperator>(in.op1), text_or_empty(in.val1)});
+      }
+      if (in.custom_count == 2) {
+        if (auto rc = check_enum_domain(in.op2, kLastOp, api, "op2"); rc != 0) {
+          return rc;
+        }
+        out->custom.filters.push_back(
+            formulon::CustomFilter{static_cast<formulon::FilterOperator>(in.op2), text_or_empty(in.val2)});
+      }
+      return 0;
+    }
+    case formulon::FilterKind::kTop10:
+      out->top10.top = in.top != 0;
+      out->top10.percent = in.percent != 0;
+      out->top10.val = in.top_val;
+      if (in.has_filter_val != 0) {
+        out->top10.filter_val = in.filter_val;
+      }
+      return 0;
+    case formulon::FilterKind::kDynamic:
+      if (auto rc = check_enum_domain(in.dynamic_type, static_cast<int64_t>(formulon::DynamicFilterType::kM12), api,
+                                      "dynamic_type");
+          rc != 0) {
+        return rc;
+      }
+      out->dynamic.type = static_cast<formulon::DynamicFilterType>(in.dynamic_type);
+      if (in.has_dyn_val != 0) {
+        out->dynamic.val = in.dyn_val;
+      }
+      if (in.has_dyn_max_val != 0) {
+        out->dynamic.max_val = in.dyn_max_val;
+      }
+      out->dynamic.val_iso = text_or_empty(in.val_iso);
+      out->dynamic.max_val_iso = text_or_empty(in.max_val_iso);
+      return 0;
+    case formulon::FilterKind::kColor:
+      if (in.dxf_id != kAbsentDxfId) {
+        out->color.dxf_id = in.dxf_id;
+      }
+      out->color.cell_color = in.cell_color != 0;
+      return 0;
+    case formulon::FilterKind::kIcon:
+      if (auto rc = check_enum_domain(in.icon_set, static_cast<int64_t>(formulon::cf::IconSetName::Five_Quarters), api,
+                                      "icon_set");
+          rc != 0) {
+        return rc;
+      }
+      out->icon.icon_set = static_cast<formulon::cf::IconSetName>(in.icon_set);
+      if (in.has_icon_id != 0) {
+        if (auto rc = check_enum_domain(in.icon_id, std::numeric_limits<int32_t>::max(), api, "icon_id"); rc != 0) {
+          return rc;
+        }
+        out->icon.icon_id = static_cast<uint32_t>(in.icon_id);
+      }
+      return 0;
+    case formulon::FilterKind::kNone:
+      return 0;
+  }
+  return 0;
+}
+
+fm_status_t sort_condition_from_fm(const fm_sort_condition& in, const char* api, formulon::SortCondition* out) {
+  if (auto rc = check_enum_domain(in.sort_by, static_cast<int64_t>(formulon::SortBy::kIcon), api, "sort_by"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_enum_domain(in.icon_set, static_cast<int64_t>(formulon::cf::IconSetName::Five_Quarters), api,
+                                  "conditions.icon_set");
+      rc != 0) {
+    return rc;
+  }
+  out->ref = from_fm(in.ref);
+  out->descending = in.descending != 0;
+  out->sort_by = static_cast<formulon::SortBy>(in.sort_by);
+  out->custom_list = text_or_empty(in.custom_list);
+  if (in.has_dxf_id != 0) {
+    out->dxf_id = in.dxf_id;
+  }
+  out->icon_set = static_cast<formulon::cf::IconSetName>(in.icon_set);
+  if (in.has_icon_id != 0) {
+    if (auto rc = check_enum_domain(in.icon_id, std::numeric_limits<int32_t>::max(), api, "conditions.icon_id");
+        rc != 0) {
+      return rc;
+    }
+    out->icon_id = static_cast<uint32_t>(in.icon_id);
+  }
+  return 0;
+}
+
+fm_status_t filter_from_fm(const fm_auto_filter& in, const char* api, formulon::AutoFilter* out) {
+  if (auto rc = check_array(in.columns, in.column_count, api, "columns"); rc != 0) {
+    return rc;
+  }
+  out->range = from_fm(in.range);
+  for (uint32_t i = 0; i < in.column_count; ++i) {
+    formulon::FilterColumn column;
+    if (auto rc = column_from_fm(in.columns[i], api, &column); rc != 0) {
+      return rc;
+    }
+    out->columns.push_back(std::move(column));
+  }
+  if (in.has_sort == 0) {
+    return 0;
+  }
+  if (auto rc = check_array(in.conditions, in.condition_count, api, "conditions"); rc != 0) {
+    return rc;
+  }
+  if (auto rc =
+          check_enum_domain(in.sort_method, static_cast<int64_t>(formulon::SortMethod::kStroke), api, "sort_method");
+      rc != 0) {
+    return rc;
+  }
+  formulon::SortState sort;
+  sort.ref = from_fm(in.sort_ref);
+  sort.column_sort = in.column_sort != 0;
+  sort.case_sensitive = in.case_sensitive != 0;
+  sort.sort_method = static_cast<formulon::SortMethod>(in.sort_method);
+  for (uint32_t i = 0; i < in.condition_count; ++i) {
+    formulon::SortCondition condition;
+    if (auto rc = sort_condition_from_fm(in.conditions[i], api, &condition); rc != 0) {
+      return rc;
+    }
+    sort.conditions.push_back(std::move(condition));
+  }
+  out->sort = std::move(sort);
+  return 0;
+}
+
+// Copies from `existing` what the C records have no slot for: unmodelled
+// attributes and extensions of the filter, its sort state and each column
+// (matched by `col_id`), and a values filter's `calendarType`.
+void carry_unmodelled(const formulon::AutoFilter& existing, formulon::AutoFilter* model) {
+  model->extra_attrs = existing.extra_attrs;
+  model->ext_lst_xml = existing.ext_lst_xml;
+  if (model->sort.has_value() && existing.sort.has_value()) {
+    model->sort->extra_attrs = existing.sort->extra_attrs;
+    model->sort->ext_lst_xml = existing.sort->ext_lst_xml;
+  }
+  for (formulon::FilterColumn& column : model->columns) {
+    for (const formulon::FilterColumn& old : existing.columns) {
+      if (old.col_id != column.col_id) {
+        continue;
+      }
+      column.extra_attrs = old.extra_attrs;
+      column.extra_xml = old.extra_xml;
+      column.ext_xml = old.ext_xml;
+      column.values.calendar_type = old.values.calendar_type;
+      break;
+    }
+  }
+}
+
+// Drops every column criterion. A column that still carries a button
+// setting or retained markup stays, without a criterion.
+void drop_criteria(formulon::AutoFilter& filter) {
+  std::vector<formulon::FilterColumn> kept;
+  for (formulon::FilterColumn& column : filter.columns) {
+    formulon::FilterColumn bare;
+    bare.col_id = column.col_id;
+    bare.hidden_button = column.hidden_button;
+    bare.show_button = column.show_button;
+    bare.extra_attrs = std::move(column.extra_attrs);
+    bare.extra_xml = std::move(column.extra_xml);
+    bare.ext_xml = std::move(column.ext_xml);
+    if (bare.hidden_button || !bare.show_button || !bare.extra_attrs.empty() || !bare.extra_xml.empty() ||
+        !bare.ext_xml.empty()) {
+      kept.push_back(std::move(bare));
+    }
+  }
+  filter.columns = std::move(kept);
+}
+
+// --- shared bodies ----------------------------------------------------------
+
+fm_status_t get_body(const fm_workbook_t* wb, const Target& target, fm_auto_filter* out, int32_t* out_present,
+                     const char* api) {
+  if (target.filter == nullptr) {
+    *out = fm_auto_filter{};
+    *out_present = 0;
+    return 0;
+  }
+  if (auto rc = require_typed(target, api); rc != 0) {
+    return rc;
+  }
+  publish(wb, *target.filter, out);
+  *out_present = 1;
+  return 0;
+}
+
+fm_status_t store(fm_workbook_t* wb, const Target& target, formulon::AutoFilter filter) {
+  formulon::Workbook& book = wb->workbook();
+  auto result = target.table.has_value() ? book.set_table_auto_filter(*target.table, std::move(filter))
+                                         : book.set_sheet_auto_filter(target.sheet, std::move(filter));
+  return result ? 0 : set_last_error(result.error());
+}
+
+fm_status_t set_body(fm_workbook_t* wb, const Target& target, const fm_auto_filter* filter, const char* api) {
+  if (filter == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             (std::string(api) + ": NULL filter").c_str());
+  }
+  formulon::AutoFilter model;
+  if (auto rc = filter_from_fm(*filter, api, &model); rc != 0) {
+    return rc;
+  }
+  if (target.filter != nullptr && !target.filter->is_opaque()) {
+    carry_unmodelled(*target.filter, &model);
+  }
+  return store(wb, target, std::move(model));
+}
+
+fm_status_t remove_body(fm_workbook_t* wb, const Target& target) {
+  formulon::Workbook& book = wb->workbook();
+  auto result = target.table.has_value() ? book.remove_table_auto_filter(*target.table)
+                                         : book.remove_sheet_auto_filter(target.sheet);
+  return result ? 0 : set_last_error(result.error());
+}
+
+fm_status_t apply_body(fm_workbook_t* wb, const Target& target, const char* api) {
+  if (auto rc = require_typed(target, api); rc != 0) {
+    return rc;
+  }
+  // Copied: the row edits must not read through storage the workbook owns.
+  const formulon::AutoFilter filter = *target.filter;
+  auto result = formulon::apply_auto_filter(wb->workbook(), target.sheet, filter);
+  return result ? 0 : set_last_error(result.error());
+}
+
+fm_status_t clear_body(fm_workbook_t* wb, const Target& target, const char* api) {
+  if (auto rc = require_typed(target, api); rc != 0) {
+    return rc;
+  }
+  formulon::AutoFilter filter = *target.filter;
+  drop_criteria(filter);
+  if (auto rc = store(wb, target, filter); rc != 0) {
+    return rc;
+  }
+  auto result = formulon::apply_auto_filter(wb->workbook(), target.sheet, filter);
+  return result ? 0 : set_last_error(result.error());
+}
+
+fm_status_t evaluate_body(const fm_workbook_t* wb, const Target& target, uint8_t* out_match, size_t cap,
+                          size_t* out_len, uint32_t* out_first_row, const char* api) {
+  if (auto rc = require_typed(target, api); rc != 0) {
+    return rc;
+  }
+  const formulon::Workbook& book = wb->workbook();
+  auto matches = formulon::evaluate_auto_filter(book, book.sheet(target.sheet), *target.filter);
+  if (!matches) {
+    return set_last_error(matches.error());
+  }
+  const std::vector<bool>& flags = matches.value();
+  const std::size_t written = std::min(cap, flags.size());
+  for (std::size_t i = 0; i < written; ++i) {
+    out_match[i] = flags[i] ? 1U : 0U;
+  }
+  *out_len = flags.size();
+  *out_first_row = target.filter->range.first_row + 1U;
+  return 0;
+}
+
+bool evaluate_args_missing(const uint8_t* out_match, size_t cap, const size_t* out_len, const uint32_t* out_first_row) {
+  return out_len == nullptr || out_first_row == nullptr || (out_match == nullptr && cap > 0U);
+}
+
+}  // namespace
+
+// --- sheet ------------------------------------------------------------------
+
+extern "C" fm_status_t fm_sheet_get_auto_filter(const fm_workbook_t* wb, size_t sheet_index, fm_auto_filter* out,
+                                                int32_t* out_present) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_get_auto_filter";
+  if (out == nullptr || out_present == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_sheet_get_auto_filter: NULL out");
+  }
+  Target target;
+  if (auto rc = resolve_sheet(wb, sheet_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return get_body(wb, target, out, out_present, kApi);
+}
+
+extern "C" fm_status_t fm_sheet_set_auto_filter(fm_workbook_t* wb, size_t sheet_index, const fm_auto_filter* filter) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_set_auto_filter";
+  Target target;
+  if (auto rc = resolve_sheet(wb, sheet_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return set_body(wb, target, filter, kApi);
+}
+
+extern "C" fm_status_t fm_sheet_remove_auto_filter(fm_workbook_t* wb, size_t sheet_index) {
+  clear_last_error();
+  Target target;
+  if (auto rc = resolve_sheet(wb, sheet_index, "fm_sheet_remove_auto_filter", &target); rc != 0) {
+    return rc;
+  }
+  return remove_body(wb, target);
+}
+
+extern "C" fm_status_t fm_sheet_apply_auto_filter(fm_workbook_t* wb, size_t sheet_index) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_apply_auto_filter";
+  Target target;
+  if (auto rc = resolve_sheet(wb, sheet_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return apply_body(wb, target, kApi);
+}
+
+extern "C" fm_status_t fm_sheet_clear_auto_filter(fm_workbook_t* wb, size_t sheet_index) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_clear_auto_filter";
+  Target target;
+  if (auto rc = resolve_sheet(wb, sheet_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return clear_body(wb, target, kApi);
+}
+
+extern "C" fm_status_t fm_sheet_evaluate_auto_filter(const fm_workbook_t* wb, size_t sheet_index, uint8_t* out_match,
+                                                     size_t cap, size_t* out_len, uint32_t* out_first_row) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_evaluate_auto_filter";
+  if (evaluate_args_missing(out_match, cap, out_len, out_first_row)) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_evaluate_auto_filter: NULL argument");
+  }
+  Target target;
+  if (auto rc = resolve_sheet(wb, sheet_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return evaluate_body(wb, target, out_match, cap, out_len, out_first_row, kApi);
+}
+
+// --- table ------------------------------------------------------------------
+
+extern "C" fm_status_t fm_table_get_auto_filter(const fm_workbook_t* wb, size_t table_index, fm_auto_filter* out,
+                                                int32_t* out_present) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_table_get_auto_filter";
+  if (out == nullptr || out_present == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_table_get_auto_filter: NULL out");
+  }
+  Target target;
+  if (auto rc = resolve_table(wb, table_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return get_body(wb, target, out, out_present, kApi);
+}
+
+extern "C" fm_status_t fm_table_set_auto_filter(fm_workbook_t* wb, size_t table_index, const fm_auto_filter* filter) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_table_set_auto_filter";
+  Target target;
+  if (auto rc = resolve_table(wb, table_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return set_body(wb, target, filter, kApi);
+}
+
+extern "C" fm_status_t fm_table_remove_auto_filter(fm_workbook_t* wb, size_t table_index) {
+  clear_last_error();
+  Target target;
+  if (auto rc = resolve_table(wb, table_index, "fm_table_remove_auto_filter", &target); rc != 0) {
+    return rc;
+  }
+  return remove_body(wb, target);
+}
+
+extern "C" fm_status_t fm_table_apply_auto_filter(fm_workbook_t* wb, size_t table_index) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_table_apply_auto_filter";
+  Target target;
+  if (auto rc = resolve_table(wb, table_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return apply_body(wb, target, kApi);
+}
+
+extern "C" fm_status_t fm_table_clear_auto_filter(fm_workbook_t* wb, size_t table_index) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_table_clear_auto_filter";
+  Target target;
+  if (auto rc = resolve_table(wb, table_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return clear_body(wb, target, kApi);
+}
+
+extern "C" fm_status_t fm_table_evaluate_auto_filter(const fm_workbook_t* wb, size_t table_index, uint8_t* out_match,
+                                                     size_t cap, size_t* out_len, uint32_t* out_first_row) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_table_evaluate_auto_filter";
+  if (evaluate_args_missing(out_match, cap, out_len, out_first_row)) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_table_evaluate_auto_filter: NULL argument");
+  }
+  Target target;
+  if (auto rc = resolve_table(wb, table_index, kApi, &target); rc != 0) {
+    return rc;
+  }
+  return evaluate_body(wb, target, out_match, cap, out_len, out_first_row, kApi);
+}
diff --git a/src/c_api/parts/cell_range.h b/src/c_api/parts/cell_range.h
new file mode 100644
index 000000000..55071df4c
--- /dev/null
+++ b/src/c_api/parts/cell_range.h
@@ -0,0 +1,71 @@
+//
+// Owned page handle behind `fm_cell_range_t`, shared by the entry points that
+// enumerate cells with a resumable `row * 16384 + col` cursor
+// (`fm_sheet_cells_in_range`, `fm_sheet_list_invalid_cells`).
+
+#ifndef FORMULON_C_API_PARTS_CELL_RANGE_H_
+#define FORMULON_C_API_PARTS_CELL_RANGE_H_
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "sheet.h"
+#include "utils/error.h"
+
+namespace formulon {
+namespace c_api {
+namespace parts {
+
+// Page size cap for a cell-range page, and the size a zero limit asks for.
+constexpr std::uint32_t kMaxCellRangeLimit = 65536U;
+
+// One past the largest cursor the grid can encode.
+constexpr std::uint64_t kCellCursorLimit = static_cast<std::uint64_t>(Sheet::kMaxRows) * Sheet::kMaxCols;
+
+inline std::uint32_t cell_range_page_size(std::uint32_t limit) noexcept {
+  return (limit == 0U || limit > kMaxCellRangeLimit) ? kMaxCellRangeLimit : limit;
+}
+
+// Rejects a cursor past the last cell of the grid.
+inline fm_status_t check_cell_cursor(std::uint64_t cursor, const char* api) {
+  if (cursor >= kCellCursorLimit) {
+    return set_binding_error(FormulonErrorCode::kInvalidArgument, (std::string(api) + ": cursor out of range").c_str(),
+                             "cursor=" + std::to_string(cursor));
+  }
+  return 0;
+}
+
+}  // namespace parts
+}  // namespace c_api
+}  // namespace formulon
+
+struct fm_cell_range {
+  struct Entry {
+    std::uint32_t row = 0;
+    std::uint32_t col = 0;
+    const char* formula = nullptr;
+    fm_value_t value{};
+  };
+  std::vector<Entry> entries;
+  // Owns every formula string and Text payload `entries` points at.
+  formulon::c_api::parts::TextStore text;
+  std::uint64_t next_cursor = formulon::Sheet::kCellCursorEnd;
+
+  // Appends `cell`, copying its formula text and Text payload into the handle.
+  void append(const formulon::Sheet::RangeCell& cell) {
+    Entry entry;
+    entry.row = cell.row;
+    entry.col = cell.col;
+    if (!cell.formula_text.empty()) {
+      text.emplace_back(cell.formula_text);
+      entry.formula = text.back().c_str();
+    }
+    formulon::c_api::parts::value_to_fm(cell.value, text, &entry.value);
+    entries.push_back(entry);
+  }
+};
+
+#endif  // FORMULON_C_API_PARTS_CELL_RANGE_H_
diff --git a/src/c_api/parts/cells.cpp b/src/c_api/parts/cells.cpp
index 3abd1b292..acf41989e 100644
--- a/src/c_api/parts/cells.cpp
+++ b/src/c_api/parts/cells.cpp
@@ -5,25 +5,34 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
+#include <memory>
 #include <string>
 #include <string_view>
 #include <utility>
 #include <vector>
 
 #include "c_api/formulon_c.h"
+#include "c_api/parts/cell_range.h"
 #include "c_api/parts/common.h"
 #include "cell.h"
+#include "eval/formula_text_utils.h"
 #include "eval/lambda_format.h"
 #include "eval/lambda_value.h"
+#include "parser/ast_format_r1c1.h"
+#include "parser/parser.h"
 #include "phonetic.h"
 #include "sheet.h"
+#include "utils/arena.h"
 #include "utils/error.h"
 #include "utils/index_sort.h"
 #include "value.h"
 #include "workbook.h"
 
+using formulon::c_api::parts::cell_range_page_size;
+using formulon::c_api::parts::check_cell_cursor;
 using formulon::c_api::parts::check_finite;
 using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::check_sheet_rect;
 using formulon::c_api::parts::check_sheet_u32;
 using formulon::c_api::parts::clear_last_error;
 using formulon::c_api::parts::set_binding_error;
@@ -536,3 +545,155 @@ extern "C" fm_status_t fm_workbook_spill_info(const fm_workbook_t* wb, std::uint
   out->engaged = 1;
   return 0;
 }
+
+// ---------------------------------------------------------------------------
+// Formula text and range enumeration
+// ---------------------------------------------------------------------------
+
+namespace {
+
+fm_status_t check_cell_coord(std::uint32_t row, std::uint32_t col, const char* api) {
+  if (formulon::Sheet::coord_in_grid(row, col)) {
+    return 0;
+  }
+  return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "cell coordinate out of range",
+                           std::string(api) + ": row=" + std::to_string(row) + " col=" + std::to_string(col));
+}
+
+// Shared front half of the two formula getters: validates, then copies the
+// stored formula text (empty for a non-formula) out under the sheet lock.
+fm_status_t read_stored_formula(const fm_workbook_t* wb, size_t sheet_index, std::uint32_t row, std::uint32_t col,
+                                const char** out_formula, const char* api, std::string* out_text) {
+  if (out_formula == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             (std::string(api) + ": NULL argument").c_str());
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, api); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_cell_coord(row, col, api); rc != 0) {
+    return rc;
+  }
+  formulon::Sheet::CellRead read;
+  wb->workbook().sheet(sheet_index).read_formula_cell(row, col, read);
+  out_text->assign(read.formula_text());
+  return 0;
+}
+
+const char* publish_scratch(const fm_workbook_t* wb, std::string text) {
+  TextStore& store = const_cast<TextStore&>(wb->read_scratch);
+  store.clear();
+  store.emplace_back(std::move(text));
+  return store.back().c_str();
+}
+
+}  // namespace
+
+extern "C" fm_status_t fm_workbook_get_formula(const fm_workbook_t* wb, size_t sheet_index, uint32_t row, uint32_t col,
+                                               const char** out_formula) {
+  clear_last_error();
+  std::string text;
+  if (auto rc = read_stored_formula(wb, sheet_index, row, col, out_formula, "fm_workbook_get_formula", &text);
+      rc != 0) {
+    return rc;
+  }
+  *out_formula = publish_scratch(wb, std::move(text));
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_get_formula_r1c1(const fm_workbook_t* wb, size_t sheet_index, uint32_t row,
+                                                    uint32_t col, const char** out_formula) {
+  clear_last_error();
+  std::string text;
+  if (auto rc = read_stored_formula(wb, sheet_index, row, col, out_formula, "fm_workbook_get_formula_r1c1", &text);
+      rc != 0) {
+    return rc;
+  }
+  if (text.empty()) {
+    *out_formula = publish_scratch(wb, std::string());
+    return 0;
+  }
+  formulon::Arena arena;
+  const formulon::parser::AstNode* root =
+      formulon::parser::parse_strict(formulon::eval::strip_formula_prefix(text), arena);
+  if (root == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kParserUnexpectedToken,
+                             "fm_workbook_get_formula_r1c1: stored formula does not parse",
+                             "row=" + std::to_string(row) + " col=" + std::to_string(col));
+  }
+  *out_formula = publish_scratch(wb, formulon::parser::format_formula_r1c1(*root, row, col));
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_cells_in_range(const fm_workbook_t* wb, size_t sheet_index, uint32_t first_row,
+                                               uint32_t first_col, uint32_t last_row, uint32_t last_col,
+                                               uint64_t cursor, uint32_t limit, fm_cell_range_t** out) {
+  clear_last_error();
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_sheet_cells_in_range: NULL out");
+  }
+  *out = nullptr;
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_cells_in_range"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_sheet_rect(first_row, first_col, last_row, last_col, "fm_sheet_cells_in_range"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_cell_cursor(cursor, "fm_sheet_cells_in_range"); rc != 0) {
+    return rc;
+  }
+  auto handle = std::unique_ptr<fm_cell_range_t>(new fm_cell_range_t{});
+  handle->next_cursor = wb->workbook()
+                            .sheet(sheet_index)
+                            .cells_in_range(
+                                first_row, first_col, last_row, last_col, cursor, cell_range_page_size(limit),
+                                [](const formulon::Sheet::RangeCell& cell, void* ctx) {
+                                  static_cast<fm_cell_range_t*>(ctx)->append(cell);
+                                },
+                                handle.get());
+  *out = handle.release();
+  return 0;
+}
+
+extern "C" fm_status_t fm_cell_range_count(const fm_cell_range_t* range, size_t* out_count) {
+  clear_last_error();
+  if (range == nullptr || out_count == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_cell_range_count: NULL argument");
+  }
+  *out_count = range->entries.size();
+  return 0;
+}
+
+extern "C" fm_status_t fm_cell_range_at(const fm_cell_range_t* range, size_t idx, uint32_t* out_row, uint32_t* out_col,
+                                        const char** out_formula, fm_value_t* out_value) {
+  clear_last_error();
+  if (range == nullptr || out_row == nullptr || out_col == nullptr || out_value == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_cell_range_at: NULL argument");
+  }
+  if (idx >= range->entries.size()) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "fm_cell_range_at: idx out of range",
+                             "idx=" + std::to_string(idx) + " count=" + std::to_string(range->entries.size()));
+  }
+  const fm_cell_range_t::Entry& entry = range->entries[idx];
+  *out_row = entry.row;
+  *out_col = entry.col;
+  if (out_formula != nullptr) {
+    *out_formula = entry.formula;
+  }
+  *out_value = entry.value;
+  return 0;
+}
+
+extern "C" fm_status_t fm_cell_range_next_cursor(const fm_cell_range_t* range, uint64_t* out_cursor) {
+  clear_last_error();
+  if (range == nullptr || out_cursor == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_cell_range_next_cursor: NULL argument");
+  }
+  *out_cursor = range->next_cursor;
+  return 0;
+}
+
+extern "C" void fm_cell_range_destroy(fm_cell_range_t* range) {
+  delete range;
+}
diff --git a/src/c_api/parts/cf_mutate.cpp b/src/c_api/parts/cf_mutate.cpp
index 410a99850..3ea38fd80 100644
--- a/src/c_api/parts/cf_mutate.cpp
+++ b/src/c_api/parts/cf_mutate.cpp
@@ -19,7 +19,6 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
-#include <cstdio>
 #include <string>
 #include <utility>
 #include <vector>
@@ -27,8 +26,10 @@
 #include "c_api/formulon_c.h"
 #include "c_api/parts/common.h"
 #include "cf/cf_types.h"
+#include "color_resolve.h"
 #include "io/cf_overlay.h"
 #include "utils/error.h"
+#include "utils/number_text.h"
 #include "workbook.h"
 
 using formulon::c_api::BorrowedArrayArena;
@@ -83,7 +84,15 @@ bool resolve_flat_index(const std::vector<formulon::cf::ConditionalFormat>& bloc
 // does not move as later payloads are adopted, so a rule engaging more
 // than one visual payload cannot invalidate a pointer already written
 // into `*out`.
-fm_cf_color_t from_cf_color(formulon::cf::Color color) {
+// The C payload carries literal channels only, so a theme / indexed / auto
+// colour is reported as its effective value in `wb`.
+fm_cf_color_t from_cf_color(const formulon::Workbook& wb, formulon::cf::Color color, formulon::ColorContext context) {
+  if (color.is_symbolic()) {
+    const std::uint32_t argb = formulon::resolve_color(wb, color.spec, context).argb;
+    return fm_cf_color_t{static_cast<std::uint8_t>((argb >> 16U) & 0xFFU),
+                         static_cast<std::uint8_t>((argb >> 8U) & 0xFFU), static_cast<std::uint8_t>(argb & 0xFFU),
+                         static_cast<std::uint8_t>((argb >> 24U) & 0xFFU)};
+  }
   return fm_cf_color_t{color.r, color.g, color.b, color.a};
 }
 
@@ -97,10 +106,10 @@ fm_cfvo_t from_cfvo(const formulon::cf::CfValueObject& src, BorrowedStringArena&
   return out;
 }
 
-void fill_rule(const formulon::cf::ConditionalFormat& block, const formulon::cf::CFRule& rule, std::size_t dxf_count,
-               BorrowedStringArena& text_arena, BorrowedArrayArena<fm_cf_cell_range_t>& range_arena,
-               BorrowedArrayArena<fm_cfvo_t>& cfvo_arena, BorrowedArrayArena<fm_cf_color_t>& color_arena,
-               fm_cf_rule_t* out) {
+void fill_rule(const formulon::Workbook& wb, const formulon::cf::ConditionalFormat& block,
+               const formulon::cf::CFRule& rule, std::size_t dxf_count, BorrowedStringArena& text_arena,
+               BorrowedArrayArena<fm_cf_cell_range_t>& range_arena, BorrowedArrayArena<fm_cfvo_t>& cfvo_arena,
+               BorrowedArrayArena<fm_cf_color_t>& color_arena, fm_cf_rule_t* out) {
   *out = fm_cf_rule_t{};
   out->id = text_arena.emplace(rule.id);
   out->type = static_cast<std::uint8_t>(rule.type);
@@ -155,7 +164,7 @@ void fill_rule(const formulon::cf::ConditionalFormat& block, const formulon::cf:
     colors.reserve(count);
     for (std::size_t i = 0; i < count; ++i) {
       thresholds.push_back(from_cfvo(spec.thresholds[i], text_arena));
-      colors.push_back(from_cf_color(spec.colors[i]));
+      colors.push_back(from_cf_color(wb, spec.colors[i], formulon::ColorContext::kFillForeground));
     }
     out->color_scale_thresholds = cfvo_arena.adopt(std::move(thresholds));
     out->color_scale_colors = color_arena.adopt(std::move(colors));
@@ -166,7 +175,7 @@ void fill_rule(const formulon::cf::ConditionalFormat& block, const formulon::cf:
     out->data_bar_engaged = 1;
     out->data_bar_min = from_cfvo(spec.min, text_arena);
     out->data_bar_max = from_cfvo(spec.max, text_arena);
-    out->data_bar_fill = from_cf_color(spec.fill);
+    out->data_bar_fill = from_cf_color(wb, spec.fill, formulon::ColorContext::kFillForeground);
     out->data_bar_show_value = spec.show_value ? 1 : 0;
     out->data_bar_min_length_pct = spec.min_length_pct;
     out->data_bar_max_length_pct = spec.max_length_pct;
@@ -179,17 +188,17 @@ void fill_rule(const formulon::cf::ConditionalFormat& block, const formulon::cf:
     out->data_bar_axis_position_engaged = 1;
     out->data_bar_axis_position = static_cast<std::uint8_t>(spec.axis_position);
     out->data_bar_negative_fill_engaged = 1;
-    out->data_bar_negative_fill = from_cf_color(spec.negative_fill);
+    out->data_bar_negative_fill = from_cf_color(wb, spec.negative_fill, formulon::ColorContext::kFillForeground);
     out->data_bar_border_engaged = spec.border.has_value() ? 1 : 0;
     if (spec.border.has_value()) {
-      out->data_bar_border = from_cf_color(*spec.border);
+      out->data_bar_border = from_cf_color(wb, *spec.border, formulon::ColorContext::kBorder);
     }
     out->data_bar_negative_border_engaged = spec.negative_border.has_value() ? 1 : 0;
     if (spec.negative_border.has_value()) {
-      out->data_bar_negative_border = from_cf_color(*spec.negative_border);
+      out->data_bar_negative_border = from_cf_color(wb, *spec.negative_border, formulon::ColorContext::kBorder);
     }
     out->data_bar_axis_color_engaged = 1;
-    out->data_bar_axis_color = from_cf_color(spec.axis_color);
+    out->data_bar_axis_color = from_cf_color(wb, spec.axis_color, formulon::ColorContext::kBorder);
     out->data_bar_direction = static_cast<std::uint8_t>(spec.direction);
   }
   if (rule.icon_set.has_value()) {
@@ -344,8 +353,9 @@ extern "C" fm_status_t fm_sheet_cf_get_at(const fm_workbook_t* wb, std::size_t s
   mutable_wb->cf_range_scratch.clear();
   mutable_wb->cfvo_scratch.clear();
   mutable_wb->cf_color_scratch.clear();
-  fill_rule(blocks[b], blocks[b].rules[r], wb->workbook().styles().dxfs.size(), mutable_wb->cf_text_scratch,
-            mutable_wb->cf_range_scratch, mutable_wb->cfvo_scratch, mutable_wb->cf_color_scratch, out);
+  fill_rule(wb->workbook(), blocks[b], blocks[b].rules[r], wb->workbook().styles().dxfs.size(),
+            mutable_wb->cf_text_scratch, mutable_wb->cf_range_scratch, mutable_wb->cfvo_scratch,
+            mutable_wb->cf_color_scratch, out);
   return 0;
 }
 
@@ -412,9 +422,9 @@ extern "C" fm_status_t fm_sheet_cf_add_rule(fm_workbook_t* wb, std::size_t sheet
     // nibble is `0`, which no random (version 4) GUID Excel generates
     // can carry, so a synthesized id can never collide with a loaded
     // one.
-    char buf[40];
-    std::snprintf(buf, sizeof(buf), "{FC000000-0000-0000-0000-%012X}", static_cast<unsigned>(out_rule.priority));
-    out_rule.id = buf;
+    char buf[16];
+    formulon::format_hex(buf, sizeof(buf), static_cast<unsigned>(out_rule.priority), 12, true);
+    out_rule.id = std::string("{FC000000-0000-0000-0000-") + buf + "}";
   }
   if (rule.formula1 != nullptr) {
     out_rule.formula1 = std::string(rule.formula1);
diff --git a/src/c_api/parts/common.cpp b/src/c_api/parts/common.cpp
index 0cbece087..cb0e32486 100644
--- a/src/c_api/parts/common.cpp
+++ b/src/c_api/parts/common.cpp
@@ -15,6 +15,7 @@
 #include "sheet.h"
 #include "styles.h"
 #include "utils/error.h"
+#include "utils/number_text.h"
 #include "value.h"
 
 namespace formulon {
@@ -126,7 +127,7 @@ fm_status_t check_finite_non_negative(double value, const char* api, const char*
     return 0;
   }
   return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "value must be finite and non-negative",
-                           std::string(api) + ": " + field + "=" + std::to_string(value));
+                           std::string(api) + ": " + field + "=" + formulon::fixed_string(value, 6));
 }
 
 fm_status_t check_finite(double value, const char* api, const char* field) {
@@ -134,7 +135,40 @@ fm_status_t check_finite(double value, const char* api, const char* field) {
     return 0;
   }
   return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "value must be finite",
-                           std::string(api) + ": " + field + "=" + std::to_string(value));
+                           std::string(api) + ": " + field + "=" + formulon::fixed_string(value, 6));
+}
+
+fm_status_t value_from_fm(const fm_value_t& in, formulon::Value* out, const char* api) {
+  switch (in.kind) {
+    case FM_VAL_BLANK:
+      *out = formulon::Value::blank();
+      return 0;
+    case FM_VAL_NUMBER:
+      if (auto rc = check_finite(in.u.number, api, "value"); rc != 0) {
+        return rc;
+      }
+      *out = formulon::Value::number(in.u.number);
+      return 0;
+    case FM_VAL_BOOL:
+      *out = formulon::Value::boolean(in.u.boolean != 0);
+      return 0;
+    case FM_VAL_TEXT:
+      if (in.u.text == nullptr) {
+        return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "value text is NULL", api);
+      }
+      *out = formulon::Value::text(in.u.text);
+      return 0;
+    case FM_VAL_ERROR:
+      if (in.u.error_code < 0 || in.u.error_code > static_cast<int32_t>(formulon::ErrorCode::Unknown)) {
+        return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "error code out of range",
+                                 std::string(api) + ": error=" + std::to_string(in.u.error_code));
+      }
+      *out = formulon::Value::error(static_cast<formulon::ErrorCode>(in.u.error_code));
+      return 0;
+    default:
+      return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "value kind not accepted",
+                               std::string(api) + ": kind=" + std::to_string(static_cast<int>(in.kind)));
+  }
 }
 
 fm_status_t check_enum_domain(std::int64_t value, std::int64_t max, const char* api, const char* field) {
diff --git a/src/c_api/parts/common.h b/src/c_api/parts/common.h
index 79212f84a..d52999ca8 100644
--- a/src/c_api/parts/common.h
+++ b/src/c_api/parts/common.h
@@ -156,6 +156,12 @@ fm_status_t check_finite_non_negative(double value, const char* api, const char*
 // disagree about the cell right up until the first save.
 fm_status_t check_finite(double value, const char* api, const char* field);
 
+// Converts a caller-supplied scalar into a `Value`, rejecting a non-finite
+// number, a NULL text, an out-of-range error code, and the array / reference
+// / lambda kinds. A Text value aliases the caller's string, so the result is
+// valid only for the duration of the call.
+fm_status_t value_from_fm(const fm_value_t& in, formulon::Value* out, const char* api);
+
 // Rejects an ordinal outside `[0, max]`. `max` is the last declared
 // enumerator of the model enum the field mirrors, so extending that enum
 // widens the domain at the same time. A value past it would otherwise be
@@ -297,6 +303,15 @@ struct fm_workbook {
   formulon::c_api::BorrowedArrayArena<fm_cfvo_t> cfvo_scratch;
   formulon::c_api::BorrowedArrayArena<fm_cf_color_t> cf_color_scratch;
 
+  // Arrays behind the borrowed `const T*` fields of the typed AutoFilter and
+  // threaded-comment getters. They carry `read_scratch`'s lifetime: each
+  // producer clears them together with `read_scratch` before refilling.
+  formulon::c_api::BorrowedArrayArena<fm_filter_column> filter_column_scratch;
+  formulon::c_api::BorrowedArrayArena<const char*> filter_value_scratch;
+  formulon::c_api::BorrowedArrayArena<fm_date_group_item> date_group_scratch;
+  formulon::c_api::BorrowedArrayArena<fm_sort_condition> sort_condition_scratch;
+  formulon::c_api::BorrowedArrayArena<fm_mention> mention_scratch;
+
   // Result of the most recent `fm_workbook_evaluate_formula_array`. Owns its
   // own text storage so cells stay readable via
   // `fm_workbook_evaluate_formula_array_cell` after the producing call's
diff --git a/src/c_api/parts/display.cpp b/src/c_api/parts/display.cpp
new file mode 100644
index 000000000..4bfae2d0f
--- /dev/null
+++ b/src/c_api/parts/display.cpp
@@ -0,0 +1,80 @@
+//
+// C ABI - cell display text and ad-hoc number-format rendering.
+//
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "eval/text_format/display_text.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::clear_last_error;
+using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::TextStore;
+using formulon::c_api::parts::value_from_fm;
+
+namespace {
+
+static_assert(FM_DISPLAY_OK == static_cast<int>(formulon::text_format::DisplayStatus::kOk),
+              "FM_DISPLAY_OK must match DisplayStatus::kOk");
+static_assert(FM_DISPLAY_OVERFLOW == static_cast<int>(formulon::text_format::DisplayStatus::kOverflow),
+              "FM_DISPLAY_OVERFLOW must match DisplayStatus::kOverflow");
+static_assert(FM_DISPLAY_INVALID_FORMAT == static_cast<int>(formulon::text_format::DisplayStatus::kInvalidFormat),
+              "FM_DISPLAY_INVALID_FORMAT must match DisplayStatus::kInvalidFormat");
+
+// Publishes a rendering through the handle's read scratch.
+void publish(const fm_workbook_t* wb, formulon::text_format::DisplayText display, const char** out_text,
+             int32_t* out_status) {
+  TextStore& store = const_cast<TextStore&>(wb->read_scratch);
+  store.clear();
+  store.emplace_back(std::move(display.text));
+  *out_text = store.back().c_str();
+  *out_status = static_cast<int32_t>(display.status);
+}
+
+}  // namespace
+
+extern "C" fm_status_t fm_workbook_get_display_text(const fm_workbook_t* wb, size_t sheet_index, uint32_t row,
+                                                    uint32_t col, const char** out_text, int32_t* out_status) {
+  clear_last_error();
+  if (out_text == nullptr || out_status == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_get_display_text: NULL argument");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_workbook_get_display_text"); rc != 0) {
+    return rc;
+  }
+  if (!formulon::Sheet::coord_in_grid(row, col)) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             "fm_workbook_get_display_text: cell coordinate out of range",
+                             "row=" + std::to_string(row) + " col=" + std::to_string(col));
+  }
+  const formulon::Workbook& workbook = wb->workbook();
+  publish(wb, formulon::text_format::format_cell_for_display(workbook, workbook.sheet(sheet_index), row, col), out_text,
+          out_status);
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_format_value(const fm_workbook_t* wb, const fm_value_t* value,
+                                                const char* format_code, const char** out_text, int32_t* out_status) {
+  clear_last_error();
+  if (wb == nullptr || value == nullptr || format_code == nullptr || out_text == nullptr || out_status == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_format_value: NULL argument");
+  }
+  formulon::Value v = formulon::Value::blank();
+  if (auto rc = value_from_fm(*value, &v, "fm_workbook_format_value"); rc != 0) {
+    return rc;
+  }
+  publish(wb, formulon::text_format::format_value_for_display(v, format_code, wb->workbook().date1904()), out_text,
+          out_status);
+  return 0;
+}
diff --git a/src/c_api/parts/drawing.cpp b/src/c_api/parts/drawing.cpp
new file mode 100644
index 000000000..1a4bda934
--- /dev/null
+++ b/src/c_api/parts/drawing.cpp
@@ -0,0 +1,200 @@
+//
+// C ABI - images in a sheet's drawing: probing, listing the drawing's
+// objects, reading, inserting and removing pictures.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "drawing/drawing_edit.h"
+#include "drawing/drawing_xml.h"
+#include "drawing/image_header.h"
+#include "io/ooxml/part_dom.h"
+#include "passthrough_part.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+using formulon::c_api::parts::check_enum_domain;
+using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::clear_last_error;
+using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::set_last_error;
+
+namespace {
+
+constexpr const char* kNullPointer = "NULL argument";
+
+fm_image_info to_fm(const formulon::ImageInfo& info) {
+  return fm_image_info{static_cast<int32_t>(info.format), info.px_width, info.px_height};
+}
+
+const char* keep(fm_workbook_t* scratch, const std::string& text) {
+  scratch->read_scratch.emplace_back(text);
+  return scratch->read_scratch.back().c_str();
+}
+
+}  // namespace
+
+extern "C" fm_status_t fm_workbook_probe_image(const fm_workbook_t* wb, const uint8_t* bytes, size_t len,
+                                               fm_image_info* out) {
+  clear_last_error();
+  if (wb == nullptr || bytes == nullptr || out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_probe_image: NULL argument");
+  }
+  auto info = formulon::probe_image(bytes, len);
+  if (!info) {
+    return set_last_error(info.error());
+  }
+  *out = to_fm(info.value());
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_drawing_object_count(const fm_workbook_t* wb, size_t sheet_index, size_t* out_count) {
+  clear_last_error();
+  if (out_count == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_drawing_object_count: NULL out_count");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_drawing_object_count"); rc != 0) {
+    return rc;
+  }
+  auto objects = formulon::list_drawing_objects(wb->workbook(), sheet_index);
+  if (!objects) {
+    return set_last_error(objects.error());
+  }
+  *out_count = objects.value().size();
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_drawing_object_at(const fm_workbook_t* wb, size_t sheet_index, size_t idx,
+                                                  fm_drawing_object* out) {
+  clear_last_error();
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_sheet_drawing_object_at: NULL out");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_drawing_object_at"); rc != 0) {
+    return rc;
+  }
+  auto objects = formulon::list_drawing_objects(wb->workbook(), sheet_index);
+  if (!objects) {
+    return set_last_error(objects.error());
+  }
+  const std::vector<formulon::DrawingObject>& list = objects.value();
+  if (idx >= list.size()) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             "fm_sheet_drawing_object_at: idx out of range",
+                             "idx=" + std::to_string(idx) + " count=" + std::to_string(list.size()));
+  }
+  const formulon::DrawingObject& obj = list[idx];
+  fm_workbook_t* scratch = const_cast<fm_workbook_t*>(wb);
+  scratch->read_scratch.clear();
+  *out = fm_drawing_object{};
+  out->object_id = obj.object_id;
+  out->kind = static_cast<int32_t>(obj.kind);
+  out->anchor_kind = static_cast<int32_t>(obj.anchor_kind);
+  out->edit_as = static_cast<int32_t>(obj.edit_as);
+  out->from_row = obj.from.row;
+  out->from_col = obj.from.col;
+  out->from_row_off = obj.from.row_off;
+  out->from_col_off = obj.from.col_off;
+  out->to_row = obj.to.row;
+  out->to_col = obj.to.col;
+  out->to_row_off = obj.to.row_off;
+  out->to_col_off = obj.to.col_off;
+  out->cx = obj.cx;
+  out->cy = obj.cy;
+  out->image_format = static_cast<int32_t>(obj.image_format);
+  out->name = keep(scratch, obj.name);
+  out->descr = keep(scratch, obj.descr);
+  out->media_path = keep(scratch, obj.media_path);
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_get_image(const fm_workbook_t* wb, size_t sheet_index, uint32_t object_id,
+                                          const uint8_t** out_bytes, size_t* out_len, fm_image_info* out_info) {
+  clear_last_error();
+  if (out_bytes == nullptr || out_len == nullptr || out_info == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_get_image: NULL output pointer");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_get_image"); rc != 0) {
+    return rc;
+  }
+  auto objects = formulon::list_drawing_objects(wb->workbook(), sheet_index);
+  if (!objects) {
+    return set_last_error(objects.error());
+  }
+  for (const formulon::DrawingObject& obj : objects.value()) {
+    if (obj.object_id != object_id || obj.kind != formulon::DrawingObjectKind::kPicture) {
+      continue;
+    }
+    const formulon::PassthroughPart* media = formulon::io::ooxml::find_passthrough_part(wb->workbook(), obj.media_path);
+    if (media == nullptr) {
+      break;
+    }
+    auto info = formulon::probe_image(media->bytes.data(), media->bytes.size());
+    if (!info) {
+      return set_last_error(info.error());
+    }
+    *out_bytes = media->bytes.data();
+    *out_len = media->bytes.size();
+    *out_info = to_fm(info.value());
+    return 0;
+  }
+  return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                           "fm_sheet_get_image: no picture with that object id",
+                           "sheet_index=" + std::to_string(sheet_index) + " object_id=" + std::to_string(object_id));
+}
+
+extern "C" fm_status_t fm_sheet_insert_image(fm_workbook_t* wb, size_t sheet_index, const uint8_t* bytes, size_t len,
+                                             const fm_image_insert* opts, uint32_t* out_object_id) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_insert_image";
+  if (bytes == nullptr || opts == nullptr || out_object_id == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             (std::string(kApi) + ": " + kNullPointer).c_str());
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, kApi); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_enum_domain(opts->anchor_kind, static_cast<std::int64_t>(formulon::AnchorKind::kAbsolute), kApi,
+                                  "anchor_kind");
+      rc != 0) {
+    return rc;
+  }
+  if (auto rc =
+          check_enum_domain(opts->edit_as, static_cast<std::int64_t>(formulon::EditAs::kAbsolute), kApi, "edit_as");
+      rc != 0) {
+    return rc;
+  }
+  formulon::ImageInsertOptions model;
+  model.name = opts->name != nullptr ? opts->name : "";
+  model.descr = opts->descr != nullptr ? opts->descr : "";
+  model.anchor_kind = static_cast<formulon::AnchorKind>(opts->anchor_kind);
+  model.edit_as = static_cast<formulon::EditAs>(opts->edit_as);
+  model.row = opts->row;
+  model.col = opts->col;
+  model.row_off = opts->row_off_emu;
+  model.col_off = opts->col_off_emu;
+  model.width_emu = opts->width_emu;
+  model.height_emu = opts->height_emu;
+  auto id = formulon::insert_image(wb->workbook(), sheet_index, bytes, len, model);
+  if (!id) {
+    return set_last_error(id.error());
+  }
+  *out_object_id = id.value();
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_remove_image(fm_workbook_t* wb, size_t sheet_index, uint32_t object_id) {
+  clear_last_error();
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_remove_image"); rc != 0) {
+    return rc;
+  }
+  auto removed = formulon::remove_image(wb->workbook(), sheet_index, object_id);
+  return removed ? 0 : set_last_error(removed.error());
+}
diff --git a/src/c_api/parts/pagination.cpp b/src/c_api/parts/pagination.cpp
index c64e03e07..8ebbc0668 100644
--- a/src/c_api/parts/pagination.cpp
+++ b/src/c_api/parts/pagination.cpp
@@ -9,6 +9,7 @@
 #include <memory>
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "c_api/formulon_c.h"
 #include "c_api/parts/common.h"
@@ -70,40 +71,166 @@ extern "C" fm_status_t fm_pagination_print_area_at(const fm_pagination_t* pagina
   return 0;
 }
 
+namespace {
+
+fm_status_t break_at(const fm_pagination_t* pagination, size_t index, uint32_t* out, bool horizontal,
+                     const char* null_message, const char* range_message) {
+  clear_last_error();
+  if (pagination == nullptr || out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, null_message);
+  }
+  const std::vector<std::uint32_t>& breaks = horizontal ? pagination->result.h_breaks : pagination->result.v_breaks;
+  if (index >= breaks.size()) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, range_message);
+  }
+  *out = breaks[index];
+  return 0;
+}
+
+}  // namespace
+
 extern "C" size_t fm_pagination_horizontal_break_count(const fm_pagination_t* pagination) {
   return pagination == nullptr ? 0U : pagination->result.h_breaks.size();
 }
 
 extern "C" fm_status_t fm_pagination_horizontal_break_at(const fm_pagination_t* pagination, size_t index,
                                                          uint32_t* out_row) {
+  return break_at(pagination, index, out_row, /*horizontal=*/true, "fm_pagination_horizontal_break_at: NULL argument",
+                  "fm_pagination_horizontal_break_at: index out of range");
+}
+
+extern "C" size_t fm_pagination_vertical_break_count(const fm_pagination_t* pagination) {
+  return pagination == nullptr ? 0U : pagination->result.v_breaks.size();
+}
+
+extern "C" fm_status_t fm_pagination_vertical_break_at(const fm_pagination_t* pagination, size_t index,
+                                                       uint32_t* out_col) {
+  return break_at(pagination, index, out_col, /*horizontal=*/false, "fm_pagination_vertical_break_at: NULL argument",
+                  "fm_pagination_vertical_break_at: index out of range");
+}
+
+extern "C" fm_status_t fm_pagination_paper(const fm_pagination_t* pagination, fm_paper_info* out) {
+  clear_last_error();
+  if (pagination == nullptr || out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_pagination_paper: NULL argument");
+  }
+  const formulon::print::PaperInfo& paper = pagination->result.paper;
+  *out = fm_paper_info{};
+  out->width_pt = paper.width_pt;
+  out->height_pt = paper.height_pt;
+  out->landscape = paper.landscape ? 1 : 0;
+  out->known = paper.known ? 1 : 0;
+  return 0;
+}
+
+extern "C" fm_status_t fm_pagination_margins(const fm_pagination_t* pagination, fm_margins_pt* out) {
+  clear_last_error();
+  if (pagination == nullptr || out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_pagination_margins: NULL argument");
+  }
+  const formulon::print::MarginsPt& margins = pagination->result.margins;
+  *out = fm_margins_pt{margins.left, margins.right, margins.top, margins.bottom, margins.header, margins.footer};
+  return 0;
+}
+
+extern "C" fm_status_t fm_pagination_printable(const fm_pagination_t* pagination, fm_rect_pt* out) {
   clear_last_error();
-  if (pagination == nullptr || out_row == nullptr) {
+  if (pagination == nullptr || out == nullptr) {
     return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
-                             "fm_pagination_horizontal_break_at: NULL argument");
+                             "fm_pagination_printable: NULL argument");
   }
-  if (index >= pagination->result.h_breaks.size()) {
-    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
-                             "fm_pagination_horizontal_break_at: index out of range");
+  const formulon::print::RectPt& rect = pagination->result.printable;
+  *out = fm_rect_pt{rect.x, rect.y, rect.width, rect.height};
+  return 0;
+}
+
+extern "C" fm_status_t fm_pagination_scale(const fm_pagination_t* pagination, double* out_scale) {
+  clear_last_error();
+  if (pagination == nullptr || out_scale == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_pagination_scale: NULL argument");
   }
-  *out_row = pagination->result.h_breaks[index];
+  *out_scale = pagination->result.scale;
   return 0;
 }
 
-extern "C" size_t fm_pagination_vertical_break_count(const fm_pagination_t* pagination) {
-  return pagination == nullptr ? 0U : pagination->result.v_breaks.size();
+extern "C" fm_status_t fm_pagination_page_order(const fm_pagination_t* pagination, int32_t* out_order) {
+  clear_last_error();
+  if (pagination == nullptr || out_order == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_pagination_page_order: NULL argument");
+  }
+  *out_order = static_cast<int32_t>(pagination->result.page_order);
+  return 0;
 }
 
-extern "C" fm_status_t fm_pagination_vertical_break_at(const fm_pagination_t* pagination, size_t index,
-                                                       uint32_t* out_col) {
+extern "C" fm_status_t fm_pagination_print_titles(const fm_pagination_t* pagination, fm_print_titles* out) {
   clear_last_error();
-  if (pagination == nullptr || out_col == nullptr) {
+  if (pagination == nullptr || out == nullptr) {
     return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
-                             "fm_pagination_vertical_break_at: NULL argument");
+                             "fm_pagination_print_titles: NULL argument");
+  }
+  const formulon::print::PrintTitleSpan& titles = pagination->result.print_titles;
+  *out = fm_print_titles{};
+  out->has_rows = titles.has_rows ? 1 : 0;
+  out->first_row = titles.first_row;
+  out->last_row = titles.last_row;
+  out->has_cols = titles.has_cols ? 1 : 0;
+  out->first_col = titles.first_col;
+  out->last_col = titles.last_col;
+  return 0;
+}
+
+extern "C" fm_status_t fm_pagination_page_at(const fm_pagination_t* pagination, size_t index, fm_page_layout* out) {
+  clear_last_error();
+  if (pagination == nullptr || out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_pagination_page_at: NULL argument");
   }
-  if (index >= pagination->result.v_breaks.size()) {
+  if (index >= pagination->result.pages.size()) {
     return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
-                             "fm_pagination_vertical_break_at: index out of range");
+                             "fm_pagination_page_at: index out of range");
+  }
+  const formulon::print::PageLayout& page = pagination->result.pages[index];
+  *out = fm_page_layout{};
+  out->area_index = page.area_index;
+  out->first_row = page.first_row;
+  out->last_row = page.last_row;
+  out->first_col = page.first_col;
+  out->last_col = page.last_col;
+  out->origin_x_pt = page.origin_x_pt;
+  out->origin_y_pt = page.origin_y_pt;
+  out->width_pt = page.width_pt;
+  out->height_pt = page.height_pt;
+  return 0;
+}
+
+namespace {
+
+fm_status_t break_is_manual(const fm_pagination_t* pagination, size_t index, int32_t* out_manual, bool horizontal,
+                            const char* null_message, const char* range_message) {
+  clear_last_error();
+  if (pagination == nullptr || out_manual == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, null_message);
   }
-  *out_col = pagination->result.v_breaks[index];
+  const std::vector<bool>& manual = horizontal ? pagination->result.h_break_manual : pagination->result.v_break_manual;
+  if (index >= manual.size()) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, range_message);
+  }
+  *out_manual = manual[index] ? 1 : 0;
   return 0;
 }
+
+}  // namespace
+
+extern "C" fm_status_t fm_pagination_horizontal_break_is_manual(const fm_pagination_t* pagination, size_t index,
+                                                                int32_t* out_manual) {
+  return break_is_manual(pagination, index, out_manual, /*horizontal=*/true,
+                         "fm_pagination_horizontal_break_is_manual: NULL argument",
+                         "fm_pagination_horizontal_break_is_manual: index out of range");
+}
+
+extern "C" fm_status_t fm_pagination_vertical_break_is_manual(const fm_pagination_t* pagination, size_t index,
+                                                              int32_t* out_manual) {
+  return break_is_manual(pagination, index, out_manual, /*horizontal=*/false,
+                         "fm_pagination_vertical_break_is_manual: NULL argument",
+                         "fm_pagination_vertical_break_is_manual: index out of range");
+}
diff --git a/src/c_api/parts/pivot_cache.cpp b/src/c_api/parts/pivot_cache.cpp
index 05e90e084..12f7ca05f 100644
--- a/src/c_api/parts/pivot_cache.cpp
+++ b/src/c_api/parts/pivot_cache.cpp
@@ -7,6 +7,7 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 #include <memory>
 #include <string>
 #include <string_view>
@@ -116,6 +117,11 @@ extern "C" fm_status_t fm_workbook_pivot_cache_create(fm_workbook_t* wb, std::ui
         max_id = c->cache_id();
       }
     }
+    if (any && max_id == std::numeric_limits<std::uint32_t>::max()) {
+      return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                               "fm_workbook_pivot_cache_create: auto-assignment would overflow",
+                               "max_existing_id=" + std::to_string(max_id));
+    }
     assigned = any ? (max_id + 1U) : 1U;
   } else {
     if (find_cache(wb->workbook(), requested_id) != nullptr) {
@@ -543,20 +549,26 @@ formulon::pivot::PivotCacheRecord* lookup_record_mut(fm_workbook_t* wb, std::uin
   return rec;
 }
 
+// Shared body of the scalar `record_set_*` setters.
+fm_status_t set_record_cell(fm_workbook_t* wb, std::uint32_t cache_id, std::size_t record_idx, std::size_t field_idx,
+                            const char* fn, formulon::Value value) {
+  fm_status_t status = 0;
+  auto* rec = lookup_record_mut(wb, cache_id, record_idx, field_idx, fn, nullptr, &status);
+  if (rec == nullptr) {
+    return status;
+  }
+  rec->cells[field_idx] = std::move(value);
+  return 0;
+}
+
 }  // namespace
 
 extern "C" fm_status_t fm_workbook_pivot_cache_record_set_number(fm_workbook_t* wb, std::uint32_t cache_id,
                                                                  std::size_t record_idx, std::size_t field_idx,
                                                                  double value) {
   clear_last_error();
-  fm_status_t status = 0;
-  auto* rec = lookup_record_mut(wb, cache_id, record_idx, field_idx, "fm_workbook_pivot_cache_record_set_number",
-                                nullptr, &status);
-  if (rec == nullptr) {
-    return status;
-  }
-  rec->cells[field_idx] = formulon::Value::number(value);
-  return 0;
+  return set_record_cell(wb, cache_id, record_idx, field_idx, "fm_workbook_pivot_cache_record_set_number",
+                         formulon::Value::number(value));
 }
 
 extern "C" fm_status_t fm_workbook_pivot_cache_record_set_text(fm_workbook_t* wb, std::uint32_t cache_id,
@@ -586,27 +598,15 @@ extern "C" fm_status_t fm_workbook_pivot_cache_record_set_bool(fm_workbook_t* wb
                                                                std::size_t record_idx, std::size_t field_idx,
                                                                std::int32_t value) {
   clear_last_error();
-  fm_status_t status = 0;
-  auto* rec = lookup_record_mut(wb, cache_id, record_idx, field_idx, "fm_workbook_pivot_cache_record_set_bool", nullptr,
-                                &status);
-  if (rec == nullptr) {
-    return status;
-  }
-  rec->cells[field_idx] = formulon::Value::boolean(value != 0);
-  return 0;
+  return set_record_cell(wb, cache_id, record_idx, field_idx, "fm_workbook_pivot_cache_record_set_bool",
+                         formulon::Value::boolean(value != 0));
 }
 
 extern "C" fm_status_t fm_workbook_pivot_cache_record_set_blank(fm_workbook_t* wb, std::uint32_t cache_id,
                                                                 std::size_t record_idx, std::size_t field_idx) {
   clear_last_error();
-  fm_status_t status = 0;
-  auto* rec = lookup_record_mut(wb, cache_id, record_idx, field_idx, "fm_workbook_pivot_cache_record_set_blank",
-                                nullptr, &status);
-  if (rec == nullptr) {
-    return status;
-  }
-  rec->cells[field_idx] = formulon::Value::blank();
-  return 0;
+  return set_record_cell(wb, cache_id, record_idx, field_idx, "fm_workbook_pivot_cache_record_set_blank",
+                         formulon::Value::blank());
 }
 
 extern "C" fm_status_t fm_workbook_pivot_cache_record_set_error(fm_workbook_t* wb, std::uint32_t cache_id,
@@ -616,12 +616,6 @@ extern "C" fm_status_t fm_workbook_pivot_cache_record_set_error(fm_workbook_t* w
   if (!is_valid_error_code(error)) {
     return set_invalid_error_code("fm_workbook_pivot_cache_record_set_error", error);
   }
-  fm_status_t status = 0;
-  auto* rec = lookup_record_mut(wb, cache_id, record_idx, field_idx, "fm_workbook_pivot_cache_record_set_error",
-                                nullptr, &status);
-  if (rec == nullptr) {
-    return status;
-  }
-  rec->cells[field_idx] = formulon::Value::error(static_cast<formulon::ErrorCode>(error));
-  return 0;
+  return set_record_cell(wb, cache_id, record_idx, field_idx, "fm_workbook_pivot_cache_record_set_error",
+                         formulon::Value::error(static_cast<formulon::ErrorCode>(error)));
 }
diff --git a/src/c_api/parts/pivot_internal.cpp b/src/c_api/parts/pivot_internal.cpp
index 8d1baafe8..8be31a125 100644
--- a/src/c_api/parts/pivot_internal.cpp
+++ b/src/c_api/parts/pivot_internal.cpp
@@ -20,6 +20,15 @@ namespace formulon {
 namespace c_api {
 namespace parts {
 
+namespace {
+
+void clear_pivot_derived_state(formulon::pivot::PivotTable& table) {
+  table.clear_last_result();
+  table.clear_span_authored();
+}
+
+}  // namespace
+
 std::vector<std::unique_ptr<formulon::pivot::PivotCache>>& mutable_pivot_caches(formulon::Workbook& wb) {
   return const_cast<std::vector<std::unique_ptr<formulon::pivot::PivotCache>>&>(wb.pivot_caches());
 }
@@ -86,19 +95,24 @@ const formulon::pivot::PivotTable* resolve_pivot(const formulon::Workbook& wb, s
   return table;
 }
 
-void invalidate_pivot_result(formulon::pivot::PivotTable& table) {
-  table.clear_last_result();
-  table.clear_span_authored();
+void invalidate_pivot_result(formulon::Workbook& wb, formulon::pivot::PivotTable& table) {
+  clear_pivot_derived_state(table);
+  wb.mark_all_formulas_dirty();
 }
 
 void invalidate_pivot_results_for_cache(formulon::Workbook& wb, std::uint32_t cache_id) {
+  bool matched = false;
   for (std::size_t s = 0; s < wb.sheet_count(); ++s) {
     for (auto& table : wb.sheet(s).mutable_pivot_tables()) {
       if (table != nullptr && table->pivot_cache_id() == cache_id) {
-        table->clear_last_result();
+        clear_pivot_derived_state(*table);
+        matched = true;
       }
     }
   }
+  if (matched) {
+    wb.mark_all_formulas_dirty();
+  }
 }
 
 formulon::Value intern_cache_text(formulon::pivot::PivotCache& cache, std::string_view utf8) {
diff --git a/src/c_api/parts/pivot_internal.h b/src/c_api/parts/pivot_internal.h
index 0e79887d5..cbd83c81b 100644
--- a/src/c_api/parts/pivot_internal.h
+++ b/src/c_api/parts/pivot_internal.h
@@ -50,13 +50,15 @@ const formulon::pivot::PivotTable* resolve_pivot(const formulon::Workbook& wb, s
 // Excel's own" mark: a span read out of a file described the report as it
 // then stood, so a field, an order, a filter or a move all invalidate it
 // as surely as they invalidate the aggregates. Positioning stays the
-// caller's; the extent goes back to being projected at save time.
-void invalidate_pivot_result(formulon::pivot::PivotTable& table);
+// caller's; the extent goes back to being projected at save time. Every
+// formula is also marked dirty so GETPIVOTDATA recomputes against the change.
+void invalidate_pivot_result(formulon::Workbook& wb, formulon::pivot::PivotTable& table);
 
-// Invalidates `last_result_` on every pivot table (across all sheets)
-// that draws from `cache_id`. Called after any pivot-cache mutation so a
-// subsequent layout recomputes against the changed cache instead of
-// returning a stale memoised projection.
+// Invalidates derived state on every pivot table (across all sheets) that
+// draws from `cache_id`. Called after any pivot-cache mutation so a
+// subsequent layout or GETPIVOTDATA recomputes against the changed cache
+// instead of returning stale memoised state. Formula cells are dirtied once
+// when at least one matching table exists.
 void invalidate_pivot_results_for_cache(formulon::Workbook& wb, std::uint32_t cache_id);
 
 // Interns `utf8` in the cache's text storage and returns a Value::text
diff --git a/src/c_api/parts/pivot_table.cpp b/src/c_api/parts/pivot_table.cpp
index 8332b28c7..372a1bcdf 100644
--- a/src/c_api/parts/pivot_table.cpp
+++ b/src/c_api/parts/pivot_table.cpp
@@ -17,9 +17,11 @@
 #include "c_api/formulon_c.h"
 #include "c_api/parts/common.h"
 #include "c_api/parts/pivot_internal.h"
+#include "pivot/date_serial.h"
 #include "pivot/field_lookup.h"
 #include "sheet.h"
 #include "utils/error.h"
+#include "utils/number_text.h"
 #include "workbook.h"
 
 using formulon::c_api::parts::check_enum_domain;
@@ -39,6 +41,7 @@ using formulon::c_api::parts::resolve_pivot;
 using formulon::c_api::parts::resolve_pivot_mut;
 using formulon::c_api::parts::set_binding_error;
 using formulon::c_api::parts::validate;
+using formulon::pivot::is_valid_date_serial;
 
 namespace {
 
@@ -136,6 +139,7 @@ extern "C" fm_status_t fm_workbook_pivot_create(fm_workbook_t* wb, std::size_t s
   formulon::Sheet& sheet = wb->workbook().sheet(sheet_index);
   sheet.add_pivot_table(std::move(table));
   *out_pivot_index = sheet.pivot_tables().size() - 1U;
+  wb->workbook().mark_all_formulas_dirty();
   return 0;
 }
 
@@ -152,6 +156,7 @@ extern "C" fm_status_t fm_workbook_pivot_remove(fm_workbook_t* wb, std::size_t s
                              "pivot_index=" + std::to_string(pivot_index));
   }
   pivots.erase(pivots.begin() + static_cast<std::ptrdiff_t>(pivot_index));
+  wb->workbook().mark_all_formulas_dirty();
   return 0;
 }
 
@@ -167,7 +172,7 @@ extern "C" fm_status_t fm_workbook_pivot_set_name(fm_workbook_t* wb, std::size_t
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   table->set_name(utf8_name);
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -196,7 +201,7 @@ extern "C" fm_status_t fm_workbook_pivot_set_anchor(fm_workbook_t* wb, std::size
                                  " span_rows=" + std::to_string(span_rows) + " span_cols=" + std::to_string(span_cols));
   }
   table->set_anchor(anchor_row, anchor_col, span_rows, span_cols);
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -213,7 +218,7 @@ extern "C" fm_status_t fm_workbook_pivot_set_grand_totals(fm_workbook_t* wb, std
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   table->set_grand_totals(rows_enabled != 0, cols_enabled != 0);
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -249,7 +254,7 @@ extern "C" fm_status_t fm_workbook_pivot_set_layout(fm_workbook_t* wb, std::size
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   table->set_layout(pivot_layout_from_fm(layout));
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -297,7 +302,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_add(fm_workbook_t* wb, std::size_
   field.number_format = spec->number_format != nullptr ? spec->number_format : "";
   table->mutable_fields().push_back(std::move(field));
   *out_field_idx = table->fields().size() - 1U;
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -313,7 +318,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_clear(fm_workbook_t* wb, std::siz
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   table->mutable_fields().clear();
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -364,7 +369,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_set_axis(fm_workbook_t* wb, std::
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   field->axis = pivot_axis_from_fm(static_cast<fm_pivot_axis_t>(axis));
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -380,7 +385,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_set_sort(fm_workbook_t* wb, std::
   }
   field->sort.ascending = ascending != 0;
   field->sort.by_field = by_field != nullptr ? by_field : "";
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -395,7 +400,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_set_subtotal_top(fm_workbook_t* w
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   field->subtotal_top = top != 0;
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -417,7 +422,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_add_item(fm_workbook_t* wb, std::
   item.name = utf8_name;
   item.visible = visible != 0;
   field->items.push_back(std::move(item));
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -439,7 +444,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_add_item_at(fm_workbook_t* wb, st
   item.has_cache_index = true;
   item.cache_index = cache_index;
   field->items.push_back(std::move(item));
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -453,7 +458,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_clear_items(fm_workbook_t* wb, st
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   field->items.clear();
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -473,7 +478,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_set_item_visible(fm_workbook_t* w
                              "item_idx=" + std::to_string(item_idx));
   }
   field->items[item_idx].visible = visible != 0;
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -496,7 +501,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_add_subtotal_fn(fm_workbook_t* wb
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   field->subtotal_fns.push_back(pivot_subtotal_from_fm(static_cast<fm_pivot_aggregation_t>(agg)));
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -510,7 +515,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_clear_subtotal_fns(fm_workbook_t*
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   field->subtotal_fns.clear();
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -539,10 +544,16 @@ extern "C" fm_status_t fm_workbook_pivot_field_set_date_group(
                                "fm_workbook_pivot_field_set_date_group: interval_days=0");
     }
     if (has_start && has_end && start_serial_or_neg1 > end_serial_or_neg1) {
+      return set_binding_error(
+          formulon::FormulonErrorCode::kInvalidArgument, "start_serial_or_neg1 must not exceed end_serial_or_neg1",
+          "fm_workbook_pivot_field_set_date_group: start=" + formulon::fixed_string(start_serial_or_neg1, 6) +
+              " end=" + formulon::fixed_string(end_serial_or_neg1, 6));
+    }
+    if ((has_start && !is_valid_date_serial(start_serial_or_neg1, wb->workbook().date1904())) ||
+        (has_end && !is_valid_date_serial(end_serial_or_neg1, wb->workbook().date1904()))) {
       return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
-                               "start_serial_or_neg1 must not exceed end_serial_or_neg1",
-                               "fm_workbook_pivot_field_set_date_group: start=" + std::to_string(start_serial_or_neg1) +
-                                   " end=" + std::to_string(end_serial_or_neg1));
+                               "date-group serial bounds must be finite dates in the supported calendar",
+                               "fm_workbook_pivot_field_set_date_group: invalid serial bound");
     }
   }
   formulon::pivot::PivotTable* table = nullptr;
@@ -568,7 +579,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_set_date_group(
     grp.end_serial = end_serial_or_neg1;
   }
   field->date_group = std::move(grp);
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -582,7 +593,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_clear_date_group(fm_workbook_t* w
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   field->date_group.reset();
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -604,7 +615,7 @@ extern "C" fm_status_t fm_workbook_pivot_field_set_number_format(fm_workbook_t*
     return rc;
   }
   field->number_format = utf8;
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -639,7 +650,7 @@ fm_status_t set_field_order(fm_workbook_t* wb, std::size_t sheet_index, std::siz
   }
   std::vector<std::uint32_t>& target = row ? table->mutable_row_field_order() : table->mutable_col_field_order();
   target.assign(indices, indices + count);
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -726,7 +737,7 @@ extern "C" fm_status_t fm_workbook_pivot_data_field_add(fm_workbook_t* wb, std::
   fill_data_field(*spec, &df);
   table->mutable_data_fields().push_back(std::move(df));
   *out_idx = table->data_fields().size() - 1U;
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -742,7 +753,7 @@ extern "C" fm_status_t fm_workbook_pivot_data_field_clear(fm_workbook_t* wb, std
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   table->mutable_data_fields().clear();
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -773,7 +784,7 @@ extern "C" fm_status_t fm_workbook_pivot_data_field_set(fm_workbook_t* wb, std::
   formulon::pivot::PivotDataField df;
   fill_data_field(*spec, &df);
   table->mutable_data_fields()[data_field_idx] = std::move(df);
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -808,11 +819,9 @@ fm_status_t add_pivot_filter_impl(fm_workbook_t* wb, std::size_t sheet_index, st
                              (std::string(api) + ": data_field_index out of range").c_str(),
                              "data_field_index=" + std::to_string(spec->data_field_index));
   }
-  // A label/date filter is applied per record against the named field, so an
-  // unresolvable name would leave the filter a silent no-op. Value filters
-  // select their axis through `axis` + `data_field_index` instead and accept
-  // any field name.
-  if (!is_value_filter && !formulon::pivot::resolve_field_by_any_name(*table, spec->field_name).has_value()) {
+  // The engine skips a filter whose field does not resolve, so an unresolvable
+  // name would leave any filter kind a silent no-op.
+  if (!formulon::pivot::resolve_field_by_any_name(*table, spec->field_name).has_value()) {
     return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
                              (std::string(api) + ": field_name does not name a pivot field").c_str(),
                              std::string("field_name=") + spec->field_name);
@@ -859,7 +868,7 @@ fm_status_t add_pivot_filter_impl(fm_workbook_t* wb, std::size_t sheet_index, st
                                "value_high_kind=" + std::to_string(static_cast<int>(spec->value_high_kind)));
   }
   table->mutable_active_filters().push_back(std::move(filter));
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -959,7 +968,7 @@ extern "C" fm_status_t fm_workbook_pivot_filter_clear(fm_workbook_t* wb, std::si
     return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
   }
   table->mutable_active_filters().clear();
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
 
@@ -981,6 +990,6 @@ extern "C" fm_status_t fm_workbook_pivot_filter_remove_at(fm_workbook_t* wb, std
                              "filter_idx=" + std::to_string(filter_idx));
   }
   filters.erase(filters.begin() + static_cast<std::ptrdiff_t>(filter_idx));
-  invalidate_pivot_result(*table);
+  invalidate_pivot_result(wb->workbook(), *table);
   return 0;
 }
diff --git a/src/c_api/parts/print_area_titles.cpp b/src/c_api/parts/print_area_titles.cpp
new file mode 100644
index 000000000..d23bfde80
--- /dev/null
+++ b/src/c_api/parts/print_area_titles.cpp
@@ -0,0 +1,324 @@
+//
+// C ABI - print area and print titles.
+//
+// Both settings live in workbook-scope defined names (`_xlnm.Print_Area` /
+// `_xlnm.Print_Titles`) rather than in the worksheet part, so they are read
+// and written through the defined-name table. The helpers here render and
+// parse the sheet-qualified A1 text those names carry.
+//
+// @size-budget: 5 KB
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "parser/reference.h"
+#include "print/print_area.h"
+#include "sheet.h"
+#include "utils/a1_column.h"
+#include "utils/a1_ref.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::clear_last_error;
+using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::set_last_error;
+
+namespace {
+
+using formulon::Sheet;
+
+// OOXML built-in defined names for the two print settings Excel stores
+// outside the worksheet part.
+constexpr std::string_view kPrintAreaName = "_xlnm.Print_Area";
+constexpr std::string_view kPrintTitlesName = "_xlnm.Print_Titles";
+
+/// Returns the sheet-qualified prefix (`Sheet1!` / `'集計 2026'!`) for a
+/// defined-name formula, quoting per Excel's rules.
+std::string sheet_qualifier(std::string_view sheet_name) {
+  std::string out;
+  if (!formulon::parser::sheet_name_needs_quoting(sheet_name)) {
+    out.append(sheet_name);
+    out.push_back('!');
+    return out;
+  }
+  out.push_back('\'');
+  for (const char c : sheet_name) {
+    if (c == '\'') {
+      out.push_back('\'');
+    }
+    out.push_back(c);
+  }
+  out.append("'!");
+  return out;
+}
+
+/// Rewrites one A1 token with every column and row anchored.
+///
+/// Works on the authored text rather than a parsed rectangle so a
+/// whole-axis area keeps its shape: `A:D` becomes `$A:$D`, not the
+/// `$A$1:$D$1048576` a round trip through `CellRange` would produce.
+/// Existing anchors are not doubled.
+std::string absolutise_a1_token(std::string_view token) {
+  // A run is a maximal stretch of one character class. `A1` is two runs
+  // (the column and the row), each needing its own anchor; `AB` and `12`
+  // are one run each.
+  enum class Run { kNone, kLetters, kDigits };
+
+  std::string out;
+  out.reserve(token.size() + 4U);
+  Run run = Run::kNone;
+  bool anchor_pending = false;
+  for (const char chr : token) {
+    if (chr == '$') {
+      anchor_pending = true;
+      run = Run::kNone;
+      out.push_back(chr);
+      continue;
+    }
+    Run kind = Run::kNone;
+    if ((chr >= 'A' && chr <= 'Z') || (chr >= 'a' && chr <= 'z')) {
+      kind = Run::kLetters;
+    } else if (chr >= '0' && chr <= '9') {
+      kind = Run::kDigits;
+    }
+    if (kind == Run::kNone) {
+      run = Run::kNone;
+      anchor_pending = false;
+      out.push_back(chr);
+      continue;
+    }
+    if (kind != run) {
+      if (!anchor_pending) {
+        out.push_back('$');
+      }
+      run = kind;
+    }
+    anchor_pending = false;
+    out.push_back(chr);
+  }
+  return out;
+}
+
+/// Splits `text` on commas, trimming ASCII whitespace around each token.
+/// The caller-facing range syntax is unqualified, so no sheet name (and
+/// therefore no quoted comma) can appear.
+std::vector<std::string_view> split_areas(std::string_view text) {
+  std::vector<std::string_view> out;
+  std::size_t start = 0;
+  while (start <= text.size()) {
+    std::size_t comma = text.find(',', start);
+    if (comma == std::string_view::npos) {
+      comma = text.size();
+    }
+    std::string_view token = text.substr(start, comma - start);
+    while (!token.empty() && (token.front() == ' ' || token.front() == '\t')) {
+      token.remove_prefix(1);
+    }
+    while (!token.empty() && (token.back() == ' ' || token.back() == '\t')) {
+      token.remove_suffix(1);
+    }
+    out.push_back(token);
+    start = comma + 1;
+  }
+  return out;
+}
+
+/// Renders a resolved rectangle as an unqualified, anchor-free A1 range.
+std::string format_range(const formulon::print::CellRange& range) {
+  std::string out;
+  formulon::a1::append_column_letters(out, range.first_col);
+  out.append(std::to_string(static_cast<std::uint64_t>(range.first_row) + 1U));
+  out.push_back(':');
+  formulon::a1::append_column_letters(out, range.last_col);
+  out.append(std::to_string(static_cast<std::uint64_t>(range.last_row) + 1U));
+  return out;
+}
+
+/// A span endpoint reader: `formulon::a1::parse_uint` or `parse_column_letters`.
+using SpanEndParser = bool (*)(std::string_view, std::size_t*, std::uint32_t*);
+
+/// True when `token` is a whole-row (`1:2`) or whole-column (`A:A`) span
+/// whose endpoints `parse_end` reads within `1..max`, writing the 1-based
+/// endpoints back out.
+bool parse_span(std::string_view token, SpanEndParser parse_end, std::uint32_t max, std::uint32_t* first,
+                std::uint32_t* last) {
+  const std::size_t colon = token.find(':');
+  if (colon == std::string_view::npos) {
+    return false;
+  }
+  const auto to_end = [&](std::string_view part, std::uint32_t* out) {
+    std::size_t pos = 0;
+    if (!part.empty() && part.front() == '$') {
+      part.remove_prefix(1);
+    }
+    return parse_end(part, &pos, out) && pos == part.size() && *out >= 1U && *out <= max;
+  };
+  return to_end(token.substr(0, colon), first) && to_end(token.substr(colon + 1), last);
+}
+
+}  // namespace
+
+/* -------------------------------------------------------------------------- */
+/* Print area and titles                                                      */
+/* -------------------------------------------------------------------------- */
+
+extern "C" fm_status_t fm_sheet_set_print_area(fm_workbook_t* wb, size_t sheet_index, const char* ranges_a1) {
+  static constexpr const char* kFn = "fm_sheet_set_print_area";
+  clear_last_error();
+  if (ranges_a1 == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, kFn, "arg=ranges_a1");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, kFn); rc != 0) {
+    return rc;
+  }
+  const std::string_view input(ranges_a1);
+  std::string formula;
+  if (!input.empty()) {
+    const std::string qualifier = sheet_qualifier(wb->workbook().sheet(sheet_index).name());
+    const std::vector<std::string_view> tokens = split_areas(input);
+    if (!formulon::c_api::parts::check_range_count(static_cast<std::uint32_t>(tokens.size()), kFn)) {
+      return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+    }
+    for (const std::string_view token : tokens) {
+      // Round-trip the token through the resolver's own grammar so a
+      // malformed area is rejected here rather than surfacing later as a
+      // `kPrintInvalidArea` from `resolve_print_area`.
+      formulon::print::CellRange probe;
+      if (token.empty() || !formulon::print::parse_area_token(token, &probe)) {
+        return set_binding_error(formulon::FormulonErrorCode::kPrintInvalidArea, kFn, "token=" + std::string(token));
+      }
+      if (!formula.empty()) {
+        formula.push_back(',');
+      }
+      formula.append(qualifier);
+      formula.append(absolutise_a1_token(token));
+    }
+  }
+  auto result = wb->workbook().set_defined_name_scoped(std::string(kPrintAreaName), std::move(formula),
+                                                       static_cast<std::int32_t>(sheet_index));
+  if (!result) {
+    return set_last_error(result.error());
+  }
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_get_print_area(const fm_workbook_t* wb, size_t sheet_index,
+                                               const char** out_ranges_a1) {
+  static constexpr const char* kFn = "fm_sheet_get_print_area";
+  clear_last_error();
+  if (out_ranges_a1 == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, kFn, "arg=out_ranges_a1");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, kFn); rc != 0) {
+    return rc;
+  }
+  auto areas = formulon::print::resolve_print_area(wb->workbook(), static_cast<std::uint32_t>(sheet_index));
+  if (!areas) {
+    return set_last_error(areas.error());
+  }
+  std::string rendered;
+  for (const formulon::print::CellRange& range : areas.value()) {
+    if (!rendered.empty()) {
+      rendered.push_back(',');
+    }
+    rendered.append(format_range(range));
+  }
+  fm_workbook_t* mutable_wb = const_cast<fm_workbook_t*>(wb);
+  mutable_wb->read_scratch.clear();
+  mutable_wb->read_scratch.emplace_back(std::move(rendered));
+  *out_ranges_a1 = mutable_wb->read_scratch.back().c_str();
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_set_print_titles(fm_workbook_t* wb, size_t sheet_index, const char* repeat_rows,
+                                                 const char* repeat_cols) {
+  static constexpr const char* kFn = "fm_sheet_set_print_titles";
+  clear_last_error();
+  if (auto rc = check_sheet_index(wb, sheet_index, kFn); rc != 0) {
+    return rc;
+  }
+  const std::string_view rows(repeat_rows == nullptr ? "" : repeat_rows);
+  const std::string_view cols(repeat_cols == nullptr ? "" : repeat_cols);
+  std::string formula;
+  if (!rows.empty() || !cols.empty()) {
+    const std::string qualifier = sheet_qualifier(wb->workbook().sheet(sheet_index).name());
+    // Excel lists rows before columns; the resolver accepts either order,
+    // but matching Excel keeps a diffed worksheet quiet.
+    if (!rows.empty()) {
+      std::uint32_t first = 0;
+      std::uint32_t last = 0;
+      if (!parse_span(rows, &formulon::a1::parse_uint, Sheet::kMaxRows, &first, &last)) {
+        return set_binding_error(formulon::FormulonErrorCode::kPrintInvalidArea, kFn,
+                                 "repeat_rows=" + std::string(rows));
+      }
+      formula.append(qualifier);
+      formula.append(absolutise_a1_token(rows));
+    }
+    if (!cols.empty()) {
+      std::uint32_t first = 0;
+      std::uint32_t last = 0;
+      if (!parse_span(cols, &formulon::a1::parse_column_letters, Sheet::kMaxCols, &first, &last)) {
+        return set_binding_error(formulon::FormulonErrorCode::kPrintInvalidArea, kFn,
+                                 "repeat_cols=" + std::string(cols));
+      }
+      if (!formula.empty()) {
+        formula.push_back(',');
+      }
+      formula.append(qualifier);
+      formula.append(absolutise_a1_token(cols));
+    }
+  }
+  auto result = wb->workbook().set_defined_name_scoped(std::string(kPrintTitlesName), std::move(formula),
+                                                       static_cast<std::int32_t>(sheet_index));
+  if (!result) {
+    return set_last_error(result.error());
+  }
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_get_print_titles(const fm_workbook_t* wb, size_t sheet_index,
+                                                 const char** out_repeat_rows, const char** out_repeat_cols) {
+  static constexpr const char* kFn = "fm_sheet_get_print_titles";
+  clear_last_error();
+  if (out_repeat_rows == nullptr || out_repeat_cols == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, kFn,
+                             "arg=out_repeat_rows|out_repeat_cols");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, kFn); rc != 0) {
+    return rc;
+  }
+  auto titles = formulon::print::resolve_print_titles(wb->workbook(), static_cast<std::uint32_t>(sheet_index));
+  if (!titles) {
+    return set_last_error(titles.error());
+  }
+  std::string rows;
+  if (titles.value().repeat_rows.has_value()) {
+    const auto& span = *titles.value().repeat_rows;
+    rows.append(std::to_string(static_cast<std::uint64_t>(span.first) + 1U));
+    rows.push_back(':');
+    rows.append(std::to_string(static_cast<std::uint64_t>(span.second) + 1U));
+  }
+  std::string cols;
+  if (titles.value().repeat_cols.has_value()) {
+    const auto& span = *titles.value().repeat_cols;
+    formulon::a1::append_column_letters(cols, span.first);
+    cols.push_back(':');
+    formulon::a1::append_column_letters(cols, span.second);
+  }
+  // Both pointers are handed out from one refresh: clearing between the two
+  // pushes would dangle the first.
+  fm_workbook_t* mutable_wb = const_cast<fm_workbook_t*>(wb);
+  mutable_wb->read_scratch.clear();
+  mutable_wb->read_scratch.emplace_back(std::move(rows));
+  *out_repeat_rows = mutable_wb->read_scratch.back().c_str();
+  mutable_wb->read_scratch.emplace_back(std::move(cols));
+  *out_repeat_cols = mutable_wb->read_scratch.back().c_str();
+  return 0;
+}
diff --git a/src/c_api/parts/print_settings.cpp b/src/c_api/parts/print_settings.cpp
index 12f86ca93..1e451e464 100644
--- a/src/c_api/parts/print_settings.cpp
+++ b/src/c_api/parts/print_settings.cpp
@@ -23,7 +23,7 @@
 // (`io/ooxml/print_settings_parse.h`). That is what makes "set it, then
 // paginate" observe the new setting instead of the loaded one.
 //
-// @size-budget: 17 KB
+// @size-budget: 12 KB
 
 #include <algorithm>
 #include <cmath>
@@ -38,12 +38,8 @@
 #include "c_api/parts/xml_fragment.h"
 #include "io/ooxml/print_settings_parse.h"
 #include "io/xml_utils.h"
-#include "parser/reference.h"
-#include "print/print_area.h"
 #include "pugixml.hpp"
 #include "sheet.h"
-#include "utils/a1_column.h"
-#include "utils/a1_ref.h"
 #include "utils/double_format.h"
 #include "utils/error.h"
 #include "utils/resource_budget.h"
@@ -54,7 +50,6 @@ using formulon::c_api::parts::clear_last_error;
 using formulon::c_api::parts::fragment_within_size_limit;
 using formulon::c_api::parts::FragmentValidation;
 using formulon::c_api::parts::set_binding_error;
-using formulon::c_api::parts::set_last_error;
 using formulon::c_api::parts::validate_single_element_fragment;
 
 namespace {
@@ -68,11 +63,6 @@ using formulon::SheetPrintSettings;
 using formulon::io::raw_xml;
 using formulon::io::ooxml::refresh_structured_views;
 
-// OOXML built-in defined names for the two print settings Excel stores
-// outside the worksheet part.
-constexpr std::string_view kPrintAreaName = "_xlnm.Print_Area";
-constexpr std::string_view kPrintTitlesName = "_xlnm.Print_Titles";
-
 // `<pageSetup scale>` is a percentage Excel accepts only inside this band;
 // the UI spinner enforces the same range.
 constexpr std::uint32_t kMinPrintScalePercent = 10U;
@@ -229,143 +219,6 @@ void set_header_footer_section(pugi::xml_node root, std::size_t section_index, s
   node.text().set(std::string(text).c_str());
 }
 
-/// Returns the sheet-qualified prefix (`Sheet1!` / `'集計 2026'!`) for a
-/// defined-name formula, quoting per Excel's rules.
-std::string sheet_qualifier(std::string_view sheet_name) {
-  std::string out;
-  if (!formulon::parser::sheet_name_needs_quoting(sheet_name)) {
-    out.append(sheet_name);
-    out.push_back('!');
-    return out;
-  }
-  out.push_back('\'');
-  for (const char c : sheet_name) {
-    if (c == '\'') {
-      out.push_back('\'');
-    }
-    out.push_back(c);
-  }
-  out.append("'!");
-  return out;
-}
-
-/// Rewrites one A1 token with every column and row anchored.
-///
-/// Works on the authored text rather than a parsed rectangle so a
-/// whole-axis area keeps its shape: `A:D` becomes `$A:$D`, not the
-/// `$A$1:$D$1048576` a round trip through `CellRange` would produce.
-/// Existing anchors are not doubled.
-std::string absolutise_a1_token(std::string_view token) {
-  // A run is a maximal stretch of one character class. `A1` is two runs
-  // (the column and the row), each needing its own anchor; `AB` and `12`
-  // are one run each.
-  enum class Run { kNone, kLetters, kDigits };
-
-  std::string out;
-  out.reserve(token.size() + 4U);
-  Run run = Run::kNone;
-  bool anchor_pending = false;
-  for (const char chr : token) {
-    if (chr == '$') {
-      anchor_pending = true;
-      run = Run::kNone;
-      out.push_back(chr);
-      continue;
-    }
-    Run kind = Run::kNone;
-    if ((chr >= 'A' && chr <= 'Z') || (chr >= 'a' && chr <= 'z')) {
-      kind = Run::kLetters;
-    } else if (chr >= '0' && chr <= '9') {
-      kind = Run::kDigits;
-    }
-    if (kind == Run::kNone) {
-      run = Run::kNone;
-      anchor_pending = false;
-      out.push_back(chr);
-      continue;
-    }
-    if (kind != run) {
-      if (!anchor_pending) {
-        out.push_back('$');
-      }
-      run = kind;
-    }
-    anchor_pending = false;
-    out.push_back(chr);
-  }
-  return out;
-}
-
-/// Splits `text` on commas, trimming ASCII whitespace around each token.
-/// The caller-facing range syntax is unqualified, so no sheet name (and
-/// therefore no quoted comma) can appear.
-std::vector<std::string_view> split_areas(std::string_view text) {
-  std::vector<std::string_view> out;
-  std::size_t start = 0;
-  while (start <= text.size()) {
-    std::size_t comma = text.find(',', start);
-    if (comma == std::string_view::npos) {
-      comma = text.size();
-    }
-    std::string_view token = text.substr(start, comma - start);
-    while (!token.empty() && (token.front() == ' ' || token.front() == '\t')) {
-      token.remove_prefix(1);
-    }
-    while (!token.empty() && (token.back() == ' ' || token.back() == '\t')) {
-      token.remove_suffix(1);
-    }
-    out.push_back(token);
-    start = comma + 1;
-  }
-  return out;
-}
-
-/// Renders a resolved rectangle as an unqualified, anchor-free A1 range.
-std::string format_range(const formulon::print::CellRange& range) {
-  std::string out;
-  formulon::a1::append_column_letters(out, range.first_col);
-  out.append(std::to_string(static_cast<std::uint64_t>(range.first_row) + 1U));
-  out.push_back(':');
-  formulon::a1::append_column_letters(out, range.last_col);
-  out.append(std::to_string(static_cast<std::uint64_t>(range.last_row) + 1U));
-  return out;
-}
-
-/// True when `token` is a whole-row span (`1:2`), writing the 1-based
-/// endpoints back out.
-bool parse_row_span(std::string_view token, std::uint32_t* first, std::uint32_t* last) {
-  const std::size_t colon = token.find(':');
-  if (colon == std::string_view::npos) {
-    return false;
-  }
-  const auto to_row = [](std::string_view part, std::uint32_t* out) {
-    std::size_t pos = 0;
-    if (!part.empty() && part.front() == '$') {
-      part.remove_prefix(1);
-    }
-    return formulon::a1::parse_uint(part, &pos, out) && pos == part.size() && *out >= 1U && *out <= Sheet::kMaxRows;
-  };
-  return to_row(token.substr(0, colon), first) && to_row(token.substr(colon + 1), last);
-}
-
-/// True when `token` is a whole-column span (`A:A`), writing the 1-based
-/// endpoints back out.
-bool parse_col_span(std::string_view token, std::uint32_t* first, std::uint32_t* last) {
-  const std::size_t colon = token.find(':');
-  if (colon == std::string_view::npos) {
-    return false;
-  }
-  const auto to_col = [](std::string_view part, std::uint32_t* out) {
-    std::size_t pos = 0;
-    if (!part.empty() && part.front() == '$') {
-      part.remove_prefix(1);
-    }
-    return formulon::a1::parse_column_letters(part, &pos, out) && pos == part.size() && *out >= 1U &&
-           *out <= Sheet::kMaxCols;
-  };
-  return to_col(token.substr(0, colon), first) && to_col(token.substr(colon + 1), last);
-}
-
 /// Upserts a manual break into an axis vector, keeping it sorted by index.
 fm_status_t upsert_break(std::vector<ManualBreak>& breaks, std::uint32_t index, std::uint32_t span_max, bool manual,
                          const char* fn) {
@@ -535,164 +388,6 @@ extern "C" fm_status_t fm_sheet_set_fit_to_page(fm_workbook_t* wb, size_t sheet_
   return 0;
 }
 
-/* -------------------------------------------------------------------------- */
-/* Print area and titles                                                      */
-/* -------------------------------------------------------------------------- */
-
-extern "C" fm_status_t fm_sheet_set_print_area(fm_workbook_t* wb, size_t sheet_index, const char* ranges_a1) {
-  static constexpr const char* kFn = "fm_sheet_set_print_area";
-  clear_last_error();
-  if (ranges_a1 == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, kFn, "arg=ranges_a1");
-  }
-  if (auto rc = check_sheet_index(wb, sheet_index, kFn); rc != 0) {
-    return rc;
-  }
-  const std::string_view input(ranges_a1);
-  std::string formula;
-  if (!input.empty()) {
-    const std::string qualifier = sheet_qualifier(wb->workbook().sheet(sheet_index).name());
-    const std::vector<std::string_view> tokens = split_areas(input);
-    if (!formulon::c_api::parts::check_range_count(static_cast<std::uint32_t>(tokens.size()), kFn)) {
-      return static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-    }
-    for (const std::string_view token : tokens) {
-      // Round-trip the token through the resolver's own grammar so a
-      // malformed area is rejected here rather than surfacing later as a
-      // `kPrintInvalidArea` from `resolve_print_area`.
-      formulon::print::CellRange probe;
-      if (token.empty() || !formulon::print::parse_area_token(token, &probe)) {
-        return set_binding_error(formulon::FormulonErrorCode::kPrintInvalidArea, kFn, "token=" + std::string(token));
-      }
-      if (!formula.empty()) {
-        formula.push_back(',');
-      }
-      formula.append(qualifier);
-      formula.append(absolutise_a1_token(token));
-    }
-  }
-  auto result = wb->workbook().set_defined_name_scoped(std::string(kPrintAreaName), std::move(formula),
-                                                       static_cast<std::int32_t>(sheet_index));
-  if (!result) {
-    return set_last_error(result.error());
-  }
-  return 0;
-}
-
-extern "C" fm_status_t fm_sheet_get_print_area(const fm_workbook_t* wb, size_t sheet_index,
-                                               const char** out_ranges_a1) {
-  static constexpr const char* kFn = "fm_sheet_get_print_area";
-  clear_last_error();
-  if (out_ranges_a1 == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, kFn, "arg=out_ranges_a1");
-  }
-  if (auto rc = check_sheet_index(wb, sheet_index, kFn); rc != 0) {
-    return rc;
-  }
-  auto areas = formulon::print::resolve_print_area(wb->workbook(), static_cast<std::uint32_t>(sheet_index));
-  if (!areas) {
-    return set_last_error(areas.error());
-  }
-  std::string rendered;
-  for (const formulon::print::CellRange& range : areas.value()) {
-    if (!rendered.empty()) {
-      rendered.push_back(',');
-    }
-    rendered.append(format_range(range));
-  }
-  fm_workbook_t* mutable_wb = const_cast<fm_workbook_t*>(wb);
-  mutable_wb->read_scratch.clear();
-  mutable_wb->read_scratch.emplace_back(std::move(rendered));
-  *out_ranges_a1 = mutable_wb->read_scratch.back().c_str();
-  return 0;
-}
-
-extern "C" fm_status_t fm_sheet_set_print_titles(fm_workbook_t* wb, size_t sheet_index, const char* repeat_rows,
-                                                 const char* repeat_cols) {
-  static constexpr const char* kFn = "fm_sheet_set_print_titles";
-  clear_last_error();
-  if (auto rc = check_sheet_index(wb, sheet_index, kFn); rc != 0) {
-    return rc;
-  }
-  const std::string_view rows(repeat_rows == nullptr ? "" : repeat_rows);
-  const std::string_view cols(repeat_cols == nullptr ? "" : repeat_cols);
-  std::string formula;
-  if (!rows.empty() || !cols.empty()) {
-    const std::string qualifier = sheet_qualifier(wb->workbook().sheet(sheet_index).name());
-    // Excel lists rows before columns; the resolver accepts either order,
-    // but matching Excel keeps a diffed worksheet quiet.
-    if (!rows.empty()) {
-      std::uint32_t first = 0;
-      std::uint32_t last = 0;
-      if (!parse_row_span(rows, &first, &last)) {
-        return set_binding_error(formulon::FormulonErrorCode::kPrintInvalidArea, kFn,
-                                 "repeat_rows=" + std::string(rows));
-      }
-      formula.append(qualifier);
-      formula.append(absolutise_a1_token(rows));
-    }
-    if (!cols.empty()) {
-      std::uint32_t first = 0;
-      std::uint32_t last = 0;
-      if (!parse_col_span(cols, &first, &last)) {
-        return set_binding_error(formulon::FormulonErrorCode::kPrintInvalidArea, kFn,
-                                 "repeat_cols=" + std::string(cols));
-      }
-      if (!formula.empty()) {
-        formula.push_back(',');
-      }
-      formula.append(qualifier);
-      formula.append(absolutise_a1_token(cols));
-    }
-  }
-  auto result = wb->workbook().set_defined_name_scoped(std::string(kPrintTitlesName), std::move(formula),
-                                                       static_cast<std::int32_t>(sheet_index));
-  if (!result) {
-    return set_last_error(result.error());
-  }
-  return 0;
-}
-
-extern "C" fm_status_t fm_sheet_get_print_titles(const fm_workbook_t* wb, size_t sheet_index,
-                                                 const char** out_repeat_rows, const char** out_repeat_cols) {
-  static constexpr const char* kFn = "fm_sheet_get_print_titles";
-  clear_last_error();
-  if (out_repeat_rows == nullptr || out_repeat_cols == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, kFn,
-                             "arg=out_repeat_rows|out_repeat_cols");
-  }
-  if (auto rc = check_sheet_index(wb, sheet_index, kFn); rc != 0) {
-    return rc;
-  }
-  auto titles = formulon::print::resolve_print_titles(wb->workbook(), static_cast<std::uint32_t>(sheet_index));
-  if (!titles) {
-    return set_last_error(titles.error());
-  }
-  std::string rows;
-  if (titles.value().repeat_rows.has_value()) {
-    const auto& span = *titles.value().repeat_rows;
-    rows.append(std::to_string(static_cast<std::uint64_t>(span.first) + 1U));
-    rows.push_back(':');
-    rows.append(std::to_string(static_cast<std::uint64_t>(span.second) + 1U));
-  }
-  std::string cols;
-  if (titles.value().repeat_cols.has_value()) {
-    const auto& span = *titles.value().repeat_cols;
-    formulon::a1::append_column_letters(cols, span.first);
-    cols.push_back(':');
-    formulon::a1::append_column_letters(cols, span.second);
-  }
-  // Both pointers are handed out from one refresh: clearing between the two
-  // pushes would dangle the first.
-  fm_workbook_t* mutable_wb = const_cast<fm_workbook_t*>(wb);
-  mutable_wb->read_scratch.clear();
-  mutable_wb->read_scratch.emplace_back(std::move(rows));
-  *out_repeat_rows = mutable_wb->read_scratch.back().c_str();
-  mutable_wb->read_scratch.emplace_back(std::move(cols));
-  *out_repeat_cols = mutable_wb->read_scratch.back().c_str();
-  return 0;
-}
-
 /* -------------------------------------------------------------------------- */
 /* Manual page breaks                                                         */
 /* -------------------------------------------------------------------------- */
diff --git a/src/c_api/parts/sheet_layout.cpp b/src/c_api/parts/sheet_layout.cpp
index bad143563..baa8448ad 100644
--- a/src/c_api/parts/sheet_layout.cpp
+++ b/src/c_api/parts/sheet_layout.cpp
@@ -18,18 +18,23 @@
 #include "c_api/formulon_c.h"
 #include "c_api/parts/common.h"
 #include "c_api/parts/xml_fragment.h"
+#include "io/auto_filter_xml.h"
+#include "print/sheet_geometry.h"
 #include "sheet.h"
 #include "utils/error.h"
 #include "utils/index_sort.h"
 #include "workbook.h"
 
 using formulon::c_api::parts::check_column_span;
+using formulon::c_api::parts::check_enum_domain;
 using formulon::c_api::parts::check_finite_non_negative;
 using formulon::c_api::parts::check_row_index;
 using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::check_sheet_rect;
 using formulon::c_api::parts::clear_last_error;
 using formulon::c_api::parts::FragmentValidation;
 using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::set_last_error;
 using formulon::c_api::parts::validate_single_element_fragment;
 
 namespace {
@@ -233,6 +238,8 @@ extern "C" fm_status_t fm_sheet_get_row_override(const fm_workbook_t* wb, size_t
   out->outline_level = rows[idx].outline_level;
   out->has_style = rows[idx].has_style ? 1 : 0;
   out->style_xf = rows[idx].style_xf;
+  out->has_height = rows[idx].has_height ? 1 : 0;
+  out->custom_height = rows[idx].custom_height ? 1 : 0;
   return 0;
 }
 
@@ -298,6 +305,7 @@ extern "C" fm_status_t fm_sheet_set_row_height(fm_workbook_t* wb, size_t sheet_i
   formulon::RowLayout* entry = upsert_row_override(wb->workbook().sheet(sheet_index).mutable_layout(), row);
   entry->height = height;
   entry->has_height = true;
+  entry->custom_height = true;
   return 0;
 }
 
@@ -336,6 +344,30 @@ extern "C" fm_status_t fm_sheet_set_row_outline(fm_workbook_t* wb, size_t sheet_
   return 0;
 }
 
+extern "C" fm_status_t fm_sheet_clear_row_height(fm_workbook_t* wb, size_t sheet_index, uint32_t row) {
+  clear_last_error();
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_clear_row_height"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_row_index(row, "fm_sheet_clear_row_height"); rc != 0) {
+    return rc;
+  }
+  auto& overrides = wb->workbook().sheet(sheet_index).mutable_layout().row_overrides;
+  for (auto it = overrides.begin(); it != overrides.end(); ++it) {
+    if (it->row != row) {
+      continue;
+    }
+    it->height = 0.0;
+    it->has_height = false;
+    it->custom_height = false;
+    if (!it->hidden && it->outline_level == 0U && !it->has_style) {
+      overrides.erase(it);
+    }
+    break;
+  }
+  return 0;
+}
+
 extern "C" fm_status_t fm_sheet_set_zoom(fm_workbook_t* wb, size_t sheet_index, uint32_t zoom_scale) {
   clear_last_error();
   if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_set_zoom"); rc != 0) {
@@ -436,7 +468,7 @@ extern "C" fm_status_t fm_sheet_get_auto_filter_xml(const fm_workbook_t* wb, siz
   }
   fm_workbook_t* mutable_wb = const_cast<fm_workbook_t*>(wb);
   mutable_wb->read_scratch.clear();
-  mutable_wb->read_scratch.emplace_back(wb->workbook().sheet(sheet_index).auto_filter_xml());
+  mutable_wb->read_scratch.emplace_back(formulon::io::auto_filter_xml(wb->workbook().sheet(sheet_index).auto_filter()));
   *out_xml = mutable_wb->read_scratch.back().c_str();
   return 0;
 }
@@ -458,7 +490,11 @@ extern "C" fm_status_t fm_sheet_set_auto_filter_xml(fm_workbook_t* wb, size_t sh
                                "fm_sheet_set_auto_filter_xml: invalid autoFilter XML fragment", validation.context);
     }
   }
-  wb->workbook().sheet(sheet_index).set_auto_filter_xml(fragment);
+  // Routed through the workbook so `_FilterDatabase` and SUBTOTAL/AGGREGATE
+  // dirty state follow the change.
+  if (auto result = wb->workbook().set_sheet_auto_filter_xml(sheet_index, fragment); !result) {
+    return set_last_error(result.error());
+  }
   return 0;
 }
 
@@ -518,3 +554,195 @@ extern "C" fm_status_t fm_sheet_set_view_mode(fm_workbook_t* wb, size_t sheet_in
   wb->workbook().sheet(sheet_index).mutable_view().view_mode = mode;
   return 0;
 }
+
+extern "C" fm_status_t fm_sheet_get_format_defaults(const fm_workbook_t* wb, size_t sheet_index,
+                                                    fm_sheet_format_defaults* out) {
+  clear_last_error();
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_get_format_defaults: NULL argument");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_get_format_defaults"); rc != 0) {
+    return rc;
+  }
+  const formulon::SheetFormatDefaults& defaults = wb->workbook().sheet(sheet_index).format_defaults();
+  *out = fm_sheet_format_defaults{};
+  out->default_col_width = defaults.default_col_width;
+  out->default_row_height = defaults.default_row_height;
+  out->base_col_width = defaults.base_col_width;
+  out->has_default_col_width = defaults.has_default_col_width ? 1 : 0;
+  out->has_default_row_height = defaults.has_default_row_height ? 1 : 0;
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_set_format_defaults(fm_workbook_t* wb, size_t sheet_index,
+                                                    const fm_sheet_format_defaults* defaults) {
+  clear_last_error();
+  if (defaults == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_set_format_defaults: NULL argument");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_set_format_defaults"); rc != 0) {
+    return rc;
+  }
+  constexpr const char* kApi = "fm_sheet_set_format_defaults";
+  const bool has_col_width = defaults->has_default_col_width != 0;
+  const bool has_row_height = defaults->has_default_row_height != 0;
+  if (has_col_width) {
+    if (auto rc = check_finite_non_negative(defaults->default_col_width, kApi, "default_col_width"); rc != 0) {
+      return rc;
+    }
+  }
+  if (has_row_height) {
+    if (auto rc = check_finite_non_negative(defaults->default_row_height, kApi, "default_row_height"); rc != 0) {
+      return rc;
+    }
+  }
+  if (auto rc = check_finite_non_negative(defaults->base_col_width, kApi, "base_col_width"); rc != 0) {
+    return rc;
+  }
+  formulon::SheetFormatDefaults& target = wb->workbook().sheet(sheet_index).mutable_format_defaults();
+  target.default_col_width = has_col_width ? defaults->default_col_width : 0.0;
+  target.default_row_height = has_row_height ? defaults->default_row_height : 0.0;
+  target.base_col_width = defaults->base_col_width;
+  target.has_default_col_width = has_col_width;
+  target.has_default_row_height = has_row_height;
+  return 0;
+}
+
+namespace {
+
+// Validates the shared `(sheet, mode)` prefix of the geometry entry points.
+fm_status_t check_geometry_args(const fm_workbook_t* wb, size_t sheet_index, int32_t mode, const char* api) {
+  if (auto rc = check_sheet_index(wb, sheet_index, api); rc != 0) {
+    return rc;
+  }
+  return check_enum_domain(mode, FM_GEOMETRY_PRINT, api, "mode");
+}
+
+formulon::print::ColumnWidthModel width_model_for(const fm_workbook_t* wb, int32_t mode) {
+  return formulon::print::resolve_column_width_model(wb->workbook().styles(),
+                                                     static_cast<formulon::print::GeometryMode>(mode));
+}
+
+}  // namespace
+
+extern "C" fm_status_t fm_sheet_cell_rect_pt(const fm_workbook_t* wb, size_t sheet_index, uint32_t first_row,
+                                             uint32_t first_col, uint32_t last_row, uint32_t last_col, int32_t mode,
+                                             fm_rect_pt* out) {
+  clear_last_error();
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_sheet_cell_rect_pt: NULL argument");
+  }
+  if (auto rc = check_geometry_args(wb, sheet_index, mode, "fm_sheet_cell_rect_pt"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_sheet_rect(first_row, first_col, last_row, last_col, "fm_sheet_cell_rect_pt"); rc != 0) {
+    return rc;
+  }
+  const formulon::Sheet& sheet = wb->workbook().sheet(sheet_index);
+  const formulon::print::ColumnWidthModel model = width_model_for(wb, mode);
+  double width = 0.0;
+  for (const double chars : formulon::print::column_widths_chars(sheet, first_col, last_col)) {
+    width += formulon::print::column_chars_to_points(chars, model);
+  }
+  const double y = formulon::print::row_offset_pt(sheet, first_row);
+  *out = fm_rect_pt{};
+  out->x = formulon::print::column_offset_pt(sheet, first_col, model);
+  out->y = y;
+  out->width = width;
+  out->height = first_row == last_row ? formulon::print::effective_row_height_pt(sheet, first_row)
+                                      : formulon::print::row_offset_pt(sheet, last_row + 1U) - y;
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_column_width_pt(const fm_workbook_t* wb, size_t sheet_index, uint32_t col, int32_t mode,
+                                                double* out_pt) {
+  clear_last_error();
+  if (out_pt == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_column_width_pt: NULL argument");
+  }
+  if (auto rc = check_geometry_args(wb, sheet_index, mode, "fm_sheet_column_width_pt"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_column_span(col, col, "fm_sheet_column_width_pt"); rc != 0) {
+    return rc;
+  }
+  *out_pt =
+      formulon::print::effective_column_width_pt(wb->workbook().sheet(sheet_index), col, width_model_for(wb, mode));
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_row_height_pt(const fm_workbook_t* wb, size_t sheet_index, uint32_t row,
+                                              double* out_pt) {
+  clear_last_error();
+  if (out_pt == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_sheet_row_height_pt: NULL argument");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_row_height_pt"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_row_index(row, "fm_sheet_row_height_pt"); rc != 0) {
+    return rc;
+  }
+  *out_pt = formulon::print::effective_row_height_pt(wb->workbook().sheet(sheet_index), row);
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_width_model(const fm_workbook_t* wb, size_t sheet_index, int32_t mode,
+                                            fm_width_model* out) {
+  clear_last_error();
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_sheet_width_model: NULL argument");
+  }
+  if (auto rc = check_geometry_args(wb, sheet_index, mode, "fm_sheet_width_model"); rc != 0) {
+    return rc;
+  }
+  const formulon::print::ColumnWidthModel model = width_model_for(wb, mode);
+  fm_workbook_t* mutable_wb = const_cast<fm_workbook_t*>(wb);
+  mutable_wb->read_scratch.clear();
+  mutable_wb->read_scratch.emplace_back(model.normal_font_name);
+  *out = fm_width_model{};
+  out->points_per_char = model.points_per_char;
+  out->padding_pt = model.padding_pt;
+  out->normal_font_size = model.normal_font_size;
+  out->calibrated = model.calibrated ? 1 : 0;
+  out->normal_font_name = mutable_wb->read_scratch.back().c_str();
+  out->platform = model.platform;
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_column_chars_to_pt(const fm_workbook_t* wb, size_t sheet_index, int32_t mode,
+                                                   double chars, double* out_pt) {
+  clear_last_error();
+  if (out_pt == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_column_chars_to_pt: NULL argument");
+  }
+  if (auto rc = check_geometry_args(wb, sheet_index, mode, "fm_sheet_column_chars_to_pt"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_finite_non_negative(chars, "fm_sheet_column_chars_to_pt", "chars"); rc != 0) {
+    return rc;
+  }
+  *out_pt = formulon::print::column_chars_to_points(chars, width_model_for(wb, mode));
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_column_pt_to_chars(const fm_workbook_t* wb, size_t sheet_index, int32_t mode, double pt,
+                                                   double* out_chars) {
+  clear_last_error();
+  if (out_chars == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_column_pt_to_chars: NULL argument");
+  }
+  if (auto rc = check_geometry_args(wb, sheet_index, mode, "fm_sheet_column_pt_to_chars"); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_finite_non_negative(pt, "fm_sheet_column_pt_to_chars", "pt"); rc != 0) {
+    return rc;
+  }
+  *out_chars = formulon::print::column_points_to_chars(pt, width_model_for(wb, mode));
+  return 0;
+}
diff --git a/src/c_api/parts/sheets_ui.cpp b/src/c_api/parts/sheets_ui.cpp
index 6f8ab67a8..f7db2d383 100644
--- a/src/c_api/parts/sheets_ui.cpp
+++ b/src/c_api/parts/sheets_ui.cpp
@@ -11,6 +11,7 @@
 #include "c_api/formulon_c.h"
 #include "c_api/parts/common.h"
 #include "sheet.h"
+#include "threaded_comment.h"
 #include "utils/error.h"
 #include "workbook.h"
 
@@ -30,6 +31,17 @@ fm_status_t check_sheet_coord(std::uint32_t row, std::uint32_t col, const char*
                            "row=" + std::to_string(row) + " col=" + std::to_string(col));
 }
 
+// Orders the corners so first <= last componentwise; mirrors the reader's
+// behaviour and keeps downstream consumers simple.
+formulon::MergeRange normalized_merge(const fm_merge_range& r) {
+  formulon::MergeRange m;
+  m.first_row = (r.first_row < r.last_row) ? r.first_row : r.last_row;
+  m.first_col = (r.first_col < r.last_col) ? r.first_col : r.last_col;
+  m.last_row = (r.first_row < r.last_row) ? r.last_row : r.first_row;
+  m.last_col = (r.first_col < r.last_col) ? r.last_col : r.first_col;
+  return m;
+}
+
 }  // namespace
 
 // ---------------------------------------------------------------------------
@@ -145,13 +157,7 @@ extern "C" fm_status_t fm_sheet_add_merge(fm_workbook_t* wb, std::uint32_t sheet
   if (auto rc = check_sheet_u32(wb, sheet, "fm_sheet_add_merge"); rc != 0) {
     return rc;
   }
-  // Normalise corners so first <= last componentwise; mirrors the
-  // reader's behaviour and keeps downstream consumers simple.
-  formulon::MergeRange m;
-  m.first_row = (merge.first_row < merge.last_row) ? merge.first_row : merge.last_row;
-  m.first_col = (merge.first_col < merge.last_col) ? merge.first_col : merge.last_col;
-  m.last_row = (merge.first_row < merge.last_row) ? merge.last_row : merge.first_row;
-  m.last_col = (merge.first_col < merge.last_col) ? merge.last_col : merge.first_col;
+  const formulon::MergeRange m = normalized_merge(merge);
   if (auto rc = check_sheet_rect(m.first_row, m.first_col, m.last_row, m.last_col, "fm_sheet_add_merge"); rc != 0) {
     return rc;
   }
@@ -167,12 +173,7 @@ extern "C" fm_status_t fm_sheet_remove_merge(fm_workbook_t* wb, std::uint32_t sh
   if (auto rc = check_sheet_u32(wb, sheet, "fm_sheet_remove_merge"); rc != 0) {
     return rc;
   }
-  // Normalise corners so first <= last componentwise; mirrors fm_sheet_add_merge.
-  formulon::MergeRange q;
-  q.first_row = (range.first_row < range.last_row) ? range.first_row : range.last_row;
-  q.first_col = (range.first_col < range.last_col) ? range.first_col : range.last_col;
-  q.last_row = (range.first_row < range.last_row) ? range.last_row : range.first_row;
-  q.last_col = (range.first_col < range.last_col) ? range.last_col : range.first_col;
+  const formulon::MergeRange q = normalized_merge(range);
   const auto result = wb->workbook().remove_merges_intersecting(sheet, q);
   if (!result) {
     return formulon::c_api::parts::set_last_error(result.error());
@@ -239,6 +240,34 @@ extern "C" fm_status_t fm_sheet_get_merge_count(fm_workbook_t* wb, std::uint32_t
   return 0;
 }
 
+extern "C" fm_status_t fm_sheet_merges_in_range(fm_workbook_t* wb, std::uint32_t sheet, fm_merge_range range,
+                                                fm_merge_range* out, std::uint32_t capacity, std::uint32_t* out_count) {
+  clear_last_error();
+  if (out_count == nullptr || (out == nullptr && capacity > 0U)) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_merges_in_range: NULL argument");
+  }
+  if (auto rc = check_sheet_u32(wb, sheet, "fm_sheet_merges_in_range"); rc != 0) {
+    return rc;
+  }
+  const std::uint32_t first_row = std::min(range.first_row, range.last_row);
+  const std::uint32_t last_row = std::max(range.first_row, range.last_row);
+  const std::uint32_t first_col = std::min(range.first_col, range.last_col);
+  const std::uint32_t last_col = std::max(range.first_col, range.last_col);
+  std::uint32_t count = 0;
+  for (const formulon::MergeRange& m : wb->workbook().sheet(sheet).merges()) {
+    if (m.last_row < first_row || m.first_row > last_row || m.last_col < first_col || m.first_col > last_col) {
+      continue;
+    }
+    if (count < capacity) {
+      out[count] = fm_merge_range{m.first_row, m.first_col, m.last_row, m.last_col};
+    }
+    ++count;
+  }
+  *out_count = count;
+  return 0;
+}
+
 // ---------------------------------------------------------------------------
 // Comments
 // ---------------------------------------------------------------------------
@@ -328,12 +357,21 @@ extern "C" fm_status_t fm_sheet_set_comment(fm_workbook_t* wb, std::uint32_t she
     }
     return 0;
   }
+  // A cell holds a note or a threaded comment, never both.
+  for (const formulon::ThreadedComment& thread : wb->workbook().sheet(sheet).threaded_comments()) {
+    if (thread.parent_id.empty() && thread.row == row && thread.col == col) {
+      return formulon::c_api::parts::set_last_error(
+          formulon::make_error(formulon::FormulonErrorCode::kThreadedCommentInvalid,
+                               "fm_sheet_set_comment: cell already has a threaded comment", thread.id));
+    }
+  }
   formulon::CellComment c;
   c.row = row;
   c.col = col;
   c.author = (author != nullptr) ? std::string(author) : std::string();
   c.text = std::string(text);
   if (found < list.size()) {
+    c.uid = std::move(list[found].uid);
     list[found] = std::move(c);
   } else {
     list.push_back(std::move(c));
diff --git a/src/c_api/parts/styles.cpp b/src/c_api/parts/styles.cpp
index 21a0e898f..782d49383 100644
--- a/src/c_api/parts/styles.cpp
+++ b/src/c_api/parts/styles.cpp
@@ -1,62 +1,33 @@
 //
 // C ABI - styles surface (cell xf bindings, fonts, fills, borders, num
-// formats, cell styles, dedup-on-insert helpers).
+// formats, cell styles). The mutation side lives in styles_mutate.cpp.
 
 #include "styles.h"
 
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
-#include <limits>
 #include <optional>
 #include <string>
 #include <string_view>
-#include <type_traits>
-#include <unordered_map>
 #include <utility>
-#include <vector>
 
 #include "c_api/formulon_c.h"
 #include "c_api/parts/common.h"
 #include "cell.h"
-#include "io/styles_writer.h"
 #include "sheet.h"
 #include "utils/error.h"
 #include "utils/resource_budget.h"
 #include "workbook.h"
 
+using formulon::effective_num_fmt;
 using formulon::c_api::parts::check_sheet_u32;
 using formulon::c_api::parts::clear_last_error;
-using formulon::c_api::parts::num_fmt_id_known;
 using formulon::c_api::parts::set_binding_error;
 using formulon::c_api::parts::set_last_error;
 
 namespace {
 
-static_assert(std::is_nothrow_move_constructible_v<formulon::StylesTable>,
-              "StylesTable must be nothrow-move-constructible for staged style commits");
-static_assert(std::is_nothrow_move_assignable_v<formulon::StylesTable>,
-              "StylesTable must be nothrow-move-assignable for staged style commits");
-
-/// Resolves a number-format id using the effective OOXML mapping. A valid
-/// custom record wins over the built-in slot, and duplicate ids resolve to
-/// the first valid custom record in document order. `std::nullopt` means that
-/// neither a valid custom record nor a non-empty built-in format exists.
-std::optional<std::string_view> effective_num_fmt(const formulon::StylesTable& styles, std::uint16_t id) {
-  for (const formulon::NumFmtRecord& record : styles.num_fmts) {
-    if (record.id == id && record.format_string_index < styles.num_fmt_strings.size()) {
-      return styles.num_fmt_strings[record.format_string_index];
-    }
-  }
-  if (id < 164U) {
-    const char* builtin = formulon::builtin_num_fmt(id);
-    if (builtin != nullptr && builtin[0] != '\0') {
-      return std::string_view(builtin);
-    }
-  }
-  return std::nullopt;
-}
-
 /// Validates the `(handle, sheet_index, row, col)` quad and resolves
 /// the cell's `xf_index`. On failure populates the thread-local
 /// diagnostic and returns the status. On success writes
@@ -159,6 +130,17 @@ void cell_xf_to_c(const formulon::CellXf& xf, fm_cell_xf* out) {
   out->has_vertical_align = xf.has_vertical_align ? 1 : 0;
   out->has_wrap_text = xf.has_wrap_text ? 1 : 0;
   out->has_justify_last_line = xf.has_justify_last_line ? 1 : 0;
+  out->apply_number_format = xf.apply_number_format ? 1 : 0;
+  out->apply_font = xf.apply_font ? 1 : 0;
+  out->apply_fill = xf.apply_fill ? 1 : 0;
+  out->apply_border = xf.apply_border ? 1 : 0;
+  out->apply_alignment = xf.apply_alignment ? 1 : 0;
+  out->apply_protection = xf.apply_protection ? 1 : 0;
+  out->quote_prefix = xf.quote_prefix ? 1 : 0;
+  out->has_protection = xf.has_protection ? 1 : 0;
+  // Without a `<protection>` child the schema defaults are in effect.
+  out->locked = (!xf.has_protection || xf.locked) ? 1 : 0;
+  out->hidden = (xf.has_protection && xf.hidden) ? 1 : 0;
 }
 
 }  // namespace
@@ -408,774 +390,3 @@ extern "C" fm_status_t fm_styles_get_cell_style_xf(fm_workbook_t* wb, uint32_t i
   out->xf_id = 0;
   return 0;
 }
-
-namespace {
-
-/// Dedup identity for the font / fill / border tables.
-///
-/// `fm_styles_add_*` may only hand back an existing index when the styles
-/// writer cannot tell the stored record from the candidate, so identity is
-/// the XML fragment the writer emits for the record. Deriving the key from
-/// the writer rather than restating its rules here folds in every
-/// writer-visible field by construction — the presence flags, `<family>` /
-/// `<charset>`, and the round-trip colour specifications that a
-/// hand-written comparator kept missing — and keeps the linear-scan
-/// comparison below and the batch hash key from drifting apart, because
-/// they are the same function.
-std::string font_key(const formulon::FontRecord& value) {
-  return formulon::io::font_fragment(value);
-}
-
-std::string fill_key(const formulon::FillRecord& value) {
-  return formulon::io::fill_fragment(value);
-}
-
-std::string border_key(const formulon::BorderRecord& value) {
-  return formulon::io::border_fragment(value);
-}
-
-bool font_records_equal(const formulon::FontRecord& a, const formulon::FontRecord& b) {
-  return font_key(a) == font_key(b);
-}
-
-bool fill_records_equal(const formulon::FillRecord& a, const formulon::FillRecord& b) {
-  return fill_key(a) == fill_key(b);
-}
-
-bool border_records_equal(const formulon::BorderRecord& a, const formulon::BorderRecord& b) {
-  return border_key(a) == border_key(b);
-}
-
-template <typename T>
-void append_key_scalar(std::string& out, const T& value) {
-  out.append(reinterpret_cast<const char*>(&value), sizeof(value));
-}
-
-std::string cell_xf_key(const formulon::CellXf& value) {
-  std::string out;
-  append_key_scalar(out, value.font_index);
-  append_key_scalar(out, value.fill_index);
-  append_key_scalar(out, value.border_index);
-  append_key_scalar(out, value.num_fmt_id);
-  append_key_scalar(out, value.xf_id);
-  append_key_scalar(out, value.apply_number_format);
-  append_key_scalar(out, value.apply_font);
-  append_key_scalar(out, value.apply_fill);
-  append_key_scalar(out, value.apply_border);
-  append_key_scalar(out, value.apply_alignment);
-  append_key_scalar(out, value.apply_protection);
-  append_key_scalar(out, value.quote_prefix);
-  const bool has_alignment = formulon::HasAlignment(value);
-  append_key_scalar(out, has_alignment);
-  const bool has_horizontal_align = formulon::HasHorizontalAlign(value);
-  append_key_scalar(out, has_horizontal_align);
-  if (has_horizontal_align) {
-    append_key_scalar(out, value.horizontal_align);
-  }
-  const bool has_vertical_align = formulon::HasVerticalAlign(value);
-  append_key_scalar(out, has_vertical_align);
-  if (has_vertical_align) {
-    append_key_scalar(out, value.vertical_align);
-  }
-  const bool has_wrap_text = formulon::HasWrapText(value);
-  append_key_scalar(out, has_wrap_text);
-  if (has_wrap_text) {
-    append_key_scalar(out, value.wrap_text);
-  }
-  const bool has_justify_last_line = formulon::HasJustifyLastLine(value);
-  append_key_scalar(out, has_justify_last_line);
-  if (has_justify_last_line) {
-    append_key_scalar(out, value.justify_last_line);
-  }
-  append_key_scalar(out, value.has_text_rotation);
-  if (value.has_text_rotation) {
-    append_key_scalar(out, value.text_rotation);
-  }
-  append_key_scalar(out, value.has_indent);
-  if (value.has_indent) {
-    append_key_scalar(out, value.indent);
-  }
-  append_key_scalar(out, value.has_relative_indent);
-  if (value.has_relative_indent) {
-    append_key_scalar(out, value.relative_indent);
-  }
-  append_key_scalar(out, value.has_shrink_to_fit);
-  if (value.has_shrink_to_fit) {
-    append_key_scalar(out, value.shrink_to_fit);
-  }
-  append_key_scalar(out, value.has_reading_order);
-  if (value.has_reading_order) {
-    append_key_scalar(out, value.reading_order);
-  }
-  append_key_scalar(out, value.has_protection);
-  if (value.has_protection) {
-    append_key_scalar(out, value.locked);
-    append_key_scalar(out, value.hidden);
-  }
-  return out;
-}
-
-/// A dxf's engaged children are compared through the same writer-derived
-/// keys as the global tables, so a differential font that only differs in
-/// `<vertAlign>` or in an explicit `<b val="0"/>` is a distinct record.
-///
-bool dxf_records_equal(const formulon::DifferentialFormat& a, const formulon::DifferentialFormat& b) {
-  return a.has_font == b.has_font && (!a.has_font || font_records_equal(a.font, b.font)) && a.has_fill == b.has_fill &&
-         (!a.has_fill || fill_records_equal(a.fill, b.fill)) && a.has_border == b.has_border &&
-         (!a.has_border || border_records_equal(a.border, b.border)) && a.has_num_fmt == b.has_num_fmt &&
-         (!a.has_num_fmt || (a.num_fmt_id == b.num_fmt_id && a.num_fmt_code == b.num_fmt_code)) &&
-         a.alignment_xml == b.alignment_xml && a.protection_xml == b.protection_xml;
-}
-
-void ensure_default_style_roots(formulon::StylesTable& styles) {
-  if (styles.fonts.empty()) {
-    styles.fonts.emplace_back();
-  }
-  if (styles.fills.empty()) {
-    styles.fills.emplace_back();
-  }
-  if (styles.borders.empty()) {
-    styles.borders.emplace_back();
-  }
-}
-
-void ensure_default_cell_xf(formulon::StylesTable& styles) {
-  ensure_default_style_roots(styles);
-  if (styles.cell_xfs.empty()) {
-    styles.cell_xfs.emplace_back();
-  }
-}
-
-/// Rejects an `<xf>` whose font / fill / border / number-format reference
-/// points past the corresponding table. Auto-growing the parallel tables
-/// would hide the caller's ordering mistake and emit a dangling index that
-/// Excel reports as a repairable file.
-fm_status_t validate_xf_references(const formulon::StylesTable& styles, const fm_cell_xf& record, const char* api) {
-  auto reject = [api](const char* what, std::string context) {
-    const std::string message = std::string(api) + ": " + what;
-    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, message.c_str(), std::move(context));
-  };
-  if (record.font_index >= styles.fonts.size()) {
-    return reject("font_index out of range", "font_index=" + std::to_string(record.font_index) +
-                                                 " fonts_count=" + std::to_string(styles.fonts.size()));
-  }
-  if (record.fill_index >= styles.fills.size()) {
-    return reject("fill_index out of range", "fill_index=" + std::to_string(record.fill_index) +
-                                                 " fills_count=" + std::to_string(styles.fills.size()));
-  }
-  if (record.border_index >= styles.borders.size()) {
-    return reject("border_index out of range", "border_index=" + std::to_string(record.border_index) +
-                                                   " borders_count=" + std::to_string(styles.borders.size()));
-  }
-  if (!num_fmt_id_known(styles, record.num_fmt_id)) {
-    return reject("num_fmt_id not registered", "num_fmt_id=" + std::to_string(record.num_fmt_id));
-  }
-  return 0;
-}
-
-fm_status_t validate_xf_alignment(const fm_cell_xf& record, const char* api) {
-  auto reject = [api](const char* what, std::string context) {
-    const std::string message = std::string(api) + ": " + what;
-    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, message.c_str(), std::move(context));
-  };
-  // The presence flags are authoritative. Values for an omitted attribute
-  // are ignored, including malformed alignment enum ordinals. The accepted
-  // ordinals are the canonical writer mapping for the corresponding XML
-  // string enums (general..distributed and top..distributed).
-  if (record.has_horizontal_align != 0 && record.horizontal_align > 7U) {
-    return reject("horizontal_align out of range", "horizontal_align=" + std::to_string(record.horizontal_align));
-  }
-  if (record.has_vertical_align != 0 && record.vertical_align > 4U) {
-    return reject("vertical_align out of range", "vertical_align=" + std::to_string(record.vertical_align));
-  }
-  if (record.has_text_rotation != 0 && record.text_rotation > 180U && record.text_rotation != 255U) {
-    return reject("text_rotation out of range", "text_rotation=" + std::to_string(record.text_rotation));
-  }
-  if (record.has_indent != 0 && record.indent > 255U) {
-    return reject("indent out of range", "indent=" + std::to_string(record.indent));
-  }
-  if (record.has_reading_order != 0 && record.reading_order > 2U) {
-    return reject("reading_order out of range", "reading_order=" + std::to_string(record.reading_order));
-  }
-  return 0;
-}
-
-formulon::CellXf cell_xf_from_c(const fm_cell_xf& record, std::uint32_t xf_id) {
-  formulon::CellXf candidate;
-  candidate.font_index = record.font_index;
-  candidate.fill_index = record.fill_index;
-  candidate.border_index = record.border_index;
-  candidate.num_fmt_id = record.num_fmt_id;
-  candidate.xf_id = xf_id;
-
-  // The record carries explicit presence bits. Keep values for present
-  // attributes and canonicalize omitted ones so Has* does not infer a child
-  // from ignored poison values.
-  candidate.horizontal_align = record.has_horizontal_align != 0 ? record.horizontal_align : 0U;
-  candidate.vertical_align = record.has_vertical_align != 0 ? record.vertical_align : 2U;
-  candidate.wrap_text = record.has_wrap_text != 0 && record.wrap_text != 0;
-  candidate.justify_last_line = record.has_justify_last_line != 0 && record.justify_last_line != 0;
-  candidate.has_alignment = record.has_alignment != 0;
-  candidate.has_horizontal_align = record.has_horizontal_align != 0;
-  candidate.has_vertical_align = record.has_vertical_align != 0;
-  candidate.has_wrap_text = record.has_wrap_text != 0;
-  candidate.has_justify_last_line = record.has_justify_last_line != 0;
-
-  // These optional attributes retain their existing presence-plus-value
-  // contract; values are copied even when the corresponding bit is false.
-  candidate.has_text_rotation = record.has_text_rotation != 0;
-  candidate.text_rotation = record.text_rotation;
-  candidate.has_indent = record.has_indent != 0;
-  candidate.indent = record.indent;
-  candidate.has_relative_indent = record.has_relative_indent != 0;
-  candidate.relative_indent = record.relative_indent;
-  candidate.has_shrink_to_fit = record.has_shrink_to_fit != 0;
-  candidate.shrink_to_fit = record.shrink_to_fit != 0;
-  candidate.has_reading_order = record.has_reading_order != 0;
-  candidate.reading_order = record.reading_order;
-
-  candidate.has_alignment = formulon::HasAlignment(candidate);
-  return candidate;
-}
-
-/// Accepts a colour specification from the caller. An out-of-range `kind`
-/// degrades to `kNone`, which makes the writer emit the sibling `*_argb` as
-/// `rgb` rather than emitting an unknown attribute. Non-`kNone` selectors
-/// remain authoritative; no theme or indexed colour is resolved here.
-formulon::ColorSpec color_from_c(const fm_color_spec& src) noexcept {
-  formulon::ColorSpec out;
-  out.kind = (src.kind <= static_cast<uint8_t>(formulon::ColorSpec::Kind::kAuto))
-                 ? static_cast<formulon::ColorSpec::Kind>(src.kind)
-                 : formulon::ColorSpec::Kind::kNone;
-  out.rgb = src.rgb;
-  out.theme = src.theme;
-  out.tint = src.tint;
-  out.indexed = src.indexed;
-  return out;
-}
-
-formulon::FontRecord font_from_c(const fm_font_record& record) {
-  formulon::FontRecord out;
-  out.name = (record.name != nullptr) ? std::string(record.name) : std::string();
-  out.size = record.size;
-  out.bold = record.bold != 0;
-  out.italic = record.italic != 0;
-  out.strike = record.strike != 0;
-  out.has_bold = record.has_bold != 0;
-  out.has_italic = record.has_italic != 0;
-  out.has_strike = record.has_strike != 0;
-  out.has_family = record.has_family != 0;
-  out.has_charset = record.has_charset != 0;
-  out.underline = record.underline;
-  out.vert_align = record.vert_align;
-  out.family = record.family;
-  out.charset = record.charset;
-  out.scheme = record.scheme;
-  out.color_argb = record.color_argb;
-  out.color = color_from_c(record.color);
-  return out;
-}
-
-formulon::FillRecord fill_from_c(const fm_fill_record& record) noexcept {
-  formulon::FillRecord out;
-  out.pattern = record.pattern;
-  out.fg_argb = record.fg_argb;
-  out.bg_argb = record.bg_argb;
-  out.fg = color_from_c(record.fg);
-  out.bg = color_from_c(record.bg);
-  return out;
-}
-
-formulon::BorderSide border_side_from_c(const fm_border_side& src) noexcept {
-  formulon::BorderSide dst;
-  dst.style = src.style;
-  dst.color_argb = src.color_argb;
-  dst.color = color_from_c(src.color);
-  return dst;
-}
-
-formulon::BorderRecord border_from_c(const fm_border_record& record) noexcept {
-  formulon::BorderRecord out;
-  out.left = border_side_from_c(record.left);
-  out.right = border_side_from_c(record.right);
-  out.top = border_side_from_c(record.top);
-  out.bottom = border_side_from_c(record.bottom);
-  out.diagonal = border_side_from_c(record.diagonal);
-  out.diagonal_up = record.diagonal_up != 0;
-  out.diagonal_down = record.diagonal_down != 0;
-  return out;
-}
-
-}  // namespace
-
-extern "C" fm_status_t fm_styles_add_font(fm_workbook_t* wb, fm_font_record record, uint32_t* out_index) {
-  clear_last_error();
-  if (wb == nullptr || out_index == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_font: NULL argument");
-  }
-  formulon::FontRecord candidate = font_from_c(record);
-
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-  ensure_default_style_roots(styles);
-  // The candidate's key is loop-invariant; building it once keeps the scan
-  // linear in the table size instead of quadratic in fragment construction.
-  const std::string candidate_key = font_key(candidate);
-  for (std::size_t i = 0; i < styles.fonts.size(); ++i) {
-    if (font_key(styles.fonts[i]) == candidate_key) {
-      *out_index = static_cast<uint32_t>(i);
-      return 0;
-    }
-  }
-  styles.fonts.push_back(std::move(candidate));
-  *out_index = static_cast<uint32_t>(styles.fonts.size() - 1);
-  return 0;
-}
-
-extern "C" fm_status_t fm_styles_set_font(fm_workbook_t* wb, uint32_t font_index, fm_font_record record) {
-  clear_last_error();
-  if (wb == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_set_font: NULL argument");
-  }
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-  // No `ensure_default_style_roots` here: growing the table to satisfy an
-  // out-of-range index would install a default-constructed font at every
-  // slot below it, which is a different workbook than the caller asked for.
-  if (font_index >= styles.fonts.size()) {
-    return set_binding_error(
-        formulon::FormulonErrorCode::kInvalidArgument, "fm_styles_set_font: font_index out of range",
-        "font_index=" + std::to_string(font_index) + " fonts_count=" + std::to_string(styles.fonts.size()));
-  }
-  styles.fonts[font_index] = font_from_c(record);
-  return 0;
-}
-
-extern "C" fm_status_t fm_workbook_set_default_font(fm_workbook_t* wb, fm_font_record record) {
-  clear_last_error();
-  if (wb == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
-                             "fm_workbook_set_default_font: NULL argument");
-  }
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-  // Unlike `fm_styles_set_font`, seeding is right here: index 0 is reserved
-  // by construction, so a table without it is an empty table rather than one
-  // whose slot the caller mis-numbered.
-  ensure_default_style_roots(styles);
-  styles.fonts[0] = font_from_c(record);
-  return 0;
-}
-
-extern "C" fm_status_t fm_styles_add_fill(fm_workbook_t* wb, fm_fill_record record, uint32_t* out_index) {
-  clear_last_error();
-  if (wb == nullptr || out_index == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_fill: NULL argument");
-  }
-  formulon::FillRecord candidate = fill_from_c(record);
-
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-  ensure_default_style_roots(styles);
-  const std::string candidate_key = fill_key(candidate);
-  for (std::size_t i = 0; i < styles.fills.size(); ++i) {
-    if (fill_key(styles.fills[i]) == candidate_key) {
-      *out_index = static_cast<uint32_t>(i);
-      return 0;
-    }
-  }
-  styles.fills.push_back(candidate);
-  *out_index = static_cast<uint32_t>(styles.fills.size() - 1);
-  return 0;
-}
-
-extern "C" fm_status_t fm_styles_add_border(fm_workbook_t* wb, fm_border_record record, uint32_t* out_index) {
-  clear_last_error();
-  if (wb == nullptr || out_index == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_border: NULL argument");
-  }
-  formulon::BorderRecord candidate = border_from_c(record);
-
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-  ensure_default_style_roots(styles);
-  const std::string candidate_key = border_key(candidate);
-  for (std::size_t i = 0; i < styles.borders.size(); ++i) {
-    if (border_key(styles.borders[i]) == candidate_key) {
-      *out_index = static_cast<uint32_t>(i);
-      return 0;
-    }
-  }
-  styles.borders.push_back(candidate);
-  *out_index = static_cast<uint32_t>(styles.borders.size() - 1);
-  return 0;
-}
-
-extern "C" fm_status_t fm_styles_add_num_fmt(fm_workbook_t* wb, const char* format_code, uint16_t* out_num_fmt_id) {
-  clear_last_error();
-  if (wb == nullptr || out_num_fmt_id == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_num_fmt: NULL argument");
-  }
-  const std::string code = (format_code != nullptr) ? std::string(format_code) : std::string();
-  const formulon::StylesTable& existing_styles = wb->workbook().styles();
-
-  // Step 1: return a built-in slot only when that slot's effective mapping
-  // matches the requested code. A custom record may override the built-in.
-  for (uint16_t id = 0; id < 164U; ++id) {
-    const std::optional<std::string_view> resolved = effective_num_fmt(existing_styles, id);
-    if (resolved.has_value() && code == *resolved) {
-      *out_num_fmt_id = id;
-      return 0;
-    }
-  }
-
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-
-  // Step 2: existing custom entry whose id still resolves to its code. This
-  // skips shadowed duplicate ids and invalid string indexes.
-  for (const formulon::NumFmtRecord& n : styles.num_fmts) {
-    const std::optional<std::string_view> resolved = effective_num_fmt(styles, n.id);
-    if (resolved.has_value() && code == *resolved) {
-      *out_num_fmt_id = n.id;
-      return 0;
-    }
-  }
-
-  // Step 3: append a new custom entry. New id is one past the largest
-  // existing custom id, with `163` as the lower bound (the last
-  // built-in slot).
-  std::uint32_t next_id = 163U;
-  for (const formulon::NumFmtRecord& n : styles.num_fmts) {
-    if (n.id > next_id) {
-      next_id = n.id;
-    }
-  }
-  if (next_id >= std::numeric_limits<std::uint16_t>::max()) {
-    return set_binding_error(formulon::FormulonErrorCode::kPreconditionFailed,
-                             "fm_styles_add_num_fmt: custom numFmtId space exhausted",
-                             "max_num_fmt_id=" + std::to_string(std::numeric_limits<std::uint16_t>::max()));
-  }
-  ++next_id;
-
-  styles.num_fmt_strings.push_back(code);
-  formulon::NumFmtRecord rec;
-  rec.id = static_cast<std::uint16_t>(next_id);
-  rec.format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size() - 1);
-  styles.num_fmts.push_back(rec);
-  *out_num_fmt_id = static_cast<std::uint16_t>(next_id);
-  return 0;
-}
-
-namespace {
-
-fm_status_t add_cell_xf_impl(fm_workbook_t* wb, const fm_cell_xf& record, uint32_t* out_xf_index, const char* api) {
-  if (wb == nullptr || out_xf_index == nullptr) {
-    const std::string message = std::string(api) + ": NULL argument";
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, message.c_str());
-  }
-  if (fm_status_t rc = validate_xf_alignment(record, api); rc != 0) {
-    return rc;
-  }
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-  ensure_default_cell_xf(styles);
-
-  // Reject out-of-range references rather than auto-growing the parallel
-  // tables; callers must register fonts / fills / borders beforehand.
-  if (fm_status_t rc = validate_xf_references(styles, record, api); rc != 0) {
-    return rc;
-  }
-  // A non-zero `xfId` must name an existing `<cellStyleXfs>` entry, or the
-  // emitted attribute dangles. Zero stays legal with an empty table, which is
-  // what a record that names no parent style looks like.
-  if (record.xf_id != 0 && record.xf_id >= styles.cell_style_xfs.size()) {
-    const std::string message = std::string(api) + ": xf_id out of range";
-    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, message.c_str(),
-                             "xf_id=" + std::to_string(record.xf_id) +
-                                 " cell_style_xfs_count=" + std::to_string(styles.cell_style_xfs.size()));
-  }
-
-  // Confirm the read-side `fm_cell_xf` struct mirrors the engine
-  // `formulon::CellXf` field-for-field; the write side reuses the
-  // same shape so a layout drift would silently corrupt records.
-  static_assert(sizeof(record.font_index) == sizeof(formulon::CellXf::font_index),
-                "fm_cell_xf::font_index width must match formulon::CellXf");
-  static_assert(sizeof(record.fill_index) == sizeof(formulon::CellXf::fill_index),
-                "fm_cell_xf::fill_index width must match formulon::CellXf");
-  static_assert(sizeof(record.border_index) == sizeof(formulon::CellXf::border_index),
-                "fm_cell_xf::border_index width must match formulon::CellXf");
-  static_assert(sizeof(record.num_fmt_id) == sizeof(formulon::CellXf::num_fmt_id),
-                "fm_cell_xf::num_fmt_id width must match formulon::CellXf");
-
-  formulon::CellXf candidate = cell_xf_from_c(record, record.xf_id);
-  const std::string candidate_key = cell_xf_key(candidate);
-  for (std::size_t i = 0; i < styles.cell_xfs.size(); ++i) {
-    if (cell_xf_key(styles.cell_xfs[i]) == candidate_key) {
-      *out_xf_index = static_cast<uint32_t>(i);
-      return 0;
-    }
-  }
-  styles.cell_xfs.push_back(candidate);
-  *out_xf_index = static_cast<uint32_t>(styles.cell_xfs.size() - 1);
-  return 0;
-}
-
-}  // namespace
-
-extern "C" fm_status_t fm_styles_add_cell_xf(fm_workbook_t* wb, fm_cell_xf record, uint32_t* out_xf_index) {
-  clear_last_error();
-  return add_cell_xf_impl(wb, record, out_xf_index, "fm_styles_add_cell_xf");
-}
-
-extern "C" fm_status_t fm_styles_add_cell_style_xf(fm_workbook_t* wb, fm_cell_xf record, uint32_t* out_xf_id) {
-  clear_last_error();
-  if (wb == nullptr || out_xf_id == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
-                             "fm_styles_add_cell_style_xf: NULL argument");
-  }
-  if (fm_status_t rc = validate_xf_alignment(record, "fm_styles_add_cell_style_xf"); rc != 0) {
-    return rc;
-  }
-  auto& styles = wb->workbook().mutable_styles();
-  ensure_default_style_roots(styles);
-  if (fm_status_t rc = validate_xf_references(styles, record, "fm_styles_add_cell_style_xf"); rc != 0) {
-    return rc;
-  }
-  formulon::CellXf candidate = cell_xf_from_c(record, 0U);
-  const std::string candidate_key = cell_xf_key(candidate);
-  for (std::size_t i = 0; i < styles.cell_style_xfs.size(); ++i) {
-    if (cell_xf_key(styles.cell_style_xfs[i]) == candidate_key) {
-      *out_xf_id = static_cast<uint32_t>(i);
-      return 0;
-    }
-  }
-  styles.cell_style_xfs.push_back(std::move(candidate));
-  *out_xf_id = static_cast<uint32_t>(styles.cell_style_xfs.size() - 1U);
-  return 0;
-}
-
-extern "C" fm_status_t fm_styles_set_cell_style(fm_workbook_t* wb, const char* name, uint32_t xf_id,
-                                                uint32_t builtin_id) {
-  clear_last_error();
-  if (wb == nullptr || name == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
-                             "fm_styles_set_cell_style: NULL argument");
-  }
-  auto& styles = wb->workbook().mutable_styles();
-  if (name[0] == '\0' || xf_id >= styles.cell_style_xfs.size()) {
-    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
-                             "fm_styles_set_cell_style: invalid name or xf_id");
-  }
-  // The OOXML ordinal space is 0..47; anything else must use the sentinel,
-  // which suppresses the attribute instead of writing an unknown ordinal.
-  if (builtin_id > 47U && builtin_id != FM_CELL_STYLE_BUILTIN_ID_NONE) {
-    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
-                             "fm_styles_set_cell_style: builtin_id out of range",
-                             "builtin_id=" + std::to_string(builtin_id));
-  }
-  for (auto& style : styles.cell_styles) {
-    if (style.name == name) {
-      style.xf_id = xf_id;
-      style.builtin_id = builtin_id;
-      return 0;
-    }
-  }
-  formulon::CellStyleRecord style;
-  style.name = name;
-  style.xf_id = xf_id;
-  style.builtin_id = builtin_id;
-  styles.cell_styles.push_back(std::move(style));
-  return 0;
-}
-
-extern "C" fm_status_t fm_styles_add_batch(fm_workbook_t* wb, const fm_styles_batch* batch) {
-  clear_last_error();
-  if (wb == nullptr || batch == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_batch: NULL argument");
-  }
-  if ((batch->font_count != 0U && (batch->fonts == nullptr || batch->font_indices == nullptr)) ||
-      (batch->fill_count != 0U && (batch->fills == nullptr || batch->fill_indices == nullptr)) ||
-      (batch->border_count != 0U && (batch->borders == nullptr || batch->border_indices == nullptr)) ||
-      (batch->cell_xf_count != 0U && (batch->cell_xfs == nullptr || batch->cell_xf_indices == nullptr)) ||
-      (batch->num_fmt_count != 0U && (batch->num_fmt_codes == nullptr || batch->num_fmt_ids == nullptr))) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
-                             "fm_styles_add_batch: non-empty array is NULL");
-  }
-
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-  // Stage every mutation, including the default roots that are required for
-  // a valid xf. StylesTable owns strings and all nested records by value, so
-  // this is a deep copy. The live table and caller-owned output arrays remain
-  // untouched until every input record has passed validation.
-  formulon::StylesTable staged = styles;
-  ensure_default_style_roots(staged);
-
-  std::vector<uint32_t> staged_font_indices(batch->font_count);
-  std::vector<uint32_t> staged_fill_indices(batch->fill_count);
-  std::vector<uint32_t> staged_border_indices(batch->border_count);
-  std::vector<uint32_t> staged_cell_xf_indices(batch->cell_xf_count);
-  std::vector<uint16_t> staged_num_fmt_ids(batch->num_fmt_count);
-
-  std::unordered_map<std::string, uint32_t> fonts;
-  std::unordered_map<std::string, uint32_t> fills;
-  std::unordered_map<std::string, uint32_t> borders;
-  fonts.reserve(staged.fonts.size() + batch->font_count);
-  fills.reserve(staged.fills.size() + batch->fill_count);
-  borders.reserve(staged.borders.size() + batch->border_count);
-  for (uint32_t i = 0; i < staged.fonts.size(); ++i)
-    fonts.emplace(font_key(staged.fonts[i]), i);
-  for (uint32_t i = 0; i < staged.fills.size(); ++i)
-    fills.emplace(fill_key(staged.fills[i]), i);
-  for (uint32_t i = 0; i < staged.borders.size(); ++i)
-    borders.emplace(border_key(staged.borders[i]), i);
-  for (size_t i = 0; i < batch->font_count; ++i) {
-    formulon::FontRecord value = font_from_c(batch->fonts[i]);
-    const std::string key = font_key(value);
-    const auto [it, inserted] = fonts.emplace(key, static_cast<uint32_t>(staged.fonts.size()));
-    if (inserted)
-      staged.fonts.push_back(std::move(value));
-    staged_font_indices[i] = it->second;
-  }
-  for (size_t i = 0; i < batch->fill_count; ++i) {
-    formulon::FillRecord value = fill_from_c(batch->fills[i]);
-    const std::string key = fill_key(value);
-    const auto [it, inserted] = fills.emplace(key, static_cast<uint32_t>(staged.fills.size()));
-    if (inserted)
-      staged.fills.push_back(value);
-    staged_fill_indices[i] = it->second;
-  }
-  for (size_t i = 0; i < batch->border_count; ++i) {
-    formulon::BorderRecord value = border_from_c(batch->borders[i]);
-    const std::string key = border_key(value);
-    const auto [it, inserted] = borders.emplace(key, static_cast<uint32_t>(staged.borders.size()));
-    if (inserted)
-      staged.borders.push_back(value);
-    staged_border_indices[i] = it->second;
-  }
-  std::unordered_map<std::string, uint16_t> num_fmts;
-  num_fmts.reserve(staged.num_fmts.size() + batch->num_fmt_count);
-  std::uint32_t next_num_fmt_id = 163U;
-  for (const formulon::NumFmtRecord& record : staged.num_fmts) {
-    const std::optional<std::string_view> resolved = effective_num_fmt(staged, record.id);
-    if (record.format_string_index < staged.num_fmt_strings.size() && resolved.has_value() &&
-        *resolved == staged.num_fmt_strings[record.format_string_index]) {
-      num_fmts.emplace(staged.num_fmt_strings[record.format_string_index], record.id);
-    }
-    if (record.id > next_num_fmt_id) {
-      next_num_fmt_id = record.id;
-    }
-  }
-  for (size_t i = 0; i < batch->num_fmt_count; ++i) {
-    const std::string code = batch->num_fmt_codes[i] != nullptr ? batch->num_fmt_codes[i] : "";
-    uint16_t builtin_id = 0U;
-    bool is_builtin = false;
-    for (uint16_t id = 0U; id < 164U; ++id) {
-      const std::optional<std::string_view> resolved = effective_num_fmt(staged, id);
-      if (resolved.has_value() && code == *resolved) {
-        builtin_id = id;
-        is_builtin = true;
-        break;
-      }
-    }
-    if (is_builtin) {
-      staged_num_fmt_ids[i] = builtin_id;
-      continue;
-    }
-    const auto existing = num_fmts.find(code);
-    if (existing != num_fmts.end()) {
-      staged_num_fmt_ids[i] = existing->second;
-      continue;
-    }
-    if (next_num_fmt_id >= std::numeric_limits<std::uint16_t>::max()) {
-      return set_binding_error(formulon::FormulonErrorCode::kPreconditionFailed,
-                               "fm_styles_add_batch: custom numFmtId space exhausted",
-                               "max_num_fmt_id=" + std::to_string(std::numeric_limits<std::uint16_t>::max()));
-    }
-    const std::uint32_t candidate_num_fmt_id = next_num_fmt_id + 1U;
-    num_fmts.emplace(code, static_cast<std::uint16_t>(candidate_num_fmt_id));
-    ++next_num_fmt_id;
-    staged.num_fmt_strings.push_back(code);
-    formulon::NumFmtRecord record;
-    record.id = static_cast<std::uint16_t>(next_num_fmt_id);
-    record.format_string_index = static_cast<uint32_t>(staged.num_fmt_strings.size() - 1U);
-    staged.num_fmts.push_back(record);
-    staged_num_fmt_ids[i] = record.id;
-  }
-  ensure_default_cell_xf(staged);
-  std::unordered_map<std::string, uint32_t> xfs;
-  xfs.reserve(staged.cell_xfs.size() + batch->cell_xf_count);
-  for (uint32_t i = 0; i < staged.cell_xfs.size(); ++i)
-    xfs.emplace(cell_xf_key(staged.cell_xfs[i]), i);
-  for (size_t i = 0; i < batch->cell_xf_count; ++i) {
-    const fm_cell_xf& record = batch->cell_xfs[i];
-    if (fm_status_t rc = validate_xf_alignment(record, "fm_styles_add_batch"); rc != 0) {
-      return rc;
-    }
-    if (fm_status_t rc = validate_xf_references(staged, record, "fm_styles_add_batch"); rc != 0) {
-      return rc;
-    }
-    // The batch shares the single-record presence-flag contract; `xfId` is
-    // staged as given so a batch may point at a named style added earlier,
-    // and is rejected when it would dangle.
-    if (record.xf_id != 0 && record.xf_id >= staged.cell_style_xfs.size()) {
-      return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "fm_styles_add_batch: xf_id out of range",
-                               "xf_id=" + std::to_string(record.xf_id) +
-                                   " cell_style_xfs_count=" + std::to_string(staged.cell_style_xfs.size()));
-    }
-    const formulon::CellXf value = cell_xf_from_c(record, record.xf_id);
-    const std::string key = cell_xf_key(value);
-    const auto [it, inserted] = xfs.emplace(key, static_cast<uint32_t>(staged.cell_xfs.size()));
-    if (inserted)
-      staged.cell_xfs.push_back(value);
-    staged_cell_xf_indices[i] = it->second;
-  }
-
-  // Commit the complete staged table and publish output indices only after
-  // all records have succeeded. A failed batch therefore leaves both the
-  // workbook and every caller-provided sentinel byte-identical.
-  styles = std::move(staged);
-  for (size_t i = 0; i < batch->font_count; ++i)
-    batch->font_indices[i] = staged_font_indices[i];
-  for (size_t i = 0; i < batch->fill_count; ++i)
-    batch->fill_indices[i] = staged_fill_indices[i];
-  for (size_t i = 0; i < batch->border_count; ++i)
-    batch->border_indices[i] = staged_border_indices[i];
-  for (size_t i = 0; i < batch->cell_xf_count; ++i)
-    batch->cell_xf_indices[i] = staged_cell_xf_indices[i];
-  for (size_t i = 0; i < batch->num_fmt_count; ++i)
-    batch->num_fmt_ids[i] = staged_num_fmt_ids[i];
-  return 0;
-}
-
-extern "C" fm_status_t fm_styles_add_dxf(fm_workbook_t* wb, fm_dxf_record record, uint32_t* out_dxf_index) {
-  clear_last_error();
-  if (wb == nullptr || out_dxf_index == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_dxf: NULL argument");
-  }
-
-  formulon::DifferentialFormat candidate;
-  candidate.has_font = record.font_engaged != 0;
-  if (candidate.has_font) {
-    candidate.font = font_from_c(record.font);
-  }
-  candidate.has_fill = record.fill_engaged != 0;
-  if (candidate.has_fill) {
-    candidate.fill = fill_from_c(record.fill);
-  }
-  candidate.has_border = record.border_engaged != 0;
-  if (candidate.has_border) {
-    candidate.border = border_from_c(record.border);
-  }
-  candidate.has_num_fmt = record.num_fmt_engaged != 0;
-  if (candidate.has_num_fmt) {
-    candidate.num_fmt_id = record.num_fmt_id;
-    candidate.num_fmt_code = (record.num_fmt_code != nullptr) ? std::string(record.num_fmt_code) : std::string();
-  }
-  candidate.alignment_xml = (record.alignment_xml != nullptr) ? std::string(record.alignment_xml) : std::string();
-  candidate.protection_xml = (record.protection_xml != nullptr) ? std::string(record.protection_xml) : std::string();
-
-  formulon::StylesTable& styles = wb->workbook().mutable_styles();
-  for (std::size_t i = 0; i < styles.dxfs.size(); ++i) {
-    if (dxf_records_equal(styles.dxfs[i], candidate)) {
-      *out_dxf_index = static_cast<uint32_t>(i);
-      return 0;
-    }
-  }
-  styles.dxfs.push_back(std::move(candidate));
-  *out_dxf_index = static_cast<uint32_t>(styles.dxfs.size() - 1);
-  return 0;
-}
diff --git a/src/c_api/parts/styles_mutate.cpp b/src/c_api/parts/styles_mutate.cpp
new file mode 100644
index 000000000..1ac16030b
--- /dev/null
+++ b/src/c_api/parts/styles_mutate.cpp
@@ -0,0 +1,838 @@
+//
+// C ABI - styles mutation surface (fonts, fills, borders, num formats, cell
+// xfs, cell styles, dxfs and the batch commit, all with dedup-on-insert).
+
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <type_traits>
+#include <unordered_map>
+#include <utility>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "io/styles_writer.h"
+#include "styles.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+using formulon::effective_num_fmt;
+using formulon::c_api::parts::clear_last_error;
+using formulon::c_api::parts::num_fmt_id_known;
+using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::set_last_error;
+
+namespace {
+
+static_assert(std::is_nothrow_move_constructible_v<formulon::StylesTable>,
+              "StylesTable must be nothrow-move-constructible for staged style commits");
+static_assert(std::is_nothrow_move_assignable_v<formulon::StylesTable>,
+              "StylesTable must be nothrow-move-assignable for staged style commits");
+
+/// Dedup identity for the font / fill / border tables.
+///
+/// `fm_styles_add_*` may only hand back an existing index when the styles
+/// writer cannot tell the stored record from the candidate, so identity is
+/// the XML fragment the writer emits for the record. Deriving the key from
+/// the writer rather than restating its rules here folds in every
+/// writer-visible field by construction — the presence flags, `<family>` /
+/// `<charset>`, and the round-trip colour specifications that a
+/// hand-written comparator kept missing — and keeps the linear-scan
+/// comparison below and the batch hash key from drifting apart, because
+/// they are the same function.
+std::string font_key(const formulon::FontRecord& value) {
+  return formulon::io::font_fragment(value);
+}
+
+std::string fill_key(const formulon::FillRecord& value) {
+  return formulon::io::fill_fragment(value);
+}
+
+std::string border_key(const formulon::BorderRecord& value) {
+  return formulon::io::border_fragment(value);
+}
+
+bool font_records_equal(const formulon::FontRecord& a, const formulon::FontRecord& b) {
+  return font_key(a) == font_key(b);
+}
+
+bool fill_records_equal(const formulon::FillRecord& a, const formulon::FillRecord& b) {
+  return fill_key(a) == fill_key(b);
+}
+
+bool border_records_equal(const formulon::BorderRecord& a, const formulon::BorderRecord& b) {
+  return border_key(a) == border_key(b);
+}
+
+template <typename T>
+void append_key_scalar(std::string& out, const T& value) {
+  out.append(reinterpret_cast<const char*>(&value), sizeof(value));
+}
+
+std::string cell_xf_key(const formulon::CellXf& value) {
+  std::string out;
+  append_key_scalar(out, value.font_index);
+  append_key_scalar(out, value.fill_index);
+  append_key_scalar(out, value.border_index);
+  append_key_scalar(out, value.num_fmt_id);
+  append_key_scalar(out, value.xf_id);
+  append_key_scalar(out, value.apply_number_format);
+  append_key_scalar(out, value.apply_font);
+  append_key_scalar(out, value.apply_fill);
+  append_key_scalar(out, value.apply_border);
+  append_key_scalar(out, value.apply_alignment);
+  append_key_scalar(out, value.apply_protection);
+  append_key_scalar(out, value.quote_prefix);
+  const bool has_alignment = formulon::HasAlignment(value);
+  append_key_scalar(out, has_alignment);
+  const bool has_horizontal_align = formulon::HasHorizontalAlign(value);
+  append_key_scalar(out, has_horizontal_align);
+  if (has_horizontal_align) {
+    append_key_scalar(out, value.horizontal_align);
+  }
+  const bool has_vertical_align = formulon::HasVerticalAlign(value);
+  append_key_scalar(out, has_vertical_align);
+  if (has_vertical_align) {
+    append_key_scalar(out, value.vertical_align);
+  }
+  const bool has_wrap_text = formulon::HasWrapText(value);
+  append_key_scalar(out, has_wrap_text);
+  if (has_wrap_text) {
+    append_key_scalar(out, value.wrap_text);
+  }
+  const bool has_justify_last_line = formulon::HasJustifyLastLine(value);
+  append_key_scalar(out, has_justify_last_line);
+  if (has_justify_last_line) {
+    append_key_scalar(out, value.justify_last_line);
+  }
+  append_key_scalar(out, value.has_text_rotation);
+  if (value.has_text_rotation) {
+    append_key_scalar(out, value.text_rotation);
+  }
+  append_key_scalar(out, value.has_indent);
+  if (value.has_indent) {
+    append_key_scalar(out, value.indent);
+  }
+  append_key_scalar(out, value.has_relative_indent);
+  if (value.has_relative_indent) {
+    append_key_scalar(out, value.relative_indent);
+  }
+  append_key_scalar(out, value.has_shrink_to_fit);
+  if (value.has_shrink_to_fit) {
+    append_key_scalar(out, value.shrink_to_fit);
+  }
+  append_key_scalar(out, value.has_reading_order);
+  if (value.has_reading_order) {
+    append_key_scalar(out, value.reading_order);
+  }
+  append_key_scalar(out, value.has_protection);
+  if (value.has_protection) {
+    append_key_scalar(out, value.locked);
+    append_key_scalar(out, value.hidden);
+  }
+  return out;
+}
+
+/// A dxf's engaged children are compared through the same writer-derived
+/// keys as the global tables, so a differential font that only differs in
+/// `<vertAlign>` or in an explicit `<b val="0"/>` is a distinct record.
+///
+bool dxf_records_equal(const formulon::DifferentialFormat& a, const formulon::DifferentialFormat& b) {
+  return a.has_font == b.has_font && (!a.has_font || font_records_equal(a.font, b.font)) && a.has_fill == b.has_fill &&
+         (!a.has_fill || fill_records_equal(a.fill, b.fill)) && a.has_border == b.has_border &&
+         (!a.has_border || border_records_equal(a.border, b.border)) && a.has_num_fmt == b.has_num_fmt &&
+         (!a.has_num_fmt || (a.num_fmt_id == b.num_fmt_id && a.num_fmt_code == b.num_fmt_code)) &&
+         a.alignment_xml == b.alignment_xml && a.protection_xml == b.protection_xml;
+}
+
+void ensure_default_style_roots(formulon::StylesTable& styles) {
+  if (styles.fonts.empty()) {
+    styles.fonts.emplace_back();
+  }
+  if (styles.fills.empty()) {
+    styles.fills.emplace_back();
+  }
+  if (styles.borders.empty()) {
+    styles.borders.emplace_back();
+  }
+}
+
+void ensure_default_cell_xf(formulon::StylesTable& styles) {
+  ensure_default_style_roots(styles);
+  if (styles.cell_xfs.empty()) {
+    styles.cell_xfs.emplace_back();
+  }
+}
+
+/// Rejects an `<xf>` whose font / fill / border / number-format reference
+/// points past the corresponding table. Auto-growing the parallel tables
+/// would hide the caller's ordering mistake and emit a dangling index that
+/// Excel reports as a repairable file.
+fm_status_t validate_xf_references(const formulon::StylesTable& styles, const fm_cell_xf& record, const char* api) {
+  auto reject = [api](const char* what, std::string context) {
+    const std::string message = std::string(api) + ": " + what;
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, message.c_str(), std::move(context));
+  };
+  if (record.font_index >= styles.fonts.size()) {
+    return reject("font_index out of range", "font_index=" + std::to_string(record.font_index) +
+                                                 " fonts_count=" + std::to_string(styles.fonts.size()));
+  }
+  if (record.fill_index >= styles.fills.size()) {
+    return reject("fill_index out of range", "fill_index=" + std::to_string(record.fill_index) +
+                                                 " fills_count=" + std::to_string(styles.fills.size()));
+  }
+  if (record.border_index >= styles.borders.size()) {
+    return reject("border_index out of range", "border_index=" + std::to_string(record.border_index) +
+                                                   " borders_count=" + std::to_string(styles.borders.size()));
+  }
+  if (!num_fmt_id_known(styles, record.num_fmt_id)) {
+    return reject("num_fmt_id not registered", "num_fmt_id=" + std::to_string(record.num_fmt_id));
+  }
+  return 0;
+}
+
+fm_status_t validate_xf_alignment(const fm_cell_xf& record, const char* api) {
+  auto reject = [api](const char* what, std::string context) {
+    const std::string message = std::string(api) + ": " + what;
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, message.c_str(), std::move(context));
+  };
+  // The presence flags are authoritative. Values for an omitted attribute
+  // are ignored, including malformed alignment enum ordinals. The accepted
+  // ordinals are the canonical writer mapping for the corresponding XML
+  // string enums (general..distributed and top..distributed).
+  if (record.has_horizontal_align != 0 && record.horizontal_align > 7U) {
+    return reject("horizontal_align out of range", "horizontal_align=" + std::to_string(record.horizontal_align));
+  }
+  if (record.has_vertical_align != 0 && record.vertical_align > 4U) {
+    return reject("vertical_align out of range", "vertical_align=" + std::to_string(record.vertical_align));
+  }
+  if (record.has_text_rotation != 0 && record.text_rotation > 180U && record.text_rotation != 255U) {
+    return reject("text_rotation out of range", "text_rotation=" + std::to_string(record.text_rotation));
+  }
+  if (record.has_indent != 0 && record.indent > 255U) {
+    return reject("indent out of range", "indent=" + std::to_string(record.indent));
+  }
+  if (record.has_reading_order != 0 && record.reading_order > 2U) {
+    return reject("reading_order out of range", "reading_order=" + std::to_string(record.reading_order));
+  }
+  return 0;
+}
+
+formulon::CellXf cell_xf_from_c(const fm_cell_xf& record, std::uint32_t xf_id) {
+  formulon::CellXf candidate;
+  candidate.font_index = record.font_index;
+  candidate.fill_index = record.fill_index;
+  candidate.border_index = record.border_index;
+  candidate.num_fmt_id = record.num_fmt_id;
+  candidate.xf_id = xf_id;
+
+  // The record carries explicit presence bits. Keep values for present
+  // attributes and canonicalize omitted ones so Has* does not infer a child
+  // from ignored poison values.
+  candidate.horizontal_align = record.has_horizontal_align != 0 ? record.horizontal_align : 0U;
+  candidate.vertical_align = record.has_vertical_align != 0 ? record.vertical_align : 2U;
+  candidate.wrap_text = record.has_wrap_text != 0 && record.wrap_text != 0;
+  candidate.justify_last_line = record.has_justify_last_line != 0 && record.justify_last_line != 0;
+  candidate.has_alignment = record.has_alignment != 0;
+  candidate.has_horizontal_align = record.has_horizontal_align != 0;
+  candidate.has_vertical_align = record.has_vertical_align != 0;
+  candidate.has_wrap_text = record.has_wrap_text != 0;
+  candidate.has_justify_last_line = record.has_justify_last_line != 0;
+
+  // These optional attributes retain their existing presence-plus-value
+  // contract; values are copied even when the corresponding bit is false.
+  candidate.has_text_rotation = record.has_text_rotation != 0;
+  candidate.text_rotation = record.text_rotation;
+  candidate.has_indent = record.has_indent != 0;
+  candidate.indent = record.indent;
+  candidate.has_relative_indent = record.has_relative_indent != 0;
+  candidate.relative_indent = record.relative_indent;
+  candidate.has_shrink_to_fit = record.has_shrink_to_fit != 0;
+  candidate.shrink_to_fit = record.shrink_to_fit != 0;
+  candidate.has_reading_order = record.has_reading_order != 0;
+  candidate.reading_order = record.reading_order;
+
+  candidate.apply_number_format = record.apply_number_format != 0;
+  candidate.apply_font = record.apply_font != 0;
+  candidate.apply_fill = record.apply_fill != 0;
+  candidate.apply_border = record.apply_border != 0;
+  candidate.apply_alignment = record.apply_alignment != 0;
+  candidate.apply_protection = record.apply_protection != 0;
+  candidate.quote_prefix = record.quote_prefix != 0;
+  // An omitted `<protection>` child canonicalizes to the schema defaults so
+  // ignored values cannot split otherwise identical records.
+  candidate.has_protection = record.has_protection != 0;
+  candidate.locked = !candidate.has_protection || record.locked != 0;
+  candidate.hidden = candidate.has_protection && record.hidden != 0;
+
+  candidate.has_alignment = formulon::HasAlignment(candidate);
+  return candidate;
+}
+
+/// Accepts a colour specification from the caller. An out-of-range `kind`
+/// degrades to `kNone`, which makes the writer emit the sibling `*_argb` as
+/// `rgb` rather than emitting an unknown attribute. Non-`kNone` selectors
+/// remain authoritative; no theme or indexed colour is resolved here.
+formulon::ColorSpec color_from_c(const fm_color_spec& src) noexcept {
+  formulon::ColorSpec out;
+  out.kind = (src.kind <= static_cast<uint8_t>(formulon::ColorSpec::Kind::kAuto))
+                 ? static_cast<formulon::ColorSpec::Kind>(src.kind)
+                 : formulon::ColorSpec::Kind::kNone;
+  out.rgb = src.rgb;
+  out.theme = src.theme;
+  out.tint = src.tint;
+  out.indexed = src.indexed;
+  return out;
+}
+
+formulon::FontRecord font_from_c(const fm_font_record& record) {
+  formulon::FontRecord out;
+  out.name = (record.name != nullptr) ? std::string(record.name) : std::string();
+  out.size = record.size;
+  out.bold = record.bold != 0;
+  out.italic = record.italic != 0;
+  out.strike = record.strike != 0;
+  out.has_bold = record.has_bold != 0;
+  out.has_italic = record.has_italic != 0;
+  out.has_strike = record.has_strike != 0;
+  out.has_family = record.has_family != 0;
+  out.has_charset = record.has_charset != 0;
+  out.underline = record.underline;
+  out.vert_align = record.vert_align;
+  out.family = record.family;
+  out.charset = record.charset;
+  out.scheme = record.scheme;
+  out.color_argb = record.color_argb;
+  out.color = color_from_c(record.color);
+  return out;
+}
+
+formulon::FillRecord fill_from_c(const fm_fill_record& record) noexcept {
+  formulon::FillRecord out;
+  out.pattern = record.pattern;
+  out.fg_argb = record.fg_argb;
+  out.bg_argb = record.bg_argb;
+  out.fg = color_from_c(record.fg);
+  out.bg = color_from_c(record.bg);
+  return out;
+}
+
+formulon::BorderSide border_side_from_c(const fm_border_side& src) noexcept {
+  formulon::BorderSide dst;
+  dst.style = src.style;
+  dst.color_argb = src.color_argb;
+  dst.color = color_from_c(src.color);
+  return dst;
+}
+
+formulon::BorderRecord border_from_c(const fm_border_record& record) noexcept {
+  formulon::BorderRecord out;
+  out.left = border_side_from_c(record.left);
+  out.right = border_side_from_c(record.right);
+  out.top = border_side_from_c(record.top);
+  out.bottom = border_side_from_c(record.bottom);
+  out.diagonal = border_side_from_c(record.diagonal);
+  out.diagonal_up = record.diagonal_up != 0;
+  out.diagonal_down = record.diagonal_down != 0;
+  return out;
+}
+
+}  // namespace
+
+extern "C" fm_status_t fm_styles_add_font(fm_workbook_t* wb, fm_font_record record, uint32_t* out_index) {
+  clear_last_error();
+  if (wb == nullptr || out_index == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_font: NULL argument");
+  }
+  formulon::FontRecord candidate = font_from_c(record);
+
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+  ensure_default_style_roots(styles);
+  // The candidate's key is loop-invariant; building it once keeps the scan
+  // linear in the table size instead of quadratic in fragment construction.
+  const std::string candidate_key = font_key(candidate);
+  for (std::size_t i = 0; i < styles.fonts.size(); ++i) {
+    if (font_key(styles.fonts[i]) == candidate_key) {
+      *out_index = static_cast<uint32_t>(i);
+      return 0;
+    }
+  }
+  styles.fonts.push_back(std::move(candidate));
+  *out_index = static_cast<uint32_t>(styles.fonts.size() - 1);
+  return 0;
+}
+
+extern "C" fm_status_t fm_styles_set_font(fm_workbook_t* wb, uint32_t font_index, fm_font_record record) {
+  clear_last_error();
+  if (wb == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_set_font: NULL argument");
+  }
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+  // No `ensure_default_style_roots` here: growing the table to satisfy an
+  // out-of-range index would install a default-constructed font at every
+  // slot below it, which is a different workbook than the caller asked for.
+  if (font_index >= styles.fonts.size()) {
+    return set_binding_error(
+        formulon::FormulonErrorCode::kInvalidArgument, "fm_styles_set_font: font_index out of range",
+        "font_index=" + std::to_string(font_index) + " fonts_count=" + std::to_string(styles.fonts.size()));
+  }
+  styles.fonts[font_index] = font_from_c(record);
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_set_default_font(fm_workbook_t* wb, fm_font_record record) {
+  clear_last_error();
+  if (wb == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_set_default_font: NULL argument");
+  }
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+  // Unlike `fm_styles_set_font`, seeding is right here: index 0 is reserved
+  // by construction, so a table without it is an empty table rather than one
+  // whose slot the caller mis-numbered.
+  ensure_default_style_roots(styles);
+  styles.fonts[0] = font_from_c(record);
+  return 0;
+}
+
+extern "C" fm_status_t fm_styles_add_fill(fm_workbook_t* wb, fm_fill_record record, uint32_t* out_index) {
+  clear_last_error();
+  if (wb == nullptr || out_index == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_fill: NULL argument");
+  }
+  formulon::FillRecord candidate = fill_from_c(record);
+
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+  ensure_default_style_roots(styles);
+  const std::string candidate_key = fill_key(candidate);
+  for (std::size_t i = 0; i < styles.fills.size(); ++i) {
+    if (fill_key(styles.fills[i]) == candidate_key) {
+      *out_index = static_cast<uint32_t>(i);
+      return 0;
+    }
+  }
+  styles.fills.push_back(candidate);
+  *out_index = static_cast<uint32_t>(styles.fills.size() - 1);
+  return 0;
+}
+
+extern "C" fm_status_t fm_styles_add_border(fm_workbook_t* wb, fm_border_record record, uint32_t* out_index) {
+  clear_last_error();
+  if (wb == nullptr || out_index == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_border: NULL argument");
+  }
+  formulon::BorderRecord candidate = border_from_c(record);
+
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+  ensure_default_style_roots(styles);
+  const std::string candidate_key = border_key(candidate);
+  for (std::size_t i = 0; i < styles.borders.size(); ++i) {
+    if (border_key(styles.borders[i]) == candidate_key) {
+      *out_index = static_cast<uint32_t>(i);
+      return 0;
+    }
+  }
+  styles.borders.push_back(candidate);
+  *out_index = static_cast<uint32_t>(styles.borders.size() - 1);
+  return 0;
+}
+
+extern "C" fm_status_t fm_styles_add_num_fmt(fm_workbook_t* wb, const char* format_code, uint16_t* out_num_fmt_id) {
+  clear_last_error();
+  if (wb == nullptr || out_num_fmt_id == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_num_fmt: NULL argument");
+  }
+  const std::string code = (format_code != nullptr) ? std::string(format_code) : std::string();
+  const formulon::StylesTable& existing_styles = wb->workbook().styles();
+
+  // Step 1: return a built-in slot only when that slot's effective mapping
+  // matches the requested code. A custom record may override the built-in.
+  for (uint16_t id = 0; id < 164U; ++id) {
+    const std::optional<std::string_view> resolved = effective_num_fmt(existing_styles, id);
+    if (resolved.has_value() && code == *resolved) {
+      *out_num_fmt_id = id;
+      return 0;
+    }
+  }
+
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+
+  // Step 2: existing custom entry whose id still resolves to its code. This
+  // skips shadowed duplicate ids and invalid string indexes.
+  for (const formulon::NumFmtRecord& n : styles.num_fmts) {
+    const std::optional<std::string_view> resolved = effective_num_fmt(styles, n.id);
+    if (resolved.has_value() && code == *resolved) {
+      *out_num_fmt_id = n.id;
+      return 0;
+    }
+  }
+
+  // Step 3: append a new custom entry. New id is one past the largest
+  // existing custom id, with `163` as the lower bound (the last
+  // built-in slot).
+  std::uint32_t next_id = 163U;
+  for (const formulon::NumFmtRecord& n : styles.num_fmts) {
+    if (n.id > next_id) {
+      next_id = n.id;
+    }
+  }
+  if (next_id >= std::numeric_limits<std::uint16_t>::max()) {
+    return set_binding_error(formulon::FormulonErrorCode::kPreconditionFailed,
+                             "fm_styles_add_num_fmt: custom numFmtId space exhausted",
+                             "max_num_fmt_id=" + std::to_string(std::numeric_limits<std::uint16_t>::max()));
+  }
+  ++next_id;
+
+  styles.num_fmt_strings.push_back(code);
+  formulon::NumFmtRecord rec;
+  rec.id = static_cast<std::uint16_t>(next_id);
+  rec.format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size() - 1);
+  styles.num_fmts.push_back(rec);
+  *out_num_fmt_id = static_cast<std::uint16_t>(next_id);
+  return 0;
+}
+
+namespace {
+
+fm_status_t add_cell_xf_impl(fm_workbook_t* wb, const fm_cell_xf& record, uint32_t* out_xf_index, const char* api) {
+  if (wb == nullptr || out_xf_index == nullptr) {
+    const std::string message = std::string(api) + ": NULL argument";
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, message.c_str());
+  }
+  if (fm_status_t rc = validate_xf_alignment(record, api); rc != 0) {
+    return rc;
+  }
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+  ensure_default_cell_xf(styles);
+
+  // Reject out-of-range references rather than auto-growing the parallel
+  // tables; callers must register fonts / fills / borders beforehand.
+  if (fm_status_t rc = validate_xf_references(styles, record, api); rc != 0) {
+    return rc;
+  }
+  // A non-zero `xfId` must name an existing `<cellStyleXfs>` entry, or the
+  // emitted attribute dangles. Zero stays legal with an empty table, which is
+  // what a record that names no parent style looks like.
+  if (record.xf_id != 0 && record.xf_id >= styles.cell_style_xfs.size()) {
+    const std::string message = std::string(api) + ": xf_id out of range";
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, message.c_str(),
+                             "xf_id=" + std::to_string(record.xf_id) +
+                                 " cell_style_xfs_count=" + std::to_string(styles.cell_style_xfs.size()));
+  }
+
+  // Confirm the read-side `fm_cell_xf` struct mirrors the engine
+  // `formulon::CellXf` field-for-field; the write side reuses the
+  // same shape so a layout drift would silently corrupt records.
+  static_assert(sizeof(record.font_index) == sizeof(formulon::CellXf::font_index),
+                "fm_cell_xf::font_index width must match formulon::CellXf");
+  static_assert(sizeof(record.fill_index) == sizeof(formulon::CellXf::fill_index),
+                "fm_cell_xf::fill_index width must match formulon::CellXf");
+  static_assert(sizeof(record.border_index) == sizeof(formulon::CellXf::border_index),
+                "fm_cell_xf::border_index width must match formulon::CellXf");
+  static_assert(sizeof(record.num_fmt_id) == sizeof(formulon::CellXf::num_fmt_id),
+                "fm_cell_xf::num_fmt_id width must match formulon::CellXf");
+
+  formulon::CellXf candidate = cell_xf_from_c(record, record.xf_id);
+  const std::string candidate_key = cell_xf_key(candidate);
+  for (std::size_t i = 0; i < styles.cell_xfs.size(); ++i) {
+    if (cell_xf_key(styles.cell_xfs[i]) == candidate_key) {
+      *out_xf_index = static_cast<uint32_t>(i);
+      return 0;
+    }
+  }
+  styles.cell_xfs.push_back(candidate);
+  *out_xf_index = static_cast<uint32_t>(styles.cell_xfs.size() - 1);
+  return 0;
+}
+
+}  // namespace
+
+extern "C" fm_status_t fm_styles_add_cell_xf(fm_workbook_t* wb, fm_cell_xf record, uint32_t* out_xf_index) {
+  clear_last_error();
+  return add_cell_xf_impl(wb, record, out_xf_index, "fm_styles_add_cell_xf");
+}
+
+extern "C" fm_status_t fm_styles_add_cell_style_xf(fm_workbook_t* wb, fm_cell_xf record, uint32_t* out_xf_id) {
+  clear_last_error();
+  if (wb == nullptr || out_xf_id == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_styles_add_cell_style_xf: NULL argument");
+  }
+  if (fm_status_t rc = validate_xf_alignment(record, "fm_styles_add_cell_style_xf"); rc != 0) {
+    return rc;
+  }
+  auto& styles = wb->workbook().mutable_styles();
+  ensure_default_style_roots(styles);
+  if (fm_status_t rc = validate_xf_references(styles, record, "fm_styles_add_cell_style_xf"); rc != 0) {
+    return rc;
+  }
+  formulon::CellXf candidate = cell_xf_from_c(record, 0U);
+  const std::string candidate_key = cell_xf_key(candidate);
+  for (std::size_t i = 0; i < styles.cell_style_xfs.size(); ++i) {
+    if (cell_xf_key(styles.cell_style_xfs[i]) == candidate_key) {
+      *out_xf_id = static_cast<uint32_t>(i);
+      return 0;
+    }
+  }
+  styles.cell_style_xfs.push_back(std::move(candidate));
+  *out_xf_id = static_cast<uint32_t>(styles.cell_style_xfs.size() - 1U);
+  return 0;
+}
+
+extern "C" fm_status_t fm_styles_set_cell_style(fm_workbook_t* wb, const fm_cell_style_record_t* record) {
+  clear_last_error();
+  if (wb == nullptr || record == nullptr || record->name == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_styles_set_cell_style: NULL argument");
+  }
+  auto& styles = wb->workbook().mutable_styles();
+  if (record->name[0] == '\0' || record->xf_id >= styles.cell_style_xfs.size()) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             "fm_styles_set_cell_style: invalid name or xf_id");
+  }
+  // Anything past the OOXML ordinal space must use the sentinel, which
+  // suppresses the attribute instead of writing an unknown ordinal.
+  const uint32_t builtin_id = record->builtin_id;
+  if (builtin_id > formulon::CellStyleRecord::kBuiltinIdMax && builtin_id != FM_CELL_STYLE_BUILTIN_ID_NONE) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             "fm_styles_set_cell_style: builtin_id out of range",
+                             "builtin_id=" + std::to_string(builtin_id));
+  }
+  // Only RowLevel_n / ColLevel_n carry an outline level.
+  const uint32_t max_level = (builtin_id == 1U || builtin_id == 2U) ? 6U : 0U;
+  if (record->i_level > max_level) {
+    return set_binding_error(
+        formulon::FormulonErrorCode::kInvalidArgument, "fm_styles_set_cell_style: i_level out of range",
+        "builtin_id=" + std::to_string(builtin_id) + " i_level=" + std::to_string(record->i_level));
+  }
+  formulon::CellStyleRecord style;
+  style.name = record->name;
+  style.xf_id = record->xf_id;
+  style.builtin_id = builtin_id;
+  style.i_level = record->i_level;
+  style.hidden = record->hidden != 0;
+  style.custom_builtin = record->custom_builtin != 0;
+  for (auto& existing : styles.cell_styles) {
+    if (existing.name == style.name) {
+      existing = std::move(style);
+      return 0;
+    }
+  }
+  styles.cell_styles.push_back(std::move(style));
+  return 0;
+}
+
+extern "C" fm_status_t fm_styles_remove_cell_style(fm_workbook_t* wb, const char* name) {
+  clear_last_error();
+  if (wb == nullptr || name == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_styles_remove_cell_style: NULL argument");
+  }
+  auto r = formulon::remove_cell_style(wb->workbook().mutable_styles(), name);
+  if (!r) {
+    return set_last_error(r.error());
+  }
+  return 0;
+}
+
+extern "C" fm_status_t fm_styles_add_batch(fm_workbook_t* wb, const fm_styles_batch* batch) {
+  clear_last_error();
+  if (wb == nullptr || batch == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_batch: NULL argument");
+  }
+  if ((batch->font_count != 0U && (batch->fonts == nullptr || batch->font_indices == nullptr)) ||
+      (batch->fill_count != 0U && (batch->fills == nullptr || batch->fill_indices == nullptr)) ||
+      (batch->border_count != 0U && (batch->borders == nullptr || batch->border_indices == nullptr)) ||
+      (batch->cell_xf_count != 0U && (batch->cell_xfs == nullptr || batch->cell_xf_indices == nullptr)) ||
+      (batch->num_fmt_count != 0U && (batch->num_fmt_codes == nullptr || batch->num_fmt_ids == nullptr))) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_styles_add_batch: non-empty array is NULL");
+  }
+
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+  // Stage every mutation, including the default roots that are required for
+  // a valid xf. StylesTable owns strings and all nested records by value, so
+  // this is a deep copy. The live table and caller-owned output arrays remain
+  // untouched until every input record has passed validation.
+  formulon::StylesTable staged = styles;
+  ensure_default_style_roots(staged);
+
+  std::vector<uint32_t> staged_font_indices(batch->font_count);
+  std::vector<uint32_t> staged_fill_indices(batch->fill_count);
+  std::vector<uint32_t> staged_border_indices(batch->border_count);
+  std::vector<uint32_t> staged_cell_xf_indices(batch->cell_xf_count);
+  std::vector<uint16_t> staged_num_fmt_ids(batch->num_fmt_count);
+
+  std::unordered_map<std::string, uint32_t> fonts;
+  std::unordered_map<std::string, uint32_t> fills;
+  std::unordered_map<std::string, uint32_t> borders;
+  fonts.reserve(staged.fonts.size() + batch->font_count);
+  fills.reserve(staged.fills.size() + batch->fill_count);
+  borders.reserve(staged.borders.size() + batch->border_count);
+  for (uint32_t i = 0; i < staged.fonts.size(); ++i)
+    fonts.emplace(font_key(staged.fonts[i]), i);
+  for (uint32_t i = 0; i < staged.fills.size(); ++i)
+    fills.emplace(fill_key(staged.fills[i]), i);
+  for (uint32_t i = 0; i < staged.borders.size(); ++i)
+    borders.emplace(border_key(staged.borders[i]), i);
+  for (size_t i = 0; i < batch->font_count; ++i) {
+    formulon::FontRecord value = font_from_c(batch->fonts[i]);
+    const std::string key = font_key(value);
+    const auto [it, inserted] = fonts.emplace(key, static_cast<uint32_t>(staged.fonts.size()));
+    if (inserted)
+      staged.fonts.push_back(std::move(value));
+    staged_font_indices[i] = it->second;
+  }
+  for (size_t i = 0; i < batch->fill_count; ++i) {
+    formulon::FillRecord value = fill_from_c(batch->fills[i]);
+    const std::string key = fill_key(value);
+    const auto [it, inserted] = fills.emplace(key, static_cast<uint32_t>(staged.fills.size()));
+    if (inserted)
+      staged.fills.push_back(value);
+    staged_fill_indices[i] = it->second;
+  }
+  for (size_t i = 0; i < batch->border_count; ++i) {
+    formulon::BorderRecord value = border_from_c(batch->borders[i]);
+    const std::string key = border_key(value);
+    const auto [it, inserted] = borders.emplace(key, static_cast<uint32_t>(staged.borders.size()));
+    if (inserted)
+      staged.borders.push_back(value);
+    staged_border_indices[i] = it->second;
+  }
+  std::unordered_map<std::string, uint16_t> num_fmts;
+  num_fmts.reserve(staged.num_fmts.size() + batch->num_fmt_count);
+  std::uint32_t next_num_fmt_id = 163U;
+  for (const formulon::NumFmtRecord& record : staged.num_fmts) {
+    const std::optional<std::string_view> resolved = effective_num_fmt(staged, record.id);
+    if (record.format_string_index < staged.num_fmt_strings.size() && resolved.has_value() &&
+        *resolved == staged.num_fmt_strings[record.format_string_index]) {
+      num_fmts.emplace(staged.num_fmt_strings[record.format_string_index], record.id);
+    }
+    if (record.id > next_num_fmt_id) {
+      next_num_fmt_id = record.id;
+    }
+  }
+  for (size_t i = 0; i < batch->num_fmt_count; ++i) {
+    const std::string code = batch->num_fmt_codes[i] != nullptr ? batch->num_fmt_codes[i] : "";
+    uint16_t builtin_id = 0U;
+    bool is_builtin = false;
+    for (uint16_t id = 0U; id < 164U; ++id) {
+      const std::optional<std::string_view> resolved = effective_num_fmt(staged, id);
+      if (resolved.has_value() && code == *resolved) {
+        builtin_id = id;
+        is_builtin = true;
+        break;
+      }
+    }
+    if (is_builtin) {
+      staged_num_fmt_ids[i] = builtin_id;
+      continue;
+    }
+    const auto existing = num_fmts.find(code);
+    if (existing != num_fmts.end()) {
+      staged_num_fmt_ids[i] = existing->second;
+      continue;
+    }
+    if (next_num_fmt_id >= std::numeric_limits<std::uint16_t>::max()) {
+      return set_binding_error(formulon::FormulonErrorCode::kPreconditionFailed,
+                               "fm_styles_add_batch: custom numFmtId space exhausted",
+                               "max_num_fmt_id=" + std::to_string(std::numeric_limits<std::uint16_t>::max()));
+    }
+    const std::uint32_t candidate_num_fmt_id = next_num_fmt_id + 1U;
+    num_fmts.emplace(code, static_cast<std::uint16_t>(candidate_num_fmt_id));
+    ++next_num_fmt_id;
+    staged.num_fmt_strings.push_back(code);
+    formulon::NumFmtRecord record;
+    record.id = static_cast<std::uint16_t>(next_num_fmt_id);
+    record.format_string_index = static_cast<uint32_t>(staged.num_fmt_strings.size() - 1U);
+    staged.num_fmts.push_back(record);
+    staged_num_fmt_ids[i] = record.id;
+  }
+  ensure_default_cell_xf(staged);
+  std::unordered_map<std::string, uint32_t> xfs;
+  xfs.reserve(staged.cell_xfs.size() + batch->cell_xf_count);
+  for (uint32_t i = 0; i < staged.cell_xfs.size(); ++i)
+    xfs.emplace(cell_xf_key(staged.cell_xfs[i]), i);
+  for (size_t i = 0; i < batch->cell_xf_count; ++i) {
+    const fm_cell_xf& record = batch->cell_xfs[i];
+    if (fm_status_t rc = validate_xf_alignment(record, "fm_styles_add_batch"); rc != 0) {
+      return rc;
+    }
+    if (fm_status_t rc = validate_xf_references(staged, record, "fm_styles_add_batch"); rc != 0) {
+      return rc;
+    }
+    // The batch shares the single-record presence-flag contract; `xfId` is
+    // staged as given so a batch may point at a named style added earlier,
+    // and is rejected when it would dangle.
+    if (record.xf_id != 0 && record.xf_id >= staged.cell_style_xfs.size()) {
+      return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "fm_styles_add_batch: xf_id out of range",
+                               "xf_id=" + std::to_string(record.xf_id) +
+                                   " cell_style_xfs_count=" + std::to_string(staged.cell_style_xfs.size()));
+    }
+    const formulon::CellXf value = cell_xf_from_c(record, record.xf_id);
+    const std::string key = cell_xf_key(value);
+    const auto [it, inserted] = xfs.emplace(key, static_cast<uint32_t>(staged.cell_xfs.size()));
+    if (inserted)
+      staged.cell_xfs.push_back(value);
+    staged_cell_xf_indices[i] = it->second;
+  }
+
+  // Commit the complete staged table and publish output indices only after
+  // all records have succeeded. A failed batch therefore leaves both the
+  // workbook and every caller-provided sentinel byte-identical.
+  styles = std::move(staged);
+  for (size_t i = 0; i < batch->font_count; ++i)
+    batch->font_indices[i] = staged_font_indices[i];
+  for (size_t i = 0; i < batch->fill_count; ++i)
+    batch->fill_indices[i] = staged_fill_indices[i];
+  for (size_t i = 0; i < batch->border_count; ++i)
+    batch->border_indices[i] = staged_border_indices[i];
+  for (size_t i = 0; i < batch->cell_xf_count; ++i)
+    batch->cell_xf_indices[i] = staged_cell_xf_indices[i];
+  for (size_t i = 0; i < batch->num_fmt_count; ++i)
+    batch->num_fmt_ids[i] = staged_num_fmt_ids[i];
+  return 0;
+}
+
+extern "C" fm_status_t fm_styles_add_dxf(fm_workbook_t* wb, fm_dxf_record record, uint32_t* out_dxf_index) {
+  clear_last_error();
+  if (wb == nullptr || out_dxf_index == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_styles_add_dxf: NULL argument");
+  }
+
+  formulon::DifferentialFormat candidate;
+  candidate.has_font = record.font_engaged != 0;
+  if (candidate.has_font) {
+    candidate.font = font_from_c(record.font);
+  }
+  candidate.has_fill = record.fill_engaged != 0;
+  if (candidate.has_fill) {
+    candidate.fill = fill_from_c(record.fill);
+  }
+  candidate.has_border = record.border_engaged != 0;
+  if (candidate.has_border) {
+    candidate.border = border_from_c(record.border);
+  }
+  candidate.has_num_fmt = record.num_fmt_engaged != 0;
+  if (candidate.has_num_fmt) {
+    candidate.num_fmt_id = record.num_fmt_id;
+    candidate.num_fmt_code = (record.num_fmt_code != nullptr) ? std::string(record.num_fmt_code) : std::string();
+  }
+  candidate.alignment_xml = (record.alignment_xml != nullptr) ? std::string(record.alignment_xml) : std::string();
+  candidate.protection_xml = (record.protection_xml != nullptr) ? std::string(record.protection_xml) : std::string();
+
+  formulon::StylesTable& styles = wb->workbook().mutable_styles();
+  for (std::size_t i = 0; i < styles.dxfs.size(); ++i) {
+    if (dxf_records_equal(styles.dxfs[i], candidate)) {
+      *out_dxf_index = static_cast<uint32_t>(i);
+      return 0;
+    }
+  }
+  styles.dxfs.push_back(std::move(candidate));
+  *out_dxf_index = static_cast<uint32_t>(styles.dxfs.size() - 1);
+  return 0;
+}
diff --git a/src/c_api/parts/tables.cpp b/src/c_api/parts/tables.cpp
index e0a764405..b840b7139 100644
--- a/src/c_api/parts/tables.cpp
+++ b/src/c_api/parts/tables.cpp
@@ -5,12 +5,14 @@
 #include <cctype>
 #include <cstddef>
 #include <cstdint>
+#include <optional>
 #include <string>
 #include <string_view>
 #include <utility>
 
 #include "c_api/formulon_c.h"
 #include "c_api/parts/common.h"
+#include "io/auto_filter_xml.h"
 #include "io/xml_escape.h"
 #include "utils/a1_ref.h"
 #include "utils/error.h"
@@ -66,10 +68,8 @@ std::string table_style_xml(std::string_view style_name) {
          "\" showFirstColumn=\"0\" showLastColumn=\"0\" showRowStripes=\"1\" showColumnStripes=\"0\"/>";
 }
 
-// Keep the raw table-level autoFilter payload, changing only its opening
-// element's ref attribute. The reader stores this fragment verbatim because
-// filterColumn criteria and extension payloads are not modelled by the
-// evaluator.
+// Changes only the opening element's ref attribute of an AutoFilter the
+// model could not parse, which is retained verbatim.
 std::string table_auto_filter_xml(std::string_view raw_xml, std::string_view ref) {
   const std::string escaped_ref = xml_attr_escape(ref);
   if (raw_xml.empty()) {
@@ -254,7 +254,8 @@ extern "C" fm_status_t fm_workbook_table_create(fm_workbook_t* wb, size_t sheet_
     column.name = column_names[i];
     table.columns.push_back(std::move(column));
   }
-  table.auto_filter_xml = "<autoFilter ref=\"" + xml_attr_escape(table.ref) + "\"/>";
+  table.auto_filter_xml.set(
+      formulon::io::auto_filter_from_xml("<autoFilter ref=\"" + xml_attr_escape(table.ref) + "\"/>"));
   table.table_style_info_xml = table_style_xml(style_name != nullptr ? style_name : "");
   auto& tables = book.mutable_tables();
   tables.push_back(std::move(table));
@@ -292,7 +293,15 @@ extern "C" fm_status_t fm_workbook_table_update(fm_workbook_t* wb, size_t index,
   // particular, a raw style payload survives a NULL style_name, while an
   // empty string explicitly removes it.
   const std::string next_ref = ref;
-  const std::string next_auto_filter_xml = table_auto_filter_xml(table.auto_filter_xml, next_ref);
+  formulon::AutoFilterSlot next_auto_filter = table.auto_filter_xml;
+  const std::optional<formulon::MergeRange> next_range = formulon::parse_a1_rectangle(next_ref);
+  if (formulon::AutoFilter* filter = next_auto_filter.get();
+      filter != nullptr && !filter->is_opaque() && next_range.has_value()) {
+    filter->range = *next_range;
+  } else {
+    next_auto_filter.set(formulon::io::auto_filter_from_xml(
+        table_auto_filter_xml(formulon::io::auto_filter_xml(next_auto_filter.get()), next_ref)));
+  }
   const std::string next_style_xml = style_name == nullptr ? table.table_style_info_xml : table_style_xml(style_name);
   const bool next_header_row = header_row < 0 ? table.header_row : header_row > 0;
   const bool next_totals_row = totals_row < 0 ? table.totals_row : totals_row > 0;
@@ -300,13 +309,14 @@ extern "C" fm_status_t fm_workbook_table_update(fm_workbook_t* wb, size_t index,
   table.ref = next_ref;
   table.header_row = next_header_row;
   table.totals_row = next_totals_row;
-  table.auto_filter_xml = next_auto_filter_xml;
+  table.auto_filter_xml = std::move(next_auto_filter);
   table.table_style_info_xml = next_style_xml;
   // The `ref` just changed, so every structured reference into this table
   // resolves to a different rectangle (`eval/dep_extractor.cpp`); reindex
   // the formulas that name it rather than leave their dep-graph edges and
   // cached values pointing at the pre-edit extent.
   wb->workbook().reindex_formulas_for_table_change({table.name, table.display_name});
+  wb->workbook().mark_row_visibility_dependents_dirty();
   return 0;
 }
 
@@ -328,5 +338,8 @@ extern "C" fm_status_t fm_workbook_table_remove(fm_workbook_t* wb, size_t index)
   const std::string removed_display_name = tables[index].display_name;
   tables.erase(tables.begin() + static_cast<std::ptrdiff_t>(index));
   wb->workbook().reindex_formulas_for_table_change({removed_name, removed_display_name});
+  // The removed table's AutoFilter may have been the sheet's only one with
+  // criteria.
+  wb->workbook().mark_row_visibility_dependents_dirty();
   return 0;
 }
diff --git a/src/c_api/parts/theme.cpp b/src/c_api/parts/theme.cpp
new file mode 100644
index 000000000..b0188dc3e
--- /dev/null
+++ b/src/c_api/parts/theme.cpp
@@ -0,0 +1,197 @@
+//
+// C ABI - workbook theme, colour resolution and effective cell style.
+
+#include "theme.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "color_resolve.h"
+#include "sheet.h"
+#include "style_resolve.h"
+#include "styles.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+using formulon::c_api::parts::check_enum_domain;
+using formulon::c_api::parts::check_finite;
+using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::clear_last_error;
+using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::set_last_error;
+using formulon::c_api::parts::TextStore;
+
+namespace {
+
+static_assert(sizeof(fm_theme_colors::argb) / sizeof(fm_theme_colors::argb[0]) == formulon::kThemeColorCount,
+              "fm_theme_colors must carry every scheme colour");
+static_assert(FM_COLOR_CONTEXT_FONT == static_cast<int>(formulon::ColorContext::kFont), "colour context drift");
+static_assert(FM_COLOR_CONTEXT_FILL_FG == static_cast<int>(formulon::ColorContext::kFillForeground),
+              "colour context drift");
+static_assert(FM_COLOR_CONTEXT_FILL_BG == static_cast<int>(formulon::ColorContext::kFillBackground),
+              "colour context drift");
+static_assert(FM_COLOR_CONTEXT_BORDER == static_cast<int>(formulon::ColorContext::kBorder), "colour context drift");
+static_assert(FM_COLOR_RESOLUTION_EXACT == static_cast<int>(formulon::ColorResolution::kExact),
+              "colour resolution drift");
+static_assert(FM_COLOR_RESOLUTION_DEFAULT_THEME == static_cast<int>(formulon::ColorResolution::kDefaultTheme),
+              "colour resolution drift");
+static_assert(FM_COLOR_RESOLUTION_INDEX_OUT_OF_RANGE == static_cast<int>(formulon::ColorResolution::kIndexOutOfRange),
+              "colour resolution drift");
+static_assert(FM_COLOR_RESOLUTION_THEME_UNPARSEABLE == static_cast<int>(formulon::ColorResolution::kThemeUnparseable),
+              "colour resolution drift");
+static_assert(FM_COLOR_RESOLUTION_AUTO_CONTEXT == static_cast<int>(formulon::ColorResolution::kAutoContext),
+              "colour resolution drift");
+
+}  // namespace
+
+extern "C" fm_status_t fm_workbook_get_theme_colors(const fm_workbook_t* wb, fm_theme_colors* out,
+                                                    int32_t* out_source) {
+  clear_last_error();
+  if (wb == nullptr || out == nullptr || out_source == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_get_theme_colors: NULL argument");
+  }
+  const formulon::LoadedTheme loaded = wb->workbook().load_theme();
+  for (std::size_t i = 0; i < formulon::kThemeColorCount; ++i) {
+    out->argb[i] = loaded.theme.colors[i];
+  }
+  *out_source = static_cast<int32_t>(loaded.source);
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_set_theme_colors(fm_workbook_t* wb, const fm_theme_colors* colors) {
+  clear_last_error();
+  if (wb == nullptr || colors == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_set_theme_colors: NULL argument");
+  }
+  formulon::ThemeColors model{};
+  for (std::size_t i = 0; i < formulon::kThemeColorCount; ++i) {
+    model[i] = colors->argb[i];
+  }
+  auto r = wb->workbook().set_theme_colors(model);
+  if (!r) {
+    return set_last_error(r.error());
+  }
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_get_theme_fonts(const fm_workbook_t* wb, fm_theme_fonts* out) {
+  clear_last_error();
+  if (wb == nullptr || out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_get_theme_fonts: NULL argument");
+  }
+  formulon::ThemeFonts fonts = wb->workbook().load_theme().theme.fonts;
+  TextStore& store = const_cast<TextStore&>(wb->read_scratch);
+  store.clear();
+  store.emplace_back(std::move(fonts.major_latin));
+  out->major_latin = store.back().c_str();
+  store.emplace_back(std::move(fonts.major_ea));
+  out->major_east_asian = store.back().c_str();
+  store.emplace_back(std::move(fonts.minor_latin));
+  out->minor_latin = store.back().c_str();
+  store.emplace_back(std::move(fonts.minor_ea));
+  out->minor_east_asian = store.back().c_str();
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_set_theme_fonts(fm_workbook_t* wb, const fm_theme_fonts* fonts) {
+  clear_last_error();
+  if (wb == nullptr || fonts == nullptr || fonts->major_latin == nullptr || fonts->major_east_asian == nullptr ||
+      fonts->minor_latin == nullptr || fonts->minor_east_asian == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_set_theme_fonts: NULL argument");
+  }
+  formulon::ThemeFonts model;
+  model.major_latin = fonts->major_latin;
+  model.major_ea = fonts->major_east_asian;
+  model.minor_latin = fonts->minor_latin;
+  model.minor_ea = fonts->minor_east_asian;
+  auto r = wb->workbook().set_theme_fonts(model);
+  if (!r) {
+    return set_last_error(r.error());
+  }
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_resolve_color(const fm_workbook_t* wb, fm_color_spec spec, int32_t context,
+                                                 uint32_t* out_argb, int32_t* out_resolution) {
+  static constexpr const char* kFn = "fm_workbook_resolve_color";
+  clear_last_error();
+  if (wb == nullptr || out_argb == nullptr || out_resolution == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_resolve_color: NULL argument");
+  }
+  if (auto rc = check_enum_domain(context, static_cast<std::int64_t>(formulon::ColorContext::kBorder), kFn, "context");
+      rc != 0) {
+    return rc;
+  }
+  if (auto rc =
+          check_enum_domain(spec.kind, static_cast<std::int64_t>(formulon::ColorSpec::Kind::kAuto), kFn, "spec.kind");
+      rc != 0) {
+    return rc;
+  }
+  formulon::ColorSpec model;
+  model.kind = static_cast<formulon::ColorSpec::Kind>(spec.kind);
+  model.rgb = spec.rgb;
+  model.theme = spec.theme;
+  model.indexed = spec.indexed;
+  if (model.kind == formulon::ColorSpec::Kind::kTheme) {
+    if (auto rc = check_finite(spec.tint, kFn, "spec.tint"); rc != 0) {
+      return rc;
+    }
+    model.tint = spec.tint;
+  }
+  const formulon::ResolvedColor resolved =
+      formulon::resolve_color(wb->workbook(), model, static_cast<formulon::ColorContext>(context));
+  *out_argb = resolved.argb;
+  *out_resolution = static_cast<int32_t>(resolved.resolution);
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_get_effective_style(const fm_workbook_t* wb, size_t sheet_index, uint32_t row,
+                                                    uint32_t col, fm_effective_style* out) {
+  clear_last_error();
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_get_effective_style: NULL argument");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_get_effective_style"); rc != 0) {
+    return rc;
+  }
+  if (!formulon::Sheet::coord_in_grid(row, col)) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             "fm_sheet_get_effective_style: cell coordinate out of range",
+                             "row=" + std::to_string(row) + " col=" + std::to_string(col));
+  }
+  const formulon::Workbook& workbook = wb->workbook();
+  formulon::EffectiveStyle style = formulon::effective_style(workbook, workbook.sheet(sheet_index), row, col);
+  *out = fm_effective_style{};
+  out->xf_index = style.xf_index;
+  out->source = static_cast<int32_t>(style.source);
+  out->font_index = style.font_index;
+  out->fill_index = style.fill_index;
+  out->border_index = style.border_index;
+  out->font_argb = style.font_color.argb;
+  out->font_resolution = static_cast<int32_t>(style.font_color.resolution);
+  out->fill_fg_argb = style.fill_foreground.argb;
+  out->fill_fg_resolution = static_cast<int32_t>(style.fill_foreground.resolution);
+  out->fill_bg_argb = style.fill_background.argb;
+  out->fill_bg_resolution = static_cast<int32_t>(style.fill_background.resolution);
+  for (std::size_t i = 0; i < style.border_colors.size(); ++i) {
+    out->border_argb[i] = style.border_colors[i].argb;
+    out->border_resolution[i] = static_cast<int32_t>(style.border_colors[i].resolution);
+  }
+  out->locked = style.locked ? 1 : 0;
+  out->hidden = style.hidden ? 1 : 0;
+  TextStore& store = const_cast<TextStore&>(wb->read_scratch);
+  store.clear();
+  store.emplace_back(std::move(style.num_fmt_code));
+  out->num_fmt_code = store.back().c_str();
+  return 0;
+}
diff --git a/src/c_api/parts/threaded_comments.cpp b/src/c_api/parts/threaded_comments.cpp
new file mode 100644
index 000000000..dcbdaa54f
--- /dev/null
+++ b/src/c_api/parts/threaded_comments.cpp
@@ -0,0 +1,237 @@
+//
+// C ABI - threaded comments (threads, replies, mentions) and the workbook
+// person list they name.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "sheet.h"
+#include "threaded_comment.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::clear_last_error;
+using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::set_last_error;
+
+namespace {
+
+std::string text_or_empty(const char* text) {
+  return text != nullptr ? std::string(text) : std::string();
+}
+
+// Copies `count` caller mentions into the model shape.
+fm_status_t mentions_from_fm(const fm_mention* mentions, uint32_t count, const char* api,
+                             std::vector<formulon::Mention>* out) {
+  if (mentions == nullptr && count != 0U) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             (std::string(api) + ": NULL mentions with a non-zero count").c_str(),
+                             "mention_count=" + std::to_string(count));
+  }
+  for (uint32_t i = 0; i < count; ++i) {
+    formulon::Mention m;
+    m.person_id = text_or_empty(mentions[i].person_id);
+    m.mention_id = text_or_empty(mentions[i].mention_id);
+    m.start = mentions[i].start;
+    m.length = mentions[i].length;
+    out->push_back(std::move(m));
+  }
+  return 0;
+}
+
+fm_status_t forward(const formulon::Expected<void, formulon::Error>& result) {
+  return result ? 0 : set_last_error(result.error());
+}
+
+// Resets the read scratch and the arenas this file publishes through, and
+// returns the handle they belong to.
+fm_workbook_t* reset_scratch(const fm_workbook_t* wb) {
+  fm_workbook_t* scratch = const_cast<fm_workbook_t*>(wb);
+  scratch->read_scratch.clear();
+  scratch->mention_scratch.clear();
+  return scratch;
+}
+
+const char* keep(fm_workbook_t* scratch, const std::string& text) {
+  scratch->read_scratch.emplace_back(text);
+  return scratch->read_scratch.back().c_str();
+}
+
+}  // namespace
+
+extern "C" fm_status_t fm_sheet_threaded_comment_count(const fm_workbook_t* wb, size_t sheet_index, size_t* out_count) {
+  clear_last_error();
+  if (out_count == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_threaded_comment_count: NULL out_count");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_threaded_comment_count"); rc != 0) {
+    return rc;
+  }
+  *out_count = wb->workbook().sheet(sheet_index).threaded_comments().size();
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_threaded_comment_at(const fm_workbook_t* wb, size_t sheet_index, size_t idx,
+                                                    fm_threaded_comment* out) {
+  clear_last_error();
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_threaded_comment_at: NULL out");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_threaded_comment_at"); rc != 0) {
+    return rc;
+  }
+  const auto& list = wb->workbook().sheet(sheet_index).threaded_comments();
+  if (idx >= list.size()) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument,
+                             "fm_sheet_threaded_comment_at: idx out of range",
+                             "idx=" + std::to_string(idx) + " count=" + std::to_string(list.size()));
+  }
+  const formulon::ThreadedComment& c = list[idx];
+  fm_workbook_t* scratch = reset_scratch(wb);
+  std::vector<fm_mention> mentions;
+  mentions.reserve(c.mentions.size());
+  for (const formulon::Mention& m : c.mentions) {
+    mentions.push_back(fm_mention{keep(scratch, m.person_id), keep(scratch, m.mention_id), m.start, m.length});
+  }
+  *out = fm_threaded_comment{};
+  out->id = keep(scratch, c.id);
+  out->row = c.row;
+  out->col = c.col;
+  out->person_id = keep(scratch, c.person_id);
+  out->created = keep(scratch, c.created);
+  out->text = keep(scratch, c.text);
+  out->parent_id = keep(scratch, c.parent_id);
+  out->done = c.done ? 1 : 0;
+  out->mention_count = static_cast<uint32_t>(mentions.size());
+  out->mentions = scratch->mention_scratch.adopt(std::move(mentions));
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_add_threaded_comment(fm_workbook_t* wb, size_t sheet_index,
+                                                     const fm_threaded_comment* comment) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_add_threaded_comment";
+  if (comment == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_add_threaded_comment: NULL comment");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, kApi); rc != 0) {
+    return rc;
+  }
+  formulon::ThreadedComment model;
+  if (auto rc = mentions_from_fm(comment->mentions, comment->mention_count, kApi, &model.mentions); rc != 0) {
+    return rc;
+  }
+  model.id = text_or_empty(comment->id);
+  model.row = comment->row;
+  model.col = comment->col;
+  model.person_id = text_or_empty(comment->person_id);
+  model.created = text_or_empty(comment->created);
+  model.text = text_or_empty(comment->text);
+  model.parent_id = text_or_empty(comment->parent_id);
+  model.done = comment->done != 0;
+  return forward(wb->workbook().add_threaded_comment(sheet_index, std::move(model)));
+}
+
+extern "C" fm_status_t fm_sheet_edit_threaded_comment(fm_workbook_t* wb, size_t sheet_index, const char* id,
+                                                      const char* text, const fm_mention* mentions,
+                                                      uint32_t mention_count) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_edit_threaded_comment";
+  if (id == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_edit_threaded_comment: NULL id");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, kApi); rc != 0) {
+    return rc;
+  }
+  std::vector<formulon::Mention> model;
+  if (auto rc = mentions_from_fm(mentions, mention_count, kApi, &model); rc != 0) {
+    return rc;
+  }
+  return forward(wb->workbook().edit_threaded_comment(sheet_index, id, text_or_empty(text), std::move(model)));
+}
+
+extern "C" fm_status_t fm_sheet_set_thread_resolved(fm_workbook_t* wb, size_t sheet_index, const char* thread_id,
+                                                    int32_t done) {
+  clear_last_error();
+  if (thread_id == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_set_thread_resolved: NULL thread_id");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_set_thread_resolved"); rc != 0) {
+    return rc;
+  }
+  return forward(wb->workbook().set_thread_resolved(sheet_index, thread_id, done != 0));
+}
+
+extern "C" fm_status_t fm_sheet_remove_threaded_comment(fm_workbook_t* wb, size_t sheet_index, const char* id) {
+  clear_last_error();
+  if (id == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_remove_threaded_comment: NULL id");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, "fm_sheet_remove_threaded_comment"); rc != 0) {
+    return rc;
+  }
+  return forward(wb->workbook().remove_threaded_comment(sheet_index, id));
+}
+
+extern "C" fm_status_t fm_workbook_person_count(const fm_workbook_t* wb, size_t* out_count) {
+  clear_last_error();
+  if (wb == nullptr || out_count == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_person_count: NULL argument");
+  }
+  *out_count = wb->workbook().persons().size();
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_person_at(const fm_workbook_t* wb, size_t idx, fm_person* out) {
+  clear_last_error();
+  if (wb == nullptr || out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_workbook_person_at: NULL argument");
+  }
+  const auto& persons = wb->workbook().persons();
+  if (idx >= persons.size()) {
+    return set_binding_error(formulon::FormulonErrorCode::kInvalidArgument, "fm_workbook_person_at: idx out of range",
+                             "idx=" + std::to_string(idx) + " count=" + std::to_string(persons.size()));
+  }
+  const formulon::Person& p = persons[idx];
+  fm_workbook_t* scratch = reset_scratch(wb);
+  out->id = keep(scratch, p.id);
+  out->display_name = keep(scratch, p.display_name);
+  out->user_id = keep(scratch, p.user_id);
+  out->provider_id = keep(scratch, p.provider_id);
+  return 0;
+}
+
+extern "C" fm_status_t fm_workbook_add_person(fm_workbook_t* wb, const fm_person* person) {
+  clear_last_error();
+  if (wb == nullptr || person == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_workbook_add_person: NULL argument");
+  }
+  formulon::Person model;
+  model.id = text_or_empty(person->id);
+  model.display_name = text_or_empty(person->display_name);
+  model.user_id = text_or_empty(person->user_id);
+  model.provider_id = text_or_empty(person->provider_id);
+  return forward(wb->workbook().add_person(std::move(model)));
+}
+
+extern "C" fm_status_t fm_workbook_remove_person(fm_workbook_t* wb, const char* id) {
+  clear_last_error();
+  if (wb == nullptr || id == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_workbook_remove_person: NULL argument");
+  }
+  return forward(wb->workbook().remove_person(id));
+}
diff --git a/src/c_api/parts/validation.cpp b/src/c_api/parts/validation.cpp
new file mode 100644
index 000000000..e9a53525e
--- /dev/null
+++ b/src/c_api/parts/validation.cpp
@@ -0,0 +1,153 @@
+//
+// C ABI - data-validation evaluation: checking a proposed value against the
+// rule covering a cell, and enumerating the cells whose value fails theirs.
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/cell_range.h"
+#include "c_api/parts/common.h"
+#include "cf/validation_eval.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+using formulon::c_api::parts::cell_range_page_size;
+using formulon::c_api::parts::check_cell_cursor;
+using formulon::c_api::parts::check_sheet_index;
+using formulon::c_api::parts::clear_last_error;
+using formulon::c_api::parts::set_binding_error;
+using formulon::c_api::parts::set_last_error;
+using formulon::c_api::parts::value_from_fm;
+
+namespace {
+
+// Cells visited per scan step while looking for invalid ones.
+constexpr std::uint32_t kInvalidScanChunk = 4096U;
+
+// One populated cell copied out of the sheet lock. Text payloads keep
+// aliasing sheet storage, which no mutation can touch during the call.
+struct Candidate {
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::string formula_text;
+  formulon::Value value = formulon::Value::blank();
+};
+
+}  // namespace
+
+extern "C" fm_status_t fm_sheet_validate_value(const fm_workbook_t* wb, size_t sheet_index, uint32_t row, uint32_t col,
+                                               const fm_value_t* proposed, fm_validation_outcome* out) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_validate_value";
+  if (proposed == nullptr || out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer,
+                             "fm_sheet_validate_value: NULL argument");
+  }
+  if (auto rc = check_sheet_index(wb, sheet_index, kApi); rc != 0) {
+    return rc;
+  }
+  formulon::Value value = formulon::Value::blank();
+  if (auto rc = value_from_fm(*proposed, &value, kApi); rc != 0) {
+    return rc;
+  }
+  const formulon::Workbook& book = wb->workbook();
+  auto outcome = formulon::validate_value(book, book.sheet(sheet_index), row, col, value);
+  if (!outcome) {
+    return set_last_error(outcome.error());
+  }
+  *out = fm_validation_outcome{};
+  out->has_rule = outcome.value().has_rule ? 1 : 0;
+  out->valid = outcome.value().valid ? 1 : 0;
+  out->rule_index = outcome.value().rule_index;
+  out->error_style = outcome.value().error_style;
+  return 0;
+}
+
+extern "C" fm_status_t fm_sheet_list_invalid_cells(const fm_workbook_t* wb, size_t sheet_index, uint64_t cursor,
+                                                   uint32_t limit, fm_cell_range_t** out) {
+  clear_last_error();
+  constexpr const char* kApi = "fm_sheet_list_invalid_cells";
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_sheet_list_invalid_cells: NULL out");
+  }
+  *out = nullptr;
+  if (auto rc = check_sheet_index(wb, sheet_index, kApi); rc != 0) {
+    return rc;
+  }
+  if (auto rc = check_cell_cursor(cursor, kApi); rc != 0) {
+    return rc;
+  }
+  const formulon::Workbook& book = wb->workbook();
+  const formulon::Sheet& sheet = book.sheet(sheet_index);
+  auto handle = std::unique_ptr<fm_cell_range_t>(new fm_cell_range_t{});
+
+  // Only cells inside some rule's ranges can fail one, so the scan covers
+  // their bounding box.
+  bool any_range = false;
+  formulon::MergeRange box;
+  for (const formulon::DataValidation& rule : sheet.validations()) {
+    for (const formulon::MergeRange& r : rule.ranges) {
+      if (!any_range) {
+        box = r;
+        any_range = true;
+        continue;
+      }
+      box.first_row = std::min(box.first_row, r.first_row);
+      box.first_col = std::min(box.first_col, r.first_col);
+      box.last_row = std::max(box.last_row, r.last_row);
+      box.last_col = std::max(box.last_col, r.last_col);
+    }
+  }
+  if (!any_range) {
+    *out = handle.release();
+    return 0;
+  }
+
+  const std::uint32_t page = cell_range_page_size(limit);
+  std::uint64_t scan = cursor;
+  std::vector<Candidate> chunk;
+  while (scan != formulon::Sheet::kCellCursorEnd) {
+    chunk.clear();
+    const std::uint64_t next = sheet.cells_in_range(
+        box.first_row, box.first_col, box.last_row, box.last_col, scan, kInvalidScanChunk,
+        [](const formulon::Sheet::RangeCell& cell, void* ctx) {
+          static_cast<std::vector<Candidate>*>(ctx)->push_back(
+              Candidate{cell.row, cell.col, std::string(cell.formula_text), cell.value});
+        },
+        &chunk);
+    for (const Candidate& candidate : chunk) {
+      auto outcome = formulon::validate_value(book, sheet, candidate.row, candidate.col, candidate.value);
+      if (!outcome) {
+        return set_last_error(outcome.error());
+      }
+      if (!outcome.value().has_rule || outcome.value().valid) {
+        continue;
+      }
+      const std::uint64_t position =
+          static_cast<std::uint64_t>(candidate.row) * formulon::Sheet::kMaxCols + candidate.col;
+      if (handle->entries.size() == page) {
+        // The page is full: the first further invalid cell is where the
+        // next page resumes.
+        handle->next_cursor = position;
+        *out = handle.release();
+        return 0;
+      }
+      formulon::Sheet::RangeCell cell;
+      cell.row = candidate.row;
+      cell.col = candidate.col;
+      cell.formula_text = candidate.formula_text;
+      cell.value = candidate.value;
+      handle->append(cell);
+    }
+    scan = next;
+  }
+  *out = handle.release();
+  return 0;
+}
diff --git a/src/c_api/parts/workbook.cpp b/src/c_api/parts/workbook.cpp
index c3c3a2471..f64050c34 100644
--- a/src/c_api/parts/workbook.cpp
+++ b/src/c_api/parts/workbook.cpp
@@ -110,6 +110,18 @@ fm_status_t save_with_diagnostics_impl(const fm_workbook_t* wb, std::int32_t for
   return 0;
 }
 
+/// Shared body of `fm_workbook_create` / `fm_workbook_create_empty`.
+fm_status_t create_handle(fm_workbook_t** out, formulon::Workbook (*factory)(), const char* null_out_message) {
+  clear_last_error();
+  if (out == nullptr) {
+    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, null_out_message);
+  }
+  auto handle = std::unique_ptr<fm_workbook_t>(new fm_workbook_t{});
+  handle->wb.emplace(factory());
+  *out = handle.release();
+  return 0;
+}
+
 }  // namespace
 
 // ---------------------------------------------------------------------------
@@ -117,25 +129,11 @@ fm_status_t save_with_diagnostics_impl(const fm_workbook_t* wb, std::int32_t for
 // ---------------------------------------------------------------------------
 
 extern "C" fm_status_t fm_workbook_create(fm_workbook_t** out) {
-  clear_last_error();
-  if (out == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_workbook_create: out is NULL");
-  }
-  auto handle = std::unique_ptr<fm_workbook_t>(new fm_workbook_t{});
-  handle->wb.emplace(formulon::Workbook::create());
-  *out = handle.release();
-  return 0;
+  return create_handle(out, &formulon::Workbook::create, "fm_workbook_create: out is NULL");
 }
 
 extern "C" fm_status_t fm_workbook_create_empty(fm_workbook_t** out) {
-  clear_last_error();
-  if (out == nullptr) {
-    return set_binding_error(formulon::FormulonErrorCode::kBindingNullPointer, "fm_workbook_create_empty: out is NULL");
-  }
-  auto handle = std::unique_ptr<fm_workbook_t>(new fm_workbook_t{});
-  handle->wb.emplace(formulon::Workbook::create_empty());
-  *out = handle.release();
-  return 0;
+  return create_handle(out, &formulon::Workbook::create_empty, "fm_workbook_create_empty: out is NULL");
 }
 
 extern "C" fm_status_t fm_workbook_load(const uint8_t* bytes, size_t len, fm_workbook_t** out) {
@@ -288,9 +286,7 @@ extern "C" fm_status_t fm_workbook_move_sheet(fm_workbook_t* wb, uint32_t from_i
   }
   // The enumeration cache is keyed by sheet index. Moving sheets can put a
   // different Sheet at a cached index with the same cell revision.
-  wb->cell_enumeration_cache.addresses.clear();
-  wb->cell_enumeration_cache.sheet_index = std::numeric_limits<std::size_t>::max();
-  wb->cell_enumeration_cache.revision = std::numeric_limits<std::uint64_t>::max();
+  wb->cell_enumeration_cache = {};
   return 0;
 }
 
@@ -306,9 +302,7 @@ extern "C" fm_status_t fm_workbook_remove_sheet(fm_workbook_t* wb, uint32_t inde
   // Removing a sheet shifts later sheet indices, so invalidate the
   // index-keyed coordinate cache even though the remaining Sheet objects
   // themselves were not mutated.
-  wb->cell_enumeration_cache.addresses.clear();
-  wb->cell_enumeration_cache.sheet_index = std::numeric_limits<std::size_t>::max();
-  wb->cell_enumeration_cache.revision = std::numeric_limits<std::uint64_t>::max();
+  wb->cell_enumeration_cache = {};
   return 0;
 }
 
diff --git a/src/cell.h b/src/cell.h
index 796610421..539217a29 100644
--- a/src/cell.h
+++ b/src/cell.h
@@ -88,9 +88,9 @@ struct Cell {
   /// alignment). `0` is the default xf and is the value Excel writes when
   /// no `s=` attribute is present on the `<c>` element. The OOXML reader
   /// populates this field from the `s=` attribute; the writer emits it
-  /// back when non-zero. Carried as `std::uint32_t` for parity with the
-  /// `cellXfs` index width (Excel allows up to ~65,000 entries; we leave
-  /// headroom for future widening).
+  /// back when non-zero or explicitly assigned. Carried as `std::uint32_t`
+  /// for parity with the `cellXfs` index width (Excel allows up to ~65,000
+  /// entries; we leave headroom for future widening).
   std::uint32_t xf_index = 0;
   /// The `<phoneticPr>` block attached to the same string item as
   /// `phonetic_runs`. Meaningful only when that vector is non-empty; the
@@ -101,6 +101,11 @@ struct Cell {
   /// Dynamic-array formula: loaded from the file's array-formula form, set by
   /// `Workbook::set_cell_formula` through `eval::may_produce_spill`.
   bool dynamic_array = false;
+  /// True when a caller or reader explicitly assigned this cell's style,
+  /// including an assignment to the default XF (index zero). This keeps an
+  /// explicit blank cell distinct from a row-vector gap materialised while
+  /// growing storage for a later column.
+  bool has_explicit_xf = false;
 };
 
 }  // namespace formulon
diff --git a/src/cf/auto_filter_eval.cpp b/src/cf/auto_filter_eval.cpp
new file mode 100644
index 000000000..a4fc52819
--- /dev/null
+++ b/src/cf/auto_filter_eval.cpp
@@ -0,0 +1,595 @@
+#include "cf/auto_filter_eval.h"
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <functional>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "cf/cf_evaluator.h"
+#include "cf/cf_match.h"
+#include "color_resolve.h"
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "eval/text_format/display_text.h"
+#include "eval/wildcard.h"
+#include "sheet.h"
+#include "style_resolve.h"
+#include "styles.h"
+#include "utils/arena.h"
+#include "utils/date_time.h"
+#include "utils/resource_budget.h"
+#include "utils/status_macros.h"
+#include "utils/strings.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+/// Shared state of one evaluation: the sheet, the evaluator collaborators
+/// and the per-column cell values read once.
+struct Run {
+  const Workbook& wb;
+  const Sheet& sheet;
+  Arena* arena;
+  const eval::FunctionRegistry* registry;
+  const eval::EvalContext* eval_ctx;
+  double today;
+  std::uint32_t first_body_row;
+  std::uint32_t body_rows;
+};
+
+// --- Text helpers -----------------------------------------------------------
+
+bool is_blank_value(const Value& v) {
+  return v.is_blank() || (v.is_text() && v.as_text().empty());
+}
+
+/// Sort class of one byte in Excel's text order: symbols and spaces, then
+/// digits, then letters, then everything beyond ASCII.
+int collation_class(unsigned char c) {
+  if (c >= 0x80U) {
+    return 3;
+  }
+  if (c >= '0' && c <= '9') {
+    return 1;
+  }
+  const char lower = strings::ascii_to_lower(static_cast<char>(c));
+  if (lower >= 'a' && lower <= 'z') {
+    return 2;
+  }
+  return 0;
+}
+
+/// Case-insensitive text comparison in Excel's sort order (-1 / 0 / +1).
+int collate(std::string_view a, std::string_view b) {
+  const std::size_t n = std::min(a.size(), b.size());
+  for (std::size_t i = 0; i < n; ++i) {
+    const auto ca = static_cast<unsigned char>(strings::ascii_to_lower(a[i]));
+    const auto cb = static_cast<unsigned char>(strings::ascii_to_lower(b[i]));
+    if (ca == cb) {
+      continue;
+    }
+    const int ka = collation_class(ca);
+    const int kb = collation_class(cb);
+    if (ka != kb) {
+      return ka < kb ? -1 : 1;
+    }
+    return ca < cb ? -1 : 1;
+  }
+  if (a.size() != b.size()) {
+    return a.size() < b.size() ? -1 : 1;
+  }
+  return 0;
+}
+
+/// Parses a criterion value as a number; the whole string must be numeric.
+std::optional<double> parse_number(std::string_view text) {
+  if (text.empty()) {
+    return std::nullopt;
+  }
+  const std::string owned(text);
+  char* end = nullptr;
+  const double v = std::strtod(owned.c_str(), &end);
+  if (end != owned.c_str() + owned.size() || !std::isfinite(v)) {
+    return std::nullopt;
+  }
+  return v;
+}
+
+bool ordered(FilterOperator op, int cmp) {
+  switch (op) {
+    case FilterOperator::kLessThan:
+      return cmp < 0;
+    case FilterOperator::kLessThanOrEqual:
+      return cmp <= 0;
+    case FilterOperator::kGreaterThanOrEqual:
+      return cmp >= 0;
+    case FilterOperator::kGreaterThan:
+      return cmp > 0;
+    case FilterOperator::kEqual:
+      return cmp == 0;
+    case FilterOperator::kNotEqual:
+      return cmp != 0;
+  }
+  return false;
+}
+
+// --- Per-kind matchers ------------------------------------------------------
+
+bool match_date_group(const DateGroupItem& g, double serial, bool date1904) {
+  if (serial < 0.0) {
+    return false;
+  }
+  const date_time::YMD ymd = date_time::ymd_from_serial(std::floor(serial), date1904);
+  const date_time::HMS hms = date_time::hms_from_fraction(serial);
+  if (ymd.y != static_cast<int>(g.year)) {
+    return false;
+  }
+  if (g.grouping >= DateTimeGrouping::kMonth && ymd.m != g.month) {
+    return false;
+  }
+  if (g.grouping >= DateTimeGrouping::kDay && ymd.d != g.day) {
+    return false;
+  }
+  if (g.grouping >= DateTimeGrouping::kHour && hms.h != g.hour) {
+    return false;
+  }
+  if (g.grouping >= DateTimeGrouping::kMinute && hms.m != g.minute) {
+    return false;
+  }
+  return g.grouping < DateTimeGrouping::kSecond || hms.s == g.second;
+}
+
+bool match_values(const ValueFilters& f, const Run& run, std::uint32_t row, std::uint32_t col, const Value& v) {
+  const text_format::DisplayText shown = text_format::format_cell_for_display(run.wb, run.sheet, row, col);
+  if (shown.status == text_format::DisplayStatus::kOverflow) {
+    return false;
+  }
+  if (shown.text.empty()) {
+    return f.blank;
+  }
+  for (const std::string& want : f.values) {
+    if (strings::case_insensitive_eq(want, shown.text)) {
+      return true;
+    }
+  }
+  if (v.is_number()) {
+    for (const DateGroupItem& g : f.date_groups) {
+      if (match_date_group(g, v.as_number(), run.wb.date1904())) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+/// Equality of one custom condition: a single space (or nothing) names the
+/// blank cell, wildcards apply to text only, and a numeric literal compares
+/// numerically against numbers.
+bool custom_equals(const CustomFilter& c, const Value& v, const Run& run, std::uint32_t row, std::uint32_t col) {
+  if (c.val.empty() || c.val == " ") {
+    return is_blank_value(v);
+  }
+  if (is_blank_value(v)) {
+    return false;
+  }
+  if (v.is_number()) {
+    const std::optional<double> n = parse_number(c.val);
+    return n.has_value() && !eval::scan_has_wildcard(c.val) && *n == v.as_number();
+  }
+  if (v.is_text()) {
+    return eval::wildcard_match(c.val, v.as_text());
+  }
+  const text_format::DisplayText shown = text_format::format_cell_for_display(run.wb, run.sheet, row, col);
+  return eval::wildcard_match(c.val, shown.text);
+}
+
+bool match_custom_one(const CustomFilter& c, const Value& v, const Run& run, std::uint32_t row, std::uint32_t col) {
+  if (c.op == FilterOperator::kEqual) {
+    return custom_equals(c, v, run, row, col);
+  }
+  if (c.op == FilterOperator::kNotEqual) {
+    return !custom_equals(c, v, run, row, col);
+  }
+  if (const std::optional<double> n = parse_number(c.val)) {
+    if (!v.is_number()) {
+      return false;
+    }
+    const double x = v.as_number();
+    return ordered(c.op, x < *n ? -1 : (x > *n ? 1 : 0));
+  }
+  if (!v.is_text() || v.as_text().empty()) {
+    return false;
+  }
+  return ordered(c.op, collate(v.as_text(), c.val));
+}
+
+bool match_custom(const CustomFilters& f, const Value& v, const Run& run, std::uint32_t row, std::uint32_t col) {
+  if (f.filters.empty()) {
+    return true;
+  }
+  bool result = match_custom_one(f.filters[0], v, run, row, col);
+  for (std::size_t i = 1; i < f.filters.size(); ++i) {
+    const bool next = match_custom_one(f.filters[i], v, run, row, col);
+    result = f.and_join ? (result && next) : (result || next);
+  }
+  return result;
+}
+
+/// The value a cell must reach to be in the top / bottom set: the k-th
+/// number in rank order, so every tie with it is kept. Percent counts round
+/// down and keep at least one item.
+std::optional<double> top10_threshold(const Top10Filter& f, std::vector<double> numbers) {
+  if (numbers.empty() || !(f.val > 0.0)) {
+    return std::nullopt;
+  }
+  const double n = static_cast<double>(numbers.size());
+  double count = f.percent ? std::floor(n * f.val / 100.0) : std::floor(f.val);
+  count = std::max(1.0, std::min(count, n));
+  const auto k = static_cast<std::size_t>(count);
+  std::sort(numbers.begin(), numbers.end());
+  return f.top ? numbers[numbers.size() - k] : numbers[k - 1U];
+}
+
+/// Half-open serial interval `[lo, hi)` of a calendar-relative filter.
+struct Period {
+  double lo;
+  double hi;
+};
+
+double month_start(int y, int m, bool date1904) {
+  // Normalises month offsets outside 1..12 into the neighbouring years.
+  const int zero_based = (y * 12) + (m - 1);
+  const int ny = zero_based >= 0 ? zero_based / 12 : -((-zero_based + 11) / 12);
+  const int nm = zero_based - (ny * 12) + 1;
+  return date_time::serial_from_ymd(ny, static_cast<unsigned>(nm), 1U, date1904);
+}
+
+std::optional<Period> relative_period(DynamicFilterType type, double today, bool date1904) {
+  const date_time::YMD t = date_time::ymd_from_serial(today, date1904);
+  const int y = t.y;
+  const int m = static_cast<int>(t.m);
+  const double week = today - static_cast<double>(date_time::weekday_sun0(today, date1904));
+  const int quarter_month = (((m - 1) / 3) * 3) + 1;
+  switch (type) {
+    case DynamicFilterType::kYesterday:
+      return Period{today - 1.0, today};
+    case DynamicFilterType::kToday:
+      return Period{today, today + 1.0};
+    case DynamicFilterType::kTomorrow:
+      return Period{today + 1.0, today + 2.0};
+    case DynamicFilterType::kLastWeek:
+      return Period{week - 7.0, week};
+    case DynamicFilterType::kThisWeek:
+      return Period{week, week + 7.0};
+    case DynamicFilterType::kNextWeek:
+      return Period{week + 7.0, week + 14.0};
+    case DynamicFilterType::kLastMonth:
+      return Period{month_start(y, m - 1, date1904), month_start(y, m, date1904)};
+    case DynamicFilterType::kThisMonth:
+      return Period{month_start(y, m, date1904), month_start(y, m + 1, date1904)};
+    case DynamicFilterType::kNextMonth:
+      return Period{month_start(y, m + 1, date1904), month_start(y, m + 2, date1904)};
+    case DynamicFilterType::kLastQuarter:
+      return Period{month_start(y, quarter_month - 3, date1904), month_start(y, quarter_month, date1904)};
+    case DynamicFilterType::kThisQuarter:
+      return Period{month_start(y, quarter_month, date1904), month_start(y, quarter_month + 3, date1904)};
+    case DynamicFilterType::kNextQuarter:
+      return Period{month_start(y, quarter_month + 3, date1904), month_start(y, quarter_month + 6, date1904)};
+    case DynamicFilterType::kLastYear:
+      return Period{month_start(y - 1, 1, date1904), month_start(y, 1, date1904)};
+    case DynamicFilterType::kThisYear:
+      return Period{month_start(y, 1, date1904), month_start(y + 1, 1, date1904)};
+    case DynamicFilterType::kNextYear:
+      return Period{month_start(y + 1, 1, date1904), month_start(y + 2, 1, date1904)};
+    case DynamicFilterType::kYearToDate:
+      return Period{month_start(y, 1, date1904), today + 1.0};
+    default:
+      return std::nullopt;
+  }
+}
+
+bool match_dynamic(const DynamicFilter& f, const Value& v, const Run& run, std::optional<double> average) {
+  if (f.type == DynamicFilterType::kNull) {
+    return true;
+  }
+  if (!v.is_number()) {
+    return false;
+  }
+  const double x = v.as_number();
+  const bool date1904 = run.wb.date1904();
+  switch (f.type) {
+    case DynamicFilterType::kAboveAverage:
+      return average.has_value() && x > *average;
+    case DynamicFilterType::kBelowAverage:
+      return average.has_value() && x < *average;
+    default:
+      break;
+  }
+  if (f.type >= DynamicFilterType::kQ1 && f.type <= DynamicFilterType::kQ4) {
+    if (x < 0.0) {
+      return false;
+    }
+    const unsigned q = static_cast<unsigned>(f.type) - static_cast<unsigned>(DynamicFilterType::kQ1);
+    const unsigned month = date_time::ymd_from_serial(std::floor(x), date1904).m;
+    return (month - 1U) / 3U == q;
+  }
+  if (f.type >= DynamicFilterType::kM1 && f.type <= DynamicFilterType::kM12) {
+    if (x < 0.0) {
+      return false;
+    }
+    const unsigned want = static_cast<unsigned>(f.type) - static_cast<unsigned>(DynamicFilterType::kM1) + 1U;
+    return date_time::ymd_from_serial(std::floor(x), date1904).m == want;
+  }
+  const std::optional<Period> p = relative_period(f.type, run.today, date1904);
+  return p.has_value() && x >= p->lo && x < p->hi;
+}
+
+// --- Colour and icon filters ------------------------------------------------
+
+ColorSpec literal_or_spec(const ColorSpec& spec, std::uint32_t argb) {
+  if (spec.kind != ColorSpec::Kind::kNone || argb == 0U) {
+    return spec;
+  }
+  ColorSpec literal;
+  literal.kind = ColorSpec::Kind::kRgb;
+  literal.rgb = argb;
+  return literal;
+}
+
+bool has_color(const ColorSpec& spec, std::uint32_t argb) {
+  return spec.kind != ColorSpec::Kind::kNone || argb != 0U;
+}
+
+std::uint32_t rgb_of(const Workbook& wb, const ColorSpec& spec, std::uint32_t argb, ColorContext context) {
+  return resolve_color(wb, literal_or_spec(spec, argb), context).argb & 0x00FFFFFFU;
+}
+
+/// Solid colour of a dxf fill: its foreground, else its background.
+std::uint32_t dxf_fill_rgb(const Workbook& wb, const FillRecord& fill) {
+  if (has_color(fill.fg, fill.fg_argb)) {
+    return rgb_of(wb, fill.fg, fill.fg_argb, ColorContext::kFillForeground);
+  }
+  return rgb_of(wb, fill.bg, fill.bg_argb, ColorContext::kFillBackground);
+}
+
+/// The colours a cell shows: its effective style with the first matching
+/// conditional format's fill and font colour laid over it.
+struct CellColors {
+  bool has_fill = false;
+  std::uint32_t fill_rgb = 0;
+  std::uint32_t font_rgb = 0;
+  std::optional<cf::IconRender> icon;
+};
+
+CellColors cell_colors(const Run& run, std::uint32_t row, std::uint32_t col) {
+  CellColors out;
+  const EffectiveStyle style = effective_style(run.wb, run.sheet, row, col);
+  out.has_fill = style.fill_pattern != 0U;
+  out.fill_rgb = style.fill_foreground.argb & 0x00FFFFFFU;
+  out.font_rgb = style.font_color.argb & 0x00FFFFFFU;
+  if (run.sheet.conditional_formats().empty() || run.arena == nullptr || run.eval_ctx == nullptr) {
+    return out;
+  }
+  cf::CFHost host;
+  host.arena = run.arena;
+  host.registry = run.registry;
+  host.eval_ctx = run.eval_ctx;
+  host.today_serial = run.today;
+  bool fill_set = false;
+  bool font_set = false;
+  const auto& dxfs = run.wb.styles().dxfs;
+  for (const cf::CFMatch& m : cf::evaluate_cf_at(run.sheet, CellAddress{row, col}, host)) {
+    if (m.icon_render.has_value() && !out.icon.has_value()) {
+      out.icon = m.icon_render;
+    }
+    if (m.resolved_fill_color.has_value() && !fill_set) {
+      const cf::Color& c = *m.resolved_fill_color;
+      out.fill_rgb = c.is_symbolic()
+                         ? rgb_of(run.wb, c.spec, 0U, ColorContext::kFillForeground)
+                         : (static_cast<std::uint32_t>(c.r) << 16U) | (static_cast<std::uint32_t>(c.g) << 8U) | c.b;
+      out.has_fill = true;
+      fill_set = true;
+    }
+    if (!m.dxf_id.has_value() || *m.dxf_id >= dxfs.size()) {
+      continue;
+    }
+    const DifferentialFormat& dxf = dxfs[*m.dxf_id];
+    if (!fill_set && dxf.has_fill &&
+        (has_color(dxf.fill.fg, dxf.fill.fg_argb) || has_color(dxf.fill.bg, dxf.fill.bg_argb))) {
+      out.fill_rgb = dxf_fill_rgb(run.wb, dxf.fill);
+      out.has_fill = true;
+      fill_set = true;
+    }
+    if (!font_set && dxf.has_font && has_color(dxf.font.color, dxf.font.color_argb)) {
+      out.font_rgb = rgb_of(run.wb, dxf.font.color, dxf.font.color_argb, ColorContext::kFont);
+      font_set = true;
+    }
+  }
+  return out;
+}
+
+/// Colour filters name a dxf. A fill filter whose dxf has no solid fill
+/// selects unfilled cells. Excel stores a font-colour filter's colour as the
+/// dxf's fill foreground, so a dxf font colour is used only when present.
+bool match_color(const ColorFilter& f, const Run& run, std::uint32_t row, std::uint32_t col) {
+  const CellColors colors = cell_colors(run, row, col);
+  const auto& dxfs = run.wb.styles().dxfs;
+  const DifferentialFormat* dxf = (f.dxf_id.has_value() && *f.dxf_id < dxfs.size()) ? &dxfs[*f.dxf_id] : nullptr;
+  if (f.cell_color) {
+    if (dxf == nullptr || !dxf->has_fill || dxf->fill.pattern == 0U) {
+      return !colors.has_fill;
+    }
+    return colors.has_fill && colors.fill_rgb == dxf_fill_rgb(run.wb, dxf->fill);
+  }
+  std::uint32_t want = rgb_of(run.wb, ColorSpec{}, 0U, ColorContext::kFont);
+  if (dxf != nullptr && dxf->has_font && has_color(dxf->font.color, dxf->font.color_argb)) {
+    want = rgb_of(run.wb, dxf->font.color, dxf->font.color_argb, ColorContext::kFont);
+  } else if (dxf != nullptr && dxf->has_fill) {
+    want = dxf_fill_rgb(run.wb, dxf->fill);
+  }
+  return colors.font_rgb == want;
+}
+
+bool match_icon(const IconFilter& f, const Run& run, std::uint32_t row, std::uint32_t col) {
+  const CellColors colors = cell_colors(run, row, col);
+  if (!f.icon_id.has_value()) {
+    return !colors.icon.has_value();
+  }
+  return colors.icon.has_value() && colors.icon->set_name == f.icon_set && colors.icon->icon_index == *f.icon_id;
+}
+
+// --- Column driver ----------------------------------------------------------
+
+/// ANDs one filter column's matches into `visible`.
+void apply_column(const FilterColumn& column, const Run& run, std::uint32_t col, std::vector<bool>& visible) {
+  if (column.kind == FilterKind::kNone) {
+    return;
+  }
+  std::vector<Value> values;
+  values.reserve(run.body_rows);
+  std::vector<double> numbers;
+  for (std::uint32_t i = 0; i < run.body_rows; ++i) {
+    values.push_back(run.sheet.resolve_cell_value(run.first_body_row + i, col));
+    if (values.back().is_number()) {
+      numbers.push_back(values.back().as_number());
+    }
+  }
+  std::optional<double> threshold;
+  if (column.kind == FilterKind::kTop10) {
+    threshold = top10_threshold(column.top10, numbers);
+  }
+  std::optional<double> average;
+  if (column.kind == FilterKind::kDynamic && !numbers.empty()) {
+    double sum = 0.0;
+    for (double x : numbers) {
+      sum += x;
+    }
+    average = sum / static_cast<double>(numbers.size());
+  }
+  for (std::uint32_t i = 0; i < run.body_rows; ++i) {
+    if (!visible[i]) {
+      continue;
+    }
+    const std::uint32_t row = run.first_body_row + i;
+    const Value& v = values[i];
+    bool match = true;
+    switch (column.kind) {
+      case FilterKind::kValues:
+        match = match_values(column.values, run, row, col, v);
+        break;
+      case FilterKind::kCustom:
+        match = match_custom(column.custom, v, run, row, col);
+        break;
+      case FilterKind::kTop10:
+        match = threshold.has_value() && v.is_number() &&
+                (column.top10.top ? v.as_number() >= *threshold : v.as_number() <= *threshold);
+        break;
+      case FilterKind::kDynamic:
+        match = match_dynamic(column.dynamic, v, run, average);
+        break;
+      case FilterKind::kColor:
+        match = match_color(column.color, run, row, col);
+        break;
+      case FilterKind::kIcon:
+        match = match_icon(column.icon, run, row, col);
+        break;
+      case FilterKind::kNone:
+        break;
+    }
+    visible[i] = match;
+  }
+}
+
+double today_serial(const eval::EvalContext& ctx, bool date1904) {
+  const date_time::CivilTime now = ctx.wall_clock();
+  return date_time::serial_from_ymd(now.date.y, now.date.m, now.date.d, date1904);
+}
+
+}  // namespace
+
+Expected<std::vector<bool>, Error> evaluate_auto_filter(const Workbook& wb, const Sheet& sheet,
+                                                        const AutoFilter& filter, const AutoFilterEvalDeps& deps) {
+  if (filter.is_opaque()) {
+    return make_error(FormulonErrorCode::kAutoFilterInvalid, "evaluate_auto_filter: AutoFilter is opaque");
+  }
+  RETURN_IF_ERROR(validate_auto_filter(filter));
+
+  // Collaborators the caller did not supply are built here and live for the call.
+  std::optional<Arena> own_arena;
+  eval::EvalState own_state;
+  std::optional<eval::EvalContext> own_ctx;
+  Arena* arena = deps.arena;
+  if (arena == nullptr) {
+    own_arena.emplace(/*initial_chunk_bytes=*/4096, kMaxEvalArenaBytes);
+    arena = &*own_arena;
+  }
+  const eval::EvalContext* ctx = deps.eval_ctx;
+  if (ctx == nullptr) {
+    own_ctx.emplace(eval::EvalContext(wb, sheet, own_state).with_pinned_now(wb.pinned_now()));
+    ctx = &*own_ctx;
+  }
+
+  const MergeRange& range = filter.range;
+  const std::uint32_t body_rows = range.last_row - range.first_row;
+  Run run{wb,
+          sheet,
+          arena,
+          deps.registry != nullptr ? deps.registry : &eval::default_registry(),
+          ctx,
+          today_serial(*ctx, wb.date1904()),
+          range.first_row + 1U,
+          body_rows};
+  std::vector<bool> visible(body_rows, true);
+  for (const FilterColumn& column : filter.columns) {
+    apply_column(column, run, range.first_col + column.col_id, visible);
+  }
+  return visible;
+}
+
+Expected<void, Error> apply_auto_filter(Workbook& wb, std::size_t sheet_index, const AutoFilter& filter,
+                                        const AutoFilterEvalDeps& deps) {
+  if (sheet_index >= wb.sheet_count()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "apply_auto_filter: sheet_index out of range",
+                      "sheet_index=" + std::to_string(sheet_index));
+  }
+  Sheet& sheet = wb.sheet(sheet_index);
+  auto visible = evaluate_auto_filter(wb, sheet, filter, deps);
+  if (!visible) {
+    return visible.error();
+  }
+  const std::uint32_t first = filter.range.first_row + 1U;
+  std::vector<RowLayout>& overrides = sheet.mutable_layout().row_overrides;
+  bool changed = false;
+  for (std::uint32_t i = 0; i < visible.value().size(); ++i) {
+    const std::uint32_t row = first + i;
+    const bool hide = !visible.value()[i];
+    auto it = std::find_if(overrides.begin(), overrides.end(), [row](const RowLayout& r) { return r.row == row; });
+    if (it == overrides.end()) {
+      if (!hide) {
+        continue;
+      }
+      RowLayout fresh;
+      fresh.row = row;
+      overrides.push_back(fresh);
+      it = overrides.end() - 1;
+    }
+    if (it->hidden != hide) {
+      it->hidden = hide;
+      changed = true;
+    }
+  }
+  if (changed) {
+    wb.mark_row_visibility_dependents_dirty();
+  }
+  return Expected<void, Error>::Ok();
+}
+
+}  // namespace formulon
diff --git a/src/cf/auto_filter_eval.h b/src/cf/auto_filter_eval.h
new file mode 100644
index 000000000..199981cb4
--- /dev/null
+++ b/src/cf/auto_filter_eval.h
@@ -0,0 +1,65 @@
+//
+// AutoFilter evaluation: which rows of a filtered range satisfy its criteria.
+//
+// Every body row (the range minus its header row) is matched against each
+// filter column; a row is visible when every column with a criterion matches.
+// `filters` lists compare the cell's displayed text case-insensitively (a cell
+// whose value overflows its format matches no listed value), custom filters
+// use Excel's wildcard dialect on text and numeric comparison on numbers,
+// `top10` and the average filters rank only the numeric cells of the column,
+// and relative-date filters read "today" from the evaluation context's wall
+// clock with weeks starting on Sunday. Colour filters compare the cell's
+// effective fill or font colour, with matching conditional formats applied,
+// against the filter's dxf; icon filters compare the conditional-format icon.
+
+#ifndef FORMULON_CF_AUTO_FILTER_EVAL_H_
+#define FORMULON_CF_AUTO_FILTER_EVAL_H_
+
+#include <cstddef>
+#include <vector>
+
+#include "auto_filter.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon {
+
+class Arena;
+class Sheet;
+class Workbook;
+
+namespace eval {
+class EvalContext;
+class FunctionRegistry;
+}  // namespace eval
+
+/// Collaborators for criteria that need the formula evaluator. Every member
+/// may be null: a null `registry` selects `eval::default_registry()`, and a
+/// null `arena` or `eval_ctx` makes the call build its own, with the clock
+/// pinned to `Workbook::pinned_now()` (the host clock when unpinned).
+struct AutoFilterEvalDeps {
+  Arena* arena = nullptr;
+  const eval::FunctionRegistry* registry = nullptr;
+  /// Supplies "today" for relative-date filters through `wall_clock()`.
+  const eval::EvalContext* eval_ctx = nullptr;
+};
+
+/// Returns one flag per body row of `filter.range` (row `first_row + 1 + i`
+/// at index `i`), true when the row satisfies every column criterion. The
+/// sheet is not modified. Fails with `kAutoFilterInvalid` when `filter` is
+/// opaque or fails `validate_auto_filter`.
+Expected<std::vector<bool>, Error> evaluate_auto_filter(const Workbook& wb, const Sheet& sheet,
+                                                        const AutoFilter& filter, const AutoFilterEvalDeps& deps = {});
+
+/// Evaluates `filter` on sheet `sheet_index` and sets each body row's hidden
+/// flag to the negation of its match, so a matching row hidden by hand is
+/// shown again; rows outside the body are untouched. Row-visibility
+/// dependents (SUBTOTAL / AGGREGATE) are marked dirty when any flag changes.
+/// Fails with `kInvalidArgument` for a bad sheet index, otherwise as
+/// `evaluate_auto_filter`.
+Expected<void, Error> apply_auto_filter(Workbook& wb, std::size_t sheet_index, const AutoFilter& filter,
+                                        const AutoFilterEvalDeps& deps = {});
+
+}  // namespace formulon
+
+#endif  // FORMULON_CF_AUTO_FILTER_EVAL_H_
diff --git a/src/cf/cf_evaluator.cpp b/src/cf/cf_evaluator.cpp
index 6c7802bb5..d501f6495 100644
--- a/src/cf/cf_evaluator.cpp
+++ b/src/cf/cf_evaluator.cpp
@@ -144,11 +144,16 @@ std::vector<CFMatch> evaluate_cf_at_impl(const Sheet& sheet, CellAddress target,
       candidates.push_back({block_idx, rule_idx, blocks[block_idx].rules[rule_idx].priority});
     }
   }
-  std::stable_sort(candidates.begin(), candidates.end(),
-                   [](const Candidate& lhs, const Candidate& rhs) { return lhs.priority < rhs.priority; });
+  std::vector<std::uint32_t> ranked;
+  sorted_index_order(ranked, static_cast<std::uint32_t>(candidates.size()),
+                     IndexLess{&candidates, [](const void* context, std::uint32_t lhs, std::uint32_t rhs) {
+                                 const auto& items = *static_cast<const std::vector<Candidate>*>(context);
+                                 return items[lhs].priority < items[rhs].priority;
+                               }});
 
   const Value cell_value = sheet.resolve_cell_value(target.row, target.col);
-  for (const Candidate& candidate : candidates) {
+  for (const std::uint32_t rank : ranked) {
+    const Candidate& candidate = candidates[rank];
     const ConditionalFormat& block = blocks[candidate.block_index];
     const CFRule& rule = block.rules[candidate.rule_index];
 
diff --git a/src/cf/cf_helpers.cpp b/src/cf/cf_helpers.cpp
index 88b47567a..3ab8bc7e2 100644
--- a/src/cf/cf_helpers.cpp
+++ b/src/cf/cf_helpers.cpp
@@ -15,13 +15,13 @@
 
 #include "cf/cf_evaluator.h"
 #include "cf/cf_types.h"
+#include "eval/builtin_names.h"
 #include "eval/coerce.h"
 #include "eval/eval_context.h"
 #include "eval/scalar_ops.h"
 #include "eval/tree_walker.h"
 #include "parser/ast.h"
 #include "parser/ast_shift.h"
-#include "parser/parser.h"
 #include "sheet.h"
 #include "utils/date_time.h"
 #include "utils/double_parse.h"
@@ -191,9 +191,8 @@ Value parse_shift_evaluate(const std::string& source, const CFEvalContext& ctx)
 
   // The model holds CF formulas in canonical formula-bar spelling (the
   // readers strip Excel's storage prefixes on load), without a leading `=`.
-  parser::Parser parser(source, *ctx.arena);
-  const parser::AstNode* root = parser.parse();
-  if (root == nullptr || !parser.errors().empty()) {
+  const parser::AstNode* root = eval::parse_formula_entry(source, *ctx.arena);
+  if (root == nullptr) {
     return Value::error(ErrorCode::Name);
   }
 
diff --git a/src/cf/cf_types.h b/src/cf/cf_types.h
index ed40cd9b0..0c1194cc8 100644
--- a/src/cf/cf_types.h
+++ b/src/cf/cf_types.h
@@ -9,12 +9,15 @@
 #ifndef FORMULON_CF_CF_TYPES_H_
 #define FORMULON_CF_CF_TYPES_H_
 
+#include <array>
 #include <cstdint>
 #include <optional>
 #include <string>
+#include <string_view>
 #include <vector>
 
 #include "cell.h"
+#include "styles.h"
 
 namespace formulon::cf {
 
@@ -102,6 +105,12 @@ enum class IconSetName : std::uint8_t {
   Five_Quarters = 16,
 };
 
+/// OOXML `ST_IconSetType` spellings, indexed by `IconSetName`.
+inline constexpr std::array<std::string_view, 17> kIconSetNames = {
+    "3Arrows",        "3ArrowsGray", "3Flags",      "3TrafficLights1", "3TrafficLights2", "3Signs",
+    "3Symbols",       "3Symbols2",   "4Arrows",     "4ArrowsGray",     "4RedToBlack",     "4Rating",
+    "4TrafficLights", "5Arrows",     "5ArrowsGray", "5Rating",         "5Quarters"};
+
 /// `<cfRule type="timePeriod">` value bucket.
 enum class TimePeriod : std::uint8_t {
   Today = 0,
@@ -116,17 +125,30 @@ enum class TimePeriod : std::uint8_t {
   NextMonth = 9,
 };
 
-/// Plain RGBA colour. Channels are 0-255 (sRGB). Alpha is opaque (255)
-/// unless explicitly set; OOXML `tint` adjustments are resolved by the
-/// reader before this struct is populated.
+/// RGBA colour of a CF element. Channels are 0-255 (sRGB), alpha opaque (255)
+/// unless explicitly set. `spec` keeps a theme / indexed / auto colour as
+/// written (`kNone` and `kRgb` mean the channels are the literal colour); for
+/// those kinds the channels are only a black placeholder and the effective
+/// colour is resolved at evaluation time against the workbook's theme and
+/// palette, so theme edits are reflected.
 struct Color {
   std::uint8_t r = 0;
   std::uint8_t g = 0;
   std::uint8_t b = 0;
   std::uint8_t a = 255;
-
-  friend bool operator==(Color x, Color y) noexcept { return x.r == y.r && x.g == y.g && x.b == y.b && x.a == y.a; }
-  friend bool operator!=(Color x, Color y) noexcept { return !(x == y); }
+  ColorSpec spec{};
+
+  /// True when the colour must be resolved through `resolve_color`.
+  bool is_symbolic() const noexcept {
+    return spec.kind == ColorSpec::Kind::kTheme || spec.kind == ColorSpec::Kind::kIndexed ||
+           spec.kind == ColorSpec::Kind::kAuto;
+  }
+
+  friend bool operator==(const Color& x, const Color& y) noexcept {
+    return x.r == y.r && x.g == y.g && x.b == y.b && x.a == y.a && x.spec.kind == y.spec.kind &&
+           x.spec.theme == y.spec.theme && x.spec.tint == y.spec.tint && x.spec.indexed == y.spec.indexed;
+  }
+  friend bool operator!=(const Color& x, const Color& y) noexcept { return !(x == y); }
 };
 
 /// Excel grid extent, mirrored from `Sheet::kMaxRows` / `Sheet::kMaxCols`
diff --git a/src/cf/scale_evaluator.cpp b/src/cf/scale_evaluator.cpp
index d03444e84..478db9311 100644
--- a/src/cf/scale_evaluator.cpp
+++ b/src/cf/scale_evaluator.cpp
@@ -15,6 +15,9 @@
 #include "cf/cf_helpers.h"
 #include "cf/cf_match.h"
 #include "cf/cf_types.h"
+#include "color_resolve.h"
+#include "eval/eval_context.h"
+#include "theme.h"
 #include "value.h"
 
 namespace formulon::cf::scales {
@@ -93,6 +96,25 @@ std::optional<std::vector<double>> resolve_cfvo_list(const std::vector<CfValueOb
   return resolved;
 }
 
+/// Resolves a theme / indexed / auto colour to literal channels. Uses the
+/// workbook behind `ctx.eval_ctx` (theme part and `<indexedColors>`); without
+/// one, the default theme and built-in palette.
+Color effective_color(const Color& color, const CFEvalContext& ctx, ColorContext usage) {
+  if (!color.is_symbolic()) {
+    return color;
+  }
+  const Workbook* wb = ctx.eval_ctx != nullptr ? ctx.eval_ctx->workbook() : nullptr;
+  const ResolvedColor resolved =
+      wb != nullptr ? resolve_color(*wb, color.spec, usage)
+                    : resolve_color(color.spec, default_theme(), ThemeSource::kDefault, IndexedPalette{}, usage);
+  Color out;
+  out.a = static_cast<std::uint8_t>((resolved.argb >> 24U) & 0xFFU);
+  out.r = static_cast<std::uint8_t>((resolved.argb >> 16U) & 0xFFU);
+  out.g = static_cast<std::uint8_t>((resolved.argb >> 8U) & 0xFFU);
+  out.b = static_cast<std::uint8_t>(resolved.argb & 0xFFU);
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // ColorScale — resolve `<cfvo>` thresholds against the sqref population
 // and linearly interpolate the bounding stop colours in RGB space.
@@ -151,12 +173,16 @@ double automatic_axis_position(double threshold_min, double threshold_max) {
 }
 
 DataBarRender make_data_bar_render(const DataBarSpec& spec, double length_pct, double cell, double threshold_min,
-                                   double threshold_max) {
+                                   double threshold_max, const CFEvalContext& ctx) {
   DataBarRender render;
   render.length_pct = length_pct;
   render.is_negative = cell < 0.0;
-  render.fill = render.is_negative ? spec.negative_fill : spec.fill;
-  render.border = render.is_negative ? spec.negative_border : spec.border;
+  render.fill =
+      effective_color(render.is_negative ? spec.negative_fill : spec.fill, ctx, ColorContext::kFillForeground);
+  const std::optional<Color>& border = render.is_negative ? spec.negative_border : spec.border;
+  if (border.has_value()) {
+    render.border = effective_color(*border, ctx, ColorContext::kBorder);
+  }
   render.gradient = spec.gradient;
   render.direction = spec.direction;
   switch (spec.axis_position) {
@@ -203,10 +229,10 @@ std::optional<Color> resolve_color_scale(const CFRule& rule, const Value& cell_v
   // Locate the segment that contains the cell value. Cells outside the
   // outermost stops clamp to the boundary colour.
   if (cell <= resolved_thresholds->front()) {
-    return spec.colors.front();
+    return effective_color(spec.colors.front(), ctx, ColorContext::kFillForeground);
   }
   if (cell >= resolved_thresholds->back()) {
-    return spec.colors.back();
+    return effective_color(spec.colors.back(), ctx, ColorContext::kFillForeground);
   }
   for (std::size_t i = 0; i + 1 < resolved_thresholds->size(); ++i) {
     const double lower_bound = (*resolved_thresholds)[i];
@@ -216,10 +242,11 @@ std::optional<Color> resolve_color_scale(const CFRule& rule, const Value& cell_v
       // colour; the cell is exactly at a stop so either end is correct.
       const double span = upper_bound - lower_bound;
       const double fraction = span == 0.0 ? 1.0 : (cell - lower_bound) / span;
-      return interpolate_color(spec.colors[i], spec.colors[i + 1], fraction);
+      return interpolate_color(effective_color(spec.colors[i], ctx, ColorContext::kFillForeground),
+                               effective_color(spec.colors[i + 1], ctx, ColorContext::kFillForeground), fraction);
     }
   }
-  return spec.colors.back();
+  return effective_color(spec.colors.back(), ctx, ColorContext::kFillForeground);
 }
 
 bool match_color_scale(const CFRule& rule, const Value& cell_value, const CFEvalContext& ctx) {
@@ -250,7 +277,7 @@ std::optional<DataBarRender> resolve_data_bar(const CFRule& rule, const Value& c
   // here makes every data bar disappear for a range such as [42, 42, 42].
   if (*threshold_min == *threshold_max) {
     return make_data_bar_render(spec, static_cast<double>(spec.max_length_pct), cell_value.as_number(), *threshold_min,
-                                *threshold_max);
+                                *threshold_max, ctx);
   }
 
   const double cell = cell_value.as_number();
@@ -284,7 +311,7 @@ std::optional<DataBarRender> resolve_data_bar(const CFRule& rule, const Value& c
   }
 
   return make_data_bar_render(spec, min_len + clamped_fraction * (max_len - min_len), cell, *threshold_min,
-                              *threshold_max);
+                              *threshold_max, ctx);
 }
 
 bool match_data_bar(const CFRule& rule, const Value& cell_value, const CFEvalContext& ctx) {
diff --git a/src/cf/validation_eval.cpp b/src/cf/validation_eval.cpp
new file mode 100644
index 000000000..f50a5bade
--- /dev/null
+++ b/src/cf/validation_eval.cpp
@@ -0,0 +1,327 @@
+#include "cf/validation_eval.h"
+
+#include <algorithm>
+#include <cmath>
+#include <cstdlib>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "cf/cf_evaluator.h"
+#include "cf/cf_helpers.h"
+#include "eval/coerce.h"
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "utils/number_text.h"
+#include "utils/resource_budget.h"
+#include "utils/utf8_length.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+// DataValidation::type / ::op encodings (see sheet.h).
+constexpr std::uint8_t kTypeNone = 0;
+constexpr std::uint8_t kTypeWhole = 1;
+constexpr std::uint8_t kTypeDecimal = 2;
+constexpr std::uint8_t kTypeList = 3;
+constexpr std::uint8_t kTypeDate = 4;
+constexpr std::uint8_t kTypeTime = 5;
+constexpr std::uint8_t kTypeTextLength = 6;
+constexpr std::uint8_t kTypeCustom = 7;
+
+constexpr std::uint8_t kOpBetween = 0;
+constexpr std::uint8_t kOpNotBetween = 1;
+constexpr std::uint8_t kOpEqual = 2;
+constexpr std::uint8_t kOpNotEqual = 3;
+constexpr std::uint8_t kOpGreaterThan = 4;
+constexpr std::uint8_t kOpLessThan = 5;
+constexpr std::uint8_t kOpGreaterThanOrEqual = 6;
+constexpr std::uint8_t kOpLessThanOrEqual = 7;
+
+bool contains(const DataValidation& dv, std::uint32_t row, std::uint32_t col) {
+  return std::any_of(dv.ranges.begin(), dv.ranges.end(), [&](const MergeRange& r) {
+    return row >= r.first_row && row <= r.last_row && col >= r.first_col && col <= r.last_col;
+  });
+}
+
+// Top-left corner of the bounding box of the rule's sqref.
+CellAddress anchor_of(const DataValidation& dv) {
+  CellAddress a{0U, 0U};
+  bool first = true;
+  for (const MergeRange& r : dv.ranges) {
+    a.row = first ? r.first_row : std::min(a.row, r.first_row);
+    a.col = first ? r.first_col : std::min(a.col, r.first_col);
+    first = false;
+  }
+  return a;
+}
+
+/// Evaluation environment shared by every formula of one call.
+struct Evaluator {
+  const Workbook& wb;
+  const Sheet& sheet;
+  CellAddress anchor;
+  CellAddress target;
+  Arena arena{/*initial_chunk_bytes=*/4096, kMaxEvalArenaBytes};
+  eval::EvalState state;
+  eval::EvalContext eval_ctx;
+  const eval::FunctionRegistry* registry;
+
+  Evaluator(const Workbook& w, const Sheet& s, CellAddress anc, CellAddress tgt, const eval::FunctionRegistry* reg)
+      : wb(w), sheet(s), anchor(anc), target(tgt), eval_ctx(w, s, state), registry(reg) {}
+
+  Value run(const std::string& source) {
+    cf::CFEvalContext ctx;
+    ctx.anchor = anchor;
+    ctx.target = target;
+    ctx.arena = &arena;
+    ctx.registry = registry;
+    ctx.eval_ctx = &eval_ctx;
+    return cf::helpers::parse_shift_evaluate(source, ctx);
+  }
+
+  /// Evaluates `source` to a scalar; a 1x1 array collapses to its element.
+  Value scalar(const std::string& source) {
+    Value v = run(source);
+    if (v.is_array() && v.as_array_rows() == 1U && v.as_array_cols() == 1U) {
+      return v.as_array()->cells[0];
+    }
+    return v;
+  }
+};
+
+std::optional<double> as_bound(const Value& v) {
+  if (v.is_number()) {
+    return v.as_number();
+  }
+  if (v.is_blank()) {
+    return 0.0;
+  }
+  return std::nullopt;
+}
+
+bool compare(std::uint8_t op, double v, double lo, double hi) {
+  switch (op) {
+    case kOpBetween:
+      return v >= lo && v <= hi;
+    case kOpNotBetween:
+      return v < lo || v > hi;
+    case kOpEqual:
+      return v == lo;
+    case kOpNotEqual:
+      return v != lo;
+    case kOpGreaterThan:
+      return v > lo;
+    case kOpLessThan:
+      return v < lo;
+    case kOpGreaterThanOrEqual:
+      return v >= lo;
+    case kOpLessThanOrEqual:
+      return v <= lo;
+    default:
+      return false;
+  }
+}
+
+/// Resolves formula1 (and formula2 for the between operators) and applies the operator.
+bool check_operator(Evaluator& ev, const DataValidation& dv, double v) {
+  const std::optional<double> lo = as_bound(ev.scalar(dv.formula1));
+  if (!lo.has_value()) {
+    return false;
+  }
+  double hi = 0.0;
+  if (dv.op == kOpBetween || dv.op == kOpNotBetween) {
+    const std::optional<double> h = as_bound(ev.scalar(dv.formula2));
+    if (!h.has_value()) {
+      return false;
+    }
+    hi = *h;
+  }
+  return compare(dv.op, v, *lo, hi);
+}
+
+bool check_numeric(Evaluator& ev, const DataValidation& dv, const Value& proposed) {
+  double v = 0.0;
+  if (proposed.is_number()) {
+    v = proposed.as_number();
+  } else if (!proposed.is_blank()) {
+    return false;
+  }
+  if (!std::isfinite(v)) {
+    return false;
+  }
+  if (dv.type == kTypeWhole && v != std::floor(v)) {
+    return false;
+  }
+  return check_operator(ev, dv, v);
+}
+
+bool check_text_length(Evaluator& ev, const DataValidation& dv, const Value& proposed) {
+  auto text = eval::coerce_to_text(proposed);
+  if (!text) {
+    return false;
+  }
+  return check_operator(ev, dv, static_cast<double>(utf16_units_in(text.value())));
+}
+
+/// Parses an inline list body (`"a,b,c"`, with `""` as an escaped quote) into its items.
+std::vector<std::string> inline_items(const std::string& formula) {
+  std::string body;
+  for (std::size_t i = 1; i + 1 < formula.size(); ++i) {
+    body.push_back(formula[i]);
+    if (formula[i] == '"' && formula[i + 1] == '"') {
+      ++i;
+    }
+  }
+  std::vector<std::string> items;
+  std::size_t start = 0;
+  for (;;) {
+    const std::size_t comma = body.find(',', start);
+    items.push_back(body.substr(start, comma == std::string::npos ? std::string::npos : comma - start));
+    if (comma == std::string::npos) {
+      break;
+    }
+    start = comma + 1;
+  }
+  return items;
+}
+
+bool is_inline_list(const std::string& f) {
+  return f.size() >= 2U && f.front() == '"' && f.back() == '"';
+}
+
+std::optional<double> parse_item_number(const std::string& item) {
+  if (item.empty()) {
+    return std::nullopt;
+  }
+  char* end = nullptr;
+  const double d = std::strtod(item.c_str(), &end);
+  if (end != item.c_str() + item.size() || !std::isfinite(d)) {
+    return std::nullopt;
+  }
+  return d;
+}
+
+bool inline_list_matches(const std::vector<std::string>& items, const Value& proposed) {
+  for (const std::string& item : items) {
+    if (proposed.is_text()) {
+      if (proposed.as_text() == item) {
+        return true;
+      }
+    } else if (proposed.is_number()) {
+      const std::optional<double> n = parse_item_number(item);
+      if (n.has_value() && *n == proposed.as_number()) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+/// Renders `proposed` as a formula literal; nullopt for kinds a list cannot contain.
+std::optional<std::string> literal_of(const Value& proposed) {
+  if (proposed.is_number()) {
+    char buf[40];
+    format_general(buf, sizeof(buf), proposed.as_number(), 17);
+    return std::string(buf);
+  }
+  if (proposed.is_boolean()) {
+    return std::string(proposed.as_boolean() ? "TRUE" : "FALSE");
+  }
+  if (proposed.is_text()) {
+    // MATCH reads `*`, `?` and `~` in text as wildcards; a literal list entry must not.
+    std::string lit = "\"";
+    for (const char c : proposed.as_text()) {
+      if (c == '*' || c == '?' || c == '~') {
+        lit.push_back('~');
+      }
+      lit.push_back(c);
+      if (c == '"') {
+        lit.push_back('"');
+      }
+    }
+    lit.push_back('"');
+    return lit;
+  }
+  return std::nullopt;
+}
+
+bool check_list(Evaluator& ev, const DataValidation& dv, const Value& proposed) {
+  if (is_inline_list(dv.formula1)) {
+    return inline_list_matches(inline_items(dv.formula1), proposed);
+  }
+  // A range source is tested with an exact MATCH: a spilled range read at the target cell
+  // would be blocked by the cells below it, and MATCH gives Excel's case-insensitive,
+  // type-strict equality.
+  const std::optional<std::string> lit = literal_of(proposed);
+  if (!lit.has_value()) {
+    return false;
+  }
+  const Value found = ev.scalar("ISNUMBER(MATCH(" + *lit + "," + dv.formula1 + ",0))");
+  return found.is_boolean() && found.as_boolean();
+}
+
+bool check_custom(Evaluator& ev, const DataValidation& dv) {
+  const Value v = ev.scalar(dv.formula1);
+  if (v.is_boolean()) {
+    return v.as_boolean();
+  }
+  return v.is_number() && v.as_number() != 0.0;
+}
+
+}  // namespace
+
+Expected<ValidationOutcome, Error> validate_value(const Workbook& wb, const Sheet& sheet, std::uint32_t row,
+                                                  std::uint32_t col, const Value& proposed,
+                                                  const ValidationEvalDeps& deps) {
+  using Result = Expected<ValidationOutcome, Error>;
+  if (!Sheet::rect_in_grid(row, col, row, col)) {
+    return Result::Err(make_error(FormulonErrorCode::kInvalidArgument, "validate_value: cell out of grid"));
+  }
+  ValidationOutcome out;
+  const std::vector<DataValidation>& rules = sheet.validations();
+  for (std::size_t i = 0; i < rules.size(); ++i) {
+    if (!contains(rules[i], row, col)) {
+      continue;
+    }
+    const DataValidation& dv = rules[i];
+    out.has_rule = true;
+    out.rule_index = static_cast<std::uint32_t>(i);
+    out.error_style = dv.error_style;
+    if (dv.type == kTypeNone || (proposed.is_blank() && dv.allow_blank)) {
+      out.valid = true;
+      return Result::Ok(out);
+    }
+    const eval::FunctionRegistry* registry = deps.registry != nullptr ? deps.registry : &eval::default_registry();
+    Evaluator ev(wb, sheet, anchor_of(dv), CellAddress{row, col}, registry);
+    switch (dv.type) {
+      case kTypeWhole:
+      case kTypeDecimal:
+      case kTypeDate:
+      case kTypeTime:
+        out.valid = check_numeric(ev, dv, proposed);
+        break;
+      case kTypeTextLength:
+        out.valid = check_text_length(ev, dv, proposed);
+        break;
+      case kTypeList:
+        out.valid = check_list(ev, dv, proposed);
+        break;
+      case kTypeCustom:
+        out.valid = check_custom(ev, dv);
+        break;
+      default:
+        out.valid = false;
+        break;
+    }
+    return Result::Ok(out);
+  }
+  return Result::Ok(out);
+}
+
+}  // namespace formulon
diff --git a/src/cf/validation_eval.h b/src/cf/validation_eval.h
new file mode 100644
index 000000000..72383836d
--- /dev/null
+++ b/src/cf/validation_eval.h
@@ -0,0 +1,58 @@
+//
+// Data-validation evaluation: whether a cell value satisfies the rule that applies to it.
+
+#ifndef FORMULON_CF_VALIDATION_EVAL_H_
+#define FORMULON_CF_VALIDATION_EVAL_H_
+
+#include <cstddef>
+#include <cstdint>
+
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "value.h"
+
+namespace formulon {
+
+class Sheet;
+class Workbook;
+
+namespace eval {
+class FunctionRegistry;
+}  // namespace eval
+
+/// Collaborators for rule formula evaluation.
+struct ValidationEvalDeps {
+  /// Function dispatch table; `nullptr` selects `eval::default_registry()`.
+  const eval::FunctionRegistry* registry = nullptr;
+};
+
+/// Result of checking one value against the rule covering a cell.
+struct ValidationOutcome {
+  /// False when no rule covers the cell; `valid` is then true.
+  bool has_rule = false;
+  bool valid = true;
+  /// Index into `Sheet::validations()` of the applied rule (meaningful only when `has_rule`).
+  std::uint32_t rule_index = 0;
+  /// The applied rule's `error_style` (0 stop, 1 warning, 2 information).
+  std::uint8_t error_style = 0;
+};
+
+/// Checks `proposed` against the data-validation rule covering `(row, col)` on `sheet`.
+///
+/// Excel applies one rule per cell: when several sqrefs overlap, the first rule in
+/// `Sheet::validations()` order wins. `formula1` / `formula2` are evaluated through the
+/// formula evaluator, shifted from the sqref's top-left cell to the target cell. `proposed`
+/// is an already-parsed value (text such as "5" is not reinterpreted as a number); numeric
+/// types reject text, and `textLength` counts UTF-16 units of the value's General text.
+/// A blank value is valid under `allow_blank`, otherwise it is checked as 0 / empty text.
+/// `custom` formulas read the workbook as stored, so a formula that refers to the cell itself
+/// sees the stored value rather than `proposed`.
+///
+/// Fails with `kInvalidArgument` when `(row, col)` is outside the grid.
+Expected<ValidationOutcome, Error> validate_value(const Workbook& wb, const Sheet& sheet, std::uint32_t row,
+                                                  std::uint32_t col, const Value& proposed,
+                                                  const ValidationEvalDeps& deps = {});
+
+}  // namespace formulon
+
+#endif  // FORMULON_CF_VALIDATION_EVAL_H_
diff --git a/src/color_resolve.cpp b/src/color_resolve.cpp
new file mode 100644
index 000000000..a6259b136
--- /dev/null
+++ b/src/color_resolve.cpp
@@ -0,0 +1,170 @@
+#include "color_resolve.h"
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+constexpr int kHlsMax = 240;
+constexpr int kRgbMax = 255;
+
+constexpr std::uint32_t kBlack = 0xFF000000U;
+constexpr std::uint32_t kWhite = 0xFFFFFFFFU;
+
+constexpr std::array<std::uint32_t, 64> kDefaultPalette = {
+    0xFF000000U, 0xFFFFFFFFU, 0xFFFF0000U, 0xFF00FF00U, 0xFF0000FFU, 0xFFFFFF00U, 0xFFFF00FFU, 0xFF00FFFFU,
+    0xFF000000U, 0xFFFFFFFFU, 0xFFFF0000U, 0xFF00FF00U, 0xFF0000FFU, 0xFFFFFF00U, 0xFFFF00FFU, 0xFF00FFFFU,
+    0xFF800000U, 0xFF008000U, 0xFF000080U, 0xFF808000U, 0xFF800080U, 0xFF008080U, 0xFFC0C0C0U, 0xFF808080U,
+    0xFF9999FFU, 0xFF993366U, 0xFFFFFFCCU, 0xFFCCFFFFU, 0xFF660066U, 0xFFFF8080U, 0xFF0066CCU, 0xFFCCCCFFU,
+    0xFF000080U, 0xFFFF00FFU, 0xFFFFFF00U, 0xFF00FFFFU, 0xFF800080U, 0xFF800000U, 0xFF008080U, 0xFF0000FFU,
+    0xFF00CCFFU, 0xFFCCFFFFU, 0xFFCCFFCCU, 0xFFFFFF99U, 0xFF99CCFFU, 0xFFFF99CCU, 0xFFCC99FFU, 0xFFFFCC99U,
+    0xFF3366FFU, 0xFF33CCCCU, 0xFF99CC00U, 0xFFFFCC00U, 0xFFFF9900U, 0xFFFF6600U, 0xFF666699U, 0xFF969696U,
+    0xFF003366U, 0xFF339966U, 0xFF003300U, 0xFF333300U, 0xFF993300U, 0xFF993366U, 0xFF333399U, 0xFF333333U};
+
+/// `spec.theme` order (0=lt1, 1=dk1, 2=lt2, 3=dk2) to scheme order.
+constexpr std::array<std::size_t, kThemeColorCount> kThemeToScheme = {1, 0, 3, 2, 4, 5, 6, 7, 8, 9, 10, 11};
+
+int hue_to_rgb(int n1, int n2, int hue) {
+  hue %= kHlsMax;
+  if (hue < 0) {
+    hue += kHlsMax;
+  }
+  if (hue < kHlsMax / 6) {
+    return n1 + (((n2 - n1) * hue + (kHlsMax / 12)) / (kHlsMax / 6));
+  }
+  if (hue < kHlsMax / 2) {
+    return n2;
+  }
+  if (hue < (kHlsMax * 2) / 3) {
+    return n1 + (((n2 - n1) * (((kHlsMax * 2) / 3) - hue) + (kHlsMax / 12)) / (kHlsMax / 6));
+  }
+  return n1;
+}
+
+std::uint32_t rgb_pack(int r, int g, int b) {
+  return 0xFF000000U | (static_cast<std::uint32_t>(r) << 16U) | (static_cast<std::uint32_t>(g) << 8U) |
+         static_cast<std::uint32_t>(b);
+}
+
+ResolvedColor auto_color(ColorContext context) {
+  const bool fill = context == ColorContext::kFillForeground || context == ColorContext::kFillBackground;
+  return {fill ? kWhite : kBlack, ColorResolution::kAutoContext};
+}
+
+}  // namespace
+
+std::uint32_t default_indexed_color(std::uint32_t index) {
+  return index < kDefaultPalette.size() ? kDefaultPalette[index] : kBlack;
+}
+
+std::uint32_t apply_tint(std::uint32_t argb, double tint) {
+  if (tint == 0.0) {
+    return argb | 0xFF000000U;
+  }
+  const int r = static_cast<int>((argb >> 16U) & 0xFFU);
+  const int g = static_cast<int>((argb >> 8U) & 0xFFU);
+  const int b = static_cast<int>(argb & 0xFFU);
+  const int c_max = std::max({r, g, b});
+  const int c_min = std::min({r, g, b});
+  const int lum = (((c_max + c_min) * kHlsMax) + kRgbMax) / (2 * kRgbMax);
+  int sat = 0;
+  int hue = 0;
+  if (c_max != c_min) {
+    if (lum <= kHlsMax / 2) {
+      sat = (((c_max - c_min) * kHlsMax) + ((c_max + c_min) / 2)) / (c_max + c_min);
+    } else {
+      sat = (((c_max - c_min) * kHlsMax) + ((2 * kRgbMax - c_max - c_min) / 2)) / (2 * kRgbMax - c_max - c_min);
+    }
+    const int span = c_max - c_min;
+    const int r_delta = (((c_max - r) * (kHlsMax / 6)) + (span / 2)) / span;
+    const int g_delta = (((c_max - g) * (kHlsMax / 6)) + (span / 2)) / span;
+    const int b_delta = (((c_max - b) * (kHlsMax / 6)) + (span / 2)) / span;
+    if (r == c_max) {
+      hue = b_delta - g_delta;
+    } else if (g == c_max) {
+      hue = (kHlsMax / 3) + r_delta - b_delta;
+    } else {
+      hue = ((2 * kHlsMax) / 3) + g_delta - r_delta;
+    }
+    if (hue < 0) {
+      hue += kHlsMax;
+    }
+    if (hue > kHlsMax) {
+      hue -= kHlsMax;
+    }
+  }
+  const double lum_d = static_cast<double>(lum);
+  // Each product is its own statement: a fused multiply-add would shift the
+  // value just below an integer and floor it one step low.
+  const double keep = tint < 0.0 ? 1.0 + tint : 1.0 - tint;
+  const double kept = lum_d * keep;
+  const double boost_base = kHlsMax * keep;
+  const double boost = kHlsMax - boost_base;
+  const double scaled = tint < 0.0 ? kept : kept + boost;
+  const int new_lum = std::clamp(static_cast<int>(std::floor(scaled)), 0, kHlsMax);
+  if (sat == 0) {
+    const int v = (new_lum * kRgbMax + kHlsMax / 2) / kHlsMax;
+    return rgb_pack(v, v, v);
+  }
+  int magic2 = 0;
+  if (new_lum <= kHlsMax / 2) {
+    magic2 = (new_lum * (kHlsMax + sat) + (kHlsMax / 2)) / kHlsMax;
+  } else {
+    magic2 = new_lum + sat - ((new_lum * sat) + (kHlsMax / 2)) / kHlsMax;
+  }
+  const int magic1 = 2 * new_lum - magic2;
+  const auto channel = [&](int h) { return (hue_to_rgb(magic1, magic2, h) * kRgbMax + kHlsMax / 2) / kHlsMax; };
+  return rgb_pack(channel(hue + kHlsMax / 3), channel(hue), channel(hue - kHlsMax / 3));
+}
+
+ResolvedColor resolve_color(const ColorSpec& spec, const Theme& theme, ThemeSource source,
+                            const IndexedPalette& palette, ColorContext context) {
+  switch (spec.kind) {
+    case ColorSpec::Kind::kRgb:
+      return {spec.rgb, ColorResolution::kExact};
+    case ColorSpec::Kind::kTheme: {
+      if (spec.theme >= kThemeColorCount) {
+        return {kBlack, ColorResolution::kIndexOutOfRange};
+      }
+      ColorResolution resolution = ColorResolution::kExact;
+      if (source == ThemeSource::kDefault) {
+        resolution = ColorResolution::kDefaultTheme;
+      } else if (source == ThemeSource::kUnparseable) {
+        resolution = ColorResolution::kThemeUnparseable;
+      }
+      return {apply_tint(theme.colors[kThemeToScheme[spec.theme]], spec.tint), resolution};
+    }
+    case ColorSpec::Kind::kIndexed:
+      if (spec.indexed == 64U || spec.indexed == 65U) {
+        // System foreground / background: windowText in text and lines, window in fills.
+        const bool fill = context == ColorContext::kFillForeground || context == ColorContext::kFillBackground;
+        const std::uint32_t argb = (spec.indexed == 65U || fill) ? kWhite : kBlack;
+        return {argb, ColorResolution::kAutoContext};
+      }
+      if (spec.indexed < palette.size()) {
+        return {palette[spec.indexed] | 0xFF000000U, ColorResolution::kExact};
+      }
+      if (spec.indexed < kDefaultPalette.size()) {
+        return {kDefaultPalette[spec.indexed], ColorResolution::kExact};
+      }
+      return {kBlack, ColorResolution::kIndexOutOfRange};
+    case ColorSpec::Kind::kAuto:
+    case ColorSpec::Kind::kNone:
+    default:
+      return auto_color(context);
+  }
+}
+
+ResolvedColor resolve_color(const Workbook& wb, const ColorSpec& spec, ColorContext context) {
+  if (spec.kind != ColorSpec::Kind::kTheme) {
+    return resolve_color(spec, default_theme(), ThemeSource::kDefault, wb.styles().indexed_colors, context);
+  }
+  const LoadedTheme loaded = wb.load_theme();
+  return resolve_color(spec, loaded.theme, loaded.source, wb.styles().indexed_colors, context);
+}
+
+}  // namespace formulon
diff --git a/src/color_resolve.h b/src/color_resolve.h
new file mode 100644
index 000000000..2c7edd397
--- /dev/null
+++ b/src/color_resolve.h
@@ -0,0 +1,62 @@
+//
+// Colour resolution: theme, tint, indexed and auto colours to effective ARGB.
+//
+// Theme colours use the `theme="N"` order of a spreadsheet colour (0=lt1,
+// 1=dk1, 2=lt2, 3=dk2, 4..11 as in the scheme), tinted with integer HLS
+// arithmetic (HLSMAX=240, floor on the new luminance) that reproduces Excel's
+// rendered RGB.
+
+#ifndef FORMULON_COLOR_RESOLVE_H_
+#define FORMULON_COLOR_RESOLVE_H_
+
+#include <cstdint>
+#include <vector>
+
+#include "styles.h"
+#include "theme.h"
+
+namespace formulon {
+
+class Workbook;
+
+/// Where a colour is used; decides what an automatic colour means.
+enum class ColorContext : std::uint8_t {
+  kFont = 0,
+  kFillForeground = 1,
+  kFillBackground = 2,
+  kBorder = 3,
+};
+
+/// How a colour was resolved.
+enum class ColorResolution : std::uint8_t {
+  kExact = 0,             ///< Literal RGB, or theme / palette colour resolved from real data.
+  kDefaultTheme = 1,      ///< Theme colour resolved against the default theme (no theme part).
+  kIndexOutOfRange = 2,   ///< Theme or palette index beyond the table; black is returned.
+  kThemeUnparseable = 3,  ///< Theme colour resolved against the default theme (part unparseable).
+  kAutoContext = 4,       ///< Automatic / system colour (or no colour) chosen by context.
+};
+
+struct ResolvedColor {
+  std::uint32_t argb = 0xFF000000U;
+  ColorResolution resolution = ColorResolution::kExact;
+};
+
+/// `<indexedColors>` override entries (AARRGGBB); empty selects the built-in
+/// palette. Entry `i` overrides palette index `i` when `i < size()`.
+using IndexedPalette = std::vector<std::uint32_t>;
+
+/// Built-in palette colour for `index` (0..63) as 0xFFRRGGBB.
+std::uint32_t default_indexed_color(std::uint32_t index);
+
+/// Applies a tint (-1..1) to an opaque RGB colour.
+std::uint32_t apply_tint(std::uint32_t argb, double tint);
+
+ResolvedColor resolve_color(const ColorSpec& spec, const Theme& theme, ThemeSource source,
+                            const IndexedPalette& palette, ColorContext context);
+
+/// Resolves against the workbook's theme and `<indexedColors>`.
+ResolvedColor resolve_color(const Workbook& wb, const ColorSpec& spec, ColorContext context);
+
+}  // namespace formulon
+
+#endif  // FORMULON_COLOR_RESOLVE_H_
diff --git a/src/drawing/drawing_edit.cpp b/src/drawing/drawing_edit.cpp
new file mode 100644
index 000000000..9553781d3
--- /dev/null
+++ b/src/drawing/drawing_edit.cpp
@@ -0,0 +1,542 @@
+#include "drawing/drawing_edit.h"
+
+#include <algorithm>
+#include <cmath>
+#include <string_view>
+#include <utility>
+
+#include "drawing/image_header.h"
+#include "io/ooxml/package_validator.h"
+#include "io/ooxml/part_dom.h"
+#include "io/ooxml_defs.h"
+#include "io/zip_reader.h"
+#include "passthrough_part.h"
+#include "print/sheet_geometry.h"
+#include "sheet.h"
+#include "utils/status_macros.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+constexpr const char* kCtDrawing = "application/vnd.openxmlformats-officedocument.drawing+xml";
+constexpr const char* kRelImage = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image";
+constexpr const char* kNsXdr = "http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing";
+constexpr const char* kNsA = "http://schemas.openxmlformats.org/drawingml/2006/main";
+constexpr const char* kNsR = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
+constexpr const char* kEmptyRels =
+    "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"/>";
+constexpr std::int64_t kEmuPerPoint = 12700;
+constexpr std::int64_t kEmuPerPixel = 9525;
+constexpr std::int64_t kEmuLimit = std::int64_t{1} << 31;
+
+Error invalid(const char* message) {
+  return make_error(FormulonErrorCode::kInvalidArgument, message);
+}
+
+Error unparseable(const char* message, std::string_view detail) {
+  return make_error(FormulonErrorCode::kIoDrawingUnparseable, message, std::string(detail));
+}
+
+// Cell extents in EMU under the Windows display geometry.
+class Geometry {
+ public:
+  Geometry(const Workbook& wb, const Sheet& sheet)
+      : sheet_(sheet), model_(print::resolve_column_width_model(wb.styles(), print::GeometryMode::kDisplay)) {}
+
+  std::int64_t size(bool row_axis, std::uint32_t index) const {
+    const double pt = row_axis ? print::effective_row_height_pt(sheet_, index)
+                               : print::effective_column_width_pt(sheet_, index, model_);
+    return std::llround(pt * kEmuPerPoint);
+  }
+
+  std::int64_t offset(bool row_axis, std::uint32_t index) const {
+    const double pt = row_axis ? print::row_offset_pt(sheet_, index) : print::column_offset_pt(sheet_, index, model_);
+    return std::llround(pt * kEmuPerPoint);
+  }
+
+  // Moves the marker (`index`, `off`) `extent` EMU further along the axis.
+  // Returns false when the result lies past the sheet's last line.
+  bool advance(bool row_axis, std::uint32_t& index, std::int64_t& off, std::int64_t extent) const {
+    const std::uint32_t limit = row_axis ? Sheet::kMaxRows : Sheet::kMaxCols;
+    std::int64_t rem = off + extent;
+    for (std::int64_t s = size(row_axis, index); rem >= s; s = size(row_axis, index)) {
+      if (index + 1 >= limit) {
+        off = rem;
+        return rem <= s;
+      }
+      rem -= s;
+      ++index;
+    }
+    off = rem;
+    return true;
+  }
+
+ private:
+  const Sheet& sheet_;
+  print::ColumnWidthModel model_;
+};
+
+template <typename Fn>
+void for_each_element(const pugi::xml_node& node, const Fn& fn) {
+  for (pugi::xml_node child = node.first_child(); child; child = child.next_sibling()) {
+    if (child.type() == pugi::node_element) {
+      fn(child);
+      for_each_element(child, fn);
+    }
+  }
+}
+
+bool has_retained_drawing(const Sheet& sheet) {
+  return std::any_of(sheet.unknown_relationships().begin(), sheet.unknown_relationships().end(),
+                     [](const UnknownRelationship& rel) { return rel.type == io::kRelDrawing; });
+}
+
+Expected<void, Error> load_drawing(const Workbook& wb, std::string_view path, pugi::xml_document& doc) {
+  const PassthroughPart* part = io::ooxml::find_passthrough_part(wb, path);
+  if (part == nullptr) {
+    return unparseable("drawing: part is missing", path);
+  }
+  return parse_drawing_part(part->bytes, doc);
+}
+
+Expected<std::vector<DrawingRel>, Error> load_rels(const std::vector<PassthroughPart>& parts, std::string_view path) {
+  const std::string rels_path = io::ooxml::rels_path_for_part(path);
+  for (const PassthroughPart& part : parts) {
+    if (part.path == rels_path) {
+      return parse_part_rels(part.bytes, io::ooxml::dir_of(path));
+    }
+  }
+  return std::vector<DrawingRel>{};
+}
+
+// The path of sheet `sheet`'s typed-editable drawing, or empty when it has
+// none. Refuses a drawing retained from an `.xlsb` package.
+Expected<std::string, Error> editable_drawing_path(const Workbook& wb, std::size_t sheet) {
+  if (sheet >= wb.sheet_count()) {
+    return invalid("drawing: sheet index out of range");
+  }
+  if (has_retained_drawing(wb.sheet(sheet))) {
+    return unparseable("drawing: drawing retained from an xlsb package is not editable", wb.sheet(sheet).name());
+  }
+  return wb.sheet(sheet).drawing_rel_target();
+}
+
+// First `<stem><N>.<suffix>` with no part named `<stem><N>.*`.
+std::string unused_part_path(const Workbook& wb, const std::string& stem, const char* suffix) {
+  for (std::uint32_t n = 1;; ++n) {
+    const std::string base = stem + std::to_string(n) + ".";
+    const bool taken = std::any_of(wb.passthrough_parts().begin(), wb.passthrough_parts().end(),
+                                   [&base](const PassthroughPart& part) { return part.path.rfind(base, 0) == 0; });
+    if (!taken) {
+      return base + suffix;
+    }
+  }
+}
+
+bool referenced(const Workbook& wb, const std::vector<PassthroughPart>& parts, const std::string& path) {
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    const Sheet& sheet = wb.sheet(i);
+    if (sheet.drawing_rel_target() == path) {
+      return true;
+    }
+    for (const UnknownRelationship& rel : sheet.unknown_relationships()) {
+      if (!rel.target_external && rel.target == path) {
+        return true;
+      }
+    }
+  }
+  for (const UnknownRelationship& rel : wb.unknown_workbook_rels()) {
+    if (!rel.target_external && (rel.target == path || "xl/" + rel.target == path)) {
+      return true;
+    }
+  }
+  for (const PassthroughPart& part : parts) {
+    if (part.path.size() < 5 || part.path.compare(part.path.size() - 5, 5, ".rels") != 0) {
+      continue;
+    }
+    auto rels = parse_part_rels(part.bytes, io::ooxml::dir_of(io::ooxml::dir_of(part.path)));
+    if (!rels) {
+      return true;  // An unreadable rels part might reference it.
+    }
+    for (const DrawingRel& rel : rels.value()) {
+      if (!rel.external && rel.target == path) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+// Drops each candidate part nothing references any more, with its rels part,
+// and then the targets only that rels part referenced.
+void remove_orphans(Workbook& wb, std::vector<std::string> candidates) {
+  std::vector<PassthroughPart> parts = wb.passthrough_parts();
+  const auto find = [&parts](const std::string& path) {
+    return std::find_if(parts.begin(), parts.end(), [&path](const PassthroughPart& p) { return p.path == path; });
+  };
+  bool removed = false;
+  while (!candidates.empty()) {
+    const std::string path = std::move(candidates.back());
+    candidates.pop_back();
+    auto it = find(path);
+    if (it == parts.end() || referenced(wb, parts, path)) {
+      continue;
+    }
+    parts.erase(it);
+    removed = true;
+    auto rels_it = find(io::ooxml::rels_path_for_part(path));
+    if (rels_it != parts.end()) {
+      if (auto rels = parse_part_rels(rels_it->bytes, io::ooxml::dir_of(path))) {
+        for (DrawingRel& rel : rels.value()) {
+          if (!rel.external) {
+            candidates.push_back(std::move(rel.target));
+          }
+        }
+      }
+      parts.erase(rels_it);
+    }
+  }
+  if (removed) {
+    wb.set_passthrough_parts(std::move(parts));
+  }
+}
+
+// Removes the top-level drawing elements `tops`, then the relationships no
+// remaining element names and the parts they leave unreferenced.
+Expected<void, Error> drop_objects(Workbook& wb, const std::string& path, pugi::xml_document& doc,
+                                   const std::vector<pugi::xml_node>& tops) {
+  ASSIGN_OR_RETURN(std::vector<DrawingRel> rels, load_rels(wb.passthrough_parts(), path));
+  for (const pugi::xml_node& top : tops) {
+    top.parent().remove_child(top);
+  }
+  std::vector<std::string> used;
+  for_each_element(doc, [&used](const pugi::xml_node& node) {
+    for (pugi::xml_attribute attr = node.first_attribute(); attr; attr = attr.next_attribute()) {
+      const std::string_view name = attr.name();
+      if (name.find(':') != std::string_view::npos && name.rfind("xmlns:", 0) != 0) {
+        used.emplace_back(attr.value());
+      }
+    }
+  });
+  RETURN_IF_ERROR(io::ooxml::store_part_dom(wb, path, doc));
+  const std::string rels_path = io::ooxml::rels_path_for_part(path);
+  pugi::xml_document rels_doc;
+  if (rels.empty() || !io::ooxml::load_part_dom(wb, rels_path, "drawing", rels_doc)) {
+    return Expected<void, Error>::Ok();
+  }
+  std::vector<std::string> candidates;
+  pugi::xml_node root = rels_doc.child("Relationships");
+  for (pugi::xml_node rel = root.child("Relationship"); rel;) {
+    pugi::xml_node next = rel.next_sibling("Relationship");
+    const std::string id = rel.attribute("Id").value();
+    if (std::find(used.begin(), used.end(), id) == used.end()) {
+      for (const DrawingRel& entry : rels) {
+        if (entry.id == id && !entry.external) {
+          candidates.push_back(entry.target);
+        }
+      }
+      root.remove_child(rel);
+    }
+    rel = next;
+  }
+  RETURN_IF_ERROR(io::ooxml::store_part_dom(wb, rels_path, rels_doc));
+  remove_orphans(wb, std::move(candidates));
+  return Expected<void, Error>::Ok();
+}
+
+std::string marker_xml(const char* tag, const AnchorPoint& p) {
+  return std::string("<xdr:") + tag + "><xdr:col>" + std::to_string(p.col) + "</xdr:col><xdr:colOff>" +
+         std::to_string(p.col_off) + "</xdr:colOff><xdr:row>" + std::to_string(p.row) + "</xdr:row><xdr:rowOff>" +
+         std::to_string(p.row_off) + "</xdr:rowOff></xdr:" + tag + ">";
+}
+
+void ensure_attr(pugi::xml_node node, const char* name, const char* value) {
+  if (!node.attribute(name)) {
+    node.append_attribute(name).set_value(value);
+  }
+}
+
+// Creates an empty part at `path` so `store_part_dom` can fill it.
+Expected<void, Error> add_empty_part(Workbook& wb, const std::string& path, const char* content_type) {
+  if (io::ooxml::find_passthrough_part(wb, path) != nullptr) {
+    return Expected<void, Error>::Ok();
+  }
+  return wb.add_passthrough_part(PassthroughPart(path, content_type, {}));
+}
+
+void ensure_default_content_type(Workbook& wb, const char* extension, const char* content_type) {
+  for (const DefaultContentType& def : wb.default_content_types()) {
+    if (def.extension == extension) {
+      return;
+    }
+  }
+  std::vector<DefaultContentType> defaults = wb.default_content_types();
+  defaults.push_back({extension, content_type});
+  wb.set_default_content_types(std::move(defaults));
+}
+
+bool in_emu_range(std::int64_t value) {
+  return value >= 0 && value < kEmuLimit;
+}
+
+// Moves one marker for an edit along its axis; a marker inside a deleted span
+// lands on the deletion boundary with offset 0.
+AnchorPoint shift_point(AnchorPoint p, std::uint32_t index, std::uint32_t count, bool is_delete, bool row_axis) {
+  std::uint32_t& line = row_axis ? p.row : p.col;
+  std::int64_t& off = row_axis ? p.row_off : p.col_off;
+  if (line < index) {
+    return p;
+  }
+  if (!is_delete) {
+    const std::uint32_t limit = row_axis ? Sheet::kMaxRows : Sheet::kMaxCols;
+    const std::uint64_t shifted = static_cast<std::uint64_t>(line) + count;
+    line = static_cast<std::uint32_t>(std::min<std::uint64_t>(shifted, limit - 1U));
+  } else if (line >= index + count) {
+    line -= count;
+  } else {
+    line = index;
+    off = 0;
+  }
+  return p;
+}
+
+bool same_point(const AnchorPoint& a, const AnchorPoint& b) {
+  return a.row == b.row && a.col == b.col && a.row_off == b.row_off && a.col_off == b.col_off;
+}
+
+}  // namespace
+
+Expected<std::vector<DrawingObject>, Error> list_drawing_objects(const Workbook& wb, std::size_t sheet) {
+  if (sheet >= wb.sheet_count()) {
+    return invalid("drawing: sheet index out of range");
+  }
+  std::string path = wb.sheet(sheet).drawing_rel_target();
+  for (const UnknownRelationship& rel : wb.sheet(sheet).unknown_relationships()) {
+    if (path.empty() && rel.type == io::kRelDrawing && !rel.target_external) {
+      path = rel.target;
+    }
+  }
+  if (path.empty()) {
+    return std::vector<DrawingObject>{};
+  }
+  pugi::xml_document doc;
+  RETURN_IF_ERROR(load_drawing(wb, path, doc));
+  ASSIGN_OR_RETURN(std::vector<DrawingRel> rels, load_rels(wb.passthrough_parts(), path));
+  std::vector<DrawingObject> objects = read_drawing_objects(doc, rels);
+  for (DrawingObject& obj : objects) {
+    if (const PassthroughPart* media = io::ooxml::find_passthrough_part(wb, obj.media_path)) {
+      if (auto info = probe_image(media->bytes.data(), media->bytes.size())) {
+        obj.image_format = info.value().format;
+      }
+    }
+  }
+  return objects;
+}
+
+Expected<std::uint32_t, Error> insert_image(Workbook& wb, std::size_t sheet, const std::uint8_t* bytes, std::size_t len,
+                                            const ImageInsertOptions& options) {
+  ASSIGN_OR_RETURN(std::string path, editable_drawing_path(wb, sheet));
+  if (len > kMaxImageBytes) {
+    return invalid("drawing: image exceeds 32 MiB");
+  }
+  ASSIGN_OR_RETURN(ImageInfo info, probe_image(bytes, len));
+  if (options.anchor_kind == AnchorKind::kAbsolute) {
+    return invalid("drawing: images are anchored to one or two cells");
+  }
+  const std::int64_t cx = options.width_emu != 0 ? options.width_emu : info.px_width * kEmuPerPixel;
+  const std::int64_t cy = options.height_emu != 0 ? options.height_emu : info.px_height * kEmuPerPixel;
+  if (!in_emu_range(options.row_off) || !in_emu_range(options.col_off) || !in_emu_range(cx) || !in_emu_range(cy) ||
+      options.row >= Sheet::kMaxRows || options.col >= Sheet::kMaxCols) {
+    return invalid("drawing: image offset, size or cell out of range");
+  }
+  std::size_t total_bytes = len;
+  for (const PassthroughPart& part : wb.passthrough_parts()) {
+    total_bytes += part.bytes.size();
+  }
+  if (wb.passthrough_parts().size() + wb.sheet_count() + 3U > io::kMaxParts ||
+      total_bytes > io::kMaxTotalExtractedBytes) {
+    return invalid("drawing: package would exceed the reader's limits");
+  }
+
+  // Canonical markers: the offset lies inside its cell and `to` is `from`
+  // plus the image size under the display geometry.
+  const Geometry geo(wb, wb.sheet(sheet));
+  AnchorPoint from{options.row, options.col, options.row_off, options.col_off};
+  if (!geo.advance(true, from.row, from.row_off, 0) || !geo.advance(false, from.col, from.col_off, 0)) {
+    return invalid("drawing: anchor lies outside the sheet");
+  }
+  AnchorPoint to = from;
+  if (!geo.advance(true, to.row, to.row_off, cy) || !geo.advance(false, to.col, to.col_off, cx)) {
+    return invalid("drawing: image extends past the sheet");
+  }
+
+  const bool fresh = path.empty();
+  if (fresh) {
+    path = unused_part_path(wb, "xl/drawings/drawing", "xml");
+  }
+  pugi::xml_document doc;
+  if (fresh) {
+    doc.append_child("xdr:wsDr");
+  } else {
+    RETURN_IF_ERROR(load_drawing(wb, path, doc));
+  }
+  ASSIGN_OR_RETURN(std::vector<DrawingRel> rels, load_rels(wb.passthrough_parts(), path));
+  std::uint32_t id = 0;
+  for_each_element(doc, [&id](const pugi::xml_node& node) {
+    if (local_name(node) == "cNvPr") {
+      id = std::max(id, node.attribute("id").as_uint());
+    }
+  });
+  id = std::max(id, 1U) + 1U;  // Excel numbers drawing objects from 2.
+  std::string rid;
+  for (std::uint32_t n = 1; rid.empty(); ++n) {
+    const std::string candidate = "rId" + std::to_string(n);
+    if (std::none_of(rels.begin(), rels.end(), [&candidate](const DrawingRel& rel) { return rel.id == candidate; })) {
+      rid = candidate;
+    }
+  }
+  const std::string media_path = unused_part_path(wb, "xl/media/image", image_extension(info.format));
+
+  std::string xml;
+  if (options.anchor_kind == AnchorKind::kOneCell) {
+    xml = "<xdr:oneCellAnchor>" + marker_xml("from", from) + "<xdr:ext cx=\"" + std::to_string(cx) + "\" cy=\"" +
+          std::to_string(cy) + "\"/>";
+  } else {
+    xml = "<xdr:twoCellAnchor";
+    xml += options.edit_as == EditAs::kOneCell    ? " editAs=\"oneCell\""
+           : options.edit_as == EditAs::kAbsolute ? " editAs=\"absolute\""
+                                                  : "";
+    xml += ">" + marker_xml("from", from) + marker_xml("to", to);
+  }
+  xml += "<xdr:pic><xdr:nvPicPr><xdr:cNvPr id=\"" + std::to_string(id) +
+         "\"/><xdr:cNvPicPr><a:picLocks noChangeAspect=\"1\"/></xdr:cNvPicPr></xdr:nvPicPr><xdr:blipFill><a:blip "
+         "xmlns:r=\"" +
+         kNsR + "\" r:embed=\"" + rid +
+         "\"/><a:stretch><a:fillRect/></a:stretch></xdr:blipFill><xdr:spPr><a:xfrm><a:off x=\"" +
+         std::to_string(geo.offset(false, from.col) + from.col_off) + "\" y=\"" +
+         std::to_string(geo.offset(true, from.row) + from.row_off) + "\"/><a:ext cx=\"" + std::to_string(cx) +
+         "\" cy=\"" + std::to_string(cy) +
+         "\"/></a:xfrm><a:prstGeom prst=\"rect\"><a:avLst/></a:prstGeom></xdr:spPr></xdr:pic><xdr:clientData/>" +
+         (options.anchor_kind == AnchorKind::kOneCell ? "</xdr:oneCellAnchor>" : "</xdr:twoCellAnchor>");
+  pugi::xml_node root = doc.document_element();
+  if (!root.append_buffer(xml.data(), xml.size())) {
+    return invalid("drawing: anchor could not be built");
+  }
+  ensure_attr(root, "xmlns:xdr", kNsXdr);
+  ensure_attr(root, "xmlns:a", kNsA);
+  pugi::xml_node cnvpr = anchor_cnvpr(root.last_child());
+  cnvpr.append_attribute("name").set_value(
+      (options.name.empty() ? "Picture " + std::to_string(id) : options.name).c_str());
+  if (!options.descr.empty()) {
+    cnvpr.append_attribute("descr").set_value(options.descr.c_str());
+  }
+
+  const std::string rels_path = io::ooxml::rels_path_for_part(path);
+  pugi::xml_document rels_doc;
+  if (io::ooxml::find_passthrough_part(wb, rels_path) != nullptr) {
+    RETURN_IF_ERROR(io::ooxml::load_part_dom(wb, rels_path, "drawing", rels_doc));
+  } else {
+    rels_doc.load_string(kEmptyRels);
+  }
+  pugi::xml_node rel = rels_doc.child("Relationships").append_child("Relationship");
+  rel.append_attribute("Id").set_value(rid.c_str());
+  rel.append_attribute("Type").set_value(kRelImage);
+  rel.append_attribute("Target").set_value(relative_target(io::ooxml::dir_of(path), media_path).c_str());
+
+  RETURN_IF_ERROR(wb.add_passthrough_part(
+      PassthroughPart(media_path, std::string(), std::vector<std::uint8_t>(bytes, bytes + len))));
+  ensure_default_content_type(wb, image_extension(info.format), image_content_type(info.format));
+  RETURN_IF_ERROR(add_empty_part(wb, path, kCtDrawing));
+  RETURN_IF_ERROR(io::ooxml::store_part_dom(wb, path, doc));
+  RETURN_IF_ERROR(add_empty_part(wb, rels_path, ""));
+  RETURN_IF_ERROR(io::ooxml::store_part_dom(wb, rels_path, rels_doc));
+  if (fresh) {
+    wb.sheet(sheet).set_drawing_rel_target(path);
+  }
+  return id;
+}
+
+Expected<void, Error> remove_image(Workbook& wb, std::size_t sheet, std::uint32_t object_id) {
+  ASSIGN_OR_RETURN(std::string path, editable_drawing_path(wb, sheet));
+  if (path.empty()) {
+    return invalid("drawing: no picture with that id");
+  }
+  pugi::xml_document doc;
+  RETURN_IF_ERROR(load_drawing(wb, path, doc));
+  const pugi::xml_node root = doc.document_element();
+  for (const pugi::xml_node& anchor : drawing_anchors(root, false)) {
+    const DrawingObject obj = read_drawing_object(anchor, {});
+    if (obj.kind == DrawingObjectKind::kPicture && obj.object_id == object_id) {
+      pugi::xml_node top = anchor;
+      while (top.parent() != root) {
+        top = top.parent();
+      }
+      return drop_objects(wb, path, doc, {top});
+    }
+  }
+  return invalid("drawing: no picture with that id");
+}
+
+void shift_drawing_anchors(Workbook& wb, std::size_t sheet, std::uint32_t index, std::uint32_t count, bool is_delete,
+                           bool row_axis) {
+  const std::string path = wb.sheet(sheet).drawing_rel_target();
+  pugi::xml_document doc;
+  if (path.empty() || count == 0 || !load_drawing(wb, path, doc)) {
+    return;
+  }
+  const Geometry geo(wb, wb.sheet(sheet));
+  const pugi::xml_node root = doc.document_element();
+  const auto line = [row_axis](const AnchorPoint& p) { return row_axis ? p.row : p.col; };
+  const auto deleted = [&](const AnchorPoint& p) { return is_delete && line(p) >= index && line(p) - index < count; };
+  std::vector<pugi::xml_node> removed;
+  bool changed = false;
+  for (const pugi::xml_node& anchor : drawing_anchors(root, true)) {
+    const DrawingObject obj = read_drawing_object(anchor, {});
+    if (obj.edit_as == EditAs::kAbsolute) {
+      continue;
+    }
+    const pugi::xml_node from_node = child_local(anchor, "from");
+    const pugi::xml_node to_node = child_local(anchor, "to");
+    const bool two_cell = obj.anchor_kind == AnchorKind::kTwoCell;
+    if (two_cell && line(obj.to) < index) {
+      continue;  // The edit lies wholly after the object.
+    }
+    if (obj.edit_as == EditAs::kTwoCell && deleted(obj.from) && deleted(obj.to)) {
+      pugi::xml_node top = anchor;
+      while (top.parent() != root) {
+        top = top.parent();
+      }
+      if (std::find(removed.begin(), removed.end(), top) == removed.end()) {
+        removed.push_back(top);
+      }
+      continue;
+    }
+    const AnchorPoint from = shift_point(obj.from, index, count, is_delete, row_axis);
+    AnchorPoint to = shift_point(obj.to, index, count, is_delete, row_axis);
+    const std::int64_t extent = row_axis ? obj.cy : obj.cx;
+    if (two_cell && obj.edit_as == EditAs::kOneCell && extent > 0) {
+      // A move-only object keeps its size: `to` is re-derived from `from`.
+      std::uint32_t& to_line = row_axis ? to.row : to.col;
+      std::int64_t& to_off = row_axis ? to.row_off : to.col_off;
+      to_line = line(from);
+      to_off = row_axis ? from.row_off : from.col_off;
+      geo.advance(row_axis, to_line, to_off, extent);
+    }
+    if (!same_point(from, obj.from)) {
+      write_anchor_point(from_node, from);
+      changed = true;
+    }
+    if (two_cell && !same_point(to, obj.to)) {
+      write_anchor_point(to_node, to);
+      changed = true;
+    }
+  }
+  if (!removed.empty()) {
+    static_cast<void>(drop_objects(wb, path, doc, removed));
+  } else if (changed) {
+    static_cast<void>(io::ooxml::store_part_dom(wb, path, doc));
+  }
+}
+
+}  // namespace formulon
diff --git a/src/drawing/drawing_edit.h b/src/drawing/drawing_edit.h
new file mode 100644
index 000000000..5786cfc37
--- /dev/null
+++ b/src/drawing/drawing_edit.h
@@ -0,0 +1,80 @@
+//
+// Typed drawing edits: insert and remove images in a sheet's drawing part.
+//
+// Every edit parses the drawing part, patches the DOM and re-serialises it,
+// so charts, shapes and anything else the part holds stay intact; a part no
+// edit touched keeps its bytes. Inserting into a sheet without a drawing
+// creates `xl/drawings/drawingN.xml`, its rels part and the sheet's drawing
+// relationship. Media parts are `Default`-typed by extension.
+//
+// Refusals: a drawing part (or its rels part) that does not parse fails with
+// `kIoDrawingUnparseable`, as does a sheet whose drawing was retained from an
+// `.xlsb` package (reachable only through `Sheet::unknown_relationships()`);
+// bytes that are not a recognised image fail with `kIoImageUnsupported`.
+//
+// Row/column edits follow Excel's anchor rules: a move-and-size (two-cell)
+// object moves each marker, a marker inside a deleted span collapses to the
+// deletion boundary with offset 0, and an object whose span is deleted
+// entirely is removed; a move-only (one-cell) object moves its `from` the same
+// way and keeps its size; an absolute object never moves.
+
+#ifndef FORMULON_DRAWING_DRAWING_EDIT_H_
+#define FORMULON_DRAWING_DRAWING_EDIT_H_
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "drawing/drawing_xml.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon {
+
+class Workbook;
+
+/// Placement of an inserted image.
+struct ImageInsertOptions {
+  std::string name;                               ///< `cNvPr/@name`; empty yields `Picture <id>`.
+  std::string descr;                              ///< Alternative text; omitted when empty.
+  AnchorKind anchor_kind = AnchorKind::kOneCell;  ///< `kOneCell` or `kTwoCell`.
+  EditAs edit_as = EditAs::kTwoCell;              ///< Honoured for `kTwoCell` only.
+  std::uint32_t row = 0;                          ///< 0-based top-left cell.
+  std::uint32_t col = 0;
+  std::int64_t row_off = 0;  ///< EMU offset inside the cell.
+  std::int64_t col_off = 0;
+  std::int64_t width_emu = 0;   ///< 0 means pixel width x 9525.
+  std::int64_t height_emu = 0;  ///< 0 means pixel height x 9525.
+};
+
+/// Largest image `insert_image` accepts, in bytes.
+inline constexpr std::size_t kMaxImageBytes = 32U * 1024U * 1024U;
+
+/// Lists the anchored objects of sheet `sheet`'s drawing in document order,
+/// with `image_format` filled for pictures whose media part is present. A
+/// sheet without a drawing yields an empty list.
+Expected<std::vector<DrawingObject>, Error> list_drawing_objects(const Workbook& wb, std::size_t sheet);
+
+/// Inserts `bytes` as a picture and returns its `cNvPr` id, which is unique
+/// within the sheet's drawing. Fails with `kInvalidArgument` for a bad sheet,
+/// an absolute anchor kind, a negative or 2^31-EMU-or-larger offset or size,
+/// an anchor outside the sheet, an image over `kMaxImageBytes`, or a package
+/// that would exceed the reader's part or size limits.
+Expected<std::uint32_t, Error> insert_image(Workbook& wb, std::size_t sheet, const std::uint8_t* bytes, std::size_t len,
+                                            const ImageInsertOptions& options);
+
+/// Removes the picture with `object_id`, plus its image relationship and
+/// media part once nothing else references them. Fails with
+/// `kInvalidArgument` when the sheet has no picture with that id.
+Expected<void, Error> remove_image(Workbook& wb, std::size_t sheet, std::uint32_t object_id);
+
+/// Moves sheet `sheet`'s anchors for a row (`row_axis`) or column edit of
+/// `count` lines at `index`, after the sheet's own cells and layout moved. A
+/// drawing that does not parse is left untouched.
+void shift_drawing_anchors(Workbook& wb, std::size_t sheet, std::uint32_t index, std::uint32_t count, bool is_delete,
+                           bool row_axis);
+
+}  // namespace formulon
+
+#endif  // FORMULON_DRAWING_DRAWING_EDIT_H_
diff --git a/src/drawing/drawing_xml.cpp b/src/drawing/drawing_xml.cpp
new file mode 100644
index 000000000..766aef278
--- /dev/null
+++ b/src/drawing/drawing_xml.cpp
@@ -0,0 +1,283 @@
+#include "drawing/drawing_xml.h"
+
+#include <cstring>
+#include <utility>
+
+#include "io/ooxml/package_validator.h"
+#include "io/xml_utils.h"
+
+namespace formulon {
+namespace {
+
+Error unparseable(std::string_view what, std::string_view detail) {
+  return make_error(FormulonErrorCode::kIoDrawingUnparseable, std::string("drawing: ") + std::string(what),
+                    std::string(detail));
+}
+
+bool is_anchor(const pugi::xml_node& node) {
+  const std::string_view name = local_name(node);
+  return name == "twoCellAnchor" || name == "oneCellAnchor" || name == "absoluteAnchor";
+}
+
+// The element an anchor positions: its first child that is not a marker.
+pugi::xml_node anchor_content(const pugi::xml_node& anchor) {
+  for (pugi::xml_node child = anchor.first_child(); child; child = child.next_sibling()) {
+    if (child.type() != pugi::node_element) {
+      continue;
+    }
+    const std::string_view name = local_name(child);
+    if (name == "from" || name == "to" || name == "ext" || name == "pos" || name == "clientData") {
+      continue;
+    }
+    if (name == "AlternateContent") {
+      return child_local(child_local(child, "Choice"), "");
+    }
+    return child;
+  }
+  return {};
+}
+
+DrawingObjectKind classify(const pugi::xml_node& content) {
+  const std::string_view name = local_name(content);
+  if (name == "pic") {
+    return DrawingObjectKind::kPicture;
+  }
+  if (name == "sp") {
+    return DrawingObjectKind::kShape;
+  }
+  if (name == "grpSp") {
+    return DrawingObjectKind::kGroup;
+  }
+  if (name == "cxnSp") {
+    return DrawingObjectKind::kConnector;
+  }
+  if (name == "graphicFrame") {
+    const std::string_view uri = child_local(child_local(content, "graphic"), "graphicData").attribute("uri").value();
+    const auto ends_with = [uri](std::string_view suffix) {
+      return uri.size() >= suffix.size() && uri.substr(uri.size() - suffix.size()) == suffix;
+    };
+    return ends_with("/chart") || ends_with("/chartex") ? DrawingObjectKind::kChart : DrawingObjectKind::kGraphicFrame;
+  }
+  return DrawingObjectKind::kOther;
+}
+
+// The object's own `a:xfrm`: a child of the content (graphic frames) or of
+// its shape-properties element.
+pugi::xml_node content_xfrm(const pugi::xml_node& content) {
+  for (pugi::xml_node child = content.first_child(); child; child = child.next_sibling()) {
+    const std::string_view name = local_name(child);
+    if (name == "xfrm") {
+      return child;
+    }
+    if (name == "spPr" || name == "grpSpPr") {
+      return child_local(child, "xfrm");
+    }
+  }
+  return {};
+}
+
+pugi::xml_attribute attr_local(const pugi::xml_node& node, std::string_view name) {
+  for (pugi::xml_attribute attr = node.first_attribute(); attr; attr = attr.next_attribute()) {
+    const char* colon = std::strchr(attr.name(), ':');
+    if (std::string_view(colon != nullptr ? colon + 1 : attr.name()) == name) {
+      return attr;
+    }
+  }
+  return {};
+}
+
+pugi::xml_node find_descendant(const pugi::xml_node& node, std::string_view name) {
+  for (pugi::xml_node child = node.first_child(); child; child = child.next_sibling()) {
+    if (child.type() != pugi::node_element) {
+      continue;
+    }
+    if (local_name(child) == name) {
+      return child;
+    }
+    if (pugi::xml_node found = find_descendant(child, name)) {
+      return found;
+    }
+  }
+  return {};
+}
+
+}  // namespace
+
+std::string relative_target(std::string_view from_dir, std::string_view target) {
+  const std::string dir = std::string(from_dir) + "/";
+  std::size_t common = 0;
+  for (std::size_t i = 0; i < dir.size() && i < target.size() && dir[i] == target[i]; ++i) {
+    if (dir[i] == '/') {
+      common = i + 1;
+    }
+  }
+  std::string out;
+  for (std::size_t i = common; i < dir.size(); ++i) {
+    if (dir[i] == '/') {
+      out.append("../");
+    }
+  }
+  out.append(target.substr(common));
+  return out;
+}
+
+Expected<void, Error> parse_drawing_part(const std::vector<std::uint8_t>& bytes, pugi::xml_document& doc) {
+  if (!io::load_xml_buffer(doc, bytes, "drawing", "drawing")) {
+    return unparseable("part is not well-formed XML", {});
+  }
+  if (local_name(doc.document_element()) != "wsDr") {
+    return unparseable("part root is not wsDr", doc.document_element().name());
+  }
+  return Expected<void, Error>::Ok();
+}
+
+Expected<std::vector<DrawingRel>, Error> parse_part_rels(const std::vector<std::uint8_t>& bytes,
+                                                         std::string_view owner_dir) {
+  pugi::xml_document doc;
+  if (!io::load_xml_buffer(doc, bytes, "drawing", "rels")) {
+    return unparseable("rels part is not well-formed XML", owner_dir);
+  }
+  std::vector<DrawingRel> rels;
+  for (pugi::xml_node rel = doc.child("Relationships").child("Relationship"); rel;
+       rel = rel.next_sibling("Relationship")) {
+    DrawingRel entry;
+    entry.id = rel.attribute("Id").value();
+    entry.type = rel.attribute("Type").value();
+    entry.external = std::strcmp(rel.attribute("TargetMode").value(), "External") == 0;
+    entry.target = rel.attribute("Target").value();
+    if (!entry.external) {
+      auto resolved = io::ooxml::resolve_relative_path(owner_dir, entry.target);
+      if (!resolved) {
+        return unparseable("rels target does not resolve", entry.target);
+      }
+      entry.target = std::move(resolved.value());
+    }
+    rels.push_back(std::move(entry));
+  }
+  return rels;
+}
+
+std::string_view local_name(const pugi::xml_node& node) {
+  const char* name = node.name();
+  const char* colon = std::strchr(name, ':');
+  return colon != nullptr ? colon + 1 : name;
+}
+
+pugi::xml_node child_local(const pugi::xml_node& parent, std::string_view name) {
+  for (pugi::xml_node child = parent.first_child(); child; child = child.next_sibling()) {
+    if (child.type() == pugi::node_element && (name.empty() || local_name(child) == name)) {
+      return child;
+    }
+  }
+  return {};
+}
+
+std::vector<pugi::xml_node> drawing_anchors(const pugi::xml_node& root, bool include_fallback) {
+  std::vector<pugi::xml_node> anchors;
+  for (pugi::xml_node child = root.first_child(); child; child = child.next_sibling()) {
+    if (is_anchor(child)) {
+      anchors.push_back(child);
+      continue;
+    }
+    if (local_name(child) != "AlternateContent") {
+      continue;
+    }
+    bool first_choice = true;
+    for (pugi::xml_node branch = child.first_child(); branch; branch = branch.next_sibling()) {
+      const std::string_view name = local_name(branch);
+      const bool take = include_fallback || (name == "Choice" && first_choice);
+      first_choice = first_choice && name != "Choice";
+      if (!take) {
+        continue;
+      }
+      for (pugi::xml_node inner = branch.first_child(); inner; inner = inner.next_sibling()) {
+        if (is_anchor(inner)) {
+          anchors.push_back(inner);
+        }
+      }
+    }
+  }
+  return anchors;
+}
+
+pugi::xml_node anchor_cnvpr(const pugi::xml_node& anchor) {
+  const pugi::xml_node content = anchor_content(anchor);
+  for (pugi::xml_node child = content.first_child(); child; child = child.next_sibling()) {
+    const std::string_view name = local_name(child);
+    if (name.size() > 4 && name.substr(0, 2) == "nv" && name.substr(name.size() - 2) == "Pr") {
+      return child_local(child, "cNvPr");
+    }
+  }
+  return {};
+}
+
+DrawingObject read_drawing_object(const pugi::xml_node& anchor, const std::vector<DrawingRel>& rels) {
+  DrawingObject obj;
+  const std::string_view anchor_name = local_name(anchor);
+  if (anchor_name == "oneCellAnchor") {
+    obj.anchor_kind = AnchorKind::kOneCell;
+    obj.edit_as = EditAs::kOneCell;
+  } else if (anchor_name == "absoluteAnchor") {
+    obj.anchor_kind = AnchorKind::kAbsolute;
+    obj.edit_as = EditAs::kAbsolute;
+    const pugi::xml_node pos = child_local(anchor, "pos");
+    obj.from.col_off = pos.attribute("x").as_llong();
+    obj.from.row_off = pos.attribute("y").as_llong();
+  } else {
+    const std::string_view edit_as = anchor.attribute("editAs").value();
+    obj.edit_as = edit_as == "oneCell"    ? EditAs::kOneCell
+                  : edit_as == "absolute" ? EditAs::kAbsolute
+                                          : EditAs::kTwoCell;
+    obj.to = read_anchor_point(child_local(anchor, "to"));
+  }
+  if (obj.anchor_kind != AnchorKind::kAbsolute) {
+    obj.from = read_anchor_point(child_local(anchor, "from"));
+  }
+  const pugi::xml_node content = anchor_content(anchor);
+  obj.kind = classify(content);
+  pugi::xml_node ext = child_local(anchor, "ext");
+  if (!ext) {
+    ext = child_local(content_xfrm(content), "ext");
+  }
+  obj.cx = ext.attribute("cx").as_llong();
+  obj.cy = ext.attribute("cy").as_llong();
+  const pugi::xml_node cnvpr = anchor_cnvpr(anchor);
+  obj.object_id = cnvpr.attribute("id").as_uint();
+  obj.name = cnvpr.attribute("name").value();
+  obj.descr = cnvpr.attribute("descr").value();
+  if (obj.kind == DrawingObjectKind::kPicture) {
+    obj.image_rel_id = attr_local(find_descendant(content, "blip"), "embed").value();
+    for (const DrawingRel& rel : rels) {
+      if (!rel.external && !obj.image_rel_id.empty() && rel.id == obj.image_rel_id) {
+        obj.media_path = rel.target;
+      }
+    }
+  }
+  return obj;
+}
+
+std::vector<DrawingObject> read_drawing_objects(const pugi::xml_document& doc, const std::vector<DrawingRel>& rels) {
+  std::vector<DrawingObject> objects;
+  for (const pugi::xml_node& anchor : drawing_anchors(doc.document_element(), false)) {
+    objects.push_back(read_drawing_object(anchor, rels));
+  }
+  return objects;
+}
+
+AnchorPoint read_anchor_point(const pugi::xml_node& marker) {
+  AnchorPoint point;
+  point.col = child_local(marker, "col").text().as_uint();
+  point.col_off = child_local(marker, "colOff").text().as_llong();
+  point.row = child_local(marker, "row").text().as_uint();
+  point.row_off = child_local(marker, "rowOff").text().as_llong();
+  return point;
+}
+
+void write_anchor_point(const pugi::xml_node& marker, const AnchorPoint& point) {
+  child_local(marker, "col").text().set(point.col);
+  child_local(marker, "colOff").text().set(static_cast<long long>(point.col_off));
+  child_local(marker, "row").text().set(point.row);
+  child_local(marker, "rowOff").text().set(static_cast<long long>(point.row_off));
+}
+
+}  // namespace formulon
diff --git a/src/drawing/drawing_xml.h b/src/drawing/drawing_xml.h
new file mode 100644
index 000000000..b03378e18
--- /dev/null
+++ b/src/drawing/drawing_xml.h
@@ -0,0 +1,133 @@
+//
+// DrawingML part model: anchors and objects of a sheet's drawing part.
+//
+// The drawing part's bytes stay the source of truth: this module reads a
+// parsed `xdr:wsDr` document into a typed list of objects but never rebuilds
+// the part from that list, so everything it does not model (shape geometry,
+// effects, extension lists, unknown elements) survives an edit made through
+// the DOM. Element names are matched by local name, so a part that binds the
+// SpreadsheetDrawing or DrawingML namespaces to other prefixes reads the same.
+//
+// A top-level `mc:AlternateContent` contributes the anchors of its first
+// `mc:Choice`; its `mc:Fallback` is a rendering of the same object.
+
+#ifndef FORMULON_DRAWING_DRAWING_XML_H_
+#define FORMULON_DRAWING_DRAWING_XML_H_
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "drawing/image_header.h"
+#include "pugixml.hpp"
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon {
+
+/// What an anchor holds.
+enum class DrawingObjectKind : std::int32_t {
+  kPicture = 0,       ///< `xdr:pic`.
+  kShape = 1,         ///< `xdr:sp`.
+  kChart = 2,         ///< `xdr:graphicFrame` holding a chart or chartex.
+  kGroup = 3,         ///< `xdr:grpSp`.
+  kConnector = 4,     ///< `xdr:cxnSp`.
+  kGraphicFrame = 5,  ///< Any other `xdr:graphicFrame` (SmartArt, slicer, ...).
+  kOther = 6,         ///< Content part or an unrecognised element.
+};
+
+/// The anchor element type.
+enum class AnchorKind : std::int32_t {
+  kOneCell = 0,   ///< `xdr:oneCellAnchor` (from + ext).
+  kTwoCell = 1,   ///< `xdr:twoCellAnchor` (from + to).
+  kAbsolute = 2,  ///< `xdr:absoluteAnchor` (pos + ext).
+};
+
+/// How the object follows row/column edits. A two-cell anchor carries it in
+/// `editAs` (absent means `kTwoCell`); a one-cell anchor behaves as
+/// `kOneCell` and an absolute anchor as `kAbsolute`.
+enum class EditAs : std::int32_t {
+  kTwoCell = 0,
+  kOneCell = 1,
+  kAbsolute = 2,
+};
+
+/// One `xdr:from` / `xdr:to` marker: a 0-based cell plus EMU offsets.
+struct AnchorPoint {
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::int64_t row_off = 0;
+  std::int64_t col_off = 0;
+};
+
+/// One anchored object. An absolute anchor reports its `xdr:pos` as offsets
+/// from cell A1 in `from` (`col_off` = x, `row_off` = y).
+struct DrawingObject {
+  std::uint32_t object_id = 0;  ///< `cNvPr/@id`.
+  DrawingObjectKind kind = DrawingObjectKind::kOther;
+  AnchorKind anchor_kind = AnchorKind::kTwoCell;
+  EditAs edit_as = EditAs::kTwoCell;
+  AnchorPoint from;
+  AnchorPoint to;       ///< Two-cell anchors only.
+  std::int64_t cx = 0;  ///< Width in EMU (`xdr:ext`, else the object's `a:xfrm/a:ext`).
+  std::int64_t cy = 0;
+  std::string name;
+  std::string descr;
+  std::string image_rel_id;                          ///< Picture `a:blip/@r:embed`.
+  std::string media_path;                            ///< Package path the blip resolves to, or empty.
+  ImageFormat image_format = ImageFormat::kUnknown;  ///< Filled by callers that hold the media bytes.
+};
+
+/// One relationship of a drawing part's rels part. `target` is the resolved
+/// package path for an internal target and the raw value for an external one.
+struct DrawingRel {
+  std::string id;
+  std::string type;
+  std::string target;
+  bool external = false;
+};
+
+/// `Target=` value reaching package path `target` from a part in directory
+/// `from_dir` (no trailing slash; `xl/drawings` + `xl/media/image1.png` ->
+/// `../media/image1.png`).
+std::string relative_target(std::string_view from_dir, std::string_view target);
+
+/// Parses drawing part bytes. Fails with `kIoDrawingUnparseable` when they
+/// are not well-formed XML or the root is not `wsDr`.
+Expected<void, Error> parse_drawing_part(const std::vector<std::uint8_t>& bytes, pugi::xml_document& doc);
+
+/// Parses the rels part of a part in directory `owner_dir` (no trailing slash). Fails with
+/// `kIoDrawingUnparseable` on malformed XML or a target that cannot resolve.
+Expected<std::vector<DrawingRel>, Error> parse_part_rels(const std::vector<std::uint8_t>& bytes,
+                                                         std::string_view owner_dir);
+
+/// Local name of `node` (the part after any `prefix:`).
+std::string_view local_name(const pugi::xml_node& node);
+
+/// First element child of `parent` whose local name is `name`.
+pugi::xml_node child_local(const pugi::xml_node& parent, std::string_view name);
+
+/// The anchor elements of `root` in document order. `include_fallback`
+/// adds the `mc:Fallback` anchors of `mc:AlternateContent` wrappers, which a
+/// row/column edit must move along with the `mc:Choice` ones.
+std::vector<pugi::xml_node> drawing_anchors(const pugi::xml_node& root, bool include_fallback);
+
+/// The `cNvPr` element naming the object `anchor` holds, or a null node.
+pugi::xml_node anchor_cnvpr(const pugi::xml_node& anchor);
+
+/// Reads one anchor element.
+DrawingObject read_drawing_object(const pugi::xml_node& anchor, const std::vector<DrawingRel>& rels);
+
+/// Reads every anchored object of a parsed drawing part.
+std::vector<DrawingObject> read_drawing_objects(const pugi::xml_document& doc, const std::vector<DrawingRel>& rels);
+
+/// Reads an `xdr:from` / `xdr:to` marker.
+AnchorPoint read_anchor_point(const pugi::xml_node& marker);
+
+/// Overwrites the four children of an `xdr:from` / `xdr:to` marker.
+void write_anchor_point(const pugi::xml_node& marker, const AnchorPoint& point);
+
+}  // namespace formulon
+
+#endif  // FORMULON_DRAWING_DRAWING_XML_H_
diff --git a/src/drawing/image_header.cpp b/src/drawing/image_header.cpp
new file mode 100644
index 000000000..6d46ce4ac
--- /dev/null
+++ b/src/drawing/image_header.cpp
@@ -0,0 +1,134 @@
+#include "drawing/image_header.h"
+
+#include <cstring>
+
+namespace formulon {
+namespace {
+
+std::uint32_t be16(const std::uint8_t* p) {
+  return (static_cast<std::uint32_t>(p[0]) << 8) | p[1];
+}
+std::uint32_t be32(const std::uint8_t* p) {
+  return (be16(p) << 16) | be16(p + 2);
+}
+std::uint32_t le16(const std::uint8_t* p) {
+  return (static_cast<std::uint32_t>(p[1]) << 8) | p[0];
+}
+std::uint32_t le32(const std::uint8_t* p) {
+  return (le16(p + 2) << 16) | le16(p);
+}
+
+// Walks the JPEG marker segments up to the first start-of-frame marker.
+bool probe_jpeg(const std::uint8_t* b, std::size_t len, ImageInfo& out) {
+  std::size_t pos = 2;
+  while (pos + 1 < len) {
+    if (b[pos] != 0xFF) {
+      return false;
+    }
+    const std::uint8_t marker = b[pos + 1];
+    if (marker == 0xFF) {
+      ++pos;  // Fill byte.
+      continue;
+    }
+    pos += 2;
+    if (marker == 0x01 || (marker >= 0xD0 && marker <= 0xD8)) {
+      continue;  // Standalone markers carry no length.
+    }
+    if (marker == 0xD9 || marker == 0xDA || pos + 2 > len) {
+      return false;  // End of image or scan data before any frame header.
+    }
+    const std::uint32_t seg = be16(b + pos);
+    if (seg < 2) {
+      return false;
+    }
+    const bool sof = marker >= 0xC0 && marker <= 0xCF && marker != 0xC4 && marker != 0xC8 && marker != 0xCC;
+    if (sof) {
+      if (seg < 7 || pos + 7 > len) {
+        return false;
+      }
+      out.format = ImageFormat::kJpeg;
+      out.px_height = be16(b + pos + 3);
+      out.px_width = be16(b + pos + 5);
+      return true;
+    }
+    pos += seg;
+  }
+  return false;
+}
+
+bool probe(const std::uint8_t* b, std::size_t len, ImageInfo& out) {
+  static constexpr std::uint8_t kPngSig[8] = {0x89, 'P', 'N', 'G', 0x0D, 0x0A, 0x1A, 0x0A};
+  if (len >= 24 && std::memcmp(b, kPngSig, 8) == 0 && std::memcmp(b + 12, "IHDR", 4) == 0) {
+    out = {ImageFormat::kPng, be32(b + 16), be32(b + 20)};
+    return true;
+  }
+  if (len >= 3 && b[0] == 0xFF && b[1] == 0xD8 && b[2] == 0xFF) {
+    return probe_jpeg(b, len, out);
+  }
+  if (len >= 10 && (std::memcmp(b, "GIF87a", 6) == 0 || std::memcmp(b, "GIF89a", 6) == 0)) {
+    out = {ImageFormat::kGif, le16(b + 6), le16(b + 8)};
+    return true;
+  }
+  if (len >= 26 && b[0] == 'B' && b[1] == 'M') {
+    const std::uint32_t dib = le32(b + 14);
+    if (dib == 12) {
+      out = {ImageFormat::kBmp, le16(b + 18), le16(b + 20)};
+      return true;
+    }
+    if (dib >= 40) {
+      // A negative height marks a top-down bitmap.
+      const auto w = static_cast<std::int32_t>(le32(b + 18));
+      const auto h = static_cast<std::int32_t>(le32(b + 22));
+      if (w <= 0 || h == INT32_MIN) {
+        return false;
+      }
+      out = {ImageFormat::kBmp, static_cast<std::uint32_t>(w), static_cast<std::uint32_t>(h < 0 ? -h : h)};
+      return true;
+    }
+  }
+  return false;
+}
+
+}  // namespace
+
+Expected<ImageInfo, Error> probe_image(const std::uint8_t* bytes, std::size_t len) {
+  ImageInfo info;
+  if (bytes == nullptr || !probe(bytes, len, info) || info.px_width == 0 || info.px_height == 0) {
+    return make_error(FormulonErrorCode::kIoImageUnsupported, "image: unrecognised or truncated image header");
+  }
+  return info;
+}
+
+const char* image_extension(ImageFormat format) {
+  switch (format) {
+    case ImageFormat::kPng:
+      return "png";
+    case ImageFormat::kJpeg:
+      return "jpeg";
+    case ImageFormat::kGif:
+      return "gif";
+    case ImageFormat::kBmp:
+      return "bmp";
+    case ImageFormat::kUnknown:
+      break;
+  }
+  return "";
+}
+
+const char* image_content_type(ImageFormat format) {
+  switch (format) {
+    case ImageFormat::kPng:
+      return "image/png";
+    case ImageFormat::kJpeg:
+      return "image/jpeg";
+    case ImageFormat::kGif:
+      return "image/gif";
+    case ImageFormat::kBmp:
+      return "image/bmp";
+    case ImageFormat::kUnknown:
+      break;
+  }
+  return "";
+}
+
+}  // namespace formulon
diff --git a/src/drawing/image_header.h b/src/drawing/image_header.h
new file mode 100644
index 000000000..5e68b72d3
--- /dev/null
+++ b/src/drawing/image_header.h
@@ -0,0 +1,50 @@
+//
+// Image header sniffing: format and pixel size of PNG, JPEG, GIF and BMP bytes.
+//
+// Only the header is read (PNG IHDR, the first JPEG SOFn frame, the GIF
+// logical screen descriptor, the BMP DIB header); the pixel data is never
+// decoded, so a truncated body past the header still probes successfully.
+
+#ifndef FORMULON_DRAWING_IMAGE_HEADER_H_
+#define FORMULON_DRAWING_IMAGE_HEADER_H_
+
+#include <cstddef>
+#include <cstdint>
+
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon {
+
+/// Raster formats the drawing layer recognises.
+enum class ImageFormat : std::int32_t {
+  kUnknown = 0,
+  kPng = 1,
+  kJpeg = 2,
+  kGif = 3,
+  kBmp = 4,
+};
+
+/// Format and pixel size of an image.
+struct ImageInfo {
+  ImageFormat format = ImageFormat::kUnknown;
+  std::uint32_t px_width = 0;
+  std::uint32_t px_height = 0;
+};
+
+/// Sniffs the format and pixel size of `bytes`. Fails with
+/// `kIoImageUnsupported` when the bytes are not one of the recognised
+/// formats, the header is truncated, or it declares a zero dimension.
+Expected<ImageInfo, Error> probe_image(const std::uint8_t* bytes, std::size_t len);
+
+/// File extension Excel uses for `format`'s media part (`png`, `jpeg`, `gif`,
+/// `bmp`), or an empty string for `kUnknown`.
+const char* image_extension(ImageFormat format);
+
+/// MIME content type registered for `format`'s extension, or an empty string
+/// for `kUnknown`.
+const char* image_content_type(ImageFormat format);
+
+}  // namespace formulon
+
+#endif  // FORMULON_DRAWING_IMAGE_HEADER_H_
diff --git a/src/eval/a1_parse.cpp b/src/eval/a1_parse.cpp
new file mode 100644
index 000000000..0b4045ed7
--- /dev/null
+++ b/src/eval/a1_parse.cpp
@@ -0,0 +1,492 @@
+//
+// A1 and R1C1 textual reference parsers declared in `eval/a1_parse.h`:
+// `parse_a1_ref`, `parse_r1c1_ref` and `column_letters`, with the sheet
+// qualifier and endpoint lexers they share.
+
+#include "eval/a1_parse.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <string_view>
+
+#include "sheet.h"
+#include "utils/a1_column.h"
+
+namespace formulon {
+namespace eval {
+namespace refs_internal {
+
+namespace {
+
+// ASCII letter / digit predicates — intentionally local to avoid pulling
+// in `<cctype>` which is locale-sensitive on some platforms.
+constexpr bool is_letter(char ch) noexcept {
+  return (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z');
+}
+
+constexpr bool is_digit(char ch) noexcept {
+  return ch >= '0' && ch <= '9';
+}
+
+// Parses letters (A..XFD) at `text[*i]` into a 1-based column index, then
+// advances `*i` past the consumed bytes. Returns 0 on malformed input
+// (no letters, too many letters, or overflow past XFD = 16384).
+std::uint32_t parse_column_letters(std::string_view text, std::size_t* i) {
+  std::uint32_t col = 0;
+  std::size_t letters_seen = 0;
+  while (*i < text.size() && is_letter(text[*i])) {
+    char ch = text[*i];
+    if (ch >= 'a' && ch <= 'z') {
+      ch = static_cast<char>(ch - ('a' - 'A'));
+    }
+    col = col * 26u + static_cast<std::uint32_t>(ch - 'A' + 1);
+    ++(*i);
+    ++letters_seen;
+    if (letters_seen > 3 || col > Sheet::kMaxCols) {
+      return 0;
+    }
+  }
+  if (letters_seen == 0) {
+    return 0;
+  }
+  return col;
+}
+
+// Parses digits at `text[*i]` into a 1-based row index, advancing `*i`
+// past them. Returns 0 on no digits, too many digits, or row > kMaxRows.
+std::uint32_t parse_row_digits(std::string_view text, std::size_t* i) {
+  std::uint64_t row = 0;
+  std::size_t digits_seen = 0;
+  while (*i < text.size() && is_digit(text[*i])) {
+    row = row * 10u + static_cast<std::uint32_t>(text[*i] - '0');
+    ++(*i);
+    ++digits_seen;
+    if (digits_seen > 7 || row > Sheet::kMaxRows) {
+      return 0;
+    }
+  }
+  if (digits_seen == 0 || row == 0) {
+    return 0;
+  }
+  return static_cast<std::uint32_t>(row);
+}
+
+// Parses `[$]?<unit>:[$]?<unit>` consuming the entire remainder of
+// `text[start..]`, where `parse_unit` reads one 1-based unit and returns 0
+// on malformed input. On success writes the 0-based min / max of the two
+// units and returns true.
+bool parse_full_axis_span(std::string_view text, std::size_t start,
+                          std::uint32_t (*parse_unit)(std::string_view, std::size_t*), std::uint32_t* out_lo,
+                          std::uint32_t* out_hi) {
+  std::size_t i = start;
+  if (i < text.size() && text[i] == '$') {
+    ++i;
+  }
+  const std::uint32_t u1 = parse_unit(text, &i);
+  if (u1 == 0) {
+    return false;
+  }
+  if (i >= text.size() || text[i] != ':') {
+    return false;
+  }
+  ++i;
+  if (i < text.size() && text[i] == '$') {
+    ++i;
+  }
+  const std::uint32_t u2 = parse_unit(text, &i);
+  if (u2 == 0) {
+    return false;
+  }
+  if (i != text.size()) {
+    return false;
+  }
+  *out_lo = std::min(u1, u2) - 1U;
+  *out_hi = std::max(u1, u2) - 1U;
+  return true;
+}
+
+// Attempts to parse `text[start..]` as a full-column shape
+// `[$]?<letters>:[$]?<letters>` consuming the entire remainder. On
+// success sets `out->is_full_col` / `out->is_range`, populates
+// `col`/`col2` with the min/max 0-based columns, and fills
+// `row`/`row2` with the full-column row span, then returns true. On
+// failure leaves `*out` untouched and returns false.
+bool try_parse_full_col(std::string_view text, std::size_t start, A1Parse* out) {
+  std::uint32_t lo = 0;
+  std::uint32_t hi = 0;
+  if (!parse_full_axis_span(text, start, parse_column_letters, &lo, &hi)) {
+    return false;
+  }
+  out->col = lo;
+  out->col2 = hi;
+  out->row = 0;
+  out->row2 = Sheet::kMaxRows - 1U;
+  out->is_full_col = true;
+  out->is_range = true;
+  return true;
+}
+
+// Attempts to parse `text[start..]` as a full-row shape
+// `[$]?<digits>:[$]?<digits>` consuming the entire remainder. On
+// success sets `out->is_full_row` / `out->is_range`, populates
+// `row`/`row2` with the min/max 0-based rows, and fills `col`/`col2`
+// with the full-row column span, then returns true.
+bool try_parse_full_row(std::string_view text, std::size_t start, A1Parse* out) {
+  std::uint32_t lo = 0;
+  std::uint32_t hi = 0;
+  if (!parse_full_axis_span(text, start, parse_row_digits, &lo, &hi)) {
+    return false;
+  }
+  out->row = lo;
+  out->row2 = hi;
+  out->col = 0;
+  out->col2 = Sheet::kMaxCols - 1U;
+  out->is_full_row = true;
+  out->is_range = true;
+  return true;
+}
+
+// Parses a single A1 endpoint (optional `$` markers, letters, digits).
+// Returns `false` on any malformed shape; on success writes 0-based
+// row/col to `*out_row` / `*out_col` and advances `*i`.
+bool parse_a1_endpoint(std::string_view text, std::size_t* i, std::uint32_t* out_row, std::uint32_t* out_col) {
+  // Optional leading `$` on the column.
+  if (*i < text.size() && text[*i] == '$') {
+    ++(*i);
+  }
+  const std::uint32_t col_1based = parse_column_letters(text, i);
+  if (col_1based == 0) {
+    return false;
+  }
+  // Optional `$` between column and row.
+  if (*i < text.size() && text[*i] == '$') {
+    ++(*i);
+  }
+  const std::uint32_t row_1based = parse_row_digits(text, i);
+  if (row_1based == 0) {
+    return false;
+  }
+  *out_col = col_1based - 1U;
+  *out_row = row_1based - 1U;
+  return true;
+}
+
+// Copies `quoted` (everything between the surrounding single quotes)
+// into `out`, collapsing each `''` pair into a single `'`. Returns the
+// new size. `quoted` already excludes the outer quotes.
+std::size_t unescape_quoted_sheet(std::string_view quoted, char* out, std::size_t cap) {
+  std::size_t w = 0;
+  for (std::size_t r = 0; r < quoted.size() && w < cap; ++r) {
+    if (quoted[r] == '\'' && r + 1 < quoted.size() && quoted[r + 1] == '\'') {
+      out[w++] = '\'';
+      ++r;
+      continue;
+    }
+    out[w++] = quoted[r];
+  }
+  return w;
+}
+
+}  // namespace
+
+std::size_t column_letters(std::uint32_t col, char* out) {
+  if (col == 0U || out == nullptr) {
+    return 0U;
+  }
+  std::string letters;
+  if (!a1::append_column_letters(letters, col - 1U)) {
+    return 0U;
+  }
+  std::memcpy(out, letters.data(), letters.size());
+  return letters.size();
+}
+
+// Outcome of reading an optional leading `Sheet!` qualifier.
+enum class SheetQualifier : std::uint8_t {
+  kNone,       ///< No qualifier; `*i` is unmoved and the whole text is the reference.
+  kParsed,     ///< Qualifier consumed; `*sheet` is set and `*i` points past the `!`.
+  kMalformed,  ///< Unterminated quote or a quoted name with no `!`; the whole reference is invalid.
+};
+
+// Reads the optional sheet qualifier at the head of `text`, advancing `*i`
+// past it. Shared by the A1 and R1C1 parsers, which differ only in how
+// they read the reference body that follows.
+SheetQualifier parse_sheet_qualifier(std::string_view text, std::size_t* i, std::string_view* sheet) {
+  if (text.empty()) {
+    return SheetQualifier::kNone;
+  }
+  if (text[0] == '\'') {
+    // Scan for the closing `'` that is NOT followed by another `'` (the
+    // doubled form is an escaped apostrophe and stays inside the name).
+    std::size_t j = 1;
+    while (j < text.size()) {
+      if (text[j] == '\'') {
+        if (j + 1 < text.size() && text[j + 1] == '\'') {
+          j += 2;
+          continue;
+        }
+        break;
+      }
+      ++j;
+    }
+    if (j >= text.size() || text[j] != '\'') {
+      return SheetQualifier::kMalformed;  // unterminated
+    }
+    // Inside content is `text.substr(1, j - 1)`; unescape `''` -> `'`.
+    // We don't own backing storage here, so write into a static-sized
+    // local buffer; Excel sheet-name limit is 31 chars (we allow up to
+    // 255 defensively, capped by the source view size).
+    static thread_local char scratch[256];
+    const std::size_t content_len = j - 1;
+    const std::size_t used = unescape_quoted_sheet(text.substr(1, content_len), scratch, sizeof(scratch));
+    // This view points into thread_local storage — callers keep it alive
+    // only until the next parse on the same thread. The consuming code
+    // (`indirect`) copies before storing.
+    *sheet = std::string_view(scratch, used);
+    std::size_t after = j + 1;
+    if (after >= text.size() || text[after] != '!') {
+      return SheetQualifier::kMalformed;  // missing `!` after quoted sheet
+    }
+    *i = after + 1;
+    return SheetQualifier::kParsed;
+  }
+  // Bare sheet name: run of letters/digits/underscore followed by `!`.
+  // We only commit to treating it as a sheet qualifier if we find the
+  // `!` — otherwise the run is part of the reference itself.
+  std::size_t j = 0;
+  while (j < text.size() && (is_letter(text[j]) || is_digit(text[j]) || text[j] == '_')) {
+    ++j;
+  }
+  if (j > 0 && j < text.size() && text[j] == '!') {
+    *sheet = text.substr(0, j);
+    *i = j + 1;
+    return SheetQualifier::kParsed;
+  }
+  return SheetQualifier::kNone;
+}
+
+A1Parse parse_a1_ref(std::string_view text) {
+  A1Parse out;
+  if (text.empty()) {
+    return out;
+  }
+  std::size_t i = 0;
+  if (parse_sheet_qualifier(text, &i, &out.sheet) == SheetQualifier::kMalformed) {
+    return out;
+  }
+
+  // Full-column / full-row shapes (`D:D`, `$FF:FG`, `5:5`, `$12:$23`)
+  // are tried before the single-endpoint path because they never share a
+  // prefix with a valid single-cell reference (the latter always has a
+  // digit immediately after the letter run, never a `:`).
+  if (try_parse_full_col(text, i, &out)) {
+    out.valid = true;
+    return out;
+  }
+  if (try_parse_full_row(text, i, &out)) {
+    out.valid = true;
+    return out;
+  }
+
+  // Parse the first endpoint.
+  if (!parse_a1_endpoint(text, &i, &out.row, &out.col)) {
+    return out;
+  }
+
+  // Optional `:` + second endpoint for ranges.
+  if (i < text.size() && text[i] == ':') {
+    ++i;
+    if (!parse_a1_endpoint(text, &i, &out.row2, &out.col2)) {
+      return out;
+    }
+    out.is_range = true;
+  }
+
+  // Trailing garbage -> invalid.
+  if (i != text.size()) {
+    return out;
+  }
+  out.valid = true;
+  return out;
+}
+
+namespace {
+
+// One axis of an R1C1 endpoint: `R`/`C` on its own, `R5` (absolute), or
+// `R[-2]` (relative). `present` distinguishes an axis that was written
+// from one that was left out, which is what makes `R5` a whole row and
+// `R5C2` a single cell.
+struct R1C1Axis {
+  bool present = false;
+  bool relative = false;
+  long long value = 0;  ///< 1-based index when absolute, signed offset when relative.
+};
+
+// Reads one `R`/`C` axis at `text[*i]` when the marker matches `marker`.
+// Returns false only on malformed input; an absent axis leaves `*out`
+// unset and still returns true.
+bool parse_r1c1_axis(std::string_view text, std::size_t* i, char marker, R1C1Axis* out) {
+  if (*i >= text.size()) {
+    return true;
+  }
+  char head = text[*i];
+  if (head >= 'a' && head <= 'z') {
+    head = static_cast<char>(head - ('a' - 'A'));
+  }
+  if (head != marker) {
+    return true;
+  }
+  ++*i;
+  out->present = true;
+  if (*i < text.size() && text[*i] == '[') {
+    ++*i;
+    bool negative = false;
+    if (*i < text.size() && (text[*i] == '-' || text[*i] == '+')) {
+      negative = text[*i] == '-';
+      ++*i;
+    }
+    const std::size_t digits_start = *i;
+    long long magnitude = 0;
+    while (*i < text.size() && is_digit(text[*i])) {
+      magnitude = magnitude * 10 + (text[*i] - '0');
+      if (magnitude > Sheet::kMaxRows) {
+        return false;  // saturate well before overflow; out of grid either way
+      }
+      ++*i;
+    }
+    if (*i == digits_start || *i >= text.size() || text[*i] != ']') {
+      return false;
+    }
+    ++*i;
+    out->relative = true;
+    out->value = negative ? -magnitude : magnitude;
+    return true;
+  }
+  // A bare `R` / `C` is the current row / column: a zero relative offset.
+  const std::size_t digits_start = *i;
+  long long absolute = 0;
+  while (*i < text.size() && is_digit(text[*i])) {
+    absolute = absolute * 10 + (text[*i] - '0');
+    if (absolute > Sheet::kMaxRows) {
+      return false;
+    }
+    ++*i;
+  }
+  if (*i == digits_start) {
+    out->relative = true;
+    out->value = 0;
+    return true;
+  }
+  out->value = absolute;
+  return true;
+}
+
+// Resolves one axis to a 0-based coordinate against `base`, rejecting
+// anything outside `[0, max)`. A relative axis with no base has nothing
+// to measure from and fails rather than assuming the origin.
+bool resolve_r1c1_axis(const R1C1Axis& axis, bool base_present, std::uint32_t base, std::uint32_t max,
+                       std::uint32_t* out) {
+  if (axis.relative && !base_present) {
+    return false;
+  }
+  const long long resolved = axis.relative ? static_cast<long long>(base) + axis.value : axis.value - 1;
+  if (resolved < 0 || resolved >= static_cast<long long>(max)) {
+    return false;
+  }
+  *out = static_cast<std::uint32_t>(resolved);
+  return true;
+}
+
+// Parses one `R...C...` endpoint. At least one axis must be written.
+bool parse_r1c1_endpoint(std::string_view text, std::size_t* i, R1C1Axis* row, R1C1Axis* col) {
+  if (!parse_r1c1_axis(text, i, 'R', row)) {
+    return false;
+  }
+  if (!parse_r1c1_axis(text, i, 'C', col)) {
+    return false;
+  }
+  return row->present || col->present;
+}
+
+}  // namespace
+
+A1Parse parse_r1c1_ref(std::string_view text, const R1C1Base& base) {
+  A1Parse out;
+  if (text.empty()) {
+    return out;
+  }
+  std::size_t i = 0;
+  if (parse_sheet_qualifier(text, &i, &out.sheet) == SheetQualifier::kMalformed) {
+    return out;
+  }
+
+  R1C1Axis row1;
+  R1C1Axis col1;
+  if (!parse_r1c1_endpoint(text, &i, &row1, &col1)) {
+    return out;
+  }
+  R1C1Axis row2 = row1;
+  R1C1Axis col2 = col1;
+  bool is_range = false;
+  if (i < text.size() && text[i] == ':') {
+    ++i;
+    row2 = R1C1Axis{};
+    col2 = R1C1Axis{};
+    if (!parse_r1c1_endpoint(text, &i, &row2, &col2)) {
+      return out;
+    }
+    // A range whose endpoints name different axes (`R2:R3C4`) has no
+    // rectangle; Excel rejects it rather than guessing the missing bound.
+    if (row1.present != row2.present || col1.present != col2.present) {
+      return out;
+    }
+    is_range = true;
+  }
+  if (i != text.size()) {
+    return out;  // trailing garbage
+  }
+
+  // An endpoint that names only one axis is unbounded along the other, the
+  // same shape `5:5` and `D:D` take on the A1 side.
+  if (!col1.present) {
+    if (!resolve_r1c1_axis(row1, base.present, base.row, Sheet::kMaxRows, &out.row) ||
+        !resolve_r1c1_axis(row2, base.present, base.row, Sheet::kMaxRows, &out.row2)) {
+      return out;
+    }
+    out.col = 0;
+    out.col2 = Sheet::kMaxCols - 1U;
+    out.is_full_row = true;
+    out.is_range = true;
+    out.valid = true;
+    return out;
+  }
+  if (!row1.present) {
+    if (!resolve_r1c1_axis(col1, base.present, base.col, Sheet::kMaxCols, &out.col) ||
+        !resolve_r1c1_axis(col2, base.present, base.col, Sheet::kMaxCols, &out.col2)) {
+      return out;
+    }
+    out.row = 0;
+    out.row2 = Sheet::kMaxRows - 1U;
+    out.is_full_col = true;
+    out.is_range = true;
+    out.valid = true;
+    return out;
+  }
+
+  if (!resolve_r1c1_axis(row1, base.present, base.row, Sheet::kMaxRows, &out.row) ||
+      !resolve_r1c1_axis(col1, base.present, base.col, Sheet::kMaxCols, &out.col) ||
+      !resolve_r1c1_axis(row2, base.present, base.row, Sheet::kMaxRows, &out.row2) ||
+      !resolve_r1c1_axis(col2, base.present, base.col, Sheet::kMaxCols, &out.col2)) {
+    return out;
+  }
+  out.is_range = is_range;
+  out.valid = true;
+  return out;
+}
+
+}  // namespace refs_internal
+}  // namespace eval
+}  // namespace formulon
diff --git a/src/eval/adhoc_eval.cpp b/src/eval/adhoc_eval.cpp
index 5b13eb09c..7c6295e7e 100644
--- a/src/eval/adhoc_eval.cpp
+++ b/src/eval/adhoc_eval.cpp
@@ -7,6 +7,7 @@
 #include <cstdint>
 #include <string_view>
 
+#include "eval/builtin_names.h"
 #include "eval/eval_context.h"
 #include "eval/eval_state.h"
 #include "eval/formula_text_utils.h"
@@ -14,7 +15,6 @@
 #include "eval/tree_walker.h"
 #include "parser/ast.h"
 #include "parser/ast_shift.h"
-#include "parser/parser.h"
 #include "sheet.h"
 #include "utils/arena.h"
 #include "value.h"
@@ -73,7 +73,7 @@ Value parse_and_evaluate(const Workbook& workbook, const Sheet& sheet, std::uint
   // matching the recalc path's use of `strip_formula_prefix`.
   const std::string_view src = strip_formula_prefix(formula);
 
-  parser::AstNode* root = parser::parse_strict(src, arena);
+  parser::AstNode* root = parse_formula_entry(src, arena);
   if (root == nullptr) {
     return Value::error(ErrorCode::Name);
   }
@@ -100,7 +100,7 @@ bool evaluate_cf_formula(const Workbook& workbook, const Sheet& sheet, std::uint
                          const FunctionRegistry& registry) {
   const std::string_view src = strip_formula_prefix(formula);
 
-  parser::AstNode* root = parser::parse_strict(src, arena);
+  parser::AstNode* root = parse_formula_entry(src, arena);
   if (root == nullptr) {
     // A malformed rule formula does not fire (coerces to false).
     return false;
diff --git a/src/eval/aggregate_lazy.cpp b/src/eval/aggregate_lazy.cpp
index 78236c646..7f227c825 100644
--- a/src/eval/aggregate_lazy.cpp
+++ b/src/eval/aggregate_lazy.cpp
@@ -9,19 +9,23 @@
 #include <utility>
 #include <vector>
 
-#include "eval/aggregate_kernels.h"
+#include "auto_filter.h"
+#include "eval/builtin_names.h"
 #include "eval/builtins/subtotal.h"
 #include "eval/coerce.h"
 #include "eval/eval_context.h"
+#include "eval/formula_text_utils.h"
 #include "eval/lazy_impls.h"
 #include "eval/name_env_resolve.h"
 #include "eval/range_args.h"
+#include "numeric_aggregate_kernels.h"
 #include "parser/ast.h"
 #include "parser/reference.h"
 #include "sheet.h"
 #include "utils/arena.h"
 #include "utils/error.h"
 #include "utils/expected.h"
+#include "utils/strings.h"
 #include "value.h"
 #include "workbook.h"
 
@@ -83,7 +87,7 @@ Expected<double, ErrorCode> read_scalar(const parser::AstNode& node, Arena& aren
 // --- Row visibility ------------------------------------------------------
 //
 // `SUBTOTAL(100+n)` and `AGGREGATE` with the hidden-row option bit skip cells
-// that sit on a manually hidden row. Visibility is a property of the sheet
+// that sit on any hidden row. Visibility is a property of the sheet
 // (`Sheet::layout().row_overrides`), so it is only knowable for an argument
 // that still carries the rows its cells came from.
 //
@@ -94,10 +98,16 @@ Expected<double, ErrorCode> read_scalar(const parser::AstNode& node, Arena& aren
 // what Excel does for a literal array and the conservative answer elsewhere —
 // a cell whose row we cannot name is never silently dropped from a total.
 //
-// Excel additionally distinguishes filter-hidden from manually hidden rows
-// (codes 1..11 already skip filter-hidden rows). Formulon models only the
-// `RowLayout::hidden` flag the OOXML reader and `fm_sheet_set_row_hidden`
-// write, so both variants read that one flag and 1..11 include everything.
+// `SUBTOTAL(1..11)` skips only filter-hidden rows. OOXML stores no filtered
+// flag, so the class is derived the way Excel does after a reload: while any
+// AutoFilter on the sheet (its own or a table's) carries a criterion, every
+// hidden row of that sheet counts as filtered; otherwise none does.
+
+/// Which hidden rows an aggregate skips.
+enum class HiddenScope : std::uint8_t {
+  kAll,       ///< Every hidden row (`SUBTOTAL(101..111)`, AGGREGATE's hidden option).
+  kFiltered,  ///< Only filter-hidden rows (`SUBTOTAL(1..11)`).
+};
 
 // Resolves the sheet a reference-shaped argument reads from, together with
 // the 0-based row its first (top-left) cell occupies. Returns nullptr when
@@ -138,12 +148,7 @@ const Sheet* reference_arg_origin(const parser::AstNode& node, const EvalContext
   if (sheet_name.empty() && second != nullptr) {
     sheet_name = second->sheet;
   }
-  const Sheet* sheet = nullptr;
-  if (sheet_name.empty()) {
-    sheet = ctx.current_sheet();
-  } else if (ctx.workbook() != nullptr) {
-    sheet = ctx.workbook()->sheet_by_name(sheet_name);
-  }
+  const Sheet* sheet = ctx.sheet_for_qualifier(sheet_name);
   if (sheet == nullptr) {
     return nullptr;
   }
@@ -152,13 +157,15 @@ const Sheet* reference_arg_origin(const parser::AstNode& node, const EvalContext
 }
 
 // Appends `count` visibility flags for the cells of one argument, given the
-// argument's resolved shape. Cells on a hidden row are marked true.
-void append_visibility(const parser::AstNode& node, const EvalContext& ctx, std::uint32_t rows, std::uint32_t cols,
-                       std::vector<bool>* out_hidden) {
+// argument's resolved shape. Cells on a hidden row within `scope` are marked
+// true.
+void append_visibility(const parser::AstNode& node, const EvalContext& ctx, HiddenScope scope, std::uint32_t rows,
+                       std::uint32_t cols, std::vector<bool>* out_hidden) {
   const std::size_t count = static_cast<std::size_t>(rows) * static_cast<std::size_t>(cols);
   std::uint32_t top = 0;
   const Sheet* sheet = reference_arg_origin(node, ctx, &top);
-  if (sheet == nullptr || rows == 0U || cols == 0U) {
+  if (sheet == nullptr || rows == 0U || cols == 0U ||
+      (scope == HiddenScope::kFiltered && !sheet_has_filter_criteria(ctx.workbook(), *sheet))) {
     out_hidden->resize(out_hidden->size() + count, false);
     return;
   }
@@ -181,6 +188,179 @@ void append_visibility(const parser::AstNode& node, const EvalContext& ctx, std:
   }
 }
 
+// --- Nested SUBTOTAL / AGGREGATE exclusion --------------------------------
+//
+// SUBTOTAL (every function number) and AGGREGATE options 0..3 skip a cell
+// whose own formula contains a SUBTOTAL or AGGREGATE call anywhere in its
+// AST: inside LET / LAMBDA bodies, in an unevaluated IF branch, in any case.
+// A defined name, a string literal, INDIRECT or a cell that merely references
+// a subtotal cell does not count. Every cell of a spill whose anchor
+// qualifies is skipped too.
+//
+// The check is two-staged. Formula text is a cheap case-insensitive substring
+// candidate test; only candidates are parsed and walked. It runs once per
+// formula cell inside a reference argument, so a range without subtotal text
+// costs one substring scan per formula cell and no parsing.
+
+bool is_nested_call_name(std::string_view name) noexcept {
+  return strings::case_insensitive_eq(name, "SUBTOTAL") || strings::case_insensitive_eq(name, "AGGREGATE");
+}
+
+bool ast_has_nested_call(const parser::AstNode& node) {
+  using parser::NodeKind;
+  switch (node.kind()) {
+    case NodeKind::SpillRef: {
+      const parser::AstNode* anchor = node.as_spill_ref_anchor_expr();
+      return anchor != nullptr && ast_has_nested_call(*anchor);
+    }
+    case NodeKind::UnaryOp:
+      return ast_has_nested_call(node.as_unary_operand());
+    case NodeKind::ImplicitIntersection:
+      return ast_has_nested_call(node.as_implicit_intersection_operand());
+    case NodeKind::BinaryOp:
+      return ast_has_nested_call(node.as_binary_lhs()) || ast_has_nested_call(node.as_binary_rhs());
+    case NodeKind::RangeOp:
+      return ast_has_nested_call(node.as_range_lhs()) || ast_has_nested_call(node.as_range_rhs());
+    case NodeKind::IntersectOp:
+      return ast_has_nested_call(node.as_intersect_lhs()) || ast_has_nested_call(node.as_intersect_rhs());
+    case NodeKind::UnionOp:
+      for (std::uint32_t i = 0; i < node.as_union_arity(); ++i) {
+        if (ast_has_nested_call(node.as_union_child(i))) {
+          return true;
+        }
+      }
+      return false;
+    case NodeKind::Call:
+      if (is_nested_call_name(node.as_call_name())) {
+        return true;
+      }
+      for (std::uint32_t i = 0; i < node.as_call_arity(); ++i) {
+        if (ast_has_nested_call(node.as_call_arg(i))) {
+          return true;
+        }
+      }
+      return false;
+    case NodeKind::ArrayLiteral:
+      for (std::uint32_t r = 0; r < node.as_array_rows(); ++r) {
+        for (std::uint32_t c = 0; c < node.as_array_cols(); ++c) {
+          if (ast_has_nested_call(node.as_array_element(r, c))) {
+            return true;
+          }
+        }
+      }
+      return false;
+    case NodeKind::Lambda:
+      return ast_has_nested_call(node.as_lambda_body());
+    case NodeKind::LetBinding:
+      for (std::uint32_t i = 0; i < node.as_let_binding_count(); ++i) {
+        if (ast_has_nested_call(node.as_let_binding_expr(i))) {
+          return true;
+        }
+      }
+      return ast_has_nested_call(node.as_let_body());
+    case NodeKind::LambdaCall:
+      if (ast_has_nested_call(node.as_lambda_call_callee())) {
+        return true;
+      }
+      for (std::uint32_t i = 0; i < node.as_lambda_call_arity(); ++i) {
+        if (ast_has_nested_call(node.as_lambda_call_arg(i))) {
+          return true;
+        }
+      }
+      return false;
+    default:
+      return false;  // Leaves: literals, references, names, errors.
+  }
+}
+
+bool text_may_hold_nested_call(std::string_view text) noexcept {
+  static constexpr std::string_view kNeedles[] = {"SUBTOTAL", "AGGREGATE"};
+  for (const std::string_view needle : kNeedles) {
+    for (std::size_t i = 0; i + needle.size() <= text.size(); ++i) {
+      if (strings::case_insensitive_eq(text.substr(i, needle.size()), needle)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+// True when the formula cell at (row, col) of `sheet` calls SUBTOTAL or
+// AGGREGATE anywhere in its AST.
+bool cell_formula_has_nested_call(const Sheet& sheet, std::uint32_t row, std::uint32_t col) {
+  Sheet::CellRead read;
+  sheet.read_formula_cell(row, col, read);
+  if (!read.exists() || !read.is_formula() || !text_may_hold_nested_call(read.formula_text())) {
+    return false;
+  }
+  Arena arena;
+  const parser::AstNode* root = parse_formula_entry(strip_formula_prefix(read.formula_text()), arena);
+  return root != nullptr && ast_has_nested_call(*root);
+}
+
+// Appends one flag per cell of the reference-shaped argument `node`, true for
+// cells that must be excluded as nested subtotals. Arguments without sheet
+// provenance (literals, computed arrays, `A1#`) are never flagged.
+void append_nested_flags(const parser::AstNode& node, const EvalContext& ctx, std::uint32_t rows, std::uint32_t cols,
+                         std::vector<bool>* out_nested) {
+  const std::size_t count = static_cast<std::size_t>(rows) * static_cast<std::size_t>(cols);
+  const std::size_t base = out_nested->size();
+  out_nested->resize(base + count, false);
+
+  const parser::Reference* first = nullptr;
+  const parser::Reference* second = nullptr;
+  if (node.kind() == parser::NodeKind::Ref) {
+    first = &node.as_ref();
+    second = first;
+  } else if (node.kind() == parser::NodeKind::RangeOp && node.as_range_lhs().kind() == parser::NodeKind::Ref &&
+             node.as_range_rhs().kind() == parser::NodeKind::Ref) {
+    first = &node.as_range_lhs().as_ref();
+    second = &node.as_range_rhs().as_ref();
+  }
+  if (first == nullptr || count == 0U) {
+    return;
+  }
+  const Sheet* sheet = nullptr;
+  const auto rect_or = ctx.walked_range_rect(*first, *second, &sheet);
+  if (!rect_or || !rect_or.value().has_value() || sheet == nullptr) {
+    return;
+  }
+  const DeclaredRect& rect = *rect_or.value();
+  if (rect.rows() != rows || rect.cols() != cols) {
+    return;  // Shape disagrees with the resolver: flag nothing.
+  }
+  const auto mark = [&](std::uint32_t row, std::uint32_t col) {
+    (*out_nested)[base + static_cast<std::size_t>(row - rect.row_first) * cols + (col - rect.col_first)] = true;
+  };
+
+  for (const CellAddress addr : sheet->formula_cells_in(rect.row_first, rect.col_first, rect.row_last, rect.col_last)) {
+    if (cell_formula_has_nested_call(*sheet, addr.row, addr.col)) {
+      mark(addr.row, addr.col);
+    }
+  }
+  // A spill's phantom cells carry no formula of their own; the anchor's
+  // formula decides for the whole footprint, even when the anchor lies
+  // outside the rectangle.
+  for (const SpillFootprint& fp : sheet->committed_spill_footprints()) {
+    if (fp.rows == 0U || fp.cols == 0U || fp.anchor_row > rect.row_last || fp.anchor_col > rect.col_last ||
+        fp.anchor_row + fp.rows - 1U < rect.row_first || fp.anchor_col + fp.cols - 1U < rect.col_first) {
+      continue;
+    }
+    if (!cell_formula_has_nested_call(*sheet, fp.anchor_row, fp.anchor_col)) {
+      continue;
+    }
+    const std::uint32_t r0 = std::max(fp.anchor_row, rect.row_first);
+    const std::uint32_t r1 = std::min(fp.anchor_row + fp.rows - 1U, rect.row_last);
+    const std::uint32_t c0 = std::max(fp.anchor_col, rect.col_first);
+    const std::uint32_t c1 = std::min(fp.anchor_col + fp.cols - 1U, rect.col_last);
+    for (std::uint32_t r = r0; r <= r1; ++r) {
+      for (std::uint32_t c = c0; c <= c1; ++c) {
+        mark(r, c);
+      }
+    }
+  }
+}
+
 // Appends every scalar Value produced by `arg_node` to `out_cells`, mirroring
 // PERCENTOF's `sum_arg_for_percentof` provenance walk. LET-bound NameRefs
 // resolve to their bound AST when range-shaped. On any expansion failure
@@ -188,23 +368,18 @@ void append_visibility(const parser::AstNode& node, const EvalContext& ctx, std:
 // error in `*out_err`. Returns true on a clean walk.
 //
 // `out_hidden` grows in lockstep with `out_cells`, one flag per appended
-// cell, so a later filter can drop the cells that sit on hidden rows without
-// re-deriving where each one came from.
+// cell (hidden rows within `scope`), so a later filter can drop them without
+// re-deriving where each one came from. `out_nested` (nullable) grows the same
+// way with the nested SUBTOTAL / AGGREGATE flags; null skips the detection.
 //
 // Unlike PERCENTOF this helper does NOT filter by Value kind: AGGREGATE's
 // per-mode rules (numeric branches drop non-numerics; COUNTA counts them;
 // the error-ignore bit decides whether errors short-circuit) are applied
 // later by `apply_filters`.
 bool collect_arg(const parser::AstNode& arg_node, Arena& arena, const FunctionRegistry& registry,
-                 const EvalContext& ctx, std::vector<Value>* out_cells, std::vector<bool>* out_hidden, Value* out_err) {
-  const parser::AstNode* effective = &arg_node;
-  if (arg_node.kind() == parser::NodeKind::NameRef) {
-    const parser::AstNode& resolved = resolve_name_ast(arg_node, ctx.name_env());
-    if (&resolved != &arg_node && is_range_shaped_ast(resolved)) {
-      effective = &resolved;
-    }
-  }
-  const parser::AstNode& node = *effective;
+                 const EvalContext& ctx, HiddenScope scope, std::vector<Value>* out_cells,
+                 std::vector<bool>* out_hidden, std::vector<bool>* out_nested, Value* out_err) {
+  const parser::AstNode& node = resolve_range_binding(arg_node, ctx.name_env(), /*accept_ref=*/false);
   const parser::NodeKind k = node.kind();
 
   // Range / Ref / SpillRef / RangeOp -> use the canonical resolver.
@@ -220,9 +395,15 @@ bool collect_arg(const parser::AstNode& arg_node, Arena& arena, const FunctionRe
     // the row mapping would be a guess.
     const std::size_t n = rr.cells.size();
     if (static_cast<std::size_t>(rr.rows) * static_cast<std::size_t>(rr.cols) == n) {
-      append_visibility(node, ctx, rr.rows, rr.cols, out_hidden);
+      append_visibility(node, ctx, scope, rr.rows, rr.cols, out_hidden);
+      if (out_nested != nullptr) {
+        append_nested_flags(node, ctx, rr.rows, rr.cols, out_nested);
+      }
     } else {
       out_hidden->resize(out_hidden->size() + n, false);
+      if (out_nested != nullptr) {
+        out_nested->resize(out_nested->size() + n, false);
+      }
     }
     out_cells->insert(out_cells->end(), std::make_move_iterator(rr.cells.begin()),
                       std::make_move_iterator(rr.cells.end()));
@@ -238,6 +419,9 @@ bool collect_arg(const parser::AstNode& arg_node, Arena& arena, const FunctionRe
         const Value v = eval_node(node.as_array_element(r, c), arena, registry, ctx);
         out_cells->push_back(v);
         out_hidden->push_back(false);
+        if (out_nested != nullptr) {
+          out_nested->push_back(false);
+        }
       }
     }
     return true;
@@ -253,10 +437,16 @@ bool collect_arg(const parser::AstNode& arg_node, Arena& arena, const FunctionRe
     const std::size_t n = static_cast<std::size_t>(array->rows) * static_cast<std::size_t>(array->cols);
     out_cells->insert(out_cells->end(), array->cells, array->cells + n);
     out_hidden->resize(out_hidden->size() + n, false);
+    if (out_nested != nullptr) {
+      out_nested->resize(out_nested->size() + n, false);
+    }
     return true;
   }
   out_cells->push_back(v);
   out_hidden->push_back(false);
+  if (out_nested != nullptr) {
+    out_nested->push_back(false);
+  }
   return true;
 }
 
@@ -276,6 +466,18 @@ void drop_hidden_cells(std::vector<Value>* cells, const std::vector<bool>& hidde
   *cells = std::move(kept);
 }
 
+// Builds the drop mask for one call: the hidden flags when `use_hidden`, OR
+// the nested flags when `use_nested`. Both inputs grew in lockstep with the
+// cells, so the mask drops them in a single pass and no vector goes stale.
+std::vector<bool> make_drop_mask(std::size_t n, bool use_hidden, const std::vector<bool>& hidden, bool use_nested,
+                                 const std::vector<bool>& nested) {
+  std::vector<bool> mask(n, false);
+  for (std::size_t i = 0; i < n; ++i) {
+    mask[i] = (use_hidden && i < hidden.size() && hidden[i]) || (use_nested && i < nested.size() && nested[i]);
+  }
+  return mask;
+}
+
 // Filters `cells` in place according to the options bit and the function
 // code's expected provenance:
 //
@@ -330,7 +532,7 @@ std::vector<double> to_numbers(const std::vector<Value>& cells) {
 // ---------------------------------------------------------------------------
 // Mode runners (codes 1..13). The numeric-aggregator slots (SUM / PRODUCT /
 // MIN / MAX / AVERAGE / VAR.* / STDEV.*) all delegate to the shared kernels
-// in `aggregate_kernels.h` so SUBTOTAL and AGGREGATE cannot drift. Empty-
+// in `numeric_aggregate_kernels.h` so SUBTOTAL and AGGREGATE cannot drift. Empty-
 // range behaviour matches Excel's convention for SUBTOTAL / AGGREGATE:
 // SUM/PRODUCT/MIN/MAX -> 0, AVERAGE/VAR/STDEV -> #DIV/0!, MEDIAN -> #DIV/0!,
 // COUNT/COUNTA -> 0, MODE.SNGL -> #N/A.
@@ -382,19 +584,19 @@ Value run_large_small(std::vector<double> xs, double k_raw, bool want_large) {
 }
 
 // PERCENTILE.INC. Domain / position-formula logic lives in
-// `aggregate_kernels::percentile_sorted_inc`; this wrapper sorts in place
+// `numeric_aggregate_kernels::percentile_sorted_inc`; this wrapper sorts in place
 // and lifts the kernel result to `Value`.
 Value run_percentile_inc(std::vector<double> xs, double p) {
   std::sort(xs.begin(), xs.end());
-  return lift_kernel_result(aggregate_kernels::percentile_sorted_inc(xs, p));
+  return lift_kernel_result(numeric_aggregate_kernels::percentile_sorted_inc(xs, p));
 }
 
 // PERCENTILE.EXC. Domain / position-formula logic lives in
-// `aggregate_kernels::percentile_sorted_exc`; this wrapper sorts in place
+// `numeric_aggregate_kernels::percentile_sorted_exc`; this wrapper sorts in place
 // and lifts the kernel result to `Value`.
 Value run_percentile_exc(std::vector<double> xs, double p) {
   std::sort(xs.begin(), xs.end());
-  return lift_kernel_result(aggregate_kernels::percentile_sorted_exc(xs, p));
+  return lift_kernel_result(numeric_aggregate_kernels::percentile_sorted_exc(xs, p));
 }
 
 // QUARTILE.INC delegates to PERCENTILE.INC at p ∈ {0, 0.25, 0.5, 0.75, 1.0}.
@@ -450,19 +652,18 @@ Value eval_subtotal_lazy(const parser::AstNode& call, Arena& arena, const Functi
   if (!code) {
     return Value::error(code.error());
   }
-  const bool skip_hidden = subtotal_code_skips_hidden(code.value());
+  const HiddenScope scope = subtotal_code_skips_hidden(code.value()) ? HiddenScope::kAll : HiddenScope::kFiltered;
 
   std::vector<Value> cells;
   std::vector<bool> hidden;
+  std::vector<bool> nested;
   Value err = Value::blank();
   for (std::uint32_t i = 1; i < arity; ++i) {
-    if (!collect_arg(call.as_call_arg(i), arena, registry, ctx, &cells, &hidden, &err)) {
+    if (!collect_arg(call.as_call_arg(i), arena, registry, ctx, scope, &cells, &hidden, &nested, &err)) {
       return err;
     }
   }
-  if (skip_hidden) {
-    drop_hidden_cells(&cells, hidden);
-  }
+  drop_hidden_cells(&cells, make_drop_mask(cells.size(), /*use_hidden=*/true, hidden, /*use_nested=*/true, nested));
 
   // Hand the mode dispatch the same shape the eager dispatcher would have
   // built: the function code followed by the flattened data cells.
@@ -500,13 +701,15 @@ Value eval_aggregate_lazy(const parser::AstNode& call, Arena& arena, const Funct
     return Value::error(ErrorCode::Value);
   }
   // Bit 0 (mask 1) is the hidden-row bit and bit 1 (mask 2) the error-ignore
-  // bit. Bit 2 selects whether nested SUBTOTAL / AGGREGATE results are also
-  // skipped, which is not yet observable; see the file header.
+  // bit. Bit 2 set (options 4..7) keeps nested SUBTOTAL / AGGREGATE cells.
   const bool ignore_hidden = (options & 1) != 0;
   const bool ignore_errors = (options & 2) != 0;
+  const bool ignore_nested = options < 4;
 
   std::vector<Value> cells;
   std::vector<bool> hidden;
+  std::vector<bool> nested;
+  std::vector<bool>* nested_out = ignore_nested ? &nested : nullptr;
 
   if (code >= kFnKArgFirst) {
     // 14..19 — Excel requires exactly one data range plus a trailing k.
@@ -514,12 +717,10 @@ Value eval_aggregate_lazy(const parser::AstNode& call, Arena& arena, const Funct
     if (arity != 4U) {
       return Value::error(ErrorCode::Value);
     }
-    if (!collect_arg(call.as_call_arg(2), arena, registry, ctx, &cells, &hidden, &err)) {
+    if (!collect_arg(call.as_call_arg(2), arena, registry, ctx, HiddenScope::kAll, &cells, &hidden, nested_out, &err)) {
       return err;
     }
-    if (ignore_hidden) {
-      drop_hidden_cells(&cells, hidden);
-    }
+    drop_hidden_cells(&cells, make_drop_mask(cells.size(), ignore_hidden, hidden, ignore_nested, nested));
     if (!apply_filters(&cells, code, ignore_errors, &err)) {
       return err;
     }
@@ -552,48 +753,46 @@ Value eval_aggregate_lazy(const parser::AstNode& call, Arena& arena, const Funct
 
   // Codes 1..13 — every remaining positional arg is data.
   for (std::uint32_t i = 2; i < arity; ++i) {
-    if (!collect_arg(call.as_call_arg(i), arena, registry, ctx, &cells, &hidden, &err)) {
+    if (!collect_arg(call.as_call_arg(i), arena, registry, ctx, HiddenScope::kAll, &cells, &hidden, nested_out, &err)) {
       return err;
     }
   }
-  if (ignore_hidden) {
-    drop_hidden_cells(&cells, hidden);
-  }
+  drop_hidden_cells(&cells, make_drop_mask(cells.size(), ignore_hidden, hidden, ignore_nested, nested));
   if (!apply_filters(&cells, code, ignore_errors, &err)) {
     return err;
   }
 
   switch (code) {
     case kCodeAverage:
-      return lift_kernel_result(aggregate_kernels::run_average(to_numbers(cells)));
+      return lift_kernel_result(numeric_aggregate_kernels::run_average(to_numbers(cells)));
     case kCodeCount:
       return run_count(cells);
     case kCodeCountA:
       return run_counta(cells);
     case kCodeMax:
-      return lift_kernel_result(aggregate_kernels::run_max(to_numbers(cells)));
+      return lift_kernel_result(numeric_aggregate_kernels::run_max(to_numbers(cells)));
     case kCodeMin:
-      return lift_kernel_result(aggregate_kernels::run_min(to_numbers(cells)));
+      return lift_kernel_result(numeric_aggregate_kernels::run_min(to_numbers(cells)));
     case kCodeProduct:
-      return lift_kernel_result(aggregate_kernels::run_product(to_numbers(cells)));
+      return lift_kernel_result(numeric_aggregate_kernels::run_product(to_numbers(cells)));
     case kCodeStdevS:
-      return lift_kernel_result(aggregate_kernels::run_stdev(to_numbers(cells), /*sample=*/true));
+      return lift_kernel_result(numeric_aggregate_kernels::run_stdev(to_numbers(cells), /*sample=*/true));
     case kCodeStdevP:
-      return lift_kernel_result(aggregate_kernels::run_stdev(to_numbers(cells), /*sample=*/false));
+      return lift_kernel_result(numeric_aggregate_kernels::run_stdev(to_numbers(cells), /*sample=*/false));
     case kCodeSum:
-      return lift_kernel_result(aggregate_kernels::run_sum(to_numbers(cells)));
+      return lift_kernel_result(numeric_aggregate_kernels::run_sum(to_numbers(cells)));
     case kCodeVarS:
-      return lift_kernel_result(aggregate_kernels::run_variance(to_numbers(cells), /*sample=*/true));
+      return lift_kernel_result(numeric_aggregate_kernels::run_variance(to_numbers(cells), /*sample=*/true));
     case kCodeVarP:
-      return lift_kernel_result(aggregate_kernels::run_variance(to_numbers(cells), /*sample=*/false));
+      return lift_kernel_result(numeric_aggregate_kernels::run_variance(to_numbers(cells), /*sample=*/false));
     case kCodeMedian:
       // The shared kernel sorts internally; do NOT pre-sort. Its empty-slice
       // code is `#NUM!`, which is what standalone MEDIAN reports.
-      return lift_kernel_result(aggregate_kernels::run_median(to_numbers(cells)));
+      return lift_kernel_result(numeric_aggregate_kernels::run_median(to_numbers(cells)));
     case kCodeModeSngl:
       // First-occurrence tie-break (Excel MODE.SNGL): the shared kernel
       // consumes the cells in input order, so do NOT sort first.
-      return lift_kernel_result(aggregate_kernels::mode_first_occurrence(to_numbers(cells)));
+      return lift_kernel_result(numeric_aggregate_kernels::mode_first_occurrence(to_numbers(cells)));
     default:
       // Unreachable: code is constrained to [1, 13] in this branch.
       return Value::error(ErrorCode::Value);
diff --git a/src/eval/aggregate_lazy.h b/src/eval/aggregate_lazy.h
index 147384406..0cedce259 100644
--- a/src/eval/aggregate_lazy.h
+++ b/src/eval/aggregate_lazy.h
@@ -26,17 +26,9 @@
 //                   filter. Codes 0..3 *also* skip nested SUBTOTAL/AGGREGATE
 //                   results inside the range; codes 4..7 do not.
 //
-// One intentional simplification relative to Mac Excel 365 (the same
-// shortfall SUBTOTAL has documented in `eval/builtins/subtotal.cpp`):
-//
-//   * Nested-SUBTOTAL/AGGREGATE filtering: Excel ignores cells whose source
-//     formula is itself a SUBTOTAL or AGGREGATE call so a column of
-//     subtotals can be aggregated without double-counting. Formulon does
-//     not yet expose per-cell formula text from inside a builtin, so this
-//     filter is omitted. The nested-call bit is therefore unobservable and
-//     options codes 0/4, 1/5, 2/6, 3/7 each collapse to one pair of
-//     behaviors.
-//
+// Options 0..3 also skip cells whose own formula calls SUBTOTAL or AGGREGATE
+// anywhere in its AST (see aggregate_lazy.cpp); options 4..7 keep them.
+
 // What we honor today is the hidden-row bit (mask 1) and the error-ignore
 // bit (mask 2):
 //
diff --git a/src/eval/array_alloc.cpp b/src/eval/array_alloc.cpp
index 48e4609c9..9879d75d6 100644
--- a/src/eval/array_alloc.cpp
+++ b/src/eval/array_alloc.cpp
@@ -37,5 +37,19 @@ ArrayValue* allocate_array_value(std::uint32_t rows, std::uint32_t cols, Arena&
   return out;
 }
 
+ArrayValue* array_from_values(std::uint32_t rows, std::uint32_t cols, const Value* values, std::size_t count,
+                              Arena& arena) {
+  Value* buffer = nullptr;
+  ArrayValue* arr = allocate_array_value(rows, cols, arena, buffer, kMaxDerivedArrayCells);
+  if (arr == nullptr) {
+    return nullptr;
+  }
+  const std::size_t total = static_cast<std::size_t>(rows) * static_cast<std::size_t>(cols);
+  for (std::size_t i = 0; i < total; ++i) {
+    buffer[i] = i < count ? values[i] : Value::blank();
+  }
+  return arr;
+}
+
 }  // namespace eval
 }  // namespace formulon
diff --git a/src/eval/array_alloc.h b/src/eval/array_alloc.h
index 5cc6eb8ee..e499017c3 100644
--- a/src/eval/array_alloc.h
+++ b/src/eval/array_alloc.h
@@ -25,6 +25,7 @@
 #ifndef FORMULON_EVAL_ARRAY_ALLOC_H_
 #define FORMULON_EVAL_ARRAY_ALLOC_H_
 
+#include <cstddef>
 #include <cstdint>
 
 #include "utils/resource_budget.h"
@@ -66,6 +67,13 @@ static_assert(kMaxDerivedArrayCells * sizeof(Value) <= kMaxEvalArenaBytes,
 ArrayValue* allocate_array_value(std::uint32_t rows, std::uint32_t cols, Arena& arena, Value*& out_buffer,
                                  std::uint64_t max_cells = kMaxDynamicArrayCells);
 
+/// Allocates a `(rows, cols)` array under `kMaxDerivedArrayCells` and fills it
+/// row-major from the first `count` entries of `values`, padding the rest with
+/// Blank (a clamped range expansion can return fewer cells than its rectangle).
+/// Returns `nullptr` under the same conditions as `allocate_array_value`.
+ArrayValue* array_from_values(std::uint32_t rows, std::uint32_t cols, const Value* values, std::size_t count,
+                              Arena& arena);
+
 }  // namespace eval
 }  // namespace formulon
 
diff --git a/src/eval/builtin_names.cpp b/src/eval/builtin_names.cpp
index f07a22824..65802fbc4 100644
--- a/src/eval/builtin_names.cpp
+++ b/src/eval/builtin_names.cpp
@@ -5,6 +5,8 @@
 #include "eval/function_registry.h"
 #include "eval/special_forms_catalog.h"
 #include "eval/tree_walker.h"
+#include "parser/parser.h"
+#include "utils/arena.h"
 #include "utils/strings.h"
 
 namespace formulon {
@@ -128,5 +130,13 @@ const AstNode* find_qualified_builtin_call(const AstNode& root) {
   return nullptr;
 }
 
+AstNode* parse_formula_entry(std::string_view src, Arena& arena) {
+  AstNode* root = parser::parse_strict(src, arena);
+  if (root == nullptr || find_qualified_builtin_call(*root) != nullptr) {
+    return nullptr;
+  }
+  return root;
+}
+
 }  // namespace eval
 }  // namespace formulon
diff --git a/src/eval/builtin_names.h b/src/eval/builtin_names.h
index 01885dea3..2f288db72 100644
--- a/src/eval/builtin_names.h
+++ b/src/eval/builtin_names.h
@@ -18,6 +18,8 @@
 #include "parser/ast.h"
 
 namespace formulon {
+class Arena;
+
 namespace eval {
 
 /// Returns the canonical UPPERCASE name of the built-in `name` refers to
@@ -32,6 +34,14 @@ const char* resolve_builtin_function_name(std::string_view name);
 /// offending callee.
 const parser::AstNode* find_qualified_builtin_call(const parser::AstNode& root);
 
+/// Parses a formula body at a public formula-entry boundary. The parser
+/// accepts qualified names syntactically because they may denote defined
+/// names; a qualified built-in is nevertheless invalid formula entry and is
+/// treated like any other parse failure by evaluation and indexing callers.
+/// The returned AST is owned by `arena`, or nullptr when parsing fails or the
+/// AST contains a qualified built-in call.
+parser::AstNode* parse_formula_entry(std::string_view src, Arena& arena);
+
 }  // namespace eval
 }  // namespace formulon
 
diff --git a/src/eval/builtins/complex_num.cpp b/src/eval/builtins/complex_num.cpp
index 71b43c138..61cb37109 100644
--- a/src/eval/builtins/complex_num.cpp
+++ b/src/eval/builtins/complex_num.cpp
@@ -575,20 +575,8 @@ Value ImExp(const Value* args, std::uint32_t /*arity*/, Arena& arena) {
   return im_unary_text(&cplx_exp, args, arena);
 }
 
-Value ImLn(const Value* args, std::uint32_t /*arity*/, Arena& arena) {
-  auto z = parse_complex_value(args[0]);
-  if (!z) {
-    return Value::error(z.error());
-  }
-  const Complex c = z.value();
-  if (c.re == 0.0 && c.im == 0.0) {
-    return Value::error(ErrorCode::Num);
-  }
-  return text_complex(cplx_ln(c), arena);
-}
-
-// Shared kernel for IMLOG10 / IMLOG2 (and any future IMLOG_<base>): computes
-// log_base(z) = ln(z) * inv_ln_base. Returns #NUM! when z == 0; otherwise
+// Shared kernel for IMLN / IMLOG10 / IMLOG2: computes
+// log_base(z) = ln(z) * inv_ln_base (IMLN passes 1, which scales exactly). Returns #NUM! when z == 0; otherwise
 // scales the real and imaginary components of ln(z) by `inv_ln_base`. The
 // caller passes the precomputed `1 / ln(base)` constant so we keep one body.
 // Marked `noinline` so the body is emitted exactly once — the wrappers are
@@ -607,6 +595,10 @@ Value ImLn(const Value* args, std::uint32_t /*arity*/, Arena& arena) {
   return text_complex(Complex{ln_z.re * inv_ln_base, ln_z.im * inv_ln_base, c.suffix}, arena);
 }
 
+Value ImLn(const Value* args, std::uint32_t /*arity*/, Arena& arena) {
+  return im_log_base(1.0, args, arena);
+}
+
 Value ImLog10(const Value* args, std::uint32_t /*arity*/, Arena& arena) {
   return im_log_base(1.0 / std::log(10.0), args, arena);
 }
diff --git a/src/eval/builtins/datetime.cpp b/src/eval/builtins/datetime.cpp
index 43649fd45..baae6d006 100644
--- a/src/eval/builtins/datetime.cpp
+++ b/src/eval/builtins/datetime.cpp
@@ -21,6 +21,7 @@
 #include <cmath>
 #include <cstdint>
 #include <ctime>
+#include <limits>
 #include <string_view>
 
 #include "eval/builtins/registration_helpers.h"
@@ -181,7 +182,12 @@ Expected<int, ErrorCode> read_optional_truncated_int_arg(const Value* args, std:
   if (!n) {
     return n.error();
   }
-  return static_cast<int>(std::trunc(n.value()));
+  const double truncated = std::trunc(n.value());
+  if (!std::isfinite(truncated) || truncated < static_cast<double>(std::numeric_limits<int>::lowest()) ||
+      truncated > static_cast<double>(std::numeric_limits<int>::max())) {
+    return ErrorCode::Num;
+  }
+  return static_cast<int>(truncated);
 }
 
 Expected<date_time::YMD, ErrorCode> coerce_serial_ymd(const Value& v, bool date1904) {
@@ -284,9 +290,10 @@ Value Date_(const Value* args, std::uint32_t /*arity*/, Arena& /*arena*/, bool d
   return Value::number(serial);
 }
 
-/// TIME(hour, minute, second). Each component is truncated; out-of-range
-/// inputs are accepted and normalised modulo 24/60/60. A negative result
-/// (e.g. `TIME(-1, 0, 0)`) yields `#NUM!` per Excel.
+/// TIME(hour, minute, second). Each component is truncated; positive values
+/// above Excel's documented 32767-component limit yield `#NUM!`. Accepted
+/// inputs are normalised modulo 24/60/60. A negative result (e.g.
+/// `TIME(-1, 0, 0)`) yields `#NUM!` per Excel.
 Value Time_(const Value* args, std::uint32_t /*arity*/, Arena& /*arena*/) {
   auto hours = read_truncated_number_arg(args, 0);
   if (!hours) {
@@ -300,8 +307,11 @@ Value Time_(const Value* args, std::uint32_t /*arity*/, Arena& /*arena*/) {
   if (!seconds) {
     return Value::error(seconds.error());
   }
+  if (hours.value() > 32767.0 || minutes.value() > 32767.0 || seconds.value() > 32767.0) {
+    return Value::error(ErrorCode::Num);
+  }
   const double total = hours.value() * 3600.0 + minutes.value() * 60.0 + seconds.value();
-  if (total < 0.0) {
+  if (!std::isfinite(total) || total < 0.0) {
     return Value::error(ErrorCode::Num);
   }
   // Normalise modulo a full day so `TIME(25, 0, 0) == TIME(1, 0, 0)`.
diff --git a/src/eval/builtins/distributions.cpp b/src/eval/builtins/distributions.cpp
index 6d8efbbfa..7dfadb3ab 100644
--- a/src/eval/builtins/distributions.cpp
+++ b/src/eval/builtins/distributions.cpp
@@ -214,21 +214,9 @@ double BetaPdfStd(double x, double alpha, double beta_shape) noexcept {
 // Jacobian 1 / (B - A). #NUM! on: alpha <= 0, beta <= 0, A >= B,
 // x < A, x > B.
 Value BetaDist(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
-  auto x_e = read_number(args, 0);
-  if (!x_e) {
-    return Value::error(x_e.error());
-  }
-  auto alpha_e = read_number(args, 1);
-  if (!alpha_e) {
-    return Value::error(alpha_e.error());
-  }
-  auto beta_e = read_number(args, 2);
-  if (!beta_e) {
-    return Value::error(beta_e.error());
-  }
-  auto cum_e = coerce_to_bool(args[3]);
-  if (!cum_e) {
-    return Value::error(cum_e.error());
+  auto parsed = read_cumulative_triple(args);
+  if (!parsed) {
+    return Value::error(parsed.error());
   }
   auto a_e = read_optional_number(args, arity, 4, 0.0);
   if (!a_e) {
@@ -238,9 +226,9 @@ Value BetaDist(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   if (!b_e) {
     return Value::error(b_e.error());
   }
-  const double x = x_e.value();
-  const double alpha = alpha_e.value();
-  const double beta_shape = beta_e.value();
+  const double x = parsed.value().params.first;
+  const double alpha = parsed.value().params.second;
+  const double beta_shape = parsed.value().params.third;
   const double a = a_e.value();
   const double b = b_e.value();
   if (alpha <= 0.0 || beta_shape <= 0.0 || a >= b || x < a || x > b) {
@@ -248,7 +236,7 @@ Value BetaDist(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   }
   const double span = b - a;
   const double y = (x - a) / span;
-  if (cum_e.value()) {
+  if (parsed.value().cumulative) {
     // CDF boundaries: the regularized incomplete beta already returns 0
     // at y == 0 and 1 at y == 1 exactly, so no special-case is needed.
     const double r = stats::regularized_incomplete_beta(alpha, beta_shape, y);
@@ -286,17 +274,9 @@ Value BetaDist(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
 // for y in (0, 1), then rescales via x = A + y * (B - A). #NUM! on
 // p <= 0, p >= 1, alpha <= 0, beta <= 0, A >= B.
 Value BetaInv(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
-  auto p_e = read_number(args, 0);
-  if (!p_e) {
-    return Value::error(p_e.error());
-  }
-  auto alpha_e = read_number(args, 1);
-  if (!alpha_e) {
-    return Value::error(alpha_e.error());
-  }
-  auto beta_e = read_number(args, 2);
-  if (!beta_e) {
-    return Value::error(beta_e.error());
+  auto parsed = read_number_triple(args);
+  if (!parsed) {
+    return Value::error(parsed.error());
   }
   auto a_e = read_optional_number(args, arity, 3, 0.0);
   if (!a_e) {
@@ -306,9 +286,9 @@ Value BetaInv(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   if (!b_e) {
     return Value::error(b_e.error());
   }
-  const double p = p_e.value();
-  const double alpha = alpha_e.value();
-  const double beta_shape = beta_e.value();
+  const double p = parsed.value().first;
+  const double alpha = parsed.value().second;
+  const double beta_shape = parsed.value().third;
   const double a = a_e.value();
   const double b = b_e.value();
   if (p <= 0.0 || p >= 1.0 || alpha <= 0.0 || beta_shape <= 0.0 || a >= b) {
diff --git a/src/eval/builtins/dynamic_array.cpp b/src/eval/builtins/dynamic_array.cpp
index a5053d775..d34a4bb96 100644
--- a/src/eval/builtins/dynamic_array.cpp
+++ b/src/eval/builtins/dynamic_array.cpp
@@ -22,7 +22,6 @@
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
-#include <random>
 
 #include "eval/array_alloc.h"
 #include "eval/builtins/numeric_helpers.h"
@@ -220,25 +219,15 @@ Value RandArray(const Value* args, std::uint32_t arity, Arena& arena) {
   }
   std::mt19937_64& rng = thread_local_rng();
   if (whole_number) {
-    const auto lo = static_cast<std::int64_t>(min_v);
-    const auto hi = static_cast<std::int64_t>(max_v);
-    std::uniform_int_distribution<std::int64_t> dist(lo, hi);
     for (std::size_t i = 0; i < n; ++i) {
-      buffer[i] = Value::number(static_cast<double>(dist(rng)));
+      buffer[i] = Value::number(sample_uniform_integer(min_v, max_v, rng));
     }
   } else {
     // `std::uniform_real_distribution` matches Excel's documented
     // half-open `[min, max)` for non-whole RANDARRAY. When `min == max`
     // the distribution returns `min` deterministically.
-    if (min_v == max_v) {
-      for (std::size_t i = 0; i < n; ++i) {
-        buffer[i] = Value::number(min_v);
-      }
-    } else {
-      std::uniform_real_distribution<double> dist(min_v, max_v);
-      for (std::size_t i = 0; i < n; ++i) {
-        buffer[i] = Value::number(dist(rng));
-      }
+    for (std::size_t i = 0; i < n; ++i) {
+      buffer[i] = Value::number(sample_uniform_real(min_v, max_v, rng));
     }
   }
 
diff --git a/src/eval/builtins/engineering.cpp b/src/eval/builtins/engineering.cpp
index 39d9edde9..52a3a88d2 100644
--- a/src/eval/builtins/engineering.cpp
+++ b/src/eval/builtins/engineering.cpp
@@ -22,7 +22,6 @@
 
 #include <cmath>
 #include <cstdint>
-#include <cstdio>
 #include <cstdlib>
 #include <string>
 #include <string_view>
@@ -32,12 +31,15 @@
 #include "eval/function_registry.h"
 #include "utils/arena.h"
 #include "utils/expected.h"
+#include "utils/number_text.h"
 #include "value.h"
 
 namespace formulon {
 namespace eval {
 namespace {
 
+using builtins_detail::coerce_truncated_in_range;
+
 // ---------------------------------------------------------------------------
 // Base conversion helpers
 // ---------------------------------------------------------------------------
@@ -157,22 +159,11 @@ Expected<std::string, ErrorCode> encode_base_string(std::int64_t value, const Ba
 // Excel rejects Bool directly for `places` with `#VALUE!` — strict-Bool
 // rejection mirroring the input-digit side of BIN2*/OCT2*/HEX2*.
 Expected<int, ErrorCode> coerce_places(const Value& v) {
-  if (v.kind() == ValueKind::Bool) {
-    return ErrorCode::Value;
-  }
-  auto p = coerce_to_number(v);
-  if (!p) {
-    return p.error();
-  }
-  const double d = p.value();
-  if (std::isnan(d) || std::isinf(d)) {
-    return ErrorCode::Num;
-  }
-  const double t = std::trunc(d);
-  if (t < 1.0 || t > 10.0) {
-    return ErrorCode::Num;
+  auto t = coerce_truncated_in_range(v, 1.0, 10.0, /*reject_bool=*/true);
+  if (!t) {
+    return t.error();
   }
-  return static_cast<int>(t);
+  return static_cast<int>(t.value());
 }
 
 // Extracts the input digit string for *2* source-side parsing. For Text,
@@ -201,7 +192,7 @@ Expected<std::string, ErrorCode> input_digit_string(const Value& v) {
       // Use a fixed-width scratch buffer: the magnitude fits in a 64-bit
       // integer (signed range is well below 2^63 for our bases).
       char buf[32];
-      std::snprintf(buf, sizeof(buf), "%lld", static_cast<long long>(t));
+      format_signed(buf, sizeof(buf), static_cast<long long>(t));
       return std::string(buf);
     }
     case ValueKind::Bool:
@@ -262,22 +253,12 @@ Value convert_from_dec(const Value* args, std::uint32_t arity, Arena& arena, con
   // with `#VALUE!` rather than coercing TRUE/FALSE to 1/0. Matches EFFECT /
   // NOMINAL's strict-Bool rejection (see `financial_misc.cpp`). Bool inside
   // a range cell would have been flattened earlier; direct scalars only.
-  if (args[0].kind() == ValueKind::Bool) {
-    return Value::error(ErrorCode::Value);
-  }
-  auto n = coerce_to_number(args[0]);
-  if (!n) {
-    return Value::error(n.error());
-  }
-  const double d = n.value();
-  if (std::isnan(d) || std::isinf(d)) {
-    return Value::error(ErrorCode::Num);
-  }
-  const double t = std::trunc(d);
-  if (t < static_cast<double>(dst.min_signed) || t > static_cast<double>(dst.max_signed)) {
-    return Value::error(ErrorCode::Num);
+  auto t = coerce_truncated_in_range(args[0], static_cast<double>(dst.min_signed), static_cast<double>(dst.max_signed),
+                                     /*reject_bool=*/true);
+  if (!t) {
+    return Value::error(t.error());
   }
-  const auto value = static_cast<std::int64_t>(t);
+  const auto value = static_cast<std::int64_t>(t.value());
   int places = 0;
   const int* places_ptr = nullptr;
   if (arity >= 2) {
@@ -387,19 +368,12 @@ Expected<std::uint64_t, ErrorCode> coerce_48_bit_unsigned(const Value& v) {
 // value argument, the shift is Excel-truncated (34.67 -> 34) rather than
 // rejected.
 Expected<int, ErrorCode> coerce_shift(const Value& v) {
-  auto n = coerce_to_number(v);
-  if (!n) {
-    return n.error();
+  auto t = coerce_truncated_in_range(v, -static_cast<double>(kBitShiftMagnitudeMax),
+                                     static_cast<double>(kBitShiftMagnitudeMax), /*reject_bool=*/false);
+  if (!t) {
+    return t.error();
   }
-  const double d = n.value();
-  if (std::isnan(d) || std::isinf(d)) {
-    return ErrorCode::Num;
-  }
-  const double t = std::trunc(d);
-  if (t < -static_cast<double>(kBitShiftMagnitudeMax) || t > static_cast<double>(kBitShiftMagnitudeMax)) {
-    return ErrorCode::Num;
-  }
-  return static_cast<int>(t);
+  return static_cast<int>(t.value());
 }
 
 using BitwiseOp = std::uint64_t (*)(std::uint64_t, std::uint64_t);
@@ -535,6 +509,29 @@ Value Gestep(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
 
 }  // namespace
 
+namespace builtins_detail {
+
+Expected<double, ErrorCode> coerce_truncated_in_range(const Value& v, double lo, double hi, bool reject_bool) {
+  if (reject_bool && v.kind() == ValueKind::Bool) {
+    return ErrorCode::Value;
+  }
+  auto n = coerce_to_number(v);
+  if (!n) {
+    return n.error();
+  }
+  const double d = n.value();
+  if (std::isnan(d) || std::isinf(d)) {
+    return ErrorCode::Num;
+  }
+  const double t = std::trunc(d);
+  if (t < lo || t > hi) {
+    return ErrorCode::Num;
+  }
+  return t;
+}
+
+}  // namespace builtins_detail
+
 void register_engineering_builtins(FunctionRegistry& registry) {
   // Base conversion. The spec pins BIN2DEC / OCT2DEC / HEX2DEC to exactly
   // one argument (no `places`); all others accept an optional `places`.
diff --git a/src/eval/builtins/engineering.h b/src/eval/builtins/engineering.h
index ce6177973..c0db6943c 100644
--- a/src/eval/builtins/engineering.h
+++ b/src/eval/builtins/engineering.h
@@ -12,11 +12,24 @@
 #ifndef FORMULON_EVAL_BUILTINS_ENGINEERING_H_
 #define FORMULON_EVAL_BUILTINS_ENGINEERING_H_
 
+#include "utils/expected.h"
+#include "value.h"
+
 namespace formulon {
 namespace eval {
 
 class FunctionRegistry;
 
+namespace builtins_detail {
+
+/// Coerces `v` to a finite number truncated toward zero and within
+/// [lo, hi]. A direct Bool is `#VALUE!` when `reject_bool`; non-finite or
+/// out-of-range values are `#NUM!`. Shared by the engineering integer
+/// arguments and the BESSEL order.
+Expected<double, ErrorCode> coerce_truncated_in_range(const Value& v, double lo, double hi, bool reject_bool);
+
+}  // namespace builtins_detail
+
 /// Registers the simple integer-only engineering built-ins into `registry`.
 ///
 /// Included functions:
diff --git a/src/eval/builtins/engineering_special.cpp b/src/eval/builtins/engineering_special.cpp
index ce99f2074..d82930de5 100644
--- a/src/eval/builtins/engineering_special.cpp
+++ b/src/eval/builtins/engineering_special.cpp
@@ -47,6 +47,7 @@
 #include <cmath>
 #include <cstdint>
 
+#include "eval/builtins/engineering.h"
 #include "eval/builtins/registration_helpers.h"
 #include "eval/coerce.h"
 #include "eval/function_registry.h"
@@ -77,28 +78,14 @@ Expected<double, ErrorCode> coerce_real_arg(const Value& v) {
 // truncation toward zero; returns the integer order. Negative or non-finite
 // -> #NUM!. Bool is rejected with #VALUE! to match Excel 365.
 Expected<int, ErrorCode> coerce_bessel_order(const Value& v) {
-  if (v.kind() == ValueKind::Bool) {
-    return ErrorCode::Value;
-  }
-  auto n = coerce_to_number(v);
-  if (!n) {
-    return n.error();
-  }
-  const double d = n.value();
-  if (std::isnan(d) || std::isinf(d)) {
-    return ErrorCode::Num;
-  }
-  const double t = std::trunc(d);
-  if (t < 0.0) {
-    return ErrorCode::Num;
-  }
   // Upper bound: guard against absurd orders that would overflow the
   // recurrence. Excel caps orders well below this; 2^30 is a defensive
   // ceiling that still accommodates any realistic engineering query.
-  if (t > static_cast<double>((1 << 30))) {
-    return ErrorCode::Num;
+  auto t = builtins_detail::coerce_truncated_in_range(v, 0.0, static_cast<double>((1 << 30)), /*reject_bool=*/true);
+  if (!t) {
+    return t.error();
   }
-  return static_cast<int>(t);
+  return static_cast<int>(t.value());
 }
 
 // ---------------------------------------------------------------------------
@@ -140,16 +127,8 @@ Value Erf(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
 // ERF.PRECISE: strict 1-arg erf(x). The registry enforces arity (min=max=1)
 // so an attempt to pass a second argument surfaces #VALUE! from the
 // dispatcher before this impl runs.
-Value ErfPrecise(const Value* args, std::uint32_t /*arity*/, Arena& /*arena*/) {
-  auto a = coerce_real_arg(args[0]);
-  if (!a) {
-    return Value::error(a.error());
-  }
-  const double r = std::erf(a.value());
-  if (std::isnan(r)) {
-    return Value::error(ErrorCode::Num);
-  }
-  return Value::number(r);
+Value ErfPrecise(const Value* args, std::uint32_t /*arity*/, Arena& arena) {
+  return Erf(args, 1, arena);
 }
 
 // ERFC(x) = 1 - erf(x). Uses std::erfc for better precision in the tail.
diff --git a/src/eval/builtins/financial_clean_price.h b/src/eval/builtins/financial_clean_price.h
index 6ebc6faef..f0e52a2d9 100644
--- a/src/eval/builtins/financial_clean_price.h
+++ b/src/eval/builtins/financial_clean_price.h
@@ -20,6 +20,8 @@
 
 #include <cstdint>
 
+#include "eval/builtins/financial_helpers.h"
+#include "eval/coupon_schedule.h"
 #include "utils/error.h"
 #include "utils/expected.h"
 #include "value.h"
@@ -51,6 +53,20 @@ namespace financial_detail {
 /// failure, non-finite intermediate or final value).
 Expected<double, ErrorCode> compute_clean_price(const Value* args, std::uint32_t arity, bool date1904);
 
+/// Argument prelude shared by PRICE and YIELD: the parsed tail plus the coupon schedule and the
+/// per-period coupon / accrued interest derived from it.
+struct CouponBondInputs {
+  CouponBondTail tail;
+  CouponDates cd;
+  double freq_d;
+  double cf;
+  double ai;
+};
+
+/// Reads args[0..6] and builds `CouponBondInputs`. `#NUM!` on date ordering, coupon-schedule failure or
+/// an exhausted schedule; the caller applies its own sign rule on `tail.amount`.
+Expected<CouponBondInputs, ErrorCode> read_coupon_bond(const Value* args, std::uint32_t arity, bool date1904);
+
 }  // namespace financial_detail
 }  // namespace eval
 }  // namespace formulon
diff --git a/src/eval/builtins/financial_price.cpp b/src/eval/builtins/financial_price.cpp
index cfb39ac08..d8f84458c 100644
--- a/src/eval/builtins/financial_price.cpp
+++ b/src/eval/builtins/financial_price.cpp
@@ -47,12 +47,7 @@
 namespace formulon {
 namespace eval {
 namespace financial_detail {
-// Computes the clean price per 100 face. Returns `#NUM!` on any
-// validation or numerical failure. Factored out of the Value-returning
-// `Price` so YIELD (Newton iteration over yld in `financial_yield.cpp`)
-// can call the same closed form without re-parsing arguments. Declared in
-// `financial_clean_price.h` so the YIELD TU can include only that header.
-Expected<double, ErrorCode> compute_clean_price(const Value* args, std::uint32_t arity, bool date1904) {
+Expected<CouponBondInputs, ErrorCode> read_coupon_bond(const Value* args, std::uint32_t arity, bool date1904) {
   auto settlement = read_financial_date(args, 0);
   if (!settlement) {
     return settlement.error();
@@ -65,33 +60,47 @@ Expected<double, ErrorCode> compute_clean_price(const Value* args, std::uint32_t
   if (!tail) {
     return tail.error();
   }
-  const auto [rate, yld, red, frequency, basis] = tail.value();
-
-  // Every domain check past the reads is `#NUM!`, so the tail reader's
-  // rate / redemption checks may run ahead of the date ordering.
+  // Every domain check past the reads is `#NUM!`, so the tail reader's rate / redemption checks may run
+  // ahead of the date ordering.
   if (settlement.value() >= maturity.value()) {
     return ErrorCode::Num;
   }
-  if (yld < 0.0) {
+  CouponBondInputs out{tail.value(), CouponDates{}, 0.0, 0.0, 0.0};
+  if (!compute_coupon_dates(settlement.value(), maturity.value(), out.tail.frequency, out.tail.basis, date1904,
+                            &out.cd)) {
     return ErrorCode::Num;
   }
-
-  CouponDates cd{};
-  if (!compute_coupon_dates(settlement.value(), maturity.value(), frequency, basis, date1904, &cd)) {
+  if (out.cd.coupons_remaining <= 0 || out.cd.period_days <= 0.0) {
     return ErrorCode::Num;
   }
-  if (cd.coupons_remaining <= 0 || cd.period_days <= 0.0) {
+  out.freq_d = static_cast<double>(out.tail.frequency);
+  out.cf = 100.0 * out.tail.rate / out.freq_d;
+  out.ai = 100.0 * out.tail.rate * out.cd.days_bs / (out.cd.period_days * out.freq_d);
+  return out;
+}
+
+// Computes the clean price per 100 face. Returns `#NUM!` on any
+// validation or numerical failure. Factored out of the Value-returning
+// `Price` so YIELD (Newton iteration over yld in `financial_yield.cpp`)
+// can call the same closed form without re-parsing arguments. Declared in
+// `financial_clean_price.h` so the YIELD TU can include only that header.
+Expected<double, ErrorCode> compute_clean_price(const Value* args, std::uint32_t arity, bool date1904) {
+  auto in = read_coupon_bond(args, arity, date1904);
+  if (!in) {
+    return in.error();
+  }
+  const auto& [tail, cd, freq_d, cf, ai] = in.value();
+  const double yld = tail.amount;
+  const double red = tail.redemption;
+  if (yld < 0.0) {
     return ErrorCode::Num;
   }
 
-  const double freq_d = static_cast<double>(frequency);
   // `bond_dsc` (not the raw `days_nc`) is the DSC the bond formula
   // needs: it satisfies `days_bs + bond_dsc == period_days` for all
   // bases, including bases 2 / 3 where the raw COUPDAYSNC value would
   // break the identity. See `coupon_schedule.h` for the rationale.
   const double t1 = cd.bond_dsc / cd.period_days;
-  const double cf = 100.0 * rate / freq_d;
-  const double ai = 100.0 * rate * cd.days_bs / (cd.period_days * freq_d);
   const std::int32_t n = cd.coupons_remaining;
   const double yfreq = yld / freq_d;
 
diff --git a/src/eval/builtins/financial_yield.cpp b/src/eval/builtins/financial_yield.cpp
index 62cc6dda8..bc6712a0a 100644
--- a/src/eval/builtins/financial_yield.cpp
+++ b/src/eval/builtins/financial_yield.cpp
@@ -101,41 +101,18 @@ Expected<double, ErrorCode> price_at(const Value* yield_args, std::uint32_t arit
 // Computes the YIELD result. Returns the yield-to-maturity (decimal) on
 // success or `ErrorCode::Num` on any validation / numerical failure.
 Expected<double, ErrorCode> compute_yield(const Value* args, std::uint32_t arity, bool date1904) {
-  auto settlement = read_financial_date(args, 0);
-  if (!settlement) {
-    return settlement.error();
-  }
-  auto maturity = read_financial_date(args, 1);
-  if (!maturity) {
-    return maturity.error();
-  }
-  auto tail = read_coupon_bond_tail(args, arity, 2);
-  if (!tail) {
-    return tail.error();
-  }
-  const auto [rate, pr_v, red, frequency, basis] = tail.value();
-
-  // Validation mirrors PRICE. The `pr <= 0` check is the YIELD-specific addition; PRICE
-  // accepts a zero yld but YIELD rejects a non-positive market price
-  // (zero would mean "infinite yield").
-  if (settlement.value() >= maturity.value()) {
-    return ErrorCode::Num;
+  auto in = read_coupon_bond(args, arity, date1904);
+  if (!in) {
+    return in.error();
   }
+  const auto& [tail, cd, freq_d, cf, ai] = in.value();
+  const double rate = tail.rate;
+  const double pr_v = tail.amount;
+  const double red = tail.redemption;
+  // YIELD rejects a non-positive market price (zero would mean "infinite yield"); PRICE accepts a zero yld.
   if (pr_v <= 0.0) {
     return ErrorCode::Num;
   }
-
-  CouponDates cd{};
-  if (!compute_coupon_dates(settlement.value(), maturity.value(), frequency, basis, date1904, &cd)) {
-    return ErrorCode::Num;
-  }
-  if (cd.coupons_remaining <= 0 || cd.period_days <= 0.0) {
-    return ErrorCode::Num;
-  }
-
-  const double freq_d = static_cast<double>(frequency);
-  const double cf = 100.0 * rate / freq_d;
-  const double ai = 100.0 * rate * cd.days_bs / (cd.period_days * freq_d);
   const std::int32_t n = cd.coupons_remaining;
 
   // --- n == 1: closed-form analytic inversion of the simple-interest
diff --git a/src/eval/builtins/math.cpp b/src/eval/builtins/math.cpp
index 8398677bd..de42c6389 100644
--- a/src/eval/builtins/math.cpp
+++ b/src/eval/builtins/math.cpp
@@ -454,7 +454,10 @@ Value MRound(const Value* args, std::uint32_t /*arity*/, Arena& /*arena*/) {
 //     (CEILING.MATH: toward -infinity for negatives;
 //      FLOOR.MATH: toward +infinity i.e. toward zero for negatives).
 
-Value CeilingMath(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
+// Shared body of CEILING.MATH (`ceiling = true`) and FLOOR.MATH. Positive
+// inputs always round in the function's own direction; a non-zero `mode`
+// flips the direction for negative inputs.
+Value math_mode_rounding(const Value* args, std::uint32_t arity, bool ceiling) {
   auto number = coerce_to_number(args[0]);
   if (!number) {
     return Value::error(number.error());
@@ -467,13 +470,13 @@ Value CeilingMath(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
     }
     significance = coerced.value();
   }
-  bool away_from_zero = false;
+  bool flip_negative = false;
   if (arity >= 3) {
     auto coerced = coerce_to_number(args[2]);
     if (!coerced) {
       return Value::error(coerced.error());
     }
-    away_from_zero = coerced.value() != 0.0;
+    flip_negative = coerced.value() != 0.0;
   }
   const double n = number.value();
   if (n == 0.0) {
@@ -488,9 +491,8 @@ Value CeilingMath(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   // 70.999... rather than exactly 71). Mirrors the legacy CEILING / FLOOR
   // path so the modern variants snap exact multiples the same way.
   const double scaled = snap_to_integer(n / abs_s);
-  // Positive inputs: always ceil. Negative inputs: ceil (toward +inf) for
-  // default mode, floor (away from zero) when mode != 0.
-  const double rounded = (n > 0.0 || !away_from_zero) ? std::ceil(scaled) : std::floor(scaled);
+  const bool use_ceil = (n > 0.0 || !flip_negative) ? ceiling : !ceiling;
+  const double rounded = use_ceil ? std::ceil(scaled) : std::floor(scaled);
   const double r = rounded * abs_s;
   if (std::isnan(r) || std::isinf(r)) {
     return Value::error(ErrorCode::Num);
@@ -498,48 +500,12 @@ Value CeilingMath(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   return Value::number(r);
 }
 
+Value CeilingMath(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
+  return math_mode_rounding(args, arity, /*ceiling=*/true);
+}
+
 Value FloorMath(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
-  auto number = coerce_to_number(args[0]);
-  if (!number) {
-    return Value::error(number.error());
-  }
-  double significance = 1.0;
-  if (arity >= 2) {
-    auto coerced = coerce_to_number(args[1]);
-    if (!coerced) {
-      return Value::error(coerced.error());
-    }
-    significance = coerced.value();
-  }
-  bool toward_zero = false;
-  if (arity >= 3) {
-    auto coerced = coerce_to_number(args[2]);
-    if (!coerced) {
-      return Value::error(coerced.error());
-    }
-    toward_zero = coerced.value() != 0.0;
-  }
-  const double n = number.value();
-  if (n == 0.0) {
-    return Value::number(0.0);
-  }
-  if (significance == 0.0) {
-    return Value::number(0.0);
-  }
-  const double abs_s = std::fabs(significance);
-  // `snap_to_integer` absorbs the IEEE-754 noise that would otherwise make
-  // e.g. `FLOOR.MATH(7.1, 0.1)` return `7` instead of `7.1`. Mirrors the
-  // legacy CEILING / FLOOR path so the modern variants snap exact multiples
-  // the same way.
-  const double scaled = snap_to_integer(n / abs_s);
-  // Positive inputs: always floor. Negative inputs: floor (toward -inf)
-  // for default mode, ceil (toward zero) when mode != 0.
-  const double rounded = (n > 0.0 || !toward_zero) ? std::floor(scaled) : std::ceil(scaled);
-  const double r = rounded * abs_s;
-  if (std::isnan(r) || std::isinf(r)) {
-    return Value::error(ErrorCode::Num);
-  }
-  return Value::number(r);
+  return math_mode_rounding(args, arity, /*ceiling=*/false);
 }
 
 // --- Parity-aware rounding ----------------------------------------------
diff --git a/src/eval/builtins/math_rng.cpp b/src/eval/builtins/math_rng.cpp
index d7fbbf821..1652c7937 100644
--- a/src/eval/builtins/math_rng.cpp
+++ b/src/eval/builtins/math_rng.cpp
@@ -12,7 +12,6 @@
 
 #include <cmath>
 #include <cstdint>
-#include <random>
 
 #include "eval/builtins/registration_helpers.h"
 #include "eval/coerce.h"
@@ -58,10 +57,7 @@ Value RandBetween_(const Value* args, std::uint32_t /*arity*/, Arena& /*arena*/)
   if (lo_d > hi_d) {
     return Value::error(ErrorCode::Num);
   }
-  const auto lo = static_cast<std::int64_t>(lo_d);
-  const auto hi = static_cast<std::int64_t>(hi_d);
-  std::uniform_int_distribution<std::int64_t> dist(lo, hi);
-  return Value::number(static_cast<double>(dist(thread_local_rng())));
+  return Value::number(sample_uniform_integer(lo_d, hi_d, thread_local_rng()));
 }
 
 }  // namespace
diff --git a/src/eval/builtins/stats.cpp b/src/eval/builtins/stats.cpp
index 888fb7587..67cd98a96 100644
--- a/src/eval/builtins/stats.cpp
+++ b/src/eval/builtins/stats.cpp
@@ -36,11 +36,11 @@
 #include <utility>
 #include <vector>
 
-#include "eval/aggregate_kernels.h"
 #include "eval/builtins/registration_helpers.h"
 #include "eval/builtins/stats/stats_helpers.h"
 #include "eval/coerce.h"
 #include "eval/function_registry.h"
+#include "numeric_aggregate_kernels.h"
 #include "utils/arena.h"
 #include "utils/index_sort.h"
 #include "value.h"
@@ -197,7 +197,7 @@ Value percentile_inc_sorted(const std::vector<double>& xs, double k) {
   // `Expected<double, ErrorCode>` so we lift through `finite_number_result`
   // for the success path and propagate `#NUM!` verbatim on failure (which
   // can still arise on a non-finite interpolated blend).
-  auto r = aggregate_kernels::percentile_sorted_inc(xs, k);
+  auto r = numeric_aggregate_kernels::percentile_sorted_inc(xs, k);
   if (!r) {
     return Value::error(r.error());
   }
@@ -210,7 +210,7 @@ Value percentile_exc_sorted(const std::vector<double>& xs, double k) {
   // (matching Mac Excel 365's `#NUM!` at the open-interval boundaries),
   // so callers do not have to re-validate `k` against `1/(n+1)` or
   // `n/(n+1)` themselves.
-  auto r = aggregate_kernels::percentile_sorted_exc(xs, k);
+  auto r = numeric_aggregate_kernels::percentile_sorted_exc(xs, k);
   if (!r) {
     return Value::error(r.error());
   }
@@ -219,16 +219,15 @@ Value percentile_exc_sorted(const std::vector<double>& xs, double k) {
 
 ModeFrequencies build_mode_frequencies(const std::vector<double>& xs) {
   ModeFrequencies freq;
-  std::vector<aggregate_kernels::ValueRun> runs = aggregate_kernels::group_equal_values(xs);
-  for (const aggregate_kernels::ValueRun& run : runs) {
+  std::vector<numeric_aggregate_kernels::ValueRun> runs = numeric_aggregate_kernels::group_equal_values(xs);
+  for (const numeric_aggregate_kernels::ValueRun& run : runs) {
     freq.best_count = std::max(freq.best_count, run.count);
   }
-  sort_by_index(runs, [](const aggregate_kernels::ValueRun& lhs, const aggregate_kernels::ValueRun& rhs) {
-    return lhs.first < rhs.first;
-  });
+  sort_by_index(runs, [](const numeric_aggregate_kernels::ValueRun& lhs,
+                         const numeric_aggregate_kernels::ValueRun& rhs) { return lhs.first < rhs.first; });
   freq.values.reserve(runs.size());
   freq.counts.reserve(runs.size());
-  for (const aggregate_kernels::ValueRun& run : runs) {
+  for (const numeric_aggregate_kernels::ValueRun& run : runs) {
     freq.values.push_back(run.value);
     freq.counts.push_back(run.count);
   }
diff --git a/src/eval/builtins/stats/stats_order.cpp b/src/eval/builtins/stats/stats_order.cpp
index f2b8e7b8f..402bb7e27 100644
--- a/src/eval/builtins/stats/stats_order.cpp
+++ b/src/eval/builtins/stats/stats_order.cpp
@@ -22,9 +22,9 @@
 #include <utility>
 #include <vector>
 
-#include "eval/aggregate_kernels.h"
 #include "eval/array_alloc.h"
 #include "eval/builtins/stats/stats_helpers.h"
+#include "numeric_aggregate_kernels.h"
 #include "utils/arena.h"
 #include "value.h"
 
@@ -35,11 +35,11 @@ namespace stats_detail {
 // MEDIAN(value, ...) - median of numeric values. Non-numerics are skipped;
 // an empty collection yields `#NUM!`. For an even count the result is the
 // arithmetic mean of the two middle elements. The arithmetic and the
-// error-code surface live in `aggregate_kernels::run_median`, which
+// error-code surface live in `numeric_aggregate_kernels::run_median`, which
 // AGGREGATE function 12 shares, so the two spellings of this aggregate
 // cannot drift apart.
 Value Median(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
-  auto result = aggregate_kernels::run_median(collect_numerics(args, arity));
+  auto result = numeric_aggregate_kernels::run_median(collect_numerics(args, arity));
   if (!result) {
     return Value::error(result.error());
   }
@@ -53,7 +53,7 @@ Value Median(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
 // surfaces cannot diverge.
 Value Mode(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   const std::vector<double> xs = collect_numerics(args, arity);
-  auto r = aggregate_kernels::mode_first_occurrence(xs);
+  auto r = numeric_aggregate_kernels::mode_first_occurrence(xs);
   if (!r) {
     return Value::error(r.error());
   }
@@ -141,6 +141,17 @@ Value Small(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   return large_small(args, arity, false);
 }
 
+// Sorts the numeric data arguments and interpolates percentile `k`; an
+// empty numeric slice is `#NUM!`.
+static Value percentile_of_data(const Value* args, std::uint32_t data_count, double k, bool exclusive) {
+  std::vector<double> xs = collect_numerics(args, data_count);
+  if (xs.empty()) {
+    return Value::error(ErrorCode::Num);
+  }
+  std::sort(xs.begin(), xs.end());
+  return exclusive ? percentile_exc_sorted(xs, k) : percentile_inc_sorted(xs, k);
+}
+
 // PERCENTILE.INC(array, k) / PERCENTILE(array, k) - linear-interpolation
 // percentile. k is the fractional rank in [0, 1]; out-of-range yields
 // `#NUM!`. Empty numeric slice yields `#NUM!`. The interpolation point is
@@ -156,12 +167,7 @@ Value PercentileInc(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   if (k < 0.0 || k > 1.0) {
     return Value::error(ErrorCode::Num);
   }
-  std::vector<double> xs = collect_numerics(args, data_count);
-  if (xs.empty()) {
-    return Value::error(ErrorCode::Num);
-  }
-  std::sort(xs.begin(), xs.end());
-  return percentile_inc_sorted(xs, k);
+  return percentile_of_data(args, data_count, k, /*exclusive=*/false);
 }
 
 // PERCENTILE.EXC(array, k) - exclusive-interpolation percentile. `k` must
@@ -177,12 +183,7 @@ Value PercentileExc(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
     return Value::error(k_raw.error());
   }
   const double k = k_raw.value();
-  std::vector<double> xs = collect_numerics(args, data_count);
-  if (xs.empty()) {
-    return Value::error(ErrorCode::Num);
-  }
-  std::sort(xs.begin(), xs.end());
-  return percentile_exc_sorted(xs, k);
+  return percentile_of_data(args, data_count, k, /*exclusive=*/true);
 }
 
 // QUARTILE.INC(array, quart) / QUARTILE(array, quart) - quartile by
@@ -199,13 +200,7 @@ Value QuartileInc(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
     return Value::error(ErrorCode::Num);
   }
   const double q = std::trunc(q_in);
-  std::vector<double> xs = collect_numerics(args, data_count);
-  if (xs.empty()) {
-    return Value::error(ErrorCode::Num);
-  }
-  std::sort(xs.begin(), xs.end());
-  const double k = q / 4.0;
-  return percentile_inc_sorted(xs, k);
+  return percentile_of_data(args, data_count, q / 4.0, /*exclusive=*/false);
 }
 
 // QUARTILE.EXC(array, quart) - exclusive quartile, equivalent to
@@ -224,13 +219,7 @@ Value QuartileExc(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
     return Value::error(ErrorCode::Num);
   }
   const double q = std::trunc(q_in);
-  std::vector<double> xs = collect_numerics(args, data_count);
-  if (xs.empty()) {
-    return Value::error(ErrorCode::Num);
-  }
-  std::sort(xs.begin(), xs.end());
-  const double k = q / 4.0;
-  return percentile_exc_sorted(xs, k);
+  return percentile_of_data(args, data_count, q / 4.0, /*exclusive=*/true);
 }
 
 // TRIMMEAN(array, percent) - mean after trimming `percent / 2` from each
diff --git a/src/eval/builtins/subtotal.cpp b/src/eval/builtins/subtotal.cpp
index 4c3112ba8..1552c9ff6 100644
--- a/src/eval/builtins/subtotal.cpp
+++ b/src/eval/builtins/subtotal.cpp
@@ -36,12 +36,9 @@
 // aggregator before we can decide whether to count it (COUNTA does count
 // errors; the numeric branches do not).
 //
-// One intentional simplification relative to Mac Excel 365:
-//   * Nested-SUBTOTAL filtering: Excel ignores cells whose source formula is
-//     itself a SUBTOTAL call so a column of subtotals can be summed without
-//     double-counting. We do not yet have access to per-cell formula text
-//     from inside a builtin, so the filter is omitted. None of the IronCalc
-//     fixtures exercise it.
+// Nested-SUBTOTAL filtering (a cell whose own formula calls SUBTOTAL or
+// AGGREGATE is skipped) happens in the lazy front-end, `eval_subtotal_lazy`,
+// which still has the argument's cell provenance; this file only sees values.
 
 #include "eval/builtins/subtotal.h"
 
@@ -49,10 +46,10 @@
 #include <cstdint>
 #include <vector>
 
-#include "eval/aggregate_kernels.h"
 #include "eval/builtins/registration_helpers.h"
 #include "eval/coerce.h"
 #include "eval/function_registry.h"
+#include "numeric_aggregate_kernels.h"
 #include "utils/arena.h"
 #include "value.h"
 
@@ -134,7 +131,7 @@ bool collect_numeric(const Value* args, std::uint32_t arity, std::vector<double>
 }
 
 // Converts an `Expected<double, ErrorCode>` from a shared
-// `aggregate_kernels::run_*` call into the `Value` shape SUBTOTAL's
+// `numeric_aggregate_kernels::run_*` call into the `Value` shape SUBTOTAL's
 // dispatcher expects.
 Value lift_kernel_result(Expected<double, ErrorCode> result) {
   if (!result) {
@@ -149,7 +146,7 @@ Value run_sum(const Value* args, std::uint32_t arity) {
   if (!collect_numeric(args, arity, &xs, &err)) {
     return Value::error(err);
   }
-  return lift_kernel_result(aggregate_kernels::run_sum(xs));
+  return lift_kernel_result(numeric_aggregate_kernels::run_sum(xs));
 }
 
 Value run_product(const Value* args, std::uint32_t arity) {
@@ -158,7 +155,7 @@ Value run_product(const Value* args, std::uint32_t arity) {
   if (!collect_numeric(args, arity, &xs, &err)) {
     return Value::error(err);
   }
-  return lift_kernel_result(aggregate_kernels::run_product(xs));
+  return lift_kernel_result(numeric_aggregate_kernels::run_product(xs));
 }
 
 Value run_min_max(const Value* args, std::uint32_t arity, bool want_max) {
@@ -167,7 +164,7 @@ Value run_min_max(const Value* args, std::uint32_t arity, bool want_max) {
   if (!collect_numeric(args, arity, &xs, &err)) {
     return Value::error(err);
   }
-  return lift_kernel_result(want_max ? aggregate_kernels::run_max(xs) : aggregate_kernels::run_min(xs));
+  return lift_kernel_result(want_max ? numeric_aggregate_kernels::run_max(xs) : numeric_aggregate_kernels::run_min(xs));
 }
 
 Value run_average(const Value* args, std::uint32_t arity) {
@@ -176,7 +173,7 @@ Value run_average(const Value* args, std::uint32_t arity) {
   if (!collect_numeric(args, arity, &xs, &err)) {
     return Value::error(err);
   }
-  return lift_kernel_result(aggregate_kernels::run_average(xs));
+  return lift_kernel_result(numeric_aggregate_kernels::run_average(xs));
 }
 
 Value run_count(const Value* args, std::uint32_t arity) {
@@ -207,7 +204,7 @@ Value run_variance(const Value* args, std::uint32_t arity, bool population) {
   if (!collect_numeric(args, arity, &xs, &err)) {
     return Value::error(err);
   }
-  return lift_kernel_result(aggregate_kernels::run_variance(xs, /*sample=*/!population));
+  return lift_kernel_result(numeric_aggregate_kernels::run_variance(xs, /*sample=*/!population));
 }
 
 Value run_stdev(const Value* args, std::uint32_t arity, bool population) {
@@ -216,18 +213,19 @@ Value run_stdev(const Value* args, std::uint32_t arity, bool population) {
   if (!collect_numeric(args, arity, &xs, &err)) {
     return Value::error(err);
   }
-  return lift_kernel_result(aggregate_kernels::run_stdev(xs, /*sample=*/!population));
+  return lift_kernel_result(numeric_aggregate_kernels::run_stdev(xs, /*sample=*/!population));
 }
 
 }  // namespace
 
 Value subtotal_apply(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
-  if (arity < 2u) {
-    // arity == 0 cannot happen (registry enforces min_arity = 2), but the
-    // bound is also enforced here so a future caller cannot violate the
-    // contract by accident.
+  if (arity < 1u) {
     return Value::error(ErrorCode::Value);
   }
+  // `arity == 1` is the function code alone: the lazy front-end filtered every
+  // data cell out (all nested subtotals or hidden), which aggregates over an
+  // empty set. The eager registration's min_arity = 2 still rejects a bare
+  // `SUBTOTAL(9)`.
   // First arg = function code. Errors propagate; non-coercible text yields
   // #VALUE!. Bool TRUE coerces to 1 (= AVERAGE), matching Excel.
   auto code = coerce_to_number(args[0]);
diff --git a/src/eval/builtins/text.cpp b/src/eval/builtins/text.cpp
index 35a2c866f..845db2ddd 100644
--- a/src/eval/builtins/text.cpp
+++ b/src/eval/builtins/text.cpp
@@ -22,7 +22,6 @@
 #include "eval/builtins/registration_helpers.h"
 #include "eval/builtins/text_detail.h"
 #include "eval/coerce.h"
-#include "eval/criteria.h"
 #include "eval/function_registry.h"
 #include "eval/jis0208_table.h"
 #include "utils/arena.h"
@@ -38,11 +37,6 @@ using text_detail::read_int_arg;
 using text_detail::read_optional_int_arg;
 using text_detail::read_text_window_args;
 
-// Excel caps the result of REPT (and a handful of related text functions)
-// at 32,767 UTF-16 units. We reuse the same constant in REPT's overflow
-// guard.
-constexpr std::uint64_t kExcelTextCapUnits = 32767u;
-
 // UPPER(text) / LOWER(text) - ASCII case fold. Multi-byte UTF-8 bytes are
 // preserved verbatim (see `text_ops::to_upper_ascii` for the contract).
 Value Upper(const Value* args, std::uint32_t /*arity*/, Arena& arena) {
@@ -364,29 +358,9 @@ Value Search(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
   if (!text_detail::read_search_args(args, arity, text_detail::SearchUnit::Utf16, &sargs, &early)) {
     return early;
   }
-  const std::string lowered_haystack = to_lower_ascii(sargs.haystack);
-  const std::string lowered_needle = to_lower_ascii(sargs.needle);
   const std::size_t start_byte = utf16_to_byte_offset(sargs.haystack, static_cast<std::uint32_t>(sargs.start - 1));
-  // Fast path: when the pattern carries no metacharacter at all (no `*`,
-  // `?`, or `~`), use a plain substring search on the lower-cased buffers.
-  // This keeps the common wildcard-free case allocation-free beyond the
-  // two `to_lower_ascii` copies that case-insensitive matching already
-  // requires. A bare `~` still needs the wildcard path because `~?` / `~*`
-  // must be un-escaped when comparing.
-  std::size_t pos = std::string::npos;
-  const bool has_metachar = lowered_needle.find_first_of("*?~") != std::string::npos;
-  if (!has_metachar) {
-    pos = lowered_haystack.find(lowered_needle, start_byte);
-  } else {
-    // Wildcard path: scan the haystack suffix starting at `start_byte`. The
-    // byte offset returned by `wildcard_find` is relative to that suffix, so
-    // we add `start_byte` back to obtain an absolute byte position.
-    const std::string_view suffix = std::string_view(lowered_haystack).substr(start_byte);
-    const std::size_t rel = wildcard_find(lowered_needle, suffix);
-    if (rel != std::string_view::npos) {
-      pos = start_byte + rel;
-    }
-  }
+  const std::size_t pos =
+      text_detail::find_folded(sargs.haystack, sargs.needle, start_byte, text_detail::SearchUnit::Utf16);
   if (pos == std::string::npos) {
     return Value::error(ErrorCode::Value);
   }
diff --git a/src/eval/builtins/text_dbcs.cpp b/src/eval/builtins/text_dbcs.cpp
index 491d343dd..e73dfc01a 100644
--- a/src/eval/builtins/text_dbcs.cpp
+++ b/src/eval/builtins/text_dbcs.cpp
@@ -12,7 +12,6 @@
 
 #include "eval/builtins/text_detail.h"
 #include "eval/coerce.h"
-#include "eval/criteria.h"
 #include "utils/arena.h"
 #include "utils/expected.h"
 #include "utils/text_ops.h"
@@ -69,23 +68,9 @@ Value SearchB_(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
       break;
     }
   }
-  // Case-fold on both sides (ASCII only; matches SEARCH's policy).
-  const std::string lowered_haystack = to_lower_ascii(sargs.haystack);
-  const std::string lowered_needle = to_lower_ascii(sargs.needle);
-  std::size_t match_byte = std::string::npos;
-  const bool has_metachar = lowered_needle.find_first_of("*?~") != std::string::npos;
-  if (!has_metachar) {
-    match_byte = lowered_haystack.find(lowered_needle, start_byte);
-  } else {
-    // SEARCHB uses byte-mode `?` (matches only SBCS codepoints under the
-    // ja-JP DBCS rule) so `=SEARCHB("?","漢ABC")` skips the kanji and
-    // lands on the 'A' (Mac Excel 365 parity).
-    const std::string_view suffix = std::string_view(lowered_haystack).substr(start_byte);
-    const std::size_t rel = wildcard_find_dbcs(lowered_needle, suffix);
-    if (rel != std::string_view::npos) {
-      match_byte = start_byte + rel;
-    }
-  }
+  // SEARCHB's `?` matches only SBCS codepoints under the ja-JP DBCS rule, so
+  // `=SEARCHB("?","漢ABC")` skips the kanji and lands on the 'A'.
+  const std::size_t match_byte = find_folded(sargs.haystack, sargs.needle, start_byte, SearchUnit::DbcsByte);
   if (match_byte == std::string::npos) {
     return Value::error(ErrorCode::Value);
   }
@@ -403,11 +388,6 @@ std::vector<DbcsCharRec> build_dbcs_char_map(std::string_view src) {
 // space before `new_text` is appended. `start_num < 1` or `num_bytes < 0`
 // -> `#VALUE!`. Result capped at Excel's 32,767-unit text limit.
 Value ReplaceB_(const Value* args, std::uint32_t arity, Arena& arena) {
-  // Excel caps the result of REPT (and a handful of related text functions)
-  // at 32,767 UTF-16 units. We reuse the same constant in REPT's overflow
-  // guard.
-  constexpr std::uint64_t kExcelTextCapUnits = 32767u;
-
   auto parsed = read_text_window_args(args, arity);
   if (!parsed) {
     return Value::error(parsed.error());
diff --git a/src/eval/builtins/text_detail.cpp b/src/eval/builtins/text_detail.cpp
index d824ae12a..d91fcfa41 100644
--- a/src/eval/builtins/text_detail.cpp
+++ b/src/eval/builtins/text_detail.cpp
@@ -11,6 +11,8 @@
 #include <utility>
 
 #include "eval/coerce.h"
+#include "eval/wildcard.h"
+#include "utils/text_ops.h"
 #include "utils/utf8_length.h"
 
 namespace formulon {
@@ -92,6 +94,25 @@ bool read_search_args(const Value* args, std::uint32_t arity, SearchUnit unit, S
   return true;
 }
 
+std::size_t find_folded(const std::string& haystack, const std::string& needle, std::size_t start_byte,
+                        SearchUnit unit) {
+  const std::string lowered_haystack = to_lower_ascii(haystack);
+  const std::string lowered_needle = to_lower_ascii(needle);
+  // Fast path: a pattern with no `*`, `?` or `~` is a plain substring search.
+  // A bare `~` still needs the wildcard path because `~?` / `~*` unescape.
+  if (lowered_needle.find_first_of("*?~") == std::string::npos) {
+    return lowered_haystack.find(lowered_needle, start_byte);
+  }
+  // The wildcard matchers report offsets relative to the scanned suffix.
+  const std::string_view suffix = std::string_view(lowered_haystack).substr(start_byte);
+  const std::size_t rel =
+      unit == SearchUnit::DbcsByte ? wildcard_find_dbcs(lowered_needle, suffix) : wildcard_find(lowered_needle, suffix);
+  if (rel == std::string_view::npos) {
+    return std::string::npos;
+  }
+  return start_byte + rel;
+}
+
 Expected<TextWindowArgs, ErrorCode> read_text_window_args(const Value* args, std::uint32_t arity) {
   auto text = coerce_to_text(args[0]);
   if (!text) {
diff --git a/src/eval/builtins/text_detail.h b/src/eval/builtins/text_detail.h
index e14bb6667..d7e430d1f 100644
--- a/src/eval/builtins/text_detail.h
+++ b/src/eval/builtins/text_detail.h
@@ -60,6 +60,13 @@ struct SearchArgs {
 // search; `false` when the caller must return `*out_result` verbatim.
 bool read_search_args(const Value* args, std::uint32_t arity, SearchUnit unit, SearchArgs* out, Value* out_result);
 
+// ASCII-case-insensitive SEARCH / SEARCHB match of `needle` in `haystack`
+// from `start_byte`, honouring `?` / `*` / `~` wildcards; `unit` selects
+// whether `?` spans any character or only an SBCS one. Returns the absolute
+// byte offset of the match, or `std::string::npos`.
+std::size_t find_folded(const std::string& haystack, const std::string& needle, std::size_t start_byte,
+                        SearchUnit unit);
+
 // The `(text, start_num, num_chars[, new_text])` arguments of MID / MIDB /
 // REPLACE / REPLACEB. `new_text` stays empty for the three-argument forms.
 struct TextWindowArgs {
diff --git a/src/eval/builtins/text_format.cpp b/src/eval/builtins/text_format.cpp
index 76d511862..2515c7c48 100644
--- a/src/eval/builtins/text_format.cpp
+++ b/src/eval/builtins/text_format.cpp
@@ -50,34 +50,44 @@ Value text_builtin_impl(const Value* args, std::uint32_t /*arity*/, Arena& arena
     return Value::error(ErrorCode::Value);
   }
 
-  // Mac Excel ja-JP returns the uppercase boolean text and ignores the
-  // format string entirely for a bool value. This matches the observable
-  // oracle and the documented Excel contract for TEXT(TRUE, ...) /
-  // TEXT(FALSE, ...).
-  if (v.is_boolean()) {
-    return Value::text(v.as_boolean() ? std::string_view{"TRUE"} : std::string_view{"FALSE"});
-  }
-
   auto fmt = coerce_to_text(args[1]);
   if (!fmt) {
     return Value::error(fmt.error());
   }
   const std::string& format_text = fmt.value();
-  if (format_text.empty()) {
-    return Value::text({});
+
+  // Booleans use the text-section path. That preserves their visible TRUE /
+  // FALSE spelling while still applying a text placeholder and validating
+  // malformed sections in the format.
+  if (v.is_boolean()) {
+    const std::string_view boolean_text = v.as_boolean() ? "TRUE" : "FALSE";
+    std::string out;
+    const auto status = ::formulon::text_format::apply_text_format(boolean_text, format_text, out);
+    if (status != ::formulon::text_format::FormatStatus::kOk) {
+      return Value::error(ErrorCode::Value);
+    }
+    return Value::text(arena.intern(out));
   }
 
   // Text goes through the shared numeric-coercion ladder, the same one
   // arithmetic and FLOOR use, so anything `=A1+0` accepts TEXT formats as
   // well: numeric strings ("42", " $1,234 "), percent, currency, and
-  // date / time text. Only a value the ladder itself rejects ("abc") is
-  // #VALUE!.
+  // date / time text. A value the ladder rejects (for example "abc") is
+  // rendered through the format's text section instead.
   double number = 0.0;
   if (v.is_text()) {
     bool from_date_text = false;
     auto coerced = coerce_text_to_number(v.as_text(), &from_date_text);
     if (!coerced) {
-      return Value::error(coerced.error());
+      if (coerced.error() != ErrorCode::Value) {
+        return Value::error(coerced.error());
+      }
+      std::string out;
+      const auto status = ::formulon::text_format::apply_text_format(v.as_text(), format_text, out);
+      if (status != ::formulon::text_format::FormatStatus::kOk) {
+        return Value::error(ErrorCode::Value);
+      }
+      return Value::text(arena.intern(out));
     }
     number = coerced.value();
     // The ladder's date fallback always yields a 1900-system serial. The
@@ -128,7 +138,11 @@ Expected<int, ErrorCode> fixed_read_int(const Value& v) {
   if (std::isnan(d.value()) || std::isinf(d.value())) {
     return ErrorCode::Num;
   }
-  return static_cast<int>(std::trunc(d.value()));
+  const double truncated = std::trunc(d.value());
+  if (truncated < -127.0 || truncated > 127.0) {
+    return ErrorCode::Value;
+  }
+  return static_cast<int>(truncated);
 }
 
 Expected<double, ErrorCode> read_finite_number_arg(const Value* args, std::uint32_t index) {
@@ -153,9 +167,6 @@ Expected<int, ErrorCode> read_optional_fixed_decimals(const Value* args, std::ui
     }
     decimals = parsed.value();
   }
-  if (decimals > 127 || decimals < -127) {
-    return ErrorCode::Value;
-  }
   return decimals;
 }
 
diff --git a/src/eval/cell_evaluator.cpp b/src/eval/cell_evaluator.cpp
index 6a6c4fe4c..1608ade81 100644
--- a/src/eval/cell_evaluator.cpp
+++ b/src/eval/cell_evaluator.cpp
@@ -16,6 +16,7 @@
 #include "eval/formula_text_utils.h"
 #include "eval/function_registry.h"
 #include "eval/iterative_solver.h"
+#include "eval/recalc_engine.h"
 #include "eval/tree_walker.h"
 #include "parser/ast.h"
 #include "parser/parser.h"
@@ -47,12 +48,7 @@ Value evaluate_cell_for_recalc(Workbook& workbook, Sheet& sheet, const Cell& cel
   // helper keeps this strip in lockstep across every recalc entry.
   const std::string_view src = strip_formula_prefix(cell_data.formula_text);
 
-  parser::AstNode* root = parser::parse_strict(src, arena);
-  // A sheet- or book-qualified built-in call is rejected at entry; the stored
-  // text still reaches here, so it fails the same way a parse error does.
-  if (root != nullptr && find_qualified_builtin_call(*root) != nullptr) {
-    root = nullptr;
-  }
+  parser::AstNode* root = parse_formula_entry(src, arena);
   if (root == nullptr) {
     // Hard parse failure, or a valid prefix followed by unparseable trailing
     // tokens. Either way we refuse to evaluate a recovered prefix as if it
@@ -117,5 +113,28 @@ bool settle_component_by_reads(const Workbook& workbook, const std::vector<CellN
       [&](std::size_t i, Value v) { commit(cells[i], v); });
 }
 
+void prepare_iterative_component_seeds(Workbook& workbook, const std::vector<CellNodeId>& cells) {
+  if (!workbook.recalc_engine().disabled_cycle_refs_pending()) {
+    return;
+  }
+  const std::size_t sheet_count = workbook.sheet_count();
+  for (const CellNodeId cell : cells) {
+    if (cell.sheet_id >= sheet_count) {
+      continue;
+    }
+    Sheet& sheet = workbook.sheet(cell.sheet_id);
+    Sheet::CellRead read;
+    sheet.read_formula_cell(cell.row, cell.col, read);
+    if (!read.is_formula()) {
+      continue;
+    }
+    const Value cached = read.value();
+    if (!cached.is_error() || cached.as_error() != ErrorCode::Ref) {
+      continue;
+    }
+    sheet.set_cell_cached_value(cell.row, cell.col, Value::blank());
+  }
+}
+
 }  // namespace eval
 }  // namespace formulon
diff --git a/src/eval/cell_evaluator.h b/src/eval/cell_evaluator.h
index ab773445a..b7ffc9e99 100644
--- a/src/eval/cell_evaluator.h
+++ b/src/eval/cell_evaluator.h
@@ -106,6 +106,16 @@ bool settle_component_by_reads(const Workbook& workbook, const std::vector<CellN
                                const std::function<Value(CellNodeId, EvalState*)>& evaluate,
                                const std::function<void(CellNodeId, Value)>& commit);
 
+/// Prepares the cached values of an iterative component for its first solve.
+/// A cycle persisted while iterative calculation was disabled holds `#REF!`,
+/// which is not a useful numerical seed. Until the first full recalculation
+/// after iteration is enabled (`RecalcEngine::disabled_cycle_refs_pending`), a
+/// formula member with a cached `#REF!` is reset to Blank; afterwards a
+/// `#REF!` is a genuine solver result and seeds the solve like any value.
+/// Only the supplied component is visited. Callers must hold the recalc
+/// write lock while restoring any prior values and invoking this helper.
+void prepare_iterative_component_seeds(Workbook& workbook, const std::vector<CellNodeId>& cells);
+
 }  // namespace eval
 }  // namespace formulon
 
diff --git a/src/eval/cell_lazy.cpp b/src/eval/cell_lazy.cpp
index 24e3fe253..dbcd0e0db 100644
--- a/src/eval/cell_lazy.cpp
+++ b/src/eval/cell_lazy.cpp
@@ -24,9 +24,12 @@
 #include "eval/lazy_impls.h"
 #include "eval/name_env_resolve.h"
 #include "eval/range_resolvers.h"
+#include "eval/text_format/display_text.h"
+#include "eval/text_format/number_format.h"
 #include "parser/ast.h"
 #include "parser/reference.h"
 #include "sheet.h"
+#include "style_resolve.h"
 #include "styles.h"
 #include "utils/a1_ref.h"
 #include "utils/arena.h"
@@ -181,8 +184,18 @@ Value resolve_topleft_value(std::string_view sheet, std::uint32_t row, std::uint
   return ctx.resolve_ref(r, arena, registry);
 }
 
+const CellXf* effective_cell_xf(const Workbook& workbook, const Sheet& sheet, std::uint32_t row, std::uint32_t col) {
+  const EffectiveXf choice = select_effective_xf(sheet, row, col);
+  const std::vector<CellXf>& xfs = workbook.styles().cell_xfs;
+  if (xfs.empty()) {
+    return nullptr;
+  }
+  const std::uint32_t xf_index = choice.xf_index < xfs.size() ? choice.xf_index : 0U;
+  return &xfs[xf_index];
+}
+
 // Resolves CELL("protect") for the cell at `(sheet, row, col)`: reads the
-// cell's cell-format (`xf`) protection `locked` flag from the workbook's
+// effective cell-format (`xf`) protection `locked` flag from the workbook's
 // StylesTable. Excel returns 1 for a locked cell and 0 for an unlocked one.
 //
 // Defaults follow the OOXML schema: the effective `locked` flag defaults to
@@ -203,20 +216,9 @@ Value resolve_cell_locked(std::string_view sheet, std::uint32_t row, std::uint32
       return Value::error(ErrorCode::Ref);
     }
   }
-  // The cell's xf index (0 = default xf when the cell is absent).
-  std::uint32_t xf_index = 0;
-  if (target != nullptr) {
-    if (const Cell* cell = target->cell_at(row, col); cell != nullptr) {
-      xf_index = cell->xf_index;
-    }
-  }
-  bool locked = true;
-  if (workbook != nullptr) {
-    const std::vector<CellXf>& cell_xfs = workbook->styles().cell_xfs;
-    if (xf_index < cell_xfs.size()) {
-      locked = cell_xfs[xf_index].locked;
-    }
-  }
+  const CellXf* xf =
+      workbook != nullptr && target != nullptr ? effective_cell_xf(*workbook, *target, row, col) : nullptr;
+  const bool locked = xf == nullptr || !xf->has_protection || xf->locked;
   return Value::number(locked ? 1.0 : 0.0);
 }
 
@@ -230,63 +232,7 @@ const CellXf* resolve_cell_xf(std::string_view sheet_name, std::uint32_t row, st
   if (workbook == nullptr || target == nullptr) {
     return nullptr;
   }
-  std::uint32_t xf_index = 0;
-  if (const Cell* cell = target->cell_at(row, col); cell != nullptr) {
-    xf_index = cell->xf_index;
-  }
-  const std::vector<CellXf>& xfs = workbook->styles().cell_xfs;
-  return xf_index < xfs.size() ? &xfs[xf_index] : nullptr;
-}
-
-bool section_uses_color(std::string_view section) {
-  for (std::size_t i = 0; i + 4U < section.size(); ++i) {
-    if (section[i] != '[') {
-      continue;
-    }
-    const std::size_t close = section.find(']', i + 1U);
-    if (close == std::string_view::npos) {
-      break;
-    }
-    const std::string_view tag = section.substr(i + 1U, close - i - 1U);
-    if (tag == "Red" || tag == "Blue" || tag == "Green" || tag == "Yellow" || tag == "Magenta" || tag == "Cyan" ||
-        tag.rfind("Color", 0) == 0U) {
-      return true;
-    }
-    i = close;
-  }
-  return false;
-}
-
-// CELL("color") answers whether negative values use a colour. A one-section
-// number format applies to all numbers; in the usual multi-section form the
-// second section is the negative-number section. Semicolons in quoted text or
-// bracket directives do not divide format sections.
-bool number_format_colors_negative_values(std::string_view format) {
-  bool quoted = false;
-  std::size_t bracket_depth = 0;
-  std::size_t negative_start = std::string_view::npos;
-  std::size_t negative_end = format.size();
-  for (std::size_t i = 0; i < format.size(); ++i) {
-    const char c = format[i];
-    if (c == '"') {
-      quoted = !quoted;
-    } else if (!quoted && c == '[') {
-      ++bracket_depth;
-    } else if (!quoted && c == ']' && bracket_depth != 0) {
-      --bracket_depth;
-    } else if (!quoted && bracket_depth == 0 && c == ';') {
-      if (negative_start == std::string_view::npos) {
-        negative_start = i + 1U;
-      } else {
-        negative_end = i;
-        break;
-      }
-    }
-  }
-  if (negative_start == std::string_view::npos) {
-    return section_uses_color(format);
-  }
-  return section_uses_color(format.substr(negative_start, negative_end - negative_start));
+  return effective_cell_xf(*workbook, *target, row, col);
 }
 
 std::string_view cell_prefix(const CellXf* xf) {
@@ -312,13 +258,7 @@ std::string_view number_format_for_xf(const CellXf* xf, const EvalContext& ctx)
   if (xf == nullptr || ctx.workbook() == nullptr) {
     return {};
   }
-  const StylesTable& styles = ctx.workbook()->styles();
-  for (const NumFmtRecord& custom : styles.num_fmts) {
-    if (custom.id == xf->num_fmt_id && custom.format_string_index < styles.num_fmt_strings.size()) {
-      return styles.num_fmt_strings[custom.format_string_index];
-    }
-  }
-  return builtin_num_fmt(xf->num_fmt_id);
+  return text_format::number_format_code_for_xf(ctx.workbook()->styles(), xf);
 }
 
 std::string_view cell_format_code(const CellXf* xf) {
@@ -402,14 +342,7 @@ Value build_width_result(const Sheet& sheet, std::uint32_t col, Arena& arena) {
 }
 
 Value resolve_cell_width(std::string_view sheet_name, std::uint32_t col, Arena& arena, const EvalContext& ctx) {
-  const Workbook* workbook = ctx.workbook();
-  const Sheet* target = ctx.current_sheet();
-  if (!sheet_name.empty()) {
-    if (workbook == nullptr) {
-      return Value::error(ErrorCode::Ref);
-    }
-    target = workbook->sheet_by_name(sheet_name);
-  }
+  const Sheet* target = ctx.sheet_for_qualifier(sheet_name);
   if (target == nullptr) {
     return Value::error(ErrorCode::Ref);
   }
@@ -565,8 +498,10 @@ Value eval_cell_lazy(const parser::AstNode& call, Arena& arena, const FunctionRe
     }
     if (key == "color") {
       return Value::number(
-          number_format_colors_negative_values(number_format_for_xf(resolve_cell_xf(sheet, row, col, ctx), ctx)) ? 1.0
-                                                                                                                 : 0.0);
+          text_format::negative_section_has_color(number_format_for_xf(resolve_cell_xf(sheet, row, col, ctx), ctx),
+                                                  text_format::FormatDialect::kStored)
+              ? 1.0
+              : 0.0);
     }
     if (key == "format") {
       return arena_text(arena, cell_format_code(resolve_cell_xf(sheet, row, col, ctx)));
diff --git a/src/eval/coerce.h b/src/eval/coerce.h
index 9bd7595bd..8d9db4c47 100644
--- a/src/eval/coerce.h
+++ b/src/eval/coerce.h
@@ -77,6 +77,10 @@ inline double truncate_index(double value) noexcept {
 /// unchanged.
 Expected<double, ErrorCode> coerce_to_index_number(const Value& v);
 
+/// Excel's text-cell limit in UTF-16 units; text builtins whose result
+/// would exceed it (REPT, REPLACEB, TEXTJOIN, REGEXREPLACE, ...) yield `#VALUE!`.
+inline constexpr std::uint64_t kExcelTextCapUnits = 32767u;
+
 /// Coerces `v` to its Excel-visible string representation.
 ///
 /// * `Number` is rendered via `format_double` (Grisu3 shortest round-trip).
diff --git a/src/eval/conditional_aggregates.cpp b/src/eval/conditional_aggregates.cpp
index 8aa9c0dbc..d40af5e27 100644
--- a/src/eval/conditional_aggregates.cpp
+++ b/src/eval/conditional_aggregates.cpp
@@ -404,6 +404,36 @@ bool sum_matching_if(const IfInputs& in, const ParsedCriterion& parsed, ExcelPro
   return true;
 }
 
+// Shared SUMIF / AVERAGEIF driver; `average` selects the final reduction.
+Value eval_sum_or_average_if(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
+                             const EvalContext& ctx, bool average) {
+  const std::uint32_t arity = call.as_call_arity();
+  if (arity != 2 && arity != 3) {
+    return Value::error(ErrorCode::Value);
+  }
+  IfInputs inputs;
+  Value err = Value::blank();
+  if (!resolve_if_inputs(call, arity, arena, registry, ctx, &inputs, &err)) {
+    return err;
+  }
+  return lift_criteria({inputs.criterion}, arena, [&](const ParsedCriteria& parsed) {
+    double sum = 0.0;
+    double count = 0.0;
+    Value match_err = Value::blank();
+    if (!sum_matching_if(inputs, *parsed[0], ctx.excel_profile(), &sum, &count, &match_err)) {
+      return match_err;
+    }
+    if (!average) {
+      return Value::number(sum);
+    }
+    if (count == 0.0) {
+      return Value::error(ErrorCode::Div0);
+    }
+    const double mean = sum / count;
+    return std::isfinite(mean) ? Value::number(mean) : Value::error(ErrorCode::Num);
+  });
+}
+
 }  // namespace
 
 // ---------------------------------------------------------------------------
@@ -470,24 +500,7 @@ Value eval_countif_lazy(const parser::AstNode& call, Arena& arena, const Functio
 // when the criterion itself passed on a non-numeric cell.
 Value eval_sumif_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                       const EvalContext& ctx) {
-  const std::uint32_t arity = call.as_call_arity();
-  if (arity != 2 && arity != 3) {
-    return Value::error(ErrorCode::Value);
-  }
-  IfInputs inputs;
-  Value err = Value::blank();
-  if (!resolve_if_inputs(call, arity, arena, registry, ctx, &inputs, &err)) {
-    return err;
-  }
-  return lift_criteria({inputs.criterion}, arena, [&](const ParsedCriteria& parsed) {
-    double sum = 0.0;
-    double count = 0.0;
-    Value match_err = Value::blank();
-    if (!sum_matching_if(inputs, *parsed[0], ctx.excel_profile(), &sum, &count, &match_err)) {
-      return match_err;
-    }
-    return Value::number(sum);
-  });
+  return eval_sum_or_average_if(call, arena, registry, ctx, /*average=*/false);
 }
 
 // AVERAGEIF(range, criterion [, average_range])
@@ -503,28 +516,7 @@ Value eval_sumif_lazy(const parser::AstNode& call, Arena& arena, const FunctionR
 // comment above for details.
 Value eval_averageif_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                           const EvalContext& ctx) {
-  const std::uint32_t arity = call.as_call_arity();
-  if (arity != 2 && arity != 3) {
-    return Value::error(ErrorCode::Value);
-  }
-  IfInputs inputs;
-  Value err = Value::blank();
-  if (!resolve_if_inputs(call, arity, arena, registry, ctx, &inputs, &err)) {
-    return err;
-  }
-  return lift_criteria({inputs.criterion}, arena, [&](const ParsedCriteria& parsed) {
-    double sum = 0.0;
-    double count = 0.0;
-    Value match_err = Value::blank();
-    if (!sum_matching_if(inputs, *parsed[0], ctx.excel_profile(), &sum, &count, &match_err)) {
-      return match_err;
-    }
-    if (count == 0.0) {
-      return Value::error(ErrorCode::Div0);
-    }
-    const double average = sum / count;
-    return std::isfinite(average) ? Value::number(average) : Value::error(ErrorCode::Num);
-  });
+  return eval_sum_or_average_if(call, arena, registry, ctx, /*average=*/true);
 }
 
 // COUNTIFS(range1, crit1 [, range2, crit2, ...])
diff --git a/src/eval/criteria.cpp b/src/eval/criteria.cpp
index 90185de10..5456becd2 100644
--- a/src/eval/criteria.cpp
+++ b/src/eval/criteria.cpp
@@ -12,9 +12,9 @@
 #include "eval/coerce.h"
 #include "eval/date_text_parse.h"
 #include "eval/jp_fold.h"
+#include "eval/wildcard.h"
 #include "utils/strings.h"
 #include "utils/text_ops.h"
-#include "utils/utf8_length.h"
 #include "value.h"
 
 namespace formulon {
@@ -143,24 +143,6 @@ std::string fold_criteria_text_for_profile(std::string_view input, ExcelProfile
   return fold_fullwidth_digits_only(input);
 }
 
-}  // namespace
-
-bool scan_has_wildcard(std::string_view rhs) {
-  for (std::size_t i = 0; i < rhs.size(); ++i) {
-    const char c = rhs[i];
-    if (c == '~' && i + 1 < rhs.size()) {
-      ++i;  // Skip the escaped byte.
-      continue;
-    }
-    if (c == '*' || c == '?') {
-      return true;
-    }
-  }
-  return false;
-}
-
-namespace {
-
 // Scans `rhs` for a `~` that does not escape `*` or `?` (the only two
 // metacharacters Excel's wildcard dialect documents). Used by
 // `parse_criterion` to flag malformed criteria that Mac Excel 365 rejects
@@ -186,184 +168,8 @@ bool scan_has_invalid_wildcard_escape(std::string_view rhs) {
   return false;
 }
 
-// Core two-pointer wildcard matcher. When `prefix_match_ok` is false the
-// pattern must consume `text` exactly (SEARCH whole-string / criteria
-// equality semantics). When `prefix_match_ok` is true the match succeeds
-// as soon as the pattern is exhausted, even if `text` has unmatched bytes
-// remaining — used by `wildcard_find` to answer "does the pattern match a
-// prefix of this suffix?". When the match succeeds in prefix mode,
-// `*out_consumed` receives the number of `text` bytes the pattern
-// consumed.
-//
-// Character comparisons are ASCII case-insensitive to match Excel's
-// criteria semantics (e.g. `*blue` matches `BLUE`). Non-ASCII bytes are
-// compared byte-for-byte, consistent with `strings::case_insensitive_eq`.
-// UTF-8 continuation: returns the byte length of the code point that
-// starts at `text[i]`, capped at `text.size() - i`. A leading byte with
-// an invalid continuation pattern falls back to 1 byte (mirrors Excel's
-// lenient "one display unit" heuristic for broken UTF-8).
-std::size_t utf8_codepoint_bytes(std::string_view text, std::size_t i) {
-  if (i >= text.size()) {
-    return 0;
-  }
-  const auto lead = static_cast<unsigned char>(text[i]);
-  std::size_t len = 1;
-  if ((lead & 0x80u) == 0x00u) {
-    len = 1;
-  } else if ((lead & 0xE0u) == 0xC0u) {
-    len = 2;
-  } else if ((lead & 0xF0u) == 0xE0u) {
-    len = 3;
-  } else if ((lead & 0xF8u) == 0xF0u) {
-    len = 4;
-  }
-  if (i + len > text.size()) {
-    len = text.size() - i;
-  }
-  return len;
-}
-
-bool wildcard_match_impl(std::string_view pattern, std::string_view text, bool prefix_match_ok,
-                         std::size_t* out_consumed, bool question_is_byte = false) {
-  std::size_t pi = 0;
-  std::size_t ti = 0;
-  std::size_t star_pi = std::string_view::npos;
-  std::size_t star_ti = 0;
-  while (ti < text.size()) {
-    // Prefix mode: succeed as soon as the pattern is fully consumed, even
-    // if there is unmatched text remaining.
-    if (prefix_match_ok && pi == pattern.size()) {
-      if (out_consumed != nullptr) {
-        *out_consumed = ti;
-      }
-      return true;
-    }
-    if (pi < pattern.size()) {
-      const char pc = pattern[pi];
-      if (pc == '~' && pi + 1 < pattern.size()) {
-        // Escaped literal: match the next pattern byte case-insensitively
-        // (Excel preserves the overall case-insensitive rule even for
-        // escape-protected characters).
-        if (strings::ascii_to_lower(pattern[pi + 1]) == strings::ascii_to_lower(text[ti])) {
-          pi += 2;
-          ++ti;
-          continue;
-        }
-      } else if (pc == '~' && pi + 1 == pattern.size()) {
-        // Trailing unpaired `~`: Excel treats it as a no-op (the escape
-        // consumes nothing of the text), so the remaining pattern is
-        // effectively empty — succeed if we're in prefix mode or if the
-        // text is also exhausted at this point.
-        ++pi;
-        continue;
-      } else if (pc == '*') {
-        star_pi = pi;
-        star_ti = ti;
-        ++pi;
-        continue;
-      } else if (pc == '?') {
-        if (question_is_byte) {
-          // SEARCHB byte-mode `?`: the pattern character matches only a
-          // codepoint whose ja-JP DBCS cost is 1 (ASCII or half-width
-          // katakana). Anything wider (kanji, hiragana, full-width, emoji)
-          // refuses to match here, falling through to the `*`-backtrack /
-          // failure path below.
-          std::size_t cp_bytes = 0;
-          const std::uint32_t cp = decode_utf8_step(text, ti, &cp_bytes);
-          if (byte_count_jajp(cp) == 1) {
-            ++pi;
-            ti += cp_bytes;
-            continue;
-          }
-        } else {
-          // Default mode: `?` matches exactly one UTF-8 code point (1-4
-          // bytes) rather than a single byte, so multibyte scripts (CJK,
-          // emoji, combining marks treated as atomic) match as Excel users
-          // would expect.
-          const std::size_t cp_bytes = utf8_codepoint_bytes(text, ti);
-          ++pi;
-          ti += cp_bytes;
-          continue;
-        }
-      } else if (strings::ascii_to_lower(pc) == strings::ascii_to_lower(text[ti])) {
-        ++pi;
-        ++ti;
-        continue;
-      }
-    }
-    if (star_pi != std::string_view::npos) {
-      // Backtrack: extend the most-recent `*` by one CODEPOINT of text. This
-      // must advance a whole UTF-8 codepoint, not a single byte — otherwise
-      // `star_ti` can land mid-sequence and a following `?` or literal would
-      // match a continuation byte (e.g. `*??c*` against `あcう` split the
-      // 3-byte `あ`). Codepoint-stepping keeps every subsequent match aligned.
-      pi = star_pi + 1;
-      const std::size_t step = utf8_codepoint_bytes(text, star_ti);
-      star_ti += (step == 0 ? 1 : step);
-      ti = star_ti;
-      continue;
-    }
-    return false;
-  }
-  // Trailing `*`s consume nothing.
-  while (pi < pattern.size() && pattern[pi] == '*') {
-    ++pi;
-  }
-  // A single unpaired trailing `~` also consumes nothing (Excel leniency).
-  // This must be the very last pattern char, otherwise it is part of an
-  // escape pair `~X` and that pair requires a text char to match.
-  if (pi + 1 == pattern.size() && pattern[pi] == '~') {
-    ++pi;
-  }
-  const bool ok = (pi == pattern.size());
-  if (ok && out_consumed != nullptr) {
-    *out_consumed = ti;
-  }
-  return ok;
-}
-
 }  // namespace
 
-bool wildcard_match(std::string_view pattern, std::string_view text) {
-  return wildcard_match_impl(pattern, text, /*prefix_match_ok=*/false, /*out_consumed=*/nullptr,
-                             /*question_is_byte=*/false);
-}
-
-std::size_t wildcard_find(std::string_view pattern, std::string_view text) {
-  // Try each start offset in `text` and attempt a prefix match. Because `*`
-  // already permits zero-or-more bytes, a leading `*` in the pattern makes
-  // offset 0 always match — but the loop below is still correct in that
-  // case (it would find offset 0 on the first iteration).
-  for (std::size_t start = 0; start <= text.size(); ++start) {
-    if (wildcard_match_impl(pattern, text.substr(start), /*prefix_match_ok=*/true,
-                            /*out_consumed=*/nullptr, /*question_is_byte=*/false)) {
-      return start;
-    }
-  }
-  return std::string_view::npos;
-}
-
-std::size_t wildcard_find_dbcs(std::string_view pattern, std::string_view text) {
-  // Iterate start positions over codepoint boundaries (not byte-by-byte) so
-  // the returned offset is always codepoint-aligned. SEARCHB looks the
-  // offset up against `build_dbcs_char_map`'s `byte_offset` records via
-  // direct equality; a misaligned offset would silently route into the
-  // defensive `total_dbcs + 1` fallback.
-  std::size_t start = 0;
-  while (start <= text.size()) {
-    if (wildcard_match_impl(pattern, text.substr(start), /*prefix_match_ok=*/true,
-                            /*out_consumed=*/nullptr, /*question_is_byte=*/true)) {
-      return start;
-    }
-    if (start == text.size()) {
-      break;
-    }
-    const std::size_t step = utf8_codepoint_bytes(text, start);
-    start += (step == 0 ? 1 : step);
-  }
-  return std::string_view::npos;
-}
-
 void ParsedCriterion::rebind_rhs_text() noexcept {
   if (rhs_text_owns_storage_) {
     rhs_text = rhs_storage;
diff --git a/src/eval/criteria.h b/src/eval/criteria.h
index 11a20204e..13ad7605a 100644
--- a/src/eval/criteria.h
+++ b/src/eval/criteria.h
@@ -20,9 +20,8 @@
 // Wildcard matching: `?` matches exactly one Unicode codepoint, `*` matches
 // any run of codepoints, and `~` escapes the next metacharacter. The matcher
 // walks the text codepoint-by-codepoint (including `*` backtracking), so
-// multibyte UTF-8 (CJK, emoji) behaves as Excel users expect. A separate
-// byte-oriented variant (`wildcard_find_dbcs`) backs SEARCHB's ja-JP DBCS
-// rule; see its declaration below.
+// multibyte UTF-8 (CJK, emoji) behaves as Excel users expect. The matcher
+// itself lives in `wildcard.h`.
 
 #ifndef FORMULON_EVAL_CRITERIA_H_
 #define FORMULON_EVAL_CRITERIA_H_
@@ -234,48 +233,6 @@ bool matches_criterion(const Value& cell, const ParsedCriterion& criterion);
 /// callers with an `EvalContext` should use this overload.
 bool matches_criterion(const Value& cell, const ParsedCriterion& criterion, ExcelProfile profile);
 
-/// Byte-level wildcard matcher. `pattern` may contain unescaped `*` / `?`
-/// and `~`-escaped literals; `text` is matched verbatim. Shared between
-/// `matches_criterion` (for `COUNTIF`/`SUMIF`/`AVERAGEIF` equality paths)
-/// and scalar lookups such as `MATCH(..., 0)` that honour the same
-/// DOS-style wildcard dialect.
-///
-/// Iterative backtrack (no recursion) keeps stack depth constant. See the
-/// header-level divergence note: `?` matches one byte, not one code point.
-bool wildcard_match(std::string_view pattern, std::string_view text);
-
-/// Scans `rhs` for an unescaped `*` or `?`. A leading `~` escapes the next
-/// byte, so `"~*"` contains no wildcard but `"*~*"` does. Returns `true` on
-/// the first unescaped metacharacter encountered.
-bool scan_has_wildcard(std::string_view rhs);
-
-/// Returns the byte offset where `pattern` first matches a prefix of
-/// `text` starting at that offset (wildcards: `*`, `?`, `~` for escape).
-/// Returns `std::string_view::npos` when no position in `text` begins a
-/// match. The match is anchored at its start but not at its end — it
-/// succeeds as soon as `pattern` is consumed, regardless of any unmatched
-/// suffix in `text`. This mirrors the SEARCH contract where the pattern
-/// need only match somewhere inside the haystack.
-///
-/// Callers that need case-insensitive matching must lower-case both inputs
-/// first (the matcher is byte-exact). UTF-16 offset mapping is likewise the
-/// caller's responsibility; this helper only reports a byte offset into
-/// `text`.
-std::size_t wildcard_find(std::string_view pattern, std::string_view text);
-
-/// Same contract as `wildcard_find`, but `?` matches only a single
-/// SBCS-byte codepoint under the ja-JP DBCS rule (`byte_count_jajp(cp)
-/// == 1`): ASCII and half-width katakana match, every other codepoint
-/// (kanji, hiragana, full-width punctuation, emoji) refuses to match.
-/// `*`, `~?`, `~*`, and literal characters retain their normal
-/// semantics. Used exclusively by SEARCHB to mirror Mac Excel 365's
-/// byte-oriented wildcard dialect.
-///
-/// The returned offset is always aligned to a UTF-8 codepoint boundary in
-/// `text`, so callers translating the offset to a DBCS position (via
-/// `build_dbcs_char_map`) can use direct equality on `byte_offset`.
-std::size_t wildcard_find_dbcs(std::string_view pattern, std::string_view text);
-
 }  // namespace eval
 }  // namespace formulon
 
diff --git a/src/eval/date_text_parse.cpp b/src/eval/date_text_parse.cpp
index fa2200694..9f70ab3c5 100644
--- a/src/eval/date_text_parse.cpp
+++ b/src/eval/date_text_parse.cpp
@@ -241,6 +241,21 @@ int era_year_anchor(Era e) noexcept {
   return 1900;  // unreachable
 }
 
+// Validates an era-relative (year, month, day) against the Gregorian
+// calendar and writes its serial.
+bool serial_from_era_ymd(Era era, int era_year, int month, int day, double* out_serial) noexcept {
+  if (month < 1 || month > 12) {
+    return false;
+  }
+  const int gy = era_year - 1 + era_year_anchor(era);
+  const unsigned dim = days_in_month(gy, static_cast<unsigned>(month));
+  if (day < 1 || static_cast<unsigned>(day) > dim) {
+    return false;
+  }
+  *out_serial = date_time::serial_from_ymd(gy, static_cast<unsigned>(month), static_cast<unsigned>(day));
+  return true;
+}
+
 // After an era prefix has been consumed, parses the year/month/day tail in
 // the kanji form `<digits>年<digits>月<digits>日`. Mac Excel rejects 元
 // (gannen) and dot/slash separators when a *full-name* era prefix is used,
@@ -273,15 +288,9 @@ bool parse_era_kanji_ymd_tail(Era era, std::string_view s, double* out_serial, s
     return false;
   }
   s.remove_prefix(3);
-  if (month < 1 || month > 12) {
+  if (!serial_from_era_ymd(era, era_year, month, day, out_serial)) {
     return false;
   }
-  const int gy = era_year - 1 + era_year_anchor(era);
-  const unsigned dim = days_in_month(gy, static_cast<unsigned>(month));
-  if (day < 1 || static_cast<unsigned>(day) > dim) {
-    return false;
-  }
-  *out_serial = date_time::serial_from_ymd(gy, static_cast<unsigned>(month), static_cast<unsigned>(day));
   *rest = s;
   return true;
 }
@@ -312,15 +321,9 @@ bool parse_era_dot_ymd_tail(Era era, std::string_view s, double* out_serial, std
   if (scan_digits(s, 2, &day) == 0) {
     return false;
   }
-  if (month < 1 || month > 12) {
+  if (!serial_from_era_ymd(era, era_year, month, day, out_serial)) {
     return false;
   }
-  const int gy = era_year - 1 + era_year_anchor(era);
-  const unsigned dim = days_in_month(gy, static_cast<unsigned>(month));
-  if (day < 1 || static_cast<unsigned>(day) > dim) {
-    return false;
-  }
-  *out_serial = date_time::serial_from_ymd(gy, static_cast<unsigned>(month), static_cast<unsigned>(day));
   *rest = s;
   return true;
 }
diff --git a/src/eval/defined_name_resolve.cpp b/src/eval/defined_name_resolve.cpp
index 3adb7c2cf..bcc49cbe1 100644
--- a/src/eval/defined_name_resolve.cpp
+++ b/src/eval/defined_name_resolve.cpp
@@ -8,13 +8,13 @@
 #include <string_view>
 
 #include "defined_name.h"
+#include "eval/builtin_names.h"
 #include "eval/eval_context.h"
 #include "eval/formula_text_utils.h"
 #include "eval/lazy_impls.h"        // eval_node
 #include "eval/name_env_resolve.h"  // is_range_shaped_ast
 #include "eval/shape_ops_lazy.h"    // eval_node_as_array
 #include "parser/ast.h"
-#include "parser/parser.h"
 #include "sheet.h"
 #include "utils/strings.h"
 #include "value.h"
@@ -123,7 +123,7 @@ const parser::AstNode* prepare_defined_name_body(const DefinedName* def, Arena&
     }
   }
   const std::string_view src = strip_formula_prefix(def->formula);
-  parser::AstNode* root = src.empty() ? nullptr : parser::parse_strict(src, arena);
+  parser::AstNode* root = src.empty() ? nullptr : parse_formula_entry(src, arena);
   if (root == nullptr) {
     *out_err = ErrorCode::Name;
     return nullptr;
diff --git a/src/eval/dep_extractor.cpp b/src/eval/dep_extractor.cpp
index 53052e826..3e7079030 100644
--- a/src/eval/dep_extractor.cpp
+++ b/src/eval/dep_extractor.cpp
@@ -14,6 +14,7 @@
 #include <vector>
 
 #include "defined_name.h"
+#include "eval/builtin_names.h"
 #include "eval/cell_lazy.h"
 #include "eval/declared_rect.h"
 #include "eval/defined_name_resolve.h"
@@ -24,7 +25,6 @@
 #include "eval/tree_walker/dispatch.h"
 #include "eval/volatile_tracker.h"
 #include "parser/ast.h"
-#include "parser/parser.h"
 #include "parser/reference.h"
 #include "sheet.h"
 #include "sheet_name.h"
@@ -305,7 +305,7 @@ void visit_defined_name_body(const DefinedName& def, WalkState& state, Visit&& v
     return;
   }
 
-  parser::AstNode* root = parser::parse_strict(src, *state.name_arena);
+  parser::AstNode* root = parse_formula_entry(src, *state.name_arena);
   if (root == nullptr) {
     return;  // Unparseable (or valid-prefix-plus-garbage) formula: skip.
   }
diff --git a/src/eval/dirty_set.h b/src/eval/dirty_set.h
index 88ce526b4..fdb6952cc 100644
--- a/src/eval/dirty_set.h
+++ b/src/eval/dirty_set.h
@@ -15,6 +15,7 @@
 #define FORMULON_EVAL_DIRTY_SET_H_
 
 #include <cstddef>
+#include <cstdint>
 #include <unordered_set>
 #include <utility>
 
@@ -42,10 +43,21 @@ class DirtySet {
   bool contains(CellNodeId cell) const { return cells_.find(cell) != cells_.end(); }
 
   /// Removes `cell` from the set; no-op when absent.
-  void unmark(CellNodeId cell) { cells_.erase(cell); }
+  void unmark(CellNodeId cell) {
+    if (cells_.erase(cell) != 0U) {
+      ++generation_;
+    }
+  }
 
   /// Empties the set.
-  void clear() noexcept { cells_.clear(); }
+  void clear() noexcept {
+    cells_.clear();
+    ++generation_;
+  }
+
+  /// Changes whenever a cell leaves the set and never otherwise, so a caller
+  /// can trust "already marked" memos taken under an unchanged generation.
+  std::uint64_t generation() const noexcept { return generation_; }
 
   /// Number of cells currently marked dirty.
   std::size_t size() const noexcept { return cells_.size(); }
@@ -64,6 +76,8 @@ class DirtySet {
 
  private:
   std::unordered_set<CellNodeId, CellNodeIdHash> cells_;
+  // Starts above the zero that marks a never-visited range entry.
+  std::uint64_t generation_ = 1U;
 };
 
 }  // namespace formulon::eval
diff --git a/src/eval/dynamic_array/filtering.cpp b/src/eval/dynamic_array/filtering.cpp
index b06cec1ed..b6522c13d 100644
--- a/src/eval/dynamic_array/filtering.cpp
+++ b/src/eval/dynamic_array/filtering.cpp
@@ -21,6 +21,27 @@
 
 namespace formulon {
 namespace eval {
+namespace {
+
+// Evaluates a boolean flag argument through `coerce_to_bool`; an error
+// value or failed coercion lands in `*out_err`.
+bool eval_flag_arg(const parser::AstNode& node, Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx,
+                   bool* out, Value* out_err) {
+  const Value flag = eval_node(node, arena, registry, ctx);
+  if (flag.is_error()) {
+    *out_err = flag;
+    return false;
+  }
+  auto coerced = coerce_to_bool(flag);
+  if (!coerced) {
+    *out_err = Value::error(coerced.error());
+    return false;
+  }
+  *out = coerced.value();
+  return true;
+}
+
+}  // namespace
 
 Value eval_filter_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                        const EvalContext& ctx) {
@@ -114,27 +135,15 @@ Value eval_unique_lazy(const parser::AstNode& call, Arena& arena, const Function
   // (Blank coerces to FALSE per `coerce_to_bool`).
   bool by_col = false;
   if (arity >= 2U) {
-    const Value flag = eval_node(call.as_call_arg(1), arena, registry, ctx);
-    if (flag.is_error()) {
-      return flag;
+    if (!eval_flag_arg(call.as_call_arg(1), arena, registry, ctx, &by_col, &err)) {
+      return err;
     }
-    auto coerced = coerce_to_bool(flag);
-    if (!coerced) {
-      return Value::error(coerced.error());
-    }
-    by_col = coerced.value();
   }
   bool exactly_once = false;
   if (arity >= 3U) {
-    const Value flag = eval_node(call.as_call_arg(2), arena, registry, ctx);
-    if (flag.is_error()) {
-      return flag;
-    }
-    auto coerced = coerce_to_bool(flag);
-    if (!coerced) {
-      return Value::error(coerced.error());
+    if (!eval_flag_arg(call.as_call_arg(2), arena, registry, ctx, &exactly_once, &err)) {
+      return err;
     }
-    exactly_once = coerced.value();
   }
 
   // Walk lanes (rows or columns) once. `distinct` records first-occurrence
@@ -206,15 +215,9 @@ Value eval_sort_lazy(const parser::AstNode& call, Arena& arena, const FunctionRe
   // range of sort_index (column-bound for row-sort, row-bound for col-sort).
   bool by_col = false;
   if (arity >= 4U && !is_omitted_arg(call.as_call_arg(3))) {
-    const Value flag = eval_node(call.as_call_arg(3), arena, registry, ctx);
-    if (flag.is_error()) {
-      return flag;
-    }
-    auto coerced = coerce_to_bool(flag);
-    if (!coerced) {
-      return Value::error(coerced.error());
+    if (!eval_flag_arg(call.as_call_arg(3), arena, registry, ctx, &by_col, &err)) {
+      return err;
     }
-    by_col = coerced.value();
   }
 
   // sort_index defaults to 1 (1-based). Out-of-range -> #VALUE!. The
diff --git a/src/eval/ets_series.cpp b/src/eval/ets_series.cpp
new file mode 100644
index 000000000..cf06a94ad
--- /dev/null
+++ b/src/eval/ets_series.cpp
@@ -0,0 +1,355 @@
+//
+// Series preparation for the FORECAST.ETS family; the contract is declared in
+// `eval/ets_series.h`.
+
+#include "eval/ets_series.h"
+
+#include <algorithm>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+
+#include "utils/error.h"
+#include "utils/index_sort.h"
+#include "value.h"
+
+namespace formulon {
+namespace eval {
+namespace ets {
+namespace {
+
+// Step-size deviation tolerance for the resample grid. A consecutive delta-t
+// is required to fall within +/-`kStepDeviation` of the median step
+// (Excel's documented +/-30% tolerance). ORACLE-PENDING.
+constexpr double kStepDeviation = 0.3;
+
+// Cap on autocorrelation lags inspected by the seasonality detector. Excel
+// allows a maximum seasonality of 8760 (hours in a year), but for the ACF
+// scan the detection ceiling is 52 (weeks per year) which matches the
+// typical "weekly seasonality on weekly data" calibration. ORACLE-PENDING.
+constexpr std::uint32_t kMaxSeasonalityDetectLag = 52U;
+
+// Minimum |ACF| magnitude required to declare a detected seasonality.
+// Below this the auto-detector returns m = 1. ORACLE-PENDING.
+constexpr double kAcfDetectionThreshold = 0.3;
+
+// Relative floor on the linear-trend residual below which the detrended
+// series is treated as pure rounding noise and no period is reported. The
+// comparison is against the raw mean-centred variance, so it scales with
+// the data instead of assuming a magnitude.
+constexpr double kDetrendedResidualEpsilon = 1e-20;
+
+// ---------------------------------------------------------------------------
+// Aggregation
+// ---------------------------------------------------------------------------
+
+// Aggregates a run `[begin, end)` of identical-timeline points using the
+// requested mode. The COUNT / COUNTA modes return the run length (COUNT
+// excludes blanks but blanks have already been rejected at the strict-
+// numeric step, so the two modes coincide here -- both return the count).
+double aggregate_run(const Series& src, std::size_t begin, std::size_t end, AggregationMode mode) {
+  const std::size_t n = end - begin;
+  if (n == 0U) {
+    return 0.0;
+  }
+  if (n == 1U) {
+    // Optimisation: a singleton run with any mode collapses to its
+    // single sample (COUNT/COUNTA collapse to 1, but a singleton is
+    // already its own answer for 5 of the 7 modes; we special-case
+    // COUNT/COUNTA below).
+    if (mode == AggregationMode::kCount || mode == AggregationMode::kCountA) {
+      return 1.0;
+    }
+    return src.y[begin];
+  }
+  switch (mode) {
+    case AggregationMode::kCount:
+    case AggregationMode::kCountA:
+      return static_cast<double>(n);
+    case AggregationMode::kSum: {
+      double s = 0.0;
+      for (std::size_t i = begin; i < end; ++i)
+        s += src.y[i];
+      return s;
+    }
+    case AggregationMode::kMax: {
+      double m = src.y[begin];
+      for (std::size_t i = begin + 1U; i < end; ++i) {
+        if (src.y[i] > m)
+          m = src.y[i];
+      }
+      return m;
+    }
+    case AggregationMode::kMin: {
+      double m = src.y[begin];
+      for (std::size_t i = begin + 1U; i < end; ++i) {
+        if (src.y[i] < m)
+          m = src.y[i];
+      }
+      return m;
+    }
+    case AggregationMode::kMedian: {
+      std::vector<double> tmp(src.y.begin() + static_cast<std::ptrdiff_t>(begin),
+                              src.y.begin() + static_cast<std::ptrdiff_t>(end));
+      std::sort(tmp.begin(), tmp.end());
+      const std::size_t mid = tmp.size() / 2U;
+      if ((tmp.size() & 1U) == 1U) {
+        return tmp[mid];
+      }
+      return 0.5 * (tmp[mid - 1U] + tmp[mid]);
+    }
+    case AggregationMode::kAverage:
+    default: {
+      double s = 0.0;
+      for (std::size_t i = begin; i < end; ++i)
+        s += src.y[i];
+      return s / static_cast<double>(n);
+    }
+  }
+}
+
+}  // namespace
+
+// Sorts `src` by t (stable) and collapses runs of identical t via `mode`.
+// Returns the new (deduped, sorted) series.
+Series sort_and_aggregate(const Series& src, AggregationMode mode) {
+  const std::size_t n = src.t.size();
+  const auto by_t = [&src](std::uint32_t a, std::uint32_t b) { return src.t[a] < src.t[b]; };
+  std::vector<std::uint32_t> idx;
+  sorted_index_order(idx, static_cast<std::uint32_t>(n), make_index_less(by_t));
+  Series sorted;
+  sorted.t.reserve(n);
+  sorted.y.reserve(n);
+  for (std::size_t i = 0; i < n; ++i) {
+    sorted.t.push_back(src.t[idx[i]]);
+    sorted.y.push_back(src.y[idx[i]]);
+  }
+  // Aggregate consecutive runs with identical t.
+  Series out;
+  out.t.reserve(sorted.t.size());
+  out.y.reserve(sorted.y.size());
+  std::size_t i = 0;
+  while (i < sorted.t.size()) {
+    std::size_t j = i + 1U;
+    while (j < sorted.t.size() && sorted.t[j] == sorted.t[i]) {
+      ++j;
+    }
+    out.t.push_back(sorted.t[i]);
+    out.y.push_back(aggregate_run(sorted, i, j, mode));
+    i = j;
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------------------
+// Step detection and resampling
+// ---------------------------------------------------------------------------
+
+// Computes the median of consecutive deltas in a sorted timeline. Caller
+// guarantees `series.t.size() >= 2`.
+double median_delta(const std::vector<double>& t) {
+  std::vector<double> deltas;
+  deltas.reserve(t.size() - 1U);
+  for (std::size_t i = 1; i < t.size(); ++i) {
+    deltas.push_back(t[i] - t[i - 1U]);
+  }
+  std::sort(deltas.begin(), deltas.end());
+  const std::size_t mid = deltas.size() / 2U;
+  if ((deltas.size() & 1U) == 1U) {
+    return deltas[mid];
+  }
+  return 0.5 * (deltas[mid - 1U] + deltas[mid]);
+}
+
+// Resamples a sorted, deduplicated `series` onto an evenly spaced grid
+// with step `step`. The first point is taken as the grid origin; for
+// each later grid index `k = round((t_i - t_0) / step)` the value is
+// the corresponding y. Missing slots are then filled per
+// `data_completion`: 0 -> zero-fill, 1 -> linear interpolation between
+// the nearest known neighbours.
+//
+// On step / regularity failures writes `#NUM!` into `*out_err` and
+// returns `false`; otherwise writes the resampled series into `*out`.
+bool resample_to_grid(const Series& sorted, double step, int data_completion, Series* out, Value* out_err) {
+  if (step <= 0.0 || !std::isfinite(step)) {
+    *out_err = Value::error(ErrorCode::Num);
+    return false;
+  }
+  const double t0 = sorted.t.front();
+  const double t_last = sorted.t.back();
+  // Compute the integer index of the last point. A negative or non-finite
+  // span is impossible after sorting, but the round-then-cast guard below
+  // copes with floating-point jitter.
+  const double span = t_last - t0;
+  const double last_idx_d = std::round(span / step);
+  if (!std::isfinite(last_idx_d) || last_idx_d < 0.0) {
+    *out_err = Value::error(ErrorCode::Num);
+    return false;
+  }
+  const std::size_t grid_size = static_cast<std::size_t>(last_idx_d) + 1U;
+  // Defensive cap: a grid size > 2^20 would mean the timeline spans >1M
+  // steps, which is well beyond Excel's practical limits and almost
+  // certainly indicates a step-detection failure.
+  if (grid_size > (1U << 20U)) {
+    *out_err = Value::error(ErrorCode::Num);
+    return false;
+  }
+  std::vector<double> grid_y(grid_size, 0.0);
+  std::vector<bool> filled(grid_size, false);
+  for (std::size_t i = 0; i < sorted.t.size(); ++i) {
+    const double rel = (sorted.t[i] - t0) / step;
+    const double rounded = std::round(rel);
+    // Regularity check: every input must land within +/-30% of an
+    // integer grid index when measured in step units.
+    const double resid = std::fabs(rel - rounded);
+    if (resid > kStepDeviation) {
+      *out_err = Value::error(ErrorCode::Num);
+      return false;
+    }
+    const std::size_t k = static_cast<std::size_t>(rounded);
+    if (k >= grid_size) {
+      *out_err = Value::error(ErrorCode::Num);
+      return false;
+    }
+    if (filled[k]) {
+      // Two distinct timeline values mapping to the same grid index
+      // means the +/-30% tolerance was insufficient; treat as a
+      // step-detection failure.
+      *out_err = Value::error(ErrorCode::Num);
+      return false;
+    }
+    grid_y[k] = sorted.y[i];
+    filled[k] = true;
+  }
+
+  if (data_completion == 0) {
+    // Zero-fill: missing slots already initialised to 0.0; nothing
+    // further to do.
+  } else {
+    // Linear interpolation between known neighbours. The endpoints are
+    // always filled (the first sample lives at index 0; the last lives
+    // at index grid_size - 1) by construction.
+    std::size_t i = 0;
+    while (i < grid_size) {
+      if (filled[i]) {
+        ++i;
+        continue;
+      }
+      // Find the previous filled index (must exist; first cell is
+      // filled by construction).
+      std::size_t prev = i;
+      while (prev > 0U && !filled[prev])
+        --prev;
+      // Find the next filled index (must exist; last cell is filled).
+      std::size_t next = i;
+      while (next < grid_size && !filled[next])
+        ++next;
+      if (next >= grid_size) {
+        // No right anchor -- defensive; shouldn't happen since the last
+        // cell is always filled. Treat as a regularity failure.
+        *out_err = Value::error(ErrorCode::Num);
+        return false;
+      }
+      const double y_prev = grid_y[prev];
+      const double y_next = grid_y[next];
+      for (std::size_t k = prev + 1U; k < next; ++k) {
+        const double frac = static_cast<double>(k - prev) / static_cast<double>(next - prev);
+        grid_y[k] = y_prev + frac * (y_next - y_prev);
+        filled[k] = true;
+      }
+      i = next;
+    }
+  }
+
+  out->t.resize(grid_size);
+  out->y.resize(grid_size);
+  for (std::size_t i = 0; i < grid_size; ++i) {
+    out->t[i] = t0 + static_cast<double>(i) * step;
+    out->y[i] = grid_y[i];
+  }
+  return true;
+}
+
+// ---------------------------------------------------------------------------
+// Seasonality detection (autocorrelation)
+// ---------------------------------------------------------------------------
+
+// Returns the auto-detected seasonality length (>= 1). 1 means "no
+// seasonality" -- both for series too short to scan and for series
+// where no lag clears the threshold.
+std::uint32_t detect_seasonality(const std::vector<double>& y) {
+  const std::size_t n = y.size();
+  if (n < 4U) {
+    return 1U;
+  }
+  // The autocorrelation scan runs on the linear-trend residual, not on the
+  // raw series. A trending series is non-stationary: every lag of a plain
+  // ramp autocorrelates near 1, so an un-detrended scan reports a period
+  // for data that has none. Ordinary least squares against the sample
+  // index is enough here because the resample grid is equally spaced by
+  // construction, which lets the regression sums close in one pass.
+  const double count = static_cast<double>(n);
+  double sum_y = 0.0;
+  double sum_iy = 0.0;
+  for (std::size_t i = 0; i < n; ++i) {
+    sum_y += y[i];
+    sum_iy += static_cast<double>(i) * y[i];
+  }
+  const double mean_y = sum_y / count;
+  const double mean_i = (count - 1.0) / 2.0;
+  // sum (i - mean_i)^2 over 0..n-1 in closed form.
+  const double sxx = count * (count * count - 1.0) / 12.0;
+  const double sxy = sum_iy - mean_i * sum_y;
+  const double slope = (sxx > 0.0) ? (sxy / sxx) : 0.0;
+
+  std::vector<double> resid(n);
+  double var = 0.0;
+  double raw_var = 0.0;
+  for (std::size_t i = 0; i < n; ++i) {
+    const double fitted = mean_y + slope * (static_cast<double>(i) - mean_i);
+    resid[i] = y[i] - fitted;
+    var += resid[i] * resid[i];
+    const double centered = y[i] - mean_y;
+    raw_var += centered * centered;
+  }
+  // A residual that is pure rounding noise carries no seasonal signal, so
+  // compare it against the scale of the original series rather than to an
+  // exact zero: a perfect ramp leaves residuals around 1e-15, whose
+  // autocorrelations are otherwise arbitrary and clear the threshold.
+  if (raw_var == 0.0 || var <= raw_var * kDetrendedResidualEpsilon) {
+    return 1U;
+  }
+  const std::uint32_t max_lag_u = std::min<std::uint32_t>(static_cast<std::uint32_t>(n / 2U), kMaxSeasonalityDetectLag);
+  if (max_lag_u < 2U) {
+    return 1U;
+  }
+  // The residual is mean-zero by construction, so the centring term drops
+  // out of the autocorrelation numerator.
+  //
+  // Only positive autocorrelation counts. A seasonality is a repetition,
+  // and a negative correlation at lag k says the residual flips sign every
+  // k steps — the repetition is at 2k, not k. Ranking by magnitude would
+  // let that anti-correlated lag outrank the real period.
+  double best_acf = 0.0;
+  std::uint32_t best_lag = 1U;
+  for (std::uint32_t k = 2U; k <= max_lag_u; ++k) {
+    double num = 0.0;
+    for (std::size_t i = k; i < n; ++i) {
+      num += resid[i] * resid[i - k];
+    }
+    const double r = num / var;
+    if (r > best_acf) {
+      best_acf = r;
+      best_lag = k;
+    }
+  }
+  if (best_acf >= kAcfDetectionThreshold) {
+    return best_lag;
+  }
+  return 1U;
+}
+
+}  // namespace ets
+}  // namespace eval
+}  // namespace formulon
diff --git a/src/eval/ets_series.h b/src/eval/ets_series.h
new file mode 100644
index 000000000..46a38cad6
--- /dev/null
+++ b/src/eval/ets_series.h
@@ -0,0 +1,54 @@
+//
+// Series preparation shared by the FORECAST.ETS family: pairing, ordering and
+// aggregating the (timeline, value) samples, resampling them onto an evenly
+// spaced grid, and detecting the seasonality length.
+
+#ifndef FORMULON_EVAL_ETS_SERIES_H_
+#define FORMULON_EVAL_ETS_SERIES_H_
+
+#include <cstdint>
+#include <vector>
+
+#include "value.h"
+
+namespace formulon {
+namespace eval {
+namespace ets {
+
+/// Excel's documented aggregation enumeration for repeated timeline entries.
+
+enum class AggregationMode : std::uint32_t {
+  kAverage = 1U,
+  kCount = 2U,
+  kCountA = 3U,
+  kMax = 4U,
+  kMedian = 5U,
+  kMin = 6U,
+  kSum = 7U,
+};
+
+/// Parallel (t, y) sample vectors.
+struct Series {
+  std::vector<double> t;
+  std::vector<double> y;
+};
+
+/// Stable-sorts `src` by t and collapses runs of identical t via `mode`.
+Series sort_and_aggregate(const Series& src, AggregationMode mode);
+
+/// Median of consecutive deltas in a sorted timeline of at least two points.
+double median_delta(const std::vector<double>& t);
+
+/// Resamples a sorted, deduplicated series onto a grid of spacing `step`,
+/// filling gaps per `data_completion` (0 zero-fill, 1 linear interpolation).
+/// Writes `#NUM!` to `*out_err` and returns false on an irregular timeline.
+bool resample_to_grid(const Series& sorted, double step, int data_completion, Series* out, Value* out_err);
+
+/// Auto-detected seasonality length (>= 1); 1 means no seasonality.
+std::uint32_t detect_seasonality(const std::vector<double>& y);
+
+}  // namespace ets
+}  // namespace eval
+}  // namespace formulon
+
+#endif  // FORMULON_EVAL_ETS_SERIES_H_
diff --git a/src/eval/eval_context.cpp b/src/eval/eval_context.cpp
index 7f3e54962..53fff8529 100644
--- a/src/eval/eval_context.cpp
+++ b/src/eval/eval_context.cpp
@@ -12,6 +12,7 @@
 #include <string_view>
 #include <vector>
 
+#include "eval/builtin_names.h"
 #include "eval/declared_rect.h"
 #include "eval/eval_state.h"
 #include "eval/formula_text_utils.h"
@@ -21,7 +22,6 @@
 #include "eval/spill_committer.h"
 #include "eval/tree_walker.h"
 #include "parser/ast.h"
-#include "parser/parser.h"
 #include "parser/reference.h"
 #include "sheet.h"
 #include "sheet_name.h"
@@ -162,6 +162,16 @@ Value adopt_into_arena(Arena& arena, Value value) {
 
 }  // namespace
 
+const Sheet* EvalContext::sheet_for_qualifier(std::string_view sheet_name) const noexcept {
+  if (sheet_name.empty()) {
+    return current_sheet_;
+  }
+  if (workbook_ == nullptr) {
+    return nullptr;
+  }
+  return workbook_->sheet_by_name(sheet_name);
+}
+
 Value EvalContext::resolve_ref(const parser::Reference& ref) const {
   Value short_circuit = Value::blank();
   const Sheet* target = resolve_ref_target(current_sheet_, workbook_, ref, &short_circuit);
@@ -268,7 +278,7 @@ Value EvalContext::resolve_ref(const parser::Reference& ref, Arena& arena, const
   // literal in the formula surfaces in `result` as a view into the same
   // bytes, and both outlive the snapshot the text was copied out of.
   const std::string_view source = arena.intern(strip_formula_prefix(read.formula_text()));
-  parser::AstNode* root = parser::parse_strict(source, arena);
+  parser::AstNode* root = parse_formula_entry(source, arena);
 
   Value result = Value::blank();
   if (root == nullptr) {
diff --git a/src/eval/eval_context.h b/src/eval/eval_context.h
index b98fc9e41..780a95071 100644
--- a/src/eval/eval_context.h
+++ b/src/eval/eval_context.h
@@ -327,6 +327,11 @@ class EvalContext {
   /// context was default-constructed.
   const Sheet* current_sheet() const noexcept { return current_sheet_; }
 
+  /// Returns the sheet a reference qualifier names: the current sheet when
+  /// `sheet_name` is empty, otherwise the bound workbook's sheet of that
+  /// name. `nullptr` when no workbook is bound or the sheet is missing.
+  const Sheet* sheet_for_qualifier(std::string_view sheet_name) const noexcept;
+
   /// Returns the recursive-evaluation state this context is bound to, or
   /// `nullptr` when no state was supplied. Useful for tests that want to
   /// inspect the memoisation map after an evaluation.
diff --git a/src/eval/financial_lazy.cpp b/src/eval/financial_lazy.cpp
index bcf12a361..2b63f17f3 100644
--- a/src/eval/financial_lazy.cpp
+++ b/src/eval/financial_lazy.cpp
@@ -306,6 +306,26 @@ double mirr_closed_form(const std::vector<double>& flows, double finance_rate, d
   return std::pow(ratio, 1.0 / static_cast<double>(n - 1)) - 1.0;
 }
 
+// Reads an optional guess argument into `*guess`; a blank leaves the caller's default so a trailing
+// comma matches an omitted argument. Returns false with the error in `*out_err` on error or non-numeric.
+bool read_optional_guess(const parser::AstNode& arg, Arena& arena, const FunctionRegistry& registry,
+                         const EvalContext& ctx, double* guess, Value* out_err) {
+  const Value guess_v = eval_node(arg, arena, registry, ctx);
+  if (guess_v.is_error()) {
+    *out_err = guess_v;
+    return false;
+  }
+  if (!guess_v.is_blank()) {
+    auto coerced = coerce_to_number(guess_v);
+    if (!coerced) {
+      *out_err = Value::error(coerced.error());
+      return false;
+    }
+    *guess = coerced.value();
+  }
+  return true;
+}
+
 }  // namespace
 
 Value eval_irr_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
@@ -329,30 +349,14 @@ Value eval_irr_lazy(const parser::AstNode& call, Arena& arena, const FunctionReg
   }
 
   double rate = 0.1;  // default guess per Excel.
-  if (arity == 2U) {
-    const Value guess_v = eval_node(call.as_call_arg(1), arena, registry, ctx);
-    if (guess_v.is_error()) {
-      return guess_v;
-    }
-    // Blank guess falls back to 0.1, matching Excel's behaviour when the
-    // second argument is elided with a trailing comma. `coerce_to_number`
-    // returns 0 for blank, which is a valid (but different) starting
-    // guess — we therefore only apply the coerced value when the cell is
-    // not blank, so `=IRR(A1:A4,)` and `=IRR(A1:A4)` behave identically.
-    if (!guess_v.is_blank()) {
-      auto coerced = coerce_to_number(guess_v);
-      if (!coerced) {
-        return Value::error(coerced.error());
-      }
-      rate = coerced.value();
-      // An explicit out-of-domain guess (the NPV expansion needs
-      // 1 + rate > 0) is an input error, not an iteration failure, so
-      // Excel surfaces #VALUE! here rather than the #NUM! the in-loop
-      // boundary check uses when Newton walks past -1 on its own.
-      if (rate <= -1.0) {
-        return Value::error(ErrorCode::Value);
-      }
-    }
+  Value guess_err = Value::blank();
+  if (arity == 2U && !read_optional_guess(call.as_call_arg(1), arena, registry, ctx, &rate, &guess_err)) {
+    return guess_err;
+  }
+  // An explicit out-of-domain guess (the NPV expansion needs 1 + rate > 0) is an input error, so
+  // Excel surfaces #VALUE! rather than the #NUM! the in-loop boundary check uses.
+  if (rate <= -1.0) {
+    return Value::error(ErrorCode::Value);
   }
 
   // Try Newton-Raphson first; it converges quickly for the well-posed
@@ -685,19 +689,8 @@ Value eval_xirr_lazy(const parser::AstNode& call, Arena& arena, const FunctionRe
   }
 
   double guess = 0.1;  // default guess per Excel.
-  if (arity == 3U) {
-    const Value guess_v = eval_node(call.as_call_arg(2), arena, registry, ctx);
-    if (guess_v.is_error()) {
-      return guess_v;
-    }
-    // Blank guess falls back to 0.1 so `=XIRR(v, d,)` matches `=XIRR(v, d)`.
-    if (!guess_v.is_blank()) {
-      auto coerced = coerce_to_number(guess_v);
-      if (!coerced) {
-        return Value::error(coerced.error());
-      }
-      guess = coerced.value();
-    }
+  if (arity == 3U && !read_optional_guess(call.as_call_arg(2), arena, registry, ctx, &guess, &err)) {
+    return err;
   }
   // Mac Excel rejects any negative guess; Newton-Raphson would still
   // converge from there, but Excel treats negative guesses as an input
diff --git a/src/eval/forecast_ets_lazy.cpp b/src/eval/forecast_ets_lazy.cpp
index ee565d8ee..7906e583c 100644
--- a/src/eval/forecast_ets_lazy.cpp
+++ b/src/eval/forecast_ets_lazy.cpp
@@ -1,8 +1,9 @@
 //
 // Implementation of the FORECAST.ETS family lazy impls.
 //
-// All four functions share a single Holt-Winters additive triple-exponential
-// smoothing core implemented in `HoltWintersFit`. The pipeline per call is:
+// All four functions share a Holt-Winters additive triple-exponential
+// smoothing core (`eval/holt_winters.h`) over a series prepared by
+// `eval/ets_series.h`. The pipeline per call is:
 //
 //   1. Materialise both array arguments (`values`, `timeline`) via
 //      `eval_node_as_array` so RangeOp / Ref / ArrayLiteral / arithmetic
@@ -38,25 +39,23 @@
 
 #include "eval/forecast_ets_lazy.h"
 
-#include <algorithm>
-#include <array>
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
-#include <limits>
 #include <utility>
 #include <vector>
 
 #include "eval/builtins/stats/stats_helpers.h"
 #include "eval/coerce.h"
+#include "eval/ets_series.h"
 #include "eval/eval_context.h"
+#include "eval/holt_winters.h"
 #include "eval/lazy_impls.h"
 #include "eval/range_args.h"
 #include "eval/shape_ops_lazy.h"
 #include "parser/ast.h"
 #include "utils/arena.h"
 #include "utils/error.h"
-#include "utils/index_sort.h"
 #include "value.h"
 
 namespace formulon {
@@ -67,54 +66,18 @@ namespace {
 // Constants
 // ---------------------------------------------------------------------------
 
-// Step-size deviation tolerance for the resample grid. A consecutive delta-t
-// is required to fall within +/-`kStepDeviation` of the median step
-// (Excel's documented +/-30% tolerance). ORACLE-PENDING.
-constexpr double kStepDeviation = 0.3;
-
-// Cap on autocorrelation lags inspected by the seasonality detector. Excel
-// allows a maximum seasonality of 8760 (hours in a year), but for the ACF
-// scan the detection ceiling is 52 (weeks per year) which matches the
-// typical "weekly seasonality on weekly data" calibration. ORACLE-PENDING.
-constexpr std::uint32_t kMaxSeasonalityDetectLag = 52U;
-
 // Maximum manually-specified seasonality. Above this the third argument
 // is rejected with `#NUM!` (matches Excel's documented 8760 limit).
 constexpr std::uint32_t kMaxSeasonalityArg = 8760U;
 
-// Minimum |ACF| magnitude required to declare a detected seasonality.
-// Below this the auto-detector returns m = 1. ORACLE-PENDING.
-constexpr double kAcfDetectionThreshold = 0.3;
-
-// Relative floor on the linear-trend residual below which the detrended
-// series is treated as pure rounding noise and no period is reported. The
-// comparison is against the raw mean-centred variance, so it scales with
-// the data instead of assuming a magnitude.
-constexpr double kDetrendedResidualEpsilon = 1e-20;
-
-// Nelder-Mead bounds clamp -- coordinates are squeezed into
-// (kBoundEps, 1 - kBoundEps) so the gradient never escapes the unit
-// cube and the smoothing recurrences stay well-defined.
-constexpr double kBoundEps = 1e-6;
-
-// Nelder-Mead convergence: stop when (fmax - fmin) over the simplex falls
-// below this, or when iteration count exceeds kMaxNelderMeadIters.
-constexpr double kNelderMeadFTol = 1e-9;
-constexpr int kMaxNelderMeadIters = 200;
-
-// ---------------------------------------------------------------------------
-// Aggregation modes (Excel's documented enumeration)
-// ---------------------------------------------------------------------------
-
-enum class AggregationMode : std::uint32_t {
-  kAverage = 1U,
-  kCount = 2U,
-  kCountA = 3U,
-  kMax = 4U,
-  kMedian = 5U,
-  kMin = 6U,
-  kSum = 7U,
-};
+using ets::AggregationMode;
+using ets::detect_seasonality;
+using ets::fit_holt_winters;
+using ets::HoltWintersFit;
+using ets::median_delta;
+using ets::resample_to_grid;
+using ets::Series;
+using ets::sort_and_aggregate;
 
 // ---------------------------------------------------------------------------
 // Array materialisation + strict numeric coercion
@@ -148,873 +111,14 @@ bool coerce_strict_numeric(const Value& v, double* out, Value* out_err) {
   return false;
 }
 
-// ---------------------------------------------------------------------------
-// (t, y) pair container shared across the helpers
-// ---------------------------------------------------------------------------
-
-struct Series {
-  std::vector<double> t;
-  std::vector<double> y;
-};
-
-// ---------------------------------------------------------------------------
-// Aggregation
-// ---------------------------------------------------------------------------
-
-// Aggregates a run `[begin, end)` of identical-timeline points using the
-// requested mode. The COUNT / COUNTA modes return the run length (COUNT
-// excludes blanks but blanks have already been rejected at the strict-
-// numeric step, so the two modes coincide here -- both return the count).
-double aggregate_run(const Series& src, std::size_t begin, std::size_t end, AggregationMode mode) {
-  const std::size_t n = end - begin;
-  if (n == 0U) {
-    return 0.0;
-  }
-  if (n == 1U) {
-    // Optimisation: a singleton run with any mode collapses to its
-    // single sample (COUNT/COUNTA collapse to 1, but a singleton is
-    // already its own answer for 5 of the 7 modes; we special-case
-    // COUNT/COUNTA below).
-    if (mode == AggregationMode::kCount || mode == AggregationMode::kCountA) {
-      return 1.0;
-    }
-    return src.y[begin];
-  }
-  switch (mode) {
-    case AggregationMode::kCount:
-    case AggregationMode::kCountA:
-      return static_cast<double>(n);
-    case AggregationMode::kSum: {
-      double s = 0.0;
-      for (std::size_t i = begin; i < end; ++i)
-        s += src.y[i];
-      return s;
-    }
-    case AggregationMode::kMax: {
-      double m = src.y[begin];
-      for (std::size_t i = begin + 1U; i < end; ++i) {
-        if (src.y[i] > m)
-          m = src.y[i];
-      }
-      return m;
-    }
-    case AggregationMode::kMin: {
-      double m = src.y[begin];
-      for (std::size_t i = begin + 1U; i < end; ++i) {
-        if (src.y[i] < m)
-          m = src.y[i];
-      }
-      return m;
-    }
-    case AggregationMode::kMedian: {
-      std::vector<double> tmp(src.y.begin() + static_cast<std::ptrdiff_t>(begin),
-                              src.y.begin() + static_cast<std::ptrdiff_t>(end));
-      std::sort(tmp.begin(), tmp.end());
-      const std::size_t mid = tmp.size() / 2U;
-      if ((tmp.size() & 1U) == 1U) {
-        return tmp[mid];
-      }
-      return 0.5 * (tmp[mid - 1U] + tmp[mid]);
-    }
-    case AggregationMode::kAverage:
-    default: {
-      double s = 0.0;
-      for (std::size_t i = begin; i < end; ++i)
-        s += src.y[i];
-      return s / static_cast<double>(n);
-    }
-  }
-}
-
-// Sorts `src` by t (stable) and collapses runs of identical t via `mode`.
-// Returns the new (deduped, sorted) series.
-Series sort_and_aggregate(const Series& src, AggregationMode mode) {
-  const std::size_t n = src.t.size();
-  const auto by_t = [&src](std::uint32_t a, std::uint32_t b) { return src.t[a] < src.t[b]; };
-  std::vector<std::uint32_t> idx;
-  sorted_index_order(idx, static_cast<std::uint32_t>(n), make_index_less(by_t));
-  Series sorted;
-  sorted.t.reserve(n);
-  sorted.y.reserve(n);
-  for (std::size_t i = 0; i < n; ++i) {
-    sorted.t.push_back(src.t[idx[i]]);
-    sorted.y.push_back(src.y[idx[i]]);
-  }
-  // Aggregate consecutive runs with identical t.
-  Series out;
-  out.t.reserve(sorted.t.size());
-  out.y.reserve(sorted.y.size());
-  std::size_t i = 0;
-  while (i < sorted.t.size()) {
-    std::size_t j = i + 1U;
-    while (j < sorted.t.size() && sorted.t[j] == sorted.t[i]) {
-      ++j;
-    }
-    out.t.push_back(sorted.t[i]);
-    out.y.push_back(aggregate_run(sorted, i, j, mode));
-    i = j;
-  }
-  return out;
-}
-
-// ---------------------------------------------------------------------------
-// Step detection and resampling
-// ---------------------------------------------------------------------------
-
-// Computes the median of consecutive deltas in a sorted timeline. Caller
-// guarantees `series.t.size() >= 2`.
-double median_delta(const std::vector<double>& t) {
-  std::vector<double> deltas;
-  deltas.reserve(t.size() - 1U);
-  for (std::size_t i = 1; i < t.size(); ++i) {
-    deltas.push_back(t[i] - t[i - 1U]);
-  }
-  std::sort(deltas.begin(), deltas.end());
-  const std::size_t mid = deltas.size() / 2U;
-  if ((deltas.size() & 1U) == 1U) {
-    return deltas[mid];
-  }
-  return 0.5 * (deltas[mid - 1U] + deltas[mid]);
-}
-
-// Resamples a sorted, deduplicated `series` onto an evenly spaced grid
-// with step `step`. The first point is taken as the grid origin; for
-// each later grid index `k = round((t_i - t_0) / step)` the value is
-// the corresponding y. Missing slots are then filled per
-// `data_completion`: 0 -> zero-fill, 1 -> linear interpolation between
-// the nearest known neighbours.
-//
-// On step / regularity failures writes `#NUM!` into `*out_err` and
-// returns `false`; otherwise writes the resampled series into `*out`.
-bool resample_to_grid(const Series& sorted, double step, int data_completion, Series* out, Value* out_err) {
-  if (step <= 0.0 || !std::isfinite(step)) {
-    *out_err = Value::error(ErrorCode::Num);
-    return false;
-  }
-  const double t0 = sorted.t.front();
-  const double t_last = sorted.t.back();
-  // Compute the integer index of the last point. A negative or non-finite
-  // span is impossible after sorting, but the round-then-cast guard below
-  // copes with floating-point jitter.
-  const double span = t_last - t0;
-  const double last_idx_d = std::round(span / step);
-  if (!std::isfinite(last_idx_d) || last_idx_d < 0.0) {
-    *out_err = Value::error(ErrorCode::Num);
-    return false;
-  }
-  const std::size_t grid_size = static_cast<std::size_t>(last_idx_d) + 1U;
-  // Defensive cap: a grid size > 2^20 would mean the timeline spans >1M
-  // steps, which is well beyond Excel's practical limits and almost
-  // certainly indicates a step-detection failure.
-  if (grid_size > (1U << 20U)) {
-    *out_err = Value::error(ErrorCode::Num);
-    return false;
-  }
-  std::vector<double> grid_y(grid_size, 0.0);
-  std::vector<bool> filled(grid_size, false);
-  for (std::size_t i = 0; i < sorted.t.size(); ++i) {
-    const double rel = (sorted.t[i] - t0) / step;
-    const double rounded = std::round(rel);
-    // Regularity check: every input must land within +/-30% of an
-    // integer grid index when measured in step units.
-    const double resid = std::fabs(rel - rounded);
-    if (resid > kStepDeviation) {
-      *out_err = Value::error(ErrorCode::Num);
-      return false;
-    }
-    const std::size_t k = static_cast<std::size_t>(rounded);
-    if (k >= grid_size) {
-      *out_err = Value::error(ErrorCode::Num);
-      return false;
-    }
-    if (filled[k]) {
-      // Two distinct timeline values mapping to the same grid index
-      // means the +/-30% tolerance was insufficient; treat as a
-      // step-detection failure.
-      *out_err = Value::error(ErrorCode::Num);
-      return false;
-    }
-    grid_y[k] = sorted.y[i];
-    filled[k] = true;
-  }
-
-  if (data_completion == 0) {
-    // Zero-fill: missing slots already initialised to 0.0; nothing
-    // further to do.
-  } else {
-    // Linear interpolation between known neighbours. The endpoints are
-    // always filled (the first sample lives at index 0; the last lives
-    // at index grid_size - 1) by construction.
-    std::size_t i = 0;
-    while (i < grid_size) {
-      if (filled[i]) {
-        ++i;
-        continue;
-      }
-      // Find the previous filled index (must exist; first cell is
-      // filled by construction).
-      std::size_t prev = i;
-      while (prev > 0U && !filled[prev])
-        --prev;
-      // Find the next filled index (must exist; last cell is filled).
-      std::size_t next = i;
-      while (next < grid_size && !filled[next])
-        ++next;
-      if (next >= grid_size) {
-        // No right anchor -- defensive; shouldn't happen since the last
-        // cell is always filled. Treat as a regularity failure.
-        *out_err = Value::error(ErrorCode::Num);
-        return false;
-      }
-      const double y_prev = grid_y[prev];
-      const double y_next = grid_y[next];
-      for (std::size_t k = prev + 1U; k < next; ++k) {
-        const double frac = static_cast<double>(k - prev) / static_cast<double>(next - prev);
-        grid_y[k] = y_prev + frac * (y_next - y_prev);
-        filled[k] = true;
-      }
-      i = next;
-    }
-  }
-
-  out->t.resize(grid_size);
-  out->y.resize(grid_size);
-  for (std::size_t i = 0; i < grid_size; ++i) {
-    out->t[i] = t0 + static_cast<double>(i) * step;
-    out->y[i] = grid_y[i];
-  }
-  return true;
-}
-
-// ---------------------------------------------------------------------------
-// Seasonality detection (autocorrelation)
-// ---------------------------------------------------------------------------
-
-// Returns the auto-detected seasonality length (>= 1). 1 means "no
-// seasonality" -- both for series too short to scan and for series
-// where no lag clears the threshold.
-std::uint32_t detect_seasonality(const std::vector<double>& y) {
-  const std::size_t n = y.size();
-  if (n < 4U) {
-    return 1U;
-  }
-  // The autocorrelation scan runs on the linear-trend residual, not on the
-  // raw series. A trending series is non-stationary: every lag of a plain
-  // ramp autocorrelates near 1, so an un-detrended scan reports a period
-  // for data that has none. Ordinary least squares against the sample
-  // index is enough here because the resample grid is equally spaced by
-  // construction, which lets the regression sums close in one pass.
-  const double count = static_cast<double>(n);
-  double sum_y = 0.0;
-  double sum_iy = 0.0;
-  for (std::size_t i = 0; i < n; ++i) {
-    sum_y += y[i];
-    sum_iy += static_cast<double>(i) * y[i];
-  }
-  const double mean_y = sum_y / count;
-  const double mean_i = (count - 1.0) / 2.0;
-  // sum (i - mean_i)^2 over 0..n-1 in closed form.
-  const double sxx = count * (count * count - 1.0) / 12.0;
-  const double sxy = sum_iy - mean_i * sum_y;
-  const double slope = (sxx > 0.0) ? (sxy / sxx) : 0.0;
-
-  std::vector<double> resid(n);
-  double var = 0.0;
-  double raw_var = 0.0;
-  for (std::size_t i = 0; i < n; ++i) {
-    const double fitted = mean_y + slope * (static_cast<double>(i) - mean_i);
-    resid[i] = y[i] - fitted;
-    var += resid[i] * resid[i];
-    const double centered = y[i] - mean_y;
-    raw_var += centered * centered;
-  }
-  // A residual that is pure rounding noise carries no seasonal signal, so
-  // compare it against the scale of the original series rather than to an
-  // exact zero: a perfect ramp leaves residuals around 1e-15, whose
-  // autocorrelations are otherwise arbitrary and clear the threshold.
-  if (raw_var == 0.0 || var <= raw_var * kDetrendedResidualEpsilon) {
-    return 1U;
-  }
-  const std::uint32_t max_lag_u = std::min<std::uint32_t>(static_cast<std::uint32_t>(n / 2U), kMaxSeasonalityDetectLag);
-  if (max_lag_u < 2U) {
-    return 1U;
-  }
-  // The residual is mean-zero by construction, so the centring term drops
-  // out of the autocorrelation numerator.
-  //
-  // Only positive autocorrelation counts. A seasonality is a repetition,
-  // and a negative correlation at lag k says the residual flips sign every
-  // k steps — the repetition is at 2k, not k. Ranking by magnitude would
-  // let that anti-correlated lag outrank the real period.
-  double best_acf = 0.0;
-  std::uint32_t best_lag = 1U;
-  for (std::uint32_t k = 2U; k <= max_lag_u; ++k) {
-    double num = 0.0;
-    for (std::size_t i = k; i < n; ++i) {
-      num += resid[i] * resid[i - k];
-    }
-    const double r = num / var;
-    if (r > best_acf) {
-      best_acf = r;
-      best_lag = k;
-    }
-  }
-  if (best_acf >= kAcfDetectionThreshold) {
-    return best_lag;
-  }
-  return 1U;
-}
-
-// ---------------------------------------------------------------------------
-// Holt-Winters fit
-// ---------------------------------------------------------------------------
-
-struct HoltWintersFit {
-  // Smoothing parameters fitted by Nelder-Mead. `gamma` is exactly 0.0
-  // when the model is non-seasonal (m == 1).
-  double alpha = 0.0;
-  double beta = 0.0;
-  double gamma = 0.0;
-  // Final state at the end of the in-sample series.
-  double level = 0.0;
-  double trend = 0.0;
-  std::vector<double> season;  // length m (or empty when m == 1)
-  std::uint32_t m = 1U;
-  // In-sample fit diagnostics. `residuals` has the same length as the
-  // resampled series; the first m entries (or the first 1 when m == 1)
-  // are zero because no one-step-ahead forecast is defined there.
-  std::vector<double> residuals;
-  double mae = 0.0;
-  double rmse = 0.0;
-  double mase = 0.0;
-  double smape = 0.0;
-};
-
-// Runs the Holt-Winters smoothing recurrences over `y` with explicit
-// initial state (`init_level`, `init_trend`, `init_season[0..m-1]`),
-// populates `*out` (level / trend / season / residuals), and returns the
-// in-sample SSE used by the optimiser.
-//
-// Recurrences (additive seasonality):
-//   L_t = alpha (y_t - S_{t-m}) + (1-alpha)(L_{t-1} + B_{t-1})
-//   B_t = beta  (L_t - L_{t-1}) + (1-beta)  B_{t-1}
-//   S_t = gamma (y_t - L_t)     + (1-gamma) S_{t-m}
-// Forecast residual at step t is `y_t - (L_{t-1} + B_{t-1} + S_{t-m})`.
-//
-// `init_season` may be null when `m == 1`.
-double simulate_with_init(const std::vector<double>& y, std::uint32_t m, double alpha, double beta, double gamma,
-                          double init_level, double init_trend, const double* init_season, HoltWintersFit* out) {
-  const std::size_t n = y.size();
-  double level = init_level;
-  double trend = init_trend;
-  std::vector<double> season(m == 1U ? 0U : static_cast<std::size_t>(m), 0.0);
-  if (m != 1U && init_season != nullptr) {
-    for (std::uint32_t i = 0; i < m; ++i) {
-      season[i] = init_season[i];
-    }
-  }
-
-  std::vector<double> residuals(n, 0.0);
-  double sse = 0.0;
-  // The first `start` indices have no one-step-ahead forecast (no prior
-  // level / trend / seasonal estimate is available beneath them).
-  const std::size_t start = (m == 1U) ? 1U : static_cast<std::size_t>(m);
-  for (std::size_t t = start; t < n; ++t) {
-    const double prev_level = level;
-    const double prev_trend = trend;
-    const double s_prev = (m == 1U) ? 0.0 : season[t % m];
-    const double y_hat = prev_level + prev_trend + s_prev;
-    const double err = y[t] - y_hat;
-    residuals[t] = err;
-    sse += err * err;
-    // Update equations.
-    level = alpha * (y[t] - s_prev) + (1.0 - alpha) * (prev_level + prev_trend);
-    trend = beta * (level - prev_level) + (1.0 - beta) * prev_trend;
-    if (m != 1U) {
-      season[t % m] = gamma * (y[t] - level) + (1.0 - gamma) * s_prev;
-    }
-  }
-
-  if (out != nullptr) {
-    out->alpha = alpha;
-    out->beta = beta;
-    out->gamma = (m == 1U) ? 0.0 : gamma;
-    out->level = level;
-    out->trend = trend;
-    out->season = season;
-    out->m = m;
-    out->residuals = std::move(residuals);
-  }
-  return sse;
-}
-
-// Computes the textbook two-season-means default initial state used as the
-// starting point of the optimiser. With `m == 1` we use Holt's double
-// exponential: L_0 = y_0, B_0 = y_1 - y_0 (no seasonal vector).
-void compute_default_init(const std::vector<double>& y, std::uint32_t m, double* out_level, double* out_trend,
-                          std::vector<double>* out_season) {
-  const std::size_t n = y.size();
-  out_season->assign(m == 1U ? 0U : static_cast<std::size_t>(m), 0.0);
-  if (m == 1U) {
-    *out_level = y[0];
-    *out_trend = (n >= 2U) ? (y[1] - y[0]) : 0.0;
-    return;
-  }
-  double mean1 = 0.0;
-  for (std::uint32_t i = 0; i < m; ++i)
-    mean1 += y[i];
-  mean1 /= static_cast<double>(m);
-  double mean2 = mean1;
-  if (n >= 2U * static_cast<std::size_t>(m)) {
-    mean2 = 0.0;
-    for (std::uint32_t i = 0; i < m; ++i)
-      mean2 += y[m + i];
-    mean2 /= static_cast<double>(m);
-  }
-  *out_level = mean1;
-  *out_trend = (mean2 - mean1) / static_cast<double>(m);
-  double s_sum = 0.0;
-  for (std::uint32_t i = 0; i < m; ++i) {
-    (*out_season)[i] = y[i] - mean1;
-    s_sum += (*out_season)[i];
-  }
-  const double s_mean = s_sum / static_cast<double>(m);
-  for (std::uint32_t i = 0; i < m; ++i)
-    (*out_season)[i] -= s_mean;
-}
-
-// Backwards-compatible wrapper: runs `simulate_with_init` from the textbook
-// two-season-means default initialisation.
-double simulate(const std::vector<double>& y, std::uint32_t m, double alpha, double beta, double gamma,
-                HoltWintersFit* out) {
-  double init_level = 0.0;
-  double init_trend = 0.0;
-  std::vector<double> init_season;
-  compute_default_init(y, m, &init_level, &init_trend, &init_season);
-  return simulate_with_init(y, m, alpha, beta, gamma, init_level, init_trend,
-                            init_season.empty() ? nullptr : init_season.data(), out);
-}
-
-// ---------------------------------------------------------------------------
-// Bounded Nelder-Mead in 2D / 3D
-// ---------------------------------------------------------------------------
-
-struct ParamBounds {
-  double lo;
-  double hi;
-};
-
-// Clamps each coordinate of `v` (length `dim`) into its per-coordinate bound.
-void clamp_vertex_bounded(double* v, std::size_t dim, const ParamBounds* bounds) noexcept {
-  for (std::size_t i = 0; i < dim; ++i) {
-    if (v[i] < bounds[i].lo)
-      v[i] = bounds[i].lo;
-    if (v[i] > bounds[i].hi)
-      v[i] = bounds[i].hi;
-  }
-}
-
-// Expands a packed parameter vector of length `dim` into (alpha, beta, gamma).
-// `dim == 2` => non-seasonal: gamma is forced to 0.
-// `dim == 3` => seasonal: all three are read out.
-void unpack_params(const double* p, std::size_t dim, double* alpha, double* beta, double* gamma) noexcept {
-  *alpha = p[0];
-  *beta = p[1];
-  *gamma = (dim == 3U) ? p[2] : 0.0;
-}
-
-// Objective evaluated by the simplex search. `smooth_dim` is only meaningful
-// to the joint objective; the smoothing-only one ignores it.
-using SimplexObjective = double (*)(const double* params, std::size_t dim, std::size_t smooth_dim,
-                                    const std::vector<double>& y, std::uint32_t m);
-
-// SSE objective for the smoothing-only optimiser. Returns +inf for non-finite
-// SSE (which guides the simplex away from pathological corners).
-double objective(const double* params, std::size_t dim, std::size_t /*smooth_dim*/, const std::vector<double>& y,
-                 std::uint32_t m) {
-  double alpha = 0.0;
-  double beta = 0.0;
-  double gamma = 0.0;
-  unpack_params(params, dim, &alpha, &beta, &gamma);
-  const double sse = simulate(y, m, alpha, beta, gamma, nullptr);
-  if (!std::isfinite(sse)) {
-    return std::numeric_limits<double>::infinity();
-  }
-  return sse;
-}
-
-// Bounded Nelder-Mead over `dim` coordinates, minimising `evaluate`. The
-// starting simplex is `seed` plus one `seed_step` perturbation per axis; every
-// vertex is clamped into `bounds` after each move. Writes the best vertex into
-// `*out_params` and returns its objective value.
-//
-// The simplex coefficients are the canonical (Nelder-Mead 1965) values:
-//   reflect rho = 1, expand chi = 2, contract psi = 0.5, shrink sigma = 0.5.
-double nelder_mead_search(const std::vector<double>& y, std::uint32_t m, std::size_t dim, std::size_t smooth_dim,
-                          const double* seed, double seed_step, const std::vector<ParamBounds>& bounds, int iter_cap,
-                          SimplexObjective evaluate, std::vector<double>* out_params) {
-  const std::size_t k = dim + 1U;
-  std::vector<std::vector<double>> simplex(k, std::vector<double>(dim, 0.0));
-  // Vertex 0: anchor.
-  for (std::size_t j = 0; j < dim; ++j) {
-    simplex[0][j] = seed[j];
-  }
-  // Vertices 1..dim: perturb the i-th axis.
-  for (std::size_t i = 1; i < k; ++i) {
-    for (std::size_t j = 0; j < dim; ++j) {
-      simplex[i][j] = simplex[0][j];
-    }
-    simplex[i][i - 1U] += seed_step;
-  }
-  for (auto& v : simplex) {
-    clamp_vertex_bounded(v.data(), dim, bounds.data());
-  }
-
-  std::vector<double> fvals(k, 0.0);
-  for (std::size_t i = 0; i < k; ++i) {
-    fvals[i] = evaluate(simplex[i].data(), dim, smooth_dim, y, m);
-  }
-
-  for (int iter = 0; iter < iter_cap; ++iter) {
-    // Sort vertices by function value (ascending).
-    std::vector<std::size_t> order(k);
-    for (std::size_t i = 0; i < k; ++i)
-      order[i] = i;
-    std::sort(order.begin(), order.end(),
-              [&fvals](std::size_t a, std::size_t b) noexcept { return fvals[a] < fvals[b]; });
-    const std::size_t best = order[0];
-    const std::size_t worst = order[k - 1U];
-    const std::size_t second_worst = order[k - 2U];
-
-    // Convergence check: span of f-values across the simplex.
-    if (std::isfinite(fvals[best]) && std::isfinite(fvals[worst]) && (fvals[worst] - fvals[best]) < kNelderMeadFTol) {
-      break;
-    }
-
-    // Centroid of the best-`dim` vertices (i.e. all except the worst).
-    std::vector<double> centroid(dim, 0.0);
-    for (std::size_t i = 0; i < k; ++i) {
-      if (i == worst)
-        continue;
-      for (std::size_t j = 0; j < dim; ++j)
-        centroid[j] += simplex[i][j];
-    }
-    for (std::size_t j = 0; j < dim; ++j)
-      centroid[j] /= static_cast<double>(dim);
-
-    // Reflect.
-    std::vector<double> reflected(dim);
-    for (std::size_t j = 0; j < dim; ++j) {
-      reflected[j] = centroid[j] + 1.0 * (centroid[j] - simplex[worst][j]);
-    }
-    clamp_vertex_bounded(reflected.data(), dim, bounds.data());
-    const double f_reflected = evaluate(reflected.data(), dim, smooth_dim, y, m);
-
-    if (f_reflected < fvals[second_worst] && f_reflected >= fvals[best]) {
-      simplex[worst] = reflected;
-      fvals[worst] = f_reflected;
-      continue;
-    }
-
-    if (f_reflected < fvals[best]) {
-      // Expand.
-      std::vector<double> expanded(dim);
-      for (std::size_t j = 0; j < dim; ++j) {
-        expanded[j] = centroid[j] + 2.0 * (reflected[j] - centroid[j]);
-      }
-      clamp_vertex_bounded(expanded.data(), dim, bounds.data());
-      const double f_expanded = evaluate(expanded.data(), dim, smooth_dim, y, m);
-      if (f_expanded < f_reflected) {
-        simplex[worst] = expanded;
-        fvals[worst] = f_expanded;
-      } else {
-        simplex[worst] = reflected;
-        fvals[worst] = f_reflected;
-      }
-      continue;
-    }
-
-    // Contract.
-    std::vector<double> contracted(dim);
-    if (f_reflected < fvals[worst]) {
-      // Outside contraction.
-      for (std::size_t j = 0; j < dim; ++j) {
-        contracted[j] = centroid[j] + 0.5 * (reflected[j] - centroid[j]);
-      }
-    } else {
-      // Inside contraction.
-      for (std::size_t j = 0; j < dim; ++j) {
-        contracted[j] = centroid[j] + 0.5 * (simplex[worst][j] - centroid[j]);
-      }
-    }
-    clamp_vertex_bounded(contracted.data(), dim, bounds.data());
-    const double f_contracted = evaluate(contracted.data(), dim, smooth_dim, y, m);
-    if (f_contracted < std::min(f_reflected, fvals[worst])) {
-      simplex[worst] = contracted;
-      fvals[worst] = f_contracted;
-      continue;
-    }
-
-    // Shrink toward best.
-    for (std::size_t i = 0; i < k; ++i) {
-      if (i == best)
-        continue;
-      for (std::size_t j = 0; j < dim; ++j) {
-        simplex[i][j] = simplex[best][j] + 0.5 * (simplex[i][j] - simplex[best][j]);
-      }
-      clamp_vertex_bounded(simplex[i].data(), dim, bounds.data());
-      fvals[i] = evaluate(simplex[i].data(), dim, smooth_dim, y, m);
-    }
-  }
-
-  // Return the best vertex.
-  std::size_t best_idx = 0;
-  for (std::size_t i = 1; i < k; ++i) {
-    if (fvals[i] < fvals[best_idx])
-      best_idx = i;
-  }
-  *out_params = simplex[best_idx];
-  return fvals[best_idx];
-}
-
-// Runs the search over the unit cube of dimension `dim` (2 or 3), tuning the
-// smoothing parameters alone. Writes the best (alpha, beta, gamma) into the
-// out-pointers and returns the best SSE.
-double nelder_mead(const std::vector<double>& y, std::uint32_t m, std::size_t dim, double* out_alpha, double* out_beta,
-                   double* out_gamma) {
-  // Initial simplex: (0.2, 0.1, 0.1) plus unit-perturbations of magnitude
-  // 0.1 in each axis. Comfortably inside the bounds.
-  const std::array<double, 3> seed{0.2, 0.1, 0.1};
-  const std::vector<ParamBounds> bounds(dim, ParamBounds{kBoundEps, 1.0 - kBoundEps});
-  std::vector<double> best;
-  const double sse = nelder_mead_search(y, m, dim, /*smooth_dim=*/dim, seed.data(), 0.1, bounds, kMaxNelderMeadIters,
-                                        &objective, &best);
-  unpack_params(best.data(), dim, out_alpha, out_beta, out_gamma);
-  return sse;
-}
-
-// ---------------------------------------------------------------------------
-// Joint (alpha, beta, gamma, L_0, B_0, S_0..S_{m-1}) optimisation
-// ---------------------------------------------------------------------------
-//
-// The 3D `nelder_mead` above only tunes the smoothing parameters at a fixed
-// two-season-means initial state. On strongly cyclic data Mac Excel reaches
-// a much tighter fit by jointly tuning the initial state vector along with
-// the smoothing parameters; the joint optimum can sit in a basin our 3D
-// optimiser cannot reach. The generalised optimiser below packs:
-//
-//   p = [alpha, beta[, gamma], L_0, B_0, S_0, ..., S_{m-1}]
-//
-// where the seasonal block is omitted when `m == 1`. The smoothing block is
-// clamped to (kBoundEps, 1 - kBoundEps); the initial-state block is bounded
-// to a generous data-range envelope so the simplex can move freely without
-// running away to non-finite SSE.
-
-// Computes the per-coordinate bounds used by `nelder_mead_full`. The
-// smoothing-param block (the first `smooth_dim` coordinates) is `(eps,
-// 1 - eps)`; the initial-state block (the remaining `dim - smooth_dim`
-// coordinates) is `[y_min - 5 * range, y_max + 5 * range]` so the simplex
-// has room to escape its starting basin.
-std::vector<ParamBounds> make_full_bounds(const std::vector<double>& y, std::size_t dim, std::size_t smooth_dim) {
-  std::vector<ParamBounds> bounds(dim);
-  for (std::size_t i = 0; i < smooth_dim; ++i) {
-    bounds[i] = ParamBounds{kBoundEps, 1.0 - kBoundEps};
-  }
-  double y_min = y[0];
-  double y_max = y[0];
-  for (double v : y) {
-    if (v < y_min)
-      y_min = v;
-    if (v > y_max)
-      y_max = v;
-  }
-  const double range = std::max(y_max - y_min, 1.0);
-  const double lo = y_min - 5.0 * range;
-  const double hi = y_max + 5.0 * range;
-  for (std::size_t i = smooth_dim; i < dim; ++i) {
-    bounds[i] = ParamBounds{lo, hi};
-  }
-  return bounds;
-}
-
-// SSE objective for the joint optimiser. Reads packed params:
-//   smooth_dim == 2 (m == 1): [alpha, beta, L_0, B_0]
-//   smooth_dim == 3 (m >= 2): [alpha, beta, gamma, L_0, B_0, S_0..S_{m-1}]
-double objective_full(const double* p, std::size_t /*dim*/, std::size_t smooth_dim, const std::vector<double>& y,
-                      std::uint32_t m) {
-  const double alpha = p[0];
-  const double beta = p[1];
-  const double gamma = (smooth_dim == 3U) ? p[2] : 0.0;
-  const double init_level = p[smooth_dim];
-  const double init_trend = p[smooth_dim + 1U];
-  const double* init_season = (m >= 2U) ? &p[smooth_dim + 2U] : nullptr;
-  const double sse = simulate_with_init(y, m, alpha, beta, gamma, init_level, init_trend, init_season, nullptr);
-  return std::isfinite(sse) ? sse : std::numeric_limits<double>::infinity();
-}
-
-// Joint optimisation over the smoothing parameters and the initial state.
-// Only the knobs differ from the smoothing-only search: the simplex is built
-// around the supplied `seed` (length `dim`) instead of the fixed anchor, the
-// bounds are per-coordinate, and the iteration budget grows with `dim` — a 9D
-// landscape needs ~2-3x more iterations than the 3D one to converge through
-// the same number of simplex collapses.
-double nelder_mead_full(const std::vector<double>& y, std::uint32_t m, std::size_t dim, std::size_t smooth_dim,
-                        const double* seed, double seed_step, const std::vector<ParamBounds>& bounds,
-                        std::vector<double>* out_params) {
-  const int iter_cap = static_cast<int>(static_cast<std::size_t>(kMaxNelderMeadIters) * std::max<std::size_t>(1U, dim));
-  return nelder_mead_search(y, m, dim, smooth_dim, seed, seed_step, bounds, iter_cap, &objective_full, out_params);
-}
-
-// ---------------------------------------------------------------------------
-// Fit + diagnostics on a resampled, deduplicated, evenly spaced series
-// ---------------------------------------------------------------------------
-
-// Fits a Holt-Winters model to `y` with the given seasonality `m`. On
-// success populates `*out` (parameters, final state, residuals, MAE,
-// RMSE, MASE, SMAPE) and returns `true`. Writes `*out_err` and returns
-// `false` on degenerate inputs (n < 2, or seasonal m with n < 2*m).
-bool fit_holt_winters(const std::vector<double>& y, std::uint32_t m, HoltWintersFit* out, Value* out_err) {
-  const std::size_t n = y.size();
-  if (n < 2U) {
-    *out_err = Value::error(ErrorCode::NA);
-    return false;
-  }
-  if (m >= 2U && n < 2U * static_cast<std::size_t>(m)) {
-    *out_err = Value::error(ErrorCode::NA);
-    return false;
-  }
-  const std::size_t smooth_dim = (m >= 2U) ? 3U : 2U;
-  double alpha = 0.0;
-  double beta = 0.0;
-  double gamma = 0.0;
-
-  // Stage 1: tune (alpha, beta[, gamma]) at the textbook two-season-means
-  // initialisation. This is the conservative path that has shipped since
-  // FORECAST.ETS landed; on most series it sits at or near the global
-  // optimum and is cheap to compute.
-  const double sse_basic = nelder_mead(y, m, smooth_dim, &alpha, &beta, &gamma);
-
-  // Stage 2: jointly tune the smoothing parameters and the initial state
-  // (L_0, B_0, S_0..S_{m-1}). The 3D optimum can sit in a basin that the
-  // smooth-only stage cannot reach because the initial state is fixed; on
-  // strongly cyclic data this stage finds the basin Mac Excel converges
-  // to. Multi-start over a small seed grid widens basin coverage further.
-  double init_level = 0.0;
-  double init_trend = 0.0;
-  std::vector<double> init_season;
-  compute_default_init(y, m, &init_level, &init_trend, &init_season);
-  const std::size_t full_dim = smooth_dim + 2U + ((m >= 2U) ? static_cast<std::size_t>(m) : 0U);
-  const std::vector<ParamBounds> full_bounds = make_full_bounds(y, full_dim, smooth_dim);
-
-  // Seed grid. Each entry supplies a (alpha, beta[, gamma]) anchor; the
-  // initial-state block is always seeded from the textbook default so the
-  // simplex can move it as needed. Seeds cover low/mid/high alpha to
-  // hedge against multimodal SSE landscapes.
-  static constexpr double kSmoothSeeds[][3] = {
-      {0.2, 0.1, 0.1},
-      {0.5, 0.1, 0.1},
-      {0.8, 0.05, 0.1},
-      {0.5, 0.5, 0.5},
-  };
-  double sse_full = std::numeric_limits<double>::infinity();
-  std::vector<double> full_params;
-  for (const auto& smooth_seed : kSmoothSeeds) {
-    std::vector<double> seed(full_dim, 0.0);
-    seed[0] = smooth_seed[0];
-    seed[1] = smooth_seed[1];
-    if (smooth_dim == 3U)
-      seed[2] = smooth_seed[2];
-    seed[smooth_dim] = init_level;
-    seed[smooth_dim + 1U] = init_trend;
-    if (m >= 2U) {
-      for (std::uint32_t i = 0; i < m; ++i) {
-        seed[smooth_dim + 2U + i] = init_season[i];
-      }
-    }
-    std::vector<double> params;
-    const double sse = nelder_mead_full(y, m, full_dim, smooth_dim, seed.data(),
-                                        /*seed_step=*/0.1, full_bounds, &params);
-    if (sse < sse_full) {
-      sse_full = sse;
-      full_params = std::move(params);
-    }
-  }
-
-  // Pick the better fit. The two stages share an objective (SSE on the
-  // same series), so a direct comparison is sound. On weakly-structured
-  // data the two-stage paths agree to numerical noise; on strongly-cyclic
-  // data the joint fit is materially better.
-  if (sse_full + 1e-9 < sse_basic && std::isfinite(sse_full)) {
-    alpha = full_params[0];
-    beta = full_params[1];
-    gamma = (smooth_dim == 3U) ? full_params[2] : 0.0;
-    init_level = full_params[smooth_dim];
-    init_trend = full_params[smooth_dim + 1U];
-    if (m >= 2U) {
-      for (std::uint32_t i = 0; i < m; ++i) {
-        init_season[i] = full_params[smooth_dim + 2U + i];
-      }
-    }
-    (void)simulate_with_init(y, m, alpha, beta, gamma, init_level, init_trend,
-                             init_season.empty() ? nullptr : init_season.data(), out);
-  } else {
-    // Re-run simulation at the fitted parameters to populate residuals
-    // and final state.
-    (void)simulate(y, m, alpha, beta, gamma, out);
-  }
-
-  // Diagnostic statistics. `start` = first index that has a forecast.
-  const std::size_t start = (m == 1U) ? 1U : static_cast<std::size_t>(m);
-  if (start >= n) {
-    *out_err = Value::error(ErrorCode::NA);
-    return false;
-  }
-  const std::size_t k = n - start;
-  double sum_abs_err = 0.0;
-  double sum_sq_err = 0.0;
-  double smape_num = 0.0;
-  std::size_t smape_n = 0U;
-  for (std::size_t t = start; t < n; ++t) {
-    const double err = out->residuals[t];
-    sum_abs_err += std::fabs(err);
-    sum_sq_err += err * err;
-    const double y_hat = y[t] - err;
-    const double denom = std::fabs(y[t]) + std::fabs(y_hat);
-    if (denom > 0.0) {
-      // SMAPE in the symmetric form: |F - y| / ((|F| + |y|) / 2).
-      smape_num += std::fabs(err) / (denom * 0.5);
-      ++smape_n;
-    }
-  }
-  out->mae = sum_abs_err / static_cast<double>(k);
-  out->rmse = std::sqrt(sum_sq_err / static_cast<double>(k));
-  out->smape = (smape_n > 0U) ? (smape_num / static_cast<double>(smape_n)) : 0.0;
-
-  // MASE: mean absolute error / mean absolute first-difference of the
-  // training series.
-  double sum_diff = 0.0;
-  for (std::size_t i = 1; i < n; ++i) {
-    sum_diff += std::fabs(y[i] - y[i - 1U]);
-  }
-  if (sum_diff > 0.0) {
-    const double scale = sum_diff / static_cast<double>(n - 1U);
-    out->mase = out->mae / scale;
-  } else {
-    out->mase = 0.0;
-  }
-  return true;
-}
-
 // ---------------------------------------------------------------------------
 // Front-end: shared input preprocessing
 // ---------------------------------------------------------------------------
 
-// Reads an optional scalar argument as a non-negative integer (truncated
-// toward zero). Blank yields `default_value`. Errors propagate. Out-of-
-// domain (negative, non-finite, fractional outside the trunc rule) is
-// flagged via `*out_err` with the supplied error code.
-bool read_int_arg(const parser::AstNode& node, Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx,
-                  std::int64_t default_value, std::int64_t* out, Value* out_err, ErrorCode oo_domain) {
+// Reads an optional scalar number argument. Blank yields `default_value`;
+// errors propagate.
+bool read_double_arg(const parser::AstNode& node, Arena& arena, const FunctionRegistry& registry,
+                     const EvalContext& ctx, double default_value, double* out, Value* out_err) {
   const Value v = eval_node(node, arena, registry, ctx);
   if (v.is_error()) {
     *out_err = v;
@@ -1029,7 +133,19 @@ bool read_int_arg(const parser::AstNode& node, Arena& arena, const FunctionRegis
     *out_err = Value::error(coerced.error());
     return false;
   }
-  const double d = coerced.value();
+  *out = coerced.value();
+  return true;
+}
+
+// Reads an optional scalar argument as a non-negative integer (truncated
+// toward zero). Same semantics as `read_double_arg`; a non-finite value is
+// flagged via `*out_err` with the supplied error code.
+bool read_int_arg(const parser::AstNode& node, Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx,
+                  std::int64_t default_value, std::int64_t* out, Value* out_err, ErrorCode oo_domain) {
+  double d = 0.0;
+  if (!read_double_arg(node, arena, registry, ctx, static_cast<double>(default_value), &d, out_err)) {
+    return false;
+  }
   if (!std::isfinite(d)) {
     *out_err = Value::error(oo_domain);
     return false;
@@ -1048,28 +164,6 @@ bool read_optional_int_arg(const parser::AstNode* node, Arena& arena, const Func
   return read_int_arg(*node, arena, registry, ctx, default_value, out, out_err, domain_error);
 }
 
-// Reads an optional scalar number argument. Same semantics as
-// `read_int_arg` minus the truncation step.
-bool read_double_arg(const parser::AstNode& node, Arena& arena, const FunctionRegistry& registry,
-                     const EvalContext& ctx, double default_value, double* out, Value* out_err) {
-  const Value v = eval_node(node, arena, registry, ctx);
-  if (v.is_error()) {
-    *out_err = v;
-    return false;
-  }
-  if (v.is_blank()) {
-    *out = default_value;
-    return true;
-  }
-  auto coerced = coerce_to_number(v);
-  if (!coerced) {
-    *out_err = Value::error(coerced.error());
-    return false;
-  }
-  *out = coerced.value();
-  return true;
-}
-
 bool read_required_finite_number(const parser::AstNode& node, Arena& arena, const FunctionRegistry& registry,
                                  const EvalContext& ctx, double* out, Value* out_err, ErrorCode non_finite_error) {
   const Value v = eval_node(node, arena, registry, ctx);
diff --git a/src/eval/forecast_ets_lazy.h b/src/eval/forecast_ets_lazy.h
index b3087d0d0..11c06b00a 100644
--- a/src/eval/forecast_ets_lazy.h
+++ b/src/eval/forecast_ets_lazy.h
@@ -20,9 +20,9 @@
 // `eval/lazy_impls.h` for the shared `LazyImpl` signature and the
 // `eval_node` recursion entry point.
 //
-// The implementation lives in a single TU (`forecast_ets_lazy.cpp`)
-// because the four impls share a substantial helper surface
-// (preprocessing, fit, ACF) that we deliberately keep in-TU.
+// `forecast_ets_lazy.cpp` holds argument reading, preprocessing and the four
+// impls; series preparation lives in `ets_series.cpp` and the smoothing fit
+// in `holt_winters.cpp`.
 
 #ifndef FORMULON_EVAL_FORECAST_ETS_LAZY_H_
 #define FORMULON_EVAL_FORECAST_ETS_LAZY_H_
diff --git a/src/eval/getpivotdata_lazy.cpp b/src/eval/getpivotdata_lazy.cpp
index f10704c03..d6be6b50f 100644
--- a/src/eval/getpivotdata_lazy.cpp
+++ b/src/eval/getpivotdata_lazy.cpp
@@ -24,11 +24,13 @@
 //          `custom_name` (or `source_name`) -- case-sensitive, matching
 //          Mac Excel's GETPIVOTDATA exact-match contract.
 //        * Determine whether the field is on the row axis or the col
-//          axis; record the pair as a (depth, item_text) entry on the
-//          appropriate axis.
+//          axis; retain both the original typed item and its coerced label
+//          as a (depth, item) entry on the appropriate axis.
 //        * Walk the row hierarchy depth-first to find the leaf whose
-//          ancestors match every recorded row-axis pair (in the order
-//          declared by `row_field_order`). Same for the col hierarchy.
+//          ancestors match every recorded row-axis pair by typed identity
+//          first, then by a unique display label (in the order declared by
+//          `row_field_order`). Same for the col hierarchy; ambiguous labels
+//          return `#REF!`.
 //        * An axis is addressed all-or-nothing. Naming some of an
 //          axis's fields but not all of them is a partial path and
 //          surfaces `#REF!` -- the design corpus (§15.1.4) keeps this
@@ -52,6 +54,7 @@
 #include <cstddef>
 #include <cstdint>
 #include <memory>
+#include <optional>
 #include <string>
 #include <string_view>
 #include <utility>
@@ -62,6 +65,7 @@
 #include "eval/lazy_impls.h"
 #include "parser/ast.h"
 #include "parser/reference.h"
+#include "pivot/field_lookup.h"
 #include "pivot/pivot_cache.h"
 #include "pivot/pivot_evaluator.h"
 #include "pivot/pivot_index.h"
@@ -103,24 +107,6 @@ const parser::Reference* anchor_ref_of(const parser::AstNode& node) noexcept {
   return &cur->as_ref();
 }
 
-// Locates `name` in `fields` by `custom_name` (preferred when non-empty,
-// matching the OOXML reader's behaviour) or `source_name`. Returns the
-// 0-based index, or `static_cast<std::size_t>(-1)` when no field
-// matches. Comparison is case-sensitive: Mac's GETPIVOTDATA requires an
-// exact text match, including whitespace.
-std::size_t find_field_index(const std::vector<pivot::PivotField>& fields, std::string_view name) noexcept {
-  for (std::size_t i = 0; i < fields.size(); ++i) {
-    const pivot::PivotField& f = fields[i];
-    if (!f.custom_name.empty() && f.custom_name == name) {
-      return i;
-    }
-    if (f.source_name == name) {
-      return i;
-    }
-  }
-  return static_cast<std::size_t>(-1);
-}
-
 // Locates `name` in `data_fields`, by display name first and then by the
 // name of the source field the entry aggregates. Returns the 0-based
 // index, or `static_cast<std::size_t>(-1)` when no data field matches.
@@ -164,69 +150,96 @@ std::size_t depth_in_axis(const std::vector<std::uint32_t>& axis_order, std::siz
   return static_cast<std::size_t>(-1);
 }
 
-// Walks an axis hierarchy tree following `path`. Each `path[i]` is the
-// label expected at depth `i`. Returns the leaf index assigned to the
-// matching leaf, or `static_cast<std::size_t>(-1)` on any mismatch.
+struct LookupItem {
+  Value value;
+  std::string label;
+};
+
+std::size_t axis_leaf_count(const pivot::AxisHierarchyNode& node) noexcept {
+  std::size_t count = 0;
+  std::vector<const pivot::AxisHierarchyNode*> stack{&node};
+  while (!stack.empty()) {
+    const pivot::AxisHierarchyNode* current = stack.back();
+    stack.pop_back();
+    if (current->children.empty()) {
+      ++count;
+      continue;
+    }
+    for (const pivot::AxisHierarchyNode& child : current->children) {
+      stack.push_back(&child);
+    }
+  }
+  return count;
+}
+
+// Walks an axis hierarchy tree following `path`. Each `path[i]` retains the
+// original typed item and its display label. Typed identity is tried first;
+// a label is a fallback only when it identifies one child uniquely. Returns
+// the leaf index assigned to the matching leaf, or
+// `static_cast<std::size_t>(-1)` on any mismatch or ambiguity.
 //
 // The leaf index is computed by counting leaves in document order,
 // matching the dense indexing used by `pivot::evaluate` in
 // `finalize_hierarchy`.
 std::size_t walk_hierarchy(const std::vector<pivot::AxisHierarchyNode>& roots,
-                           const std::vector<std::string>& path) noexcept {
+                           const std::vector<LookupItem>& path) noexcept {
   if (path.empty() || roots.empty()) {
     return static_cast<std::size_t>(-1);
   }
   std::size_t leaf_index = 0;
   const std::vector<pivot::AxisHierarchyNode>* level = &roots;
   for (std::size_t depth = 0; depth < path.size(); ++depth) {
-    const std::string& want = path[depth];
-    bool matched = false;
+    const LookupItem& want = path[depth];
+    const pivot::AxisHierarchyNode* typed_match = nullptr;
+    std::size_t typed_matches = 0;
+    const pivot::AxisHierarchyNode* label_match = nullptr;
+    std::size_t label_matches = 0;
     for (const pivot::AxisHierarchyNode& node : *level) {
-      if (node.label == want) {
-        // Descend.
-        if (depth + 1 == path.size()) {
-          // Leaf level: this node must be a leaf for the path to be
-          // valid. A non-leaf at the final position means the caller
-          // gave a partial address at this axis, which the MVP refuses.
-          if (!node.children.empty()) {
-            return static_cast<std::size_t>(-1);
-          }
-          return leaf_index;
-        }
-        if (node.children.empty()) {
-          // Path expects to descend further, but we're already at a
-          // leaf -- the caller asked for a deeper item than the pivot
-          // exposes.
-          return static_cast<std::size_t>(-1);
-        }
-        level = &node.children;
-        matched = true;
+      if (node.identity.has_value() && *node.identity == want.value) {
+        ++typed_matches;
+        typed_match = &node;
+      }
+      if (node.label == want.label) {
+        ++label_matches;
+        label_match = &node;
+      }
+    }
+
+    const pivot::AxisHierarchyNode* matched = nullptr;
+    if (typed_matches != 0U) {
+      if (typed_matches != 1U) {
+        return static_cast<std::size_t>(-1);
+      }
+      matched = typed_match;
+    } else {
+      if (label_matches != 1U) {
+        return static_cast<std::size_t>(-1);
+      }
+      matched = label_match;
+    }
+
+    // Count only siblings before the selected node. Descending into the
+    // selected subtree preserves its prefix and avoids repeatedly traversing
+    // that subtree at every deeper level.
+    for (const pivot::AxisHierarchyNode& node : *level) {
+      if (&node == matched) {
         break;
       }
-      // Non-matching subtree: skip its leaf count so the leaf_index
-      // counter stays aligned with `pivot::evaluate`'s dense ordering.
-      if (node.children.empty()) {
-        ++leaf_index;
-      } else {
-        // Count all leaves in this subtree.
-        std::vector<const pivot::AxisHierarchyNode*> stack;
-        stack.push_back(&node);
-        while (!stack.empty()) {
-          const pivot::AxisHierarchyNode* top = stack.back();
-          stack.pop_back();
-          if (top->children.empty()) {
-            ++leaf_index;
-          } else {
-            for (const pivot::AxisHierarchyNode& c : top->children) {
-              stack.push_back(&c);
-            }
-          }
-        }
+      leaf_index += axis_leaf_count(node);
+    }
+
+    if (depth + 1 == path.size()) {
+      // Leaf level: this node must be a leaf for the path to be valid.
+      if (!matched->children.empty()) {
+        return static_cast<std::size_t>(-1);
       }
+      return leaf_index;
     }
-    if (!matched) {
+    if (matched->children.empty()) {
+      // Path expects to descend further, but we're already at a leaf.
       return static_cast<std::size_t>(-1);
     }
+    level = &matched->children;
   }
   return static_cast<std::size_t>(-1);
 }
@@ -336,11 +349,11 @@ Value eval_getpivotdata_lazy(const parser::AstNode& call, Arena& arena, const Fu
   // axis. Each pair is keyed by the field's depth on its axis so we
   // can sort them into row_field_order / col_field_order order.
   const std::size_t pair_count = (arity - 2U) / 2U;
-  // Initialise paths to empty strings; fill the depths we receive and
-  // refuse the lookup later if any depth is left blank (partial path).
-  std::vector<std::string> row_path(table->row_field_order().size());
+  // Retain both the original typed item and its display label. Paths are
+  // filled by axis depth and rejected later if any depth is left unset.
+  std::vector<std::optional<LookupItem>> row_path(table->row_field_order().size());
   std::vector<bool> row_path_set(table->row_field_order().size(), false);
-  std::vector<std::string> col_path(table->col_field_order().size());
+  std::vector<std::optional<LookupItem>> col_path(table->col_field_order().size());
   std::vector<bool> col_path_set(table->col_field_order().size(), false);
 
   for (std::size_t p = 0; p < pair_count; ++p) {
@@ -365,24 +378,25 @@ Value eval_getpivotdata_lazy(const parser::AstNode& call, Arena& arena, const Fu
       return Value::error(kPivotRefError);
     }
 
-    const std::size_t fi = find_field_index(table->fields(), field_text.value());
-    if (fi == static_cast<std::size_t>(-1)) {
+    const std::optional<std::size_t> fi = pivot::find_unique_field_by_name(*table, field_text.value());
+    if (!fi.has_value()) {
       return Value::error(kPivotRefError);
     }
-    const std::size_t row_depth = depth_in_axis(table->row_field_order(), fi);
-    const std::size_t col_depth = depth_in_axis(table->col_field_order(), fi);
+    const std::size_t row_depth = depth_in_axis(table->row_field_order(), *fi);
+    const std::size_t col_depth = depth_in_axis(table->col_field_order(), *fi);
+    LookupItem lookup_item{iv, std::move(item_text.value())};
     if (row_depth != static_cast<std::size_t>(-1)) {
       if (row_path_set[row_depth]) {
         // Caller addressed the same field twice: ambiguous, refuse.
         return Value::error(kPivotRefError);
       }
-      row_path[row_depth] = std::move(item_text.value());
+      row_path[row_depth] = std::move(lookup_item);
       row_path_set[row_depth] = true;
     } else if (col_depth != static_cast<std::size_t>(-1)) {
       if (col_path_set[col_depth]) {
         return Value::error(kPivotRefError);
       }
-      col_path[col_depth] = std::move(item_text.value());
+      col_path[col_depth] = std::move(lookup_item);
       col_path_set[col_depth] = true;
     } else {
       // Field is on neither row nor col axis (or doesn't exist).
@@ -452,14 +466,24 @@ Value eval_getpivotdata_lazy(const parser::AstNode& call, Arena& arena, const Fu
 
   std::size_t row_leaf = 0;
   if (row_complete) {
-    row_leaf = walk_hierarchy(pivot_result.rows, row_path);
+    std::vector<LookupItem> resolved_row_path;
+    resolved_row_path.reserve(row_path.size());
+    for (const std::optional<LookupItem>& item : row_path) {
+      resolved_row_path.push_back(*item);
+    }
+    row_leaf = walk_hierarchy(pivot_result.rows, resolved_row_path);
     if (row_leaf == static_cast<std::size_t>(-1)) {
       return Value::error(kPivotRefError);
     }
   }
   std::size_t col_leaf = 0;
   if (col_complete) {
-    col_leaf = walk_hierarchy(pivot_result.cols, col_path);
+    std::vector<LookupItem> resolved_col_path;
+    resolved_col_path.reserve(col_path.size());
+    for (const std::optional<LookupItem>& item : col_path) {
+      resolved_col_path.push_back(*item);
+    }
+    col_leaf = walk_hierarchy(pivot_result.cols, resolved_col_path);
     if (col_leaf == static_cast<std::size_t>(-1)) {
       return Value::error(kPivotRefError);
     }
diff --git a/src/eval/getpivotdata_lazy.h b/src/eval/getpivotdata_lazy.h
index 16c4773e0..4473dc8f3 100644
--- a/src/eval/getpivotdata_lazy.h
+++ b/src/eval/getpivotdata_lazy.h
@@ -39,13 +39,14 @@ class FunctionRegistry;
 
 /// `GETPIVOTDATA(data_field, pivot_anchor, [field1, item1, ...])` --
 /// returns the value of a single pivot cell. `data_field` and the
-/// optional field/item arguments are evaluated eagerly and coerced to
-/// text; `pivot_anchor` is required to be a single cell `Ref` or a
-/// `RangeOp` (whose top-left cell is used as the anchor). Any other AST
-/// shape, an unknown data field, an unknown item, an arity mismatch
-/// (no anchor, or odd field/item count), or an anchor not contained in
-/// any pivot table on the workbook surfaces `#REF!`. Errors in any
-/// argument propagate.
+/// field-name arguments are evaluated eagerly and coerced to text; item
+/// arguments retain their original Value kind for exact typed matching,
+/// with display text used as a unique fallback. `pivot_anchor` is required
+/// to be a single cell `Ref` or a `RangeOp` (whose top-left cell is used as
+/// the anchor). Any other AST shape, an unknown data field, an unknown item,
+/// an arity mismatch (no anchor, or odd field/item count), or an anchor not
+/// contained in any pivot table on the workbook surfaces `#REF!`. Errors in
+/// any argument propagate.
 Value eval_getpivotdata_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                              const EvalContext& ctx);
 
diff --git a/src/eval/groupby_pivotby/common.cpp b/src/eval/groupby_pivotby/common.cpp
index 4a9093a2c..cf2c8fb9a 100644
--- a/src/eval/groupby_pivotby/common.cpp
+++ b/src/eval/groupby_pivotby/common.cpp
@@ -7,6 +7,7 @@
 #include <cstring>
 #include <string>
 #include <string_view>
+#include <unordered_map>
 #include <utility>
 #include <vector>
 
@@ -34,30 +35,6 @@ namespace eval {
 
 namespace {
 
-// Builds a synthetic `ArrayLiteral` AST mirroring `arr`. This lets a Lambda
-// body that expects a range-shaped argument (`SUM(v)`, `AVERAGE(v)`, ...)
-// see the slice through the dispatcher's existing ArrayLiteral branch
-// rather than as an opaque `Value::Array`. Mirrors the helper in
-// `lambda_helpers_lazy.cpp`.
-const parser::AstNode* build_array_literal_for_slice(const ArrayValue* arr, Arena& arena) {
-  if (arr == nullptr || arr->rows == 0U || arr->cols == 0U) {
-    return nullptr;
-  }
-  const std::size_t total = static_cast<std::size_t>(arr->rows) * static_cast<std::size_t>(arr->cols);
-  const parser::AstNode** children = arena.create_array<const parser::AstNode*>(total);
-  if (children == nullptr) {
-    return nullptr;
-  }
-  for (std::size_t i = 0; i < total; ++i) {
-    parser::AstNode* lit = parser::make_literal(arena, arr->cells[i]);
-    if (lit == nullptr) {
-      return nullptr;
-    }
-    children[i] = lit;
-  }
-  return parser::make_array_literal(arena, arr->rows, arr->cols, children);
-}
-
 // Number of arguments an aggregator receives per group: the group's value
 // slice, and nothing else.
 constexpr std::uint32_t kAggregatorCallArity = 1U;
@@ -366,6 +343,24 @@ bool row_key_is_error(const ArrayValue& keys, std::uint32_t row) {
   return false;
 }
 
+std::size_t find_or_add_group(const ArrayValue& keys, std::uint32_t row,
+                              std::vector<std::uint32_t>* representative_rows,
+                              std::vector<std::vector<std::uint32_t>>* member_rows, std::vector<bool>* is_error_group,
+                              std::unordered_map<std::string, std::size_t>* index) {
+  const std::string key = normalized_group_key(keys, row);
+  const auto existing = index->find(key);
+  if (existing != index->end()) {
+    (*member_rows)[existing->second].push_back(row);
+    return existing->second;
+  }
+  const std::size_t group = representative_rows->size();
+  index->emplace(key, group);
+  representative_rows->push_back(row);
+  member_rows->push_back(std::vector<std::uint32_t>{row});
+  is_error_group->push_back(row_key_is_error(keys, row));
+  return group;
+}
+
 const ArrayValue* build_group_slice(const ArrayValue& values, std::uint32_t value_col,
                                     const std::vector<std::uint32_t>& row_indices, Arena& arena) {
   const std::uint32_t n = static_cast<std::uint32_t>(row_indices.size());
@@ -385,7 +380,7 @@ const ArrayValue* build_group_slice(const ArrayValue& values, std::uint32_t valu
 
 Value invoke_aggregator_for_group(const LambdaValue* agg, const ArrayValue* slice, Arena& arena,
                                   const FunctionRegistry& registry, const EvalContext& ctx) {
-  const parser::AstNode* slice_ast = build_array_literal_for_slice(slice, arena);
+  const parser::AstNode* slice_ast = array_literal_ast(slice, arena);
   if (slice_ast == nullptr) {
     return Value::error(ErrorCode::Num);
   }
diff --git a/src/eval/groupby_pivotby/common.h b/src/eval/groupby_pivotby/common.h
index 24c26206f..08cfaf6c5 100644
--- a/src/eval/groupby_pivotby/common.h
+++ b/src/eval/groupby_pivotby/common.h
@@ -11,7 +11,7 @@
 // equality, slice construction, aggregator invocation, output assembly and
 // sort tie-breaking. Each .cpp owns its public `eval_<fn>_lazy` entry point
 // and any helper that is specific to that surface (e.g. PIVOTBY's
-// `find_or_add_group`).
+// `order_axis_groups`).
 //
 // See `eval/lazy_impls.h` for the shared `LazyImpl` signature and the
 // `eval_node` recursion entry point.
@@ -24,6 +24,7 @@
 #include <cstdint>
 #include <string>
 #include <string_view>
+#include <unordered_map>
 #include <vector>
 
 #include "eval/function_registry.h"
@@ -152,6 +153,14 @@ std::string normalized_group_key(const ArrayValue& keys, std::uint32_t row);
 /// groups sort to the bottom (after all valid groups).
 bool row_key_is_error(const ArrayValue& keys, std::uint32_t row);
 
+/// Maps `row`'s group key to its group index, appending a new group (its
+/// representative row, member list and error flag) on first occurrence so
+/// groups keep first-occurrence order.
+std::size_t find_or_add_group(const ArrayValue& keys, std::uint32_t row,
+                              std::vector<std::uint32_t>* representative_rows,
+                              std::vector<std::vector<std::uint32_t>>* member_rows, std::vector<bool>* is_error_group,
+                              std::unordered_map<std::string, std::size_t>* index);
+
 /// Builds a 1-column array containing one cell per row in `row_indices` from
 /// `values`'s `value_col`-th column. Used to construct the per-group slice
 /// passed to the aggregator.
diff --git a/src/eval/groupby_pivotby/groupby.cpp b/src/eval/groupby_pivotby/groupby.cpp
index 699b0d938..8dc122230 100644
--- a/src/eval/groupby_pivotby/groupby.cpp
+++ b/src/eval/groupby_pivotby/groupby.cpp
@@ -115,18 +115,7 @@ Value eval_groupby_lazy(const parser::AstNode& call, Arena& arena, const Functio
     if (!include_row[i]) {
       continue;
     }
-    const std::uint32_t row = data_start_row + i;
-    const std::string key = normalized_group_key(*row_fields, row);
-    const auto existing = group_index.find(key);
-    if (existing != group_index.end()) {
-      group_rows[existing->second].push_back(row);
-    } else {
-      const std::size_t group = group_repr.size();
-      group_index.emplace(key, group);
-      group_repr.push_back(row);
-      group_rows.push_back(std::vector<std::uint32_t>{row});
-      group_is_error.push_back(row_key_is_error(*row_fields, row));
-    }
+    find_or_add_group(*row_fields, data_start_row + i, &group_repr, &group_rows, &group_is_error, &group_index);
   }
 
   if (group_repr.empty()) {
diff --git a/src/eval/groupby_pivotby/pivotby.cpp b/src/eval/groupby_pivotby/pivotby.cpp
index 69aed5301..6d2d613b4 100644
--- a/src/eval/groupby_pivotby/pivotby.cpp
+++ b/src/eval/groupby_pivotby/pivotby.cpp
@@ -31,33 +31,6 @@ struct ColSlot {
   std::size_t outer_group = 0;
 };
 
-// Maps a single row's group key to its group index, appending a new group on
-// first occurrence. `keys` is the source key array (row_fields or
-// col_fields); `row` is the absolute row index. Returns the group index.
-//
-// A composite copy of `representative_rows` is kept so callers can later
-// pull the canonical key cells via `keys.cells[representative_rows[g] *
-// keys.cols + c]`. Mirrors the inline group-build loop in
-// `eval_groupby_lazy`; factored here so both the row and column axes share
-// the same first-occurrence semantics.
-std::size_t find_or_add_group(const ArrayValue& keys, std::uint32_t row,
-                              std::vector<std::uint32_t>* representative_rows,
-                              std::vector<std::vector<std::uint32_t>>* member_rows, std::vector<bool>* is_error_group,
-                              std::unordered_map<std::string, std::size_t>* index) {
-  const std::string key = normalized_group_key(keys, row);
-  const auto existing = index->find(key);
-  if (existing != index->end()) {
-    (*member_rows)[existing->second].push_back(row);
-    return existing->second;
-  }
-  const std::size_t group = representative_rows->size();
-  index->emplace(key, group);
-  representative_rows->push_back(row);
-  member_rows->push_back(std::vector<std::uint32_t>{row});
-  is_error_group->push_back(row_key_is_error(keys, row));
-  return group;
-}
-
 // Orders one axis's groups into `*out_order`. Error-keyed groups sink to the
 // bottom; sort_order=0 otherwise keeps first-occurrence order, and ±1 sorts
 // by the first value column's axis total (aggregated on the fly when
diff --git a/src/eval/holt_winters.cpp b/src/eval/holt_winters.cpp
new file mode 100644
index 000000000..84682b4fe
--- /dev/null
+++ b/src/eval/holt_winters.cpp
@@ -0,0 +1,554 @@
+//
+// Holt-Winters fit for the FORECAST.ETS family; the contract is declared in
+// `eval/holt_winters.h`.
+
+#include "eval/holt_winters.h"
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <utility>
+#include <vector>
+
+#include "utils/error.h"
+#include "utils/index_sort.h"
+#include "value.h"
+
+namespace formulon {
+namespace eval {
+namespace ets {
+namespace {
+
+// Nelder-Mead bounds clamp -- coordinates are squeezed into
+// (kBoundEps, 1 - kBoundEps) so the gradient never escapes the unit
+// cube and the smoothing recurrences stay well-defined.
+constexpr double kBoundEps = 1e-6;
+
+// Nelder-Mead convergence: stop when (fmax - fmin) over the simplex falls
+// below this, or when iteration count exceeds kMaxNelderMeadIters.
+constexpr double kNelderMeadFTol = 1e-9;
+constexpr int kMaxNelderMeadIters = 200;
+
+// Runs the Holt-Winters smoothing recurrences over `y` with explicit
+// initial state (`init_level`, `init_trend`, `init_season[0..m-1]`),
+// populates `*out` (level / trend / season / residuals), and returns the
+// in-sample SSE used by the optimiser.
+//
+// Recurrences (additive seasonality):
+//   L_t = alpha (y_t - S_{t-m}) + (1-alpha)(L_{t-1} + B_{t-1})
+//   B_t = beta  (L_t - L_{t-1}) + (1-beta)  B_{t-1}
+//   S_t = gamma (y_t - L_t)     + (1-gamma) S_{t-m}
+// Forecast residual at step t is `y_t - (L_{t-1} + B_{t-1} + S_{t-m})`.
+//
+// `init_season` may be null when `m == 1`.
+double simulate_with_init(const std::vector<double>& y, std::uint32_t m, double alpha, double beta, double gamma,
+                          double init_level, double init_trend, const double* init_season, HoltWintersFit* out) {
+  const std::size_t n = y.size();
+  double level = init_level;
+  double trend = init_trend;
+  std::vector<double> season(m == 1U ? 0U : static_cast<std::size_t>(m), 0.0);
+  if (m != 1U && init_season != nullptr) {
+    for (std::uint32_t i = 0; i < m; ++i) {
+      season[i] = init_season[i];
+    }
+  }
+
+  std::vector<double> residuals(n, 0.0);
+  double sse = 0.0;
+  // The first `start` indices have no one-step-ahead forecast (no prior
+  // level / trend / seasonal estimate is available beneath them).
+  const std::size_t start = (m == 1U) ? 1U : static_cast<std::size_t>(m);
+  for (std::size_t t = start; t < n; ++t) {
+    const double prev_level = level;
+    const double prev_trend = trend;
+    const double s_prev = (m == 1U) ? 0.0 : season[t % m];
+    const double y_hat = prev_level + prev_trend + s_prev;
+    const double err = y[t] - y_hat;
+    residuals[t] = err;
+    sse += err * err;
+    // Update equations.
+    level = alpha * (y[t] - s_prev) + (1.0 - alpha) * (prev_level + prev_trend);
+    trend = beta * (level - prev_level) + (1.0 - beta) * prev_trend;
+    if (m != 1U) {
+      season[t % m] = gamma * (y[t] - level) + (1.0 - gamma) * s_prev;
+    }
+  }
+
+  if (out != nullptr) {
+    out->alpha = alpha;
+    out->beta = beta;
+    out->gamma = (m == 1U) ? 0.0 : gamma;
+    out->level = level;
+    out->trend = trend;
+    out->season = season;
+    out->m = m;
+    out->residuals = std::move(residuals);
+  }
+  return sse;
+}
+
+// Computes the textbook two-season-means default initial state used as the
+// starting point of the optimiser. With `m == 1` we use Holt's double
+// exponential: L_0 = y_0, B_0 = y_1 - y_0 (no seasonal vector).
+void compute_default_init(const std::vector<double>& y, std::uint32_t m, double* out_level, double* out_trend,
+                          std::vector<double>* out_season) {
+  const std::size_t n = y.size();
+  out_season->assign(m == 1U ? 0U : static_cast<std::size_t>(m), 0.0);
+  if (m == 1U) {
+    *out_level = y[0];
+    *out_trend = (n >= 2U) ? (y[1] - y[0]) : 0.0;
+    return;
+  }
+  double mean1 = 0.0;
+  for (std::uint32_t i = 0; i < m; ++i)
+    mean1 += y[i];
+  mean1 /= static_cast<double>(m);
+  double mean2 = mean1;
+  if (n >= 2U * static_cast<std::size_t>(m)) {
+    mean2 = 0.0;
+    for (std::uint32_t i = 0; i < m; ++i)
+      mean2 += y[m + i];
+    mean2 /= static_cast<double>(m);
+  }
+  *out_level = mean1;
+  *out_trend = (mean2 - mean1) / static_cast<double>(m);
+  double s_sum = 0.0;
+  for (std::uint32_t i = 0; i < m; ++i) {
+    (*out_season)[i] = y[i] - mean1;
+    s_sum += (*out_season)[i];
+  }
+  const double s_mean = s_sum / static_cast<double>(m);
+  for (std::uint32_t i = 0; i < m; ++i)
+    (*out_season)[i] -= s_mean;
+}
+
+// Backwards-compatible wrapper: runs `simulate_with_init` from the textbook
+// two-season-means default initialisation.
+double simulate(const std::vector<double>& y, std::uint32_t m, double alpha, double beta, double gamma,
+                HoltWintersFit* out) {
+  double init_level = 0.0;
+  double init_trend = 0.0;
+  std::vector<double> init_season;
+  compute_default_init(y, m, &init_level, &init_trend, &init_season);
+  return simulate_with_init(y, m, alpha, beta, gamma, init_level, init_trend,
+                            init_season.empty() ? nullptr : init_season.data(), out);
+}
+
+// ---------------------------------------------------------------------------
+// Bounded Nelder-Mead in 2D / 3D
+// ---------------------------------------------------------------------------
+
+struct ParamBounds {
+  double lo;
+  double hi;
+};
+
+// Clamps each coordinate of `v` (length `dim`) into its per-coordinate bound.
+void clamp_vertex_bounded(double* v, std::size_t dim, const ParamBounds* bounds) noexcept {
+  for (std::size_t i = 0; i < dim; ++i) {
+    if (v[i] < bounds[i].lo)
+      v[i] = bounds[i].lo;
+    if (v[i] > bounds[i].hi)
+      v[i] = bounds[i].hi;
+  }
+}
+
+// Expands a packed parameter vector of length `dim` into (alpha, beta, gamma).
+// `dim == 2` => non-seasonal: gamma is forced to 0.
+// `dim == 3` => seasonal: all three are read out.
+void unpack_params(const double* p, std::size_t dim, double* alpha, double* beta, double* gamma) noexcept {
+  *alpha = p[0];
+  *beta = p[1];
+  *gamma = (dim == 3U) ? p[2] : 0.0;
+}
+
+// Objective evaluated by the simplex search. `smooth_dim` is only meaningful
+// to the joint objective; the smoothing-only one ignores it.
+using SimplexObjective = double (*)(const double* params, std::size_t dim, std::size_t smooth_dim,
+                                    const std::vector<double>& y, std::uint32_t m);
+
+// SSE objective for the smoothing-only optimiser. Returns +inf for non-finite
+// SSE (which guides the simplex away from pathological corners).
+double objective(const double* params, std::size_t dim, std::size_t /*smooth_dim*/, const std::vector<double>& y,
+                 std::uint32_t m) {
+  double alpha = 0.0;
+  double beta = 0.0;
+  double gamma = 0.0;
+  unpack_params(params, dim, &alpha, &beta, &gamma);
+  const double sse = simulate(y, m, alpha, beta, gamma, nullptr);
+  if (!std::isfinite(sse)) {
+    return std::numeric_limits<double>::infinity();
+  }
+  return sse;
+}
+
+// Bounded Nelder-Mead over `dim` coordinates, minimising `evaluate`. The
+// starting simplex is `seed` plus one `seed_step` perturbation per axis; every
+// vertex is clamped into `bounds` after each move. Writes the best vertex into
+// `*out_params` and returns its objective value.
+//
+// The simplex coefficients are the canonical (Nelder-Mead 1965) values:
+//   reflect rho = 1, expand chi = 2, contract psi = 0.5, shrink sigma = 0.5.
+double nelder_mead_search(const std::vector<double>& y, std::uint32_t m, std::size_t dim, std::size_t smooth_dim,
+                          const double* seed, double seed_step, const std::vector<ParamBounds>& bounds, int iter_cap,
+                          SimplexObjective evaluate, std::vector<double>* out_params) {
+  const std::size_t k = dim + 1U;
+  std::vector<std::vector<double>> simplex(k, std::vector<double>(dim, 0.0));
+  // Vertex 0: anchor.
+  for (std::size_t j = 0; j < dim; ++j) {
+    simplex[0][j] = seed[j];
+  }
+  // Vertices 1..dim: perturb the i-th axis.
+  for (std::size_t i = 1; i < k; ++i) {
+    for (std::size_t j = 0; j < dim; ++j) {
+      simplex[i][j] = simplex[0][j];
+    }
+    simplex[i][i - 1U] += seed_step;
+  }
+  for (auto& v : simplex) {
+    clamp_vertex_bounded(v.data(), dim, bounds.data());
+  }
+
+  std::vector<double> fvals(k, 0.0);
+  for (std::size_t i = 0; i < k; ++i) {
+    fvals[i] = evaluate(simplex[i].data(), dim, smooth_dim, y, m);
+  }
+
+  for (int iter = 0; iter < iter_cap; ++iter) {
+    // Sort vertices by function value (ascending).
+    std::vector<std::size_t> order(k);
+    for (std::size_t i = 0; i < k; ++i)
+      order[i] = i;
+    std::sort(order.begin(), order.end(),
+              [&fvals](std::size_t a, std::size_t b) noexcept { return fvals[a] < fvals[b]; });
+    const std::size_t best = order[0];
+    const std::size_t worst = order[k - 1U];
+    const std::size_t second_worst = order[k - 2U];
+
+    // Convergence check: span of f-values across the simplex.
+    if (std::isfinite(fvals[best]) && std::isfinite(fvals[worst]) && (fvals[worst] - fvals[best]) < kNelderMeadFTol) {
+      break;
+    }
+
+    // Centroid of the best-`dim` vertices (i.e. all except the worst).
+    std::vector<double> centroid(dim, 0.0);
+    for (std::size_t i = 0; i < k; ++i) {
+      if (i == worst)
+        continue;
+      for (std::size_t j = 0; j < dim; ++j)
+        centroid[j] += simplex[i][j];
+    }
+    for (std::size_t j = 0; j < dim; ++j)
+      centroid[j] /= static_cast<double>(dim);
+
+    // Reflect.
+    std::vector<double> reflected(dim);
+    for (std::size_t j = 0; j < dim; ++j) {
+      reflected[j] = centroid[j] + 1.0 * (centroid[j] - simplex[worst][j]);
+    }
+    clamp_vertex_bounded(reflected.data(), dim, bounds.data());
+    const double f_reflected = evaluate(reflected.data(), dim, smooth_dim, y, m);
+
+    if (f_reflected < fvals[second_worst] && f_reflected >= fvals[best]) {
+      simplex[worst] = reflected;
+      fvals[worst] = f_reflected;
+      continue;
+    }
+
+    if (f_reflected < fvals[best]) {
+      // Expand.
+      std::vector<double> expanded(dim);
+      for (std::size_t j = 0; j < dim; ++j) {
+        expanded[j] = centroid[j] + 2.0 * (reflected[j] - centroid[j]);
+      }
+      clamp_vertex_bounded(expanded.data(), dim, bounds.data());
+      const double f_expanded = evaluate(expanded.data(), dim, smooth_dim, y, m);
+      if (f_expanded < f_reflected) {
+        simplex[worst] = expanded;
+        fvals[worst] = f_expanded;
+      } else {
+        simplex[worst] = reflected;
+        fvals[worst] = f_reflected;
+      }
+      continue;
+    }
+
+    // Contract.
+    std::vector<double> contracted(dim);
+    if (f_reflected < fvals[worst]) {
+      // Outside contraction.
+      for (std::size_t j = 0; j < dim; ++j) {
+        contracted[j] = centroid[j] + 0.5 * (reflected[j] - centroid[j]);
+      }
+    } else {
+      // Inside contraction.
+      for (std::size_t j = 0; j < dim; ++j) {
+        contracted[j] = centroid[j] + 0.5 * (simplex[worst][j] - centroid[j]);
+      }
+    }
+    clamp_vertex_bounded(contracted.data(), dim, bounds.data());
+    const double f_contracted = evaluate(contracted.data(), dim, smooth_dim, y, m);
+    if (f_contracted < std::min(f_reflected, fvals[worst])) {
+      simplex[worst] = contracted;
+      fvals[worst] = f_contracted;
+      continue;
+    }
+
+    // Shrink toward best.
+    for (std::size_t i = 0; i < k; ++i) {
+      if (i == best)
+        continue;
+      for (std::size_t j = 0; j < dim; ++j) {
+        simplex[i][j] = simplex[best][j] + 0.5 * (simplex[i][j] - simplex[best][j]);
+      }
+      clamp_vertex_bounded(simplex[i].data(), dim, bounds.data());
+      fvals[i] = evaluate(simplex[i].data(), dim, smooth_dim, y, m);
+    }
+  }
+
+  // Return the best vertex.
+  std::size_t best_idx = 0;
+  for (std::size_t i = 1; i < k; ++i) {
+    if (fvals[i] < fvals[best_idx])
+      best_idx = i;
+  }
+  *out_params = simplex[best_idx];
+  return fvals[best_idx];
+}
+
+// Runs the search over the unit cube of dimension `dim` (2 or 3), tuning the
+// smoothing parameters alone. Writes the best (alpha, beta, gamma) into the
+// out-pointers and returns the best SSE.
+double nelder_mead(const std::vector<double>& y, std::uint32_t m, std::size_t dim, double* out_alpha, double* out_beta,
+                   double* out_gamma) {
+  // Initial simplex: (0.2, 0.1, 0.1) plus unit-perturbations of magnitude
+  // 0.1 in each axis. Comfortably inside the bounds.
+  const std::array<double, 3> seed{0.2, 0.1, 0.1};
+  const std::vector<ParamBounds> bounds(dim, ParamBounds{kBoundEps, 1.0 - kBoundEps});
+  std::vector<double> best;
+  const double sse = nelder_mead_search(y, m, dim, /*smooth_dim=*/dim, seed.data(), 0.1, bounds, kMaxNelderMeadIters,
+                                        &objective, &best);
+  unpack_params(best.data(), dim, out_alpha, out_beta, out_gamma);
+  return sse;
+}
+
+// ---------------------------------------------------------------------------
+// Joint (alpha, beta, gamma, L_0, B_0, S_0..S_{m-1}) optimisation
+// ---------------------------------------------------------------------------
+//
+// The 3D `nelder_mead` above only tunes the smoothing parameters at a fixed
+// two-season-means initial state. On strongly cyclic data Mac Excel reaches
+// a much tighter fit by jointly tuning the initial state vector along with
+// the smoothing parameters; the joint optimum can sit in a basin our 3D
+// optimiser cannot reach. The generalised optimiser below packs:
+//
+//   p = [alpha, beta[, gamma], L_0, B_0, S_0, ..., S_{m-1}]
+//
+// where the seasonal block is omitted when `m == 1`. The smoothing block is
+// clamped to (kBoundEps, 1 - kBoundEps); the initial-state block is bounded
+// to a generous data-range envelope so the simplex can move freely without
+// running away to non-finite SSE.
+
+// Computes the per-coordinate bounds used by `nelder_mead_full`. The
+// smoothing-param block (the first `smooth_dim` coordinates) is `(eps,
+// 1 - eps)`; the initial-state block (the remaining `dim - smooth_dim`
+// coordinates) is `[y_min - 5 * range, y_max + 5 * range]` so the simplex
+// has room to escape its starting basin.
+std::vector<ParamBounds> make_full_bounds(const std::vector<double>& y, std::size_t dim, std::size_t smooth_dim) {
+  std::vector<ParamBounds> bounds(dim);
+  for (std::size_t i = 0; i < smooth_dim; ++i) {
+    bounds[i] = ParamBounds{kBoundEps, 1.0 - kBoundEps};
+  }
+  double y_min = y[0];
+  double y_max = y[0];
+  for (double v : y) {
+    if (v < y_min)
+      y_min = v;
+    if (v > y_max)
+      y_max = v;
+  }
+  const double range = std::max(y_max - y_min, 1.0);
+  const double lo = y_min - 5.0 * range;
+  const double hi = y_max + 5.0 * range;
+  for (std::size_t i = smooth_dim; i < dim; ++i) {
+    bounds[i] = ParamBounds{lo, hi};
+  }
+  return bounds;
+}
+
+// SSE objective for the joint optimiser. Reads packed params:
+//   smooth_dim == 2 (m == 1): [alpha, beta, L_0, B_0]
+//   smooth_dim == 3 (m >= 2): [alpha, beta, gamma, L_0, B_0, S_0..S_{m-1}]
+double objective_full(const double* p, std::size_t /*dim*/, std::size_t smooth_dim, const std::vector<double>& y,
+                      std::uint32_t m) {
+  const double alpha = p[0];
+  const double beta = p[1];
+  const double gamma = (smooth_dim == 3U) ? p[2] : 0.0;
+  const double init_level = p[smooth_dim];
+  const double init_trend = p[smooth_dim + 1U];
+  const double* init_season = (m >= 2U) ? &p[smooth_dim + 2U] : nullptr;
+  const double sse = simulate_with_init(y, m, alpha, beta, gamma, init_level, init_trend, init_season, nullptr);
+  return std::isfinite(sse) ? sse : std::numeric_limits<double>::infinity();
+}
+
+// Joint optimisation over the smoothing parameters and the initial state.
+// Only the knobs differ from the smoothing-only search: the simplex is built
+// around the supplied `seed` (length `dim`) instead of the fixed anchor, the
+// bounds are per-coordinate, and the iteration budget grows with `dim` — a 9D
+// landscape needs ~2-3x more iterations than the 3D one to converge through
+// the same number of simplex collapses.
+double nelder_mead_full(const std::vector<double>& y, std::uint32_t m, std::size_t dim, std::size_t smooth_dim,
+                        const double* seed, double seed_step, const std::vector<ParamBounds>& bounds,
+                        std::vector<double>* out_params) {
+  const int iter_cap = static_cast<int>(static_cast<std::size_t>(kMaxNelderMeadIters) * std::max<std::size_t>(1U, dim));
+  return nelder_mead_search(y, m, dim, smooth_dim, seed, seed_step, bounds, iter_cap, &objective_full, out_params);
+}
+
+}  // namespace
+
+// ---------------------------------------------------------------------------
+// Fit + diagnostics on a resampled, deduplicated, evenly spaced series
+// ---------------------------------------------------------------------------
+
+// Fits a Holt-Winters model to `y` with the given seasonality `m`. On
+// success populates `*out` (parameters, final state, residuals, MAE,
+// RMSE, MASE, SMAPE) and returns `true`. Writes `*out_err` and returns
+// `false` on degenerate inputs (n < 2, or seasonal m with n < 2*m).
+bool fit_holt_winters(const std::vector<double>& y, std::uint32_t m, HoltWintersFit* out, Value* out_err) {
+  const std::size_t n = y.size();
+  if (n < 2U) {
+    *out_err = Value::error(ErrorCode::NA);
+    return false;
+  }
+  if (m >= 2U && n < 2U * static_cast<std::size_t>(m)) {
+    *out_err = Value::error(ErrorCode::NA);
+    return false;
+  }
+  const std::size_t smooth_dim = (m >= 2U) ? 3U : 2U;
+  double alpha = 0.0;
+  double beta = 0.0;
+  double gamma = 0.0;
+
+  // Stage 1: tune (alpha, beta[, gamma]) at the textbook two-season-means
+  // initialisation. This is the conservative path that has shipped since
+  // FORECAST.ETS landed; on most series it sits at or near the global
+  // optimum and is cheap to compute.
+  const double sse_basic = nelder_mead(y, m, smooth_dim, &alpha, &beta, &gamma);
+
+  // Stage 2: jointly tune the smoothing parameters and the initial state
+  // (L_0, B_0, S_0..S_{m-1}). The 3D optimum can sit in a basin that the
+  // smooth-only stage cannot reach because the initial state is fixed; on
+  // strongly cyclic data this stage finds the basin Mac Excel converges
+  // to. Multi-start over a small seed grid widens basin coverage further.
+  double init_level = 0.0;
+  double init_trend = 0.0;
+  std::vector<double> init_season;
+  compute_default_init(y, m, &init_level, &init_trend, &init_season);
+  const std::size_t full_dim = smooth_dim + 2U + ((m >= 2U) ? static_cast<std::size_t>(m) : 0U);
+  const std::vector<ParamBounds> full_bounds = make_full_bounds(y, full_dim, smooth_dim);
+
+  // Seed grid. Each entry supplies a (alpha, beta[, gamma]) anchor; the
+  // initial-state block is always seeded from the textbook default so the
+  // simplex can move it as needed. Seeds cover low/mid/high alpha to
+  // hedge against multimodal SSE landscapes.
+  static constexpr double kSmoothSeeds[][3] = {
+      {0.2, 0.1, 0.1},
+      {0.5, 0.1, 0.1},
+      {0.8, 0.05, 0.1},
+      {0.5, 0.5, 0.5},
+  };
+  double sse_full = std::numeric_limits<double>::infinity();
+  std::vector<double> full_params;
+  for (const auto& smooth_seed : kSmoothSeeds) {
+    std::vector<double> seed(full_dim, 0.0);
+    seed[0] = smooth_seed[0];
+    seed[1] = smooth_seed[1];
+    if (smooth_dim == 3U)
+      seed[2] = smooth_seed[2];
+    seed[smooth_dim] = init_level;
+    seed[smooth_dim + 1U] = init_trend;
+    if (m >= 2U) {
+      for (std::uint32_t i = 0; i < m; ++i) {
+        seed[smooth_dim + 2U + i] = init_season[i];
+      }
+    }
+    std::vector<double> params;
+    const double sse = nelder_mead_full(y, m, full_dim, smooth_dim, seed.data(),
+                                        /*seed_step=*/0.1, full_bounds, &params);
+    if (sse < sse_full) {
+      sse_full = sse;
+      full_params = std::move(params);
+    }
+  }
+
+  // Pick the better fit. The two stages share an objective (SSE on the
+  // same series), so a direct comparison is sound. On weakly-structured
+  // data the two-stage paths agree to numerical noise; on strongly-cyclic
+  // data the joint fit is materially better.
+  if (sse_full + 1e-9 < sse_basic && std::isfinite(sse_full)) {
+    alpha = full_params[0];
+    beta = full_params[1];
+    gamma = (smooth_dim == 3U) ? full_params[2] : 0.0;
+    init_level = full_params[smooth_dim];
+    init_trend = full_params[smooth_dim + 1U];
+    if (m >= 2U) {
+      for (std::uint32_t i = 0; i < m; ++i) {
+        init_season[i] = full_params[smooth_dim + 2U + i];
+      }
+    }
+    (void)simulate_with_init(y, m, alpha, beta, gamma, init_level, init_trend,
+                             init_season.empty() ? nullptr : init_season.data(), out);
+  } else {
+    // Re-run simulation at the fitted parameters to populate residuals
+    // and final state.
+    (void)simulate(y, m, alpha, beta, gamma, out);
+  }
+
+  // Diagnostic statistics. `start` = first index that has a forecast.
+  const std::size_t start = (m == 1U) ? 1U : static_cast<std::size_t>(m);
+  if (start >= n) {
+    *out_err = Value::error(ErrorCode::NA);
+    return false;
+  }
+  const std::size_t k = n - start;
+  double sum_abs_err = 0.0;
+  double sum_sq_err = 0.0;
+  double smape_num = 0.0;
+  std::size_t smape_n = 0U;
+  for (std::size_t t = start; t < n; ++t) {
+    const double err = out->residuals[t];
+    sum_abs_err += std::fabs(err);
+    sum_sq_err += err * err;
+    const double y_hat = y[t] - err;
+    const double denom = std::fabs(y[t]) + std::fabs(y_hat);
+    if (denom > 0.0) {
+      // SMAPE in the symmetric form: |F - y| / ((|F| + |y|) / 2).
+      smape_num += std::fabs(err) / (denom * 0.5);
+      ++smape_n;
+    }
+  }
+  out->mae = sum_abs_err / static_cast<double>(k);
+  out->rmse = std::sqrt(sum_sq_err / static_cast<double>(k));
+  out->smape = (smape_n > 0U) ? (smape_num / static_cast<double>(smape_n)) : 0.0;
+
+  // MASE: mean absolute error / mean absolute first-difference of the
+  // training series.
+  double sum_diff = 0.0;
+  for (std::size_t i = 1; i < n; ++i) {
+    sum_diff += std::fabs(y[i] - y[i - 1U]);
+  }
+  if (sum_diff > 0.0) {
+    const double scale = sum_diff / static_cast<double>(n - 1U);
+    out->mase = out->mae / scale;
+  } else {
+    out->mase = 0.0;
+  }
+  return true;
+}
+
+}  // namespace ets
+}  // namespace eval
+}  // namespace formulon
diff --git a/src/eval/holt_winters.h b/src/eval/holt_winters.h
new file mode 100644
index 000000000..8c9ec6347
--- /dev/null
+++ b/src/eval/holt_winters.h
@@ -0,0 +1,49 @@
+//
+// Holt-Winters additive triple-exponential smoothing fit used by the
+// FORECAST.ETS family.
+
+#ifndef FORMULON_EVAL_HOLT_WINTERS_H_
+#define FORMULON_EVAL_HOLT_WINTERS_H_
+
+#include <cstdint>
+#include <vector>
+
+#include "value.h"
+
+namespace formulon {
+namespace eval {
+namespace ets {
+
+/// Fitted smoothing parameters, final state and in-sample diagnostics.
+
+struct HoltWintersFit {
+  // Smoothing parameters fitted by Nelder-Mead. `gamma` is exactly 0.0
+  // when the model is non-seasonal (m == 1).
+  double alpha = 0.0;
+  double beta = 0.0;
+  double gamma = 0.0;
+  // Final state at the end of the in-sample series.
+  double level = 0.0;
+  double trend = 0.0;
+  std::vector<double> season;  // length m (or empty when m == 1)
+  std::uint32_t m = 1U;
+  // In-sample fit diagnostics. `residuals` has the same length as the
+  // resampled series; the first m entries (or the first 1 when m == 1)
+  // are zero because no one-step-ahead forecast is defined there.
+  std::vector<double> residuals;
+  double mae = 0.0;
+  double rmse = 0.0;
+  double mase = 0.0;
+  double smape = 0.0;
+};
+
+/// Fits a Holt-Winters model to `y` with seasonality `m`. On success fills
+/// `*out` and returns true; writes `*out_err` and returns false on degenerate
+/// inputs (n < 2, or seasonal m with n < 2*m).
+bool fit_holt_winters(const std::vector<double>& y, std::uint32_t m, HoltWintersFit* out, Value* out_err);
+
+}  // namespace ets
+}  // namespace eval
+}  // namespace formulon
+
+#endif  // FORMULON_EVAL_HOLT_WINTERS_H_
diff --git a/src/eval/info_lazy.cpp b/src/eval/info_lazy.cpp
index 1e16831fb..745eac6c7 100644
--- a/src/eval/info_lazy.cpp
+++ b/src/eval/info_lazy.cpp
@@ -83,21 +83,6 @@ std::size_t find_sheet_index(const Workbook& workbook, const Sheet& sheet) noexc
   return 0;
 }
 
-// Returns the referenced cell's sheet, resolving qualifier via the
-// bound workbook. Returns `nullptr` when the qualifier is present but
-// no workbook is bound, or when the named sheet is missing. `ref_sheet`
-// is the sheet string from a `parser::Reference`; empty means "current
-// sheet".
-const Sheet* resolve_ref_sheet(std::string_view ref_sheet, const EvalContext& ctx) noexcept {
-  if (ref_sheet.empty()) {
-    return ctx.current_sheet();
-  }
-  if (ctx.workbook() == nullptr) {
-    return nullptr;
-  }
-  return ctx.workbook()->sheet_by_name(ref_sheet);
-}
-
 struct SingleReference {
   const Sheet* sheet = nullptr;
   std::uint32_t row = 0;
@@ -133,7 +118,7 @@ Expected<SingleReference, ErrorCode> resolve_single_reference(const parser::AstN
   if (top != bottom || left != right) {
     return ErrorCode::Value;
   }
-  const Sheet* sheet = resolve_ref_sheet(sheet_name, ctx);
+  const Sheet* sheet = ctx.sheet_for_qualifier(sheet_name);
   if (sheet == nullptr) {
     return ctx.current_sheet() == nullptr ? ErrorCode::Name : ErrorCode::Ref;
   }
diff --git a/src/eval/lambda_helpers_lazy.cpp b/src/eval/lambda_helpers_lazy.cpp
index 64a147cff..129b2495d 100644
--- a/src/eval/lambda_helpers_lazy.cpp
+++ b/src/eval/lambda_helpers_lazy.cpp
@@ -61,39 +61,6 @@ Value unwrap_1x1_array(const Value& v) {
   return v;
 }
 
-// Builds a synthetic `ArrayLiteral` AST that mirrors the cells of `arr`.
-// Used to give a per-row / per-column slice a range-shaped AST identity,
-// so range-aware functions inside the lambda body (`SUM`, `AVERAGE`, ...)
-// can flatten the slice through the dispatcher's existing ArrayLiteral
-// branch instead of receiving an opaque `Value::Array` they cannot coerce.
-//
-// Each cell becomes a `Literal` AST node carrying the cell's `Value`. The
-// resulting AST and all child nodes live in `arena` for the same lifetime
-// as the lambda invocation. Returns `nullptr` on allocation failure.
-const parser::AstNode* build_array_literal_for(const ArrayValue* arr, Arena& arena) {
-  const std::uint32_t rows = arr->rows;
-  const std::uint32_t cols = arr->cols;
-  // `make_array_literal` precondition: rows / cols must be >= 1. The
-  // empty-input guards in BYROW / BYCOL / SCAN ensure this never triggers
-  // for a valid slice.
-  if (rows == 0U || cols == 0U) {
-    return nullptr;
-  }
-  const std::size_t total = static_cast<std::size_t>(rows) * static_cast<std::size_t>(cols);
-  const parser::AstNode** children = arena.create_array<const parser::AstNode*>(total);
-  if (children == nullptr) {
-    return nullptr;
-  }
-  for (std::size_t i = 0; i < total; ++i) {
-    parser::AstNode* lit = parser::make_literal(arena, arr->cells[i]);
-    if (lit == nullptr) {
-      return nullptr;
-    }
-    children[i] = lit;
-  }
-  return parser::make_array_literal(arena, rows, cols, children);
-}
-
 // Where a helper's source argument lies on the grid when it is a reference.
 // Excel binds each callback argument taken from such a source as the cell
 // (MAP, REDUCE, SCAN) or the row / column (BYROW, BYCOL) it came from, so
@@ -280,7 +247,7 @@ Value byrow_or_bycol(const parser::AstNode& call, bool by_row, Arena& arena, con
     // dispatcher's ArrayLiteral branch.
     const parser::AstNode* slice_ast = origin.valid ? (by_row ? origin_rect_ast(origin, i, 0U, i, cols_in - 1U, arena)
                                                               : origin_rect_ast(origin, 0U, i, rows_in - 1U, i, arena))
-                                                    : build_array_literal_for(slice_arr, arena);
+                                                    : array_literal_ast(slice_arr, arena);
     if (slice_ast == nullptr) {
       return Value::error(ErrorCode::Num);
     }
@@ -308,6 +275,40 @@ Value byrow_or_bycol(const parser::AstNode& call, bool by_row, Arena& arena, con
   return Value::array(out_arr);
 }
 
+/// Shared inputs of REDUCE / SCAN: seed, source array and the 2-arity callable.
+struct FoldInputs {
+  Value acc = Value::blank();
+  const parser::AstNode* acc_ast = nullptr;
+  const ArrayValue* in = nullptr;
+  const LambdaValue* lv = nullptr;
+  SourceOrigin origin;
+};
+
+/// Reads `(initial_value, array, lambda)`; on failure returns false with the error in `*out_err`.
+bool read_fold_inputs(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
+                      const EvalContext& ctx, FoldInputs* fi, Value* out_err) {
+  if (call.as_call_arity() != 3U) {
+    *out_err = Value::error(ErrorCode::Value);
+    return false;
+  }
+  // The seed binds like a LAMBDA argument, so a reference seed stays a reference for the first call.
+  fi->acc = eval_binding_source(call.as_call_arg(0), arena, registry, ctx, &fi->acc_ast);
+  if (fi->acc.is_error()) {
+    *out_err = fi->acc;
+    return false;
+  }
+  fi->in = eval_array_arg(call.as_call_arg(1), arena, registry, ctx, out_err);
+  if (fi->in == nullptr) {
+    return false;
+  }
+  fi->lv = resolve_callable(call.as_call_arg(2), /*call_arity=*/2U, arena, registry, ctx, out_err);
+  if (fi->lv == nullptr) {
+    return false;
+  }
+  fi->origin = source_origin(call.as_call_arg(1), fi->in, arena, registry, ctx);
+  return true;
+}
+
 }  // namespace
 
 Value eval_byrow_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
@@ -421,26 +422,16 @@ Value eval_map_lazy(const parser::AstNode& call, Arena& arena, const FunctionReg
 
 Value eval_reduce_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                        const EvalContext& ctx) {
-  if (call.as_call_arity() != 3U) {
-    return Value::error(ErrorCode::Value);
-  }
-  // initial_value binds like a LAMBDA argument, so a reference seed stays a
-  // reference for the first call; an error propagates.
-  const parser::AstNode* acc_ast = nullptr;
-  Value acc = eval_binding_source(call.as_call_arg(0), arena, registry, ctx, &acc_ast);
-  if (acc.is_error()) {
-    return acc;
-  }
+  FoldInputs fi;
   Value err = Value::blank();
-  const ArrayValue* in = eval_array_arg(call.as_call_arg(1), arena, registry, ctx, &err);
-  if (in == nullptr) {
+  if (!read_fold_inputs(call, arena, registry, ctx, &fi, &err)) {
     return err;
   }
-  const LambdaValue* lv = resolve_callable(call.as_call_arg(2), /*call_arity=*/2U, arena, registry, ctx, &err);
-  if (lv == nullptr) {
-    return err;
-  }
-  const SourceOrigin origin = source_origin(call.as_call_arg(1), in, arena, registry, ctx);
+  Value acc = fi.acc;
+  const parser::AstNode* acc_ast = fi.acc_ast;
+  const ArrayValue* in = fi.in;
+  const LambdaValue* lv = fi.lv;
+  const SourceOrigin origin = fi.origin;
 
   // An empty input is a no-op fold: REDUCE returns the seed unchanged
   // (the Mac Excel observed behaviour for `=REDUCE(0, FILTER(...empty...), ...)`).
@@ -467,24 +458,16 @@ Value eval_reduce_lazy(const parser::AstNode& call, Arena& arena, const Function
 
 Value eval_scan_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                      const EvalContext& ctx) {
-  if (call.as_call_arity() != 3U) {
-    return Value::error(ErrorCode::Value);
-  }
-  const parser::AstNode* acc_ast = nullptr;
-  Value acc = eval_binding_source(call.as_call_arg(0), arena, registry, ctx, &acc_ast);
-  if (acc.is_error()) {
-    return acc;
-  }
+  FoldInputs fi;
   Value err = Value::blank();
-  const ArrayValue* in = eval_array_arg(call.as_call_arg(1), arena, registry, ctx, &err);
-  if (in == nullptr) {
-    return err;
-  }
-  const LambdaValue* lv = resolve_callable(call.as_call_arg(2), /*call_arity=*/2U, arena, registry, ctx, &err);
-  if (lv == nullptr) {
+  if (!read_fold_inputs(call, arena, registry, ctx, &fi, &err)) {
     return err;
   }
-  const SourceOrigin origin = source_origin(call.as_call_arg(1), in, arena, registry, ctx);
+  Value acc = fi.acc;
+  const parser::AstNode* acc_ast = fi.acc_ast;
+  const ArrayValue* in = fi.in;
+  const LambdaValue* lv = fi.lv;
+  const SourceOrigin origin = fi.origin;
 
   const std::uint32_t rows = in->rows;
   const std::uint32_t cols = in->cols;
diff --git a/src/eval/lambda_value.h b/src/eval/lambda_value.h
index 5a58d50c3..2a77ef593 100644
--- a/src/eval/lambda_value.h
+++ b/src/eval/lambda_value.h
@@ -53,7 +53,7 @@ struct LambdaValue {
   /// — must satisfy `param_count - optional_count <= arity <= param_count`;
   /// anything outside that window surfaces `#VALUE!`. The rule is enforced
   /// in one place, `invoke_lambda_values_with_ast` in
-  /// `eval/tree_walker/dispatch.cpp`.
+  /// `eval/tree_walker/lambda_invoke.cpp`.
   std::uint32_t param_count;
   /// Number of trailing parameters declared with `[name]` bracket syntax.
   /// When the call site provides fewer than `param_count` arguments, the
diff --git a/src/eval/linest_lazy.cpp b/src/eval/linest_lazy.cpp
index 61a40ab8e..6b67b01be 100644
--- a/src/eval/linest_lazy.cpp
+++ b/src/eval/linest_lazy.cpp
@@ -76,22 +76,6 @@ bool coerce_array(const ArrayValue& src, std::vector<double>& out, Value* out_er
   return true;
 }
 
-/// Flat row-major buffer + shape returned by `make_double_array`.
-ArrayValue* make_double_array(const std::vector<Value>& data, std::uint32_t rows, std::uint32_t cols, Arena& arena) {
-  // Same overflow-defensive guard as `coerce_array`: bail on 32-bit
-  // wrap so the arena allocation request matches what the loop expects.
-  Value* buffer = nullptr;
-  ArrayValue* arr = allocate_array_value(rows, cols, arena, buffer, kMaxDerivedArrayCells);
-  if (arr == nullptr) {
-    return nullptr;
-  }
-  const std::size_t n = static_cast<std::size_t>(rows) * static_cast<std::size_t>(cols);
-  for (std::size_t i = 0; i < n; ++i) {
-    buffer[i] = data[i];
-  }
-  return arr;
-}
-
 /// Returns true if `v` is finite, false for NaN / +-inf. Used to gate
 /// final result cells; LINEST surfaces `#NUM!` for any non-finite
 /// statistic.
@@ -488,7 +472,7 @@ ArrayValue* build_prediction_output(const std::vector<double>& coeffs, const std
 
   const std::uint32_t out_rows = y_is_col ? n_obs : 1U;
   const std::uint32_t out_cols = y_is_col ? 1U : n_obs;
-  return make_double_array(cells, out_rows, out_cols, arena);
+  return array_from_values(out_rows, out_cols, cells.data(), cells.size(), arena);
 }
 
 /// Builds the LINEST / LOGEST output array. `coeffs` is in normal
@@ -514,7 +498,7 @@ ArrayValue* build_simple_output(const std::vector<double>& coeffs, std::uint32_t
   } else {
     cells[k] = Value::number(log_form ? 1.0 : 0.0);
   }
-  return make_double_array(cells, 1U, out_cols, arena);
+  return array_from_values(1U, out_cols, cells.data(), cells.size(), arena);
 }
 
 /// Builds the 5x(k+1) statistics matrix. `inv_a` is `A^{-1}` (the
@@ -621,7 +605,7 @@ ArrayValue* build_stats_output(const std::vector<double>& coeffs, const std::vec
   cells[4U * out_cols + 0U] = is_finite(ss_reg) ? Value::number(ss_reg) : Value::error(ErrorCode::NA);
   cells[4U * out_cols + 1U] = is_finite(ss_resid) ? Value::number(ss_resid) : Value::error(ErrorCode::NA);
 
-  return make_double_array(cells, out_rows, out_cols, arena);
+  return array_from_values(out_rows, out_cols, cells.data(), cells.size(), arena);
 }
 
 /// Replaces every entry of `dm.y` with `ln(y_i)`. Returns `false` if
diff --git a/src/eval/lookups/classic.cpp b/src/eval/lookups/classic.cpp
index 04f7b7c96..0ea614201 100644
--- a/src/eval/lookups/classic.cpp
+++ b/src/eval/lookups/classic.cpp
@@ -15,7 +15,6 @@
 #include <vector>
 
 #include "eval/coerce.h"
-#include "eval/criteria.h"
 #include "eval/declared_rect.h"
 #include "eval/dynamic_array/common.h"
 #include "eval/eval_context.h"
@@ -25,6 +24,7 @@
 #include "eval/lookups/common.h"
 #include "eval/name_env_resolve.h"
 #include "eval/range_args.h"
+#include "eval/wildcard.h"
 #include "parser/ast.h"
 #include "utils/arena.h"
 #include "utils/expected.h"
diff --git a/src/eval/lookups/index.cpp b/src/eval/lookups/index.cpp
index 3b07f17e9..e51d8d9e6 100644
--- a/src/eval/lookups/index.cpp
+++ b/src/eval/lookups/index.cpp
@@ -13,6 +13,7 @@
 #include <utility>
 #include <vector>
 
+#include "eval/array_alloc.h"
 #include "eval/coerce.h"
 #include "eval/declared_rect.h"
 #include "eval/dynamic_array/common.h"
@@ -56,15 +57,10 @@ Value index_whole_column(const std::vector<Value>& cells, std::uint32_t rows, st
 // single axis — `INDEX(array, 0, 0)` and its two-argument spelling
 // `INDEX(array, 0)`. Returns `#NUM!` on arena exhaustion.
 Value index_whole_array(const std::vector<Value>& cells, std::uint32_t rows, std::uint32_t cols, Arena& arena) {
-  Value* buffer = nullptr;
-  ArrayValue* out = dynamic_array::allocate_array_value(rows, cols, arena, buffer, kMaxDerivedArrayCells);
+  ArrayValue* out = array_from_values(rows, cols, cells.data(), cells.size(), arena);
   if (out == nullptr) {
     return Value::error(ErrorCode::Num);
   }
-  const std::size_t total = static_cast<std::size_t>(rows) * cols;
-  for (std::size_t i = 0; i < total; ++i) {
-    buffer[i] = cells[i];
-  }
   return Value::array(out);
 }
 
diff --git a/src/eval/lookups/xlookup.cpp b/src/eval/lookups/xlookup.cpp
index 9ca9136a7..b0dff2f95 100644
--- a/src/eval/lookups/xlookup.cpp
+++ b/src/eval/lookups/xlookup.cpp
@@ -15,7 +15,6 @@
 
 #include "eval/array_alloc.h"
 #include "eval/coerce.h"
-#include "eval/criteria.h"
 #include "eval/eval_context.h"
 #include "eval/function_registry.h"
 #include "eval/jp_fold.h"
@@ -23,6 +22,7 @@
 #include "eval/omitted_arg.h"
 #include "eval/range_args.h"
 #include "eval/range_resolvers.h"
+#include "eval/wildcard.h"
 #include "parser/ast.h"
 #include "utils/arena.h"
 #include "utils/strings.h"
diff --git a/src/eval/name_env_resolve.h b/src/eval/name_env_resolve.h
index 2920ae386..592fb7f98 100644
--- a/src/eval/name_env_resolve.h
+++ b/src/eval/name_env_resolve.h
@@ -83,6 +83,22 @@ inline bool is_range_shaped_ast(const parser::AstNode& node) noexcept {
   }
 }
 
+/// Returns the LET binding behind a `NameRef` `node` when that binding is
+/// range-shaped (or, with `accept_ref`, a single-cell `Ref`); otherwise
+/// returns `node` unchanged.
+inline const parser::AstNode& resolve_range_binding(const parser::AstNode& node, const NameEnv* env,
+                                                    bool accept_ref) noexcept {
+  if (node.kind() != parser::NodeKind::NameRef) {
+    return node;
+  }
+  const parser::AstNode& resolved = resolve_name_ast(node, env);
+  if (&resolved != &node &&
+      (is_range_shaped_ast(resolved) || (accept_ref && resolved.kind() == parser::NodeKind::Ref))) {
+    return resolved;
+  }
+  return node;
+}
+
 }  // namespace eval
 }  // namespace formulon
 
diff --git a/src/eval/phonetic_lazy.cpp b/src/eval/phonetic_lazy.cpp
index 72773df94..6b7d94e4a 100644
--- a/src/eval/phonetic_lazy.cpp
+++ b/src/eval/phonetic_lazy.cpp
@@ -21,26 +21,11 @@
 #include "utils/error.h"
 #include "utils/text_ops.h"
 #include "value.h"
-#include "workbook.h"
 
 namespace formulon {
 namespace eval {
 namespace {
 
-// Same helper as info_lazy.cpp. Inlined here rather than extracted to a
-// shared header because PHONETIC is the only outside consumer today;
-// promoting `resolve_ref_sheet` later is a bigger refactor than this
-// commit warrants.
-const Sheet* resolve_ref_sheet_for_phonetic(std::string_view ref_sheet, const EvalContext& ctx) noexcept {
-  if (ref_sheet.empty()) {
-    return ctx.current_sheet();
-  }
-  if (ctx.workbook() == nullptr) {
-    return nullptr;
-  }
-  return ctx.workbook()->sheet_by_name(ref_sheet);
-}
-
 // Applies Mac's strict-text passthrough to a flattened scalar `v`:
 //   * Text  -> the text itself (unchanged).
 //   * Blank -> empty string (interned in the eval arena).
@@ -129,7 +114,7 @@ Value eval_phonetic_lazy(const parser::AstNode& call, Arena& arena, const Functi
     if (r.is_full_col || r.is_full_row) {
       return Value::error(ErrorCode::Value);
     }
-    const Sheet* target = resolve_ref_sheet_for_phonetic(r.sheet, ctx);
+    const Sheet* target = ctx.sheet_for_qualifier(r.sheet);
     if (target == nullptr) {
       // Unbound context: #NAME?. Missing qualified sheet: #REF!. Same
       // mapping as ISFORMULA / FORMULATEXT.
diff --git a/src/eval/range_args.cpp b/src/eval/range_args.cpp
index c2c17ebcd..47d38146a 100644
--- a/src/eval/range_args.cpp
+++ b/src/eval/range_args.cpp
@@ -126,14 +126,7 @@ bool resolve_range_arg_into(const parser::AstNode& raw_arg, Arena& arena, const
   // shape decisions below need the original AST, not the NameRef. Single-
   // cell Refs and scalar bindings are intentionally left as-is so the
   // existing 1-cell / scalar-fallback semantics are preserved.
-  const parser::AstNode* effective = &raw_arg;
-  if (raw_arg.kind() == parser::NodeKind::NameRef) {
-    const parser::AstNode& resolved = resolve_name_ast(raw_arg, ctx.name_env());
-    if (&resolved != &raw_arg && is_range_shaped_ast(resolved)) {
-      effective = &resolved;
-    }
-  }
-  const parser::AstNode& arg_node = *effective;
+  const parser::AstNode& arg_node = resolve_range_binding(raw_arg, ctx.name_env(), /*accept_ref=*/false);
   // OFFSET / CHOOSE / IF / ROW / COLUMN all need range-shaped expansion
   // glue (see per-branch comments below). Dispatch via a single
   // case-insensitive name lookup against `kRangeShapedNames` so the hot
@@ -193,24 +186,7 @@ bool resolve_range_arg_into(const parser::AstNode& raw_arg, Arena& arena, const
             // path and a bare `IF(cond, a, b)` cannot answer differently for
             // one formula. `expand_if_call` resolves through this branch.
             const Value result = eval_if_array_cond_lazy(arg_node, cond, arena, registry, ctx);
-            if (result.is_error()) {
-              *out_err_code = result.as_error();
-              return false;
-            }
-            if (!result.is_array()) {
-              *out_err_code = ErrorCode::Value;
-              return false;
-            }
-            const ArrayValue* array = result.as_array();
-            const std::size_t count = static_cast<std::size_t>(array->rows) * array->cols;
-            out_cells->assign(array->cells, array->cells + count);
-            if (out_rows != nullptr) {
-              *out_rows = array->rows;
-            }
-            if (out_cols != nullptr) {
-              *out_cols = array->cols;
-            }
-            return true;
+            return expand_array_result(result, out_cells, out_err_code, out_rows, out_cols);
           }
           auto coerced = coerce_to_bool(cond);
           if (!coerced) {
diff --git a/src/eval/range_dep_index.cpp b/src/eval/range_dep_index.cpp
index 21c0a53f9..a04d8a0b2 100644
--- a/src/eval/range_dep_index.cpp
+++ b/src/eval/range_dep_index.cpp
@@ -21,7 +21,7 @@ std::uint32_t RangeDepIndex::intern_range(const CellRangeDependency& range) {
   if (!free_range_ids_.empty()) {
     range_id = free_range_ids_.back();
     free_range_ids_.pop_back();
-    ranges_[range_id].range = range;
+    ranges_[range_id] = RangeEntry{range, {}};
   } else {
     range_id = static_cast<std::uint32_t>(ranges_.size());
     ranges_.push_back(RangeEntry{range, {}});
@@ -81,8 +81,13 @@ std::vector<std::uint32_t> RangeDepIndex::erase_owner(CellNodeId owner) {
   }
 
   for (const OwnedRange& owned : it->second) {
-    std::vector<CellNodeId>& owners = ranges_[owned.range_id].owners;
+    RangeEntry& entry = ranges_[owned.range_id];
+    std::vector<CellNodeId>& owners = entry.owners;
     const std::size_t last_index = owners.size() - 1U;
+    // Keep the visited prefix exact: a not-yet-visited tail owner swapped into it ends the prefix there.
+    if (owned.owner_index < entry.visited_owners) {
+      entry.visited_owners = last_index < entry.visited_owners ? entry.visited_owners - 1U : owned.owner_index;
+    }
     if (owned.owner_index != last_index) {
       // Swap-remove: the owner moved into the vacated slot must learn its new
       // index, otherwise its own erase would target a stranger's slot.
diff --git a/src/eval/range_dep_index.h b/src/eval/range_dep_index.h
index 591633b1a..a79406294 100644
--- a/src/eval/range_dep_index.h
+++ b/src/eval/range_dep_index.h
@@ -23,7 +23,8 @@
 // buckets and a whole-column rectangle a fixed `kMaxRows / kBandRows`, which
 // keeps insertion bounded regardless of the referenced area. A coverage
 // lookup still visits every owner of each covering rectangle, so bulk
-// writers that need no dirty marking (workbook load) bypass it.
+// writers that need no dirty marking (workbook load) bypass it, and dirty
+// marking revisits only owners added since its previous visit.
 //
 // Not thread-safe: the recalc engine owns the instance and mutates it under
 // its own mutex.
@@ -107,6 +108,34 @@ class RangeDepIndex {
     }
   }
 
+  /// Like `for_each_owner_covering`, but within one `generation` each owner
+  /// slot of a covering rectangle is visited at most once: a later call with
+  /// the same generation visits only owners added since. Lets dirty marking,
+  /// which is idempotent until the dirty set drops a cell, skip rectangles
+  /// whose owners are already marked. Starting a new generation revisits
+  /// every owner.
+  template <typename Fn>
+  void for_each_new_owner_covering(CellNodeId cell, std::uint64_t generation, Fn&& fn) {
+    const auto band = bands_.find(band_key(cell.sheet_id, cell.row));
+    if (band == bands_.end()) {
+      return;
+    }
+    for (const std::uint32_t range_id : band->second) {
+      RangeEntry& entry = ranges_[range_id];
+      if (!entry.range.contains(cell)) {
+        continue;
+      }
+      if (entry.visited_generation != generation) {
+        entry.visited_generation = generation;
+        entry.visited_owners = 0U;
+      }
+      for (std::size_t i = entry.visited_owners; i < entry.owners.size(); ++i) {
+        fn(entry.owners[i]);
+      }
+      entry.visited_owners = static_cast<std::uint32_t>(entry.owners.size());
+    }
+  }
+
   /// Invokes `fn(std::uint32_t range_id)` once per interned rectangle that
   /// covers `cell`. `fn` must not mutate the index.
   template <typename Fn>
@@ -154,9 +183,13 @@ class RangeDepIndex {
  private:
   // One interned rectangle. An entry whose owner list is empty is a released
   // slot: its id lives in `free_range_ids_` and is skipped by iteration.
+  // `owners[0, visited_owners)` were visited by `for_each_new_owner_covering`
+  // during `visited_generation`.
   struct RangeEntry {
     CellRangeDependency range;
     std::vector<CellNodeId> owners;
+    std::uint64_t visited_generation = 0U;
+    std::uint32_t visited_owners = 0U;
   };
 
   // Back-reference from an owner to its slot inside `RangeEntry::owners`, so
diff --git a/src/eval/range_expanders.h b/src/eval/range_expanders.h
index ba21e2d0b..14330c894 100644
--- a/src/eval/range_expanders.h
+++ b/src/eval/range_expanders.h
@@ -126,6 +126,12 @@ bool expand_column_call(const parser::AstNode& call, Arena& arena, const Functio
                         const EvalContext& ctx, std::vector<Value>* out_cells, ErrorCode* out_err_code,
                         std::uint32_t* out_rows, std::uint32_t* out_cols);
 
+/// Flattens the `Value::Array` an array-condition / array-index broadcast
+/// produced into the expander out-params. An error result writes its code
+/// and a non-array result writes `#VALUE!`; both return `false`.
+bool expand_array_result(const Value& result, std::vector<Value>* out_cells, ErrorCode* out_err_code,
+                         std::uint32_t* out_rows, std::uint32_t* out_cols);
+
 }  // namespace eval
 }  // namespace formulon
 
diff --git a/src/eval/rank_lazy.cpp b/src/eval/rank_lazy.cpp
index 0bcbc110d..02913bd39 100644
--- a/src/eval/rank_lazy.cpp
+++ b/src/eval/rank_lazy.cpp
@@ -348,66 +348,51 @@ std::size_t percentrank_floor_index(const std::vector<double>& sorted, double x)
   return k;
 }
 
-}  // namespace
-
-Value eval_percentrank_inc_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
-                                const EvalContext& ctx) {
+// Shared body of PERCENTRANK.INC / .EXC. The inclusive form ranks exact
+// matches at k / (N - 1); the exclusive one uses 1-based positions over
+// (N + 1), so an exact match at sorted[k] yields (k + 1) / (N + 1).
+Value percentrank_impl(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
+                       const EvalContext& ctx, bool exclusive) {
   auto prepared = prepare_percentrank(call, arena, registry, ctx);
   if (std::holds_alternative<Value>(prepared)) {
     return std::get<Value>(prepared);
   }
   const PercentRankInputs& in = std::get<PercentRankInputs>(prepared);
   const std::size_t n = in.sorted.size();
-  // Excel returns #N/A for an array with fewer than two numeric cells
-  // (the `(N - 1)` divisor collapses).
-  if (n < 2U) {
+  // Excel returns #N/A for an empty array, and for the inclusive form also
+  // for a single numeric cell (the `(N - 1)` divisor collapses).
+  if (n < (exclusive ? 1U : 2U)) {
     return Value::error(ErrorCode::NA);
   }
   if (in.x < in.sorted.front() || in.x > in.sorted.back()) {
     return Value::error(ErrorCode::NA);
   }
   const std::size_t k = percentrank_floor_index(in.sorted, in.x);
+  const std::size_t pos = exclusive ? k + 1U : k;
+  const double denom = static_cast<double>(exclusive ? n + 1U : n - 1U);
   double raw = 0.0;
   if (in.sorted[k] == in.x) {
-    raw = static_cast<double>(k) / static_cast<double>(n - 1U);
+    raw = static_cast<double>(pos) / denom;
   } else {
     // Interpolate between sorted[k] and sorted[k + 1]. The outer range
     // check above guarantees k + 1 < n here.
     const double span = in.sorted[k + 1U] - in.sorted[k];
-    raw = (static_cast<double>(k) + (in.x - in.sorted[k]) / span) / static_cast<double>(n - 1U);
+    raw = (static_cast<double>(pos) + (in.x - in.sorted[k]) / span) / denom;
   }
   const double result = truncate_to_significance(raw, in.significance);
   return std::isfinite(result) ? Value::number(result) : Value::error(ErrorCode::Num);
 }
 
+}  // namespace
+
+Value eval_percentrank_inc_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
+                                const EvalContext& ctx) {
+  return percentrank_impl(call, arena, registry, ctx, /*exclusive=*/false);
+}
+
 Value eval_percentrank_exc_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                                 const EvalContext& ctx) {
-  auto prepared = prepare_percentrank(call, arena, registry, ctx);
-  if (std::holds_alternative<Value>(prepared)) {
-    return std::get<Value>(prepared);
-  }
-  const PercentRankInputs& in = std::get<PercentRankInputs>(prepared);
-  const std::size_t n = in.sorted.size();
-  if (n < 1U) {
-    return Value::error(ErrorCode::NA);
-  }
-  if (in.x < in.sorted.front() || in.x > in.sorted.back()) {
-    return Value::error(ErrorCode::NA);
-  }
-  // Exclusive uses divisor (N + 1) and 1-based positions, so an exact
-  // match at sorted[k] yields raw = (k + 1) / (N + 1).
-  const std::size_t k = percentrank_floor_index(in.sorted, in.x);
-  const double denom = static_cast<double>(n + 1U);
-  double raw = 0.0;
-  if (in.sorted[k] == in.x) {
-    raw = static_cast<double>(k + 1U) / denom;
-  } else {
-    // k + 1 < n because x < sorted.back() when no exact match is found.
-    const double span = in.sorted[k + 1U] - in.sorted[k];
-    raw = (static_cast<double>(k + 1U) + (in.x - in.sorted[k]) / span) / denom;
-  }
-  const double result = truncate_to_significance(raw, in.significance);
-  return std::isfinite(result) ? Value::number(result) : Value::error(ErrorCode::Num);
+  return percentrank_impl(call, arena, registry, ctx, /*exclusive=*/true);
 }
 
 }  // namespace eval
diff --git a/src/eval/recalc_engine.cpp b/src/eval/recalc_engine.cpp
index 011bf2156..d247e6b23 100644
--- a/src/eval/recalc_engine.cpp
+++ b/src/eval/recalc_engine.cpp
@@ -10,11 +10,13 @@
 #include <memory>
 #include <optional>
 #include <string>
+#include <string_view>
 #include <unordered_set>
 #include <utility>
 #include <vector>
 
 #include "cell.h"
+#include "eval/builtin_names.h"
 #include "eval/cell_evaluator.h"
 #include "eval/dep_extractor.h"
 #include "eval/dep_graph.h"
@@ -27,13 +29,13 @@
 #include "eval/spill_release.h"
 #include "eval/volatile_tracker.h"
 #include "parser/ast.h"
-#include "parser/parser.h"
 #include "sheet.h"
 #include "utils/arena.h"
 #include "utils/error.h"
 #include "utils/expected.h"
 #include "utils/rect_iterator.h"
 #include "utils/resource_budget.h"
+#include "utils/status_macros.h"
 #include "value.h"
 #include "workbook.h"
 
@@ -42,13 +44,9 @@ namespace {
 
 // The spill-release queue, the progress snapshot and the wave ceilings are
 // shared with the parallel scheduler; see `spill_release.h`.
-using detail::BlockedSpillState;
-using detail::canonical_release_targets;
-using detail::kMaxNoProgressSpillWaves;
-using detail::kMaxSpillReleaseWaves;
 using detail::queue_spill_release;
-using detail::snapshot_blocked_spills;
 using detail::SpillReleaseQueue;
+using detail::SpillWaveBudget;
 
 void mark_spill_release_wave(const RecalcEngine::LockedMutator& mutator, const std::vector<CellNodeId>& anchors,
                              const DepGraph& graph) {
@@ -83,6 +81,55 @@ bool spill_intersects_range(const SpillFootprint& footprint, const CellRangeDepe
          static_cast<std::uint64_t>(range.col_first) < spill_col_end;
 }
 
+// Cells probed straight above and straight left of a spill target for a blocker; none found admits conservatively.
+constexpr std::uint32_t kSpillBlockerProbeCells = 64U;
+
+// Largest runtime read rectangle whose open cells are checked one by one before admitting a producer.
+constexpr std::uint64_t kMaxCheckedSpillReadCells = 256U;
+
+// A stored formula or non-blank literal blocks every spill covering it. A phantom does not: its producer may shrink.
+bool blocks_spill(const Cell* cell) noexcept {
+  return cell != nullptr && (!cell->formula_text.empty() || !cell->cached_value.is_blank());
+}
+
+// A coordinate a not-yet-committed spill might fill, with the nearest stored blocker straight above and left of it.
+struct SpillTarget {
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::int64_t blocker_row = -1;
+  std::int64_t blocker_col = -1;
+
+  SpillTarget(const Sheet& sheet, std::uint32_t target_row, std::uint32_t target_col) noexcept
+      : row(target_row), col(target_col) {
+    for (std::uint32_t step = 1U; step <= kSpillBlockerProbeCells && step <= row; ++step) {
+      if (blocks_spill(sheet.cell_at(row - step, col))) {
+        blocker_row = static_cast<std::int64_t>(row - step);
+        break;
+      }
+    }
+    for (std::uint32_t step = 1U; step <= kSpillBlockerProbeCells && step <= col; ++step) {
+      if (blocks_spill(sheet.cell_at(row, col - step))) {
+        blocker_col = static_cast<std::int64_t>(col - step);
+        break;
+      }
+    }
+  }
+
+  // A spill covering the target covers the whole producer-to-target rectangle, so a blocker inside it rules the
+  // producer out unless the blocker is the producer's own cell.
+  bool reachable_from(CellNodeId producer) const noexcept {
+    if (producer.row > row || producer.col > col) {
+      return false;
+    }
+    const auto producer_row = static_cast<std::int64_t>(producer.row);
+    const auto producer_col = static_cast<std::int64_t>(producer.col);
+    if (producer_row <= blocker_row && !(producer_row == blocker_row && producer.col == col)) {
+      return false;
+    }
+    return !(producer_col <= blocker_col && !(producer_col == blocker_col && producer.row == row));
+  }
+};
+
 }  // namespace
 
 // ----------------------------------------------------------------------------
@@ -128,6 +175,10 @@ const DepGraph& RecalcEngine::LockedMutator::dep_graph() const noexcept {
   return engine_.graph_;
 }
 
+bool RecalcEngine::LockedMutator::has_ever_registered_formula() const noexcept {
+  return engine_.has_ever_registered_formula_;
+}
+
 namespace {
 
 // Appends every populated coordinate of `range` to `out`. `extent` is the
@@ -384,42 +435,333 @@ void RecalcEngine::DynamicReadPass::settle_sccs(std::vector<std::vector<CellNode
 }
 
 const std::vector<CellNodeId>& RecalcEngine::DynamicReadPass::end_wave(
-    const std::unordered_set<CellNodeId, CellNodeIdHash>* closure) {
+    const std::unordered_set<CellNodeId, CellNodeIdHash>* closure, const FunctionRegistry* registry) {
   stale_ = engine_.reconcile_dynamic_reads_locked(workbook_, log_, closure, refreshed_);
+  if (closure != nullptr && registry != nullptr) {
+    discover_pending_candidates(*registry, *closure);
+  }
   log_.clear_wave();
   first_wave_ = false;
+  std::sort(stale_.begin(), stale_.end(), CellNodeIdOrder{});
+  stale_.erase(std::unique(stale_.begin(), stale_.end()), stale_.end());
   return stale_;
 }
 
+void RecalcEngine::DynamicReadPass::discover_pending_candidates(
+    const FunctionRegistry& registry, const std::unordered_set<CellNodeId, CellNodeIdHash>& closure) {
+  Arena potential_arena;
+  for (const DynamicRead& read : log_.reads()) {
+    if (read.sheet_id >= workbook_.sheet_count() ||
+        read.sheet_id >= engine_.potential_spill_producers_by_sheet_.size()) {
+      continue;
+    }
+
+    // Discovery is only for a blank coordinate whose producer has not committed. A small rectangle is checked cell
+    // by cell; a larger one keeps the geometric test alone.
+    const Sheet& read_sheet = workbook_.sheet(static_cast<std::uint16_t>(read.sheet_id));
+    const bool checks_targets =
+        static_cast<std::uint64_t>(read.rect.rows()) * read.rect.cols() <= kMaxCheckedSpillReadCells;
+    std::vector<SpillTarget> open_targets;
+    if (checks_targets) {
+      for (std::uint32_t row = read.rect.row_first; row <= read.rect.row_last; ++row) {
+        for (std::uint32_t col = read.rect.col_first; col <= read.rect.col_last; ++col) {
+          Sheet::CellRead target;
+          read_sheet.read_formula_cell(row, col, target);
+          if (!target.is_formula() && target.value().is_blank()) {
+            open_targets.emplace_back(read_sheet, row, col);
+          }
+        }
+      }
+      if (open_targets.empty()) {
+        continue;
+      }
+    }
+
+    CandidateSet* pending = nullptr;
+    CandidateSet* attempted = nullptr;
+    const auto attempted_it = attempted_candidates_.find(read.reader);
+    if (attempted_it != attempted_candidates_.end()) {
+      attempted = &attempted_it->second;
+    }
+    for (const auto& [producer, static_potential] : engine_.potential_spill_producers_by_sheet_[read.sheet_id]) {
+      // A spill extends only down and right, so an anchor past either last coordinate cannot intersect the read.
+      if (producer.row > read.rect.row_last || producer.col > read.rect.col_last) {
+        continue;
+      }
+      const CellNodeId candidate = producer;
+      if (checks_targets && std::none_of(open_targets.begin(), open_targets.end(),
+                                         [candidate](const SpillTarget& t) { return t.reachable_from(candidate); })) {
+        continue;
+      }
+      if (log_.commit_ordinal(producer).has_value()) {
+        // A producer committed in this wave is covered by spill-footprint reconciliation.
+        continue;
+      }
+      if (closure.count(producer) != 0U) {
+        // A producer already in the closure was expanded by the ordinary BFS.
+        continue;
+      }
+      if (attempted != nullptr && attempted->count(producer) != 0U) {
+        continue;
+      }
+      if (!engine_.is_admissible_potential_spill_producer_locked(workbook_, registry, producer, static_potential,
+                                                                 potential_arena)) {
+        continue;
+      }
+      if (pending == nullptr) {
+        pending = &pending_candidates_[read.reader];
+      }
+      if (pending->insert(producer).second) {
+        stale_.push_back(read.reader);
+      }
+    }
+    // Drop an empty entry so the next wave does not visit it.
+    if (pending != nullptr && pending->empty()) {
+      pending_candidates_.erase(read.reader);
+    }
+  }
+}
+
+bool RecalcEngine::DynamicReadPass::seed_pending_candidates(const FunctionRegistry& registry,
+                                                            std::unordered_set<CellNodeId, CellNodeIdHash>& closure,
+                                                            std::vector<CellNodeId>& bfs_queue) {
+  bool expanded = false;
+  Arena potential_arena;
+  for (auto pending_it = pending_candidates_.begin(); pending_it != pending_candidates_.end();) {
+    const CellNodeId reader = pending_it->first;
+    if (closure.count(reader) == 0U) {
+      ++pending_it;
+      continue;
+    }
+    CandidateSet& attempted = attempted_candidates_[reader];
+    for (const CellNodeId producer : pending_it->second) {
+      attempted.insert(producer);
+      if (producer.sheet_id >= engine_.potential_spill_producers_by_sheet_.size()) {
+        continue;
+      }
+      const auto candidate_it = engine_.potential_spill_producers_by_sheet_[producer.sheet_id].find(producer);
+      if (candidate_it == engine_.potential_spill_producers_by_sheet_[producer.sheet_id].end()) {
+        continue;
+      }
+      if (!engine_.is_admissible_potential_spill_producer_locked(workbook_, registry, producer, candidate_it->second,
+                                                                 potential_arena)) {
+        continue;
+      }
+      if (closure.insert(producer).second) {
+        bfs_queue.push_back(producer);
+        expanded = true;
+      }
+    }
+    pending_it = pending_candidates_.erase(pending_it);
+  }
+
+  // An attempted pair remains a temporary seed for every later wave of this
+  // partial call. A producer can be clean when first admitted, then become
+  // dirty after a compact-range watcher learns its spill footprint. Keeping
+  // the seed lets the next closure expand through that producer's authored
+  // dependencies without rediscovering the pair or adding a speculative
+  // graph edge. Revalidation removes candidates that were rewritten away.
+  for (auto attempted_it = attempted_candidates_.begin(); attempted_it != attempted_candidates_.end();) {
+    if (closure.count(attempted_it->first) == 0U) {
+      ++attempted_it;
+      continue;
+    }
+    CandidateSet& attempted = attempted_it->second;
+    for (auto producer_it = attempted.begin(); producer_it != attempted.end();) {
+      const CellNodeId producer = *producer_it;
+      if (producer.sheet_id >= engine_.potential_spill_producers_by_sheet_.size()) {
+        producer_it = attempted.erase(producer_it);
+        continue;
+      }
+      const auto candidate_it = engine_.potential_spill_producers_by_sheet_[producer.sheet_id].find(producer);
+      if (candidate_it == engine_.potential_spill_producers_by_sheet_[producer.sheet_id].end() ||
+          !engine_.is_admissible_potential_spill_producer_locked(workbook_, registry, producer, candidate_it->second,
+                                                                 potential_arena)) {
+        producer_it = attempted.erase(producer_it);
+        continue;
+      }
+      if (closure.insert(producer).second) {
+        bfs_queue.push_back(producer);
+        expanded = true;
+      }
+      ++producer_it;
+    }
+    if (attempted.empty()) {
+      attempted_it = attempted_candidates_.erase(attempted_it);
+    } else {
+      ++attempted_it;
+    }
+  }
+  return expanded;
+}
+
 void RecalcEngine::DynamicReadPass::mark_stale_dirty() {
   for (const CellNodeId reader : stale_) {
     engine_.dirty_.mark(reader);
   }
 }
 
-void RecalcEngine::commit_unresolved_cycle_locked(Workbook& workbook, const std::vector<CellNodeId>& component,
-                                                  DynamicReadPass& dynamic, SpillReleaseCallback release_callback,
-                                                  void* release_user_data, RecalcStats& stats) {
+void RecalcEngine::commit_unresolved_cycle_locked(const SerialEvalPass& pass,
+                                                  const std::vector<CellNodeId>& component) {
   // Excel shows a warning and leaves the cells as they were; with no UI to
   // host that banner Formulon surfaces #REF!, keeping Excel's last value
   // only for a cycle through an OFFSET / INDIRECT read.
   const bool dynamic_cycle = closes_through_dynamic_edge(component, graph_);
-  const std::uint64_t ordinal = dynamic.next_ordinal();
+  const std::uint64_t ordinal = pass.dynamic.next_ordinal();
   if (dynamic_cycle) {
-    dynamic.log().restore_prior_values(workbook, component);
+    pass.dynamic.log().restore_prior_values(pass.workbook, component);
   }
   for (const CellNodeId c : component) {
-    if (c.sheet_id >= workbook.sheet_count()) {
+    if (c.sheet_id >= pass.workbook.sheet_count()) {
       continue;  // A virtual range node.
     }
     if (!dynamic_cycle) {
-      Sheet& sheet = workbook.sheet(c.sheet_id);
-      SpillCommitter committer(&sheet, c.row, c.col, release_callback, release_user_data);
+      Sheet& sheet = pass.workbook.sheet(c.sheet_id);
+      SpillCommitter committer(&sheet, c.row, c.col, pass.release_callback, pass.release_user_data);
       sheet.set_cell_cached_value(c.row, c.col, committer.commit(Value::error(ErrorCode::Ref)));
     }
-    dynamic.log().note_commit(c, ordinal);
-    ++stats.cycle_cells;
+    pass.dynamic.log().note_commit(c, ordinal);
+    ++pass.stats.cycle_cells;
+  }
+}
+
+Expected<void, Error> RecalcEngine::evaluate_formula_cell_locked(const SerialEvalPass& pass, CellNodeId cell) {
+  if (cell.sheet_id >= pass.workbook.sheet_count()) {
+    return Expected<void, Error>::Ok();
+  }
+  Sheet& sheet = pass.workbook.sheet(cell.sheet_id);
+  Cell staged;
+  if (!stage_formula_cell(sheet, cell.row, cell.col, staged)) {
+    // The dep graph may carry pure-input cells (read-only literals that
+    // someone reads via `add_dependency`). They have nothing to evaluate.
+    return Expected<void, Error>::Ok();
+  }
+  // Reset the per-pass arena before each evaluate so the bump allocator
+  // does not grow without bound across cells. Both result shapes
+  // already survive this reset:
+  //   * Array results are deep-copied into sheet-owned storage by
+  //     `Sheet::commit_spill` (driven by
+  //     `EvalContext::dispatch_array_result`), keeping the spill table
+  //     independent of the arena.
+  //   * Scalar Text results are deep-copied into the destination cell's
+  //     `Cell::cached_text_owned` by `Sheet::set_cell_cached_value` on
+  //     the write below, so the cached `string_view` does not dangle
+  //     when the next cell's evaluation resets the arena.
+  arena_->reset();
+  EvaluateCellOptions opts;
+  opts.spill_release_callback = pass.release_callback;
+  opts.spill_release_user_data = pass.release_user_data;
+  const std::uint64_t ordinal = pass.dynamic.next_ordinal();
+  pass.dynamic.log().observe(cell, ordinal, opts, &sheet);
+  Value result =
+      evaluate_cell_for_recalc(pass.workbook, sheet, staged, cell.row, cell.col, pass.registry, *arena_, opts);
+  pass.dynamic.log().end();
+  if (arena_->exhausted()) {
+    return make_error(FormulonErrorCode::kOutOfMemory, pass.oom_message);
+  }
+  sheet.set_cell_cached_value(cell.row, cell.col, result);
+  pass.dynamic.log().note_commit(cell, ordinal);
+  ++pass.stats.cells_evaluated;
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> RecalcEngine::evaluate_cyclic_component_locked(const SerialEvalPass& pass,
+                                                                     const std::vector<CellNodeId>& component,
+                                                                     const char* iterative_oom_message) {
+  const std::size_t sheet_count = pass.workbook.sheet_count();
+  // Evaluation glue for the read-ordered settle (iterative calc off)
+  // and the solver (on). `evaluate_with` mirrors the singleton path's
+  // evaluator glue: parse on the fly, dispatch through `evaluate()`,
+  // fold dynamic-array spills back into a scalar anchor. The `commit`
+  // lambda writes the new value into the cell store so the next
+  // evaluation reads the freshest value back.
+  // Hoisted out of `evaluate_one` so a staged formula's bytes stay live
+  // exactly as long as the arena contents of the same call: a string
+  // literal inside the formula surfaces in the returned Value as a view
+  // into this buffer, and the solver consumes each result before asking
+  // for the next one (which resets the arena).
+  Cell staged;
+  const std::uint64_t component_ordinal = pass.dynamic.next_ordinal();
+  auto evaluate_with = [&](CellNodeId c, EvalState* observer) -> Value {
+    if (c.sheet_id >= sheet_count) {
+      return Value::error(ErrorCode::Ref);
+    }
+    Sheet& sheet = pass.workbook.sheet(c.sheet_id);
+    if (!stage_formula_cell(sheet, c.row, c.col, staged)) {
+      // No formula text: nothing to evaluate. Treat as Blank so the
+      // solver still has a value to compare against — this happens
+      // only on logic bugs but we degrade gracefully.
+      return Value::blank();
+    }
+    // Reset the bump arena per-evaluation. The previous iteration's
+    // committed Text scalars survive this reset because
+    // `Sheet::set_cell_cached_value` deep-copies Text payloads into
+    // each cell's own `cached_text_owned` storage; Array results are
+    // similarly deep-copied into `SpillRegion::owned_strings` by
+    // `Sheet::commit_spill`.
+    arena_->reset();
+    EvaluateCellOptions opts;
+    opts.spill_release_callback = pass.release_callback;
+    opts.spill_release_user_data = pass.release_user_data;
+    opts.read_observer = observer;
+    pass.dynamic.log().observe(c, component_ordinal, opts, nullptr);
+    pass.dynamic.log().note_iterative_member(c, component_ordinal);
+    Value result = evaluate_cell_for_recalc(pass.workbook, sheet, staged, c.row, c.col, pass.registry, *arena_, opts);
+    pass.dynamic.log().end();
+    return result;
+  };
+  auto evaluate_one = [&](CellNodeId c) { return evaluate_with(c, nullptr); };
+  auto commit = [&](CellNodeId c, Value v) {
+    if (c.sheet_id >= sheet_count) {
+      return;
+    }
+    Sheet& sheet = pass.workbook.sheet(c.sheet_id);
+    sheet.set_cell_cached_value(c.row, c.col, v);
+    pass.dynamic.log().note_commit(c, component_ordinal);
+  };
+
+  const std::vector<CellNodeId> cells = cells_of_component(component);
+  if (!iterative_.enabled) {
+    // Excel judges circularity by what evaluation reads, so only a cycle
+    // that reads back into itself is one. A cycle through an OFFSET /
+    // INDIRECT read keeps its own treatment.
+    const bool settled = !closes_through_dynamic_edge(component, graph_) &&
+                         settle_component_by_reads(pass.workbook, cells, evaluate_with, commit);
+    if (arena_->exhausted()) {
+      return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during recalc");
+    }
+    if (settled) {
+      pass.stats.cells_evaluated += static_cast<std::uint32_t>(cells.size());
+      return Expected<void, Error>::Ok();
+    }
+    commit_unresolved_cycle_locked(pass, component);
+    return Expected<void, Error>::Ok();
+  }
+  // A reader first evaluated as a singleton in this recalc has already
+  // stepped once; the solver starts from the value it showed before.
+  pass.dynamic.log().restore_prior_values(pass.workbook, cells);
+  prepare_iterative_component_seeds(pass.workbook, cells);
+  const IterativeOutcome outcome =
+      run_iterative_solve(cells, iterative_, evaluate_one, commit, progress_cb_, progress_user_data_);
+  if (arena_->exhausted()) {
+    return make_error(FormulonErrorCode::kOutOfMemory, iterative_oom_message);
   }
+  if (outcome.converged) {
+    // Solver wrote the converged values into the cell store; count
+    // each member as evaluated (singleton-style accounting) plus
+    // tagged as iterative.
+    pass.stats.cells_evaluated += static_cast<std::uint32_t>(cells.size());
+    pass.stats.iterative_cells += static_cast<std::uint32_t>(cells.size());
+  } else {
+    // Iteration-limit exhaustion or callback-driven abort leaves the
+    // last-iteration values in place. The user-visible failure mode is
+    // still "the cycle did not resolve", so we
+    // count the members in `cycle_cells` to mirror the
+    // disabled-iterative-calc accounting.
+    // A later pass can continue from the retained approximation.
+    pass.stats.cycle_cells += static_cast<std::uint32_t>(cells.size());
+  }
+  return Expected<void, Error>::Ok();
 }
 
 bool RecalcEngine::drop_dynamic_only_cycles_locked(const std::vector<std::vector<CellNodeId>>& sccs) {
@@ -452,6 +794,12 @@ void RecalcEngine::register_formula(CellNodeId cell, const parser::AstNode& ast,
 }
 
 void RecalcEngine::register_formula_locked(CellNodeId cell, const parser::AstNode& ast, const Workbook& workbook) {
+  // Keep this separate from graph node presence: a syntactically valid
+  // formula that currently references a missing sheet can have no static
+  // dependency edges at all, yet must be reconsidered when that sheet is
+  // appended or renamed into existence.
+  has_ever_registered_formula_ = true;
+
   // A rewrite can change a producer's result shape. Remove its previous
   // candidate-index membership before replacing graph/volatile metadata.
   update_potential_spill_producer_locked(cell, SpillPotential::kNever);
@@ -567,7 +915,8 @@ void RecalcEngine::mark_dirty_locked(CellNodeId cell) {
 }
 
 void RecalcEngine::mark_range_dependents_dirty_locked(CellNodeId cell) {
-  range_dependencies_.for_each_owner_covering(cell, [this](CellNodeId owner) { dirty_.mark(owner); });
+  range_dependencies_.for_each_new_owner_covering(cell, dirty_.generation(),
+                                                  [this](CellNodeId owner) { dirty_.mark(owner); });
 }
 
 void RecalcEngine::reset_graph_locked() {
@@ -595,6 +944,36 @@ void RecalcEngine::update_potential_spill_producer_locked(CellNodeId cell, Spill
   }
 }
 
+bool RecalcEngine::is_admissible_potential_spill_producer_locked(const Workbook& workbook,
+                                                                 const FunctionRegistry& registry, CellNodeId producer,
+                                                                 SpillPotential static_potential,
+                                                                 Arena& potential_arena) const {
+  if (producer.sheet_id >= workbook.sheet_count()) {
+    return false;
+  }
+  SpillPotential candidate = static_potential;
+  if (candidate == SpillPotential::kNeedsRegistry) {
+    const Sheet& producer_sheet = workbook.sheet(producer.sheet_id);
+    const Cell* producer_cell = producer_sheet.cell_at(producer.row, producer.col);
+    if (producer_cell == nullptr || producer_cell->formula_text.empty()) {
+      return false;
+    }
+    std::string_view formula = producer_cell->formula_text;
+    if (!formula.empty() && formula.front() == '=') {
+      formula.remove_prefix(1);
+    }
+    potential_arena.reset();
+    parser::AstNode* producer_ast = parse_formula_entry(formula, potential_arena);
+    if (producer_ast == nullptr) {
+      // A stale/unparseable candidate cannot commit a spill; its cell will
+      // surface the ordinary formula error if it is dirty.
+      return false;
+    }
+    candidate = spill_potential(*producer_ast, registry);
+  }
+  return candidate != SpillPotential::kNever;
+}
+
 Expected<RecalcStats, Error> RecalcEngine::recalc(Workbook& workbook, const FunctionRegistry& registry) {
   // Same-thread re-entry would deadlock on the non-recursive `mutex_`.
   // The shared `g_in_recalc` flag (also tracked by `recalc_parallel_impl`)
@@ -615,13 +994,10 @@ Expected<RecalcStats, Error> RecalcEngine::recalc_locked(Workbook& workbook, con
   RecalcStats stats;
   SpillReleaseQueue release_queue{&workbook};
   const SpillReleaseCallback release_callback = &queue_spill_release;
-  std::size_t release_waves = 0U;
-  std::size_t dependency_waves = 0U;
-  std::size_t no_progress_waves = 0U;
-  std::vector<BlockedSpillState> previous_release_state;
-  std::vector<CellNodeId> previous_release_targets;
-  bool have_previous_release_state = false;
+  SpillWaveBudget wave_budget;
   DynamicReadPass dynamic(*this, workbook);
+  const SerialEvalPass pass{
+      workbook, registry, dynamic, release_callback, &release_queue, stats, "evaluation arena exhausted during recalc"};
 
   // Per-wave locals begin after this label and are destroyed on the backward
   // jump, while the counters, queue, and accumulated stats above persist.
@@ -677,11 +1053,6 @@ Expected<RecalcStats, Error> RecalcEngine::recalc_locked(Workbook& workbook, con
   std::vector<std::vector<CellNodeId>> sccs = graph_.tarjan_scc_subset(dirty_nodes);
   dynamic.settle_sccs(sccs, dirty_nodes);
 
-  // Index sheet pointers once so we can resolve `CellNodeId::sheet_id` to
-  // a `Sheet*` without a per-cell lookup. Workbook sheet count is small
-  // (typically <= a few dozen).
-  const std::size_t sheet_count = workbook.sheet_count();
-
   // ---- Phase 4: evaluate every dirty SCC. ----
   // Also track which dirty cells have been visited via the SCC walk, so a
   // final sweep can pick up dirty cells with no graph edges (e.g. a
@@ -711,138 +1082,15 @@ Expected<RecalcStats, Error> RecalcEngine::recalc_locked(Workbook& workbook, con
         visited_in_sccs.insert(c);
       }
 
-      // Evaluation glue for the read-ordered settle (iterative calc off)
-      // and the solver (on). `evaluate_with` mirrors the singleton path's
-      // evaluator glue: parse on the fly, dispatch through `evaluate()`,
-      // fold dynamic-array spills back into a scalar anchor. The `commit`
-      // lambda writes the new value into the cell store so the next
-      // evaluation reads the freshest value back.
-      // Hoisted out of `evaluate_one` so a staged formula's bytes stay live
-      // exactly as long as the arena contents of the same call: a string
-      // literal inside the formula surfaces in the returned Value as a view
-      // into this buffer, and the solver consumes each result before asking
-      // for the next one (which resets the arena).
-      Cell staged;
-      const std::uint64_t component_ordinal = dynamic.next_ordinal();
-      auto evaluate_with = [&](CellNodeId c, EvalState* observer) -> Value {
-        if (c.sheet_id >= sheet_count) {
-          return Value::error(ErrorCode::Ref);
-        }
-        Sheet& sheet = workbook.sheet(c.sheet_id);
-        if (!stage_formula_cell(sheet, c.row, c.col, staged)) {
-          // No formula text: nothing to evaluate. Treat as Blank so the
-          // solver still has a value to compare against — this happens
-          // only on logic bugs but we degrade gracefully.
-          return Value::blank();
-        }
-        // Reset the bump arena per-evaluation. The previous iteration's
-        // committed Text scalars survive this reset because
-        // `Sheet::set_cell_cached_value` deep-copies Text payloads into
-        // each cell's own `cached_text_owned` storage; Array results are
-        // similarly deep-copied into `SpillRegion::owned_strings` by
-        // `Sheet::commit_spill`.
-        arena_->reset();
-        EvaluateCellOptions opts;
-        opts.spill_release_callback = release_callback;
-        opts.spill_release_user_data = &release_queue;
-        opts.read_observer = observer;
-        dynamic.log().observe(c, component_ordinal, opts, nullptr);
-        dynamic.log().note_iterative_member(c, component_ordinal);
-        Value result = evaluate_cell_for_recalc(workbook, sheet, staged, c.row, c.col, registry, *arena_, opts);
-        dynamic.log().end();
-        return result;
-      };
-      auto evaluate_one = [&](CellNodeId c) { return evaluate_with(c, nullptr); };
-      auto commit = [&](CellNodeId c, Value v) {
-        if (c.sheet_id >= sheet_count) {
-          return;
-        }
-        Sheet& sheet = workbook.sheet(c.sheet_id);
-        sheet.set_cell_cached_value(c.row, c.col, v);
-        dynamic.log().note_commit(c, component_ordinal);
-      };
-
-      const std::vector<CellNodeId> cells = cells_of_component(component);
-      if (!iterative_.enabled) {
-        // Excel judges circularity by what evaluation reads, so only a cycle
-        // that reads back into itself is one. A cycle through an OFFSET /
-        // INDIRECT read keeps its own treatment.
-        const bool settled = !closes_through_dynamic_edge(component, graph_) &&
-                             settle_component_by_reads(workbook, cells, evaluate_with, commit);
-        if (arena_->exhausted()) {
-          return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during recalc");
-        }
-        if (settled) {
-          stats.cells_evaluated += static_cast<std::uint32_t>(cells.size());
-          continue;
-        }
-        commit_unresolved_cycle_locked(workbook, component, dynamic, release_callback, &release_queue, stats);
-        continue;
-      }
-      // A reader first evaluated as a singleton in this recalc has already
-      // stepped once; the solver starts from the value it showed before.
-      dynamic.log().restore_prior_values(workbook, cells);
-      const IterativeOutcome outcome =
-          run_iterative_solve(cells, iterative_, evaluate_one, commit, progress_cb_, progress_user_data_);
-      if (arena_->exhausted()) {
-        return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during iterative recalc");
-      }
-      if (outcome.converged) {
-        // Solver wrote the converged values into the cell store; count
-        // each member as evaluated (singleton-style accounting) plus
-        // tagged as iterative.
-        stats.cells_evaluated += static_cast<std::uint32_t>(cells.size());
-        stats.iterative_cells += static_cast<std::uint32_t>(cells.size());
-      } else {
-        // Iteration-limit exhaustion or callback-driven abort leaves the
-        // last-iteration values in place. The user-visible failure mode is
-        // still "the cycle did not resolve", so we
-        // count the members in `cycle_cells` to mirror the
-        // disabled-iterative-calc accounting.
-        // A later pass can continue from the retained approximation.
-        stats.cycle_cells += static_cast<std::uint32_t>(cells.size());
-      }
+      RETURN_IF_ERROR(
+          evaluate_cyclic_component_locked(pass, component, "evaluation arena exhausted during iterative recalc"));
       continue;
     }
 
     // Plain singleton: evaluate the cell.
     const CellNodeId only = component.front();
     visited_in_sccs.insert(only);
-    if (only.sheet_id >= sheet_count) {
-      continue;
-    }
-    Sheet& sheet = workbook.sheet(only.sheet_id);
-    Cell staged;
-    if (!stage_formula_cell(sheet, only.row, only.col, staged)) {
-      // The dep graph may carry pure-input cells (read-only literals that
-      // someone reads via `add_dependency`). They have nothing to evaluate.
-      continue;
-    }
-    // Reset the per-pass arena before each evaluate so the bump allocator
-    // does not grow without bound across cells. Both result shapes
-    // already survive this reset:
-    //   * Array results are deep-copied into sheet-owned storage by
-    //     `Sheet::commit_spill` (driven by
-    //     `EvalContext::dispatch_array_result`), keeping the spill table
-    //     independent of the arena.
-    //   * Scalar Text results are deep-copied into the destination cell's
-    //     `Cell::cached_text_owned` by `Sheet::set_cell_cached_value` on
-    //     the write below, so the cached `string_view` does not dangle
-    //     when the next cell's evaluation resets the arena.
-    arena_->reset();
-    EvaluateCellOptions opts;
-    opts.spill_release_callback = release_callback;
-    opts.spill_release_user_data = &release_queue;
-    const std::uint64_t ordinal = dynamic.next_ordinal();
-    dynamic.log().observe(only, ordinal, opts, &sheet);
-    Value result = evaluate_cell_for_recalc(workbook, sheet, staged, only.row, only.col, registry, *arena_, opts);
-    dynamic.log().end();
-    if (arena_->exhausted()) {
-      return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during recalc");
-    }
-    sheet.set_cell_cached_value(only.row, only.col, result);
-    dynamic.log().note_commit(only, ordinal);
-    ++stats.cells_evaluated;
+    RETURN_IF_ERROR(evaluate_formula_cell_locked(pass, only));
   }
 
   // ---- Phase 4b: defensive pickup for dirty cells not visited by Tarjan. ----
@@ -855,28 +1103,7 @@ Expected<RecalcStats, Error> RecalcEngine::recalc_locked(Workbook& workbook, con
     }
   });
   for (CellNodeId c : standalone_dirty) {
-    if (c.sheet_id >= sheet_count) {
-      continue;
-    }
-    Sheet& sheet = workbook.sheet(c.sheet_id);
-    Cell staged;
-    if (!stage_formula_cell(sheet, c.row, c.col, staged)) {
-      continue;
-    }
-    arena_->reset();
-    EvaluateCellOptions opts;
-    opts.spill_release_callback = release_callback;
-    opts.spill_release_user_data = &release_queue;
-    const std::uint64_t ordinal = dynamic.next_ordinal();
-    dynamic.log().observe(c, ordinal, opts, &sheet);
-    Value result = evaluate_cell_for_recalc(workbook, sheet, staged, c.row, c.col, registry, *arena_, opts);
-    dynamic.log().end();
-    if (arena_->exhausted()) {
-      return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during recalc");
-    }
-    sheet.set_cell_cached_value(c.row, c.col, result);
-    dynamic.log().note_commit(c, ordinal);
-    ++stats.cells_evaluated;
+    RETURN_IF_ERROR(evaluate_formula_cell_locked(pass, c));
   }
 
   // Reconcile compact-range -> spill-producer edges only after every cell in
@@ -890,7 +1117,7 @@ Expected<RecalcStats, Error> RecalcEngine::recalc_locked(Workbook& workbook, con
   const bool dynamic_retry = !dynamic.end_wave(nullptr).empty();
   const bool dependency_retry = !dependency_delta.added.empty() || dynamic_retry;
   if (dependency_retry) {
-    ++dependency_waves;
+    wave_budget.count_dependency_wave();
     for (const DepGraph::Edge& edge : dependency_delta.added) {
       dirty_.mark(edge.first);
     }
@@ -901,22 +1128,9 @@ Expected<RecalcStats, Error> RecalcEngine::recalc_locked(Workbook& workbook, con
   // of losing them when this pass clears its dirty set.
   const std::vector<CellNodeId> released = release_queue.take();
   if (!released.empty() || dependency_retry) {
-    ++release_waves;
-    if (!released.empty()) {
-      const std::vector<BlockedSpillState> release_state = snapshot_blocked_spills(workbook);
-      const std::vector<CellNodeId> release_targets = canonical_release_targets(released);
-      if (have_previous_release_state && release_state == previous_release_state &&
-          release_targets == previous_release_targets) {
-        ++no_progress_waves;
-      } else {
-        no_progress_waves = 0U;
-      }
-      previous_release_state = release_state;
-      previous_release_targets = release_targets;
-      have_previous_release_state = true;
-    }
-    if (release_waves > kMaxSpillReleaseWaves || dependency_waves > kMaxSpillReleaseWaves ||
-        (!released.empty() && no_progress_waves >= kMaxNoProgressSpillWaves)) {
+    wave_budget.count_release_wave();
+    wave_budget.observe_release(workbook, released);
+    if (wave_budget.exceeded(!released.empty())) {
       // Do not recurse through an unbounded chain of release waves. Preserve
       // the existing dirty set (including unrelated work) and keep the
       // release targets dirty for a caller retry after an external mutation.
@@ -937,6 +1151,7 @@ Expected<RecalcStats, Error> RecalcEngine::recalc_locked(Workbook& workbook, con
 
   // ---- Phase 5: clear the dirty set. ----
   dirty_.clear();
+  disabled_cycle_refs_pending_ = false;
   return stats;
 }
 
@@ -959,13 +1174,15 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
   RecalcStats stats;
   SpillReleaseQueue release_queue{&workbook};
   const SpillReleaseCallback release_callback = &queue_spill_release;
-  std::size_t release_waves = 0U;
-  std::size_t dependency_waves = 0U;
-  std::size_t no_progress_waves = 0U;
-  std::vector<BlockedSpillState> previous_release_state;
-  std::vector<CellNodeId> previous_release_targets;
-  bool have_previous_release_state = false;
+  SpillWaveBudget wave_budget;
   DynamicReadPass dynamic(*this, workbook);
+  const SerialEvalPass pass{workbook,
+                            registry,
+                            dynamic,
+                            release_callback,
+                            &release_queue,
+                            stats,
+                            "evaluation arena exhausted during partial recalc"};
 
   // ---- Phase 0: validate the viewport. ----
   // Empty viewport — collapsed row / column range, or unknown sheet —
@@ -1050,20 +1267,52 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
     }
   }
 
-  // Before the first committed spill exists there is no derived edge from a
-  // compact range watcher to its producer. A viewport containing that
-  // watcher must nevertheless pull in every indexed potential producer on
-  // the referenced sheet whose down/right geometry could intersect it. Clean
-  // candidates enter the closure so their dependencies can participate in
-  // graph expansion; only dirty members of the resulting closure evaluate.
-  // Each authored range entry is processed independently, and newly reached
-  // watchers are expanded in the same fixed-point loop.
+  // Pull indexed potential spill producers into the closure: no derived edge exists before the first commit.
   bool expanded_potential_producers = true;
   std::unordered_set<std::uint32_t> processed_range_entries;
   processed_range_entries.reserve(range_dependencies_.distinct_range_count());
   Arena potential_arena;
+
+  // The potential-producer index ignores the registry, so re-classify each candidate against it.
+  const auto is_admissible_potential_producer = [&](CellNodeId producer, SpillPotential static_potential) {
+    return is_admissible_potential_spill_producer_locked(workbook, registry, producer, static_potential,
+                                                         potential_arena);
+  };
+
+  const auto enqueue_potential_producer = [&](CellNodeId producer, SpillPotential static_potential) {
+    if (!is_admissible_potential_producer(producer, static_potential)) {
+      return;
+    }
+    if (closure.insert(producer).second) {
+      expanded_potential_producers = true;
+      bfs_queue.push_back(producer);
+    }
+  };
+
+  // A phantom spill coordinate has no edge to its uncommitted anchor; scan for producers above-left.
+  std::size_t potential_coordinate_head = 0;
   while (expanded_potential_producers) {
     expanded_potential_producers = false;
+    if (dynamic.seed_pending_candidates(registry, closure, bfs_queue)) {
+      expanded_potential_producers = true;
+    }
+    while (potential_coordinate_head < bfs_queue.size()) {
+      const CellNodeId current = bfs_queue[potential_coordinate_head++];
+      if (current.sheet_id >= sheet_count || current.sheet_id >= potential_spill_producers_by_sheet_.size()) {
+        continue;
+      }
+      const Cell* current_cell = workbook.sheet(current.sheet_id).cell_at(current.row, current.col);
+      if (blocks_spill(current_cell)) {
+        continue;
+      }
+      const SpillTarget target(workbook.sheet(current.sheet_id), current.row, current.col);
+      for (const auto& [producer, static_potential] : potential_spill_producers_by_sheet_[current.sheet_id]) {
+        if (producer.sheet_id != current.sheet_id || !target.reachable_from(producer)) {
+          continue;
+        }
+        enqueue_potential_producer(producer, static_potential);
+      }
+    }
     range_dependencies_.for_each_distinct_range(
         [&](std::uint32_t range_id, const CellRangeDependency& range, const std::vector<CellNodeId>& owners) {
           if (range.sheet_id >= sheet_count || range.sheet_id >= potential_spill_producers_by_sheet_.size()) {
@@ -1079,39 +1328,11 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
           }
           processed_range_entries.insert(range_id);
           for (const auto& [producer, static_potential] : potential_spill_producers_by_sheet_[range.sheet_id]) {
-            // Excel spills only down and right from the anchor. The producer may
-            // begin before the watcher's first row/column, but an anchor beyond
-            // either inclusive last bound cannot reach the compact rectangle.
+            // A spill extends only down and right, so an anchor past either last bound cannot reach the range.
             if (producer.row > range.row_last || producer.col > range.col_last) {
               continue;
             }
-            SpillPotential candidate = static_potential;
-            if (candidate == SpillPotential::kNeedsRegistry) {
-              const Sheet& producer_sheet = workbook.sheet(producer.sheet_id);
-              const Cell* producer_cell = producer_sheet.cell_at(producer.row, producer.col);
-              if (producer_cell == nullptr || producer_cell->formula_text.empty()) {
-                continue;
-              }
-              std::string_view formula = producer_cell->formula_text;
-              if (!formula.empty() && formula.front() == '=') {
-                formula.remove_prefix(1);
-              }
-              potential_arena.reset();
-              parser::AstNode* producer_ast = parser::parse_strict(formula, potential_arena);
-              if (producer_ast == nullptr) {
-                // A stale/unparseable candidate cannot commit a spill; its cell
-                // will surface the ordinary formula error if it is dirty.
-                continue;
-              }
-              candidate = spill_potential(*producer_ast, registry);
-            }
-            if (candidate == SpillPotential::kNever) {
-              continue;
-            }
-            if (closure.insert(producer).second) {
-              expanded_potential_producers = true;
-              bfs_queue.push_back(producer);
-            }
+            enqueue_potential_producer(producer, static_potential);
           }
         });
     while (bfs_head < bfs_queue.size()) {
@@ -1217,72 +1438,8 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
         visited_in_sccs.insert(c);
       }
 
-      // Hoisted for the same reason as the full-recalc solver above: the
-      // staged bytes have to outlive each `evaluate_one` call, because a
-      // string literal in the formula surfaces in the result as a view
-      // into them.
-      Cell staged;
-      const std::uint64_t component_ordinal = dynamic.next_ordinal();
-      auto evaluate_with = [&](CellNodeId c, EvalState* observer) -> Value {
-        if (c.sheet_id >= sheet_count) {
-          return Value::error(ErrorCode::Ref);
-        }
-        Sheet& sheet = workbook.sheet(c.sheet_id);
-        if (!stage_formula_cell(sheet, c.row, c.col, staged)) {
-          return Value::blank();
-        }
-        arena_->reset();
-        EvaluateCellOptions opts;
-        opts.spill_release_callback = release_callback;
-        opts.spill_release_user_data = &release_queue;
-        opts.read_observer = observer;
-        dynamic.log().observe(c, component_ordinal, opts, nullptr);
-        dynamic.log().note_iterative_member(c, component_ordinal);
-        Value result = evaluate_cell_for_recalc(workbook, sheet, staged, c.row, c.col, registry, *arena_, opts);
-        dynamic.log().end();
-        return result;
-      };
-      auto evaluate_one = [&](CellNodeId c) { return evaluate_with(c, nullptr); };
-      auto commit = [&](CellNodeId c, Value v) {
-        if (c.sheet_id >= sheet_count) {
-          return;
-        }
-        Sheet& sheet = workbook.sheet(c.sheet_id);
-        sheet.set_cell_cached_value(c.row, c.col, v);
-        dynamic.log().note_commit(c, component_ordinal);
-      };
-
-      const std::vector<CellNodeId> cells = cells_of_component(component);
-      if (!iterative_.enabled) {
-        // Excel judges circularity by what evaluation reads, so only a cycle
-        // that reads back into itself is one. A cycle through an OFFSET /
-        // INDIRECT read keeps its own treatment.
-        const bool settled = !closes_through_dynamic_edge(component, graph_) &&
-                             settle_component_by_reads(workbook, cells, evaluate_with, commit);
-        if (arena_->exhausted()) {
-          return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during recalc");
-        }
-        if (settled) {
-          stats.cells_evaluated += static_cast<std::uint32_t>(cells.size());
-          continue;
-        }
-        commit_unresolved_cycle_locked(workbook, component, dynamic, release_callback, &release_queue, stats);
-        continue;
-      }
-      dynamic.log().restore_prior_values(workbook, cells);
-      const IterativeOutcome outcome =
-          run_iterative_solve(cells, iterative_, evaluate_one, commit, progress_cb_, progress_user_data_);
-      if (arena_->exhausted()) {
-        return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during partial recalc");
-      }
-      if (outcome.converged) {
-        stats.cells_evaluated += static_cast<std::uint32_t>(cells.size());
-        stats.iterative_cells += static_cast<std::uint32_t>(cells.size());
-      } else {
-        // A finite iteration budget leaves the solver's final approximation
-        // in place so a later viewport/full pass can resume from it.
-        stats.cycle_cells += static_cast<std::uint32_t>(cells.size());
-      }
+      RETURN_IF_ERROR(
+          evaluate_cyclic_component_locked(pass, component, "evaluation arena exhausted during partial recalc"));
       continue;
     }
 
@@ -1293,28 +1450,7 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
       continue;
     }
     visited_in_sccs.insert(only);
-    if (only.sheet_id >= sheet_count) {
-      continue;
-    }
-    Sheet& sheet = workbook.sheet(only.sheet_id);
-    Cell staged;
-    if (!stage_formula_cell(sheet, only.row, only.col, staged)) {
-      continue;
-    }
-    arena_->reset();
-    EvaluateCellOptions opts;
-    opts.spill_release_callback = release_callback;
-    opts.spill_release_user_data = &release_queue;
-    const std::uint64_t ordinal = dynamic.next_ordinal();
-    dynamic.log().observe(only, ordinal, opts, &sheet);
-    Value result = evaluate_cell_for_recalc(workbook, sheet, staged, only.row, only.col, registry, *arena_, opts);
-    dynamic.log().end();
-    if (arena_->exhausted()) {
-      return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during partial recalc");
-    }
-    sheet.set_cell_cached_value(only.row, only.col, result);
-    dynamic.log().note_commit(only, ordinal);
-    ++stats.cells_evaluated;
+    RETURN_IF_ERROR(evaluate_formula_cell_locked(pass, only));
   }
 
   // ---- Phase 4b: standalone dirty cells inside the closure. ----
@@ -1328,28 +1464,7 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
     }
   });
   for (CellNodeId c : standalone_dirty) {
-    if (c.sheet_id >= sheet_count) {
-      continue;
-    }
-    Sheet& sheet = workbook.sheet(c.sheet_id);
-    Cell staged;
-    if (!stage_formula_cell(sheet, c.row, c.col, staged)) {
-      continue;
-    }
-    arena_->reset();
-    EvaluateCellOptions opts;
-    opts.spill_release_callback = release_callback;
-    opts.spill_release_user_data = &release_queue;
-    const std::uint64_t ordinal = dynamic.next_ordinal();
-    dynamic.log().observe(c, ordinal, opts, &sheet);
-    Value result = evaluate_cell_for_recalc(workbook, sheet, staged, c.row, c.col, registry, *arena_, opts);
-    dynamic.log().end();
-    if (arena_->exhausted()) {
-      return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during partial recalc");
-    }
-    sheet.set_cell_cached_value(c.row, c.col, result);
-    dynamic.log().note_commit(c, ordinal);
-    ++stats.cells_evaluated;
+    RETURN_IF_ERROR(evaluate_formula_cell_locked(pass, c));
   }
 
   // Reconcile globally after this partial wave. A newly discovered
@@ -1366,7 +1481,7 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
   }
   // Judged before the closure is unmarked, so a target this viewport left
   // dirty still reads as unevaluated.
-  const std::vector<CellNodeId>& stale_readers = dynamic.end_wave(&closure);
+  const std::vector<CellNodeId>& stale_readers = dynamic.end_wave(&closure, &registry);
   for (const CellNodeId reader : stale_readers) {
     if (closure.count(reader) != 0U) {
       dependency_retry_in_closure = true;
@@ -1385,6 +1500,18 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
       to_unmark.push_back(c);
     }
   });
+  // Hand dirtiness on to dependents outside the closure so a later pass still reaches them.
+  const auto mark_outside_closure = [&](CellNodeId dependent) {
+    if (closure.count(dependent) == 0U) {
+      dirty_.mark(dependent);
+    }
+  };
+  for (CellNodeId c : to_unmark) {
+    for (CellNodeId dependent : graph_.dependents_of_ref(c)) {
+      mark_outside_closure(dependent);
+    }
+    range_dependencies_.for_each_owner_covering(c, mark_outside_closure);
+  }
   for (CellNodeId c : to_unmark) {
     dirty_.unmark(c);
   }
@@ -1412,24 +1539,13 @@ Expected<RecalcStats, Error> RecalcEngine::partial_recalc_locked(Workbook& workb
     }
     if (release_in_closure || dependency_retry_in_closure) {
       if (!released.empty()) {
-        ++release_waves;
-        const std::vector<BlockedSpillState> release_state = snapshot_blocked_spills(workbook);
-        const std::vector<CellNodeId> release_targets = canonical_release_targets(released);
-        if (have_previous_release_state && release_state == previous_release_state &&
-            release_targets == previous_release_targets) {
-          ++no_progress_waves;
-        } else {
-          no_progress_waves = 0U;
-        }
-        previous_release_state = release_state;
-        previous_release_targets = release_targets;
-        have_previous_release_state = true;
+        wave_budget.count_release_wave();
+        wave_budget.observe_release(workbook, released);
       }
       if (dependency_retry_in_closure) {
-        ++dependency_waves;
+        wave_budget.count_dependency_wave();
       }
-      if (release_waves > kMaxSpillReleaseWaves || dependency_waves > kMaxSpillReleaseWaves ||
-          (!released.empty() && no_progress_waves >= kMaxNoProgressSpillWaves)) {
+      if (wave_budget.exceeded(!released.empty())) {
         return make_error(FormulonErrorCode::kGraphScheduleFailed, "recalc waves made no progress",
                           "partial spill recovery or dynamic-reference retries exceeded the bounded wave budget");
       }
diff --git a/src/eval/recalc_engine.h b/src/eval/recalc_engine.h
index 3bac4fa77..b386fa334 100644
--- a/src/eval/recalc_engine.h
+++ b/src/eval/recalc_engine.h
@@ -9,9 +9,8 @@
 //   * a `DirtySet` accumulating cells that need to be re-evaluated on the
 //     next pass.
 //
-// The engine itself is single-threaded; the multi-threaded scheduler that
-// will eventually parallelise SCC evaluation lives in a later phase. For
-// now the contract is intentionally narrow:
+// The engine evaluates on the calling thread; the parallel scheduler in
+// `scheduler.cpp` drives the same state through friend access. The contract:
 //
 //   * `register_formula(cell, ast, workbook)` analyses `ast` (via
 //     `extract_deps`) and updates the dep graph + volatile tracker for
@@ -25,12 +24,13 @@
 //     formula text changes.
 //   * `recalc(workbook, registry)` performs an end-to-end incremental
 //     recalc: it seeds the dirty set with volatile cells, BFS-propagates
-//     dirtiness through reverse edges, runs Tarjan SCC over the *full*
-//     graph (so the reverse-topological order is preserved), and evaluates
-//     every dirty SCC in order. Singleton SCCs without a self-loop are
-//     evaluated via the tree walker; SCCs with cycles surface `#REF!` on
-//     every member (until the iterative solver lands in a follow-up
-//     bundle). The dirty set is cleared at the end of the pass.
+//     dirtiness through reverse edges, runs Tarjan SCC over the dirty
+//     induced subgraph (`tarjan_scc_subset`), and evaluates every dirty SCC
+//     in reverse-topological order. Singleton SCCs without a self-loop are
+//     evaluated via the tree walker; a cyclic SCC is settled by what its
+//     members read, or by the iterative solver when iterative calc is
+//     enabled, and otherwise surfaces `#REF!`. The dirty set is cleared at
+//     the end of the pass.
 
 #ifndef FORMULON_EVAL_RECALC_ENGINE_H_
 #define FORMULON_EVAL_RECALC_ENGINE_H_
@@ -203,6 +203,11 @@ class RecalcEngine {
     /// the physical row/column move.
     std::vector<CellNodeId> three_d_span_owners_covering_sheet(std::uint16_t edited_sheet) const;
     const DepGraph& dep_graph() const noexcept;
+    /// True after any formula has been registered, including a formula whose
+    /// current AST has no static dependency edges. This sticky bit lets
+    /// workbook topology edits skip scans on genuinely formula-free sheets
+    /// without mistaking an empty graph for an empty formula registry.
+    bool has_ever_registered_formula() const noexcept;
 
    private:
     friend class RecalcEngine;
@@ -241,13 +246,14 @@ class RecalcEngine {
   ///      regardless of upstream changes.
   ///   2. BFS-propagate dirtiness via `DepGraph::dependents_of` until no new
   ///      cells are added.
-  ///   3. Compute Tarjan SCCs of the entire graph. Tarjan emits leaves
+  ///   3. Compute Tarjan SCCs of the dirty subgraph. Tarjan emits leaves
   ///      first, which is exactly the order the evaluator wants (a cell's
   ///      dependencies are evaluated before the cell itself).
   ///   4. Walk the SCC list and evaluate every component whose intersection
   ///      with the dirty set is non-empty. Singleton SCCs without a
-  ///      self-loop run through the tree walker; cyclic SCCs receive
-  ///      `#REF!` on every member.
+  ///      self-loop run through the tree walker; a cyclic SCC is settled by
+  ///      what its members read, or by the iterative solver when iterative
+  ///      calc is enabled, and otherwise surfaces `#REF!`.
   ///   5. Clear the dirty set.
   ///
   /// Returns `RecalcStats` describing the pass. The engine never propagates
@@ -333,9 +339,18 @@ class RecalcEngine {
   /// spelling for a single pass.
   void set_iterative_options(IterativeOptions opts) noexcept {
     opts.max_iterations = std::min(opts.max_iterations, kMaxIterationsCap);
+    if (!iterative_.enabled && opts.enabled) {
+      disabled_cycle_refs_pending_ = true;
+    }
     iterative_ = opts;
   }
 
+  /// True from the moment iterative calculation is enabled until the next
+  /// full recalculation completes. While set, a cached `#REF!` in a cyclic
+  /// component is the placeholder a disabled-iteration pass stored, and
+  /// `prepare_iterative_component_seeds` resets it to Blank before solving.
+  bool disabled_cycle_refs_pending() const noexcept { return disabled_cycle_refs_pending_; }
+
   /// Returns the active iterative-calc options.
   const IterativeOptions& iterative_options() const noexcept { return iterative_; }
 
@@ -405,6 +420,9 @@ class RecalcEngine {
   void mark_dirty_locked(CellNodeId cell);
   void mark_range_dependents_dirty_locked(CellNodeId cell);
   void reset_graph_locked();
+  bool is_admissible_potential_spill_producer_locked(const Workbook& workbook, const FunctionRegistry& registry,
+                                                     CellNodeId producer, SpillPotential static_potential,
+                                                     Arena& potential_arena) const;
   void update_potential_spill_producer_locked(CellNodeId cell, SpillPotential potential);
   Expected<RecalcStats, Error> recalc_locked(Workbook& workbook, const FunctionRegistry& registry);
   Expected<RecalcStats, Error> partial_recalc_locked(Workbook& workbook, const FunctionRegistry& registry,
@@ -453,34 +471,80 @@ class RecalcEngine {
 
     /// Ends a wave: learns its reads and returns the stale readers (see
     /// `reconcile_dynamic_reads_locked`, which takes `closure`).
-    const std::vector<CellNodeId>& end_wave(const std::unordered_set<CellNodeId, CellNodeIdHash>* closure);
+    const std::vector<CellNodeId>& end_wave(const std::unordered_set<CellNodeId, CellNodeIdHash>* closure,
+                                            const FunctionRegistry* registry = nullptr);
+
+    /// Seeds a partial-recalc closure with candidate spill producers learned
+    /// from a previous dynamic-read wave. The candidate relationship is
+    /// intentionally ephemeral: only the exact spill footprint discovered
+    /// after evaluation is installed in the persistent graph.
+    bool seed_pending_candidates(const FunctionRegistry& registry,
+                                 std::unordered_set<CellNodeId, CellNodeIdHash>& closure,
+                                 std::vector<CellNodeId>& bfs_queue);
 
     /// Marks the readers the last `end_wave` found stale dirty.
     void mark_stale_dirty();
 
    private:
+    using CandidateSet = std::unordered_set<CellNodeId, CellNodeIdHash>;
+    using CandidatePairs = std::unordered_map<CellNodeId, CandidateSet, CellNodeIdHash>;
+
+    /// Finds indexed potential producers that could cover the runtime reads
+    /// observed in this partial wave. This deliberately does not add graph
+    /// edges: each pair is attempted once, retained as a temporary closure
+    /// seed for later waves of this partial call, and learned by the normal
+    /// exact-footprint pass only when a real spill commits.
+    void discover_pending_candidates(const FunctionRegistry& registry,
+                                     const std::unordered_set<CellNodeId, CellNodeIdHash>& closure);
+
     RecalcEngine& engine_;
     const Workbook& workbook_;
     DynamicReadLog log_;
     std::unordered_set<CellNodeId, CellNodeIdHash> refreshed_;
     std::vector<CellNodeId> stale_;
+    CandidatePairs pending_candidates_;
+    CandidatePairs attempted_candidates_;
     std::uint64_t next_ordinal_ = 0U;
     bool first_wave_ = true;
   };
 
+  /// What every evaluation site of one serial recalc call shares.
+  /// `oom_message` is that driver's arena-exhaustion error text.
+  struct SerialEvalPass {
+    Workbook& workbook;
+    const FunctionRegistry& registry;
+    DynamicReadPass& dynamic;
+    SpillReleaseCallback release_callback;
+    void* release_user_data;
+    RecalcStats& stats;
+    const char* oom_message;
+  };
+
+  /// Evaluates the formula at `cell` outside any cycle and commits its
+  /// result; a cell with no formula is left alone.
+  Expected<void, Error> evaluate_formula_cell_locked(const SerialEvalPass& pass, CellNodeId cell);
+
+  /// Settles a cyclic component by its reads (iterative calc off) or runs
+  /// the iterative solver (on). A solve that exhausts the arena fails with
+  /// `iterative_oom_message`.
+  Expected<void, Error> evaluate_cyclic_component_locked(const SerialEvalPass& pass,
+                                                         const std::vector<CellNodeId>& component,
+                                                         const char* iterative_oom_message);
+
   /// Commits a cyclic component iterative calc does not resolve: `#REF!` on
   /// every member, except that a cycle closing through an OFFSET / INDIRECT
   /// read restores each member's value from before this recalc, as Excel
   /// leaves a circular cell at its last value. Counts the members in
-  /// `stats.cycle_cells`.
-  void commit_unresolved_cycle_locked(Workbook& workbook, const std::vector<CellNodeId>& component,
-                                      DynamicReadPass& dynamic, SpillReleaseCallback release_callback,
-                                      void* release_user_data, RecalcStats& stats);
+  /// `pass.stats.cycle_cells`.
+  void commit_unresolved_cycle_locked(const SerialEvalPass& pass, const std::vector<CellNodeId>& component);
 
   // Serialises every mutating access to `graph_`, `volatiles_`, `dirty_`,
   // and `arena_`. Held for the full duration of each public entry; the
   // parallel scheduler also acquires it once at recalc entry.
   mutable std::mutex mutex_;
+  // Registration history is intentionally sticky: graph resets and formula
+  // unregistration do not make a later sheet/name mutation safe to skip.
+  bool has_ever_registered_formula_ = false;
 
   DepGraph graph_;
   // Compact rectangle dependencies (whole-row / whole-column references and
@@ -550,6 +614,8 @@ class RecalcEngine {
   // Iterative-calc knobs. Default-disabled so existing callers keep the
   // legacy `#REF!` behaviour for cyclic SCCs without opting in.
   IterativeOptions iterative_;
+  // See `disabled_cycle_refs_pending()`.
+  bool disabled_cycle_refs_pending_ = false;
   // Optional progress callback for the iterative solver. `nullptr`
   // disables it (the legacy contract). `progress_user_data_` is
   // forwarded verbatim to every invocation; the engine does not own it.
diff --git a/src/eval/reference/common.cpp b/src/eval/reference/common.cpp
index c320b53fc..844aeb8f1 100644
--- a/src/eval/reference/common.cpp
+++ b/src/eval/reference/common.cpp
@@ -1,10 +1,6 @@
 //
 // Shared bodies for the reference-family lazy impls. Hosts:
 //
-//   * The A1 textual reference parser (`parse_a1_ref`, `column_letters`,
-//     `A1Parse`) — public surface declared in `eval/a1_parse.h` and used
-//     by INDIRECT (this subdirectory), INFO ("address"), CELL, and the
-//     `ADDRESS` builtin.
 //   * Small helpers `apply_offset` / `read_int` that the OFFSET and
 //     CHOOSE expanders share with the intersection resolver.
 //   * The rectangle-construction routines `resolve_indirect_reference`,
@@ -17,9 +13,7 @@
 
 #include <algorithm>
 #include <cmath>
-#include <cstddef>
 #include <cstdint>
-#include <cstring>
 #include <string>
 #include <string_view>
 
@@ -34,11 +28,9 @@
 #include "parser/reference.h"
 #include "sheet.h"
 #include "sheet_name.h"
-#include "utils/a1_column.h"
 #include "utils/arena.h"
 #include "utils/error.h"
 #include "utils/expected.h"
-#include "utils/strings.h"
 #include "value.h"
 #include "workbook.h"
 
@@ -47,474 +39,6 @@ namespace eval {
 
 namespace refs_internal {
 
-namespace {
-
-// ASCII letter / digit predicates — intentionally local to avoid pulling
-// in `<cctype>` which is locale-sensitive on some platforms.
-constexpr bool is_letter(char ch) noexcept {
-  return (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z');
-}
-
-constexpr bool is_digit(char ch) noexcept {
-  return ch >= '0' && ch <= '9';
-}
-
-// Parses letters (A..XFD) at `text[*i]` into a 1-based column index, then
-// advances `*i` past the consumed bytes. Returns 0 on malformed input
-// (no letters, too many letters, or overflow past XFD = 16384).
-std::uint32_t parse_column_letters(std::string_view text, std::size_t* i) {
-  std::uint32_t col = 0;
-  std::size_t letters_seen = 0;
-  while (*i < text.size() && is_letter(text[*i])) {
-    char ch = text[*i];
-    if (ch >= 'a' && ch <= 'z') {
-      ch = static_cast<char>(ch - ('a' - 'A'));
-    }
-    col = col * 26u + static_cast<std::uint32_t>(ch - 'A' + 1);
-    ++(*i);
-    ++letters_seen;
-    if (letters_seen > 3 || col > Sheet::kMaxCols) {
-      return 0;
-    }
-  }
-  if (letters_seen == 0) {
-    return 0;
-  }
-  return col;
-}
-
-// Parses digits at `text[*i]` into a 1-based row index, advancing `*i`
-// past them. Returns 0 on no digits, too many digits, or row > kMaxRows.
-std::uint32_t parse_row_digits(std::string_view text, std::size_t* i) {
-  std::uint64_t row = 0;
-  std::size_t digits_seen = 0;
-  while (*i < text.size() && is_digit(text[*i])) {
-    row = row * 10u + static_cast<std::uint32_t>(text[*i] - '0');
-    ++(*i);
-    ++digits_seen;
-    if (digits_seen > 7 || row > Sheet::kMaxRows) {
-      return 0;
-    }
-  }
-  if (digits_seen == 0 || row == 0) {
-    return 0;
-  }
-  return static_cast<std::uint32_t>(row);
-}
-
-// Parses `[$]?<unit>:[$]?<unit>` consuming the entire remainder of
-// `text[start..]`, where `parse_unit` reads one 1-based unit and returns 0
-// on malformed input. On success writes the 0-based min / max of the two
-// units and returns true.
-bool parse_full_axis_span(std::string_view text, std::size_t start,
-                          std::uint32_t (*parse_unit)(std::string_view, std::size_t*), std::uint32_t* out_lo,
-                          std::uint32_t* out_hi) {
-  std::size_t i = start;
-  if (i < text.size() && text[i] == '$') {
-    ++i;
-  }
-  const std::uint32_t u1 = parse_unit(text, &i);
-  if (u1 == 0) {
-    return false;
-  }
-  if (i >= text.size() || text[i] != ':') {
-    return false;
-  }
-  ++i;
-  if (i < text.size() && text[i] == '$') {
-    ++i;
-  }
-  const std::uint32_t u2 = parse_unit(text, &i);
-  if (u2 == 0) {
-    return false;
-  }
-  if (i != text.size()) {
-    return false;
-  }
-  *out_lo = std::min(u1, u2) - 1U;
-  *out_hi = std::max(u1, u2) - 1U;
-  return true;
-}
-
-// Attempts to parse `text[start..]` as a full-column shape
-// `[$]?<letters>:[$]?<letters>` consuming the entire remainder. On
-// success sets `out->is_full_col` / `out->is_range`, populates
-// `col`/`col2` with the min/max 0-based columns, and fills
-// `row`/`row2` with the full-column row span, then returns true. On
-// failure leaves `*out` untouched and returns false.
-bool try_parse_full_col(std::string_view text, std::size_t start, A1Parse* out) {
-  std::uint32_t lo = 0;
-  std::uint32_t hi = 0;
-  if (!parse_full_axis_span(text, start, parse_column_letters, &lo, &hi)) {
-    return false;
-  }
-  out->col = lo;
-  out->col2 = hi;
-  out->row = 0;
-  out->row2 = Sheet::kMaxRows - 1U;
-  out->is_full_col = true;
-  out->is_range = true;
-  return true;
-}
-
-// Attempts to parse `text[start..]` as a full-row shape
-// `[$]?<digits>:[$]?<digits>` consuming the entire remainder. On
-// success sets `out->is_full_row` / `out->is_range`, populates
-// `row`/`row2` with the min/max 0-based rows, and fills `col`/`col2`
-// with the full-row column span, then returns true.
-bool try_parse_full_row(std::string_view text, std::size_t start, A1Parse* out) {
-  std::uint32_t lo = 0;
-  std::uint32_t hi = 0;
-  if (!parse_full_axis_span(text, start, parse_row_digits, &lo, &hi)) {
-    return false;
-  }
-  out->row = lo;
-  out->row2 = hi;
-  out->col = 0;
-  out->col2 = Sheet::kMaxCols - 1U;
-  out->is_full_row = true;
-  out->is_range = true;
-  return true;
-}
-
-// Parses a single A1 endpoint (optional `$` markers, letters, digits).
-// Returns `false` on any malformed shape; on success writes 0-based
-// row/col to `*out_row` / `*out_col` and advances `*i`.
-bool parse_a1_endpoint(std::string_view text, std::size_t* i, std::uint32_t* out_row, std::uint32_t* out_col) {
-  // Optional leading `$` on the column.
-  if (*i < text.size() && text[*i] == '$') {
-    ++(*i);
-  }
-  const std::uint32_t col_1based = parse_column_letters(text, i);
-  if (col_1based == 0) {
-    return false;
-  }
-  // Optional `$` between column and row.
-  if (*i < text.size() && text[*i] == '$') {
-    ++(*i);
-  }
-  const std::uint32_t row_1based = parse_row_digits(text, i);
-  if (row_1based == 0) {
-    return false;
-  }
-  *out_col = col_1based - 1U;
-  *out_row = row_1based - 1U;
-  return true;
-}
-
-// Copies `quoted` (everything between the surrounding single quotes)
-// into `out`, collapsing each `''` pair into a single `'`. Returns the
-// new size. `quoted` already excludes the outer quotes.
-std::size_t unescape_quoted_sheet(std::string_view quoted, char* out, std::size_t cap) {
-  std::size_t w = 0;
-  for (std::size_t r = 0; r < quoted.size() && w < cap; ++r) {
-    if (quoted[r] == '\'' && r + 1 < quoted.size() && quoted[r + 1] == '\'') {
-      out[w++] = '\'';
-      ++r;
-      continue;
-    }
-    out[w++] = quoted[r];
-  }
-  return w;
-}
-
-}  // namespace
-
-std::size_t column_letters(std::uint32_t col, char* out) {
-  if (col == 0U || out == nullptr) {
-    return 0U;
-  }
-  std::string letters;
-  if (!a1::append_column_letters(letters, col - 1U)) {
-    return 0U;
-  }
-  std::memcpy(out, letters.data(), letters.size());
-  return letters.size();
-}
-
-// Outcome of reading an optional leading `Sheet!` qualifier.
-enum class SheetQualifier : std::uint8_t {
-  kNone,       ///< No qualifier; `*i` is unmoved and the whole text is the reference.
-  kParsed,     ///< Qualifier consumed; `*sheet` is set and `*i` points past the `!`.
-  kMalformed,  ///< Unterminated quote or a quoted name with no `!`; the whole reference is invalid.
-};
-
-// Reads the optional sheet qualifier at the head of `text`, advancing `*i`
-// past it. Shared by the A1 and R1C1 parsers, which differ only in how
-// they read the reference body that follows.
-SheetQualifier parse_sheet_qualifier(std::string_view text, std::size_t* i, std::string_view* sheet) {
-  if (text.empty()) {
-    return SheetQualifier::kNone;
-  }
-  if (text[0] == '\'') {
-    // Scan for the closing `'` that is NOT followed by another `'` (the
-    // doubled form is an escaped apostrophe and stays inside the name).
-    std::size_t j = 1;
-    while (j < text.size()) {
-      if (text[j] == '\'') {
-        if (j + 1 < text.size() && text[j + 1] == '\'') {
-          j += 2;
-          continue;
-        }
-        break;
-      }
-      ++j;
-    }
-    if (j >= text.size() || text[j] != '\'') {
-      return SheetQualifier::kMalformed;  // unterminated
-    }
-    // Inside content is `text.substr(1, j - 1)`; unescape `''` -> `'`.
-    // We don't own backing storage here, so write into a static-sized
-    // local buffer; Excel sheet-name limit is 31 chars (we allow up to
-    // 255 defensively, capped by the source view size).
-    static thread_local char scratch[256];
-    const std::size_t content_len = j - 1;
-    const std::size_t used = unescape_quoted_sheet(text.substr(1, content_len), scratch, sizeof(scratch));
-    // This view points into thread_local storage — callers keep it alive
-    // only until the next parse on the same thread. The consuming code
-    // (`indirect`) copies before storing.
-    *sheet = std::string_view(scratch, used);
-    std::size_t after = j + 1;
-    if (after >= text.size() || text[after] != '!') {
-      return SheetQualifier::kMalformed;  // missing `!` after quoted sheet
-    }
-    *i = after + 1;
-    return SheetQualifier::kParsed;
-  }
-  // Bare sheet name: run of letters/digits/underscore followed by `!`.
-  // We only commit to treating it as a sheet qualifier if we find the
-  // `!` — otherwise the run is part of the reference itself.
-  std::size_t j = 0;
-  while (j < text.size() && (is_letter(text[j]) || is_digit(text[j]) || text[j] == '_')) {
-    ++j;
-  }
-  if (j > 0 && j < text.size() && text[j] == '!') {
-    *sheet = text.substr(0, j);
-    *i = j + 1;
-    return SheetQualifier::kParsed;
-  }
-  return SheetQualifier::kNone;
-}
-
-A1Parse parse_a1_ref(std::string_view text) {
-  A1Parse out;
-  if (text.empty()) {
-    return out;
-  }
-  std::size_t i = 0;
-  if (parse_sheet_qualifier(text, &i, &out.sheet) == SheetQualifier::kMalformed) {
-    return out;
-  }
-
-  // Full-column / full-row shapes (`D:D`, `$FF:FG`, `5:5`, `$12:$23`)
-  // are tried before the single-endpoint path because they never share a
-  // prefix with a valid single-cell reference (the latter always has a
-  // digit immediately after the letter run, never a `:`).
-  if (try_parse_full_col(text, i, &out)) {
-    out.valid = true;
-    return out;
-  }
-  if (try_parse_full_row(text, i, &out)) {
-    out.valid = true;
-    return out;
-  }
-
-  // Parse the first endpoint.
-  if (!parse_a1_endpoint(text, &i, &out.row, &out.col)) {
-    return out;
-  }
-
-  // Optional `:` + second endpoint for ranges.
-  if (i < text.size() && text[i] == ':') {
-    ++i;
-    if (!parse_a1_endpoint(text, &i, &out.row2, &out.col2)) {
-      return out;
-    }
-    out.is_range = true;
-  }
-
-  // Trailing garbage -> invalid.
-  if (i != text.size()) {
-    return out;
-  }
-  out.valid = true;
-  return out;
-}
-
-namespace {
-
-// One axis of an R1C1 endpoint: `R`/`C` on its own, `R5` (absolute), or
-// `R[-2]` (relative). `present` distinguishes an axis that was written
-// from one that was left out, which is what makes `R5` a whole row and
-// `R5C2` a single cell.
-struct R1C1Axis {
-  bool present = false;
-  bool relative = false;
-  long long value = 0;  ///< 1-based index when absolute, signed offset when relative.
-};
-
-// Reads one `R`/`C` axis at `text[*i]` when the marker matches `marker`.
-// Returns false only on malformed input; an absent axis leaves `*out`
-// unset and still returns true.
-bool parse_r1c1_axis(std::string_view text, std::size_t* i, char marker, R1C1Axis* out) {
-  if (*i >= text.size()) {
-    return true;
-  }
-  char head = text[*i];
-  if (head >= 'a' && head <= 'z') {
-    head = static_cast<char>(head - ('a' - 'A'));
-  }
-  if (head != marker) {
-    return true;
-  }
-  ++*i;
-  out->present = true;
-  if (*i < text.size() && text[*i] == '[') {
-    ++*i;
-    bool negative = false;
-    if (*i < text.size() && (text[*i] == '-' || text[*i] == '+')) {
-      negative = text[*i] == '-';
-      ++*i;
-    }
-    const std::size_t digits_start = *i;
-    long long magnitude = 0;
-    while (*i < text.size() && is_digit(text[*i])) {
-      magnitude = magnitude * 10 + (text[*i] - '0');
-      if (magnitude > Sheet::kMaxRows) {
-        return false;  // saturate well before overflow; out of grid either way
-      }
-      ++*i;
-    }
-    if (*i == digits_start || *i >= text.size() || text[*i] != ']') {
-      return false;
-    }
-    ++*i;
-    out->relative = true;
-    out->value = negative ? -magnitude : magnitude;
-    return true;
-  }
-  // A bare `R` / `C` is the current row / column: a zero relative offset.
-  const std::size_t digits_start = *i;
-  long long absolute = 0;
-  while (*i < text.size() && is_digit(text[*i])) {
-    absolute = absolute * 10 + (text[*i] - '0');
-    if (absolute > Sheet::kMaxRows) {
-      return false;
-    }
-    ++*i;
-  }
-  if (*i == digits_start) {
-    out->relative = true;
-    out->value = 0;
-    return true;
-  }
-  out->value = absolute;
-  return true;
-}
-
-// Resolves one axis to a 0-based coordinate against `base`, rejecting
-// anything outside `[0, max)`. A relative axis with no base has nothing
-// to measure from and fails rather than assuming the origin.
-bool resolve_r1c1_axis(const R1C1Axis& axis, bool base_present, std::uint32_t base, std::uint32_t max,
-                       std::uint32_t* out) {
-  if (axis.relative && !base_present) {
-    return false;
-  }
-  const long long resolved = axis.relative ? static_cast<long long>(base) + axis.value : axis.value - 1;
-  if (resolved < 0 || resolved >= static_cast<long long>(max)) {
-    return false;
-  }
-  *out = static_cast<std::uint32_t>(resolved);
-  return true;
-}
-
-// Parses one `R...C...` endpoint. At least one axis must be written.
-bool parse_r1c1_endpoint(std::string_view text, std::size_t* i, R1C1Axis* row, R1C1Axis* col) {
-  if (!parse_r1c1_axis(text, i, 'R', row)) {
-    return false;
-  }
-  if (!parse_r1c1_axis(text, i, 'C', col)) {
-    return false;
-  }
-  return row->present || col->present;
-}
-
-}  // namespace
-
-A1Parse parse_r1c1_ref(std::string_view text, const R1C1Base& base) {
-  A1Parse out;
-  if (text.empty()) {
-    return out;
-  }
-  std::size_t i = 0;
-  if (parse_sheet_qualifier(text, &i, &out.sheet) == SheetQualifier::kMalformed) {
-    return out;
-  }
-
-  R1C1Axis row1;
-  R1C1Axis col1;
-  if (!parse_r1c1_endpoint(text, &i, &row1, &col1)) {
-    return out;
-  }
-  R1C1Axis row2 = row1;
-  R1C1Axis col2 = col1;
-  bool is_range = false;
-  if (i < text.size() && text[i] == ':') {
-    ++i;
-    row2 = R1C1Axis{};
-    col2 = R1C1Axis{};
-    if (!parse_r1c1_endpoint(text, &i, &row2, &col2)) {
-      return out;
-    }
-    // A range whose endpoints name different axes (`R2:R3C4`) has no
-    // rectangle; Excel rejects it rather than guessing the missing bound.
-    if (row1.present != row2.present || col1.present != col2.present) {
-      return out;
-    }
-    is_range = true;
-  }
-  if (i != text.size()) {
-    return out;  // trailing garbage
-  }
-
-  // An endpoint that names only one axis is unbounded along the other, the
-  // same shape `5:5` and `D:D` take on the A1 side.
-  if (!col1.present) {
-    if (!resolve_r1c1_axis(row1, base.present, base.row, Sheet::kMaxRows, &out.row) ||
-        !resolve_r1c1_axis(row2, base.present, base.row, Sheet::kMaxRows, &out.row2)) {
-      return out;
-    }
-    out.col = 0;
-    out.col2 = Sheet::kMaxCols - 1U;
-    out.is_full_row = true;
-    out.is_range = true;
-    out.valid = true;
-    return out;
-  }
-  if (!row1.present) {
-    if (!resolve_r1c1_axis(col1, base.present, base.col, Sheet::kMaxCols, &out.col) ||
-        !resolve_r1c1_axis(col2, base.present, base.col, Sheet::kMaxCols, &out.col2)) {
-      return out;
-    }
-    out.row = 0;
-    out.row2 = Sheet::kMaxRows - 1U;
-    out.is_full_col = true;
-    out.is_range = true;
-    out.valid = true;
-    return out;
-  }
-
-  if (!resolve_r1c1_axis(row1, base.present, base.row, Sheet::kMaxRows, &out.row) ||
-      !resolve_r1c1_axis(col1, base.present, base.col, Sheet::kMaxCols, &out.col) ||
-      !resolve_r1c1_axis(row2, base.present, base.row, Sheet::kMaxRows, &out.row2) ||
-      !resolve_r1c1_axis(col2, base.present, base.col, Sheet::kMaxCols, &out.col2)) {
-    return out;
-  }
-  out.is_range = is_range;
-  out.valid = true;
-  return out;
-}
-
 bool apply_offset(std::uint32_t base, int offset, std::uint32_t max, std::uint32_t* out) {
   const long long sum = static_cast<long long>(base) + static_cast<long long>(offset);
   if (sum < 0 || sum >= static_cast<long long>(max)) {
diff --git a/src/eval/reference/common.h b/src/eval/reference/common.h
index c43cc2f80..20b5666ce 100644
--- a/src/eval/reference/common.h
+++ b/src/eval/reference/common.h
@@ -8,18 +8,14 @@
 // `read_int`) that the three reference-family pipelines all touch.
 //
 // The public A1-text parser (`parse_a1_ref`, `column_letters`, `A1Parse`)
-// continues to live in `eval/a1_parse.h`; the bodies are defined in
-// `reference/common.cpp` and are reachable from outside the subdirectory
-// through that header. Public lazy impl declarations
-// (`eval_indirect_lazy`, `eval_offset_lazy`) live in `reference/indirect.h`
-// and `reference/offset.h`; the range-expander / range-resolver externs
-// live in `eval/range_expanders.h` and `eval/range_resolvers.h`.
+// lives in `eval/a1_parse.h`, with its bodies in `eval/a1_parse.cpp`.
+// Public lazy impl declarations (`eval_indirect_lazy`, `eval_offset_lazy`)
+// live in `reference/indirect.h` and `reference/offset.h`; the
+// range-expander / range-resolver externs live in `eval/range_expanders.h`
+// and `eval/range_resolvers.h`.
 //
-// TODO(D-07): the A1 endpoint parser duplicates work that the OOXML-side
-// `src/io/a1_ref.h` already does for a more restricted dialect. Hoisting
-// a shared parser into a refs layer depends on cross-layer design
-// decisions (eval -> io dependency direction); defer the unification
-// until that lands. Until then, the parser stays local here.
+// The A1 endpoint parser stays local to eval rather than sharing the OOXML
+// side's `src/io/a1_ref.h`, which would need an eval -> io dependency.
 
 #ifndef FORMULON_EVAL_REFERENCE_COMMON_H_
 #define FORMULON_EVAL_REFERENCE_COMMON_H_
diff --git a/src/eval/reference/indirect.cpp b/src/eval/reference/indirect.cpp
index b51651eac..b78cb8f39 100644
--- a/src/eval/reference/indirect.cpp
+++ b/src/eval/reference/indirect.cpp
@@ -10,7 +10,7 @@
 #include <utility>
 #include <vector>
 
-#include "eval/dynamic_array/common.h"
+#include "eval/array_alloc.h"
 #include "eval/eval_context.h"
 #include "eval/reference/common.h"
 #include "parser/ast.h"
@@ -79,19 +79,10 @@ Value eval_indirect_lazy(const parser::AstNode& call, Arena& arena, const Functi
       // spill, so collapse to a blank scalar. `SUM`/`COUNT` of this is 0.
       return Value::blank();
     }
-    Value* buffer = nullptr;
-    // The cells are a copy of the rectangle `expand_range` just admitted under
-    // the range-expansion bound, so the copy is bounded the same way. Using the
-    // narrower ceiling that applies to arrays a formula conjures from its
-    // arguments would reject a rectangle the read itself accepted.
-    ArrayValue* out = dynamic_array::allocate_array_value(rows, cols, arena, buffer, kMaxDerivedArrayCells);
+    ArrayValue* out = array_from_values(rows, cols, cells.data(), cells.size(), arena);
     if (out == nullptr) {
       return Value::error(ErrorCode::Num);
     }
-    const std::size_t total = static_cast<std::size_t>(rows) * cols;
-    for (std::size_t i = 0; i < total && i < cells.size(); ++i) {
-      buffer[i] = cells[i];
-    }
     return Value::array(out);
   }
 
diff --git a/src/eval/reference/indirect.h b/src/eval/reference/indirect.h
index 8fcd1a63c..d1facce98 100644
--- a/src/eval/reference/indirect.h
+++ b/src/eval/reference/indirect.h
@@ -3,7 +3,8 @@
 // own header so the central dispatch table (`tree_walker_lazy_table.cpp`)
 // can include it directly without pulling in the OFFSET / intersection
 // surfaces. The accompanying text-to-rectangle decoder lives in
-// `eval/a1_parse.h` (public) and `reference/common.h` (intra-subdir).
+// `eval/a1_parse.h` (public, defined in `eval/a1_parse.cpp`) and
+// `reference/common.h` (intra-subdir).
 
 #ifndef FORMULON_EVAL_REFERENCE_INDIRECT_H_
 #define FORMULON_EVAL_REFERENCE_INDIRECT_H_
diff --git a/src/eval/reference/offset.cpp b/src/eval/reference/offset.cpp
index a02ebd6d7..748b51094 100644
--- a/src/eval/reference/offset.cpp
+++ b/src/eval/reference/offset.cpp
@@ -17,9 +17,9 @@
 #include <utility>
 #include <vector>
 
+#include "eval/array_alloc.h"
 #include "eval/coerce.h"
 #include "eval/declared_rect.h"
-#include "eval/dynamic_array/common.h"
 #include "eval/eval_context.h"
 #include "eval/lazy_impls.h"
 #include "eval/lookups/classic.h"
@@ -118,20 +118,11 @@ Value eval_offset_lazy(const parser::AstNode& call, Arena& arena, const Function
   if (!expanded) {
     return Value::error(expanded.error());
   }
-  Value* buffer = nullptr;
-  // The cells are a copy of the rectangle `expand_range` just admitted under
-  // the range-expansion bound, so the copy is bounded the same way. Using the
-  // narrower ceiling that applies to arrays a formula conjures from its
-  // arguments would reject a rectangle the read itself accepted.
-  ArrayValue* out = dynamic_array::allocate_array_value(height, width, arena, buffer, kMaxDerivedArrayCells);
+  const std::vector<Value>& cells = expanded.value();
+  ArrayValue* out = array_from_values(height, width, cells.data(), cells.size(), arena);
   if (out == nullptr) {
     return Value::error(ErrorCode::Num);
   }
-  const std::vector<Value>& cells = expanded.value();
-  const std::size_t total = static_cast<std::size_t>(height) * width;
-  for (std::size_t i = 0; i < total && i < cells.size(); ++i) {
-    buffer[i] = cells[i];
-  }
   return Value::array(out);
 }
 
@@ -178,24 +169,7 @@ bool expand_choose_call(const parser::AstNode& call, Arena& arena, const Functio
   }
   if (idx_val.is_array()) {
     const Value result = eval_choose_array_index_lazy(call, idx_val, arena, registry, ctx);
-    if (result.is_error()) {
-      *out_err_code = result.as_error();
-      return false;
-    }
-    if (!result.is_array()) {
-      *out_err_code = ErrorCode::Value;
-      return false;
-    }
-    const ArrayValue* array = result.as_array();
-    const std::size_t count = static_cast<std::size_t>(array->rows) * array->cols;
-    out_cells->assign(array->cells, array->cells + count);
-    if (out_rows != nullptr) {
-      *out_rows = array->rows;
-    }
-    if (out_cols != nullptr) {
-      *out_cols = array->cols;
-    }
-    return true;
+    return expand_array_result(result, out_cells, out_err_code, out_rows, out_cols);
   }
   auto idx_num = coerce_to_number(idx_val);
   if (!idx_num) {
@@ -217,6 +191,28 @@ bool expand_choose_call(const parser::AstNode& call, Arena& arena, const Functio
                                out_cols);
 }
 
+bool expand_array_result(const Value& result, std::vector<Value>* out_cells, ErrorCode* out_err_code,
+                         std::uint32_t* out_rows, std::uint32_t* out_cols) {
+  if (result.is_error()) {
+    *out_err_code = result.as_error();
+    return false;
+  }
+  if (!result.is_array()) {
+    *out_err_code = ErrorCode::Value;
+    return false;
+  }
+  const ArrayValue* array = result.as_array();
+  const std::size_t count = static_cast<std::size_t>(array->rows) * array->cols;
+  out_cells->assign(array->cells, array->cells + count);
+  if (out_rows != nullptr) {
+    *out_rows = array->rows;
+  }
+  if (out_cols != nullptr) {
+    *out_cols = array->cols;
+  }
+  return true;
+}
+
 bool expand_if_call(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx,
                     std::vector<Value>* out_cells, ErrorCode* out_err_code, std::uint32_t* out_rows,
                     std::uint32_t* out_cols) {
@@ -272,14 +268,7 @@ bool expand_row_or_column_call(const parser::AstNode& call, Arena& arena, const
   // "Ref OR range-shaped" set so a single-cell binding still yields a
   // meaningful row / column index.
   const parser::AstNode& raw_arg = call.as_call_arg(0);
-  const parser::AstNode* effective = &raw_arg;
-  if (raw_arg.kind() == parser::NodeKind::NameRef) {
-    const parser::AstNode& resolved = resolve_name_ast(raw_arg, ctx.name_env());
-    if (&resolved != &raw_arg && (resolved.kind() == parser::NodeKind::Ref || is_range_shaped_ast(resolved))) {
-      effective = &resolved;
-    }
-  }
-  const parser::AstNode& arg = *effective;
+  const parser::AstNode& arg = resolve_range_binding(raw_arg, ctx.name_env(), /*accept_ref=*/true);
 
   std::uint32_t top = 0;
   std::uint32_t left = 0;
diff --git a/src/eval/regex_lazy.cpp b/src/eval/regex_lazy.cpp
index a4f7dae85..c9c41970b 100644
--- a/src/eval/regex_lazy.cpp
+++ b/src/eval/regex_lazy.cpp
@@ -63,10 +63,6 @@ namespace {
 // and capping early gives a clean #VALUE! instead of a slow compile.
 constexpr std::size_t kMaxPatternBytes = 32767U;
 
-// Excel caps a text cell at 32,767 UTF-16 units. REGEXREPLACE output past
-// the cap surfaces #VALUE! instead of growing an unbounded buffer.
-constexpr std::uint64_t kExcelTextCapUnits = 32767U;
-
 // Conservative byte bound for the cap: a UTF-16 unit never needs more than
 // 4 UTF-8 bytes, so a required substitution output beyond this many bytes
 // always exceeds the cap and can be rejected before any buffer growth.
@@ -818,23 +814,20 @@ Value eval_regextest_lazy(const parser::AstNode& call, Arena& arena, const Funct
   // loop-invariant, the subjects are not.
   const CompiledPattern program(pattern, case_insensitive);
 
-  if (!text_arg.is_array) {
-    KernelResult kr = regex_kernel(program, text_arg.scalar, /*find_all=*/false,
+  auto per_subject = [&](std::string_view subject) -> Value {
+    KernelResult kr = regex_kernel(program, subject, /*find_all=*/false,
                                    /*on_match_limit_returns_no_match=*/true);
     if (!kr.ok) {
       return kr.err;
     }
     return Value::boolean(!kr.matches.empty());
+  };
+
+  if (!text_arg.is_array) {
+    return per_subject(text_arg.scalar);
   }
 
-  return broadcast_over_text(text_arg.array, arena, [&](std::string_view subject) -> Value {
-    KernelResult kr = regex_kernel(program, subject, /*find_all=*/false,
-                                   /*on_match_limit_returns_no_match=*/true);
-    if (!kr.ok) {
-      return kr.err;
-    }
-    return Value::boolean(!kr.matches.empty());
-  });
+  return broadcast_over_text(text_arg.array, arena, per_subject);
 }
 
 // ---------------------------------------------------------------------------
@@ -889,17 +882,18 @@ Value eval_regexextract_lazy(const parser::AstNode& call, Arena& arena, const Fu
   // Compile once for the whole call; every subject reuses the program.
   const CompiledPattern program(pattern, case_insensitive);
 
-  if (!text_arg.is_array) {
-    // find_all is needed for modes 1 and 3; modes 0 and 2 want only the
-    // first match. Cheap to over-collect, so we always find_all. The
-    // kernel iterates internally — bounded by subject length.
-    const bool find_all = (mode == 1 || mode == 3);
-    KernelResult kr = regex_kernel(program, text_arg.scalar, find_all,
+  // find_all is needed for modes 1 and 3; modes 0 and 2 want only the first match.
+  auto per_subject = [&](std::string_view subject) -> Value {
+    KernelResult kr = regex_kernel(program, subject, /*find_all=*/mode_yields_array,
                                    /*on_match_limit_returns_no_match=*/false);
     if (!kr.ok) {
       return kr.err;
     }
-    return extract_dispatch(kr, text_arg.scalar, mode, arena);
+    return extract_dispatch(kr, subject, mode, arena);
+  };
+
+  if (!text_arg.is_array) {
+    return per_subject(text_arg.scalar);
   }
 
   // Array broadcast (only meaningful for scalar-yielding modes).
@@ -907,14 +901,7 @@ Value eval_regexextract_lazy(const parser::AstNode& call, Arena& arena, const Fu
     return Value::error(ErrorCode::Calc);
   }
 
-  return broadcast_over_text(text_arg.array, arena, [&](std::string_view subject) -> Value {
-    KernelResult kr = regex_kernel(program, subject, /*find_all=*/(mode == 1 || mode == 3),
-                                   /*on_match_limit_returns_no_match=*/false);
-    if (!kr.ok) {
-      return kr.err;
-    }
-    return extract_dispatch(kr, subject, mode, arena);
-  });
+  return broadcast_over_text(text_arg.array, arena, per_subject);
 }
 
 // ---------------------------------------------------------------------------
diff --git a/src/eval/regression_lazy.cpp b/src/eval/regression_lazy.cpp
index 721a3f10d..452b8a041 100644
--- a/src/eval/regression_lazy.cpp
+++ b/src/eval/regression_lazy.cpp
@@ -138,184 +138,149 @@ bool compute_slope_intercept(const std::variant<Value, NumericPairs>& prepared,
   return true;
 }
 
-}  // namespace
+enum class PairStat {
+  Correl,
+  CovarianceP,
+  CovarianceS,
+  Slope,
+  Intercept,
+  Rsq,
+  Steyx,
+  SumX2PY2,
+  SumX2MY2,
+  SumXMY2,
+};
 
-Value eval_correl_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
-                       const EvalContext& ctx) {
+// Shared driver for the 2-arity pairwise statistics: prepares the pairs once, then reduces per `kind`.
+Value eval_pair_stat(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
+                     const EvalContext& ctx, PairStat kind) {
   auto prepared = prepare_pairs(call, arena, registry, ctx);
   if (std::holds_alternative<Value>(prepared)) {
     return std::get<Value>(prepared);
   }
   const NumericPairs& pairs = std::get<NumericPairs>(prepared);
-  // Pearson correlation is undefined for fewer than two points (the
-  // sample variances collapse to zero) and when either marginal
-  // variance is exactly zero (the denominator would be zero).
-  if (pairs.second.size() < 2U) {
+  const std::size_t n = pairs.second.size();
+  switch (kind) {
+    case PairStat::Slope:
+    case PairStat::Intercept: {
+      double slope = 0.0;
+      double intercept = 0.0;
+      Value err = Value::blank();
+      if (!compute_slope_intercept(prepared, &slope, &intercept, &err)) {
+        return err;
+      }
+      return finite_number(kind == PairStat::Slope ? slope : intercept);
+    }
+    case PairStat::SumX2PY2:
+    case PairStat::SumX2MY2:
+    case PairStat::SumXMY2: {
+      // Collection runs left to right: array_x lands in `pairs.first`, array_y in `pairs.second`.
+      const std::vector<double>& x = pairs.first;
+      const std::vector<double>& y = pairs.second;
+      if (x.empty()) {
+        return Value::error(ErrorCode::NA);
+      }
+      double total = 0.0;
+      for (std::size_t i = 0; i < x.size(); ++i) {
+        if (kind == PairStat::SumX2PY2) {
+          total += x[i] * x[i] + y[i] * y[i];
+        } else if (kind == PairStat::SumX2MY2) {
+          total += x[i] * x[i] - y[i] * y[i];
+        } else {
+          const double d = x[i] - y[i];
+          total += d * d;
+        }
+      }
+      return finite_number(total);
+    }
+    default:
+      break;
+  }
+  // Pearson / RSQ need n >= 2, COVARIANCE.P needs n >= 1, STEYX needs n >= 3 (n - 2 degrees of freedom).
+  const std::size_t min_n = kind == PairStat::Steyx ? 3U : (kind == PairStat::CovarianceP ? 1U : 2U);
+  if (n < min_n) {
     return Value::error(ErrorCode::Div0);
   }
   const RegressionStats s = compute_regression_stats(pairs);
-  if (s.sum_xx == 0.0 || s.sum_yy == 0.0) {
-    return Value::error(ErrorCode::Div0);
+  switch (kind) {
+    case PairStat::Correl:
+      // A zero marginal variance makes the denominator zero.
+      if (s.sum_xx == 0.0 || s.sum_yy == 0.0) {
+        return Value::error(ErrorCode::Div0);
+      }
+      return finite_number(s.sum_xy / std::sqrt(s.sum_xx * s.sum_yy));
+    case PairStat::CovarianceP:
+      return finite_number(s.sum_xy / static_cast<double>(n));
+    case PairStat::CovarianceS:
+      return finite_number(s.sum_xy / static_cast<double>(n - 1U));
+    case PairStat::Rsq:
+      if (s.sum_xx == 0.0 || s.sum_yy == 0.0) {
+        return Value::error(ErrorCode::Div0);
+      }
+      // CORREL^2 computed directly avoids the intermediate sqrt.
+      return finite_number((s.sum_xy * s.sum_xy) / (s.sum_xx * s.sum_yy));
+    default: {  // Steyx
+      if (s.sum_xx == 0.0) {
+        return Value::error(ErrorCode::Div0);
+      }
+      const double residual_ss = s.sum_yy - (s.sum_xy * s.sum_xy) / s.sum_xx;
+      // Rounding can leave a tiny negative on an exact fit; clamp before the root.
+      const double clamped = residual_ss < 0.0 ? 0.0 : residual_ss;
+      return finite_number(std::sqrt(clamped / static_cast<double>(n - 2U)));
+    }
   }
-  return finite_number(s.sum_xy / std::sqrt(s.sum_xx * s.sum_yy));
+}
+
+}  // namespace
+
+Value eval_correl_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
+                       const EvalContext& ctx) {
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::Correl);
 }
 
 Value eval_covariance_p_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                              const EvalContext& ctx) {
-  auto prepared = prepare_pairs(call, arena, registry, ctx);
-  if (std::holds_alternative<Value>(prepared)) {
-    return std::get<Value>(prepared);
-  }
-  const NumericPairs& pairs = std::get<NumericPairs>(prepared);
-  // Population covariance is defined for any n >= 1 (variance of a
-  // single point is zero); only n == 0 is degenerate.
-  if (pairs.second.empty()) {
-    return Value::error(ErrorCode::Div0);
-  }
-  const RegressionStats s = compute_regression_stats(pairs);
-  return finite_number(s.sum_xy / static_cast<double>(pairs.second.size()));
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::CovarianceP);
 }
 
 Value eval_covariance_s_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                              const EvalContext& ctx) {
-  auto prepared = prepare_pairs(call, arena, registry, ctx);
-  if (std::holds_alternative<Value>(prepared)) {
-    return std::get<Value>(prepared);
-  }
-  const NumericPairs& pairs = std::get<NumericPairs>(prepared);
-  // Sample covariance uses divisor (n - 1); a single point yields 0/0.
-  if (pairs.second.size() < 2U) {
-    return Value::error(ErrorCode::Div0);
-  }
-  const RegressionStats s = compute_regression_stats(pairs);
-  return finite_number(s.sum_xy / static_cast<double>(pairs.second.size() - 1U));
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::CovarianceS);
 }
 
 Value eval_slope_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                       const EvalContext& ctx) {
-  double slope = 0.0;
-  double intercept = 0.0;
-  Value err = Value::blank();
-  if (!compute_slope_intercept(prepare_pairs(call, arena, registry, ctx), &slope, &intercept, &err)) {
-    return err;
-  }
-  return finite_number(slope);
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::Slope);
 }
 
 Value eval_intercept_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                           const EvalContext& ctx) {
-  double slope = 0.0;
-  double intercept = 0.0;
-  Value err = Value::blank();
-  if (!compute_slope_intercept(prepare_pairs(call, arena, registry, ctx), &slope, &intercept, &err)) {
-    return err;
-  }
-  return finite_number(intercept);
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::Intercept);
 }
 
 Value eval_rsq_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                     const EvalContext& ctx) {
-  auto prepared = prepare_pairs(call, arena, registry, ctx);
-  if (std::holds_alternative<Value>(prepared)) {
-    return std::get<Value>(prepared);
-  }
-  const NumericPairs& pairs = std::get<NumericPairs>(prepared);
-  if (pairs.second.size() < 2U) {
-    return Value::error(ErrorCode::Div0);
-  }
-  const RegressionStats s = compute_regression_stats(pairs);
-  if (s.sum_xx == 0.0 || s.sum_yy == 0.0) {
-    return Value::error(ErrorCode::Div0);
-  }
-  // RSQ = CORREL^2 = sum_xy^2 / (sum_xx * sum_yy). Computing the ratio
-  // directly avoids the intermediate sqrt in CORREL and stays closer
-  // to the double-precision limit.
-  return finite_number((s.sum_xy * s.sum_xy) / (s.sum_xx * s.sum_yy));
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::Rsq);
 }
 
 Value eval_steyx_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                       const EvalContext& ctx) {
-  auto prepared = prepare_pairs(call, arena, registry, ctx);
-  if (std::holds_alternative<Value>(prepared)) {
-    return std::get<Value>(prepared);
-  }
-  const NumericPairs& pairs = std::get<NumericPairs>(prepared);
-  // Residual standard error has (n - 2) degrees of freedom, so we need at
-  // least 3 pairs. A collinear x-vector (sum_xx == 0) also makes the
-  // regression undefined.
-  if (pairs.second.size() < 3U) {
-    return Value::error(ErrorCode::Div0);
-  }
-  const RegressionStats s = compute_regression_stats(pairs);
-  if (s.sum_xx == 0.0) {
-    return Value::error(ErrorCode::Div0);
-  }
-  const double residual_ss = s.sum_yy - (s.sum_xy * s.sum_xy) / s.sum_xx;
-  // Floating-point subtraction can produce a tiny negative when the fit
-  // is essentially exact; clamp to zero before taking the root.
-  const double clamped = residual_ss < 0.0 ? 0.0 : residual_ss;
-  return finite_number(std::sqrt(clamped / static_cast<double>(pairs.second.size() - 2U)));
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::Steyx);
 }
 
 Value eval_sumx2py2_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                          const EvalContext& ctx) {
-  auto prepared = prepare_pairs(call, arena, registry, ctx);
-  if (std::holds_alternative<Value>(prepared)) {
-    return std::get<Value>(prepared);
-  }
-  const NumericPairs& pairs = std::get<NumericPairs>(prepared);
-  // SUMX2PY2 / SUMX2MY2 / SUMXMY2 take `(array_x, array_y)`, the opposite
-  // of `(known_y, known_x)`; collection still runs left to right, so
-  // array_x lands in `pairs.first` and array_y in `pairs.second`.
-  const std::vector<double>& x = pairs.first;
-  const std::vector<double>& y = pairs.second;
-  if (x.empty()) {
-    return Value::error(ErrorCode::NA);
-  }
-  double total = 0.0;
-  for (std::size_t i = 0; i < x.size(); ++i) {
-    total += x[i] * x[i] + y[i] * y[i];
-  }
-  return finite_number(total);
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::SumX2PY2);
 }
 
 Value eval_sumx2my2_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                          const EvalContext& ctx) {
-  auto prepared = prepare_pairs(call, arena, registry, ctx);
-  if (std::holds_alternative<Value>(prepared)) {
-    return std::get<Value>(prepared);
-  }
-  const NumericPairs& pairs = std::get<NumericPairs>(prepared);
-  const std::vector<double>& x = pairs.first;
-  const std::vector<double>& y = pairs.second;
-  if (x.empty()) {
-    return Value::error(ErrorCode::NA);
-  }
-  double total = 0.0;
-  for (std::size_t i = 0; i < x.size(); ++i) {
-    total += x[i] * x[i] - y[i] * y[i];
-  }
-  return finite_number(total);
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::SumX2MY2);
 }
 
 Value eval_sumxmy2_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                         const EvalContext& ctx) {
-  auto prepared = prepare_pairs(call, arena, registry, ctx);
-  if (std::holds_alternative<Value>(prepared)) {
-    return std::get<Value>(prepared);
-  }
-  const NumericPairs& pairs = std::get<NumericPairs>(prepared);
-  const std::vector<double>& x = pairs.first;
-  const std::vector<double>& y = pairs.second;
-  if (x.empty()) {
-    return Value::error(ErrorCode::NA);
-  }
-  double total = 0.0;
-  for (std::size_t i = 0; i < x.size(); ++i) {
-    const double d = x[i] - y[i];
-    total += d * d;
-  }
-  return finite_number(total);
+  return eval_pair_stat(call, arena, registry, ctx, PairStat::SumXMY2);
 }
 
 Value eval_forecast_linear_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
diff --git a/src/eval/rng.cpp b/src/eval/rng.cpp
index 8abd34cb0..8b369018d 100644
--- a/src/eval/rng.cpp
+++ b/src/eval/rng.cpp
@@ -1,6 +1,9 @@
 
 #include "eval/rng.h"
 
+#include <cmath>
+#include <cstdint>
+
 namespace formulon {
 namespace eval {
 
@@ -9,5 +12,78 @@ std::mt19937_64& thread_local_rng() {
   return rng;
 }
 
+namespace {
+
+double unit_sample(std::mt19937_64& rng) {
+  std::uniform_real_distribution<double> dist(0.0, 1.0);
+  return dist(rng);
+}
+
+// `double(INT64_MAX)` rounds to 2^63, so the upper bound is intentionally
+// exclusive when deciding whether a floating-point endpoint can be converted
+// to int64_t without leaving its representable domain.
+constexpr double kInt64MinAsDouble = -0x1p63;
+constexpr double kInt64UpperExclusiveAsDouble = 0x1p63;
+
+}  // namespace
+
+double sample_uniform_real(double min, double max, std::mt19937_64& rng) {
+  if (min == max) {
+    return min;
+  }
+
+  const double span = max - min;
+  if (std::isfinite(span)) {
+    std::uniform_real_distribution<double> dist(min, max);
+    return dist(rng);
+  }
+
+  // The endpoints are finite, but their difference is not. Interpolating the
+  // weighted endpoints avoids forming that overflowing difference.
+  const double unit = unit_sample(rng);
+  double sample = (1.0 - unit) * min + unit * max;
+  if (!(sample >= min)) {
+    sample = min;
+  }
+  if (sample >= max) {
+    sample = std::nextafter(max, min);
+  }
+  return sample;
+}
+
+double sample_uniform_integer(double min, double max, std::mt19937_64& rng) {
+  if (min == max) {
+    return min;
+  }
+
+  if (min >= kInt64MinAsDouble && max < kInt64UpperExclusiveAsDouble) {
+    const auto lo = static_cast<std::int64_t>(min);
+    const auto hi = static_cast<std::int64_t>(max);
+    std::uniform_int_distribution<std::int64_t> dist(lo, hi);
+    return static_cast<double>(dist(rng));
+  }
+
+  // Out-of-range integral doubles cannot be represented by int64_t, but all
+  // doubles at these magnitudes are already integral. Interpolate directly in
+  // double space, then floor and clamp to retain an integral-valued result in
+  // the requested closed interval.
+  const double unit = unit_sample(rng);
+  double sample = (1.0 - unit) * min + unit * max;
+  if (!(sample >= min)) {
+    sample = min;
+  }
+  if (sample > max) {
+    sample = max;
+  }
+  sample = std::floor(sample);
+  if (sample < min) {
+    sample = min;
+  }
+  if (sample > max) {
+    sample = max;
+  }
+  return sample;
+}
+
 }  // namespace eval
 }  // namespace formulon
diff --git a/src/eval/rng.h b/src/eval/rng.h
index 1db574fcf..12629d712 100644
--- a/src/eval/rng.h
+++ b/src/eval/rng.h
@@ -21,6 +21,21 @@ namespace eval {
 /// `builtins/math_rng.cpp` for the original rationale.
 std::mt19937_64& thread_local_rng();
 
+/// Samples a finite real value from the half-open interval `[min, max)`.
+///
+/// Finite spans use the standard library distribution so the normal-range
+/// sequence remains unchanged. When subtraction overflows, a unit sample is
+/// interpolated between the endpoints without forming the overflowing span.
+/// A singleton is returned directly, preserving its exact double value.
+double sample_uniform_real(double min, double max, std::mt19937_64& rng);
+
+/// Samples an integral-valued double from the closed interval `[min, max]`.
+///
+/// Integral double endpoints that fit in int64_t use the standard integer
+/// distribution. Larger magnitudes are sampled by stable double interpolation
+/// and flooring, avoiding an out-of-range floating-to-integer conversion.
+double sample_uniform_integer(double min, double max, std::mt19937_64& rng);
+
 }  // namespace eval
 }  // namespace formulon
 
diff --git a/src/eval/scheduler.cpp b/src/eval/scheduler.cpp
index dd4021863..94d10173c 100644
--- a/src/eval/scheduler.cpp
+++ b/src/eval/scheduler.cpp
@@ -65,13 +65,9 @@ using detail::RecalcReentryGuard;
 
 // The spill-release queue, the progress snapshot and the wave ceilings are
 // shared with the serial `RecalcEngine::recalc`; see `spill_release.h`.
-using detail::BlockedSpillState;
-using detail::canonical_release_targets;
-using detail::kMaxNoProgressSpillWaves;
-using detail::kMaxSpillReleaseWaves;
 using detail::queue_spill_release;
-using detail::snapshot_blocked_spills;
 using detail::SpillReleaseQueue;
+using detail::SpillWaveBudget;
 
 // Maps each cell in the dirty SCC list to its 0-based super-node id. SCC
 // indices are assigned in iteration order of `sccs_dirty`.
@@ -302,11 +298,13 @@ SccOutcome process_scc(const std::vector<CellNodeId>& component, Workbook& wb, c
       }
       return out;
     }
-    if (obs.log != nullptr) {
-      // A reader already evaluated as a singleton in this recalc starts the
-      // solve from the value it showed before.
+    {
+      // A reader already evaluated as a singleton starts from the value it showed before.
       std::lock_guard<std::mutex> guard(write_mutex);
-      obs.log->restore_prior_values(wb, cells);
+      if (obs.log != nullptr) {
+        obs.log->restore_prior_values(wb, cells);
+      }
+      prepare_iterative_component_seeds(wb, cells);
     }
     const IterativeOutcome outcome =
         run_iterative_solve(cells, iter_opts, evaluate_one, commit, progress_cb, progress_user_data);
@@ -617,12 +615,7 @@ Expected<void, Error> recalc_parallel_impl(Workbook& wb, const FunctionRegistry&
   std::uint64_t parallel_steps = 0;
   std::uint64_t serial_fallback_steps = 0;
   std::uint64_t cycle_recoveries = 0;
-  std::size_t release_waves = 0U;
-  std::size_t dependency_waves = 0U;
-  std::size_t no_progress_waves = 0U;
-  std::vector<BlockedSpillState> previous_release_state;
-  std::vector<CellNodeId> previous_release_targets;
-  bool have_previous_release_state = false;
+  SpillWaveBudget wave_budget;
   const std::uint32_t configured_worker_count = resolve_thread_count(cfg.num_threads);
   // Keep one pool for the complete pass. A spill/dependency retry is another
   // wave of the same recalc, not a new recalc invocation; workers therefore
@@ -765,6 +758,22 @@ Expected<void, Error> recalc_parallel_impl(Workbook& wb, const FunctionRegistry&
         (dynamic_reference_bearing ? isolated : pooled).push_back(scc_id);
       }
 
+      // Runs `sccs` in order on the calling thread; false once the arena is exhausted.
+      const auto run_on_caller = [&](const std::vector<std::size_t>& sccs) {
+        Arena& arena = *arenas[0U];
+        for (std::size_t position = 0U; position < sccs.size(); ++position) {
+          const SccOutcome o = process_scc(idx.components[sccs[position]], wb, engine.graph_, registry, iter_opts,
+                                           arena, progress_cb, progress_user_data, write_mutex, release_callback,
+                                           &release_queue, observation(layer_index, position + 1U));
+          if (o.arena_exhausted) {
+            return false;
+          }
+          cells_evaluated += o.cells_evaluated;
+          cycle_recoveries += o.cycle_recoveries;
+        }
+        return true;
+      };
+
       bool run_serial = pooled.size() <= 1U || configured_worker_count <= 1U || callback_cycle;
       if (!run_serial && worker_pool == nullptr) {
         // The pool is lazy so a no-op / serial-only recalc starts no OS
@@ -785,17 +794,8 @@ Expected<void, Error> recalc_parallel_impl(Workbook& wb, const FunctionRegistry&
       if (run_serial) {
         // Tiny layer or single-worker mode: process serially on this thread.
         ++serial_fallback_steps;
-        Arena& arena = *arenas[0U];
-        for (std::size_t position = 0U; position < layer.size(); ++position) {
-          const std::size_t scc_id = layer[position];
-          const SccOutcome o = process_scc(idx.components[scc_id], wb, engine.graph_, registry, iter_opts, arena,
-                                           progress_cb, progress_user_data, write_mutex, release_callback,
-                                           &release_queue, observation(layer_index, position + 1U));
-          if (o.arena_exhausted) {
-            return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during parallel recalc");
-          }
-          cells_evaluated += o.cells_evaluated;
-          cycle_recoveries += o.cycle_recoveries;
+        if (!run_on_caller(layer)) {
+          return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during parallel recalc");
         }
         continue;
       }
@@ -839,17 +839,8 @@ Expected<void, Error> recalc_parallel_impl(Workbook& wb, const FunctionRegistry&
       // dynamic-reference super-nodes run.
       if (!isolated.empty()) {
         ++serial_fallback_steps;
-        Arena& arena = *arenas[0U];
-        for (std::size_t position = 0U; position < isolated.size(); ++position) {
-          const std::size_t scc_id = isolated[position];
-          const SccOutcome o = process_scc(idx.components[scc_id], wb, engine.graph_, registry, iter_opts, arena,
-                                           progress_cb, progress_user_data, write_mutex, release_callback,
-                                           &release_queue, observation(layer_index, position + 1U));
-          if (o.arena_exhausted) {
-            return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during parallel recalc");
-          }
-          cells_evaluated += o.cells_evaluated;
-          cycle_recoveries += o.cycle_recoveries;
+        if (!run_on_caller(isolated)) {
+          return make_error(FormulonErrorCode::kOutOfMemory, "evaluation arena exhausted during parallel recalc");
         }
       }
     }
@@ -901,7 +892,7 @@ Expected<void, Error> recalc_parallel_impl(Workbook& wb, const FunctionRegistry&
     const bool dynamic_retry = !dynamic.end_wave(nullptr).empty();
     const bool dependency_retry = !dependency_delta.added.empty() || dynamic_retry;
     if (dependency_retry) {
-      ++dependency_waves;
+      wave_budget.count_dependency_wave();
       for (const DepGraph::Edge& edge : dependency_delta.added) {
         engine.dirty_.mark(edge.first);
       }
@@ -909,22 +900,9 @@ Expected<void, Error> recalc_parallel_impl(Workbook& wb, const FunctionRegistry&
 
     const std::vector<CellNodeId> released = release_queue.take();
     if (!released.empty() || dependency_retry) {
-      ++release_waves;
-      if (!released.empty()) {
-        const std::vector<BlockedSpillState> release_state = snapshot_blocked_spills(wb);
-        const std::vector<CellNodeId> release_targets = canonical_release_targets(released);
-        if (have_previous_release_state && release_state == previous_release_state &&
-            release_targets == previous_release_targets) {
-          ++no_progress_waves;
-        } else {
-          no_progress_waves = 0U;
-        }
-        previous_release_state = release_state;
-        previous_release_targets = release_targets;
-        have_previous_release_state = true;
-      }
-      if (release_waves > kMaxSpillReleaseWaves || dependency_waves > kMaxSpillReleaseWaves ||
-          (!released.empty() && no_progress_waves >= kMaxNoProgressSpillWaves)) {
+      wave_budget.count_release_wave();
+      wave_budget.observe_release(wb, released);
+      if (wave_budget.exceeded(!released.empty())) {
         // Keep the current dirty set, including unrelated work, while
         // retaining the release targets for a caller retry after an
         // external mutation.
@@ -943,6 +921,7 @@ Expected<void, Error> recalc_parallel_impl(Workbook& wb, const FunctionRegistry&
 
     // Phase 5: clear the dirty set.
     engine.dirty_.clear();
+    engine.disabled_cycle_refs_pending_ = false;
 
     if (stats != nullptr) {
       stats->cells_evaluated = cells_evaluated;
diff --git a/src/eval/shape_ops_lazy.cpp b/src/eval/shape_ops_lazy.cpp
index 349721b31..a39f59660 100644
--- a/src/eval/shape_ops_lazy.cpp
+++ b/src/eval/shape_ops_lazy.cpp
@@ -63,14 +63,7 @@ bool resolve_shape(const parser::AstNode& raw_arg, Arena& arena, const FunctionR
   // so the kind dispatch below sees the same shape it would for a literal
   // `=ROWS(A1:C3)`. Single-cell Refs and scalar bindings are left as-is
   // (the scalar fallback already returns 1x1 for them).
-  const parser::AstNode* effective = &raw_arg;
-  if (raw_arg.kind() == parser::NodeKind::NameRef) {
-    const parser::AstNode& resolved = resolve_name_ast(raw_arg, ctx.name_env());
-    if (&resolved != &raw_arg && is_range_shaped_ast(resolved)) {
-      effective = &resolved;
-    }
-  }
-  const parser::AstNode& arg_node = *effective;
+  const parser::AstNode& arg_node = resolve_range_binding(raw_arg, ctx.name_env(), /*accept_ref=*/false);
   const parser::NodeKind k = arg_node.kind();
   if (k == parser::NodeKind::Ref || k == parser::NodeKind::RangeOp) {
     parser::Reference lhs{};
@@ -189,16 +182,7 @@ double sumproduct_coerce(const Value& v) {
 // is exhausted; every caller maps that to `#NUM!`.
 const ArrayValue* make_array_value(Arena& arena, std::uint32_t rows, std::uint32_t cols,
                                    const std::vector<Value>& cells) {
-  Value* buffer = nullptr;
-  const ArrayValue* arr = allocate_array_value(rows, cols, arena, buffer, kMaxDerivedArrayCells);
-  if (arr == nullptr) {
-    return nullptr;
-  }
-  const std::size_t n = static_cast<std::size_t>(rows) * static_cast<std::size_t>(cols);
-  for (std::size_t i = 0; i < n; ++i) {
-    buffer[i] = cells[i];
-  }
-  return arr;
+  return array_from_values(rows, cols, cells.data(), cells.size(), arena);
 }
 
 // `Value::array(nullptr)` is not a legal value, so every `make_array_value`
@@ -301,14 +285,7 @@ Value eval_row_or_column(const parser::AstNode& call, Arena& arena, const Functi
   // accept the broader "Ref OR range-shaped" set: ROW(single-cell Ref)
   // is meaningful (returns its row), so unlike the SUM-style passthrough
   // we do not exclude bare Refs here.
-  const parser::AstNode* effective = &raw_arg;
-  if (raw_arg.kind() == parser::NodeKind::NameRef) {
-    const parser::AstNode& resolved = resolve_name_ast(raw_arg, ctx.name_env());
-    if (&resolved != &raw_arg && (resolved.kind() == parser::NodeKind::Ref || is_range_shaped_ast(resolved))) {
-      effective = &resolved;
-    }
-  }
-  const parser::AstNode& arg = *effective;
+  const parser::AstNode& arg = resolve_range_binding(raw_arg, ctx.name_env(), /*accept_ref=*/true);
   const parser::NodeKind k = arg.kind();
   parser::Reference rect_lhs{};
   parser::Reference rect_rhs{};
@@ -428,14 +405,7 @@ Value eval_sumproduct_lazy(const parser::AstNode& call, Arena& arena, const Func
     // shape it would for a literal `=SUMPRODUCT(A1:A3)`. Single-cell Refs
     // and scalar bindings are left as-is (the scalar fallback already
     // returns 1x1 for them). This mirrors `resolve_shape` above.
-    const parser::AstNode* effective = &raw_arg;
-    if (raw_arg.kind() == parser::NodeKind::NameRef) {
-      const parser::AstNode& resolved = resolve_name_ast(raw_arg, ctx.name_env());
-      if (&resolved != &raw_arg && is_range_shaped_ast(resolved)) {
-        effective = &resolved;
-      }
-    }
-    const parser::AstNode& arg_node = *effective;
+    const parser::AstNode& arg_node = resolve_range_binding(raw_arg, ctx.name_env(), /*accept_ref=*/false);
     const parser::NodeKind k = arg_node.kind();
     ArgArray a{};
     if (k == parser::NodeKind::Ref || k == parser::NodeKind::RangeOp || k == parser::NodeKind::Call) {
@@ -535,14 +505,7 @@ Value eval_node_as_array(const parser::AstNode& node, Arena& arena, const Functi
   // LET-binding NameRef passthrough: mirror the pattern used by the other
   // shape-aware seams so `=LET(r, A1:A3, r+1)` sees the bound RangeOp / Call
   // AST rather than the NameRef wrapper.
-  const parser::AstNode* effective = &node;
-  if (node.kind() == parser::NodeKind::NameRef) {
-    const parser::AstNode& resolved = resolve_name_ast(node, ctx.name_env());
-    if (&resolved != &node && (resolved.kind() == parser::NodeKind::Ref || is_range_shaped_ast(resolved))) {
-      effective = &resolved;
-    }
-  }
-  const parser::AstNode& target = *effective;
+  const parser::AstNode& target = resolve_range_binding(node, ctx.name_env(), /*accept_ref=*/true);
   const parser::NodeKind k = target.kind();
 
   // BinaryOp -> recurse into the cellwise broadcaster.
diff --git a/src/eval/spill_anchor.cpp b/src/eval/spill_anchor.cpp
index dae9011ab..e32a9deed 100644
--- a/src/eval/spill_anchor.cpp
+++ b/src/eval/spill_anchor.cpp
@@ -50,15 +50,11 @@ ArrayValue* project_spill_at_anchor(std::string_view sheet, std::uint32_t row, s
     *out_err = ErrorCode::Ref;
     return nullptr;
   }
-  Value* buffer = nullptr;
-  ArrayValue* arr = allocate_array_value(rows, cols, arena, buffer, kMaxDerivedArrayCells);
+  ArrayValue* arr = array_from_values(rows, cols, cells.data(), cells.size(), arena);
   if (arr == nullptr) {
     *out_err = ErrorCode::Num;
     return nullptr;
   }
-  for (std::size_t i = 0; i < cells.size(); ++i) {
-    buffer[i] = cells[i];
-  }
   return arr;
 }
 
diff --git a/src/eval/spill_release.cpp b/src/eval/spill_release.cpp
index 8a900347a..ec83f4618 100644
--- a/src/eval/spill_release.cpp
+++ b/src/eval/spill_release.cpp
@@ -75,4 +75,20 @@ std::vector<CellNodeId> canonical_release_targets(const std::vector<CellNodeId>&
   return sorted;
 }
 
+void SpillWaveBudget::observe_release(const Workbook& workbook, const std::vector<CellNodeId>& released) {
+  if (released.empty()) {
+    return;
+  }
+  const std::vector<BlockedSpillState> release_state = snapshot_blocked_spills(workbook);
+  const std::vector<CellNodeId> release_targets = canonical_release_targets(released);
+  if (have_previous_ && release_state == previous_state_ && release_targets == previous_targets_) {
+    ++no_progress_waves_;
+  } else {
+    no_progress_waves_ = 0U;
+  }
+  previous_state_ = release_state;
+  previous_targets_ = release_targets;
+  have_previous_ = true;
+}
+
 }  // namespace formulon::eval::detail
diff --git a/src/eval/spill_release.h b/src/eval/spill_release.h
index 1d5676a56..34e48c948 100644
--- a/src/eval/spill_release.h
+++ b/src/eval/spill_release.h
@@ -89,6 +89,34 @@ std::vector<CellNodeId> canonical_release_targets(const std::vector<CellNodeId>&
 constexpr std::size_t kMaxSpillReleaseWaves = 4096U;
 constexpr std::size_t kMaxNoProgressSpillWaves = 8U;
 
+/// Wave counters and the no-progress snapshot of one recalc call's release
+/// loop. Each driver decides which waves it counts; the ceilings are shared.
+class SpillWaveBudget {
+ public:
+  void count_release_wave() noexcept { ++release_waves_; }
+  void count_dependency_wave() noexcept { ++dependency_waves_; }
+
+  /// Counts a no-progress wave when the blocked geometry and the woken
+  /// targets both match the previous release, and resets the count
+  /// otherwise. No-op when `released` is empty.
+  void observe_release(const Workbook& workbook, const std::vector<CellNodeId>& released);
+
+  /// Whether a ceiling is exceeded. The no-progress ceiling applies only to
+  /// a wave that released anchors.
+  bool exceeded(bool released_any) const noexcept {
+    return release_waves_ > kMaxSpillReleaseWaves || dependency_waves_ > kMaxSpillReleaseWaves ||
+           (released_any && no_progress_waves_ >= kMaxNoProgressSpillWaves);
+  }
+
+ private:
+  std::size_t release_waves_ = 0U;
+  std::size_t dependency_waves_ = 0U;
+  std::size_t no_progress_waves_ = 0U;
+  std::vector<BlockedSpillState> previous_state_;
+  std::vector<CellNodeId> previous_targets_;
+  bool have_previous_ = false;
+};
+
 }  // namespace formulon::eval::detail
 
 #endif  // FORMULON_EVAL_SPILL_RELEASE_H_
diff --git a/src/eval/structured_ref_project.cpp b/src/eval/structured_ref_project.cpp
index 780137be2..bc1c4aa05 100644
--- a/src/eval/structured_ref_project.cpp
+++ b/src/eval/structured_ref_project.cpp
@@ -71,20 +71,12 @@ Value project_structured_ref(std::string_view table_name, std::string_view colum
   }
   const std::uint32_t rows = rect.row_last - rect.row_first + 1U;
   const std::uint32_t cols = rect.col_last - rect.col_first + 1U;
-  Value* buffer = nullptr;
-  ArrayValue* arr = allocate_array_value(rows, cols, arena, buffer, kMaxDerivedArrayCells);
+  const std::vector<Value>& expanded = cells.value();
+  ArrayValue* arr = array_from_values(rows, cols, expanded.data(), expanded.size(), arena);
   if (arr == nullptr) {
     *out_arena_exhausted = true;
     return Value::error(ErrorCode::Num);
   }
-  // The seam hands back uninitialised storage, so every cell must be
-  // written even when the expansion returned fewer values than the
-  // rectangle covers (a clamped whole-row / whole-column endpoint).
-  const std::size_t total = static_cast<std::size_t>(rows) * static_cast<std::size_t>(cols);
-  const std::vector<Value>& expanded = cells.value();
-  for (std::size_t i = 0; i < total; ++i) {
-    buffer[i] = i < expanded.size() ? expanded[i] : Value::blank();
-  }
   return Value::array(arr);
 }
 
diff --git a/src/eval/text_format/display_text.cpp b/src/eval/text_format/display_text.cpp
new file mode 100644
index 000000000..1cbdecfe1
--- /dev/null
+++ b/src/eval/text_format/display_text.cpp
@@ -0,0 +1,98 @@
+#include "eval/text_format/display_text.h"
+
+#include <cmath>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "eval/text_format/number_format.h"
+#include "sheet.h"
+#include "style_resolve.h"
+#include "styles.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace text_format {
+namespace {
+
+constexpr std::string_view kOverflowText = "########";
+
+DisplayText render_text(std::string_view text, std::string_view code) {
+  DisplayText result;
+  if (apply_text_format(text, code, result.text, FormatDialect::kStored) != FormatStatus::kOk) {
+    result.text = std::string(text);
+    result.status = DisplayStatus::kInvalidFormat;
+  }
+  return result;
+}
+
+DisplayText render_number(double number, std::string_view code, bool date1904) {
+  DisplayText result;
+  if (!std::isfinite(number)) {
+    result.text = std::string(kOverflowText);
+    result.status = DisplayStatus::kOverflow;
+    return result;
+  }
+  const std::string_view effective = code.empty() ? std::string_view("General") : code;
+  std::string out;
+  switch (apply_format(number, effective, out, date1904, FormatDialect::kStored)) {
+    case FormatStatus::kOk:
+      result.text = std::move(out);
+      break;
+    case FormatStatus::kOverflow:
+      result.text = std::string(kOverflowText);
+      result.status = DisplayStatus::kOverflow;
+      break;
+    case FormatStatus::kValueError:
+      apply_format(number, "General", result.text, date1904, FormatDialect::kStored);
+      result.status = DisplayStatus::kInvalidFormat;
+      break;
+  }
+  return result;
+}
+
+}  // namespace
+
+DisplayText format_value_for_display(const Value& value, std::string_view code, bool date1904) {
+  switch (value.kind()) {
+    case ValueKind::Number:
+      return render_number(value.as_number(), code, date1904);
+    case ValueKind::Text:
+      return render_text(value.as_text(), code);
+    case ValueKind::Bool:
+      return render_text(value.as_boolean() ? "TRUE" : "FALSE", code);
+    case ValueKind::Error: {
+      DisplayText result;
+      result.text = display_name(value.as_error());
+      return result;
+    }
+    default:
+      return DisplayText{};
+  }
+}
+
+std::string_view number_format_code_for_xf(const StylesTable& styles, const CellXf* xf) {
+  if (xf == nullptr) {
+    return {};
+  }
+  const std::optional<std::string_view> code = effective_num_fmt(styles, xf->num_fmt_id);
+  return code ? *code : std::string_view{};
+}
+
+DisplayText format_cell_for_display(const Workbook& workbook, const Sheet& sheet, std::uint32_t row,
+                                    std::uint32_t col) {
+  const EffectiveXf choice = select_effective_xf(sheet, row, col);
+  const std::vector<CellXf>& xfs = workbook.styles().cell_xfs;
+  const CellXf* xf = nullptr;
+  if (!xfs.empty()) {
+    const std::uint32_t xf_index = choice.xf_index < xfs.size() ? choice.xf_index : 0U;
+    xf = &xfs[xf_index];
+  }
+  return format_value_for_display(sheet.resolve_cell_value(row, col), number_format_code_for_xf(workbook.styles(), xf),
+                                  workbook.date1904());
+}
+
+}  // namespace text_format
+}  // namespace formulon
diff --git a/src/eval/text_format/display_text.h b/src/eval/text_format/display_text.h
new file mode 100644
index 000000000..87ab6a206
--- /dev/null
+++ b/src/eval/text_format/display_text.h
@@ -0,0 +1,63 @@
+//
+// Cell display text: the string Excel shows for a value under a number format.
+//
+// The result is independent of column width: a `*x` repeat fill emits no
+// characters and `_x` emits one space. A value that cannot be rendered in the
+// format (for example a date serial outside the calendar range) is reported
+// through `DisplayStatus` rather than by a width-dependent `#` run.
+
+#ifndef FORMULON_EVAL_TEXT_FORMAT_DISPLAY_TEXT_H_
+#define FORMULON_EVAL_TEXT_FORMAT_DISPLAY_TEXT_H_
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+#include "value.h"
+
+namespace formulon {
+
+class Workbook;
+class Sheet;
+struct CellXf;
+struct StylesTable;
+
+namespace text_format {
+
+/// Outcome of a display-text rendering.
+enum class DisplayStatus : int {
+  kOk = 0,
+  /// The value does not fit the format (e.g. date serial out of range);
+  /// `DisplayText::text` is `"########"`.
+  kOverflow = 1,
+  /// The format code is malformed; `DisplayText::text` is the General
+  /// rendering of the value.
+  kInvalidFormat = 2,
+};
+
+/// Display string plus the status it was produced under.
+struct DisplayText {
+  std::string text;
+  DisplayStatus status = DisplayStatus::kOk;
+};
+
+/// Renders `value` as Excel displays it under number-format `code`.
+/// Blank is empty, errors show their name, booleans show `TRUE`/`FALSE`,
+/// text uses the format's text section when it has one, and numbers go
+/// through `apply_format`. An empty `code` means General. `date1904`
+/// selects the workbook date epoch.
+DisplayText format_value_for_display(const Value& value, std::string_view code, bool date1904);
+
+/// Returns the number-format code of `xf` as resolved against `styles`
+/// (custom formats first, then the built-in table); empty for a null `xf`.
+std::string_view number_format_code_for_xf(const StylesTable& styles, const CellXf* xf);
+
+/// Display text of (`row`, `col`) of `sheet`, using the effective cell/row/
+/// column/default XF and the workbook's date system. A truly empty coordinate
+/// is empty; a spill phantom uses its resolved value and inherited style.
+DisplayText format_cell_for_display(const Workbook& workbook, const Sheet& sheet, std::uint32_t row, std::uint32_t col);
+
+}  // namespace text_format
+}  // namespace formulon
+
+#endif  // FORMULON_EVAL_TEXT_FORMAT_DISPLAY_TEXT_H_
diff --git a/src/eval/text_format/number_format.cpp b/src/eval/text_format/number_format.cpp
index 9554a8d54..f421491f4 100644
--- a/src/eval/text_format/number_format.cpp
+++ b/src/eval/text_format/number_format.cpp
@@ -21,38 +21,69 @@
 #include "eval/text_format/number_format_types.h"
 #include "eval/text_format/render_date.h"
 #include "eval/text_format/render_numeric.h"
+#include "utils/date_time.h"
 
 namespace formulon {
 namespace text_format {
+namespace {
 
-FormatStatus apply_format(double value, std::string_view format, std::string_view original_text, std::string& out,
-                          bool date1904) {
-  using number_format_detail::CondOp;
-  using number_format_detail::Section;
-  if (format.empty()) {
-    return FormatStatus::kOk;
-  }
+using number_format_detail::CondOp;
+using number_format_detail::kMaxDateSerial1900;
+using number_format_detail::Section;
+
+// A format code split into sections. The views in `raw` point into
+// `normalized`, so a `ParsedFormat` is filled in place and never moved.
+struct ParsedFormat {
+  std::string normalized;
+  std::vector<std::string_view> raw;
+  std::vector<Section> sections;
+};
+
+void parse_format(std::string_view format, FormatDialect dialect, ParsedFormat& parsed) {
   // Normalise the ja-JP full-width syntax once. All section/string views and
   // literal offsets below refer to this owned buffer for the duration of the
   // render; quoted and escaped payloads remain byte-for-byte unchanged.
-  const std::string normalized_format = number_format_detail::normalize_ja_jp_format_syntax(format);
-  const auto sections_raw = number_format_detail::split_sections(normalized_format);
-  if (sections_raw.empty()) {
-    return FormatStatus::kOk;
-  }
-  std::vector<Section> sections;
-  sections.reserve(sections_raw.size());
-  for (const auto& raw : sections_raw) {
+  parsed.normalized = number_format_detail::normalize_ja_jp_format_syntax(format);
+  parsed.raw = number_format_detail::split_sections(parsed.normalized);
+  parsed.sections.reserve(parsed.raw.size());
+  for (const auto& raw : parsed.raw) {
     Section s;
-    number_format_detail::tokenize_section(raw, s);
+    number_format_detail::tokenize_section(raw, s, dialect);
     number_format_detail::classify(s, raw);
-    sections.push_back(std::move(s));
+    parsed.sections.push_back(std::move(s));
   }
+}
 
-  // Caller is passing `original_text`: if the value is text (non-numeric
-  // source) and we have a text section (index 3 for 4-section formats; any
-  // `@` token in a single-section format also applies), route there.
-  const bool has_original_text = !original_text.empty();
+bool valid_format(const ParsedFormat& parsed) noexcept {
+  if (parsed.sections.size() > 4U) {
+    return false;
+  }
+  for (std::size_t i = 0; i < parsed.sections.size(); ++i) {
+    const Section& section = parsed.sections[i];
+    if (section.has_invalid_bracket || (i >= 2U && section.cond_op != CondOp::kNone)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+}  // namespace
+
+FormatStatus apply_format(double value, std::string_view format, std::string& out, bool date1904,
+                          FormatDialect dialect) {
+  if (format.empty()) {
+    return FormatStatus::kOk;
+  }
+  ParsedFormat parsed;
+  parse_format(format, dialect, parsed);
+  if (!valid_format(parsed)) {
+    return FormatStatus::kValueError;
+  }
+  const std::vector<std::string_view>& sections_raw = parsed.raw;
+  const std::vector<Section>& sections = parsed.sections;
+  if (sections.empty()) {
+    return FormatStatus::kOk;
+  }
 
   // Returns true if `op(v, pred)` holds; `kNone` is treated as the always-true
   // unconditional sentinel.
@@ -77,11 +108,9 @@ FormatStatus apply_format(double value, std::string_view format, std::string_vie
   };
 
   // Predicate-based dispatch (`[>N]` / `[<N]` / `[=N]` / ... section prefix).
-  // Excel's rule: when section 0 OR section 1 carries a predicate, sign-class
-  // dispatch is replaced by predicate matching. Sections are visited in
-  // declaration order; the first whose predicate holds wins. With three or
-  // more sections, section 2 is the unconditional fallback when neither
-  // predicate matches.
+  // When section 0 or 1 carries a predicate, predicate matching replaces
+  // sign-class dispatch; each branch below states what an unconditional arm
+  // stands for. A value no two-section arm accepts has no rendering.
   bool used_conditional = false;
   // Decide the section to use based on Excel's rules:
   //   1 section : apply to everything; text passes unformatted unless `@`
@@ -91,44 +120,64 @@ FormatStatus apply_format(double value, std::string_view format, std::string_vie
   //   4 sections: section 0 = positive; section 1 = negative; section 2 = zero;
   //               section 3 = text.
   int chosen = 0;
+  bool chosen_predicate_matched = false;
   const bool any_predicate = (!sections.empty() && sections[0].cond_op != CondOp::kNone) ||
                              (sections.size() >= 2 && sections[1].cond_op != CondOp::kNone);
-  if (has_original_text) {
-    if (sections.size() >= 4) {
-      chosen = 3;
-    } else {
-      // Single-section with an `@`: route through the numeric walker but
-      // `@` substitutes the text.
-      chosen = 0;
-    }
-  } else if (any_predicate) {
+  if (any_predicate) {
     used_conditional = true;
-    chosen = -1;
-    // Walk the first two sections, picking the first whose predicate holds.
-    // A section without a predicate (`cond_op == kNone`) acts as the
-    // catch-all in this position.
-    const std::size_t scan_limit = sections.size() < 2 ? sections.size() : 2;
-    for (std::size_t i = 0; i < scan_limit; ++i) {
-      if (cond_match(sections[i].cond_op, sections[i].cond_value, value)) {
-        chosen = static_cast<int>(i);
-        break;
-      }
-    }
-    if (chosen < 0) {
-      // Neither of sections 0/1 matched. Excel uses section 2 as the
-      // unconditional fallback when present; otherwise it falls through to
-      // section 1 (the predicateless section, by elimination) so that the
-      // user-supplied "else" arm renders. If both arms had predicates, fall
-      // back to section 0 to mirror Mac Excel's "first section wins" tiebreak.
-      if (sections.size() >= 3) {
-        chosen = 2;
-      } else if (sections.size() >= 2 && sections[1].cond_op == CondOp::kNone) {
-        chosen = 1;
-      } else if (!sections.empty() && sections[0].cond_op == CondOp::kNone) {
+    const bool first_predicate = sections[0].cond_op != CondOp::kNone;
+    const bool second_predicate = sections.size() >= 2U && sections[1].cond_op != CondOp::kNone;
+    if (sections.size() >= 3U) {
+      // Unconditional arms 0/1 are implicit positive/negative predicates; section 2 is the raw fallback.
+      const bool first_matches =
+          first_predicate ? cond_match(sections[0].cond_op, sections[0].cond_value, value) : value > 0.0;
+      if (first_matches) {
         chosen = 0;
+        chosen_predicate_matched = first_predicate;
       } else {
-        chosen = 0;
+        const bool second_matches =
+            second_predicate ? cond_match(sections[1].cond_op, sections[1].cond_value, value) : value < 0.0;
+        if (second_matches) {
+          chosen = 1;
+          chosen_predicate_matched = second_predicate;
+        } else {
+          chosen = 2;
+        }
+      }
+    } else if (sections.size() == 2U) {
+      if (first_predicate && second_predicate) {
+        if (cond_match(sections[0].cond_op, sections[0].cond_value, value)) {
+          chosen = 0;
+          chosen_predicate_matched = true;
+        } else if (cond_match(sections[1].cond_op, sections[1].cond_value, value)) {
+          chosen = 1;
+          chosen_predicate_matched = true;
+        } else {
+          return FormatStatus::kOverflow;
+        }
+      } else if (first_predicate) {
+        if (cond_match(sections[0].cond_op, sections[0].cond_value, value)) {
+          chosen = 0;
+          chosen_predicate_matched = true;
+        } else {
+          // The unconditional second arm is the fallback when the first arm carries the predicate.
+          chosen = 1;
+        }
+      } else {
+        // An unconditional first arm is the implicit positive arm; zero belongs to neither arm.
+        if (value > 0.0) {
+          chosen = 0;
+        } else if (cond_match(sections[1].cond_op, sections[1].cond_value, value)) {
+          chosen = 1;
+          chosen_predicate_matched = true;
+        } else {
+          return FormatStatus::kOverflow;
+        }
       }
+    } else {
+      // A lone predicate section still renders on a miss; the sign treatment below tells the cases apart.
+      chosen = 0;
+      chosen_predicate_matched = cond_match(sections[0].cond_op, sections[0].cond_value, value);
     }
   } else if (value > 0.0) {
     chosen = 0;
@@ -149,18 +198,13 @@ FormatStatus apply_format(double value, std::string_view format, std::string_vie
 
   const Section& section = sections[static_cast<std::size_t>(chosen)];
   const std::string_view raw_fmt = sections_raw[static_cast<std::size_t>(chosen)];
-  if (section.has_invalid_bracket) {
-    return FormatStatus::kValueError;
-  }
 
-  // For section 1 (negative) Excel emits the value's absolute representation
-  // unless the format itself includes an explicit minus sign. The numeric
-  // walker currently prefixes the minus from `signbit(scaled)`, so pass the
-  // absolute value when we've chosen the dedicated negative section.
+  // For section 1 (negative) Excel renders the magnitude; any explicit sign
+  // comes from that section's literals. The numeric walker prefixes a minus
+  // for negative input, so pass the magnitude for the dedicated negative arm.
   //
-  // When predicate-based dispatch picked the section, the chosen index no
-  // longer correlates with sign class — the value's sign should be rendered
-  // verbatim. Skip the abs-adjustment in that case.
+  // Predicate dispatch chooses its sign treatment below from the selected
+  // explicit or implicit arm; section index alone does not determine it.
   double render_value = value;
   if (!used_conditional) {
     if (chosen == 1 && sections.size() >= 2) {
@@ -169,46 +213,116 @@ FormatStatus apply_format(double value, std::string_view format, std::string_vie
       render_value = std::fabs(value);
     }
   } else if (value < 0.0) {
-    // Conditional sections do not imply a sign class, but an explicit
-    // literal minus in the selected section is itself the sign glyph. Feed
-    // it the magnitude so the numeric renderer does not prepend another
-    // minus (e.g. `[<=0]-0.00` must render `-1.50`, not `--1.50`).
-    bool has_explicit_minus = false;
-    for (const number_format_detail::Token& token : section.tokens) {
-      if (token.kind != number_format_detail::Tok::Literal || token.lit_end <= token.lit_begin) {
-        continue;
-      }
-      const std::string_view literal = raw_fmt.substr(token.lit_begin, token.lit_end - token.lit_begin);
-      if (literal.find('-') != std::string_view::npos) {
-        has_explicit_minus = true;
-        break;
+    bool use_magnitude = false;
+    if (section.cond_op != CondOp::kNone) {
+      if (chosen_predicate_matched) {
+        // Excel passes the magnitude for `<` at a threshold <= 0, and for `<=`/`=` at a threshold < 0.
+        switch (section.cond_op) {
+          case CondOp::kLt:
+            use_magnitude = section.cond_value <= 0.0;
+            break;
+          case CondOp::kLe:
+          case CondOp::kEq:
+            use_magnitude = section.cond_value < 0.0;
+            break;
+          default:
+            break;
+        }
+      } else if (sections.size() == 1U && !chosen_predicate_matched) {
+        // A negative miss renders positively for negative-only or all-positive predicates; `=` stays signed.
+        switch (section.cond_op) {
+          case CondOp::kLt:
+            use_magnitude = section.cond_value <= 0.0;
+            break;
+          case CondOp::kLe:
+            use_magnitude = section.cond_value < 0.0;
+            break;
+          case CondOp::kGt:
+          case CondOp::kGe:
+            use_magnitude = section.cond_value <= 0.0;
+            break;
+          case CondOp::kNe:
+            use_magnitude = section.cond_value < 0.0;
+            break;
+          case CondOp::kEq:
+          case CondOp::kNone:
+            break;
+        }
       }
+    } else if (sections.size() >= 3U && chosen == 1) {
+      // Section 1 is the implicit negative-magnitude arm; section 2 is the raw fallback and keeps the sign.
+      use_magnitude = true;
+    } else if (sections.size() == 2U && sections[0].cond_op != CondOp::kNone) {
+      // Only a predicate covering every positive value makes the second arm the negative section.
+      const CondOp first_op = sections[0].cond_op;
+      use_magnitude = ((first_op == CondOp::kGt || first_op == CondOp::kGe) && sections[0].cond_value <= 0.0) ||
+                      (first_op == CondOp::kNe && sections[0].cond_value < 0.0);
     }
-    if (has_explicit_minus) {
+
+    if (use_magnitude) {
       render_value = std::fabs(value);
     }
   }
 
-  if (section.is_text ||
-      (has_original_text && !section.is_date && section.integer_zero_digits == 0 && section.integer_opt_digits == 0 &&
-       section.integer_pad_digits == 0 && section.fraction_zero_digits == 0 && section.fraction_opt_digits == 0 &&
-       section.fraction_pad_digits == 0)) {
-    number_format_detail::render_text_section(section, raw_fmt, original_text, out);
-    return FormatStatus::kOk;
+  if (section.is_text) {
+    // A number selecting a text-only section (`@`, `"pre"@`) renders as General without its literals.
+    return apply_format(value, "General", out, date1904, dialect);
   }
   if (section.is_date) {
-    // Excel rejects out-of-range date serials from TEXT: the valid range is
-    // [0, 2958465] (the latter is 9999-12-31). Surface as #VALUE! rather than
-    // silently emitting an empty string.
-    if (render_value < 0.0 || render_value > 2958465.0) {
-      return FormatStatus::kValueError;
+    // The calendar runs from serial 0 to 9999-12-31. The 1904 system also
+    // shows a negative serial, as its magnitude behind a leading minus.
+    const double max_serial = date1904 ? kMaxDateSerial1900 - date_time::kDate1904EpochGap : kMaxDateSerial1900;
+    // The last calendar day keeps its time fraction; the next whole day is out of range in either epoch.
+    const bool out_of_range =
+        date1904 ? std::fabs(render_value) >= max_serial + 1.0 : render_value < 0.0 || render_value >= max_serial + 1.0;
+    if (out_of_range) {
+      return FormatStatus::kOverflow;
+    }
+    const std::size_t out_size = out.size();
+    if (render_value < 0.0) {
+      out.push_back('-');
+      render_value = -render_value;
+    }
+    const FormatStatus status = number_format_detail::render_date(section, raw_fmt, render_value, out, date1904);
+    if (status != FormatStatus::kOk) {
+      out.resize(out_size);
     }
-    number_format_detail::render_date(section, raw_fmt, render_value, out, date1904);
+    return status;
+  }
+  return number_format_detail::render_numeric(section, raw_fmt, render_value, out);
+}
+
+FormatStatus apply_text_format(std::string_view text, std::string_view format, std::string& out,
+                               FormatDialect dialect) {
+  ParsedFormat parsed;
+  parse_format(format, dialect, parsed);
+  // Even when the format has no text section and would otherwise pass the
+  // original bytes through unchanged, Excel validates every section first.
+  // This matters for text/bool TEXT values with a malformed numeric sibling
+  // section (for example `@;[invalid]0`).
+  if (!valid_format(parsed)) {
+    return FormatStatus::kValueError;
+  }
+  std::size_t chosen = 0;
+  if (parsed.sections.size() >= 4U) {
+    chosen = 3U;
+  } else if (parsed.sections.size() != 1U || !parsed.sections[0].is_text) {
+    out.append(text);
     return FormatStatus::kOk;
   }
-  number_format_detail::render_numeric(section, raw_fmt, render_value, out);
+  const Section& section = parsed.sections[chosen];
+  number_format_detail::render_text_section(section, parsed.raw[chosen], text, out);
   return FormatStatus::kOk;
 }
 
+bool negative_section_has_color(std::string_view format, FormatDialect dialect) {
+  ParsedFormat parsed;
+  parse_format(format, dialect, parsed);
+  if (parsed.sections.empty()) {
+    return false;
+  }
+  return parsed.sections[parsed.sections.size() >= 2U ? 1U : 0U].has_color;
+}
+
 }  // namespace text_format
 }  // namespace formulon
diff --git a/src/eval/text_format/number_format.h b/src/eval/text_format/number_format.h
index 1145c7444..593869a81 100644
--- a/src/eval/text_format/number_format.h
+++ b/src/eval/text_format/number_format.h
@@ -17,11 +17,11 @@
 //   Section split:  `;` (up to 4 sections: positive; negative; zero; text),
 //                   and conditional selectors such as `[>100]`.
 //   Digit styles:    `[DBNum1]`, `[DBNum2]`, `[DBNum3]`.
-//   Discarded:      `[赤]` / `[青]` / ... colour specifiers, currency
+//   Discarded:      `[赤]` / `[Red]` / ... colour specifiers, currency
 //                   locale prefixes like `[$-409]` (treated as inert).
-//                   Colour names follow the format string's locale, so the
-//                   English spellings are rejected under the ja-JP profile
-//                   just as Excel rejects them.
+//                   Colour names follow the code's `FormatDialect`: the
+//                   ja-JP spellings for a TEXT() argument, the English
+//                   ones for a stored cell format.
 //   Text-section:   `@` substitutes the original text input in the text
 //                   section of the format.
 //
@@ -41,41 +41,54 @@
 namespace formulon {
 namespace text_format {
 
-/// Return codes for `apply_format`. The engine surfaces `Value` / `Num`
-/// errors to the caller rather than throwing; parsing failures and
-/// unrepresentable renderings both map to `kValueError` so the caller can
-/// forward them as Excel's `#VALUE!`.
+/// Spelling of a format code. A TEXT() format argument is written in the UI
+/// locale (`[赤]`, `G/標準`); a cell's stored code (styles.xml / XLSB) is the
+/// locale-independent canonical form (`[Red]`, `[Color10]`, `General`).
+/// Colour names are accepted only in the dialect's own spelling, exactly as
+/// Excel rejects `=TEXT(5,"[Red]0")` on a ja-JP host.
+enum class FormatDialect : int {
+  kLocalized = 0,
+  kStored = 1,
+};
+
+/// Return codes for `apply_format`. The engine surfaces failures to the
+/// caller rather than throwing; callers that only need Excel's TEXT()
+/// semantics map every non-`kOk` value to `#VALUE!`.
 enum class FormatStatus : int {
   kOk = 0,
+  /// The format code is malformed (e.g. an unrecognised bracket).
   kValueError = 1,
+  /// The code is valid but the value has no rendering in it: a date or time
+  /// section given a serial outside the workbook's calendar range, a value no
+  /// conditional arm accepts, or numeric scaling/normalization overflowed to
+  /// a non-finite value.
+  kOverflow = 2,
 };
 
 /// Renders the numeric scalar `value` through `format`, appending the result
-/// to `out`. Returns `kOk` on success, `kValueError` on any format-parse or
-/// rendering failure.
+/// to `out`. An empty `format` yields an empty result.
 ///
-/// An empty `format` yields an empty result. `original_text` is the raw text
-/// form of the caller's value; if the format contains an `@` token in the
-/// text section, `original_text` is substituted there. When the caller
-/// passed a non-text value, `original_text` should be empty.
-///
-/// The engine does not perform any argument coercion itself: the caller is
-/// responsible for supplying a finite `value` (non-NaN, non-Inf) and a
-/// non-owning `std::string_view` for `original_text`. The format string is
-/// interpreted as UTF-8 bytes; quoted literal text and non-token bytes are
-/// copied verbatim.
+/// The caller supplies a finite `value` (non-NaN, non-Inf); no coercion is
+/// performed. The format string is interpreted as UTF-8 bytes; quoted literal
+/// text and non-token bytes are copied verbatim.
 /// `date1904` selects the workbook date epoch for date/time tokens (the
 /// serial->calendar conversion shifts by 1462 days under the 1904 system).
 /// Callers that render a value from a date1904 workbook (the TEXT builtin)
 /// must pass the workbook flag; the pure-numeric callers leave it false.
-FormatStatus apply_format(double value, std::string_view format, std::string_view original_text, std::string& out,
-                          bool date1904 = false);
+FormatStatus apply_format(double value, std::string_view format, std::string& out, bool date1904 = false,
+                          FormatDialect dialect = FormatDialect::kLocalized);
+
+/// Renders the text value `text` through the text section of `format`: the
+/// fourth section, or a single section containing `@`, with `@` replaced by
+/// `text`. A format without a text section shows `text` unchanged. An empty
+/// `text` is still a text value and takes the text section.
+FormatStatus apply_text_format(std::string_view text, std::string_view format, std::string& out,
+                               FormatDialect dialect = FormatDialect::kLocalized);
 
-/// Convenience overload for the pure-numeric path. Equivalent to
-/// `apply_format(value, format, {}, out, date1904)`.
-inline FormatStatus apply_format(double value, std::string_view format, std::string& out, bool date1904 = false) {
-  return apply_format(value, format, std::string_view{}, out, date1904);
-}
+/// True when the section of `format` that renders negative numbers (the
+/// second section, or the only one) carries a colour qualifier spelled in
+/// `dialect`.
+bool negative_section_has_color(std::string_view format, FormatDialect dialect);
 
 }  // namespace text_format
 }  // namespace formulon
diff --git a/src/eval/text_format/number_format_render.cpp b/src/eval/text_format/number_format_render.cpp
index bfd39e6a8..c4debd8c5 100644
--- a/src/eval/text_format/number_format_render.cpp
+++ b/src/eval/text_format/number_format_render.cpp
@@ -20,6 +20,7 @@
 #include <cstddef>
 #include <string>
 #include <string_view>
+#include <utility>
 
 #include "eval/text_format/number_format_types.h"
 #include "eval/text_format/render_common.h"
@@ -41,6 +42,9 @@ namespace {
 //   * `=TEXT(1234, "[DBNum2]0")` -> `壱弐参四` (NOT `壱阡弐百参拾四`).
 //   * `=TEXT(1234, "[DBNum3]0")` -> `１２３４` (full-width Arabic).
 //
+// The exception is `[DBNum1]General`, whose integer part is positional
+// (`千二百三十四`); `render_numeric.cpp` owns it.
+//
 // Tables:
 //   * DBNum1: 〇一二三四五六七八九 (weak-form everyday kanji digits).
 //   * DBNum2: 零壱弐参四伍六七捌玖. Digit 4 is the everyday form 四 (not
@@ -176,6 +180,33 @@ bool decimal_digits_all_zero(std::string_view digits) noexcept {
   return true;
 }
 
+void cap_integer_significant_digits(std::string* digits) {
+  constexpr std::size_t kSignificantDigits = 15u;
+  if (digits->size() <= kSignificantDigits) {
+    return;
+  }
+  const std::size_t original_length = digits->size();
+  std::string prefix = digits->substr(0, kSignificantDigits);
+  if ((*digits)[kSignificantDigits] >= '5') {
+    // Half-away-from-zero round-up, with carry propagation; an all-9s
+    // prefix carries out and grows by one digit (e.g. "999" -> "1000").
+    std::size_t i = prefix.size();
+    while (i > 0) {
+      --i;
+      if (prefix[i] != '9') {
+        ++prefix[i];
+        break;
+      }
+      prefix[i] = '0';
+      if (i == 0) {
+        prefix.insert(prefix.begin(), '1');
+      }
+    }
+  }
+  prefix.append(original_length - prefix.size(), '0');
+  *digits = std::move(prefix);
+}
+
 // --- Text-section walker ----------------------------------------------
 
 // Renders the text section by walking the raw format bytes. We do not
diff --git a/src/eval/text_format/number_format_scanner.cpp b/src/eval/text_format/number_format_scanner.cpp
index 814619902..0cdf50a50 100644
--- a/src/eval/text_format/number_format_scanner.cpp
+++ b/src/eval/text_format/number_format_scanner.cpp
@@ -468,10 +468,15 @@ namespace {
 // The eight color names a ja-JP format string may use, listed in the order
 // the English UI names them (black, blue, cyan, green, magenta, red, white,
 // yellow). Each is a single UTF-8 CJK character.
-constexpr std::string_view kColorNames[] = {"黒", "青", "水", "緑", "紫", "赤", "白", "黄"};
+constexpr std::string_view kLocalizedColorNames[] = {"黒", "青", "水", "緑", "紫", "赤", "白", "黄"};
 
-// Localized spelling of the indexed `ColorN` form.
-constexpr std::string_view kColorIndexPrefix = "色";
+// The same eight colors as a stored format code spells them.
+constexpr std::string_view kStoredColorNames[] = {"Black",   "Blue", "Cyan",  "Green",
+                                                  "Magenta", "Red",  "White", "Yellow"};
+
+// Localized and stored spellings of the indexed `ColorN` form.
+constexpr std::string_view kLocalizedColorIndexPrefix = "色";
+constexpr std::string_view kStoredColorIndexPrefix = "Color";
 
 // Highest index the indexed form accepts; `色57` is rejected.
 constexpr int kMaxColorIndex = 56;
@@ -480,6 +485,18 @@ bool starts_with(std::string_view s, std::string_view prefix) noexcept {
   return s.size() >= prefix.size() && s.substr(0, prefix.size()) == prefix;
 }
 
+bool starts_with_ascii_ci(std::string_view s, std::string_view prefix) noexcept {
+  if (s.size() < prefix.size()) {
+    return false;
+  }
+  for (std::size_t i = 0; i < prefix.size(); ++i) {
+    if (ascii_lower(s[i]) != ascii_lower(prefix[i])) {
+      return false;
+    }
+  }
+  return true;
+}
+
 // Reads one decimal digit at `body[i]`, accepting the ASCII digits and their
 // full-width forms U+FF10..U+FF19 alike (Excel folds full-width ASCII across
 // the whole format string, and the color index inherits that). Advances `i`
@@ -503,18 +520,28 @@ int take_digit(std::string_view body, std::size_t& i) noexcept {
 
 }  // namespace
 
-bool is_color_specifier(std::string_view body) noexcept {
-  for (const std::string_view name : kColorNames) {
-    if (starts_with(body, name)) {
-      return true;
+bool is_color_specifier(std::string_view body, FormatDialect dialect) noexcept {
+  const bool stored = dialect == FormatDialect::kStored;
+  if (stored) {
+    for (const std::string_view name : kStoredColorNames) {
+      if (starts_with_ascii_ci(body, name)) {
+        return true;
+      }
+    }
+  } else {
+    for (const std::string_view name : kLocalizedColorNames) {
+      if (starts_with(body, name)) {
+        return true;
+      }
     }
   }
-  if (!starts_with(body, kColorIndexPrefix)) {
+  const std::string_view prefix = stored ? kStoredColorIndexPrefix : kLocalizedColorIndexPrefix;
+  if (!(stored ? starts_with_ascii_ci(body, prefix) : starts_with(body, prefix))) {
     return false;
   }
-  // `色` then optional blanks then the index. Trailing bytes after the digit
-  // run are ignored the same way they are after a name.
-  std::size_t i = kColorIndexPrefix.size();
+  // The index prefix then optional blanks then the index. Trailing bytes
+  // after the digit run are ignored the same way they are after a name.
+  std::size_t i = prefix.size();
   while (i < body.size() && (body[i] == ' ' || body[i] == '\t')) {
     ++i;
   }
diff --git a/src/eval/text_format/number_format_scanner.h b/src/eval/text_format/number_format_scanner.h
index 00af77e32..dd0f1e925 100644
--- a/src/eval/text_format/number_format_scanner.h
+++ b/src/eval/text_format/number_format_scanner.h
@@ -43,22 +43,20 @@ bool is_date_letter(char c) noexcept;
 // the caller already matched at least one character).
 std::size_t scan_run(std::string_view fmt, std::size_t& i, char letter) noexcept;
 
-// Returns true if `body` is a color qualifier: either a named color or the
-// indexed `色N` form with N in 1..56.
+// Returns true if `body` is a color qualifier in `dialect`: a named color or
+// the indexed form with N in 1..56.
 //
-// A format string is interpreted in the UI locale, so the accepted spellings
-// are the localized ones. Under the ja-JP profile that means `黒`, `青`, `水`,
-// `緑`, `紫`, `赤`, `白`, `黄` and `色N` — the English `Red` / `ColorN`
-// spellings are *not* accepted and fall through to the invalid-bracket path,
-// exactly as Excel rejects `=TEXT(5,"[Red]0.00")` with #VALUE!. The English
-// names OOXML stores in `numFmtCode` are a separate, locale-independent
-// surface matched where stored formats are read.
+// The localized dialect (a TEXT() argument) takes the ja-JP spellings `黒`,
+// `青`, `水`, `緑`, `紫`, `赤`, `白`, `黄` and `色N`; the English `Red` /
+// `ColorN` fall through to the invalid-bracket path, exactly as Excel rejects
+// `=TEXT(5,"[Red]0.00")` with #VALUE!. The stored dialect (a cell's
+// `numFmtCode`) takes the English `Black`, `Blue`, `Cyan`, `Green`,
+// `Magenta`, `Red`, `White`, `Yellow` and `ColorN`, ASCII case-insensitively.
 //
 // The name is a prefix: anything after it in the same bracket is ignored, so
 // `[赤色]` and `[色1x]` are both accepted. Leading whitespace is not.
-// Excel discards the color itself inside TEXT, so a match is treated the same
-// as `[$...]` — inert.
-bool is_color_specifier(std::string_view body) noexcept;
+// The colour itself is discarded, so a match is inert like `[$...]`.
+bool is_color_specifier(std::string_view body, FormatDialect dialect) noexcept;
 
 // Detects an Excel conditional-section directive of the form `[op N]`,
 // where `op` is one of `>`, `>=`, `<`, `<=`, `=`, `<>` and `N` is a literal
diff --git a/src/eval/text_format/number_format_section.cpp b/src/eval/text_format/number_format_section.cpp
index 3ceed788a..b98547dec 100644
--- a/src/eval/text_format/number_format_section.cpp
+++ b/src/eval/text_format/number_format_section.cpp
@@ -16,6 +16,7 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 #include <string_view>
 #include <vector>
 
@@ -27,6 +28,10 @@ namespace text_format {
 namespace number_format_detail {
 namespace {
 
+// An 18-digit fixed denominator keeps one decimal digit times the
+// denominator plus carry below UINT64_MAX in the fraction renderer.
+constexpr std::uint64_t kMaxFractionDenominator = 999999999999999999ULL;
+
 // After tokenization, rewrite DateMOrMin tokens into either DateM/DateMM
 // (month) or DateMin/DateMMMin (minute) based on surrounding context.
 // Rule (matches Excel): a DateMOrMin between an hour token and a second
@@ -153,6 +158,7 @@ void classify(Section& section, std::string_view fmt) noexcept {
   int frac_opt = 0;
   int frac_pad = 0;
   bool has_percent = false;
+  int percent_count = 0;
   bool saw_sci = false;
   bool sci_plus = false;
   int sci_digits = 0;
@@ -194,6 +200,7 @@ void classify(Section& section, std::string_view fmt) noexcept {
     }
     if (tk.kind == Tok::Percent) {
       has_percent = true;
+      ++percent_count;
     }
     if (tk.kind == Tok::SciPlus || tk.kind == Tok::SciMinus) {
       saw_sci = true;
@@ -242,6 +249,24 @@ void classify(Section& section, std::string_view fmt) noexcept {
       }
     }
   }
+  // A comma run immediately after the last integer placeholder and before
+  // the decimal point is also a scale marker (`0,.00`, `#,##0,.00`). A comma
+  // between fractional placeholders (`0.0,0`) remains an inert separator.
+  if (point_index >= 0 && last_integer_digit_index >= 0 && last_integer_digit_index + 1 < point_index) {
+    bool only_scaling_commas = true;
+    int before_point_commas = 0;
+    for (int i = last_integer_digit_index + 1; i < point_index; ++i) {
+      if (section.tokens[static_cast<std::size_t>(i)].kind == Tok::Comma) {
+        ++before_point_commas;
+      } else {
+        only_scaling_commas = false;
+        break;
+      }
+    }
+    if (only_scaling_commas) {
+      trailing_commas += before_point_commas;
+    }
+  }
   // Thousands-separator test: any `,` between two integer digit tokens
   // triggers it. Bounded by the integer part so a scaling comma placed after
   // the fraction cannot be mistaken for a group separator.
@@ -288,7 +313,7 @@ void classify(Section& section, std::string_view fmt) noexcept {
           // renderer skips them when emitting the regular date sequence.
           Token marker;
           marker.kind = Tok::FracSecDigits;
-          marker.width = static_cast<std::uint8_t>(digits);
+          marker.width = static_cast<std::size_t>(digits);
           section.tokens[i + 1] = marker;
           // Clear the fractional digit tokens (mark them as empty literals).
           for (std::size_t k = i + 2; k < j; ++k) {
@@ -308,13 +333,12 @@ void classify(Section& section, std::string_view fmt) noexcept {
   }
 
   section.is_date = any_date;
-  // A section is classified as `text` whenever it contains an `@` token and
-  // no numeric digit tokens. Stray date letters that slipped into literal
-  // phrases (e.g. the `s` in "text is @") are tolerated: we demote them to
-  // literals during text rendering by ignoring any non-`@` / non-Literal
-  // token in `render_text_section`.
-  section.is_text =
-      any_at && int_zero == 0 && int_opt == 0 && int_pad == 0 && frac_zero == 0 && frac_opt == 0 && frac_pad == 0;
+  // A text section contains `@` and literal text, without numeric or date
+  // tokens. Literal phrases containing date letters must be quoted.
+  const bool has_numeric_tokens = int_zero != 0 || int_opt != 0 || int_pad != 0 || frac_zero != 0 || frac_opt != 0 ||
+                                  frac_pad != 0 || has_general || saw_sci || has_percent;
+  const bool invalid_mixed_at = any_at && (any_date || has_numeric_tokens);
+  section.is_text = any_at && !invalid_mixed_at;
   section.integer_zero_digits = int_zero;
   section.integer_opt_digits = int_opt;
   section.integer_pad_digits = int_pad;
@@ -328,6 +352,14 @@ void classify(Section& section, std::string_view fmt) noexcept {
   section.sci_plus = sci_plus;
   section.sci_digits = sci_digits;
 
+  // Excel rejects a text placeholder mixed with any numeric, date, General,
+  // or scientific token. A lone text section (including quoted literals
+  // around `@`) remains valid. Repeated percent markers and scientific
+  // percent formats are also invalid stored number formats.
+  if (invalid_mixed_at || percent_count > 1 || (saw_sci && has_percent)) {
+    section.has_invalid_bracket = true;
+  }
+
   // Excel rejects formats that mix date tokens with number-digit tokens in
   // the same section (e.g. `mm###`). Mac Excel 365 and IronCalc both
   // surface `#VALUE!` here. Reuse the `has_invalid_bracket` channel so
@@ -338,22 +370,11 @@ void classify(Section& section, std::string_view fmt) noexcept {
 
   // --- Fraction format detection (`# ?/?`, `0/0`, etc.) ----------------
   //
-  // A fraction format has these features:
-  //   * Exactly one literal '/' byte token in the section.
-  //   * Immediately before the slash: a contiguous run of digit-placeholder
-  //     tokens (`#`/`?`/`0`) -- the numerator group.
-  //   * Immediately after the slash: a contiguous run of digit-placeholder
-  //     tokens -- the denominator group.
-  //   * Optionally before the numerator: an integer-placeholder run and
-  //     exactly one literal-space byte that visually separates the integer
-  //     from the numerator.
-  //   * No `.` (Point) token (fractions and decimal points are mutually
-  //     exclusive).
-  //
-  // When detected, we set `is_fraction` and the digit-group bounds; the
-  // renderer's `render_numeric` branches into `render_fraction` based on
-  // the flag. Date sections never qualify (the slash inside a date is a
-  // date separator).
+  // Fraction structure is driven by an unquoted, unescaped slash token. A
+  // slash copied from a quoted or escaped payload remains an ordinary
+  // literal, even when it sits between digit placeholders. A raw denominator
+  // containing a non-zero digit is fixed; all-zero and placeholder runs
+  // remain variable bounded searches.
   auto is_digit_tok2 = [](Tok k) { return k == Tok::DigitZero || k == Tok::DigitOpt || k == Tok::DigitPad; };
   auto is_single_byte_literal = [&fmt](const Token& tk, char want) {
     if (tk.kind != Tok::Literal) {
@@ -368,11 +389,11 @@ void classify(Section& section, std::string_view fmt) noexcept {
     return fmt[tk.lit_begin] == want;
   };
   if (!any_date && point_index < 0) {
-    // Find slash candidate.
+    // Exactly one structural slash; quoted or escaped slashes never form a fraction.
     int slash_idx = -1;
     int slash_count = 0;
     for (std::size_t i = 0; i < section.tokens.size(); ++i) {
-      if (is_single_byte_literal(section.tokens[i], '/')) {
+      if (section.tokens[i].fraction_slash_candidate) {
         slash_idx = static_cast<int>(i);
         ++slash_count;
       }
@@ -384,17 +405,73 @@ void classify(Section& section, std::string_view fmt) noexcept {
       while (num_begin > 0 && is_digit_tok2(section.tokens[static_cast<std::size_t>(num_begin) - 1].kind)) {
         --num_begin;
       }
-      // Walk right from slash to find denominator group.
+      // A raw run starting with 0 is variable only when all zeros (`/000`); `/08` is fixed.
       int den_begin = slash_idx + 1;
       int den_end = den_begin;
-      while (static_cast<std::size_t>(den_end) + 1 <= section.tokens.size() &&
-             is_digit_tok2(section.tokens[static_cast<std::size_t>(den_end)].kind)) {
-        ++den_end;
+      bool fixed_denominator = false;
+      std::uint64_t fixed_denominator_value = 0;
+      int fixed_den_end = den_begin;
+      int raw_den_end = den_begin;
+      bool raw_den_overflow = false;
+      bool raw_den_nonzero = false;
+      while (raw_den_end < static_cast<int>(section.tokens.size())) {
+        const Token& token = section.tokens[static_cast<std::size_t>(raw_den_end)];
+        char digit = '\0';
+        if (token.kind == Tok::DigitZero) {
+          digit = '0';
+        } else if (token.kind == Tok::Literal && !token.protected_literal && token.lit_end == token.lit_begin + 1 &&
+                   token.lit_begin < fmt.size()) {
+          const char raw = fmt[token.lit_begin];
+          if (raw >= '0' && raw <= '9') {
+            digit = raw;
+          }
+        }
+        if (digit == '\0') {
+          break;
+        }
+        raw_den_nonzero = raw_den_nonzero || digit != '0';
+        const std::uint64_t digit_value = static_cast<std::uint64_t>(digit - '0');
+        constexpr std::uint64_t kMax = std::numeric_limits<std::uint64_t>::max();
+        if (fixed_denominator_value > (kMax - digit_value) / 10U) {
+          section.has_invalid_bracket = true;
+          raw_den_overflow = true;
+          break;
+        }
+        fixed_denominator_value = fixed_denominator_value * 10U + digit_value;
+        ++raw_den_end;
+      }
+      if (!raw_den_overflow && raw_den_end > den_begin && raw_den_nonzero) {
+        fixed_denominator = true;
+        fixed_den_end = raw_den_end;
+        if (fixed_denominator_value > kMaxFractionDenominator) {
+          // Denominators wider than the renderer's uint64_t bound are malformed, not partially rendered.
+          section.has_invalid_bracket = true;
+          fixed_denominator = false;
+        }
+      } else {
+        // An all-zero run is a zero-placeholder denominator, as are mixed `0?` and `?0`.
+        while (static_cast<std::size_t>(den_end) < section.tokens.size() &&
+               is_digit_tok2(section.tokens[static_cast<std::size_t>(den_end)].kind)) {
+          ++den_end;
+        }
+        if (den_end == den_begin && den_begin < static_cast<int>(section.tokens.size())) {
+          const Token& first = section.tokens[static_cast<std::size_t>(den_begin)];
+          if (first.kind == Tok::Literal && first.protected_literal && first.lit_begin < fmt.size() &&
+              first.lit_end > first.lit_begin && fmt[first.lit_begin] >= '1' && fmt[first.lit_begin] <= '9') {
+            // Excel rejects a quoted or escaped fixed denominator.
+            section.has_invalid_bracket = true;
+          }
+        }
       }
+
+      if (fixed_denominator) {
+        den_end = fixed_den_end;
+      }
+
       // Numerator and denominator both need to be at least one digit.
       const bool has_num =
           num_end >= num_begin && is_digit_tok2(section.tokens[static_cast<std::size_t>(num_begin)].kind);
-      const bool has_den = den_end > den_begin;
+      const bool has_den = fixed_denominator ? fixed_den_end > den_begin : den_end > den_begin;
       if (has_num && has_den) {
         // Optional integer group: a literal-space immediately precedes the
         // numerator group, and a digit-placeholder run precedes the space.
@@ -417,8 +494,16 @@ void classify(Section& section, std::string_view fmt) noexcept {
         section.fraction_den_end = den_end;
         section.fraction_slash_index = slash_idx;
         section.fraction_int_max_digits = int_end - int_begin;
-        section.fraction_num_max_digits = (num_end + 1) - num_begin;
-        section.fraction_den_max_digits = den_end - den_begin;
+        section.fraction_den_max_digits = fixed_denominator ? 0 : den_end - den_begin;
+        section.fraction_fixed_denominator = fixed_denominator;
+        section.fraction_fixed_denominator_value = fixed_denominator ? fixed_denominator_value : 1U;
+        // A trailing comma after a fraction denominator is invalid, not a scaling marker.
+        for (std::size_t i = static_cast<std::size_t>(den_end); i < section.tokens.size(); ++i) {
+          if (section.tokens[i].kind == Tok::Comma) {
+            section.has_invalid_bracket = true;
+            break;
+          }
+        }
       }
     }
   }
diff --git a/src/eval/text_format/number_format_tokenizer.cpp b/src/eval/text_format/number_format_tokenizer.cpp
index ed8925158..6fa931d9f 100644
--- a/src/eval/text_format/number_format_tokenizer.cpp
+++ b/src/eval/text_format/number_format_tokenizer.cpp
@@ -23,9 +23,9 @@ namespace formulon {
 namespace text_format {
 namespace number_format_detail {
 
-void tokenize_section(std::string_view fmt, Section& out) {
+void tokenize_section(std::string_view fmt, Section& out, FormatDialect dialect) {
   std::vector<Token>& toks = out.tokens;
-  auto push_literal = [&](std::size_t b, std::size_t e) {
+  auto push_literal = [&](std::size_t b, std::size_t e, bool protected_literal = false) {
     if (b == e) {
       return;
     }
@@ -33,6 +33,7 @@ void tokenize_section(std::string_view fmt, Section& out) {
     t.kind = Tok::Literal;
     t.lit_begin = b;
     t.lit_end = e;
+    t.protected_literal = protected_literal;
     toks.push_back(t);
   };
 
@@ -46,23 +47,32 @@ void tokenize_section(std::string_view fmt, Section& out) {
       while (j < fmt.size() && fmt[j] != '"') {
         ++j;
       }
-      push_literal(i + 1, j);
-      i = j < fmt.size() ? j + 1 : j;
+      if (j == fmt.size()) {
+        out.has_invalid_bracket = true;
+        return;
+      }
+      push_literal(i + 1, j, true);
+      i = j + 1;
       continue;
     }
+    // Escape, spacing, and fill operators each require a following scalar.
+    if ((c == '\\' || c == '!' || c == '_' || c == '*') && i + 1 == fmt.size()) {
+      out.has_invalid_bracket = true;
+      return;
+    }
     // Escape `\x` or `!x` -> next UTF-8 scalar is a literal.
     if ((c == '\\' || c == '!') && i + 1 < fmt.size()) {
       const std::size_t payload_width = utf8_scalar_width(fmt, i + 1);
-      push_literal(i + 1, i + 1 + payload_width);
+      push_literal(i + 1, i + 1 + payload_width, true);
       i += 1 + payload_width;
       continue;
     }
     // Bracketed specifier. Recognised kinds:
     //   `[h]` / `[m]` / `[s]`   -> elapsed-time tokens (any run length).
     //   `[$...]`                -> locale-currency marker; silently dropped.
-    //   `[赤]` / `[青]` / ...    -> named color qualifier; silently dropped
-    //                               (Excel ignores color inside TEXT).
-    //   `[色N]` (N in 1..56)     -> indexed color qualifier; silently dropped.
+    //   `[赤]` / `[Red]` / ...   -> named color qualifier in `dialect`;
+    //                               silently dropped (no color in text).
+    //   `[色N]` / `[ColorN]`     -> indexed color qualifier; silently dropped.
     // Anything else (`[>100]`, `[DBNum1]`, unknown qualifiers) still trips
     // the invalid-bracket flag and surfaces as #VALUE!.
     if (c == '[') {
@@ -71,8 +81,12 @@ void tokenize_section(std::string_view fmt, Section& out) {
       while (j < fmt.size() && fmt[j] != ']') {
         ++j;
       }
-      const std::string_view body = fmt.substr(body_begin, (j < fmt.size() ? j : fmt.size()) - body_begin);
-      i = j < fmt.size() ? j + 1 : j;
+      if (j == fmt.size()) {
+        out.has_invalid_bracket = true;
+        return;
+      }
+      const std::string_view body = fmt.substr(body_begin, j - body_begin);
+      i = j + 1;
       // Elapsed time markers: any run of `h`, `m`, or `s` (case-insensitive).
       bool all_h = !body.empty();
       bool all_m = !body.empty();
@@ -92,12 +106,12 @@ void tokenize_section(std::string_view fmt, Section& out) {
       if (all_h) {
         Token t;
         t.kind = Tok::DateElapsedH;
-        t.width = static_cast<std::uint8_t>(body.size());
+        t.width = body.size();
         toks.push_back(t);
       } else if (all_m) {
         Token t;
         t.kind = Tok::DateElapsedM;
-        t.width = static_cast<std::uint8_t>(body.size());
+        t.width = body.size();
         toks.push_back(t);
       } else if (!body.empty() && body.front() == '$') {
         // Locale-currency marker. Form: `[$<symbol>-<lcid>]` or `[$<symbol>]`
@@ -120,9 +134,9 @@ void tokenize_section(std::string_view fmt, Section& out) {
       } else if (all_s) {
         Token t;
         t.kind = Tok::DateElapsedS;
-        t.width = static_cast<std::uint8_t>(body.size());
+        t.width = body.size();
         toks.push_back(t);
-      } else if (is_color_specifier(body)) {
+      } else if (is_color_specifier(body, dialect)) {
         // Named colour (`[赤]`) or indexed colour (`[色12]`). Excel discards
         // the colour inside TEXT, so the rest of the section still formats
         // the value. A section may carry at most one colour, though: Excel
@@ -132,6 +146,7 @@ void tokenize_section(std::string_view fmt, Section& out) {
           out.has_invalid_bracket = true;
         }
         saw_color = true;
+        out.has_color = true;
       } else if (const int dbnum = parse_dbnum_directive(body); dbnum > 0) {
         // `[DBNum1]` / `[DBNum2]` / `[DBNum3]`: digit-substitution mode for
         // the rest of the section. Multiple directives stack last-write-wins,
@@ -172,8 +187,7 @@ void tokenize_section(std::string_view fmt, Section& out) {
     }
     // Underscore-skip `_X`: Excel reserves the width of character `X` and
     // emits a matching amount of whitespace. TEXT's output uses a single
-    // space regardless of `X`. If `_` is the last byte of the format with
-    // nothing following, fall through to the single-byte literal path.
+    // space regardless of `X`.
     if (c == '_' && i + 1 < fmt.size()) {
       Token t;
       t.kind = Tok::Space;
@@ -183,9 +197,7 @@ void tokenize_section(std::string_view fmt, Section& out) {
     }
     // Asterisk-fill `*X`: in cell formats this pads the cell with `X` to
     // fill the column width. TEXT() has no column width, so Mac Excel 365
-    // emits this as a no-op (both `*` and the fill char are skipped). If
-    // `*` is the last byte of the format with nothing following, fall
-    // through to the single-byte literal path.
+    // emits this as a no-op (both `*` and the fill char are skipped).
     if (c == '*' && i + 1 < fmt.size()) {
       i += 1 + utf8_scalar_width(fmt, i + 1);
       continue;
@@ -438,6 +450,17 @@ void tokenize_section(std::string_view fmt, Section& out) {
       default:
         break;
     }
+    // Keep the slash's source range so the classifier can tell it from a quoted slash.
+    if (c == '/') {
+      Token t;
+      t.kind = Tok::Literal;
+      t.lit_begin = i;
+      t.lit_end = i + 1;
+      t.fraction_slash_candidate = true;
+      toks.push_back(t);
+      ++i;
+      continue;
+    }
     // Fallback: preserve one complete UTF-8 scalar as a literal. Malformed
     // input is consumed one byte at a time by `utf8_scalar_width`, so it is
     // still copied without crashing or swallowing following syntax.
diff --git a/src/eval/text_format/number_format_types.h b/src/eval/text_format/number_format_types.h
index a3fd5715f..b64269b57 100644
--- a/src/eval/text_format/number_format_types.h
+++ b/src/eval/text_format/number_format_types.h
@@ -15,10 +15,16 @@
 #include <string_view>
 #include <vector>
 
+#include "eval/text_format/number_format.h"
+
 namespace formulon {
 namespace text_format {
 namespace number_format_detail {
 
+// Last serial of the 1900 calendar (9999-12-31). The 1904 system ends the
+// same day, `kDate1904EpochGap` serials earlier.
+constexpr double kMaxDateSerial1900 = 2958465.0;
+
 // --- Token representation ----------------------------------------------
 
 enum class Tok : std::uint8_t {
@@ -69,14 +75,22 @@ enum class Tok : std::uint8_t {
 
 struct Token {
   Tok kind = Tok::Literal;
-  // Length hint (0..4) used for date tokens to carry the run length encoded
-  // in the format (e.g. yyyy vs yy, hh vs h). Also reused by FracSecDigits
-  // to store the fractional-digit count.
-  std::uint8_t width = 0;
+  // Length hint used for date tokens to carry the run length encoded in the
+  // format (e.g. yyyy vs yy, hh vs h). Also reused by FracSecDigits to store
+  // the fractional-digit count. Keep this wide enough for a user-supplied
+  // fractional-second run; the renderer caps arithmetic precision separately.
+  std::size_t width = 0;
   // Byte range inside the format string (Literal only). `lit_begin <=
   // lit_end`; empty slices are legal and simply contribute no output.
   std::size_t lit_begin = 0;
   std::size_t lit_end = 0;
+  // A literal copied from a quoted or escaped payload cannot introduce a
+  // structural fraction slash. The tokenizer sets this on those payloads so
+  // the classifier can distinguish `?/"/"?` from `?/?`.
+  bool protected_literal = false;
+  // True only for an unquoted, unescaped `/` byte. Fraction classification
+  // uses this marker instead of treating every literal slash as structural.
+  bool fraction_slash_candidate = false;
 };
 
 // DBNum digit-substitution mode controlled by the `[DBNum1]`, `[DBNum2]`,
@@ -114,10 +128,14 @@ struct Section {
   // locale currency code (`[$...]`), a colour (`[赤]`, `[色12]`), a
   // `[DBNumN]` directive, or a conditional predicate. Excel rejects TEXT
   // with an unrecognised bracket — including a colour spelled in another
-  // locale, such as `[Red]` — so `apply_format` surfaces `#VALUE!` whenever
-  // this flag is set on any section it would have rendered.
+  // dialect, such as `[Red]` in a TEXT() argument — so `apply_format`
+  // surfaces `#VALUE!` whenever this flag is set on any section it would
+  // have rendered.
   bool has_invalid_bracket = false;
 
+  // Set when the section carries a colour qualifier in the parse dialect.
+  bool has_color = false;
+
   // DBNum1/2/3 digit-substitution mode. Set by the tokenizer when a
   // `[DBNumN]` directive is observed; consumed by the renderer.
   DbNumMode dbnum_mode = DbNumMode::kNone;
@@ -160,14 +178,13 @@ struct Section {
   // --- Fraction format (`# ?/?`, `# ??/??`, etc.) ----------------------
   // When `is_fraction` is true the section renders `value` as an
   // (optional integer + ) numerator / denominator triple computed by a
-  // bounded Stern-Brocot mediant search. The token-stream-walk path is
+  // bounded continued-fraction search. The token-stream-walk path is
   // bypassed; literals before the integer group, between integer and
   // numerator, and after the denominator are still emitted from `tokens`.
   bool is_fraction = false;
-  // Maximum digit count of each placeholder run. 10^N - 1 gives the cap
-  // used by the rational-approximation search.
+  // Placeholder widths control padding. Only the denominator width sets
+  // the rational-approximation cap (10^N - 1, bounded to seven digits).
   int fraction_int_max_digits = 0;
-  int fraction_num_max_digits = 0;
   int fraction_den_max_digits = 0;
   // Inclusive token-index bounds for each digit-placeholder run. When
   // `fraction_int_max_digits == 0` the integer group is absent and
@@ -180,6 +197,12 @@ struct Section {
   int fraction_den_end = 0;
   // Index of the `/` literal token between numerator and denominator.
   int fraction_slash_index = -1;
+  // A raw denominator containing a non-zero digit is a checked fixed integer
+  // denominator (`# ?/8`, `# ?/08`, `# ?/16`). An all-zero run and placeholder
+  // denominators remain bounded variable searches; quoted/escaped fixed
+  // denominators are invalid formats.
+  bool fraction_fixed_denominator = false;
+  std::uint64_t fraction_fixed_denominator_value = 1;
 };
 
 // --- Tokenizer entry points (implemented in number_format_tokenizer.cpp) ---
@@ -191,9 +214,9 @@ struct Section {
 std::vector<std::string_view> split_sections(std::string_view fmt);
 
 // Tokenizes one section. Writes the token list into `out.tokens` and
-// surfaces invalid bracket qualifiers (colour names, conditional tests,
-// DBNum markers, etc.) through `out.has_invalid_bracket`.
-void tokenize_section(std::string_view fmt, Section& out);
+// surfaces invalid bracket qualifiers (colour names outside `dialect`,
+// malformed conditional tests, etc.) through `out.has_invalid_bracket`.
+void tokenize_section(std::string_view fmt, Section& out, FormatDialect dialect);
 
 // Populate the numeric/date summary on `section`. Also detect fractional
 // seconds `.0...` that immediately follow a second token (used to format
diff --git a/src/eval/text_format/render_common.h b/src/eval/text_format/render_common.h
index c712d7926..a6d734d6e 100644
--- a/src/eval/text_format/render_common.h
+++ b/src/eval/text_format/render_common.h
@@ -29,6 +29,9 @@ namespace number_format_detail {
 //   * `=TEXT(1234, "[DBNum1]0")` -> `一二三四` (NOT `一千二百三十四`).
 //   * `=TEXT(1234, "[DBNum2]0")` -> `壱弐参四` (NOT `壱阡弐百参拾四`).
 //   * `=TEXT(1234, "[DBNum3]0")` -> `１２３４` (full-width Arabic).
+//
+// The exception is `[DBNum1]General`, whose integer part is positional
+// (`千二百三十四`); `render_numeric.cpp` owns it.
 
 // Returns the per-digit substitution for `c` under `mode`, or an empty
 // string if no substitution applies (caller falls back to `c` verbatim).
@@ -58,6 +61,13 @@ void append_pad2_dbnum(std::string& out, unsigned value, DbNumMode mode);
 // magnitude rounds down to a representation of zero.
 bool decimal_digits_all_zero(std::string_view digits) noexcept;
 
+// Zeros every digit of `digits` past the 15th significant one, rounding the
+// 15th half-away-from-zero against the 16th. `digits` holds decimal digits
+// only (no sign); its length is preserved, so only trailing digits collapse
+// to zero. Excel shows no more than 15 significant digits: `2^60` displays
+// as `1152921504606850000`, not the exact 19-digit integer `%.0f` prints.
+void cap_integer_significant_digits(std::string* digits);
+
 }  // namespace number_format_detail
 }  // namespace text_format
 }  // namespace formulon
diff --git a/src/eval/text_format/render_date.cpp b/src/eval/text_format/render_date.cpp
index 8e5fdb781..7c26533da 100644
--- a/src/eval/text_format/render_date.cpp
+++ b/src/eval/text_format/render_date.cpp
@@ -9,7 +9,6 @@
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
-#include <cstdio>
 #include <string>
 #include <string_view>
 
@@ -17,6 +16,7 @@
 #include "eval/text_format/render_common.h"
 #include "utils/date_time.h"
 #include "utils/japanese_era.h"
+#include "utils/number_text.h"
 
 namespace formulon {
 namespace text_format {
@@ -62,15 +62,25 @@ const char* weekday_long(int sun0) noexcept {
   return kTable[sun0];
 }
 
-void append_elapsed_int_dbnum(std::string& out, long long value, std::uint8_t width, DbNumMode mode) {
+void append_elapsed_int_dbnum(std::string& out, long long value, std::size_t width, DbNumMode mode) {
   const std::string digits = std::to_string(value);
-  const std::size_t min_width = static_cast<std::size_t>(width);
-  for (std::size_t i = digits.size(); i < min_width; ++i) {
+  for (std::size_t i = digits.size(); i < width; ++i) {
     append_digit_dbnum(out, mode, '0');
   }
   append_chars_dbnum(out, mode, digits);
 }
 
+constexpr long long kSecondsPerDay = 86400;
+constexpr std::size_t kMaxMeaningfulFractionDigits = 15;
+
+std::uint64_t power10(std::size_t exponent) noexcept {
+  std::uint64_t result = 1;
+  for (std::size_t i = 0; i < exponent; ++i) {
+    result *= 10;
+  }
+  return result;
+}
+
 // ja-JP weekday tokens (`aaa` / `aaaa`). Index 0 = Sunday to match the
 // `sun0` index used elsewhere in this file.
 const char* weekday_ja_short(int sun0) noexcept {
@@ -112,29 +122,58 @@ const EraInfo& classify_era(int year, unsigned month, unsigned day) noexcept {
 
 }  // namespace
 
-void render_date(const Section& section, std::string_view fmt, double serial, std::string& out, bool date1904) {
-  if (serial < 0.0 || serial > 2958465.0) {
+FormatStatus render_date(const Section& section, std::string_view fmt, double serial, std::string& out, bool date1904) {
+  const double max_serial =
+      date1904 ? kMaxDateSerial1900 - ::formulon::date_time::kDate1904EpochGap : kMaxDateSerial1900;
+  if (!std::isfinite(serial) || serial < 0.0 || serial >= max_serial + 1.0) {
     // Excel rejects out-of-range serials from TEXT.
-    return;
+    return FormatStatus::kOverflow;
   }
-  const ::formulon::date_time::YMD ymd = ::formulon::date_time::ymd_from_serial(serial, date1904);
-  const int sun0 = ::formulon::date_time::weekday_sun0(serial, date1904);
 
-  // Decompose the time portion with optional fractional seconds.
-  const double frac_day = serial - std::floor(serial);
-  // Total seconds (float-precision) so fractional seconds survive.
-  double total_seconds_f = frac_day * 86400.0;
-  // Round to `frac_sec_digits` if requested, otherwise to whole seconds.
-  double rounded = total_seconds_f;
-  if (section.frac_sec_digits == 0) {
-    rounded = std::floor(total_seconds_f + 0.5);
-  } else {
-    const double scale = std::pow(10.0, section.frac_sec_digits);
-    rounded = std::floor(total_seconds_f * scale + 0.5) / scale;
+  // Decompose the time portion into an integral second and a sub-second
+  // fraction. Only the fraction is scaled: scaling the complete serial by
+  // 10^15 would overflow before elapsed-hour/minute/second formatting sees
+  // the value.
+  const double day_floor_f = std::floor(serial);
+  const long long day_floor = static_cast<long long>(day_floor_f);
+  const double frac_day = serial - day_floor_f;
+  const double total_seconds_f = frac_day * static_cast<double>(kSecondsPerDay);
+  const double whole_seconds_f = std::floor(total_seconds_f);
+  const long long whole_seconds = static_cast<long long>(whole_seconds_f);
+  const double subsecond = total_seconds_f - whole_seconds_f;
+  const std::size_t requested_fraction_digits =
+      section.frac_sec_digits > 0 ? static_cast<std::size_t>(section.frac_sec_digits) : 0U;
+  const std::size_t meaningful_fraction_digits = requested_fraction_digits < kMaxMeaningfulFractionDigits
+                                                     ? requested_fraction_digits
+                                                     : kMaxMeaningfulFractionDigits;
+  const std::uint64_t fraction_scale = power10(meaningful_fraction_digits);
+  std::uint64_t fraction_ticks =
+      static_cast<std::uint64_t>(std::floor(subsecond * static_cast<double>(fraction_scale) + 0.5));
+  long long rounded_seconds_in_day = whole_seconds;
+  if (fraction_ticks >= fraction_scale) {
+    ++rounded_seconds_in_day;
+    fraction_ticks = 0;
   }
-  // Extract integer h/m/s and fractional remainder.
-  long long total_int_seconds = static_cast<long long>(std::floor(rounded));
-  const double sub_sec_float = rounded - static_cast<double>(total_int_seconds);
+
+  // Calendar and ordinary time tokens share the rounded day. A carry beyond
+  // 9999-12-31 is a date overflow even when the source serial itself still
+  // lies within the final day's fractional range.
+  const long long day_carry = rounded_seconds_in_day / kSecondsPerDay;
+  const long long day_for_calendar = day_floor + day_carry;
+  if (static_cast<double>(day_for_calendar) > max_serial) {
+    return FormatStatus::kOverflow;
+  }
+  const long long seconds_of_day = rounded_seconds_in_day % kSecondsPerDay;
+  const double calendar_serial = static_cast<double>(day_for_calendar);
+  const ::formulon::date_time::YMD ymd = date1904 ? ::formulon::date_time::ymd_from_serial(calendar_serial, true)
+                                                  : ::formulon::date_time::legacy_1900_ymd(calendar_serial);
+  const int sun0 = ::formulon::date_time::weekday_sun0(calendar_serial, date1904);
+
+  // Elapsed fields use the same rounded second as ordinary h/m/s fields.
+  // `day_floor` is only a few million in the supported date range, so this
+  // product remains well within int64_t while retaining all day carries.
+  const long long total_rounded_seconds = day_floor * kSecondsPerDay + rounded_seconds_in_day;
+
   // If AM/PM is in use, we need to know it before formatting hours.
   bool use_am_pm = false;
   for (const Token& tk : section.tokens) {
@@ -144,7 +183,6 @@ void render_date(const Section& section, std::string_view fmt, double serial, st
     }
   }
 
-  const long long seconds_of_day = ((total_int_seconds % 86400) + 86400) % 86400;
   unsigned hour_24 = static_cast<unsigned>(seconds_of_day / 3600);
   unsigned minute = static_cast<unsigned>((seconds_of_day / 60) % 60);
   unsigned second = static_cast<unsigned>(seconds_of_day % 60);
@@ -168,7 +206,7 @@ void render_date(const Section& section, std::string_view fmt, double serial, st
       }
       case Tok::DateY4: {
         char buf[16];
-        const int n = std::snprintf(buf, sizeof(buf), "%04d", ymd.y);
+        const int n = format_signed(buf, sizeof(buf), ymd.y, 4);
         if (n > 0) {
           if (dbnum == DbNumMode::kNone) {
             out.append(buf, static_cast<std::size_t>(n));
@@ -268,19 +306,17 @@ void render_date(const Section& section, std::string_view fmt, double serial, st
         append_pad2_dbnum(out, second, dbnum);
         break;
       case Tok::DateElapsedH: {
-        // Total hours since serial 0 (integer floor).
-        const long long total_hours = static_cast<long long>(std::floor(serial * 24.0));
+        const long long total_hours = total_rounded_seconds / 3600;
         append_elapsed_int_dbnum(out, total_hours, tk.width, dbnum);
         break;
       }
       case Tok::DateElapsedM: {
-        const long long total_minutes = static_cast<long long>(std::floor(serial * 1440.0));
+        const long long total_minutes = total_rounded_seconds / 60;
         append_elapsed_int_dbnum(out, total_minutes, tk.width, dbnum);
         break;
       }
       case Tok::DateElapsedS: {
-        const long long total_sec = static_cast<long long>(std::floor(serial * 86400.0));
-        append_elapsed_int_dbnum(out, total_sec, tk.width, dbnum);
+        append_elapsed_int_dbnum(out, total_rounded_seconds, tk.width, dbnum);
         break;
       }
       case Tok::AmPm:
@@ -291,24 +327,16 @@ void render_date(const Section& section, std::string_view fmt, double serial, st
         break;
       case Tok::FracSecDigits: {
         // Render fractional seconds at the requested precision.
-        const int digits = static_cast<int>(tk.width);
+        const std::size_t digits = tk.width;
         if (digits > 0) {
           out.push_back('.');
-          double f = sub_sec_float;
-          if (f < 0.0) {
-            f = 0.0;
+          std::string fraction = std::to_string(fraction_ticks);
+          if (fraction.size() < meaningful_fraction_digits) {
+            fraction.insert(0, meaningful_fraction_digits - fraction.size(), '0');
           }
-          for (int k = 0; k < digits; ++k) {
-            f *= 10.0;
-            int d = static_cast<int>(std::floor(f));
-            if (d > 9) {
-              d = 9;
-            } else if (d < 0) {
-              d = 0;
-            }
-            const char ch = static_cast<char>('0' + d);
-            append_digit_dbnum(out, dbnum, ch);
-            f -= static_cast<double>(d);
+          append_chars_dbnum(out, dbnum, fraction);
+          for (std::size_t k = meaningful_fraction_digits; k < digits; ++k) {
+            append_digit_dbnum(out, dbnum, '0');
           }
         }
         break;
@@ -326,6 +354,7 @@ void render_date(const Section& section, std::string_view fmt, double serial, st
         break;
     }
   }
+  return FormatStatus::kOk;
 }
 
 }  // namespace number_format_detail
diff --git a/src/eval/text_format/render_date.h b/src/eval/text_format/render_date.h
index 3da6d5655..f76f8dfa2 100644
--- a/src/eval/text_format/render_date.h
+++ b/src/eval/text_format/render_date.h
@@ -20,8 +20,11 @@ namespace number_format_detail {
 
 // Render the date/time section for the given serial. `date1904` selects the
 // workbook date epoch for the serial->calendar conversion (1462-day shift);
-// it is trailing + defaulted so pure-1900 callers need no change.
-void render_date(const Section& section, std::string_view fmt, double serial, std::string& out, bool date1904 = false);
+// it is trailing + defaulted so pure-1900 callers need no change. Rounding
+// that carries past the final representable calendar day returns overflow
+// before appending any output.
+FormatStatus render_date(const Section& section, std::string_view fmt, double serial, std::string& out,
+                         bool date1904 = false);
 
 }  // namespace number_format_detail
 }  // namespace text_format
diff --git a/src/eval/text_format/render_fraction.cpp b/src/eval/text_format/render_fraction.cpp
index 1e72db3ed..8507fde37 100644
--- a/src/eval/text_format/render_fraction.cpp
+++ b/src/eval/text_format/render_fraction.cpp
@@ -1,101 +1,226 @@
 //
-// Fraction-format rendering for the Excel TEXT() engine. Covers `# ?/?`,
-// `# ??/??`, `0/0`, and friends. Implements Excel's bounded
-// best-rational-approximation via a Stern-Brocot mediant search.
-//
-// Compared to the more familiar continued-fraction algorithm, Stern-Brocot
-// occasionally picks a different mediant when the target lies near a
-// Farey-neighbour boundary; Mac Excel's empirical output matches
-// Stern-Brocot, so we follow that.
-//
-// For a value `v` (already absolute) and a denominator cap `max_q` and
-// numerator cap `max_p`, the search finds (p, q) minimising |v - p/q|
-// with 1 <= q <= max_q and 0 <= p <= max_p. When an integer group is
-// present the search runs against `frac = v - floor(v)` only.
+// Fraction-format rendering for the Excel TEXT() engine. Variable
+// denominators use a bounded continued-fraction search; fixed denominators
+// round directly. Numerator placeholder width controls padding, not magnitude.
 
 #include "eval/text_format/render_fraction.h"
 
+#include <algorithm>
 #include <cmath>
 #include <cstddef>
+#include <cstdint>
+#include <limits>
 #include <string>
 #include <string_view>
 
+#include "eval/text_format/number_format_scanner.h"
 #include "eval/text_format/number_format_types.h"
 #include "eval/text_format/render_common.h"
+#include "utils/number_text.h"
 
 namespace formulon {
 namespace text_format {
 namespace number_format_detail {
 namespace {
 
-// Returns 10^N for small non-negative N. Always fits in a long long for
-// the digit-counts we accept (Excel caps fraction placeholder runs well
-// below 18 digits in practice; for safety we cap at 9 here).
-long long fraction_pow10(int n) noexcept {
-  long long r = 1;
+// Excel caps variable-denominator approximation at seven digits even when
+// the format has more placeholders. The improper numerator is a decimal
+// string: a finite double's whole part can run to 309 digits.
+constexpr std::uint64_t kMaxVariableDenominator = 9999999ULL;
+
+// Compute 10^N without overflow for the supported placeholder widths.
+// best_rational applies Excel's seven-digit variable-denominator cap; wider
+// placeholder runs retain their layout.
+std::uint64_t fraction_pow10(int n) noexcept {
+  std::uint64_t r = 1;
   for (int i = 0; i < n && i < 18; ++i) {
     r *= 10;
   }
   return r;
 }
 
-// Stern-Brocot bounded mediant search. Returns the best (num, den) with
-// `1 <= den <= max_q` and `0 <= num <= max_p`, ties broken by smaller den
-// then smaller num (the search's natural traversal order).
-void best_rational(double target, long long max_p, long long max_q, long long* out_num, long long* out_den) noexcept {
+std::uint64_t rounded_product(double target, std::uint64_t denominator) noexcept {
+  const long double product = static_cast<long double>(target) * static_cast<long double>(denominator);
+  if (!(product > 0.0L)) {
+    return 0;
+  }
+  const long double rounded = std::floor(product + 0.5L);
+  if (rounded >= static_cast<long double>(denominator)) {
+    return denominator;
+  }
+  return static_cast<std::uint64_t>(rounded);
+}
+
+struct RationalCandidate {
+  std::uint64_t numerator = 0;
+  std::uint64_t denominator = 1;
+  long double error = std::numeric_limits<long double>::max();
+};
+
+// Long double supplies arithmetic headroom for the bounded search. Candidate
+// comparisons account for the input's double precision on every platform.
+void consider_candidate(long double target, std::uint64_t numerator, std::uint64_t denominator,
+                        RationalCandidate* best) noexcept {
+  if (denominator == 0) {
+    return;
+  }
+  const long double approximation = static_cast<long double>(numerator) / static_cast<long double>(denominator);
+  const long double error = std::fabs(target - approximation);
+  // Excel treats adjacent binary64 values at a rational midpoint as ties
+  // (17/144 with a one-digit denominator chooses 1/8, not 1/9). Use the
+  // input's precision rather than platform-dependent long-double precision.
+  // Scale the bound by approximation error, so an exact rational never ties
+  // with a non-exact one and tiny fractions remain distinguishable from zero.
+  const long double tie_bound = 32.0L * std::numeric_limits<double>::epsilon() * std::max(error, best->error);
+  const bool tied = std::fabs(error - best->error) <= tie_bound;
+  if ((!tied && error < best->error) || (tied && (denominator < best->denominator ||
+                                                  (denominator == best->denominator && numerator < best->numerator)))) {
+    best->numerator = numerator;
+    best->denominator = denominator;
+    best->error = error;
+  }
+}
+
+// Bounded continued-fraction search. It keeps the convergents in an integer
+// denominator and jumps over large partial quotients, avoiding the linear
+// Stern-Brocot walk that made values such as 1/20000 hit its iteration cap.
+void best_rational(double target, std::uint64_t max_q, std::uint64_t* out_num, std::uint64_t* out_den) noexcept {
+  max_q = std::min(max_q, kMaxVariableDenominator);
   if (max_q < 1) {
     max_q = 1;
   }
-  if (max_p < 0) {
-    max_p = 0;
-  }
-  long long a_num = 0;
-  long long a_den = 1;
-  long long b_num = 1;
-  long long b_den = 0;  // Represents +infinity.
-  long long best_num = 0;
-  long long best_den = 1;
-  double best_err = std::fabs(target - 0.0);
-  for (int iter = 0; iter < 10000; ++iter) {
-    const long long m_num = a_num + b_num;
-    const long long m_den = a_den + b_den;
-    if (m_den > max_q || m_num > max_p) {
+  const long double target_decimal = static_cast<long double>(target);
+  RationalCandidate best;
+
+  auto consider_boundary = [&](std::uint64_t denominator) noexcept {
+    if (denominator > 0) {
+      consider_candidate(target_decimal, rounded_product(target, denominator), denominator, &best);
+    }
+  };
+
+  // A denominator-one endpoint is always a useful initial candidate,
+  // including tiny fractional parts whose first continued-fraction term
+  // exceeds the denominator range.
+  consider_boundary(1);
+
+  // Expand in binary64 as Excel does: a wider long double (x86-64, aarch64
+  // Linux, WASM) turns 1/0.1 into 9.99..., not 10, and picks a different term.
+  double x = target;
+  std::uint64_t p_prev2 = 0;
+  std::uint64_t p_prev1 = 1;
+  std::uint64_t q_prev2 = 1;
+  std::uint64_t q_prev1 = 0;
+  for (int iter = 0; iter < 256 && std::isfinite(x); ++iter) {
+    const double a_value = std::floor(x);
+    if (a_value < 0.0) {
       break;
     }
-    const double m = static_cast<double>(m_num) / static_cast<double>(m_den);
-    const double err = std::fabs(target - m);
-    if (err < best_err) {
-      best_err = err;
-      best_num = m_num;
-      best_den = m_den;
+    if (q_prev2 > max_q) {
+      consider_boundary(max_q);
+      break;
     }
-    if (target < m) {
-      b_num = m_num;
-      b_den = m_den;
-    } else if (target > m) {
-      a_num = m_num;
-      a_den = m_den;
-    } else {
+    const std::uint64_t quotient_limit = q_prev1 == 0 ? max_q : (max_q - q_prev2) / q_prev1;
+    // Compare before casting: a double cannot represent UINT64_MAX exactly.
+    if (static_cast<long double>(a_value) >= static_cast<long double>(quotient_limit) + 1.0L) {
+      // When even the first reciprocal is out of range Excel returns zero, not 1/max_q.
+      if (p_prev1 == 0 && q_prev1 == 1) {
+        break;
+      }
+      const std::uint64_t t = quotient_limit;
+      if (t > 0) {
+        consider_candidate(target_decimal, p_prev2 + p_prev1 * t, q_prev2 + q_prev1 * t, &best);
+      }
+      consider_candidate(target_decimal, p_prev1, q_prev1, &best);
+      consider_boundary(max_q);
+      break;
+    }
+    const std::uint64_t a = static_cast<std::uint64_t>(a_value);
+
+    if (a != 0 && p_prev1 > (std::numeric_limits<std::uint64_t>::max() - p_prev2) / a) {
+      consider_boundary(max_q);
       break;
     }
+    const std::uint64_t p = p_prev2 + p_prev1 * a;
+    const std::uint64_t q = q_prev2 + q_prev1 * a;
+    if (q > max_q || q == 0) {
+      consider_boundary(max_q);
+      break;
+    }
+    consider_candidate(target_decimal, p, q, &best);
+    const double fractional = x - a_value;
+    if (fractional == 0.0) {
+      break;
+    }
+    p_prev2 = p_prev1;
+    p_prev1 = p;
+    q_prev2 = q_prev1;
+    q_prev1 = q;
+    x = 1.0 / fractional;
+  }
+
+  *out_num = best.numerator;
+  *out_den = best.denominator < 1 ? 1 : best.denominator;
+}
+
+// Multiply a decimal digit string by an 18-digit-or-smaller denominator. The
+// per-digit product plus carry is at most 9e18 + 1e18, safely below UINT64_MAX.
+std::string multiply_decimal(std::string_view digits, std::uint64_t multiplier) {
+  if (multiplier == 0 || digits.empty() || (digits.size() == 1 && digits[0] == '0')) {
+    return "0";
+  }
+  std::string reversed;
+  reversed.reserve(digits.size() + 20);
+  std::uint64_t carry = 0;
+  for (std::size_t i = digits.size(); i > 0; --i) {
+    const std::uint64_t digit = static_cast<std::uint64_t>(digits[i - 1] - '0');
+    const std::uint64_t product = digit * multiplier + carry;
+    reversed.push_back(static_cast<char>('0' + product % 10U));
+    carry = product / 10U;
+  }
+  while (carry != 0) {
+    reversed.push_back(static_cast<char>('0' + carry % 10U));
+    carry /= 10U;
+  }
+  std::reverse(reversed.begin(), reversed.end());
+  return reversed;
+}
+
+std::string add_decimal(std::string_view digits, std::uint64_t addend) {
+  const std::string addend_digits = std::to_string(addend);
+  std::string reversed;
+  reversed.reserve(std::max(digits.size(), addend_digits.size()) + 1);
+  std::size_t i = digits.size();
+  std::size_t j = addend_digits.size();
+  std::uint64_t carry = 0;
+  while (i > 0 || j > 0 || carry != 0) {
+    std::uint64_t sum = carry;
+    if (i > 0) {
+      sum += static_cast<std::uint64_t>(digits[--i] - '0');
+    }
+    if (j > 0) {
+      sum += static_cast<std::uint64_t>(addend_digits[--j] - '0');
+    }
+    reversed.push_back(static_cast<char>('0' + sum % 10U));
+    carry = sum / 10U;
+  }
+  if (reversed.empty()) {
+    reversed.push_back('0');
   }
-  *out_num = best_num;
-  *out_den = best_den < 1 ? 1 : best_den;
+  std::reverse(reversed.begin(), reversed.end());
+  return reversed;
 }
 
-// Emit a non-negative integer `value` right-aligned to `width` characters
+// Emit the non-negative integer `digits` right-aligned to `width` characters
 // using the placeholder kinds in `[begin, end)`. Each placeholder kind
 // determines how unused leading positions render: `0` -> '0' pad, `?` ->
 // space pad, `#` -> nothing emitted. The DBNum mapping applies to digits
 // (and to `0`-pad positions) but never to spaces or absent positions.
-void emit_fraction_digits(const Section& section, std::string_view fmt, long long value, int begin, int end,
-                          std::string& out) {
-  (void)fmt;
+void emit_fraction_digits(const Section& section, std::string_view digits, int begin, int end, std::string& out,
+                          bool trailing_pad = false) {
   const int width = end - begin;
   if (width <= 0) {
     return;
   }
-  std::string digits = std::to_string(value);
   if (static_cast<int>(digits.size()) > width) {
     // Overflow: Excel never produces this for our caps, but be defensive.
     // Emit the digits verbatim (the widest available run cap is enforced
@@ -110,7 +235,8 @@ void emit_fraction_digits(const Section& section, std::string_view fmt, long lon
   std::size_t digit_cursor = 0;
   for (int k = 0; k < width; ++k) {
     const Tok kind = section.tokens[static_cast<std::size_t>(begin + k)].kind;
-    if (k < pad) {
+    const bool is_padding = trailing_pad ? k >= static_cast<int>(digits.size()) : k < pad;
+    if (is_padding) {
       // Leading-position behaviour by placeholder kind.
       if (kind == Tok::DigitZero) {
         append_digit_dbnum(out, section.dbnum_mode, '0');
@@ -119,7 +245,7 @@ void emit_fraction_digits(const Section& section, std::string_view fmt, long lon
       }
       // `#`: emit nothing.
     } else {
-      const char d = digits[digit_cursor++];
+      const char d = trailing_pad ? digits[static_cast<std::size_t>(k)] : digits[digit_cursor++];
       append_digit_dbnum(out, section.dbnum_mode, d);
     }
   }
@@ -127,7 +253,7 @@ void emit_fraction_digits(const Section& section, std::string_view fmt, long lon
 
 }  // namespace
 
-void render_fraction(const Section& section, std::string_view fmt, double value, std::string& out) {
+FormatStatus render_fraction(const Section& section, std::string_view fmt, double value, std::string& out) {
   // Sign: emit minus prefix on the rendered form for negative values, then
   // operate on the absolute magnitude. Excel's fraction format does not
   // honour `?`/`#` for sign placement -- the leading `-` is unconditional.
@@ -136,40 +262,51 @@ void render_fraction(const Section& section, std::string_view fmt, double value,
 
   const bool has_int_group = section.fraction_int_max_digits > 0;
 
-  // Compute integer part and fraction target. When no integer group is
-  // present (`?/?`-style improper fractions), the search runs against the
-  // full magnitude and the numerator is allowed to exceed 1.
-  long long integer_part = 0;
+  // Split the magnitude before approximation. The bounded search only needs
+  // the fractional part, while an improper numerator is assembled as
+  // `whole * denominator + fraction_numerator` below using decimal strings.
+  // That preserves values whose whole part is wider than uint64_t.
+  double integer_part = 0.0;
   double target = abs_v;
-  if (has_int_group) {
-    integer_part = static_cast<long long>(std::floor(abs_v));
-    target = abs_v - static_cast<double>(integer_part);
-  }
+  integer_part = std::floor(abs_v);
+  target = abs_v - integer_part;
 
-  // Run the bounded Stern-Brocot search.
-  const long long max_p = fraction_pow10(section.fraction_num_max_digits) - 1;
-  const long long max_q = fraction_pow10(section.fraction_den_max_digits) - 1;
-  long long num = 0;
-  long long den = 1;
-  // For improper fractions (no integer group) the numerator bound is the
-  // raw cap; for proper fractions (target < 1) Stern-Brocot's invariant
-  // `m_num <= m_den` means the cap on `p` is implicitly at most `max_q`,
-  // so passing the raw `max_p` is also safe.
-  best_rational(target, max_p, max_q, &num, &den);
+  std::uint64_t fraction_num = 0;
+  std::uint64_t den = 1;
+  if (section.fraction_fixed_denominator) {
+    den = section.fraction_fixed_denominator_value;
+    fraction_num = rounded_product(target, den);
+  } else {
+    // The numerator is uncapped so improper forms such as `?/?` render `2469/2`.
+    const std::uint64_t max_q = fraction_pow10(section.fraction_den_max_digits) - 1U;
+    best_rational(target, max_q, &fraction_num, &den);
+  }
 
   // Rounding promotion: if the best approximation rounds up to 1 exactly
   // (num == den) and we have an integer group, increment the integer and
   // zero out the fraction.
-  if (has_int_group && num == den) {
-    integer_part += 1;
-    num = 0;
+  if (has_int_group && fraction_num == den) {
+    integer_part += 1.0;
+    if (!std::isfinite(integer_part)) {
+      return FormatStatus::kOverflow;
+    }
+    fraction_num = 0;
     den = 1;
   }
-  // A whole value has no fractional component to render. Emitting the
-  // numerator/denominator placeholders here produced e.g. `2 0/1` for
-  // `# ?/?`, whereas Excel suppresses the entire fraction (including its
-  // separating space).
-  const bool suppress_fraction = has_int_group && num == 0;
+  // A whole value shows no fraction, but keeps its width: the separator,
+  // numerator, slash and denominator each become blanks (`59    ` for
+  // `# ?/?`), and a zero integer is shown even under `#`.
+  const bool suppress_fraction = has_int_group && fraction_num == 0;
+  char int_buf[400];
+  const int int_len = format_fixed(int_buf, sizeof(int_buf), integer_part, 0);
+  if (int_len < 0 || static_cast<std::size_t>(int_len) >= sizeof(int_buf)) {
+    return FormatStatus::kOverflow;
+  }
+  std::string int_digits(int_buf, int_len > 0 ? static_cast<std::size_t>(int_len) : 0U);
+  cap_integer_significant_digits(&int_digits);
+  const std::string numerator_digits =
+      has_int_group ? std::to_string(fraction_num) : add_decimal(multiply_decimal(int_digits, den), fraction_num);
+  const std::string denominator_digits = std::to_string(den);
 
   std::string result;
   if (negative) {
@@ -218,15 +355,23 @@ void render_fraction(const Section& section, std::string_view fmt, double value,
     // placeholder is `#`; otherwise the leading-pad behaviour from
     // `emit_fraction_digits` handles `0` and `?` correctly.
     const Tok lead_kind = section.tokens[static_cast<std::size_t>(int_begin)].kind;
-    if (integer_part == 0 && lead_kind == Tok::DigitOpt) {
+    if (integer_part == 0.0 && lead_kind == Tok::DigitOpt && !suppress_fraction) {
       // Emit nothing for the integer group.
     } else {
-      emit_fraction_digits(section, fmt, integer_part, int_begin, int_end, result);
+      emit_fraction_digits(section, int_digits, int_begin, int_end, result);
     }
     i = static_cast<std::size_t>(int_end);
     if (suppress_fraction) {
-      // Retain only suffix literals following the denominator group.
-      i = static_cast<std::size_t>(den_end);
+      for (; i < static_cast<std::size_t>(den_end); ++i) {
+        const Token& tk = section.tokens[i];
+        if (tk.kind == Tok::Literal) {
+          for (std::size_t k = tk.lit_begin; k < tk.lit_end; k += utf8_scalar_width(fmt, k)) {
+            result.push_back(' ');
+          }
+        } else {
+          result.push_back(' ');
+        }
+      }
     } else {
       // 3) Literals between integer group and numerator group (typically a
       // single space).
@@ -242,10 +387,10 @@ void render_fraction(const Section& section, std::string_view fmt, double value,
       ++i;
     }
     out.append(result);
-    return;
+    return FormatStatus::kOk;
   }
   // 4) Numerator group.
-  emit_fraction_digits(section, fmt, num, num_begin, num_end, result);
+  emit_fraction_digits(section, numerator_digits, num_begin, num_end, result);
   i = static_cast<std::size_t>(num_end);
   // 5) Literals up to the slash (including the slash itself).
   while (i <= static_cast<std::size_t>(slash_index)) {
@@ -253,7 +398,24 @@ void render_fraction(const Section& section, std::string_view fmt, double value,
     ++i;
   }
   // 6) Denominator group.
-  emit_fraction_digits(section, fmt, den, den_begin, den_end, result);
+  if (section.fraction_fixed_denominator) {
+    // A zero-prefixed fixed denominator shows zeros for its significant width, then spaces (`/008` -> `0  `).
+    const bool has_zero_prefix =
+        den_begin < den_end && section.tokens[static_cast<std::size_t>(den_begin)].kind == Tok::DigitZero;
+    if (!has_zero_prefix) {
+      result.append(denominator_digits);
+    } else {
+      for (std::size_t digit = 0; digit < denominator_digits.size(); ++digit) {
+        append_digit_dbnum(result, section.dbnum_mode, '0');
+      }
+      result.append(static_cast<std::size_t>(den_end - den_begin) - denominator_digits.size(), ' ');
+    }
+  } else {
+    // Runs starting with `0` right-align, others left-align (`?0` -> `20`, `0?` -> `02`).
+    const bool denominator_trailing_pad =
+        den_begin < den_end && section.tokens[static_cast<std::size_t>(den_begin)].kind != Tok::DigitZero;
+    emit_fraction_digits(section, denominator_digits, den_begin, den_end, result, denominator_trailing_pad);
+  }
   i = static_cast<std::size_t>(den_end);
   // 7) Trailing literals.
   while (i < n_tokens) {
@@ -262,6 +424,7 @@ void render_fraction(const Section& section, std::string_view fmt, double value,
   }
 
   out.append(result);
+  return FormatStatus::kOk;
 }
 
 }  // namespace number_format_detail
diff --git a/src/eval/text_format/render_fraction.h b/src/eval/text_format/render_fraction.h
index 208be39ac..1056c43bd 100644
--- a/src/eval/text_format/render_fraction.h
+++ b/src/eval/text_format/render_fraction.h
@@ -3,7 +3,7 @@
 //
 // Fraction rendering for the Excel TEXT() engine (`# ?/?`, `# ??/??`,
 // `0/0`, ...). Implements Excel's bounded best-rational-approximation
-// via a Stern-Brocot mediant search.
+// via a bounded continued-fraction search.
 
 #ifndef FORMULON_EVAL_TEXT_FORMAT_RENDER_FRACTION_H_
 #define FORMULON_EVAL_TEXT_FORMAT_RENDER_FRACTION_H_
@@ -19,7 +19,7 @@ namespace number_format_detail {
 
 // Render one fraction-format section. The dispatcher in `render_numeric`
 // calls this when `Section::is_fraction` is true.
-void render_fraction(const Section& section, std::string_view fmt, double value, std::string& out);
+FormatStatus render_fraction(const Section& section, std::string_view fmt, double value, std::string& out);
 
 }  // namespace number_format_detail
 }  // namespace text_format
diff --git a/src/eval/text_format/render_numeric.cpp b/src/eval/text_format/render_numeric.cpp
index e4abcb724..7e5c7b821 100644
--- a/src/eval/text_format/render_numeric.cpp
+++ b/src/eval/text_format/render_numeric.cpp
@@ -6,10 +6,10 @@
 
 #include "eval/text_format/render_numeric.h"
 
+#include <algorithm>
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
-#include <cstdio>
 #include <string>
 #include <string_view>
 #include <vector>
@@ -18,51 +18,13 @@
 #include "eval/text_format/render_common.h"
 #include "eval/text_format/render_fraction.h"
 #include "eval/text_format/rounding.h"
+#include "utils/number_text.h"
 
 namespace formulon {
 namespace text_format {
 namespace number_format_detail {
 namespace {
 
-// Zeros every digit of `digits` past the 15th significant one, rounding the
-// 15th digit half-away-from-zero against the 16th (matching
-// `round_display_decimal`'s tie direction). `digits` holds decimal digits
-// only (no sign, no leading zeros besides a lone "0"); its length is
-// preserved so the value's magnitude does not change, only its trailing
-// digits collapse to zero. A no-op when `digits->size() <= 15`.
-//
-// Companion to the `rendered_decimals` clamp above, which caps *fractional*
-// significant digits the same way: once 15 significant digits have been
-// emitted, the rest are unrepresentable precision from the binary double,
-// not real information (`2^60` prints as the exact 19-digit integer via
-// `%.0f`, but Excel displays `1152921504606850000`).
-void cap_integer_significant_digits(std::string* digits) {
-  constexpr std::size_t kSignificantDigits = 15u;
-  if (digits->size() <= kSignificantDigits) {
-    return;
-  }
-  const std::size_t original_length = digits->size();
-  std::string prefix = digits->substr(0, kSignificantDigits);
-  if ((*digits)[kSignificantDigits] >= '5') {
-    // Half-away-from-zero round-up, with carry propagation; an all-9s
-    // prefix carries out and grows by one digit (e.g. "999" -> "1000").
-    std::size_t i = prefix.size();
-    while (i > 0) {
-      --i;
-      if (prefix[i] != '9') {
-        ++prefix[i];
-        break;
-      }
-      prefix[i] = '0';
-      if (i == 0) {
-        prefix.insert(prefix.begin(), '1');
-      }
-    }
-  }
-  prefix.append(original_length - prefix.size(), '0');
-  *digits = std::move(prefix);
-}
-
 // Rounds `v` to `decimals` fractional places, half-away-from-zero. The
 // result's integer and fractional digit strings are written into
 // `*int_digits` and `*frac_digits` (decimal digits only, no sign, no
@@ -75,10 +37,14 @@ void format_fixed_digits(double v, int decimals, bool* negative, std::string* in
   // no sign byte. Mac Excel's two-section formats (`#,##0_);(#,##0)`) expect
   // the positive section to emit "0 " for both `+0` and `-0`; without this
   // guard the minus leaks out via `signbit(-0.0)`.
-  const double rounded = ::formulon::text_format::round_display_decimal(v, decimals);
+  const double decimal_rounded = ::formulon::text_format::round_display_decimal(v, decimals);
+  // A finite value at the double limit can round beyond its binary range.
+  // Convert the original magnitude in that case; the digit-string cap below
+  // still rounds its integer part to Excel's 15 significant digits.
+  const double rounded = std::isfinite(decimal_rounded) ? decimal_rounded : v;
   *negative = rounded < 0.0;
   const double abs_v = std::fabs(rounded);
-  // `snprintf` only converts an already Excel-rounded decimal value to its
+  // `format_fixed` only converts an already Excel-rounded decimal value to its
   // digit string. It must not decide the tie direction: Apple libc rounds
   // `%.0f` ties to even, while Excel rounds them away from zero.
   const int requested_decimals = decimals < 0 ? 0 : decimals;
@@ -91,12 +57,12 @@ void format_fixed_digits(double v, int decimals, bool* negative, std::string* in
     rendered_decimals = std::min(requested_decimals, std::max(0, 14 - exponent));
   }
   char buf[64];
-  const int n = std::snprintf(buf, sizeof(buf), "%.*f", rendered_decimals, abs_v);
+  const int n = format_fixed(buf, sizeof(buf), abs_v, rendered_decimals);
   if (n < 0 || static_cast<std::size_t>(n) >= sizeof(buf)) {
-    // Fallback: fall back to sprintf with a heap buffer (extremely rare).
+    // Fallback: a heap buffer for the oversized text (extremely rare).
     std::string out;
     out.resize(static_cast<std::size_t>(rendered_decimals) + 32u);
-    const int m = std::snprintf(&out[0], out.size(), "%.*f", rendered_decimals, abs_v);
+    const int m = format_fixed(&out[0], out.size(), abs_v, rendered_decimals);
     if (m > 0) {
       out.resize(static_cast<std::size_t>(m));
     } else {
@@ -127,6 +93,21 @@ void format_fixed_digits(double v, int decimals, bool* negative, std::string* in
   cap_integer_significant_digits(int_digits);
 }
 
+// Length of `s` once trailing fractional zeros, and then a bare '.', are dropped.
+std::size_t trimmed_fraction_length(std::string_view s) {
+  std::size_t end = s.size();
+  const std::size_t dot = s.find('.');
+  if (dot != std::string_view::npos) {
+    while (end > dot + 1 && s[end - 1] == '0') {
+      --end;
+    }
+    if (end > 0 && s[end - 1] == '.') {
+      --end;
+    }
+  }
+  return end;
+}
+
 // Excel's `General` format code produces an ~11-character-wide numeric
 // display: fixed-point when the value fits, scientific notation otherwise.
 // This matches Mac Excel 365 / ja-JP for TEXT() calls and is the rendering
@@ -184,9 +165,10 @@ void format_general(std::string& out, double v) {
       frac = 0;
     }
     char buf[64];
-    const int n = std::snprintf(buf, sizeof(buf), "%.*e", frac, v);
+    const int n = format_exponential(buf, sizeof(buf), v, frac);
     if (n <= 0) {
-      out.append(std::to_string(v));
+      format_fixed(buf, sizeof(buf), v, 6);
+      out.append(buf);
       return;
     }
     std::string_view s(buf, static_cast<std::size_t>(n));
@@ -199,17 +181,7 @@ void format_general(std::string& out, double v) {
     std::string_view exp_part = s.substr(epos + 1);
     // Trim trailing zeros from the mantissa's fractional part. `2.50000`
     // collapses to `2.5`; `1.00000` collapses to `1`.
-    std::size_t dot = mantissa.find('.');
-    std::size_t mantissa_end = mantissa.size();
-    if (dot != std::string_view::npos) {
-      while (mantissa_end > dot + 1 && mantissa[mantissa_end - 1] == '0') {
-        --mantissa_end;
-      }
-      if (mantissa_end > 0 && mantissa[mantissa_end - 1] == '.') {
-        --mantissa_end;
-      }
-    }
-    out.append(mantissa.data(), mantissa_end);
+    out.append(mantissa.data(), trimmed_fraction_length(mantissa));
     out.push_back('E');
     // Exponent: always emit an explicit sign, and pad the exponent digits
     // to at least two characters (e.g. `E+09`, not `E+9`). Mac Excel /
@@ -239,23 +211,99 @@ void format_general(std::string& out, double v) {
     frac = 0;
   }
   char buf[64];
-  const int n = std::snprintf(buf, sizeof(buf), "%.*f", frac, v);
+  const int n = format_fixed(buf, sizeof(buf), v, frac);
   if (n <= 0) {
-    out.append(std::to_string(v));
+    format_fixed(buf, sizeof(buf), v, 6);
+    out.append(buf);
     return;
   }
-  std::string_view s(buf, static_cast<std::size_t>(n));
-  std::size_t dot = s.find('.');
-  std::size_t end = s.size();
-  if (dot != std::string_view::npos) {
-    while (end > dot + 1 && s[end - 1] == '0') {
-      --end;
+  out.append(buf, trimmed_fraction_length(std::string_view(buf, static_cast<std::size_t>(n))));
+}
+
+// Appends one 4-digit group (leading zeros allowed, value non-zero) as kanji
+// with 千/百/十 place units; a 1 before a place unit is dropped (1234 ->
+// 千二百三十四).
+void append_kanji_group(std::string& out, std::string_view group) {
+  static const char* const kPlaceUnits[4] = {"", "\xE5\x8D\x81", "\xE7\x99\xBE", "\xE5\x8D\x83"};  // 十 百 千
+  for (std::size_t i = 0; i < group.size(); ++i) {
+    const char digit = group[i];
+    const std::size_t place = group.size() - 1U - i;
+    if (digit == '0') {
+      continue;
     }
-    if (end > 0 && s[end - 1] == '.') {
-      --end;
+    if (place == 0U || digit != '1') {
+      append_digit_dbnum(out, DbNumMode::kDBNum1, digit);
+    }
+    out.append(kPlaceUnits[place]);
+  }
+}
+
+// Appends the integer `digits` as positional kanji in 4-digit groups under
+// 万/億/兆. A part above 兆 longer than one group has no larger unit and is
+// spelled digit by digit.
+void append_kanji_integer(std::string& out, std::string_view digits) {
+  static const char* const kGroupUnits[4] = {"", "\xE4\xB8\x87", "\xE5\x84\x84", "\xE5\x85\x86"};  // 万 億 兆
+  constexpr std::size_t kGroupDigits = 4U;
+  constexpr std::size_t kTopGroup = 3U;
+  const std::size_t first = digits.find_first_not_of('0');
+  if (first == std::string_view::npos) {
+    append_digit_dbnum(out, DbNumMode::kDBNum1, '0');
+    return;
+  }
+  digits.remove_prefix(first);
+  const std::size_t lower_digits = kTopGroup * kGroupDigits;
+  if (digits.size() > lower_digits) {
+    const std::string_view top = digits.substr(0, digits.size() - lower_digits);
+    if (top.size() <= kGroupDigits) {
+      append_kanji_group(out, top);
+    } else {
+      append_chars_dbnum(out, DbNumMode::kDBNum1, top);
+    }
+    out.append(kGroupUnits[kTopGroup]);
+    digits.remove_prefix(top.size());
+  }
+  std::size_t unit = (digits.size() + kGroupDigits - 1U) / kGroupDigits;
+  std::size_t begin = 0;
+  while (unit > 0U) {
+    --unit;
+    const std::size_t end = digits.size() - unit * kGroupDigits;
+    const std::string_view group = digits.substr(begin, end - begin);
+    if (group.find_first_not_of('0') != std::string_view::npos) {
+      append_kanji_group(out, group);
+      out.append(kGroupUnits[unit]);
+    }
+    begin = end;
+  }
+}
+
+// `[DBNum1]General`: the integer part in positional kanji, the fraction digit
+// by digit. A magnitude General would show in scientific form is written out
+// to 15 significant digits instead (1E+15 -> 千兆).
+void append_dbnum1_general(std::string& out, double abs_v) {
+  std::string general;
+  format_general(general, abs_v);
+  std::string int_digits;
+  std::string frac_digits;
+  if (general.find('E') == std::string::npos) {
+    const std::size_t dot = general.find('.');
+    int_digits = general.substr(0, dot);
+    frac_digits = dot == std::string::npos ? std::string() : general.substr(dot + 1U);
+  } else if (abs_v >= 1.0) {
+    const int exp10 = static_cast<int>(std::floor(std::log10(abs_v)));
+    bool negative = false;
+    format_fixed_digits(abs_v, std::max(0, 14 - exp10), &negative, &int_digits, &frac_digits);
+    while (!frac_digits.empty() && frac_digits.back() == '0') {
+      frac_digits.pop_back();
     }
+  } else {
+    append_chars_dbnum(out, DbNumMode::kDBNum1, general);
+    return;
+  }
+  append_kanji_integer(out, int_digits);
+  if (!frac_digits.empty()) {
+    out.push_back('.');
+    append_chars_dbnum(out, DbNumMode::kDBNum1, frac_digits);
   }
-  out.append(s.data(), end);
 }
 
 }  // namespace
@@ -271,11 +319,7 @@ void format_general(std::string& out, double v) {
 //   3. Round the absolute value to that precision; capture sign separately.
 //   4. Walk the tokens and weave the integer/fraction digit strings into
 //      the output alongside literals, commas, and percent.
-void render_numeric(const Section& section, std::string_view fmt, double value, std::string& out) {
-  if (section.is_fraction) {
-    render_fraction(section, fmt, value, out);
-    return;
-  }
+FormatStatus render_numeric(const Section& section, std::string_view fmt, double value, std::string& out) {
   double scaled = value;
   if (section.has_percent) {
     scaled *= 100.0;
@@ -283,91 +327,62 @@ void render_numeric(const Section& section, std::string_view fmt, double value,
   for (int i = 0; i < section.trailing_comma_scale; ++i) {
     scaled /= 1000.0;
   }
+  if (!std::isfinite(scaled)) {
+    return FormatStatus::kOverflow;
+  }
+  if (section.is_fraction) {
+    return render_fraction(section, fmt, scaled, out);
+  }
   const int frac_digits = section.fraction_zero_digits + section.fraction_opt_digits + section.fraction_pad_digits;
   bool negative = false;
   std::string int_digits;
   std::string frac_digits_str;
 
+  int exponent = 0;
   if (section.has_scientific) {
-    // Scientific notation: compute mantissa/exponent, format mantissa
-    // through the fixed path, then append the exponent with the configured
-    // sign behaviour.
+    // Engineering groups span all integer placeholders; required `0`/`?` still set minimum padding.
+    const int integer_group =
+        std::max(1, section.integer_zero_digits + section.integer_opt_digits + section.integer_pad_digits);
     double mantissa = scaled;
-    int exponent = 0;
     if (mantissa != 0.0) {
-      // Normalise mantissa so the integer part has `integer_digits_total`
-      // digits; default is one digit.
-      const int int_total = section.integer_zero_digits + section.integer_opt_digits + section.integer_pad_digits;
-      const int want_int_digits = int_total > 0 ? int_total : 1;
       const double abs_m = std::fabs(mantissa);
-      const double log10_m = std::log10(abs_m);
-      // Target: floor(log10(|mantissa|)) == want_int_digits - 1.
-      const int target = want_int_digits - 1;
-      int shift = static_cast<int>(std::floor(log10_m)) - target;
-      // Walk toward target in a stable way (avoid pow() rounding drift for
-      // exact powers of 10).
-      if (shift > 0) {
-        for (int i = 0; i < shift; ++i) {
+      const int raw_exponent = static_cast<int>(std::floor(std::log10(abs_m)));
+      // Floor division keeps values in (-1, 0) in the preceding group.
+      int quotient = raw_exponent / integer_group;
+      if (raw_exponent < 0 && raw_exponent % integer_group != 0) {
+        --quotient;
+      }
+      exponent = quotient * integer_group;
+      if (exponent > 0) {
+        for (int i = 0; i < exponent; ++i) {
           mantissa /= 10.0;
         }
-      } else if (shift < 0) {
-        for (int i = 0; i < -shift; ++i) {
+      } else if (exponent < 0) {
+        for (int i = 0; i > exponent; --i) {
           mantissa *= 10.0;
         }
       }
-      exponent = shift;
+      if (!std::isfinite(mantissa)) {
+        return FormatStatus::kOverflow;
+      }
     }
     format_fixed_digits(mantissa, frac_digits, &negative, &int_digits, &frac_digits_str);
-    // Fall through into the standard walker below, but also remember the
-    // exponent to emit when we hit the scientific marker.
-    // We lay out a specialised walker here rather than reusing the fixed
-    // path's literal copier because the scientific token needs to consume
-    // both the SciPlus/SciMinus token and the subsequent digit tokens that
-    // describe the exponent width.
-    std::string result;
-    if (negative) {
-      result.push_back('-');
-    }
-    // int_digits is already normalised by the scaling + format_fixed_digits
-    // call above; append it verbatim.
-    result.append(int_digits);
-    if (section.has_point && frac_digits > 0) {
-      result.push_back('.');
-      // Pad `frac_digits_str` to `frac_digits` characters.
-      if (static_cast<int>(frac_digits_str.size()) < frac_digits) {
-        frac_digits_str.append(static_cast<std::size_t>(frac_digits) - frac_digits_str.size(), '0');
-      } else if (static_cast<int>(frac_digits_str.size()) > frac_digits) {
-        frac_digits_str.resize(static_cast<std::size_t>(frac_digits));
+
+    // Rounding can carry into a new group (99.999 -> 100.00); renormalize and format again.
+    if (mantissa != 0.0 && static_cast<int>(int_digits.size()) > integer_group) {
+      for (int i = 0; i < integer_group; ++i) {
+        mantissa /= 10.0;
       }
-      result.append(frac_digits_str);
-    }
-    // Exponent marker + digits. Sign emission: SciPlus always emits '+' or
-    // '-'; SciMinus emits only '-'.
-    // Use capital or lowercase 'E' matching the format string? In this
-    // simplified implementation we always emit 'E'. (Mac Excel on a ja-JP
-    // keyboard renders a capital E by default.)
-    result.push_back('E');
-    if (exponent >= 0) {
-      if (section.sci_plus) {
-        result.push_back('+');
+      exponent += integer_group;
+      if (!std::isfinite(mantissa)) {
+        return FormatStatus::kOverflow;
       }
-    } else {
-      result.push_back('-');
-    }
-    const int abs_exp = exponent >= 0 ? exponent : -exponent;
-    std::string exp_str = std::to_string(abs_exp);
-    // Pad to at least `sci_digits` digits.
-    if (static_cast<int>(exp_str.size()) < section.sci_digits) {
-      exp_str.insert(exp_str.begin(), static_cast<std::size_t>(section.sci_digits) - exp_str.size(), '0');
+      format_fixed_digits(mantissa, frac_digits, &negative, &int_digits, &frac_digits_str);
     }
-    result.append(exp_str);
-    out.append(result);
-    (void)fmt;
-    return;
+  } else {
+    format_fixed_digits(scaled, frac_digits, &negative, &int_digits, &frac_digits_str);
   }
 
-  format_fixed_digits(scaled, frac_digits, &negative, &int_digits, &frac_digits_str);
-
   // `General` chooses its own display precision below.  Its sign must
   // therefore come from the unrounded input, not from the zero-decimal
   // placeholder pass above: e.g. TEXT(-1/3, "General") is -0.333333333,
@@ -390,7 +405,7 @@ void render_numeric(const Section& section, std::string_view fmt, double value,
     int_digits.clear();
   }
 
-  // Fraction adjustment: the snprintf produced exactly `frac_digits` chars.
+  // Fraction adjustment: the formatter produced exactly `frac_digits` chars.
   // Trim trailing zeros matching the `#` tokens (scan right-to-left).
   int trim = section.fraction_opt_digits;
   while (trim > 0 && !frac_digits_str.empty() && frac_digits_str.back() == '0') {
@@ -398,19 +413,20 @@ void render_numeric(const Section& section, std::string_view fmt, double value,
     --trim;
   }
 
-  // Locate the decimal point inside the token stream so we can partition the
-  // digit tokens into integer / fraction stacks. This mirrors the classifier,
-  // but we need the position again at walk time to drive the interleaving.
+  // Locate the decimal point and scientific marker inside the token stream so
+  // we can partition the digit tokens into integer / fraction / exponent
+  // stacks. This mirrors the classifier, but we need the positions again at
+  // walk time to drive the interleaving.
   int point_index = -1;
+  int scientific_index = -1;
   for (std::size_t i = 0; i < section.tokens.size(); ++i) {
-    if (section.tokens[i].kind == Tok::Point) {
+    if (point_index < 0 && section.tokens[i].kind == Tok::Point) {
       point_index = static_cast<int>(i);
-      break;
+    }
+    if (scientific_index < 0 && (section.tokens[i].kind == Tok::SciPlus || section.tokens[i].kind == Tok::SciMinus)) {
+      scientific_index = static_cast<int>(i);
     }
   }
-  // Scientific tokens were handled in the earlier branch; for plain numeric
-  // rendering we ignore any post-scientific digit tokens (there are none in
-  // practice since the scientific branch returns early).
   auto is_digit_tok = [](Tok k) { return k == Tok::DigitZero || k == Tok::DigitOpt || k == Tok::DigitPad; };
 
   // Gather integer digit token positions (in token order). We distribute the
@@ -422,10 +438,53 @@ void render_numeric(const Section& section, std::string_view fmt, double value,
     if (point_index >= 0 && static_cast<int>(i) >= point_index) {
       break;
     }
+    if (scientific_index >= 0 && static_cast<int>(i) >= scientific_index) {
+      break;
+    }
     if (is_digit_tok(section.tokens[i].kind)) {
       int_digit_positions.push_back(i);
     }
   }
+
+  // Scientific exponent placeholders consume the prepared exponent digits
+  // independently of the mantissa's integer/fraction streams. Keep the same
+  // right-aligned slot behavior as the common numeric walker so literals,
+  // DBNum substitution, and `_X` spaces remain in their original positions.
+  std::vector<std::size_t> exponent_digit_positions;
+  std::vector<std::string> exponent_slot_text;
+  std::string exponent_digits;
+  if (section.has_scientific) {
+    const int abs_exponent = exponent < 0 ? -exponent : exponent;
+    exponent_digits = std::to_string(abs_exponent);
+    bool after_marker = false;
+    for (std::size_t i = 0; i < section.tokens.size(); ++i) {
+      const Tok kind = section.tokens[i].kind;
+      if (kind == Tok::SciPlus || kind == Tok::SciMinus) {
+        after_marker = true;
+        continue;
+      }
+      if (after_marker && is_digit_tok(kind)) {
+        exponent_digit_positions.push_back(i);
+      }
+    }
+    exponent_slot_text.resize(exponent_digit_positions.size());
+    const std::size_t n_exponent_tokens = exponent_digit_positions.size();
+    const std::size_t n_exponent_digits = exponent_digits.size();
+    if (n_exponent_tokens > 0 && n_exponent_digits > 0) {
+      if (n_exponent_digits >= n_exponent_tokens) {
+        const std::size_t prefix_len = n_exponent_digits - n_exponent_tokens + 1;
+        exponent_slot_text[0].assign(exponent_digits, 0, prefix_len);
+        for (std::size_t i = 1; i < n_exponent_tokens; ++i) {
+          exponent_slot_text[i].assign(1, exponent_digits[prefix_len + i - 1]);
+        }
+      } else {
+        const std::size_t fallback_count = n_exponent_tokens - n_exponent_digits;
+        for (std::size_t i = 0; i < n_exponent_digits; ++i) {
+          exponent_slot_text[fallback_count + i].assign(1, exponent_digits[i]);
+        }
+      }
+    }
+  }
   const std::size_t n_int_tokens = int_digit_positions.size();
   const std::size_t n_int_digits = int_digits.size();
 
@@ -471,7 +530,9 @@ void render_numeric(const Section& section, std::string_view fmt, double value,
   std::size_t int_cursor = 0;
   std::size_t int_token_cursor = 0;
   std::size_t frac_cursor = 0;
+  std::size_t exponent_token_cursor = 0;
   bool past_point = false;
+  bool in_exponent = false;
 
   auto emit_int_digit_char = [&](char digit) {
     if (section.thousands_separator && int_cursor > 0 && (n_int_digits - int_cursor) % 3 == 0) {
@@ -490,7 +551,22 @@ void render_numeric(const Section& section, std::string_view fmt, double value,
       case Tok::DigitZero:
       case Tok::DigitOpt:
       case Tok::DigitPad:
-        if (past_point) {
+        if (in_exponent) {
+          const std::string* slot = nullptr;
+          if (exponent_token_cursor < exponent_slot_text.size()) {
+            slot = &exponent_slot_text[exponent_token_cursor];
+          }
+          if (slot != nullptr && !slot->empty()) {
+            for (char d : *slot) {
+              append_digit_dbnum(result, section.dbnum_mode, d);
+            }
+          } else if (tk.kind == Tok::DigitZero) {
+            append_digit_dbnum(result, section.dbnum_mode, '0');
+          } else if (tk.kind == Tok::DigitPad) {
+            result.push_back(' ');
+          }
+          ++exponent_token_cursor;
+        } else if (past_point) {
           if (frac_cursor < frac_digits_str.size()) {
             emit_frac_digit_char(frac_digits_str[frac_cursor]);
             ++frac_cursor;
@@ -550,10 +626,14 @@ void render_numeric(const Section& section, std::string_view fmt, double value,
         // Render through the Excel-specific 11-character `General` formatter
         // on the absolute value; the sign prefix was already emitted above
         // (for single-section formats) or stripped by the section selector
-        // (two-section formats pass an already-positive `value`). A
-        // `[DBNum1-3]` qualifier applies to General the same as it does to
-        // every digit token elsewhere in this function; non-digit bytes
-        // (the decimal point, exponent marker, ...) pass through unchanged.
+        // (two-section formats pass an already-positive `value`).
+        // `[DBNum1]` spells the integer part positionally; `[DBNum2-3]`
+        // substitute digit by digit, and non-digit bytes (the decimal
+        // point, exponent marker, ...) pass through unchanged.
+        if (section.dbnum_mode == DbNumMode::kDBNum1) {
+          append_dbnum1_general(result, std::fabs(value));
+          break;
+        }
         std::string general;
         format_general(general, std::fabs(value));
         append_chars_dbnum(result, section.dbnum_mode, general);
@@ -561,16 +641,26 @@ void render_numeric(const Section& section, std::string_view fmt, double value,
       }
       case Tok::SciPlus:
       case Tok::SciMinus:
-        // Scientific path handled above; should not reach here.
+        // Walk the remaining tokens so exponent placeholders and literals keep their positions.
+        result.push_back('E');
+        if (exponent >= 0) {
+          if (tk.kind == Tok::SciPlus) {
+            result.push_back('+');
+          }
+        } else {
+          result.push_back('-');
+        }
+        in_exponent = true;
         break;
       case Tok::At:
-        // `@` in a numeric context is ignored (Excel emits nothing).
+        // Text-only sections are dispatched before numeric rendering.
         break;
       default:
         break;
     }
   }
   out.append(result);
+  return FormatStatus::kOk;
 }
 
 }  // namespace number_format_detail
diff --git a/src/eval/text_format/render_numeric.h b/src/eval/text_format/render_numeric.h
index f0fb1f468..bbf4f4845 100644
--- a/src/eval/text_format/render_numeric.h
+++ b/src/eval/text_format/render_numeric.h
@@ -18,7 +18,7 @@ namespace number_format_detail {
 
 // Render one numeric section through the walk-tokens pipeline. Delegates to
 // `render_fraction` when `section.is_fraction` is set.
-void render_numeric(const Section& section, std::string_view fmt, double value, std::string& out);
+FormatStatus render_numeric(const Section& section, std::string_view fmt, double value, std::string& out);
 
 }  // namespace number_format_detail
 }  // namespace text_format
diff --git a/src/eval/text_format/rounding.h b/src/eval/text_format/rounding.h
index fe97c1608..d77c6a5d3 100644
--- a/src/eval/text_format/rounding.h
+++ b/src/eval/text_format/rounding.h
@@ -6,10 +6,11 @@
 
 #include <cmath>
 #include <cstddef>
-#include <cstdio>
+#include <cstring>
 #include <string_view>
 
 #include "utils/double_parse.h"
+#include "utils/number_text.h"
 
 namespace formulon {
 namespace text_format {
@@ -47,7 +48,7 @@ inline double round_display_decimal(double value, int decimals) noexcept {
     return value;
   }
   char text[32];
-  const int written = std::snprintf(text, sizeof(text), "%.*e", kExcelSignificantDigits - 1, std::fabs(value));
+  const int written = format_exponential(text, sizeof(text), std::fabs(value), kExcelSignificantDigits - 1);
   if (written <= 0 || static_cast<std::size_t>(written) >= sizeof(text)) {
     return value;
   }
@@ -117,17 +118,21 @@ inline double round_display_decimal(double value, int decimals) noexcept {
       ++exponent;
     }
   }
-  digits[keep] = '\0';
 
   // Rebuild through a point-free literal: the mantissa is an integer and the
   // exponent carries the scale, so the conversion back is exact for every
   // representable magnitude and never touches a locale decimal point.
   char rebuilt[kExcelSignificantDigits + 8];
-  const int rebuilt_length = std::snprintf(rebuilt, sizeof(rebuilt), "%se%d", digits, exponent - keep + 1);
-  if (rebuilt_length <= 0 || static_cast<std::size_t>(rebuilt_length) >= sizeof(rebuilt)) {
+  const std::size_t mantissa_length = static_cast<std::size_t>(keep);
+  std::memcpy(rebuilt, digits, mantissa_length);
+  rebuilt[mantissa_length] = 'e';
+  const std::size_t exponent_offset = mantissa_length + 1;
+  const int exponent_length =
+      format_signed(rebuilt + exponent_offset, sizeof(rebuilt) - exponent_offset, exponent - keep + 1);
+  if (exponent_length <= 0 || static_cast<std::size_t>(exponent_length) >= sizeof(rebuilt) - exponent_offset) {
     return value;
   }
-  const std::string_view literal(rebuilt, static_cast<std::size_t>(rebuilt_length));
+  const std::string_view literal(rebuilt, exponent_offset + static_cast<std::size_t>(exponent_length));
   return std::copysign(parse_double_prefix(literal).value, value);
 }
 
diff --git a/src/eval/textjoin_lazy.cpp b/src/eval/textjoin_lazy.cpp
index 3f3b89792..bfb3c7488 100644
--- a/src/eval/textjoin_lazy.cpp
+++ b/src/eval/textjoin_lazy.cpp
@@ -22,10 +22,6 @@ namespace eval {
 
 namespace {
 
-// Excel caps the result of TEXTJOIN (and REPT / SUBSTITUTE and other text
-// builtins) at 32,767 UTF-16 units.
-constexpr std::uint64_t kExcelTextCapUnits = 32767u;
-
 // Longest UTF-8 sequence, and therefore the most trailing bytes of a buffer
 // whose decoding a later append can still change.
 constexpr std::size_t kMaxUtf8SequenceBytes = 4u;
diff --git a/src/eval/tree_walker/binding_source.cpp b/src/eval/tree_walker/binding_source.cpp
new file mode 100644
index 000000000..88505f65b
--- /dev/null
+++ b/src/eval/tree_walker/binding_source.cpp
@@ -0,0 +1,181 @@
+//
+// LET / LAMBDA binding-source resolution: decides whether a binding records a
+// reference (so the bound name reads it where it is used) or an evaluated
+// value. The public contract is declared in `tree_walker/dispatch.h`.
+
+#include <cstdint>
+#include <string_view>
+
+#include "eval/declared_rect.h"
+#include "eval/eval_context.h"
+#include "eval/function_registry.h"
+#include "eval/lazy_impls.h"
+#include "eval/name_env.h"
+#include "eval/name_env_resolve.h"
+#include "eval/range_resolvers.h"
+#include "eval/tree_walker/dispatch.h"
+#include "parser/ast.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "value.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+
+// True when `node` reads no lexical binding, so it evaluates the same in any
+// scope. Conservative: a shape it does not know is not scope-free.
+bool is_scope_free(const parser::AstNode& node, const NameEnv* env) {
+  switch (node.kind()) {
+    case parser::NodeKind::Literal:
+    case parser::NodeKind::ErrorLiteral:
+    case parser::NodeKind::Ref:
+    case parser::NodeKind::Ref3D:
+    case parser::NodeKind::ArrayLiteral:
+      return true;
+    case parser::NodeKind::SpillRef:
+      return node.as_spill_ref_anchor_expr() == nullptr;
+    case parser::NodeKind::UnaryOp:
+      return is_scope_free(node.as_unary_operand(), env);
+    case parser::NodeKind::BinaryOp:
+      return is_scope_free(node.as_binary_lhs(), env) && is_scope_free(node.as_binary_rhs(), env);
+    case parser::NodeKind::RangeOp:
+      return is_scope_free(node.as_range_lhs(), env) && is_scope_free(node.as_range_rhs(), env);
+    case parser::NodeKind::IntersectOp:
+      return is_scope_free(node.as_intersect_lhs(), env) && is_scope_free(node.as_intersect_rhs(), env);
+    case parser::NodeKind::UnionOp:
+      for (std::uint32_t i = 0; i < node.as_union_arity(); ++i) {
+        if (!is_scope_free(node.as_union_child(i), env)) {
+          return false;
+        }
+      }
+      return true;
+    case parser::NodeKind::Call:
+      if (env != nullptr && env->lookup(node.as_call_name()) != nullptr) {
+        return false;
+      }
+      for (std::uint32_t i = 0; i < node.as_call_arity(); ++i) {
+        if (!is_scope_free(node.as_call_arg(i), env)) {
+          return false;
+        }
+      }
+      return true;
+    default:
+      return false;
+  }
+}
+
+// Resolves a binding source that returns a reference (a reference-returning
+// call, a `:` over one, or an intersection) to the static `RangeOp` it names,
+// so the binding carries that rectangle rather than the call. Returns nullptr
+// for any other shape or when the call picks a non-reference (`INDEX({1,2},1)`).
+const parser::AstNode* resolve_computed_reference(const parser::AstNode& expr, Arena& arena,
+                                                  const FunctionRegistry& registry, const EvalContext& ctx) {
+  if (expr.kind() == parser::NodeKind::Call) {
+    const NameEnv* env = ctx.name_env();
+    if (!is_reference_call_name(expr.as_call_name()) ||
+        (env != nullptr && env->lookup(expr.as_call_name()) != nullptr)) {
+      return nullptr;
+    }
+  } else if (expr.kind() == parser::NodeKind::RangeOp) {
+    parser::Reference lhs{};
+    parser::Reference rhs{};
+    if (declared_rect_endpoint_pair(expr, &lhs, &rhs)) {
+      return nullptr;
+    }
+  } else if (expr.kind() != parser::NodeKind::IntersectOp) {
+    return nullptr;
+  }
+  std::string_view sheet;
+  std::uint32_t top = 0;
+  std::uint32_t left = 0;
+  std::uint32_t bottom = 0;
+  std::uint32_t right = 0;
+  ErrorCode err = ErrorCode::Value;
+  if (!resolve_reference_rect(expr, arena, registry, ctx, &sheet, &top, &left, &bottom, &right, &err)) {
+    return nullptr;
+  }
+  parser::Reference first{};
+  parser::Reference last{};
+  first.sheet = sheet;
+  last.sheet = sheet;
+  if (top == 0U && bottom == Sheet::kMaxRows - 1U) {
+    first.is_full_col = true;
+    last.is_full_col = true;
+    first.col = left;
+    last.col = right;
+  } else if (left == 0U && right == Sheet::kMaxCols - 1U) {
+    first.is_full_row = true;
+    last.is_full_row = true;
+    first.row = top;
+    last.row = bottom;
+  } else {
+    first.row = top;
+    first.col = left;
+    last.row = bottom;
+    last.col = right;
+  }
+  // Always a `RangeOp`, even for one cell (`D1:D1`): a bare `Ref` binding is
+  // the scalar-provenance shape, and a reference-returning call is not.
+  parser::AstNode* lhs = parser::make_ref(arena, first);
+  parser::AstNode* rhs = parser::make_ref(arena, last);
+  if (lhs == nullptr || rhs == nullptr) {
+    return nullptr;
+  }
+  return parser::make_range_op(arena, lhs, rhs);
+}
+
+}  // namespace
+
+const parser::AstNode* resolve_binding_reference(const parser::AstNode& expr, Arena& arena,
+                                                 const FunctionRegistry& registry, const EvalContext& ctx) {
+  parser::Reference lhs{};
+  parser::Reference rhs{};
+  switch (expr.kind()) {
+    case parser::NodeKind::Ref:
+      return &expr;
+    case parser::NodeKind::RangeOp:
+      if (declared_rect_endpoint_pair(expr, &lhs, &rhs)) {
+        return &expr;
+      }
+      break;
+    case parser::NodeKind::NameRef: {
+      const NameEnv* env = ctx.name_env();
+      const parser::AstNode* bound =
+          (env != nullptr && expr.as_name_sheet().empty()) ? env->lookup_ast(expr.as_name()) : nullptr;
+      if (bound != nullptr && (bound->kind() == parser::NodeKind::Ref || bound->kind() == parser::NodeKind::RangeOp)) {
+        return bound;
+      }
+      return nullptr;
+    }
+    default:
+      break;
+  }
+  return resolve_computed_reference(expr, arena, registry, ctx);
+}
+
+Value eval_binding_source(const parser::AstNode& expr, Arena& arena, const FunctionRegistry& registry,
+                          const EvalContext& ctx, const parser::AstNode** out_ast) {
+  const parser::AstNode* ref = resolve_binding_reference(expr, arena, registry, ctx);
+  *out_ast = ref;
+  // A union, or a range-shaped call naming no single rectangle (one picking a
+  // union), is recorded as written when it reads the same in any scope.
+  const bool unresolved_range =
+      ref == nullptr && (expr.kind() == parser::NodeKind::UnionOp ||
+                         (expr.kind() == parser::NodeKind::Call && is_range_shaped_ast(expr)));
+  if (expr.kind() == parser::NodeKind::ArrayLiteral ||
+      (expr.kind() == parser::NodeKind::SpillRef && expr.as_spill_ref_anchor_expr() == nullptr) ||
+      (unresolved_range && is_scope_free(expr, ctx.name_env()))) {
+    *out_ast = &expr;
+  } else if (expr.kind() == parser::NodeKind::NameRef && expr.as_name_sheet().empty() && ctx.name_env() != nullptr) {
+    *out_ast = ctx.name_env()->lookup_ast(expr.as_name());
+  }
+  // A reference is read where the bound name is used, not here.
+  if (ref != nullptr) {
+    return Value::blank();
+  }
+  return eval_node(expr, arena, registry, ctx);
+}
+
+}  // namespace eval
+}  // namespace formulon
diff --git a/src/eval/tree_walker/depth_guard.h b/src/eval/tree_walker/depth_guard.h
index 9dd0aad31..1ed26acf2 100644
--- a/src/eval/tree_walker/depth_guard.h
+++ b/src/eval/tree_walker/depth_guard.h
@@ -1,10 +1,10 @@
 //
 // Private helper for the tree-walk evaluator: a tiny RAII counter guard
 // that bounds runaway recursion through `EvalContext::resolve_ref` and
-// user-defined LAMBDA closures. Kept header-only so the two evaluator
-// translation units that need it (`tree_walker/walker.cpp` and
-// `tree_walker/dispatch.cpp`) can construct guards inline without an
-// extra function-call hop.
+// user-defined LAMBDA closures. Kept header-only so the evaluator
+// translation units that need it (`tree_walker/walker.cpp`,
+// `tree_walker/dispatch.cpp` and `tree_walker/lambda_invoke.cpp`) can
+// construct guards inline without an extra function-call hop.
 //
 // This header is internal to the tree-walker family and is not part of
 // the public evaluator surface — production callers reach the evaluator
diff --git a/src/eval/tree_walker/dispatch.cpp b/src/eval/tree_walker/dispatch.cpp
index 13f1707f6..d9175e075 100644
--- a/src/eval/tree_walker/dispatch.cpp
+++ b/src/eval/tree_walker/dispatch.cpp
@@ -104,6 +104,31 @@ bool append_expanded_call_argument(const FunctionDef& def, const parser::AstNode
   return true;
 }
 
+// Expands the rectangle [`lhs`, `rhs`] into `values` through `def`'s range
+// filters. An expansion error is pushed, or returned via `immediate_return`
+// (with `false`) when `def` propagates errors.
+bool append_expanded_range(const FunctionDef& def, const parser::Reference& lhs, const parser::Reference& rhs,
+                           Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx,
+                           std::vector<Value>* values, Value* immediate_return) {
+  auto expanded = ctx.expand_range(lhs, rhs, arena, registry);
+  if (!expanded) {
+    const Value err = Value::error(expanded.error());
+    if (def.propagate_errors) {
+      *immediate_return = err;
+      return false;
+    }
+    values->push_back(err);
+    return true;
+  }
+  Value range_err = Value::blank();
+  const std::vector<Value>& cells = expanded.value();
+  if (!append_range_sourced_values(def, cells.data(), cells.size(), values, &range_err)) {
+    *immediate_return = range_err;
+    return false;
+  }
+  return true;
+}
+
 }  // namespace
 
 bool is_reference_shape(const parser::AstNode& node) noexcept {
@@ -122,246 +147,6 @@ bool is_reference_shape(const parser::AstNode& node) noexcept {
 
 namespace {
 
-// `syntax_args` is the call site's argument AST, consulted for one thing
-// only: telling a syntactically omitted slot (`f(1, , 3)`) from a supplied
-// one. It is deliberately separate from `ast_args`, the per-argument AST
-// `eval_binding_source` chose to record on the binding.
-// Binds `lv`'s parameters for a call into `*env`; the error a call surfaces
-// instead when the arity does not fit or the lambda has no body.
-std::optional<ErrorCode> bind_lambda_params(const LambdaValue* lv, std::uint32_t arity, const Value* args,
-                                            const parser::AstNode* const* ast_args,
-                                            const parser::AstNode* const* syntax_args, Arena& arena, NameEnv* out) {
-  const std::uint32_t required = lv->param_count - lv->optional_count;
-  if (arity < required || arity > lv->param_count) {
-    return ErrorCode::Value;
-  }
-  if (lv->body == nullptr) {
-    return ErrorCode::Name;
-  }
-  NameEnv& env = *out;
-  if (lv->captured_env != nullptr) {
-    env = *lv->captured_env;
-  }
-  for (std::uint32_t i = 0; i < arity; ++i) {
-    const parser::AstNode* expr = (ast_args != nullptr) ? ast_args[i] : nullptr;
-    // `f(1, , 3)` supplies the slot syntactically and omits its value, and
-    // Excel treats that as omitted wherever it appears -- leading, middle
-    // or trailing -- not only past the end of the argument list. Binding
-    // it as an ordinary blank would give the body the right number (an
-    // omitted slot arithmetic-coerces to 0 either way) while telling
-    // ISOMITTED the wrong thing, which is the whole of what that function
-    // is for. Only the AST can answer this: by the time the argument is a
-    // Value, an omitted slot and a blank cell are the same blank.
-    const parser::AstNode* syntax = (syntax_args != nullptr) ? syntax_args[i] : expr;
-    if (syntax != nullptr && is_omitted_arg(*syntax)) {
-      env = env.extend_omitted(lv->params[i], arena);
-      continue;
-    }
-    env = env.extend(lv->params[i], args[i], expr, arena);
-  }
-  for (std::uint32_t i = arity; i < lv->param_count; ++i) {
-    env = env.extend_omitted(lv->params[i], arena);
-  }
-  return std::nullopt;
-}
-
-EvalContext lambda_body_context(const LambdaValue* lv, const NameEnv& env, const EvalContext& ctx) {
-  EvalContext body_ctx = ctx.with_name_env(&env);
-  if (lv->name_scope_sheet >= 0) {
-    body_ctx = body_ctx.with_name_scope_sheet(lv->name_scope_sheet);
-  }
-  return body_ctx;
-}
-
-Value invoke_lambda_values_impl(const LambdaValue* lv, std::uint32_t arity, const Value* args,
-                                const parser::AstNode* const* ast_args, const parser::AstNode* const* syntax_args,
-                                Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx) {
-  NameEnv env;
-  if (const std::optional<ErrorCode> err = bind_lambda_params(lv, arity, args, ast_args, syntax_args, arena, &env)) {
-    return Value::error(*err);
-  }
-  return eval_node(*lv->body, arena, registry, lambda_body_context(lv, env, ctx));
-}
-
-}  // namespace
-
-Value invoke_lambda_values(const LambdaValue* lv, std::uint32_t arity, const Value* args, Arena& arena,
-                           const FunctionRegistry& registry, const EvalContext& ctx) {
-  return invoke_lambda_values_with_ast(lv, arity, args, /*ast_args=*/nullptr, arena, registry, ctx);
-}
-
-Value invoke_lambda_values_with_ast(const LambdaValue* lv, std::uint32_t arity, const Value* args,
-                                    const parser::AstNode* const* ast_args, Arena& arena,
-                                    const FunctionRegistry& registry, const EvalContext& ctx) {
-  if (lv == nullptr || (arity != 0U && args == nullptr)) {
-    return Value::error(ErrorCode::Value);
-  }
-  // Lambda-depth cap fires before the arity check so a runaway
-  // self-recursion (e.g. `LAMBDA(n, f(n+1))`) cannot keep extending the
-  // call stack on its own dime. See `kMaxLambdaDepth` for rationale.
-  EvalDepthGuard lambda_guard(ctx.lambda_depth_counter(), kMaxLambdaDepth);
-  if (lambda_guard.exceeded()) {
-    return Value::error(ErrorCode::Calc);
-  }
-  return invoke_lambda_values_impl(lv, arity, args, ast_args, /*syntax_args=*/nullptr, arena, registry, ctx);
-}
-
-namespace {
-
-// Builds the eta-expansion of the built-in `name` at `arity`:
-// `LAMBDA(p1, ..., pn, name(p1, ..., pn))`. The parameter names cannot be
-// spelled in a formula, so the body can only ever see its own arguments.
-// Returns nullptr on arena exhaustion.
-const LambdaValue* eta_expand(std::string_view name, std::uint32_t arity, Arena& arena) {
-  std::string_view* params = nullptr;
-  const parser::AstNode** body_args = nullptr;
-  if (arity > 0U) {
-    params = arena.create_array<std::string_view>(arity);
-    body_args = arena.create_array<const parser::AstNode*>(arity);
-    if (params == nullptr || body_args == nullptr) {
-      return nullptr;
-    }
-  }
-  for (std::uint32_t i = 0; i < arity; ++i) {
-    params[i] = arena.intern("@" + std::to_string(i + 1U));
-    body_args[i] = parser::make_name_ref(arena, params[i]);
-    if (params[i].empty() || body_args[i] == nullptr) {
-      return nullptr;
-    }
-  }
-  const parser::AstNode* body = parser::make_call(arena, name, body_args, arity);
-  auto* lv = arena.create<LambdaValue>();
-  if (body == nullptr || lv == nullptr) {
-    return nullptr;
-  }
-  lv->params = params;
-  lv->param_count = arity;
-  lv->optional_count = 0U;
-  lv->body = body;
-  lv->captured_env = nullptr;
-  return lv;
-}
-
-// A lambda is callable by a helper when it accepts `call_arity` arguments
-// (trailing `[optional]` params may stay unbound) and carries a body.
-const LambdaValue* check_callable(const LambdaValue* lv, std::uint32_t call_arity, Value* out_err) {
-  const std::uint32_t required = lv->param_count - lv->optional_count;
-  if (call_arity < required || call_arity > lv->param_count) {
-    *out_err = Value::error(ErrorCode::Value);
-    return nullptr;
-  }
-  if (lv->body == nullptr) {
-    *out_err = Value::error(ErrorCode::Name);
-    return nullptr;
-  }
-  return lv;
-}
-
-}  // namespace
-
-const LambdaValue* resolve_callable(const parser::AstNode& arg, std::uint32_t call_arity, Arena& arena,
-                                    const FunctionRegistry& registry, const EvalContext& ctx, Value* out_err) {
-  // `Sheet1!Fn` is neither a binding nor a built-in; it evaluates below.
-  if (arg.kind() == parser::NodeKind::NameRef && arg.as_name_sheet().empty()) {
-    const std::string_view name = arg.as_name();
-    const NameEnv* env = ctx.name_env();
-    // A name bound in scope shadows any built-in of the same spelling.
-    const auto read = [&](const parser::AstNode& ref) { return eval_node(ref, arena, registry, ctx); };
-    if (const Value* bound = (env != nullptr) ? env->lookup_or_read(name, read) : nullptr; bound != nullptr) {
-      if (bound->is_error()) {
-        *out_err = *bound;
-        return nullptr;
-      }
-      if (!bound->is_lambda()) {
-        *out_err = Value::error(ErrorCode::Value);
-        return nullptr;
-      }
-      return check_callable(bound->as_lambda(), call_arity, out_err);
-    }
-    // An unbound built-in name is an eta-reduced lambda. A miss falls through
-    // to ordinary evaluation, which reports `#NAME?`.
-    if (registry.lookup(name) != nullptr || find_lazy_impl(strip_future_prefix(name)) != nullptr) {
-      const LambdaValue* lv = eta_expand(name, call_arity, arena);
-      if (lv == nullptr) {
-        *out_err = Value::error(ErrorCode::Num);
-      }
-      return lv;
-    }
-  }
-  const Value v = eval_node(arg, arena, registry, ctx);
-  if (v.is_error()) {
-    *out_err = v;
-    return nullptr;
-  }
-  if (!v.is_lambda()) {
-    *out_err = Value::error(ErrorCode::Value);
-    return nullptr;
-  }
-  return check_callable(v.as_lambda(), call_arity, out_err);
-}
-
-Value invoke_lambda(const LambdaValue* lv, std::uint32_t arity, const parser::AstNode* const* call_args, Arena& arena,
-                    const FunctionRegistry& registry, const EvalContext& ctx) {
-  if (lv == nullptr || (arity != 0U && call_args == nullptr)) {
-    return Value::error(ErrorCode::Value);
-  }
-  // Lambda-depth cap fires before the arity check so a runaway
-  // self-recursion (e.g. `LAMBDA(n, f(n+1))`) cannot keep extending the
-  // call stack on its own dime. See `kMaxLambdaDepth` for rationale.
-  EvalDepthGuard lambda_guard(ctx.lambda_depth_counter(), kMaxLambdaDepth);
-  if (lambda_guard.exceeded()) {
-    return Value::error(ErrorCode::Calc);
-  }
-  const std::uint32_t required = lv->param_count - lv->optional_count;
-  if (arity < required || arity > lv->param_count) {
-    return Value::error(ErrorCode::Value);
-  }
-  std::vector<Value> args;
-  std::vector<const parser::AstNode*> bound_asts;
-  args.reserve(arity);
-  bound_asts.reserve(arity);
-  for (std::uint32_t i = 0; i < arity; ++i) {
-    const parser::AstNode* bound = nullptr;
-    args.push_back(eval_binding_source(*call_args[i], arena, registry, ctx, &bound));
-    bound_asts.push_back(bound);
-  }
-  return invoke_lambda_values_impl(lv, arity, args.empty() ? nullptr : args.data(),
-                                   bound_asts.empty() ? nullptr : bound_asts.data(), call_args, arena, registry, ctx);
-}
-
-bool resolve_lambda_reference(const LambdaValue* lv, std::uint32_t arity, const parser::AstNode* const* call_args,
-                              Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx,
-                              std::string_view* out_sheet, std::uint32_t* out_top_row, std::uint32_t* out_left_col,
-                              std::uint32_t* out_bottom_row, std::uint32_t* out_right_col, ErrorCode* out_err) {
-  if (lv == nullptr || (arity != 0U && call_args == nullptr)) {
-    *out_err = ErrorCode::Value;
-    return false;
-  }
-  EvalDepthGuard lambda_guard(ctx.lambda_depth_counter(), kMaxLambdaDepth);
-  if (lambda_guard.exceeded()) {
-    *out_err = ErrorCode::Calc;
-    return false;
-  }
-  std::vector<Value> args;
-  std::vector<const parser::AstNode*> bound_asts;
-  for (std::uint32_t i = 0; i < arity; ++i) {
-    const parser::AstNode* bound = nullptr;
-    args.push_back(eval_binding_source(*call_args[i], arena, registry, ctx, &bound));
-    bound_asts.push_back(bound);
-  }
-  NameEnv env;
-  if (const std::optional<ErrorCode> err =
-          bind_lambda_params(lv, arity, args.empty() ? nullptr : args.data(),
-                             bound_asts.empty() ? nullptr : bound_asts.data(), call_args, arena, &env)) {
-    *out_err = *err;
-    return false;
-  }
-  return resolve_reference_rect(*lv->body, arena, registry, lambda_body_context(lv, env, ctx), out_sheet, out_top_row,
-                                out_left_col, out_bottom_row, out_right_col, out_err);
-}
-
-namespace {
-
 // One argument slot for element-wise broadcasting of a scalar function
 // over array-shaped arguments: either a scalar (`scalar != nullptr`) or
 // an ArrayValue (`array != nullptr`).
@@ -597,14 +382,7 @@ Value dispatch_call(const parser::AstNode& node, Arena& arena, const FunctionReg
     // Substitute only when the resolved AST is genuinely range-shaped so
     // that a NameRef bound to a scalar (or a single-cell Ref) continues to
     // flow through the existing scalar branch with its original provenance.
-    const parser::AstNode* effective = &raw_arg;
-    if (raw_arg.kind() == parser::NodeKind::NameRef) {
-      const parser::AstNode& resolved = resolve_name_ast(raw_arg, ctx.name_env());
-      if (&resolved != &raw_arg && is_range_shaped_ast(resolved)) {
-        effective = &resolved;
-      }
-    }
-    const parser::AstNode& arg_node = *effective;
+    const parser::AstNode& arg_node = resolve_range_binding(raw_arg, ctx.name_env(), /*accept_ref=*/false);
     // Minimal array-literal support: when a range-aware function receives
     // a `{a;b;c}` style literal, flatten it in row-major order exactly like
     // a RangeOp argument. This is just enough to let LARGE / SMALL /
@@ -805,53 +583,25 @@ Value dispatch_call(const parser::AstNode& node, Arena& arena, const FunctionReg
       const bool is_bare_pair = lhs_ast.kind() == parser::NodeKind::Ref && rhs_ast.kind() == parser::NodeKind::Ref;
       const bool whole_axis_pair = is_bare_pair && (lhs_ast.as_ref().is_full_col || lhs_ast.as_ref().is_full_row ||
                                                     rhs_ast.as_ref().is_full_col || rhs_ast.as_ref().is_full_row);
-      if (whole_axis_pair || (!is_bare_pair && declared_rect_endpoint_pair(arg_node, &chain_lhs, &chain_rhs))) {
-        if (whole_axis_pair) {
-          chain_lhs = lhs_ast.as_ref();
-          chain_rhs = rhs_ast.as_ref();
-        }
-        auto expanded = ctx.expand_range(chain_lhs, chain_rhs, arena, registry);
-        if (!expanded) {
-          const Value err = Value::error(expanded.error());
+      if (whole_axis_pair) {
+        chain_lhs = lhs_ast.as_ref();
+        chain_rhs = rhs_ast.as_ref();
+      } else if (is_bare_pair || !declared_rect_endpoint_pair(arg_node, &chain_lhs, &chain_rhs)) {
+        // Union the two endpoints into one rectangle and let `expand_range`
+        // validate sheet equality (mismatched qualifiers surface as #REF!).
+        ErrorCode endpoint_err = ErrorCode::Ref;
+        if (!union_endpoint_refs(lhs_ast, rhs_ast, arena, registry, ctx, &chain_lhs, &chain_rhs, &endpoint_err)) {
+          const Value err = Value::error(endpoint_err);
           if (def->propagate_errors) {
             return err;
           }
           values.push_back(err);
           continue;
         }
-        Value range_err = Value::blank();
-        const std::vector<Value>& expanded_values = expanded.value();
-        if (!append_range_sourced_values(*def, expanded_values.data(), expanded_values.size(), &values, &range_err)) {
-          return range_err;
-        }
-        continue;
-      }
-      // Union the two endpoints into one rectangle and let `expand_range`
-      // validate sheet equality (mismatched qualifiers surface as #REF!).
-      parser::Reference union_lhs{};
-      parser::Reference union_rhs{};
-      ErrorCode endpoint_err = ErrorCode::Ref;
-      if (!union_endpoint_refs(lhs_ast, rhs_ast, arena, registry, ctx, &union_lhs, &union_rhs, &endpoint_err)) {
-        const Value err = Value::error(endpoint_err);
-        if (def->propagate_errors) {
-          return err;
-        }
-        values.push_back(err);
-        continue;
       }
-      auto expanded = ctx.expand_range(union_lhs, union_rhs, arena, registry);
-      if (!expanded) {
-        const Value err = Value::error(expanded.error());
-        if (def->propagate_errors) {
-          return err;
-        }
-        values.push_back(err);
-        continue;
-      }
-      Value range_err = Value::blank();
-      const std::vector<Value>& expanded_values = expanded.value();
-      if (!append_range_sourced_values(*def, expanded_values.data(), expanded_values.size(), &values, &range_err)) {
-        return range_err;
+      Value range_return = Value::blank();
+      if (!append_expanded_range(*def, chain_lhs, chain_rhs, arena, registry, ctx, &values, &range_return)) {
+        return range_return;
       }
       continue;
     }
@@ -895,16 +645,11 @@ Value dispatch_call(const parser::AstNode& node, Arena& arena, const FunctionReg
         }
         const std::uint32_t rrows = union_rhs.row - union_lhs.row + 1u;
         const std::uint32_t rcols = union_rhs.col - union_lhs.col + 1u;
-        Value* buffer = nullptr;
-        ArrayValue* arr = allocate_array_value(rrows, rcols, arena, buffer, kMaxDerivedArrayCells);
+        const std::vector<Value>& ev = expanded.value();
+        ArrayValue* arr = array_from_values(rrows, rcols, ev.data(), ev.size(), arena);
         if (arr == nullptr) {
           return Value::error(ErrorCode::Num);
         }
-        const std::size_t total = static_cast<std::size_t>(rrows) * static_cast<std::size_t>(rcols);
-        const std::vector<Value>& ev = expanded.value();
-        for (std::size_t k = 0; k < total; ++k) {
-          buffer[k] = k < ev.size() ? ev[k] : Value::blank();
-        }
         values.push_back(Value::array(arr));
         continue;
       }
@@ -950,19 +695,9 @@ Value dispatch_call(const parser::AstNode& node, Arena& arena, const FunctionReg
       isect_rhs.sheet = isect_sheet;
       isect_rhs.row = isect_r2;
       isect_rhs.col = isect_c2;
-      auto isect_expanded = ctx.expand_range(isect_lhs, isect_rhs, arena, registry);
-      if (!isect_expanded) {
-        const Value err = Value::error(isect_expanded.error());
-        if (def->propagate_errors) {
-          return err;
-        }
-        values.push_back(err);
-        continue;
-      }
-      Value range_err = Value::blank();
-      const std::vector<Value>& isect_values = isect_expanded.value();
-      if (!append_range_sourced_values(*def, isect_values.data(), isect_values.size(), &values, &range_err)) {
-        return range_err;
+      Value range_return = Value::blank();
+      if (!append_expanded_range(*def, isect_lhs, isect_rhs, arena, registry, ctx, &values, &range_return)) {
+        return range_return;
       }
       continue;
     }
@@ -1111,19 +846,9 @@ Value dispatch_call(const parser::AstNode& node, Arena& arena, const FunctionReg
         (arg_node.as_ref().is_full_col || arg_node.as_ref().is_full_row)) {
       had_range_shaped_arg = true;
       const parser::Reference& ref = arg_node.as_ref();
-      auto expanded = ctx.expand_range(ref, ref, arena, registry);
-      if (!expanded) {
-        const Value err = Value::error(expanded.error());
-        if (def->propagate_errors) {
-          return err;
-        }
-        values.push_back(err);
-        continue;
-      }
-      Value range_err = Value::blank();
-      const std::vector<Value>& expanded_values = expanded.value();
-      if (!append_range_sourced_values(*def, expanded_values.data(), expanded_values.size(), &values, &range_err)) {
-        return range_err;
+      Value range_return = Value::blank();
+      if (!append_expanded_range(*def, ref, ref, arena, registry, ctx, &values, &range_return)) {
+        return range_return;
       }
       continue;
     }
diff --git a/src/eval/tree_walker/dispatch.h b/src/eval/tree_walker/dispatch.h
index 650473448..f276ca6b3 100644
--- a/src/eval/tree_walker/dispatch.h
+++ b/src/eval/tree_walker/dispatch.h
@@ -1,10 +1,11 @@
 //
 // Private seam between the tree-walker's recursive node visitor
 // (`tree_walker/walker.cpp`) and the function-call dispatch path
-// (`tree_walker/dispatch.cpp`). The two translation units were split out
+// (`tree_walker/dispatch.cpp`), the runtime lambda invocation path
+// (`tree_walker/lambda_invoke.cpp`) and LET/LAMBDA binding resolution
+// (`tree_walker/binding_source.cpp`). The translation units were split out
 // of the original monolithic `tree_walker.cpp` to keep compile units
-// digestible; this header publishes the two entry points walker.cpp
-// needs from dispatch.cpp.
+// digestible; this header publishes the entry points walker.cpp needs.
 //
 // `dispatch_call` is invoked from `eval_node` for every `Call` AST node:
 // it handles name-bound lambda dispatch, lazy/special-form routing
@@ -13,7 +14,8 @@
 // `FunctionDef::impl`.
 //
 // `invoke_lambda` is shared between the `LambdaCall` AST case (handled
-// in walker.cpp) and the name-bound dispatch path (in dispatch.cpp).
+// in walker.cpp) and the name-bound dispatch path (in dispatch.cpp); it is
+// defined in lambda_invoke.cpp.
 // Its already-evaluated-arguments siblings `invoke_lambda_values` /
 // `invoke_lambda_values_with_ast` are the single lambda-invocation entry
 // point for the lazy lambda helpers, so the arity and
@@ -143,6 +145,12 @@ Value invoke_lambda_values_with_ast(const LambdaValue* lv, std::uint32_t arity,
                                     const parser::AstNode* const* ast_args, Arena& arena,
                                     const FunctionRegistry& registry, const EvalContext& ctx);
 
+/// Builds a synthetic `ArrayLiteral` AST whose cells are `Literal` nodes
+/// carrying `arr`'s values, so a slice passed through
+/// `invoke_lambda_values_with_ast` flattens like a written array literal.
+/// Returns nullptr for a null or empty `arr` and on allocation failure.
+const parser::AstNode* array_literal_ast(const ArrayValue* arr, Arena& arena);
+
 }  // namespace eval
 }  // namespace formulon
 
diff --git a/src/eval/tree_walker/lambda_invoke.cpp b/src/eval/tree_walker/lambda_invoke.cpp
new file mode 100644
index 000000000..cbf028013
--- /dev/null
+++ b/src/eval/tree_walker/lambda_invoke.cpp
@@ -0,0 +1,292 @@
+//
+// Runtime invocation of `LambdaValue`s: parameter binding, the arity and
+// lambda-depth rules, callable resolution for the lazy lambda helpers, and
+// reference resolution through a lambda body. The public contract is declared
+// in `tree_walker/dispatch.h`.
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "eval/eval_context.h"
+#include "eval/function_registry.h"
+#include "eval/lambda_value.h"
+#include "eval/lazy_impls.h"
+#include "eval/name_env.h"
+#include "eval/omitted_arg.h"
+#include "eval/range_resolvers.h"
+#include "eval/tree_walker/depth_guard.h"
+#include "eval/tree_walker/dispatch.h"
+#include "eval/tree_walker_lazy_table.h"
+#include "parser/ast.h"
+#include "utils/arena.h"
+#include "value.h"
+
+namespace formulon {
+namespace eval {
+
+namespace {
+
+// `syntax_args` is the call site's argument AST, consulted for one thing
+// only: telling a syntactically omitted slot (`f(1, , 3)`) from a supplied
+// one. It is deliberately separate from `ast_args`, the per-argument AST
+// `eval_binding_source` chose to record on the binding.
+// Binds `lv`'s parameters for a call into `*env`; the error a call surfaces
+// instead when the arity does not fit or the lambda has no body.
+std::optional<ErrorCode> bind_lambda_params(const LambdaValue* lv, std::uint32_t arity, const Value* args,
+                                            const parser::AstNode* const* ast_args,
+                                            const parser::AstNode* const* syntax_args, Arena& arena, NameEnv* out) {
+  const std::uint32_t required = lv->param_count - lv->optional_count;
+  if (arity < required || arity > lv->param_count) {
+    return ErrorCode::Value;
+  }
+  if (lv->body == nullptr) {
+    return ErrorCode::Name;
+  }
+  NameEnv& env = *out;
+  if (lv->captured_env != nullptr) {
+    env = *lv->captured_env;
+  }
+  for (std::uint32_t i = 0; i < arity; ++i) {
+    const parser::AstNode* expr = (ast_args != nullptr) ? ast_args[i] : nullptr;
+    // `f(1, , 3)` supplies the slot syntactically and omits its value, and
+    // Excel treats that as omitted wherever it appears -- leading, middle
+    // or trailing -- not only past the end of the argument list. Binding
+    // it as an ordinary blank would give the body the right number (an
+    // omitted slot arithmetic-coerces to 0 either way) while telling
+    // ISOMITTED the wrong thing, which is the whole of what that function
+    // is for. Only the AST can answer this: by the time the argument is a
+    // Value, an omitted slot and a blank cell are the same blank.
+    const parser::AstNode* syntax = (syntax_args != nullptr) ? syntax_args[i] : expr;
+    if (syntax != nullptr && is_omitted_arg(*syntax)) {
+      env = env.extend_omitted(lv->params[i], arena);
+      continue;
+    }
+    env = env.extend(lv->params[i], args[i], expr, arena);
+  }
+  for (std::uint32_t i = arity; i < lv->param_count; ++i) {
+    env = env.extend_omitted(lv->params[i], arena);
+  }
+  return std::nullopt;
+}
+
+EvalContext lambda_body_context(const LambdaValue* lv, const NameEnv& env, const EvalContext& ctx) {
+  EvalContext body_ctx = ctx.with_name_env(&env);
+  if (lv->name_scope_sheet >= 0) {
+    body_ctx = body_ctx.with_name_scope_sheet(lv->name_scope_sheet);
+  }
+  return body_ctx;
+}
+
+Value invoke_lambda_values_impl(const LambdaValue* lv, std::uint32_t arity, const Value* args,
+                                const parser::AstNode* const* ast_args, const parser::AstNode* const* syntax_args,
+                                Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx) {
+  NameEnv env;
+  if (const std::optional<ErrorCode> err = bind_lambda_params(lv, arity, args, ast_args, syntax_args, arena, &env)) {
+    return Value::error(*err);
+  }
+  return eval_node(*lv->body, arena, registry, lambda_body_context(lv, env, ctx));
+}
+
+}  // namespace
+
+Value invoke_lambda_values(const LambdaValue* lv, std::uint32_t arity, const Value* args, Arena& arena,
+                           const FunctionRegistry& registry, const EvalContext& ctx) {
+  return invoke_lambda_values_with_ast(lv, arity, args, /*ast_args=*/nullptr, arena, registry, ctx);
+}
+
+Value invoke_lambda_values_with_ast(const LambdaValue* lv, std::uint32_t arity, const Value* args,
+                                    const parser::AstNode* const* ast_args, Arena& arena,
+                                    const FunctionRegistry& registry, const EvalContext& ctx) {
+  if (lv == nullptr || (arity != 0U && args == nullptr)) {
+    return Value::error(ErrorCode::Value);
+  }
+  // Lambda-depth cap fires before the arity check so a runaway
+  // self-recursion (e.g. `LAMBDA(n, f(n+1))`) cannot keep extending the
+  // call stack on its own dime. See `kMaxLambdaDepth` for rationale.
+  EvalDepthGuard lambda_guard(ctx.lambda_depth_counter(), kMaxLambdaDepth);
+  if (lambda_guard.exceeded()) {
+    return Value::error(ErrorCode::Calc);
+  }
+  return invoke_lambda_values_impl(lv, arity, args, ast_args, /*syntax_args=*/nullptr, arena, registry, ctx);
+}
+
+const parser::AstNode* array_literal_ast(const ArrayValue* arr, Arena& arena) {
+  // `make_array_literal` requires rows / cols >= 1.
+  if (arr == nullptr || arr->rows == 0U || arr->cols == 0U) {
+    return nullptr;
+  }
+  const std::size_t total = static_cast<std::size_t>(arr->rows) * static_cast<std::size_t>(arr->cols);
+  const parser::AstNode** children = arena.create_array<const parser::AstNode*>(total);
+  if (children == nullptr) {
+    return nullptr;
+  }
+  for (std::size_t i = 0; i < total; ++i) {
+    parser::AstNode* lit = parser::make_literal(arena, arr->cells[i]);
+    if (lit == nullptr) {
+      return nullptr;
+    }
+    children[i] = lit;
+  }
+  return parser::make_array_literal(arena, arr->rows, arr->cols, children);
+}
+
+namespace {
+
+// Builds the eta-expansion of the built-in `name` at `arity`:
+// `LAMBDA(p1, ..., pn, name(p1, ..., pn))`. The parameter names cannot be
+// spelled in a formula, so the body can only ever see its own arguments.
+// Returns nullptr on arena exhaustion.
+const LambdaValue* eta_expand(std::string_view name, std::uint32_t arity, Arena& arena) {
+  std::string_view* params = nullptr;
+  const parser::AstNode** body_args = nullptr;
+  if (arity > 0U) {
+    params = arena.create_array<std::string_view>(arity);
+    body_args = arena.create_array<const parser::AstNode*>(arity);
+    if (params == nullptr || body_args == nullptr) {
+      return nullptr;
+    }
+  }
+  for (std::uint32_t i = 0; i < arity; ++i) {
+    params[i] = arena.intern("@" + std::to_string(i + 1U));
+    body_args[i] = parser::make_name_ref(arena, params[i]);
+    if (params[i].empty() || body_args[i] == nullptr) {
+      return nullptr;
+    }
+  }
+  const parser::AstNode* body = parser::make_call(arena, name, body_args, arity);
+  auto* lv = arena.create<LambdaValue>();
+  if (body == nullptr || lv == nullptr) {
+    return nullptr;
+  }
+  lv->params = params;
+  lv->param_count = arity;
+  lv->optional_count = 0U;
+  lv->body = body;
+  lv->captured_env = nullptr;
+  return lv;
+}
+
+// A lambda is callable by a helper when it accepts `call_arity` arguments
+// (trailing `[optional]` params may stay unbound) and carries a body.
+const LambdaValue* check_callable(const LambdaValue* lv, std::uint32_t call_arity, Value* out_err) {
+  const std::uint32_t required = lv->param_count - lv->optional_count;
+  if (call_arity < required || call_arity > lv->param_count) {
+    *out_err = Value::error(ErrorCode::Value);
+    return nullptr;
+  }
+  if (lv->body == nullptr) {
+    *out_err = Value::error(ErrorCode::Name);
+    return nullptr;
+  }
+  return lv;
+}
+
+}  // namespace
+
+const LambdaValue* resolve_callable(const parser::AstNode& arg, std::uint32_t call_arity, Arena& arena,
+                                    const FunctionRegistry& registry, const EvalContext& ctx, Value* out_err) {
+  // `Sheet1!Fn` is neither a binding nor a built-in; it evaluates below.
+  if (arg.kind() == parser::NodeKind::NameRef && arg.as_name_sheet().empty()) {
+    const std::string_view name = arg.as_name();
+    const NameEnv* env = ctx.name_env();
+    // A name bound in scope shadows any built-in of the same spelling.
+    const auto read = [&](const parser::AstNode& ref) { return eval_node(ref, arena, registry, ctx); };
+    if (const Value* bound = (env != nullptr) ? env->lookup_or_read(name, read) : nullptr; bound != nullptr) {
+      if (bound->is_error()) {
+        *out_err = *bound;
+        return nullptr;
+      }
+      if (!bound->is_lambda()) {
+        *out_err = Value::error(ErrorCode::Value);
+        return nullptr;
+      }
+      return check_callable(bound->as_lambda(), call_arity, out_err);
+    }
+    // An unbound built-in name is an eta-reduced lambda. A miss falls through
+    // to ordinary evaluation, which reports `#NAME?`.
+    if (registry.lookup(name) != nullptr || find_lazy_impl(strip_future_prefix(name)) != nullptr) {
+      const LambdaValue* lv = eta_expand(name, call_arity, arena);
+      if (lv == nullptr) {
+        *out_err = Value::error(ErrorCode::Num);
+      }
+      return lv;
+    }
+  }
+  const Value v = eval_node(arg, arena, registry, ctx);
+  if (v.is_error()) {
+    *out_err = v;
+    return nullptr;
+  }
+  if (!v.is_lambda()) {
+    *out_err = Value::error(ErrorCode::Value);
+    return nullptr;
+  }
+  return check_callable(v.as_lambda(), call_arity, out_err);
+}
+
+Value invoke_lambda(const LambdaValue* lv, std::uint32_t arity, const parser::AstNode* const* call_args, Arena& arena,
+                    const FunctionRegistry& registry, const EvalContext& ctx) {
+  if (lv == nullptr || (arity != 0U && call_args == nullptr)) {
+    return Value::error(ErrorCode::Value);
+  }
+  // Lambda-depth cap fires before the arity check so a runaway
+  // self-recursion (e.g. `LAMBDA(n, f(n+1))`) cannot keep extending the
+  // call stack on its own dime. See `kMaxLambdaDepth` for rationale.
+  EvalDepthGuard lambda_guard(ctx.lambda_depth_counter(), kMaxLambdaDepth);
+  if (lambda_guard.exceeded()) {
+    return Value::error(ErrorCode::Calc);
+  }
+  const std::uint32_t required = lv->param_count - lv->optional_count;
+  if (arity < required || arity > lv->param_count) {
+    return Value::error(ErrorCode::Value);
+  }
+  std::vector<Value> args;
+  std::vector<const parser::AstNode*> bound_asts;
+  args.reserve(arity);
+  bound_asts.reserve(arity);
+  for (std::uint32_t i = 0; i < arity; ++i) {
+    const parser::AstNode* bound = nullptr;
+    args.push_back(eval_binding_source(*call_args[i], arena, registry, ctx, &bound));
+    bound_asts.push_back(bound);
+  }
+  return invoke_lambda_values_impl(lv, arity, args.empty() ? nullptr : args.data(),
+                                   bound_asts.empty() ? nullptr : bound_asts.data(), call_args, arena, registry, ctx);
+}
+
+bool resolve_lambda_reference(const LambdaValue* lv, std::uint32_t arity, const parser::AstNode* const* call_args,
+                              Arena& arena, const FunctionRegistry& registry, const EvalContext& ctx,
+                              std::string_view* out_sheet, std::uint32_t* out_top_row, std::uint32_t* out_left_col,
+                              std::uint32_t* out_bottom_row, std::uint32_t* out_right_col, ErrorCode* out_err) {
+  if (lv == nullptr || (arity != 0U && call_args == nullptr)) {
+    *out_err = ErrorCode::Value;
+    return false;
+  }
+  EvalDepthGuard lambda_guard(ctx.lambda_depth_counter(), kMaxLambdaDepth);
+  if (lambda_guard.exceeded()) {
+    *out_err = ErrorCode::Calc;
+    return false;
+  }
+  std::vector<Value> args;
+  std::vector<const parser::AstNode*> bound_asts;
+  for (std::uint32_t i = 0; i < arity; ++i) {
+    const parser::AstNode* bound = nullptr;
+    args.push_back(eval_binding_source(*call_args[i], arena, registry, ctx, &bound));
+    bound_asts.push_back(bound);
+  }
+  NameEnv env;
+  if (const std::optional<ErrorCode> err =
+          bind_lambda_params(lv, arity, args.empty() ? nullptr : args.data(),
+                             bound_asts.empty() ? nullptr : bound_asts.data(), call_args, arena, &env)) {
+    *out_err = *err;
+    return false;
+  }
+  return resolve_reference_rect(*lv->body, arena, registry, lambda_body_context(lv, env, ctx), out_sheet, out_top_row,
+                                out_left_col, out_bottom_row, out_right_col, out_err);
+}
+
+}  // namespace eval
+}  // namespace formulon
diff --git a/src/eval/tree_walker/walker.cpp b/src/eval/tree_walker/walker.cpp
index 8031d62aa..45b3bb5da 100644
--- a/src/eval/tree_walker/walker.cpp
+++ b/src/eval/tree_walker/walker.cpp
@@ -4,11 +4,12 @@
 // linkage in `eval/lazy_impls.h` so lazy-impl TUs can recurse back into
 // it), and the read-only spill-collision detector.
 //
-// The function-call dispatch path (`dispatch_call`, `invoke_lambda`,
-// range-argument expansion) lives in `tree_walker/dispatch.cpp`; the
+// The function-call dispatch path (`dispatch_call`, range-argument
+// expansion) lives in `tree_walker/dispatch.cpp`, the runtime lambda
+// invocation (`invoke_lambda`) in `tree_walker/lambda_invoke.cpp`; the
 // array-broadcasting helpers (`broadcast_binop`, `broadcast_unary`,
 // `apply_binop_per_cell`) live in `tree_walker/broadcast.cpp`. The
-// three TUs split the original monolithic `tree_walker.cpp` while
+// TUs split the original monolithic `tree_walker.cpp` while
 // preserving file-local helpers and the existing `formulon::eval`
 // namespace shape (anonymous helpers are local to each TU).
 //
@@ -68,16 +69,11 @@ Value materialize_rectangle(const parser::Reference& top_left, const parser::Ref
   }
   const std::uint32_t rows = bottom_right.row - top_left.row + 1U;
   const std::uint32_t cols = bottom_right.col - top_left.col + 1U;
-  Value* buffer = nullptr;
-  ArrayValue* arr = allocate_array_value(rows, cols, arena, buffer, kMaxDerivedArrayCells);
+  const std::vector<Value>& ev = expanded.value();
+  ArrayValue* arr = array_from_values(rows, cols, ev.data(), ev.size(), arena);
   if (arr == nullptr) {
     return Value::error(ErrorCode::Num);
   }
-  const std::size_t total = static_cast<std::size_t>(rows) * static_cast<std::size_t>(cols);
-  const std::vector<Value>& ev = expanded.value();
-  for (std::size_t k = 0; k < total; ++k) {
-    buffer[k] = k < ev.size() ? ev[k] : Value::blank();
-  }
   return Value::array(arr);
 }
 
@@ -317,160 +313,8 @@ Value eval_intersect_op(const parser::AstNode& node, Arena& arena, const Functio
   return materialize_rectangle(top_left, bottom_right, arena, registry, ctx);
 }
 
-// True when `node` reads no lexical binding, so it evaluates the same in any
-// scope. Conservative: a shape it does not know is not scope-free.
-bool is_scope_free(const parser::AstNode& node, const NameEnv* env) {
-  switch (node.kind()) {
-    case parser::NodeKind::Literal:
-    case parser::NodeKind::ErrorLiteral:
-    case parser::NodeKind::Ref:
-    case parser::NodeKind::Ref3D:
-    case parser::NodeKind::ArrayLiteral:
-      return true;
-    case parser::NodeKind::SpillRef:
-      return node.as_spill_ref_anchor_expr() == nullptr;
-    case parser::NodeKind::UnaryOp:
-      return is_scope_free(node.as_unary_operand(), env);
-    case parser::NodeKind::BinaryOp:
-      return is_scope_free(node.as_binary_lhs(), env) && is_scope_free(node.as_binary_rhs(), env);
-    case parser::NodeKind::RangeOp:
-      return is_scope_free(node.as_range_lhs(), env) && is_scope_free(node.as_range_rhs(), env);
-    case parser::NodeKind::IntersectOp:
-      return is_scope_free(node.as_intersect_lhs(), env) && is_scope_free(node.as_intersect_rhs(), env);
-    case parser::NodeKind::UnionOp:
-      for (std::uint32_t i = 0; i < node.as_union_arity(); ++i) {
-        if (!is_scope_free(node.as_union_child(i), env)) {
-          return false;
-        }
-      }
-      return true;
-    case parser::NodeKind::Call:
-      if (env != nullptr && env->lookup(node.as_call_name()) != nullptr) {
-        return false;
-      }
-      for (std::uint32_t i = 0; i < node.as_call_arity(); ++i) {
-        if (!is_scope_free(node.as_call_arg(i), env)) {
-          return false;
-        }
-      }
-      return true;
-    default:
-      return false;
-  }
-}
-
-// Resolves a binding source that returns a reference (a reference-returning
-// call, a `:` over one, or an intersection) to the static `RangeOp` it names,
-// so the binding carries that rectangle rather than the call. Returns nullptr
-// for any other shape or when the call picks a non-reference (`INDEX({1,2},1)`).
-const parser::AstNode* resolve_computed_reference(const parser::AstNode& expr, Arena& arena,
-                                                  const FunctionRegistry& registry, const EvalContext& ctx) {
-  if (expr.kind() == parser::NodeKind::Call) {
-    const NameEnv* env = ctx.name_env();
-    if (!is_reference_call_name(expr.as_call_name()) ||
-        (env != nullptr && env->lookup(expr.as_call_name()) != nullptr)) {
-      return nullptr;
-    }
-  } else if (expr.kind() == parser::NodeKind::RangeOp) {
-    parser::Reference lhs{};
-    parser::Reference rhs{};
-    if (declared_rect_endpoint_pair(expr, &lhs, &rhs)) {
-      return nullptr;
-    }
-  } else if (expr.kind() != parser::NodeKind::IntersectOp) {
-    return nullptr;
-  }
-  std::string_view sheet;
-  std::uint32_t top = 0;
-  std::uint32_t left = 0;
-  std::uint32_t bottom = 0;
-  std::uint32_t right = 0;
-  ErrorCode err = ErrorCode::Value;
-  if (!resolve_reference_rect(expr, arena, registry, ctx, &sheet, &top, &left, &bottom, &right, &err)) {
-    return nullptr;
-  }
-  parser::Reference first{};
-  parser::Reference last{};
-  first.sheet = sheet;
-  last.sheet = sheet;
-  if (top == 0U && bottom == Sheet::kMaxRows - 1U) {
-    first.is_full_col = true;
-    last.is_full_col = true;
-    first.col = left;
-    last.col = right;
-  } else if (left == 0U && right == Sheet::kMaxCols - 1U) {
-    first.is_full_row = true;
-    last.is_full_row = true;
-    first.row = top;
-    last.row = bottom;
-  } else {
-    first.row = top;
-    first.col = left;
-    last.row = bottom;
-    last.col = right;
-  }
-  // Always a `RangeOp`, even for one cell (`D1:D1`): a bare `Ref` binding is
-  // the scalar-provenance shape, and a reference-returning call is not.
-  parser::AstNode* lhs = parser::make_ref(arena, first);
-  parser::AstNode* rhs = parser::make_ref(arena, last);
-  if (lhs == nullptr || rhs == nullptr) {
-    return nullptr;
-  }
-  return parser::make_range_op(arena, lhs, rhs);
-}
-
 }  // namespace
 
-const parser::AstNode* resolve_binding_reference(const parser::AstNode& expr, Arena& arena,
-                                                 const FunctionRegistry& registry, const EvalContext& ctx) {
-  parser::Reference lhs{};
-  parser::Reference rhs{};
-  switch (expr.kind()) {
-    case parser::NodeKind::Ref:
-      return &expr;
-    case parser::NodeKind::RangeOp:
-      if (declared_rect_endpoint_pair(expr, &lhs, &rhs)) {
-        return &expr;
-      }
-      break;
-    case parser::NodeKind::NameRef: {
-      const NameEnv* env = ctx.name_env();
-      const parser::AstNode* bound =
-          (env != nullptr && expr.as_name_sheet().empty()) ? env->lookup_ast(expr.as_name()) : nullptr;
-      if (bound != nullptr && (bound->kind() == parser::NodeKind::Ref || bound->kind() == parser::NodeKind::RangeOp)) {
-        return bound;
-      }
-      return nullptr;
-    }
-    default:
-      break;
-  }
-  return resolve_computed_reference(expr, arena, registry, ctx);
-}
-
-Value eval_binding_source(const parser::AstNode& expr, Arena& arena, const FunctionRegistry& registry,
-                          const EvalContext& ctx, const parser::AstNode** out_ast) {
-  const parser::AstNode* ref = resolve_binding_reference(expr, arena, registry, ctx);
-  *out_ast = ref;
-  // A union, or a range-shaped call naming no single rectangle (one picking a
-  // union), is recorded as written when it reads the same in any scope.
-  const bool unresolved_range =
-      ref == nullptr && (expr.kind() == parser::NodeKind::UnionOp ||
-                         (expr.kind() == parser::NodeKind::Call && is_range_shaped_ast(expr)));
-  if (expr.kind() == parser::NodeKind::ArrayLiteral ||
-      (expr.kind() == parser::NodeKind::SpillRef && expr.as_spill_ref_anchor_expr() == nullptr) ||
-      (unresolved_range && is_scope_free(expr, ctx.name_env()))) {
-    *out_ast = &expr;
-  } else if (expr.kind() == parser::NodeKind::NameRef && expr.as_name_sheet().empty() && ctx.name_env() != nullptr) {
-    *out_ast = ctx.name_env()->lookup_ast(expr.as_name());
-  }
-  // A reference is read where the bound name is used, not here.
-  if (ref != nullptr) {
-    return Value::blank();
-  }
-  return eval_node(expr, arena, registry, ctx);
-}
-
 // Public entry point declared in `eval/tree_walker.h`. Routes through
 // the lazy-table seam; the actual array is owned by
 // `tree_walker_lazy_table.cpp`.
diff --git a/src/eval/tree_walker_lazy_table.cpp b/src/eval/tree_walker_lazy_table.cpp
index 81a578369..c09cc7c89 100644
--- a/src/eval/tree_walker_lazy_table.cpp
+++ b/src/eval/tree_walker_lazy_table.cpp
@@ -335,16 +335,15 @@ constexpr bool lazy_dispatch_is_strictly_sorted() {
 
 static_assert(lazy_dispatch_is_strictly_sorted(), "kLazyDispatch must stay in canonical-name order");
 
-}  // namespace
-
-LazyImpl find_lazy_impl(std::string_view name) noexcept {
+// Binary search over the canonical-name-ordered table; nullptr when absent.
+const LazyEntry* find_lazy_entry(std::string_view name) noexcept {
   std::size_t first = 0;
   std::size_t last = kLazyDispatchCount;
   while (first < last) {
     const std::size_t middle = first + (last - first) / 2;
     const int cmp = strings::case_insensitive_compare(name, kLazyDispatch[middle].name);
     if (cmp == 0) {
-      return kLazyDispatch[middle].impl;
+      return &kLazyDispatch[middle];
     }
     if (cmp < 0) {
       last = middle;
@@ -355,22 +354,16 @@ LazyImpl find_lazy_impl(std::string_view name) noexcept {
   return nullptr;
 }
 
+}  // namespace
+
+LazyImpl find_lazy_impl(std::string_view name) noexcept {
+  const LazyEntry* entry = find_lazy_entry(name);
+  return entry != nullptr ? entry->impl : nullptr;
+}
+
 LazyResultShape find_lazy_result_shape(std::string_view name) noexcept {
-  std::size_t first = 0;
-  std::size_t last = kLazyDispatchCount;
-  while (first < last) {
-    const std::size_t middle = first + (last - first) / 2;
-    const int cmp = strings::case_insensitive_compare(name, kLazyDispatch[middle].name);
-    if (cmp == 0) {
-      return kLazyDispatch[middle].shape;
-    }
-    if (cmp < 0) {
-      last = middle;
-    } else {
-      first = middle + 1;
-    }
-  }
-  return LazyResultShape::kNotLazy;
+  const LazyEntry* entry = find_lazy_entry(name);
+  return entry != nullptr ? entry->shape : LazyResultShape::kNotLazy;
 }
 
 const char* const* lazy_table_names() {
diff --git a/src/eval/wildcard.cpp b/src/eval/wildcard.cpp
new file mode 100644
index 000000000..8714af8dc
--- /dev/null
+++ b/src/eval/wildcard.cpp
@@ -0,0 +1,213 @@
+//
+// Excel's `*` / `?` / `~` wildcard dialect used by criteria matching and the
+// text and lookup builtins. See `wildcard.h` for the authoritative contract.
+
+#include "eval/wildcard.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <string_view>
+
+#include "utils/strings.h"
+#include "utils/text_ops.h"
+#include "utils/utf8_length.h"
+
+namespace formulon {
+namespace eval {
+
+bool scan_has_wildcard(std::string_view rhs) {
+  for (std::size_t i = 0; i < rhs.size(); ++i) {
+    const char c = rhs[i];
+    if (c == '~' && i + 1 < rhs.size()) {
+      ++i;  // Skip the escaped byte.
+      continue;
+    }
+    if (c == '*' || c == '?') {
+      return true;
+    }
+  }
+  return false;
+}
+
+namespace {
+
+// Core two-pointer wildcard matcher. When `prefix_match_ok` is false the
+// pattern must consume `text` exactly (SEARCH whole-string / criteria
+// equality semantics). When `prefix_match_ok` is true the match succeeds
+// as soon as the pattern is exhausted, even if `text` has unmatched bytes
+// remaining — used by `wildcard_find` to answer "does the pattern match a
+// prefix of this suffix?". When the match succeeds in prefix mode,
+// `*out_consumed` receives the number of `text` bytes the pattern
+// consumed.
+//
+// Character comparisons are ASCII case-insensitive to match Excel's
+// criteria semantics (e.g. `*blue` matches `BLUE`). Non-ASCII bytes are
+// compared byte-for-byte, consistent with `strings::case_insensitive_eq`.
+// UTF-8 continuation: returns the byte length of the code point that
+// starts at `text[i]`, capped at `text.size() - i`. A leading byte with
+// an invalid continuation pattern falls back to 1 byte (mirrors Excel's
+// lenient "one display unit" heuristic for broken UTF-8).
+std::size_t utf8_codepoint_bytes(std::string_view text, std::size_t i) {
+  if (i >= text.size()) {
+    return 0;
+  }
+  const auto lead = static_cast<unsigned char>(text[i]);
+  std::size_t len = 1;
+  if ((lead & 0x80u) == 0x00u) {
+    len = 1;
+  } else if ((lead & 0xE0u) == 0xC0u) {
+    len = 2;
+  } else if ((lead & 0xF0u) == 0xE0u) {
+    len = 3;
+  } else if ((lead & 0xF8u) == 0xF0u) {
+    len = 4;
+  }
+  if (i + len > text.size()) {
+    len = text.size() - i;
+  }
+  return len;
+}
+
+bool wildcard_match_impl(std::string_view pattern, std::string_view text, bool prefix_match_ok,
+                         std::size_t* out_consumed, bool question_is_byte = false) {
+  std::size_t pi = 0;
+  std::size_t ti = 0;
+  std::size_t star_pi = std::string_view::npos;
+  std::size_t star_ti = 0;
+  while (ti < text.size()) {
+    // Prefix mode: succeed as soon as the pattern is fully consumed, even
+    // if there is unmatched text remaining.
+    if (prefix_match_ok && pi == pattern.size()) {
+      if (out_consumed != nullptr) {
+        *out_consumed = ti;
+      }
+      return true;
+    }
+    if (pi < pattern.size()) {
+      const char pc = pattern[pi];
+      if (pc == '~' && pi + 1 < pattern.size()) {
+        // Escaped literal: match the next pattern byte case-insensitively
+        // (Excel preserves the overall case-insensitive rule even for
+        // escape-protected characters).
+        if (strings::ascii_to_lower(pattern[pi + 1]) == strings::ascii_to_lower(text[ti])) {
+          pi += 2;
+          ++ti;
+          continue;
+        }
+      } else if (pc == '~' && pi + 1 == pattern.size()) {
+        // Trailing unpaired `~`: Excel treats it as a no-op (the escape
+        // consumes nothing of the text), so the remaining pattern is
+        // effectively empty — succeed if we're in prefix mode or if the
+        // text is also exhausted at this point.
+        ++pi;
+        continue;
+      } else if (pc == '*') {
+        star_pi = pi;
+        star_ti = ti;
+        ++pi;
+        continue;
+      } else if (pc == '?') {
+        if (question_is_byte) {
+          // SEARCHB byte-mode `?`: the pattern character matches only a
+          // codepoint whose ja-JP DBCS cost is 1 (ASCII or half-width
+          // katakana). Anything wider (kanji, hiragana, full-width, emoji)
+          // refuses to match here, falling through to the `*`-backtrack /
+          // failure path below.
+          std::size_t cp_bytes = 0;
+          const std::uint32_t cp = decode_utf8_step(text, ti, &cp_bytes);
+          if (byte_count_jajp(cp) == 1) {
+            ++pi;
+            ti += cp_bytes;
+            continue;
+          }
+        } else {
+          // Default mode: `?` matches exactly one UTF-8 code point (1-4
+          // bytes) rather than a single byte, so multibyte scripts (CJK,
+          // emoji, combining marks treated as atomic) match as Excel users
+          // would expect.
+          const std::size_t cp_bytes = utf8_codepoint_bytes(text, ti);
+          ++pi;
+          ti += cp_bytes;
+          continue;
+        }
+      } else if (strings::ascii_to_lower(pc) == strings::ascii_to_lower(text[ti])) {
+        ++pi;
+        ++ti;
+        continue;
+      }
+    }
+    if (star_pi != std::string_view::npos) {
+      // Backtrack: extend the most-recent `*` by one CODEPOINT of text. This
+      // must advance a whole UTF-8 codepoint, not a single byte — otherwise
+      // `star_ti` can land mid-sequence and a following `?` or literal would
+      // match a continuation byte (e.g. `*??c*` against `あcう` split the
+      // 3-byte `あ`). Codepoint-stepping keeps every subsequent match aligned.
+      pi = star_pi + 1;
+      const std::size_t step = utf8_codepoint_bytes(text, star_ti);
+      star_ti += (step == 0 ? 1 : step);
+      ti = star_ti;
+      continue;
+    }
+    return false;
+  }
+  // Trailing `*`s consume nothing.
+  while (pi < pattern.size() && pattern[pi] == '*') {
+    ++pi;
+  }
+  // A single unpaired trailing `~` also consumes nothing (Excel leniency).
+  // This must be the very last pattern char, otherwise it is part of an
+  // escape pair `~X` and that pair requires a text char to match.
+  if (pi + 1 == pattern.size() && pattern[pi] == '~') {
+    ++pi;
+  }
+  const bool ok = (pi == pattern.size());
+  if (ok && out_consumed != nullptr) {
+    *out_consumed = ti;
+  }
+  return ok;
+}
+
+}  // namespace
+
+bool wildcard_match(std::string_view pattern, std::string_view text) {
+  return wildcard_match_impl(pattern, text, /*prefix_match_ok=*/false, /*out_consumed=*/nullptr,
+                             /*question_is_byte=*/false);
+}
+
+std::size_t wildcard_find(std::string_view pattern, std::string_view text) {
+  // Try each start offset in `text` and attempt a prefix match. Because `*`
+  // already permits zero-or-more bytes, a leading `*` in the pattern makes
+  // offset 0 always match — but the loop below is still correct in that
+  // case (it would find offset 0 on the first iteration).
+  for (std::size_t start = 0; start <= text.size(); ++start) {
+    if (wildcard_match_impl(pattern, text.substr(start), /*prefix_match_ok=*/true,
+                            /*out_consumed=*/nullptr, /*question_is_byte=*/false)) {
+      return start;
+    }
+  }
+  return std::string_view::npos;
+}
+
+std::size_t wildcard_find_dbcs(std::string_view pattern, std::string_view text) {
+  // Iterate start positions over codepoint boundaries (not byte-by-byte) so
+  // the returned offset is always codepoint-aligned. SEARCHB looks the
+  // offset up against `build_dbcs_char_map`'s `byte_offset` records via
+  // direct equality; a misaligned offset would silently route into the
+  // defensive `total_dbcs + 1` fallback.
+  std::size_t start = 0;
+  while (start <= text.size()) {
+    if (wildcard_match_impl(pattern, text.substr(start), /*prefix_match_ok=*/true,
+                            /*out_consumed=*/nullptr, /*question_is_byte=*/true)) {
+      return start;
+    }
+    if (start == text.size()) {
+      break;
+    }
+    const std::size_t step = utf8_codepoint_bytes(text, start);
+    start += (step == 0 ? 1 : step);
+  }
+  return std::string_view::npos;
+}
+
+}  // namespace eval
+}  // namespace formulon
diff --git a/src/eval/wildcard.h b/src/eval/wildcard.h
new file mode 100644
index 000000000..7b1b7956e
--- /dev/null
+++ b/src/eval/wildcard.h
@@ -0,0 +1,61 @@
+//
+// Excel's wildcard dialect: `*` matches any run of codepoints, `?` matches
+// exactly one codepoint, and `~` escapes the next metacharacter. Matching is
+// ASCII case-insensitive and walks UTF-8 codepoint-by-codepoint. Shared by
+// the criteria matcher, SEARCH/SEARCHB and the exact-match lookups.
+
+#ifndef FORMULON_EVAL_WILDCARD_H_
+#define FORMULON_EVAL_WILDCARD_H_
+
+#include <cstddef>
+#include <string_view>
+
+namespace formulon {
+namespace eval {
+
+/// Byte-level wildcard matcher. `pattern` may contain unescaped `*` / `?`
+/// and `~`-escaped literals; `text` is matched verbatim. Shared between
+/// `matches_criterion` (for `COUNTIF`/`SUMIF`/`AVERAGEIF` equality paths)
+/// and scalar lookups such as `MATCH(..., 0)` that honour the same
+/// DOS-style wildcard dialect.
+///
+/// Iterative backtrack (no recursion) keeps stack depth constant. `?`
+/// matches exactly one code point (1-4 UTF-8 bytes), not one byte.
+bool wildcard_match(std::string_view pattern, std::string_view text);
+
+/// Scans `rhs` for an unescaped `*` or `?`. A leading `~` escapes the next
+/// byte, so `"~*"` contains no wildcard but `"*~*"` does. Returns `true` on
+/// the first unescaped metacharacter encountered.
+bool scan_has_wildcard(std::string_view rhs);
+
+/// Returns the byte offset where `pattern` first matches a prefix of
+/// `text` starting at that offset (wildcards: `*`, `?`, `~` for escape).
+/// Returns `std::string_view::npos` when no position in `text` begins a
+/// match. The match is anchored at its start but not at its end — it
+/// succeeds as soon as `pattern` is consumed, regardless of any unmatched
+/// suffix in `text`. This mirrors the SEARCH contract where the pattern
+/// need only match somewhere inside the haystack.
+///
+/// Callers that need case-insensitive matching must lower-case both inputs
+/// first (the matcher is byte-exact). UTF-16 offset mapping is likewise the
+/// caller's responsibility; this helper only reports a byte offset into
+/// `text`.
+std::size_t wildcard_find(std::string_view pattern, std::string_view text);
+
+/// Same contract as `wildcard_find`, but `?` matches only a single
+/// SBCS-byte codepoint under the ja-JP DBCS rule (`byte_count_jajp(cp)
+/// == 1`): ASCII and half-width katakana match, every other codepoint
+/// (kanji, hiragana, full-width punctuation, emoji) refuses to match.
+/// `*`, `~?`, `~*`, and literal characters retain their normal
+/// semantics. Used exclusively by SEARCHB to mirror Mac Excel 365's
+/// byte-oriented wildcard dialect.
+///
+/// The returned offset is always aligned to a UTF-8 codepoint boundary in
+/// `text`, so callers translating the offset to a DBCS position (via
+/// `build_dbcs_char_map`) can use direct equality on `byte_offset`.
+std::size_t wildcard_find_dbcs(std::string_view pattern, std::string_view text);
+
+}  // namespace eval
+}  // namespace formulon
+
+#endif  // FORMULON_EVAL_WILDCARD_H_
diff --git a/src/eval/workdays_lazy.cpp b/src/eval/workdays_lazy.cpp
index 25a60bbb0..6bdd9bb1b 100644
--- a/src/eval/workdays_lazy.cpp
+++ b/src/eval/workdays_lazy.cpp
@@ -303,100 +303,55 @@ Value add_workdays(double start, double days, std::uint8_t mask, const std::vect
   return Value::number(cur);
 }
 
-}  // namespace
-
-Value eval_networkdays_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
-                            const EvalContext& ctx) {
+// Shared driver for NETWORKDAYS / WORKDAY and their .INTL forms: `add_days` selects WORKDAY, `intl` the
+// weekend-mask calendar (and the 4th argument).
+Value eval_workdays_driver(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
+                           const EvalContext& ctx, bool add_days, bool intl) {
   const std::uint32_t arity = call.as_call_arity();
-  if (arity < 2U || arity > 3U) {
+  if (arity < 2U || arity > (intl ? 4U : 3U)) {
     return Value::error(ErrorCode::Value);
   }
   double start = 0.0;
-  double end = 0.0;
+  double second = 0.0;
   Value err = Value::blank();
-  if (!eval_leading_numbers(call, arena, registry, ctx, &start, &end, &err)) {
+  if (!eval_leading_numbers(call, arena, registry, ctx, &start, &second, &err)) {
     return err;
   }
   const bool date1904 = ctx.date1904();
-  if (!is_valid_workday_serial(start, date1904) || !is_valid_workday_serial(end, date1904)) {
+  if (!is_valid_workday_serial(start, date1904) ||
+      !(add_days ? is_valid_workday_count(second, date1904) : is_valid_workday_serial(second, date1904))) {
     return Value::error(ErrorCode::Num);
   }
+  std::uint8_t mask = kSatSunWeekendMask;
   std::vector<double> holidays;
-  if (!collect_holidays(call, arity, arena, registry, ctx, &holidays, &err)) {
+  if (intl ? !resolve_intl_calendar(call, arity, arena, registry, ctx, &mask, &holidays, &err)
+           : !collect_holidays(call, arity, arena, registry, ctx, &holidays, &err)) {
     return err;
   }
-  return count_workdays(start, end, kSatSunWeekendMask, holidays, date1904);
+  return add_days ? add_workdays(start, second, mask, holidays, date1904)
+                  : count_workdays(start, second, mask, holidays, date1904);
+}
+
+}  // namespace
+
+Value eval_networkdays_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
+                            const EvalContext& ctx) {
+  return eval_workdays_driver(call, arena, registry, ctx, /*add_days=*/false, /*intl=*/false);
 }
 
 Value eval_workday_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                         const EvalContext& ctx) {
-  const std::uint32_t arity = call.as_call_arity();
-  if (arity < 2U || arity > 3U) {
-    return Value::error(ErrorCode::Value);
-  }
-  double start = 0.0;
-  double days = 0.0;
-  Value err = Value::blank();
-  if (!eval_leading_numbers(call, arena, registry, ctx, &start, &days, &err)) {
-    return err;
-  }
-  const bool date1904 = ctx.date1904();
-  if (!is_valid_workday_serial(start, date1904) || !is_valid_workday_count(days, date1904)) {
-    return Value::error(ErrorCode::Num);
-  }
-  std::vector<double> holidays;
-  if (!collect_holidays(call, arity, arena, registry, ctx, &holidays, &err)) {
-    return err;
-  }
-  return add_workdays(start, days, kSatSunWeekendMask, holidays, date1904);
+  return eval_workdays_driver(call, arena, registry, ctx, /*add_days=*/true, /*intl=*/false);
 }
 
 Value eval_networkdays_intl_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                                  const EvalContext& ctx) {
-  const std::uint32_t arity = call.as_call_arity();
-  if (arity < 2U || arity > 4U) {
-    return Value::error(ErrorCode::Value);
-  }
-  double start = 0.0;
-  double end = 0.0;
-  Value err = Value::blank();
-  if (!eval_leading_numbers(call, arena, registry, ctx, &start, &end, &err)) {
-    return err;
-  }
-  const bool date1904 = ctx.date1904();
-  if (!is_valid_workday_serial(start, date1904) || !is_valid_workday_serial(end, date1904)) {
-    return Value::error(ErrorCode::Num);
-  }
-  std::uint8_t mask = 0;
-  std::vector<double> holidays;
-  if (!resolve_intl_calendar(call, arity, arena, registry, ctx, &mask, &holidays, &err)) {
-    return err;
-  }
-  return count_workdays(start, end, mask, holidays, date1904);
+  return eval_workdays_driver(call, arena, registry, ctx, /*add_days=*/false, /*intl=*/true);
 }
 
 Value eval_workday_intl_lazy(const parser::AstNode& call, Arena& arena, const FunctionRegistry& registry,
                              const EvalContext& ctx) {
-  const std::uint32_t arity = call.as_call_arity();
-  if (arity < 2U || arity > 4U) {
-    return Value::error(ErrorCode::Value);
-  }
-  double start = 0.0;
-  double days = 0.0;
-  Value err = Value::blank();
-  if (!eval_leading_numbers(call, arena, registry, ctx, &start, &days, &err)) {
-    return err;
-  }
-  const bool date1904 = ctx.date1904();
-  if (!is_valid_workday_serial(start, date1904) || !is_valid_workday_count(days, date1904)) {
-    return Value::error(ErrorCode::Num);
-  }
-  std::uint8_t mask = 0;
-  std::vector<double> holidays;
-  if (!resolve_intl_calendar(call, arity, arena, registry, ctx, &mask, &holidays, &err)) {
-    return err;
-  }
-  return add_workdays(start, days, mask, holidays, date1904);
+  return eval_workdays_driver(call, arena, registry, ctx, /*add_days=*/true, /*intl=*/true);
 }
 
 }  // namespace eval
diff --git a/src/io/array_anchor_budget.h b/src/io/array_anchor_budget.h
index 9b6725dbe..46888e295 100644
--- a/src/io/array_anchor_budget.h
+++ b/src/io/array_anchor_budget.h
@@ -1,7 +1,7 @@
-// Shared validation and size accounting for dynamic-array spill footprints.
-// The OOXML and XLSB readers carry the same inclusive rectangle shape but
-// keep format-specific error codes and record state, so only the arithmetic
-// belongs in this seam.
+// Dynamic-array spill footprints shared by the OOXML and XLSB readers:
+// the anchor rectangle, its validation and size accounting, and the
+// registration pass that turns each footprint into a spill region. Error
+// codes and diagnostic context stay format-specific and are passed in.
 
 #ifndef FORMULON_IO_ARRAY_ANCHOR_BUDGET_H_
 #define FORMULON_IO_ARRAY_ANCHOR_BUDGET_H_
@@ -9,17 +9,32 @@
 #include <cstdint>
 #include <limits>
 #include <string>
+#include <string_view>
 #include <utility>
+#include <vector>
 
 #include "sheet.h"
 #include "utils/budget_charge.h"
 #include "utils/error.h"
 #include "utils/expected.h"
 #include "utils/resource_budget.h"
+#include "value.h"
 
 namespace formulon {
 namespace io {
 
+/// One dynamic-array formula anchor and its spill footprint, as recorded by
+/// `<f t="array" ref="F6:F8">` (OOXML) or a `BrtArrFmla` record's `RfX`
+/// (XLSB). The 0-based inclusive rectangle `[row..last_row] x
+/// [col..last_col]` is the footprint; `(row, col)` is the anchor. One-cell
+/// anchors are kept too so dynamic-array metadata survives a rewrite.
+struct ArrayAnchor {
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::uint32_t last_row = 0;
+  std::uint32_t last_col = 0;
+};
+
 /// Checks an inclusive dynamic-array anchor rectangle and returns its cell
 /// count without narrowing to `size_t`. The caller charges the returned count
 /// to its sheet-scoped `ResourceBudget` before reserving or walking cells.
@@ -47,6 +62,73 @@ inline Expected<void, Error> consume_array_anchor_budget(ResourceBudget& budget,
   return charge(budget, cell_count, std::move(context));
 }
 
+/// Registers each anchor's footprint as a spill region on `sheet`: captures
+/// the footprint's current cached values, blanks the non-anchor cells so
+/// they block neither the commit's collision scan nor the anchor's re-spill
+/// on recalc, then commits the region. Must run after the whole sheet has
+/// been decoded. `reader` and `format` name the caller in error context.
+inline Expected<void, Error> register_array_spills(Sheet& sheet, const std::vector<ArrayAnchor>& anchors,
+                                                   FormulonErrorCode error_code, std::string_view reader,
+                                                   std::string_view format) {
+  // Validate and charge every footprint before the first reserve or cell
+  // walk. This keeps a later malformed/over-budget anchor from arriving
+  // after an earlier one has already started an attacker-sized operation.
+  // The budget is local to this sheet so independent sheets cannot consume
+  // one another's dynamic-array allowance.
+  ResourceBudget budget(kMaxDynamicArrayCells, error_code);
+  std::string cells_context("context=");
+  cells_context.append(reader);
+  cells_context.append(" array_anchor");
+  for (const ArrayAnchor& a : anchors) {
+    auto cells_or = checked_array_anchor_cells(a.row, a.col, a.last_row, a.last_col, error_code, cells_context.c_str());
+    if (!cells_or) {
+      return cells_or.error();
+    }
+    std::string context("context=");
+    context.append(reader);
+    context.append(" format=");
+    context.append(format);
+    context.append(" anchor_row=");
+    context.append(std::to_string(a.row));
+    context.append(" anchor_col=");
+    context.append(std::to_string(a.col));
+    context.append(" last_row=");
+    context.append(std::to_string(a.last_row));
+    context.append(" last_col=");
+    context.append(std::to_string(a.last_col));
+    auto charged = consume_array_anchor_budget(budget, cells_or.value(), std::move(context));
+    if (!charged) {
+      return charged.error();
+    }
+  }
+
+  for (const ArrayAnchor& a : anchors) {
+    const std::uint32_t rows = a.last_row - a.row + 1U;
+    const std::uint32_t cols = a.last_col - a.col + 1U;
+    const std::uint64_t cell_count = static_cast<std::uint64_t>(rows) * cols;
+    std::vector<Value> values;
+    values.reserve(static_cast<std::size_t>(cell_count));
+    for (std::uint32_t r = a.row; r <= a.last_row; ++r) {
+      for (std::uint32_t c = a.col; c <= a.last_col; ++c) {
+        const Cell* cell = sheet.cell_at(r, c);
+        values.push_back(cell != nullptr ? cell->cached_value : Value::blank());
+      }
+    }
+    // Blank the non-anchor cells: their values now live in the region as
+    // phantoms.
+    for (std::uint32_t r = a.row; r <= a.last_row; ++r) {
+      for (std::uint32_t c = a.col; c <= a.last_col; ++c) {
+        if (r == a.row && c == a.col) {
+          continue;
+        }
+        sheet.set_cell_cached_value(r, c, Value::blank());
+      }
+    }
+    sheet.commit_spill(a.row, a.col, rows, cols, std::move(values));
+  }
+  return Expected<void, Error>::Ok();
+}
+
 }  // namespace io
 }  // namespace formulon
 
diff --git a/src/io/auto_filter_xml.cpp b/src/io/auto_filter_xml.cpp
new file mode 100644
index 000000000..79e9513be
--- /dev/null
+++ b/src/io/auto_filter_xml.cpp
@@ -0,0 +1,747 @@
+#include "io/auto_filter_xml.h"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "io/xml_utils.h"
+#include "io/xsd_double.h"
+#include "pugixml.hpp"
+
+namespace formulon::io {
+
+namespace {
+
+constexpr std::string_view kRichFilterExtUri = "{1AD28BCE-077C-4C59-8B6E-1921CE8616D4}";
+constexpr std::string_view kRichDataNamespace = "http://schemas.microsoft.com/office/spreadsheetml/2017/richdata2";
+
+constexpr std::array<std::string_view, 6> kGroupingNames = {"year", "month", "day", "hour", "minute", "second"};
+constexpr std::array<std::string_view, 6> kOperatorNames = {"equal",    "lessThan",           "lessThanOrEqual",
+                                                            "notEqual", "greaterThanOrEqual", "greaterThan"};
+constexpr std::array<std::string_view, 35> kDynamicNames = {
+    "null",        "aboveAverage", "belowAverage", "tomorrow",  "today",      "yesterday",   "nextWeek",
+    "thisWeek",    "lastWeek",     "nextMonth",    "thisMonth", "lastMonth",  "nextQuarter", "thisQuarter",
+    "lastQuarter", "nextYear",     "thisYear",     "lastYear",  "yearToDate", "Q1",          "Q2",
+    "Q3",          "Q4",           "M1",           "M2",        "M3",         "M4",          "M5",
+    "M6",          "M7",           "M8",           "M9",        "M10",        "M11",         "M12"};
+constexpr std::array<std::string_view, 4> kSortByNames = {"value", "cellColor", "fontColor", "icon"};
+constexpr std::array<std::string_view, 3> kSortMethodNames = {"none", "pinYin", "stroke"};
+
+std::optional<std::size_t> lookup(const std::string_view* names, std::size_t count, std::string_view text) {
+  for (std::size_t i = 0; i < count; ++i) {
+    if (names[i] == text) {
+      return i;
+    }
+  }
+  return std::nullopt;
+}
+
+/// How one attribute is parsed and serialized. The target a table entry binds
+/// to has the type named in each comment.
+enum class AttrKind : std::uint8_t {
+  kBool,            ///< `bool`; written when it differs from `bool_default`.
+  kU32,             ///< `std::optional<std::uint32_t>`; written when engaged.
+  kU32Required,     ///< `std::uint32_t`; absence fails, always written.
+  kNumber,          ///< `std::optional<double>`; written when engaged.
+  kNumberRequired,  ///< `double`; absence fails, always written.
+  kText,            ///< `std::string`; written when non-empty.
+  kTextAlways,      ///< `std::string`; always written.
+  kChoice,          ///< One-byte enum indexing `choices`; written unless 0.
+  kChoiceRequired,  ///< One-byte enum indexing `choices`; absence fails, always written.
+  kRect,            ///< `MergeRange` as an A1 `ref`; always written.
+  kExtras,          ///< `RawAttributes`: every attribute the table does not name.
+};
+
+/// One attribute of an element. A table lists them in serialization order; an
+/// element whose table has no `kExtras` entry rejects unlisted attributes.
+struct AttrSpec {
+  const char* name;
+  AttrKind kind;
+  bool bool_default = false;
+  const std::string_view* choices = nullptr;
+  std::size_t choice_count = 0;
+};
+
+constexpr AttrSpec choice_attr(const char* name, AttrKind kind, const std::string_view* names, std::size_t count) {
+  return AttrSpec{name, kind, false, names, count};
+}
+
+constexpr AttrSpec kRootAttrs[] = {{"ref", AttrKind::kRect}, {nullptr, AttrKind::kExtras}};
+constexpr AttrSpec kColumnAttrs[] = {{"colId", AttrKind::kU32Required},
+                                     {"hiddenButton", AttrKind::kBool, false},
+                                     {"showButton", AttrKind::kBool, true},
+                                     {nullptr, AttrKind::kExtras}};
+constexpr AttrSpec kFiltersAttrs[] = {{"blank", AttrKind::kBool, false}, {"calendarType", AttrKind::kText}};
+constexpr AttrSpec kFilterAttrs[] = {{"val", AttrKind::kTextAlways}};
+constexpr AttrSpec kDateGroupAttrs[] = {
+    {"year", AttrKind::kU32},
+    {"month", AttrKind::kU32},
+    {"day", AttrKind::kU32},
+    {"hour", AttrKind::kU32},
+    {"minute", AttrKind::kU32},
+    {"second", AttrKind::kU32},
+    choice_attr("dateTimeGrouping", AttrKind::kChoiceRequired, kGroupingNames.data(), kGroupingNames.size())};
+constexpr AttrSpec kCustomFiltersAttrs[] = {{"and", AttrKind::kBool, false}};
+constexpr AttrSpec kCustomFilterAttrs[] = {
+    choice_attr("operator", AttrKind::kChoice, kOperatorNames.data(), kOperatorNames.size()),
+    {"val", AttrKind::kTextAlways}};
+constexpr AttrSpec kTop10Attrs[] = {{"top", AttrKind::kBool, true},
+                                    {"percent", AttrKind::kBool, false},
+                                    {"val", AttrKind::kNumberRequired},
+                                    {"filterVal", AttrKind::kNumber}};
+constexpr AttrSpec kDynamicAttrs[] = {
+    choice_attr("type", AttrKind::kChoiceRequired, kDynamicNames.data(), kDynamicNames.size()),
+    {"val", AttrKind::kNumber},
+    {"valIso", AttrKind::kText},
+    {"maxVal", AttrKind::kNumber},
+    {"maxValIso", AttrKind::kText}};
+constexpr AttrSpec kColorAttrs[] = {{"dxfId", AttrKind::kU32}, {"cellColor", AttrKind::kBool, true}};
+constexpr AttrSpec kIconAttrs[] = {
+    choice_attr("iconSet", AttrKind::kChoiceRequired, cf::kIconSetNames.data(), cf::kIconSetNames.size()),
+    {"iconId", AttrKind::kU32}};
+constexpr AttrSpec kSortStateAttrs[] = {
+    {"columnSort", AttrKind::kBool, false},
+    {"caseSensitive", AttrKind::kBool, false},
+    choice_attr("sortMethod", AttrKind::kChoice, kSortMethodNames.data(), kSortMethodNames.size()),
+    {nullptr, AttrKind::kExtras},
+    {"ref", AttrKind::kRect}};
+/// `iconSet` (index `kSortConditionIconSet`) is written by hand: an icon sort
+/// names its set even when it is the default one.
+constexpr AttrSpec kSortConditionAttrs[] = {
+    {"descending", AttrKind::kBool, false},
+    choice_attr("sortBy", AttrKind::kChoice, kSortByNames.data(), kSortByNames.size()),
+    {"ref", AttrKind::kRect},
+    {"customList", AttrKind::kText},
+    {"dxfId", AttrKind::kU32},
+    choice_attr("iconSet", AttrKind::kChoice, cf::kIconSetNames.data(), cf::kIconSetNames.size()),
+    {"iconId", AttrKind::kU32}};
+constexpr std::size_t kSortConditionIconSet = 5U;
+
+static_assert(sizeof(FilterOperator) == 1U && sizeof(DynamicFilterType) == 1U && sizeof(cf::IconSetName) == 1U &&
+                  sizeof(SortBy) == 1U && sizeof(SortMethod) == 1U && sizeof(DateTimeGrouping) == 1U,
+              "kChoice targets are stored through one byte");
+
+/// Parse state: `ok` turns false on the first construct the model cannot carry.
+struct Reader {
+  bool ok = true;
+
+  void fail() { ok = false; }
+
+  bool boolean(const pugi::xml_node& node, const char* name, bool def) {
+    const pugi::xml_attribute attr = node.attribute(name);
+    if (!attr) {
+      return def;
+    }
+    const std::string_view v = attr.value();
+    if (v == "1" || v == "true") {
+      return true;
+    }
+    if (v == "0" || v == "false") {
+      return false;
+    }
+    fail();
+    return def;
+  }
+
+  std::optional<std::uint32_t> u32(const pugi::xml_node& node, const char* name) {
+    const pugi::xml_attribute attr = node.attribute(name);
+    if (!attr) {
+      return std::nullopt;
+    }
+    const std::optional<std::uint32_t> v = parse_xml_u32_attr_strict(attr);
+    if (!v) {
+      fail();
+    }
+    return v;
+  }
+
+  std::optional<double> number(const pugi::xml_node& node, const char* name) {
+    const pugi::xml_attribute attr = node.attribute(name);
+    if (!attr) {
+      return std::nullopt;
+    }
+    double v = 0.0;
+    if (!parse_xsd_double(attr.value(), &v)) {
+      fail();
+      return std::nullopt;
+    }
+    return v;
+  }
+
+  MergeRange rect(const pugi::xml_node& node) {
+    const std::optional<MergeRange> r = parse_a1_rectangle(node.attribute("ref").value());
+    if (!r) {
+      fail();
+      return {};
+    }
+    return *r;
+  }
+
+  /// Reads every attribute `specs` names into the matching `targets` entry.
+  void attrs(const pugi::xml_node& node, const AttrSpec* specs, std::size_t n, void* const* targets) {
+    RawAttributes* extras = nullptr;
+    for (std::size_t i = 0; i < n; ++i) {
+      if (specs[i].kind == AttrKind::kExtras) {
+        extras = static_cast<RawAttributes*>(targets[i]);
+        extras->clear();
+      }
+    }
+    for (const pugi::xml_attribute& attr : node.attributes()) {
+      bool listed = false;
+      for (std::size_t i = 0; i < n; ++i) {
+        listed = listed || (specs[i].name != nullptr && std::string_view(specs[i].name) == attr.name());
+      }
+      if (listed) {
+        continue;
+      }
+      if (extras != nullptr) {
+        extras->emplace_back(attr.name(), attr.value());
+      } else {
+        fail();
+      }
+    }
+    for (std::size_t i = 0; i < n; ++i) {
+      const AttrSpec& spec = specs[i];
+      void* target = targets[i];
+      switch (spec.kind) {
+        case AttrKind::kBool:
+          *static_cast<bool*>(target) = boolean(node, spec.name, spec.bool_default);
+          break;
+        case AttrKind::kU32:
+          *static_cast<std::optional<std::uint32_t>*>(target) = u32(node, spec.name);
+          break;
+        case AttrKind::kU32Required: {
+          const std::optional<std::uint32_t> v = u32(node, spec.name);
+          if (!v) {
+            fail();
+          }
+          *static_cast<std::uint32_t*>(target) = v.value_or(0U);
+          break;
+        }
+        case AttrKind::kNumber:
+          *static_cast<std::optional<double>*>(target) = number(node, spec.name);
+          break;
+        case AttrKind::kNumberRequired: {
+          const std::optional<double> v = number(node, spec.name);
+          if (!v) {
+            fail();
+          }
+          *static_cast<double*>(target) = v.value_or(0.0);
+          break;
+        }
+        case AttrKind::kText:
+        case AttrKind::kTextAlways:
+          *static_cast<std::string*>(target) = node.attribute(spec.name).value();
+          break;
+        case AttrKind::kChoice:
+        case AttrKind::kChoiceRequired: {
+          const pugi::xml_attribute attr = node.attribute(spec.name);
+          std::size_t index = 0;
+          if (attr) {
+            const std::optional<std::size_t> v = lookup(spec.choices, spec.choice_count, attr.value());
+            if (v) {
+              index = *v;
+            } else {
+              fail();
+            }
+          } else if (spec.kind == AttrKind::kChoiceRequired) {
+            fail();
+          }
+          *static_cast<std::uint8_t*>(target) = static_cast<std::uint8_t>(index);
+          break;
+        }
+        case AttrKind::kRect:
+          *static_cast<MergeRange*>(target) = rect(node);
+          break;
+        case AttrKind::kExtras:
+          break;
+      }
+    }
+  }
+
+  template <std::size_t N>
+  void attrs(const pugi::xml_node& node, const AttrSpec (&specs)[N], void* const (&targets)[N]) {
+    attrs(node, specs, N, targets);
+  }
+};
+
+bool is_element(const pugi::xml_node& node) {
+  return node.type() == pugi::node_element;
+}
+
+/// Parses one `<dateGroupItem>` (any prefix); fields present must be exactly
+/// those its grouping uses.
+std::optional<DateGroupItem> read_date_group(Reader& r, const pugi::xml_node& node) {
+  std::array<std::optional<std::uint32_t>, 6> fields;
+  DateGroupItem item;
+  r.attrs(node, kDateGroupAttrs,
+          {&fields[0], &fields[1], &fields[2], &fields[3], &fields[4], &fields[5], &item.grouping});
+  if (!r.ok) {
+    return std::nullopt;
+  }
+  constexpr std::array<std::uint32_t, 6> kMax = {9999U, 12U, 31U, 23U, 59U, 59U};
+  for (std::size_t i = 0; i < fields.size(); ++i) {
+    if (fields[i].has_value() != (i <= static_cast<std::size_t>(item.grouping)) ||
+        (fields[i] && *fields[i] > kMax[i])) {
+      r.fail();
+      return std::nullopt;
+    }
+  }
+  item.year = static_cast<std::uint16_t>(fields[0].value_or(0U));
+  item.month = static_cast<std::uint8_t>(fields[1].value_or(0U));
+  item.day = static_cast<std::uint8_t>(fields[2].value_or(0U));
+  item.hour = static_cast<std::uint8_t>(fields[3].value_or(0U));
+  item.minute = static_cast<std::uint8_t>(fields[4].value_or(0U));
+  item.second = static_cast<std::uint8_t>(fields[5].value_or(0U));
+  return item;
+}
+
+/// Parses `<filters>` children named `<prefix>filter` / `<prefix>dateGroupItem`.
+void read_value_filters(Reader& r, const pugi::xml_node& node, std::string_view prefix, ValueFilters& out) {
+  r.attrs(node, kFiltersAttrs, {&out.blank, &out.calendar_type});
+  if (out.calendar_type == "none") {
+    out.calendar_type.clear();
+  }
+  for (const pugi::xml_node& child : node.children()) {
+    if (!is_element(child)) {
+      continue;
+    }
+    const std::string_view name = child.name();
+    if (name.substr(0, prefix.size()) != prefix) {
+      r.fail();
+      return;
+    }
+    const std::string_view local = name.substr(prefix.size());
+    if (local == "filter") {
+      std::string& value = out.values.emplace_back();
+      r.attrs(child, kFilterAttrs, {&value});
+    } else if (local == "dateGroupItem") {
+      if (std::optional<DateGroupItem> item = read_date_group(r, child)) {
+        out.date_groups.push_back(*item);
+      }
+    } else {
+      r.fail();
+      return;
+    }
+  }
+}
+
+/// Lifts the date-group extension Excel writes into `out`. Returns false
+/// (leaving `out` untouched) when `ext` is any other extension or carries
+/// content the model does not name.
+bool lift_rich_filter_ext(const pugi::xml_node& ext, ValueFilters& out) {
+  if (std::string_view(ext.attribute("uri").value()) != kRichFilterExtUri) {
+    return false;
+  }
+  std::string prefix;
+  for (const pugi::xml_attribute& attr : ext.attributes()) {
+    const std::string_view name = attr.name();
+    if (name == "uri") {
+      continue;
+    }
+    if (name.substr(0, 6) != "xmlns:" || std::string_view(attr.value()) != kRichDataNamespace || !prefix.empty()) {
+      return false;
+    }
+    prefix = std::string(name.substr(6)) + ":";
+  }
+  if (prefix.empty()) {
+    return false;
+  }
+  const pugi::xml_node column = ext.first_child();
+  if (!is_element(column) || column.next_sibling() || column.first_attribute() ||
+      std::string_view(column.name()) != prefix + "filterColumn") {
+    return false;
+  }
+  const pugi::xml_node filters = column.first_child();
+  if (!is_element(filters) || filters.next_sibling() || std::string_view(filters.name()) != prefix + "filters") {
+    return false;
+  }
+  Reader r;
+  ValueFilters lifted;
+  read_value_filters(r, filters, prefix, lifted);
+  if (!r.ok || lifted.date_groups.empty()) {
+    return false;
+  }
+  out = std::move(lifted);
+  return true;
+}
+
+void read_filter_column(Reader& r, const pugi::xml_node& node, FilterColumn& col) {
+  r.attrs(node, kColumnAttrs, {&col.col_id, &col.hidden_button, &col.show_button, &col.extra_attrs});
+  if (!r.ok) {
+    return;
+  }
+  for (const pugi::xml_node& child : node.children()) {
+    if (!is_element(child)) {
+      continue;
+    }
+    const std::string_view name = child.name();
+    const bool criterion = name == "filters" || name == "customFilters" || name == "top10" || name == "dynamicFilter" ||
+                           name == "colorFilter" || name == "iconFilter";
+    if (criterion && col.kind != FilterKind::kNone) {
+      r.fail();
+      return;
+    }
+    if (name == "filters") {
+      col.kind = FilterKind::kValues;
+      read_value_filters(r, child, "", col.values);
+    } else if (name == "customFilters") {
+      col.kind = FilterKind::kCustom;
+      r.attrs(child, kCustomFiltersAttrs, {&col.custom.and_join});
+      for (const pugi::xml_node& item : child.children()) {
+        if (!is_element(item)) {
+          continue;
+        }
+        if (std::string_view(item.name()) != "customFilter") {
+          r.fail();
+          return;
+        }
+        CustomFilter& filter = col.custom.filters.emplace_back();
+        r.attrs(item, kCustomFilterAttrs, {&filter.op, &filter.val});
+      }
+      if (col.custom.filters.empty() || col.custom.filters.size() > 2U) {
+        r.fail();
+      }
+    } else if (name == "top10") {
+      col.kind = FilterKind::kTop10;
+      r.attrs(child, kTop10Attrs, {&col.top10.top, &col.top10.percent, &col.top10.val, &col.top10.filter_val});
+    } else if (name == "dynamicFilter") {
+      col.kind = FilterKind::kDynamic;
+      r.attrs(
+          child, kDynamicAttrs,
+          {&col.dynamic.type, &col.dynamic.val, &col.dynamic.val_iso, &col.dynamic.max_val, &col.dynamic.max_val_iso});
+    } else if (name == "colorFilter") {
+      col.kind = FilterKind::kColor;
+      r.attrs(child, kColorAttrs, {&col.color.dxf_id, &col.color.cell_color});
+    } else if (name == "iconFilter") {
+      col.kind = FilterKind::kIcon;
+      r.attrs(child, kIconAttrs, {&col.icon.icon_set, &col.icon.icon_id});
+    } else if (name == "extLst") {
+      for (const pugi::xml_node& ext : child.children()) {
+        if (!is_element(ext)) {
+          continue;
+        }
+        ValueFilters lifted;
+        if (col.kind == FilterKind::kNone && lift_rich_filter_ext(ext, lifted)) {
+          col.kind = FilterKind::kValues;
+          col.values = std::move(lifted);
+        } else {
+          append_raw_xml(col.ext_xml, ext);
+        }
+      }
+    } else {
+      append_raw_xml(col.extra_xml, child);
+    }
+    if (!r.ok) {
+      return;
+    }
+  }
+}
+
+void read_sort_state(Reader& r, const pugi::xml_node& node, SortState& sort) {
+  r.attrs(node, kSortStateAttrs,
+          {&sort.column_sort, &sort.case_sensitive, &sort.sort_method, &sort.extra_attrs, &sort.ref});
+  for (const pugi::xml_node& child : node.children()) {
+    if (!is_element(child)) {
+      continue;
+    }
+    const std::string_view name = child.name();
+    if (name == "sortCondition") {
+      SortCondition& cond = sort.conditions.emplace_back();
+      r.attrs(
+          child, kSortConditionAttrs,
+          {&cond.descending, &cond.sort_by, &cond.ref, &cond.custom_list, &cond.dxf_id, &cond.icon_set, &cond.icon_id});
+    } else if (name == "extLst" && sort.ext_lst_xml.empty()) {
+      sort.ext_lst_xml = raw_xml(child);
+    } else {
+      r.fail();
+    }
+  }
+}
+
+void append_number(std::string& out, const char* name, double value) {
+  out.push_back(' ');
+  out.append(name);
+  out.append("=\"");
+  append_xml_number(out, value);
+  out.push_back('"');
+}
+
+void append_ref(std::string& out, const MergeRange& rect) {
+  std::string ref;
+  append_a1_rectangle(ref, rect);
+  append_xml_attr(out, "ref", ref);
+}
+
+/// Writes the attributes `specs` describes, in table order, from `targets`.
+void write_attrs(std::string& out, const AttrSpec* specs, std::size_t n, const void* const* targets) {
+  for (std::size_t i = 0; i < n; ++i) {
+    const AttrSpec& spec = specs[i];
+    const void* target = targets[i];
+    switch (spec.kind) {
+      case AttrKind::kBool: {
+        const bool value = *static_cast<const bool*>(target);
+        if (value != spec.bool_default) {
+          append_xml_attr(out, spec.name, value ? "1" : "0");
+        }
+        break;
+      }
+      case AttrKind::kU32:
+        if (const auto& value = *static_cast<const std::optional<std::uint32_t>*>(target)) {
+          append_xml_attr_uint(out, spec.name, *value);
+        }
+        break;
+      case AttrKind::kU32Required:
+        append_xml_attr_uint(out, spec.name, *static_cast<const std::uint32_t*>(target));
+        break;
+      case AttrKind::kNumber:
+        if (const auto& value = *static_cast<const std::optional<double>*>(target)) {
+          append_number(out, spec.name, *value);
+        }
+        break;
+      case AttrKind::kNumberRequired:
+        append_number(out, spec.name, *static_cast<const double*>(target));
+        break;
+      case AttrKind::kText:
+      case AttrKind::kTextAlways: {
+        const std::string& value = *static_cast<const std::string*>(target);
+        if (spec.kind == AttrKind::kTextAlways || !value.empty()) {
+          append_xml_attr(out, spec.name, value);
+        }
+        break;
+      }
+      case AttrKind::kChoice:
+      case AttrKind::kChoiceRequired: {
+        const std::uint8_t index = *static_cast<const std::uint8_t*>(target);
+        if (spec.kind == AttrKind::kChoiceRequired || index != 0U) {
+          append_xml_attr(out, spec.name, spec.choices[index]);
+        }
+        break;
+      }
+      case AttrKind::kRect:
+        append_ref(out, *static_cast<const MergeRange*>(target));
+        break;
+      case AttrKind::kExtras:
+        append_raw_attrs(out, *static_cast<const RawAttributes*>(target));
+        break;
+    }
+  }
+}
+
+template <std::size_t N>
+void write_attrs(std::string& out, const AttrSpec (&specs)[N], const void* const (&targets)[N]) {
+  write_attrs(out, specs, N, targets);
+}
+
+void append_value_filters(std::string& out, const ValueFilters& values, std::string_view prefix) {
+  out.push_back('<');
+  out.append(prefix);
+  out.append("filters");
+  write_attrs(out, kFiltersAttrs, {&values.blank, &values.calendar_type});
+  if (values.values.empty() && values.date_groups.empty()) {
+    out.append("/>");
+    return;
+  }
+  out.push_back('>');
+  for (const std::string& value : values.values) {
+    out.push_back('<');
+    out.append(prefix);
+    out.append("filter");
+    write_attrs(out, kFilterAttrs, {&value});
+    out.append("/>");
+  }
+  for (const DateGroupItem& item : values.date_groups) {
+    out.push_back('<');
+    out.append(prefix);
+    out.append("dateGroupItem");
+    const std::array<std::uint32_t, 6> fields = {item.year, item.month, item.day, item.hour, item.minute, item.second};
+    for (std::size_t i = 0; i <= static_cast<std::size_t>(item.grouping); ++i) {
+      append_xml_attr_uint(out, kDateGroupAttrs[i].name, fields[i]);
+    }
+    append_xml_attr(out, "dateTimeGrouping", kGroupingNames[static_cast<std::size_t>(item.grouping)]);
+    out.append("/>");
+  }
+  out.append("</");
+  out.append(prefix);
+  out.append("filters>");
+}
+
+void append_filter_column(std::string& out, const FilterColumn& col) {
+  out.append("<filterColumn");
+  write_attrs(out, kColumnAttrs, {&col.col_id, &col.hidden_button, &col.show_button, &col.extra_attrs});
+  const bool rich_dates = col.kind == FilterKind::kValues && !col.values.date_groups.empty();
+  std::string body;
+  switch (col.kind) {
+    case FilterKind::kNone:
+      break;
+    case FilterKind::kValues:
+      if (!rich_dates) {
+        append_value_filters(body, col.values, "");
+      }
+      break;
+    case FilterKind::kCustom:
+      body.append("<customFilters");
+      write_attrs(body, kCustomFiltersAttrs, {&col.custom.and_join});
+      body.push_back('>');
+      for (const CustomFilter& filter : col.custom.filters) {
+        body.append("<customFilter");
+        write_attrs(body, kCustomFilterAttrs, {&filter.op, &filter.val});
+        body.append("/>");
+      }
+      body.append("</customFilters>");
+      break;
+    case FilterKind::kTop10:
+      body.append("<top10");
+      write_attrs(body, kTop10Attrs, {&col.top10.top, &col.top10.percent, &col.top10.val, &col.top10.filter_val});
+      body.append("/>");
+      break;
+    case FilterKind::kDynamic:
+      body.append("<dynamicFilter");
+      write_attrs(
+          body, kDynamicAttrs,
+          {&col.dynamic.type, &col.dynamic.val, &col.dynamic.val_iso, &col.dynamic.max_val, &col.dynamic.max_val_iso});
+      body.append("/>");
+      break;
+    case FilterKind::kColor:
+      body.append("<colorFilter");
+      write_attrs(body, kColorAttrs, {&col.color.dxf_id, &col.color.cell_color});
+      body.append("/>");
+      break;
+    case FilterKind::kIcon:
+      body.append("<iconFilter");
+      write_attrs(body, kIconAttrs, {&col.icon.icon_set, &col.icon.icon_id});
+      body.append("/>");
+      break;
+  }
+  body.append(col.extra_xml);
+  if (rich_dates || !col.ext_xml.empty()) {
+    body.append("<extLst>");
+    if (rich_dates) {
+      body.append("<ext");
+      append_xml_attr(body, "uri", kRichFilterExtUri);
+      append_xml_attr(body, "xmlns:xlrd2", kRichDataNamespace);
+      body.append("><xlrd2:filterColumn>");
+      append_value_filters(body, col.values, "xlrd2:");
+      body.append("</xlrd2:filterColumn></ext>");
+    }
+    body.append(col.ext_xml);
+    body.append("</extLst>");
+  }
+  if (body.empty()) {
+    out.append("/>");
+    return;
+  }
+  out.push_back('>');
+  out.append(body);
+  out.append("</filterColumn>");
+}
+
+void append_sort_state(std::string& out, const SortState& sort) {
+  out.append("<sortState");
+  write_attrs(out, kSortStateAttrs,
+              {&sort.column_sort, &sort.case_sensitive, &sort.sort_method, &sort.extra_attrs, &sort.ref});
+  if (sort.conditions.empty() && sort.ext_lst_xml.empty()) {
+    out.append("/>");
+    return;
+  }
+  out.push_back('>');
+  for (const SortCondition& cond : sort.conditions) {
+    out.append("<sortCondition");
+    const void* const targets[] = {&cond.descending, &cond.sort_by,  &cond.ref,    &cond.custom_list,
+                                   &cond.dxf_id,     &cond.icon_set, &cond.icon_id};
+    write_attrs(out, kSortConditionAttrs, kSortConditionIconSet, targets);
+    if (cond.sort_by == SortBy::kIcon || cond.icon_set != cf::IconSetName::Three_Arrows) {
+      append_xml_attr(out, "iconSet", cf::kIconSetNames[static_cast<std::size_t>(cond.icon_set)]);
+    }
+    write_attrs(out, kSortConditionAttrs + kSortConditionIconSet + 1U, 1U, targets + kSortConditionIconSet + 1U);
+    out.append("/>");
+  }
+  out.append(sort.ext_lst_xml);
+  out.append("</sortState>");
+}
+
+Error invalid(std::string message) {
+  return make_error(FormulonErrorCode::kAutoFilterInvalid, std::move(message));
+}
+
+}  // namespace
+
+Expected<AutoFilter, Error> parse_auto_filter_xml(std::string_view xml) {
+  pugi::xml_document doc;
+  const pugi::xml_parse_result parsed =
+      doc.load_buffer(xml.data(), xml.size(), pugi::parse_default, pugi::encoding_utf8);
+  if (!parsed) {
+    return invalid(std::string("autoFilter: XML parse failed: ") + parsed.description());
+  }
+  const pugi::xml_node root = doc.first_child();
+  if (!is_element(root) || root.next_sibling() || std::string_view(root.name()) != "autoFilter") {
+    return invalid("autoFilter: fragment is not a single autoFilter element");
+  }
+  Reader r;
+  AutoFilter filter;
+  r.attrs(root, kRootAttrs, {&filter.range, &filter.extra_attrs});
+  for (const pugi::xml_node& child : root.children()) {
+    if (!is_element(child) || !r.ok) {
+      continue;
+    }
+    const std::string_view name = child.name();
+    if (name == "filterColumn" && !filter.sort && filter.ext_lst_xml.empty()) {
+      filter.columns.emplace_back();
+      read_filter_column(r, child, filter.columns.back());
+    } else if (name == "sortState" && !filter.sort && filter.ext_lst_xml.empty()) {
+      filter.sort.emplace();
+      read_sort_state(r, child, *filter.sort);
+    } else if (name == "extLst" && filter.ext_lst_xml.empty()) {
+      filter.ext_lst_xml = raw_xml(child);
+    } else {
+      r.fail();
+    }
+  }
+  if (!r.ok) {
+    return invalid("autoFilter: element carries content the model cannot represent");
+  }
+  return filter;
+}
+
+std::string serialize_auto_filter(const AutoFilter& filter) {
+  if (filter.is_opaque()) {
+    return filter.opaque_xml;
+  }
+  std::string out = "<autoFilter";
+  write_attrs(out, kRootAttrs, {&filter.range, &filter.extra_attrs});
+  if (filter.columns.empty() && !filter.sort && filter.ext_lst_xml.empty()) {
+    out.append("/>");
+    return out;
+  }
+  out.push_back('>');
+  for (const FilterColumn& col : filter.columns) {
+    append_filter_column(out, col);
+  }
+  if (filter.sort) {
+    append_sort_state(out, *filter.sort);
+  }
+  out.append(filter.ext_lst_xml);
+  out.append("</autoFilter>");
+  return out;
+}
+
+std::string auto_filter_xml(const AutoFilter* filter) {
+  return filter != nullptr ? serialize_auto_filter(*filter) : std::string();
+}
+
+AutoFilter auto_filter_from_xml(std::string_view xml) {
+  Expected<AutoFilter, Error> parsed = parse_auto_filter_xml(xml);
+  if (parsed) {
+    return std::move(parsed.value());
+  }
+  AutoFilter opaque;
+  opaque.opaque_xml.assign(xml);
+  return opaque;
+}
+
+}  // namespace formulon::io
diff --git a/src/io/auto_filter_xml.h b/src/io/auto_filter_xml.h
new file mode 100644
index 000000000..bd963e7f2
--- /dev/null
+++ b/src/io/auto_filter_xml.h
@@ -0,0 +1,47 @@
+//
+// `<autoFilter>` element (ECMA-376 §18.3.2, `CT_AutoFilter`) reader and
+// writer for the AutoFilter model in `auto_filter.h`.
+//
+// Attributes the model does not name on `autoFilter`, `filterColumn` and
+// `sortState` (Excel's `xr:uid`, namespace declarations) and unknown
+// `filterColumn` children are retained as raw XML. A fragment that does not
+// parse into the model at all -- malformed XML, a ref that is not a plain A1
+// rectangle, an unknown enumeration value -- is kept verbatim as `opaque_xml`
+// and round-trips unchanged.
+//
+// Excel writes date-group criteria only inside a `filterColumn` extension
+// (`xlrd2:filterColumn`, uri {1AD28BCE-077C-4C59-8B6E-1921CE8616D4}); the
+// reader lifts them into `ValueFilters::date_groups` and the writer emits
+// them back in that form, whichever form the source used.
+
+#ifndef FORMULON_IO_AUTO_FILTER_XML_H_
+#define FORMULON_IO_AUTO_FILTER_XML_H_
+
+#include <string>
+#include <string_view>
+
+#include "auto_filter.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon::io {
+
+/// Parses one `<autoFilter>` element. Returns `kAutoFilterInvalid` when the
+/// fragment is not a single well-formed `autoFilter` element the model can
+/// represent.
+Expected<AutoFilter, Error> parse_auto_filter_xml(std::string_view xml);
+
+/// Serializes `filter` as an `<autoFilter>` element. An opaque filter
+/// returns its retained bytes.
+std::string serialize_auto_filter(const AutoFilter& filter);
+
+/// The serialized element of `filter`, or empty when it is null.
+std::string auto_filter_xml(const AutoFilter* filter);
+
+/// Reads a non-empty `<autoFilter>` element; a fragment the model cannot
+/// represent comes back opaque.
+AutoFilter auto_filter_from_xml(std::string_view xml);
+
+}  // namespace formulon::io
+
+#endif  // FORMULON_IO_AUTO_FILTER_XML_H_
diff --git a/src/io/cell_parser.cpp b/src/io/cell_parser.cpp
index 436a0b514..010d8eaf4 100644
--- a/src/io/cell_parser.cpp
+++ b/src/io/cell_parser.cpp
@@ -31,8 +31,6 @@
 #include <vector>
 
 #include "io/iso_date.h"
-#include "io/phonetic_pr.h"
-#include "io/xml_escape.h"
 #include "io/xml_utils.h"
 #include "io/xsd_double.h"
 #include "io/xsd_int.h"
@@ -145,30 +143,12 @@ std::uint32_t ParseColumnLetters(std::string_view text, std::size_t* i) {
 /// Walks `is_node`'s descendants and concatenates every `<t>` text node
 /// payload into `out`, in document order. Thin wrapper over the shared
 /// `append_rich_text` helper (which skips `<rPh>` so phonetic guides do
-/// not leak into the surface string; `CollectInlinePhoneticRuns` walks
+/// not leak into the surface string; `append_phonetic_runs` walks
 /// them separately).
 void ConcatInlineStringText(const pugi::xml_node& is_node, std::string& out) {
   (void)append_rich_text(is_node, out);
 }
 
-/// Collects every `<rPh>` direct child of `is_node` into `out`, one run
-/// per block, in document order. The `sb`/`eb` attributes delimit the
-/// surface-text span each block's kana covers, in UTF-16 code units, and
-/// are preserved: PHONETIC replaces only the annotated spans and passes
-/// the rest of the string through, so the boundaries are observable.
-/// Mirrors `CollectPhoneticRuns` on the shared-strings side.
-void CollectInlinePhoneticRuns(const pugi::xml_node& is_node, std::vector<PhoneticRun>& out) {
-  for (pugi::xml_node rph = is_node.child("rPh"); rph; rph = rph.next_sibling("rPh")) {
-    PhoneticRun run;
-    run.sb = static_cast<std::uint32_t>(rph.attribute("sb").as_uint(0U));
-    run.eb = static_cast<std::uint32_t>(rph.attribute("eb").as_uint(0U));
-    for (pugi::xml_node t = rph.child("t"); t; t = t.next_sibling("t")) {
-      AppendOoxmlTextUnescaped(run.text, t.text().get());
-    }
-    out.push_back(std::move(run));
-  }
-}
-
 }  // namespace
 
 Expected<std::pair<std::uint32_t, std::uint32_t>, Error> parse_a1(std::string_view ref) {
@@ -309,6 +289,7 @@ Expected<ParsedCell, Error> decode_cell_payload(std::string_view t, std::string_
     double serial = 0.0;
     if (parse_iso_date_serial(v_text, &serial)) {
       out.value = Value::number(serial);
+      out.is_iso_date = true;
     } else {
       // Non-conforming producer: keep the raw text rather than failing.
       text_storage.emplace_back(std::string(v_text));
@@ -359,8 +340,10 @@ Expected<ParsedCell, Error> parse_cell_element(const pugi::xml_node& node, std::
   // over one malformed value would trade a formatting loss for a load
   // failure. The streaming reader applies the same lexer and the same
   // disposition to the same attribute.
+  const std::string_view s_attr = attr_str(node, "s");
+  const bool has_explicit_xf = !s_attr.empty();
   std::uint32_t xf_index = 0;
-  if (!parse_xsd_nonneg_int(attr_str(node, "s"), &xf_index)) {
+  if (!parse_xsd_nonneg_int(s_attr, &xf_index)) {
     xf_index = 0;
   }
 
@@ -408,6 +391,7 @@ Expected<ParsedCell, Error> parse_cell_element(const pugi::xml_node& node, std::
   out.col = col;
   out.formula = std::move(formula);
   out.xf_index = xf_index;
+  out.has_explicit_xf = has_explicit_xf;
 
   // Capture <rPh> phonetic runs from the inline-string block (when
   // present). SST-referenced cells (t="s") carry their phonetic on the
@@ -416,12 +400,8 @@ Expected<ParsedCell, Error> parse_cell_element(const pugi::xml_node& node, std::
   // their kana, so unlike the cell's surface text they do not borrow
   // from `text_storage`.
   if (is_node) {
-    CollectInlinePhoneticRuns(is_node, out.phonetic_runs);
-    if (pugi::xml_node pr = is_node.child("phoneticPr")) {
-      out.phonetic_props.font_id = static_cast<std::uint16_t>(pr.attribute("fontId").as_uint(0U));
-      out.phonetic_props.type = parse_phonetic_type(pr.attribute("type").value());
-      out.phonetic_props.alignment = parse_phonetic_alignment(pr.attribute("alignment").value());
-    }
+    append_phonetic_runs(is_node, out.phonetic_runs);
+    out.phonetic_props = read_phonetic_properties(is_node);
   }
   return out;
 }
diff --git a/src/io/cell_parser.h b/src/io/cell_parser.h
index aa0503bf9..8d433ba73 100644
--- a/src/io/cell_parser.h
+++ b/src/io/cell_parser.h
@@ -64,6 +64,11 @@ struct ParsedCell {
   ///                  `sst_index`, with `is_sst_index = true`
   ///   * `Blank` — when `<v>` and `<is>` are both absent
   Value value = Value::blank();
+  /// True only when `value` came from a successfully parsed `t="d"` ISO
+  /// 8601 date payload. The decoder keeps that payload on the canonical
+  /// 1900 serial axis; the sheet reader applies the workbook's 1904 offset
+  /// once, immediately before storing the literal or formula cache.
+  bool is_iso_date = false;
   /// Bundle 2.3 hand-off: when `t="s"`, the parser surfaces the SST index
   /// here instead of resolving it. The reader records (row, col,
   /// sst_index) in a side table and replaces the placeholder text once the
@@ -85,6 +90,10 @@ struct ParsedCell {
   /// `s=` attribute on the `<c>` element. Defaults to `0` (the default
   /// xf) when the attribute is absent.
   std::uint32_t xf_index = 0;
+  /// True when the `<c>` element carried a non-empty `s=` attribute,
+  /// including an explicit `s="0"`. This distinguishes an explicitly
+  /// default-formatted cell from an unstyled storage gap.
+  bool has_explicit_xf = false;
 };
 
 /// Parses one `<c>` element. `node` must be a valid `<c>` element node;
diff --git a/src/io/cf_reader.cpp b/src/io/cf_reader.cpp
index c1874ae3a..9aa52beb7 100644
--- a/src/io/cf_reader.cpp
+++ b/src/io/cf_reader.cpp
@@ -14,6 +14,7 @@
 
 #include "cf/cf_types.h"
 #include "io/cell_parser.h"
+#include "io/color_spec_xml.h"
 #include "io/future_functions.h"
 #include "io/xml_escape.h"
 #include "io/xml_utils.h"
@@ -111,40 +112,11 @@ cf::CfvoType ParseCfvoType(std::string_view text) {
 }
 
 cf::IconSetName ParseIconSetName(std::string_view text) {
-  if (text == "3Arrows")
-    return cf::IconSetName::Three_Arrows;
-  if (text == "3ArrowsGray")
-    return cf::IconSetName::Three_ArrowsGray;
-  if (text == "3Flags")
-    return cf::IconSetName::Three_Flags;
-  if (text == "3TrafficLights1")
-    return cf::IconSetName::Three_TrafficLights1;
-  if (text == "3TrafficLights2")
-    return cf::IconSetName::Three_TrafficLights2;
-  if (text == "3Signs")
-    return cf::IconSetName::Three_Signs;
-  if (text == "3Symbols")
-    return cf::IconSetName::Three_Symbols;
-  if (text == "3Symbols2")
-    return cf::IconSetName::Three_Symbols2;
-  if (text == "4Arrows")
-    return cf::IconSetName::Four_Arrows;
-  if (text == "4ArrowsGray")
-    return cf::IconSetName::Four_ArrowsGray;
-  if (text == "4RedToBlack")
-    return cf::IconSetName::Four_RedToBlack;
-  if (text == "4Rating")
-    return cf::IconSetName::Four_Rating;
-  if (text == "4TrafficLights")
-    return cf::IconSetName::Four_TrafficLights;
-  if (text == "5Arrows")
-    return cf::IconSetName::Five_Arrows;
-  if (text == "5ArrowsGray")
-    return cf::IconSetName::Five_ArrowsGray;
-  if (text == "5Rating")
-    return cf::IconSetName::Five_Rating;
-  if (text == "5Quarters")
-    return cf::IconSetName::Five_Quarters;
+  for (std::size_t i = 0; i < cf::kIconSetNames.size(); ++i) {
+    if (cf::kIconSetNames[i] == text) {
+      return static_cast<cf::IconSetName>(i);
+    }
+  }
   // The schema default, which Excel omits the attribute for.
   return cf::IconSetName::Three_TrafficLights1;
 }
@@ -353,6 +325,18 @@ cf::Color ParseRgbColor(std::string_view rgb) {
   return out;
 }
 
+/// Reads a CF `<color>`-like element. `theme` / `indexed` / `auto` are kept as
+/// a `ColorSpec` (resolved at evaluation time); `rgb` stays literal.
+cf::Color ReadColor(const pugi::xml_node& node) {
+  const ColorSpec spec = read_color_spec(node);
+  if (spec.kind != ColorSpec::Kind::kNone && spec.kind != ColorSpec::Kind::kRgb) {
+    cf::Color out{};
+    out.spec = spec;
+    return out;
+  }
+  return ParseRgbColor(attr_str(node, "rgb"));
+}
+
 cf::CfValueObject ReadCfvo(const pugi::xml_node& cfvo) {
   cf::CfValueObject out{};
   out.type = ParseCfvoType(attr_str(cfvo, "type"));
@@ -380,7 +364,7 @@ void ReadColorScale(const pugi::xml_node& scale, cf::ColorScaleSpec* out) {
     if (name == "cfvo") {
       out->thresholds.push_back(ReadCfvo(child));
     } else if (name == "color") {
-      out->colors.push_back(ParseRgbColor(attr_str(child, "rgb")));
+      out->colors.push_back(ReadColor(child));
     }
   }
 }
@@ -403,7 +387,7 @@ void ReadDataBar(const pugi::xml_node& bar, cf::DataBarSpec* out) {
       // gradient live only in the 2010+ `<x14:dataBar>` extension, which
       // `ApplyX14DataBarOverlay` folds on top of this.
       if (color_idx == 0) {
-        out->fill = ParseRgbColor(attr_str(child, "rgb"));
+        out->fill = ReadColor(child);
         out->negative_fill = out->fill;
       }
       ++color_idx;
@@ -457,13 +441,13 @@ void ApplyX14DataBarOverlay(const pugi::xml_node& x14_bar, cf::DataBarSpec* out)
   for (pugi::xml_node child = x14_bar.first_child(); child; child = child.next_sibling()) {
     const std::string_view name = child.name();
     if (name == "x14:negativeFillColor") {
-      out->negative_fill = ParseRgbColor(attr_str(child, "rgb"));
+      out->negative_fill = ReadColor(child);
     } else if (name == "x14:negativeBorderColor") {
-      out->negative_border = ParseRgbColor(attr_str(child, "rgb"));
+      out->negative_border = ReadColor(child);
     } else if (name == "x14:axisColor") {
-      out->axis_color = ParseRgbColor(attr_str(child, "rgb"));
+      out->axis_color = ReadColor(child);
     } else if (name == "x14:borderColor") {
-      out->border = ParseRgbColor(attr_str(child, "rgb"));
+      out->border = ReadColor(child);
     }
   }
   // `negativeBarColorSameAsPositive="1"` overrides any explicit
diff --git a/src/io/cf_writer.cpp b/src/io/cf_writer.cpp
index 02791d185..2f49e050a 100644
--- a/src/io/cf_writer.cpp
+++ b/src/io/cf_writer.cpp
@@ -6,19 +6,21 @@
 
 #include <cstddef>
 #include <cstdint>
-#include <cstdio>
 #include <string>
 #include <string_view>
 
 #include "cf/cf_types.h"
+#include "io/color_spec_xml.h"
 #include "io/future_functions.h"
 #include "io/xml_escape.h"
+#include "io/xml_utils.h"
 #include "parser/ast.h"
 #include "parser/ast_format.h"
 #include "parser/parser.h"
 #include "utils/a1_column.h"
 #include "utils/a1_ref.h"
 #include "utils/arena.h"
+#include "utils/number_text.h"
 
 namespace formulon::io {
 namespace {
@@ -110,43 +112,7 @@ std::string_view CfvoTypeToString(cf::CfvoType t) {
 }
 
 std::string_view IconSetNameToString(cf::IconSetName n) {
-  switch (n) {
-    case cf::IconSetName::Three_Arrows:
-      return "3Arrows";
-    case cf::IconSetName::Three_ArrowsGray:
-      return "3ArrowsGray";
-    case cf::IconSetName::Three_Flags:
-      return "3Flags";
-    case cf::IconSetName::Three_TrafficLights1:
-      return "3TrafficLights1";
-    case cf::IconSetName::Three_TrafficLights2:
-      return "3TrafficLights2";
-    case cf::IconSetName::Three_Signs:
-      return "3Signs";
-    case cf::IconSetName::Three_Symbols:
-      return "3Symbols";
-    case cf::IconSetName::Three_Symbols2:
-      return "3Symbols2";
-    case cf::IconSetName::Four_Arrows:
-      return "4Arrows";
-    case cf::IconSetName::Four_ArrowsGray:
-      return "4ArrowsGray";
-    case cf::IconSetName::Four_RedToBlack:
-      return "4RedToBlack";
-    case cf::IconSetName::Four_Rating:
-      return "4Rating";
-    case cf::IconSetName::Four_TrafficLights:
-      return "4TrafficLights";
-    case cf::IconSetName::Five_Arrows:
-      return "5Arrows";
-    case cf::IconSetName::Five_ArrowsGray:
-      return "5ArrowsGray";
-    case cf::IconSetName::Five_Rating:
-      return "5Rating";
-    case cf::IconSetName::Five_Quarters:
-      return "5Quarters";
-  }
-  return "3Arrows";
+  return cf::kIconSetNames[static_cast<std::size_t>(n)];
 }
 
 std::string_view TimePeriodToString(cf::TimePeriod p) {
@@ -237,12 +203,22 @@ std::string EncodeSqref(const std::vector<cf::CFCellRange>& ranges) {
   return out;
 }
 
-void AppendColor(std::string& out, cf::Color c) {
-  char buf[16];
-  std::snprintf(buf, sizeof(buf), "%02X%02X%02X%02X", c.a, c.r, c.g, c.b);
-  out.append("<color rgb=\"");
-  out.append(buf);
-  out.append("\"/>");
+/// Emits the colour attributes: `theme` / `indexed` / `auto` as written, else
+/// the literal `rgb`.
+void AppendColorAttrs(std::string& out, const cf::Color& c) {
+  const std::uint32_t argb = (static_cast<std::uint32_t>(c.a) << 24U) | (static_cast<std::uint32_t>(c.r) << 16U) |
+                             (static_cast<std::uint32_t>(c.g) << 8U) | static_cast<std::uint32_t>(c.b);
+  ColorSpec spec = c.spec;
+  if (spec.kind == ColorSpec::Kind::kRgb) {
+    spec.kind = ColorSpec::Kind::kNone;  // The literal channels are authoritative for rgb.
+  }
+  io::append_color_spec_attrs(out, spec, argb);
+}
+
+void AppendColor(std::string& out, const cf::Color& c) {
+  out.append("<color");
+  AppendColorAttrs(out, c);
+  out.append("/>");
 }
 
 void AppendCfvo(std::string& out, const cf::CfValueObject& v) {
@@ -398,14 +374,11 @@ void AppendRuleExtLst(std::string& out, const cf::CFRule& r) {
 /// Emits one x14 colour element. The x14 schema names each colour slot
 /// with its own element rather than reusing `<color>`, so the element
 /// name is a parameter here where `AppendColor` can hard-code it.
-void AppendX14Color(std::string& out, std::string_view element, cf::Color c) {
-  char buf[16];
-  std::snprintf(buf, sizeof(buf), "%02X%02X%02X%02X", c.a, c.r, c.g, c.b);
+void AppendX14Color(std::string& out, std::string_view element, const cf::Color& c) {
   out.push_back('<');
   out.append(element);
-  out.append(" rgb=\"");
-  out.append(buf);
-  out.append("\"/>");
+  AppendColorAttrs(out, c);
+  out.append("/>");
 }
 
 /// Emits one `<x14:cfvo>`, mirroring the legacy `<cfvo>` it accompanies.
@@ -571,7 +544,7 @@ void AppendCfRule(std::string& out, const cf::CFRule& r, std::size_t dxf_count)
     }
     if (r.std_dev.has_value()) {
       char buf[32];
-      std::snprintf(buf, sizeof(buf), "%g", r.std_dev.value());
+      format_general(buf, sizeof(buf), r.std_dev.value(), 6);
       out.append(" stdDev=\"");
       out.append(buf);
       out.push_back('"');
diff --git a/src/io/color_spec_xml.cpp b/src/io/color_spec_xml.cpp
new file mode 100644
index 000000000..ddd5c1a43
--- /dev/null
+++ b/src/io/color_spec_xml.cpp
@@ -0,0 +1,71 @@
+#include "io/color_spec_xml.h"
+
+#include "io/xml_utils.h"
+#include "utils/number_text.h"
+
+namespace formulon {
+namespace io {
+
+ColorSpec read_color_spec(const pugi::xml_node& node) {
+  ColorSpec spec;
+  if (!node) {
+    return spec;
+  }
+  if (pugi::xml_attribute rgb = node.attribute("rgb"); rgb) {
+    spec.kind = ColorSpec::Kind::kRgb;
+    spec.rgb = parse_rgb_hex(rgb.value(), 0xFF000000U);
+    return spec;
+  }
+  if (pugi::xml_attribute theme = node.attribute("theme"); theme) {
+    spec.kind = ColorSpec::Kind::kTheme;
+    spec.theme = theme.as_uint(0U);
+    // Signed by design (ECMA-376 bounds it to [-1.0, 1.0]); attr_f64 rejects NaN and infinity.
+    spec.tint = attr_f64(node, "tint", 0.0);
+    return spec;
+  }
+  if (pugi::xml_attribute indexed = node.attribute("indexed"); indexed) {
+    spec.kind = ColorSpec::Kind::kIndexed;
+    spec.indexed = indexed.as_uint(0U);
+    return spec;
+  }
+  if (node.attribute("auto")) {
+    spec.kind = ColorSpec::Kind::kAuto;
+  }
+  return spec;
+}
+
+void append_color_spec_attrs(std::string& out, const ColorSpec& spec, std::uint32_t fallback_argb) {
+  char buf[24];
+  switch (spec.kind) {
+    case ColorSpec::Kind::kTheme:
+      format_unsigned(buf, sizeof(buf), spec.theme);
+      out.append(" theme=\"");
+      out.append(buf);
+      out.push_back('"');
+      if (spec.tint != 0.0) {
+        out.append(" tint=\"");
+        append_xml_number(out, spec.tint);
+        out.push_back('"');
+      }
+      return;
+    case ColorSpec::Kind::kIndexed:
+      format_unsigned(buf, sizeof(buf), spec.indexed);
+      out.append(" indexed=\"");
+      out.append(buf);
+      out.push_back('"');
+      return;
+    case ColorSpec::Kind::kAuto:
+      out.append(" auto=\"1\"");
+      return;
+    case ColorSpec::Kind::kRgb:
+    case ColorSpec::Kind::kNone:
+      break;
+  }
+  format_hex(buf, sizeof(buf), spec.kind == ColorSpec::Kind::kRgb ? spec.rgb : fallback_argb, 8, true);
+  out.append(" rgb=\"");
+  out.append(buf);
+  out.push_back('"');
+}
+
+}  // namespace io
+}  // namespace formulon
diff --git a/src/io/color_spec_xml.h b/src/io/color_spec_xml.h
new file mode 100644
index 000000000..d3bc2057b
--- /dev/null
+++ b/src/io/color_spec_xml.h
@@ -0,0 +1,28 @@
+//
+// Read and write OOXML colour elements (rgb, theme and tint, indexed, auto) as ColorSpec.
+
+#ifndef FORMULON_IO_COLOR_SPEC_XML_H_
+#define FORMULON_IO_COLOR_SPEC_XML_H_
+
+#include <cstdint>
+#include <string>
+
+#include "pugixml.hpp"
+#include "styles.h"
+
+namespace formulon {
+namespace io {
+
+/// Reads the colour attributes of a `<color>`-like element (`color`, `fgColor`,
+/// `bgColor`, ...). Precedence is `rgb`, `theme` (+ `tint`), `indexed`, `auto`.
+/// Returns `kNone` when the node is absent or carries none of them.
+ColorSpec read_color_spec(const pugi::xml_node& node);
+
+/// Appends the colour attributes (with a leading space) for `spec`. A `kNone`
+/// spec emits `rgb="<fallback_argb>"`; every other kind is authoritative.
+void append_color_spec_attrs(std::string& out, const ColorSpec& spec, std::uint32_t fallback_argb);
+
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_COLOR_SPEC_XML_H_
diff --git a/src/io/comments_reader.cpp b/src/io/comments_reader.cpp
index 1217d6adf..0bb775c60 100644
--- a/src/io/comments_reader.cpp
+++ b/src/io/comments_reader.cpp
@@ -64,6 +64,7 @@ Expected<std::vector<CellComment>, Error> read_comments(const std::vector<std::u
     if (author_id >= 0 && static_cast<std::size_t>(author_id) < authors.size()) {
       cc.author = authors[static_cast<std::size_t>(author_id)];
     }
+    cc.uid = c.attribute("xr:uid").value();
     if (pugi::xml_node text = c.child("text"); text) {
       // Comment XML never carries `<rPh>` in practice (kana phonetic
       // guides only attach to shared-string entries), so the unified
diff --git a/src/io/comments_writer.cpp b/src/io/comments_writer.cpp
index eb4881bdb..041ee4a0e 100644
--- a/src/io/comments_writer.cpp
+++ b/src/io/comments_writer.cpp
@@ -5,9 +5,12 @@
 
 #include "io/comments_writer.h"
 
+#include <algorithm>
+#include <cstddef>
 #include <cstdint>
 #include <string>
 #include <unordered_map>
+#include <utility>
 #include <vector>
 
 #include "io/xml_escape.h"
@@ -45,7 +48,17 @@ std::string write_comments(const std::vector<CellComment>& comments) {
   std::string out;
   out.reserve(256 + comments.size() * 96 + authors.size() * 32);
   out.append(kXmlDecl);
-  out.append("<comments xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n");
+  bool any_uid = false;
+  for (const CellComment& c : comments) {
+    any_uid = any_uid || !c.uid.empty();
+  }
+  out.append("<comments xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"");
+  if (any_uid) {
+    out.append(
+        " xmlns:mc=\"http://schemas.openxmlformats.org/markup-compatibility/2006\" mc:Ignorable=\"xr\""
+        " xmlns:xr=\"http://schemas.microsoft.com/office/spreadsheetml/2014/revision\"");
+  }
+  out.append(">\n");
   out.append("  <authors>\n");
   for (const std::string& a : authors) {
     out.append("    <author>");
@@ -59,7 +72,11 @@ std::string write_comments(const std::vector<CellComment>& comments) {
     AppendCellRef(out, c.row, c.col);
     out.append("\" authorId=\"");
     out.append(std::to_string(author_index[c.author]));
-    out.append("\">\n");
+    out.push_back('"');
+    if (!c.uid.empty()) {
+      append_xml_attr(out, "xr:uid", c.uid);
+    }
+    out.append(">\n");
     out.append("      <text><r><t xml:space=\"preserve\">");
     AppendXmlEscaped(out, c.text);
     out.append("</t></r></text>\n");
@@ -70,26 +87,66 @@ std::string write_comments(const std::vector<CellComment>& comments) {
   return out;
 }
 
-std::string write_vml_drawing_stub() {
-  // Minimal but well-formed VML payload. The shape has no visible
-  // styling — Excel regenerates per-comment shapes on first edit. The
-  // namespaces match the canonical Excel emission so older parsers
-  // recognise the document.
+std::string write_vml_drawing(const std::vector<std::pair<std::uint32_t, std::uint32_t>>& anchors,
+                              std::uint32_t drawing_id) {
   std::string out;
-  out.reserve(384);
+  out.reserve(512 + anchors.size() * 640);
   out.append("<xml xmlns:v=\"urn:schemas-microsoft-com:vml\"\n");
-  out.append("     xmlns:o=\"urn:schemas-microsoft-com:office:office\"\n");
-  out.append("     xmlns:x=\"urn:schemas-microsoft-com:office:excel\">\n");
-  out.append("  <o:shapelayout v:ext=\"edit\">\n");
-  out.append("    <o:idmap v:ext=\"edit\" data=\"1\"/>\n");
-  out.append("  </o:shapelayout>\n");
-  out.append("  <v:shapetype id=\"_x0000_t202\" coordsize=\"21600,21600\" o:spt=\"202\"\n");
-  out.append("               path=\"m,l,21600r21600,l21600,xe\">\n");
-  out.append("    <v:stroke joinstyle=\"miter\"/>\n");
-  out.append("    <v:path gradientshapeok=\"t\" o:connecttype=\"rect\"/>\n");
-  out.append("  </v:shapetype>\n");
+  out.append(" xmlns:o=\"urn:schemas-microsoft-com:office:office\"\n");
+  out.append(" xmlns:x=\"urn:schemas-microsoft-com:office:excel\">\n");
+  out.append(" <o:shapelayout v:ext=\"edit\">\n");
+  out.append("  <o:idmap v:ext=\"edit\" data=\"");
+  out.append(std::to_string(drawing_id));
+  out.append("\"/>\n");
+  out.append(" </o:shapelayout>\n");
+  out.append(" <v:shapetype id=\"_x0000_t202\" coordsize=\"21600,21600\" o:spt=\"202\"\n");
+  out.append("  path=\"m,l,21600r21600,l21600,xe\">\n");
+  out.append("  <v:stroke joinstyle=\"miter\"/>\n");
+  out.append("  <v:path gradientshapeok=\"t\" o:connecttype=\"rect\"/>\n");
+  out.append(" </v:shapetype>\n");
+  const std::uint64_t first_shape = static_cast<std::uint64_t>(drawing_id) * 1024U + 1U;
+  for (std::size_t i = 0; i < anchors.size(); ++i) {
+    const std::uint32_t row = anchors[i].first;
+    const std::uint32_t col = anchors[i].second;
+    // Excel's default note box: two columns wide, four rows tall, offset
+    // one column right of the cell and starting a row above it.
+    const std::uint32_t left = std::min(col + 1U, Sheet::kMaxCols - 1U);
+    const std::uint32_t right = std::min(col + 3U, Sheet::kMaxCols - 1U);
+    const std::uint32_t top = row == 0U ? 0U : row - 1U;
+    const std::uint32_t bottom = std::min(top + 4U, Sheet::kMaxRows - 1U);
+    out.append(" <v:shape id=\"_x0000_s");
+    out.append(std::to_string(first_shape + i));
+    out.append("\" type=\"#_x0000_t202\" style=\"position:absolute;width:108pt;height:59.25pt;z-index:");
+    out.append(std::to_string(i + 1U));
+    out.append(";visibility:hidden\" fillcolor=\"#ffffe1\" o:insetmode=\"auto\">\n");
+    out.append("  <v:fill color2=\"#ffffe1\"/>\n");
+    out.append("  <v:shadow on=\"t\" color=\"black\" obscured=\"t\"/>\n");
+    out.append("  <v:path o:connecttype=\"none\"/>\n");
+    out.append("  <v:textbox style=\"mso-direction-alt:auto\"><div style=\"text-align:left\"></div></v:textbox>\n");
+    out.append("  <x:ClientData ObjectType=\"Note\">\n");
+    out.append("   <x:MoveWithCells/>\n");
+    out.append("   <x:SizeWithCells/>\n");
+    out.append("   <x:Anchor>");
+    out.append(std::to_string(left)).append(", 15, ");
+    out.append(std::to_string(top)).append(row == 0U ? ", 2, " : ", 10, ");
+    out.append(std::to_string(right)).append(", 15, ");
+    out.append(std::to_string(bottom)).append(", 4</x:Anchor>\n");
+    out.append("   <x:AutoFill>False</x:AutoFill>\n");
+    out.append("   <x:Row>");
+    out.append(std::to_string(row));
+    out.append("</x:Row>\n");
+    out.append("   <x:Column>");
+    out.append(std::to_string(col));
+    out.append("</x:Column>\n");
+    out.append("  </x:ClientData>\n");
+    out.append(" </v:shape>\n");
+  }
   out.append("</xml>\n");
   return out;
 }
 
+std::string write_vml_drawing_stub() {
+  return write_vml_drawing({}, 1U);
+}
+
 }  // namespace formulon::io
diff --git a/src/io/comments_writer.h b/src/io/comments_writer.h
index 59b98e8c4..2874749db 100644
--- a/src/io/comments_writer.h
+++ b/src/io/comments_writer.h
@@ -1,21 +1,21 @@
 //
-// Writer for `xl/comments<N>.xml`. Emits the modern shape with an
-// inline author table plus a flat `<commentList>` of `<comment>`
-// elements (one per `CellComment`). Rich-text fidelity is intentionally
-// dropped: each comment is emitted as a single `<r><t>...</t></r>` run.
+// Writer for `xl/comments<N>.xml` and its legacy VML drawing. Emits the
+// modern shape with an inline author table plus a flat `<commentList>` of
+// `<comment>` elements (one per `CellComment`). Rich-text fidelity is
+// intentionally dropped: each comment is emitted as a single
+// `<r><t>...</t></r>` run.
 //
-// The writer also produces a minimal VML drawing stub for legacy Excel
-// compatibility: the bytes describe a single transparent shape at the
-// origin so Excel won't reject the package, and the actual per-comment
-// bounding boxes are left to be regenerated by Excel on first save.
-// VML round-trip from non-trivial sources is out of scope; the
-// passthrough mechanism on the workbook handles preservation when the
-// reader carries the original bytes through.
+// The VML drawing carries one hidden note shape per commented cell, which
+// is what Excel needs to show the comment indicator. The OOXML writer
+// re-emits a sheet's source VML verbatim while its comment anchors are
+// unchanged and regenerates it with `write_vml_drawing` otherwise.
 
 #ifndef FORMULON_IO_COMMENTS_WRITER_H_
 #define FORMULON_IO_COMMENTS_WRITER_H_
 
+#include <cstdint>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "sheet.h"
@@ -26,14 +26,18 @@ namespace formulon::io {
 /// document. The author table is built from the unique `author` strings
 /// present in `comments` (in first-occurrence order); each `<comment>`
 /// references its author by index. Empty `comments` returns the empty
-/// string — the writer must NOT emit an empty comments part.
+/// string — the writer must NOT emit an empty comments part. A non-empty
+/// `uid` is written as the comment's `xr:uid` attribute.
 std::string write_comments(const std::vector<CellComment>& comments);
 
-/// Produces a minimal VML drawing stub. Excel requires the part to
-/// exist whenever a sheet has comments, but the bounding-box detail is
-/// optional in modern viewers. We emit a single placeholder shape so
-/// older renderers don't choke; layout is regenerated by Excel on the
-/// first edit.
+/// Serialises a VML drawing with one hidden note shape per `(row, col)` in
+/// `anchors`. `drawing_id` (1-based, unique per package) sets the shape-id
+/// block: `<o:idmap data>` is `drawing_id` and shapes are numbered from
+/// `1024 * drawing_id + 1`.
+std::string write_vml_drawing(const std::vector<std::pair<std::uint32_t, std::uint32_t>>& anchors,
+                              std::uint32_t drawing_id);
+
+/// A VML drawing with no shapes (`write_vml_drawing({}, 1)`).
 std::string write_vml_drawing_stub();
 
 }  // namespace formulon::io
diff --git a/src/io/iso_date.cpp b/src/io/iso_date.cpp
index c2689e4fb..43506eb1d 100644
--- a/src/io/iso_date.cpp
+++ b/src/io/iso_date.cpp
@@ -55,6 +55,33 @@ int DaysInMonth(int year, int month) noexcept {
   return kDaysInMonth[month - 1];
 }
 
+// ISO 8601 permits a UTC marker or a signed hour/minute offset. Excel keeps
+// the wall-clock value, so the validated offset is intentionally ignored.
+bool TakeTimezoneSuffix(std::string_view s, std::size_t* pos) noexcept {
+  if (*pos >= s.size()) {
+    return true;
+  }
+  if (s[*pos] == 'Z' || s[*pos] == 'z') {
+    ++(*pos);
+    return true;
+  }
+  if (s[*pos] != '+' && s[*pos] != '-') {
+    return false;
+  }
+  ++(*pos);
+  int tz_h = 0;
+  int tz_m = 0;
+  if (!TakeDigits(s, pos, 2, &tz_h) || !TakeChar(s, pos, ':') || !TakeDigits(s, pos, 2, &tz_m)) {
+    return false;
+  }
+  // OOXML's XSD timezone range ends at fourteen hours; 14:00 is the only valid
+  // offset at that boundary. Minutes are always below 60.
+  if (tz_m >= 60) {
+    return false;
+  }
+  return tz_h < 14 || (tz_h == 14 && tz_m == 0);
+}
+
 }  // namespace
 
 bool parse_iso_date_serial(std::string_view text, double* out_serial) noexcept {
@@ -76,12 +103,8 @@ bool parse_iso_date_serial(std::string_view text, double* out_serial) noexcept {
 
   double serial = date_time::serial_from_ymd(year, static_cast<unsigned>(month), static_cast<unsigned>(day));
 
-  if (pos < text.size()) {
-    // A time component must follow, introduced by 'T' (strict OOXML) or a
-    // space (lenient producers). Reject anything else.
-    if (text[pos] != 'T' && text[pos] != 't' && text[pos] != ' ') {
-      return false;
-    }
+  if (pos < text.size() && (text[pos] == 'T' || text[pos] == 't' || text[pos] == ' ')) {
+    // A time component follows 'T' (strict OOXML) or a space (lenient producers).
     ++pos;
     int hour = 0;
     int minute = 0;
@@ -113,23 +136,13 @@ bool parse_iso_date_serial(std::string_view text, double* out_serial) noexcept {
       }
     }
     serial += frac;
+  }
 
-    // Optional time-zone designator: 'Z' or '(+|-)hh:mm'. Excel stores a
-    // wall-clock serial, so the offset is accepted but not applied.
-    if (pos < text.size()) {
-      if (text[pos] == 'Z' || text[pos] == 'z') {
-        ++pos;
-      } else if (text[pos] == '+' || text[pos] == '-') {
-        ++pos;
-        int tz_h = 0;
-        int tz_m = 0;
-        if (!TakeDigits(text, &pos, 2, &tz_h) || !TakeChar(text, &pos, ':') || !TakeDigits(text, &pos, 2, &tz_m)) {
-          return false;
-        }
-      } else {
-        return false;
-      }
-    }
+  // Optional time-zone designator: 'Z' or '(+|-)hh:mm'. Excel stores a
+  // wall-clock serial, so the offset is accepted but not applied. This is
+  // shared by date-only and date-time forms.
+  if (!TakeTimezoneSuffix(text, &pos)) {
+    return false;
   }
 
   if (pos != text.size()) {
diff --git a/src/io/ooxml/emission_plan.cpp b/src/io/ooxml/emission_plan.cpp
index 317bf7ab9..80fd83758 100644
--- a/src/io/ooxml/emission_plan.cpp
+++ b/src/io/ooxml/emission_plan.cpp
@@ -42,7 +42,11 @@ std::string NumberedPartPath(std::string_view prefix, std::uint32_t id, std::str
 }
 
 bool HasPassthroughPart(const EmissionPlan& plan, std::string_view path) {
-  for (const PassthroughPart* part : plan.passthrough_kept) {
+  return HasPassthroughPart(plan.passthrough_kept, path);
+}
+
+bool HasPassthroughPart(const std::vector<const PassthroughPart*>& passthrough_kept, std::string_view path) {
+  for (const PassthroughPart* part : passthrough_kept) {
     if (part != nullptr && part->path == path) {
       return true;
     }
@@ -113,6 +117,12 @@ std::unordered_set<std::string> BuildGeneratedPathSet(
     }
     paths.insert(c.comments_path);
     paths.insert(c.vml_path);
+    if (!c.threaded_path.empty()) {
+      paths.insert(c.threaded_path);
+    }
+  }
+  if (!wb.persons().empty()) {
+    paths.insert(std::string(kPersonsPartPath));
   }
   // Per-link rels files for external links — the writer generates these
   // from the captured `ExternalLinkRecord`s; the body parts themselves
@@ -159,6 +169,7 @@ std::string_view EffectiveContentType(const Workbook& wb, const PassthroughPart&
 EmissionPlan BuildEmissionPlan(const Workbook& wb, bool generated_shared_strings, WriteDiagnostics* diagnostics) {
   EmissionPlan plan;
   plan.generated_shared_strings = generated_shared_strings;
+  plan.generated_persons = !wb.persons().empty();
   plan.tables_by_sheet.assign(wb.sheet_count(), {});
 
   // Distribute tables to their owning sheets, assigning fallback
@@ -269,9 +280,11 @@ EmissionPlan BuildEmissionPlan(const Workbook& wb, bool generated_shared_strings
   }
 
   // Comments / VML parts. One package-wide numeric counter; each sheet
-  // with at least one comment gets a `comments<N>.xml` and a matching
-  // `vmlDrawing<N>.vml`. The numeric id matches between the two so the
-  // sheet rels file pairs them by ordinal.
+  // with at least one note or thread gets a `comments<N>.xml` and a
+  // matching `vmlDrawing<N>.vml` (a thread is also written as a legacy
+  // stub note), plus `threadedComment<N>.xml` when it has threads. The
+  // numeric id matches between them so the sheet rels file pairs them by
+  // ordinal.
   //
   // A vmlDrawing target still named by some sheet's `unknown_relationships()`
   // (for example a `<legacyDrawingHF>` header/footer VML preserved
@@ -296,7 +309,8 @@ EmissionPlan BuildEmissionPlan(const Workbook& wb, bool generated_shared_strings
   plan.comments_by_sheet.assign(wb.sheet_count(), EmissionPlan::CommentsPlan{});
   std::uint32_t next_comments_id = 1;
   for (std::size_t s = 0; s < wb.sheet_count(); ++s) {
-    if (wb.sheet(s).comments().empty()) {
+    const Sheet& sheet = wb.sheet(s);
+    if (sheet.comments().empty() && sheet.threaded_comments().empty()) {
       continue;
     }
     while (retained_paths.count(NumberedPartPath("xl/drawings/vmlDrawing", next_comments_id, ".vml")) != 0U) {
@@ -306,14 +320,20 @@ EmissionPlan BuildEmissionPlan(const Workbook& wb, bool generated_shared_strings
     entry.numeric_id = next_comments_id++;
     entry.comments_path = NumberedPartPath("xl/comments", entry.numeric_id, ".xml");
     entry.vml_path = NumberedPartPath("xl/drawings/vmlDrawing", entry.numeric_id, ".vml");
+    if (!sheet.threaded_comments().empty()) {
+      entry.threaded_path = NumberedPartPath("xl/threadedComments/threadedComment", entry.numeric_id, ".xml");
+    }
     // Detect whether this sheet still carries its original VML bytes. Do
     // not infer the source from a newly assigned output number: removing a
     // preceding commented sheet renumbers output parts but must not discard
-    // the surviving sheet's shape geometry.
-    for (const PassthroughPart& part : wb.passthrough_parts()) {
-      if (!wb.sheet(s).comment_vml_path().empty() && part.path == wb.sheet(s).comment_vml_path()) {
-        entry.vml_source = &part;
-        break;
+    // the surviving sheet's shape geometry. Bytes whose shapes no longer
+    // match the comment anchors are regenerated instead.
+    if (!sheet.comment_vml_path().empty() && sheet.comment_vml_anchors() == sheet.comment_anchor_set()) {
+      for (const PassthroughPart& part : wb.passthrough_parts()) {
+        if (part.path == sheet.comment_vml_path()) {
+          entry.vml_source = &part;
+          break;
+        }
       }
     }
     plan.comments_by_sheet[s] = std::move(entry);
diff --git a/src/io/ooxml/emission_plan.h b/src/io/ooxml/emission_plan.h
index 18664eaea..29a456bdf 100644
--- a/src/io/ooxml/emission_plan.h
+++ b/src/io/ooxml/emission_plan.h
@@ -78,6 +78,8 @@ struct EmissionPlan {
   // True when the writer generates xl/metadata.xml (the XLDAPR entry a
   // dynamic-array formula's `cm=` names) because no retained part carries it.
   bool generated_dynamic_metadata = false;
+  // True when the writer generates `kPersonsPartPath` from `Workbook::persons()`.
+  bool generated_persons = false;
   // For each sheet (by 0-based index), the in-source TableMetadata
   // entries that target it, paired with the package-relative path the
   // writer assigned (`xl/tables/tableN.xml`). `(table_ref, path)` is
@@ -124,16 +126,18 @@ struct EmissionPlan {
   std::vector<std::vector<PivotTablePlan>> pivot_tables_by_sheet;
   // Per-sheet comments / VML payload. `numeric_id` matches the
   // `comments<N>.xml` filename (1-based, package-wide). `vml_path` is
-  // the per-sheet VML drawing path, emitted as a stub when the source
-  // had none and as passthrough bytes otherwise.
+  // the per-sheet VML drawing path: the source bytes are re-emitted
+  // verbatim while the sheet's comment anchors match the ones they were
+  // read with, and the drawing is regenerated from the model otherwise.
   struct CommentsPlan {
     std::uint32_t numeric_id = 0;
     std::string comments_path;                    // "xl/comments<N>.xml"
     std::string vml_path;                         // "xl/drawings/vmlDrawing<N>.vml"
+    std::string threaded_path;                    // "xl/threadedComments/threadedComment<N>.xml", or empty
     const PassthroughPart* vml_source = nullptr;  // non-null => use bytes verbatim
   };
   // One entry per sheet; engaged only for sheets with at least one
-  // comment. Disengaged entries have `numeric_id == 0`.
+  // note or thread. Disengaged entries have `numeric_id == 0`.
   std::vector<CommentsPlan> comments_by_sheet;
   // External link relationships. One entry per `wb.external_links()` in
   // document order. `workbook_rid` is the writer-assigned rId integer
@@ -158,6 +162,9 @@ struct EmissionPlan {
   std::vector<SheetRelsResult> sheet_rels;
 };
 
+/// Package path of the generated person list.
+inline constexpr std::string_view kPersonsPartPath = "xl/persons/person.xml";
+
 /// Builds the emission plan. Performs collision detection between
 /// generated and passthrough paths; collisions are logged via
 /// `StructuredLog` (warn) and the passthrough copy is dropped.
@@ -179,6 +186,10 @@ std::string NumberedPartPath(std::string_view prefix, std::uint32_t id, std::str
 /// calcChain, sharedStrings, ...).
 bool HasPassthroughPart(const EmissionPlan& plan, std::string_view path);
 
+/// Same as above over a bare kept-part list; shared with the XLSB writer,
+/// whose emission plan carries the same list.
+bool HasPassthroughPart(const std::vector<const PassthroughPart*>& passthrough_kept, std::string_view path);
+
 /// True when `content_type` names a part whose body is a stream of
 /// MS-XLSB binary records rather than XML.
 ///
diff --git a/src/io/ooxml/part_dom.cpp b/src/io/ooxml/part_dom.cpp
new file mode 100644
index 000000000..f857b8891
--- /dev/null
+++ b/src/io/ooxml/part_dom.cpp
@@ -0,0 +1,43 @@
+#include "io/ooxml/part_dom.h"
+
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "io/xml_utils.h"
+#include "passthrough_part.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace ooxml {
+
+const PassthroughPart* find_passthrough_part(const Workbook& wb, std::string_view path) {
+  for (const PassthroughPart& part : wb.passthrough_parts()) {
+    if (part.path == path) {
+      return &part;
+    }
+  }
+  return nullptr;
+}
+
+Expected<void, Error> load_part_dom(const Workbook& wb, std::string_view path, std::string_view reader_module,
+                                    pugi::xml_document& doc) {
+  const PassthroughPart* part = find_passthrough_part(wb, path);
+  if (part == nullptr) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "part_dom: no such part", "part=" + std::string(path));
+  }
+  return load_xml_buffer(doc, part->bytes, reader_module, path);
+}
+
+Expected<void, Error> store_part_dom(Workbook& wb, std::string_view path, const pugi::xml_document& doc) {
+  std::string xml = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n";
+  append_raw_xml(xml, doc.document_element());
+  return wb.replace_passthrough_part(path, std::vector<std::uint8_t>(xml.begin(), xml.end()));
+}
+
+}  // namespace ooxml
+}  // namespace io
+}  // namespace formulon
diff --git a/src/io/ooxml/part_dom.h b/src/io/ooxml/part_dom.h
new file mode 100644
index 000000000..4d1ab5b7b
--- /dev/null
+++ b/src/io/ooxml/part_dom.h
@@ -0,0 +1,54 @@
+//
+// Load, edit and re-serialize one XML package part through a single pugixml document.
+//
+// A part the engine edits without modelling it (the theme, threaded comments,
+// drawings) lives in `Workbook::passthrough_parts()` as raw bytes. Editing one
+// is always the same three steps: parse the bytes with the standard part parse
+// flags, mutate the DOM, and write it back as an XML declaration followed by
+// the raw (unindented) root element. These functions own the first and last
+// step so every such edit parses and serializes identically:
+//
+//   pugi::xml_document doc;
+//   RETURN_IF_ERROR(io::ooxml::load_part_dom(wb, path, "theme", doc));
+//   ... mutate doc ...
+//   return io::ooxml::store_part_dom(wb, path, doc);
+//
+// Creating an absent part (and registering its relationship) stays with the
+// caller, since the content type and the owning relationship differ per part.
+
+#ifndef FORMULON_IO_OOXML_PART_DOM_H_
+#define FORMULON_IO_OOXML_PART_DOM_H_
+
+#include <string_view>
+
+#include "pugixml.hpp"
+#include "utils/expected.h"
+
+namespace formulon {
+
+class Workbook;
+struct PassthroughPart;
+
+namespace io {
+namespace ooxml {
+
+/// Returns the passthrough part stored at package path `path`, or NULL.
+const PassthroughPart* find_passthrough_part(const Workbook& wb, std::string_view path);
+
+/// Parses the passthrough part at `path` into `doc` with the standard part
+/// parse flags. `reader_module` names the caller in a parse error's context.
+/// Fails with `kInvalidArgument` when no such part exists and with
+/// `kIoXmlParse` when its bytes are not well-formed XML.
+Expected<void, Error> load_part_dom(const Workbook& wb, std::string_view path, std::string_view reader_module,
+                                    pugi::xml_document& doc);
+
+/// Serializes `doc` as the standalone UTF-8 XML declaration plus its root
+/// element in raw form and replaces the bytes of the passthrough part at
+/// `path`. Fails with `kInvalidArgument` when no such part exists.
+Expected<void, Error> store_part_dom(Workbook& wb, std::string_view path, const pugi::xml_document& doc);
+
+}  // namespace ooxml
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_OOXML_PART_DOM_H_
diff --git a/src/io/ooxml/print_settings_parse.cpp b/src/io/ooxml/print_settings_parse.cpp
index 314393461..4ab19d8c3 100644
--- a/src/io/ooxml/print_settings_parse.cpp
+++ b/src/io/ooxml/print_settings_parse.cpp
@@ -41,6 +41,10 @@ void apply_structured_page_setup(const pugi::xml_node& page_setup, PageSetup& ou
   if (pugi::xml_attribute attr = page_setup.attribute("fitToHeight"); attr) {
     out.fit_to_height = static_cast<std::uint32_t>(attr.as_uint(out.fit_to_height));
   }
+  if (pugi::xml_attribute attr = page_setup.attribute("pageOrder"); attr) {
+    out.page_order =
+        std::string_view(attr.value()) == "overThenDown" ? PageOrder::kOverThenDown : PageOrder::kDownThenOver;
+  }
 }
 
 void apply_structured_page_margins(const pugi::xml_node& page_margins, PageMargins& out) {
@@ -134,6 +138,7 @@ void refresh_structured_views(std::string_view element_name, std::string_view fr
     settings.page_setup.scale = defaults.scale;
     settings.page_setup.fit_to_width = defaults.fit_to_width;
     settings.page_setup.fit_to_height = defaults.fit_to_height;
+    settings.page_setup.page_order = defaults.page_order;
   } else if (is_page_margins) {
     settings.page_margins = PageMargins{};
   } else {
diff --git a/src/io/ooxml/relationship_writer.cpp b/src/io/ooxml/relationship_writer.cpp
index 884b50c5f..eb7d8aa6f 100644
--- a/src/io/ooxml/relationship_writer.cpp
+++ b/src/io/ooxml/relationship_writer.cpp
@@ -13,12 +13,14 @@
 namespace formulon {
 namespace io {
 
-std::string_view WithoutXlPrefix(std::string_view path) {
+std::string TargetRelativeToWorkbook(std::string_view path) {
   constexpr std::string_view kXlPrefix = "xl/";
   if (path.size() >= kXlPrefix.size() && path.substr(0, kXlPrefix.size()) == kXlPrefix) {
-    path.remove_prefix(kXlPrefix.size());
+    return std::string(path.substr(kXlPrefix.size()));
   }
-  return path;
+  std::string out("../");
+  out.append(path);
+  return out;
 }
 
 std::string TargetRelativeToWorksheet(std::string_view package_path) {
@@ -29,7 +31,8 @@ std::string TargetRelativeToWorksheet(std::string_view package_path) {
     out.append(package_path.substr(kXlPrefix.size()));
     return out;
   }
-  out.assign(package_path);
+  out.assign("../../");
+  out.append(package_path);
   return out;
 }
 
@@ -50,7 +53,7 @@ void AppendRelationship(std::string& out, std::string_view id, std::string_view
   out.append("  <Relationship Id=\"");
   AppendXmlAttrEscaped(out, id);
   out.append("\" Type=\"");
-  out.append(type);
+  AppendXmlAttrEscaped(out, type);
   out.append("\" Target=\"");
   if (escape_target) {
     // `Target` is an `xsd:anyURI` the rels reader takes verbatim from the
diff --git a/src/io/ooxml/relationship_writer.h b/src/io/ooxml/relationship_writer.h
index 92ba7ea89..a905f440e 100644
--- a/src/io/ooxml/relationship_writer.h
+++ b/src/io/ooxml/relationship_writer.h
@@ -26,15 +26,19 @@ namespace io {
 // Path-shaping helpers
 // ---------------------------------------------------------------------------
 
-/// Strips a leading `"xl/"` segment when present; the value is returned
-/// as a view into the original path. Used to convert package paths
-/// into the relative form Excel emits for workbook-level relationships.
-std::string_view WithoutXlPrefix(std::string_view path);
+/// Builds the `Target=` value for a workbook rels file. Package parts below
+/// `xl/` lose that leading segment because the rels file lives in `xl/`;
+/// package-root parts step out of that directory with `../` (for example,
+/// `customXml/item1.xml` becomes `../customXml/item1.xml`). The returned
+/// string owns its storage so callers cannot retain a view into a temporary.
+std::string TargetRelativeToWorkbook(std::string_view package_path);
 
 /// Builds the `Target=` value for a worksheet rels file: prefixes the
 /// path with `"../"` so it resolves against the `xl/worksheets/`
 /// directory (e.g. `"xl/printerSettings/printerSettings1.bin"` ->
-/// `"../printerSettings/printerSettings1.bin"`).
+/// `"../printerSettings/printerSettings1.bin"`); package-root parts use
+/// `"../../"` (e.g. `"customXml/item1.xml"` ->
+/// `"../../customXml/item1.xml"`).
 std::string TargetRelativeToWorksheet(std::string_view package_path);
 
 // ---------------------------------------------------------------------------
@@ -50,7 +54,8 @@ std::string TargetRelativeToWorksheet(std::string_view package_path);
 void AppendOverride(std::string& out, std::string_view path, std::string_view ct, bool escape_path = false);
 
 /// Appends a single `<Relationship Id="<id>" Type="<type>"
-/// Target="<target>"/>` entry plus its trailing newline.
+/// Target="<target>"/>` entry plus its trailing newline. `id` and `type` are
+/// always attribute-escaped; `target` only with `escape_target`.
 void AppendRelationship(std::string& out, std::string_view id, std::string_view type, std::string_view target,
                         bool target_external = false, bool escape_target = false);
 
diff --git a/src/io/ooxml/shared_strings_writer.cpp b/src/io/ooxml/shared_strings_writer.cpp
index 6198c80e0..07725212d 100644
--- a/src/io/ooxml/shared_strings_writer.cpp
+++ b/src/io/ooxml/shared_strings_writer.cpp
@@ -21,8 +21,8 @@
 namespace formulon {
 namespace io {
 
-std::string SharedStrings::key_for(std::string_view text, const std::vector<PhoneticRun>& phonetic,
-                                   PhoneticProperties phonetic_props) {
+std::string SharedStringKey(std::string_view text, const std::vector<PhoneticRun>& phonetic,
+                            PhoneticProperties phonetic_props) {
   std::string key;
   key.reserve(text.size() + 32U + phonetic.size() * 16U);
   key.append(std::to_string(text.size()));
@@ -55,7 +55,7 @@ std::string SharedStrings::key_for(std::string_view text, const std::vector<Phon
 std::uint32_t SharedStrings::intern(std::string_view text, const std::vector<PhoneticRun>& phonetic,
                                     PhoneticProperties phonetic_props) {
   ++total_count_;
-  const std::string key = key_for(text, phonetic, phonetic_props);
+  const std::string key = SharedStringKey(text, phonetic, phonetic_props);
   const auto found = index_.find(key);
   if (found != index_.end()) {
     return found->second;
@@ -68,7 +68,7 @@ std::uint32_t SharedStrings::intern(std::string_view text, const std::vector<Pho
 
 std::uint32_t SharedStrings::index_of(std::string_view text, const std::vector<PhoneticRun>& phonetic,
                                       PhoneticProperties phonetic_props) const {
-  const auto found = index_.find(key_for(text, phonetic, phonetic_props));
+  const auto found = index_.find(SharedStringKey(text, phonetic, phonetic_props));
   // `BuildSharedStrings` visits the same literal-cell set before any
   // worksheet is written, so this fallback is unreachable in normal use.
   // Keep the writer exception-free even if a future caller violates that
diff --git a/src/io/ooxml/shared_strings_writer.h b/src/io/ooxml/shared_strings_writer.h
index 5d66feb9e..5bece91df 100644
--- a/src/io/ooxml/shared_strings_writer.h
+++ b/src/io/ooxml/shared_strings_writer.h
@@ -37,20 +37,20 @@ class SharedStrings {
   const std::vector<SharedStringEntry>& entries() const noexcept { return entries_; }
 
  private:
-  /// Interning key. Two cells share an `<si>` only when both their
-  /// surface text and their full run list agree, so the spans are part
-  /// of the key: `東京都` annotated over `[0,2)` and the same text
-  /// annotated over `[0,3)` are different string items. The
-  /// `<phoneticPr>` block joins the key for the same reason: one reading
-  /// rendered as hiragana and the other as katakana are two items.
-  static std::string key_for(std::string_view text, const std::vector<PhoneticRun>& phonetic,
-                             PhoneticProperties phonetic_props);
-
   std::uint32_t total_count_ = 0;
   std::vector<SharedStringEntry> entries_;
   std::unordered_map<std::string, std::uint32_t> index_;
 };
 
+/// Interning key shared by the OOXML and XLSB string tables. Two cells
+/// share an entry only when both their surface text and their full run
+/// list agree, so the spans are part of the key: `東京都` annotated over
+/// `[0,2)` and the same text annotated over `[0,3)` are different string
+/// items. The `<phoneticPr>` block joins the key for the same reason: one
+/// reading rendered as hiragana and the other as katakana are two items.
+std::string SharedStringKey(std::string_view text, const std::vector<PhoneticRun>& phonetic,
+                            PhoneticProperties phonetic_props);
+
 SharedStrings BuildSharedStrings(const Workbook& workbook);
 std::string WriteSharedStrings(const SharedStrings& strings);
 
diff --git a/src/io/ooxml/sheet_aux_rels_reader.cpp b/src/io/ooxml/sheet_aux_rels_reader.cpp
index 7ac0eda48..dba396f31 100644
--- a/src/io/ooxml/sheet_aux_rels_reader.cpp
+++ b/src/io/ooxml/sheet_aux_rels_reader.cpp
@@ -90,6 +90,12 @@ Expected<SheetAuxRels, Error> load_sheet_aux_rels(const ZipReader& zip, std::str
             return resolved.error();
           }
           out.comments_path = std::move(resolved).value();
+        } else if (type == kRelThreadedComment) {
+          auto resolved = resolve_relative_path(sheet_dir, target);
+          if (!resolved) {
+            return resolved.error();
+          }
+          out.threaded_comments_path = std::move(resolved).value();
         } else if (type == kRelVmlDrawing) {
           auto resolved = resolve_relative_path(sheet_dir, target);
           if (!resolved) {
diff --git a/src/io/ooxml/sheet_aux_rels_reader.h b/src/io/ooxml/sheet_aux_rels_reader.h
index 28491291f..fd1400d03 100644
--- a/src/io/ooxml/sheet_aux_rels_reader.h
+++ b/src/io/ooxml/sheet_aux_rels_reader.h
@@ -56,6 +56,8 @@ namespace ooxml {
 ///     through `unknown_rels` so its id and target round-trip.
 ///   * `printer_settings_path` — resolved path of the binary printer
 ///     settings part referenced by `<pageSetup r:id="...">`, or empty.
+///   * `threaded_comments_path` — resolved path of the
+///     `kRelThreadedComment` target, or empty when the sheet has none.
 ///   * `drawing_path` — resolved path of the DrawingML part referenced
 ///     by the worksheet's `<drawing r:id="...">` element (charts,
 ///     images, shapes), or empty. The drawing part, its own rels, and
@@ -65,6 +67,7 @@ namespace ooxml {
 struct SheetAuxRels {
   std::unordered_map<std::string, std::string> hyperlink_rid_to_target;
   std::string comments_path;
+  std::string threaded_comments_path;
   std::string vml_path;
   std::string printer_settings_rid;
   std::string printer_settings_path;
@@ -88,10 +91,10 @@ Expected<std::vector<std::string>, Error> load_sheet_pivot_table_targets(const Z
                                                                          std::string_view sheet_rels_path,
                                                                          std::string_view sheet_dir);
 
-/// Walks `sheet_rels_path` once for hyperlink, comments, VML and
-/// printer-settings entries; returns the aggregated lookup. The walker
-/// silently ignores unrelated relationship types so each consumer site
-/// reads only the slice it cares about.
+/// Walks `sheet_rels_path` once for hyperlink, comments, threaded
+/// comments, VML and printer-settings entries; returns the aggregated
+/// lookup. The walker silently ignores unrelated relationship types so
+/// each consumer site reads only the slice it cares about.
 ///
 /// `legacy_drawing_body_rid` is the `r:id` value of the worksheet body's
 /// `<legacyDrawing>` element (empty when the sheet has none). A sheet
diff --git a/src/io/ooxml/sheet_xml_builder.cpp b/src/io/ooxml/sheet_xml_builder.cpp
index f268654bb..c47bf2d67 100644
--- a/src/io/ooxml/sheet_xml_builder.cpp
+++ b/src/io/ooxml/sheet_xml_builder.cpp
@@ -15,6 +15,7 @@
 #include <utility>
 #include <vector>
 
+#include "io/auto_filter_xml.h"
 #include "io/cf_overlay.h"
 #include "io/cf_writer.h"
 #include "io/ooxml/cell_ref_writer.h"
@@ -831,11 +832,11 @@ std::string BuildWorksheetXml(const Sheet& sheet, const std::vector<EmissionPlan
     }
   }
   // <autoFilter> sits between <sheetProtection>/<scenarios> and
-  // <mergeCells> in ECMA-376 document order. Round-tripped verbatim.
+  // <mergeCells> in ECMA-376 document order, serialized from the model.
   flush_raw_before("autoFilter");
-  if (!sheet.auto_filter_xml().empty()) {
+  if (sheet.has_auto_filter()) {
     out.append("  ");
-    out.append(sheet.auto_filter_xml());
+    out.append(serialize_auto_filter(*sheet.auto_filter()));
     out.push_back('\n');
   }
   // Merge cells precede CF in ECMA-376 document order.
@@ -1101,6 +1102,9 @@ SheetRelsResult BuildSheetRels(const Sheet& sheet, const std::vector<EmissionPla
     add_rel(next_unique_rid(), kRelComments, comments_target);
     res.legacy_drawing_rid = next_unique_rid();
     add_rel(res.legacy_drawing_rid, kRelVmlDrawing, vml_target);
+    if (!comments_plan.threaded_path.empty()) {
+      add_rel(next_unique_rid(), kRelThreadedComment, TargetRelativeToWorksheet(comments_plan.threaded_path));
+    }
   }
   for (const UnknownRelationship& relationship : sheet.unknown_relationships()) {
     // Internal unknown relationships are meaningful only when the
diff --git a/src/io/ooxml/workbook_xml_builder.cpp b/src/io/ooxml/workbook_xml_builder.cpp
index 0d76401a7..1cc7b00fe 100644
--- a/src/io/ooxml/workbook_xml_builder.cpp
+++ b/src/io/ooxml/workbook_xml_builder.cpp
@@ -27,10 +27,12 @@
 #include "io/workbook_kind_ooxml.h"
 #include "io/xml_escape.h"
 #include "io/xml_utils.h"
+#include "io/xsd_bool.h"
 #include "parser/ast.h"
 #include "parser/ast_format.h"
 #include "parser/parser.h"
 #include "passthrough_part.h"
+#include "pugixml.hpp"
 #include "unknown_relationship.h"
 #include "utils/arena.h"
 #include "utils/double_format.h"
@@ -47,10 +49,8 @@ namespace {
 // `kXmlDecl` lives in `io/xml_utils.h` and is shared with comments / cf
 // writers (single source of truth for the XML 1.0 prologue).
 //
-// Relationship type URIs (the `kRel*` family that is also consumed by
-// the reader) live in `io/ooxml_defs.h`; the writer-only relationship
-// URIs (`kRelCalcChain`, `kRelTheme`, `kRelCoreProperties`,
-// `kRelExtendedProperties`) stay below.
+// Relationship type URIs shared with other readers / writers live in
+// `io/ooxml_defs.h`; only `kRelCalcChain` stays below.
 
 constexpr std::string_view kCtPackageRels = "application/vnd.openxmlformats-package.relationships+xml";
 constexpr std::string_view kCtXml = "application/xml";
@@ -60,8 +60,6 @@ constexpr std::string_view kCtSharedStrings =
     "application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml";
 constexpr std::string_view kCtSheetMetadata =
     "application/vnd.openxmlformats-officedocument.spreadsheetml.sheetMetadata+xml";
-constexpr std::string_view kRelSheetMetadata =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata";
 constexpr std::string_view kCtTable = "application/vnd.openxmlformats-officedocument.spreadsheetml.table+xml";
 constexpr std::string_view kCtPivotCacheDefinition =
     "application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml";
@@ -70,17 +68,51 @@ constexpr std::string_view kCtPivotCacheRecords =
 constexpr std::string_view kCtPivotTable = "application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml";
 constexpr std::string_view kCtComments = "application/vnd.openxmlformats-officedocument.spreadsheetml.comments+xml";
 constexpr std::string_view kCtVmlDrawing = "application/vnd.openxmlformats-officedocument.vmlDrawing";
+constexpr std::string_view kCtThreadedComments = "application/vnd.ms-excel.threadedcomments+xml";
+constexpr std::string_view kCtPerson = "application/vnd.ms-excel.person+xml";
 
-// Writer-only relationship URIs (no reader consumer).
+// Relationship URI only this writer emits.
 constexpr std::string_view kRelCalcChain =
     "http://schemas.openxmlformats.org/officeDocument/2006/relationships/calcChain";
-constexpr std::string_view kRelTheme = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme";
-constexpr std::string_view kRelCoreProperties =
-    "http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties";
-constexpr std::string_view kRelExtendedProperties =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties";
-constexpr std::string_view kRelCustomProperties =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties";
+
+/// Synchronises the date-system attributes in a retained `<workbookPr>`
+/// fragment with the model flag. For a parseable fragment, the reader's
+/// canonical `date1904` and legacy `1904` attributes are removed before the
+/// writer emits the canonical name when the model is true. A semantically
+/// matching canonical fragment is returned byte-for-byte so unrelated raw
+/// attributes do not drift on a no-op save. A malformed fragment stays opaque
+/// to preserve the established passthrough contract.
+std::string SynchronizedWorkbookPr(const Workbook& wb) {
+  const std::string& raw = wb.workbook_pr_xml();
+  if (raw.empty()) {
+    return wb.date1904() ? std::string("<workbookPr date1904=\"1\"/>") : std::string();
+  }
+
+  pugi::xml_document doc;
+  const pugi::xml_parse_result parsed =
+      doc.load_buffer(raw.data(), raw.size(), pugi::parse_default, pugi::encoding_utf8);
+  pugi::xml_node root = doc.first_child();
+  if (!parsed || !root || root.type() != pugi::node_element || std::string_view(root.name()) != "workbookPr") {
+    // Keep the established raw-fragment contract when an extension or a
+    // non-conforming producer supplied a fragment pugixml cannot parse.
+    return raw;
+  }
+
+  const char* const legacy_name = "1904";
+  const pugi::xml_attribute legacy = root.attribute(legacy_name);
+  const bool raw_date1904 = read_xsd_bool(root, "date1904", false) || read_xsd_bool(root, legacy_name, false);
+  if (!legacy && raw_date1904 == wb.date1904()) {
+    return raw;
+  }
+
+  root.remove_attribute("date1904");
+  root.remove_attribute(legacy_name);
+  if (wb.date1904()) {
+    pugi::xml_attribute date_attr = root.append_attribute("date1904");
+    date_attr.set_value("1");
+  }
+  return raw_xml(root);
+}
 
 void AppendDefinedNamesBlock(std::string& out, const std::vector<DefinedName>& names) {
   if (names.empty()) {
@@ -249,6 +281,12 @@ std::string BuildContentTypes(const Workbook& wb, const EmissionPlan& plan) {
       continue;
     }
     AppendOverride(out, cplan.comments_path, kCtComments);
+    if (!cplan.threaded_path.empty()) {
+      AppendOverride(out, cplan.threaded_path, kCtThreadedComments);
+    }
+  }
+  if (plan.generated_persons) {
+    AppendOverride(out, kPersonsPartPath, kCtPerson);
   }
   // Passthrough overrides: only for entries that carried an explicit
   // ContentType in the source archive. Default-typed parts (empty
@@ -271,24 +309,33 @@ std::string BuildContentTypes(const Workbook& wb, const EmissionPlan& plan) {
 }
 
 std::string BuildPackageRels(const Workbook& wb, const EmissionPlan& plan, WriteDiagnostics* diagnostics) {
+  return BuildPackageRels(wb, "xl/workbook.xml", plan.passthrough_kept, "ooxml_writer.package_rel_skipped",
+                          diagnostics);
+}
+
+std::string BuildPackageRels(const Workbook& wb, std::string_view workbook_target,
+                             const std::vector<const PassthroughPart*>& passthrough_kept,
+                             std::string_view skipped_event, WriteDiagnostics* diagnostics) {
   std::string out;
-  out.reserve(256);
+  out.reserve(384);
   out.append(kXmlDecl);
   out.append("<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n");
-  AppendRelationship(out, 1, kRelOfficeDocument, "xl/workbook.xml");
+  AppendRelationship(out, 1, kRelOfficeDocument, workbook_target);
   std::uint32_t next_rid = 2;
-  if (HasPassthroughPart(plan, "docProps/core.xml")) {
+  // docProps parts ride the passthrough path but need package-level rels or
+  // Excel treats them as orphaned (and drops the document properties).
+  if (HasPassthroughPart(passthrough_kept, "docProps/core.xml")) {
     AppendRelationship(out, next_rid++, kRelCoreProperties, "docProps/core.xml");
   }
-  if (HasPassthroughPart(plan, "docProps/app.xml")) {
+  if (HasPassthroughPart(passthrough_kept, "docProps/app.xml")) {
     AppendRelationship(out, next_rid++, kRelExtendedProperties, "docProps/app.xml");
   }
-  if (HasPassthroughPart(plan, "docProps/custom.xml")) {
+  if (HasPassthroughPart(passthrough_kept, "docProps/custom.xml")) {
     AppendRelationship(out, next_rid++, kRelCustomProperties, "docProps/custom.xml");
   }
   for (const UnknownRelationship& r : wb.unknown_package_rels()) {
-    if (!r.target_external && !HasPassthroughPart(plan, r.target)) {
-      StructuredLog("ooxml_writer.package_rel_skipped")
+    if (!r.target_external && !HasPassthroughPart(passthrough_kept, r.target)) {
+      StructuredLog(skipped_event)
           .field("reason", std::string_view("target_part_absent"))
           .field("type", r.type)
           .field("target", r.target)
@@ -334,12 +381,11 @@ std::string BuildWorkbookXml(const Workbook& wb, const EmissionPlan& plan) {
     out.append(wb.file_sharing_xml());
     out.push_back('\n');
   }
-  if (!wb.workbook_pr_xml().empty()) {
+  const std::string workbook_pr_xml = SynchronizedWorkbookPr(wb);
+  if (!workbook_pr_xml.empty()) {
     out.append("  ");
-    out.append(wb.workbook_pr_xml());
+    out.append(workbook_pr_xml);
     out.push_back('\n');
-  } else if (wb.date1904()) {
-    out.append("  <workbookPr date1904=\"1\"/>\n");
   }
   if (!wb.workbook_protection_xml().empty()) {
     out.append("  ");
@@ -469,7 +515,7 @@ std::string BuildWorkbookRels(std::size_t sheet_count, const EmissionPlan& plan,
     const Sheet& sheet = wb.sheet(i);
     if (sheet.is_opaque_ooxml_sheet()) {
       AppendRelationship(out, static_cast<std::uint32_t>(i + 1), sheet.opaque_ooxml_relationship_type(),
-                         WithoutXlPrefix(sheet.opaque_ooxml_part_path()));
+                         TargetRelativeToWorkbook(sheet.opaque_ooxml_part_path()));
     } else {
       const std::string target = "worksheets/sheet" + std::to_string(i + 1) + ".xml";
       AppendRelationship(out, static_cast<std::uint32_t>(i + 1), kRelWorksheet, target);
@@ -485,7 +531,7 @@ std::string BuildWorkbookRels(std::size_t sheet_count, const EmissionPlan& plan,
   // prefix from `definition_path` so the form matches what Excel emits
   // (e.g. `Target="pivotCache/pivotCacheDefinition1.xml"`).
   for (const EmissionPlan::PivotCachePlan& c : plan.pivot_caches) {
-    AppendRelationship(out, c.workbook_rid, kRelPivotCacheDefinition, WithoutXlPrefix(c.definition_path));
+    AppendRelationship(out, c.workbook_rid, kRelPivotCacheDefinition, TargetRelativeToWorkbook(c.definition_path));
   }
   // External link relationships. Same `xl/` prefix stripping as pivot
   // caches above; targets land as `Target="externalLinks/externalLink1.xml"`.
@@ -506,7 +552,7 @@ std::string BuildWorkbookRels(std::size_t sheet_count, const EmissionPlan& plan,
       }
       continue;
     }
-    AppendRelationship(out, e.workbook_rid, kRelExternalLink, WithoutXlPrefix(e.record->part_path),
+    AppendRelationship(out, e.workbook_rid, kRelExternalLink, TargetRelativeToWorkbook(e.record->part_path),
                        /*target_external=*/false, /*escape_target=*/true);
   }
   // Round-tripped relationships whose Type URI the reader did not
@@ -536,6 +582,9 @@ std::string BuildWorkbookRels(std::size_t sheet_count, const EmissionPlan& plan,
   if (plan.generated_dynamic_metadata) {
     AppendRelationship(out, next_rid++, kRelSheetMetadata, "metadata.xml");
   }
+  if (plan.generated_persons) {
+    AppendRelationship(out, next_rid++, kRelPerson, TargetRelativeToWorkbook(kPersonsPartPath));
+  }
   for (const UnknownRelationship& r : wb.unknown_workbook_rels()) {
     // Only emit a relationship whose target actually exists in the
     // output package. External targets need no local part. Internal
@@ -556,8 +605,7 @@ std::string BuildWorkbookRels(std::size_t sheet_count, const EmissionPlan& plan,
       }
       continue;
     }
-    const std::string_view target =
-        r.target_external ? std::string_view(r.target) : WithoutXlPrefix(std::string_view(r.target));
+    const std::string target = r.target_external ? r.target : TargetRelativeToWorkbook(r.target);
     AppendRelationship(out, next_rid++, std::string_view(r.type), target, r.target_external,
                        /*escape_target=*/true);
   }
diff --git a/src/io/ooxml/workbook_xml_builder.h b/src/io/ooxml/workbook_xml_builder.h
index 93a43bb9d..4d0a04aff 100644
--- a/src/io/ooxml/workbook_xml_builder.h
+++ b/src/io/ooxml/workbook_xml_builder.h
@@ -10,6 +10,8 @@
 
 #include <cstddef>
 #include <string>
+#include <string_view>
+#include <vector>
 
 #include "io/ooxml/emission_plan.h"
 
@@ -33,6 +35,14 @@ std::string BuildContentTypes(const Workbook& wb, const EmissionPlan& plan);
 /// `diagnostics` may be NULL, which discards the count.
 std::string BuildPackageRels(const Workbook& wb, const EmissionPlan& plan, WriteDiagnostics* diagnostics);
 
+/// Format-neutral form of the above, shared with the XLSB writer:
+/// `workbook_target` is the workbook part path, `passthrough_kept` the
+/// parts that will be emitted, and `skipped_event` the log event for a
+/// dropped relationship.
+std::string BuildPackageRels(const Workbook& wb, std::string_view workbook_target,
+                             const std::vector<const PassthroughPart*>& passthrough_kept,
+                             std::string_view skipped_event, WriteDiagnostics* diagnostics);
+
 /// Builds the `xl/workbook.xml` part: `<sheets>`, optional
 /// `<externalReferences>`, `<definedNames>`, `<calcPr>`, and
 /// `<pivotCaches>` in ECMA-376 element order.
diff --git a/src/io/ooxml/zip_part_writer.cpp b/src/io/ooxml/zip_part_writer.cpp
index d499e2a0a..b6162d331 100644
--- a/src/io/ooxml/zip_part_writer.cpp
+++ b/src/io/ooxml/zip_part_writer.cpp
@@ -3,7 +3,9 @@
 
 #include "io/ooxml/zip_part_writer.h"
 
+#include <cstddef>
 #include <cstdint>
+#include <cstring>
 #include <string>
 #include <string_view>
 #include <unordered_set>
@@ -35,37 +37,64 @@ Expected<void, Error> CheckAndRecordPath(std::string_view path, std::unordered_s
   return Expected<void, Error>::Ok();
 }
 
-}  // namespace
-
-Expected<void, Error> AddPart(mz_zip_archive* archive, std::string_view path, const std::string& body,
-                              std::unordered_set<std::string>* seen_paths) {
+/// Adds `size` bytes at `data` as entry `path`; `failure` is the error
+/// message when miniz rejects the entry.
+Expected<void, Error> AddEntry(mz_zip_archive* archive, std::string_view path, const void* data, std::size_t size,
+                               std::unordered_set<std::string>* seen_paths, const char* failure) {
   if (auto dup_check = CheckAndRecordPath(path, seen_paths); !dup_check) {
     return dup_check.error();
   }
-  const mz_bool ok = mz_zip_writer_add_mem(archive, std::string(path).c_str(), body.data(), body.size(),
+  const mz_bool ok = mz_zip_writer_add_mem(archive, std::string(path).c_str(), data, size,
                                            static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION));
   if (ok == MZ_FALSE) {
     std::string context("part=");
     context.append(path);
-    return make_error(FormulonErrorCode::kIoWriteFailed, "miniz mz_zip_writer_add_mem failed", std::move(context));
+    return make_error(FormulonErrorCode::kIoWriteFailed, failure, std::move(context));
   }
   return Expected<void, Error>::Ok();
 }
 
+}  // namespace
+
+Expected<void, Error> AddPart(mz_zip_archive* archive, std::string_view path, const std::string& body,
+                              std::unordered_set<std::string>* seen_paths) {
+  return AddEntry(archive, path, body.data(), body.size(), seen_paths, "miniz mz_zip_writer_add_mem failed");
+}
+
 Expected<void, Error> AddPartBytes(mz_zip_archive* archive, std::string_view path,
                                    const std::vector<std::uint8_t>& body, std::unordered_set<std::string>* seen_paths) {
-  if (auto dup_check = CheckAndRecordPath(path, seen_paths); !dup_check) {
-    return dup_check.error();
+  return AddEntry(archive, path, body.data(), body.size(), seen_paths,
+                  "miniz mz_zip_writer_add_mem failed (binary part)");
+}
+
+Expected<std::vector<std::uint8_t>, Error> FinalizeArchive(ZipWriterGuard& writer, const char* context) {
+  void* archive_ptr = nullptr;
+  std::size_t archive_size = 0;
+  if (mz_zip_writer_finalize_heap_archive(writer.get(), &archive_ptr, &archive_size) == MZ_FALSE) {
+    return make_error(FormulonErrorCode::kIoWriteFailed, "miniz mz_zip_writer_finalize_heap_archive failed",
+                      std::string(context));
   }
-  const mz_bool ok = mz_zip_writer_add_mem(archive, std::string(path).c_str(), body.data(), body.size(),
-                                           static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION));
-  if (ok == MZ_FALSE) {
-    std::string context("part=");
-    context.append(path);
-    return make_error(FormulonErrorCode::kIoWriteFailed, "miniz mz_zip_writer_add_mem failed (binary part)",
-                      std::move(context));
+  if (mz_zip_writer_end(writer.get()) == MZ_FALSE) {
+    // Finalize succeeded but end failed: still free the buffer miniz handed
+    // us before surfacing the error.
+    if (archive_ptr != nullptr) {
+      mz_free(archive_ptr);
+    }
+    writer.release();
+    return make_error(FormulonErrorCode::kIoWriteFailed, "miniz mz_zip_writer_end failed", std::string(context));
   }
-  return Expected<void, Error>::Ok();
+  writer.release();
+
+  // Copy into a std::vector so the caller owns the bytes through normal RAII.
+  std::vector<std::uint8_t> bytes;
+  bytes.resize(archive_size);
+  if (archive_size > 0 && archive_ptr != nullptr) {
+    std::memcpy(bytes.data(), archive_ptr, archive_size);
+  }
+  if (archive_ptr != nullptr) {
+    mz_free(archive_ptr);
+  }
+  return bytes;
 }
 
 }  // namespace io
diff --git a/src/io/ooxml/zip_part_writer.h b/src/io/ooxml/zip_part_writer.h
index 3e64e3fcb..a3e5147d3 100644
--- a/src/io/ooxml/zip_part_writer.h
+++ b/src/io/ooxml/zip_part_writer.h
@@ -77,6 +77,10 @@ Expected<void, Error> AddPartBytes(mz_zip_archive* archive, std::string_view pat
                                    const std::vector<std::uint8_t>& body,
                                    std::unordered_set<std::string>* seen_paths = nullptr);
 
+/// Finalises `writer`'s heap archive and returns its bytes, ending the
+/// writer either way. `context` tags any miniz failure.
+Expected<std::vector<std::uint8_t>, Error> FinalizeArchive(ZipWriterGuard& writer, const char* context);
+
 }  // namespace io
 }  // namespace formulon
 
diff --git a/src/io/ooxml_defs.h b/src/io/ooxml_defs.h
index 883245019..3016ba958 100644
--- a/src/io/ooxml_defs.h
+++ b/src/io/ooxml_defs.h
@@ -1,7 +1,7 @@
 //
 // Shared OOXML schema constants used by the reader and writer.
-// Only the relationship type URIs that BOTH sides need are hoisted
-// here; content-type strings that are needed by exactly one side
+// Only the relationship type URIs that more than one reader / writer
+// (OOXML or XLSB) needs are hoisted here; content-type strings that are needed by exactly one side
 // (e.g. the `kCtWorkbook*` family the reader uses for kind detection,
 // or the writer-only `kCtPackageRels` / `kCtComments`) stay in the
 // consuming `.cpp` so this header tracks the minimum shared surface
@@ -63,6 +63,19 @@ inline constexpr std::string_view kRelOleLink =
     "http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleLink";
 inline constexpr std::string_view kRelDdeLink =
     "http://schemas.openxmlformats.org/officeDocument/2006/relationships/ddeLink";
+inline constexpr std::string_view kRelThreadedComment =
+    "http://schemas.microsoft.com/office/2017/10/relationships/threadedComment";
+inline constexpr std::string_view kRelPerson = "http://schemas.microsoft.com/office/2017/10/relationships/person";
+inline constexpr std::string_view kRelTheme =
+    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme";
+inline constexpr std::string_view kRelSheetMetadata =
+    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata";
+inline constexpr std::string_view kRelCoreProperties =
+    "http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties";
+inline constexpr std::string_view kRelExtendedProperties =
+    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties";
+inline constexpr std::string_view kRelCustomProperties =
+    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties";
 
 }  // namespace io
 }  // namespace formulon
diff --git a/src/io/ooxml_reader.cpp b/src/io/ooxml_reader.cpp
index 337141d36..825223958 100644
--- a/src/io/ooxml_reader.cpp
+++ b/src/io/ooxml_reader.cpp
@@ -36,6 +36,7 @@
 #include "calc_settings.h"
 #include "default_content_type.h"
 #include "defined_name.h"
+#include "io/auto_filter_xml.h"
 #include "io/cf_reader.h"
 #include "io/comments_reader.h"
 #include "io/defined_names_internal.h"
@@ -49,10 +50,13 @@
 #include "io/ooxml_defs.h"
 #include "io/pivot_cache_reader.h"
 #include "io/pivot_table_reader.h"
+#include "io/sheet_layout_reader.h"
+#include "io/sheet_overlay_reader.h"
 #include "io/sheet_reader.h"
 #include "io/sst_reader.h"
 #include "io/styles_reader.h"
 #include "io/tables_reader.h"
+#include "io/threaded_comments_io.h"
 #include "io/workbook_kind_ooxml.h"
 #include "io/xml_utils.h"
 #include "io/xsd_bool.h"
@@ -75,15 +79,6 @@ namespace formulon {
 namespace io {
 namespace {
 
-constexpr std::string_view kRelOfficeDocument =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument";
-constexpr std::string_view kRelCoreProperties =
-    "http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties";
-constexpr std::string_view kRelExtendedProperties =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties";
-constexpr std::string_view kRelCustomProperties =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties";
-
 Expected<std::vector<UnknownRelationship>, Error> ReadUnknownPackageRels(const std::vector<std::uint8_t>& bytes) {
   pugi::xml_document doc;
   RETURN_IF_ERROR(load_xml_buffer(doc, bytes, "ooxml_reader", "package-level rels"));
@@ -309,7 +304,7 @@ Expected<void, Error> ApplyWorksheetMetadata(const pugi::xml_document& doc, std:
     print.header_footer_xml = raw_xml(header_footer);
   }
   if (pugi::xml_node auto_filter = worksheet.child("autoFilter")) {
-    wb.sheet(i).set_auto_filter_xml(raw_xml(auto_filter));
+    wb.sheet(i).set_auto_filter(auto_filter_from_xml(raw_xml(auto_filter)));
   }
   // Worksheet-level `<extLst>` holds the *data* for 2010+ extensions —
   // notably `x14:conditionalFormattings` (DataBar negative-fill / axis /
@@ -692,6 +687,26 @@ static Expected<OoxmlReadResult, Error> ReadOoxmlWithThreshold(ByteSpan bytes, s
     consumed_parts.insert("xl/calcChain.xml");
   }
 
+  // Persons: the person list the sheets' threaded comments name. The part
+  // is model-owned, so its relationship leaves the unknown list with it.
+  for (auto it = wb_rels.unknown_rels.begin(); it != wb_rels.unknown_rels.end(); ++it) {
+    if (it->type != kRelPerson || it->target_external || !zip.has_entry(it->target)) {
+      continue;
+    }
+    auto pb_or = zip.read_entry(it->target);
+    if (!pb_or) {
+      return pb_or.error();
+    }
+    auto persons_or = read_persons(pb_or.value());
+    if (!persons_or) {
+      return persons_or.error();
+    }
+    wb.mutable_persons() = std::move(persons_or.value());
+    consumed_parts.insert(it->target);
+    wb_rels.unknown_rels.erase(it);
+    break;
+  }
+
   // 4b. Styles — read for validation only at this slice. The full
   // numFmt/font/fill runtime model lands later when the formatter
   // pipeline begins consuming it. Mark consumed regardless of whether
@@ -928,9 +943,25 @@ static Expected<OoxmlReadResult, Error> ReadOoxmlWithThreshold(ByteSpan bytes, s
         }
       }
 
+      // Threaded comments load before the legacy comments part so the
+      // thread stubs in it can be told apart from notes.
+      if (!aux.threaded_comments_path.empty() && zip.has_entry(aux.threaded_comments_path)) {
+        auto tb_or = zip.read_entry(aux.threaded_comments_path);
+        if (!tb_or) {
+          return tb_or.error();
+        }
+        auto threads_or = read_threaded_comments(tb_or.value());
+        if (!threads_or) {
+          return threads_or.error();
+        }
+        wb.sheet(i).mutable_threaded_comments() = std::move(threads_or.value());
+        consumed_parts.insert(aux.threaded_comments_path);
+      }
+
       // Comments part: load + attach. The VML drawing companion is
       // intentionally NOT consumed here so the bytes flow through the
-      // unknown-parts passthrough mechanism unchanged.
+      // unknown-parts passthrough mechanism unchanged; the anchors it was
+      // read with let the writer tell whether those bytes are still current.
       if (!aux.comments_path.empty() && zip.has_entry(aux.comments_path)) {
         auto cb_or = zip.read_entry(aux.comments_path);
         if (!cb_or) {
@@ -940,8 +971,10 @@ static Expected<OoxmlReadResult, Error> ReadOoxmlWithThreshold(ByteSpan bytes, s
         if (!comments_or) {
           return comments_or.error();
         }
+        drop_thread_stubs(comments_or.value(), wb.sheet(i).threaded_comments());
         wb.sheet(i).mutable_comments() = std::move(comments_or.value());
         wb.sheet(i).set_comment_vml_path(aux.vml_path);
+        wb.sheet(i).set_comment_vml_anchors(wb.sheet(i).comment_anchor_set());
         consumed_parts.insert(aux.comments_path);
       }
 
@@ -1044,11 +1077,7 @@ static Expected<OoxmlReadResult, Error> ReadOoxmlWithThreshold(ByteSpan bytes, s
     }
   }
 
-  // 7. Defined names — parsed from the same `wb_doc` we already loaded
-  // above. Pure metadata extraction; the writer slice (Bundle 2.5) will
-  // emit them back. Resolution at evaluation time arrives in Phase 4.
-  // We run this after sheet construction so future name validation can
-  // cross-reference sheet indices without re-shuffling the call order.
+  // 7. Defined names, read from `wb_doc` after sheet construction and resolved lazily at evaluation time.
   auto defined_names_or = read_defined_names(wb_doc);
   if (!defined_names_or) {
     return defined_names_or.error();
diff --git a/src/io/ooxml_writer.cpp b/src/io/ooxml_writer.cpp
index 4a079c28a..d0af4c130 100644
--- a/src/io/ooxml_writer.cpp
+++ b/src/io/ooxml_writer.cpp
@@ -15,7 +15,7 @@
 // validations, hyperlinks, sheet protection, page breaks, sheet rels)
 // live in `src/io/ooxml/sheet_xml_builder.{h,cpp}`. The pipeline-only
 // pieces — `BuildTableXml`, `BuildExternalLinkRels`,
-// `BuildPivotCacheDefinitionRels`, and `write_ooxml()` itself — stay
+// `BuildSingleRelationshipRels`, and `write_ooxml()` itself — stay
 // here because each is consumed only by `write_ooxml()`.
 
 #include "io/ooxml_writer.h"
@@ -23,7 +23,6 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
-#include <cstring>
 #include <memory>
 #include <optional>
 #include <string>
@@ -33,6 +32,7 @@
 #include <vector>
 
 #include "external_link.h"
+#include "io/auto_filter_xml.h"
 #include "io/comments_writer.h"
 #include "io/dynamic_array_formula.h"
 #include "io/ooxml/emission_plan.h"
@@ -46,6 +46,7 @@
 #include "io/pivot_cache_writer.h"
 #include "io/pivot_table_writer.h"
 #include "io/styles_writer.h"
+#include "io/threaded_comments_io.h"
 #include "io/xml_escape.h"
 #include "io/xml_utils.h"
 #include "miniz.h"
@@ -66,17 +67,17 @@ namespace formulon {
 namespace io {
 namespace {
 
-/// Builds the `_rels` document for a pivotCacheDefinition part: a single
-/// relationship of type `pivotCacheRecords` pointing at the matching
-/// records part. The records target lives in the same directory as the
-/// definition, so the `Target` is just the basename (e.g.
-/// `"pivotCacheRecords1.xml"`).
-std::string BuildPivotCacheDefinitionRels(std::string_view records_filename) {
+/// Builds a `_rels` document holding the single relationship `rId1` of
+/// `type` to `target`. A pivotCacheDefinition part relates to its records
+/// part (a basename in the same directory); a pivotTable part relates to
+/// its cache definition, which ECMA-376 §12.3.19 requires even though the
+/// table also names the cache by `cacheId`.
+std::string BuildSingleRelationshipRels(std::string_view type, std::string_view target) {
   std::string out;
-  out.reserve(256 + records_filename.size());
+  out.reserve(256 + target.size());
   out.append(kXmlDecl);
   out.append("<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n");
-  AppendRelationship(out, 1, kRelPivotCacheRecords, records_filename);
+  AppendRelationship(out, 1, type, target);
   out.append("</Relationships>\n");
   return out;
 }
@@ -128,22 +129,6 @@ std::optional<PivotRenderedSpan> ProjectPivotSpan(const Workbook& wb, const pivo
   return PivotRenderedSpan{layout_or.value().rows, layout_or.value().cols};
 }
 
-/// Builds the `_rels` document for a pivotTable part: a single
-/// relationship of type `pivotCacheDefinition` pointing at the cache the
-/// table draws from. ECMA-376 §12.3.19 requires this relationship even
-/// though the table also names the cache by `cacheId`, so consumers that
-/// navigate the package by relationship alone can still find it. The
-/// target steps out of `xl/pivotTables/` into `xl/pivotCache/`.
-std::string BuildPivotTableRels(std::string_view cache_definition_target) {
-  std::string out;
-  out.reserve(256 + cache_definition_target.size());
-  out.append(kXmlDecl);
-  out.append("<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n");
-  AppendRelationship(out, 1, kRelPivotCacheDefinition, cache_definition_target);
-  out.append("</Relationships>\n");
-  return out;
-}
-
 /// Builds the per-link rels file content for one external link.
 /// Returns an empty string when the record has no captured target —
 /// callers should skip the AddPart call in that case so the package
@@ -199,12 +184,11 @@ std::string BuildTableXml(const TableMetadata& t, std::uint32_t numeric_id) {
   }
   out.append(">\n");
   // CT_Table orders the optional filter/sort payload before the required
-  // tableColumns collection. Keep these fragments opaque: they may carry
-  // filter criteria, extension attributes, or other fields the table model
-  // does not interpret.
+  // tableColumns collection. The AutoFilter is serialized from its model;
+  // the sort and extension fragments are retained verbatim.
   if (!t.auto_filter_xml.empty()) {
     out.append("  ");
-    out.append(t.auto_filter_xml);
+    out.append(serialize_auto_filter(*t.auto_filter_xml.get()));
     out.push_back('\n');
   }
   if (!t.sort_state_xml.empty()) {
@@ -505,8 +489,8 @@ Expected<OoxmlWriteResult, Error> write_ooxml_with_result(const Workbook& wb) {
       const std::string_view records_filename = slash == std::string::npos
                                                     ? std::string_view(c.records_path)
                                                     : std::string_view(c.records_path).substr(slash + 1);
-      auto result = AddPart(writer.get(), c.definition_rels_path, BuildPivotCacheDefinitionRels(records_filename),
-                            &written_paths);
+      auto result = AddPart(writer.get(), c.definition_rels_path,
+                            BuildSingleRelationshipRels(kRelPivotCacheRecords, records_filename), &written_paths);
       if (!result) {
         return result.error();
       }
@@ -527,7 +511,8 @@ Expected<OoxmlWriteResult, Error> write_ooxml_with_result(const Workbook& wb) {
       // no rels part, so the package never carries a dangling target.
       if (!t.cache_definition_target.empty()) {
         auto rels_result =
-            AddPart(writer.get(), t.rels_path, BuildPivotTableRels(t.cache_definition_target), &written_paths);
+            AddPart(writer.get(), t.rels_path,
+                    BuildSingleRelationshipRels(kRelPivotCacheDefinition, t.cache_definition_target), &written_paths);
         if (!rels_result) {
           return rels_result.error();
         }
@@ -576,15 +561,19 @@ Expected<OoxmlWriteResult, Error> write_ooxml_with_result(const Workbook& wb) {
   }
 
   // 9.5. Comments + VML drawings — one pair per sheet that has at
-  // least one comment. The VML companion uses the passthrough bytes
-  // when available so unchanged round-trips stay byte-identical;
-  // otherwise the writer's stub keeps Excel happy on a fresh comment.
+  // least one note or thread, plus the sheet's threaded comments. The
+  // comments part carries the notes and one legacy stub per thread. The
+  // VML companion re-emits the source bytes while the plan found them
+  // current, and is regenerated with one shape per commented cell
+  // otherwise.
   for (std::size_t i = 0; i < plan.comments_by_sheet.size(); ++i) {
     const EmissionPlan::CommentsPlan& cplan = plan.comments_by_sheet[i];
     if (cplan.numeric_id == 0) {
       continue;
     }
-    auto cresult = AddPart(writer.get(), cplan.comments_path, write_comments(wb.sheet(i).comments()), &written_paths);
+    const Sheet& sheet = wb.sheet(i);
+    auto cresult =
+        AddPart(writer.get(), cplan.comments_path, write_comments(legacy_comments_with_stubs(sheet)), &written_paths);
     if (!cresult) {
       return cresult.error();
     }
@@ -594,11 +583,25 @@ Expected<OoxmlWriteResult, Error> write_ooxml_with_result(const Workbook& wb) {
         return vresult.error();
       }
     } else {
-      auto vresult = AddPart(writer.get(), cplan.vml_path, write_vml_drawing_stub(), &written_paths);
+      auto vresult = AddPart(writer.get(), cplan.vml_path,
+                             write_vml_drawing(sheet.comment_anchor_set(), cplan.numeric_id), &written_paths);
       if (!vresult) {
         return vresult.error();
       }
     }
+    if (!cplan.threaded_path.empty()) {
+      auto tresult = AddPart(writer.get(), cplan.threaded_path, write_threaded_comments(sheet.threaded_comments()),
+                             &written_paths);
+      if (!tresult) {
+        return tresult.error();
+      }
+    }
+  }
+  if (plan.generated_persons) {
+    auto presult = AddPart(writer.get(), kPersonsPartPath, write_persons(wb.persons()), &written_paths);
+    if (!presult) {
+      return presult.error();
+    }
   }
 
   // 10. Passthrough parts — bytes from the original archive, written
@@ -617,34 +620,11 @@ Expected<OoxmlWriteResult, Error> write_ooxml_with_result(const Workbook& wb) {
     }
   }
 
-  // Finalise into a heap buffer, then copy into a std::vector so the caller
-  // owns the bytes through normal RAII.
-  void* archive_ptr = nullptr;
-  std::size_t archive_size = 0;
-  if (mz_zip_writer_finalize_heap_archive(writer.get(), &archive_ptr, &archive_size) == MZ_FALSE) {
-    return make_error(FormulonErrorCode::kIoWriteFailed, "miniz mz_zip_writer_finalize_heap_archive failed",
-                      "context=write_ooxml");
-  }
-  if (mz_zip_writer_end(writer.get()) == MZ_FALSE) {
-    // finalize succeeded but end failed — still free the buffer miniz handed
-    // us before surfacing the error.
-    if (archive_ptr != nullptr) {
-      mz_free(archive_ptr);
-    }
-    writer.release();
-    return make_error(FormulonErrorCode::kIoWriteFailed, "miniz mz_zip_writer_end failed", "context=write_ooxml");
-  }
-  writer.release();
-
-  std::vector<std::uint8_t> bytes;
-  bytes.resize(archive_size);
-  if (archive_size > 0 && archive_ptr != nullptr) {
-    std::memcpy(bytes.data(), archive_ptr, archive_size);
-  }
-  if (archive_ptr != nullptr) {
-    mz_free(archive_ptr);
+  auto bytes_or = FinalizeArchive(writer, "context=write_ooxml");
+  if (!bytes_or) {
+    return bytes_or.error();
   }
-  return OoxmlWriteResult{std::move(bytes), diagnostics};
+  return OoxmlWriteResult{std::move(bytes_or.value()), diagnostics};
 }
 
 Expected<std::vector<std::uint8_t>, Error> write_ooxml(const Workbook& wb) {
diff --git a/src/io/ooxml_writer_cell.cpp b/src/io/ooxml_writer_cell.cpp
index ee3f7e4bc..d9fc9aa84 100644
--- a/src/io/ooxml_writer_cell.cpp
+++ b/src/io/ooxml_writer_cell.cpp
@@ -44,6 +44,7 @@
 #include "parser/parser.h"
 #include "phonetic.h"
 #include "sheet.h"
+#include "style_resolve.h"
 #include "utils/a1_column.h"
 #include "utils/a1_ref.h"
 #include "utils/arena.h"
@@ -58,11 +59,35 @@ namespace {
 // Cell emission
 // ---------------------------------------------------------------------------
 
+// True when a cell's explicit default style must be written as `s="0"`: only a
+// blank, formula-less cell does not own its style, so only there does the
+// attribute carry meaning (it blocks row/column style inheritance).
+bool ForcesDefaultStyle(const Cell& cell) {
+  return cell.has_explicit_xf && cell.formula_text.empty() && cell.cached_value.is_blank();
+}
+
+// True when a row or column style would apply to `(row, col)` were its own
+// style not written; an explicit default style is only observable then.
+bool InheritsNonDefaultStyle(const Sheet& sheet, std::uint32_t row, std::uint32_t col) {
+  const SheetLayout& layout = sheet.layout();
+  for (const RowLayout& r : layout.row_overrides) {
+    if (r.row == row && r.has_style && r.style_xf != 0U) {
+      return true;
+    }
+  }
+  for (const ColumnLayout& c : layout.columns) {
+    if (c.first <= col && col <= c.last && c.has_style && c.style_xf != 0U) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // Emits an `s="N"` attribute when `xf_index` is non-zero. The default
-// xf (index 0) is omitted for byte parity with Excel's writer, which
-// emits `<c>` without `s=` for the default-formatted majority of cells.
-void AppendStyleAttr(std::string& out, std::uint32_t xf_index) {
-  if (xf_index == 0U) {
+// xf (index 0) is omitted for byte parity with Excel's writer unless `force`
+// is set (see `ForcesDefaultStyle`).
+void AppendStyleAttr(std::string& out, std::uint32_t xf_index, bool force) {
+  if (xf_index == 0U && !force) {
     return;
   }
   out.append(" s=\"");
@@ -71,11 +96,12 @@ void AppendStyleAttr(std::string& out, std::uint32_t xf_index) {
 }
 
 // Emits the <c> element for an Error value at `addr`.
-void AppendErrorCellXml(std::string& out, std::string_view addr, ErrorCode code, std::uint32_t xf_index) {
+void AppendErrorCellXml(std::string& out, std::string_view addr, ErrorCode code, std::uint32_t xf_index,
+                        bool force_style) {
   out.append("<c r=\"");
   out.append(addr);
   out.append("\"");
-  AppendStyleAttr(out, xf_index);
+  AppendStyleAttr(out, xf_index, force_style);
   out.append(" t=\"e\"><v>");
   out.append(display_name(stored_cell_error(code)));
   out.append("</v></c>");
@@ -103,9 +129,9 @@ void AppendErrorCellXml(std::string& out, std::string_view addr, ErrorCode code,
 // block would read kana over characters it does not cover.
 void AppendLiteralCellBody(std::string& out, const Value& value, const std::vector<PhoneticRun>& phonetic,
                            PhoneticProperties phonetic_props, const SharedStrings* shared_strings,
-                           std::uint32_t xf_index) {
+                           std::uint32_t xf_index, bool force_style) {
   out.push_back('"');
-  AppendStyleAttr(out, xf_index);
+  AppendStyleAttr(out, xf_index, force_style);
   if (value.is_number()) {
     // Defensive: NaN / +/-Inf must never reach append_xml_number, which
     // would emit `nan`/`inf` text inside `<v>` (Excel rejects this on
@@ -230,11 +256,11 @@ void AppendFormulaValue(std::string& out, const Value& cv) {
 // value typed as a formula result's, and `<f ca="1"/>` when the anchor is
 // recalculated every time (measured).
 void AppendPhantomCellXml(std::string& out, std::uint32_t row, std::uint32_t col, std::uint32_t xf_index,
-                          const Value& value, bool always_calculates) {
+                          bool force_style, const Value& value, bool always_calculates) {
   out.append("<c r=\"");
   out.append(a1::encode_a1(row, col));
   out.append("\"");
-  AppendStyleAttr(out, xf_index);
+  AppendStyleAttr(out, xf_index, force_style);
   AppendFormulaValueType(out, value);
   out.push_back('>');
   if (always_calculates) {
@@ -261,7 +287,7 @@ bool AppendCellXml(std::string& out, const Sheet& sheet, std::uint32_t row, std:
   // the <v> is downgraded.
   if (!has_formula && cell.cached_value.is_number() && !std::isfinite(cell.cached_value.as_number())) {
     const std::string addr = a1::encode_a1(row, col);
-    AppendErrorCellXml(out, addr, ErrorCode::Num, cell.xf_index);
+    AppendErrorCellXml(out, addr, ErrorCode::Num, cell.xf_index, ForcesDefaultStyle(cell));
     return true;
   }
 
@@ -274,7 +300,7 @@ bool AppendCellXml(std::string& out, const Sheet& sheet, std::uint32_t row, std:
     out.append("<c r=\"");
     out.append(addr);
     out.append("\"");
-    AppendStyleAttr(out, cell.xf_index);
+    AppendStyleAttr(out, cell.xf_index, ForcesDefaultStyle(cell));
     out.append("/>");
     return true;
   }
@@ -306,7 +332,7 @@ bool AppendCellXml(std::string& out, const Sheet& sheet, std::uint32_t row, std:
     // that tells Excel this `t="array"` is a modern spill rather than a
     // legacy CSE array on reopen; emitted only when the saved package
     // carries a resolved entry for it.
-    AppendStyleAttr(out, cell.xf_index);
+    AppendStyleAttr(out, cell.xf_index, ForcesDefaultStyle(cell));
     AppendFormulaValueType(out, cell.cached_value);
     if (dynamic) {
       out.append(" cm=\"");
@@ -383,7 +409,8 @@ bool AppendCellXml(std::string& out, const Sheet& sheet, std::uint32_t row, std:
   // through the inline-string block, spans intact.
   out.append("<c r=\"");
   out.append(addr);
-  AppendLiteralCellBody(out, cell.cached_value, cell.phonetic_runs, cell.phonetic_props, shared_strings, cell.xf_index);
+  AppendLiteralCellBody(out, cell.cached_value, cell.phonetic_runs, cell.phonetic_props, shared_strings, cell.xf_index,
+                        ForcesDefaultStyle(cell));
   return true;
 }
 
@@ -391,8 +418,8 @@ bool AppendCellXml(std::string& out, const Sheet& sheet, std::uint32_t row, std:
 // `RowLayout` override. Caller has already emitted `<row r="N"`. Each
 // override field is emitted only when it differs from the OOXML
 // default (height -> none, hidden -> "0", outlineLevel -> 0). Excel
-// itself emits `customHeight="1"` alongside `ht`; we mirror that so a
-// reload reproduces the visual size.
+// emits `customHeight="1"` only for an explicit override, so an auto
+// height stays auto across a save.
 void AppendRowOverrideAttrs(std::string& out, const RowLayout& layout) {
   if (layout.has_height || layout.height > 0.0) {
     out.append(" ht=\"");
@@ -400,7 +427,10 @@ void AppendRowOverrideAttrs(std::string& out, const RowLayout& layout) {
     // recalc-save neither drifts the row metric nor respells 13.2 as
     // 13.199999999999999. Matches the column-width writer.
     append_xml_number(out, layout.height);
-    out.append("\" customHeight=\"1\"");
+    out.append("\"");
+    if (layout.custom_height) {
+      out.append(" customHeight=\"1\"");
+    }
   }
   if (layout.hidden) {
     out.append(" hidden=\"1\"");
@@ -453,7 +483,9 @@ bool AppendRowXml(std::string& out, const Sheet& sheet, std::uint32_t row, const
     const std::size_t idx =
         static_cast<std::size_t>(row - region->anchor_row) * region->cols + (col - region->anchor_col);
     const Value value = idx < region->cells.size() ? region->cells[idx] : Value::blank();
-    AppendPhantomCellXml(body, row, col, col < stored ? row_cells[col].xf_index : 0U, value, it->second);
+    const bool force_style =
+        col < stored && ForcesDefaultStyle(row_cells[col]) && InheritsNonDefaultStyle(sheet, row, col);
+    AppendPhantomCellXml(body, row, col, select_effective_xf(sheet, row, col).xf_index, force_style, value, it->second);
   };
   for (std::uint32_t col = 0; col < stored; ++col) {
     if (sheet.spill_region_covering(row, col) != nullptr) {
@@ -489,7 +521,7 @@ bool AppendRowXml(std::string& out, const Sheet& sheet, std::uint32_t row, const
 }  // namespace
 
 bool CellIsEmitted(const Cell& cell) {
-  return !cell.formula_text.empty() || !cell.cached_value.is_blank() || cell.xf_index != 0U;
+  return !cell.formula_text.empty() || !cell.cached_value.is_blank() || cell.xf_index != 0U || cell.has_explicit_xf;
 }
 
 std::string BuildSheetDataXml(const Sheet& sheet, const SharedStrings* shared_strings,
diff --git a/src/io/ooxml_writer_cell.h b/src/io/ooxml_writer_cell.h
index b6e40fbe0..184eda8a4 100644
--- a/src/io/ooxml_writer_cell.h
+++ b/src/io/ooxml_writer_cell.h
@@ -25,9 +25,10 @@ class SharedStrings;
 /// True when a save writes a `<c>` element for `cell`.
 ///
 /// A cell is omitted only when it holds nothing at all: no formula, a
-/// blank value, and the default style. A blank cell carrying a style
-/// index still ships, as a bare `<c r="..." s="N"/>`, because Excel
-/// preserves the formatting of an empty cell.
+/// blank value, and no explicit style assignment. A blank cell carrying
+/// a style index (including explicit `s="0"`) still ships, as a bare
+/// `<c r="..." s="N"/>`, because Excel preserves the formatting of an
+/// empty cell.
 ///
 /// Shared so `<dimension>` is derived from the same test that decides
 /// what `<sheetData>` contains. The two answering differently is what
diff --git a/src/io/sheet_layout_reader.cpp b/src/io/sheet_layout_reader.cpp
new file mode 100644
index 000000000..3877bb220
--- /dev/null
+++ b/src/io/sheet_layout_reader.cpp
@@ -0,0 +1,286 @@
+//
+// Worksheet view and layout reader: `<sheetView>` / `<pane>`, `<sheetPr>`
+// tab visibility, `<sheetFormatPr>` defaults, `<cols>` spans and `<row>`
+// overrides. See sheet_layout_reader.h for the public contract.
+
+#include "io/sheet_layout_reader.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#include "io/xml_utils.h"
+#include "io/xsd_bool.h"
+#include "io/xsd_double.h"
+#include "io/xsd_int.h"
+#include "pugixml.hpp"
+#include "sheet.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+
+// ---------------------------------------------------------------------------
+// View / layout helpers. Each lives in an anonymous namespace so the
+// translation unit owns its parsing fences; the public driver
+// `read_sheet_view_and_layout` composes them in document order.
+// ---------------------------------------------------------------------------
+
+namespace {
+
+/// Parses `<sheetView zoomScale="...">` and `<pane state="frozen"
+/// xSplit="N" ySplit="M">` into `view`. Missing or out-of-range
+/// `zoomScale` falls back to `SheetView::kDefaultZoomScale`. A `<pane>`
+/// element whose `state` is neither `frozen` nor `frozenSplit` (or that
+/// is absent) leaves `freeze_rows` / `freeze_cols` at zero.
+void ApplySheetView(const pugi::xml_node& worksheet, SheetView& view) {
+  pugi::xml_node sheet_views = worksheet.child("sheetViews");
+  if (!sheet_views) {
+    return;
+  }
+  pugi::xml_node sheet_view = sheet_views.child("sheetView");
+  if (!sheet_view) {
+    return;
+  }
+  if (sheet_view.attribute("zoomScale")) {
+    const std::int32_t raw = attr_i32(sheet_view, "zoomScale", 0);
+    if (raw >= 10 && raw <= 400) {
+      view.zoom_scale = static_cast<std::uint32_t>(raw);
+    }
+  }
+  // Display attributes. Three default to true in the schema, so absence
+  // means "shown"; the tri-state reader applies each attribute's real
+  // default rather than a blanket false.
+  view.show_grid_lines = read_xsd_bool(sheet_view, "showGridLines", true);
+  view.show_row_col_headers = read_xsd_bool(sheet_view, "showRowColHeaders", true);
+  view.show_zeros = read_xsd_bool(sheet_view, "showZeros", true);
+  view.right_to_left = read_xsd_bool(sheet_view, "rightToLeft", false);
+  view.tab_selected = read_xsd_bool(sheet_view, "tabSelected", false);
+  if (pugi::xml_attribute v = sheet_view.attribute("view"); v) {
+    const std::string_view mode = v.value();
+    // "normal" is the schema default; keep the model empty for it so a
+    // default sheet stays byte-clean on re-emit.
+    if (mode != "normal") {
+      view.view_mode.assign(mode);
+    }
+  }
+  pugi::xml_node pane = sheet_view.child("pane");
+  if (pane) {
+    // `ST_PaneState` has three values; two of them freeze. `frozenSplit`
+    // is a frozen pane that also remembers a movable split position, so
+    // its xSplit/ySplit bind the frozen extent exactly like `frozen`.
+    const std::string_view state = attr_str(pane, "state");
+    if (state == "frozen" || state == "frozenSplit") {
+      const std::int32_t y = attr_i32(pane, "ySplit", 0);
+      const std::int32_t x = attr_i32(pane, "xSplit", 0);
+      if (y > 0) {
+        view.freeze_rows = static_cast<std::uint32_t>(y);
+      }
+      if (x > 0) {
+        view.freeze_cols = static_cast<std::uint32_t>(x);
+      }
+    }
+  }
+}
+
+/// Parses `<sheetPr><tabHidden val="1"/></sheetPr>` into `view`.
+/// OOXML also accepts `<sheetPr><tabColor .../>`, but only `tabHidden`
+/// is a visibility-affecting flag for the worksheet part itself. The
+/// workbook-level `<sheet state="hidden">` form is handled in
+/// `read_ooxml`; this helper preserves any prior `tab_hidden` state so
+/// the merge is OR-style.
+void ApplySheetPrTabHidden(const pugi::xml_node& worksheet, SheetView& view) {
+  pugi::xml_node sheet_pr = worksheet.child("sheetPr");
+  if (!sheet_pr) {
+    return;
+  }
+  // Some writers emit `tabHidden` as a direct attribute (`<sheetPr
+  // tabHidden="1"/>`); others emit it as a child element with a `val`
+  // attribute. Accept both shapes.
+  if (attr_bool(sheet_pr, "tabHidden")) {
+    view.tab_hidden = true;
+  }
+  if (pugi::xml_node child = sheet_pr.child("tabHidden"); child) {
+    if (child.attribute("val")) {
+      if (attr_bool(child, "val")) {
+        view.tab_hidden = true;
+      }
+    } else {
+      // Bare `<tabHidden/>` element with no `val` attribute is treated
+      // as `val="1"` to match what Excel's older writers emit.
+      view.tab_hidden = true;
+    }
+  }
+}
+
+/// Parses `<sheetFormatPr defaultColWidth defaultRowHeight baseColWidth/>`
+/// into `defaults`. The element appears before `<cols>` in the worksheet
+/// part. Absent attributes leave the corresponding fields at their
+/// struct defaults; `defaultColWidth` / `defaultRowHeight` also set the
+/// `has_*` flags so a consumer can distinguish an explicit `0` from an
+/// absent attribute.
+///
+/// A measurement outside the shared non-negative-double lexical space is
+/// treated as absent, flag included: these three sizes are what the
+/// paginator falls back to for every un-overridden track, so admitting an
+/// infinity or a NaN here changes the page count of the whole sheet.
+void ApplySheetFormatDefaults(const pugi::xml_node& worksheet, SheetFormatDefaults& defaults) {
+  pugi::xml_node fmt = worksheet.child("sheetFormatPr");
+  if (!fmt) {
+    return;
+  }
+  double measurement = 0.0;
+  if (parse_xsd_nonneg_double(attr_str(fmt, "defaultColWidth"), &measurement)) {
+    defaults.default_col_width = measurement;
+    defaults.has_default_col_width = true;
+  }
+  if (parse_xsd_nonneg_double(attr_str(fmt, "defaultRowHeight"), &measurement)) {
+    defaults.default_row_height = measurement;
+    defaults.has_default_row_height = true;
+  }
+  if (parse_xsd_nonneg_double(attr_str(fmt, "baseColWidth"), &measurement)) {
+    defaults.base_col_width = measurement;
+  }
+}
+
+/// Parses `<cols><col min max width style hidden outlineLevel/></cols>` into
+/// `layout.columns`. Width and style retain attribute presence, so explicit
+/// zero values remain distinct from an omitted attribute. A valid span that
+/// carries only hidden / outline metadata is retained even when it has no
+/// width; pure `customWidth=1` / `bestFit=1` markers remain a no-op.
+void ApplyColumnLayouts(const pugi::xml_node& worksheet, SheetLayout& layout) {
+  pugi::xml_node cols = worksheet.child("cols");
+  if (!cols) {
+    return;
+  }
+  for (pugi::xml_node col = cols.child("col"); col; col = col.next_sibling("col")) {
+    if (!col.attribute("min") || !col.attribute("max")) {
+      continue;
+    }
+    const std::int32_t min_v = attr_i32(col, "min", 0);
+    const std::int32_t max_v = attr_i32(col, "max", 0);
+    if (min_v < 1 || max_v < min_v) {
+      continue;
+    }
+    ColumnLayout entry;
+    entry.first = static_cast<std::uint32_t>(min_v - 1);
+    entry.last = static_cast<std::uint32_t>(max_v - 1);
+    double width = 0.0;
+    if (parse_xsd_nonneg_double(attr_str(col, "width"), &width)) {
+      entry.width = width;
+      entry.has_width = true;
+    }
+    if (pugi::xml_attribute style_attr = col.attribute("style"); style_attr) {
+      entry.style_xf = attr_u32(col, "style", 0U);
+      entry.has_style = true;
+    }
+    if (pugi::xml_attribute hidden_attr = col.attribute("hidden"); hidden_attr) {
+      entry.hidden = attr_bool(col, "hidden");
+    }
+    if (pugi::xml_attribute outline_attr = col.attribute("outlineLevel"); outline_attr) {
+      entry.outline_level = parse_outline_level(outline_attr.value());
+    }
+    if (!entry.has_width && !entry.has_style && !col.attribute("hidden") && !col.attribute("outlineLevel")) {
+      // A span with only a marker such as `bestFit` has no observable
+      // layout state in this model.
+      continue;
+    }
+    layout.columns.push_back(entry);
+  }
+}
+
+/// Walks `<sheetData><row .../></sheetData>` collecting per-row
+/// overrides (height / hidden / outline / custom row style) into
+/// `layout.row_overrides`. A row `s=` attribute is effective only when
+/// `customFormat="1"`; when customFormat is true but `s` is absent, the
+/// effective style is the explicit default xf 0.
+/// Rows that carry only `r` (the row number) are skipped — they are
+/// just position markers and have no override payload.
+void ApplyRowOverrides(const pugi::xml_node& worksheet, SheetLayout& layout) {
+  pugi::xml_node sheet_data = worksheet.child("sheetData");
+  if (!sheet_data) {
+    return;
+  }
+  for (pugi::xml_node row = sheet_data.child("row"); row; row = row.next_sibling("row")) {
+    pugi::xml_attribute r_attr = row.attribute("r");
+    pugi::xml_attribute ht_attr = row.attribute("ht");
+    pugi::xml_attribute hidden_attr = row.attribute("hidden");
+    pugi::xml_attribute outline_attr = row.attribute("outlineLevel");
+    pugi::xml_attribute custom_format_attr = row.attribute("customFormat");
+    pugi::xml_attribute style_attr = row.attribute("s");
+    const bool custom_format = custom_format_attr && read_xsd_bool(row, "customFormat", false);
+    // An `ht` outside the shared non-negative-double lexical space is
+    // treated as absent for both the contribute test below and the stored
+    // override, so a row carrying nothing else does not become an
+    // all-defaults entry.
+    double height = 0.0;
+    const bool has_height = ht_attr && parse_xsd_nonneg_double(attr_str(row, "ht"), &height);
+    if (!has_height && !hidden_attr && !outline_attr && !custom_format) {
+      continue;
+    }
+    if (!r_attr) {
+      continue;
+    }
+    // A row number outside the shared non-negative-integer lexical space
+    // is treated as absent and the override is dropped, on both read
+    // paths: attaching the override to whatever prefix happened to parse
+    // would silently restyle an unrelated row.
+    std::uint32_t r_v = 0;
+    if (!parse_xsd_nonneg_int(attr_str(row, "r"), &r_v) || r_v < 1U) {
+      continue;
+    }
+    RowLayout entry;
+    entry.row = r_v - 1U;
+    if (has_height) {
+      entry.height = height;
+      entry.has_height = true;
+      entry.custom_height = read_xsd_bool(row, "customHeight", false);
+    }
+    if (hidden_attr) {
+      entry.hidden = read_xsd_bool(row, "hidden", false);
+    }
+    if (outline_attr) {
+      entry.outline_level = parse_outline_level(outline_attr.value());
+    }
+    if (custom_format) {
+      entry.has_style = true;
+      entry.style_xf = style_attr ? attr_u32(row, "s", 0U) : 0U;
+    }
+    layout.row_overrides.push_back(entry);
+  }
+}
+
+}  // namespace
+
+Expected<void, Error> read_sheet_view_and_layout(const pugi::xml_document& sheet_doc, std::size_t sheet_index,
+                                                 Workbook& workbook) {
+  if (sheet_index >= workbook.sheet_count()) {
+    std::string ctx("context=sheet_reader.view_layout sheet_index=");
+    ctx.append(std::to_string(sheet_index));
+    ctx.append(" sheet_count=");
+    ctx.append(std::to_string(workbook.sheet_count()));
+    return make_error(FormulonErrorCode::kInvalidArgument, "read_sheet_view_and_layout: sheet_index out of range",
+                      std::move(ctx));
+  }
+  pugi::xml_node worksheet = sheet_doc.child("worksheet");
+  if (!worksheet) {
+    return make_error(FormulonErrorCode::kIoSheetCorrupt, "sheet doc: missing <worksheet> root",
+                      "context=sheet_reader.view_layout");
+  }
+  Sheet& sheet = workbook.sheet(sheet_index);
+  SheetView& view = sheet.mutable_view();
+  SheetLayout& layout = sheet.mutable_layout();
+  ApplySheetView(worksheet, view);
+  ApplySheetPrTabHidden(worksheet, view);
+  ApplySheetFormatDefaults(worksheet, sheet.mutable_format_defaults());
+  ApplyColumnLayouts(worksheet, layout);
+  ApplyRowOverrides(worksheet, layout);
+  return Expected<void, Error>::Ok();
+}
+
+}  // namespace io
+}  // namespace formulon
diff --git a/src/io/sheet_layout_reader.h b/src/io/sheet_layout_reader.h
new file mode 100644
index 000000000..06234ebb3
--- /dev/null
+++ b/src/io/sheet_layout_reader.h
@@ -0,0 +1,54 @@
+//
+// Worksheet view and layout reader: viewport state, sheet format
+// defaults, `<cols>` spans and `<row>`-level overrides.
+
+#ifndef FORMULON_IO_SHEET_LAYOUT_READER_H_
+#define FORMULON_IO_SHEET_LAYOUT_READER_H_
+
+#include <cstddef>
+
+#include "pugixml.hpp"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+
+/// Reads non-cell worksheet metadata from the parsed `sheet*.xml`
+/// document and writes it onto `workbook.sheet(sheet_index)`. Currently
+/// covers the viewport state mirrored by `Sheet::view()` (zoom scale,
+/// frozen panes, tab visibility) and the layout overrides mirrored by
+/// `Sheet::layout()` (`<cols>` spans, `<row>`-level height / hidden /
+/// outline overrides).
+///
+/// Behaviour:
+///   * `<sheetView zoomScale="...">` — clamped to `[10, 400]`, defaulting
+///     to `SheetView::kDefaultZoomScale` when absent or out of range.
+///   * `<sheetView><pane state="frozen" xSplit ySplit/></sheetView>` —
+///     populates `freeze_rows` / `freeze_cols`. `state="frozenSplit"`
+///     is equally frozen and is read the same way; the model does not
+///     carry the split position, so the writer re-emits both spellings
+///     as `state="frozen"`. A `state="split"` pane leaves both at `0`.
+///   * `<sheetPr><tabHidden val="1"/></sheetPr>` — sets
+///     `view().tab_hidden`. The workbook-side `<sheet state="hidden">`
+///     path (handled in `read_ooxml`) merges OR-style: either signal
+///     marks the sheet as hidden.
+///   * `<cols>/<col min max width style hidden outlineLevel/>` — appended to
+///     `layout().columns`. Width/style attribute presence is preserved,
+///     including explicit zero values; valid hidden/outline-only spans are
+///     retained. A `customWidth=1` / `bestFit=1` marker without any stored
+///     layout state remains a no-op for the model.
+///   * `<row r ht hidden outlineLevel s customFormat ...>` — appended to
+///     `layout().row_overrides` when a metric/visibility/outline override is
+///     present or when `customFormat=1`; row `s` is ignored otherwise.
+///
+/// Returns `kIoSheetCorrupt` when the worksheet root is malformed.
+/// Missing optional sub-elements are not errors.
+Expected<void, Error> read_sheet_view_and_layout(const pugi::xml_document& sheet_doc, std::size_t sheet_index,
+                                                 Workbook& workbook);
+
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_SHEET_LAYOUT_READER_H_
diff --git a/src/io/sheet_overlay_reader.cpp b/src/io/sheet_overlay_reader.cpp
new file mode 100644
index 000000000..66bef2614
--- /dev/null
+++ b/src/io/sheet_overlay_reader.cpp
@@ -0,0 +1,383 @@
+//
+// Presentation-overlay readers for one worksheet: merged cells, hyperlinks,
+// data validations and sheet protection. See sheet_overlay_reader.h for the
+// public contract.
+
+#include "io/sheet_overlay_reader.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <unordered_map>
+#include <utility>
+#include <vector>
+
+#include "io/cell_parser.h"
+#include "io/cf_reader.h"
+#include "io/xml_escape.h"
+#include "io/xml_utils.h"
+#include "io/xsd_bool.h"
+#include "pugixml.hpp"
+#include "sheet.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "utils/structured_log.h"
+
+namespace formulon {
+namespace io {
+
+namespace {
+
+/// Decodes one A1-style range token (`A1`, `A1:B5`, or `$A$1:$B$5`)
+/// into a `MergeRange`. Single-cell tokens land as `first == last`.
+/// Both corners are normalised so `first <= last` componentwise.
+Expected<MergeRange, Error> ParseA1RangeMerge(std::string_view ref) {
+  const std::size_t colon = ref.find(':');
+  if (colon == std::string_view::npos) {
+    auto rc = parse_a1(ref);
+    if (!rc) {
+      std::string ctx("context=sheet_reader ref=");
+      ctx.append(ref);
+      return make_error(FormulonErrorCode::kIoSheetCorrupt, "merge/hyperlink: ref token unparseable", std::move(ctx));
+    }
+    MergeRange out{};
+    out.first_row = rc.value().first;
+    out.first_col = rc.value().second;
+    out.last_row = out.first_row;
+    out.last_col = out.first_col;
+    return out;
+  }
+  const std::string_view a = ref.substr(0, colon);
+  const std::string_view b = ref.substr(colon + 1);
+  auto a_rc = parse_a1(a);
+  auto b_rc = parse_a1(b);
+  if (!a_rc || !b_rc) {
+    std::string ctx("context=sheet_reader ref=");
+    ctx.append(ref);
+    return make_error(FormulonErrorCode::kIoSheetCorrupt, "merge: ref token unparseable", std::move(ctx));
+  }
+  const std::uint32_t r0 = a_rc.value().first;
+  const std::uint32_t c0 = a_rc.value().second;
+  const std::uint32_t r1 = b_rc.value().first;
+  const std::uint32_t c1 = b_rc.value().second;
+  MergeRange out{};
+  out.first_row = (r0 < r1) ? r0 : r1;
+  out.first_col = (c0 < c1) ? c0 : c1;
+  out.last_row = (r0 < r1) ? r1 : r0;
+  out.last_col = (c0 < c1) ? c1 : c0;
+  return out;
+}
+
+/// Emits the WARN diagnostic for one skipped presentation-overlay entry.
+/// Merges, hyperlinks and data validations are optional worksheet
+/// metadata carrying no cell value, so a single malformed reference
+/// drops that entry and load continues — the same disposition
+/// `read_conditional_formats` applies to a malformed `<conditionalFormatting>`
+/// block. Genuine cell-data corruption still fails the sheet.
+void SkipOverlayEntry(std::string_view part, std::string_view reason, std::string_view ref,
+                      ReadDiagnostics* diagnostics) {
+  StructuredLog("io.sheet.overlay.skip")
+      .field("part", part)
+      .field("reason", reason)
+      .field("ref", ref)
+      .error_code(FormulonErrorCode::kIoSheetCorrupt)
+      .warn();
+  if (diagnostics != nullptr) {
+    ++diagnostics->skipped_feature_count;
+  }
+}
+
+/// Splits a whitespace-separated `sqref="A1 B2:C3 D4"` attribute and
+/// decodes each token. Returns `kIoSheetCorrupt` on the first
+/// unparseable token.
+Expected<std::vector<MergeRange>, Error> ParseSqrefRanges(std::string_view sqref) {
+  std::vector<MergeRange> out;
+  std::size_t i = 0;
+  while (i < sqref.size()) {
+    while (i < sqref.size() && (sqref[i] == ' ' || sqref[i] == '\t' || sqref[i] == '\n' || sqref[i] == '\r')) {
+      ++i;
+    }
+    const std::size_t start = i;
+    while (i < sqref.size() && sqref[i] != ' ' && sqref[i] != '\t' && sqref[i] != '\n' && sqref[i] != '\r') {
+      ++i;
+    }
+    if (start == i) {
+      break;
+    }
+    auto r = ParseA1RangeMerge(sqref.substr(start, i - start));
+    if (!r) {
+      return r.error();
+    }
+    out.push_back(r.value());
+  }
+  return out;
+}
+
+}  // namespace
+
+Expected<std::vector<MergeRange>, Error> read_merges(const pugi::xml_node& worksheet, ReadDiagnostics* diagnostics) {
+  std::vector<MergeRange> out;
+  if (!worksheet) {
+    return out;
+  }
+  pugi::xml_node mc = worksheet.child("mergeCells");
+  if (!mc) {
+    return out;
+  }
+  for (pugi::xml_node m = mc.child("mergeCell"); m; m = m.next_sibling("mergeCell")) {
+    const std::string_view ref = attr_str(m, "ref");
+    if (ref.empty()) {
+      SkipOverlayEntry("mergeCells", "ref attribute missing or empty", ref, diagnostics);
+      continue;
+    }
+    auto r = ParseA1RangeMerge(ref);
+    if (!r) {
+      SkipOverlayEntry("mergeCells", "ref unparseable", ref, diagnostics);
+      continue;
+    }
+    out.push_back(r.value());
+  }
+  return out;
+}
+
+Expected<std::vector<Hyperlink>, Error> read_hyperlinks(const pugi::xml_node& worksheet, ReadDiagnostics* diagnostics) {
+  std::vector<Hyperlink> out;
+  if (!worksheet) {
+    return out;
+  }
+  pugi::xml_node node = worksheet.child("hyperlinks");
+  if (!node) {
+    return out;
+  }
+  for (pugi::xml_node h = node.child("hyperlink"); h; h = h.next_sibling("hyperlink")) {
+    const std::string_view ref = attr_str(h, "ref");
+    if (ref.empty()) {
+      SkipOverlayEntry("hyperlinks", "ref attribute missing or empty", ref, diagnostics);
+      continue;
+    }
+    // Hyperlinks may span a range (`ref="A1:B2"`); Excel applies the link
+    // to every cell. Keep both corners in the model so structural edits can
+    // shrink/shift the complete rectangle and the writer can regenerate the
+    // A1 reference from numeric coordinates.
+    auto range_or = ParseA1RangeMerge(ref);
+    if (!range_or) {
+      SkipOverlayEntry("hyperlinks", "ref unparseable", ref, diagnostics);
+      continue;
+    }
+    Hyperlink hl;
+    hl.row = range_or.value().first_row;
+    hl.col = range_or.value().first_col;
+    hl.last_row = range_or.value().last_row;
+    hl.last_col = range_or.value().last_col;
+    // Accept both Office-namespaced ("r:id") and bare "id" attribute spellings.
+    const std::string_view rid_v = attr_str(h, "r:id");
+    if (!rid_v.empty()) {
+      hl.rid.assign(rid_v);
+    } else {
+      hl.rid.assign(attr_str(h, "id"));
+    }
+    hl.location.assign(attr_str(h, "location"));
+    hl.display.assign(attr_str(h, "display"));
+    hl.tooltip.assign(attr_str(h, "tooltip"));
+    out.push_back(std::move(hl));
+  }
+  return out;
+}
+
+void apply_hyperlink_rels(std::vector<Hyperlink>& hyperlinks,
+                          const std::unordered_map<std::string, std::string>& rid_to_target) {
+  for (Hyperlink& h : hyperlinks) {
+    if (h.rid.empty()) {
+      continue;
+    }
+    auto it = rid_to_target.find(h.rid);
+    if (it == rid_to_target.end()) {
+      continue;
+    }
+    h.target = it->second;
+  }
+}
+
+Expected<std::vector<DataValidation>, Error> read_data_validations(const pugi::xml_node& worksheet,
+                                                                   ReadDiagnostics* diagnostics) {
+  std::vector<DataValidation> out;
+  if (!worksheet) {
+    return out;
+  }
+  pugi::xml_node dvs = worksheet.child("dataValidations");
+  if (!dvs) {
+    return out;
+  }
+  for (pugi::xml_node dv = dvs.child("dataValidation"); dv; dv = dv.next_sibling("dataValidation")) {
+    DataValidation v;
+    const std::string_view sqref = attr_str(dv, "sqref");
+    if (sqref.empty()) {
+      SkipOverlayEntry("dataValidations", "sqref attribute missing or empty", sqref, diagnostics);
+      continue;
+    }
+    auto ranges_or = ParseSqrefRanges(sqref);
+    if (!ranges_or) {
+      SkipOverlayEntry("dataValidations", "sqref unparseable", sqref, diagnostics);
+      continue;
+    }
+    v.ranges = std::move(ranges_or.value());
+
+    // type
+    const std::string_view t = attr_str(dv, "type");
+    if (t == "whole") {
+      v.type = 1;
+    } else if (t == "decimal") {
+      v.type = 2;
+    } else if (t == "list") {
+      v.type = 3;
+    } else if (t == "date") {
+      v.type = 4;
+    } else if (t == "time") {
+      v.type = 5;
+    } else if (t == "textLength") {
+      v.type = 6;
+    } else if (t == "custom") {
+      v.type = 7;
+    } else {
+      v.type = 0;
+    }
+
+    // operator
+    const std::string_view op = attr_str(dv, "operator");
+    if (op == "notBetween") {
+      v.op = 1;
+    } else if (op == "equal") {
+      v.op = 2;
+    } else if (op == "notEqual") {
+      v.op = 3;
+    } else if (op == "greaterThan") {
+      v.op = 4;
+    } else if (op == "lessThan") {
+      v.op = 5;
+    } else if (op == "greaterThanOrEqual") {
+      v.op = 6;
+    } else if (op == "lessThanOrEqual") {
+      v.op = 7;
+    } else {
+      v.op = 0;  // "between" / unspecified
+    }
+
+    // errorStyle
+    const std::string_view es = attr_str(dv, "errorStyle");
+    if (es == "warning") {
+      v.error_style = 1;
+    } else if (es == "information") {
+      v.error_style = 2;
+    } else {
+      v.error_style = 0;
+    }
+
+    // Boolean attributes default to false: Excel omits allowBlank when it
+    // is off (the .xlsb twin's fAllowBlank bit is clear) and writes "1"
+    // when it is on.
+    v.allow_blank = false;
+    if (pugi::xml_attribute ab = dv.attribute("allowBlank"); ab) {
+      v.allow_blank = parse_xml_bool(ab.value());
+    }
+    if (pugi::xml_attribute sim = dv.attribute("showInputMessage"); sim) {
+      v.show_input_message = parse_xml_bool(sim.value());
+    }
+    if (pugi::xml_attribute sem = dv.attribute("showErrorMessage"); sem) {
+      v.show_error_message = parse_xml_bool(sem.value());
+    }
+    // `showDropDown` has inverted semantics: presence with a true value
+    // suppresses the arrow, so the user-facing `show_dropdown` is the
+    // negation of the raw attribute (absent/false attribute => shown).
+    if (pugi::xml_attribute sdd = dv.attribute("showDropDown"); sdd) {
+      v.show_dropdown = !parse_xml_bool(sdd.value());
+    }
+
+    v.error_title.assign(attr_str(dv, "errorTitle"));
+    v.error_message.assign(attr_str(dv, "error"));
+    v.prompt_title.assign(attr_str(dv, "promptTitle"));
+    v.prompt_message.assign(attr_str(dv, "prompt"));
+
+    // `AppendOoxmlTextUnescaped` decodes the OOXML `_xHHHH_` control-
+    // character escapes the writer emits for this slot (`AppendXmlEscaped`
+    // in ooxml/sheet_xml_builder.cpp), on top of `.text().get()`'s
+    // ordinary XML entity decoding.
+    if (pugi::xml_node f1 = dv.child("formula1"); f1) {
+      v.formula1.clear();
+      AppendOoxmlTextUnescaped(v.formula1, f1.text().get());
+      if (!v.formula1.empty() && v.formula1.front() == '=') {
+        v.formula1.erase(0, 1);
+      }
+      v.formula1 = canonical_feature_formula(v.formula1);
+    }
+    if (pugi::xml_node f2 = dv.child("formula2"); f2) {
+      v.formula2.clear();
+      AppendOoxmlTextUnescaped(v.formula2, f2.text().get());
+      if (!v.formula2.empty() && v.formula2.front() == '=') {
+        v.formula2.erase(0, 1);
+      }
+      v.formula2 = canonical_feature_formula(v.formula2);
+    }
+
+    out.push_back(std::move(v));
+  }
+  return out;
+}
+
+SheetProtection read_sheet_protection(const pugi::xml_node& worksheet) {
+  SheetProtection out;
+  if (!worksheet) {
+    return out;
+  }
+  const pugi::xml_node node = worksheet.child("sheetProtection");
+  if (!node) {
+    return out;
+  }
+  out.enabled = true;
+
+  out.algorithm_name.assign(attr_str(node, "algorithmName"));
+  out.hash_value.assign(attr_str(node, "hashValue"));
+  out.salt_value.assign(attr_str(node, "saltValue"));
+  if (pugi::xml_attribute sc = node.attribute("spinCount"); sc) {
+    // Saturate at both ends rather than truncating. A `static_cast` of a
+    // value above 2^32-1 wraps, and a value that wraps to exactly 0 is then
+    // dropped by the writer's non-zero guard, so the saved file would carry
+    // a hash and salt with no iteration count at all. This surface promises
+    // verbatim round-trip, so an unrepresentable count must degrade to the
+    // nearest representable one instead of disappearing.
+    const long long parsed = sc.as_llong(0);
+    out.spin_count = parsed < 0 ? 0U
+                     : parsed > static_cast<long long>(std::numeric_limits<std::uint32_t>::max())
+                         ? std::numeric_limits<std::uint32_t>::max()
+                         : static_cast<std::uint32_t>(parsed);
+  }
+  out.legacy_password.assign(attr_str(node, "password"));
+
+  // Per-attribute XSD defaults (ECMA-376 §18.3.1.85). Eleven action flags
+  // (format*, insert*, delete*, sort, autoFilter, pivotTables) default to
+  // TRUE (locked); the rest default to FALSE. Reading with the wrong
+  // default silently under-reports protection when Excel omits an
+  // at-default attribute, so use the tri-state reader with each attribute's
+  // real default rather than a blanket `false`.
+  out.sheet = read_xsd_bool(node, "sheet", false);
+  out.objects = read_xsd_bool(node, "objects", false);
+  out.scenarios = read_xsd_bool(node, "scenarios", false);
+  out.format_cells = read_xsd_bool(node, "formatCells", true);
+  out.format_columns = read_xsd_bool(node, "formatColumns", true);
+  out.format_rows = read_xsd_bool(node, "formatRows", true);
+  out.insert_columns = read_xsd_bool(node, "insertColumns", true);
+  out.insert_rows = read_xsd_bool(node, "insertRows", true);
+  out.insert_hyperlinks = read_xsd_bool(node, "insertHyperlinks", true);
+  out.delete_columns = read_xsd_bool(node, "deleteColumns", true);
+  out.delete_rows = read_xsd_bool(node, "deleteRows", true);
+  out.select_locked_cells = read_xsd_bool(node, "selectLockedCells", false);
+  out.select_unlocked_cells = read_xsd_bool(node, "selectUnlockedCells", false);
+  out.sort = read_xsd_bool(node, "sort", true);
+  out.auto_filter = read_xsd_bool(node, "autoFilter", true);
+  out.pivot_tables = read_xsd_bool(node, "pivotTables", true);
+
+  return out;
+}
+
+}  // namespace io
+}  // namespace formulon
diff --git a/src/io/sheet_overlay_reader.h b/src/io/sheet_overlay_reader.h
new file mode 100644
index 000000000..767e7e028
--- /dev/null
+++ b/src/io/sheet_overlay_reader.h
@@ -0,0 +1,78 @@
+//
+// Per-sheet presentation overlays: `<mergeCells>`, `<hyperlinks>`,
+// `<dataValidations>` and `<sheetProtection>`. These carry no cell value, so
+// they are read independently of the `<sheetData>` walker in `sheet_reader.h`.
+
+#ifndef FORMULON_IO_SHEET_OVERLAY_READER_H_
+#define FORMULON_IO_SHEET_OVERLAY_READER_H_
+
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+#include "io/package_diagnostics.h"
+#include "pugixml.hpp"
+#include "sheet.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon {
+namespace io {
+
+/// Walks `<mergeCells>` inside `worksheet` and returns the parsed
+/// `MergeRange` list in document order. Returns an empty vector when
+/// the sheet has no merges.
+///
+/// Invalid-reference policy — shared by every presentation-overlay
+/// reader on this sheet (merges, hyperlinks, data validations, and
+/// `read_conditional_formats`): an entry whose reference is missing,
+/// empty or unparseable is dropped with a WARN diagnostic
+/// (`io.sheet.overlay.skip`) and the walk continues. None of this
+/// metadata carries a cell value, so one malformed entry must not cost
+/// the caller the whole workbook. Corruption inside `<sheetData>` still
+/// fails the sheet with `kIoSheetCorrupt`.
+///
+/// Every such drop bumps `diagnostics->skipped_feature_count` when
+/// `diagnostics` is non-NULL. The structured log is off by default in
+/// shipped builds, so that counter is what surfaces the loss to a caller.
+/// Passing NULL discards the count.
+Expected<std::vector<MergeRange>, Error> read_merges(const pugi::xml_node& worksheet,
+                                                     ReadDiagnostics* diagnostics = nullptr);
+
+/// Walks `<hyperlinks>` inside `worksheet` and returns the parsed
+/// `Hyperlink` list in document order. The reader populates
+/// `Hyperlink::rid` from the `r:id` attribute as observed; the caller
+/// is responsible for joining each rid against the sheet's rels file
+/// to fill in `target` (external URL) — see `apply_hyperlink_rels`.
+/// A malformed `ref=` drops that hyperlink under the invalid-reference
+/// policy documented on `read_merges`, `diagnostics` included.
+Expected<std::vector<Hyperlink>, Error> read_hyperlinks(const pugi::xml_node& worksheet,
+                                                        ReadDiagnostics* diagnostics = nullptr);
+
+/// Joins `hyperlinks` against the parsed sheet rels file (`rid -> target`
+/// map) populating `Hyperlink::target` in place for entries whose `rid`
+/// matches an entry in `rid_to_target`. Entries with empty `rid` or no
+/// matching rid are left untouched (their `target` stays whatever the
+/// reader picked up from any inline `location` attribute).
+void apply_hyperlink_rels(std::vector<Hyperlink>& hyperlinks,
+                          const std::unordered_map<std::string, std::string>& rid_to_target);
+
+/// Walks `<dataValidations>` inside `worksheet` and returns the parsed
+/// `DataValidation` list in document order. Returns an empty vector
+/// when the sheet has no validations. A malformed `sqref=` drops that
+/// validation under the invalid-reference policy documented on
+/// `read_merges`, `diagnostics` included.
+Expected<std::vector<DataValidation>, Error> read_data_validations(const pugi::xml_node& worksheet,
+                                                                   ReadDiagnostics* diagnostics = nullptr);
+
+/// Reads `<sheetProtection>` from the sheet and returns the parsed
+/// `SheetProtection`. When the element is absent the result has
+/// `enabled = false` and every other field at its default. The reader
+/// never fails: malformed attribute values fall back to their default
+/// (matching pugixml's xsd:boolean conversion behaviour).
+SheetProtection read_sheet_protection(const pugi::xml_node& worksheet);
+
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_SHEET_OVERLAY_READER_H_
diff --git a/src/io/sheet_reader.cpp b/src/io/sheet_reader.cpp
index 3174030de..842059de3 100644
--- a/src/io/sheet_reader.cpp
+++ b/src/io/sheet_reader.cpp
@@ -46,6 +46,7 @@
 #include "pugixml.hpp"
 #include "sheet.h"
 #include "utils/arena.h"
+#include "utils/date_time.h"
 #include "utils/error.h"
 #include "utils/expected.h"
 #include "utils/resource_budget.h"
@@ -276,6 +277,16 @@ Expected<void, Error> ResolveFormula(const pugi::xml_node& c_node,
 Expected<void, Error> ApplyParsedCell(const ParsedCell& parsed, std::string_view formula_text, std::uint32_t xf_index,
                                       const std::vector<PhoneticRun>* phonetic_runs, PhoneticProperties phonetic_props,
                                       std::size_t sheet_index, Workbook& workbook, SheetReadContext& ctx) {
+  // `decode_cell_payload` deliberately produces all ISO dates on the
+  // canonical 1900 serial axis so DOM and SAX share one pure decoder. The
+  // workbook epoch is applied exactly once at this shared storage boundary,
+  // and only for a successfully parsed `t="d"` payload. Ordinary numeric
+  // literals with the same value must keep their original serial unchanged.
+  Value stored_value = parsed.value;
+  if (workbook.date1904() && parsed.is_iso_date && stored_value.is_number()) {
+    stored_value = Value::number(stored_value.as_number() - date_time::kDate1904EpochGap);
+  }
+
   // A `<c s="900">` against a five-entry `<cellXfs>` names no style. Fall
   // back to the default xf so the loaded workbook stays self-consistent:
   // `fm_cell_get_xf` resolves for every cell that loaded, and a save does
@@ -303,17 +314,17 @@ Expected<void, Error> ApplyParsedCell(const ParsedCell& parsed, std::string_view
     // This is essential when a workbook uses functions Formulon does not yet
     // implement: eagerly replacing a valid loaded cache with #NAME? makes a
     // read-only inspection or save/load round-trip lose useful data.
-    if (!parsed.value.is_blank() && !parsed.is_sst_index) {
-      workbook.sheet(sheet_index).set_cell_cached_value_borrowed(parsed.row, parsed.col, parsed.value);
+    if (!stored_value.is_blank() && !parsed.is_sst_index) {
+      workbook.sheet(sheet_index).set_cell_cached_value_borrowed(parsed.row, parsed.col, stored_value);
     }
-  } else if (parsed.value.is_blank()) {
+  } else if (stored_value.is_blank()) {
     // Skip blank-blank cells to keep the row map sparse, unless a style
-    // index exists: then the format is the payload and must materialise
-    // the cell below.
+    // index or explicit style attribute exists: then the format metadata
+    // is the payload and must materialise the cell below.
     if (parsed.is_sst_index) {
       ctx.pending_sst_cells.emplace_back(parsed.row, parsed.col, parsed.sst_index);
     }
-    if (xf_index == 0U) {
+    if (xf_index == 0U && !parsed.has_explicit_xf) {
       return Expected<void, Error>::Ok();
     }
   } else {
@@ -325,12 +336,12 @@ Expected<void, Error> ApplyParsedCell(const ParsedCell& parsed, std::string_view
     Sheet& sheet = workbook.sheet(sheet_index);
     const Cell* existing = sheet.cell_at(parsed.row, parsed.col);
     if (existing != nullptr && !existing->formula_text.empty()) {
-      auto wv = workbook.set_cell_value(sheet_index, parsed.row, parsed.col, parsed.value);
+      auto wv = workbook.set_cell_value(sheet_index, parsed.row, parsed.col, stored_value);
       if (!wv) {
         return wv.error();
       }
     } else {
-      sheet.set_cell_value(parsed.row, parsed.col, parsed.value);
+      sheet.set_cell_value(parsed.row, parsed.col, stored_value);
     }
   }
 
@@ -338,7 +349,7 @@ Expected<void, Error> ApplyParsedCell(const ParsedCell& parsed, std::string_view
     ctx.pending_sst_cells.emplace_back(parsed.row, parsed.col, parsed.sst_index);
   }
 
-  if (xf_index != 0U) {
+  if (xf_index != 0U || parsed.has_explicit_xf) {
     auto sx = workbook.set_cell_xf_index(sheet_index, parsed.row, parsed.col, xf_index);
     if (!sx) {
       return sx.error();
@@ -355,56 +366,7 @@ Expected<void, Error> ApplyParsedCell(const ParsedCell& parsed, std::string_view
 }  // namespace
 
 Expected<void, Error> RegisterArraySpills(Sheet& sheet, const std::vector<ArrayAnchor>& anchors) {
-  // Validate and charge every footprint before the first reserve or cell
-  // walk. This keeps a later malformed/over-budget anchor from arriving
-  // after an earlier one has already started an attacker-sized operation.
-  ResourceBudget budget(kMaxDynamicArrayCells, FormulonErrorCode::kIoSheetCorrupt);
-  for (const ArrayAnchor& a : anchors) {
-    auto cells_or = checked_array_anchor_cells(a.row, a.col, a.last_row, a.last_col, FormulonErrorCode::kIoSheetCorrupt,
-                                               "context=sheet_reader array_anchor");
-    if (!cells_or) {
-      return cells_or.error();
-    }
-    std::string context("context=sheet_reader format=ooxml anchor_row=");
-    context.append(std::to_string(a.row));
-    context.append(" anchor_col=");
-    context.append(std::to_string(a.col));
-    context.append(" last_row=");
-    context.append(std::to_string(a.last_row));
-    context.append(" last_col=");
-    context.append(std::to_string(a.last_col));
-    auto charged = consume_array_anchor_budget(budget, cells_or.value(), std::move(context));
-    if (!charged) {
-      return charged.error();
-    }
-  }
-
-  for (const ArrayAnchor& a : anchors) {
-    const std::uint32_t rows = a.last_row - a.row + 1U;
-    const std::uint32_t cols = a.last_col - a.col + 1U;
-    const std::uint64_t cell_count = static_cast<std::uint64_t>(rows) * cols;
-    std::vector<Value> values;
-    values.reserve(static_cast<std::size_t>(cell_count));
-    for (std::uint32_t r = a.row; r <= a.last_row; ++r) {
-      for (std::uint32_t c = a.col; c <= a.last_col; ++c) {
-        const Cell* cell = sheet.cell_at(r, c);
-        values.push_back(cell != nullptr ? cell->cached_value : Value::blank());
-      }
-    }
-    // Blank the non-anchor cells: their values now live in the region as
-    // phantoms, and blanking keeps them from blocking either this commit's
-    // collision scan or the anchor's re-spill on recalc.
-    for (std::uint32_t r = a.row; r <= a.last_row; ++r) {
-      for (std::uint32_t c = a.col; c <= a.last_col; ++c) {
-        if (r == a.row && c == a.col) {
-          continue;
-        }
-        sheet.set_cell_cached_value(r, c, Value::blank());
-      }
-    }
-    sheet.commit_spill(a.row, a.col, rows, cols, std::move(values));
-  }
-  return Expected<void, Error>::Ok();
+  return register_array_spills(sheet, anchors, FormulonErrorCode::kIoSheetCorrupt, "sheet_reader", "ooxml");
 }
 
 Expected<void, Error> read_sheet_data(const pugi::xml_document& sheet_doc, std::size_t sheet_index, Workbook& workbook,
@@ -464,8 +426,8 @@ Expected<void, Error> read_sheet_data(const pugi::xml_document& sheet_doc, std::
       // `RowCells::ensure()`, so it must not advance `cell_growth` either
       // -- otherwise a later real write in the same row would be charged
       // as if the gap it bridges were smaller than it actually is.
-      const bool materializes =
-          !formula_text.empty() || !parsed.value.is_blank() || parsed.is_sst_index || parsed.xf_index != 0U;
+      const bool materializes = !formula_text.empty() || !parsed.value.is_blank() || parsed.is_sst_index ||
+                                parsed.xf_index != 0U || parsed.has_explicit_xf;
       if (materializes) {
         const std::uint64_t growth = cell_growth.charge_for(parsed.row, parsed.col);
         if (growth != 0U) {
@@ -502,287 +464,6 @@ Expected<void, Error> read_sheet_data(const pugi::xml_document& sheet_doc, std::
   return Expected<void, Error>::Ok();
 }
 
-// ---------------------------------------------------------------------------
-// View / layout helpers. Each lives in an anonymous namespace so the
-// translation unit owns its parsing fences; the public driver
-// `read_sheet_view_and_layout` composes them in document order.
-// ---------------------------------------------------------------------------
-
-namespace {
-
-/// Saturating cast from a possibly-signed C string to `std::uint8_t`.
-/// Used for `outlineLevel`; OOXML caps the value at 7 but we accept up
-/// to 255 defensively and clamp negatives to 0.
-std::uint8_t ParseOutlineLevel(const char* text) noexcept {
-  if (text == nullptr || *text == '\0') {
-    return 0U;
-  }
-  // strtol is locale-independent for ASCII digits and doesn't pull in
-  // <iostream>. The result is clamped to [0, 255] so callers see a
-  // valid `uint8_t` even on garbage input.
-  char* end = nullptr;
-  const long n = std::strtol(text, &end, 10);
-  if (end == text) {
-    return 0U;
-  }
-  if (n <= 0) {
-    return 0U;
-  }
-  if (n >= 255) {
-    return 255U;
-  }
-  return static_cast<std::uint8_t>(n);
-}
-
-/// Parses `<sheetView zoomScale="...">` and `<pane state="frozen"
-/// xSplit="N" ySplit="M">` into `view`. Missing or out-of-range
-/// `zoomScale` falls back to `SheetView::kDefaultZoomScale`. A `<pane>`
-/// element whose `state` is neither `frozen` nor `frozenSplit` (or that
-/// is absent) leaves `freeze_rows` / `freeze_cols` at zero.
-void ApplySheetView(const pugi::xml_node& worksheet, SheetView& view) {
-  pugi::xml_node sheet_views = worksheet.child("sheetViews");
-  if (!sheet_views) {
-    return;
-  }
-  pugi::xml_node sheet_view = sheet_views.child("sheetView");
-  if (!sheet_view) {
-    return;
-  }
-  if (sheet_view.attribute("zoomScale")) {
-    const std::int32_t raw = attr_i32(sheet_view, "zoomScale", 0);
-    if (raw >= 10 && raw <= 400) {
-      view.zoom_scale = static_cast<std::uint32_t>(raw);
-    }
-  }
-  // Display attributes. Three default to true in the schema, so absence
-  // means "shown"; the tri-state reader applies each attribute's real
-  // default rather than a blanket false.
-  view.show_grid_lines = read_xsd_bool(sheet_view, "showGridLines", true);
-  view.show_row_col_headers = read_xsd_bool(sheet_view, "showRowColHeaders", true);
-  view.show_zeros = read_xsd_bool(sheet_view, "showZeros", true);
-  view.right_to_left = read_xsd_bool(sheet_view, "rightToLeft", false);
-  view.tab_selected = read_xsd_bool(sheet_view, "tabSelected", false);
-  if (pugi::xml_attribute v = sheet_view.attribute("view"); v) {
-    const std::string_view mode = v.value();
-    // "normal" is the schema default; keep the model empty for it so a
-    // default sheet stays byte-clean on re-emit.
-    if (mode != "normal") {
-      view.view_mode.assign(mode);
-    }
-  }
-  pugi::xml_node pane = sheet_view.child("pane");
-  if (pane) {
-    // `ST_PaneState` has three values; two of them freeze. `frozenSplit`
-    // is a frozen pane that also remembers a movable split position, so
-    // its xSplit/ySplit bind the frozen extent exactly like `frozen`.
-    const std::string_view state = attr_str(pane, "state");
-    if (state == "frozen" || state == "frozenSplit") {
-      const std::int32_t y = attr_i32(pane, "ySplit", 0);
-      const std::int32_t x = attr_i32(pane, "xSplit", 0);
-      if (y > 0) {
-        view.freeze_rows = static_cast<std::uint32_t>(y);
-      }
-      if (x > 0) {
-        view.freeze_cols = static_cast<std::uint32_t>(x);
-      }
-    }
-  }
-}
-
-/// Parses `<sheetPr><tabHidden val="1"/></sheetPr>` into `view`.
-/// OOXML also accepts `<sheetPr><tabColor .../>`, but only `tabHidden`
-/// is a visibility-affecting flag for the worksheet part itself. The
-/// workbook-level `<sheet state="hidden">` form is handled in
-/// `read_ooxml`; this helper preserves any prior `tab_hidden` state so
-/// the merge is OR-style.
-void ApplySheetPrTabHidden(const pugi::xml_node& worksheet, SheetView& view) {
-  pugi::xml_node sheet_pr = worksheet.child("sheetPr");
-  if (!sheet_pr) {
-    return;
-  }
-  // Some writers emit `tabHidden` as a direct attribute (`<sheetPr
-  // tabHidden="1"/>`); others emit it as a child element with a `val`
-  // attribute. Accept both shapes.
-  if (attr_bool(sheet_pr, "tabHidden")) {
-    view.tab_hidden = true;
-  }
-  if (pugi::xml_node child = sheet_pr.child("tabHidden"); child) {
-    if (child.attribute("val")) {
-      if (attr_bool(child, "val")) {
-        view.tab_hidden = true;
-      }
-    } else {
-      // Bare `<tabHidden/>` element with no `val` attribute is treated
-      // as `val="1"` to match what Excel's older writers emit.
-      view.tab_hidden = true;
-    }
-  }
-}
-
-/// Parses `<sheetFormatPr defaultColWidth defaultRowHeight baseColWidth/>`
-/// into `defaults`. The element appears before `<cols>` in the worksheet
-/// part. Absent attributes leave the corresponding fields at their
-/// struct defaults; `defaultColWidth` / `defaultRowHeight` also set the
-/// `has_*` flags so a consumer can distinguish an explicit `0` from an
-/// absent attribute.
-///
-/// A measurement outside the shared non-negative-double lexical space is
-/// treated as absent, flag included: these three sizes are what the
-/// paginator falls back to for every un-overridden track, so admitting an
-/// infinity or a NaN here changes the page count of the whole sheet.
-void ApplySheetFormatDefaults(const pugi::xml_node& worksheet, SheetFormatDefaults& defaults) {
-  pugi::xml_node fmt = worksheet.child("sheetFormatPr");
-  if (!fmt) {
-    return;
-  }
-  double measurement = 0.0;
-  if (parse_xsd_nonneg_double(attr_str(fmt, "defaultColWidth"), &measurement)) {
-    defaults.default_col_width = measurement;
-    defaults.has_default_col_width = true;
-  }
-  if (parse_xsd_nonneg_double(attr_str(fmt, "defaultRowHeight"), &measurement)) {
-    defaults.default_row_height = measurement;
-    defaults.has_default_row_height = true;
-  }
-  if (parse_xsd_nonneg_double(attr_str(fmt, "baseColWidth"), &measurement)) {
-    defaults.base_col_width = measurement;
-  }
-}
-
-/// Parses `<cols><col min max width style hidden outlineLevel/></cols>` into
-/// `layout.columns`. Width and style retain attribute presence, so explicit
-/// zero values remain distinct from an omitted attribute. A valid span that
-/// carries only hidden / outline metadata is retained even when it has no
-/// width; pure `customWidth=1` / `bestFit=1` markers remain a no-op.
-void ApplyColumnLayouts(const pugi::xml_node& worksheet, SheetLayout& layout) {
-  pugi::xml_node cols = worksheet.child("cols");
-  if (!cols) {
-    return;
-  }
-  for (pugi::xml_node col = cols.child("col"); col; col = col.next_sibling("col")) {
-    if (!col.attribute("min") || !col.attribute("max")) {
-      continue;
-    }
-    const std::int32_t min_v = attr_i32(col, "min", 0);
-    const std::int32_t max_v = attr_i32(col, "max", 0);
-    if (min_v < 1 || max_v < min_v) {
-      continue;
-    }
-    ColumnLayout entry;
-    entry.first = static_cast<std::uint32_t>(min_v - 1);
-    entry.last = static_cast<std::uint32_t>(max_v - 1);
-    double width = 0.0;
-    if (parse_xsd_nonneg_double(attr_str(col, "width"), &width)) {
-      entry.width = width;
-      entry.has_width = true;
-    }
-    if (pugi::xml_attribute style_attr = col.attribute("style"); style_attr) {
-      entry.style_xf = attr_u32(col, "style", 0U);
-      entry.has_style = true;
-    }
-    if (pugi::xml_attribute hidden_attr = col.attribute("hidden"); hidden_attr) {
-      entry.hidden = attr_bool(col, "hidden");
-    }
-    if (pugi::xml_attribute outline_attr = col.attribute("outlineLevel"); outline_attr) {
-      entry.outline_level = ParseOutlineLevel(outline_attr.value());
-    }
-    if (!entry.has_width && !entry.has_style && !col.attribute("hidden") && !col.attribute("outlineLevel")) {
-      // A span with only a marker such as `bestFit` has no observable
-      // layout state in this model.
-      continue;
-    }
-    layout.columns.push_back(entry);
-  }
-}
-
-/// Walks `<sheetData><row .../></sheetData>` collecting per-row
-/// overrides (height / hidden / outline / custom row style) into
-/// `layout.row_overrides`. A row `s=` attribute is effective only when
-/// `customFormat="1"`; when customFormat is true but `s` is absent, the
-/// effective style is the explicit default xf 0.
-/// Rows that carry only `r` (the row number) are skipped — they are
-/// just position markers and have no override payload.
-void ApplyRowOverrides(const pugi::xml_node& worksheet, SheetLayout& layout) {
-  pugi::xml_node sheet_data = worksheet.child("sheetData");
-  if (!sheet_data) {
-    return;
-  }
-  for (pugi::xml_node row = sheet_data.child("row"); row; row = row.next_sibling("row")) {
-    pugi::xml_attribute r_attr = row.attribute("r");
-    pugi::xml_attribute ht_attr = row.attribute("ht");
-    pugi::xml_attribute hidden_attr = row.attribute("hidden");
-    pugi::xml_attribute outline_attr = row.attribute("outlineLevel");
-    pugi::xml_attribute custom_format_attr = row.attribute("customFormat");
-    pugi::xml_attribute style_attr = row.attribute("s");
-    const bool custom_format = custom_format_attr && read_xsd_bool(row, "customFormat", false);
-    // An `ht` outside the shared non-negative-double lexical space is
-    // treated as absent for both the contribute test below and the stored
-    // override, so a row carrying nothing else does not become an
-    // all-defaults entry.
-    double height = 0.0;
-    const bool has_height = ht_attr && parse_xsd_nonneg_double(attr_str(row, "ht"), &height);
-    if (!has_height && !hidden_attr && !outline_attr && !custom_format) {
-      continue;
-    }
-    if (!r_attr) {
-      continue;
-    }
-    // A row number outside the shared non-negative-integer lexical space
-    // is treated as absent and the override is dropped, on both read
-    // paths: attaching the override to whatever prefix happened to parse
-    // would silently restyle an unrelated row.
-    std::uint32_t r_v = 0;
-    if (!parse_xsd_nonneg_int(attr_str(row, "r"), &r_v) || r_v < 1U) {
-      continue;
-    }
-    RowLayout entry;
-    entry.row = r_v - 1U;
-    if (has_height) {
-      entry.height = height;
-      entry.has_height = true;
-    }
-    if (hidden_attr) {
-      entry.hidden = read_xsd_bool(row, "hidden", false);
-    }
-    if (outline_attr) {
-      entry.outline_level = ParseOutlineLevel(outline_attr.value());
-    }
-    if (custom_format) {
-      entry.has_style = true;
-      entry.style_xf = style_attr ? attr_u32(row, "s", 0U) : 0U;
-    }
-    layout.row_overrides.push_back(entry);
-  }
-}
-
-}  // namespace
-
-Expected<void, Error> read_sheet_view_and_layout(const pugi::xml_document& sheet_doc, std::size_t sheet_index,
-                                                 Workbook& workbook) {
-  if (sheet_index >= workbook.sheet_count()) {
-    std::string ctx("context=sheet_reader.view_layout sheet_index=");
-    ctx.append(std::to_string(sheet_index));
-    ctx.append(" sheet_count=");
-    ctx.append(std::to_string(workbook.sheet_count()));
-    return make_error(FormulonErrorCode::kInvalidArgument, "read_sheet_view_and_layout: sheet_index out of range",
-                      std::move(ctx));
-  }
-  pugi::xml_node worksheet = sheet_doc.child("worksheet");
-  if (!worksheet) {
-    return make_error(FormulonErrorCode::kIoSheetCorrupt, "sheet doc: missing <worksheet> root",
-                      "context=sheet_reader.view_layout");
-  }
-  Sheet& sheet = workbook.sheet(sheet_index);
-  SheetView& view = sheet.mutable_view();
-  SheetLayout& layout = sheet.mutable_layout();
-  ApplySheetView(worksheet, view);
-  ApplySheetPrTabHidden(worksheet, view);
-  ApplySheetFormatDefaults(worksheet, sheet.mutable_format_defaults());
-  ApplyColumnLayouts(worksheet, layout);
-  ApplyRowOverrides(worksheet, layout);
-  return Expected<void, Error>::Ok();
-}
-
 // ---------------------------------------------------------------------------
 // SAX-path implementation. The streaming scanner produces one
 // `CellRecord` per `<c>` element; this helper translates that record
@@ -885,12 +566,13 @@ Expected<void, Error> ApplyCellRecord(const CellRecord& rec, std::size_t sheet_i
   ParsedCell cell = parsed;
   cell.row = rec.row;
   cell.col = rec.col;
+  cell.has_explicit_xf = !rec.s.empty();
 
   // Persist the cell's `s=` xf index when present. The SAX scanner
   // surfaces it as a string view; parse to integer here through the same
   // lexer and with the same degrade-to-0 disposition the DOM cell parser
-  // uses. Empty / "0" collapses to the default sentinel and we skip the
-  // call to keep the row map sparse.
+  // uses. An explicit non-empty `s=` remains meaningful even when it
+  // normalises to the default sentinel `0`.
   std::uint32_t xf = 0;
   if (!parse_xsd_nonneg_int(rec.s, &xf)) {
     xf = 0;
@@ -915,7 +597,8 @@ Expected<void, Error> ApplyCellRecord(const CellRecord& rec, std::size_t sheet_i
   // Charge before `ApplyParsedCell` materialises -- mirrors the DOM
   // path's placement and no-op guard exactly (see `read_sheet_data`), so
   // a truly empty record never advances `cell_growth`.
-  const bool materializes = !formula_text.empty() || !parsed.value.is_blank() || parsed.is_sst_index || xf != 0U;
+  const bool materializes =
+      !formula_text.empty() || !parsed.value.is_blank() || parsed.is_sst_index || xf != 0U || cell.has_explicit_xf;
   if (materializes) {
     const std::uint64_t growth = cell_growth.charge_for(rec.row, rec.col);
     if (growth != 0U) {
@@ -978,12 +661,13 @@ Expected<void, Error> SaxOnRowStartTrampoline(void* user_data, const RowRecord&
   if (has_height) {
     entry.height = height;
     entry.has_height = true;
+    entry.custom_height = parse_xsd_bool(rec.custom_height, false);
   }
   if (!rec.hidden.empty()) {
     entry.hidden = parse_xsd_bool(rec.hidden, false);
   }
   if (!rec.outline_level.empty()) {
-    entry.outline_level = ParseOutlineLevel(std::string(rec.outline_level).c_str());
+    entry.outline_level = parse_outline_level(std::string(rec.outline_level).c_str());
   }
   if (custom_format) {
     entry.has_style = true;
@@ -1034,357 +718,5 @@ Expected<void, Error> read_sheet_data_sax(ByteSpan sheet_xml, std::size_t sheet_
 
 #endif  // !FORMULON_WASM || FORMULON_WASM_ENABLE_SAX
 
-namespace {
-
-/// Decodes one A1-style range token (`A1`, `A1:B5`, or `$A$1:$B$5`)
-/// into a `MergeRange`. Single-cell tokens land as `first == last`.
-/// Both corners are normalised so `first <= last` componentwise.
-Expected<MergeRange, Error> ParseA1RangeMerge(std::string_view ref) {
-  const std::size_t colon = ref.find(':');
-  if (colon == std::string_view::npos) {
-    auto rc = parse_a1(ref);
-    if (!rc) {
-      std::string ctx("context=sheet_reader ref=");
-      ctx.append(ref);
-      return make_error(FormulonErrorCode::kIoSheetCorrupt, "merge/hyperlink: ref token unparseable", std::move(ctx));
-    }
-    MergeRange out{};
-    out.first_row = rc.value().first;
-    out.first_col = rc.value().second;
-    out.last_row = out.first_row;
-    out.last_col = out.first_col;
-    return out;
-  }
-  const std::string_view a = ref.substr(0, colon);
-  const std::string_view b = ref.substr(colon + 1);
-  auto a_rc = parse_a1(a);
-  auto b_rc = parse_a1(b);
-  if (!a_rc || !b_rc) {
-    std::string ctx("context=sheet_reader ref=");
-    ctx.append(ref);
-    return make_error(FormulonErrorCode::kIoSheetCorrupt, "merge: ref token unparseable", std::move(ctx));
-  }
-  const std::uint32_t r0 = a_rc.value().first;
-  const std::uint32_t c0 = a_rc.value().second;
-  const std::uint32_t r1 = b_rc.value().first;
-  const std::uint32_t c1 = b_rc.value().second;
-  MergeRange out{};
-  out.first_row = (r0 < r1) ? r0 : r1;
-  out.first_col = (c0 < c1) ? c0 : c1;
-  out.last_row = (r0 < r1) ? r1 : r0;
-  out.last_col = (c0 < c1) ? c1 : c0;
-  return out;
-}
-
-/// Emits the WARN diagnostic for one skipped presentation-overlay entry.
-/// Merges, hyperlinks and data validations are optional worksheet
-/// metadata carrying no cell value, so a single malformed reference
-/// drops that entry and load continues — the same disposition
-/// `read_conditional_formats` applies to a malformed `<conditionalFormatting>`
-/// block. Genuine cell-data corruption still fails the sheet.
-void SkipOverlayEntry(std::string_view part, std::string_view reason, std::string_view ref,
-                      ReadDiagnostics* diagnostics) {
-  StructuredLog("io.sheet.overlay.skip")
-      .field("part", part)
-      .field("reason", reason)
-      .field("ref", ref)
-      .error_code(FormulonErrorCode::kIoSheetCorrupt)
-      .warn();
-  if (diagnostics != nullptr) {
-    ++diagnostics->skipped_feature_count;
-  }
-}
-
-/// Splits a whitespace-separated `sqref="A1 B2:C3 D4"` attribute and
-/// decodes each token. Returns `kIoSheetCorrupt` on the first
-/// unparseable token.
-Expected<std::vector<MergeRange>, Error> ParseSqrefRanges(std::string_view sqref) {
-  std::vector<MergeRange> out;
-  std::size_t i = 0;
-  while (i < sqref.size()) {
-    while (i < sqref.size() && (sqref[i] == ' ' || sqref[i] == '\t' || sqref[i] == '\n' || sqref[i] == '\r')) {
-      ++i;
-    }
-    const std::size_t start = i;
-    while (i < sqref.size() && sqref[i] != ' ' && sqref[i] != '\t' && sqref[i] != '\n' && sqref[i] != '\r') {
-      ++i;
-    }
-    if (start == i) {
-      break;
-    }
-    auto r = ParseA1RangeMerge(sqref.substr(start, i - start));
-    if (!r) {
-      return r.error();
-    }
-    out.push_back(r.value());
-  }
-  return out;
-}
-
-}  // namespace
-
-Expected<std::vector<MergeRange>, Error> read_merges(const pugi::xml_node& worksheet, ReadDiagnostics* diagnostics) {
-  std::vector<MergeRange> out;
-  if (!worksheet) {
-    return out;
-  }
-  pugi::xml_node mc = worksheet.child("mergeCells");
-  if (!mc) {
-    return out;
-  }
-  for (pugi::xml_node m = mc.child("mergeCell"); m; m = m.next_sibling("mergeCell")) {
-    const std::string_view ref = attr_str(m, "ref");
-    if (ref.empty()) {
-      SkipOverlayEntry("mergeCells", "ref attribute missing or empty", ref, diagnostics);
-      continue;
-    }
-    auto r = ParseA1RangeMerge(ref);
-    if (!r) {
-      SkipOverlayEntry("mergeCells", "ref unparseable", ref, diagnostics);
-      continue;
-    }
-    out.push_back(r.value());
-  }
-  return out;
-}
-
-Expected<std::vector<Hyperlink>, Error> read_hyperlinks(const pugi::xml_node& worksheet, ReadDiagnostics* diagnostics) {
-  std::vector<Hyperlink> out;
-  if (!worksheet) {
-    return out;
-  }
-  pugi::xml_node node = worksheet.child("hyperlinks");
-  if (!node) {
-    return out;
-  }
-  for (pugi::xml_node h = node.child("hyperlink"); h; h = h.next_sibling("hyperlink")) {
-    const std::string_view ref = attr_str(h, "ref");
-    if (ref.empty()) {
-      SkipOverlayEntry("hyperlinks", "ref attribute missing or empty", ref, diagnostics);
-      continue;
-    }
-    // Hyperlinks may span a range (`ref="A1:B2"`); Excel applies the link
-    // to every cell. Keep both corners in the model so structural edits can
-    // shrink/shift the complete rectangle and the writer can regenerate the
-    // A1 reference from numeric coordinates.
-    auto range_or = ParseA1RangeMerge(ref);
-    if (!range_or) {
-      SkipOverlayEntry("hyperlinks", "ref unparseable", ref, diagnostics);
-      continue;
-    }
-    Hyperlink hl;
-    hl.row = range_or.value().first_row;
-    hl.col = range_or.value().first_col;
-    hl.last_row = range_or.value().last_row;
-    hl.last_col = range_or.value().last_col;
-    // Accept both Office-namespaced ("r:id") and bare "id" attribute spellings.
-    const std::string_view rid_v = attr_str(h, "r:id");
-    if (!rid_v.empty()) {
-      hl.rid.assign(rid_v);
-    } else {
-      hl.rid.assign(attr_str(h, "id"));
-    }
-    hl.location.assign(attr_str(h, "location"));
-    hl.display.assign(attr_str(h, "display"));
-    hl.tooltip.assign(attr_str(h, "tooltip"));
-    out.push_back(std::move(hl));
-  }
-  return out;
-}
-
-void apply_hyperlink_rels(std::vector<Hyperlink>& hyperlinks,
-                          const std::unordered_map<std::string, std::string>& rid_to_target) {
-  for (Hyperlink& h : hyperlinks) {
-    if (h.rid.empty()) {
-      continue;
-    }
-    auto it = rid_to_target.find(h.rid);
-    if (it == rid_to_target.end()) {
-      continue;
-    }
-    h.target = it->second;
-  }
-}
-
-Expected<std::vector<DataValidation>, Error> read_data_validations(const pugi::xml_node& worksheet,
-                                                                   ReadDiagnostics* diagnostics) {
-  std::vector<DataValidation> out;
-  if (!worksheet) {
-    return out;
-  }
-  pugi::xml_node dvs = worksheet.child("dataValidations");
-  if (!dvs) {
-    return out;
-  }
-  for (pugi::xml_node dv = dvs.child("dataValidation"); dv; dv = dv.next_sibling("dataValidation")) {
-    DataValidation v;
-    const std::string_view sqref = attr_str(dv, "sqref");
-    if (sqref.empty()) {
-      SkipOverlayEntry("dataValidations", "sqref attribute missing or empty", sqref, diagnostics);
-      continue;
-    }
-    auto ranges_or = ParseSqrefRanges(sqref);
-    if (!ranges_or) {
-      SkipOverlayEntry("dataValidations", "sqref unparseable", sqref, diagnostics);
-      continue;
-    }
-    v.ranges = std::move(ranges_or.value());
-
-    // type
-    const std::string_view t = attr_str(dv, "type");
-    if (t == "whole") {
-      v.type = 1;
-    } else if (t == "decimal") {
-      v.type = 2;
-    } else if (t == "list") {
-      v.type = 3;
-    } else if (t == "date") {
-      v.type = 4;
-    } else if (t == "time") {
-      v.type = 5;
-    } else if (t == "textLength") {
-      v.type = 6;
-    } else if (t == "custom") {
-      v.type = 7;
-    } else {
-      v.type = 0;
-    }
-
-    // operator
-    const std::string_view op = attr_str(dv, "operator");
-    if (op == "notBetween") {
-      v.op = 1;
-    } else if (op == "equal") {
-      v.op = 2;
-    } else if (op == "notEqual") {
-      v.op = 3;
-    } else if (op == "greaterThan") {
-      v.op = 4;
-    } else if (op == "lessThan") {
-      v.op = 5;
-    } else if (op == "greaterThanOrEqual") {
-      v.op = 6;
-    } else if (op == "lessThanOrEqual") {
-      v.op = 7;
-    } else {
-      v.op = 0;  // "between" / unspecified
-    }
-
-    // errorStyle
-    const std::string_view es = attr_str(dv, "errorStyle");
-    if (es == "warning") {
-      v.error_style = 1;
-    } else if (es == "information") {
-      v.error_style = 2;
-    } else {
-      v.error_style = 0;
-    }
-
-    // Boolean attributes default to false: Excel omits allowBlank when it
-    // is off (the .xlsb twin's fAllowBlank bit is clear) and writes "1"
-    // when it is on.
-    v.allow_blank = false;
-    if (pugi::xml_attribute ab = dv.attribute("allowBlank"); ab) {
-      v.allow_blank = parse_xml_bool(ab.value());
-    }
-    if (pugi::xml_attribute sim = dv.attribute("showInputMessage"); sim) {
-      v.show_input_message = parse_xml_bool(sim.value());
-    }
-    if (pugi::xml_attribute sem = dv.attribute("showErrorMessage"); sem) {
-      v.show_error_message = parse_xml_bool(sem.value());
-    }
-    // `showDropDown` has inverted semantics: presence with a true value
-    // suppresses the arrow, so the user-facing `show_dropdown` is the
-    // negation of the raw attribute (absent/false attribute => shown).
-    if (pugi::xml_attribute sdd = dv.attribute("showDropDown"); sdd) {
-      v.show_dropdown = !parse_xml_bool(sdd.value());
-    }
-
-    v.error_title.assign(attr_str(dv, "errorTitle"));
-    v.error_message.assign(attr_str(dv, "error"));
-    v.prompt_title.assign(attr_str(dv, "promptTitle"));
-    v.prompt_message.assign(attr_str(dv, "prompt"));
-
-    // `AppendOoxmlTextUnescaped` decodes the OOXML `_xHHHH_` control-
-    // character escapes the writer emits for this slot (`AppendXmlEscaped`
-    // in ooxml/sheet_xml_builder.cpp), on top of `.text().get()`'s
-    // ordinary XML entity decoding.
-    if (pugi::xml_node f1 = dv.child("formula1"); f1) {
-      v.formula1.clear();
-      AppendOoxmlTextUnescaped(v.formula1, f1.text().get());
-      if (!v.formula1.empty() && v.formula1.front() == '=') {
-        v.formula1.erase(0, 1);
-      }
-      v.formula1 = canonical_feature_formula(v.formula1);
-    }
-    if (pugi::xml_node f2 = dv.child("formula2"); f2) {
-      v.formula2.clear();
-      AppendOoxmlTextUnescaped(v.formula2, f2.text().get());
-      if (!v.formula2.empty() && v.formula2.front() == '=') {
-        v.formula2.erase(0, 1);
-      }
-      v.formula2 = canonical_feature_formula(v.formula2);
-    }
-
-    out.push_back(std::move(v));
-  }
-  return out;
-}
-
-SheetProtection read_sheet_protection(const pugi::xml_node& worksheet) {
-  SheetProtection out;
-  if (!worksheet) {
-    return out;
-  }
-  const pugi::xml_node node = worksheet.child("sheetProtection");
-  if (!node) {
-    return out;
-  }
-  out.enabled = true;
-
-  out.algorithm_name.assign(attr_str(node, "algorithmName"));
-  out.hash_value.assign(attr_str(node, "hashValue"));
-  out.salt_value.assign(attr_str(node, "saltValue"));
-  if (pugi::xml_attribute sc = node.attribute("spinCount"); sc) {
-    // Saturate at both ends rather than truncating. A `static_cast` of a
-    // value above 2^32-1 wraps, and a value that wraps to exactly 0 is then
-    // dropped by the writer's non-zero guard, so the saved file would carry
-    // a hash and salt with no iteration count at all. This surface promises
-    // verbatim round-trip, so an unrepresentable count must degrade to the
-    // nearest representable one instead of disappearing.
-    const long long parsed = sc.as_llong(0);
-    out.spin_count = parsed < 0 ? 0U
-                     : parsed > static_cast<long long>(std::numeric_limits<std::uint32_t>::max())
-                         ? std::numeric_limits<std::uint32_t>::max()
-                         : static_cast<std::uint32_t>(parsed);
-  }
-  out.legacy_password.assign(attr_str(node, "password"));
-
-  // Per-attribute XSD defaults (ECMA-376 §18.3.1.85). Eleven action flags
-  // (format*, insert*, delete*, sort, autoFilter, pivotTables) default to
-  // TRUE (locked); the rest default to FALSE. Reading with the wrong
-  // default silently under-reports protection when Excel omits an
-  // at-default attribute, so use the tri-state reader with each attribute's
-  // real default rather than a blanket `false`.
-  out.sheet = read_xsd_bool(node, "sheet", false);
-  out.objects = read_xsd_bool(node, "objects", false);
-  out.scenarios = read_xsd_bool(node, "scenarios", false);
-  out.format_cells = read_xsd_bool(node, "formatCells", true);
-  out.format_columns = read_xsd_bool(node, "formatColumns", true);
-  out.format_rows = read_xsd_bool(node, "formatRows", true);
-  out.insert_columns = read_xsd_bool(node, "insertColumns", true);
-  out.insert_rows = read_xsd_bool(node, "insertRows", true);
-  out.insert_hyperlinks = read_xsd_bool(node, "insertHyperlinks", true);
-  out.delete_columns = read_xsd_bool(node, "deleteColumns", true);
-  out.delete_rows = read_xsd_bool(node, "deleteRows", true);
-  out.select_locked_cells = read_xsd_bool(node, "selectLockedCells", false);
-  out.select_unlocked_cells = read_xsd_bool(node, "selectUnlockedCells", false);
-  out.sort = read_xsd_bool(node, "sort", true);
-  out.auto_filter = read_xsd_bool(node, "autoFilter", true);
-  out.pivot_tables = read_xsd_bool(node, "pivotTables", true);
-
-  return out;
-}
-
 }  // namespace io
 }  // namespace formulon
diff --git a/src/io/sheet_reader.h b/src/io/sheet_reader.h
index 6541fde8d..c5513ba5e 100644
--- a/src/io/sheet_reader.h
+++ b/src/io/sheet_reader.h
@@ -17,6 +17,7 @@
 #include <unordered_map>
 #include <vector>
 
+#include "io/array_anchor_budget.h"
 #include "io/package_diagnostics.h"
 #include "io/zip_reader.h"
 #include "pugixml.hpp"
@@ -37,19 +38,6 @@ namespace io {
 /// that carry a shared-string index (`t="s"`); the higher-level reader
 /// resolves these against the workbook's shared-string pool once the
 /// SST part has been loaded (Bundle 2.3).
-/// One dynamic-array formula anchor discovered during the cell scan.
-/// Excel writes a spilling formula (e.g. `=SEQUENCE(3)`) at the anchor as
-/// `<f t="array" ref="F6:F8">` and the spill targets (F7 / F8) as bare
-/// `<v>` cached-value cells. The 0-based inclusive rectangle
-/// `[row..last_row] x [col..last_col]` is the spill footprint; `(row, col)`
-/// is the anchor.
-struct ArrayAnchor {
-  std::uint32_t row = 0;
-  std::uint32_t col = 0;
-  std::uint32_t last_row = 0;
-  std::uint32_t last_col = 0;
-};
-
 struct SheetReadContext {
   /// Side table for SST-typed cells: list of (row, col, sst_index).
   /// Bundle 2.3 will iterate this list and replace the placeholder
@@ -205,92 +193,6 @@ Expected<void, Error> read_sheet_data_sax(ByteSpan sheet_xml, std::size_t sheet_
                                           ReadDiagnostics* diagnostics = nullptr,
                                           std::uint64_t max_cell_bytes = kMaxSheetLoadCellBytes);
 
-/// Reads non-cell worksheet metadata from the parsed `sheet*.xml`
-/// document and writes it onto `workbook.sheet(sheet_index)`. Currently
-/// covers the viewport state mirrored by `Sheet::view()` (zoom scale,
-/// frozen panes, tab visibility) and the layout overrides mirrored by
-/// `Sheet::layout()` (`<cols>` spans, `<row>`-level height / hidden /
-/// outline overrides).
-///
-/// Behaviour:
-///   * `<sheetView zoomScale="...">` — clamped to `[10, 400]`, defaulting
-///     to `SheetView::kDefaultZoomScale` when absent or out of range.
-///   * `<sheetView><pane state="frozen" xSplit ySplit/></sheetView>` —
-///     populates `freeze_rows` / `freeze_cols`. `state="frozenSplit"`
-///     is equally frozen and is read the same way; the model does not
-///     carry the split position, so the writer re-emits both spellings
-///     as `state="frozen"`. A `state="split"` pane leaves both at `0`.
-///   * `<sheetPr><tabHidden val="1"/></sheetPr>` — sets
-///     `view().tab_hidden`. The workbook-side `<sheet state="hidden">`
-///     path (handled in `read_ooxml`) merges OR-style: either signal
-///     marks the sheet as hidden.
-///   * `<cols>/<col min max width style hidden outlineLevel/>` — appended to
-///     `layout().columns`. Width/style attribute presence is preserved,
-///     including explicit zero values; valid hidden/outline-only spans are
-///     retained. A `customWidth=1` / `bestFit=1` marker without any stored
-///     layout state remains a no-op for the model.
-///   * `<row r ht hidden outlineLevel s customFormat ...>` — appended to
-///     `layout().row_overrides` when a metric/visibility/outline override is
-///     present or when `customFormat=1`; row `s` is ignored otherwise.
-///
-/// Returns `kIoSheetCorrupt` when the worksheet root is malformed.
-/// Missing optional sub-elements are not errors.
-Expected<void, Error> read_sheet_view_and_layout(const pugi::xml_document& sheet_doc, std::size_t sheet_index,
-                                                 Workbook& workbook);
-
-/// Walks `<mergeCells>` inside `worksheet` and returns the parsed
-/// `MergeRange` list in document order. Returns an empty vector when
-/// the sheet has no merges.
-///
-/// Invalid-reference policy — shared by every presentation-overlay
-/// reader on this sheet (merges, hyperlinks, data validations, and
-/// `read_conditional_formats`): an entry whose reference is missing,
-/// empty or unparseable is dropped with a WARN diagnostic
-/// (`io.sheet.overlay.skip`) and the walk continues. None of this
-/// metadata carries a cell value, so one malformed entry must not cost
-/// the caller the whole workbook. Corruption inside `<sheetData>` still
-/// fails the sheet with `kIoSheetCorrupt`.
-///
-/// Every such drop bumps `diagnostics->skipped_feature_count` when
-/// `diagnostics` is non-NULL. The structured log is off by default in
-/// shipped builds, so that counter is what surfaces the loss to a caller.
-/// Passing NULL discards the count.
-Expected<std::vector<MergeRange>, Error> read_merges(const pugi::xml_node& worksheet,
-                                                     ReadDiagnostics* diagnostics = nullptr);
-
-/// Walks `<hyperlinks>` inside `worksheet` and returns the parsed
-/// `Hyperlink` list in document order. The reader populates
-/// `Hyperlink::rid` from the `r:id` attribute as observed; the caller
-/// is responsible for joining each rid against the sheet's rels file
-/// to fill in `target` (external URL) — see `apply_hyperlink_rels`.
-/// A malformed `ref=` drops that hyperlink under the invalid-reference
-/// policy documented on `read_merges`, `diagnostics` included.
-Expected<std::vector<Hyperlink>, Error> read_hyperlinks(const pugi::xml_node& worksheet,
-                                                        ReadDiagnostics* diagnostics = nullptr);
-
-/// Joins `hyperlinks` against the parsed sheet rels file (`rid -> target`
-/// map) populating `Hyperlink::target` in place for entries whose `rid`
-/// matches an entry in `rid_to_target`. Entries with empty `rid` or no
-/// matching rid are left untouched (their `target` stays whatever the
-/// reader picked up from any inline `location` attribute).
-void apply_hyperlink_rels(std::vector<Hyperlink>& hyperlinks,
-                          const std::unordered_map<std::string, std::string>& rid_to_target);
-
-/// Walks `<dataValidations>` inside `worksheet` and returns the parsed
-/// `DataValidation` list in document order. Returns an empty vector
-/// when the sheet has no validations. A malformed `sqref=` drops that
-/// validation under the invalid-reference policy documented on
-/// `read_merges`, `diagnostics` included.
-Expected<std::vector<DataValidation>, Error> read_data_validations(const pugi::xml_node& worksheet,
-                                                                   ReadDiagnostics* diagnostics = nullptr);
-
-/// Reads `<sheetProtection>` from the sheet and returns the parsed
-/// `SheetProtection`. When the element is absent the result has
-/// `enabled = false` and every other field at its default. The reader
-/// never fails: malformed attribute values fall back to their default
-/// (matching pugixml's xsd:boolean conversion behaviour).
-SheetProtection read_sheet_protection(const pugi::xml_node& worksheet);
-
 }  // namespace io
 }  // namespace formulon
 
diff --git a/src/io/sst_reader.cpp b/src/io/sst_reader.cpp
index a62e98581..b2da833ff 100644
--- a/src/io/sst_reader.cpp
+++ b/src/io/sst_reader.cpp
@@ -20,8 +20,6 @@
 #include <string_view>
 #include <vector>
 
-#include "io/phonetic_pr.h"
-#include "io/xml_escape.h"
 #include "io/xml_utils.h"
 #include "phonetic.h"
 #include "pugixml.hpp"
@@ -31,41 +29,6 @@
 
 namespace formulon {
 namespace io {
-namespace {
-
-/// Collects every `<rPh>` direct child of `si_node` into `out`, one run
-/// per block, in document order. Each block looks like
-/// `<rPh sb="0" eb="2"><t>トウキョウ</t></rPh>`: `sb`/`eb` delimit the
-/// surface-text span the kana covers, in UTF-16 code units, and the
-/// block's `<t>` descendants concatenate into that run's kana. The spans
-/// are kept because PHONETIC leaves the unannotated remainder of the
-/// string in place, so collapsing multi-block annotations into one kana
-/// string would lose observable content.
-void CollectPhoneticRuns(const pugi::xml_node& si_node, std::vector<PhoneticRun>& out) {
-  for (pugi::xml_node rph = si_node.child("rPh"); rph; rph = rph.next_sibling("rPh")) {
-    PhoneticRun run;
-    run.sb = static_cast<std::uint32_t>(rph.attribute("sb").as_uint(0U));
-    run.eb = static_cast<std::uint32_t>(rph.attribute("eb").as_uint(0U));
-    for (pugi::xml_node t = rph.child("t"); t; t = t.next_sibling("t")) {
-      AppendOoxmlTextUnescaped(run.text, t.text().get());
-    }
-    out.push_back(std::move(run));
-  }
-}
-
-/// Reads the `<phoneticPr>` sibling of those runs. An absent element
-/// leaves the defaults, which is the state Excel would have inferred.
-PhoneticProperties ReadPhoneticProperties(const pugi::xml_node& si_node) {
-  PhoneticProperties props;
-  if (pugi::xml_node node = si_node.child("phoneticPr")) {
-    props.font_id = static_cast<std::uint16_t>(node.attribute("fontId").as_uint(0U));
-    props.type = parse_phonetic_type(node.attribute("type").value());
-    props.alignment = parse_phonetic_alignment(node.attribute("alignment").value());
-  }
-  return props;
-}
-
-}  // namespace
 
 Expected<SharedStringTable, Error> read_shared_strings(std::vector<std::uint8_t> sst_bytes,
                                                        std::deque<std::string>& text_storage) {
@@ -107,8 +70,8 @@ Expected<SharedStringTable, Error> read_shared_strings(std::vector<std::uint8_t>
     // unconditionally to keep the index alignment invariant
     // `phonetic_for_entries.size() == entries.size()`.
     table.phonetic_for_entries.emplace_back();
-    CollectPhoneticRuns(si, table.phonetic_for_entries.back());
-    table.phonetic_props_for_entries.push_back(ReadPhoneticProperties(si));
+    append_phonetic_runs(si, table.phonetic_for_entries.back());
+    table.phonetic_props_for_entries.push_back(read_phonetic_properties(si));
   }
 
   return table;
diff --git a/src/io/styles_reader.cpp b/src/io/styles_reader.cpp
index 8ccb3e7ef..e55740d61 100644
--- a/src/io/styles_reader.cpp
+++ b/src/io/styles_reader.cpp
@@ -17,6 +17,8 @@
 #include <type_traits>
 #include <utility>
 
+#include "io/color_spec_xml.h"
+#include "io/styles_vocab.h"
 #include "io/xml_utils.h"
 #include "io/xsd_bool.h"
 #include "io/xsd_double.h"
@@ -47,52 +49,24 @@ std::uint32_t ParseColorArgb(const pugi::xml_node& color, std::uint32_t fallback
   return parse_rgb_hex(color.attribute("rgb").value(), fallback);
 }
 
-/// Parses the original specification of a `<color>` element (rgb / theme /
-/// indexed / auto). Returns `kNone` when the element is absent or carries
-/// none of the recognised attributes. The caller keeps the literal RGB or
-/// compatibility fallback separately via `ParseColorArgb`; no theme/palette
-/// rendering is performed.
-ColorSpec ParseColorSpec(const pugi::xml_node& color) {
-  ColorSpec spec;
-  if (!color) {
-    return spec;
-  }
-  if (pugi::xml_attribute rgb = color.attribute("rgb"); rgb) {
-    spec.kind = ColorSpec::Kind::kRgb;
-    spec.rgb = parse_rgb_hex(rgb.value(), 0xFF000000U);
-    return spec;
-  }
-  if (pugi::xml_attribute theme = color.attribute("theme"); theme) {
-    spec.kind = ColorSpec::Kind::kTheme;
-    spec.theme = theme.as_uint(0U);
-    // Signed by design (ECMA-376 bounds it to [-1.0, 1.0]), so this takes
-    // the plain double lexer rather than the non-negative one; what it
-    // must not admit is a NaN or an infinity, which would propagate into
-    // every channel of the resolved colour.
-    spec.tint = attr_f64(color, "tint", 0.0);
-    return spec;
-  }
-  if (pugi::xml_attribute indexed = color.attribute("indexed"); indexed) {
-    spec.kind = ColorSpec::Kind::kIndexed;
-    spec.indexed = indexed.as_uint(0U);
-    return spec;
-  }
-  if (color.attribute("auto")) {
-    spec.kind = ColorSpec::Kind::kAuto;
+/// `FindStyleToken` fallback for strict callers; no table has this many entries.
+constexpr std::uint8_t kNoStyleToken = 0xFF;
+
+/// Returns the ordinal of `s` in a `styles_vocab.h` table, or `fallback`
+/// when the token is absent from it.
+std::uint8_t FindStyleToken(const char* const* names, std::size_t count, std::string_view s, std::uint8_t fallback) {
+  for (std::size_t i = 0; i < count; ++i) {
+    if (s == names[i]) {
+      return static_cast<std::uint8_t>(i);
+    }
   }
-  return spec;
+  return fallback;
 }
 
 /// Parses a `<vertAlign val="..."/>` run into the `FontRecord::vert_align`
 /// ordinal. Missing / baseline / unknown collapse to 0 (baseline).
 std::uint8_t ParseVertAlign(std::string_view s) {
-  if (s == "superscript") {
-    return 1;
-  }
-  if (s == "subscript") {
-    return 2;
-  }
-  return 0;
+  return FindStyleToken(kVertAlignNames, kVertAlignCount, s, 0);
 }
 
 /// Parses a `<scheme val="..."/>` link into the `FontRecord::scheme`
@@ -100,138 +74,21 @@ std::uint8_t ParseVertAlign(std::string_view s) {
 /// preserving an uninterpretable link would let the writer emit a theme
 /// reference Excel cannot resolve.
 std::uint8_t ParseFontScheme(std::string_view s) {
-  if (s == "major") {
-    return 1;
-  }
-  if (s == "minor") {
-    return 2;
-  }
-  return 0;
+  return FindStyleToken(kFontSchemeNames, kFontSchemeCount, s, 0);
 }
 
 /// Maps OOXML border-style strings to the integer ordinal stored in
 /// `BorderSide::style`. Unknown strings collapse to `0` (none).
 std::uint8_t ParseBorderStyle(std::string_view s) {
-  if (s == "none" || s.empty()) {
-    return 0;
-  }
-  if (s == "thin") {
-    return 1;
-  }
-  if (s == "medium") {
-    return 2;
-  }
-  if (s == "dashed") {
-    return 3;
-  }
-  if (s == "dotted") {
-    return 4;
-  }
-  if (s == "thick") {
-    return 5;
-  }
-  if (s == "double") {
-    return 6;
-  }
-  if (s == "hair") {
-    return 7;
-  }
-  if (s == "mediumDashed") {
-    return 8;
-  }
-  if (s == "dashDot") {
-    return 9;
-  }
-  if (s == "mediumDashDot") {
-    return 10;
-  }
-  if (s == "dashDotDot") {
-    return 11;
-  }
-  if (s == "mediumDashDotDot") {
-    return 12;
-  }
-  if (s == "slantDashDot") {
-    return 13;
-  }
-  return 0;
+  return FindStyleToken(kBorderStyleNames, kBorderStyleCount, s, 0);
 }
 
 std::uint8_t ParseUnderline(std::string_view s) {
-  if (s == "single" || s.empty()) {
-    return s.empty() ? 0 : 1;
-  }
-  if (s == "double") {
-    return 2;
-  }
-  if (s == "singleAccounting") {
-    return 3;
-  }
-  if (s == "doubleAccounting") {
-    return 4;
-  }
-  return 0;
+  return FindStyleToken(kUnderlineNames, kUnderlineCount, s, 0);
 }
 
 std::uint8_t ParseFillPattern(std::string_view s) {
-  if (s == "none" || s.empty()) {
-    return 0;
-  }
-  if (s == "solid") {
-    return 1;
-  }
-  if (s == "mediumGray") {
-    return 2;
-  }
-  if (s == "darkGray") {
-    return 3;
-  }
-  if (s == "lightGray") {
-    return 4;
-  }
-  if (s == "darkHorizontal") {
-    return 5;
-  }
-  if (s == "darkVertical") {
-    return 6;
-  }
-  if (s == "darkDown") {
-    return 7;
-  }
-  if (s == "darkUp") {
-    return 8;
-  }
-  if (s == "darkGrid") {
-    return 9;
-  }
-  if (s == "darkTrellis") {
-    return 10;
-  }
-  if (s == "lightHorizontal") {
-    return 11;
-  }
-  if (s == "lightVertical") {
-    return 12;
-  }
-  if (s == "lightDown") {
-    return 13;
-  }
-  if (s == "lightUp") {
-    return 14;
-  }
-  if (s == "lightGrid") {
-    return 15;
-  }
-  if (s == "lightTrellis") {
-    return 16;
-  }
-  if (s == "gray125") {
-    return 17;
-  }
-  if (s == "gray0625") {
-    return 18;
-  }
-  return 0;
+  return FindStyleToken(kFillPatternNames, kFillPatternCount, s, 0);
 }
 
 FontRecord ParseFontNode(const pugi::xml_node& f) {
@@ -283,7 +140,7 @@ FontRecord ParseFontNode(const pugi::xml_node& f) {
     rec.scheme = ParseFontScheme(scheme.attribute("val").value());
   }
   rec.color_argb = ParseColorArgb(f.child("color"), 0xFF000000U);
-  rec.color = ParseColorSpec(f.child("color"));
+  rec.color = read_color_spec(f.child("color"));
   return rec;
 }
 
@@ -308,8 +165,8 @@ FillRecord ParseFillNode(const pugi::xml_node& fill) {
     rec.pattern = ParseFillPattern(pattern.attribute("patternType").value());
     rec.fg_argb = ParseColorArgb(pattern.child("fgColor"), 0U);
     rec.bg_argb = ParseColorArgb(pattern.child("bgColor"), 0U);
-    rec.fg = ParseColorSpec(pattern.child("fgColor"));
-    rec.bg = ParseColorSpec(pattern.child("bgColor"));
+    rec.fg = read_color_spec(pattern.child("fgColor"));
+    rec.bg = read_color_spec(pattern.child("bgColor"));
   }
   return rec;
 }
@@ -334,7 +191,7 @@ void ReadBorderSide(const pugi::xml_node& side, BorderSide* out) {
   }
   out->style = ParseBorderStyle(side.attribute("style").value());
   out->color_argb = ParseColorArgb(side.child("color"), 0U);
-  out->color = ParseColorSpec(side.child("color"));
+  out->color = read_color_spec(side.child("color"));
 }
 
 void ReadBorders(const pugi::xml_node& root, StylesTable& table) {
@@ -504,29 +361,9 @@ Expected<std::uint8_t, Error> ParseHorizontalAlignStrict(const pugi::xml_attribu
   // numeric and boolean attributes, its whitespace is significant: XML
   // values such as ` center ` are not the `center` token.
   const std::string_view value(attr.value());
-  if (value == "general") {
-    return static_cast<std::uint8_t>(0);
-  }
-  if (value == "left") {
-    return static_cast<std::uint8_t>(1);
-  }
-  if (value == "center") {
-    return static_cast<std::uint8_t>(2);
-  }
-  if (value == "right") {
-    return static_cast<std::uint8_t>(3);
-  }
-  if (value == "fill") {
-    return static_cast<std::uint8_t>(4);
-  }
-  if (value == "justify") {
-    return static_cast<std::uint8_t>(5);
-  }
-  if (value == "centerContinuous") {
-    return static_cast<std::uint8_t>(6);
-  }
-  if (value == "distributed") {
-    return static_cast<std::uint8_t>(7);
+  const std::uint8_t ordinal = FindStyleToken(kHorizontalAlignNames, kHorizontalAlignCount, value, kNoStyleToken);
+  if (ordinal != kNoStyleToken) {
+    return ordinal;
   }
   return InvalidXfAttribute(section, index, attr.name(), value);
 }
@@ -539,20 +376,9 @@ Expected<std::uint8_t, Error> ParseVerticalAlignStrict(const pugi::xml_attribute
   // ST_VerticalAlignment is also xsd:string-derived; preserve its lexical
   // whitespace and reject padded tokens.
   const std::string_view value(attr.value());
-  if (value == "bottom") {
-    return static_cast<std::uint8_t>(2);
-  }
-  if (value == "top") {
-    return static_cast<std::uint8_t>(0);
-  }
-  if (value == "center") {
-    return static_cast<std::uint8_t>(1);
-  }
-  if (value == "justify") {
-    return static_cast<std::uint8_t>(3);
-  }
-  if (value == "distributed") {
-    return static_cast<std::uint8_t>(4);
+  const std::uint8_t ordinal = FindStyleToken(kVerticalAlignNames, kVerticalAlignCount, value, kNoStyleToken);
+  if (ordinal != kNoStyleToken) {
+    return ordinal;
   }
   return InvalidXfAttribute(section, index, attr.name(), value);
 }
@@ -688,6 +514,27 @@ void ReadCellStyles(const pugi::xml_node& root, StylesTable& table) {
   }
 }
 
+/// Reads `<colors>`: the `<indexedColors>` palette becomes `indexed_colors`
+/// and every other child is retained verbatim in `colors_xml`.
+void ReadColors(const pugi::xml_node& colors, StylesTable& table) {
+  std::string others;
+  for (pugi::xml_node child : colors.children()) {
+    if (child.type() != pugi::node_element) {
+      continue;
+    }
+    if (std::string_view(child.name()) != "indexedColors") {
+      append_raw_xml(others, child);
+      continue;
+    }
+    for (pugi::xml_node rgb = child.child("rgbColor"); rgb; rgb = rgb.next_sibling("rgbColor")) {
+      table.indexed_colors.push_back(parse_rgb_hex(rgb.attribute("rgb").value(), 0xFF000000U));
+    }
+  }
+  if (!others.empty()) {
+    table.colors_xml = "<colors>" + others + "</colors>";
+  }
+}
+
 std::string CaptureRootExtraAttrs(const pugi::xml_node& root) {
   std::string out;
   for (pugi::xml_attribute attr : root.attributes()) {
@@ -798,7 +645,7 @@ Expected<StylesTable, Error> read_styles(const std::vector<std::uint8_t>& styles
   NormalizeStyleIndices(table);
   table.root_extra_attrs = CaptureRootExtraAttrs(root);
   if (pugi::xml_node colors = root.child("colors")) {
-    table.colors_xml = raw_xml(colors);
+    ReadColors(colors, table);
   }
   if (pugi::xml_node table_styles = root.child("tableStyles")) {
     table.table_styles_xml = raw_xml(table_styles);
diff --git a/src/io/styles_vocab.h b/src/io/styles_vocab.h
new file mode 100644
index 000000000..7ba55cb0d
--- /dev/null
+++ b/src/io/styles_vocab.h
@@ -0,0 +1,70 @@
+//
+// OOXML token vocabularies for the `styles.xml` enums that `styles.h`
+// stores as ordinals. Each array is indexed by the stored ordinal, so the
+// writer maps ordinal -> token by subscript and the reader maps token ->
+// ordinal by position. Out-of-range ordinals and unknown tokens are each
+// side's own policy.
+//
+// Header-only, `inline constexpr` — no translation unit needed.
+
+#ifndef FORMULON_IO_STYLES_VOCAB_H_
+#define FORMULON_IO_STYLES_VOCAB_H_
+
+#include <cstddef>
+
+namespace formulon {
+namespace io {
+
+/// `ST_HorizontalAlignment`, by `CellXf::horizontal_align`.
+inline constexpr const char* kHorizontalAlignNames[] = {
+    "general", "left", "center", "right", "fill", "justify", "centerContinuous", "distributed",
+};
+inline constexpr std::size_t kHorizontalAlignCount = sizeof(kHorizontalAlignNames) / sizeof(kHorizontalAlignNames[0]);
+
+/// `ST_VerticalAlignment`, by `CellXf::vertical_align`.
+inline constexpr const char* kVerticalAlignNames[] = {
+    "top", "center", "bottom", "justify", "distributed",
+};
+inline constexpr std::size_t kVerticalAlignCount = sizeof(kVerticalAlignNames) / sizeof(kVerticalAlignNames[0]);
+
+/// `ST_UnderlineValues`, by `FontRecord::underline`.
+inline constexpr const char* kUnderlineNames[] = {
+    "none", "single", "double", "singleAccounting", "doubleAccounting",
+};
+inline constexpr std::size_t kUnderlineCount = sizeof(kUnderlineNames) / sizeof(kUnderlineNames[0]);
+
+/// `ST_VerticalAlignRun`, by `FontRecord::vert_align`.
+inline constexpr const char* kVertAlignNames[] = {
+    "baseline",
+    "superscript",
+    "subscript",
+};
+inline constexpr std::size_t kVertAlignCount = sizeof(kVertAlignNames) / sizeof(kVertAlignNames[0]);
+
+/// `ST_FontScheme`, by `FontRecord::scheme`.
+inline constexpr const char* kFontSchemeNames[] = {
+    "none",
+    "major",
+    "minor",
+};
+inline constexpr std::size_t kFontSchemeCount = sizeof(kFontSchemeNames) / sizeof(kFontSchemeNames[0]);
+
+/// `ST_PatternType`, by `FillRecord::pattern`.
+inline constexpr const char* kFillPatternNames[] = {
+    "none",     "solid",     "mediumGray",   "darkGray",    "lightGray",       "darkHorizontal", "darkVertical",
+    "darkDown", "darkUp",    "darkGrid",     "darkTrellis", "lightHorizontal", "lightVertical",  "lightDown",
+    "lightUp",  "lightGrid", "lightTrellis", "gray125",     "gray0625",
+};
+inline constexpr std::size_t kFillPatternCount = sizeof(kFillPatternNames) / sizeof(kFillPatternNames[0]);
+
+/// `ST_BorderStyle`, by `BorderSide::style`.
+inline constexpr const char* kBorderStyleNames[] = {
+    "none",         "thin",    "medium",        "dashed",     "dotted",           "thick",        "double", "hair",
+    "mediumDashed", "dashDot", "mediumDashDot", "dashDotDot", "mediumDashDotDot", "slantDashDot",
+};
+inline constexpr std::size_t kBorderStyleCount = sizeof(kBorderStyleNames) / sizeof(kBorderStyleNames[0]);
+
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_STYLES_VOCAB_H_
diff --git a/src/io/styles_writer.cpp b/src/io/styles_writer.cpp
index f23e12131..a47d20499 100644
--- a/src/io/styles_writer.cpp
+++ b/src/io/styles_writer.cpp
@@ -4,13 +4,15 @@
 #include "io/styles_writer.h"
 
 #include <cstdint>
-#include <cstdio>
 #include <string>
 #include <string_view>
 
+#include "io/color_spec_xml.h"
+#include "io/styles_vocab.h"
 #include "io/xml_escape.h"
 #include "io/xml_utils.h"
 #include "styles.h"
+#include "utils/number_text.h"
 
 namespace formulon {
 namespace io {
@@ -22,19 +24,19 @@ constexpr std::string_view kXmlNs = "http://schemas.openxmlformats.org/spreadshe
 
 void AppendUint(std::string& out, std::uint64_t v) {
   char buf[24];
-  std::snprintf(buf, sizeof(buf), "%llu", static_cast<unsigned long long>(v));
+  format_unsigned(buf, sizeof(buf), v);
   out.append(buf);
 }
 
 void AppendInt(std::string& out, std::int64_t v) {
   char buf[24];
-  std::snprintf(buf, sizeof(buf), "%lld", static_cast<long long>(v));
+  format_signed(buf, sizeof(buf), v);
   out.append(buf);
 }
 
 void AppendArgb(std::string& out, std::uint32_t argb) {
   char buf[12];
-  std::snprintf(buf, sizeof(buf), "%08X", argb);
+  format_hex(buf, sizeof(buf), argb, 8, true);
   out.append(buf);
 }
 
@@ -49,37 +51,7 @@ void AppendArgb(std::string& out, std::uint32_t argb) {
 void AppendColor(std::string& out, const char* tag, const ColorSpec& spec, std::uint32_t fallback_argb) {
   out.push_back('<');
   out.append(tag);
-  switch (spec.kind) {
-    case ColorSpec::Kind::kTheme:
-      out.append(" theme=\"");
-      AppendUint(out, spec.theme);
-      out.append("\"");
-      if (spec.tint != 0.0) {
-        out.append(" tint=\"");
-        append_xml_number(out, spec.tint);
-        out.append("\"");
-      }
-      break;
-    case ColorSpec::Kind::kIndexed:
-      out.append(" indexed=\"");
-      AppendUint(out, spec.indexed);
-      out.append("\"");
-      break;
-    case ColorSpec::Kind::kAuto:
-      out.append(" auto=\"1\"");
-      break;
-    case ColorSpec::Kind::kRgb:
-      out.append(" rgb=\"");
-      AppendArgb(out, spec.rgb);
-      out.append("\"");
-      break;
-    case ColorSpec::Kind::kNone:
-    default:
-      out.append(" rgb=\"");
-      AppendArgb(out, fallback_argb);
-      out.append("\"");
-      break;
-  }
+  append_color_spec_attrs(out, spec, fallback_argb);
   out.append("/>");
 }
 
@@ -92,67 +64,20 @@ bool HasColor(const ColorSpec& spec, std::uint32_t argb) {
 }
 
 const char* HorizontalAlignName(std::uint8_t v) {
-  switch (v) {
-    case 1:
-      return "left";
-    case 2:
-      return "center";
-    case 3:
-      return "right";
-    case 4:
-      return "fill";
-    case 5:
-      return "justify";
-    case 6:
-      return "centerContinuous";
-    case 7:
-      return "distributed";
-    case 0:
-    default:
-      return "general";
-  }
+  return kHorizontalAlignNames[v < kHorizontalAlignCount ? v : 0];
 }
 
 const char* VerticalAlignName(std::uint8_t v) {
-  switch (v) {
-    case 0:
-      return "top";
-    case 1:
-      return "center";
-    case 3:
-      return "justify";
-    case 4:
-      return "distributed";
-    case 2:
-    default:
-      return "bottom";
-  }
+  return kVerticalAlignNames[v < kVerticalAlignCount ? v : 2];
 }
 
 const char* UnderlineName(std::uint8_t v) {
-  switch (v) {
-    case 1:
-      return "single";
-    case 2:
-      return "double";
-    case 3:
-      return "singleAccounting";
-    case 4:
-      return "doubleAccounting";
-    default:
-      return nullptr;
-  }
+  return v != 0 && v < kUnderlineCount ? kUnderlineNames[v] : nullptr;
 }
 
 const char* VertAlignName(std::uint8_t v) {
-  switch (v) {
-    case 1:
-      return "superscript";
-    case 2:
-      return "subscript";
-    default:
-      return nullptr;  // 0 = baseline (default); emit no element.
-  }
+  // 0 = baseline (default); emit no element.
+  return v != 0 && v < kVertAlignCount ? kVertAlignNames[v] : nullptr;
 }
 
 void AppendVertAlign(std::string& out, std::uint8_t v) {
@@ -164,14 +89,8 @@ void AppendVertAlign(std::string& out, std::uint8_t v) {
 }
 
 const char* FontSchemeName(std::uint8_t v) {
-  switch (v) {
-    case 1:
-      return "major";
-    case 2:
-      return "minor";
-    default:
-      return nullptr;  // 0 = no theme link; emit no element.
-  }
+  // 0 = no theme link; emit no element.
+  return v != 0 && v < kFontSchemeCount ? kFontSchemeNames[v] : nullptr;
 }
 
 /// Emits the trailing `<family>` / `<charset>` / `<scheme>` children in the
@@ -196,81 +115,12 @@ void AppendFontFamilyCharsetScheme(std::string& out, const FontRecord& f) {
 }
 
 const char* FillPatternName(std::uint8_t v) {
-  switch (v) {
-    case 0:
-      return "none";
-    case 1:
-      return "solid";
-    case 2:
-      return "mediumGray";
-    case 3:
-      return "darkGray";
-    case 4:
-      return "lightGray";
-    case 5:
-      return "darkHorizontal";
-    case 6:
-      return "darkVertical";
-    case 7:
-      return "darkDown";
-    case 8:
-      return "darkUp";
-    case 9:
-      return "darkGrid";
-    case 10:
-      return "darkTrellis";
-    case 11:
-      return "lightHorizontal";
-    case 12:
-      return "lightVertical";
-    case 13:
-      return "lightDown";
-    case 14:
-      return "lightUp";
-    case 15:
-      return "lightGrid";
-    case 16:
-      return "lightTrellis";
-    case 17:
-      return "gray125";
-    case 18:
-      return "gray0625";
-    default:
-      return "none";
-  }
+  return kFillPatternNames[v < kFillPatternCount ? v : 0];
 }
 
 const char* BorderStyleName(std::uint8_t v) {
-  switch (v) {
-    case 1:
-      return "thin";
-    case 2:
-      return "medium";
-    case 3:
-      return "dashed";
-    case 4:
-      return "dotted";
-    case 5:
-      return "thick";
-    case 6:
-      return "double";
-    case 7:
-      return "hair";
-    case 8:
-      return "mediumDashed";
-    case 9:
-      return "dashDot";
-    case 10:
-      return "mediumDashDot";
-    case 11:
-      return "dashDotDot";
-    case 12:
-      return "mediumDashDotDot";
-    case 13:
-      return "slantDashDot";
-    default:
-      return nullptr;  // 0 = none; emit no style attribute.
-  }
+  // 0 = none; emit no style attribute.
+  return v != 0 && v < kBorderStyleCount ? kBorderStyleNames[v] : nullptr;
 }
 
 void AppendBorderSide(std::string& out, const char* tag, const BorderSide& side) {
@@ -631,6 +481,30 @@ void AppendCellStyles(std::string& out, const StylesTable& table) {
   out.append("  </cellStyles>\n");
 }
 
+/// Emits `<colors>`: the `<indexedColors>` palette followed by the other
+/// retained children (`colors_xml` is a `<colors>` element holding them).
+void AppendColors(std::string& out, const StylesTable& table) {
+  constexpr std::string_view kOpen = "<colors>";
+  constexpr std::string_view kClose = "</colors>";
+  if (table.indexed_colors.empty() && table.colors_xml.empty()) {
+    return;
+  }
+  out.append("  <colors>");
+  if (!table.indexed_colors.empty()) {
+    out.append("<indexedColors>");
+    for (const std::uint32_t argb : table.indexed_colors) {
+      out.append("<rgbColor rgb=\"");
+      AppendArgb(out, argb);
+      out.append("\"/>");
+    }
+    out.append("</indexedColors>");
+  }
+  if (table.colors_xml.size() > kOpen.size() + kClose.size()) {
+    out.append(table.colors_xml, kOpen.size(), table.colors_xml.size() - kOpen.size() - kClose.size());
+  }
+  out.append("</colors>\n");
+}
+
 void AppendFontFragment(std::string& out, const FontRecord& f) {
   out.append("<font>");
   AppendFontToggle(out, "b", f.has_bold, f.bold);
@@ -776,11 +650,7 @@ std::string write_styles(const StylesTable& table) {
     out.append(table.table_styles_xml);
     out.push_back('\n');
   }
-  if (!table.colors_xml.empty()) {
-    out.append("  ");
-    out.append(table.colors_xml);
-    out.push_back('\n');
-  }
+  AppendColors(out, table);
   for (const std::string& raw : table.unknown_top_level_xml) {
     out.append("  ");
     out.append(raw);
diff --git a/src/io/tables_reader.cpp b/src/io/tables_reader.cpp
index 5e818a74c..902efbad5 100644
--- a/src/io/tables_reader.cpp
+++ b/src/io/tables_reader.cpp
@@ -11,6 +11,7 @@
 #include <utility>
 #include <vector>
 
+#include "io/auto_filter_xml.h"
 #include "io/xml_escape.h"
 #include "io/xml_utils.h"
 #include "pugixml.hpp"
@@ -109,7 +110,7 @@ Expected<TableMetadata, Error> read_table(const std::vector<std::uint8_t>& table
     table.table_style_info_xml = raw_xml(style_info);
   }
   if (pugi::xml_node auto_filter = root.child("autoFilter"); auto_filter) {
-    table.auto_filter_xml = raw_xml(auto_filter);
+    table.auto_filter_xml.set(auto_filter_from_xml(raw_xml(auto_filter)));
   }
   if (pugi::xml_node sort_state = root.child("sortState"); sort_state) {
     table.sort_state_xml = raw_xml(sort_state);
diff --git a/src/io/theme_part.cpp b/src/io/theme_part.cpp
new file mode 100644
index 000000000..d7aeead21
--- /dev/null
+++ b/src/io/theme_part.cpp
@@ -0,0 +1,285 @@
+#include "io/theme_part.h"
+
+#include <array>
+#include <optional>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "io/ooxml/part_dom.h"
+#include "io/ooxml_defs.h"
+#include "io/xml_utils.h"
+#include "passthrough_part.h"
+#include "pugixml.hpp"
+#include "utils/number_text.h"
+#include "utils/status_macros.h"
+#include "workbook.h"
+
+namespace formulon::io {
+namespace {
+
+constexpr const char* kThemeContentType = "application/vnd.openxmlformats-officedocument.theme+xml";
+constexpr const char* kDefaultThemePath = "xl/theme/theme1.xml";
+
+constexpr std::array<const char*, kThemeColorCount> kSchemeNames = {
+    "dk1", "lt1", "dk2", "lt2", "accent1", "accent2", "accent3", "accent4", "accent5", "accent6", "hlink", "folHlink"};
+
+/// Local part of a possibly prefixed element name.
+std::string_view local_name(const char* qualified) {
+  std::string_view name(qualified);
+  const std::size_t colon = name.find(':');
+  return colon == std::string_view::npos ? name : name.substr(colon + 1U);
+}
+
+/// Namespace prefix including the trailing colon, or empty.
+std::string prefix_of(const char* qualified) {
+  std::string_view name(qualified);
+  const std::size_t colon = name.find(':');
+  return colon == std::string_view::npos ? std::string() : std::string(name.substr(0U, colon + 1U));
+}
+
+pugi::xml_node find_child(const pugi::xml_node& parent, std::string_view local) {
+  for (pugi::xml_node child : parent.children()) {
+    if (child.type() == pugi::node_element && local_name(child.name()) == local) {
+      return child;
+    }
+  }
+  return pugi::xml_node();
+}
+
+pugi::xml_node clr_scheme_of(const pugi::xml_document& doc) {
+  return find_child(find_child(doc.document_element(), "themeElements"), "clrScheme");
+}
+
+pugi::xml_node font_scheme_of(const pugi::xml_document& doc) {
+  return find_child(find_child(doc.document_element(), "themeElements"), "fontScheme");
+}
+
+std::string hex6(std::uint32_t argb) {
+  char buf[8];
+  format_hex(buf, sizeof(buf), argb & 0xFFFFFFU, 6, true);
+  return buf;
+}
+
+/// Reads one scheme slot (`a:sysClr lastClr` or `a:srgbClr val`).
+std::optional<std::uint32_t> read_scheme_color(const pugi::xml_node& slot) {
+  if (!slot) {
+    return std::nullopt;
+  }
+  pugi::xml_node clr = slot.first_child();
+  while (clr && clr.type() != pugi::node_element) {
+    clr = clr.next_sibling();
+  }
+  if (!clr) {
+    return std::nullopt;
+  }
+  const std::string_view kind = local_name(clr.name());
+  const char* hex = nullptr;
+  if (kind == "srgbClr") {
+    hex = clr.attribute("val").value();
+  } else if (kind == "sysClr") {
+    hex = clr.attribute("lastClr").value();
+  } else {
+    return std::nullopt;
+  }
+  const std::uint32_t argb = parse_rgb_hex(hex, 0U);
+  if (argb == 0U) {
+    return std::nullopt;
+  }
+  return argb;
+}
+
+std::string font_face(const pugi::xml_node& font_node, bool east_asian) {
+  if (!east_asian) {
+    return find_child(font_node, "latin").attribute("typeface").value();
+  }
+  const std::string ea = find_child(font_node, "ea").attribute("typeface").value();
+  if (!ea.empty()) {
+    return ea;
+  }
+  for (pugi::xml_node child : font_node.children()) {
+    if (child.type() == pugi::node_element && local_name(child.name()) == "font" &&
+        std::string_view(child.attribute("script").value()) == "Jpan") {
+      return child.attribute("typeface").value();
+    }
+  }
+  return std::string();
+}
+
+std::optional<Theme> parse_theme(const pugi::xml_document& doc) {
+  const pugi::xml_node clr = clr_scheme_of(doc);
+  if (!clr) {
+    return std::nullopt;
+  }
+  Theme out = default_theme();
+  for (std::size_t i = 0; i < kThemeColorCount; ++i) {
+    const std::optional<std::uint32_t> argb = read_scheme_color(find_child(clr, kSchemeNames[i]));
+    if (!argb) {
+      return std::nullopt;
+    }
+    out.colors[i] = *argb;
+  }
+  const pugi::xml_node fonts = font_scheme_of(doc);
+  if (const pugi::xml_node major = find_child(fonts, "majorFont")) {
+    out.fonts.major_latin = font_face(major, false);
+    out.fonts.major_ea = font_face(major, true);
+  }
+  if (const pugi::xml_node minor = find_child(fonts, "minorFont")) {
+    out.fonts.minor_latin = font_face(minor, false);
+    out.fonts.minor_ea = font_face(minor, true);
+  }
+  return out;
+}
+
+/// Package path of the theme part: the workbook relationship's target when it
+/// names one, otherwise the conventional path.
+std::string theme_part_path(const Workbook& wb) {
+  for (const UnknownRelationship& rel : wb.unknown_workbook_rels()) {
+    if (!rel.target_external && rel.type == kRelTheme) {
+      return rel.target;
+    }
+  }
+  return kDefaultThemePath;
+}
+
+/// A minimal valid theme (colour scheme, font scheme, format scheme with three
+/// entries per list) carrying the default colours and fonts.
+std::string build_default_theme_xml() {
+  const Theme& def = default_theme();
+  std::string xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<a:theme xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\" name=\"Office Theme\">"
+      "<a:themeElements><a:clrScheme name=\"Office\">";
+  for (std::size_t i = 0; i < kThemeColorCount; ++i) {
+    xml += "<a:" + std::string(kSchemeNames[i]) + "><a:srgbClr val=\"" + hex6(def.colors[i]) +
+           "\"/></a:" + kSchemeNames[i] + ">";
+  }
+  xml += "</a:clrScheme><a:fontScheme name=\"Office\">";
+  const auto font = [&xml](const char* tag, const std::string& latin, const std::string& ea) {
+    xml += std::string("<a:") + tag + "><a:latin typeface=\"" + latin +
+           "\"/><a:ea typeface=\"\"/><a:cs typeface=\"\"/>" + "<a:font script=\"Jpan\" typeface=\"" + ea +
+           "\"/></a:" + tag + ">";
+  };
+  font("majorFont", def.fonts.major_latin, def.fonts.major_ea);
+  font("minorFont", def.fonts.minor_latin, def.fonts.minor_ea);
+  xml += "</a:fontScheme><a:fmtScheme name=\"Office\">";
+  const std::string fill = "<a:solidFill><a:schemeClr val=\"phClr\"/></a:solidFill>";
+  const auto list = [&xml](const char* tag, const std::string& item) {
+    xml += std::string("<a:") + tag + ">" + item + item + item + "</a:" + tag + ">";
+  };
+  list("fillStyleLst", fill);
+  list("lnStyleLst", "<a:ln w=\"6350\">" + fill + "</a:ln>");
+  list("effectStyleLst", "<a:effectStyle><a:effectLst/></a:effectStyle>");
+  list("bgFillStyleLst", fill);
+  xml += "</a:fmtScheme></a:themeElements></a:theme>";
+  return xml;
+}
+
+/// Parses the workbook's theme part for editing, generating and registering a
+/// default one when absent. Yields the part path and the parsed document.
+Expected<std::string, Error> open_theme_for_edit(Workbook& wb, pugi::xml_document& doc) {
+  std::string path = theme_part_path(wb);
+  if (ooxml::find_passthrough_part(wb, path) == nullptr) {
+    const std::string xml = build_default_theme_xml();
+    PassthroughPart part(path, kThemeContentType, std::vector<std::uint8_t>(xml.begin(), xml.end()));
+    RETURN_IF_ERROR(wb.add_passthrough_part(std::move(part)));
+    wb.add_workbook_relationship(std::string(kRelTheme), path);
+  }
+  RETURN_IF_ERROR(ooxml::load_part_dom(wb, path, "theme", doc));
+  if (!parse_theme(doc)) {
+    return make_error(FormulonErrorCode::kIoXmlParse, "theme: part is not a parseable theme", "part=" + path);
+  }
+  return path;
+}
+
+void set_attr(pugi::xml_node node, const char* name, const std::string& value) {
+  pugi::xml_attribute attr = node.attribute(name);
+  if (!attr) {
+    attr = node.append_attribute(name);
+  }
+  attr.set_value(value.c_str());
+}
+
+/// Writes the Latin and East Asian faces of one `a:majorFont` / `a:minorFont`.
+void patch_font(pugi::xml_node font_node, const std::string& latin, const std::string& east_asian) {
+  const std::string prefix = prefix_of(font_node.name());
+  pugi::xml_node latin_node = find_child(font_node, "latin");
+  if (!latin_node) {
+    latin_node = font_node.prepend_child((prefix + "latin").c_str());
+  }
+  set_attr(latin_node, "typeface", latin);
+  pugi::xml_node ea_node = find_child(font_node, "ea");
+  if (ea_node && *ea_node.attribute("typeface").value() != '\0') {
+    set_attr(ea_node, "typeface", east_asian);
+    return;
+  }
+  for (pugi::xml_node child : font_node.children()) {
+    if (child.type() == pugi::node_element && local_name(child.name()) == "font" &&
+        std::string_view(child.attribute("script").value()) == "Jpan") {
+      set_attr(child, "typeface", east_asian);
+      return;
+    }
+  }
+  pugi::xml_node jpan = font_node.append_child((prefix + "font").c_str());
+  set_attr(jpan, "script", "Jpan");
+  set_attr(jpan, "typeface", east_asian);
+}
+
+}  // namespace
+
+LoadedTheme load_theme(const Workbook& wb) {
+  LoadedTheme out;
+  out.theme = default_theme();
+  const PassthroughPart* part = ooxml::find_passthrough_part(wb, theme_part_path(wb));
+  if (part == nullptr) {
+    return out;
+  }
+  out.source = ThemeSource::kUnparseable;
+  pugi::xml_document doc;
+  if (!load_xml_buffer(doc, part->bytes, "theme", part->path)) {
+    return out;
+  }
+  if (std::optional<Theme> parsed = parse_theme(doc)) {
+    out.theme = std::move(*parsed);
+    out.source = ThemeSource::kPart;
+  }
+  return out;
+}
+
+Expected<void, Error> set_theme_colors(Workbook& wb, const ThemeColors& colors) {
+  pugi::xml_document doc;
+  auto path_or = open_theme_for_edit(wb, doc);
+  if (!path_or) {
+    return Expected<void, Error>(path_or.error());
+  }
+  const pugi::xml_node clr = clr_scheme_of(doc);
+  const std::string prefix = prefix_of(clr.name());
+  for (std::size_t i = 0; i < kThemeColorCount; ++i) {
+    pugi::xml_node slot = find_child(clr, kSchemeNames[i]);
+    while (slot.first_child()) {
+      slot.remove_child(slot.first_child());
+    }
+    set_attr(slot.append_child((prefix + "srgbClr").c_str()), "val", hex6(colors[i]));
+  }
+  return ooxml::store_part_dom(wb, path_or.value(), doc);
+}
+
+Expected<void, Error> set_theme_fonts(Workbook& wb, const ThemeFonts& fonts) {
+  pugi::xml_document doc;
+  auto path_or = open_theme_for_edit(wb, doc);
+  if (!path_or) {
+    return Expected<void, Error>(path_or.error());
+  }
+  const pugi::xml_node scheme = font_scheme_of(doc);
+  const pugi::xml_node major = find_child(scheme, "majorFont");
+  const pugi::xml_node minor = find_child(scheme, "minorFont");
+  if (!major || !minor) {
+    return make_error(FormulonErrorCode::kIoXmlParse, "theme: font scheme has no major/minor font",
+                      "part=" + path_or.value());
+  }
+  patch_font(major, fonts.major_latin, fonts.major_ea);
+  patch_font(minor, fonts.minor_latin, fonts.minor_ea);
+  return ooxml::store_part_dom(wb, path_or.value(), doc);
+}
+
+}  // namespace formulon::io
diff --git a/src/io/theme_part.h b/src/io/theme_part.h
new file mode 100644
index 000000000..2a497f9db
--- /dev/null
+++ b/src/io/theme_part.h
@@ -0,0 +1,32 @@
+//
+// Reader and in-place editor for the workbook theme part (DrawingML
+// `a:theme`), which lives in the workbook's passthrough parts. Edits patch
+// only the `a:clrScheme` / `a:fontScheme` elements of the existing part, so
+// the unmodelled remainder survives.
+
+#ifndef FORMULON_IO_THEME_PART_H_
+#define FORMULON_IO_THEME_PART_H_
+
+#include "theme.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon {
+
+class Workbook;
+
+namespace io {
+
+/// Implements `Workbook::load_theme`.
+LoadedTheme load_theme(const Workbook& wb);
+
+/// Implements `Workbook::set_theme_colors`.
+Expected<void, Error> set_theme_colors(Workbook& wb, const ThemeColors& colors);
+
+/// Implements `Workbook::set_theme_fonts`.
+Expected<void, Error> set_theme_fonts(Workbook& wb, const ThemeFonts& fonts);
+
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_THEME_PART_H_
diff --git a/src/io/threaded_comments_io.cpp b/src/io/threaded_comments_io.cpp
new file mode 100644
index 000000000..ce7071555
--- /dev/null
+++ b/src/io/threaded_comments_io.cpp
@@ -0,0 +1,198 @@
+#include "io/threaded_comments_io.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "io/cell_parser.h"
+#include "io/xml_escape.h"
+#include "io/xml_utils.h"
+#include "pugixml.hpp"
+#include "sheet.h"
+#include "threaded_comment.h"
+#include "utils/a1_ref.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "utils/status_macros.h"
+
+namespace formulon::io {
+namespace {
+
+constexpr std::string_view kThreadedNs = "http://schemas.microsoft.com/office/spreadsheetml/2018/threadedcomments";
+constexpr std::string_view kMainNs = "http://schemas.openxmlformats.org/spreadsheetml/2006/main";
+constexpr std::string_view kStubAuthorPrefix = "tc=";
+
+void AppendRootOpen(std::string& out, std::string_view root) {
+  out.append(kXmlDecl);
+  out.push_back('<');
+  out.append(root);
+  append_xml_attr(out, "xmlns", kThreadedNs);
+  append_xml_attr(out, "xmlns:x", kMainNs);
+  out.append(">\n");
+}
+
+}  // namespace
+
+Expected<std::vector<ThreadedComment>, Error> read_threaded_comments(const std::vector<std::uint8_t>& bytes) {
+  pugi::xml_document doc;
+  RETURN_IF_ERROR(load_xml_buffer(doc, bytes, "threaded_comments_reader", "threadedComments part"));
+  const pugi::xml_node root = doc.child("ThreadedComments");
+  if (!root) {
+    return make_error(FormulonErrorCode::kIoSheetCorrupt, "threadedComments part: missing <ThreadedComments> root",
+                      "context=threaded_comments_reader");
+  }
+  std::vector<ThreadedComment> out;
+  for (pugi::xml_node node = root.child("threadedComment"); node; node = node.next_sibling("threadedComment")) {
+    auto rc = parse_a1(node.attribute("ref").value());
+    if (!rc) {
+      return make_error(FormulonErrorCode::kIoSheetCorrupt, "threadedComment: ref missing or unparseable",
+                        "context=threaded_comments_reader ref=" + std::string(node.attribute("ref").value()));
+    }
+    ThreadedComment c;
+    c.row = rc.value().first;
+    c.col = rc.value().second;
+    c.id = node.attribute("id").value();
+    c.person_id = node.attribute("personId").value();
+    c.created = node.attribute("dT").value();
+    c.parent_id = node.attribute("parentId").value();
+    c.done = attr_bool(node, "done");
+    c.text = node.child("text").text().get();
+    for (pugi::xml_node m = node.child("mentions").child("mention"); m; m = m.next_sibling("mention")) {
+      Mention mention;
+      mention.person_id = m.attribute("mentionpersonId").value();
+      mention.mention_id = m.attribute("mentionId").value();
+      mention.start = attr_u32(m, "startIndex");
+      mention.length = attr_u32(m, "length");
+      c.mentions.push_back(std::move(mention));
+    }
+    out.push_back(std::move(c));
+  }
+  return out;
+}
+
+Expected<std::vector<Person>, Error> read_persons(const std::vector<std::uint8_t>& bytes) {
+  pugi::xml_document doc;
+  RETURN_IF_ERROR(load_xml_buffer(doc, bytes, "persons_reader", "persons part"));
+  const pugi::xml_node root = doc.child("personList");
+  if (!root) {
+    return make_error(FormulonErrorCode::kIoSheetCorrupt, "persons part: missing <personList> root",
+                      "context=persons_reader");
+  }
+  std::vector<Person> out;
+  for (pugi::xml_node node = root.child("person"); node; node = node.next_sibling("person")) {
+    Person p;
+    p.id = node.attribute("id").value();
+    p.display_name = node.attribute("displayName").value();
+    p.user_id = node.attribute("userId").value();
+    p.provider_id = node.attribute("providerId").value();
+    out.push_back(std::move(p));
+  }
+  return out;
+}
+
+std::string write_threaded_comments(const std::vector<ThreadedComment>& comments) {
+  if (comments.empty()) {
+    return {};
+  }
+  std::string out;
+  out.reserve(256 + comments.size() * 256);
+  AppendRootOpen(out, "ThreadedComments");
+  for (const ThreadedComment& c : comments) {
+    out.append("  <threadedComment");
+    append_xml_attr(out, "ref", a1::encode_a1(c.row, c.col));
+    append_xml_attr(out, "dT", c.created);
+    append_xml_attr(out, "personId", c.person_id);
+    append_xml_attr(out, "id", c.id);
+    if (!c.parent_id.empty()) {
+      append_xml_attr(out, "parentId", c.parent_id);
+    } else if (c.done) {
+      out.append(" done=\"1\"");
+    }
+    out.append("><text>");
+    AppendXmlEscaped(out, c.text);
+    out.append("</text>");
+    if (!c.mentions.empty()) {
+      out.append("<mentions>");
+      for (const Mention& m : c.mentions) {
+        out.append("<mention");
+        append_xml_attr(out, "mentionpersonId", m.person_id);
+        append_xml_attr(out, "mentionId", m.mention_id);
+        append_xml_attr_uint(out, "startIndex", m.start);
+        append_xml_attr_uint(out, "length", m.length);
+        out.append("/>");
+      }
+      out.append("</mentions>");
+    }
+    out.append("</threadedComment>\n");
+  }
+  out.append("</ThreadedComments>\n");
+  return out;
+}
+
+std::string write_persons(const std::vector<Person>& persons) {
+  if (persons.empty()) {
+    return {};
+  }
+  std::string out;
+  out.reserve(256 + persons.size() * 192);
+  AppendRootOpen(out, "personList");
+  for (const Person& p : persons) {
+    out.append("  <person");
+    append_xml_attr(out, "displayName", p.display_name);
+    append_xml_attr(out, "id", p.id);
+    if (!p.user_id.empty()) {
+      append_xml_attr(out, "userId", p.user_id);
+    }
+    if (!p.provider_id.empty()) {
+      append_xml_attr(out, "providerId", p.provider_id);
+    }
+    out.append("/>\n");
+  }
+  out.append("</personList>\n");
+  return out;
+}
+
+void drop_thread_stubs(std::vector<CellComment>& notes, const std::vector<ThreadedComment>& threads) {
+  if (threads.empty()) {
+    return;
+  }
+  std::vector<CellComment> kept;
+  kept.reserve(notes.size());
+  for (CellComment& note : notes) {
+    const std::string_view author(note.author);
+    bool stub = false;
+    if (author.substr(0, kStubAuthorPrefix.size()) == kStubAuthorPrefix) {
+      const std::size_t root = find_threaded_comment(threads, author.substr(kStubAuthorPrefix.size()));
+      stub = root < threads.size() && threads[root].parent_id.empty() && threads[root].row == note.row &&
+             threads[root].col == note.col;
+    }
+    if (!stub) {
+      kept.push_back(std::move(note));
+    }
+  }
+  notes = std::move(kept);
+}
+
+std::vector<CellComment> legacy_comments_with_stubs(const Sheet& sheet) {
+  const std::vector<ThreadedComment>& threads = sheet.threaded_comments();
+  std::vector<CellComment> out;
+  out.reserve(sheet.comments().size() + threads.size());
+  for (const CellComment& note : sheet.comments()) {
+    if (find_thread_at(threads, note.row, note.col) == threads.size()) {
+      out.push_back(note);
+    }
+  }
+  for (std::size_t i = 0; i < threads.size(); ++i) {
+    const ThreadedComment& t = threads[i];
+    if (t.parent_id.empty()) {
+      out.emplace_back(t.row, t.col, std::string(kStubAuthorPrefix) + t.id, threaded_comment_stub_text(threads, i),
+                       t.id);
+    }
+  }
+  return out;
+}
+
+}  // namespace formulon::io
diff --git a/src/io/threaded_comments_io.h b/src/io/threaded_comments_io.h
new file mode 100644
index 000000000..ede2cc312
--- /dev/null
+++ b/src/io/threaded_comments_io.h
@@ -0,0 +1,50 @@
+//
+// Read and write the threadedComments and persons package parts.
+//
+// `xl/threadedComments/threadedComment<N>.xml` holds one sheet's threaded
+// comments; `xl/persons/person.xml` the workbook's person list. Both are
+// fully model-owned: the reader takes them out of passthrough and the writer
+// regenerates them. Each thread also has a legacy note stub in the sheet's
+// comments part, identified by the author `tc={thread id}`; the helpers here
+// separate stubs from real notes on read and rebuild them on write.
+
+#ifndef FORMULON_IO_THREADED_COMMENTS_IO_H_
+#define FORMULON_IO_THREADED_COMMENTS_IO_H_
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "sheet.h"
+#include "threaded_comment.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+
+namespace formulon::io {
+
+/// Parses a threadedComments part. Fails with `kIoSheetCorrupt` on a missing
+/// root or an absent / unparseable `ref`.
+Expected<std::vector<ThreadedComment>, Error> read_threaded_comments(const std::vector<std::uint8_t>& bytes);
+
+/// Parses a persons part. Fails with `kIoSheetCorrupt` on a missing root.
+Expected<std::vector<Person>, Error> read_persons(const std::vector<std::uint8_t>& bytes);
+
+/// Serialises one sheet's threaded comments; empty input returns "".
+std::string write_threaded_comments(const std::vector<ThreadedComment>& comments);
+
+/// Serialises the person list; empty input returns "".
+std::string write_persons(const std::vector<Person>& persons);
+
+/// Removes from `notes` every legacy stub of a thread in `threads`: a note
+/// whose author is `tc=` + the id of a thread anchored at the same cell.
+/// A `tc=` note without its thread stays a note.
+void drop_thread_stubs(std::vector<CellComment>& notes, const std::vector<ThreadedComment>& threads);
+
+/// The comments-part list for `sheet`: its notes in order, then one stub per
+/// thread (author `tc={id}`, `xr:uid` = thread id). A note sharing a cell with
+/// a thread is left out, since a cell carries one comment.
+std::vector<CellComment> legacy_comments_with_stubs(const Sheet& sheet);
+
+}  // namespace formulon::io
+
+#endif  // FORMULON_IO_THREADED_COMMENTS_IO_H_
diff --git a/src/io/xlsb/brt_color.h b/src/io/xlsb/brt_color.h
new file mode 100644
index 000000000..5e40c1f32
--- /dev/null
+++ b/src/io/xlsb/brt_color.h
@@ -0,0 +1,72 @@
+//
+// BrtColor encoding shared by the styles and conditional-formatting
+// writers: [flags (fValidRGB bit 0, XColorType bits 1..7), index,
+// tint:i16, r, g, b, a].
+
+#ifndef FORMULON_IO_XLSB_BRT_COLOR_H_
+#define FORMULON_IO_XLSB_BRT_COLOR_H_
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <cstdint>
+
+#include "styles.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+
+/// `XColorType` values.
+inline constexpr std::uint8_t kBrtColorTypeAuto = 0;
+inline constexpr std::uint8_t kBrtColorTypeIndexed = 1;
+inline constexpr std::uint8_t kBrtColorTypeRgb = 2;
+inline constexpr std::uint8_t kBrtColorTypeTheme = 3;
+/// The system palette slot Excel writes beside an automatic colour.
+inline constexpr std::uint8_t kBrtColorAutoIndex = 0x40U;
+/// A tint is stored as a signed 16-bit fraction of this scale.
+inline constexpr double kBrtColorTintScale = 32767.0;
+
+/// Encodes `spec`, keeping a theme / indexed / auto selector; the RGBA
+/// bytes are `argb`, literal for an RGB selector and a fallback otherwise.
+/// Bit 7 of the flags byte stays clear: the reserved type 0x41 it would
+/// produce makes Excel reject the whole part.
+inline std::array<std::uint8_t, 8> encode_brt_color(std::uint32_t argb, const ColorSpec& spec) {
+  std::uint8_t type = kBrtColorTypeRgb;
+  std::uint8_t index = 0xFFU;  // what Excel writes beside an RGB colour
+  std::int16_t tint = 0;
+  switch (spec.kind) {
+    case ColorSpec::Kind::kTheme:
+      type = kBrtColorTypeTheme;
+      index = static_cast<std::uint8_t>(std::min<std::uint32_t>(spec.theme, 0xFFU));
+      tint = static_cast<std::int16_t>(
+          std::clamp(std::round(spec.tint * kBrtColorTintScale), -kBrtColorTintScale, kBrtColorTintScale));
+      break;
+    case ColorSpec::Kind::kIndexed:
+      type = kBrtColorTypeIndexed;
+      index = static_cast<std::uint8_t>(std::min<std::uint32_t>(spec.indexed, 0xFFU));
+      break;
+    case ColorSpec::Kind::kAuto:
+      type = kBrtColorTypeAuto;
+      index = kBrtColorAutoIndex;
+      break;
+    case ColorSpec::Kind::kNone:
+    case ColorSpec::Kind::kRgb:
+      break;
+  }
+  const auto raw = static_cast<std::uint16_t>(tint);
+  return {static_cast<std::uint8_t>((static_cast<unsigned>(type) << 1U) | 0x01U),
+          index,
+          static_cast<std::uint8_t>(raw & 0xFFU),
+          static_cast<std::uint8_t>(raw >> 8U),
+          static_cast<std::uint8_t>((argb >> 16U) & 0xFFU),
+          static_cast<std::uint8_t>((argb >> 8U) & 0xFFU),
+          static_cast<std::uint8_t>(argb & 0xFFU),
+          static_cast<std::uint8_t>((argb >> 24U) & 0xFFU)};
+}
+
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_XLSB_BRT_COLOR_H_
diff --git a/src/io/xlsb/cf_records.cpp b/src/io/xlsb/cf_records.cpp
index ec3026afc..5705b4b2e 100644
--- a/src/io/xlsb/cf_records.cpp
+++ b/src/io/xlsb/cf_records.cpp
@@ -5,7 +5,6 @@
 #include <algorithm>
 #include <array>
 #include <cmath>
-#include <cstdio>
 #include <cstring>
 #include <limits>
 #include <optional>
@@ -14,6 +13,7 @@
 #include <utility>
 
 #include "io/cf_writer.h"
+#include "io/xlsb/brt_color.h"
 #include "io/xlsb/ptg_reader.h"
 #include "io/xlsb/record.h"
 #include "io/xlsb/record_writer.h"
@@ -22,6 +22,7 @@
 #include "parser/ast_format.h"
 #include "parser/parser.h"
 #include "utils/arena.h"
+#include "utils/number_text.h"
 #include "utils/structured_log.h"
 
 namespace formulon {
@@ -264,11 +265,48 @@ class BlockCursor {
   ByteSpan cursor_;
 };
 
+// BrtColor: [flags (fValidRGB bit 0, XColorType bits 1..7), index, tint:i16,
+// r, g, b, a]. XColorType 0 is automatic, 1 a palette index, 2 literal RGB,
+// 3 a theme index with tint (tint / 32767). Theme, palette and automatic
+// colours keep their selector in `Color::spec`; the channels stay the
+// placeholder the OOXML reader leaves.
+
 std::optional<cf::Color> DecodeColor(ByteSpan p) {
-  if (p.size != 8U || p.data[0] != 0x05U || p.data[1] != 0xFFU || p.data[2] != 0U || p.data[3] != 0U) {
+  if (p.size != 8U) {
     return std::nullopt;
   }
-  return cf::Color{p.data[4], p.data[5], p.data[6], p.data[7]};
+  const std::uint8_t type = static_cast<std::uint8_t>(p.data[0] >> 1U);
+  const std::uint8_t index = p.data[1];
+  cf::Color out{};
+  switch (type) {
+    case kBrtColorTypeRgb:
+      if (p.data[0] != 0x05U || index != 0xFFU || p.data[2] != 0U || p.data[3] != 0U) {
+        return std::nullopt;
+      }
+      return cf::Color{p.data[4], p.data[5], p.data[6], p.data[7]};
+    case kBrtColorTypeTheme: {
+      out.spec.kind = ColorSpec::Kind::kTheme;
+      out.spec.theme = index;
+      const auto raw = static_cast<std::int16_t>(static_cast<std::uint16_t>(p.data[2] | (p.data[3] << 8U)));
+      out.spec.tint = static_cast<double>(raw) / kBrtColorTintScale;
+      return out;
+    }
+    case kBrtColorTypeIndexed:
+      out.spec.kind = ColorSpec::Kind::kIndexed;
+      out.spec.indexed = index;
+      return out;
+    case kBrtColorTypeAuto:
+      out.spec.kind = ColorSpec::Kind::kAuto;
+      return out;
+    default:
+      return std::nullopt;
+  }
+}
+
+std::array<std::uint8_t, 8> EncodeColor(const cf::Color& c) {
+  const std::uint32_t argb = (static_cast<std::uint32_t>(c.a) << 24U) | (static_cast<std::uint32_t>(c.r) << 16U) |
+                             (static_cast<std::uint32_t>(c.g) << 8U) | static_cast<std::uint32_t>(c.b);
+  return encode_brt_color(argb, c.spec);
 }
 
 std::optional<cf::CfValueObject> DecodeCfvo(ByteSpan p, bool in_icon_set, const MergeRange& base,
@@ -326,10 +364,19 @@ std::optional<cf::CfValueObject> DecodeCfvo(ByteSpan p, bool in_icon_set, const
 }
 
 std::string FormatGuid(const std::uint8_t* g) {
-  char buf[40];
-  std::snprintf(buf, sizeof(buf), "{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", g[3], g[2],
-                g[1], g[0], g[5], g[4], g[7], g[6], g[8], g[9], g[10], g[11], g[12], g[13], g[14], g[15]);
-  return buf;
+  // Bytes in GUID text order: the first three groups are stored little-endian.
+  static constexpr int kTextOrder[16] = {3, 2, 1, 0, 5, 4, 7, 6, 8, 9, 10, 11, 12, 13, 14, 15};
+  std::string out = "{";
+  for (int i = 0; i < 16; ++i) {
+    if (i == 4 || i == 6 || i == 8 || i == 10) {
+      out.push_back('-');
+    }
+    char hex[4];
+    format_hex(hex, sizeof(hex), g[kTextOrder[i]], 2, true);
+    out.append(hex);
+  }
+  out.push_back('}');
+  return out;
 }
 
 /// Decodes the visual payload and x14 link that follow a BrtBeginCFRule, up
@@ -631,8 +678,8 @@ bool ParseGuid(const std::string& id, std::array<std::uint8_t, kGuidBytes>& out)
 }
 
 void EmitColor(std::vector<std::uint8_t>& dst, cf::Color c) {
-  const std::vector<std::uint8_t> payload = {0x05, 0xFF, 0x00, 0x00, c.r, c.g, c.b, c.a};
-  emit_record(dst, kColor, payload);
+  const auto bytes = EncodeColor(c);
+  emit_record(dst, kColor, std::vector<std::uint8_t>(bytes.begin(), bytes.end()));
 }
 
 Expected<void, Error> EmitCfvo(std::vector<std::uint8_t>& dst, const cf::CfValueObject& v, bool in_icon_set,
@@ -994,7 +1041,9 @@ void EmitDataBar14(std::vector<std::uint8_t>& head, std::vector<std::uint8_t>& c
   emit_u16(p, flags);
   emit_record(head, kBeginDataBar14, p);
   const auto color = [&colors](cf::Color c) {
-    const std::vector<std::uint8_t> payload = {0x00, 0x00, 0x00, 0x00, 0x05, 0xFF, 0x00, 0x00, c.r, c.g, c.b, c.a};
+    std::vector<std::uint8_t> payload(4U, 0U);
+    const auto bytes = EncodeColor(c);
+    payload.insert(payload.end(), bytes.begin(), bytes.end());
     emit_record(colors, kColor14, payload);
   };
   if (border) {
diff --git a/src/io/xlsb/external_link_reader.cpp b/src/io/xlsb/external_link_reader.cpp
index d9190eefb..a7b747d7b 100644
--- a/src/io/xlsb/external_link_reader.cpp
+++ b/src/io/xlsb/external_link_reader.cpp
@@ -3,7 +3,6 @@
 
 #include <cstddef>
 #include <cstdint>
-#include <cstring>
 #include <string>
 #include <utility>
 
@@ -34,18 +33,6 @@ Error CorruptError(const char* message) {
   return make_error(FormulonErrorCode::kIoXlsbCorrupt, message, "context=xlsb_external_link_reader");
 }
 
-Expected<double, Error> ReadDouble(ByteSpan& cursor) {
-  if (cursor.size < sizeof(double)) {
-    return make_error(FormulonErrorCode::kIoXlsbRecordTruncated, "xlsb extern cell double truncated",
-                      "context=xlsb_external_link_reader");
-  }
-  double value = 0.0;
-  std::memcpy(&value, cursor.data, sizeof(value));
-  cursor.data += sizeof(double);
-  cursor.size -= sizeof(double);
-  return value;
-}
-
 /// Decodes a defined name's stored formula into the rectangle it names.
 ///
 /// The two accepted shapes are a single reference and a rectangle, each
@@ -185,7 +172,7 @@ Expected<ExternalBook, Error> read_external_link_bin(ByteSpan cursor) {
         if (!col_or) {
           return col_or.error();
         }
-        auto value_or = ReadDouble(payload);
+        auto value_or = read_double(payload);
         if (!value_or) {
           return value_or.error();
         }
diff --git a/src/io/xlsb/pivot_reader.cpp b/src/io/xlsb/pivot_reader.cpp
index 555c805bc..22c9611a1 100644
--- a/src/io/xlsb/pivot_reader.cpp
+++ b/src/io/xlsb/pivot_reader.cpp
@@ -2,7 +2,6 @@
 
 #include <cstddef>
 #include <cstdint>
-#include <cstring>
 #include <optional>
 #include <string>
 #include <utility>
@@ -92,18 +91,6 @@ Error CorruptError(const char* message) {
   return make_error(FormulonErrorCode::kIoXlsbRecordCorrupt, message, "context=xlsb_pivot_reader");
 }
 
-Expected<double, Error> ReadDouble(ByteSpan& cursor) {
-  if (cursor.size < sizeof(double)) {
-    return make_error(FormulonErrorCode::kIoXlsbRecordTruncated, "xlsb pivot record double truncated",
-                      "context=xlsb_pivot_reader");
-  }
-  double value = 0.0;
-  std::memcpy(&value, cursor.data, sizeof(value));
-  cursor.data += sizeof(double);
-  cursor.size -= sizeof(double);
-  return value;
-}
-
 /// How a record cell encodes the value for one cache field.
 ///
 /// The record stream is not self-describing: the width and meaning of a
@@ -316,7 +303,7 @@ Expected<void, Error> DecodeCacheRecords(ByteSpan cursor, const std::vector<Cell
         record.cells.push_back(Value::number(static_cast<double>(index_or.value())));
         record.cell_is_index.push_back(true);
       } else {
-        auto value_or = ReadDouble(payload);
+        auto value_or = read_double(payload);
         if (!value_or) {
           return value_or.error();
         }
diff --git a/src/io/xlsb/protection_records.cpp b/src/io/xlsb/protection_records.cpp
index d4510d97f..5f4bd1c06 100644
--- a/src/io/xlsb/protection_records.cpp
+++ b/src/io/xlsb/protection_records.cpp
@@ -3,7 +3,6 @@
 #include "io/xlsb/protection_records.h"
 
 #include <array>
-#include <cstdio>
 #include <string_view>
 
 #include "io/xlsb/record.h"
@@ -11,6 +10,7 @@
 #include "io/xml_escape.h"
 #include "io/xsd_bool.h"
 #include "pugixml.hpp"
+#include "utils/number_text.h"
 
 namespace formulon {
 namespace io {
@@ -70,7 +70,7 @@ bool ReadBlob(ByteSpan& p, std::vector<std::uint8_t>& out) {
 
 std::string LegacyHex(std::uint16_t pwd) {
   char buf[5];
-  std::snprintf(buf, sizeof(buf), "%04X", static_cast<unsigned>(pwd));
+  format_hex(buf, sizeof(buf), pwd, 4, true);
   return buf;
 }
 
diff --git a/src/io/xlsb/ptg_declarations.cpp b/src/io/xlsb/ptg_declarations.cpp
new file mode 100644
index 000000000..9398e9f1b
--- /dev/null
+++ b/src/io/xlsb/ptg_declarations.cpp
@@ -0,0 +1,340 @@
+//
+// Implementation of the name / sheet-range collection pass declared in
+// `io/xlsb/ptg_writer.h`: which `BrtName` and `BrtExternSheet` entries a
+// formula's Ptg encoding will resolve through.
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <unordered_set>
+#include <utility>
+#include <vector>
+
+#include "io/future_functions.h"
+#include "io/xlsb/func_id_table.h"
+#include "io/xlsb/ptg_targets.h"
+#include "io/xlsb/ptg_writer.h"
+#include "parser/ast.h"
+#include "parser/reference.h"
+#include "utils/strings.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+
+/// Recursion helper for `collect_ptg_names`: adds `name` to `names` (and
+/// marks it in `seen`) unless already present.
+void AddName(std::string_view name, std::vector<std::string>& names, std::unordered_set<std::string>& seen) {
+  std::string owned(name);
+  if (seen.insert(owned).second) {
+    names.push_back(std::move(owned));
+  }
+}
+
+/// Packs an `(itabFirst, itabLast)` pair into a single dedupe key.
+std::uint64_t PackRangeKey(std::int32_t itab_first, std::int32_t itab_last) {
+  return (static_cast<std::uint64_t>(static_cast<std::uint32_t>(itab_first)) << 32) |
+         static_cast<std::uint64_t>(static_cast<std::uint32_t>(itab_last));
+}
+
+/// Recursion helper for `collect_ptg_sheet_ranges`: resolves `itab_first`
+/// / `itab_last` and, when both are valid, appends the pair to `ranges`
+/// unless already present in `seen`.
+void AddSheetRange(std::int32_t itab_first, std::int32_t itab_last, SheetRangeTable& ranges,
+                   std::unordered_set<std::uint64_t>& seen) {
+  if (itab_first < 0 || itab_last < 0) {
+    return;  // Unresolvable sheet name; the encode fails later with a precise error.
+  }
+  if (seen.insert(PackRangeKey(itab_first, itab_last)).second) {
+    ranges.emplace_back(itab_first, itab_last);
+  }
+}
+
+enum class NameCollectMode : std::uint8_t { kPtg, kScopeResolved, kSheetQualified };
+
+/// True when `name` matches an in-scope LET / LAMBDA parameter.
+bool InParamScope(const std::vector<std::string_view>& scope, std::string_view name) {
+  // Case-insensitive: see `Encoder::emit_name_ref`.
+  return std::any_of(scope.begin(), scope.end(),
+                     [name](std::string_view param) { return strings::case_insensitive_eq(param, name); });
+}
+
+/// Recursive worker for `collect_ptg_names` carrying the LET / LAMBDA
+/// parameter names currently in scope (innermost last). A `NameRef`
+/// matching an in-scope parameter resolves at encode time to that
+/// parameter's hidden `_xlpm.<name>` placeholder (see
+/// `Encoder::emit_name_ref`), so it must not be registered as an ordinary
+/// workbook defined name. A callee with no function id (`Fn(3)`: a named
+/// LAMBDA, or a name no one defined) is a name too. `mode` selects the view:
+/// every unqualified name a `PtgName` or self-book `PtgNameX` needs
+/// (`kPtg`); only names resolved from the formula's own scope
+/// (`kScopeResolved`); or only sheet-qualified names, each added as `sheet`
+/// NUL `name` (`kSheetQualified`).
+void CollectNamesScoped(const parser::AstNode& node, std::vector<std::string>& names,
+                        std::unordered_set<std::string>& seen, std::vector<std::string_view>& scope,
+                        NameCollectMode mode) {
+  // Hidden `_xlfn.*` / `_xlpm.*` records and unqualified names.
+  auto add = [&](std::string_view name) {
+    if (mode != NameCollectMode::kSheetQualified) {
+      AddName(name, names, seen);
+    }
+  };
+  switch (node.kind()) {
+    case parser::NodeKind::NameRef: {
+      const std::string_view name = node.as_name();
+      if (!node.as_name_sheet().empty()) {
+        // Resolves through a scoped key (a definition or its sheet's stub),
+        // never a LET / LAMBDA parameter or a workbook placeholder.
+        if (mode == NameCollectMode::kSheetQualified) {
+          AddName(std::string(node.as_name_sheet()) + '\0' + std::string(name), names, seen);
+        }
+        return;
+      }
+      if (InParamScope(scope, name)) {
+        return;  // LET / LAMBDA parameter: encoded via its _xlpm. placeholder.
+      }
+      add(name);
+      return;
+    }
+    case parser::NodeKind::Call: {
+      const std::string_view name = canonical_function_name(node.as_call_name());
+      if (UsesHiddenNameRoute(name)) {
+        add(xlsb_hidden_function_name(name));
+      } else if (lookup_func_by_name(name) == nullptr && !InParamScope(scope, node.as_call_name())) {
+        add(node.as_call_name());
+      }
+      const std::uint32_t arity = node.as_call_arity();
+      for (std::uint32_t i = 0; i < arity; ++i) {
+        CollectNamesScoped(node.as_call_arg(i), names, seen, scope, mode);
+      }
+      return;
+    }
+    case parser::NodeKind::UnaryOp:
+      CollectNamesScoped(node.as_unary_operand(), names, seen, scope, mode);
+      return;
+    case parser::NodeKind::BinaryOp:
+      CollectNamesScoped(node.as_binary_lhs(), names, seen, scope, mode);
+      CollectNamesScoped(node.as_binary_rhs(), names, seen, scope, mode);
+      return;
+    case parser::NodeKind::RangeOp:
+      CollectNamesScoped(node.as_range_lhs(), names, seen, scope, mode);
+      CollectNamesScoped(node.as_range_rhs(), names, seen, scope, mode);
+      return;
+    case parser::NodeKind::IntersectOp:
+      CollectNamesScoped(node.as_intersect_lhs(), names, seen, scope, mode);
+      CollectNamesScoped(node.as_intersect_rhs(), names, seen, scope, mode);
+      return;
+    case parser::NodeKind::UnionOp: {
+      const std::uint32_t arity = node.as_union_arity();
+      for (std::uint32_t i = 0; i < arity; ++i) {
+        CollectNamesScoped(node.as_union_child(i), names, seen, scope, mode);
+      }
+      return;
+    }
+    case parser::NodeKind::ImplicitIntersection:
+      add(xlsb_hidden_function_name("SINGLE"));
+      CollectNamesScoped(node.as_implicit_intersection_operand(), names, seen, scope, mode);
+      return;
+    case parser::NodeKind::ArrayLiteral: {
+      const std::uint32_t rows = node.as_array_rows();
+      const std::uint32_t cols = node.as_array_cols();
+      for (std::uint32_t r = 0; r < rows; ++r) {
+        for (std::uint32_t c = 0; c < cols; ++c) {
+          CollectNamesScoped(node.as_array_element(r, c), names, seen, scope, mode);
+        }
+      }
+      return;
+    }
+    case parser::NodeKind::SpillRef: {
+      // Stored as a call to the hidden `_xlfn.ANCHORARRAY` name (see
+      // `Encoder::emit_spill_ref`), so it needs the same BrtName
+      // registration any other future-function callee gets.
+      add(xlsb_hidden_function_name("ANCHORARRAY"));
+      if (const parser::AstNode* anchor = node.as_spill_ref_anchor_expr(); anchor != nullptr) {
+        CollectNamesScoped(*anchor, names, seen, scope, mode);
+      }
+      return;
+    }
+    case parser::NodeKind::ExternalRef:
+      // `[0]!Rate` is never a LET / LAMBDA parameter and, like `Sheet2!Rate`,
+      // not resolved from the formula's own scope.
+      if (parser::is_self_book_name_ref(node) && mode == NameCollectMode::kPtg) {
+        AddName(node.as_external_ref_name(), names, seen);
+      }
+      return;
+    case parser::NodeKind::LambdaCall: {
+      CollectNamesScoped(node.as_lambda_call_callee(), names, seen, scope, mode);
+      const std::uint32_t arity = node.as_lambda_call_arity();
+      for (std::uint32_t i = 0; i < arity; ++i) {
+        CollectNamesScoped(node.as_lambda_call_arg(i), names, seen, scope, mode);
+      }
+      return;
+    }
+    case parser::NodeKind::LetBinding: {
+      add("_xlfn.LET");
+      const std::uint32_t n = node.as_let_binding_count();
+      const std::size_t scope_base = scope.size();
+      for (std::uint32_t i = 0; i < n; ++i) {
+        add(std::string("_xlpm.") + std::string(node.as_let_binding_name(i)));
+        // Excel LET binds sequentially: a value expression sees only the
+        // earlier bindings, so collect it before pushing this parameter.
+        CollectNamesScoped(node.as_let_binding_expr(i), names, seen, scope, mode);
+        scope.push_back(node.as_let_binding_name(i));
+      }
+      CollectNamesScoped(node.as_let_body(), names, seen, scope, mode);
+      scope.resize(scope_base);
+      return;
+    }
+    case parser::NodeKind::Lambda: {
+      add("_xlfn.LAMBDA");
+      const std::uint32_t n = node.as_lambda_param_count();
+      const std::size_t scope_base = scope.size();
+      for (std::uint32_t i = 0; i < n; ++i) {
+        add(std::string("_xlpm.") + std::string(node.as_lambda_param(i)));
+        scope.push_back(node.as_lambda_param(i));
+      }
+      CollectNamesScoped(node.as_lambda_body(), names, seen, scope, mode);
+      scope.resize(scope_base);
+      return;
+    }
+    // Leaves, and forms the encoder does not lower (StructuredRef): nothing
+    // to collect. A future writer bundle that lowers these would extend
+    // this switch alongside the corresponding `emit_*` case.
+    default:
+      return;
+  }
+}
+
+}  // namespace
+
+std::string sheet_scoped_name_key(std::int32_t itab, std::string_view name) {
+  std::string key = std::to_string(itab);
+  key.push_back('!');
+  key.append(strings::to_ascii_lower(name));
+  return key;
+}
+
+void collect_ptg_names(const parser::AstNode& node, std::vector<std::string>& names,
+                       std::unordered_set<std::string>& seen) {
+  std::vector<std::string_view> scope;
+  CollectNamesScoped(node, names, seen, scope, NameCollectMode::kPtg);
+}
+
+void collect_scope_resolved_names(const parser::AstNode& node, std::vector<std::string>& names,
+                                  std::unordered_set<std::string>& seen) {
+  std::vector<std::string_view> scope;
+  CollectNamesScoped(node, names, seen, scope, NameCollectMode::kScopeResolved);
+}
+
+void collect_sheet_qualified_names(const parser::AstNode& node,
+                                   std::vector<std::pair<std::string, std::string>>& qualified) {
+  std::vector<std::string> keys;
+  std::unordered_set<std::string> seen;
+  std::vector<std::string_view> scope;
+  CollectNamesScoped(node, keys, seen, scope, NameCollectMode::kSheetQualified);
+  for (const std::string& key : keys) {
+    const std::size_t split = key.find('\0');
+    qualified.emplace_back(key.substr(0, split), key.substr(split + 1));
+  }
+}
+
+void collect_ptg_sheet_ranges(const parser::AstNode& node, const std::vector<std::string>& sheet_names,
+                              SheetRangeTable& ranges, std::unordered_set<std::uint64_t>& seen) {
+  switch (node.kind()) {
+    case parser::NodeKind::Ref: {
+      const parser::Reference& r = node.as_ref();
+      if (!r.sheet.empty()) {
+        const int itab = resolve_ixti(sheet_names, r.sheet);
+        AddSheetRange(itab, itab, ranges, seen);
+      }
+      return;
+    }
+    case parser::NodeKind::Ref3D: {
+      const int itab_begin = resolve_ixti(sheet_names, node.as_ref3d_sheet_begin());
+      const int itab_end = resolve_ixti(sheet_names, node.as_ref3d_sheet_end());
+      AddSheetRange(itab_begin, itab_end, ranges, seen);
+      return;
+    }
+    case parser::NodeKind::NameRef:
+    case parser::NodeKind::ExternalRef: {
+      // `Sheet1!Rate` and `[0]!Rate` encode as `PtgNameX` through the
+      // book-scope entry.
+      const bool name_x = node.kind() == parser::NodeKind::NameRef ? !node.as_name_sheet().empty()
+                                                                   : parser::is_self_book_name_ref(node);
+      if (name_x && seen.insert(PackRangeKey(kXtiNoSheet, kXtiNoSheet)).second) {
+        ranges.emplace_back(kXtiNoSheet, kXtiNoSheet);
+      }
+      return;
+    }
+    case parser::NodeKind::LambdaCall: {
+      collect_ptg_sheet_ranges(node.as_lambda_call_callee(), sheet_names, ranges, seen);
+      const std::uint32_t arity = node.as_lambda_call_arity();
+      for (std::uint32_t i = 0; i < arity; ++i) {
+        collect_ptg_sheet_ranges(node.as_lambda_call_arg(i), sheet_names, ranges, seen);
+      }
+      return;
+    }
+    case parser::NodeKind::Call: {
+      const std::uint32_t arity = node.as_call_arity();
+      for (std::uint32_t i = 0; i < arity; ++i) {
+        collect_ptg_sheet_ranges(node.as_call_arg(i), sheet_names, ranges, seen);
+      }
+      return;
+    }
+    case parser::NodeKind::UnaryOp:
+      collect_ptg_sheet_ranges(node.as_unary_operand(), sheet_names, ranges, seen);
+      return;
+    case parser::NodeKind::BinaryOp:
+      collect_ptg_sheet_ranges(node.as_binary_lhs(), sheet_names, ranges, seen);
+      collect_ptg_sheet_ranges(node.as_binary_rhs(), sheet_names, ranges, seen);
+      return;
+    case parser::NodeKind::RangeOp:
+      collect_ptg_sheet_ranges(node.as_range_lhs(), sheet_names, ranges, seen);
+      collect_ptg_sheet_ranges(node.as_range_rhs(), sheet_names, ranges, seen);
+      return;
+    case parser::NodeKind::IntersectOp:
+      collect_ptg_sheet_ranges(node.as_intersect_lhs(), sheet_names, ranges, seen);
+      collect_ptg_sheet_ranges(node.as_intersect_rhs(), sheet_names, ranges, seen);
+      return;
+    case parser::NodeKind::UnionOp: {
+      const std::uint32_t arity = node.as_union_arity();
+      for (std::uint32_t i = 0; i < arity; ++i) {
+        collect_ptg_sheet_ranges(node.as_union_child(i), sheet_names, ranges, seen);
+      }
+      return;
+    }
+    case parser::NodeKind::ImplicitIntersection:
+      collect_ptg_sheet_ranges(node.as_implicit_intersection_operand(), sheet_names, ranges, seen);
+      return;
+    case parser::NodeKind::ArrayLiteral: {
+      const std::uint32_t rows = node.as_array_rows();
+      const std::uint32_t cols = node.as_array_cols();
+      for (std::uint32_t r = 0; r < rows; ++r) {
+        for (std::uint32_t c = 0; c < cols; ++c) {
+          collect_ptg_sheet_ranges(node.as_array_element(r, c), sheet_names, ranges, seen);
+        }
+      }
+      return;
+    }
+    case parser::NodeKind::LetBinding: {
+      const std::uint32_t n = node.as_let_binding_count();
+      for (std::uint32_t i = 0; i < n; ++i) {
+        collect_ptg_sheet_ranges(node.as_let_binding_expr(i), sheet_names, ranges, seen);
+      }
+      collect_ptg_sheet_ranges(node.as_let_body(), sheet_names, ranges, seen);
+      return;
+    }
+    case parser::NodeKind::Lambda:
+      collect_ptg_sheet_ranges(node.as_lambda_body(), sheet_names, ranges, seen);
+      return;
+    default:
+      return;
+  }
+}
+
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/src/io/xlsb/ptg_targets.h b/src/io/xlsb/ptg_targets.h
new file mode 100644
index 000000000..ada787746
--- /dev/null
+++ b/src/io/xlsb/ptg_targets.h
@@ -0,0 +1,61 @@
+//
+// Internal primitives shared by the Ptg encoder (`ptg_writer.cpp`) and the
+// workbook-wide name / sheet-range collection pass (`ptg_declarations.cpp`),
+// which decide which `BrtName` / `BrtExternSheet` entries a formula needs.
+
+#ifndef FORMULON_IO_XLSB_PTG_TARGETS_H_
+#define FORMULON_IO_XLSB_PTG_TARGETS_H_
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "io/future_functions.h"
+#include "sheet_name.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+
+/// `itabFirst` / `itabLast` of the `BrtExternSheet` entry a `PtgNameX`
+/// naming one of this workbook's own defined names resolves through: the
+/// entry names no sheet, the record's own scope does.
+inline constexpr std::int32_t kXtiNoSheet = -2;
+
+/// True when Excel stores a call to `name` under a hidden `_xlfn.*`
+/// BrtName rather than a function id. Classified by
+/// `io::classify_storage_prefix`, the same enumeration the OOXML writer
+/// consults, so the two formats name the callee identically.
+inline bool IsFutureFunction(std::string_view name) {
+  return classify_storage_prefix(name) != parser::StoragePrefixKind::None;
+}
+
+/// True when a call to `name` is encoded through the hidden-name route
+/// (`PtgName` + `PtgFuncVar(255)`) rather than a function id: either a
+/// `_xlfn.*` future function, or one of the enumerated names Excel
+/// spells bare in OOXML yet has no function id for. Both sets are
+/// enumerated from observed Excel output — "absent from
+/// `func_id_table`" deliberately does not qualify, because that table
+/// grows incrementally and a hidden `_xlfn.<NAME>` Excel does not know
+/// resolves to `#NAME?`.
+inline bool UsesHiddenNameRoute(std::string_view name) {
+  return IsFutureFunction(name) || xlsb_uses_hidden_name(name);
+}
+
+/// Resolves a sheet name to its 0-based ixti. Returns -1 when absent.
+inline int resolve_ixti(const std::vector<std::string>& sheet_names, std::string_view sheet) {
+  for (std::size_t i = 0; i < sheet_names.size(); ++i) {
+    if (formulon::sheet_names::equal(sheet_names[i], sheet)) {
+      return static_cast<int>(i);
+    }
+  }
+  return -1;
+}
+
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_XLSB_PTG_TARGETS_H_
diff --git a/src/io/xlsb/ptg_writer.cpp b/src/io/xlsb/ptg_writer.cpp
index 24a6629fa..a91470bdc 100644
--- a/src/io/xlsb/ptg_writer.cpp
+++ b/src/io/xlsb/ptg_writer.cpp
@@ -9,7 +9,6 @@
 
 #include <algorithm>
 #include <cstdint>
-#include <cstring>
 #include <optional>
 #include <string>
 #include <string_view>
@@ -20,6 +19,8 @@
 #include "io/future_functions.h"
 #include "io/xlsb/func_id_table.h"
 #include "io/xlsb/ptg.h"
+#include "io/xlsb/ptg_targets.h"
+#include "io/xlsb/record_writer.h"
 #include "parser/ast_format.h"
 #include "parser/reference.h"
 #include "sheet_name.h"
@@ -32,26 +33,6 @@ namespace io {
 namespace xlsb {
 namespace {
 
-/// True when Excel stores a call to `name` under a hidden `_xlfn.*`
-/// BrtName rather than a function id. Classified by
-/// `io::classify_storage_prefix`, the same enumeration the OOXML writer
-/// consults, so the two formats name the callee identically.
-bool IsFutureFunction(std::string_view name) {
-  return classify_storage_prefix(name) != parser::StoragePrefixKind::None;
-}
-
-/// True when a call to `name` is encoded through the hidden-name route
-/// (`PtgName` + `PtgFuncVar(255)`) rather than a function id: either a
-/// `_xlfn.*` future function, or one of the enumerated names Excel
-/// spells bare in OOXML yet has no function id for. Both sets are
-/// enumerated from observed Excel output — "absent from
-/// `func_id_table`" deliberately does not qualify, because that table
-/// grows incrementally and a hidden `_xlfn.<NAME>` Excel does not know
-/// resolves to `#NAME?`.
-bool UsesHiddenNameRoute(std::string_view name) {
-  return IsFutureFunction(name) || xlsb_uses_hidden_name(name);
-}
-
 /// Built-ins whose result can be a reference, as measured for the class of
 /// their call token.
 bool ReturnsReference(std::string_view name) {
@@ -134,29 +115,6 @@ std::uint8_t SlotClass(Slot slot, bool area, PtgEvaluation evaluation = PtgEvalu
   }
 }
 
-void emit_u8(std::vector<std::uint8_t>& dst, std::uint8_t v) {
-  dst.push_back(v);
-}
-
-void emit_u16(std::vector<std::uint8_t>& dst, std::uint16_t v) {
-  dst.push_back(static_cast<std::uint8_t>(v & 0xFF));
-  dst.push_back(static_cast<std::uint8_t>((v >> 8) & 0xFF));
-}
-
-void emit_u32(std::vector<std::uint8_t>& dst, std::uint32_t v) {
-  dst.push_back(static_cast<std::uint8_t>(v & 0xFF));
-  dst.push_back(static_cast<std::uint8_t>((v >> 8) & 0xFF));
-  dst.push_back(static_cast<std::uint8_t>((v >> 16) & 0xFF));
-  dst.push_back(static_cast<std::uint8_t>((v >> 24) & 0xFF));
-}
-
-void emit_double(std::vector<std::uint8_t>& dst, double v) {
-  std::uint64_t bits = 0;
-  std::memcpy(&bits, &v, sizeof(v));
-  emit_u32(dst, static_cast<std::uint32_t>(bits & 0xFFFFFFFFU));
-  emit_u32(dst, static_cast<std::uint32_t>((bits >> 32) & 0xFFFFFFFFU));
-}
-
 /// Emits a u16 code-unit count + UTF-16LE units for `text` (UTF-8 in).
 /// Mirrors `read_ptg_string` in the decoder. Code points above the BMP
 /// are emitted as a surrogate pair (so the count is in UTF-16 units).
@@ -268,26 +226,11 @@ parser::Reference OffsetFrom(parser::Reference ref, PtgBaseCell base) {
   return ref;
 }
 
-/// `itabFirst` / `itabLast` of the `BrtExternSheet` entry a `PtgNameX`
-/// naming one of this workbook's own defined names resolves through: the
-/// entry names no sheet, the record's own scope does.
-constexpr std::int32_t kXtiNoSheet = -2;
-
 Error unsupported_node(const char* kind) {
   return make_error(FormulonErrorCode::kIoXlsbUnsupportedPtg,
                     std::string("xlsb encoder cannot lower AST node kind: ") + kind, "context=xlsb_ptg_writer");
 }
 
-/// Resolves a sheet name to its 0-based ixti. Returns -1 when absent.
-int resolve_ixti(const std::vector<std::string>& sheet_names, std::string_view sheet) {
-  for (std::size_t i = 0; i < sheet_names.size(); ++i) {
-    if (formulon::sheet_names::equal(sheet_names[i], sheet)) {
-      return static_cast<int>(i);
-    }
-  }
-  return -1;
-}
-
 /// One rectangle of a precomputed reference result (`PtgMemArea`'s cache).
 struct Rect {
   std::uint32_t row_first;
@@ -1895,316 +1838,8 @@ class Encoder {
   std::vector<std::pair<std::string_view, std::uint32_t>> let_scope_;
 };
 
-/// Recursion helper for `collect_ptg_names`: adds `name` to `names` (and
-/// marks it in `seen`) unless already present.
-void AddName(std::string_view name, std::vector<std::string>& names, std::unordered_set<std::string>& seen) {
-  std::string owned(name);
-  if (seen.insert(owned).second) {
-    names.push_back(std::move(owned));
-  }
-}
-
-/// Packs an `(itabFirst, itabLast)` pair into a single dedupe key.
-std::uint64_t PackRangeKey(std::int32_t itab_first, std::int32_t itab_last) {
-  return (static_cast<std::uint64_t>(static_cast<std::uint32_t>(itab_first)) << 32) |
-         static_cast<std::uint64_t>(static_cast<std::uint32_t>(itab_last));
-}
-
-/// Recursion helper for `collect_ptg_sheet_ranges`: resolves `itab_first`
-/// / `itab_last` and, when both are valid, appends the pair to `ranges`
-/// unless already present in `seen`.
-void AddSheetRange(std::int32_t itab_first, std::int32_t itab_last, SheetRangeTable& ranges,
-                   std::unordered_set<std::uint64_t>& seen) {
-  if (itab_first < 0 || itab_last < 0) {
-    return;  // Unresolvable sheet name; the encode fails later with a precise error.
-  }
-  if (seen.insert(PackRangeKey(itab_first, itab_last)).second) {
-    ranges.emplace_back(itab_first, itab_last);
-  }
-}
-
-enum class NameCollectMode : std::uint8_t { kPtg, kScopeResolved, kSheetQualified };
-
-/// True when `name` matches an in-scope LET / LAMBDA parameter.
-bool InParamScope(const std::vector<std::string_view>& scope, std::string_view name) {
-  // Case-insensitive: see `Encoder::emit_name_ref`.
-  return std::any_of(scope.begin(), scope.end(),
-                     [name](std::string_view param) { return strings::case_insensitive_eq(param, name); });
-}
-
-/// Recursive worker for `collect_ptg_names` carrying the LET / LAMBDA
-/// parameter names currently in scope (innermost last). A `NameRef`
-/// matching an in-scope parameter resolves at encode time to that
-/// parameter's hidden `_xlpm.<name>` placeholder (see
-/// `Encoder::emit_name_ref`), so it must not be registered as an ordinary
-/// workbook defined name. A callee with no function id (`Fn(3)`: a named
-/// LAMBDA, or a name no one defined) is a name too. `mode` selects the view:
-/// every unqualified name a `PtgName` or self-book `PtgNameX` needs
-/// (`kPtg`); only names resolved from the formula's own scope
-/// (`kScopeResolved`); or only sheet-qualified names, each added as `sheet`
-/// NUL `name` (`kSheetQualified`).
-void CollectNamesScoped(const parser::AstNode& node, std::vector<std::string>& names,
-                        std::unordered_set<std::string>& seen, std::vector<std::string_view>& scope,
-                        NameCollectMode mode) {
-  // Hidden `_xlfn.*` / `_xlpm.*` records and unqualified names.
-  auto add = [&](std::string_view name) {
-    if (mode != NameCollectMode::kSheetQualified) {
-      AddName(name, names, seen);
-    }
-  };
-  switch (node.kind()) {
-    case parser::NodeKind::NameRef: {
-      const std::string_view name = node.as_name();
-      if (!node.as_name_sheet().empty()) {
-        // Resolves through a scoped key (a definition or its sheet's stub),
-        // never a LET / LAMBDA parameter or a workbook placeholder.
-        if (mode == NameCollectMode::kSheetQualified) {
-          AddName(std::string(node.as_name_sheet()) + '\0' + std::string(name), names, seen);
-        }
-        return;
-      }
-      if (InParamScope(scope, name)) {
-        return;  // LET / LAMBDA parameter: encoded via its _xlpm. placeholder.
-      }
-      add(name);
-      return;
-    }
-    case parser::NodeKind::Call: {
-      const std::string_view name = canonical_function_name(node.as_call_name());
-      if (UsesHiddenNameRoute(name)) {
-        add(xlsb_hidden_function_name(name));
-      } else if (lookup_func_by_name(name) == nullptr && !InParamScope(scope, node.as_call_name())) {
-        add(node.as_call_name());
-      }
-      const std::uint32_t arity = node.as_call_arity();
-      for (std::uint32_t i = 0; i < arity; ++i) {
-        CollectNamesScoped(node.as_call_arg(i), names, seen, scope, mode);
-      }
-      return;
-    }
-    case parser::NodeKind::UnaryOp:
-      CollectNamesScoped(node.as_unary_operand(), names, seen, scope, mode);
-      return;
-    case parser::NodeKind::BinaryOp:
-      CollectNamesScoped(node.as_binary_lhs(), names, seen, scope, mode);
-      CollectNamesScoped(node.as_binary_rhs(), names, seen, scope, mode);
-      return;
-    case parser::NodeKind::RangeOp:
-      CollectNamesScoped(node.as_range_lhs(), names, seen, scope, mode);
-      CollectNamesScoped(node.as_range_rhs(), names, seen, scope, mode);
-      return;
-    case parser::NodeKind::IntersectOp:
-      CollectNamesScoped(node.as_intersect_lhs(), names, seen, scope, mode);
-      CollectNamesScoped(node.as_intersect_rhs(), names, seen, scope, mode);
-      return;
-    case parser::NodeKind::UnionOp: {
-      const std::uint32_t arity = node.as_union_arity();
-      for (std::uint32_t i = 0; i < arity; ++i) {
-        CollectNamesScoped(node.as_union_child(i), names, seen, scope, mode);
-      }
-      return;
-    }
-    case parser::NodeKind::ImplicitIntersection:
-      add(xlsb_hidden_function_name("SINGLE"));
-      CollectNamesScoped(node.as_implicit_intersection_operand(), names, seen, scope, mode);
-      return;
-    case parser::NodeKind::ArrayLiteral: {
-      const std::uint32_t rows = node.as_array_rows();
-      const std::uint32_t cols = node.as_array_cols();
-      for (std::uint32_t r = 0; r < rows; ++r) {
-        for (std::uint32_t c = 0; c < cols; ++c) {
-          CollectNamesScoped(node.as_array_element(r, c), names, seen, scope, mode);
-        }
-      }
-      return;
-    }
-    case parser::NodeKind::SpillRef: {
-      // Stored as a call to the hidden `_xlfn.ANCHORARRAY` name (see
-      // `Encoder::emit_spill_ref`), so it needs the same BrtName
-      // registration any other future-function callee gets.
-      add(xlsb_hidden_function_name("ANCHORARRAY"));
-      if (const parser::AstNode* anchor = node.as_spill_ref_anchor_expr(); anchor != nullptr) {
-        CollectNamesScoped(*anchor, names, seen, scope, mode);
-      }
-      return;
-    }
-    case parser::NodeKind::ExternalRef:
-      // `[0]!Rate` is never a LET / LAMBDA parameter and, like `Sheet2!Rate`,
-      // not resolved from the formula's own scope.
-      if (parser::is_self_book_name_ref(node) && mode == NameCollectMode::kPtg) {
-        AddName(node.as_external_ref_name(), names, seen);
-      }
-      return;
-    case parser::NodeKind::LambdaCall: {
-      CollectNamesScoped(node.as_lambda_call_callee(), names, seen, scope, mode);
-      const std::uint32_t arity = node.as_lambda_call_arity();
-      for (std::uint32_t i = 0; i < arity; ++i) {
-        CollectNamesScoped(node.as_lambda_call_arg(i), names, seen, scope, mode);
-      }
-      return;
-    }
-    case parser::NodeKind::LetBinding: {
-      add("_xlfn.LET");
-      const std::uint32_t n = node.as_let_binding_count();
-      const std::size_t scope_base = scope.size();
-      for (std::uint32_t i = 0; i < n; ++i) {
-        add(std::string("_xlpm.") + std::string(node.as_let_binding_name(i)));
-        // Excel LET binds sequentially: a value expression sees only the
-        // earlier bindings, so collect it before pushing this parameter.
-        CollectNamesScoped(node.as_let_binding_expr(i), names, seen, scope, mode);
-        scope.push_back(node.as_let_binding_name(i));
-      }
-      CollectNamesScoped(node.as_let_body(), names, seen, scope, mode);
-      scope.resize(scope_base);
-      return;
-    }
-    case parser::NodeKind::Lambda: {
-      add("_xlfn.LAMBDA");
-      const std::uint32_t n = node.as_lambda_param_count();
-      const std::size_t scope_base = scope.size();
-      for (std::uint32_t i = 0; i < n; ++i) {
-        add(std::string("_xlpm.") + std::string(node.as_lambda_param(i)));
-        scope.push_back(node.as_lambda_param(i));
-      }
-      CollectNamesScoped(node.as_lambda_body(), names, seen, scope, mode);
-      scope.resize(scope_base);
-      return;
-    }
-    // Leaves, and forms the encoder does not lower (StructuredRef): nothing
-    // to collect. A future writer bundle that lowers these would extend
-    // this switch alongside the corresponding `emit_*` case.
-    default:
-      return;
-  }
-}
-
 }  // namespace
 
-std::string sheet_scoped_name_key(std::int32_t itab, std::string_view name) {
-  std::string key = std::to_string(itab);
-  key.push_back('!');
-  key.append(strings::to_ascii_lower(name));
-  return key;
-}
-
-void collect_ptg_names(const parser::AstNode& node, std::vector<std::string>& names,
-                       std::unordered_set<std::string>& seen) {
-  std::vector<std::string_view> scope;
-  CollectNamesScoped(node, names, seen, scope, NameCollectMode::kPtg);
-}
-
-void collect_scope_resolved_names(const parser::AstNode& node, std::vector<std::string>& names,
-                                  std::unordered_set<std::string>& seen) {
-  std::vector<std::string_view> scope;
-  CollectNamesScoped(node, names, seen, scope, NameCollectMode::kScopeResolved);
-}
-
-void collect_sheet_qualified_names(const parser::AstNode& node,
-                                   std::vector<std::pair<std::string, std::string>>& qualified) {
-  std::vector<std::string> keys;
-  std::unordered_set<std::string> seen;
-  std::vector<std::string_view> scope;
-  CollectNamesScoped(node, keys, seen, scope, NameCollectMode::kSheetQualified);
-  for (const std::string& key : keys) {
-    const std::size_t split = key.find('\0');
-    qualified.emplace_back(key.substr(0, split), key.substr(split + 1));
-  }
-}
-
-void collect_ptg_sheet_ranges(const parser::AstNode& node, const std::vector<std::string>& sheet_names,
-                              SheetRangeTable& ranges, std::unordered_set<std::uint64_t>& seen) {
-  switch (node.kind()) {
-    case parser::NodeKind::Ref: {
-      const parser::Reference& r = node.as_ref();
-      if (!r.sheet.empty()) {
-        const int itab = resolve_ixti(sheet_names, r.sheet);
-        AddSheetRange(itab, itab, ranges, seen);
-      }
-      return;
-    }
-    case parser::NodeKind::Ref3D: {
-      const int itab_begin = resolve_ixti(sheet_names, node.as_ref3d_sheet_begin());
-      const int itab_end = resolve_ixti(sheet_names, node.as_ref3d_sheet_end());
-      AddSheetRange(itab_begin, itab_end, ranges, seen);
-      return;
-    }
-    case parser::NodeKind::NameRef:
-    case parser::NodeKind::ExternalRef: {
-      // `Sheet1!Rate` and `[0]!Rate` encode as `PtgNameX` through the
-      // book-scope entry.
-      const bool name_x = node.kind() == parser::NodeKind::NameRef ? !node.as_name_sheet().empty()
-                                                                   : parser::is_self_book_name_ref(node);
-      if (name_x && seen.insert(PackRangeKey(kXtiNoSheet, kXtiNoSheet)).second) {
-        ranges.emplace_back(kXtiNoSheet, kXtiNoSheet);
-      }
-      return;
-    }
-    case parser::NodeKind::LambdaCall: {
-      collect_ptg_sheet_ranges(node.as_lambda_call_callee(), sheet_names, ranges, seen);
-      const std::uint32_t arity = node.as_lambda_call_arity();
-      for (std::uint32_t i = 0; i < arity; ++i) {
-        collect_ptg_sheet_ranges(node.as_lambda_call_arg(i), sheet_names, ranges, seen);
-      }
-      return;
-    }
-    case parser::NodeKind::Call: {
-      const std::uint32_t arity = node.as_call_arity();
-      for (std::uint32_t i = 0; i < arity; ++i) {
-        collect_ptg_sheet_ranges(node.as_call_arg(i), sheet_names, ranges, seen);
-      }
-      return;
-    }
-    case parser::NodeKind::UnaryOp:
-      collect_ptg_sheet_ranges(node.as_unary_operand(), sheet_names, ranges, seen);
-      return;
-    case parser::NodeKind::BinaryOp:
-      collect_ptg_sheet_ranges(node.as_binary_lhs(), sheet_names, ranges, seen);
-      collect_ptg_sheet_ranges(node.as_binary_rhs(), sheet_names, ranges, seen);
-      return;
-    case parser::NodeKind::RangeOp:
-      collect_ptg_sheet_ranges(node.as_range_lhs(), sheet_names, ranges, seen);
-      collect_ptg_sheet_ranges(node.as_range_rhs(), sheet_names, ranges, seen);
-      return;
-    case parser::NodeKind::IntersectOp:
-      collect_ptg_sheet_ranges(node.as_intersect_lhs(), sheet_names, ranges, seen);
-      collect_ptg_sheet_ranges(node.as_intersect_rhs(), sheet_names, ranges, seen);
-      return;
-    case parser::NodeKind::UnionOp: {
-      const std::uint32_t arity = node.as_union_arity();
-      for (std::uint32_t i = 0; i < arity; ++i) {
-        collect_ptg_sheet_ranges(node.as_union_child(i), sheet_names, ranges, seen);
-      }
-      return;
-    }
-    case parser::NodeKind::ImplicitIntersection:
-      collect_ptg_sheet_ranges(node.as_implicit_intersection_operand(), sheet_names, ranges, seen);
-      return;
-    case parser::NodeKind::ArrayLiteral: {
-      const std::uint32_t rows = node.as_array_rows();
-      const std::uint32_t cols = node.as_array_cols();
-      for (std::uint32_t r = 0; r < rows; ++r) {
-        for (std::uint32_t c = 0; c < cols; ++c) {
-          collect_ptg_sheet_ranges(node.as_array_element(r, c), sheet_names, ranges, seen);
-        }
-      }
-      return;
-    }
-    case parser::NodeKind::LetBinding: {
-      const std::uint32_t n = node.as_let_binding_count();
-      for (std::uint32_t i = 0; i < n; ++i) {
-        collect_ptg_sheet_ranges(node.as_let_binding_expr(i), sheet_names, ranges, seen);
-      }
-      collect_ptg_sheet_ranges(node.as_let_body(), sheet_names, ranges, seen);
-      return;
-    }
-    case parser::NodeKind::Lambda:
-      collect_ptg_sheet_ranges(node.as_lambda_body(), sheet_names, ranges, seen);
-      return;
-    default:
-      return;
-  }
-}
-
 bool formula_is_dynamic_array(const parser::AstNode& root, const NameShapes& names) {
   Shapes shapes(names);
   return MarksDynamic(shapes, root, Slot{}, /*root=*/true);
diff --git a/src/io/xlsb/reader.cpp b/src/io/xlsb/reader.cpp
index c018e5000..5618d7047 100644
--- a/src/io/xlsb/reader.cpp
+++ b/src/io/xlsb/reader.cpp
@@ -16,11 +16,9 @@
 #include "io/xlsb/reader.h"
 
 #include <algorithm>
-#include <cctype>
 #include <cstddef>
 #include <cstdint>
 #include <deque>
-#include <limits>
 #include <string>
 #include <string_view>
 #include <unordered_map>
@@ -44,10 +42,9 @@
 #include "io/xlsb/sheet_reader.h"
 #include "io/xlsb/sst_reader.h"
 #include "io/xlsb/styles_reader.h"
+#include "io/xlsb/workbook_bin_reader.h"
 #include "io/zip_reader.h"
 #include "parser/ast.h"
-#include "parser/ast_format.h"
-#include "parser/formula_prefix.h"
 #include "passthrough_part.h"
 #include "phonetic.h"
 #include "pivot/pivot_cache.h"
@@ -56,7 +53,6 @@
 #include "pugixml.hpp"
 #include "sheet.h"
 #include "unknown_relationship.h"
-#include "utils/arena.h"
 #include "utils/error.h"
 #include "utils/expected.h"
 #include "utils/resource_budget.h"
@@ -75,28 +71,6 @@ namespace {
 // content types target binary parts (`*.bin`) instead of XML.
 // ---------------------------------------------------------------------------
 
-constexpr std::string_view kRelOfficeDocument =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument";
-constexpr std::string_view kRelCoreProperties =
-    "http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties";
-constexpr std::string_view kRelExtendedProperties =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties";
-constexpr std::string_view kRelCustomProperties =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties";
-constexpr std::string_view kRelWorksheet =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet";
-constexpr std::string_view kRelSharedStrings =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings";
-constexpr std::string_view kRelStyles = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles";
-constexpr std::string_view kRelHyperlink =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink";
-constexpr std::string_view kRelPivotTable =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotTable";
-constexpr std::string_view kRelPivotCacheDefinition =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheDefinition";
-constexpr std::string_view kRelPivotCacheRecords =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheRecords";
-
 // `[Content_Types].xml` registers the workbook part under the binary
 // content type for `.xlsb`. The reader gates on this content type to
 // avoid acting on a `.xlsx` archive that happened to be passed in.
@@ -355,535 +329,6 @@ Expected<WorkbookRels, Error> LoadWorkbookRels(const ZipReader& zip, std::string
 // Binary part decoders.
 // ---------------------------------------------------------------------------
 
-/// One decoded entry of the workbook's sheet bundle.
-///
-///   * `name`  — display name of the sheet.
-///   * `rid`   — workbook-rels relationship id pointing at the sheet
-///               binary part.
-struct SheetBundleEntry {
-  std::string name;
-  std::string rid;
-  /// The sheet's `hsState`, which shares its numbering with
-  /// `SheetVisibility` and so is carried across whole. Very-hidden stays
-  /// distinct from hidden: it is the state that keeps a sheet out of
-  /// Excel's "Unhide" dialog.
-  SheetVisibility visibility = SheetVisibility::kVisible;
-};
-
-/// Workbook-global fields needed while constructing the model.
-struct WorkbookBinInfo {
-  std::vector<SheetBundleEntry> sheets;
-  bool date1904 = false;
-  /// `<workbookProtection>` rebuilt from BrtBookProtection(Iso); empty
-  /// when the book is unprotected or the records were not decodable.
-  std::string protection_xml;
-};
-
-/// Decodes `xl/workbook.bin` to extract the ordered sheet-bundle list and
-/// workbook date system and protection. Other records are skipped.
-Expected<WorkbookBinInfo, Error> DecodeWorkbookBin(const std::vector<std::uint8_t>& body) {
-  WorkbookBinInfo info;
-  ByteSpan protection_iso{};
-  ByteSpan cursor{body.data(), body.size()};
-  while (cursor.size > 0) {
-    auto rec_or = read_record(cursor);
-    if (!rec_or) {
-      return rec_or.error();
-    }
-    const XlsbRecord& rec = rec_or.value();
-    if (rec.type == static_cast<std::uint16_t>(XlsbRecordType::BrtWbProp)) {
-      // BrtWbProp ([MS-XLSB] §2.4.866) begins with a u32 grbit; bit 0
-      // is f1904. The following theme-version and optional code-name
-      // fields are irrelevant to the workbook model.
-      ByteSpan p = rec.payload;
-      auto flags_or = read_u32(p);
-      if (!flags_or) {
-        return flags_or.error();
-      }
-      info.date1904 = (flags_or.value() & 0x00000001U) != 0U;
-      continue;
-    }
-    if (rec.type == kBrtBookProtectionIso) {
-      protection_iso = rec.payload;
-      continue;
-    }
-    if (rec.type == kBrtBookProtection) {
-      if (!decode_book_protection(rec.payload, protection_iso, info.protection_xml)) {
-        info.protection_xml.clear();
-        StructuredLog("xlsb.book_protection.not_decoded").warn();
-      }
-      continue;
-    }
-    if (rec.type != static_cast<std::uint16_t>(XlsbRecordType::BrtBundleSh)) {
-      continue;
-    }
-    // BrtBundleSh ([MS-XLSB] §2.4.304):
-    //   hsState    : u32 (visibility)
-    //   iTabID     : u32
-    //   strRelID   : XLNullableWideString
-    //   strName    : XLWideString
-    ByteSpan p = rec.payload;
-    // hsState: 0 = visible, 1 = hidden, 2 = very hidden.
-    auto hs_state_or = read_u32(p);
-    if (!hs_state_or) {
-      return hs_state_or.error();
-    }
-    auto skip2 = read_u32(p);  // iTabID
-    if (!skip2) {
-      return skip2.error();
-    }
-    auto rid_or = read_xlnullablewidestring(p);
-    if (!rid_or) {
-      return rid_or.error();
-    }
-    auto name_or = read_xlwidestring(p);
-    if (!name_or) {
-      return name_or.error();
-    }
-    SheetBundleEntry entry;
-    entry.rid = std::move(rid_or.value());
-    entry.name = std::move(name_or.value());
-    // An hsState outside the three defined values is not a visibility this
-    // model can name; treat anything non-zero it cannot place as plain
-    // hidden, which is the conservative direction (the sheet stays out of
-    // sight rather than appearing unbidden).
-    switch (hs_state_or.value()) {
-      case 0U:
-        entry.visibility = SheetVisibility::kVisible;
-        break;
-      case 2U:
-        entry.visibility = SheetVisibility::kVeryHidden;
-        break;
-      default:
-        entry.visibility = SheetVisibility::kHidden;
-        break;
-    }
-    info.sheets.push_back(std::move(entry));
-  }
-  if (info.sheets.empty()) {
-    return make_error(FormulonErrorCode::kIoXlsbCorrupt, "workbook.bin: no BrtBundleSh records",
-                      "context=xlsb_reader part=xl/workbook.bin");
-  }
-  return info;
-}
-
-/// Decodes a UTF-16LE name of `units` code units starting at `cursor`,
-/// advancing it past the name. `units` is caller-known (from a fixed-size
-/// header field), unlike `read_xlwidestring`'s self-describing length. This
-/// path intentionally avoids Expected<std::string, Error>: malformed
-/// workbook names are common fuzz inputs, and libc++'s variant dispatch
-/// under UBSan must not turn recoverable input errors into a process abort.
-bool ReadFixedWideString(ByteSpan& cursor, std::uint32_t units, std::string& out) {
-  // Check in the destination width before multiplying. On wasm32, a hostile
-  // u32 `units` value can wrap `units * 2` back below cursor.size otherwise.
-  if (units > cursor.size / 2U) {
-    return false;
-  }
-  const std::size_t byte_len = static_cast<std::size_t>(units) * 2U;
-  out.clear();
-  out.reserve(byte_len);
-  for (std::uint32_t i = 0; i < units; ++i) {
-    const std::size_t offset = static_cast<std::size_t>(i) * 2U;
-    const std::uint16_t cu = static_cast<std::uint16_t>(static_cast<std::uint16_t>(cursor.data[offset]) |
-                                                        (static_cast<std::uint16_t>(cursor.data[offset + 1U]) << 8));
-    std::uint32_t cp = cu;
-    if (cu >= 0xD800U && cu <= 0xDBFFU && i + 1 < units) {
-      const std::size_t low_offset = static_cast<std::size_t>(i + 1U) * 2U;
-      const std::uint16_t low =
-          static_cast<std::uint16_t>(static_cast<std::uint16_t>(cursor.data[low_offset]) |
-                                     (static_cast<std::uint16_t>(cursor.data[low_offset + 1U]) << 8));
-      if (low >= 0xDC00U && low <= 0xDFFFU) {
-        cp = 0x10000U + ((static_cast<std::uint32_t>(cu) - 0xD800U) << 10) + (low - 0xDC00U);
-        ++i;
-      }
-    }
-    if (cp < 0x80U) {
-      out.push_back(static_cast<char>(cp));
-    } else if (cp < 0x800U) {
-      out.push_back(static_cast<char>(0xC0U | (cp >> 6)));
-      out.push_back(static_cast<char>(0x80U | (cp & 0x3FU)));
-    } else if (cp < 0x10000U) {
-      out.push_back(static_cast<char>(0xE0U | (cp >> 12)));
-      out.push_back(static_cast<char>(0x80U | ((cp >> 6) & 0x3FU)));
-      out.push_back(static_cast<char>(0x80U | (cp & 0x3FU)));
-    } else {
-      out.push_back(static_cast<char>(0xF0U | (cp >> 18)));
-      out.push_back(static_cast<char>(0x80U | ((cp >> 12) & 0x3FU)));
-      out.push_back(static_cast<char>(0x80U | ((cp >> 6) & 0x3FU)));
-      out.push_back(static_cast<char>(0x80U | (cp & 0x3FU)));
-    }
-  }
-  cursor.data += byte_len;
-  cursor.size -= byte_len;
-  return true;
-}
-
-/// True when `name` carries one of Excel's hidden storage prefixes, i.e.
-/// the record is a `_xlfn.<FN>` future-function or `_xlpm.<param>`
-/// LET / LAMBDA-parameter placeholder rather than a user-visible defined
-/// name. Matched case-insensitively, the same way `ptg_reader.cpp`
-/// resolves these names during Ptg decode.
-///
-/// This is deliberately NOT the `fHidden` bit: Excel sets `fHidden` on
-/// the placeholders, but it also sets it on an ordinary defined name the
-/// user chose to hide from the Name Manager, and both this reader's
-/// writer counterpart and Excel itself store the two the same way.
-bool IsStoragePlaceholderName(std::string_view name) {
-  constexpr std::string_view kPrefixes[] = {"_xlfn.", "_xlpm."};
-  for (const std::string_view prefix : kPrefixes) {
-    if (name.size() < prefix.size()) {
-      continue;
-    }
-    bool match = true;
-    for (std::size_t i = 0; i < prefix.size(); ++i) {
-      const char lhs = static_cast<char>(std::tolower(static_cast<unsigned char>(name[i])));
-      if (lhs != prefix[i]) {
-        match = false;
-        break;
-      }
-    }
-    if (match) {
-      return true;
-    }
-  }
-  return false;
-}
-
-/// Decodes the workbook-scope `BrtName` table from `xl/workbook.bin`:
-/// ordinary defined names and the hidden `_xlfn.*` / `_xlpm.*`
-/// future-function / LET-parameter placeholders `PtgName` resolves by
-/// 1-based declaration order. Byte layout verified against a real
-/// Excel-365-produced `xl/workbook.bin`:
-///   flags (u16) + 3 reserved bytes + itab (i32) + cch (u32) +
-///   cch x UTF-16LE code units + <formula body, not consumed here>.
-/// Records other than `BrtName` are skipped.
-Expected<std::vector<XlsbName>, Error> DecodeWorkbookNames(const std::vector<std::uint8_t>& body) {
-  std::vector<XlsbName> names;
-  ByteSpan cursor{body.data(), body.size()};
-  while (cursor.size > 0) {
-    auto rec_or = read_record(cursor);
-    if (!rec_or) {
-      return rec_or.error();
-    }
-    const XlsbRecord& rec = rec_or.value();
-    if (rec.type != static_cast<std::uint16_t>(XlsbRecordType::BrtName)) {
-      continue;
-    }
-    ByteSpan p = rec.payload;
-    if (p.size < 5) {
-      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated, "workbook.bin: BrtName header truncated",
-                        "context=xlsb_reader");
-    }
-    auto flags_or = read_u16(p);
-    if (!flags_or) {
-      return flags_or.error();
-    }
-    p.data += 3;  // 3 reserved bytes between flags and itab.
-    p.size -= 3;
-    auto itab_or = read_u32(p);
-    if (!itab_or) {
-      return itab_or.error();
-    }
-    auto cch_or = read_u32(p);
-    if (!cch_or) {
-      return cch_or.error();
-    }
-    std::string name;
-    if (!ReadFixedWideString(p, cch_or.value(), name)) {
-      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated, "xlsb fixed-length wide string truncated",
-                        "context=xlsb_reader");
-    }
-    XlsbName entry;
-    entry.itab = static_cast<std::int32_t>(itab_or.value());
-    entry.name = std::move(name);
-    entry.hidden = (flags_or.value() & 0x0001U) != 0;
-    names.push_back(std::move(entry));
-  }
-  return names;
-}
-
-/// Decodes the supporting-book list from `xl/workbook.bin` into one
-/// entry per book, in `BrtExternSheet`'s `iSupBook` order. The value is
-/// `0` for this workbook and `N >= 1` for the N-th external book in
-/// package order, which is the number the equivalent xlsx formula text
-/// spells as `[N]`.
-///
-/// Layout verified against Excel-365-produced `xl/workbook.bin` files:
-/// the books are the records between `BrtBeginExternals` and
-/// `BrtEndExternals`, one record each, and the record id alone says
-/// which kind it is. Only `BrtSupSelf` is this workbook; `BrtSupAddin`
-/// and `BrtSupSame` are counted so later entries keep their index, but
-/// neither names a resolvable external package, so both are reported as
-/// external and therefore refused downstream.
-///
-/// A workbook can legitimately have no self entry: one whose only
-/// qualified references are cross-workbook carries a single
-/// `BrtSupBookSrc`, so `iSupBook == 0` is then an external book. That
-/// case is why this list has to be read rather than assumed.
-///
-/// A `BrtSupBookSrc` also names the relationship its external link part
-/// hangs off, which is how a `[N]` is turned back into a package part.
-/// That id is retained on the entry; the other kinds leave it empty.
-struct XlsbSupBook {
-  std::uint32_t external_book = 0;
-  std::string rel_id;
-};
-
-std::vector<XlsbSupBook> DecodeSupBooks(const std::vector<std::uint8_t>& body) {
-  std::vector<XlsbSupBook> books;
-  ByteSpan cursor{body.data(), body.size()};
-  bool inside = false;
-  std::uint32_t next_external = 1;
-  while (cursor.size > 0) {
-    auto rec_or = read_record(cursor);
-    if (!rec_or) {
-      break;
-    }
-    const XlsbRecord& rec = rec_or.value();
-    const auto type = static_cast<XlsbRecordType>(rec.type);
-    if (type == XlsbRecordType::BrtBeginExternals) {
-      inside = true;
-      continue;
-    }
-    if (type == XlsbRecordType::BrtEndExternals) {
-      break;
-    }
-    if (!inside) {
-      continue;
-    }
-    switch (type) {
-      case XlsbRecordType::BrtSupSelf:
-        books.push_back(XlsbSupBook{});
-        break;
-      case XlsbRecordType::BrtSupBookSrc: {
-        ByteSpan payload = rec.payload;
-        auto rid_or = read_xlwidestring(payload);
-        books.push_back(XlsbSupBook{next_external, rid_or ? std::move(rid_or.value()) : std::string()});
-        ++next_external;
-        break;
-      }
-      case XlsbRecordType::BrtSupAddin:
-      case XlsbRecordType::BrtSupSame:
-        books.push_back(XlsbSupBook{next_external, std::string()});
-        ++next_external;
-        break;
-      default:
-        // `BrtSupTabs` and the future-record framing that decorates a
-        // book entry sit inside the same block without adding a book.
-        break;
-    }
-  }
-  return books;
-}
-
-/// Decodes the `BrtExternSheet` table from `xl/workbook.bin`: resolves a
-/// `PtgRef3d` / `PtgArea3d` `ixti` (0-based index into the returned
-/// vector) to a `(itabFirst, itabLast)` sheet-index range. Byte layout
-/// verified against a real Excel-365-produced `xl/workbook.bin`: u32
-/// count, followed by `count` entries of `(iSupBook, itabFirst,
-/// itabLast)` as 3 x i32 each. `iSupBook` is resolved through
-/// `DecodeSupBooks` so `decode_ptgs` can tell an internal range from an
-/// external-workbook one, whose sheet indices index the supporting book
-/// rather than this workbook's `sheet_names`.
-/// A workbook with no qualified references at all carries no
-/// `BrtExternSheet` record, so an empty result is a normal outcome, not
-/// an error.
-Expected<std::vector<XlsbSheetRange>, Error> DecodeExternSheet(const std::vector<std::uint8_t>& body,
-                                                               const std::vector<XlsbSupBook>& books) {
-  std::vector<XlsbSheetRange> ranges;
-  ByteSpan cursor{body.data(), body.size()};
-  while (cursor.size > 0) {
-    auto rec_or = read_record(cursor);
-    if (!rec_or) {
-      return rec_or.error();
-    }
-    const XlsbRecord& rec = rec_or.value();
-    if (rec.type != static_cast<std::uint16_t>(XlsbRecordType::BrtExternSheet)) {
-      continue;
-    }
-    ByteSpan p = rec.payload;
-    auto count_or = read_u32(p);
-    if (!count_or) {
-      return count_or.error();
-    }
-    // Each entry consumes three u32s. Never reserve beyond what the
-    // remaining payload can actually hold, so an attacker-controlled
-    // count (up to 4 billion) cannot force a multi-GB reservation before
-    // the per-entry reads run out of bytes and fail.
-    constexpr std::size_t kExternSheetEntryBytes = 12U;
-    const std::size_t reservable =
-        static_cast<std::size_t>(std::min<std::uint64_t>(count_or.value(), p.size / kExternSheetEntryBytes));
-    ranges.reserve(reservable);
-    for (std::uint32_t i = 0; i < count_or.value(); ++i) {
-      auto sup_book_or = read_u32(p);
-      if (!sup_book_or) {
-        return sup_book_or.error();
-      }
-      auto first_or = read_u32(p);
-      if (!first_or) {
-        return first_or.error();
-      }
-      auto last_or = read_u32(p);
-      if (!last_or) {
-        return last_or.error();
-      }
-      // An `iSupBook` past the end of the list cannot be resolved. Treat
-      // it as external: that refuses the reference, where assuming
-      // "internal" would bind it to a local sheet by index.
-      //
-      // An *entirely* absent list is a different situation: the file
-      // carries qualified references but no supporting-book block to
-      // resolve them against, which no Excel-written file observed here
-      // does. Refusing every reference would regress such a file from
-      // working to undecodable, so it keeps the weaker rule that index
-      // 0 is this workbook.
-      const std::uint32_t sup_book = sup_book_or.value();
-      std::uint32_t external_book = std::numeric_limits<std::uint32_t>::max();
-      if (books.empty()) {
-        external_book = sup_book == 0U ? 0U : sup_book;
-      } else if (sup_book < books.size()) {
-        external_book = books[sup_book].external_book;
-      }
-      ranges.push_back(XlsbSheetRange{static_cast<std::int32_t>(first_or.value()),
-                                      static_cast<std::int32_t>(last_or.value()), external_book});
-    }
-    break;  // Exactly one BrtExternSheet record per workbook.
-  }
-  return ranges;
-}
-
-/// Registers every user-visible `BrtName` entry as a workbook defined
-/// name via a single bulk `Workbook::set_defined_names` call (mirroring
-/// the OOXML reader's `ooxml_reader.cpp` pattern -- a load-time
-/// population pass, not the incremental single-name edit API
-/// `set_defined_name_scoped` guards with dedup/dep-graph-rebuild logic
-/// that only matters for post-load mutation). Only the storage
-/// placeholders (the `_xlfn.*` / `_xlpm.*` future-function and
-/// LET/LAMBDA-parameter names `PtgName` resolves during Ptg decode — see
-/// `name_table`) are skipped; they are not user-visible names and never
-/// carry a Name Manager comment. A name Excel merely hides from the Name
-/// Manager keeps its `fHidden` bit on the produced `DefinedName` and
-/// is registered like any other. Walks `xl/workbook.bin`'s `BrtName`
-/// records a second time (after `DecodeWorkbookNames` has already built
-/// the complete `name_table`), decoding each entry's own formula body so
-/// a qualified or name-referencing formula (e.g. `Rate` defined as a
-/// cell reference) resolves against the full table rather than a
-/// partially-built one. A name whose formula uses a Ptg token outside
-/// the supported set logs a structured warning and is skipped rather
-/// than failing the whole read — the OOXML reader's `DecodeFormulaText`
-/// contract mirrored at the workbook-name level.
-Expected<void, Error> RegisterDefinedNames(const std::vector<std::uint8_t>& body,
-                                           const std::vector<XlsbName>& name_table,
-                                           const std::vector<std::string>& sheet_names,
-                                           const std::vector<XlsbSheetRange>& sheet_ranges,
-                                           const XlsbExternalBooks& external_books, Workbook& wb,
-                                           std::uint32_t* undecoded_defined_name_count) {
-  ByteSpan cursor{body.data(), body.size()};
-  std::size_t name_index = 0;
-  std::vector<DefinedName> out;
-  while (cursor.size > 0) {
-    auto rec_or = read_record(cursor);
-    if (!rec_or) {
-      return rec_or.error();
-    }
-    const XlsbRecord& rec = rec_or.value();
-    if (rec.type != static_cast<std::uint16_t>(XlsbRecordType::BrtName)) {
-      continue;
-    }
-    if (name_index >= name_table.size()) {
-      break;  // Defensive: should be unreachable (same records, same order).
-    }
-    const XlsbName& entry = name_table[name_index];
-    ++name_index;
-    if (IsStoragePlaceholderName(entry.name)) {
-      continue;
-    }
-    ByteSpan p = rec.payload;
-    if (p.size < 9) {
-      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated,
-                        "workbook.bin: BrtName header truncated (defined-name pass)", "context=xlsb_reader");
-    }
-    p.data += 9;  // flags (2) + 3 reserved bytes + itab (4).
-    p.size -= 9;
-    auto cch_or = read_u32(p);
-    if (!cch_or) {
-      return cch_or.error();
-    }
-    const std::size_t name_bytes = static_cast<std::size_t>(cch_or.value()) * 2;
-    if (name_bytes > p.size) {
-      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated,
-                        "workbook.bin: BrtName name truncated (defined-name pass)", "context=xlsb_reader");
-    }
-    p.data += name_bytes;
-    p.size -= name_bytes;
-    auto cce_or = read_u32(p);
-    if (!cce_or) {
-      return cce_or.error();
-    }
-    const std::uint32_t cce = cce_or.value();
-    if (cce > p.size) {
-      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated,
-                        "workbook.bin: BrtName formula rgce length exceeds payload", "context=xlsb_reader");
-    }
-    if (cce == 0) {
-      continue;
-    }
-    ByteSpan rgce{p.data, cce};
-    p.data += cce;
-    p.size -= cce;
-    // `cb` + `rgcb` ([MS-XLSB] §2.4.649's `CellParsedFormula`): the
-    // array-constant / mem-area extra data for this formula's own Ptg
-    // tokens. Must be skipped correctly (not just assumed absent) to
-    // land on the trailing comment string below.
-    auto cb_or = read_u32(p);
-    if (!cb_or) {
-      return cb_or.error();
-    }
-    const std::uint32_t cb = cb_or.value();
-    if (cb > p.size) {
-      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated,
-                        "workbook.bin: BrtName formula rgcb length exceeds payload", "context=xlsb_reader");
-    }
-    ByteSpan rgcb{p.data, cb};
-    p.data += cb;
-    p.size -= cb;
-    Arena arena(/*initial_chunk_bytes=*/4096, kMaxLoadArenaBytes);
-    auto ast_or = decode_ptgs(rgce, rgcb, arena, sheet_names, name_table, sheet_ranges, external_books);
-    if (!ast_or) {
-      StructuredLog("xlsb.defined_name.not_decoded")
-          .field("name", entry.name)
-          .field("reason", ast_or.error().message)
-          .warn();
-      if (undecoded_defined_name_count != nullptr) {
-        ++*undecoded_defined_name_count;
-      }
-      continue;
-    }
-    // Trailing BrtName strings: a plain name carries exactly one, the
-    // optional Name Manager comment, as a null `XLNullableWideString`
-    // when unset (`read_xlnullablewidestring` maps that to an empty
-    // string). This mirrors the writer's `EmitName`.
-    auto comment_or = read_xlnullablewidestring(p);
-    if (!comment_or) {
-      return comment_or.error();
-    }
-    // Defined-name formulas store the bare expression text (no leading
-    // `=`), matching the OOXML `<definedName>` element's text content.
-    DefinedName dn;
-    dn.name = entry.name;
-    // The decoder names a hidden-name callee with its storage prefix; the
-    // text reads back in formula-bar spelling, like a cell's.
-    dn.formula = parser::spell_storage_operators(
-        parser::strip_storage_prefixes(parser::format_formula(*ast_or.value()), &has_storage_prefix));
-    dn.local_sheet_id = entry.itab;
-    dn.hidden = entry.hidden;
-    dn.comment = std::move(comment_or.value());
-    out.push_back(std::move(dn));
-  }
-  wb.set_defined_names(std::move(out));
-  return Expected<void, Error>::Ok();
-}
-
 /// Reads every entry of a worksheet's `.rels` part, keeping the original
 /// relationship ids so the retained tail records still resolve. Internal
 /// targets are normalised to package-relative paths (matching what the OOXML
@@ -921,22 +366,20 @@ Expected<std::vector<UnknownRelationship>, Error> LoadSheetRelationships(const Z
 }
 
 /// Returns the package-relative target of the first internal relationship
-/// of `type` declared by `part_path`, or an empty string when the part has
-/// no rels file or no such relationship.
-Expected<std::string, Error> FindRelationshipTarget(const ZipReader& zip, std::string_view part_path,
-                                                    std::string_view type) {
+/// declared by `part_path` whose `attr` attribute equals `value`, or an
+/// empty string when the part has no rels file or no such relationship.
+/// `label` names the rels file in error messages.
+Expected<std::string, Error> FindRelationship(const ZipReader& zip, std::string_view part_path, const char* attr,
+                                              std::string_view value, std::string_view label) {
   const std::string rels_path = ooxml::rels_path_for_part(part_path);
-  if (!zip.has_entry(rels_path)) {
+  if (value.empty() || !zip.has_entry(rels_path)) {
     return std::string();
   }
   const std::string dir = ooxml::dir_of(part_path);
   std::string found;
   auto status = ooxml::visit_relationship_nodes(
-      zip, rels_path, "pivot rels", "xlsb_reader", [&](const pugi::xml_node& rel) -> Expected<void, Error> {
-        if (!found.empty()) {
-          return Expected<void, Error>::Ok();
-        }
-        if (std::string_view(rel.attribute("Type").value()) != type) {
+      zip, rels_path, label, "xlsb_reader", [&](const pugi::xml_node& rel) -> Expected<void, Error> {
+        if (!found.empty() || std::string_view(rel.attribute(attr).value()) != value) {
           return Expected<void, Error>::Ok();
         }
         if (std::string_view(rel.attribute("TargetMode").value()) == "External") {
@@ -1000,7 +443,7 @@ struct RetainedPartOrigins {
 std::optional<std::uint32_t> LoadPivotCacheFor(const ZipReader& zip, Workbook& wb, std::string_view pivot_table_path,
                                                std::unordered_map<std::string, std::uint32_t>& loaded,
                                                RetainedPartOrigins& origins) {
-  auto def_path_or = FindRelationshipTarget(zip, pivot_table_path, kRelPivotCacheDefinition);
+  auto def_path_or = FindRelationship(zip, pivot_table_path, "Type", kRelPivotCacheDefinition, "pivot rels");
   if (!def_path_or || def_path_or.value().empty()) {
     return std::nullopt;
   }
@@ -1009,7 +452,7 @@ std::optional<std::uint32_t> LoadPivotCacheFor(const ZipReader& zip, Workbook& w
   if (seen != loaded.end()) {
     return seen->second;
   }
-  auto rec_path_or = FindRelationshipTarget(zip, def_path, kRelPivotCacheRecords);
+  auto rec_path_or = FindRelationship(zip, def_path, "Type", kRelPivotCacheRecords, "pivot rels");
   if (!rec_path_or || rec_path_or.value().empty()) {
     return std::nullopt;
   }
@@ -1042,47 +485,6 @@ std::optional<std::uint32_t> LoadPivotCacheFor(const ZipReader& zip, Workbook& w
   return cache_id;
 }
 
-/// Decodes every pivot table reachable from a sheet's relationships.
-///
-/// A pivot this reader cannot account for is skipped, not failed. Before
-/// this existed no XLSB pivot was decoded at all, so refusing one leaves
-/// that workbook loading exactly as it used to, whereas propagating the
-/// error would turn a working open into a failure. Skipping is also why
-/// the parts are left out of `consumed_parts`: the XLSB writer has no
-/// pivot output, so a decoded-but-not-consumed part still round-trips
-/// verbatim, and a skipped one is indistinguishable from before.
-/// Returns the package-relative target of the relationship `rel_id`
-/// declared by `part_path`, or an empty string when it is absent or
-/// points outside the package.
-Expected<std::string, Error> FindRelationshipById(const ZipReader& zip, std::string_view part_path,
-                                                  std::string_view rel_id) {
-  const std::string rels_path = ooxml::rels_path_for_part(part_path);
-  if (rel_id.empty() || !zip.has_entry(rels_path)) {
-    return std::string();
-  }
-  const std::string dir = ooxml::dir_of(part_path);
-  std::string found;
-  auto status = ooxml::visit_relationship_nodes(
-      zip, rels_path, "external link rels", "xlsb_reader", [&](const pugi::xml_node& rel) -> Expected<void, Error> {
-        if (!found.empty() || std::string_view(rel.attribute("Id").value()) != rel_id) {
-          return Expected<void, Error>::Ok();
-        }
-        if (std::string_view(rel.attribute("TargetMode").value()) == "External") {
-          return Expected<void, Error>::Ok();
-        }
-        auto resolved = ResolveRelativePath(dir, rel.attribute("Target").value());
-        if (!resolved) {
-          return Expected<void, Error>(resolved.error());
-        }
-        found = std::move(resolved).value();
-        return Expected<void, Error>::Ok();
-      });
-  if (!status) {
-    return status.error();
-  }
-  return found;
-}
-
 /// Reads the remote workbook URL recorded in an external link part's own
 /// rels file. Empty when the part has no rels or no external-path
 /// relationship, which is what an unresolvable link already looks like.
@@ -1125,7 +527,7 @@ void LoadExternalLinkParts(const ZipReader& zip, Workbook& wb, const std::vector
     ExternalLinkRecord record;
     record.index = sup.external_book;
     record.rel_id = sup.rel_id;
-    auto path_or = FindRelationshipById(zip, "xl/workbook.bin", sup.rel_id);
+    auto path_or = FindRelationship(zip, "xl/workbook.bin", "Id", sup.rel_id, "external link rels");
     if (path_or && !path_or.value().empty() && zip.has_entry(path_or.value())) {
       record.part_path = path_or.value();
       record.target = ReadExternalLinkTarget(zip, record.part_path);
@@ -1164,6 +566,15 @@ XlsbExternalBooks CollectExternalBookTables(const Workbook& wb) {
   return books;
 }
 
+/// Decodes every pivot table reachable from a sheet's relationships.
+///
+/// A pivot this reader cannot account for is skipped, not failed. Before
+/// this existed no XLSB pivot was decoded at all, so refusing one leaves
+/// that workbook loading exactly as it used to, whereas propagating the
+/// error would turn a working open into a failure. Skipping is also why
+/// the parts are left out of `consumed_parts`: the XLSB writer has no
+/// pivot output, so a decoded-but-not-consumed part still round-trips
+/// verbatim, and a skipped one is indistinguishable from before.
 void LoadPivotParts(const ZipReader& zip, Workbook& wb, RetainedPartOrigins& origins) {
   std::unordered_map<std::string, std::uint32_t> loaded_caches;
   for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
diff --git a/src/io/xlsb/record.cpp b/src/io/xlsb/record.cpp
index 4f6fed529..faf68e29c 100644
--- a/src/io/xlsb/record.cpp
+++ b/src/io/xlsb/record.cpp
@@ -82,6 +82,18 @@ Expected<std::uint32_t, Error> read_u32(ByteSpan& cursor) {
   return v;
 }
 
+Expected<double, Error> read_double(ByteSpan& cursor) {
+  if (cursor.size < sizeof(double)) {
+    return make_error(FormulonErrorCode::kIoXlsbRecordTruncated, "xlsb double read out of range",
+                      "context=xlsb.record");
+  }
+  double value = 0.0;
+  std::memcpy(&value, cursor.data, sizeof(value));
+  cursor.data += sizeof(double);
+  cursor.size -= sizeof(double);
+  return value;
+}
+
 Expected<std::string, Error> read_xlwidestring(ByteSpan& cursor) {
   auto len_or = read_u32(cursor);
   if (!len_or) {
diff --git a/src/io/xlsb/record.h b/src/io/xlsb/record.h
index 4aa163f62..7dd8df990 100644
--- a/src/io/xlsb/record.h
+++ b/src/io/xlsb/record.h
@@ -196,6 +196,9 @@ Expected<std::uint16_t, Error> read_u16(ByteSpan& cursor);
 /// Reads a little-endian 32-bit unsigned integer; advances `cursor`.
 Expected<std::uint32_t, Error> read_u32(ByteSpan& cursor);
 
+/// Reads a little-endian IEEE 754 64-bit double; advances `cursor`.
+Expected<double, Error> read_double(ByteSpan& cursor);
+
 /// Reads an `XLWideString` ([MS-XLSB] §2.5.166): a 32-bit length-prefix
 /// followed by `length` UCS-2 little-endian code units. The returned
 /// string is UTF-8 encoded. Lone surrogates are passed through as if
diff --git a/src/io/xlsb/sheet_reader.cpp b/src/io/xlsb/sheet_reader.cpp
index d46d4bf4c..1e101504c 100644
--- a/src/io/xlsb/sheet_reader.cpp
+++ b/src/io/xlsb/sheet_reader.cpp
@@ -3,7 +3,6 @@
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
-#include <cstdio>
 #include <cstring>
 #include <deque>
 #include <iterator>
@@ -28,6 +27,7 @@
 #include "utils/arena.h"
 #include "utils/error.h"
 #include "utils/expected.h"
+#include "utils/number_text.h"
 #include "utils/resource_budget.h"
 #include "utils/structured_log.h"
 #include "value.h"
@@ -189,15 +189,15 @@ constexpr std::uint32_t kWsPropSyncUnused = 0xFFFFFFFFU;
 /// default tab, and an explicit `auto="1"` would make the two containers
 /// disagree on an otherwise identical sheet.
 void AppendTabColor(std::string& out, const ColorSpec& spec, std::uint32_t argb) {
-  char buf[32];
+  char buf[16];
   switch (spec.kind) {
     case ColorSpec::Kind::kRgb:
-      std::snprintf(buf, sizeof(buf), "<tabColor rgb=\"%08X\"/>", argb);
-      out.append(buf);
+      format_hex(buf, sizeof(buf), argb, 8, true);
+      out.append("<tabColor rgb=\"").append(buf).append("\"/>");
       break;
     case ColorSpec::Kind::kTheme:
-      std::snprintf(buf, sizeof(buf), "<tabColor theme=\"%u\"", spec.theme);
-      out.append(buf);
+      format_unsigned(buf, sizeof(buf), spec.theme);
+      out.append("<tabColor theme=\"").append(buf).push_back('"');
       if (spec.tint != 0.0) {
         // Shortest round-trip spelling, matching the styles writer: the
         // same tint must not be spelled two ways depending on whether the
@@ -209,8 +209,8 @@ void AppendTabColor(std::string& out, const ColorSpec& spec, std::uint32_t argb)
       out.append("/>");
       break;
     case ColorSpec::Kind::kIndexed:
-      std::snprintf(buf, sizeof(buf), "<tabColor indexed=\"%u\"/>", spec.indexed);
-      out.append(buf);
+      format_unsigned(buf, sizeof(buf), spec.indexed);
+      out.append("<tabColor indexed=\"").append(buf).append("\"/>");
       break;
     case ColorSpec::Kind::kAuto:
     case ColorSpec::Kind::kNone:
@@ -592,9 +592,9 @@ Expected<bool, Error> DecodeTailFeature(ByteSpan& cursor, const std::uint8_t* fr
 /// Column + style-table index decoded by `ReadCellHeader`.
 struct CellHeaderInfo {
   std::uint32_t col = 0;
-  /// 0-based index into `StylesTable::cell_xfs`. `0` is the default xf
-  /// and is never stored on a cell (mirrors the OOXML reader's
-  /// `xf_index != 0` guard before calling `set_cell_xf_index`).
+  /// 0-based index into `StylesTable::cell_xfs`. `0` is the default xf;
+  /// value records skip storing it, blank and formula records store it as an
+  /// explicit assignment.
   std::uint32_t xf_index = 0;
 };
 
@@ -628,8 +628,7 @@ Expected<CellHeaderInfo, Error> ReadCellHeader(ByteSpan& cursor) {
 }
 
 /// Stores `xf_index` on `(sheet_index, row, col)` when it differs from
-/// the default xf (`0`), mirroring the OOXML sheet reader's
-/// `xf_index != 0` guard before calling `Workbook::set_cell_xf_index`.
+/// the default xf (`0`); a value record's default style is implicit.
 Expected<void, Error> ApplyXfIndex(Workbook& wb, std::size_t sheet_index, std::uint32_t row, std::uint32_t col,
                                    std::uint32_t xf_index) {
   if (xf_index == 0) {
@@ -643,63 +642,15 @@ Expected<void, Error> ApplyXfIndex(Workbook& wb, std::size_t sheet_index, std::u
 /// plain `BrtCellRk` / `BrtCellReal` / ... for the cached spill targets
 /// of e.g. `=SEQUENCE(3)` in F6, spilling into F7:F8) does not read back
 /// as independent literals that block the anchor's own re-spill on
-/// recalc. Mirrors the OOXML reader's `RegisterArraySpills`
-/// (`io/sheet_reader.cpp`) byte-for-byte in intent: capture the
-/// footprint's current cached values, blank the non-anchor cells, then
-/// commit the spill region. Must run only after the entire sheet has
+/// recalc. Shares `register_array_spills` with the OOXML reader. Must
+/// run only after the entire sheet has
 /// been decoded -- see the `BrtArrFmla` case's comment in
 /// `DecodeSheetBin` for why registering inline (while later rows in the
 /// footprint have not been decoded yet) does not work.
 Expected<void, Error> RegisterArraySpills(Workbook& wb, std::size_t sheet_index,
                                           const std::vector<ArrayAnchor>& anchors) {
-  // Validate and charge every footprint before the first reserve or cell
-  // walk. Keep the budget local to this decoded sheet so independent sheets
-  // cannot consume one another's dynamic-array allowance.
-  ResourceBudget budget(kMaxDynamicArrayCells, FormulonErrorCode::kIoXlsbRecordCorrupt);
-  for (const ArrayAnchor& a : anchors) {
-    auto cells_or =
-        checked_array_anchor_cells(a.row, a.col, a.last_row, a.last_col, FormulonErrorCode::kIoXlsbRecordCorrupt,
-                                   "context=xlsb_reader array_anchor");
-    if (!cells_or) {
-      return cells_or.error();
-    }
-    std::string context("context=xlsb_reader format=xlsb anchor_row=");
-    context.append(std::to_string(a.row));
-    context.append(" anchor_col=");
-    context.append(std::to_string(a.col));
-    context.append(" last_row=");
-    context.append(std::to_string(a.last_row));
-    context.append(" last_col=");
-    context.append(std::to_string(a.last_col));
-    auto charged = consume_array_anchor_budget(budget, cells_or.value(), std::move(context));
-    if (!charged) {
-      return charged.error();
-    }
-  }
-
-  for (const ArrayAnchor& a : anchors) {
-    const std::uint32_t rows = a.last_row - a.row + 1U;
-    const std::uint32_t cols = a.last_col - a.col + 1U;
-    const std::uint64_t cell_count = static_cast<std::uint64_t>(rows) * cols;
-    std::vector<Value> values;
-    values.reserve(static_cast<std::size_t>(cell_count));
-    for (std::uint32_t r = a.row; r <= a.last_row; ++r) {
-      for (std::uint32_t c = a.col; c <= a.last_col; ++c) {
-        const Cell* cell = wb.sheet(sheet_index).cell_at(r, c);
-        values.push_back(cell != nullptr ? cell->cached_value : Value::blank());
-      }
-    }
-    for (std::uint32_t r = a.row; r <= a.last_row; ++r) {
-      for (std::uint32_t c = a.col; c <= a.last_col; ++c) {
-        if (r == a.row && c == a.col) {
-          continue;
-        }
-        wb.sheet(sheet_index).set_cell_cached_value_borrowed(r, c, Value::blank());
-      }
-    }
-    wb.sheet(sheet_index).commit_spill(a.row, a.col, rows, cols, std::move(values));
-  }
-  return Expected<void, Error>::Ok();
+  return register_array_spills(wb.sheet(sheet_index), anchors, FormulonErrorCode::kIoXlsbRecordCorrupt, "xlsb_reader",
+                               "xlsb");
 }
 
 /// Classifies and decodes one worksheet record.
@@ -849,6 +800,7 @@ Expected<RecordDisposition, Error> DispatchSheetRecord(
           if (has_height) {
             layout.height = static_cast<double>(height_or.value()) / 20.0;
             layout.has_height = true;
+            layout.custom_height = true;
           }
           layout.hidden = (flags & 0x10U) != 0U;
           layout.outline_level = static_cast<std::uint8_t>(flags & 0x07U);
@@ -998,7 +950,8 @@ Expected<RecordDisposition, Error> DispatchSheetRecord(
         return col_or.error();
       }
       wb.sheet(sheet_index).set_cell_cached_value_borrowed(state.current_row, col_or.value().col, Value::blank());
-      if (auto r = ApplyXfIndex(wb, sheet_index, state.current_row, col_or.value().col, col_or.value().xf_index); !r) {
+      if (auto r = wb.set_cell_xf_index(sheet_index, state.current_row, col_or.value().col, col_or.value().xf_index);
+          !r) {
         return r.error();
       }
       ++state.cells_decoded;
@@ -1280,7 +1233,8 @@ Expected<RecordDisposition, Error> DispatchSheetRecord(
       if (!cached.is_blank()) {
         wb.sheet(sheet_index).set_cell_cached_value_borrowed(state.current_row, col_or.value().col, cached);
       }
-      if (auto r = ApplyXfIndex(wb, sheet_index, state.current_row, col_or.value().col, col_or.value().xf_index); !r) {
+      if (auto r = wb.set_cell_xf_index(sheet_index, state.current_row, col_or.value().col, col_or.value().xf_index);
+          !r) {
         return r.error();
       }
       ++state.cells_decoded;
diff --git a/src/io/xlsb/sheet_reader.h b/src/io/xlsb/sheet_reader.h
index a74bdea6c..4d91cd74f 100644
--- a/src/io/xlsb/sheet_reader.h
+++ b/src/io/xlsb/sheet_reader.h
@@ -14,6 +14,7 @@
 #include <tuple>
 #include <vector>
 
+#include "io/array_anchor_budget.h"
 #include "io/xlsb/ptg_reader.h"
 #include "phonetic.h"
 #include "sheet.h"
@@ -27,18 +28,6 @@ class Workbook;
 namespace io {
 namespace xlsb {
 
-/// A dynamic-array formula's anchor cell plus its footprint, decoded
-/// from a `BrtArrFmla` record's `RfX`. `row` / `col` is the anchor
-/// (`rwFirst`, `colFirst`); `last_row` / `last_col` is the footprint's
-/// bottom-right corner (`rwLast`, `colLast`). One-cell array anchors are
-/// retained as well so dynamic-array metadata survives an XLSB rewrite.
-struct ArrayAnchor {
-  std::uint32_t row = 0;
-  std::uint32_t col = 0;
-  std::uint32_t last_row = 0;
-  std::uint32_t last_col = 0;
-};
-
 /// Per-sheet decode state. The reader walks records in order and
 /// updates `current_row` whenever it sees a `BrtRowHdr`. Cell records
 /// then resolve `(current_row, col)` to the absolute cell address.
diff --git a/src/io/xlsb/sheet_writer.cpp b/src/io/xlsb/sheet_writer.cpp
index bd11cbb46..d4e742198 100644
--- a/src/io/xlsb/sheet_writer.cpp
+++ b/src/io/xlsb/sheet_writer.cpp
@@ -30,6 +30,7 @@
 #include "io/xlsb/sst_writer.h"
 #include "pugixml.hpp"
 #include "sheet.h"
+#include "style_resolve.h"
 #include "utils/error.h"
 #include "utils/expected.h"
 #include "utils/index_sort.h"
@@ -45,7 +46,7 @@ namespace {
 /// to skip implicitly-default-constructed columns produced by sheet
 /// row growth (see `Sheet::set_cell_value` docs).
 bool IsEmptySlot(const Cell& cell) {
-  return cell.formula_text.empty() && cell.cached_value.is_blank();
+  return cell.formula_text.empty() && cell.cached_value.is_blank() && cell.xf_index == 0U && !cell.has_explicit_xf;
 }
 
 /// Emits a `BrtRowHdr` for `row`. [MS-XLSB] §2.4.770 layout:
@@ -75,7 +76,7 @@ void EmitRowHeader(std::vector<std::uint8_t>& dst, std::uint32_t row, const RowL
   if (layout != nullptr && layout->hidden) {
     flags2 |= 0x10U;  // fDyZero
   }
-  if (has_height) {
+  if (layout != nullptr && layout->custom_height) {
     flags2 |= 0x20U;  // fUnsynced
   }
   if (layout != nullptr && layout->has_style) {
@@ -727,7 +728,7 @@ Expected<std::vector<std::uint8_t>, Error> emit_sheet(const Sheet& sheet, SstBui
         if (downgraded_array_anchors.count(anchor_key(ph->second.anchor_row, ph->second.anchor_col)) != 0U) {
           continue;
         }
-        const std::uint32_t xf_index = cell != nullptr ? cell->xf_index : 0U;
+        const std::uint32_t xf_index = select_effective_xf(sheet, row, col).xf_index;
         emit_array_phantom(body, col, xf_index, ph->second.value, ph->second.anchor_row, ph->second.anchor_col,
                            ph->second.always_calculates);
       }
diff --git a/src/io/xlsb/sst_writer.cpp b/src/io/xlsb/sst_writer.cpp
index 391ca1e18..46231d48a 100644
--- a/src/io/xlsb/sst_writer.cpp
+++ b/src/io/xlsb/sst_writer.cpp
@@ -10,6 +10,7 @@
 #include <utility>
 #include <vector>
 
+#include "io/ooxml/shared_strings_writer.h"
 #include "io/xlsb/record.h"
 #include "io/xlsb/record_writer.h"
 #include "phonetic.h"
@@ -39,40 +40,6 @@ std::uint16_t pack_phonetic_flags(PhoneticProperties props) {
                                     static_cast<std::uint16_t>((props.alignment & 0x03U) << 2U));
 }
 
-/// Builds the interner key for one payload.
-///
-/// Length-prefixes every field for the same reason the OOXML shared
-/// strings writer does: without it, adjacent fields could be re-cut into
-/// the same byte sequence and collide two distinct annotations onto one
-/// entry.
-std::string key_for(std::string_view text, const std::vector<PhoneticRun>& phonetic,
-                    PhoneticProperties phonetic_props) {
-  std::string key;
-  key.reserve(text.size() + 32U + phonetic.size() * 16U);
-  key.append(std::to_string(text.size()));
-  key.push_back(':');
-  key.append(text);
-  for (const PhoneticRun& run : phonetic) {
-    key.push_back(';');
-    key.append(std::to_string(run.sb));
-    key.push_back(',');
-    key.append(std::to_string(run.eb));
-    key.push_back(',');
-    key.append(std::to_string(run.text.size()));
-    key.push_back(':');
-    key.append(run.text);
-  }
-  if (!phonetic.empty()) {
-    key.push_back('|');
-    key.append(std::to_string(phonetic_props.font_id));
-    key.push_back(',');
-    key.append(std::to_string(phonetic_props.type));
-    key.push_back(',');
-    key.append(std::to_string(phonetic_props.alignment));
-  }
-  return key;
-}
-
 /// Narrows a UTF-16 offset to the `u16` the record format stores.
 ///
 /// Excel's own string ceiling is 32767 characters, so a well-formed
@@ -110,7 +77,7 @@ void emit_phonetic_tail(std::vector<std::uint8_t>& payload, const std::vector<Ph
 
 std::uint32_t SstBuilder::intern(std::string_view text, const std::vector<PhoneticRun>& phonetic,
                                  PhoneticProperties phonetic_props) {
-  std::string key = key_for(text, phonetic, phonetic_props);
+  std::string key = SharedStringKey(text, phonetic, phonetic_props);
   if (auto it = index_.find(key); it != index_.end()) {
     return it->second;
   }
diff --git a/src/io/xlsb/styles_writer.cpp b/src/io/xlsb/styles_writer.cpp
index b34ce57b2..d26425e2f 100644
--- a/src/io/xlsb/styles_writer.cpp
+++ b/src/io/xlsb/styles_writer.cpp
@@ -8,6 +8,7 @@
 #include <string_view>
 #include <vector>
 
+#include "io/xlsb/brt_color.h"
 #include "io/xlsb/record.h"
 #include "io/xlsb/record_writer.h"
 #include "io/xlsb/xf_flags.h"
@@ -74,42 +75,8 @@ std::uint16_t FontHeightTwips(double points) {
 }
 
 void EmitColor(std::vector<std::uint8_t>& payload, std::uint32_t argb, const ColorSpec& spec) {
-  // BrtColor is [flags/type, index, tint:i16, r, g, b, a]. Preserve a
-  // theme/indexed/auto selector when it exists. The sibling ARGB bytes are
-  // literal RGB for an RGB selector or a compatibility fallback; this writer
-  // does not resolve theme, indexed, or auto colours.
-  std::uint8_t kind = 0x02U;
-  std::uint8_t index = 0xFFU;  // what Excel writes beside an RGB colour
-  std::int16_t tint = 0;
-  switch (spec.kind) {
-    case ColorSpec::Kind::kTheme:
-      kind = 0x03U;
-      index = static_cast<std::uint8_t>(std::min<std::uint32_t>(spec.theme, 0xFFU));
-      tint = static_cast<std::int16_t>(std::clamp(std::round(spec.tint * 32767.0), -32767.0, 32767.0));
-      break;
-    case ColorSpec::Kind::kIndexed:
-      kind = 0x01U;
-      index = static_cast<std::uint8_t>(std::min<std::uint32_t>(spec.indexed, 0xFFU));
-      break;
-    case ColorSpec::Kind::kAuto:
-      kind = 0x00U;
-      index = 0x40U;  // the system colour Excel writes for `auto`
-      break;
-    case ColorSpec::Kind::kNone:
-    case ColorSpec::Kind::kRgb:
-      break;
-  }
-  // BrtColor stores fValidRGB in bit 0 and XColorType in bits 1..7.
-  // Setting bit 7 turns an RGB color into the reserved type 0x41, which
-  // makes Excel reject the entire styles part.
-  const std::uint32_t color_flags = (static_cast<std::uint32_t>(kind) << 1U) | 0x01U;
-  emit_u8(payload, static_cast<std::uint8_t>(color_flags));
-  emit_u8(payload, index);
-  emit_u16(payload, static_cast<std::uint16_t>(tint));
-  emit_u8(payload, static_cast<std::uint8_t>((argb >> 16U) & 0xFFU));
-  emit_u8(payload, static_cast<std::uint8_t>((argb >> 8U) & 0xFFU));
-  emit_u8(payload, static_cast<std::uint8_t>(argb & 0xFFU));
-  emit_u8(payload, static_cast<std::uint8_t>((argb >> 24U) & 0xFFU));
+  const auto bytes = encode_brt_color(argb, spec);
+  payload.insert(payload.end(), bytes.begin(), bytes.end());
 }
 
 void EmitFont(std::vector<std::uint8_t>& out, const FontRecord& font) {
diff --git a/src/io/xlsb/workbook_bin_reader.cpp b/src/io/xlsb/workbook_bin_reader.cpp
new file mode 100644
index 000000000..d9d3fb7a7
--- /dev/null
+++ b/src/io/xlsb/workbook_bin_reader.cpp
@@ -0,0 +1,520 @@
+//
+// Implementation of the `xl/workbook.bin` global-record decoders. See
+// `io/xlsb/workbook_bin_reader.h`.
+
+#include "io/xlsb/workbook_bin_reader.h"
+
+#include <algorithm>
+#include <cctype>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "io/future_functions.h"
+#include "io/xlsb/protection_records.h"
+#include "io/xlsb/ptg_reader.h"
+#include "io/xlsb/record.h"
+#include "parser/ast.h"
+#include "parser/ast_format.h"
+#include "parser/formula_prefix.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "utils/resource_budget.h"
+#include "utils/structured_log.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+
+/// Decodes `xl/workbook.bin` to extract the ordered sheet-bundle list and
+/// workbook date system and protection. Other records are skipped.
+Expected<WorkbookBinInfo, Error> DecodeWorkbookBin(const std::vector<std::uint8_t>& body) {
+  WorkbookBinInfo info;
+  ByteSpan protection_iso{};
+  ByteSpan cursor{body.data(), body.size()};
+  while (cursor.size > 0) {
+    auto rec_or = read_record(cursor);
+    if (!rec_or) {
+      return rec_or.error();
+    }
+    const XlsbRecord& rec = rec_or.value();
+    if (rec.type == static_cast<std::uint16_t>(XlsbRecordType::BrtWbProp)) {
+      // BrtWbProp ([MS-XLSB] §2.4.866) begins with a u32 grbit; bit 0
+      // is f1904. The following theme-version and optional code-name
+      // fields are irrelevant to the workbook model.
+      ByteSpan p = rec.payload;
+      auto flags_or = read_u32(p);
+      if (!flags_or) {
+        return flags_or.error();
+      }
+      info.date1904 = (flags_or.value() & 0x00000001U) != 0U;
+      continue;
+    }
+    if (rec.type == kBrtBookProtectionIso) {
+      protection_iso = rec.payload;
+      continue;
+    }
+    if (rec.type == kBrtBookProtection) {
+      if (!decode_book_protection(rec.payload, protection_iso, info.protection_xml)) {
+        info.protection_xml.clear();
+        StructuredLog("xlsb.book_protection.not_decoded").warn();
+      }
+      continue;
+    }
+    if (rec.type != static_cast<std::uint16_t>(XlsbRecordType::BrtBundleSh)) {
+      continue;
+    }
+    // BrtBundleSh ([MS-XLSB] §2.4.304):
+    //   hsState    : u32 (visibility)
+    //   iTabID     : u32
+    //   strRelID   : XLNullableWideString
+    //   strName    : XLWideString
+    ByteSpan p = rec.payload;
+    // hsState: 0 = visible, 1 = hidden, 2 = very hidden.
+    auto hs_state_or = read_u32(p);
+    if (!hs_state_or) {
+      return hs_state_or.error();
+    }
+    auto skip2 = read_u32(p);  // iTabID
+    if (!skip2) {
+      return skip2.error();
+    }
+    auto rid_or = read_xlnullablewidestring(p);
+    if (!rid_or) {
+      return rid_or.error();
+    }
+    auto name_or = read_xlwidestring(p);
+    if (!name_or) {
+      return name_or.error();
+    }
+    SheetBundleEntry entry;
+    entry.rid = std::move(rid_or.value());
+    entry.name = std::move(name_or.value());
+    // An hsState outside the three defined values is not a visibility this
+    // model can name; treat anything non-zero it cannot place as plain
+    // hidden, which is the conservative direction (the sheet stays out of
+    // sight rather than appearing unbidden).
+    switch (hs_state_or.value()) {
+      case 0U:
+        entry.visibility = SheetVisibility::kVisible;
+        break;
+      case 2U:
+        entry.visibility = SheetVisibility::kVeryHidden;
+        break;
+      default:
+        entry.visibility = SheetVisibility::kHidden;
+        break;
+    }
+    info.sheets.push_back(std::move(entry));
+  }
+  if (info.sheets.empty()) {
+    return make_error(FormulonErrorCode::kIoXlsbCorrupt, "workbook.bin: no BrtBundleSh records",
+                      "context=xlsb_reader part=xl/workbook.bin");
+  }
+  return info;
+}
+
+namespace {
+
+/// Decodes a UTF-16LE name of `units` code units starting at `cursor`,
+/// advancing it past the name. `units` is caller-known (from a fixed-size
+/// header field), unlike `read_xlwidestring`'s self-describing length. This
+/// path intentionally avoids Expected<std::string, Error>: malformed
+/// workbook names are common fuzz inputs, and libc++'s variant dispatch
+/// under UBSan must not turn recoverable input errors into a process abort.
+bool ReadFixedWideString(ByteSpan& cursor, std::uint32_t units, std::string& out) {
+  // Check in the destination width before multiplying. On wasm32, a hostile
+  // u32 `units` value can wrap `units * 2` back below cursor.size otherwise.
+  if (units > cursor.size / 2U) {
+    return false;
+  }
+  const std::size_t byte_len = static_cast<std::size_t>(units) * 2U;
+  out.clear();
+  out.reserve(byte_len);
+  for (std::uint32_t i = 0; i < units; ++i) {
+    const std::size_t offset = static_cast<std::size_t>(i) * 2U;
+    const std::uint16_t cu = static_cast<std::uint16_t>(static_cast<std::uint16_t>(cursor.data[offset]) |
+                                                        (static_cast<std::uint16_t>(cursor.data[offset + 1U]) << 8));
+    std::uint32_t cp = cu;
+    if (cu >= 0xD800U && cu <= 0xDBFFU && i + 1 < units) {
+      const std::size_t low_offset = static_cast<std::size_t>(i + 1U) * 2U;
+      const std::uint16_t low =
+          static_cast<std::uint16_t>(static_cast<std::uint16_t>(cursor.data[low_offset]) |
+                                     (static_cast<std::uint16_t>(cursor.data[low_offset + 1U]) << 8));
+      if (low >= 0xDC00U && low <= 0xDFFFU) {
+        cp = 0x10000U + ((static_cast<std::uint32_t>(cu) - 0xD800U) << 10) + (low - 0xDC00U);
+        ++i;
+      }
+    }
+    if (cp < 0x80U) {
+      out.push_back(static_cast<char>(cp));
+    } else if (cp < 0x800U) {
+      out.push_back(static_cast<char>(0xC0U | (cp >> 6)));
+      out.push_back(static_cast<char>(0x80U | (cp & 0x3FU)));
+    } else if (cp < 0x10000U) {
+      out.push_back(static_cast<char>(0xE0U | (cp >> 12)));
+      out.push_back(static_cast<char>(0x80U | ((cp >> 6) & 0x3FU)));
+      out.push_back(static_cast<char>(0x80U | (cp & 0x3FU)));
+    } else {
+      out.push_back(static_cast<char>(0xF0U | (cp >> 18)));
+      out.push_back(static_cast<char>(0x80U | ((cp >> 12) & 0x3FU)));
+      out.push_back(static_cast<char>(0x80U | ((cp >> 6) & 0x3FU)));
+      out.push_back(static_cast<char>(0x80U | (cp & 0x3FU)));
+    }
+  }
+  cursor.data += byte_len;
+  cursor.size -= byte_len;
+  return true;
+}
+
+/// True when `name` carries one of Excel's hidden storage prefixes, i.e.
+/// the record is a `_xlfn.<FN>` future-function or `_xlpm.<param>`
+/// LET / LAMBDA-parameter placeholder rather than a user-visible defined
+/// name. Matched case-insensitively, the same way `ptg_reader.cpp`
+/// resolves these names during Ptg decode.
+///
+/// This is deliberately NOT the `fHidden` bit: Excel sets `fHidden` on
+/// the placeholders, but it also sets it on an ordinary defined name the
+/// user chose to hide from the Name Manager, and both this reader's
+/// writer counterpart and Excel itself store the two the same way.
+bool IsStoragePlaceholderName(std::string_view name) {
+  constexpr std::string_view kPrefixes[] = {"_xlfn.", "_xlpm."};
+  for (const std::string_view prefix : kPrefixes) {
+    if (name.size() < prefix.size()) {
+      continue;
+    }
+    bool match = true;
+    for (std::size_t i = 0; i < prefix.size(); ++i) {
+      const char lhs = static_cast<char>(std::tolower(static_cast<unsigned char>(name[i])));
+      if (lhs != prefix[i]) {
+        match = false;
+        break;
+      }
+    }
+    if (match) {
+      return true;
+    }
+  }
+  return false;
+}
+
+}  // namespace
+
+/// Decodes the workbook-scope `BrtName` table from `xl/workbook.bin`:
+/// ordinary defined names and the hidden `_xlfn.*` / `_xlpm.*`
+/// future-function / LET-parameter placeholders `PtgName` resolves by
+/// 1-based declaration order. Byte layout verified against a real
+/// Excel-365-produced `xl/workbook.bin`:
+///   flags (u16) + 3 reserved bytes + itab (i32) + cch (u32) +
+///   cch x UTF-16LE code units + <formula body, not consumed here>.
+/// Records other than `BrtName` are skipped.
+Expected<std::vector<XlsbName>, Error> DecodeWorkbookNames(const std::vector<std::uint8_t>& body) {
+  std::vector<XlsbName> names;
+  ByteSpan cursor{body.data(), body.size()};
+  while (cursor.size > 0) {
+    auto rec_or = read_record(cursor);
+    if (!rec_or) {
+      return rec_or.error();
+    }
+    const XlsbRecord& rec = rec_or.value();
+    if (rec.type != static_cast<std::uint16_t>(XlsbRecordType::BrtName)) {
+      continue;
+    }
+    ByteSpan p = rec.payload;
+    if (p.size < 5) {
+      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated, "workbook.bin: BrtName header truncated",
+                        "context=xlsb_reader");
+    }
+    auto flags_or = read_u16(p);
+    if (!flags_or) {
+      return flags_or.error();
+    }
+    p.data += 3;  // 3 reserved bytes between flags and itab.
+    p.size -= 3;
+    auto itab_or = read_u32(p);
+    if (!itab_or) {
+      return itab_or.error();
+    }
+    auto cch_or = read_u32(p);
+    if (!cch_or) {
+      return cch_or.error();
+    }
+    std::string name;
+    if (!ReadFixedWideString(p, cch_or.value(), name)) {
+      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated, "xlsb fixed-length wide string truncated",
+                        "context=xlsb_reader");
+    }
+    XlsbName entry;
+    entry.itab = static_cast<std::int32_t>(itab_or.value());
+    entry.name = std::move(name);
+    entry.hidden = (flags_or.value() & 0x0001U) != 0;
+    names.push_back(std::move(entry));
+  }
+  return names;
+}
+
+std::vector<XlsbSupBook> DecodeSupBooks(const std::vector<std::uint8_t>& body) {
+  std::vector<XlsbSupBook> books;
+  ByteSpan cursor{body.data(), body.size()};
+  bool inside = false;
+  std::uint32_t next_external = 1;
+  while (cursor.size > 0) {
+    auto rec_or = read_record(cursor);
+    if (!rec_or) {
+      break;
+    }
+    const XlsbRecord& rec = rec_or.value();
+    const auto type = static_cast<XlsbRecordType>(rec.type);
+    if (type == XlsbRecordType::BrtBeginExternals) {
+      inside = true;
+      continue;
+    }
+    if (type == XlsbRecordType::BrtEndExternals) {
+      break;
+    }
+    if (!inside) {
+      continue;
+    }
+    switch (type) {
+      case XlsbRecordType::BrtSupSelf:
+        books.push_back(XlsbSupBook{});
+        break;
+      case XlsbRecordType::BrtSupBookSrc: {
+        ByteSpan payload = rec.payload;
+        auto rid_or = read_xlwidestring(payload);
+        books.push_back(XlsbSupBook{next_external, rid_or ? std::move(rid_or.value()) : std::string()});
+        ++next_external;
+        break;
+      }
+      case XlsbRecordType::BrtSupAddin:
+      case XlsbRecordType::BrtSupSame:
+        books.push_back(XlsbSupBook{next_external, std::string()});
+        ++next_external;
+        break;
+      default:
+        // `BrtSupTabs` and the future-record framing that decorates a
+        // book entry sit inside the same block without adding a book.
+        break;
+    }
+  }
+  return books;
+}
+
+/// Decodes the `BrtExternSheet` table from `xl/workbook.bin`: resolves a
+/// `PtgRef3d` / `PtgArea3d` `ixti` (0-based index into the returned
+/// vector) to a `(itabFirst, itabLast)` sheet-index range. Byte layout
+/// verified against a real Excel-365-produced `xl/workbook.bin`: u32
+/// count, followed by `count` entries of `(iSupBook, itabFirst,
+/// itabLast)` as 3 x i32 each. `iSupBook` is resolved through
+/// `DecodeSupBooks` so `decode_ptgs` can tell an internal range from an
+/// external-workbook one, whose sheet indices index the supporting book
+/// rather than this workbook's `sheet_names`.
+/// A workbook with no qualified references at all carries no
+/// `BrtExternSheet` record, so an empty result is a normal outcome, not
+/// an error.
+Expected<std::vector<XlsbSheetRange>, Error> DecodeExternSheet(const std::vector<std::uint8_t>& body,
+                                                               const std::vector<XlsbSupBook>& books) {
+  std::vector<XlsbSheetRange> ranges;
+  ByteSpan cursor{body.data(), body.size()};
+  while (cursor.size > 0) {
+    auto rec_or = read_record(cursor);
+    if (!rec_or) {
+      return rec_or.error();
+    }
+    const XlsbRecord& rec = rec_or.value();
+    if (rec.type != static_cast<std::uint16_t>(XlsbRecordType::BrtExternSheet)) {
+      continue;
+    }
+    ByteSpan p = rec.payload;
+    auto count_or = read_u32(p);
+    if (!count_or) {
+      return count_or.error();
+    }
+    // Each entry consumes three u32s. Never reserve beyond what the
+    // remaining payload can actually hold, so an attacker-controlled
+    // count (up to 4 billion) cannot force a multi-GB reservation before
+    // the per-entry reads run out of bytes and fail.
+    constexpr std::size_t kExternSheetEntryBytes = 12U;
+    const std::size_t reservable =
+        static_cast<std::size_t>(std::min<std::uint64_t>(count_or.value(), p.size / kExternSheetEntryBytes));
+    ranges.reserve(reservable);
+    for (std::uint32_t i = 0; i < count_or.value(); ++i) {
+      auto sup_book_or = read_u32(p);
+      if (!sup_book_or) {
+        return sup_book_or.error();
+      }
+      auto first_or = read_u32(p);
+      if (!first_or) {
+        return first_or.error();
+      }
+      auto last_or = read_u32(p);
+      if (!last_or) {
+        return last_or.error();
+      }
+      // An `iSupBook` past the end of the list cannot be resolved. Treat
+      // it as external: that refuses the reference, where assuming
+      // "internal" would bind it to a local sheet by index.
+      //
+      // An *entirely* absent list is a different situation: the file
+      // carries qualified references but no supporting-book block to
+      // resolve them against, which no Excel-written file observed here
+      // does. Refusing every reference would regress such a file from
+      // working to undecodable, so it keeps the weaker rule that index
+      // 0 is this workbook.
+      const std::uint32_t sup_book = sup_book_or.value();
+      std::uint32_t external_book = std::numeric_limits<std::uint32_t>::max();
+      if (books.empty()) {
+        external_book = sup_book == 0U ? 0U : sup_book;
+      } else if (sup_book < books.size()) {
+        external_book = books[sup_book].external_book;
+      }
+      ranges.push_back(XlsbSheetRange{static_cast<std::int32_t>(first_or.value()),
+                                      static_cast<std::int32_t>(last_or.value()), external_book});
+    }
+    break;  // Exactly one BrtExternSheet record per workbook.
+  }
+  return ranges;
+}
+
+/// Registers every user-visible `BrtName` entry as a workbook defined
+/// name via a single bulk `Workbook::set_defined_names` call (mirroring
+/// the OOXML reader's `ooxml_reader.cpp` pattern -- a load-time
+/// population pass, not the incremental single-name edit API
+/// `set_defined_name_scoped` guards with dedup/dep-graph-rebuild logic
+/// that only matters for post-load mutation). Only the storage
+/// placeholders (the `_xlfn.*` / `_xlpm.*` future-function and
+/// LET/LAMBDA-parameter names `PtgName` resolves during Ptg decode — see
+/// `name_table`) are skipped; they are not user-visible names and never
+/// carry a Name Manager comment. A name Excel merely hides from the Name
+/// Manager keeps its `fHidden` bit on the produced `DefinedName` and
+/// is registered like any other. Walks `xl/workbook.bin`'s `BrtName`
+/// records a second time (after `DecodeWorkbookNames` has already built
+/// the complete `name_table`), decoding each entry's own formula body so
+/// a qualified or name-referencing formula (e.g. `Rate` defined as a
+/// cell reference) resolves against the full table rather than a
+/// partially-built one. A name whose formula uses a Ptg token outside
+/// the supported set logs a structured warning and is skipped rather
+/// than failing the whole read — the OOXML reader's `DecodeFormulaText`
+/// contract mirrored at the workbook-name level.
+Expected<void, Error> RegisterDefinedNames(const std::vector<std::uint8_t>& body,
+                                           const std::vector<XlsbName>& name_table,
+                                           const std::vector<std::string>& sheet_names,
+                                           const std::vector<XlsbSheetRange>& sheet_ranges,
+                                           const XlsbExternalBooks& external_books, Workbook& wb,
+                                           std::uint32_t* undecoded_defined_name_count) {
+  ByteSpan cursor{body.data(), body.size()};
+  std::size_t name_index = 0;
+  std::vector<DefinedName> out;
+  while (cursor.size > 0) {
+    auto rec_or = read_record(cursor);
+    if (!rec_or) {
+      return rec_or.error();
+    }
+    const XlsbRecord& rec = rec_or.value();
+    if (rec.type != static_cast<std::uint16_t>(XlsbRecordType::BrtName)) {
+      continue;
+    }
+    if (name_index >= name_table.size()) {
+      break;  // Defensive: should be unreachable (same records, same order).
+    }
+    const XlsbName& entry = name_table[name_index];
+    ++name_index;
+    if (IsStoragePlaceholderName(entry.name)) {
+      continue;
+    }
+    ByteSpan p = rec.payload;
+    if (p.size < 9) {
+      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated,
+                        "workbook.bin: BrtName header truncated (defined-name pass)", "context=xlsb_reader");
+    }
+    p.data += 9;  // flags (2) + 3 reserved bytes + itab (4).
+    p.size -= 9;
+    auto cch_or = read_u32(p);
+    if (!cch_or) {
+      return cch_or.error();
+    }
+    const std::size_t name_bytes = static_cast<std::size_t>(cch_or.value()) * 2;
+    if (name_bytes > p.size) {
+      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated,
+                        "workbook.bin: BrtName name truncated (defined-name pass)", "context=xlsb_reader");
+    }
+    p.data += name_bytes;
+    p.size -= name_bytes;
+    auto cce_or = read_u32(p);
+    if (!cce_or) {
+      return cce_or.error();
+    }
+    const std::uint32_t cce = cce_or.value();
+    if (cce > p.size) {
+      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated,
+                        "workbook.bin: BrtName formula rgce length exceeds payload", "context=xlsb_reader");
+    }
+    if (cce == 0) {
+      continue;
+    }
+    ByteSpan rgce{p.data, cce};
+    p.data += cce;
+    p.size -= cce;
+    // `cb` + `rgcb` ([MS-XLSB] §2.4.649's `CellParsedFormula`): the
+    // array-constant / mem-area extra data for this formula's own Ptg
+    // tokens. Must be skipped correctly (not just assumed absent) to
+    // land on the trailing comment string below.
+    auto cb_or = read_u32(p);
+    if (!cb_or) {
+      return cb_or.error();
+    }
+    const std::uint32_t cb = cb_or.value();
+    if (cb > p.size) {
+      return make_error(FormulonErrorCode::kIoXlsbRecordTruncated,
+                        "workbook.bin: BrtName formula rgcb length exceeds payload", "context=xlsb_reader");
+    }
+    ByteSpan rgcb{p.data, cb};
+    p.data += cb;
+    p.size -= cb;
+    Arena arena(/*initial_chunk_bytes=*/4096, kMaxLoadArenaBytes);
+    auto ast_or = decode_ptgs(rgce, rgcb, arena, sheet_names, name_table, sheet_ranges, external_books);
+    if (!ast_or) {
+      StructuredLog("xlsb.defined_name.not_decoded")
+          .field("name", entry.name)
+          .field("reason", ast_or.error().message)
+          .warn();
+      if (undecoded_defined_name_count != nullptr) {
+        ++*undecoded_defined_name_count;
+      }
+      continue;
+    }
+    // Trailing BrtName strings: a plain name carries exactly one, the
+    // optional Name Manager comment, as a null `XLNullableWideString`
+    // when unset (`read_xlnullablewidestring` maps that to an empty
+    // string). This mirrors the writer's `EmitName`.
+    auto comment_or = read_xlnullablewidestring(p);
+    if (!comment_or) {
+      return comment_or.error();
+    }
+    // Defined-name formulas store the bare expression text (no leading
+    // `=`), matching the OOXML `<definedName>` element's text content.
+    DefinedName dn;
+    dn.name = entry.name;
+    // The decoder names a hidden-name callee with its storage prefix; the
+    // text reads back in formula-bar spelling, like a cell's.
+    dn.formula = parser::spell_storage_operators(
+        parser::strip_storage_prefixes(parser::format_formula(*ast_or.value()), &has_storage_prefix));
+    dn.local_sheet_id = entry.itab;
+    dn.hidden = entry.hidden;
+    dn.comment = std::move(comment_or.value());
+    out.push_back(std::move(dn));
+  }
+  wb.set_defined_names(std::move(out));
+  return Expected<void, Error>::Ok();
+}
+
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/src/io/xlsb/workbook_bin_reader.h b/src/io/xlsb/workbook_bin_reader.h
new file mode 100644
index 000000000..bb744be79
--- /dev/null
+++ b/src/io/xlsb/workbook_bin_reader.h
@@ -0,0 +1,101 @@
+//
+// Decoding of the global records of `xl/workbook.bin`: the sheet bundle,
+// date system and protection, the `BrtName` table, the supporting-book list
+// and the `BrtExternSheet` table that `PtgRef3d` / `PtgNameX` resolve
+// through. Consumed by the package reader (`reader.cpp`).
+
+#ifndef FORMULON_IO_XLSB_WORKBOOK_BIN_READER_H_
+#define FORMULON_IO_XLSB_WORKBOOK_BIN_READER_H_
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "io/xlsb/ptg_reader.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+
+/// One decoded entry of the workbook's sheet bundle.
+///
+///   * `name`  — display name of the sheet.
+///   * `rid`   — workbook-rels relationship id pointing at the sheet
+///               binary part.
+struct SheetBundleEntry {
+  std::string name;
+  std::string rid;
+  /// The sheet's `hsState`, which shares its numbering with
+  /// `SheetVisibility` and so is carried across whole. Very-hidden stays
+  /// distinct from hidden: it is the state that keeps a sheet out of
+  /// Excel's "Unhide" dialog.
+  SheetVisibility visibility = SheetVisibility::kVisible;
+};
+
+/// Workbook-global fields needed while constructing the model.
+struct WorkbookBinInfo {
+  std::vector<SheetBundleEntry> sheets;
+  bool date1904 = false;
+  /// `<workbookProtection>` rebuilt from BrtBookProtection(Iso); empty
+  /// when the book is unprotected or the records were not decodable.
+  std::string protection_xml;
+};
+
+/// Decodes the supporting-book list from `xl/workbook.bin` into one
+/// entry per book, in `BrtExternSheet`'s `iSupBook` order. The value is
+/// `0` for this workbook and `N >= 1` for the N-th external book in
+/// package order, which is the number the equivalent xlsx formula text
+/// spells as `[N]`.
+///
+/// Layout verified against Excel-365-produced `xl/workbook.bin` files:
+/// the books are the records between `BrtBeginExternals` and
+/// `BrtEndExternals`, one record each, and the record id alone says
+/// which kind it is. Only `BrtSupSelf` is this workbook; `BrtSupAddin`
+/// and `BrtSupSame` are counted so later entries keep their index, but
+/// neither names a resolvable external package, so both are reported as
+/// external and therefore refused downstream.
+///
+/// A workbook can legitimately have no self entry: one whose only
+/// qualified references are cross-workbook carries a single
+/// `BrtSupBookSrc`, so `iSupBook == 0` is then an external book. That
+/// case is why this list has to be read rather than assumed.
+///
+/// A `BrtSupBookSrc` also names the relationship its external link part
+/// hangs off, which is how a `[N]` is turned back into a package part.
+/// That id is retained on the entry; the other kinds leave it empty.
+struct XlsbSupBook {
+  std::uint32_t external_book = 0;
+  std::string rel_id;
+};
+
+/// Decodes `xl/workbook.bin` to extract the ordered sheet-bundle list and
+/// workbook date system and protection. Other records are skipped.
+Expected<WorkbookBinInfo, Error> DecodeWorkbookBin(const std::vector<std::uint8_t>& body);
+
+/// Decodes the workbook-scope `BrtName` table (declaration order).
+Expected<std::vector<XlsbName>, Error> DecodeWorkbookNames(const std::vector<std::uint8_t>& body);
+
+/// Decodes the supporting-book list in `BrtExternSheet`'s `iSupBook` order.
+std::vector<XlsbSupBook> DecodeSupBooks(const std::vector<std::uint8_t>& body);
+
+/// Decodes the `BrtExternSheet` table into `(itabFirst, itabLast)` ranges.
+Expected<std::vector<XlsbSheetRange>, Error> DecodeExternSheet(const std::vector<std::uint8_t>& body,
+                                                               const std::vector<XlsbSupBook>& books);
+
+/// Registers every user-visible `BrtName` entry as a workbook defined name.
+Expected<void, Error> RegisterDefinedNames(const std::vector<std::uint8_t>& body,
+                                           const std::vector<XlsbName>& name_table,
+                                           const std::vector<std::string>& sheet_names,
+                                           const std::vector<XlsbSheetRange>& sheet_ranges,
+                                           const XlsbExternalBooks& external_books, Workbook& wb,
+                                           std::uint32_t* undecoded_defined_name_count);
+
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_XLSB_WORKBOOK_BIN_READER_H_
diff --git a/src/io/xlsb/workbook_bin_writer.cpp b/src/io/xlsb/workbook_bin_writer.cpp
new file mode 100644
index 000000000..320af3ede
--- /dev/null
+++ b/src/io/xlsb/workbook_bin_writer.cpp
@@ -0,0 +1,673 @@
+//
+// Implementation of the `xl/workbook.bin` stream writer. See
+// `io/xlsb/workbook_bin_writer.h`.
+
+#include "io/xlsb/workbook_bin_writer.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <unordered_map>
+#include <unordered_set>
+#include <utility>
+#include <vector>
+
+#include "cf/cf_types.h"
+#include "io/dynamic_array_formula.h"
+#include "io/future_functions.h"
+#include "io/xlsb/protection_records.h"
+#include "io/xlsb/ptg_targets.h"
+#include "io/xlsb/ptg_writer.h"
+#include "io/xlsb/record.h"
+#include "io/xlsb/record_writer.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+
+// Workbook-globals record ids the reader does not consume (so they are absent
+// from `XlsbRecordType`) but the writer must emit for a well-formed stream.
+// A `BrtExternSheet` must live inside a `BrtBeginExternals ... BrtEndExternals`
+// block with a `BrtSupSelf` (self-referencing supporting book); Excel rejects a
+// bare `BrtExternSheet`. Ids per [MS-XLSB] §2.4.
+constexpr std::uint16_t kBrtBeginExternals = 353;
+constexpr std::uint16_t kBrtSupSelf = 357;
+constexpr std::uint16_t kBrtEndExternals = 354;
+// Workbook-globals structural records Excel expects before the sheet bundle.
+constexpr std::uint16_t kBrtFileVersion = 128;
+constexpr std::uint16_t kBrtBeginBookViews = 135;
+constexpr std::uint16_t kBrtWbView = 158;
+constexpr std::uint16_t kBrtEndBookViews = 136;
+// Opens a future-record block in a sheet tail (x14 extensions).
+constexpr std::uint16_t kBrtFrtBegin = 35;
+
+}  // namespace
+
+// ---------------------------------------------------------------------------
+// PtgName table (BrtName): defined names + future-function callees
+// ---------------------------------------------------------------------------
+
+namespace {
+
+/// Parses `formula` (with or without a leading `=`) and folds every name
+/// `collect_ptg_names` finds into `names` / `seen`. Parse failures are
+/// silently skipped here — `EncodeCellFormula` / the defined-name
+/// encode pass below surface the same failure as a proper `Expected`
+/// error when the formula is actually encoded.
+///
+/// `scope_sheet_id` is the scope the formula resolves names from (see
+/// `BuildNameTableForScope`). Every referenced text defined only as the
+/// local name of sheets other than that scope is added to `invisible`:
+/// Excel resolves such a reference to `#NAME?`, so it needs a
+/// workbook-scope record of its own rather than an ordinal borrowed from
+/// another sheet's definition, which would read back as that sheet's
+/// qualified name. Every sheet-qualified reference is appended to
+/// `qualified` as `(sheet, name)`.
+void CollectNamesFromFormula(std::string_view formula, std::int32_t scope_sheet_id,
+                             const std::unordered_map<std::string, std::vector<std::int32_t>>& defined_scopes,
+                             std::vector<std::string>& names, std::unordered_set<std::string>& seen,
+                             std::vector<std::string>& invisible, std::unordered_set<std::string>& invisible_seen,
+                             std::vector<std::pair<std::string, std::string>>& qualified) {
+  if (!formula.empty() && formula.front() == '=') {
+    formula.remove_prefix(1);
+  }
+  Arena arena;
+  parser::Parser p(formula, arena);
+  parser::AstNode* root = p.parse();
+  if (root == nullptr || !p.errors().empty()) {
+    return;
+  }
+  collect_ptg_names(*root, names, seen);
+  collect_sheet_qualified_names(*root, qualified);
+  std::vector<std::string> referenced;
+  std::unordered_set<std::string> referenced_seen;
+  collect_scope_resolved_names(*root, referenced, referenced_seen);
+  for (std::string& text : referenced) {
+    const auto it = defined_scopes.find(text);
+    if (it == defined_scopes.end()) {
+      continue;
+    }
+    const std::vector<std::int32_t>& scopes = it->second;
+    const bool visible = std::any_of(scopes.begin(), scopes.end(),
+                                     [scope_sheet_id](std::int32_t s) { return s < 0 || s == scope_sheet_id; });
+    if (!visible && invisible_seen.insert(text).second) {
+      invisible.push_back(std::move(text));
+    }
+  }
+}
+
+/// Calls `visit` with the text (no leading `=`) of every formula a sheet
+/// part carries: cell formulas, conditional-format rule and threshold
+/// formulas, and data-validation formulas. The name and ExternSheet tables
+/// are both built over this one walk, so every formula the sheet writer
+/// encodes finds its entries.
+template <typename Visit>
+void ForEachSheetFormula(const Sheet& sheet, Visit&& visit) {
+  for (const auto& [row, cells] : sheet.rows()) {
+    (void)row;
+    for (const Cell& cell : cells) {
+      std::string_view body(cell.formula_text);
+      if (!body.empty() && body.front() == '=') {
+        body.remove_prefix(1);
+      }
+      if (!body.empty()) {
+        visit(body);
+      }
+    }
+  }
+  const auto visit_text = [&visit](const std::string& text) {
+    if (!text.empty()) {
+      visit(std::string_view(text));
+    }
+  };
+  const auto visit_cfvo = [&visit_text](const cf::CfValueObject& v) {
+    if (v.type == cf::CfvoType::Formula) {
+      visit_text(v.value);
+    }
+  };
+  for (const cf::ConditionalFormat& format : sheet.conditional_formats()) {
+    for (const cf::CFRule& rule : format.rules) {
+      visit_text(rule.formula1.value_or(std::string()));
+      visit_text(rule.formula2.value_or(std::string()));
+      if (rule.color_scale) {
+        std::for_each(rule.color_scale->thresholds.begin(), rule.color_scale->thresholds.end(), visit_cfvo);
+      }
+      if (rule.data_bar) {
+        visit_cfvo(rule.data_bar->min);
+        visit_cfvo(rule.data_bar->max);
+      }
+      if (rule.icon_set) {
+        std::for_each(rule.icon_set->thresholds.begin(), rule.icon_set->thresholds.end(), visit_cfvo);
+      }
+    }
+  }
+  for (const DataValidation& dv : sheet.validations()) {
+    visit_text(dv.formula1);
+    visit_text(dv.formula2);
+  }
+}
+
+}  // namespace
+
+/// Builds the workbook's `BrtName` record order: every genuine defined
+/// name (`Workbook::defined_names()`, in declaration order) occupies the
+/// leading slots, followed by every future-function callee / `NameRef`
+/// `collect_ptg_names` discovers across defined-name and sheet formulas
+/// (in first-encounter order) that is not already a defined name, then a
+/// workbook-scope placeholder for each name referenced where none of its
+/// definitions is visible, then an empty stub scoped to `S` for each
+/// `S!Name` that neither `S` nor the workbook defines, as Excel 365 saves
+/// it. Slot `i` is the record a `PtgName` reaches with `ilbl == i + 1`.
+///
+/// Defined names take one slot each, duplicate name text included:
+/// `Workbook::set_defined_name_scoped` deliberately admits a
+/// workbook-scoped and a sheet-local name spelling the same text, and
+/// each needs its own `BrtName` record for the emission pass (which
+/// walks `wb.defined_names()` by the same index) to stay aligned with
+/// the `ilbl` values encoded into formulas.
+void BuildOrderedNames(const Workbook& wb, std::vector<OrderedName>& ordered_names) {
+  std::vector<std::string> names;
+  std::unordered_set<std::string> seen;
+  std::vector<std::string> invisible;
+  std::unordered_set<std::string> invisible_seen;
+  std::vector<std::pair<std::string, std::string>> qualified;
+  std::unordered_map<std::string, std::vector<std::int32_t>> defined_scopes;
+  std::unordered_set<std::string> scoped_keys;
+  for (const DefinedName& dn : wb.defined_names()) {
+    names.push_back(dn.name);
+    seen.insert(dn.name);
+    defined_scopes[dn.name].push_back(dn.local_sheet_id);
+    scoped_keys.insert(sheet_scoped_name_key(dn.local_sheet_id, dn.name));
+  }
+  for (const DefinedName& dn : wb.defined_names()) {
+    CollectNamesFromFormula(dn.formula, dn.local_sheet_id, defined_scopes, names, seen, invisible, invisible_seen,
+                            qualified);
+  }
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    ForEachSheetFormula(wb.sheet(i), [&](std::string_view formula) {
+      CollectNamesFromFormula(formula, static_cast<std::int32_t>(i), defined_scopes, names, seen, invisible,
+                              invisible_seen, qualified);
+    });
+  }
+  for (std::string& text : names) {
+    ordered_names.push_back(OrderedName{std::move(text), -1});
+  }
+  for (std::string& text : invisible) {
+    ordered_names.push_back(OrderedName{std::move(text), -1});
+  }
+  for (auto& [sheet, name] : qualified) {
+    const std::size_t itab = wb.sheet_index_by_name(sheet);
+    if (itab >= wb.sheet_count()) {
+      continue;  // The encoder reports the unknown sheet.
+    }
+    const auto scope = static_cast<std::int32_t>(itab);
+    if (scoped_keys.count(sheet_scoped_name_key(-1, name)) == 0 &&
+        scoped_keys.insert(sheet_scoped_name_key(scope, name)).second) {
+      ordered_names.push_back(OrderedName{std::move(name), scope});
+    }
+  }
+}
+
+/// Builds the `name -> ilbl` map `encode_ptgs` consults for a formula
+/// that lives in `scope_sheet_id` (a 0-based sheet index for a cell
+/// formula or a sheet-local defined name, `-1` for a workbook-scoped
+/// defined name).
+///
+/// A `PtgName` token carries no scope of its own — it is a bare ordinal
+/// into the `BrtName` table — so the scope has to be resolved here, at
+/// encode time, exactly as Excel resolves it when reading the file back:
+/// a sheet-local name shadows a workbook-scoped one of the same text for
+/// formulas on that sheet, and the workbook-scoped name is reached only
+/// where no local one exists. Encoding a single workbook-wide ordinal
+/// per name text would silently re-point one of the two.
+///
+/// The three passes are layered by precedence and rely on `emplace`
+/// leaving an entry that is already present alone:
+///   1. names local to `scope_sheet_id`, stubs included — these shadow
+///      everything;
+///   2. workbook-scoped names, filling any text no local one claimed;
+///   3. every placeholder slot, then every remaining defined slot. The
+///      placeholders are the hidden `_xlfn.*` / `_xlpm.*` names (which
+///      have no scope), undefined names, and the workbook-scope record
+///      `BuildOrderedNames` adds for a text that exists only as another
+///      sheet's local name: that reference is `#NAME?` in Excel, and
+///      reaching the other sheet's record instead would read back as
+///      that sheet's qualified name.
+NameTable BuildNameTableForScope(const Workbook& wb, const std::vector<OrderedName>& ordered_names,
+                                 std::int32_t scope_sheet_id) {
+  const std::vector<DefinedName>& defined = wb.defined_names();
+  const std::size_t defined_count = std::min(defined.size(), ordered_names.size());
+  NameTable name_table;
+  name_table.reserve(ordered_names.size());
+  if (scope_sheet_id >= 0) {
+    for (std::size_t i = 0; i < defined_count; ++i) {
+      if (defined[i].local_sheet_id == scope_sheet_id) {
+        name_table.emplace(defined[i].name, static_cast<std::uint32_t>(i + 1));
+      }
+    }
+    // A stub scoped to this sheet is its local name too: Excel resolves a
+    // bare `NOSUCH(1)` on Sheet1 to the stub `Sheet1!NOSUCH` created there.
+    for (std::size_t i = defined_count; i < ordered_names.size(); ++i) {
+      if (ordered_names[i].itab == scope_sheet_id) {
+        name_table.emplace(ordered_names[i].name, static_cast<std::uint32_t>(i + 1));
+      }
+    }
+  }
+  for (std::size_t i = 0; i < defined_count; ++i) {
+    if (defined[i].local_sheet_id < 0) {
+      name_table.emplace(defined[i].name, static_cast<std::uint32_t>(i + 1));
+    }
+  }
+  for (std::size_t i = defined_count; i < ordered_names.size(); ++i) {
+    const OrderedName& slot = ordered_names[i];
+    // A sheet-scoped stub is reachable only through its qualified key.
+    name_table.emplace(slot.itab < 0 ? slot.name : sheet_scoped_name_key(slot.itab, slot.name),
+                       static_cast<std::uint32_t>(i + 1));
+  }
+  for (std::size_t i = 0; i < defined_count; ++i) {
+    name_table.emplace(ordered_names[i].name, static_cast<std::uint32_t>(i + 1));
+  }
+  // Scope-independent keys for sheet-qualified references (`Sheet2!Local`).
+  for (std::size_t i = 0; i < defined_count; ++i) {
+    name_table.emplace(sheet_scoped_name_key(defined[i].local_sheet_id, defined[i].name),
+                       static_cast<std::uint32_t>(i + 1));
+  }
+  return name_table;
+}
+
+// ---------------------------------------------------------------------------
+// ExternSheet table (BrtExternSheet): every sheet-qualified reference's
+// (itabFirst, itabLast) span, single- and multi-sheet alike.
+// ---------------------------------------------------------------------------
+
+namespace {
+
+/// Parses `formula` (no leading `=`) and folds every distinct
+/// `(itabFirst, itabLast)` span `collect_ptg_sheet_ranges` finds into
+/// `ranges` / `seen`. Parse failures are silently skipped here --
+/// `EncodeCellFormula` surfaces the same failure as a proper `Expected`
+/// error when the formula is actually encoded.
+void CollectSheetRangesFromFormula(std::string_view formula, const std::vector<std::string>& sheet_names,
+                                   SheetRangeTable& ranges, std::unordered_set<std::uint64_t>& seen) {
+  Arena arena;
+  parser::Parser p(formula, arena);
+  parser::AstNode* root = p.parse();
+  if (root == nullptr || !p.errors().empty()) {
+    return;
+  }
+  collect_ptg_sheet_ranges(*root, sheet_names, ranges, seen);
+}
+
+/// True when `records` holds a future-record block (BrtFRTBegin). Such
+/// blocks -- x14 conditional formats and validations -- are the retained
+/// content that carries sheet-qualified formulas.
+bool HoldsFrtBlock(const std::vector<std::uint8_t>& records) {
+  ByteSpan cursor{records.data(), records.size()};
+  while (cursor.size != 0U) {
+    auto rec = read_record(cursor);
+    if (!rec) {
+      return false;
+    }
+    if (rec.value().type == kBrtFrtBegin) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/// The leading entries of the `BrtExternSheet` table: the source
+/// workbook's table, in its `ixti` order, when a retained sheet tail holds
+/// a block that may reference it, so those verbatim indices keep naming
+/// the same sheets. Fails when an entry no longer names a sheet of this
+/// workbook (renamed or removed since load, or another workbook's), since
+/// the retained bytes would then reference the wrong sheet.
+Expected<SheetRangeTable, Error> SeedFromRetainedTails(const Workbook& wb) {
+  SheetRangeTable seed;
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    const XlsbSheetTail& tail = wb.sheet(i).xlsb_tail();
+    if (tail.extern_sheets.empty() ||
+        !(HoldsFrtBlock(tail.before_merges) || HoldsFrtBlock(tail.after_merges_before_hyperlinks) ||
+          HoldsFrtBlock(tail.after_hyperlinks))) {
+      continue;
+    }
+    for (const XlsbExternSheetEntry& entry : tail.extern_sheets) {
+      if (entry.first.empty() && entry.last.empty() && !entry.unresolved) {
+        seed.emplace_back(kXtiNoSheet, kXtiNoSheet);
+        continue;
+      }
+      const std::size_t first = wb.sheet_index_by_name(entry.first);
+      const std::size_t last = wb.sheet_index_by_name(entry.last);
+      if (entry.unresolved || first >= wb.sheet_count() || last >= wb.sheet_count()) {
+        return make_error(FormulonErrorCode::kIoXlsbRetainedPartStale,
+                          "retained XLSB sheet records reference a sheet this workbook no longer has",
+                          "context=write_xlsb sheet=" + wb.sheet(i).name() + " ref=" + entry.first);
+      }
+      seed.emplace_back(static_cast<std::int32_t>(first), static_cast<std::int32_t>(last));
+    }
+    break;
+  }
+  return seed;
+}
+
+}  // namespace
+
+/// Builds the `BrtExternSheet` table for the whole workbook: every
+/// distinct sheet-qualified reference span (single-sheet `(itab, itab)`
+/// or a genuine 3-D range `(itabFirst, itabLast)`) any sheet formula (see
+/// `ForEachSheetFormula`) or defined-name formula needs, in first-encounter order. Every
+/// `PtgRef3d` / `PtgArea3d` token this writer emits -- single- or
+/// multi-sheet alike -- resolves its `ixti` through this one table:
+/// once the workbook emits any `BrtExternSheet` entry, the reader
+/// interprets *every* `ixti` as an index into it rather than a bare
+/// sheet index (see `ptg_reader.cpp`'s `sheet_for_ixti` /
+/// `sheet_range_for_ixti`), so single- and multi-sheet references
+/// cannot use two different numbering schemes in the same file.
+Expected<SheetRangeTable, Error> BuildSheetRangeTable(const Workbook& wb, const std::vector<std::string>& sheet_names) {
+  SheetRangeTable collected;
+  std::unordered_set<std::uint64_t> seen;
+  for (const DefinedName& dn : wb.defined_names()) {
+    CollectSheetRangesFromFormula(dn.formula, sheet_names, collected, seen);
+  }
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    ForEachSheetFormula(wb.sheet(i), [&](std::string_view formula) {
+      CollectSheetRangesFromFormula(formula, sheet_names, collected, seen);
+    });
+  }
+  auto ranges = SeedFromRetainedTails(wb);
+  if (!ranges) {
+    return ranges.error();
+  }
+  for (const auto& range : collected) {
+    if (std::find(ranges.value().begin(), ranges.value().end(), range) == ranges.value().end()) {
+      ranges.value().push_back(range);
+    }
+  }
+  return ranges;
+}
+
+namespace {
+
+/// Emits one `BrtExternSheet` record. Byte layout verified against a
+/// real Excel-365-produced `xl/workbook.bin` (see `workbook_bin_reader.cpp`'s
+/// `DecodeExternSheet`, the decoder counterpart): `count(u32)` followed
+/// by `count` entries of `(iSupBook, itabFirst, itabLast)` as three
+/// `i32`s each. `iSupBook` is always 0 here (internal-workbook sheets
+/// only; external-workbook 3-D ranges are out of scope for this
+/// writer).
+void EmitExternSheet(std::vector<std::uint8_t>& body, const SheetRangeTable& ranges) {
+  if (ranges.empty()) {
+    return;
+  }
+  std::vector<std::uint8_t> p;
+  emit_u32(p, static_cast<std::uint32_t>(ranges.size()));
+  for (const auto& [itab_first, itab_last] : ranges) {
+    emit_u32(p, 0);  // iSupBook
+    emit_u32(p, static_cast<std::uint32_t>(itab_first));
+    emit_u32(p, static_cast<std::uint32_t>(itab_last));
+  }
+  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtExternSheet), p);
+}
+
+/// Emits one `BrtName` record. Byte layout verified against a real
+/// Excel-365-produced `xl/workbook.bin` (see `workbook_bin_reader.cpp`'s
+/// `DecodeWorkbookNames`, the decoder counterpart):
+///   flags (u16: bit 0 = fHidden) + 3 reserved bytes + itab (i32,
+///   `-1` = workbook scope) + cch (u32) + cch x UTF-16LE name +
+///   cce (u32) + cce bytes rgce + cb (u32) + cb bytes rgcb.
+/// `formula` is the name's own bare expression text (no leading `=`,
+/// matching `<definedName>`'s XML text content); an empty string emits
+/// a zero-length `rgce` (the hidden future-function / LET-parameter
+/// placeholders this writer registers carry no real formula body — real
+/// Excel stores a `#NAME?` placeholder there, which is not required for
+/// this writer's own reader to round-trip the name table).
+Expected<void, Error> EmitName(std::vector<std::uint8_t>& body, const std::string& name, std::string_view formula,
+                               std::int32_t itab, bool hidden, bool calc_exp, std::string_view comment,
+                               const std::vector<std::string>& sheet_names, const SheetRangeTable& sheet_ranges,
+                               const NameTable& name_table) {
+  // Names carrying Excel's hidden storage prefixes are not ordinary
+  // defined names: `_xlfn.<FN>` registers a post-2007 "future function"
+  // and `_xlpm.<param>` a LET / LAMBDA parameter. Real Excel stores each
+  // with a specific flag word (fHidden | fFunc | fFutureFunction for the
+  // former, the proc-parameter flags for the latter), a PtgErr(#NAME?)
+  // placeholder body, and five trailing null strings. A cell's future-
+  // function call resolves through the matching BrtName's ilbl, so these
+  // flags and the placeholder body must match Excel byte-for-byte or the
+  // callee shows up as #NAME? on load. A prefixed name Excel does not know
+  // (`_xlfn.FOOBAR`) is an ordinary undefined-name stub instead (measured).
+  const bool is_param = name.rfind("_xlpm.", 0) == 0;
+  std::string_view callee(name);
+  const bool xlfn = callee.rfind("_xlfn.", 0) == 0;
+  callee.remove_prefix(xlfn ? 6U : 0U);
+  if (callee.rfind("_xlws.", 0) == 0) {
+    callee.remove_prefix(6U);
+  }
+  const bool is_future_fn = xlfn && has_storage_prefix(callee);
+  const bool is_placeholder = is_param || is_future_fn;
+  std::uint32_t flags;
+  if (is_param) {
+    flags = 0x00020019U;
+  } else if (is_future_fn) {
+    flags = 0x0002000bU;
+  } else {
+    flags = hidden ? 0x00000001U : 0x00000000U;
+  }
+  std::vector<std::uint8_t> p;
+  emit_u32(p, flags);  // grbit (flags word)
+  emit_u8(p, 0);       // chKey
+  emit_u32(p, static_cast<std::uint32_t>(itab));
+  emit_xlwidestring(p, name);
+  if (is_placeholder) {
+    emit_u32(p, 2);    // cce
+    emit_u8(p, 0x1C);  // PtgErr
+    emit_u8(p, 0x1D);  // #NAME? error code
+    emit_u32(p, 0);    // cb
+  } else if (formula.empty()) {
+    emit_u32(p, 0);  // cce
+    emit_u32(p, 0);  // cb
+  } else {
+    Arena arena;
+    parser::Parser parser(formula, arena);
+    parser::AstNode* root = parser.parse();
+    if (root == nullptr || !parser.errors().empty()) {
+      return make_error(FormulonErrorCode::kIoXlsbUnsupportedPtg,
+                        "xlsb writer: defined-name formula failed to parse for Ptg encoding",
+                        std::string("context=xlsb_writer name=") + name);
+    }
+    if (calc_exp) {
+      p[0] |= 0x10U;  // fCalcExp (grbit bit 4)
+    }
+    // Measured: a defined-name body's root reference stays reference class.
+    auto encoded_or = encode_ptgs(*root, sheet_names, sheet_ranges, name_table, PtgRootClass::kReference);
+    if (!encoded_or) {
+      return encoded_or.error();
+    }
+    const EncodedFormula& encoded = encoded_or.value();
+    emit_u32(p, static_cast<std::uint32_t>(encoded.rgce.size()));
+    p.insert(p.end(), encoded.rgce.begin(), encoded.rgce.end());
+    emit_u32(p, static_cast<std::uint32_t>(encoded.rgcb.size()));
+    p.insert(p.end(), encoded.rgcb.begin(), encoded.rgcb.end());
+  }
+  // Trailing BrtName strings ([MS-XLSB] §2.4.649). Excel rejects a
+  // BrtName that stops after the formula. A plain defined name carries
+  // just the comment (a null `XLNullableWideString` when absent, matching
+  // Excel's own encoding for a name whose Name Manager "Comment" field
+  // was never set -- not a zero-length string); a future-function /
+  // proc-parameter placeholder carries five strings (comment plus four
+  // further unused strings, always null -- these are internal storage
+  // artifacts with no Name Manager entry a comment could attach to),
+  // matching real Excel output.
+  if (is_placeholder) {
+    for (int i = 0; i < 5; ++i) {
+      emit_u32(p, 0xFFFFFFFFU);  // null XLNullableWideString
+    }
+  } else {
+    emit_xlnullablewidestring(p, comment.empty() ? std::nullopt : std::make_optional(comment));
+  }
+  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtName), p);
+  return Expected<void, Error>::Ok();
+}
+
+}  // namespace
+
+// ---------------------------------------------------------------------------
+// Workbook stream (xl/workbook.bin)
+// ---------------------------------------------------------------------------
+
+Expected<std::vector<std::uint8_t>, Error> BuildWorkbookBin(const Workbook& wb,
+                                                            const std::vector<OrderedName>& ordered_names,
+                                                            const SheetRangeTable& sheet_ranges,
+                                                            const std::vector<std::string>& sheet_names) {
+  std::vector<std::uint8_t> body;
+  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtBeginBook), ByteSpan{});
+
+  // Workbook globals Excel expects before the sheet bundle. These are
+  // fixed-shape records with no dependency on workbook content, so we emit
+  // known-valid default payloads (byte layout captured from a real Excel 365
+  // `xl/workbook.bin`):
+  //   * BrtFileVersion : appName "xl", lastEdited/lowestEdited "7", build.
+  //   * BrtWbProp      : default flags + defaultThemeVersion 202300.
+  //   * BrtWbView      : a single window view; itabCur (offset 24, u32) is
+  //                      patched below to the tab-selected sheet.
+  // Omitting these produced a workbook stream Excel rejected.
+  static const std::vector<std::uint8_t> kFileVersionPayload = {
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+      0x00, 0x00, 0x00, 0x78, 0x00, 0x6c, 0x00, 0x01, 0x00, 0x00, 0x00, 0x37, 0x00, 0x01, 0x00, 0x00, 0x00,
+      0x37, 0x00, 0x05, 0x00, 0x00, 0x00, 0x31, 0x00, 0x30, 0x00, 0x36, 0x00, 0x32, 0x00, 0x38, 0x00};
+  static const std::vector<std::uint8_t> kDefaultWbPropPayload = {0x20, 0x00, 0x01, 0x00, 0x3c, 0x16,
+                                                                  0x03, 0x00, 0x00, 0x00, 0x00, 0x00};
+  static const std::vector<std::uint8_t> kWbViewPayload = {0x10, 0x4f, 0x00, 0x00, 0x18, 0x15, 0x00, 0x00, 0x8c, 0x6e,
+                                                           0x00, 0x00, 0xd0, 0x43, 0x00, 0x00, 0x58, 0x02, 0x00, 0x00,
+                                                           0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x78};
+  emit_record(body, kBrtFileVersion, kFileVersionPayload);
+  std::vector<std::uint8_t> wb_prop_payload = kDefaultWbPropPayload;
+  // BrtWbProp ([MS-XLSB] §2.4.866): f1904 is bit 0 of the leading
+  // little-endian u32 grbit. Preserve Excel's captured default flags.
+  if (wb.date1904()) {
+    wb_prop_payload[0] |= 0x01U;
+  }
+  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtWbProp), wb_prop_payload);
+  // Excel places the protection records between BrtWbProp and the views.
+  if (auto protection = emit_book_protection(body, wb.workbook_protection_xml()); !protection) {
+    return protection.error();
+  }
+  emit_record(body, kBrtBeginBookViews, ByteSpan{});
+  // itabCur (u32 at offset 24): measured to equal the tab-selected sheet's
+  // index in every fixture; a mismatch made Excel show every tab selected.
+  std::vector<std::uint8_t> wb_view_payload = kWbViewPayload;
+  std::uint32_t itab_cur = 0U;
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    if (wb.sheet(i).view().tab_selected) {
+      itab_cur = static_cast<std::uint32_t>(i);
+      break;
+    }
+  }
+  wb_view_payload[24] = static_cast<std::uint8_t>(itab_cur & 0xFFU);
+  wb_view_payload[25] = static_cast<std::uint8_t>((itab_cur >> 8) & 0xFFU);
+  wb_view_payload[26] = static_cast<std::uint8_t>((itab_cur >> 16) & 0xFFU);
+  wb_view_payload[27] = static_cast<std::uint8_t>((itab_cur >> 24) & 0xFFU);
+  emit_record(body, kBrtWbView, wb_view_payload);
+  emit_record(body, kBrtEndBookViews, ByteSpan{});
+
+  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtBeginBundleShs), ByteSpan{});
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    // BrtBundleSh ([MS-XLSB] §2.4.304):
+    //   hsState    : u32 (0 = visible, 1 = hidden, 2 = very hidden)
+    //   iTabID     : u32 (sheet id; 1-based)
+    //   strRelID   : XLNullableWideString
+    //   strName    : XLWideString
+    std::vector<std::uint8_t> p;
+    // `SheetVisibility` is numbered to match `hsState`, so the model state
+    // is the field value.
+    const auto hs_state = static_cast<std::uint32_t>(wb.sheet(i).view().visibility());
+    emit_u32(p, hs_state);                            // hsState
+    emit_u32(p, static_cast<std::uint32_t>(i + 1U));  // iTabID
+    const std::string rid = std::string("rId") + std::to_string(i + 1U);
+    emit_xlnullablewidestring(p, std::optional<std::string_view>{rid});
+    emit_xlwidestring(p, wb.sheet(i).name());
+    emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtBundleSh), p);
+  }
+  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtEndBundleShs), ByteSpan{});
+
+  // BrtExternSheet: every distinct sheet-qualified reference span this
+  // workbook's formulas need an `ixti` for (single- and multi-sheet
+  // alike; see `BuildSheetRangeTable`'s doc comment for why both share
+  // this one table). Omitted entirely when no formula uses a qualified
+  // reference, matching the fallback the reader's `sheet_for_ixti` /
+  // `sheet_range_for_ixti` already implement for that case.
+  //
+  // The record MUST be wrapped in the externals block: a bare
+  // `BrtExternSheet` outside `BrtBeginExternals ... BrtEndExternals` is an
+  // out-of-place record that makes Excel reject the package. A workbook that
+  // only references its own sheets still needs a single `BrtSupSelf`
+  // supporting-book entry inside the block.
+  if (!sheet_ranges.empty()) {
+    emit_record(body, kBrtBeginExternals, ByteSpan{});
+    emit_record(body, kBrtSupSelf, ByteSpan{});
+    EmitExternSheet(body, sheet_ranges);
+    emit_record(body, kBrtEndExternals, ByteSpan{});
+  }
+
+  // BrtName table: every genuine defined name (hidden per its own OOXML
+  // `hidden` flag) followed by every future-function callee / defined
+  // name `collect_ptg_names` needed a `PtgName` reference for that
+  // wasn't already a defined name (the `_xlfn.` / `_xlpm.` records
+  // hidden, a stub for an undefined name not). `ordered_names` is built once by `BuildOrderedNames`
+  // and shared with every sheet's cell encoder so `ilbl` assignments
+  // stay consistent workbook-wide. The leading `defined_count` slots are
+  // `wb.defined_names()` element-for-element, so every defined name
+  // emits exactly one record at the `ilbl` the encoder assigned it.
+  //
+  // A name's own formula resolves other names from the scope the name
+  // itself lives in, the same rule a cell formula follows, so each entry
+  // encodes against a table built for its `local_sheet_id`. The tables
+  // are memoized per scope: workbooks routinely carry many names in the
+  // same scope and each table is a full pass over the name list.
+  const std::size_t defined_count = wb.defined_names().size();
+  std::unordered_map<std::int32_t, NameTable> scoped_tables;
+  auto table_for_scope = [&](std::int32_t scope_sheet_id) -> const NameTable& {
+    auto it = scoped_tables.find(scope_sheet_id);
+    if (it == scoped_tables.end()) {
+      it = scoped_tables.emplace(scope_sheet_id, BuildNameTableForScope(wb, ordered_names, scope_sheet_id)).first;
+    }
+    return it->second;
+  };
+  const std::vector<NameShape> shapes = defined_name_shapes(wb);
+  for (std::size_t i = 0; i < ordered_names.size(); ++i) {
+    if (i < defined_count) {
+      const DefinedName& dn = wb.defined_names()[i];
+      if (auto r = EmitName(body, dn.name, dn.formula, dn.local_sheet_id, dn.hidden, shapes[i].calc_exp, dn.comment,
+                            sheet_names, sheet_ranges, table_for_scope(dn.local_sheet_id));
+          !r) {
+        return r.error();
+      }
+    } else {
+      // Placeholders carry no formula body, so the table they are handed is
+      // never consulted; the workbook-scope one keeps the call uniform. A
+      // stub for an undefined name is not hidden, as Excel saves it.
+      const OrderedName& slot = ordered_names[i];
+      if (auto r = EmitName(body, slot.name, /*formula=*/{}, slot.itab, /*hidden=*/false, /*calc_exp=*/false,
+                            /*comment=*/{}, sheet_names, sheet_ranges, table_for_scope(-1));
+          !r) {
+        return r.error();
+      }
+    }
+  }
+
+  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtEndBook), ByteSpan{});
+  return body;
+}
+
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/src/io/xlsb/workbook_bin_writer.h b/src/io/xlsb/workbook_bin_writer.h
new file mode 100644
index 000000000..06056f8a0
--- /dev/null
+++ b/src/io/xlsb/workbook_bin_writer.h
@@ -0,0 +1,53 @@
+//
+// Writer of the `xl/workbook.bin` stream: workbook globals, the sheet
+// bundle, the `BrtExternSheet` table and the `BrtName` table. The name and
+// sheet-range tables are built once per workbook and shared with every
+// sheet's cell encoder so `ilbl` / `ixti` assignments stay consistent.
+
+#ifndef FORMULON_IO_XLSB_WORKBOOK_BIN_WRITER_H_
+#define FORMULON_IO_XLSB_WORKBOOK_BIN_WRITER_H_
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "io/xlsb/ptg_writer.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+
+/// One `BrtName` slot: the record's name and scope (`-1`: workbook, else
+/// the 0-based sheet a stub is scoped to). Defined-name slots carry their
+/// text only; their scope is read from `Workbook::defined_names()`.
+struct OrderedName {
+  std::string name;
+  std::int32_t itab = -1;
+};
+
+/// Builds the workbook's `BrtName` record order (defined names first, then
+/// placeholders and stubs).
+void BuildOrderedNames(const Workbook& wb, std::vector<OrderedName>& ordered_names);
+
+/// Builds the `name -> ilbl` map `encode_ptgs` consults for a formula that
+/// lives in `scope_sheet_id` (`-1` for a workbook-scoped defined name).
+NameTable BuildNameTableForScope(const Workbook& wb, const std::vector<OrderedName>& ordered_names,
+                                 std::int32_t scope_sheet_id);
+
+/// Builds the `BrtExternSheet` table for the whole workbook.
+Expected<SheetRangeTable, Error> BuildSheetRangeTable(const Workbook& wb, const std::vector<std::string>& sheet_names);
+
+/// Emits the whole `xl/workbook.bin` record stream.
+Expected<std::vector<std::uint8_t>, Error> BuildWorkbookBin(const Workbook& wb,
+                                                            const std::vector<OrderedName>& ordered_names,
+                                                            const SheetRangeTable& sheet_ranges,
+                                                            const std::vector<std::string>& sheet_names);
+
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
+
+#endif  // FORMULON_IO_XLSB_WORKBOOK_BIN_WRITER_H_
diff --git a/src/io/xlsb/writer.cpp b/src/io/xlsb/writer.cpp
index 8379edc2c..5101aedc7 100644
--- a/src/io/xlsb/writer.cpp
+++ b/src/io/xlsb/writer.cpp
@@ -11,7 +11,6 @@
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
-#include <cstring>
 #include <limits>
 #include <optional>
 #include <string>
@@ -29,9 +28,12 @@
 #include "io/future_functions.h"
 #include "io/ooxml/package_validator.h"
 #include "io/ooxml/relationship_writer.h"
+#include "io/ooxml/workbook_xml_builder.h"
 #include "io/ooxml/zip_part_writer.h"
+#include "io/ooxml_defs.h"
 #include "io/xlsb/metadata_bin.h"
 #include "io/xlsb/protection_records.h"
+#include "io/xlsb/ptg_targets.h"
 #include "io/xlsb/ptg_writer.h"
 #include "io/xlsb/record.h"
 #include "io/xlsb/record_writer.h"
@@ -39,6 +41,7 @@
 #include "io/xlsb/sheet_writer.h"
 #include "io/xlsb/sst_writer.h"
 #include "io/xlsb/styles_writer.h"
+#include "io/xlsb/workbook_bin_writer.h"
 #include "io/xml_escape.h"
 #include "miniz.h"
 #include "parser/ast.h"
@@ -82,44 +85,6 @@ constexpr std::string_view kCtSharedStringsXlsb = "application/vnd.ms-excel.shar
 constexpr std::string_view kCtStylesXlsb = "application/vnd.ms-excel.styles";
 constexpr std::string_view kCtSheetMetadataXlsb = "application/vnd.ms-excel.sheetMetadata";
 
-constexpr std::string_view kRelOfficeDocument =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument";
-constexpr std::string_view kRelWorksheet =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet";
-constexpr std::string_view kRelSharedStrings =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings";
-constexpr std::string_view kRelStyles = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles";
-constexpr std::string_view kRelTheme = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme";
-constexpr std::string_view kRelHyperlink =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink";
-constexpr std::string_view kRelSheetMetadata =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata";
-constexpr std::string_view kRelCoreProps =
-    "http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties";
-constexpr std::string_view kRelExtendedProps =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties";
-constexpr std::string_view kRelCustomProps =
-    "http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties";
-
-// Workbook-globals record ids the reader does not consume (so they are absent
-// from `XlsbRecordType`) but the writer must emit for a well-formed stream.
-// A `BrtExternSheet` must live inside a `BrtBeginExternals ... BrtEndExternals`
-// block with a `BrtSupSelf` (self-referencing supporting book); Excel rejects a
-// bare `BrtExternSheet`. Ids per [MS-XLSB] §2.4.
-constexpr std::uint16_t kBrtBeginExternals = 353;
-constexpr std::uint16_t kBrtSupSelf = 357;
-constexpr std::uint16_t kBrtEndExternals = 354;
-// Workbook-globals structural records Excel expects before the sheet bundle.
-constexpr std::uint16_t kBrtFileVersion = 128;
-constexpr std::uint16_t kBrtBeginBookViews = 135;
-constexpr std::uint16_t kBrtWbView = 158;
-constexpr std::uint16_t kBrtEndBookViews = 136;
-// Opens a future-record block in a sheet tail (x14 extensions).
-constexpr std::uint16_t kBrtFrtBegin = 35;
-// `BrtExternSheet` sheet index of the sheetless entry a book-scope
-// `PtgNameX` resolves through.
-constexpr std::int32_t kXtiNoSheet = -2;
-
 // ---------------------------------------------------------------------------
 // Emission plan: where do passthrough parts land, do any collide?
 // ---------------------------------------------------------------------------
@@ -219,8 +184,12 @@ std::uint32_t ReportDeferredSheetFeatures(const Workbook& workbook) {
   const bool pivots_survive_via_passthrough = HasPivotPassthroughPart(workbook);
   for (std::size_t i = 0; i < workbook.sheet_count(); ++i) {
     const Sheet& sheet = workbook.sheet(i);
-    ReportDeferred(&count, "auto_filter", sheet.auto_filter_xml().empty() ? 0U : 1U, i);
+    ReportDeferred(&count, "auto_filter", sheet.has_auto_filter() ? 1U : 0U, i);
     ReportDeferred(&count, "comments", sheet.comments().size(), i);
+    ReportDeferred(&count, "threaded_comments", sheet.threaded_comments().size(), i);
+    // A drawing read from (or inserted into) an OOXML package has no
+    // binary relationship here; only `.xlsb`-retained drawings survive.
+    ReportDeferred(&count, "drawings", sheet.drawing_rel_target().empty() ? 0U : 1U, i);
     ReportDeferred(&count, "pivot_tables", pivots_survive_via_passthrough ? 0U : sheet.pivot_tables().size(), i);
     const SheetPrintSettings& print = sheet.print_settings();
     const bool has_print = !print.sheet_pr_xml.empty() || !print.page_margins_xml.empty() ||
@@ -581,70 +550,6 @@ std::string BuildContentTypes(const Workbook& wb, const EmissionPlan& plan) {
   return out;
 }
 
-// Appends one `<Relationship>` with a fresh rId drawn from `*next_rid`.
-void AppendRelationship(std::string& out, std::size_t* next_rid, std::string_view type, std::string_view target,
-                        bool target_external = false) {
-  out.append("  <Relationship Id=\"rId");
-  out.append(std::to_string((*next_rid)++));
-  out.append("\" Type=\"");
-  AppendXmlAttrEscaped(out, type);
-  out.append("\" Target=\"");
-  // `Target` is an `xsd:anyURI` the rels reader takes verbatim from the
-  // parser, so it gets the attribute rule and no OOXML escaping.
-  AppendXmlAttrEscaped(out, target);
-  if (target_external) {
-    out.append("\" TargetMode=\"External\"/>\n");
-  } else {
-    out.append("\"/>\n");
-  }
-}
-
-// Returns true when a passthrough part with `path` will be emitted.
-bool HasPassthrough(const EmissionPlan& plan, std::string_view path) {
-  for (const PassthroughPart* part : plan.passthrough_kept) {
-    if (part->path == path) {
-      return true;
-    }
-  }
-  return false;
-}
-
-std::string BuildPackageRels(const Workbook& wb, const EmissionPlan& plan, WriteDiagnostics* diagnostics) {
-  std::string out;
-  out.reserve(384);
-  out.append(kXmlDecl);
-  out.append("<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n");
-  std::size_t next_rid = 1;
-  AppendRelationship(out, &next_rid, kRelOfficeDocument, "xl/workbook.bin");
-  // docProps parts ride the passthrough path but need package-level rels or
-  // Excel treats them as orphaned (and drops the document properties).
-  if (HasPassthrough(plan, "docProps/core.xml")) {
-    AppendRelationship(out, &next_rid, kRelCoreProps, "docProps/core.xml");
-  }
-  if (HasPassthrough(plan, "docProps/app.xml")) {
-    AppendRelationship(out, &next_rid, kRelExtendedProps, "docProps/app.xml");
-  }
-  if (HasPassthrough(plan, "docProps/custom.xml")) {
-    AppendRelationship(out, &next_rid, kRelCustomProps, "docProps/custom.xml");
-  }
-  for (const UnknownRelationship& r : wb.unknown_package_rels()) {
-    if (!r.target_external && !HasPassthrough(plan, r.target)) {
-      StructuredLog("xlsb.writer.package_rel_skipped")
-          .field("reason", std::string_view("target_part_absent"))
-          .field("type", r.type)
-          .field("target", r.target)
-          .warn();
-      if (diagnostics != nullptr) {
-        ++diagnostics->dropped_relationship_count;
-      }
-      continue;
-    }
-    AppendRelationship(out, &next_rid, r.type, r.target, r.target_external);
-  }
-  out.append("</Relationships>\n");
-  return out;
-}
-
 // Builds `xl/worksheets/_rels/sheet<N>.bin.rels`, or an empty string when the
 // sheet has nothing to relate to.
 //
@@ -656,7 +561,7 @@ std::string BuildPackageRels(const Workbook& wb, const EmissionPlan& plan, Write
 std::string BuildSheetRels(const Sheet& sheet, const EmissionPlan& plan, WriteDiagnostics* diagnostics) {
   std::string entries;
   for (const UnknownRelationship& rel : sheet.unknown_relationships()) {
-    if (!rel.target_external && !HasPassthrough(plan, rel.target)) {
+    if (!rel.target_external && !HasPassthroughPart(plan.passthrough_kept, rel.target)) {
       StructuredLog("xlsb.writer.sheet_rel_skipped")
           .field("reason", std::string_view("target_part_absent"))
           .field("type", rel.type)
@@ -720,7 +625,7 @@ std::string BuildWorkbookRels(std::size_t sheet_count, bool emit_sst, const Emis
   out.reserve(256 + sheet_count * 192 + wb.unknown_workbook_rels().size() * 192);
   out.append(kXmlDecl);
   out.append("<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n");
-  std::size_t next_rid = 1;
+  std::uint32_t next_rid = 1;
   for (std::size_t i = 0; i < sheet_count; ++i) {
     out.append("  <Relationship Id=\"rId");
     out.append(std::to_string(next_rid++));
@@ -731,21 +636,24 @@ std::string BuildWorkbookRels(std::size_t sheet_count, bool emit_sst, const Emis
     out.append(".bin\"/>\n");
   }
   if (emit_sst) {
-    AppendRelationship(out, &next_rid, kRelSharedStrings, "sharedStrings.bin");
+    AppendRelationship(out, next_rid++, kRelSharedStrings, "sharedStrings.bin", /*target_external=*/false,
+                       /*escape_target=*/true);
   }
   // The styles / theme / metadata parts ride the passthrough path, but the
   // reader (and Excel) locate them only through these workbook relationships.
   // Without them a styled cell's iStyleRef dangles against an empty style
   // table, and the theme / metadata parts are treated as orphans. Emit a rel
   // for each part that is actually present in the package.
-  if (plan.has_generated_styles || HasPassthrough(plan, "xl/styles.bin")) {
-    AppendRelationship(out, &next_rid, kRelStyles, "styles.bin");
+  if (plan.has_generated_styles || HasPassthroughPart(plan.passthrough_kept, "xl/styles.bin")) {
+    AppendRelationship(out, next_rid++, kRelStyles, "styles.bin", /*target_external=*/false, /*escape_target=*/true);
   }
-  if (HasPassthrough(plan, "xl/theme/theme1.xml")) {
-    AppendRelationship(out, &next_rid, kRelTheme, "theme/theme1.xml");
+  if (HasPassthroughPart(plan.passthrough_kept, "xl/theme/theme1.xml")) {
+    AppendRelationship(out, next_rid++, kRelTheme, "theme/theme1.xml", /*target_external=*/false,
+                       /*escape_target=*/true);
   }
-  if (plan.has_generated_dynamic_metadata || HasPassthrough(plan, "xl/metadata.bin")) {
-    AppendRelationship(out, &next_rid, kRelSheetMetadata, "metadata.bin");
+  if (plan.has_generated_dynamic_metadata || HasPassthroughPart(plan.passthrough_kept, "xl/metadata.bin")) {
+    AppendRelationship(out, next_rid++, kRelSheetMetadata, "metadata.bin", /*target_external=*/false,
+                       /*escape_target=*/true);
   }
   // Preserve relationships to raw XLSB parts that the reader does not model
   // (drawings, VBA, custom XML, etc.).  Internal targets are stored as
@@ -753,7 +661,7 @@ std::string BuildWorkbookRels(std::size_t sheet_count, bool emit_sst, const Emis
   // `xl/`.  Do not duplicate relationships which the generated package
   // already owns above.
   for (const UnknownRelationship& rel : wb.unknown_workbook_rels()) {
-    if (!rel.target_external && !HasPassthrough(plan, rel.target)) {
+    if (!rel.target_external && !HasPassthroughPart(plan.passthrough_kept, rel.target)) {
       StructuredLog("xlsb.writer.workbook_rel_skipped")
           .field("reason", std::string_view("target_part_absent"))
           .field("type", rel.type)
@@ -768,623 +676,13 @@ std::string BuildWorkbookRels(std::size_t sheet_count, bool emit_sst, const Emis
                                  (rel.type == kRelSheetMetadata && rel.target == "xl/metadata.bin"))) {
       continue;
     }
-    const std::string target = rel.target_external ? rel.target : std::string(WithoutXlPrefix(rel.target));
-    AppendRelationship(out, &next_rid, rel.type, target, rel.target_external);
+    const std::string target = rel.target_external ? rel.target : TargetRelativeToWorkbook(rel.target);
+    AppendRelationship(out, next_rid++, rel.type, target, rel.target_external, /*escape_target=*/true);
   }
   out.append("</Relationships>\n");
   return out;
 }
 
-// ---------------------------------------------------------------------------
-// PtgName table (BrtName): defined names + future-function callees
-// ---------------------------------------------------------------------------
-
-/// One `BrtName` slot: the record's name and scope (`-1`: workbook, else
-/// the 0-based sheet a stub is scoped to). Defined-name slots carry their
-/// text only; their scope is read from `Workbook::defined_names()`.
-struct OrderedName {
-  std::string name;
-  std::int32_t itab = -1;
-};
-
-/// Parses `formula` (with or without a leading `=`) and folds every name
-/// `collect_ptg_names` finds into `names` / `seen`. Parse failures are
-/// silently skipped here — `EncodeCellFormula` / the defined-name
-/// encode pass below surface the same failure as a proper `Expected`
-/// error when the formula is actually encoded.
-///
-/// `scope_sheet_id` is the scope the formula resolves names from (see
-/// `BuildNameTableForScope`). Every referenced text defined only as the
-/// local name of sheets other than that scope is added to `invisible`:
-/// Excel resolves such a reference to `#NAME?`, so it needs a
-/// workbook-scope record of its own rather than an ordinal borrowed from
-/// another sheet's definition, which would read back as that sheet's
-/// qualified name. Every sheet-qualified reference is appended to
-/// `qualified` as `(sheet, name)`.
-void CollectNamesFromFormula(std::string_view formula, std::int32_t scope_sheet_id,
-                             const std::unordered_map<std::string, std::vector<std::int32_t>>& defined_scopes,
-                             std::vector<std::string>& names, std::unordered_set<std::string>& seen,
-                             std::vector<std::string>& invisible, std::unordered_set<std::string>& invisible_seen,
-                             std::vector<std::pair<std::string, std::string>>& qualified) {
-  if (!formula.empty() && formula.front() == '=') {
-    formula.remove_prefix(1);
-  }
-  Arena arena;
-  parser::Parser p(formula, arena);
-  parser::AstNode* root = p.parse();
-  if (root == nullptr || !p.errors().empty()) {
-    return;
-  }
-  collect_ptg_names(*root, names, seen);
-  collect_sheet_qualified_names(*root, qualified);
-  std::vector<std::string> referenced;
-  std::unordered_set<std::string> referenced_seen;
-  collect_scope_resolved_names(*root, referenced, referenced_seen);
-  for (std::string& text : referenced) {
-    const auto it = defined_scopes.find(text);
-    if (it == defined_scopes.end()) {
-      continue;
-    }
-    const std::vector<std::int32_t>& scopes = it->second;
-    const bool visible = std::any_of(scopes.begin(), scopes.end(),
-                                     [scope_sheet_id](std::int32_t s) { return s < 0 || s == scope_sheet_id; });
-    if (!visible && invisible_seen.insert(text).second) {
-      invisible.push_back(std::move(text));
-    }
-  }
-}
-
-/// Calls `visit` with the text (no leading `=`) of every formula a sheet
-/// part carries: cell formulas, conditional-format rule and threshold
-/// formulas, and data-validation formulas. The name and ExternSheet tables
-/// are both built over this one walk, so every formula the sheet writer
-/// encodes finds its entries.
-template <typename Visit>
-void ForEachSheetFormula(const Sheet& sheet, Visit&& visit) {
-  for (const auto& [row, cells] : sheet.rows()) {
-    (void)row;
-    for (const Cell& cell : cells) {
-      std::string_view body(cell.formula_text);
-      if (!body.empty() && body.front() == '=') {
-        body.remove_prefix(1);
-      }
-      if (!body.empty()) {
-        visit(body);
-      }
-    }
-  }
-  const auto visit_text = [&visit](const std::string& text) {
-    if (!text.empty()) {
-      visit(std::string_view(text));
-    }
-  };
-  const auto visit_cfvo = [&visit_text](const cf::CfValueObject& v) {
-    if (v.type == cf::CfvoType::Formula) {
-      visit_text(v.value);
-    }
-  };
-  for (const cf::ConditionalFormat& format : sheet.conditional_formats()) {
-    for (const cf::CFRule& rule : format.rules) {
-      visit_text(rule.formula1.value_or(std::string()));
-      visit_text(rule.formula2.value_or(std::string()));
-      if (rule.color_scale) {
-        std::for_each(rule.color_scale->thresholds.begin(), rule.color_scale->thresholds.end(), visit_cfvo);
-      }
-      if (rule.data_bar) {
-        visit_cfvo(rule.data_bar->min);
-        visit_cfvo(rule.data_bar->max);
-      }
-      if (rule.icon_set) {
-        std::for_each(rule.icon_set->thresholds.begin(), rule.icon_set->thresholds.end(), visit_cfvo);
-      }
-    }
-  }
-  for (const DataValidation& dv : sheet.validations()) {
-    visit_text(dv.formula1);
-    visit_text(dv.formula2);
-  }
-}
-
-/// Builds the workbook's `BrtName` record order: every genuine defined
-/// name (`Workbook::defined_names()`, in declaration order) occupies the
-/// leading slots, followed by every future-function callee / `NameRef`
-/// `collect_ptg_names` discovers across defined-name and sheet formulas
-/// (in first-encounter order) that is not already a defined name, then a
-/// workbook-scope placeholder for each name referenced where none of its
-/// definitions is visible, then an empty stub scoped to `S` for each
-/// `S!Name` that neither `S` nor the workbook defines, as Excel 365 saves
-/// it. Slot `i` is the record a `PtgName` reaches with `ilbl == i + 1`.
-///
-/// Defined names take one slot each, duplicate name text included:
-/// `Workbook::set_defined_name_scoped` deliberately admits a
-/// workbook-scoped and a sheet-local name spelling the same text, and
-/// each needs its own `BrtName` record for the emission pass (which
-/// walks `wb.defined_names()` by the same index) to stay aligned with
-/// the `ilbl` values encoded into formulas.
-void BuildOrderedNames(const Workbook& wb, std::vector<OrderedName>& ordered_names) {
-  std::vector<std::string> names;
-  std::unordered_set<std::string> seen;
-  std::vector<std::string> invisible;
-  std::unordered_set<std::string> invisible_seen;
-  std::vector<std::pair<std::string, std::string>> qualified;
-  std::unordered_map<std::string, std::vector<std::int32_t>> defined_scopes;
-  std::unordered_set<std::string> scoped_keys;
-  for (const DefinedName& dn : wb.defined_names()) {
-    names.push_back(dn.name);
-    seen.insert(dn.name);
-    defined_scopes[dn.name].push_back(dn.local_sheet_id);
-    scoped_keys.insert(sheet_scoped_name_key(dn.local_sheet_id, dn.name));
-  }
-  for (const DefinedName& dn : wb.defined_names()) {
-    CollectNamesFromFormula(dn.formula, dn.local_sheet_id, defined_scopes, names, seen, invisible, invisible_seen,
-                            qualified);
-  }
-  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
-    ForEachSheetFormula(wb.sheet(i), [&](std::string_view formula) {
-      CollectNamesFromFormula(formula, static_cast<std::int32_t>(i), defined_scopes, names, seen, invisible,
-                              invisible_seen, qualified);
-    });
-  }
-  for (std::string& text : names) {
-    ordered_names.push_back(OrderedName{std::move(text), -1});
-  }
-  for (std::string& text : invisible) {
-    ordered_names.push_back(OrderedName{std::move(text), -1});
-  }
-  for (auto& [sheet, name] : qualified) {
-    const std::size_t itab = wb.sheet_index_by_name(sheet);
-    if (itab >= wb.sheet_count()) {
-      continue;  // The encoder reports the unknown sheet.
-    }
-    const auto scope = static_cast<std::int32_t>(itab);
-    if (scoped_keys.count(sheet_scoped_name_key(-1, name)) == 0 &&
-        scoped_keys.insert(sheet_scoped_name_key(scope, name)).second) {
-      ordered_names.push_back(OrderedName{std::move(name), scope});
-    }
-  }
-}
-
-/// Builds the `name -> ilbl` map `encode_ptgs` consults for a formula
-/// that lives in `scope_sheet_id` (a 0-based sheet index for a cell
-/// formula or a sheet-local defined name, `-1` for a workbook-scoped
-/// defined name).
-///
-/// A `PtgName` token carries no scope of its own — it is a bare ordinal
-/// into the `BrtName` table — so the scope has to be resolved here, at
-/// encode time, exactly as Excel resolves it when reading the file back:
-/// a sheet-local name shadows a workbook-scoped one of the same text for
-/// formulas on that sheet, and the workbook-scoped name is reached only
-/// where no local one exists. Encoding a single workbook-wide ordinal
-/// per name text would silently re-point one of the two.
-///
-/// The three passes are layered by precedence and rely on `emplace`
-/// leaving an entry that is already present alone:
-///   1. names local to `scope_sheet_id`, stubs included — these shadow
-///      everything;
-///   2. workbook-scoped names, filling any text no local one claimed;
-///   3. every placeholder slot, then every remaining defined slot. The
-///      placeholders are the hidden `_xlfn.*` / `_xlpm.*` names (which
-///      have no scope), undefined names, and the workbook-scope record
-///      `BuildOrderedNames` adds for a text that exists only as another
-///      sheet's local name: that reference is `#NAME?` in Excel, and
-///      reaching the other sheet's record instead would read back as
-///      that sheet's qualified name.
-NameTable BuildNameTableForScope(const Workbook& wb, const std::vector<OrderedName>& ordered_names,
-                                 std::int32_t scope_sheet_id) {
-  const std::vector<DefinedName>& defined = wb.defined_names();
-  const std::size_t defined_count = std::min(defined.size(), ordered_names.size());
-  NameTable name_table;
-  name_table.reserve(ordered_names.size());
-  if (scope_sheet_id >= 0) {
-    for (std::size_t i = 0; i < defined_count; ++i) {
-      if (defined[i].local_sheet_id == scope_sheet_id) {
-        name_table.emplace(defined[i].name, static_cast<std::uint32_t>(i + 1));
-      }
-    }
-    // A stub scoped to this sheet is its local name too: Excel resolves a
-    // bare `NOSUCH(1)` on Sheet1 to the stub `Sheet1!NOSUCH` created there.
-    for (std::size_t i = defined_count; i < ordered_names.size(); ++i) {
-      if (ordered_names[i].itab == scope_sheet_id) {
-        name_table.emplace(ordered_names[i].name, static_cast<std::uint32_t>(i + 1));
-      }
-    }
-  }
-  for (std::size_t i = 0; i < defined_count; ++i) {
-    if (defined[i].local_sheet_id < 0) {
-      name_table.emplace(defined[i].name, static_cast<std::uint32_t>(i + 1));
-    }
-  }
-  for (std::size_t i = defined_count; i < ordered_names.size(); ++i) {
-    const OrderedName& slot = ordered_names[i];
-    // A sheet-scoped stub is reachable only through its qualified key.
-    name_table.emplace(slot.itab < 0 ? slot.name : sheet_scoped_name_key(slot.itab, slot.name),
-                       static_cast<std::uint32_t>(i + 1));
-  }
-  for (std::size_t i = 0; i < defined_count; ++i) {
-    name_table.emplace(ordered_names[i].name, static_cast<std::uint32_t>(i + 1));
-  }
-  // Scope-independent keys for sheet-qualified references (`Sheet2!Local`).
-  for (std::size_t i = 0; i < defined_count; ++i) {
-    name_table.emplace(sheet_scoped_name_key(defined[i].local_sheet_id, defined[i].name),
-                       static_cast<std::uint32_t>(i + 1));
-  }
-  return name_table;
-}
-
-// ---------------------------------------------------------------------------
-// ExternSheet table (BrtExternSheet): every sheet-qualified reference's
-// (itabFirst, itabLast) span, single- and multi-sheet alike.
-// ---------------------------------------------------------------------------
-
-/// Parses `formula` (no leading `=`) and folds every distinct
-/// `(itabFirst, itabLast)` span `collect_ptg_sheet_ranges` finds into
-/// `ranges` / `seen`. Parse failures are silently skipped here --
-/// `EncodeCellFormula` surfaces the same failure as a proper `Expected`
-/// error when the formula is actually encoded.
-void CollectSheetRangesFromFormula(std::string_view formula, const std::vector<std::string>& sheet_names,
-                                   SheetRangeTable& ranges, std::unordered_set<std::uint64_t>& seen) {
-  Arena arena;
-  parser::Parser p(formula, arena);
-  parser::AstNode* root = p.parse();
-  if (root == nullptr || !p.errors().empty()) {
-    return;
-  }
-  collect_ptg_sheet_ranges(*root, sheet_names, ranges, seen);
-}
-
-/// True when `records` holds a future-record block (BrtFRTBegin). Such
-/// blocks -- x14 conditional formats and validations -- are the retained
-/// content that carries sheet-qualified formulas.
-bool HoldsFrtBlock(const std::vector<std::uint8_t>& records) {
-  ByteSpan cursor{records.data(), records.size()};
-  while (cursor.size != 0U) {
-    auto rec = read_record(cursor);
-    if (!rec) {
-      return false;
-    }
-    if (rec.value().type == kBrtFrtBegin) {
-      return true;
-    }
-  }
-  return false;
-}
-
-/// The leading entries of the `BrtExternSheet` table: the source
-/// workbook's table, in its `ixti` order, when a retained sheet tail holds
-/// a block that may reference it, so those verbatim indices keep naming
-/// the same sheets. Fails when an entry no longer names a sheet of this
-/// workbook (renamed or removed since load, or another workbook's), since
-/// the retained bytes would then reference the wrong sheet.
-Expected<SheetRangeTable, Error> SeedFromRetainedTails(const Workbook& wb) {
-  SheetRangeTable seed;
-  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
-    const XlsbSheetTail& tail = wb.sheet(i).xlsb_tail();
-    if (tail.extern_sheets.empty() ||
-        !(HoldsFrtBlock(tail.before_merges) || HoldsFrtBlock(tail.after_merges_before_hyperlinks) ||
-          HoldsFrtBlock(tail.after_hyperlinks))) {
-      continue;
-    }
-    for (const XlsbExternSheetEntry& entry : tail.extern_sheets) {
-      if (entry.first.empty() && entry.last.empty() && !entry.unresolved) {
-        seed.emplace_back(kXtiNoSheet, kXtiNoSheet);
-        continue;
-      }
-      const std::size_t first = wb.sheet_index_by_name(entry.first);
-      const std::size_t last = wb.sheet_index_by_name(entry.last);
-      if (entry.unresolved || first >= wb.sheet_count() || last >= wb.sheet_count()) {
-        return make_error(FormulonErrorCode::kIoXlsbRetainedPartStale,
-                          "retained XLSB sheet records reference a sheet this workbook no longer has",
-                          "context=write_xlsb sheet=" + wb.sheet(i).name() + " ref=" + entry.first);
-      }
-      seed.emplace_back(static_cast<std::int32_t>(first), static_cast<std::int32_t>(last));
-    }
-    break;
-  }
-  return seed;
-}
-
-/// Builds the `BrtExternSheet` table for the whole workbook: every
-/// distinct sheet-qualified reference span (single-sheet `(itab, itab)`
-/// or a genuine 3-D range `(itabFirst, itabLast)`) any sheet formula (see
-/// `ForEachSheetFormula`) or defined-name formula needs, in first-encounter order. Every
-/// `PtgRef3d` / `PtgArea3d` token this writer emits -- single- or
-/// multi-sheet alike -- resolves its `ixti` through this one table:
-/// once the workbook emits any `BrtExternSheet` entry, the reader
-/// interprets *every* `ixti` as an index into it rather than a bare
-/// sheet index (see `ptg_reader.cpp`'s `sheet_for_ixti` /
-/// `sheet_range_for_ixti`), so single- and multi-sheet references
-/// cannot use two different numbering schemes in the same file.
-Expected<SheetRangeTable, Error> BuildSheetRangeTable(const Workbook& wb, const std::vector<std::string>& sheet_names) {
-  SheetRangeTable collected;
-  std::unordered_set<std::uint64_t> seen;
-  for (const DefinedName& dn : wb.defined_names()) {
-    CollectSheetRangesFromFormula(dn.formula, sheet_names, collected, seen);
-  }
-  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
-    ForEachSheetFormula(wb.sheet(i), [&](std::string_view formula) {
-      CollectSheetRangesFromFormula(formula, sheet_names, collected, seen);
-    });
-  }
-  auto ranges = SeedFromRetainedTails(wb);
-  if (!ranges) {
-    return ranges.error();
-  }
-  for (const auto& range : collected) {
-    if (std::find(ranges.value().begin(), ranges.value().end(), range) == ranges.value().end()) {
-      ranges.value().push_back(range);
-    }
-  }
-  return ranges;
-}
-
-/// Emits one `BrtExternSheet` record. Byte layout verified against a
-/// real Excel-365-produced `xl/workbook.bin` (see `ptg_reader.cpp`'s
-/// `DecodeExternSheet`, the decoder counterpart): `count(u32)` followed
-/// by `count` entries of `(iSupBook, itabFirst, itabLast)` as three
-/// `i32`s each. `iSupBook` is always 0 here (internal-workbook sheets
-/// only; external-workbook 3-D ranges are out of scope for this
-/// writer).
-void EmitExternSheet(std::vector<std::uint8_t>& body, const SheetRangeTable& ranges) {
-  if (ranges.empty()) {
-    return;
-  }
-  std::vector<std::uint8_t> p;
-  emit_u32(p, static_cast<std::uint32_t>(ranges.size()));
-  for (const auto& [itab_first, itab_last] : ranges) {
-    emit_u32(p, 0);  // iSupBook
-    emit_u32(p, static_cast<std::uint32_t>(itab_first));
-    emit_u32(p, static_cast<std::uint32_t>(itab_last));
-  }
-  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtExternSheet), p);
-}
-
-/// Emits one `BrtName` record. Byte layout verified against a real
-/// Excel-365-produced `xl/workbook.bin` (see `ptg_reader.cpp`'s
-/// `DecodeWorkbookNames`, the decoder counterpart):
-///   flags (u16: bit 0 = fHidden) + 3 reserved bytes + itab (i32,
-///   `-1` = workbook scope) + cch (u32) + cch x UTF-16LE name +
-///   cce (u32) + cce bytes rgce + cb (u32) + cb bytes rgcb.
-/// `formula` is the name's own bare expression text (no leading `=`,
-/// matching `<definedName>`'s XML text content); an empty string emits
-/// a zero-length `rgce` (the hidden future-function / LET-parameter
-/// placeholders this writer registers carry no real formula body — real
-/// Excel stores a `#NAME?` placeholder there, which is not required for
-/// this writer's own reader to round-trip the name table).
-Expected<void, Error> EmitName(std::vector<std::uint8_t>& body, const std::string& name, std::string_view formula,
-                               std::int32_t itab, bool hidden, bool calc_exp, std::string_view comment,
-                               const std::vector<std::string>& sheet_names, const SheetRangeTable& sheet_ranges,
-                               const NameTable& name_table) {
-  // Names carrying Excel's hidden storage prefixes are not ordinary
-  // defined names: `_xlfn.<FN>` registers a post-2007 "future function"
-  // and `_xlpm.<param>` a LET / LAMBDA parameter. Real Excel stores each
-  // with a specific flag word (fHidden | fFunc | fFutureFunction for the
-  // former, the proc-parameter flags for the latter), a PtgErr(#NAME?)
-  // placeholder body, and five trailing null strings. A cell's future-
-  // function call resolves through the matching BrtName's ilbl, so these
-  // flags and the placeholder body must match Excel byte-for-byte or the
-  // callee shows up as #NAME? on load. A prefixed name Excel does not know
-  // (`_xlfn.FOOBAR`) is an ordinary undefined-name stub instead (measured).
-  const bool is_param = name.rfind("_xlpm.", 0) == 0;
-  std::string_view callee(name);
-  const bool xlfn = callee.rfind("_xlfn.", 0) == 0;
-  callee.remove_prefix(xlfn ? 6U : 0U);
-  if (callee.rfind("_xlws.", 0) == 0) {
-    callee.remove_prefix(6U);
-  }
-  const bool is_future_fn = xlfn && has_storage_prefix(callee);
-  const bool is_placeholder = is_param || is_future_fn;
-  std::uint32_t flags;
-  if (is_param) {
-    flags = 0x00020019U;
-  } else if (is_future_fn) {
-    flags = 0x0002000bU;
-  } else {
-    flags = hidden ? 0x00000001U : 0x00000000U;
-  }
-  std::vector<std::uint8_t> p;
-  emit_u32(p, flags);  // grbit (flags word)
-  emit_u8(p, 0);       // chKey
-  emit_u32(p, static_cast<std::uint32_t>(itab));
-  emit_xlwidestring(p, name);
-  if (is_placeholder) {
-    emit_u32(p, 2);    // cce
-    emit_u8(p, 0x1C);  // PtgErr
-    emit_u8(p, 0x1D);  // #NAME? error code
-    emit_u32(p, 0);    // cb
-  } else if (formula.empty()) {
-    emit_u32(p, 0);  // cce
-    emit_u32(p, 0);  // cb
-  } else {
-    Arena arena;
-    parser::Parser parser(formula, arena);
-    parser::AstNode* root = parser.parse();
-    if (root == nullptr || !parser.errors().empty()) {
-      return make_error(FormulonErrorCode::kIoXlsbUnsupportedPtg,
-                        "xlsb writer: defined-name formula failed to parse for Ptg encoding",
-                        std::string("context=xlsb_writer name=") + name);
-    }
-    if (calc_exp) {
-      p[0] |= 0x10U;  // fCalcExp (grbit bit 4)
-    }
-    // Measured: a defined-name body's root reference stays reference class.
-    auto encoded_or = encode_ptgs(*root, sheet_names, sheet_ranges, name_table, PtgRootClass::kReference);
-    if (!encoded_or) {
-      return encoded_or.error();
-    }
-    const EncodedFormula& encoded = encoded_or.value();
-    emit_u32(p, static_cast<std::uint32_t>(encoded.rgce.size()));
-    p.insert(p.end(), encoded.rgce.begin(), encoded.rgce.end());
-    emit_u32(p, static_cast<std::uint32_t>(encoded.rgcb.size()));
-    p.insert(p.end(), encoded.rgcb.begin(), encoded.rgcb.end());
-  }
-  // Trailing BrtName strings ([MS-XLSB] §2.4.649). Excel rejects a
-  // BrtName that stops after the formula. A plain defined name carries
-  // just the comment (a null `XLNullableWideString` when absent, matching
-  // Excel's own encoding for a name whose Name Manager "Comment" field
-  // was never set -- not a zero-length string); a future-function /
-  // proc-parameter placeholder carries five strings (comment plus four
-  // further unused strings, always null -- these are internal storage
-  // artifacts with no Name Manager entry a comment could attach to),
-  // matching real Excel output.
-  if (is_placeholder) {
-    for (int i = 0; i < 5; ++i) {
-      emit_u32(p, 0xFFFFFFFFU);  // null XLNullableWideString
-    }
-  } else {
-    emit_xlnullablewidestring(p, comment.empty() ? std::nullopt : std::make_optional(comment));
-  }
-  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtName), p);
-  return Expected<void, Error>::Ok();
-}
-
-// ---------------------------------------------------------------------------
-// Workbook stream (xl/workbook.bin)
-// ---------------------------------------------------------------------------
-
-Expected<std::vector<std::uint8_t>, Error> BuildWorkbookBin(const Workbook& wb,
-                                                            const std::vector<OrderedName>& ordered_names,
-                                                            const SheetRangeTable& sheet_ranges,
-                                                            const std::vector<std::string>& sheet_names) {
-  std::vector<std::uint8_t> body;
-  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtBeginBook), ByteSpan{});
-
-  // Workbook globals Excel expects before the sheet bundle. These are
-  // fixed-shape records with no dependency on workbook content, so we emit
-  // known-valid default payloads (byte layout captured from a real Excel 365
-  // `xl/workbook.bin`):
-  //   * BrtFileVersion : appName "xl", lastEdited/lowestEdited "7", build.
-  //   * BrtWbProp      : default flags + defaultThemeVersion 202300.
-  //   * BrtWbView      : a single window view; itabCur (offset 24, u32) is
-  //                      patched below to the tab-selected sheet.
-  // Omitting these produced a workbook stream Excel rejected.
-  static const std::vector<std::uint8_t> kFileVersionPayload = {
-      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
-      0x00, 0x00, 0x00, 0x78, 0x00, 0x6c, 0x00, 0x01, 0x00, 0x00, 0x00, 0x37, 0x00, 0x01, 0x00, 0x00, 0x00,
-      0x37, 0x00, 0x05, 0x00, 0x00, 0x00, 0x31, 0x00, 0x30, 0x00, 0x36, 0x00, 0x32, 0x00, 0x38, 0x00};
-  static const std::vector<std::uint8_t> kDefaultWbPropPayload = {0x20, 0x00, 0x01, 0x00, 0x3c, 0x16,
-                                                                  0x03, 0x00, 0x00, 0x00, 0x00, 0x00};
-  static const std::vector<std::uint8_t> kWbViewPayload = {0x10, 0x4f, 0x00, 0x00, 0x18, 0x15, 0x00, 0x00, 0x8c, 0x6e,
-                                                           0x00, 0x00, 0xd0, 0x43, 0x00, 0x00, 0x58, 0x02, 0x00, 0x00,
-                                                           0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x78};
-  emit_record(body, kBrtFileVersion, kFileVersionPayload);
-  std::vector<std::uint8_t> wb_prop_payload = kDefaultWbPropPayload;
-  // BrtWbProp ([MS-XLSB] §2.4.866): f1904 is bit 0 of the leading
-  // little-endian u32 grbit. Preserve Excel's captured default flags.
-  if (wb.date1904()) {
-    wb_prop_payload[0] |= 0x01U;
-  }
-  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtWbProp), wb_prop_payload);
-  // Excel places the protection records between BrtWbProp and the views.
-  if (auto protection = emit_book_protection(body, wb.workbook_protection_xml()); !protection) {
-    return protection.error();
-  }
-  emit_record(body, kBrtBeginBookViews, ByteSpan{});
-  // itabCur (u32 at offset 24): measured to equal the tab-selected sheet's
-  // index in every fixture; a mismatch made Excel show every tab selected.
-  std::vector<std::uint8_t> wb_view_payload = kWbViewPayload;
-  std::uint32_t itab_cur = 0U;
-  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
-    if (wb.sheet(i).view().tab_selected) {
-      itab_cur = static_cast<std::uint32_t>(i);
-      break;
-    }
-  }
-  wb_view_payload[24] = static_cast<std::uint8_t>(itab_cur & 0xFFU);
-  wb_view_payload[25] = static_cast<std::uint8_t>((itab_cur >> 8) & 0xFFU);
-  wb_view_payload[26] = static_cast<std::uint8_t>((itab_cur >> 16) & 0xFFU);
-  wb_view_payload[27] = static_cast<std::uint8_t>((itab_cur >> 24) & 0xFFU);
-  emit_record(body, kBrtWbView, wb_view_payload);
-  emit_record(body, kBrtEndBookViews, ByteSpan{});
-
-  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtBeginBundleShs), ByteSpan{});
-  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
-    // BrtBundleSh ([MS-XLSB] §2.4.304):
-    //   hsState    : u32 (0 = visible, 1 = hidden, 2 = very hidden)
-    //   iTabID     : u32 (sheet id; 1-based)
-    //   strRelID   : XLNullableWideString
-    //   strName    : XLWideString
-    std::vector<std::uint8_t> p;
-    // `SheetVisibility` is numbered to match `hsState`, so the model state
-    // is the field value.
-    const auto hs_state = static_cast<std::uint32_t>(wb.sheet(i).view().visibility());
-    emit_u32(p, hs_state);                            // hsState
-    emit_u32(p, static_cast<std::uint32_t>(i + 1U));  // iTabID
-    const std::string rid = std::string("rId") + std::to_string(i + 1U);
-    emit_xlnullablewidestring(p, std::optional<std::string_view>{rid});
-    emit_xlwidestring(p, wb.sheet(i).name());
-    emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtBundleSh), p);
-  }
-  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtEndBundleShs), ByteSpan{});
-
-  // BrtExternSheet: every distinct sheet-qualified reference span this
-  // workbook's formulas need an `ixti` for (single- and multi-sheet
-  // alike; see `BuildSheetRangeTable`'s doc comment for why both share
-  // this one table). Omitted entirely when no formula uses a qualified
-  // reference, matching the fallback the reader's `sheet_for_ixti` /
-  // `sheet_range_for_ixti` already implement for that case.
-  //
-  // The record MUST be wrapped in the externals block: a bare
-  // `BrtExternSheet` outside `BrtBeginExternals ... BrtEndExternals` is an
-  // out-of-place record that makes Excel reject the package. A workbook that
-  // only references its own sheets still needs a single `BrtSupSelf`
-  // supporting-book entry inside the block.
-  if (!sheet_ranges.empty()) {
-    emit_record(body, kBrtBeginExternals, ByteSpan{});
-    emit_record(body, kBrtSupSelf, ByteSpan{});
-    EmitExternSheet(body, sheet_ranges);
-    emit_record(body, kBrtEndExternals, ByteSpan{});
-  }
-
-  // BrtName table: every genuine defined name (hidden per its own OOXML
-  // `hidden` flag) followed by every future-function callee / defined
-  // name `collect_ptg_names` needed a `PtgName` reference for that
-  // wasn't already a defined name (the `_xlfn.` / `_xlpm.` records
-  // hidden, a stub for an undefined name not). `ordered_names` is built once by `BuildOrderedNames`
-  // and shared with every sheet's cell encoder so `ilbl` assignments
-  // stay consistent workbook-wide. The leading `defined_count` slots are
-  // `wb.defined_names()` element-for-element, so every defined name
-  // emits exactly one record at the `ilbl` the encoder assigned it.
-  //
-  // A name's own formula resolves other names from the scope the name
-  // itself lives in, the same rule a cell formula follows, so each entry
-  // encodes against a table built for its `local_sheet_id`. The tables
-  // are memoized per scope: workbooks routinely carry many names in the
-  // same scope and each table is a full pass over the name list.
-  const std::size_t defined_count = wb.defined_names().size();
-  std::unordered_map<std::int32_t, NameTable> scoped_tables;
-  auto table_for_scope = [&](std::int32_t scope_sheet_id) -> const NameTable& {
-    auto it = scoped_tables.find(scope_sheet_id);
-    if (it == scoped_tables.end()) {
-      it = scoped_tables.emplace(scope_sheet_id, BuildNameTableForScope(wb, ordered_names, scope_sheet_id)).first;
-    }
-    return it->second;
-  };
-  const std::vector<NameShape> shapes = defined_name_shapes(wb);
-  for (std::size_t i = 0; i < ordered_names.size(); ++i) {
-    if (i < defined_count) {
-      const DefinedName& dn = wb.defined_names()[i];
-      if (auto r = EmitName(body, dn.name, dn.formula, dn.local_sheet_id, dn.hidden, shapes[i].calc_exp, dn.comment,
-                            sheet_names, sheet_ranges, table_for_scope(dn.local_sheet_id));
-          !r) {
-        return r.error();
-      }
-    } else {
-      // Placeholders carry no formula body, so the table they are handed is
-      // never consulted; the workbook-scope one keeps the call uniform. A
-      // stub for an undefined name is not hidden, as Excel saves it.
-      const OrderedName& slot = ordered_names[i];
-      if (auto r = EmitName(body, slot.name, /*formula=*/{}, slot.itab, /*hidden=*/false, /*calc_exp=*/false,
-                            /*comment=*/{}, sheet_names, sheet_ranges, table_for_scope(-1));
-          !r) {
-        return r.error();
-      }
-    }
-  }
-
-  emit_record(body, static_cast<std::uint16_t>(XlsbRecordType::BrtEndBook), ByteSpan{});
-  return body;
-}
-
 }  // namespace
 
 Expected<XlsbWriteResult, Error> write_xlsb_with_result(const Workbook& workbook) {
@@ -1461,7 +759,10 @@ Expected<XlsbWriteResult, Error> write_xlsb_with_result(const Workbook& workbook
     return r.error();
   }
   // 2. _rels/.rels
-  if (auto r = AddPart(writer.get(), "_rels/.rels", BuildPackageRels(workbook, plan, &diagnostics)); !r) {
+  if (auto r = AddPart(writer.get(), "_rels/.rels",
+                       BuildPackageRels(workbook, "xl/workbook.bin", plan.passthrough_kept,
+                                        "xlsb.writer.package_rel_skipped", &diagnostics));
+      !r) {
     return r.error();
   }
   // 3. xl/_rels/workbook.bin.rels
@@ -1546,32 +847,12 @@ Expected<XlsbWriteResult, Error> write_xlsb_with_result(const Workbook& workbook
     }
   }
 
-  // Finalise into a heap buffer, then copy into a std::vector.
-  void* archive_ptr = nullptr;
-  std::size_t archive_size = 0;
-  if (mz_zip_writer_finalize_heap_archive(writer.get(), &archive_ptr, &archive_size) == MZ_FALSE) {
-    return make_error(FormulonErrorCode::kIoWriteFailed, "miniz mz_zip_writer_finalize_heap_archive failed",
-                      "context=write_xlsb");
-  }
-  if (mz_zip_writer_end(writer.get()) == MZ_FALSE) {
-    if (archive_ptr != nullptr) {
-      mz_free(archive_ptr);
-    }
-    writer.release();
-    return make_error(FormulonErrorCode::kIoWriteFailed, "miniz mz_zip_writer_end failed", "context=write_xlsb");
-  }
-  writer.release();
-
-  std::vector<std::uint8_t> bytes;
-  bytes.resize(archive_size);
-  if (archive_size > 0 && archive_ptr != nullptr) {
-    std::memcpy(bytes.data(), archive_ptr, archive_size);
-  }
-  if (archive_ptr != nullptr) {
-    mz_free(archive_ptr);
+  auto bytes_or = FinalizeArchive(writer, "context=write_xlsb");
+  if (!bytes_or) {
+    return bytes_or.error();
   }
   diagnostics.downgraded_formula_count = downgraded_formula_count;
-  return XlsbWriteResult{std::move(bytes), diagnostics};
+  return XlsbWriteResult{std::move(bytes_or.value()), diagnostics};
 }
 
 Expected<std::vector<std::uint8_t>, Error> write_xlsb(const Workbook& workbook) {
diff --git a/src/io/xml_utils.cpp b/src/io/xml_utils.cpp
index c014354b7..1f996e050 100644
--- a/src/io/xml_utils.cpp
+++ b/src/io/xml_utils.cpp
@@ -17,6 +17,7 @@
 #include <vector>
 
 #include "double-conversion/double-conversion.h"
+#include "io/phonetic_pr.h"
 #include "io/xml_escape.h"
 #include "pugixml.hpp"
 #include "utils/error.h"
@@ -421,6 +422,28 @@ std::size_t append_rich_text(const pugi::xml_node& node, std::string& out) {
   return count;
 }
 
+void append_phonetic_runs(const pugi::xml_node& node, std::vector<PhoneticRun>& out) {
+  for (pugi::xml_node rph = node.child("rPh"); rph; rph = rph.next_sibling("rPh")) {
+    PhoneticRun run;
+    run.sb = static_cast<std::uint32_t>(rph.attribute("sb").as_uint(0U));
+    run.eb = static_cast<std::uint32_t>(rph.attribute("eb").as_uint(0U));
+    for (pugi::xml_node t = rph.child("t"); t; t = t.next_sibling("t")) {
+      AppendOoxmlTextUnescaped(run.text, t.text().get());
+    }
+    out.push_back(std::move(run));
+  }
+}
+
+PhoneticProperties read_phonetic_properties(const pugi::xml_node& node) {
+  PhoneticProperties props;
+  if (pugi::xml_node pr = node.child("phoneticPr")) {
+    props.font_id = static_cast<std::uint16_t>(pr.attribute("fontId").as_uint(0U));
+    props.type = parse_phonetic_type(pr.attribute("type").value());
+    props.alignment = parse_phonetic_alignment(pr.attribute("alignment").value());
+  }
+  return props;
+}
+
 std::string capture_root_extra_ns_attrs(const pugi::xml_node& root) {
   std::string out;
   for (pugi::xml_attribute attr = root.first_attribute(); attr; attr = attr.next_attribute()) {
diff --git a/src/io/xml_utils.h b/src/io/xml_utils.h
index a24fb9968..c53e39249 100644
--- a/src/io/xml_utils.h
+++ b/src/io/xml_utils.h
@@ -23,6 +23,7 @@
 #include <vector>
 
 #include "io/xsd_double.h"
+#include "phonetic.h"
 #include "pugixml.hpp"
 #include "utils/error.h"
 #include "utils/expected.h"
@@ -98,7 +99,7 @@ std::int32_t parse_xml_i32_attr(const pugi::xml_attribute& attr, std::int32_t de
 /// "true", false for everything else (including a missing attribute).
 /// Matches the lexicon Excel emits for the majority of `xs:boolean`
 /// attributes. For the case-insensitive variant Excel uses on a small
-/// subset of sheet flags, see `sheet_reader.cpp`'s local helper.
+/// subset of sheet flags, see `read_xsd_bool` in `io/xsd_bool.h`.
 bool parse_xml_bool_attr(const pugi::xml_attribute& attr);
 
 /// String-view variant of `parse_xml_bool_attr`. Returns true for
@@ -325,6 +326,16 @@ std::uint32_t parse_rgb_hex(std::string_view hex, std::uint32_t fallback) noexce
 /// contributes zero bytes but is still a valid payload.
 std::size_t append_rich_text(const pugi::xml_node& node, std::string& out);
 
+/// Appends one run per `<rPh>` direct child of `node` (an `<si>` or `<is>`
+/// string item), in document order. `sb`/`eb` delimit the surface-text span
+/// each block's kana covers, in UTF-16 code units, and are kept: PHONETIC
+/// replaces only the annotated spans, so the boundaries are observable.
+void append_phonetic_runs(const pugi::xml_node& node, std::vector<PhoneticRun>& out);
+
+/// Reads the `<phoneticPr>` child of a string item. An absent element
+/// leaves the defaults, which is the state Excel would have inferred.
+PhoneticProperties read_phonetic_properties(const pugi::xml_node& node);
+
 }  // namespace io
 }  // namespace formulon
 
diff --git a/src/io/xsd_int.h b/src/io/xsd_int.h
index b479d4bc6..643c6b1a9 100644
--- a/src/io/xsd_int.h
+++ b/src/io/xsd_int.h
@@ -15,6 +15,7 @@
 #define FORMULON_IO_XSD_INT_H_
 
 #include <cstdint>
+#include <cstdlib>
 #include <string_view>
 
 namespace formulon {
@@ -52,6 +53,30 @@ inline bool parse_xsd_nonneg_int(std::string_view text, std::uint32_t* out) noex
   return true;
 }
 
+/// Saturating cast from a possibly-signed C string to `std::uint8_t`.
+/// Used for `outlineLevel`; OOXML caps the value at 7 but we accept up
+/// to 255 defensively and clamp negatives to 0.
+inline std::uint8_t parse_outline_level(const char* text) noexcept {
+  if (text == nullptr || *text == '\0') {
+    return 0U;
+  }
+  // strtol is locale-independent for ASCII digits and doesn't pull in
+  // <iostream>. The result is clamped to [0, 255] so callers see a
+  // valid `uint8_t` even on garbage input.
+  char* end = nullptr;
+  const long n = std::strtol(text, &end, 10);
+  if (end == text) {
+    return 0U;
+  }
+  if (n <= 0) {
+    return 0U;
+  }
+  if (n >= 255) {
+    return 255U;
+  }
+  return static_cast<std::uint8_t>(n);
+}
+
 }  // namespace io
 }  // namespace formulon
 
diff --git a/src/merge_range.h b/src/merge_range.h
new file mode 100644
index 000000000..93a782dea
--- /dev/null
+++ b/src/merge_range.h
@@ -0,0 +1,27 @@
+//
+// The 0-based inclusive cell rectangle shared by merges, AutoFilter and sort
+// ranges.
+
+#ifndef FORMULON_MERGE_RANGE_H_
+#define FORMULON_MERGE_RANGE_H_
+
+#include <cstdint>
+
+namespace formulon {
+
+/// One `<mergeCell ref="A1:B2"/>` block: a rectangular merged range
+/// stored as 0-based, inclusive `(row, col)` corners. The two corners
+/// are normalised so that `first_row <= last_row` and
+/// `first_col <= last_col`; degenerate `first == last` rectangles are
+/// permitted (single-cell merges, which Excel emits). Also the rectangle
+/// type of AutoFilter and sort ranges.
+struct MergeRange {
+  std::uint32_t first_row = 0;
+  std::uint32_t first_col = 0;
+  std::uint32_t last_row = 0;
+  std::uint32_t last_col = 0;
+};
+
+}  // namespace formulon
+
+#endif  // FORMULON_MERGE_RANGE_H_
diff --git a/src/node_addon/addon.cc b/src/node_addon/addon.cc
index b1f560891..dca05f643 100644
--- a/src/node_addon/addon.cc
+++ b/src/node_addon/addon.cc
@@ -10,15 +10,21 @@
 //   * `parts/workbook_class.{h,cc}` -- `Workbook` ObjectWrap definition,
 //     ctor / dtor, static factories, argument helpers, and the
 //     `DefineClass` registration table.
-//   * `parts/lifecycle.cc`         -- cell mutation / read, recalc,
-//     save, iterative-solver registration, isValid.
+//   * `parts/cells.cc`             -- cell mutation / read, phonetic
+//     metadata, ad-hoc formula evaluation, lambda text.
+//   * `parts/lifecycle.cc`         -- calc policy, recalc, save,
+//     iterative-solver registration, diagnostics, isValid.
 //   * `parts/sheet.cc`             -- sheet operations, row/col edits,
 //     metadata iteration, defined-name mutation.
 //   * `parts/pivot_cache.cc`       -- PivotCache mutation surface.
 //   * `parts/pivot_table.cc`       -- PivotTable mutation surface.
-//   * `parts/styles.cc`            -- styles + EvaluateCfRange.
-//   * `parts/sheet_view.cc`        -- view / column / row layout +
-//     merges / comments / hyperlinks / validations.
+//   * `parts/styles.cc`            -- styles.
+//   * `parts/conditional_format.cc` -- conditional-format surface +
+//     EvaluateCfRange.
+//   * `parts/sheet_view.cc`        -- view / protection / column / row
+//     layout.
+//   * `parts/sheet_ui.cc`         -- merges / comments / hyperlinks /
+//     validations / AutoFilter / threaded comments and persons.
 //   * `parts/free_funcs.{h,cc}`    -- evalFormula / version /
 //     lastError* / statusString / the process-wide structured-log
 //     controls.
diff --git a/src/node_addon/parts/addon_common.cc b/src/node_addon/parts/addon_common.cc
index 28e0e4555..67a687ebd 100644
--- a/src/node_addon/parts/addon_common.cc
+++ b/src/node_addon/parts/addon_common.cc
@@ -3,6 +3,9 @@
 
 #include "node_addon/parts/addon_common.h"
 
+#include <cmath>
+#include <limits>
+
 namespace formulon_node {
 
 namespace {
@@ -17,31 +20,359 @@ Napi::Object MakeStatusEnvelope(Napi::Env env, bool ok, fm_status_t code, const
   return o;
 }
 
-// Reads the number at `key` into `out`. Returns false when the key is
-// missing / undefined / null, or (after throwing a TypeError) not a number.
-bool SpecPullNumber(const Napi::Object& spec, const char* key, Napi::Number& out) {
-  if (!spec.Has(key)) {
+}  // namespace
+
+// FORMULON-ALLOW: N-API uses JavaScript exceptions for argument validation.
+void CheckedSpecReader::ObservePending() {
+  if (!failed_ && env_.IsExceptionPending()) {
+    failed_ = true;
+  }
+}
+
+void CheckedSpecReader::ReportType(const char* key, const char* expected) {
+  if (failed_ || env_.IsExceptionPending()) {
+    failed_ = true;
+    return;
+  }
+  Napi::TypeError::New(env_, std::string(key) + " must be a " + expected).ThrowAsJavaScriptException();
+  failed_ = true;
+}
+
+void CheckedSpecReader::ReportRange(const char* key, const char* range_name) {
+  if (failed_ || env_.IsExceptionPending()) {
+    failed_ = true;
+    return;
+  }
+  Napi::RangeError::New(env_, std::string(key) + " is outside " + range_name + " range").ThrowAsJavaScriptException();
+  failed_ = true;
+}
+
+bool CheckedSpecReader::ReadOptional(const Napi::Object& owner, const char* key, Napi::Value* out, bool* present) {
+  if (present != nullptr) {
+    *present = false;
+  }
+  if (!ok()) {
     return false;
   }
-  Napi::Value v = spec.Get(key);
-  if (v.IsUndefined() || v.IsNull()) {
+  const bool has_property = owner.Has(key);
+  ObservePending();
+  if (!ok() || !has_property) {
     return false;
   }
-  if (!v.IsNumber()) {
-    // `.As<Napi::Number>()` below is an unchecked cast: under
-    // NAPI_DISABLE_CPP_EXCEPTIONS it does not throw a C++ exception on a
-    // non-number value, it leaves a *pending* JS exception and returns a
-    // default -- indistinguishable, to this function's caller, from a
-    // successful parse. Throwing here explicitly makes the failure
-    // immediate and deterministic instead of implementation-defined.
-    Napi::TypeError::New(spec.Env(), std::string(key) + " must be a number").ThrowAsJavaScriptException();
+  *out = owner.Get(key);
+  ObservePending();
+  if (!ok() || out->IsUndefined() || out->IsNull()) {
     return false;
   }
-  out = v.As<Napi::Number>();
+  if (present != nullptr) {
+    *present = true;
+  }
   return true;
 }
 
-}  // namespace
+bool CheckedSpecReader::Value(const Napi::Value& value, const char* key, Napi::Value* out) {
+  if (!ok() || value.IsUndefined() || value.IsNull()) {
+    return false;
+  }
+  *out = value;
+  ObservePending();
+  if (!ok()) {
+    return false;
+  }
+  (void)key;
+  return true;
+}
+
+bool CheckedSpecReader::ArrayElement(const Napi::Array& owner, uint32_t index, Napi::Value* out) {
+  if (!ok()) {
+    return false;
+  }
+  *out = owner.Get(index);
+  ObservePending();
+  if (!ok()) {
+    return false;
+  }
+  return Value(*out, "array element", out);
+}
+
+bool CheckedSpecReader::ReadNumber(const Napi::Object& owner, const char* key, double* out, bool* present) {
+  Napi::Value value;
+  if (!ReadOptional(owner, key, &value, present)) {
+    return ok();
+  }
+  return ReadNumber(value, key, out);
+}
+
+bool CheckedSpecReader::ReadNumber(const Napi::Value& value, const char* key, double* out) {
+  Napi::Value present;
+  if (!Value(value, key, &present)) {
+    return ok();
+  }
+  if (!present.IsNumber()) {
+    ReportType(key, "number");
+    return false;
+  }
+  *out = present.As<Napi::Number>().DoubleValue();
+  ObservePending();
+  return ok();
+}
+
+bool CheckedSpecReader::ReadInteger(const Napi::Object& owner, const char* key, double* out, double min_value,
+                                    double max_value, const char* range_name, bool* present) {
+  if (!ReadNumber(owner, key, out, present)) {
+    return false;
+  }
+  if (!std::isfinite(*out) || std::trunc(*out) != *out || *out < min_value || *out > max_value) {
+    ReportRange(key, range_name);
+    return false;
+  }
+  return true;
+}
+
+bool CheckedSpecReader::String(const Napi::Object& owner, const char* key, std::string* out) {
+  Napi::Value value;
+  if (!ReadOptional(owner, key, &value)) {
+    out->clear();
+    return false;
+  }
+  return String(value, key, out);
+}
+
+bool CheckedSpecReader::String(const Napi::Value& value, const char* key, std::string* out) {
+  Napi::Value present;
+  if (!Value(value, key, &present)) {
+    out->clear();
+    return false;
+  }
+  // Same acceptance as the WASM surface: a string or a one-byte buffer, never
+  // a coerced value.
+  const bool byte_view = present.IsTypedArray() && [&present] {
+    const napi_typedarray_type type = present.As<Napi::TypedArray>().TypedArrayType();
+    return type == napi_int8_array || type == napi_uint8_array || type == napi_uint8_clamped_array;
+  }();
+  if (present.IsString()) {
+    *out = present.As<Napi::String>().Utf8Value();
+  } else if (present.IsArrayBuffer()) {
+    Napi::ArrayBuffer buffer = present.As<Napi::ArrayBuffer>();
+    out->assign(static_cast<const char*>(buffer.Data()), buffer.ByteLength());
+  } else if (byte_view) {
+    Napi::TypedArray view = present.As<Napi::TypedArray>();
+    const auto* data = static_cast<const char*>(view.ArrayBuffer().Data()) + view.ByteOffset();
+    out->assign(data, view.ByteLength());
+  } else {
+    out->clear();
+    ReportType(key, "string or one-byte buffer");
+    return false;
+  }
+  ObservePending();
+  return ok();
+}
+
+bool CheckedSpecReader::Object(const Napi::Object& owner, const char* key, Napi::Object* out) {
+  Napi::Value value;
+  if (!ReadOptional(owner, key, &value)) {
+    return false;
+  }
+  return Object(value, key, out);
+}
+
+bool CheckedSpecReader::Object(const Napi::Value& value, const char* key, Napi::Object* out) {
+  Napi::Value present;
+  if (!Value(value, key, &present)) {
+    return false;
+  }
+  if (!present.IsObject()) {
+    ReportType(key, "object");
+    return false;
+  }
+  *out = present.As<Napi::Object>();
+  ObservePending();
+  return ok();
+}
+
+bool CheckedSpecReader::Array(const Napi::Object& owner, const char* key, Napi::Array* out) {
+  Napi::Value value;
+  if (!ReadOptional(owner, key, &value)) {
+    return false;
+  }
+  return Array(value, key, out);
+}
+
+bool CheckedSpecReader::Array(const Napi::Value& value, const char* key, Napi::Array* out) {
+  Napi::Value present;
+  if (!Value(value, key, &present)) {
+    return false;
+  }
+  if (!present.IsArray()) {
+    ReportType(key, "array");
+    return false;
+  }
+  *out = present.As<Napi::Array>();
+  ObservePending();
+  return ok();
+}
+
+bool CheckedSpecReader::Bool(const Napi::Object& owner, const char* key, bool dflt, bool* present) {
+  Napi::Value value;
+  if (!ReadOptional(owner, key, &value, present)) {
+    return dflt;
+  }
+  return Bool(value, key, dflt);
+}
+
+bool CheckedSpecReader::Bool(const Napi::Value& value, const char* key, bool dflt) {
+  Napi::Value present;
+  if (!Value(value, key, &present)) {
+    return dflt;
+  }
+  const bool result = present.ToBoolean().Value();
+  ObservePending();
+  return result;
+}
+
+double CheckedSpecReader::Double(const Napi::Object& owner, const char* key, double dflt, bool* present) {
+  double value = dflt;
+  if (!ReadNumber(owner, key, &value, present)) {
+    return dflt;
+  }
+  return value;
+}
+
+double CheckedSpecReader::Double(const Napi::Value& value, const char* key, double dflt) {
+  double result = dflt;
+  if (!ReadNumber(value, key, &result)) {
+    return dflt;
+  }
+  return result;
+}
+
+uint8_t CheckedSpecReader::U8(const Napi::Object& owner, const char* key, uint8_t dflt, bool* present) {
+  double value = static_cast<double>(dflt);
+  if (!ReadInteger(owner, key, &value, 0.0, static_cast<double>(std::numeric_limits<uint8_t>::max()), "uint8",
+                   present)) {
+    return dflt;
+  }
+  return static_cast<uint8_t>(value);
+}
+
+uint8_t CheckedSpecReader::U8(const Napi::Value& value, const char* key, uint8_t dflt) {
+  double result = static_cast<double>(dflt);
+  if (!ReadNumber(value, key, &result)) {
+    return dflt;
+  }
+  if (!std::isfinite(result) || std::trunc(result) != result || result < 0.0 ||
+      result > static_cast<double>(std::numeric_limits<uint8_t>::max())) {
+    ReportRange(key, "uint8");
+    return dflt;
+  }
+  return static_cast<uint8_t>(result);
+}
+
+uint16_t CheckedSpecReader::U16(const Napi::Object& owner, const char* key, uint16_t dflt, bool* present) {
+  double value = static_cast<double>(dflt);
+  if (!ReadInteger(owner, key, &value, 0.0, static_cast<double>(std::numeric_limits<uint16_t>::max()), "uint16",
+                   present)) {
+    return dflt;
+  }
+  return static_cast<uint16_t>(value);
+}
+
+uint16_t CheckedSpecReader::U16(const Napi::Value& value, const char* key, uint16_t dflt) {
+  double result = static_cast<double>(dflt);
+  if (!ReadNumber(value, key, &result)) {
+    return dflt;
+  }
+  if (!std::isfinite(result) || std::trunc(result) != result || result < 0.0 ||
+      result > static_cast<double>(std::numeric_limits<uint16_t>::max())) {
+    ReportRange(key, "uint16");
+    return dflt;
+  }
+  return static_cast<uint16_t>(result);
+}
+
+uint32_t CheckedSpecReader::U32(const Napi::Object& owner, const char* key, uint32_t dflt, bool* present) {
+  double value = static_cast<double>(dflt);
+  if (!ReadInteger(owner, key, &value, 0.0, static_cast<double>(std::numeric_limits<uint32_t>::max()), "uint32",
+                   present)) {
+    return dflt;
+  }
+  return static_cast<uint32_t>(value);
+}
+
+uint32_t CheckedSpecReader::U32(const Napi::Value& value, const char* key, uint32_t dflt) {
+  double result = static_cast<double>(dflt);
+  if (!ReadNumber(value, key, &result)) {
+    return dflt;
+  }
+  if (!std::isfinite(result) || std::trunc(result) != result || result < 0.0 ||
+      result > static_cast<double>(std::numeric_limits<uint32_t>::max())) {
+    ReportRange(key, "uint32");
+    return dflt;
+  }
+  return static_cast<uint32_t>(result);
+}
+
+int32_t CheckedSpecReader::I32(const Napi::Object& owner, const char* key, int32_t dflt, bool* present) {
+  double value = static_cast<double>(dflt);
+  if (!ReadInteger(owner, key, &value, static_cast<double>(std::numeric_limits<int32_t>::min()),
+                   static_cast<double>(std::numeric_limits<int32_t>::max()), "int32", present)) {
+    return dflt;
+  }
+  return static_cast<int32_t>(value);
+}
+
+int32_t CheckedSpecReader::I32(const Napi::Value& value, const char* key, int32_t dflt) {
+  double result = static_cast<double>(dflt);
+  if (!ReadNumber(value, key, &result)) {
+    return dflt;
+  }
+  if (!std::isfinite(result) || std::trunc(result) != result ||
+      result < static_cast<double>(std::numeric_limits<int32_t>::min()) ||
+      result > static_cast<double>(std::numeric_limits<int32_t>::max())) {
+    ReportRange(key, "int32");
+    return dflt;
+  }
+  return static_cast<int32_t>(result);
+}
+
+int64_t CheckedSpecReader::I64(const Napi::Object& owner, const char* key, int64_t dflt, bool* present) {
+  double value = static_cast<double>(dflt);
+  if (!ReadNumber(owner, key, &value, present)) {
+    return dflt;
+  }
+  if (!std::isfinite(value) || std::trunc(value) != value || value < -0x1p63 || value >= 0x1p63) {
+    ReportRange(key, "int64");
+    return dflt;
+  }
+  if (value == -0x1p63) {
+    return std::numeric_limits<int64_t>::min();
+  }
+  return static_cast<int64_t>(value);
+}
+
+int64_t CheckedSpecReader::I64(const Napi::Value& value, const char* key, int64_t dflt) {
+  Napi::Value present;
+  if (!Value(value, key, &present)) {
+    return dflt;
+  }
+  if (!present.IsNumber()) {
+    ReportType(key, "number");
+    return dflt;
+  }
+  const double number = present.As<Napi::Number>().DoubleValue();
+  ObservePending();
+  if (!ok()) {
+    return dflt;
+  }
+  if (!std::isfinite(number) || std::trunc(number) != number || number < -0x1p63 || number >= 0x1p63) {
+    ReportRange(key, "int64");
+    return dflt;
+  }
+  if (number == -0x1p63) {
+    return std::numeric_limits<int64_t>::min();
+  }
+  return static_cast<int64_t>(number);
+}
 
 Napi::Object MakeOkStatus(Napi::Env env) {
   return MakeStatusEnvelope(env, true, 0, "", "");
@@ -211,76 +542,50 @@ Napi::Object TranslateCfMatch(Napi::Env env, const fm_cf_match_t& m) {
   return o;
 }
 
-int32_t SpecPullInt32(const Napi::Object& spec, const char* key, int32_t dflt) {
-  Napi::Number n;
-  return SpecPullNumber(spec, key, n) ? n.Int32Value() : dflt;
-}
-
-uint32_t SpecPullU32(const Napi::Object& spec, const char* key, uint32_t dflt) {
-  Napi::Number n;
-  return SpecPullNumber(spec, key, n) ? n.Uint32Value() : dflt;
+void BuildDataFieldSpec(CheckedSpecReader& reader, const Napi::Object& spec, fm_pivot_data_field_spec_t& out,
+                        std::string& name_buf, std::string& nfmt_buf, bool& has_nfmt) {
+  // `name` is required; an omitted key passes NULL through rather than
+  // the coerced literal string "undefined" `.ToString()` would otherwise
+  // produce, so the C ABI's own kBindingNullPointer check is what rejects
+  // the call. See the `sourceName` comment in `pivot_table.cc`'s
+  // `PivotFieldAdd`.
+  const bool has_name = reader.String(spec, "name", &name_buf);
+  has_nfmt = reader.String(spec, "numberFormat", &nfmt_buf);
+  out.name = has_name ? name_buf.c_str() : nullptr;
+  out.field_index = reader.U32(spec, "fieldIndex", 0U);
+  out.aggregation = static_cast<fm_pivot_aggregation_t>(reader.U32(spec, "aggregation", 0U));
+  out.number_format = has_nfmt ? nfmt_buf.c_str() : nullptr;
+  out.show_as = static_cast<fm_pivot_show_as_t>(reader.U32(spec, "showAs", 0U));
+  out.show_as_base_field = reader.I32(spec, "showAsBaseField", -1);
+  out.show_as_base_item = reader.I32(spec, "showAsBaseItem", -1);
 }
 
-double SpecPullDouble(const Napi::Object& spec, const char* key, double dflt) {
-  Napi::Number n;
-  return SpecPullNumber(spec, key, n) ? n.DoubleValue() : dflt;
+// Reads a `{ firstRow, lastRow, firstCol, lastCol }` range object.
+bool ReadMergeRange(CheckedSpecReader& reader, const Napi::Object& range, fm_merge_range* out) {
+  out->first_row = reader.U32(range, "firstRow", 0U);
+  out->last_row = reader.U32(range, "lastRow", 0U);
+  out->first_col = reader.U32(range, "firstCol", 0U);
+  out->last_col = reader.U32(range, "lastCol", 0U);
+  return reader.ok();
 }
 
-bool SpecPullBool(const Napi::Object& spec, const char* key, bool dflt) {
-  if (!spec.Has(key)) {
-    return dflt;
+// Reads the range at `info[idx]`; a missing/nullish argument reads as all
+// zeros, while a supplied non-object is rejected by the reader.
+bool MergeRangeArg(CheckedSpecReader& reader, const Napi::CallbackInfo& info, size_t idx, fm_merge_range* out) {
+  *out = fm_merge_range{};
+  if (info.Length() <= idx) {
+    return true;
   }
-  Napi::Value v = spec.Get(key);
-  if (v.IsUndefined() || v.IsNull()) {
-    return dflt;
+  Napi::Value value = info[idx];
+  Napi::Value present;
+  if (!reader.Value(value, "range", &present)) {
+    return reader.ok();
   }
-  return v.ToBoolean().Value();
-}
-
-bool SpecHas(const Napi::Object& spec, const char* key) {
-  if (!spec.Has(key)) {
+  Napi::Object object;
+  if (!reader.Object(present, "range", &object)) {
     return false;
   }
-  Napi::Value v = spec.Get(key);
-  return !v.IsUndefined() && !v.IsNull();
-}
-
-std::vector<uint32_t> ReadU32Array(const Napi::CallbackInfo& info, size_t idx) {
-  std::vector<uint32_t> out;
-  if (idx >= info.Length()) {
-    return out;
-  }
-  Napi::Value v = info[idx];
-  if (!v.IsArray()) {
-    return out;
-  }
-  Napi::Array arr = v.As<Napi::Array>();
-  const uint32_t len = arr.Length();
-  out.reserve(len);
-  for (uint32_t i = 0; i < len; ++i) {
-    out.push_back(arr.Get(i).As<Napi::Number>().Uint32Value());
-  }
-  return out;
-}
-
-void BuildDataFieldSpec(const Napi::Object& spec, fm_pivot_data_field_spec_t& out, std::string& name_buf,
-                        std::string& nfmt_buf, bool& has_nfmt) {
-  // `name` is required; an omitted key passes NULL through rather than
-  // the coerced literal string "undefined" `.ToString()` would otherwise
-  // produce, so the C ABI's own kBindingNullPointer check is what rejects
-  // the call. See the `sourceName` comment in `pivot_table.cc`'s
-  // `PivotFieldAdd`.
-  const bool has_name = SpecHas(spec, "name");
-  name_buf = has_name ? spec.Get("name").ToString().Utf8Value() : std::string();
-  has_nfmt = SpecHas(spec, "numberFormat");
-  nfmt_buf = has_nfmt ? spec.Get("numberFormat").ToString().Utf8Value() : std::string();
-  out.name = has_name ? name_buf.c_str() : nullptr;
-  out.field_index = SpecPullU32(spec, "fieldIndex", 0U);
-  out.aggregation = static_cast<fm_pivot_aggregation_t>(SpecPullU32(spec, "aggregation", 0U));
-  out.number_format = has_nfmt ? nfmt_buf.c_str() : nullptr;
-  out.show_as = static_cast<fm_pivot_show_as_t>(SpecPullU32(spec, "showAs", 0U));
-  out.show_as_base_field = SpecPullInt32(spec, "showAsBaseField", -1);
-  out.show_as_base_item = SpecPullInt32(spec, "showAsBaseItem", -1);
+  return ReadMergeRange(reader, object, out);
 }
 
 }  // namespace formulon_node
diff --git a/src/node_addon/parts/addon_common.h b/src/node_addon/parts/addon_common.h
index 1910eaa99..f952d62a6 100644
--- a/src/node_addon/parts/addon_common.h
+++ b/src/node_addon/parts/addon_common.h
@@ -158,37 +158,71 @@ Napi::Object TranslateCfColor(Napi::Env env, const fm_cf_color_t& c);
 Napi::Object TranslateCfMatch(Napi::Env env, const fm_cf_match_t& m);
 
 // ---------------------------------------------------------------------
-// JS-spec pullers (read optional fields out of JS objects)
-// ---------------------------------------------------------------------
-
-/// Pulls an optional int32 field from a JS spec object; returns `dflt`
-/// when the field is missing / undefined / null.
-int32_t SpecPullInt32(const Napi::Object& spec, const char* key, int32_t dflt);
-
-/// Pulls an optional uint32 field; returns `dflt` when missing.
-uint32_t SpecPullU32(const Napi::Object& spec, const char* key, uint32_t dflt);
-
-/// Pulls an optional double field; returns `dflt` when missing.
-double SpecPullDouble(const Napi::Object& spec, const char* key, double dflt);
-
-/// Pulls an optional bool field; returns `dflt` when missing.
-bool SpecPullBool(const Napi::Object& spec, const char* key, bool dflt);
-
-/// Returns whether the spec carries a non-null entry for `key`. Used to
-/// decide whether a `const char*` field should be forwarded as nullptr.
-bool SpecHas(const Napi::Object& spec, const char* key);
-
-/// Pulls a numeric array from `info[idx]` into a `std::vector<uint32_t>`.
-/// Returns an empty vector when the argument is missing / undefined /
-/// null or not array-shaped.
-std::vector<uint32_t> ReadU32Array(const Napi::CallbackInfo& info, size_t idx);
+/// Per-call reader for nested binding object fields. It owns the pending-error
+/// bit for one binding invocation, so nested parsers stop touching JS objects
+/// as soon as a getter or checked conversion fails.
+class CheckedSpecReader final {
+ public:
+  explicit CheckedSpecReader(Napi::Env env) : env_(env) {}
+
+  bool ok() const noexcept { return !failed_ && !env_.IsExceptionPending(); }
+
+  /// Copies a non-nullish value into `out`, recording any pending getter
+  /// exception on this reader. Nullish values are absent and keep defaults.
+  bool Value(const Napi::Value& value, const char* key, Napi::Value* out);
+  /// Reads one array element while retaining the same per-call error state.
+  /// Missing/nullish elements are absent and do not fail the reader.
+  bool ArrayElement(const Napi::Array& owner, uint32_t index, Napi::Value* out);
+  bool String(const Napi::Object& owner, const char* key, std::string* out);
+  bool String(const Napi::Value& value, const char* key, std::string* out);
+  bool Object(const Napi::Object& owner, const char* key, Napi::Object* out);
+  bool Object(const Napi::Value& value, const char* key, Napi::Object* out);
+  bool Array(const Napi::Object& owner, const char* key, Napi::Array* out);
+  bool Array(const Napi::Value& value, const char* key, Napi::Array* out);
+  bool Bool(const Napi::Object& owner, const char* key, bool dflt, bool* present = nullptr);
+  bool Bool(const Napi::Value& value, const char* key, bool dflt);
+  double Double(const Napi::Object& owner, const char* key, double dflt, bool* present = nullptr);
+  double Double(const Napi::Value& value, const char* key, double dflt);
+  uint8_t U8(const Napi::Object& owner, const char* key, uint8_t dflt, bool* present = nullptr);
+  uint8_t U8(const Napi::Value& value, const char* key, uint8_t dflt);
+  uint16_t U16(const Napi::Object& owner, const char* key, uint16_t dflt, bool* present = nullptr);
+  uint16_t U16(const Napi::Value& value, const char* key, uint16_t dflt);
+  uint32_t U32(const Napi::Object& owner, const char* key, uint32_t dflt, bool* present = nullptr);
+  uint32_t U32(const Napi::Value& value, const char* key, uint32_t dflt);
+  int32_t I32(const Napi::Object& owner, const char* key, int32_t dflt, bool* present = nullptr);
+  int32_t I32(const Napi::Value& value, const char* key, int32_t dflt);
+  /// Reads a signed int64 from a JavaScript Number without narrowing through
+  /// a wider unsigned intermediate. The valid interval is [-2^63, 2^63).
+  int64_t I64(const Napi::Object& owner, const char* key, int64_t dflt, bool* present = nullptr);
+  int64_t I64(const Napi::Value& value, const char* key, int64_t dflt);
+
+ private:
+  bool ReadOptional(const Napi::Object& owner, const char* key, Napi::Value* out, bool* present = nullptr);
+  bool ReadNumber(const Napi::Object& owner, const char* key, double* out, bool* present = nullptr);
+  bool ReadNumber(const Napi::Value& value, const char* key, double* out);
+  bool ReadInteger(const Napi::Object& owner, const char* key, double* out, double min_value, double max_value,
+                   const char* range_name, bool* present = nullptr);
+  void ObservePending();
+  void ReportType(const char* key, const char* expected);
+  void ReportRange(const char* key, const char* range_name);
+
+  Napi::Env env_;
+  bool failed_ = false;
+};
+
+/// Reads a `{ firstRow, lastRow, firstCol, lastCol }` range object.
+bool ReadMergeRange(CheckedSpecReader& reader, const Napi::Object& range, fm_merge_range* out);
+
+/// Reads the range at `info[idx]`; a missing/nullish argument reads as all
+/// zeros, while a supplied non-object is rejected by the reader.
+bool MergeRangeArg(CheckedSpecReader& reader, const Napi::CallbackInfo& info, size_t idx, fm_merge_range* out);
 
 /// Builds an `fm_pivot_data_field_spec_t` from a JS spec object. The
 /// `name_buf` / `nfmt_buf` strings keep the borrowed `const char*`
 /// pointers alive for the caller; `has_nfmt` is set when the spec
 /// carries a non-null `numberFormat`.
-void BuildDataFieldSpec(const Napi::Object& spec, fm_pivot_data_field_spec_t& out, std::string& name_buf,
-                        std::string& nfmt_buf, bool& has_nfmt);
+void BuildDataFieldSpec(CheckedSpecReader& reader, const Napi::Object& spec, fm_pivot_data_field_spec_t& out,
+                        std::string& name_buf, std::string& nfmt_buf, bool& has_nfmt);
 
 }  // namespace formulon_node
 
diff --git a/src/node_addon/parts/cells.cc b/src/node_addon/parts/cells.cc
new file mode 100644
index 000000000..427039b38
--- /dev/null
+++ b/src/node_addon/parts/cells.cc
@@ -0,0 +1,632 @@
+// Workbook cell bindings: cell mutation and read (including phonetic
+// metadata), ad-hoc formula evaluation, and lambda text.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "node_addon/parts/workbook_class.h"
+
+namespace formulon_node {
+
+// ---- Cell mutation --------------------------------------------------
+
+Napi::Value Workbook::SetNumber(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const double value = ArgDouble(info, 3);
+  fm_status_t rc = fm_workbook_set_number(handle_, sheet, row, col, value);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::SetBool(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  bool value = false;
+  if (info.Length() > 3) {
+    value = info[3].ToBoolean().Value();
+  }
+  fm_status_t rc = fm_workbook_set_bool(handle_, sheet, row, col, value ? 1 : 0);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::SetError(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (info.Length() < 4) {
+    // Unlike the other cell-mutation setters, a missing 4th argument
+    // here has no sane zero-value default: `error_code = 0` silently
+    // writes `#NULL!`, masking a caller bug instead of surfacing it.
+    // Reject it the same way the WASM (embind arity check) and Python
+    // (required positional parameter) bindings already do.
+    Napi::TypeError::New(env, "setError requires 4 arguments (sheet, row, col, errorCode)")
+        .ThrowAsJavaScriptException();
+    return env.Undefined();
+  }
+  if (!info[3].IsNumber()) {
+    // `.As<Napi::Number>()` below is an unchecked cast: on a non-number
+    // 4th argument it does not itself throw, so without this check the
+    // mutation below would run first and any resulting exception would
+    // only surface afterwards, on return to JS.
+    Napi::TypeError::New(env, "setError: `errorCode` must be a number").ThrowAsJavaScriptException();
+    return env.Undefined();
+  }
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const int32_t error_code = info[3].As<Napi::Number>().Int32Value();
+  fm_status_t rc = fm_workbook_set_error(handle_, sheet, row, col, static_cast<fm_error_code_t>(error_code));
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::SetText(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const std::string text = ArgString(info, 3);
+  fm_status_t rc = fm_workbook_set_text(handle_, sheet, row, col, text.c_str());
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::SetCellPhonetic(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const std::string phonetic = ArgString(info, 3);
+  fm_status_t rc = fm_workbook_set_cell_phonetic(handle_, sheet, row, col, phonetic.c_str());
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::SetCellPhoneticRuns(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  if (info.Length() <= 3 || !info[3].IsArray()) {
+    return MakeBindingArgumentError(env, "setCellPhoneticRuns: `runs` must be an array of { sb, eb, text }");
+  }
+  const Napi::Array runs = info[3].As<Napi::Array>();
+  const uint32_t count = runs.Length();
+  CheckedSpecReader reader(env);
+  // Two passes so no `c_str()` is taken before `texts` has finished growing.
+  std::vector<std::string> texts;
+  texts.reserve(count);
+  std::vector<fm_phonetic_run_t> records;
+  records.reserve(count);
+  for (uint32_t i = 0; i < count; ++i) {
+    Napi::Value element;
+    if (!reader.ArrayElement(runs, i, &element)) {
+      if (!reader.ok()) {
+        return env.Undefined();
+      }
+      return MakeBindingArgumentError(env, "setCellPhoneticRuns: each run must be an object { sb, eb, text }");
+    }
+    Napi::Object run;
+    if (!reader.Object(element, "run", &run)) {
+      if (!reader.ok()) {
+        return env.Undefined();
+      }
+      return MakeBindingArgumentError(env, "setCellPhoneticRuns: each run must be an object { sb, eb, text }");
+    }
+    std::string text;
+    (void)reader.String(run, "text", &text);
+    texts.push_back(std::move(text));
+    records.push_back(fm_phonetic_run_t{reader.U32(run, "sb", 0U), reader.U32(run, "eb", 0U), nullptr});
+  }
+  for (uint32_t i = 0; i < count; ++i) {
+    records[i].text = texts[i].c_str();
+  }
+  if (!reader.ok()) {
+    // A malformed field left a pending JS exception: stop before the C ABI
+    // call commits a default value for it.
+    return env.Undefined();
+  }
+  fm_status_t rc = fm_workbook_set_cell_phonetic_runs(handle_, sheet, row, col, records.data(), records.size());
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::SetCellPhoneticProperties(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  if (info.Length() <= 3 || !info[3].IsObject()) {
+    return MakeBindingArgumentError(
+        env, "setCellPhoneticProperties: `properties` must be an object { fontId, type, alignment }");
+  }
+  const Napi::Object props = info[3].As<Napi::Object>();
+  CheckedSpecReader reader(env);
+  const uint32_t font_id = reader.U32(props, "fontId", 0U);
+  const uint32_t type = reader.U32(props, "type", 0U);
+  const uint32_t alignment = reader.U32(props, "alignment", 0U);
+  if (!reader.ok()) {
+    // A malformed field left a pending JS exception: stop before the C ABI
+    // call commits a default value for it.
+    return env.Undefined();
+  }
+  fm_status_t rc = fm_workbook_set_cell_phonetic_properties(handle_, sheet, row, col, font_id, type, alignment);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::SetBlank(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  fm_status_t rc = fm_workbook_set_blank(handle_, sheet, row, col);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::SetFormula(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const std::string formula = ArgString(info, 3);
+  fm_status_t rc = fm_workbook_set_formula(handle_, sheet, row, col, formula.c_str());
+  return MakeStatus(env, rc);
+}
+
+// ---- Cell read ------------------------------------------------------
+
+Napi::Value Workbook::GetValue(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeEmptyValueResult(env, NullHandleError(env));
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  fm_value_t v{};
+  fm_status_t rc = fm_workbook_get_value(handle_, sheet, row, col, &v);
+  return MakeValueResult(env, rc, v);
+}
+
+Napi::Value Workbook::GetCellPhonetic(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeStringFieldResult(env, NullHandleError(env), "value", "");
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const char* text = nullptr;
+  fm_status_t rc = fm_workbook_get_cell_phonetic(handle_, sheet, row, col, &text);
+  if (rc != 0) {
+    return MakeStringFieldResult(env, MakeErrorStatus(env, rc), "value", "");
+  }
+  return MakeStringFieldResult(env, MakeOkStatus(env), "value", text);
+}
+
+Napi::Value Workbook::GetCellPhoneticRuns(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeFieldResult(env, NullHandleError(env), "runs", Napi::Array::New(env, 0));
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  uint32_t count = 0;
+  fm_status_t rc = fm_workbook_get_cell_phonetic_run_count(handle_, sheet, row, col, &count);
+  Napi::Array out = Napi::Array::New(env, rc == 0 ? count : 0);
+  for (uint32_t i = 0; rc == 0 && i < count; ++i) {
+    fm_phonetic_run_t run{};
+    rc = fm_workbook_get_cell_phonetic_run(handle_, sheet, row, col, i, &run);
+    if (rc != 0) {
+      break;
+    }
+    Napi::Object entry = Napi::Object::New(env);
+    entry.Set("sb", Napi::Number::New(env, run.sb));
+    entry.Set("eb", Napi::Number::New(env, run.eb));
+    // Copied immediately: each read refreshes the handle's scratch, so the
+    // previous run's pointer is dead by the time the next one lands.
+    entry.Set("text", Napi::String::New(env, run.text != nullptr ? run.text : ""));
+    out.Set(i, entry);
+  }
+  if (rc != 0) {
+    return MakeFieldResult(env, MakeErrorStatus(env, rc), "runs", Napi::Array::New(env, 0));
+  }
+  return MakeFieldResult(env, MakeOkStatus(env), "runs", out);
+}
+
+Napi::Value Workbook::GetCellPhoneticProperties(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  uint32_t font_id = 0;
+  uint32_t type = 0;
+  uint32_t alignment = 0;
+  const fm_status_t rc = handle_ != nullptr ? fm_workbook_get_cell_phonetic_properties(handle_, sheet, row, col,
+                                                                                       &font_id, &type, &alignment)
+                                            : kBindingInvalidHandle;
+  // The payload keys are declared unconditionally, so a failure reports the
+  // defaults beside the status rather than dropping them.
+  if (rc != 0) {
+    font_id = 0;
+    type = 0;
+    alignment = 0;
+  }
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("fontId", Napi::Number::New(env, font_id));
+  out.Set("type", Napi::Number::New(env, type));
+  out.Set("alignment", Napi::Number::New(env, alignment));
+  out.Set("status", MakeStatus(env, rc));
+  return out;
+}
+
+Napi::Value Workbook::EvaluateFormulaText(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeEmptyValueResult(env, NullHandleError(env));
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const std::string formula = ArgString(info, 3);
+  fm_value_t v{};
+  fm_status_t rc = fm_workbook_evaluate_formula(handle_, sheet, row, col, formula.c_str(), &v);
+  return MakeValueResult(env, rc, v);
+}
+
+Napi::Value Workbook::EvaluateFormulaArray(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    out.Set("rows", Napi::Number::New(env, 0));
+    out.Set("cols", Napi::Number::New(env, 0));
+    out.Set("cells", Napi::Array::New(env, 0));
+    return out;
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const std::string formula = ArgString(info, 3);
+
+  uint32_t rows = 0;
+  uint32_t cols = 0;
+  fm_status_t rc = fm_workbook_evaluate_formula_array(handle_, sheet, row, col, formula.c_str(), &rows, &cols);
+  if (rc != 0) {
+    out.Set("status", MakeErrorStatus(env, rc));
+    out.Set("rows", Napi::Number::New(env, 0));
+    out.Set("cols", Napi::Number::New(env, 0));
+    out.Set("cells", Napi::Array::New(env, 0));
+    return out;
+  }
+
+  // Build a rows x cols nested array of Value objects, reading each stashed
+  // cell by its row-major index (r * cols + c).
+  Napi::Array cells = Napi::Array::New(env, rows);
+  for (uint32_t r = 0; r < rows; ++r) {
+    Napi::Array js_row = Napi::Array::New(env, cols);
+    for (uint32_t c = 0; c < cols; ++c) {
+      const std::size_t index = static_cast<std::size_t>(r) * cols + c;
+      fm_value_t v{};
+      fm_status_t cell_rc = fm_workbook_evaluate_formula_array_cell(handle_, index, &v);
+      if (cell_rc != 0) {
+        out.Set("status", MakeErrorStatus(env, cell_rc));
+        out.Set("rows", Napi::Number::New(env, 0));
+        out.Set("cols", Napi::Number::New(env, 0));
+        out.Set("cells", Napi::Array::New(env, 0));
+        return out;
+      }
+      js_row.Set(c, TranslateValue(env, v));
+    }
+    cells.Set(r, js_row);
+  }
+
+  out.Set("status", MakeOkStatus(env));
+  out.Set("rows", Napi::Number::New(env, rows));
+  out.Set("cols", Napi::Number::New(env, cols));
+  out.Set("cells", cells);
+  return out;
+}
+
+Napi::Value Workbook::EvaluateConditionalFormula(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeEmptyValueResult(env, NullHandleError(env));
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const uint32_t anchor_row = ArgU32(info, 3);
+  const uint32_t anchor_col = ArgU32(info, 4);
+  const std::string formula = ArgString(info, 5);
+  fm_value_t v{};
+  fm_status_t rc =
+      fm_workbook_evaluate_cf_formula(handle_, sheet, row, col, anchor_row, anchor_col, formula.c_str(), &v);
+  return MakeValueResult(env, rc, v);
+}
+
+Napi::Value Workbook::GetLambdaText(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeStringFieldResult(env, NullHandleError(env), "text", "");
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const char* text = nullptr;
+  fm_status_t rc = fm_workbook_lambda_text_at(handle_, sheet, row, col, &text);
+  if (rc != 0) {
+    return MakeStringFieldResult(env, MakeErrorStatus(env, rc), "text", "");
+  }
+  return MakeStringFieldResult(env, MakeOkStatus(env), "text", text);
+}
+
+// ---- Formula text, range enumeration, display text ------------------
+
+namespace {
+
+// Builds `{ status, <field>: string | null }`; an empty C string is "no formula".
+Napi::Object MakeFormulaResult(Napi::Env env, fm_status_t code, const char* formula) {
+  const bool present = code == 0 && formula != nullptr && formula[0] != '\0';
+  return MakeFieldResult(env, MakeStatus(env, code), "formula",
+                         present ? static_cast<Napi::Value>(Napi::String::New(env, formula)) : env.Null());
+}
+
+// Builds `{ status, text, displayStatus }`; `text` is "" and the display
+// status OK when the call failed.
+Napi::Object MakeDisplayResult(Napi::Env env, fm_status_t code, const char* text, int32_t display_status) {
+  const bool ok = code == 0;
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("status", MakeStatus(env, code));
+  out.Set("text", Napi::String::New(env, ok && text != nullptr ? text : ""));
+  out.Set("displayStatus", Napi::Number::New(env, ok ? display_status : 0));
+  return out;
+}
+
+}  // namespace
+
+Napi::Value Workbook::GetFormula(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeFormulaResult(env, kBindingInvalidHandle, nullptr);
+  }
+  const char* formula = nullptr;
+  const fm_status_t rc = fm_workbook_get_formula(handle_, ArgU32(info, 0), ArgU32(info, 1), ArgU32(info, 2), &formula);
+  return MakeFormulaResult(env, rc, formula);
+}
+
+Napi::Value Workbook::GetFormulaR1C1(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeFormulaResult(env, kBindingInvalidHandle, nullptr);
+  }
+  const char* formula = nullptr;
+  const fm_status_t rc =
+      fm_workbook_get_formula_r1c1(handle_, ArgU32(info, 0), ArgU32(info, 1), ArgU32(info, 2), &formula);
+  return MakeFormulaResult(env, rc, formula);
+}
+
+namespace {
+
+// Reads a `Value`-shaped JS object into `value`; `text` backs a text payload
+// and must outlive the C call.
+bool ReadValueSpec(CheckedSpecReader& reader, const Napi::Object& spec, std::string& text, fm_value_t& value) {
+  (void)reader.String(spec, "text", &text);
+  value.kind = static_cast<fm_value_kind_t>(reader.I32(spec, "kind", FM_VAL_BLANK));
+  switch (value.kind) {
+    case FM_VAL_NUMBER:
+      value.u.number = reader.Double(spec, "number", 0.0);
+      break;
+    case FM_VAL_BOOL:
+      value.u.boolean = reader.I32(spec, "boolean", 0) != 0 ? 1 : 0;
+      break;
+    case FM_VAL_TEXT:
+      value.u.text = text.c_str();
+      break;
+    case FM_VAL_ERROR:
+      value.u.error_code = reader.I32(spec, "errorCode", 0);
+      break;
+    default:
+      break;
+  }
+  return reader.ok();
+}
+
+// Fills `out` ({status, cells, nextCursor}) from a cell-range page, which it
+// consumes. `rc` is the status of the call that produced `page`.
+void FillCellsPage(Napi::Env env, Napi::Object out, fm_cell_range_t* page, fm_status_t rc) {
+  Napi::Array cells = out.Get("cells").As<Napi::Array>();
+  if (rc != 0) {
+    out.Set("status", MakeErrorStatus(env, rc));
+    return;
+  }
+  size_t count = 0;
+  rc = fm_cell_range_count(page, &count);
+  for (size_t i = 0; rc == 0 && i < count; ++i) {
+    uint32_t row = 0;
+    uint32_t col = 0;
+    const char* formula = nullptr;
+    fm_value_t value{};
+    rc = fm_cell_range_at(page, i, &row, &col, &formula, &value);
+    if (rc != 0) {
+      break;
+    }
+    Napi::Object cell = Napi::Object::New(env);
+    cell.Set("row", Napi::Number::New(env, row));
+    cell.Set("col", Napi::Number::New(env, col));
+    cell.Set("formula", formula != nullptr ? static_cast<Napi::Value>(Napi::String::New(env, formula)) : env.Null());
+    cell.Set("value", TranslateValue(env, value));
+    cells.Set(static_cast<uint32_t>(i), cell);
+  }
+  uint64_t next = UINT64_MAX;
+  if (rc == 0) {
+    rc = fm_cell_range_next_cursor(page, &next);
+  }
+  fm_cell_range_destroy(page);
+  if (rc != 0) {
+    out.Set("status", MakeErrorStatus(env, rc));
+    return;
+  }
+  out.Set("status", MakeOkStatus(env));
+  if (next != UINT64_MAX) {
+    out.Set("nextCursor", Napi::Number::New(env, static_cast<double>(next)));
+  }
+}
+
+}  // namespace
+
+Napi::Value Workbook::GetCellsInRange(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  Napi::Array cells = Napi::Array::New(env);
+  out.Set("cells", cells);
+  out.Set("nextCursor", env.Null());
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    return out;
+  }
+  if (info.Length() < 2) {
+    out.Set("status",
+            MakeBindingArgumentError(env, "getCellsInRange expects (sheet:number, range:object, cursor?, limit?)"));
+    return out;
+  }
+  const bool has_cursor = info.Length() > 2 && info[2].IsNumber();
+  const uint64_t cursor = has_cursor ? static_cast<uint64_t>(info[2].As<Napi::Number>().DoubleValue()) : 0U;
+  const uint32_t limit = info.Length() > 3 && info[3].IsNumber() ? ArgU32(info, 3) : 0U;
+  CheckedSpecReader reader(env);
+  fm_merge_range range{};
+  if (!MergeRangeArg(reader, info, 1, &range)) {
+    return env.Undefined();
+  }
+  fm_cell_range_t* page = nullptr;
+  fm_status_t rc = fm_sheet_cells_in_range(handle_, ArgU32(info, 0), range.first_row, range.first_col, range.last_row,
+                                           range.last_col, cursor, limit, &page);
+  if (rc != 0) {
+    out.Set("status", MakeErrorStatus(env, rc));
+    return out;
+  }
+  FillCellsPage(env, out, page, rc);
+  return out;
+}
+
+Napi::Value Workbook::ListInvalidCells(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("cells", Napi::Array::New(env));
+  out.Set("nextCursor", env.Null());
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    return out;
+  }
+  const bool has_cursor = info.Length() > 1 && info[1].IsNumber();
+  const uint64_t cursor = has_cursor ? static_cast<uint64_t>(info[1].As<Napi::Number>().DoubleValue()) : 0U;
+  const uint32_t limit = info.Length() > 2 && info[2].IsNumber() ? ArgU32(info, 2) : 0U;
+  fm_cell_range_t* page = nullptr;
+  const fm_status_t rc = fm_sheet_list_invalid_cells(handle_, ArgU32(info, 0), cursor, limit, &page);
+  FillCellsPage(env, out, page, rc);
+  return out;
+}
+
+Napi::Value Workbook::ValidateValue(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("hasRule", Napi::Boolean::New(env, false));
+  out.Set("valid", Napi::Boolean::New(env, false));
+  out.Set("ruleIndex", Napi::Number::New(env, 0));
+  out.Set("errorStyle", Napi::Number::New(env, 0));
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    return out;
+  }
+  if (info.Length() < 4 || !info[3].IsObject()) {
+    out.Set("status",
+            MakeBindingArgumentError(env, "validateValue expects (sheet:number, row:number, col:number, value:Value)"));
+    return out;
+  }
+  std::string text;
+  fm_value_t value{};
+  CheckedSpecReader reader(env);
+  if (!ReadValueSpec(reader, info[3].As<Napi::Object>(), text, value)) {
+    return env.Undefined();
+  }
+  fm_validation_outcome outcome{};
+  const fm_status_t rc =
+      fm_sheet_validate_value(handle_, ArgU32(info, 0), ArgU32(info, 1), ArgU32(info, 2), &value, &outcome);
+  if (rc != 0) {
+    out.Set("status", MakeErrorStatus(env, rc));
+    return out;
+  }
+  out.Set("status", MakeOkStatus(env));
+  out.Set("hasRule", Napi::Boolean::New(env, outcome.has_rule != 0));
+  out.Set("valid", Napi::Boolean::New(env, outcome.valid != 0));
+  out.Set("ruleIndex", Napi::Number::New(env, outcome.rule_index));
+  out.Set("errorStyle", Napi::Number::New(env, outcome.error_style));
+  return out;
+}
+
+Napi::Value Workbook::GetDisplayText(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeDisplayResult(env, kBindingInvalidHandle, nullptr, 0);
+  }
+  const char* text = nullptr;
+  int32_t display_status = 0;
+  const fm_status_t rc =
+      fm_workbook_get_display_text(handle_, ArgU32(info, 0), ArgU32(info, 1), ArgU32(info, 2), &text, &display_status);
+  return MakeDisplayResult(env, rc, text, display_status);
+}
+
+Napi::Value Workbook::FormatValue(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeDisplayResult(env, kBindingInvalidHandle, nullptr, 0);
+  }
+  if (info.Length() < 1 || !info[0].IsObject()) {
+    Napi::Object out = MakeDisplayResult(env, kBindingNullPointer, nullptr, 0);
+    out.Set("status", MakeBindingArgumentError(env, "formatValue expects (value:Value, formatCode:string)"));
+    return out;
+  }
+  const Napi::Object spec = info[0].As<Napi::Object>();
+  const std::string format_code = ArgString(info, 1);
+  std::string text;
+  fm_value_t value{};
+  CheckedSpecReader reader(env);
+  if (!ReadValueSpec(reader, spec, text, value)) {
+    return env.Undefined();
+  }
+  const char* out_text = nullptr;
+  int32_t display_status = 0;
+  const fm_status_t rc = fm_workbook_format_value(handle_, &value, format_code.c_str(), &out_text, &display_status);
+  return MakeDisplayResult(env, rc, out_text, display_status);
+}
+
+}  // namespace formulon_node
diff --git a/src/node_addon/parts/conditional_format.cc b/src/node_addon/parts/conditional_format.cc
new file mode 100644
index 000000000..38a1c6fd6
--- /dev/null
+++ b/src/node_addon/parts/conditional_format.cc
@@ -0,0 +1,524 @@
+// Conditional-formatting bindings: the `evaluateCfRange` evaluator plus the
+// read / mutate surface for per-sheet conditional-format rules.
+
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <string>
+#include <vector>
+
+#include "c_api/borrowed_arena.h"
+#include "node_addon/parts/workbook_class.h"
+
+namespace formulon_node {
+namespace {
+
+fm_cf_color_t PullCfColor(CheckedSpecReader& reader, const Napi::Object& spec) {
+  fm_cf_color_t out{};
+  out.r = reader.U8(spec, "r", 0U);
+  out.g = reader.U8(spec, "g", 0U);
+  out.b = reader.U8(spec, "b", 0U);
+  out.a = reader.U8(spec, "a", 255U);
+  return out;
+}
+
+fm_cfvo_t PullCfvo(CheckedSpecReader& reader, const Napi::Object& spec, formulon::c_api::BorrowedStringArena* strings) {
+  fm_cfvo_t out{};
+  out.type = reader.U8(spec, "type", 0U);
+  out.gte = reader.Bool(spec, "gte", true) ? 1 : 0;
+  std::string value;
+  if (reader.String(spec, "value", &value)) {
+    out.value = strings->emplace(value);
+  }
+  return out;
+}
+
+Napi::Object CfColorToJs(Napi::Env env, fm_cf_color_t color) {
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("r", Napi::Number::New(env, color.r));
+  out.Set("g", Napi::Number::New(env, color.g));
+  out.Set("b", Napi::Number::New(env, color.b));
+  out.Set("a", Napi::Number::New(env, color.a));
+  return out;
+}
+
+Napi::Object CfvoToJs(Napi::Env env, const fm_cfvo_t& cfvo) {
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("type", Napi::Number::New(env, static_cast<uint32_t>(cfvo.type)));
+  out.Set("gte", Napi::Boolean::New(env, cfvo.gte != 0));
+  if (cfvo.value != nullptr) {
+    out.Set("value", Napi::String::New(env, cfvo.value));
+  }
+  return out;
+}
+
+}  // namespace
+
+// ---- Conditional formatting -----------------------------------------
+
+Napi::Value Workbook::EvaluateCfRange(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    out.Set("cells", Napi::Array::New(env));
+    return out;
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  const uint32_t first_row = ArgU32(info, 1);
+  const uint32_t first_col = ArgU32(info, 2);
+  const uint32_t last_row = ArgU32(info, 3);
+  const uint32_t last_col = ArgU32(info, 4);
+  // A missing `todaySerial` must disable `timePeriod` rules, matching the
+  // Python binding and the C ABI contract. `ArgDouble`'s 0.0 fallback is a
+  // valid Excel serial (1899-12-30), so it would silently evaluate those
+  // rules against that date instead of skipping them.
+  const double today_serial =
+      info.Length() > 5 ? info[5].ToNumber().DoubleValue() : std::numeric_limits<double>::quiet_NaN();
+  fm_cf_results_t* results = nullptr;
+  fm_status_t rc =
+      fm_workbook_cf_evaluate_range(handle_, sheet, first_row, first_col, last_row, last_col, today_serial, &results);
+  if (rc != 0) {
+    out.Set("status", MakeErrorStatus(env, rc));
+    out.Set("cells", Napi::Array::New(env));
+    return out;
+  }
+  const std::size_t cell_count = fm_cf_results_cell_count(results);
+  Napi::Array cells = Napi::Array::New(env, cell_count);
+  std::size_t emitted = 0;
+  for (std::size_t i = 0; i < cell_count; ++i) {
+    uint32_t row = 0;
+    uint32_t col = 0;
+    std::size_t match_count = 0;
+    if (fm_cf_results_cell_at(results, i, &row, &col, &match_count) != 0) {
+      // Defensive: skip entries the C ABI declines to materialise.
+      continue;
+    }
+    Napi::Array matches = Napi::Array::New(env, match_count);
+    std::size_t mj = 0;
+    for (std::size_t j = 0; j < match_count; ++j) {
+      fm_cf_match_t m{};
+      if (fm_cf_results_match_at(results, i, j, &m) != 0) {
+        continue;
+      }
+      matches.Set(static_cast<uint32_t>(mj), TranslateCfMatch(env, m));
+      ++mj;
+    }
+    Napi::Object cell = Napi::Object::New(env);
+    cell.Set("row", Napi::Number::New(env, row));
+    cell.Set("col", Napi::Number::New(env, col));
+    cell.Set("matches", matches);
+    cells.Set(static_cast<uint32_t>(emitted), cell);
+    ++emitted;
+  }
+  fm_cf_results_destroy(results);
+  out.Set("status", MakeOkStatus(env));
+  out.Set("cells", cells);
+  return out;
+}
+
+// ---- Conditional formatting (read / mutate) -------------------------
+
+Napi::Value Workbook::GetConditionalFormats(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Array arr = Napi::Array::New(env);
+  if (handle_ == nullptr) {
+    return FinishListResult(env, arr, kBindingInvalidHandle);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  std::size_t count = 0;
+  fm_status_t rc = fm_sheet_cf_count(handle_, sheet, &count);
+  if (rc != 0) {
+    return FinishListResult(env, arr, rc);
+  }
+  std::size_t emitted = 0;
+  for (std::size_t i = 0; i < count; ++i) {
+    fm_cf_rule_t rule{};
+    rc = fm_sheet_cf_get_at(handle_, sheet, i, &rule);
+    if (rc != 0) {
+      return FinishListResult(env, arr, rc);
+    }
+    Napi::Object item = Napi::Object::New(env);
+    item.Set("id", Napi::String::New(env, rule.id != nullptr ? rule.id : ""));
+    item.Set("type", Napi::Number::New(env, static_cast<uint32_t>(rule.type)));
+    item.Set("priority", Napi::Number::New(env, rule.priority));
+    item.Set("stopIfTrue", Napi::Boolean::New(env, rule.stop_if_true != 0));
+    Napi::Array sqref = Napi::Array::New(env, rule.sqref_count);
+    for (uint32_t r = 0; r < rule.sqref_count; ++r) {
+      Napi::Object rng = Napi::Object::New(env);
+      rng.Set("firstRow", Napi::Number::New(env, rule.sqref[r].first_row));
+      rng.Set("firstCol", Napi::Number::New(env, rule.sqref[r].first_col));
+      rng.Set("lastRow", Napi::Number::New(env, rule.sqref[r].last_row));
+      rng.Set("lastCol", Napi::Number::New(env, rule.sqref[r].last_col));
+      sqref.Set(r, rng);
+    }
+    item.Set("sqref", sqref);
+    if (rule.dxf_id_engaged != 0) {
+      item.Set("dxfId", Napi::Number::New(env, rule.dxf_id));
+    }
+    if (rule.formula1 != nullptr) {
+      item.Set("formula1", Napi::String::New(env, rule.formula1));
+    }
+    if (rule.formula2 != nullptr) {
+      item.Set("formula2", Napi::String::New(env, rule.formula2));
+    }
+    if (rule.op_engaged != 0) {
+      item.Set("op", Napi::Number::New(env, static_cast<uint32_t>(rule.op)));
+    }
+    if (rule.rank_engaged != 0) {
+      item.Set("rank", Napi::Number::New(env, rule.rank));
+      item.Set("percent", Napi::Boolean::New(env, rule.percent != 0));
+      item.Set("bottom", Napi::Boolean::New(env, rule.bottom != 0));
+    }
+    // aboveAverage flags are always engineered but only meaningful for
+    // the AboveAverage rule type; surface them only there to mirror the
+    // embind shape.
+    if (rule.type == 6 /* AboveAverage */) {
+      item.Set("aboveAverage", Napi::Boolean::New(env, rule.above_average != 0));
+      item.Set("equalAverage", Napi::Boolean::New(env, rule.equal_average != 0));
+      if (rule.std_dev_engaged != 0) {
+        item.Set("stdDev", Napi::Number::New(env, rule.std_dev));
+      }
+    }
+    if (rule.text != nullptr) {
+      item.Set("text", Napi::String::New(env, rule.text));
+    }
+    if (rule.time_period_engaged != 0) {
+      item.Set("timePeriod", Napi::Number::New(env, static_cast<uint32_t>(rule.time_period)));
+    }
+    if (rule.color_scale_count > 0 && rule.color_scale_thresholds != nullptr && rule.color_scale_colors != nullptr) {
+      Napi::Object color_scale = Napi::Object::New(env);
+      Napi::Array thresholds = Napi::Array::New(env, rule.color_scale_count);
+      Napi::Array colors = Napi::Array::New(env, rule.color_scale_count);
+      for (uint32_t j = 0; j < rule.color_scale_count; ++j) {
+        thresholds.Set(j, CfvoToJs(env, rule.color_scale_thresholds[j]));
+        colors.Set(j, CfColorToJs(env, rule.color_scale_colors[j]));
+      }
+      color_scale.Set("thresholds", thresholds);
+      color_scale.Set("colors", colors);
+      item.Set("colorScale", color_scale);
+    }
+    if (rule.data_bar_engaged != 0) {
+      Napi::Object data_bar = Napi::Object::New(env);
+      data_bar.Set("min", CfvoToJs(env, rule.data_bar_min));
+      data_bar.Set("max", CfvoToJs(env, rule.data_bar_max));
+      data_bar.Set("fill", CfColorToJs(env, rule.data_bar_fill));
+      data_bar.Set("showValue", Napi::Boolean::New(env, rule.data_bar_show_value != 0));
+      data_bar.Set("minLengthPct", Napi::Number::New(env, static_cast<uint32_t>(rule.data_bar_min_length_pct)));
+      data_bar.Set("maxLengthPct", Napi::Number::New(env, static_cast<uint32_t>(rule.data_bar_max_length_pct)));
+      // `x14` extension payload. Each key appears only when the C ABI
+      // reports the matching `*_engaged` flag, so an absent key means the
+      // rule keeps the model default and the object round-trips through
+      // `addConditionalFormat` unchanged. The getter engages all six.
+      if (rule.data_bar_gradient_engaged != 0) {
+        data_bar.Set("gradient", Napi::Boolean::New(env, rule.data_bar_gradient != 0));
+      }
+      if (rule.data_bar_axis_position_engaged != 0) {
+        data_bar.Set("axisPosition", Napi::Number::New(env, static_cast<uint32_t>(rule.data_bar_axis_position)));
+      }
+      if (rule.data_bar_negative_fill_engaged != 0) {
+        data_bar.Set("negativeFill", CfColorToJs(env, rule.data_bar_negative_fill));
+      }
+      if (rule.data_bar_border_engaged != 0) {
+        data_bar.Set("border", CfColorToJs(env, rule.data_bar_border));
+      }
+      if (rule.data_bar_negative_border_engaged != 0) {
+        data_bar.Set("negativeBorder", CfColorToJs(env, rule.data_bar_negative_border));
+      }
+      if (rule.data_bar_axis_color_engaged != 0) {
+        data_bar.Set("axisColor", CfColorToJs(env, rule.data_bar_axis_color));
+      }
+      data_bar.Set("direction", Napi::Number::New(env, static_cast<uint32_t>(rule.data_bar_direction)));
+      item.Set("dataBar", data_bar);
+    }
+    if (rule.icon_set_engaged != 0) {
+      Napi::Object icon_set = Napi::Object::New(env);
+      icon_set.Set("name", Napi::Number::New(env, static_cast<uint32_t>(rule.icon_set_name)));
+      Napi::Array thresholds = Napi::Array::New(env, rule.icon_set_threshold_count);
+      for (uint32_t j = 0; j < rule.icon_set_threshold_count; ++j) {
+        thresholds.Set(j, CfvoToJs(env, rule.icon_set_thresholds[j]));
+      }
+      icon_set.Set("thresholds", thresholds);
+      icon_set.Set("reverse", Napi::Boolean::New(env, rule.icon_set_reverse != 0));
+      icon_set.Set("showValue", Napi::Boolean::New(env, rule.icon_set_show_value != 0));
+      icon_set.Set("percent", Napi::Boolean::New(env, rule.icon_set_percent != 0));
+      if (rule.icon_set_floor_engaged != 0) {
+        icon_set.Set("floor", CfvoToJs(env, rule.icon_set_floor));
+      }
+      item.Set("iconSet", icon_set);
+    }
+    arr.Set(static_cast<uint32_t>(emitted), item);
+    ++emitted;
+  }
+  return FinishListResult(env, arr, 0);
+}
+
+Napi::Value Workbook::AddConditionalFormat(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeNumberFieldResult(env, NullHandleError(env), "index", 0);
+  }
+  if (info.Length() < 2 || !info[0].IsNumber() || !info[1].IsObject()) {
+    Napi::TypeError::New(env, "addConditionalFormat expects (sheet:number, rule:object)").ThrowAsJavaScriptException();
+    return env.Undefined();
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  Napi::Object v = info[1].As<Napi::Object>();
+
+  // Pull every JS field into local storage first; the C ABI receives
+  // borrowed `const char*` views that must stay valid until
+  // `fm_sheet_cf_add_rule` returns. Threshold value strings go into an
+  // arena rather than a vector: the colorScale, dataBar and iconSet
+  // branches below all feed the same store, and a vector would relocate
+  // the earlier strings as the later branches add theirs.
+  std::vector<fm_cf_cell_range_t> ranges_buf;
+  std::vector<fm_cfvo_t> color_scale_thresholds;
+  std::vector<fm_cf_color_t> color_scale_colors;
+  std::vector<fm_cfvo_t> icon_set_thresholds;
+  formulon::c_api::BorrowedStringArena cfvo_strings;
+  CheckedSpecReader reader(env);
+  Napi::Array sqref_arr;
+  if (reader.Array(v, "sqref", &sqref_arr)) {
+    const uint32_t n = sqref_arr.Length();
+    if (!reader.ok()) {
+      return env.Undefined();
+    }
+    ranges_buf.reserve(n);
+    for (uint32_t i = 0; i < n; ++i) {
+      if (!reader.ok()) {
+        break;
+      }
+      Napi::Value rng_v;
+      if (!reader.ArrayElement(sqref_arr, i, &rng_v)) {
+        if (!reader.ok()) {
+          break;
+        }
+        continue;
+      }
+      if (!rng_v.IsObject()) {
+        continue;
+      }
+      Napi::Object rng = rng_v.As<Napi::Object>();
+      fm_cf_cell_range_t r{};
+      r.first_row = reader.U32(rng, "firstRow", 0U);
+      r.first_col = reader.U32(rng, "firstCol", 0U);
+      r.last_row = reader.U32(rng, "lastRow", 0U);
+      r.last_col = reader.U32(rng, "lastCol", 0U);
+      ranges_buf.push_back(r);
+    }
+  }
+  std::string id;
+  std::string formula1;
+  std::string formula2;
+  std::string text;
+  reader.String(v, "id", &id);
+  reader.String(v, "formula1", &formula1);
+  reader.String(v, "formula2", &formula2);
+  reader.String(v, "text", &text);
+
+  fm_cf_rule_t rule{};
+  rule.id = id.empty() ? nullptr : id.c_str();
+  rule.type = reader.U8(v, "type", 0U);
+  rule.priority = reader.I32(v, "priority", 0);
+  rule.stop_if_true = reader.Bool(v, "stopIfTrue", false) ? 1 : 0;
+  bool dxf_id_present = false;
+  rule.dxf_id = reader.U32(v, "dxfId", 0U, &dxf_id_present);
+  if (dxf_id_present) {
+    rule.dxf_id_engaged = 1;
+  }
+  rule.sqref = ranges_buf.empty() ? nullptr : ranges_buf.data();
+  rule.sqref_count = static_cast<uint32_t>(ranges_buf.size());
+  rule.formula1 = formula1.empty() ? nullptr : formula1.c_str();
+  rule.formula2 = formula2.empty() ? nullptr : formula2.c_str();
+  bool op_present = false;
+  rule.op = reader.U8(v, "op", 0U, &op_present);
+  if (op_present) {
+    rule.op_engaged = 1;
+  }
+  bool rank_present = false;
+  rule.rank = reader.I32(v, "rank", 0, &rank_present);
+  if (rank_present) {
+    rule.rank_engaged = 1;
+  }
+  rule.percent = reader.Bool(v, "percent", false) ? 1 : 0;
+  rule.bottom = reader.Bool(v, "bottom", false) ? 1 : 0;
+  rule.above_average = reader.Bool(v, "aboveAverage", true) ? 1 : 0;
+  rule.equal_average = reader.Bool(v, "equalAverage", false) ? 1 : 0;
+  bool std_dev_present = false;
+  rule.std_dev = reader.Double(v, "stdDev", 0.0, &std_dev_present);
+  if (std_dev_present) {
+    rule.std_dev_engaged = 1;
+  }
+  rule.text = text.empty() ? nullptr : text.c_str();
+  bool time_period_present = false;
+  rule.time_period = reader.U8(v, "timePeriod", 0U, &time_period_present);
+  if (time_period_present) {
+    rule.time_period_engaged = 1;
+  }
+  Napi::Object cs;
+  if (reader.Object(v, "colorScale", &cs)) {
+    Napi::Array arr;
+    if (reader.Array(cs, "thresholds", &arr)) {
+      color_scale_thresholds.reserve(arr.Length());
+      for (uint32_t i = 0; i < arr.Length(); ++i) {
+        if (!reader.ok()) {
+          break;
+        }
+        Napi::Value threshold;
+        if (!reader.ArrayElement(arr, i, &threshold)) {
+          if (!reader.ok()) {
+            break;
+          }
+          continue;
+        }
+        if (threshold.IsObject()) {
+          color_scale_thresholds.push_back(PullCfvo(reader, threshold.As<Napi::Object>(), &cfvo_strings));
+        }
+      }
+    }
+    if (reader.Array(cs, "colors", &arr)) {
+      color_scale_colors.reserve(arr.Length());
+      for (uint32_t i = 0; i < arr.Length(); ++i) {
+        if (!reader.ok()) {
+          break;
+        }
+        Napi::Value color;
+        if (!reader.ArrayElement(arr, i, &color)) {
+          if (!reader.ok()) {
+            break;
+          }
+          continue;
+        }
+        if (color.IsObject()) {
+          color_scale_colors.push_back(PullCfColor(reader, color.As<Napi::Object>()));
+        }
+      }
+    }
+    rule.color_scale_thresholds = color_scale_thresholds.empty() ? nullptr : color_scale_thresholds.data();
+    rule.color_scale_colors = color_scale_colors.empty() ? nullptr : color_scale_colors.data();
+    rule.color_scale_count = static_cast<uint32_t>(color_scale_thresholds.size());
+  }
+  Napi::Object db;
+  if (reader.Object(v, "dataBar", &db)) {
+    rule.data_bar_engaged = 1;
+    Napi::Object min;
+    if (reader.Object(db, "min", &min)) {
+      rule.data_bar_min = PullCfvo(reader, min, &cfvo_strings);
+    }
+    Napi::Object max;
+    if (reader.Object(db, "max", &max)) {
+      rule.data_bar_max = PullCfvo(reader, max, &cfvo_strings);
+    }
+    Napi::Object fill;
+    if (reader.Object(db, "fill", &fill)) {
+      rule.data_bar_fill = PullCfColor(reader, fill);
+    }
+    rule.data_bar_show_value = reader.Bool(db, "showValue", true) ? 1 : 0;
+    rule.data_bar_min_length_pct = reader.U8(db, "minLengthPct", 10U);
+    rule.data_bar_max_length_pct = reader.U8(db, "maxLengthPct", 90U);
+    // `x14` extension payload. An omitted key leaves the `*_engaged` flag
+    // clear, which the C ABI reads as "keep the model default" (gradient
+    // on, automatic axis, negative fill equal to the positive fill, no
+    // border, black axis).
+    bool gradient_present = false;
+    const bool gradient = reader.Bool(db, "gradient", true, &gradient_present);
+    if (gradient_present) {
+      rule.data_bar_gradient_engaged = 1;
+      rule.data_bar_gradient = gradient ? 1 : 0;
+    }
+    bool axis_position_present = false;
+    rule.data_bar_axis_position = reader.U8(db, "axisPosition", 0U, &axis_position_present);
+    if (axis_position_present) {
+      rule.data_bar_axis_position_engaged = 1;
+    }
+    Napi::Object negative_fill;
+    if (reader.Object(db, "negativeFill", &negative_fill)) {
+      rule.data_bar_negative_fill_engaged = 1;
+      rule.data_bar_negative_fill = PullCfColor(reader, negative_fill);
+    }
+    Napi::Object border;
+    if (reader.Object(db, "border", &border)) {
+      rule.data_bar_border_engaged = 1;
+      rule.data_bar_border = PullCfColor(reader, border);
+    }
+    Napi::Object negative_border;
+    if (reader.Object(db, "negativeBorder", &negative_border)) {
+      rule.data_bar_negative_border_engaged = 1;
+      rule.data_bar_negative_border = PullCfColor(reader, negative_border);
+    }
+    Napi::Object axis_color;
+    if (reader.Object(db, "axisColor", &axis_color)) {
+      rule.data_bar_axis_color_engaged = 1;
+      rule.data_bar_axis_color = PullCfColor(reader, axis_color);
+    }
+    rule.data_bar_direction = reader.U8(db, "direction", 0U);
+  }
+  Napi::Object is;
+  if (reader.Object(v, "iconSet", &is)) {
+    rule.icon_set_engaged = 1;
+    rule.icon_set_name = reader.U8(is, "name", 0U);
+    Napi::Array arr;
+    if (reader.Array(is, "thresholds", &arr)) {
+      icon_set_thresholds.reserve(arr.Length());
+      for (uint32_t i = 0; i < arr.Length(); ++i) {
+        if (!reader.ok()) {
+          break;
+        }
+        Napi::Value threshold;
+        if (!reader.ArrayElement(arr, i, &threshold)) {
+          if (!reader.ok()) {
+            break;
+          }
+          continue;
+        }
+        if (threshold.IsObject()) {
+          icon_set_thresholds.push_back(PullCfvo(reader, threshold.As<Napi::Object>(), &cfvo_strings));
+        }
+      }
+    }
+    rule.icon_set_thresholds = icon_set_thresholds.empty() ? nullptr : icon_set_thresholds.data();
+    rule.icon_set_threshold_count = static_cast<uint32_t>(icon_set_thresholds.size());
+    rule.icon_set_reverse = reader.Bool(is, "reverse", false) ? 1 : 0;
+    rule.icon_set_show_value = reader.Bool(is, "showValue", true) ? 1 : 0;
+    rule.icon_set_percent = reader.Bool(is, "percent", true) ? 1 : 0;
+    // An omitted floor keeps Excel's default, `percent 0`.
+    Napi::Object floor;
+    if (reader.Object(is, "floor", &floor)) {
+      rule.icon_set_floor_engaged = 1;
+      rule.icon_set_floor = PullCfvo(reader, floor, &cfvo_strings);
+    }
+  }
+  if (!reader.ok()) {
+    // See the matching guard in AddFont. The return value is discarded
+    // in favor of the pending exception either way.
+    return env.Undefined();
+  }
+  std::size_t new_index = 0;
+  fm_status_t rc = fm_sheet_cf_add_rule(handle_, sheet, rule, &new_index);
+  if (rc != 0) {
+    return MakeNumberFieldResult(env, MakeErrorStatus(env, rc), "index", 0);
+  }
+  return MakeNumberFieldResult(env, MakeOkStatus(env), "index", static_cast<double>(new_index));
+}
+
+Napi::Value Workbook::RemoveConditionalFormatAt(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const std::size_t index = static_cast<std::size_t>(ArgU32(info, 1));
+  fm_status_t rc = fm_sheet_cf_remove_at(handle_, sheet, index);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::ClearConditionalFormats(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  fm_status_t rc = fm_sheet_cf_clear(handle_, sheet);
+  return MakeStatus(env, rc);
+}
+}  // namespace formulon_node
diff --git a/src/node_addon/parts/free_funcs.cc b/src/node_addon/parts/free_funcs.cc
index 20b2152f4..8ad3ce14a 100644
--- a/src/node_addon/parts/free_funcs.cc
+++ b/src/node_addon/parts/free_funcs.cc
@@ -3,8 +3,10 @@
 
 #include "node_addon/parts/free_funcs.h"
 
+#include <cmath>
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 #include <mutex>
 #include <string>
 #include <vector>
@@ -67,6 +69,26 @@ void LogSinkTrampoline(const char* record, std::size_t len, void* /*user_data*/)
   }
 }
 
+bool ReadInt32(const Napi::CallbackInfo& info, std::size_t idx, std::int32_t* out) {
+  if (idx >= info.Length()) {
+    return true;
+  }
+  const Napi::Value value = info[idx];
+  if (!value.IsNumber()) {
+    Napi::TypeError::New(info.Env(), "positional argument must be a number").ThrowAsJavaScriptException();
+    return false;
+  }
+  const double number = value.As<Napi::Number>().DoubleValue();
+  if (!std::isfinite(number) || std::trunc(number) != number ||
+      number < static_cast<double>(std::numeric_limits<std::int32_t>::min()) ||
+      number > static_cast<double>(std::numeric_limits<std::int32_t>::max())) {
+    Napi::RangeError::New(info.Env(), "positional argument is outside int32 range").ThrowAsJavaScriptException();
+    return false;
+  }
+  *out = static_cast<std::int32_t>(number);
+  return true;
+}
+
 }  // namespace
 
 // Read-only ad-hoc evaluation anchored at `Sheet1!A1`, matching the embind
@@ -78,7 +100,11 @@ Napi::Value EvalFormula(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   std::string formula;
   if (info.Length() > 0) {
-    formula = info[0].ToString().Utf8Value();
+    if (!info[0].IsString()) {
+      Napi::TypeError::New(env, "formula must be a string").ThrowAsJavaScriptException();
+      return env.Undefined();
+    }
+    formula = info[0].As<Napi::String>().Utf8Value();
   }
 
   fm_workbook_t* wb = nullptr;
@@ -120,8 +146,8 @@ Napi::Value LastErrorContext(const Napi::CallbackInfo& info) {
 Napi::Value StatusString(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   int32_t code = 0;
-  if (info.Length() > 0) {
-    code = info[0].ToNumber().Int32Value();
+  if (!ReadInt32(info, 0, &code)) {
+    return env.Undefined();
   }
   const char* s = fm_status_string(static_cast<fm_status_t>(code));
   return Napi::String::New(env, s != nullptr ? s : "");
@@ -130,8 +156,8 @@ Napi::Value StatusString(const Napi::CallbackInfo& info) {
 Napi::Value ErrorDisplayName(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   int32_t code = 0;
-  if (info.Length() > 0) {
-    code = info[0].ToNumber().Int32Value();
+  if (!ReadInt32(info, 0, &code)) {
+    return env.Undefined();
   }
   const char* s = fm_error_display_name(static_cast<fm_error_code_t>(code));
   return Napi::String::New(env, s != nullptr ? s : "");
@@ -140,8 +166,8 @@ Napi::Value ErrorDisplayName(const Napi::CallbackInfo& info) {
 Napi::Value SetLogMinLevel(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   int32_t level = 0;
-  if (info.Length() > 0) {
-    level = info[0].ToNumber().Int32Value();
+  if (!ReadInt32(info, 0, &level)) {
+    return env.Undefined();
   }
   return MakeStatus(env, fm_set_log_min_level(level));
 }
diff --git a/src/node_addon/parts/lifecycle.cc b/src/node_addon/parts/lifecycle.cc
index 369bbbeae..73ea08c4f 100644
--- a/src/node_addon/parts/lifecycle.cc
+++ b/src/node_addon/parts/lifecycle.cc
@@ -1,5 +1,5 @@
-// Workbook lifecycle bindings: cell mutation / read, recalc & save,
-// iterative-solver registration, and the trivial `isValid` predicate.
+// Workbook lifecycle bindings: calc policy, recalc & save, iterative-solver
+// registration, diagnostics, and the trivial `isValid` predicate.
 
 #include <cmath>
 #include <cstddef>
@@ -70,375 +70,6 @@ bool ReadThreadCount(const Napi::CallbackInfo& info, uint32_t& thread_count) {
 
 }  // namespace
 
-// ---- Cell mutation --------------------------------------------------
-
-Napi::Value Workbook::SetNumber(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const double value = ArgDouble(info, 3);
-  fm_status_t rc = fm_workbook_set_number(handle_, sheet, row, col, value);
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetBool(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  bool value = false;
-  if (info.Length() > 3) {
-    value = info[3].ToBoolean().Value();
-  }
-  fm_status_t rc = fm_workbook_set_bool(handle_, sheet, row, col, value ? 1 : 0);
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetError(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (info.Length() < 4) {
-    // Unlike the other cell-mutation setters, a missing 4th argument
-    // here has no sane zero-value default: `error_code = 0` silently
-    // writes `#NULL!`, masking a caller bug instead of surfacing it.
-    // Reject it the same way the WASM (embind arity check) and Python
-    // (required positional parameter) bindings already do.
-    Napi::TypeError::New(env, "setError requires 4 arguments (sheet, row, col, errorCode)")
-        .ThrowAsJavaScriptException();
-    return env.Undefined();
-  }
-  if (!info[3].IsNumber()) {
-    // `.As<Napi::Number>()` below is an unchecked cast: on a non-number
-    // 4th argument it does not itself throw, so without this check the
-    // mutation below would run first and any resulting exception would
-    // only surface afterwards, on return to JS.
-    Napi::TypeError::New(env, "setError: `errorCode` must be a number").ThrowAsJavaScriptException();
-    return env.Undefined();
-  }
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const int32_t error_code = info[3].As<Napi::Number>().Int32Value();
-  fm_status_t rc = fm_workbook_set_error(handle_, sheet, row, col, static_cast<fm_error_code_t>(error_code));
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetText(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const std::string text = ArgString(info, 3);
-  fm_status_t rc = fm_workbook_set_text(handle_, sheet, row, col, text.c_str());
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetCellPhonetic(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const std::string phonetic = ArgString(info, 3);
-  fm_status_t rc = fm_workbook_set_cell_phonetic(handle_, sheet, row, col, phonetic.c_str());
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetCellPhoneticRuns(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  if (info.Length() <= 3 || !info[3].IsArray()) {
-    return MakeBindingArgumentError(env, "setCellPhoneticRuns: `runs` must be an array of { sb, eb, text }");
-  }
-  const Napi::Array runs = info[3].As<Napi::Array>();
-  const uint32_t count = runs.Length();
-  // Two passes so no `c_str()` is taken before `texts` has finished growing.
-  std::vector<std::string> texts;
-  texts.reserve(count);
-  std::vector<fm_phonetic_run_t> records;
-  records.reserve(count);
-  for (uint32_t i = 0; i < count; ++i) {
-    Napi::Value element = runs.Get(i);
-    if (!element.IsObject()) {
-      return MakeBindingArgumentError(env, "setCellPhoneticRuns: each run must be an object { sb, eb, text }");
-    }
-    const Napi::Object run = element.As<Napi::Object>();
-    const Napi::Value text = run.Get("text");
-    texts.push_back(text.IsString() ? text.As<Napi::String>().Utf8Value() : std::string());
-    records.push_back(fm_phonetic_run_t{SpecPullU32(run, "sb", 0U), SpecPullU32(run, "eb", 0U), nullptr});
-  }
-  for (uint32_t i = 0; i < count; ++i) {
-    records[i].text = texts[i].c_str();
-  }
-  if (env.IsExceptionPending()) {
-    // A malformed `sb`/`eb` left a pending JS exception (see
-    // SpecPullU32): stop before the C ABI call commits a default value
-    // for it.
-    return env.Undefined();
-  }
-  fm_status_t rc = fm_workbook_set_cell_phonetic_runs(handle_, sheet, row, col, records.data(), records.size());
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetCellPhoneticProperties(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  if (info.Length() <= 3 || !info[3].IsObject()) {
-    return MakeBindingArgumentError(
-        env, "setCellPhoneticProperties: `properties` must be an object { fontId, type, alignment }");
-  }
-  const Napi::Object props = info[3].As<Napi::Object>();
-  const uint32_t font_id = SpecPullU32(props, "fontId", 0U);
-  const uint32_t type = SpecPullU32(props, "type", 0U);
-  const uint32_t alignment = SpecPullU32(props, "alignment", 0U);
-  if (env.IsExceptionPending()) {
-    // A malformed field left a pending JS exception (see SpecPullU32):
-    // stop before the C ABI call commits a default value for it.
-    return env.Undefined();
-  }
-  fm_status_t rc = fm_workbook_set_cell_phonetic_properties(handle_, sheet, row, col, font_id, type, alignment);
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetBlank(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  fm_status_t rc = fm_workbook_set_blank(handle_, sheet, row, col);
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetFormula(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const std::string formula = ArgString(info, 3);
-  fm_status_t rc = fm_workbook_set_formula(handle_, sheet, row, col, formula.c_str());
-  return MakeStatus(env, rc);
-}
-
-// ---- Cell read ------------------------------------------------------
-
-Napi::Value Workbook::GetValue(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeEmptyValueResult(env, NullHandleError(env));
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  fm_value_t v{};
-  fm_status_t rc = fm_workbook_get_value(handle_, sheet, row, col, &v);
-  return MakeValueResult(env, rc, v);
-}
-
-Napi::Value Workbook::GetCellPhonetic(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeStringFieldResult(env, NullHandleError(env), "value", "");
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const char* text = nullptr;
-  fm_status_t rc = fm_workbook_get_cell_phonetic(handle_, sheet, row, col, &text);
-  if (rc != 0) {
-    return MakeStringFieldResult(env, MakeErrorStatus(env, rc), "value", "");
-  }
-  return MakeStringFieldResult(env, MakeOkStatus(env), "value", text);
-}
-
-Napi::Value Workbook::GetCellPhoneticRuns(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeFieldResult(env, NullHandleError(env), "runs", Napi::Array::New(env, 0));
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  uint32_t count = 0;
-  fm_status_t rc = fm_workbook_get_cell_phonetic_run_count(handle_, sheet, row, col, &count);
-  Napi::Array out = Napi::Array::New(env, rc == 0 ? count : 0);
-  for (uint32_t i = 0; rc == 0 && i < count; ++i) {
-    fm_phonetic_run_t run{};
-    rc = fm_workbook_get_cell_phonetic_run(handle_, sheet, row, col, i, &run);
-    if (rc != 0) {
-      break;
-    }
-    Napi::Object entry = Napi::Object::New(env);
-    entry.Set("sb", Napi::Number::New(env, run.sb));
-    entry.Set("eb", Napi::Number::New(env, run.eb));
-    // Copied immediately: each read refreshes the handle's scratch, so the
-    // previous run's pointer is dead by the time the next one lands.
-    entry.Set("text", Napi::String::New(env, run.text != nullptr ? run.text : ""));
-    out.Set(i, entry);
-  }
-  if (rc != 0) {
-    return MakeFieldResult(env, MakeErrorStatus(env, rc), "runs", Napi::Array::New(env, 0));
-  }
-  return MakeFieldResult(env, MakeOkStatus(env), "runs", out);
-}
-
-Napi::Value Workbook::GetCellPhoneticProperties(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  uint32_t font_id = 0;
-  uint32_t type = 0;
-  uint32_t alignment = 0;
-  const fm_status_t rc =
-      handle_ != nullptr ? fm_workbook_get_cell_phonetic_properties(handle_, sheet, row, col, &font_id, &type,
-                                                                    &alignment)
-                         : kBindingInvalidHandle;
-  // The payload keys are declared unconditionally, so a failure reports the
-  // defaults beside the status rather than dropping them.
-  if (rc != 0) {
-    font_id = 0;
-    type = 0;
-    alignment = 0;
-  }
-  Napi::Object out = Napi::Object::New(env);
-  out.Set("fontId", Napi::Number::New(env, font_id));
-  out.Set("type", Napi::Number::New(env, type));
-  out.Set("alignment", Napi::Number::New(env, alignment));
-  out.Set("status", MakeStatus(env, rc));
-  return out;
-}
-
-Napi::Value Workbook::EvaluateFormulaText(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeEmptyValueResult(env, NullHandleError(env));
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const std::string formula = ArgString(info, 3);
-  fm_value_t v{};
-  fm_status_t rc = fm_workbook_evaluate_formula(handle_, sheet, row, col, formula.c_str(), &v);
-  return MakeValueResult(env, rc, v);
-}
-
-Napi::Value Workbook::EvaluateFormulaArray(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  Napi::Object out = Napi::Object::New(env);
-  if (handle_ == nullptr) {
-    out.Set("status", NullHandleError(env));
-    out.Set("rows", Napi::Number::New(env, 0));
-    out.Set("cols", Napi::Number::New(env, 0));
-    out.Set("cells", Napi::Array::New(env, 0));
-    return out;
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const std::string formula = ArgString(info, 3);
-
-  uint32_t rows = 0;
-  uint32_t cols = 0;
-  fm_status_t rc = fm_workbook_evaluate_formula_array(handle_, sheet, row, col, formula.c_str(), &rows, &cols);
-  if (rc != 0) {
-    out.Set("status", MakeErrorStatus(env, rc));
-    out.Set("rows", Napi::Number::New(env, 0));
-    out.Set("cols", Napi::Number::New(env, 0));
-    out.Set("cells", Napi::Array::New(env, 0));
-    return out;
-  }
-
-  // Build a rows x cols nested array of Value objects, reading each stashed
-  // cell by its row-major index (r * cols + c).
-  Napi::Array cells = Napi::Array::New(env, rows);
-  for (uint32_t r = 0; r < rows; ++r) {
-    Napi::Array js_row = Napi::Array::New(env, cols);
-    for (uint32_t c = 0; c < cols; ++c) {
-      const std::size_t index = static_cast<std::size_t>(r) * cols + c;
-      fm_value_t v{};
-      fm_status_t cell_rc = fm_workbook_evaluate_formula_array_cell(handle_, index, &v);
-      if (cell_rc != 0) {
-        out.Set("status", MakeErrorStatus(env, cell_rc));
-        out.Set("rows", Napi::Number::New(env, 0));
-        out.Set("cols", Napi::Number::New(env, 0));
-        out.Set("cells", Napi::Array::New(env, 0));
-        return out;
-      }
-      js_row.Set(c, TranslateValue(env, v));
-    }
-    cells.Set(r, js_row);
-  }
-
-  out.Set("status", MakeOkStatus(env));
-  out.Set("rows", Napi::Number::New(env, rows));
-  out.Set("cols", Napi::Number::New(env, cols));
-  out.Set("cells", cells);
-  return out;
-}
-
-Napi::Value Workbook::EvaluateConditionalFormula(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeEmptyValueResult(env, NullHandleError(env));
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const uint32_t anchor_row = ArgU32(info, 3);
-  const uint32_t anchor_col = ArgU32(info, 4);
-  const std::string formula = ArgString(info, 5);
-  fm_value_t v{};
-  fm_status_t rc =
-      fm_workbook_evaluate_cf_formula(handle_, sheet, row, col, anchor_row, anchor_col, formula.c_str(), &v);
-  return MakeValueResult(env, rc, v);
-}
-
-Napi::Value Workbook::GetLambdaText(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeStringFieldResult(env, NullHandleError(env), "text", "");
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const char* text = nullptr;
-  fm_status_t rc = fm_workbook_lambda_text_at(handle_, sheet, row, col, &text);
-  if (rc != 0) {
-    return MakeStringFieldResult(env, MakeErrorStatus(env, rc), "text", "");
-  }
-  return MakeStringFieldResult(env, MakeOkStatus(env), "text", text);
-}
-
 // ---- Calc policy / behaviour profile --------------------------------
 
 Napi::Value Workbook::CalcMode(const Napi::CallbackInfo& info) {
@@ -594,11 +225,15 @@ Napi::Value Workbook::PartialRecalc(const Napi::CallbackInfo& info) {
   fm_viewport vp{};
   if (info.Length() > 0 && info[0].IsObject()) {
     Napi::Object vpobj = info[0].As<Napi::Object>();
-    vp.sheet = vpobj.Get("sheet").ToNumber().Uint32Value();
-    vp.first_row = vpobj.Get("firstRow").ToNumber().Uint32Value();
-    vp.last_row = vpobj.Get("lastRow").ToNumber().Uint32Value();
-    vp.first_col = vpobj.Get("firstCol").ToNumber().Uint32Value();
-    vp.last_col = vpobj.Get("lastCol").ToNumber().Uint32Value();
+    CheckedSpecReader reader(env);
+    vp.sheet = reader.U32(vpobj, "sheet", 0U);
+    vp.first_row = reader.U32(vpobj, "firstRow", 0U);
+    vp.last_row = reader.U32(vpobj, "lastRow", 0U);
+    vp.first_col = reader.U32(vpobj, "firstCol", 0U);
+    vp.last_col = reader.U32(vpobj, "lastCol", 0U);
+    if (!reader.ok()) {
+      return env.Undefined();
+    }
   }
   uint32_t recomputed = 0;
   (void)TakeIterativeProgressThrew();
diff --git a/src/node_addon/parts/pivot_cache.cc b/src/node_addon/parts/pivot_cache.cc
index 04c697b8b..577a5b74a 100644
--- a/src/node_addon/parts/pivot_cache.cc
+++ b/src/node_addon/parts/pivot_cache.cc
@@ -15,6 +15,24 @@
 
 namespace formulon_node {
 
+namespace {
+
+// Shared body of the per-cache count getters (fields, records).
+using CacheCountFn = fm_status_t (*)(const fm_workbook_t*, uint32_t, size_t*);
+
+Napi::Value CacheCountResult(const Napi::CallbackInfo& info, const fm_workbook_t* handle, CacheCountFn fn) {
+  Napi::Env env = info.Env();
+  if (handle == nullptr) {
+    return MakeNumberResult(env, kBindingInvalidHandle, 0);
+  }
+  const uint32_t cache_id = Workbook::ArgU32(info, 0);
+  std::size_t count = 0;
+  const fm_status_t rc = fn(handle, cache_id, &count);
+  return MakeNumberResult(env, rc, static_cast<double>(count));
+}
+
+}  // namespace
+
 Napi::Value Workbook::PivotCacheCount(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
@@ -97,13 +115,17 @@ Napi::Value Workbook::PivotCacheSetWorksheetSource(const Napi::CallbackInfo& inf
   }
   const uint32_t cache_id = ArgU32(info, 0);
   Napi::Object source = (info.Length() > 1 && info[1].IsObject()) ? info[1].As<Napi::Object>() : Napi::Object::New(env);
-  const bool present = SpecPullBool(source, "present", true);
-  const bool has_ref = SpecHas(source, "ref");
-  const bool has_sheet = SpecHas(source, "sheet");
-  const bool has_name = SpecHas(source, "name");
-  const std::string ref = has_ref ? source.Get("ref").ToString().Utf8Value() : std::string();
-  const std::string sheet = has_sheet ? source.Get("sheet").ToString().Utf8Value() : std::string();
-  const std::string name = has_name ? source.Get("name").ToString().Utf8Value() : std::string();
+  CheckedSpecReader reader(env);
+  const bool present = reader.Bool(source, "present", true);
+  std::string ref;
+  std::string sheet;
+  std::string name;
+  const bool has_ref = reader.String(source, "ref", &ref);
+  const bool has_sheet = reader.String(source, "sheet", &sheet);
+  const bool has_name = reader.String(source, "name", &name);
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
   fm_status_t rc = fm_workbook_pivot_cache_set_worksheet_source(
       handle_, cache_id, present ? 1 : 0, has_ref ? ref.c_str() : nullptr, has_sheet ? sheet.c_str() : nullptr,
       has_name ? name.c_str() : nullptr);
@@ -111,14 +133,7 @@ Napi::Value Workbook::PivotCacheSetWorksheetSource(const Napi::CallbackInfo& inf
 }
 
 Napi::Value Workbook::PivotCacheFieldCount(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeNumberResult(env, kBindingInvalidHandle, 0);
-  }
-  const uint32_t cache_id = ArgU32(info, 0);
-  std::size_t count = 0;
-  const fm_status_t rc = fm_workbook_pivot_cache_field_count(handle_, cache_id, &count);
-  return MakeNumberResult(env, rc, static_cast<double>(count));
+  return CacheCountResult(info, handle_, &fm_workbook_pivot_cache_field_count);
 }
 
 Napi::Value Workbook::PivotCacheFieldName(const Napi::CallbackInfo& info) {
@@ -251,14 +266,7 @@ Napi::Value Workbook::PivotCacheFieldClearSharedItems(const Napi::CallbackInfo&
 }
 
 Napi::Value Workbook::PivotCacheRecordCount(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeNumberResult(env, kBindingInvalidHandle, 0);
-  }
-  const uint32_t cache_id = ArgU32(info, 0);
-  std::size_t count = 0;
-  const fm_status_t rc = fm_workbook_pivot_cache_record_count(handle_, cache_id, &count);
-  return MakeNumberResult(env, rc, static_cast<double>(count));
+  return CacheCountResult(info, handle_, &fm_workbook_pivot_cache_record_count);
 }
 
 Napi::Value Workbook::PivotCacheRecordAdd(const Napi::CallbackInfo& info) {
diff --git a/src/node_addon/parts/pivot_table.cc b/src/node_addon/parts/pivot_table.cc
index a965deb6b..011e4f9af 100644
--- a/src/node_addon/parts/pivot_table.cc
+++ b/src/node_addon/parts/pivot_table.cc
@@ -141,12 +141,13 @@ Napi::Value Workbook::PivotFieldAdd(const Napi::CallbackInfo& info) {
   }
   Napi::Object spec = info[2].As<Napi::Object>();
 
-  const bool has_source = SpecHas(spec, "sourceName");
-  const std::string source_name = has_source ? spec.Get("sourceName").ToString().Utf8Value() : std::string();
-  const bool has_custom = SpecHas(spec, "customName");
-  const std::string custom_name = has_custom ? spec.Get("customName").ToString().Utf8Value() : std::string();
-  const bool has_nfmt = SpecHas(spec, "numberFormat");
-  const std::string number_format = has_nfmt ? spec.Get("numberFormat").ToString().Utf8Value() : std::string();
+  CheckedSpecReader reader(env);
+  std::string source_name;
+  std::string custom_name;
+  std::string number_format;
+  const bool has_source = reader.String(spec, "sourceName", &source_name);
+  const bool has_custom = reader.String(spec, "customName", &custom_name);
+  const bool has_nfmt = reader.String(spec, "numberFormat", &number_format);
 
   fm_pivot_field_spec_t c_spec{};
   // `sourceName` is required; an omitted key passes NULL through rather
@@ -155,13 +156,13 @@ Napi::Value Workbook::PivotFieldAdd(const Napi::CallbackInfo& info) {
   // what rejects the call.
   c_spec.source_name = has_source ? source_name.c_str() : nullptr;
   c_spec.custom_name = has_custom ? custom_name.c_str() : nullptr;
-  c_spec.axis = static_cast<fm_pivot_axis_t>(SpecPullU32(spec, "axis", 0U));
-  c_spec.subtotal_top = SpecPullBool(spec, "subtotalTop", false) ? 1 : 0;
+  c_spec.axis = static_cast<fm_pivot_axis_t>(reader.U32(spec, "axis", 0U));
+  c_spec.subtotal_top = reader.Bool(spec, "subtotalTop", false) ? 1 : 0;
   c_spec.number_format = has_nfmt ? number_format.c_str() : nullptr;
 
-  if (env.IsExceptionPending()) {
-    // A malformed `axis` left a pending JS exception (see SpecPullU32):
-    // stop before the C ABI call commits a default value for it.
+  if (!reader.ok()) {
+    // A malformed nested value left a pending JS exception: stop before the
+    // C ABI call commits a default value for it.
     return env.Undefined();
   }
   std::size_t out = 0;
@@ -321,9 +322,9 @@ Napi::Value Workbook::PivotFieldSetDateGroup(const Napi::CallbackInfo& info) {
   const std::uint32_t interval_days = info.Length() > 7 ? info[7].As<Napi::Number>().Uint32Value() : 1;
   const double start_serial = info.Length() > 8 ? info[8].As<Napi::Number>().DoubleValue() : -1.0;
   const double end_serial = info.Length() > 9 ? info[9].As<Napi::Number>().DoubleValue() : -1.0;
-  fm_status_t rc = fm_workbook_pivot_field_set_date_group(handle_, sheet, pivot_idx, field_idx, granularity, calendar,
-                                                          start_year, end_year, interval_days, start_serial,
-                                                          end_serial);
+  fm_status_t rc =
+      fm_workbook_pivot_field_set_date_group(handle_, sheet, pivot_idx, field_idx, granularity, calendar, start_year,
+                                             end_year, interval_days, start_serial, end_serial);
   return MakeStatus(env, rc);
 }
 
@@ -352,30 +353,41 @@ Napi::Value Workbook::PivotFieldSetNumberFormat(const Napi::CallbackInfo& info)
   return MakeStatus(env, rc);
 }
 
-Napi::Value Workbook::PivotSetRowFieldOrder(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::InvokePivotFieldOrder(const Napi::CallbackInfo& info, PivotFieldOrderFn fn) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
     return NullHandleError(env);
   }
   const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
   const std::size_t pivot_idx = static_cast<std::size_t>(ArgU32(info, 1));
-  const std::vector<uint32_t> indices = ReadU32Array(info, 2);
-  fm_status_t rc = fm_workbook_pivot_set_row_field_order(handle_, sheet, pivot_idx,
-                                                         indices.empty() ? nullptr : indices.data(), indices.size());
+  CheckedSpecReader reader(env);
+  std::vector<uint32_t> indices;
+  if (info.Length() > 2 && !info[2].IsUndefined() && !info[2].IsNull()) {
+    Napi::Array array;
+    if (!reader.Array(info[2], "indices", &array)) {
+      return env.Undefined();
+    }
+    const uint32_t length = array.Length();
+    indices.reserve(length);
+    for (uint32_t i = 0; i < length; ++i) {
+      Napi::Value value;
+      (void)reader.ArrayElement(array, i, &value);
+      indices.push_back(reader.U32(value, "indices element", 0U));
+    }
+  }
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  fm_status_t rc = fn(handle_, sheet, pivot_idx, indices.empty() ? nullptr : indices.data(), indices.size());
   return MakeStatus(env, rc);
 }
 
+Napi::Value Workbook::PivotSetRowFieldOrder(const Napi::CallbackInfo& info) {
+  return InvokePivotFieldOrder(info, &fm_workbook_pivot_set_row_field_order);
+}
+
 Napi::Value Workbook::PivotSetColFieldOrder(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const std::size_t pivot_idx = static_cast<std::size_t>(ArgU32(info, 1));
-  const std::vector<uint32_t> indices = ReadU32Array(info, 2);
-  fm_status_t rc = fm_workbook_pivot_set_col_field_order(handle_, sheet, pivot_idx,
-                                                         indices.empty() ? nullptr : indices.data(), indices.size());
-  return MakeStatus(env, rc);
+  return InvokePivotFieldOrder(info, &fm_workbook_pivot_set_col_field_order);
 }
 
 Napi::Value Workbook::PivotDataFieldCount(const Napi::CallbackInfo& info) {
@@ -405,10 +417,10 @@ Napi::Value Workbook::PivotDataFieldAdd(const Napi::CallbackInfo& info) {
   std::string name_buf;
   std::string nfmt_buf;
   bool has_nfmt = false;
-  BuildDataFieldSpec(spec, c_spec, name_buf, nfmt_buf, has_nfmt);
-  if (env.IsExceptionPending()) {
-    // A malformed field left a pending JS exception (see SpecPullU32 /
-    // SpecPullInt32 inside BuildDataFieldSpec): stop before the C ABI
+  CheckedSpecReader reader(env);
+  BuildDataFieldSpec(reader, spec, c_spec, name_buf, nfmt_buf, has_nfmt);
+  if (!reader.ok()) {
+    // A malformed field left a pending JS exception: stop before the C ABI
     // call commits a default value for it.
     return env.Undefined();
   }
@@ -447,8 +459,9 @@ Napi::Value Workbook::PivotDataFieldSet(const Napi::CallbackInfo& info) {
   std::string name_buf;
   std::string nfmt_buf;
   bool has_nfmt = false;
-  BuildDataFieldSpec(spec, c_spec, name_buf, nfmt_buf, has_nfmt);
-  if (env.IsExceptionPending()) {
+  CheckedSpecReader reader(env);
+  BuildDataFieldSpec(reader, spec, c_spec, name_buf, nfmt_buf, has_nfmt);
+  if (!reader.ok()) {
     // See the matching guard in PivotDataFieldAdd.
     return env.Undefined();
   }
@@ -509,28 +522,29 @@ Napi::Value Workbook::PivotFilterAdd(const Napi::CallbackInfo& info) {
   }
   Napi::Object spec = info[2].As<Napi::Object>();
 
-  const bool has_field = SpecHas(spec, "fieldName");
-  const std::string field_name = has_field ? spec.Get("fieldName").ToString().Utf8Value() : std::string();
-  const bool has_text = SpecHas(spec, "valueText");
-  const std::string value_text = has_text ? spec.Get("valueText").ToString().Utf8Value() : std::string();
+  CheckedSpecReader reader(env);
+  std::string field_name;
+  std::string value_text;
+  const bool has_field = reader.String(spec, "fieldName", &field_name);
+  const bool has_text = reader.String(spec, "valueText", &value_text);
 
   fm_pivot_filter_spec_t c_spec{};
-  c_spec.axis = static_cast<fm_pivot_axis_t>(SpecPullU32(spec, "axis", 0U));
+  c_spec.axis = static_cast<fm_pivot_axis_t>(reader.U32(spec, "axis", 0U));
   // `fieldName` is required; see the `sourceName` comment in
   // `PivotFieldAdd` above -- an omitted key must reach the C ABI as NULL,
   // not the coerced literal string "undefined".
   c_spec.field_name = has_field ? field_name.c_str() : nullptr;
-  c_spec.type = static_cast<fm_pivot_filter_type_t>(SpecPullU32(spec, "type", 0U));
-  c_spec.value_kind = static_cast<fm_pivot_filter_value_kind_t>(SpecPullInt32(spec, "valueKind", -1));
-  c_spec.value_int = SpecPullInt32(spec, "valueInt", 0);
-  c_spec.value_double = SpecPullDouble(spec, "valueDouble", 0.0);
+  c_spec.type = static_cast<fm_pivot_filter_type_t>(reader.U32(spec, "type", 0U));
+  c_spec.value_kind = static_cast<fm_pivot_filter_value_kind_t>(reader.I32(spec, "valueKind", -1));
+  c_spec.value_int = reader.I32(spec, "valueInt", 0);
+  c_spec.value_double = reader.Double(spec, "valueDouble", 0.0);
   c_spec.value_text = has_text ? value_text.c_str() : nullptr;
-  c_spec.value_high_kind = static_cast<fm_pivot_filter_value_kind_t>(SpecPullInt32(spec, "valueHighKind", -1));
-  c_spec.value_high_int = SpecPullInt32(spec, "valueHighInt", 0);
-  c_spec.value_high_double = SpecPullDouble(spec, "valueHighDouble", 0.0);
-  c_spec.data_field_index = SpecPullU32(spec, "dataFieldIndex", 0U);
+  c_spec.value_high_kind = static_cast<fm_pivot_filter_value_kind_t>(reader.I32(spec, "valueHighKind", -1));
+  c_spec.value_high_int = reader.I32(spec, "valueHighInt", 0);
+  c_spec.value_high_double = reader.Double(spec, "valueHighDouble", 0.0);
+  c_spec.data_field_index = reader.U32(spec, "dataFieldIndex", 0U);
 
-  if (env.IsExceptionPending()) {
+  if (!reader.ok()) {
     // A malformed numeric field left a pending JS exception: stop before
     // the C ABI call commits a default value for it.
     return env.Undefined();
diff --git a/src/node_addon/parts/print.cc b/src/node_addon/parts/print.cc
index ac86fd02c..d2d21d2c4 100644
--- a/src/node_addon/parts/print.cc
+++ b/src/node_addon/parts/print.cc
@@ -19,76 +19,76 @@ namespace {
 /// Reads an optional string property as the C tri-state: absent stays
 /// `nullptr` (leave that section alone), present owns its bytes in
 /// `storage` so the borrowed pointer outlives the call.
-const char* PullOptionalString(const Napi::Object& spec, const char* key, std::string& storage) {
-  if (!SpecHas(spec, key)) {
+const char* PullOptionalString(CheckedSpecReader& reader, const Napi::Object& spec, const char* key,
+                               std::string& storage) {
+  if (!reader.String(spec, key, &storage)) {
     return nullptr;
   }
-  storage = spec.Get(key).ToString().Utf8Value();
   return storage.c_str();
 }
 
 }  // namespace
 
-Napi::Value Workbook::XmlFragmentGetter(const Napi::CallbackInfo& info, XmlFragmentGetFn getter) {
+Napi::Value Workbook::SheetStringGetter(const Napi::CallbackInfo& info, SheetStringGetFn getter, const char* field) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
-    return MakeStringFieldResult(env, NullHandleError(env), "xml", nullptr);
+    return MakeStringFieldResult(env, NullHandleError(env), field, nullptr);
   }
-  const char* xml = nullptr;
-  const fm_status_t rc = getter(handle_, ArgU32(info, 0), &xml);
+  const char* text = nullptr;
+  const fm_status_t rc = getter(handle_, ArgU32(info, 0), &text);
   if (rc != 0) {
-    return MakeStringFieldResult(env, MakeErrorStatus(env, rc), "xml", nullptr);
+    return MakeStringFieldResult(env, MakeErrorStatus(env, rc), field, nullptr);
   }
-  return MakeStringFieldResult(env, MakeOkStatus(env), "xml", xml);
+  return MakeStringFieldResult(env, MakeOkStatus(env), field, text);
 }
 
-Napi::Value Workbook::XmlFragmentSetter(const Napi::CallbackInfo& info, XmlFragmentSetFn setter) {
+Napi::Value Workbook::SheetStringSetter(const Napi::CallbackInfo& info, SheetStringSetFn setter) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
     return NullHandleError(env);
   }
-  const std::string xml = ArgString(info, 1);
-  return MakeStatus(env, setter(handle_, ArgU32(info, 0), xml.c_str()));
+  const std::string text = ArgString(info, 1);
+  return MakeStatus(env, setter(handle_, ArgU32(info, 0), text.c_str()));
 }
 
 Napi::Value Workbook::GetSheetPageSetupXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentGetter(info, &fm_sheet_get_page_setup_xml);
+  return SheetStringGetter(info, &fm_sheet_get_page_setup_xml, "xml");
 }
 
 Napi::Value Workbook::SetSheetPageSetupXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentSetter(info, &fm_sheet_set_page_setup_xml);
+  return SheetStringSetter(info, &fm_sheet_set_page_setup_xml);
 }
 
 Napi::Value Workbook::GetSheetPageMarginsXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentGetter(info, &fm_sheet_get_page_margins_xml);
+  return SheetStringGetter(info, &fm_sheet_get_page_margins_xml, "xml");
 }
 
 Napi::Value Workbook::SetSheetPageMarginsXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentSetter(info, &fm_sheet_set_page_margins_xml);
+  return SheetStringSetter(info, &fm_sheet_set_page_margins_xml);
 }
 
 Napi::Value Workbook::GetSheetPrintOptionsXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentGetter(info, &fm_sheet_get_print_options_xml);
+  return SheetStringGetter(info, &fm_sheet_get_print_options_xml, "xml");
 }
 
 Napi::Value Workbook::SetSheetPrintOptionsXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentSetter(info, &fm_sheet_set_print_options_xml);
+  return SheetStringSetter(info, &fm_sheet_set_print_options_xml);
 }
 
 Napi::Value Workbook::GetSheetHeaderFooterXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentGetter(info, &fm_sheet_get_header_footer_xml);
+  return SheetStringGetter(info, &fm_sheet_get_header_footer_xml, "xml");
 }
 
 Napi::Value Workbook::SetSheetHeaderFooterXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentSetter(info, &fm_sheet_set_header_footer_xml);
+  return SheetStringSetter(info, &fm_sheet_set_header_footer_xml);
 }
 
 Napi::Value Workbook::GetSheetSheetPrXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentGetter(info, &fm_sheet_get_sheet_pr_xml);
+  return SheetStringGetter(info, &fm_sheet_get_sheet_pr_xml, "xml");
 }
 
 Napi::Value Workbook::SetSheetSheetPrXml(const Napi::CallbackInfo& info) {
-  return XmlFragmentSetter(info, &fm_sheet_set_sheet_pr_xml);
+  return SheetStringSetter(info, &fm_sheet_set_sheet_pr_xml);
 }
 
 Napi::Value Workbook::SetSheetFitToPage(const Napi::CallbackInfo& info) {
@@ -100,25 +100,11 @@ Napi::Value Workbook::SetSheetFitToPage(const Napi::CallbackInfo& info) {
 }
 
 Napi::Value Workbook::GetSheetPrintArea(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return MakeStringFieldResult(env, NullHandleError(env), "ranges", nullptr);
-  }
-  const char* ranges = nullptr;
-  const fm_status_t rc = fm_sheet_get_print_area(handle_, ArgU32(info, 0), &ranges);
-  if (rc != 0) {
-    return MakeStringFieldResult(env, MakeErrorStatus(env, rc), "ranges", nullptr);
-  }
-  return MakeStringFieldResult(env, MakeOkStatus(env), "ranges", ranges);
+  return SheetStringGetter(info, &fm_sheet_get_print_area, "ranges");
 }
 
 Napi::Value Workbook::SetSheetPrintArea(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::string ranges = ArgString(info, 1);
-  return MakeStatus(env, fm_sheet_set_print_area(handle_, ArgU32(info, 0), ranges.c_str()));
+  return SheetStringSetter(info, &fm_sheet_set_print_area);
 }
 
 Napi::Value Workbook::GetSheetPrintTitles(const Napi::CallbackInfo& info) {
@@ -245,21 +231,23 @@ Napi::Value Workbook::SetSheetPageSetup(const Napi::CallbackInfo& info) {
     return env.Undefined();
   }
   const Napi::Object spec = info[1].As<Napi::Object>();
+  CheckedSpecReader reader(env);
   fm_page_setup_t out{};
-  out.orientation_engaged = SpecHas(spec, "orientation") ? 1 : 0;
-  out.orientation = SpecPullU32(spec, "orientation", 0U);
-  out.paper_size_engaged = SpecHas(spec, "paperSize") ? 1 : 0;
-  out.paper_size = SpecPullU32(spec, "paperSize", 0U);
-  out.scale_engaged = SpecHas(spec, "scale") ? 1 : 0;
-  out.scale = SpecPullU32(spec, "scale", 0U);
-  out.fit_to_width_engaged = SpecHas(spec, "fitToWidth") ? 1 : 0;
-  out.fit_to_width = SpecPullU32(spec, "fitToWidth", 0U);
-  out.fit_to_height_engaged = SpecHas(spec, "fitToHeight") ? 1 : 0;
-  out.fit_to_height = SpecPullU32(spec, "fitToHeight", 0U);
-  out.fit_to_page_engaged = SpecHas(spec, "fitToPage") ? 1 : 0;
-  out.fit_to_page = SpecPullBool(spec, "fitToPage", false) ? 1 : 0;
-  if (env.IsExceptionPending()) {
-    // A malformed field left a pending JS exception (see SpecPullU32):
+  bool present = false;
+  out.orientation = reader.U32(spec, "orientation", 0U, &present);
+  out.orientation_engaged = present ? 1 : 0;
+  out.paper_size = reader.U32(spec, "paperSize", 0U, &present);
+  out.paper_size_engaged = present ? 1 : 0;
+  out.scale = reader.U32(spec, "scale", 0U, &present);
+  out.scale_engaged = present ? 1 : 0;
+  out.fit_to_width = reader.U32(spec, "fitToWidth", 0U, &present);
+  out.fit_to_width_engaged = present ? 1 : 0;
+  out.fit_to_height = reader.U32(spec, "fitToHeight", 0U, &present);
+  out.fit_to_height_engaged = present ? 1 : 0;
+  out.fit_to_page = reader.Bool(spec, "fitToPage", false, &present) ? 1 : 0;
+  out.fit_to_page_engaged = present ? 1 : 0;
+  if (!reader.ok()) {
+    // A malformed field left a pending JS exception:
     // stop before the C ABI call commits a default value for it.
     return env.Undefined();
   }
@@ -277,21 +265,23 @@ Napi::Value Workbook::SetSheetPageMargins(const Napi::CallbackInfo& info) {
     return env.Undefined();
   }
   const Napi::Object spec = info[1].As<Napi::Object>();
+  CheckedSpecReader reader(env);
   fm_page_margins_t out{};
-  out.left_engaged = SpecHas(spec, "left") ? 1 : 0;
-  out.left = SpecPullDouble(spec, "left", 0.0);
-  out.right_engaged = SpecHas(spec, "right") ? 1 : 0;
-  out.right = SpecPullDouble(spec, "right", 0.0);
-  out.top_engaged = SpecHas(spec, "top") ? 1 : 0;
-  out.top = SpecPullDouble(spec, "top", 0.0);
-  out.bottom_engaged = SpecHas(spec, "bottom") ? 1 : 0;
-  out.bottom = SpecPullDouble(spec, "bottom", 0.0);
-  out.header_engaged = SpecHas(spec, "header") ? 1 : 0;
-  out.header = SpecPullDouble(spec, "header", 0.0);
-  out.footer_engaged = SpecHas(spec, "footer") ? 1 : 0;
-  out.footer = SpecPullDouble(spec, "footer", 0.0);
-  if (env.IsExceptionPending()) {
-    // A malformed field left a pending JS exception (see SpecPullDouble):
+  bool present = false;
+  out.left = reader.Double(spec, "left", 0.0, &present);
+  out.left_engaged = present ? 1 : 0;
+  out.right = reader.Double(spec, "right", 0.0, &present);
+  out.right_engaged = present ? 1 : 0;
+  out.top = reader.Double(spec, "top", 0.0, &present);
+  out.top_engaged = present ? 1 : 0;
+  out.bottom = reader.Double(spec, "bottom", 0.0, &present);
+  out.bottom_engaged = present ? 1 : 0;
+  out.header = reader.Double(spec, "header", 0.0, &present);
+  out.header_engaged = present ? 1 : 0;
+  out.footer = reader.Double(spec, "footer", 0.0, &present);
+  out.footer_engaged = present ? 1 : 0;
+  if (!reader.ok()) {
+    // A malformed field left a pending JS exception:
     // stop before the C ABI call commits a default value for it.
     return env.Undefined();
   }
@@ -309,15 +299,20 @@ Napi::Value Workbook::SetSheetPrintOptions(const Napi::CallbackInfo& info) {
     return env.Undefined();
   }
   const Napi::Object spec = info[1].As<Napi::Object>();
+  CheckedSpecReader reader(env);
   fm_print_options_t out{};
-  out.grid_lines_engaged = SpecHas(spec, "gridLines") ? 1 : 0;
-  out.grid_lines = SpecPullBool(spec, "gridLines", false) ? 1 : 0;
-  out.headings_engaged = SpecHas(spec, "headings") ? 1 : 0;
-  out.headings = SpecPullBool(spec, "headings", false) ? 1 : 0;
-  out.horizontal_centered_engaged = SpecHas(spec, "horizontalCentered") ? 1 : 0;
-  out.horizontal_centered = SpecPullBool(spec, "horizontalCentered", false) ? 1 : 0;
-  out.vertical_centered_engaged = SpecHas(spec, "verticalCentered") ? 1 : 0;
-  out.vertical_centered = SpecPullBool(spec, "verticalCentered", false) ? 1 : 0;
+  bool present = false;
+  out.grid_lines = reader.Bool(spec, "gridLines", false, &present) ? 1 : 0;
+  out.grid_lines_engaged = present ? 1 : 0;
+  out.headings = reader.Bool(spec, "headings", false, &present) ? 1 : 0;
+  out.headings_engaged = present ? 1 : 0;
+  out.horizontal_centered = reader.Bool(spec, "horizontalCentered", false, &present) ? 1 : 0;
+  out.horizontal_centered_engaged = present ? 1 : 0;
+  out.vertical_centered = reader.Bool(spec, "verticalCentered", false, &present) ? 1 : 0;
+  out.vertical_centered_engaged = present ? 1 : 0;
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
   return MakeStatus(env, fm_sheet_set_print_options(handle_, ArgU32(info, 0), &out));
 }
 
@@ -332,6 +327,7 @@ Napi::Value Workbook::SetSheetHeaderFooter(const Napi::CallbackInfo& info) {
     return env.Undefined();
   }
   const Napi::Object spec = info[1].As<Napi::Object>();
+  CheckedSpecReader reader(env);
   // The six section strings are borrowed by the C struct, so their
   // storage has to outlive the call.
   std::string odd_header;
@@ -341,20 +337,24 @@ Napi::Value Workbook::SetSheetHeaderFooter(const Napi::CallbackInfo& info) {
   std::string first_header;
   std::string first_footer;
   fm_header_footer_t out{};
-  out.odd_header = PullOptionalString(spec, "oddHeader", odd_header);
-  out.odd_footer = PullOptionalString(spec, "oddFooter", odd_footer);
-  out.even_header = PullOptionalString(spec, "evenHeader", even_header);
-  out.even_footer = PullOptionalString(spec, "evenFooter", even_footer);
-  out.first_header = PullOptionalString(spec, "firstHeader", first_header);
-  out.first_footer = PullOptionalString(spec, "firstFooter", first_footer);
-  out.different_odd_even_engaged = SpecHas(spec, "differentOddEven") ? 1 : 0;
-  out.different_odd_even = SpecPullBool(spec, "differentOddEven", false) ? 1 : 0;
-  out.different_first_engaged = SpecHas(spec, "differentFirst") ? 1 : 0;
-  out.different_first = SpecPullBool(spec, "differentFirst", false) ? 1 : 0;
-  out.scale_with_doc_engaged = SpecHas(spec, "scaleWithDoc") ? 1 : 0;
-  out.scale_with_doc = SpecPullBool(spec, "scaleWithDoc", false) ? 1 : 0;
-  out.align_with_margins_engaged = SpecHas(spec, "alignWithMargins") ? 1 : 0;
-  out.align_with_margins = SpecPullBool(spec, "alignWithMargins", false) ? 1 : 0;
+  out.odd_header = PullOptionalString(reader, spec, "oddHeader", odd_header);
+  out.odd_footer = PullOptionalString(reader, spec, "oddFooter", odd_footer);
+  out.even_header = PullOptionalString(reader, spec, "evenHeader", even_header);
+  out.even_footer = PullOptionalString(reader, spec, "evenFooter", even_footer);
+  out.first_header = PullOptionalString(reader, spec, "firstHeader", first_header);
+  out.first_footer = PullOptionalString(reader, spec, "firstFooter", first_footer);
+  bool present = false;
+  out.different_odd_even = reader.Bool(spec, "differentOddEven", false, &present) ? 1 : 0;
+  out.different_odd_even_engaged = present ? 1 : 0;
+  out.different_first = reader.Bool(spec, "differentFirst", false, &present) ? 1 : 0;
+  out.different_first_engaged = present ? 1 : 0;
+  out.scale_with_doc = reader.Bool(spec, "scaleWithDoc", false, &present) ? 1 : 0;
+  out.scale_with_doc_engaged = present ? 1 : 0;
+  out.align_with_margins = reader.Bool(spec, "alignWithMargins", false, &present) ? 1 : 0;
+  out.align_with_margins_engaged = present ? 1 : 0;
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
   return MakeStatus(env, fm_sheet_set_header_footer(handle_, ArgU32(info, 0), &out));
 }
 
@@ -412,6 +412,98 @@ Napi::Value Workbook::GetSheetPageMargins(const Napi::CallbackInfo& info) {
   return result;
 }
 
+namespace {
+
+Napi::Object RectToJs(Napi::Env env, const fm_rect_pt& r) {
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("x", Napi::Number::New(env, r.x));
+  out.Set("y", Napi::Number::New(env, r.y));
+  out.Set("width", Napi::Number::New(env, r.width));
+  out.Set("height", Napi::Number::New(env, r.height));
+  return out;
+}
+
+// Sets the pagination detail keys on `result`. A null `pagination` yields the
+// all-zero record every failure path reports, so the keys exist on every exit.
+void SetPaginationDetail(Napi::Env env, Napi::Object result, const fm_pagination_t* pagination) {
+  fm_paper_info paper{};
+  fm_margins_pt margins{};
+  fm_rect_pt printable{};
+  double scale = 0.0;
+  int32_t page_order = 0;
+  fm_print_titles titles{};
+  Napi::Array pages = Napi::Array::New(env);
+  Napi::Array horizontal_manual = Napi::Array::New(env);
+  Napi::Array vertical_manual = Napi::Array::New(env);
+  if (pagination != nullptr) {
+    (void)fm_pagination_paper(pagination, &paper);
+    (void)fm_pagination_margins(pagination, &margins);
+    (void)fm_pagination_printable(pagination, &printable);
+    (void)fm_pagination_scale(pagination, &scale);
+    (void)fm_pagination_page_order(pagination, &page_order);
+    (void)fm_pagination_print_titles(pagination, &titles);
+    for (std::size_t i = 0; i < fm_pagination_page_count(pagination); ++i) {
+      fm_page_layout page{};
+      if (fm_pagination_page_at(pagination, i, &page) != 0) {
+        continue;
+      }
+      Napi::Object item = Napi::Object::New(env);
+      item.Set("areaIndex", Napi::Number::New(env, page.area_index));
+      item.Set("firstRow", Napi::Number::New(env, page.first_row));
+      item.Set("lastRow", Napi::Number::New(env, page.last_row));
+      item.Set("firstCol", Napi::Number::New(env, page.first_col));
+      item.Set("lastCol", Napi::Number::New(env, page.last_col));
+      item.Set("originXPt", Napi::Number::New(env, page.origin_x_pt));
+      item.Set("originYPt", Napi::Number::New(env, page.origin_y_pt));
+      item.Set("widthPt", Napi::Number::New(env, page.width_pt));
+      item.Set("heightPt", Napi::Number::New(env, page.height_pt));
+      pages.Set(i, item);
+    }
+    for (std::size_t i = 0; i < fm_pagination_horizontal_break_count(pagination); ++i) {
+      int32_t manual = 0;
+      if (fm_pagination_horizontal_break_is_manual(pagination, i, &manual) == 0) {
+        horizontal_manual.Set(i, Napi::Boolean::New(env, manual != 0));
+      }
+    }
+    for (std::size_t i = 0; i < fm_pagination_vertical_break_count(pagination); ++i) {
+      int32_t manual = 0;
+      if (fm_pagination_vertical_break_is_manual(pagination, i, &manual) == 0) {
+        vertical_manual.Set(i, Napi::Boolean::New(env, manual != 0));
+      }
+    }
+  }
+  Napi::Object paper_js = Napi::Object::New(env);
+  paper_js.Set("widthPt", Napi::Number::New(env, paper.width_pt));
+  paper_js.Set("heightPt", Napi::Number::New(env, paper.height_pt));
+  paper_js.Set("landscape", Napi::Boolean::New(env, paper.landscape != 0));
+  paper_js.Set("known", Napi::Boolean::New(env, paper.known != 0));
+  Napi::Object margins_js = Napi::Object::New(env);
+  margins_js.Set("left", Napi::Number::New(env, margins.left));
+  margins_js.Set("right", Napi::Number::New(env, margins.right));
+  margins_js.Set("top", Napi::Number::New(env, margins.top));
+  margins_js.Set("bottom", Napi::Number::New(env, margins.bottom));
+  margins_js.Set("header", Napi::Number::New(env, margins.header));
+  margins_js.Set("footer", Napi::Number::New(env, margins.footer));
+  Napi::Object titles_js = Napi::Object::New(env);
+  titles_js.Set("hasRows", Napi::Boolean::New(env, titles.has_rows != 0));
+  titles_js.Set("firstRow", Napi::Number::New(env, titles.first_row));
+  titles_js.Set("lastRow", Napi::Number::New(env, titles.last_row));
+  titles_js.Set("hasCols", Napi::Boolean::New(env, titles.has_cols != 0));
+  titles_js.Set("firstCol", Napi::Number::New(env, titles.first_col));
+  titles_js.Set("lastCol", Napi::Number::New(env, titles.last_col));
+  result.Set("paper", paper_js);
+  result.Set("margins", margins_js);
+  result.Set("printable", RectToJs(env, printable));
+  result.Set("scale", Napi::Number::New(env, scale));
+  result.Set("pageOrder", Napi::Number::New(env, page_order));
+  result.Set("printTitles", titles_js);
+  result.Set("pages", pages);
+  result.Set("horizontalBreakManual", horizontal_manual);
+  result.Set("verticalBreakManual", vertical_manual);
+}
+
+}  // namespace
+
 Napi::Value Workbook::Paginate(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   Napi::Object result = Napi::Object::New(env);
@@ -424,6 +516,7 @@ Napi::Value Workbook::Paginate(const Napi::CallbackInfo& info) {
     result.Set("horizontalBreaks", horizontal_breaks);
     result.Set("verticalBreaks", vertical_breaks);
     result.Set("pageCount", Napi::Number::New(env, 0));
+    SetPaginationDetail(env, result, nullptr);
     return result;
   }
   if (info.Length() < 1 || !info[0].IsNumber()) {
@@ -438,6 +531,7 @@ Napi::Value Workbook::Paginate(const Napi::CallbackInfo& info) {
     result.Set("horizontalBreaks", horizontal_breaks);
     result.Set("verticalBreaks", vertical_breaks);
     result.Set("pageCount", Napi::Number::New(env, 0));
+    SetPaginationDetail(env, result, nullptr);
     return result;
   }
   for (std::size_t i = 0; i < fm_pagination_print_area_count(pagination); ++i) {
@@ -469,6 +563,7 @@ Napi::Value Workbook::Paginate(const Napi::CallbackInfo& info) {
   result.Set("horizontalBreaks", horizontal_breaks);
   result.Set("verticalBreaks", vertical_breaks);
   result.Set("pageCount", Napi::Number::New(env, fm_pagination_page_count(pagination)));
+  SetPaginationDetail(env, result, pagination);
   fm_pagination_destroy(pagination);
   return result;
 }
diff --git a/src/node_addon/parts/sheet_ui.cc b/src/node_addon/parts/sheet_ui.cc
new file mode 100644
index 000000000..967554f0b
--- /dev/null
+++ b/src/node_addon/parts/sheet_ui.cc
@@ -0,0 +1,1344 @@
+// Per-sheet UI feature bindings: merges, comments, hyperlinks, and data
+// validations.
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <deque>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "node_addon/parts/workbook_class.h"
+
+namespace formulon_node {
+
+// ---- Merges ---------------------------------------------------------
+
+namespace {
+
+// Enumerates a per-sheet list through its count / at-index pair into a
+// `ListResult` array, stopping at the first failed element read.
+template <typename T>
+Napi::Value SheetListResult(const Napi::CallbackInfo& info, fm_workbook_t* handle,
+                            fm_status_t (*count_fn)(fm_workbook_t*, uint32_t, uint32_t*),
+                            fm_status_t (*at_fn)(fm_workbook_t*, uint32_t, uint32_t, T*),
+                            Napi::Object (*to_js)(Napi::Env, const T&)) {
+  Napi::Env env = info.Env();
+  Napi::Array arr = Napi::Array::New(env);
+  if (handle == nullptr) {
+    return FinishListResult(env, arr, kBindingInvalidHandle);
+  }
+  const uint32_t sheet = Workbook::ArgU32(info, 0);
+  uint32_t count = 0;
+  fm_status_t rc = count_fn(handle, sheet, &count);
+  if (rc != 0) {
+    return FinishListResult(env, arr, rc);
+  }
+  for (uint32_t i = 0; i < count; ++i) {
+    T entry{};
+    rc = at_fn(handle, sheet, i, &entry);
+    if (rc != 0) {
+      return FinishListResult(env, arr, rc);
+    }
+    arr.Set(i, to_js(env, entry));
+  }
+  return FinishListResult(env, arr, 0);
+}
+
+}  // namespace
+
+Napi::Value Workbook::AddMerge(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  CheckedSpecReader reader(env);
+  fm_merge_range range{};
+  if (!MergeRangeArg(reader, info, 1, &range)) {
+    return env.Undefined();
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  fm_status_t rc = fm_sheet_add_merge(handle_, sheet, range);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::RemoveMerge(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  CheckedSpecReader reader(env);
+  fm_merge_range range{};
+  if (!MergeRangeArg(reader, info, 1, &range)) {
+    return env.Undefined();
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  fm_status_t rc = fm_sheet_remove_merge(handle_, sheet, range);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::RemoveMergeAt(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  const uint32_t index = ArgU32(info, 1);
+  fm_status_t rc = fm_sheet_remove_merge_at(handle_, sheet, index);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::ClearMerges(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  fm_status_t rc = fm_sheet_clear_merges(handle_, sheet);
+  return MakeStatus(env, rc);
+}
+
+namespace {
+
+Napi::Object MergeToJs(Napi::Env env, const fm_merge_range& m) {
+  Napi::Object item = Napi::Object::New(env);
+  item.Set("firstRow", Napi::Number::New(env, m.first_row));
+  item.Set("lastRow", Napi::Number::New(env, m.last_row));
+  item.Set("firstCol", Napi::Number::New(env, m.first_col));
+  item.Set("lastCol", Napi::Number::New(env, m.last_col));
+  return item;
+}
+
+}  // namespace
+
+Napi::Value Workbook::GetMerges(const Napi::CallbackInfo& info) {
+  return SheetListResult(info, handle_, &fm_sheet_get_merge_count, &fm_sheet_get_merge_at, &MergeToJs);
+}
+
+Napi::Value Workbook::GetMergesInRange(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Array arr = Napi::Array::New(env);
+  if (handle_ == nullptr) {
+    return FinishListResult(env, arr, kBindingInvalidHandle);
+  }
+  CheckedSpecReader reader(env);
+  fm_merge_range range{};
+  if (!MergeRangeArg(reader, info, 1, &range)) {
+    return env.Undefined();
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  uint32_t total = 0;
+  fm_status_t rc = fm_sheet_merges_in_range(handle_, sheet, range, nullptr, 0, &total);
+  if (rc != 0) {
+    return FinishListResult(env, arr, rc);
+  }
+  std::vector<fm_merge_range> merges(total);
+  uint32_t again = 0;
+  rc = fm_sheet_merges_in_range(handle_, sheet, range, merges.data(), total, &again);
+  if (rc != 0) {
+    return FinishListResult(env, arr, rc);
+  }
+  for (uint32_t i = 0; i < total; ++i) {
+    Napi::Object item = Napi::Object::New(env);
+    item.Set("firstRow", Napi::Number::New(env, merges[i].first_row));
+    item.Set("lastRow", Napi::Number::New(env, merges[i].last_row));
+    item.Set("firstCol", Napi::Number::New(env, merges[i].first_col));
+    item.Set("lastCol", Napi::Number::New(env, merges[i].last_col));
+    arr.Set(i, item);
+  }
+  return FinishListResult(env, arr, 0);
+}
+
+// ---- Comments -------------------------------------------------------
+
+Napi::Value Workbook::GetComment(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return env.Null();
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  fm_comment c{};
+  if (fm_sheet_get_comment_at(handle_, sheet, row, col, &c) != 0) {
+    return env.Null();
+  }
+  Napi::Object o = Napi::Object::New(env);
+  o.Set("author", Napi::String::New(env, c.author != nullptr ? c.author : ""));
+  o.Set("text", Napi::String::New(env, c.text != nullptr ? c.text : ""));
+  return o;
+}
+
+Napi::Value Workbook::GetCommentResult(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    out.Set("comment", env.Null());
+    return out;
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  fm_comment c{};
+  const fm_status_t rc = fm_sheet_get_comment_at(handle_, sheet, row, col, &c);
+  if (rc != 0) {
+    out.Set("status", MakeErrorStatus(env, rc));
+    out.Set("comment", env.Null());
+    return out;
+  }
+  Napi::Object comment = Napi::Object::New(env);
+  comment.Set("author", Napi::String::New(env, c.author != nullptr ? c.author : ""));
+  comment.Set("text", Napi::String::New(env, c.text != nullptr ? c.text : ""));
+  out.Set("status", MakeOkStatus(env));
+  out.Set("comment", comment);
+  return out;
+}
+
+namespace {
+
+Napi::Object CommentToJs(Napi::Env env, const fm_comment& c) {
+  Napi::Object item = Napi::Object::New(env);
+  item.Set("row", Napi::Number::New(env, c.row));
+  item.Set("col", Napi::Number::New(env, c.col));
+  item.Set("author", Napi::String::New(env, c.author != nullptr ? c.author : ""));
+  item.Set("text", Napi::String::New(env, c.text != nullptr ? c.text : ""));
+  return item;
+}
+
+}  // namespace
+
+Napi::Value Workbook::GetComments(const Napi::CallbackInfo& info) {
+  return SheetListResult(info, handle_, &fm_sheet_get_comment_count, &fm_sheet_get_comment_at_index, &CommentToJs);
+}
+
+Napi::Value Workbook::SetComment(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  const std::string author = ArgString(info, 3);
+  const std::string text = ArgString(info, 4);
+  // Empty strings turn into NULL in the C ABI to remove an entry,
+  // matching the embind binding's contract.
+  const char* author_c = author.empty() ? nullptr : author.c_str();
+  const char* text_c = text.empty() ? nullptr : text.c_str();
+  fm_status_t rc = fm_sheet_set_comment(handle_, sheet, row, col, author_c, text_c);
+  return MakeStatus(env, rc);
+}
+
+// ---- Hyperlinks -----------------------------------------------------
+
+namespace {
+
+// Adds the hyperlink described by the already type-checked arguments
+// `(sheet, row, col[, lastRow, lastCol], target, display, tooltip, location)`.
+// Empty strings are forwarded as NULL.
+fm_status_t AddHyperlinkFromArgs(fm_workbook_t* wb, const Napi::CallbackInfo& info, bool ranged) {
+  const uint32_t sheet = Workbook::ArgU32(info, 0);
+  const uint32_t row = Workbook::ArgU32(info, 1);
+  const uint32_t col = Workbook::ArgU32(info, 2);
+  const uint32_t last_row = ranged ? Workbook::ArgU32(info, 3) : row;
+  const uint32_t last_col = ranged ? Workbook::ArgU32(info, 4) : col;
+  const std::size_t text_idx = ranged ? 5 : 3;
+  // Keep the std::string buffers alive until after the C ABI call so the
+  // borrowed `const char*` pointers in `fm_hyperlink` stay valid.
+  const std::string target = Workbook::ArgString(info, text_idx);
+  const std::string display = Workbook::ArgString(info, text_idx + 1);
+  const std::string tooltip = Workbook::ArgString(info, text_idx + 2);
+  const std::string location = Workbook::ArgString(info, text_idx + 3);
+  fm_hyperlink hl{};
+  hl.row = row;
+  hl.col = col;
+  hl.last_row = last_row;
+  hl.last_col = last_col;
+  hl.target = target.empty() ? nullptr : target.c_str();
+  hl.location = location.empty() ? nullptr : location.c_str();
+  hl.display = display.empty() ? nullptr : display.c_str();
+  hl.tooltip = tooltip.empty() ? nullptr : tooltip.c_str();
+  return fm_sheet_add_hyperlink(wb, sheet, hl);
+}
+
+}  // namespace
+
+Napi::Value Workbook::AddHyperlink(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  if (info.Length() < 7 || !info[0].IsNumber() || !info[1].IsNumber() || !info[2].IsNumber() || !info[3].IsString() ||
+      !info[4].IsString() || !info[5].IsString() || !info[6].IsString()) {
+    Napi::TypeError::New(env,
+                         "addHyperlink expects (sheet:number, row:number, col:number, "
+                         "target:string, display:string, tooltip:string, location:string)")
+        .ThrowAsJavaScriptException();
+    return env.Undefined();
+  }
+  return MakeStatus(env, AddHyperlinkFromArgs(handle_, info, /*ranged=*/false));
+}
+
+Napi::Value Workbook::AddHyperlinkRange(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  if (info.Length() < 9 || !info[0].IsNumber() || !info[1].IsNumber() || !info[2].IsNumber() || !info[3].IsNumber() ||
+      !info[4].IsNumber() || !info[5].IsString() || !info[6].IsString() || !info[7].IsString() || !info[8].IsString()) {
+    Napi::TypeError::New(env,
+                         "addHyperlinkRange expects (sheet:number, row:number, col:number, "
+                         "lastRow:number, lastCol:number, target:string, display:string, "
+                         "tooltip:string, location:string)")
+        .ThrowAsJavaScriptException();
+    return env.Undefined();
+  }
+  return MakeStatus(env, AddHyperlinkFromArgs(handle_, info, /*ranged=*/true));
+}
+
+namespace {
+
+Napi::Object HyperlinkToJs(Napi::Env env, const fm_hyperlink& h) {
+  Napi::Object item = Napi::Object::New(env);
+  item.Set("row", Napi::Number::New(env, h.row));
+  item.Set("col", Napi::Number::New(env, h.col));
+  item.Set("lastRow", Napi::Number::New(env, h.last_row));
+  item.Set("lastCol", Napi::Number::New(env, h.last_col));
+  item.Set("target", Napi::String::New(env, h.target != nullptr ? h.target : ""));
+  item.Set("location", Napi::String::New(env, h.location != nullptr ? h.location : ""));
+  item.Set("display", Napi::String::New(env, h.display != nullptr ? h.display : ""));
+  item.Set("tooltip", Napi::String::New(env, h.tooltip != nullptr ? h.tooltip : ""));
+  return item;
+}
+
+}  // namespace
+
+Napi::Value Workbook::GetHyperlinks(const Napi::CallbackInfo& info) {
+  return SheetListResult(info, handle_, &fm_sheet_get_hyperlink_count, &fm_sheet_get_hyperlink_at, &HyperlinkToJs);
+}
+
+Napi::Value Workbook::RemoveHyperlink(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  const uint32_t row = ArgU32(info, 1);
+  const uint32_t col = ArgU32(info, 2);
+  fm_status_t rc = fm_sheet_remove_hyperlink(handle_, sheet, row, col);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::RemoveHyperlinkAt(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  const uint32_t index = ArgU32(info, 1);
+  fm_status_t rc = fm_sheet_remove_hyperlink_at(handle_, sheet, index);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::ClearHyperlinks(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  fm_status_t rc = fm_sheet_clear_hyperlinks(handle_, sheet);
+  return MakeStatus(env, rc);
+}
+
+// ---- Validations ----------------------------------------------------
+
+namespace {
+
+Napi::Object ValidationToJs(Napi::Env env, const fm_data_validation& v) {
+  Napi::Object item = Napi::Object::New(env);
+  Napi::Array ranges = Napi::Array::New(env);
+  for (uint32_t r = 0; r < v.range_count; ++r) {
+    Napi::Object rng = Napi::Object::New(env);
+    rng.Set("firstRow", Napi::Number::New(env, v.ranges[r].first_row));
+    rng.Set("lastRow", Napi::Number::New(env, v.ranges[r].last_row));
+    rng.Set("firstCol", Napi::Number::New(env, v.ranges[r].first_col));
+    rng.Set("lastCol", Napi::Number::New(env, v.ranges[r].last_col));
+    ranges.Set(r, rng);
+  }
+  item.Set("ranges", ranges);
+  item.Set("type", Napi::Number::New(env, v.type));
+  item.Set("op", Napi::Number::New(env, v.op));
+  item.Set("errorStyle", Napi::Number::New(env, v.error_style));
+  item.Set("allowBlank", Napi::Boolean::New(env, v.allow_blank != 0));
+  item.Set("showInputMessage", Napi::Boolean::New(env, v.show_input_message != 0));
+  item.Set("showErrorMessage", Napi::Boolean::New(env, v.show_error_message != 0));
+  item.Set("showDropDown", Napi::Boolean::New(env, v.show_dropdown != 0));
+  item.Set("formula1", Napi::String::New(env, v.formula1 != nullptr ? v.formula1 : ""));
+  item.Set("formula2", Napi::String::New(env, v.formula2 != nullptr ? v.formula2 : ""));
+  item.Set("errorTitle", Napi::String::New(env, v.error_title != nullptr ? v.error_title : ""));
+  item.Set("errorMessage", Napi::String::New(env, v.error_message != nullptr ? v.error_message : ""));
+  item.Set("promptTitle", Napi::String::New(env, v.prompt_title != nullptr ? v.prompt_title : ""));
+  item.Set("promptMessage", Napi::String::New(env, v.prompt_message != nullptr ? v.prompt_message : ""));
+  return item;
+}
+
+}  // namespace
+
+Napi::Value Workbook::GetValidations(const Napi::CallbackInfo& info) {
+  return SheetListResult(info, handle_, &fm_sheet_get_validation_count, &fm_sheet_get_validation_at, &ValidationToJs);
+}
+
+Napi::Value Workbook::AddValidation(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  if (info.Length() < 2 || !info[0].IsNumber() || !info[1].IsObject()) {
+    Napi::TypeError::New(env, "addValidation expects (sheet:number, validation:object)").ThrowAsJavaScriptException();
+    return env.Undefined();
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  Napi::Object v = info[1].As<Napi::Object>();
+  CheckedSpecReader reader(env);
+
+  // Pull every JS field into local storage first; the C ABI receives
+  // borrowed `const char*` views that must stay valid until
+  // `fm_sheet_add_validation` returns.
+  std::vector<fm_merge_range> ranges_buf;
+  Napi::Array ranges_arr;
+  if (reader.Array(v, "ranges", &ranges_arr)) {
+    const uint32_t n = ranges_arr.Length();
+    ranges_buf.reserve(n);
+    for (uint32_t i = 0; i < n && reader.ok(); ++i) {
+      Napi::Value range_value;
+      if (!reader.ArrayElement(ranges_arr, i, &range_value)) {
+        continue;
+      }
+      Napi::Object range;
+      if (!reader.Object(range_value, "ranges[]", &range)) {
+        break;
+      }
+      fm_merge_range parsed{};
+      if (!ReadMergeRange(reader, range, &parsed)) {
+        break;
+      }
+      ranges_buf.push_back(parsed);
+    }
+  }
+  std::string formula1;
+  std::string formula2;
+  std::string error_title;
+  std::string error_message;
+  std::string prompt_title;
+  std::string prompt_message;
+  reader.String(v, "formula1", &formula1);
+  reader.String(v, "formula2", &formula2);
+  reader.String(v, "errorTitle", &error_title);
+  reader.String(v, "errorMessage", &error_message);
+  reader.String(v, "promptTitle", &prompt_title);
+  reader.String(v, "promptMessage", &prompt_message);
+
+  fm_data_validation dv{};
+  dv.ranges = ranges_buf.empty() ? nullptr : ranges_buf.data();
+  dv.range_count = static_cast<uint32_t>(ranges_buf.size());
+  dv.type = reader.U8(v, "type", 0U);
+  dv.op = reader.U8(v, "op", 0U);
+  dv.error_style = reader.U8(v, "errorStyle", 0U);
+  dv.allow_blank = reader.Bool(v, "allowBlank", false) ? 1 : 0;
+  dv.show_input_message = reader.Bool(v, "showInputMessage", false) ? 1 : 0;
+  dv.show_error_message = reader.Bool(v, "showErrorMessage", false) ? 1 : 0;
+  dv.show_dropdown = reader.Bool(v, "showDropDown", true) ? 1 : 0;
+  dv.formula1 = formula1.empty() ? nullptr : formula1.c_str();
+  dv.formula2 = formula2.empty() ? nullptr : formula2.c_str();
+  dv.error_title = error_title.empty() ? nullptr : error_title.c_str();
+  dv.error_message = error_message.empty() ? nullptr : error_message.c_str();
+  dv.prompt_title = prompt_title.empty() ? nullptr : prompt_title.c_str();
+  dv.prompt_message = prompt_message.empty() ? nullptr : prompt_message.c_str();
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  fm_status_t rc = fm_sheet_add_validation(handle_, sheet, dv);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::RemoveValidationAt(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  const uint32_t index = ArgU32(info, 1);
+  fm_status_t rc = fm_sheet_remove_validation_at(handle_, sheet, index);
+  return MakeStatus(env, rc);
+}
+
+Napi::Value Workbook::ClearValidations(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  fm_status_t rc = fm_sheet_clear_validations(handle_, sheet);
+  return MakeStatus(env, rc);
+}
+
+// ---- Typed AutoFilter -----------------------------------------------
+
+namespace {
+
+constexpr uint32_t kAbsentDxfId = UINT32_MAX;
+
+bool PullString(CheckedSpecReader& reader, const Napi::Object& spec, const char* key, std::string* out) {
+  return reader.String(spec, key, out);
+}
+
+Napi::Value MergeRangeToJs(Napi::Env env, const fm_merge_range& r) {
+  Napi::Object o = Napi::Object::New(env);
+  o.Set("firstRow", Napi::Number::New(env, r.first_row));
+  o.Set("lastRow", Napi::Number::New(env, r.last_row));
+  o.Set("firstCol", Napi::Number::New(env, r.first_col));
+  o.Set("lastCol", Napi::Number::New(env, r.last_col));
+  return o;
+}
+
+bool PullRange(CheckedSpecReader& reader, const Napi::Object& spec, const char* key, fm_merge_range* out) {
+  *out = fm_merge_range{};
+  Napi::Object object;
+  if (!reader.Object(spec, key, &object)) {
+    return reader.ok();
+  }
+  return ReadMergeRange(reader, object, out);
+}
+
+Napi::Value CStr(Napi::Env env, const char* s) {
+  return Napi::String::New(env, s != nullptr ? s : "");
+}
+
+Napi::Value Num(Napi::Env env, double v) {
+  return Napi::Number::New(env, v);
+}
+
+Napi::Value Bool(Napi::Env env, int32_t v) {
+  return Napi::Boolean::New(env, v != 0);
+}
+
+Napi::Object FilterColumnToJs(Napi::Env env, const fm_filter_column& c) {
+  Napi::Object o = Napi::Object::New(env);
+  o.Set("colId", Num(env, c.col_id));
+  o.Set("hiddenButton", Bool(env, c.hidden_button));
+  o.Set("showButton", Bool(env, c.show_button));
+  o.Set("kind", Num(env, c.kind));
+  o.Set("filterBlank", Bool(env, c.filter_blank));
+  Napi::Array values = Napi::Array::New(env, c.value_count);
+  for (uint32_t i = 0; i < c.value_count; ++i) {
+    values.Set(i, CStr(env, c.values[i]));
+  }
+  o.Set("values", values);
+  Napi::Array groups = Napi::Array::New(env, c.date_group_count);
+  for (uint32_t i = 0; i < c.date_group_count; ++i) {
+    const fm_date_group_item& g = c.date_groups[i];
+    Napi::Object item = Napi::Object::New(env);
+    item.Set("year", Num(env, g.year));
+    item.Set("month", Num(env, g.month));
+    item.Set("day", Num(env, g.day));
+    item.Set("hour", Num(env, g.hour));
+    item.Set("minute", Num(env, g.minute));
+    item.Set("second", Num(env, g.second));
+    item.Set("grouping", Num(env, g.grouping));
+    groups.Set(i, item);
+  }
+  o.Set("dateGroups", groups);
+  o.Set("customAnd", Bool(env, c.custom_and));
+  o.Set("customCount", Num(env, c.custom_count));
+  o.Set("op1", Num(env, c.op1));
+  o.Set("val1", CStr(env, c.val1));
+  o.Set("op2", Num(env, c.op2));
+  o.Set("val2", CStr(env, c.val2));
+  o.Set("top", Bool(env, c.top));
+  o.Set("percent", Bool(env, c.percent));
+  o.Set("hasFilterVal", Bool(env, c.has_filter_val));
+  o.Set("topVal", Num(env, c.top_val));
+  o.Set("filterVal", Num(env, c.filter_val));
+  o.Set("dynamicType", Num(env, c.dynamic_type));
+  o.Set("hasDynVal", Bool(env, c.has_dyn_val));
+  o.Set("hasDynMaxVal", Bool(env, c.has_dyn_max_val));
+  o.Set("dynVal", Num(env, c.dyn_val));
+  o.Set("dynMaxVal", Num(env, c.dyn_max_val));
+  o.Set("valIso", CStr(env, c.val_iso));
+  o.Set("maxValIso", CStr(env, c.max_val_iso));
+  o.Set("dxfId", Num(env, c.dxf_id));
+  o.Set("cellColor", Bool(env, c.cell_color));
+  o.Set("iconSet", Num(env, c.icon_set));
+  o.Set("iconId", Num(env, c.icon_id));
+  o.Set("hasIconId", Bool(env, c.has_icon_id));
+  return o;
+}
+
+Napi::Object AutoFilterToJs(Napi::Env env, const fm_auto_filter& f) {
+  Napi::Object o = Napi::Object::New(env);
+  o.Set("range", MergeRangeToJs(env, f.range));
+  Napi::Array columns = Napi::Array::New(env, f.column_count);
+  for (uint32_t i = 0; i < f.column_count; ++i) {
+    columns.Set(i, FilterColumnToJs(env, f.columns[i]));
+  }
+  o.Set("columns", columns);
+  if (f.has_sort == 0) {
+    o.Set("sort", env.Null());
+    return o;
+  }
+  Napi::Object sort = Napi::Object::New(env);
+  sort.Set("ref", MergeRangeToJs(env, f.sort_ref));
+  sort.Set("columnSort", Bool(env, f.column_sort));
+  sort.Set("caseSensitive", Bool(env, f.case_sensitive));
+  sort.Set("sortMethod", Num(env, f.sort_method));
+  Napi::Array conditions = Napi::Array::New(env, f.condition_count);
+  for (uint32_t i = 0; i < f.condition_count; ++i) {
+    const fm_sort_condition& c = f.conditions[i];
+    Napi::Object item = Napi::Object::New(env);
+    item.Set("ref", MergeRangeToJs(env, c.ref));
+    item.Set("descending", Bool(env, c.descending));
+    item.Set("sortBy", Num(env, c.sort_by));
+    item.Set("customList", CStr(env, c.custom_list));
+    item.Set("dxfId", Num(env, c.dxf_id));
+    item.Set("hasDxfId", Bool(env, c.has_dxf_id));
+    item.Set("iconSet", Num(env, c.icon_set));
+    item.Set("iconId", Num(env, c.icon_id));
+    item.Set("hasIconId", Bool(env, c.has_icon_id));
+    conditions.Set(i, item);
+  }
+  sort.Set("conditions", conditions);
+  o.Set("sort", sort);
+  return o;
+}
+
+// Owns the strings and arrays an `fm_auto_filter` borrows from.
+struct AutoFilterInput {
+  fm_auto_filter filter{};
+  std::vector<fm_filter_column> columns;
+  std::vector<fm_sort_condition> conditions;
+  // A deque never relocates its elements, so the `c_str()` views stay valid.
+  std::deque<std::string> strings;
+  std::vector<std::vector<const char*>> value_ptrs;
+  std::vector<std::vector<fm_date_group_item>> groups;
+
+  const char* Keep(std::string s) {
+    strings.push_back(std::move(s));
+    return strings.back().c_str();
+  }
+};
+
+void ReadFilterColumn(CheckedSpecReader& reader, const Napi::Object& spec, AutoFilterInput& in, fm_filter_column& c) {
+  c = fm_filter_column{};
+  c.col_id = reader.U32(spec, "colId", 0U);
+  c.hidden_button = reader.Bool(spec, "hiddenButton", false) ? 1 : 0;
+  c.show_button = reader.Bool(spec, "showButton", true) ? 1 : 0;
+  c.kind = reader.I32(spec, "kind", 0);
+  c.filter_blank = reader.Bool(spec, "filterBlank", false) ? 1 : 0;
+  in.value_ptrs.emplace_back();
+  std::vector<const char*>& ptrs = in.value_ptrs.back();
+  Napi::Array values;
+  if (reader.Array(spec, "values", &values)) {
+    for (uint32_t i = 0; i < values.Length(); ++i) {
+      Napi::Value value;
+      if (!reader.ArrayElement(values, i, &value)) {
+        continue;
+      }
+      std::string text;
+      if (!reader.String(value, "values[]", &text)) {
+        break;
+      }
+      ptrs.push_back(in.Keep(std::move(text)));
+    }
+  }
+  c.values = ptrs.empty() ? nullptr : ptrs.data();
+  c.value_count = static_cast<uint32_t>(ptrs.size());
+  in.groups.emplace_back();
+  std::vector<fm_date_group_item>& groups = in.groups.back();
+  Napi::Array date_groups;
+  if (reader.Array(spec, "dateGroups", &date_groups)) {
+    const Napi::Array& arr = date_groups;
+    for (uint32_t i = 0; i < arr.Length(); ++i) {
+      Napi::Value group_value;
+      if (!reader.ArrayElement(arr, i, &group_value)) {
+        continue;
+      }
+      Napi::Object g;
+      if (!reader.Object(group_value, "dateGroups[]", &g)) {
+        break;
+      }
+      fm_date_group_item item{};
+      item.year = reader.U16(g, "year", 0U);
+      item.month = reader.U8(g, "month", 0U);
+      item.day = reader.U8(g, "day", 0U);
+      item.hour = reader.U8(g, "hour", 0U);
+      item.minute = reader.U8(g, "minute", 0U);
+      item.second = reader.U8(g, "second", 0U);
+      item.grouping = reader.U8(g, "grouping", 0U);
+      if (!reader.ok()) {
+        break;
+      }
+      groups.push_back(item);
+    }
+  }
+  c.date_groups = groups.empty() ? nullptr : groups.data();
+  c.date_group_count = static_cast<uint32_t>(groups.size());
+  c.custom_and = reader.Bool(spec, "customAnd", false) ? 1 : 0;
+  c.custom_count = reader.I32(spec, "customCount", 0);
+  c.op1 = reader.I32(spec, "op1", 0);
+  std::string val1;
+  PullString(reader, spec, "val1", &val1);
+  c.val1 = in.Keep(std::move(val1));
+  c.op2 = reader.I32(spec, "op2", 0);
+  std::string val2;
+  PullString(reader, spec, "val2", &val2);
+  c.val2 = in.Keep(std::move(val2));
+  c.top = reader.Bool(spec, "top", false) ? 1 : 0;
+  c.percent = reader.Bool(spec, "percent", false) ? 1 : 0;
+  c.has_filter_val = reader.Bool(spec, "hasFilterVal", false) ? 1 : 0;
+  c.top_val = reader.Double(spec, "topVal", 0.0);
+  c.filter_val = reader.Double(spec, "filterVal", 0.0);
+  c.dynamic_type = reader.I32(spec, "dynamicType", 0);
+  c.has_dyn_val = reader.Bool(spec, "hasDynVal", false) ? 1 : 0;
+  c.has_dyn_max_val = reader.Bool(spec, "hasDynMaxVal", false) ? 1 : 0;
+  c.dyn_val = reader.Double(spec, "dynVal", 0.0);
+  c.dyn_max_val = reader.Double(spec, "dynMaxVal", 0.0);
+  std::string val_iso;
+  std::string max_val_iso;
+  PullString(reader, spec, "valIso", &val_iso);
+  PullString(reader, spec, "maxValIso", &max_val_iso);
+  c.val_iso = in.Keep(std::move(val_iso));
+  c.max_val_iso = in.Keep(std::move(max_val_iso));
+  c.dxf_id = reader.U32(spec, "dxfId", kAbsentDxfId);
+  c.cell_color = reader.Bool(spec, "cellColor", false) ? 1 : 0;
+  c.icon_set = reader.I32(spec, "iconSet", 0);
+  c.icon_id = reader.I32(spec, "iconId", 0);
+  c.has_icon_id = reader.Bool(spec, "hasIconId", false) ? 1 : 0;
+}
+
+void ReadSortCondition(CheckedSpecReader& reader, const Napi::Object& spec, AutoFilterInput& in, fm_sort_condition& c) {
+  c = fm_sort_condition{};
+  PullRange(reader, spec, "ref", &c.ref);
+  c.descending = reader.Bool(spec, "descending", false) ? 1 : 0;
+  c.sort_by = reader.I32(spec, "sortBy", 0);
+  std::string custom_list;
+  PullString(reader, spec, "customList", &custom_list);
+  c.custom_list = in.Keep(std::move(custom_list));
+  c.dxf_id = reader.U32(spec, "dxfId", kAbsentDxfId);
+  c.has_dxf_id = reader.Bool(spec, "hasDxfId", false) ? 1 : 0;
+  c.icon_set = reader.I32(spec, "iconSet", 0);
+  c.icon_id = reader.I32(spec, "iconId", 0);
+  c.has_icon_id = reader.Bool(spec, "hasIconId", false) ? 1 : 0;
+}
+
+// Reads the `AutoFilter` record at `info[idx]`; false when it is not an object.
+bool ReadAutoFilter(CheckedSpecReader& reader, const Napi::CallbackInfo& info, size_t idx, AutoFilterInput& in) {
+  if (info.Length() <= idx || !info[idx].IsObject()) {
+    return false;
+  }
+  const Napi::Object spec = info[idx].As<Napi::Object>();
+  fm_auto_filter& f = in.filter;
+  PullRange(reader, spec, "range", &f.range);
+  Napi::Array columns;
+  if (reader.Array(spec, "columns", &columns)) {
+    for (uint32_t i = 0; i < columns.Length() && reader.ok(); ++i) {
+      Napi::Value column_value;
+      if (!reader.ArrayElement(columns, i, &column_value)) {
+        continue;
+      }
+      Napi::Object column;
+      if (!reader.Object(column_value, "columns[]", &column)) {
+        break;
+      }
+      in.columns.emplace_back();
+      ReadFilterColumn(reader, column, in, in.columns.back());
+    }
+  }
+  Napi::Object sort;
+  const bool has_sort = reader.Object(spec, "sort", &sort);
+  if (!reader.ok()) {
+    return false;
+  }
+  Napi::Array conditions;
+  if (has_sort && reader.Array(sort, "conditions", &conditions)) {
+    for (uint32_t i = 0; i < conditions.Length() && reader.ok(); ++i) {
+      Napi::Value condition_value;
+      if (!reader.ArrayElement(conditions, i, &condition_value)) {
+        continue;
+      }
+      Napi::Object condition;
+      if (!reader.Object(condition_value, "conditions[]", &condition)) {
+        break;
+      }
+      in.conditions.emplace_back();
+      ReadSortCondition(reader, condition, in, in.conditions.back());
+    }
+  }
+  if (!reader.ok()) {
+    return false;
+  }
+  f.columns = in.columns.empty() ? nullptr : in.columns.data();
+  f.column_count = static_cast<uint32_t>(in.columns.size());
+  f.has_sort = has_sort ? 1 : 0;
+  if (has_sort) {
+    PullRange(reader, sort, "ref", &f.sort_ref);
+    f.column_sort = reader.Bool(sort, "columnSort", false) ? 1 : 0;
+    f.case_sensitive = reader.Bool(sort, "caseSensitive", false) ? 1 : 0;
+    f.sort_method = reader.I32(sort, "sortMethod", 0);
+  }
+  f.conditions = in.conditions.empty() ? nullptr : in.conditions.data();
+  f.condition_count = static_cast<uint32_t>(in.conditions.size());
+  return reader.ok();
+}
+
+// Shared by the sheet and table entry points: `table` selects which C
+// function family a call goes to, `idx` being the sheet or table index.
+Napi::Value GetAutoFilterImpl(Napi::Env env, const fm_workbook_t* wb, bool table, size_t idx) {
+  fm_auto_filter af{};
+  int32_t present = 0;
+  const fm_status_t rc =
+      table ? fm_table_get_auto_filter(wb, idx, &af, &present) : fm_sheet_get_auto_filter(wb, idx, &af, &present);
+  const bool has = rc == 0 && present != 0;
+  return MakeFieldResult(env, MakeStatus(env, rc), "autoFilter",
+                         has ? static_cast<Napi::Value>(AutoFilterToJs(env, af)) : env.Null());
+}
+
+Napi::Value EvaluateAutoFilterImpl(Napi::Env env, const fm_workbook_t* wb, bool table, size_t idx) {
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("firstRow", Num(env, 0));
+  out.Set("match", Napi::Array::New(env));
+  auto call = [&](uint8_t* buf, size_t cap, size_t* len, uint32_t* first) {
+    return table ? fm_table_evaluate_auto_filter(wb, idx, buf, cap, len, first)
+                 : fm_sheet_evaluate_auto_filter(wb, idx, buf, cap, len, first);
+  };
+  size_t len = 0;
+  uint32_t first = 0;
+  fm_status_t rc = call(nullptr, 0, &len, &first);
+  std::vector<uint8_t> flags(len);
+  if (rc == 0 && len > 0) {
+    rc = call(flags.data(), flags.size(), &len, &first);
+  }
+  if (rc != 0) {
+    out.Set("status", MakeErrorStatus(env, rc));
+    return out;
+  }
+  Napi::Array match = Napi::Array::New(env, flags.size());
+  for (size_t i = 0; i < flags.size(); ++i) {
+    match.Set(static_cast<uint32_t>(i), Napi::Boolean::New(env, flags[i] != 0));
+  }
+  out.Set("status", MakeOkStatus(env));
+  out.Set("firstRow", Num(env, first));
+  out.Set("match", match);
+  return out;
+}
+
+}  // namespace
+
+Napi::Value Workbook::GetAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeFieldResult(env, NullHandleError(env), "autoFilter", env.Null());
+  }
+  return GetAutoFilterImpl(env, handle_, false, ArgU32(info, 0));
+}
+
+Napi::Value Workbook::GetTableAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return MakeFieldResult(env, NullHandleError(env), "autoFilter", env.Null());
+  }
+  return GetAutoFilterImpl(env, handle_, true, ArgU32(info, 0));
+}
+
+Napi::Value Workbook::SetAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  CheckedSpecReader reader(env);
+  AutoFilterInput in;
+  if (!ReadAutoFilter(reader, info, 1, in)) {
+    if (!reader.ok()) {
+      return env.Undefined();
+    }
+    return MakeBindingArgumentError(env, "setAutoFilter expects (sheet:number, autoFilter:object)");
+  }
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  return MakeStatus(env, fm_sheet_set_auto_filter(handle_, ArgU32(info, 0), &in.filter));
+}
+
+Napi::Value Workbook::SetTableAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  CheckedSpecReader reader(env);
+  AutoFilterInput in;
+  if (!ReadAutoFilter(reader, info, 1, in)) {
+    if (!reader.ok()) {
+      return env.Undefined();
+    }
+    return MakeBindingArgumentError(env, "setTableAutoFilter expects (tableIdx:number, autoFilter:object)");
+  }
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  return MakeStatus(env, fm_table_set_auto_filter(handle_, ArgU32(info, 0), &in.filter));
+}
+
+Napi::Value Workbook::RemoveAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  return handle_ == nullptr ? NullHandleError(env)
+                            : MakeStatus(env, fm_sheet_remove_auto_filter(handle_, ArgU32(info, 0)));
+}
+
+Napi::Value Workbook::RemoveTableAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  return handle_ == nullptr ? NullHandleError(env)
+                            : MakeStatus(env, fm_table_remove_auto_filter(handle_, ArgU32(info, 0)));
+}
+
+Napi::Value Workbook::ApplyAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  return handle_ == nullptr ? NullHandleError(env)
+                            : MakeStatus(env, fm_sheet_apply_auto_filter(handle_, ArgU32(info, 0)));
+}
+
+Napi::Value Workbook::ApplyTableAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  return handle_ == nullptr ? NullHandleError(env)
+                            : MakeStatus(env, fm_table_apply_auto_filter(handle_, ArgU32(info, 0)));
+}
+
+Napi::Value Workbook::ClearAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  return handle_ == nullptr ? NullHandleError(env)
+                            : MakeStatus(env, fm_sheet_clear_auto_filter(handle_, ArgU32(info, 0)));
+}
+
+Napi::Value Workbook::ClearTableAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  return handle_ == nullptr ? NullHandleError(env)
+                            : MakeStatus(env, fm_table_clear_auto_filter(handle_, ArgU32(info, 0)));
+}
+
+Napi::Value Workbook::EvaluateAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    Napi::Object out = Napi::Object::New(env);
+    out.Set("status", NullHandleError(env));
+    out.Set("firstRow", Num(env, 0));
+    out.Set("match", Napi::Array::New(env));
+    return out;
+  }
+  return EvaluateAutoFilterImpl(env, handle_, false, ArgU32(info, 0));
+}
+
+Napi::Value Workbook::EvaluateTableAutoFilter(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    Napi::Object out = Napi::Object::New(env);
+    out.Set("status", NullHandleError(env));
+    out.Set("firstRow", Num(env, 0));
+    out.Set("match", Napi::Array::New(env));
+    return out;
+  }
+  return EvaluateAutoFilterImpl(env, handle_, true, ArgU32(info, 0));
+}
+
+// ---- Threaded comments and persons ----------------------------------
+
+namespace {
+
+// Reads the `Mention[]` at `arr`; `ids` backs the borrowed strings.
+bool ReadMentions(CheckedSpecReader& reader, const Napi::Value& arr, std::vector<std::string>& ids,
+                  std::vector<fm_mention>& out) {
+  Napi::Array list;
+  if (!reader.Array(arr, "mentions", &list)) {
+    return reader.ok();
+  }
+  ids.reserve(static_cast<size_t>(list.Length()) * 2U);
+  out.reserve(list.Length());
+  for (uint32_t i = 0; i < list.Length() && reader.ok(); ++i) {
+    Napi::Value mention_value;
+    if (!reader.ArrayElement(list, i, &mention_value)) {
+      continue;
+    }
+    Napi::Object m;
+    if (!reader.Object(mention_value, "mentions[]", &m)) {
+      break;
+    }
+    std::string person_id;
+    std::string mention_id;
+    PullString(reader, m, "personId", &person_id);
+    PullString(reader, m, "mentionId", &mention_id);
+    ids.push_back(std::move(person_id));
+    ids.push_back(std::move(mention_id));
+    fm_mention c{};
+    c.person_id = ids[ids.size() - 2].c_str();
+    c.mention_id = ids.back().c_str();
+    c.start = reader.U32(m, "start", 0U);
+    c.length = reader.U32(m, "length", 0U);
+    if (!reader.ok()) {
+      break;
+    }
+    out.push_back(c);
+  }
+  return reader.ok();
+}
+
+}  // namespace
+
+Napi::Value Workbook::GetThreadedComments(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Array arr = Napi::Array::New(env);
+  if (handle_ == nullptr) {
+    return MakeFieldResult(env, NullHandleError(env), "comments", arr);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  size_t count = 0;
+  fm_status_t rc = fm_sheet_threaded_comment_count(handle_, sheet, &count);
+  for (size_t i = 0; rc == 0 && i < count; ++i) {
+    fm_threaded_comment c{};
+    rc = fm_sheet_threaded_comment_at(handle_, sheet, i, &c);
+    if (rc != 0) {
+      break;
+    }
+    Napi::Object item = Napi::Object::New(env);
+    item.Set("id", CStr(env, c.id));
+    item.Set("row", Num(env, c.row));
+    item.Set("col", Num(env, c.col));
+    item.Set("personId", CStr(env, c.person_id));
+    item.Set("created", CStr(env, c.created));
+    item.Set("text", CStr(env, c.text));
+    item.Set("parentId", CStr(env, c.parent_id));
+    item.Set("done", Bool(env, c.done));
+    Napi::Array mentions = Napi::Array::New(env, c.mention_count);
+    for (uint32_t m = 0; m < c.mention_count; ++m) {
+      Napi::Object mention = Napi::Object::New(env);
+      mention.Set("personId", CStr(env, c.mentions[m].person_id));
+      mention.Set("mentionId", CStr(env, c.mentions[m].mention_id));
+      mention.Set("start", Num(env, c.mentions[m].start));
+      mention.Set("length", Num(env, c.mentions[m].length));
+      mentions.Set(m, mention);
+    }
+    item.Set("mentions", mentions);
+    arr.Set(static_cast<uint32_t>(i), item);
+  }
+  return MakeFieldResult(env, MakeStatus(env, rc), "comments", arr);
+}
+
+Napi::Value Workbook::AddThreadedComment(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  if (info.Length() < 2 || !info[1].IsObject()) {
+    return MakeBindingArgumentError(env, "addThreadedComment expects (sheet:number, comment:object)");
+  }
+  CheckedSpecReader reader(env);
+  const Napi::Object spec = info[1].As<Napi::Object>();
+  std::string id;
+  std::string person_id;
+  std::string created;
+  std::string text;
+  std::string parent_id;
+  PullString(reader, spec, "id", &id);
+  PullString(reader, spec, "personId", &person_id);
+  PullString(reader, spec, "created", &created);
+  PullString(reader, spec, "text", &text);
+  PullString(reader, spec, "parentId", &parent_id);
+  std::vector<std::string> mention_ids;
+  std::vector<fm_mention> mentions;
+  Napi::Array mention_array;
+  if (reader.Array(spec, "mentions", &mention_array)) {
+    ReadMentions(reader, mention_array, mention_ids, mentions);
+  }
+  fm_threaded_comment c{};
+  c.id = id.c_str();
+  c.row = reader.U32(spec, "row", 0U);
+  c.col = reader.U32(spec, "col", 0U);
+  c.person_id = person_id.c_str();
+  c.created = created.c_str();
+  c.text = text.c_str();
+  c.parent_id = parent_id.c_str();
+  c.done = reader.Bool(spec, "done", false) ? 1 : 0;
+  c.mentions = mentions.empty() ? nullptr : mentions.data();
+  c.mention_count = static_cast<uint32_t>(mentions.size());
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  return MakeStatus(env, fm_sheet_add_threaded_comment(handle_, ArgU32(info, 0), &c));
+}
+
+Napi::Value Workbook::EditThreadedComment(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  CheckedSpecReader reader(env);
+  const std::string id = ArgString(info, 1);
+  const std::string text = ArgString(info, 2);
+  std::vector<std::string> mention_ids;
+  std::vector<fm_mention> mentions;
+  if (info.Length() > 3) {
+    ReadMentions(reader, info[3], mention_ids, mentions);
+  }
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  return MakeStatus(env, fm_sheet_edit_threaded_comment(handle_, ArgU32(info, 0), id.c_str(), text.c_str(),
+                                                        mentions.empty() ? nullptr : mentions.data(),
+                                                        static_cast<uint32_t>(mentions.size())));
+}
+
+Napi::Value Workbook::SetThreadResolved(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::string thread_id = ArgString(info, 1);
+  return MakeStatus(
+      env, fm_sheet_set_thread_resolved(handle_, ArgU32(info, 0), thread_id.c_str(), ArgBool(info, 2) ? 1 : 0));
+}
+
+Napi::Value Workbook::RemoveThreadedComment(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::string id = ArgString(info, 1);
+  return MakeStatus(env, fm_sheet_remove_threaded_comment(handle_, ArgU32(info, 0), id.c_str()));
+}
+
+Napi::Value Workbook::GetPersons(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Array arr = Napi::Array::New(env);
+  if (handle_ == nullptr) {
+    return MakeFieldResult(env, NullHandleError(env), "persons", arr);
+  }
+  size_t count = 0;
+  fm_status_t rc = fm_workbook_person_count(handle_, &count);
+  for (size_t i = 0; rc == 0 && i < count; ++i) {
+    fm_person p{};
+    rc = fm_workbook_person_at(handle_, i, &p);
+    if (rc != 0) {
+      break;
+    }
+    Napi::Object item = Napi::Object::New(env);
+    item.Set("id", CStr(env, p.id));
+    item.Set("displayName", CStr(env, p.display_name));
+    item.Set("userId", CStr(env, p.user_id));
+    item.Set("providerId", CStr(env, p.provider_id));
+    arr.Set(static_cast<uint32_t>(i), item);
+  }
+  return MakeFieldResult(env, MakeStatus(env, rc), "persons", arr);
+}
+
+Napi::Value Workbook::AddPerson(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  if (info.Length() < 1 || !info[0].IsObject()) {
+    return MakeBindingArgumentError(env, "addPerson expects (person:object)");
+  }
+  CheckedSpecReader reader(env);
+  const Napi::Object spec = info[0].As<Napi::Object>();
+  std::string id;
+  std::string display_name;
+  std::string user_id;
+  std::string provider_id;
+  PullString(reader, spec, "id", &id);
+  PullString(reader, spec, "displayName", &display_name);
+  PullString(reader, spec, "userId", &user_id);
+  PullString(reader, spec, "providerId", &provider_id);
+  fm_person p{};
+  p.id = id.c_str();
+  p.display_name = display_name.c_str();
+  p.user_id = user_id.c_str();
+  p.provider_id = provider_id.c_str();
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  return MakeStatus(env, fm_workbook_add_person(handle_, &p));
+}
+
+Napi::Value Workbook::RemovePerson(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  const std::string id = ArgString(info, 0);
+  return MakeStatus(env, fm_workbook_remove_person(handle_, id.c_str()));
+}
+
+// ---- Drawing images -------------------------------------------------
+
+namespace {
+
+// Returns the bytes of the Uint8Array at `info[idx]`; false when it is not one.
+bool ReadImageBytes(const Napi::CallbackInfo& info, size_t idx, const uint8_t*& data, size_t& len) {
+  if (info.Length() <= idx || !info[idx].IsTypedArray() ||
+      info[idx].As<Napi::TypedArray>().TypedArrayType() != napi_uint8_array) {
+    return false;
+  }
+  const Napi::Uint8Array u8 = info[idx].As<Napi::Uint8Array>();
+  data = u8.Data();
+  len = u8.ElementLength();
+  return true;
+}
+
+}  // namespace
+
+Napi::Value Workbook::ProbeImage(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("format", Num(env, 0));
+  out.Set("pxWidth", Num(env, 0));
+  out.Set("pxHeight", Num(env, 0));
+  const uint8_t* data = nullptr;
+  size_t len = 0;
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    return out;
+  }
+  if (!ReadImageBytes(info, 0, data, len)) {
+    out.Set("status", MakeBindingArgumentError(env, "probeImage expects (bytes:Uint8Array)"));
+    return out;
+  }
+  fm_image_info img{};
+  const fm_status_t rc = fm_workbook_probe_image(handle_, data, len, &img);
+  if (rc == 0) {
+    out.Set("format", Num(env, img.format));
+    out.Set("pxWidth", Num(env, img.px_width));
+    out.Set("pxHeight", Num(env, img.px_height));
+  }
+  out.Set("status", MakeStatus(env, rc));
+  return out;
+}
+
+Napi::Value Workbook::ListDrawingObjects(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Array arr = Napi::Array::New(env);
+  if (handle_ == nullptr) {
+    return FinishListResult(env, arr, kBindingInvalidHandle);
+  }
+  const uint32_t sheet = ArgU32(info, 0);
+  size_t count = 0;
+  fm_status_t rc = fm_sheet_drawing_object_count(handle_, sheet, &count);
+  for (size_t i = 0; rc == 0 && i < count; ++i) {
+    fm_drawing_object o{};
+    rc = fm_sheet_drawing_object_at(handle_, sheet, i, &o);
+    if (rc != 0) {
+      break;
+    }
+    Napi::Object item = Napi::Object::New(env);
+    item.Set("objectId", Num(env, o.object_id));
+    item.Set("kind", Num(env, o.kind));
+    item.Set("anchorKind", Num(env, o.anchor_kind));
+    item.Set("editAs", Num(env, o.edit_as));
+    item.Set("fromRow", Num(env, o.from_row));
+    item.Set("fromCol", Num(env, o.from_col));
+    item.Set("fromRowOff", Num(env, static_cast<double>(o.from_row_off)));
+    item.Set("fromColOff", Num(env, static_cast<double>(o.from_col_off)));
+    item.Set("toRow", Num(env, o.to_row));
+    item.Set("toCol", Num(env, o.to_col));
+    item.Set("toRowOff", Num(env, static_cast<double>(o.to_row_off)));
+    item.Set("toColOff", Num(env, static_cast<double>(o.to_col_off)));
+    item.Set("cx", Num(env, static_cast<double>(o.cx)));
+    item.Set("cy", Num(env, static_cast<double>(o.cy)));
+    item.Set("imageFormat", Num(env, o.image_format));
+    item.Set("name", CStr(env, o.name));
+    item.Set("descr", CStr(env, o.descr));
+    item.Set("mediaPath", CStr(env, o.media_path));
+    arr.Set(static_cast<uint32_t>(i), item);
+  }
+  return FinishListResult(env, arr, rc);
+}
+
+Napi::Value Workbook::GetImage(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("format", Num(env, 0));
+  out.Set("bytes", Napi::Uint8Array::New(env, 0));
+  out.Set("pxWidth", Num(env, 0));
+  out.Set("pxHeight", Num(env, 0));
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    return out;
+  }
+  const uint8_t* bytes = nullptr;
+  size_t len = 0;
+  fm_image_info img{};
+  const fm_status_t rc = fm_sheet_get_image(handle_, ArgU32(info, 0), ArgU32(info, 1), &bytes, &len, &img);
+  if (rc == 0) {
+    // The C pointer dies on the next mutation, so the bytes are copied out.
+    Napi::Uint8Array copy = Napi::Uint8Array::New(env, len);
+    if (len != 0) {
+      std::memcpy(copy.Data(), bytes, len);
+    }
+    out.Set("format", Num(env, img.format));
+    out.Set("bytes", copy);
+    out.Set("pxWidth", Num(env, img.px_width));
+    out.Set("pxHeight", Num(env, img.px_height));
+  }
+  out.Set("status", MakeStatus(env, rc));
+  return out;
+}
+
+Napi::Value Workbook::InsertImage(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("objectId", Num(env, 0));
+  if (handle_ == nullptr) {
+    out.Set("status", NullHandleError(env));
+    return out;
+  }
+  const uint8_t* data = nullptr;
+  size_t len = 0;
+  const bool has_opts = info.Length() > 2 && info[2].IsObject();
+  if (!ReadImageBytes(info, 1, data, len) || (info.Length() > 2 && !info[2].IsUndefined() && !has_opts)) {
+    out.Set("status",
+            MakeBindingArgumentError(env, "insertImage expects (sheet:number, bytes:Uint8Array, opts?:object)"));
+    return out;
+  }
+  CheckedSpecReader reader(env);
+  const Napi::Object spec = has_opts ? info[2].As<Napi::Object>() : Napi::Object::New(env);
+  std::string name;
+  std::string descr;
+  PullString(reader, spec, "name", &name);
+  PullString(reader, spec, "descr", &descr);
+  fm_image_insert opts{};
+  opts.name = name.c_str();
+  opts.descr = descr.c_str();
+  opts.anchor_kind = reader.I32(spec, "anchorKind", FM_ANCHOR_KIND_ONE_CELL);
+  opts.edit_as = reader.I32(spec, "editAs", FM_ANCHOR_EDIT_AS_TWO_CELL);
+  opts.row = reader.U32(spec, "row", 0U);
+  opts.col = reader.U32(spec, "col", 0U);
+  opts.row_off_emu = reader.I64(spec, "rowOffEmu", 0);
+  opts.col_off_emu = reader.I64(spec, "colOffEmu", 0);
+  opts.width_emu = reader.I64(spec, "widthEmu", 0);
+  opts.height_emu = reader.I64(spec, "heightEmu", 0);
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  uint32_t object_id = 0;
+  const fm_status_t rc = fm_sheet_insert_image(handle_, ArgU32(info, 0), data, len, &opts, &object_id);
+  out.Set("objectId", Num(env, rc == 0 ? object_id : 0));
+  out.Set("status", MakeStatus(env, rc));
+  return out;
+}
+
+Napi::Value Workbook::RemoveImage(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (handle_ == nullptr) {
+    return NullHandleError(env);
+  }
+  return MakeStatus(env, fm_sheet_remove_image(handle_, ArgU32(info, 0), ArgU32(info, 1)));
+}
+
+}  // namespace formulon_node
diff --git a/src/node_addon/parts/sheet_view.cc b/src/node_addon/parts/sheet_view.cc
index 6f145bd50..438bcf0b1 100644
--- a/src/node_addon/parts/sheet_view.cc
+++ b/src/node_addon/parts/sheet_view.cc
@@ -1,11 +1,9 @@
-// Sheet view / layout bindings (zoom, freeze, tab visibility, column /
-// row layout) and the per-sheet UI feature surfaces: merges,
-// comments, hyperlinks, and data validations.
+// Sheet view / layout bindings: zoom, freeze, tab visibility, protection,
+// and column / row layout.
 
 #include <cstddef>
 #include <cstdint>
 #include <string>
-#include <vector>
 
 #include "node_addon/parts/workbook_class.h"
 
@@ -15,6 +13,11 @@ namespace formulon_node {
 
 namespace {
 
+// Reads a geometry mode ordinal; an absent argument is the display mode.
+int32_t ArgMode(const Napi::CallbackInfo& info, size_t idx) {
+  return idx < info.Length() ? info[idx].ToNumber().Int32Value() : static_cast<int32_t>(FM_GEOMETRY_DISPLAY);
+}
+
 Napi::Object DefaultSheetView(Napi::Env env) {
   Napi::Object view = Napi::Object::New(env);
   view.Set("zoomScale", Napi::Number::New(env, 100));
@@ -122,44 +125,43 @@ Napi::Value Workbook::SetSheetProtection(const Napi::CallbackInfo& info) {
 
   // Keep the std::string buffers alive until after the C ABI call so the
   // borrowed `const char*` fields stay valid.
-  auto pull_string = [&](const char* key) -> std::string {
-    if (!SpecHas(in, key)) {
-      return std::string();
-    }
-    return in.Get(key).ToString().Utf8Value();
-  };
-  const std::string algorithm_name = pull_string("algorithmName");
-  const std::string hash_value = pull_string("hashValue");
-  const std::string salt_value = pull_string("saltValue");
-  const std::string legacy_password = pull_string("legacyPassword");
+  CheckedSpecReader reader(env);
+  std::string algorithm_name;
+  std::string hash_value;
+  std::string salt_value;
+  std::string legacy_password;
+  (void)reader.String(in, "algorithmName", &algorithm_name);
+  (void)reader.String(in, "hashValue", &hash_value);
+  (void)reader.String(in, "saltValue", &salt_value);
+  (void)reader.String(in, "legacyPassword", &legacy_password);
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
 
   fm_sheet_protection_t p{};
-  p.enabled = SpecPullInt32(in, "enabled", 0);
+  p.enabled = reader.I32(in, "enabled", 0);
   p.algorithm_name = algorithm_name.c_str();
   p.hash_value = hash_value.c_str();
   p.salt_value = salt_value.c_str();
-  p.spin_count = SpecPullU32(in, "spinCount", 0U);
+  p.spin_count = reader.U32(in, "spinCount", 0U);
   p.legacy_password = legacy_password.c_str();
-  p.sheet = SpecPullInt32(in, "sheet", 0);
-  p.objects = SpecPullInt32(in, "objects", 0);
-  p.scenarios = SpecPullInt32(in, "scenarios", 0);
-  p.format_cells = SpecPullInt32(in, "formatCells", 0);
-  p.format_columns = SpecPullInt32(in, "formatColumns", 0);
-  p.format_rows = SpecPullInt32(in, "formatRows", 0);
-  p.insert_columns = SpecPullInt32(in, "insertColumns", 0);
-  p.insert_rows = SpecPullInt32(in, "insertRows", 0);
-  p.insert_hyperlinks = SpecPullInt32(in, "insertHyperlinks", 0);
-  p.delete_columns = SpecPullInt32(in, "deleteColumns", 0);
-  p.delete_rows = SpecPullInt32(in, "deleteRows", 0);
-  p.select_locked_cells = SpecPullInt32(in, "selectLockedCells", 0);
-  p.select_unlocked_cells = SpecPullInt32(in, "selectUnlockedCells", 0);
-  p.sort = SpecPullInt32(in, "sort", 0);
-  p.auto_filter = SpecPullInt32(in, "autoFilter", 0);
-  p.pivot_tables = SpecPullInt32(in, "pivotTables", 0);
-  if (env.IsExceptionPending()) {
-    // A malformed field left a pending JS exception (see SpecPullInt32 /
-    // SpecPullU32): stop before the C ABI call commits a default value
-    // for it.
+  p.sheet = reader.I32(in, "sheet", 0);
+  p.objects = reader.I32(in, "objects", 0);
+  p.scenarios = reader.I32(in, "scenarios", 0);
+  p.format_cells = reader.I32(in, "formatCells", 0);
+  p.format_columns = reader.I32(in, "formatColumns", 0);
+  p.format_rows = reader.I32(in, "formatRows", 0);
+  p.insert_columns = reader.I32(in, "insertColumns", 0);
+  p.insert_rows = reader.I32(in, "insertRows", 0);
+  p.insert_hyperlinks = reader.I32(in, "insertHyperlinks", 0);
+  p.delete_columns = reader.I32(in, "deleteColumns", 0);
+  p.delete_rows = reader.I32(in, "deleteRows", 0);
+  p.select_locked_cells = reader.I32(in, "selectLockedCells", 0);
+  p.select_unlocked_cells = reader.I32(in, "selectUnlockedCells", 0);
+  p.sort = reader.I32(in, "sort", 0);
+  p.auto_filter = reader.I32(in, "autoFilter", 0);
+  p.pivot_tables = reader.I32(in, "pivotTables", 0);
+  if (!reader.ok()) {
     return env.Undefined();
   }
   fm_status_t rc = fm_sheet_set_protection(handle_, sheet, &p);
@@ -390,6 +392,8 @@ Napi::Value Workbook::GetSheetRowOverrides(const Napi::CallbackInfo& info) {
     Napi::Object row = Napi::Object::New(env);
     row.Set("row", Napi::Number::New(env, entry.row));
     row.Set("height", Napi::Number::New(env, entry.height));
+    row.Set("hasHeight", Napi::Number::New(env, entry.has_height));
+    row.Set("customHeight", Napi::Number::New(env, entry.custom_height));
     row.Set("hidden", Napi::Number::New(env, entry.hidden));
     row.Set("outlineLevel", Napi::Number::New(env, static_cast<int32_t>(entry.outline_level)));
     row.Set("hasStyle", Napi::Number::New(env, entry.has_style));
@@ -414,510 +418,178 @@ Napi::Value Workbook::SetRowHeight(const Napi::CallbackInfo& info) {
   return MakeStatus(env, rc);
 }
 
-Napi::Value Workbook::SetRowHidden(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::ClearRowHeight(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
     return NullHandleError(env);
   }
   const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  const bool hidden = ArgBool(info, 2);
-  fm_status_t rc = fm_sheet_set_row_hidden(handle_, sheet, row, hidden ? 1 : 0);
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::SetRowOutline(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const uint32_t row = ArgU32(info, 1);
-  uint32_t level = ArgU32(info, 2);
-  if (level > 255U) {
-    level = 255U;
-  }
-  fm_status_t rc = fm_sheet_set_row_outline(handle_, sheet, row, static_cast<uint8_t>(level));
-  return MakeStatus(env, rc);
-}
-
-// ---- Merges ---------------------------------------------------------
-
-namespace {
-
-// Reads a `{ firstRow, lastRow, firstCol, lastCol }` range object.
-fm_merge_range ReadMergeRange(const Napi::Object& range) {
-  fm_merge_range m{};
-  m.first_row = range.Get("firstRow").ToNumber().Uint32Value();
-  m.last_row = range.Get("lastRow").ToNumber().Uint32Value();
-  m.first_col = range.Get("firstCol").ToNumber().Uint32Value();
-  m.last_col = range.Get("lastCol").ToNumber().Uint32Value();
-  return m;
-}
-
-// Reads the range at `info[idx]`; a missing or non-object argument reads as all zeros.
-fm_merge_range MergeRangeArg(const Napi::CallbackInfo& info, size_t idx) {
-  return info.Length() > idx && info[idx].IsObject() ? ReadMergeRange(info[idx].As<Napi::Object>()) : fm_merge_range{};
-}
-
-}  // namespace
-
-Napi::Value Workbook::AddMerge(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  fm_status_t rc = fm_sheet_add_merge(handle_, sheet, MergeRangeArg(info, 1));
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::RemoveMerge(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  fm_status_t rc = fm_sheet_remove_merge(handle_, sheet, MergeRangeArg(info, 1));
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::RemoveMergeAt(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t index = ArgU32(info, 1);
-  fm_status_t rc = fm_sheet_remove_merge_at(handle_, sheet, index);
-  return MakeStatus(env, rc);
+  return MakeStatus(env, fm_sheet_clear_row_height(handle_, sheet, ArgU32(info, 1)));
 }
 
-Napi::Value Workbook::ClearMerges(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::GetSheetFormatDefaults(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  fm_status_t rc = fm_sheet_clear_merges(handle_, sheet);
-  return MakeStatus(env, rc);
-}
-
-Napi::Value Workbook::GetMerges(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  Napi::Array arr = Napi::Array::New(env);
-  if (handle_ == nullptr) {
-    return FinishListResult(env, arr, kBindingInvalidHandle);
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  uint32_t count = 0;
-  fm_status_t rc = fm_sheet_get_merge_count(handle_, sheet, &count);
+  fm_sheet_format_defaults d{};
+  const fm_status_t rc =
+      handle_ != nullptr ? fm_sheet_get_format_defaults(handle_, ArgU32(info, 0), &d) : kBindingInvalidHandle;
   if (rc != 0) {
-    return FinishListResult(env, arr, rc);
-  }
-  std::size_t emitted = 0;
-  for (uint32_t i = 0; i < count; ++i) {
-    fm_merge_range m{};
-    rc = fm_sheet_get_merge_at(handle_, sheet, i, &m);
-    if (rc != 0) {
-      return FinishListResult(env, arr, rc);
-    }
-    Napi::Object item = Napi::Object::New(env);
-    item.Set("firstRow", Napi::Number::New(env, m.first_row));
-    item.Set("lastRow", Napi::Number::New(env, m.last_row));
-    item.Set("firstCol", Napi::Number::New(env, m.first_col));
-    item.Set("lastCol", Napi::Number::New(env, m.last_col));
-    arr.Set(static_cast<uint32_t>(emitted), item);
-    ++emitted;
+    d = fm_sheet_format_defaults{};
   }
-  return FinishListResult(env, arr, 0);
-}
-
-// ---- Comments -------------------------------------------------------
-
-Napi::Value Workbook::GetComment(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return env.Null();
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  fm_comment c{};
-  if (fm_sheet_get_comment_at(handle_, sheet, row, col, &c) != 0) {
-    return env.Null();
-  }
-  Napi::Object o = Napi::Object::New(env);
-  o.Set("author", Napi::String::New(env, c.author != nullptr ? c.author : ""));
-  o.Set("text", Napi::String::New(env, c.text != nullptr ? c.text : ""));
-  return o;
-}
-
-Napi::Value Workbook::GetCommentResult(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
   Napi::Object out = Napi::Object::New(env);
-  if (handle_ == nullptr) {
-    out.Set("status", NullHandleError(env));
-    out.Set("comment", env.Null());
-    return out;
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  fm_comment c{};
-  const fm_status_t rc = fm_sheet_get_comment_at(handle_, sheet, row, col, &c);
-  if (rc != 0) {
-    out.Set("status", MakeErrorStatus(env, rc));
-    out.Set("comment", env.Null());
-    return out;
-  }
-  Napi::Object comment = Napi::Object::New(env);
-  comment.Set("author", Napi::String::New(env, c.author != nullptr ? c.author : ""));
-  comment.Set("text", Napi::String::New(env, c.text != nullptr ? c.text : ""));
-  out.Set("status", MakeOkStatus(env));
-  out.Set("comment", comment);
+  out.Set("status", MakeStatus(env, rc));
+  out.Set("defaultColWidth", Napi::Number::New(env, d.default_col_width));
+  out.Set("defaultRowHeight", Napi::Number::New(env, d.default_row_height));
+  out.Set("baseColWidth", Napi::Number::New(env, d.base_col_width));
+  out.Set("hasDefaultColWidth", Napi::Boolean::New(env, d.has_default_col_width != 0));
+  out.Set("hasDefaultRowHeight", Napi::Boolean::New(env, d.has_default_row_height != 0));
   return out;
 }
 
-Napi::Value Workbook::GetComments(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  Napi::Array arr = Napi::Array::New(env);
-  if (handle_ == nullptr) {
-    return FinishListResult(env, arr, kBindingInvalidHandle);
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  uint32_t count = 0;
-  fm_status_t rc = fm_sheet_get_comment_count(handle_, sheet, &count);
-  if (rc != 0) {
-    return FinishListResult(env, arr, rc);
-  }
-  std::size_t emitted = 0;
-  for (uint32_t i = 0; i < count; ++i) {
-    fm_comment c{};
-    rc = fm_sheet_get_comment_at_index(handle_, sheet, i, &c);
-    if (rc != 0) {
-      return FinishListResult(env, arr, rc);
-    }
-    Napi::Object item = Napi::Object::New(env);
-    item.Set("row", Napi::Number::New(env, c.row));
-    item.Set("col", Napi::Number::New(env, c.col));
-    item.Set("author", Napi::String::New(env, c.author != nullptr ? c.author : ""));
-    item.Set("text", Napi::String::New(env, c.text != nullptr ? c.text : ""));
-    arr.Set(static_cast<uint32_t>(emitted), item);
-    ++emitted;
-  }
-  return FinishListResult(env, arr, 0);
-}
-
-Napi::Value Workbook::SetComment(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const std::string author = ArgString(info, 3);
-  const std::string text = ArgString(info, 4);
-  // Empty strings turn into NULL in the C ABI to remove an entry,
-  // matching the embind binding's contract.
-  const char* author_c = author.empty() ? nullptr : author.c_str();
-  const char* text_c = text.empty() ? nullptr : text.c_str();
-  fm_status_t rc = fm_sheet_set_comment(handle_, sheet, row, col, author_c, text_c);
-  return MakeStatus(env, rc);
-}
-
-// ---- Hyperlinks -----------------------------------------------------
-
-namespace {
-
-// Adds the hyperlink described by the already type-checked arguments
-// `(sheet, row, col[, lastRow, lastCol], target, display, tooltip, location)`.
-// Empty strings are forwarded as NULL.
-fm_status_t AddHyperlinkFromArgs(fm_workbook_t* wb, const Napi::CallbackInfo& info, bool ranged) {
-  const uint32_t sheet = Workbook::ArgU32(info, 0);
-  const uint32_t row = Workbook::ArgU32(info, 1);
-  const uint32_t col = Workbook::ArgU32(info, 2);
-  const uint32_t last_row = ranged ? Workbook::ArgU32(info, 3) : row;
-  const uint32_t last_col = ranged ? Workbook::ArgU32(info, 4) : col;
-  const std::size_t text_idx = ranged ? 5 : 3;
-  // Keep the std::string buffers alive until after the C ABI call so the
-  // borrowed `const char*` pointers in `fm_hyperlink` stay valid.
-  const std::string target = Workbook::ArgString(info, text_idx);
-  const std::string display = Workbook::ArgString(info, text_idx + 1);
-  const std::string tooltip = Workbook::ArgString(info, text_idx + 2);
-  const std::string location = Workbook::ArgString(info, text_idx + 3);
-  fm_hyperlink hl{};
-  hl.row = row;
-  hl.col = col;
-  hl.last_row = last_row;
-  hl.last_col = last_col;
-  hl.target = target.empty() ? nullptr : target.c_str();
-  hl.location = location.empty() ? nullptr : location.c_str();
-  hl.display = display.empty() ? nullptr : display.c_str();
-  hl.tooltip = tooltip.empty() ? nullptr : tooltip.c_str();
-  return fm_sheet_add_hyperlink(wb, sheet, hl);
-}
-
-}  // namespace
-
-Napi::Value Workbook::AddHyperlink(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::SetSheetFormatDefaults(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
     return NullHandleError(env);
   }
-  if (info.Length() < 7 || !info[0].IsNumber() || !info[1].IsNumber() || !info[2].IsNumber() || !info[3].IsString() ||
-      !info[4].IsString() || !info[5].IsString() || !info[6].IsString()) {
-    Napi::TypeError::New(env,
-                         "addHyperlink expects (sheet:number, row:number, col:number, "
-                         "target:string, display:string, tooltip:string, location:string)")
-        .ThrowAsJavaScriptException();
+  if (info.Length() < 2 || !info[1].IsObject()) {
+    return MakeBindingArgumentError(env, "setSheetFormatDefaults expects (sheet:number, defaults:object)");
+  }
+  const Napi::Object spec = info[1].As<Napi::Object>();
+  CheckedSpecReader reader(env);
+  bool has_default_col_width = false;
+  bool has_default_row_height = false;
+  fm_sheet_format_defaults d{};
+  d.default_col_width = reader.Double(spec, "defaultColWidth", 0.0, &has_default_col_width);
+  d.default_row_height = reader.Double(spec, "defaultRowHeight", 0.0, &has_default_row_height);
+  d.base_col_width = reader.Double(spec, "baseColWidth", 8.0);
+  d.has_default_col_width = reader.Bool(spec, "hasDefaultColWidth", has_default_col_width) ? 1 : 0;
+  d.has_default_row_height = reader.Bool(spec, "hasDefaultRowHeight", has_default_row_height) ? 1 : 0;
+  if (!reader.ok()) {
     return env.Undefined();
   }
-  return MakeStatus(env, AddHyperlinkFromArgs(handle_, info, /*ranged=*/false));
+  return MakeStatus(env, fm_sheet_set_format_defaults(handle_, ArgU32(info, 0), &d));
 }
 
-Napi::Value Workbook::AddHyperlinkRange(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  if (info.Length() < 9 || !info[0].IsNumber() || !info[1].IsNumber() || !info[2].IsNumber() || !info[3].IsNumber() ||
-      !info[4].IsNumber() || !info[5].IsString() || !info[6].IsString() || !info[7].IsString() || !info[8].IsString()) {
-    Napi::TypeError::New(env,
-                         "addHyperlinkRange expects (sheet:number, row:number, col:number, "
-                         "lastRow:number, lastCol:number, target:string, display:string, "
-                         "tooltip:string, location:string)")
-        .ThrowAsJavaScriptException();
-    return env.Undefined();
-  }
-  return MakeStatus(env, AddHyperlinkFromArgs(handle_, info, /*ranged=*/true));
-}
+// ---- Geometry -------------------------------------------------------
 
-Napi::Value Workbook::GetHyperlinks(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::GetCellRectPt(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
-  Napi::Array arr = Napi::Array::New(env);
+  fm_rect_pt rect{};
+  Napi::Object status = Napi::Object::New(env);
   if (handle_ == nullptr) {
-    return FinishListResult(env, arr, kBindingInvalidHandle);
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  uint32_t count = 0;
-  fm_status_t rc = fm_sheet_get_hyperlink_count(handle_, sheet, &count);
-  if (rc != 0) {
-    return FinishListResult(env, arr, rc);
-  }
-  std::size_t emitted = 0;
-  for (uint32_t i = 0; i < count; ++i) {
-    fm_hyperlink h{};
-    rc = fm_sheet_get_hyperlink_at(handle_, sheet, i, &h);
+    status = NullHandleError(env);
+  } else if (info.Length() < 2 || !info[1].IsObject()) {
+    status = MakeBindingArgumentError(env, "getCellRectPt expects (sheet:number, range:object, mode:number)");
+  } else {
+    const Napi::Object range = info[1].As<Napi::Object>();
+    CheckedSpecReader reader(env);
+    const uint32_t first_row = reader.U32(range, "firstRow", 0U);
+    const uint32_t first_col = reader.U32(range, "firstCol", 0U);
+    const uint32_t last_row = reader.U32(range, "lastRow", 0U);
+    const uint32_t last_col = reader.U32(range, "lastCol", 0U);
+    if (!reader.ok()) {
+      return env.Undefined();
+    }
+    const fm_status_t rc = fm_sheet_cell_rect_pt(handle_, ArgU32(info, 0), first_row, first_col, last_row, last_col,
+                                                 ArgMode(info, 2), &rect);
     if (rc != 0) {
-      return FinishListResult(env, arr, rc);
+      rect = fm_rect_pt{};
     }
-    Napi::Object item = Napi::Object::New(env);
-    item.Set("row", Napi::Number::New(env, h.row));
-    item.Set("col", Napi::Number::New(env, h.col));
-    item.Set("lastRow", Napi::Number::New(env, h.last_row));
-    item.Set("lastCol", Napi::Number::New(env, h.last_col));
-    item.Set("target", Napi::String::New(env, h.target != nullptr ? h.target : ""));
-    item.Set("location", Napi::String::New(env, h.location != nullptr ? h.location : ""));
-    item.Set("display", Napi::String::New(env, h.display != nullptr ? h.display : ""));
-    item.Set("tooltip", Napi::String::New(env, h.tooltip != nullptr ? h.tooltip : ""));
-    arr.Set(static_cast<uint32_t>(emitted), item);
-    ++emitted;
+    status = MakeStatus(env, rc);
   }
-  return FinishListResult(env, arr, 0);
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("status", status);
+  out.Set("x", Napi::Number::New(env, rect.x));
+  out.Set("y", Napi::Number::New(env, rect.y));
+  out.Set("width", Napi::Number::New(env, rect.width));
+  out.Set("height", Napi::Number::New(env, rect.height));
+  return out;
 }
 
-Napi::Value Workbook::RemoveHyperlink(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::GetColumnWidthPt(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
-    return NullHandleError(env);
+    return MakeNumberResult(env, kBindingInvalidHandle, 0);
   }
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  fm_status_t rc = fm_sheet_remove_hyperlink(handle_, sheet, row, col);
-  return MakeStatus(env, rc);
+  double pt = 0.0;
+  const fm_status_t rc = fm_sheet_column_width_pt(handle_, ArgU32(info, 0), ArgU32(info, 1), ArgMode(info, 2), &pt);
+  return MakeNumberResult(env, rc, pt);
 }
 
-Napi::Value Workbook::RemoveHyperlinkAt(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::GetRowHeightPt(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
-    return NullHandleError(env);
+    return MakeNumberResult(env, kBindingInvalidHandle, 0);
   }
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t index = ArgU32(info, 1);
-  fm_status_t rc = fm_sheet_remove_hyperlink_at(handle_, sheet, index);
-  return MakeStatus(env, rc);
+  double pt = 0.0;
+  const fm_status_t rc = fm_sheet_row_height_pt(handle_, ArgU32(info, 0), ArgU32(info, 1), &pt);
+  return MakeNumberResult(env, rc, pt);
 }
 
-Napi::Value Workbook::ClearHyperlinks(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::GetWidthModel(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
-  if (handle_ == nullptr) {
-    return NullHandleError(env);
+  fm_width_model model{};
+  const fm_status_t rc = handle_ != nullptr ? fm_sheet_width_model(handle_, ArgU32(info, 0), ArgMode(info, 1), &model)
+                                            : kBindingInvalidHandle;
+  if (rc != 0) {
+    model = fm_width_model{};
   }
-  const uint32_t sheet = ArgU32(info, 0);
-  fm_status_t rc = fm_sheet_clear_hyperlinks(handle_, sheet);
-  return MakeStatus(env, rc);
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("status", MakeStatus(env, rc));
+  out.Set("pointsPerChar", Napi::Number::New(env, model.points_per_char));
+  out.Set("paddingPt", Napi::Number::New(env, model.padding_pt));
+  out.Set("normalFontSize", Napi::Number::New(env, model.normal_font_size));
+  out.Set("calibrated", Napi::Boolean::New(env, model.calibrated != 0));
+  out.Set("normalFontName", Napi::String::New(env, model.normal_font_name != nullptr ? model.normal_font_name : ""));
+  out.Set("platform", Napi::String::New(env, model.platform != nullptr ? model.platform : ""));
+  return out;
 }
 
-// ---- Validations ----------------------------------------------------
-
-Napi::Value Workbook::GetValidations(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::ColumnCharsToPt(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
-  Napi::Array arr = Napi::Array::New(env);
   if (handle_ == nullptr) {
-    return FinishListResult(env, arr, kBindingInvalidHandle);
+    return MakeNumberResult(env, kBindingInvalidHandle, 0);
   }
-  const uint32_t sheet = ArgU32(info, 0);
-  uint32_t count = 0;
-  fm_status_t rc = fm_sheet_get_validation_count(handle_, sheet, &count);
-  if (rc != 0) {
-    return FinishListResult(env, arr, rc);
-  }
-  std::size_t emitted = 0;
-  for (uint32_t i = 0; i < count; ++i) {
-    fm_data_validation v{};
-    rc = fm_sheet_get_validation_at(handle_, sheet, i, &v);
-    if (rc != 0) {
-      return FinishListResult(env, arr, rc);
-    }
-    Napi::Object item = Napi::Object::New(env);
-    Napi::Array ranges = Napi::Array::New(env);
-    for (uint32_t r = 0; r < v.range_count; ++r) {
-      Napi::Object rng = Napi::Object::New(env);
-      rng.Set("firstRow", Napi::Number::New(env, v.ranges[r].first_row));
-      rng.Set("lastRow", Napi::Number::New(env, v.ranges[r].last_row));
-      rng.Set("firstCol", Napi::Number::New(env, v.ranges[r].first_col));
-      rng.Set("lastCol", Napi::Number::New(env, v.ranges[r].last_col));
-      ranges.Set(r, rng);
-    }
-    item.Set("ranges", ranges);
-    item.Set("type", Napi::Number::New(env, v.type));
-    item.Set("op", Napi::Number::New(env, v.op));
-    item.Set("errorStyle", Napi::Number::New(env, v.error_style));
-    item.Set("allowBlank", Napi::Boolean::New(env, v.allow_blank != 0));
-    item.Set("showInputMessage", Napi::Boolean::New(env, v.show_input_message != 0));
-    item.Set("showErrorMessage", Napi::Boolean::New(env, v.show_error_message != 0));
-    item.Set("showDropDown", Napi::Boolean::New(env, v.show_dropdown != 0));
-    item.Set("formula1", Napi::String::New(env, v.formula1 != nullptr ? v.formula1 : ""));
-    item.Set("formula2", Napi::String::New(env, v.formula2 != nullptr ? v.formula2 : ""));
-    item.Set("errorTitle", Napi::String::New(env, v.error_title != nullptr ? v.error_title : ""));
-    item.Set("errorMessage", Napi::String::New(env, v.error_message != nullptr ? v.error_message : ""));
-    item.Set("promptTitle", Napi::String::New(env, v.prompt_title != nullptr ? v.prompt_title : ""));
-    item.Set("promptMessage", Napi::String::New(env, v.prompt_message != nullptr ? v.prompt_message : ""));
-    arr.Set(static_cast<uint32_t>(emitted), item);
-    ++emitted;
-  }
-  return FinishListResult(env, arr, 0);
+  double pt = 0.0;
+  const fm_status_t rc =
+      fm_sheet_column_chars_to_pt(handle_, ArgU32(info, 0), ArgMode(info, 1), ArgDouble(info, 2), &pt);
+  return MakeNumberResult(env, rc, pt);
 }
 
-Napi::Value Workbook::AddValidation(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::ColumnPtToChars(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
-    return NullHandleError(env);
-  }
-  if (info.Length() < 2 || !info[0].IsNumber() || !info[1].IsObject()) {
-    Napi::TypeError::New(env, "addValidation expects (sheet:number, validation:object)").ThrowAsJavaScriptException();
-    return env.Undefined();
+    return MakeNumberResult(env, kBindingInvalidHandle, 0);
   }
-  const uint32_t sheet = ArgU32(info, 0);
-  Napi::Object v = info[1].As<Napi::Object>();
-
-  // Pull every JS field into local storage first; the C ABI receives
-  // borrowed `const char*` views that must stay valid until
-  // `fm_sheet_add_validation` returns.
-  std::vector<fm_merge_range> ranges_buf;
-  if (v.Has("ranges")) {
-    Napi::Value ranges_js = v.Get("ranges");
-    if (ranges_js.IsArray()) {
-      Napi::Array ranges_arr = ranges_js.As<Napi::Array>();
-      const uint32_t n = ranges_arr.Length();
-      ranges_buf.reserve(n);
-      for (uint32_t i = 0; i < n; ++i) {
-        Napi::Value rng_v = ranges_arr.Get(i);
-        if (!rng_v.IsObject()) {
-          continue;
-        }
-        ranges_buf.push_back(ReadMergeRange(rng_v.As<Napi::Object>()));
-      }
-    }
-  }
-  auto pull_string = [&](const char* key) -> std::string {
-    if (!v.Has(key)) {
-      return std::string();
-    }
-    Napi::Value f = v.Get(key);
-    if (f.IsUndefined() || f.IsNull()) {
-      return std::string();
-    }
-    return f.ToString().Utf8Value();
-  };
-  auto pull_u8 = [&](const char* key) -> uint8_t {
-    if (!v.Has(key)) {
-      return 0;
-    }
-    Napi::Value f = v.Get(key);
-    if (f.IsUndefined() || f.IsNull()) {
-      return 0;
-    }
-    return static_cast<uint8_t>(f.ToNumber().Uint32Value() & 0xFFU);
-  };
-  auto pull_bool = [&](const char* key, bool dflt) -> bool {
-    if (!v.Has(key)) {
-      return dflt;
-    }
-    Napi::Value f = v.Get(key);
-    if (f.IsUndefined() || f.IsNull()) {
-      return dflt;
-    }
-    return f.ToBoolean().Value();
-  };
-  const std::string formula1 = pull_string("formula1");
-  const std::string formula2 = pull_string("formula2");
-  const std::string error_title = pull_string("errorTitle");
-  const std::string error_message = pull_string("errorMessage");
-  const std::string prompt_title = pull_string("promptTitle");
-  const std::string prompt_message = pull_string("promptMessage");
-
-  fm_data_validation dv{};
-  dv.ranges = ranges_buf.empty() ? nullptr : ranges_buf.data();
-  dv.range_count = static_cast<uint32_t>(ranges_buf.size());
-  dv.type = pull_u8("type");
-  dv.op = pull_u8("op");
-  dv.error_style = pull_u8("errorStyle");
-  dv.allow_blank = pull_bool("allowBlank", false) ? 1 : 0;
-  dv.show_input_message = pull_bool("showInputMessage", false) ? 1 : 0;
-  dv.show_error_message = pull_bool("showErrorMessage", false) ? 1 : 0;
-  dv.show_dropdown = pull_bool("showDropDown", true) ? 1 : 0;
-  dv.formula1 = formula1.empty() ? nullptr : formula1.c_str();
-  dv.formula2 = formula2.empty() ? nullptr : formula2.c_str();
-  dv.error_title = error_title.empty() ? nullptr : error_title.c_str();
-  dv.error_message = error_message.empty() ? nullptr : error_message.c_str();
-  dv.prompt_title = prompt_title.empty() ? nullptr : prompt_title.c_str();
-  dv.prompt_message = prompt_message.empty() ? nullptr : prompt_message.c_str();
-  fm_status_t rc = fm_sheet_add_validation(handle_, sheet, dv);
-  return MakeStatus(env, rc);
+  double chars = 0.0;
+  const fm_status_t rc =
+      fm_sheet_column_pt_to_chars(handle_, ArgU32(info, 0), ArgMode(info, 1), ArgDouble(info, 2), &chars);
+  return MakeNumberResult(env, rc, chars);
 }
 
-Napi::Value Workbook::RemoveValidationAt(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::SetRowHidden(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
     return NullHandleError(env);
   }
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t index = ArgU32(info, 1);
-  fm_status_t rc = fm_sheet_remove_validation_at(handle_, sheet, index);
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  const bool hidden = ArgBool(info, 2);
+  fm_status_t rc = fm_sheet_set_row_hidden(handle_, sheet, row, hidden ? 1 : 0);
   return MakeStatus(env, rc);
 }
 
-Napi::Value Workbook::ClearValidations(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::SetRowOutline(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
     return NullHandleError(env);
   }
-  const uint32_t sheet = ArgU32(info, 0);
-  fm_status_t rc = fm_sheet_clear_validations(handle_, sheet);
+  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
+  const uint32_t row = ArgU32(info, 1);
+  uint32_t level = ArgU32(info, 2);
+  if (level > 255U) {
+    level = 255U;
+  }
+  fm_status_t rc = fm_sheet_set_row_outline(handle_, sheet, row, static_cast<uint8_t>(level));
   return MakeStatus(env, rc);
 }
 
diff --git a/src/node_addon/parts/styles.cc b/src/node_addon/parts/styles.cc
index b00dbb35e..e6d5079e1 100644
--- a/src/node_addon/parts/styles.cc
+++ b/src/node_addon/parts/styles.cc
@@ -1,76 +1,32 @@
 // Style-table bindings: read / write entries in the xf / font / fill /
-// border / numFmt pools plus the per-cell xf-index getters, the named
-// cell-style accessors, the conditional-formatting read / mutate
-// surface, and the `evaluateCfRange` evaluator. The cf translator
-// lives here because it shares the styles compilation dependency on
-// `fm_styles_*` typedefs declared in the same C ABI header block.
+// border / numFmt pools plus the per-cell xf-index getters and the named
+// cell-style accessors.
 
 #include <cstddef>
 #include <cstdint>
-#include <limits>
 #include <string>
-#include <vector>
 
-#include "c_api/borrowed_arena.h"
 #include "node_addon/parts/workbook_class.h"
 
 namespace formulon_node {
 namespace {
 
-fm_cf_color_t PullCfColor(const Napi::Object& spec) {
-  fm_cf_color_t out{};
-  out.r = static_cast<uint8_t>(SpecPullU32(spec, "r", 0U) & 0xFFU);
-  out.g = static_cast<uint8_t>(SpecPullU32(spec, "g", 0U) & 0xFFU);
-  out.b = static_cast<uint8_t>(SpecPullU32(spec, "b", 0U) & 0xFFU);
-  out.a = static_cast<uint8_t>(SpecPullU32(spec, "a", 255U) & 0xFFU);
-  return out;
-}
-
-fm_cfvo_t PullCfvo(const Napi::Object& spec, formulon::c_api::BorrowedStringArena* strings) {
-  fm_cfvo_t out{};
-  out.type = static_cast<uint8_t>(SpecPullU32(spec, "type", 0U) & 0xFFU);
-  out.gte = SpecPullBool(spec, "gte", true) ? 1 : 0;
-  if (SpecHas(spec, "value")) {
-    out.value = strings->emplace(spec.Get("value").ToString().Utf8Value());
-  }
-  return out;
-}
-
-Napi::Object CfColorToJs(Napi::Env env, fm_cf_color_t color) {
-  Napi::Object out = Napi::Object::New(env);
-  out.Set("r", Napi::Number::New(env, color.r));
-  out.Set("g", Napi::Number::New(env, color.g));
-  out.Set("b", Napi::Number::New(env, color.b));
-  out.Set("a", Napi::Number::New(env, color.a));
-  return out;
-}
-
-Napi::Object CfvoToJs(Napi::Env env, const fm_cfvo_t& cfvo) {
-  Napi::Object out = Napi::Object::New(env);
-  out.Set("type", Napi::Number::New(env, static_cast<uint32_t>(cfvo.type)));
-  out.Set("gte", Napi::Boolean::New(env, cfvo.gte != 0));
-  if (cfvo.value != nullptr) {
-    out.Set("value", Napi::String::New(env, cfvo.value));
-  }
-  return out;
-}
-
 /// Reads the `{kind, rgb, theme, tint, indexed}` colour specification out
 /// of `owner[key]`. An absent object leaves `kind` at `kFmColorNone`, so
 /// the writer emits the sibling `*Argb` as literal `rgb`. A supplied
 /// selector is authoritative; this binding does not resolve theme/indexed /
 /// auto colours.
-fm_color_spec PullColorSpec(const Napi::Object& owner, const char* key) {
+fm_color_spec PullColorSpec(CheckedSpecReader& reader, const Napi::Object& owner, const char* key) {
   fm_color_spec spec{};
-  if (!SpecHas(owner, key) || !owner.Get(key).IsObject()) {
+  Napi::Object v;
+  if (!reader.Object(owner, key, &v)) {
     return spec;
   }
-  Napi::Object v = owner.Get(key).As<Napi::Object>();
-  spec.kind = static_cast<uint8_t>(SpecPullU32(v, "kind", 0U) & 0xFFU);
-  spec.rgb = SpecPullU32(v, "rgb", 0U);
-  spec.theme = SpecPullU32(v, "theme", 0U);
-  spec.tint = SpecPullDouble(v, "tint", 0.0);
-  spec.indexed = SpecPullU32(v, "indexed", 0U);
+  spec.kind = reader.U8(v, "kind", 0U);
+  spec.rgb = reader.U32(v, "rgb", 0U);
+  spec.theme = reader.U32(v, "theme", 0U);
+  spec.tint = reader.Double(v, "tint", 0.0);
+  spec.indexed = reader.U32(v, "indexed", 0U);
   return spec;
 }
 
@@ -110,29 +66,26 @@ Napi::Object FontRecordToJs(Napi::Env env, const fm_font_record& f) {
 
 /// Reads a font record out of a JS object. `name_storage` owns the font
 /// name for the duration of the C ABI call, which borrows the pointer.
-void PullFontRecord(const Napi::Object& record, std::string* name_storage, fm_font_record* out) {
-  if (SpecHas(record, "name")) {
-    *name_storage = record.Get("name").ToString().Utf8Value();
-  } else {
-    name_storage->clear();
-  }
+void PullFontRecord(CheckedSpecReader& reader, const Napi::Object& record, std::string* name_storage,
+                    fm_font_record* out) {
+  reader.String(record, "name", name_storage);
   out->name = name_storage->c_str();
-  out->size = SpecPullDouble(record, "size", 11.0);
-  out->bold = SpecPullBool(record, "bold", false) ? 1 : 0;
-  out->italic = SpecPullBool(record, "italic", false) ? 1 : 0;
-  out->strike = SpecPullBool(record, "strike", false) ? 1 : 0;
-  out->has_bold = SpecPullBool(record, "hasBold", false) ? 1 : 0;
-  out->has_italic = SpecPullBool(record, "hasItalic", false) ? 1 : 0;
-  out->has_strike = SpecPullBool(record, "hasStrike", false) ? 1 : 0;
-  out->underline = static_cast<uint8_t>(SpecPullU32(record, "underline", 0U) & 0xFFU);
-  out->vert_align = static_cast<uint8_t>(SpecPullU32(record, "vertAlign", 0U) & 0xFFU);
-  out->has_family = SpecPullBool(record, "hasFamily", false) ? 1 : 0;
-  out->family = static_cast<uint8_t>(SpecPullU32(record, "family", 0U) & 0xFFU);
-  out->has_charset = SpecPullBool(record, "hasCharset", false) ? 1 : 0;
-  out->charset = static_cast<uint8_t>(SpecPullU32(record, "charset", 0U) & 0xFFU);
-  out->scheme = static_cast<uint8_t>(SpecPullU32(record, "scheme", 0U) & 0xFFU);
-  out->color_argb = SpecPullU32(record, "colorArgb", 0xFF000000U);
-  out->color = PullColorSpec(record, "color");
+  out->size = reader.Double(record, "size", 11.0);
+  out->bold = reader.Bool(record, "bold", false) ? 1 : 0;
+  out->italic = reader.Bool(record, "italic", false) ? 1 : 0;
+  out->strike = reader.Bool(record, "strike", false) ? 1 : 0;
+  out->has_bold = reader.Bool(record, "hasBold", false) ? 1 : 0;
+  out->has_italic = reader.Bool(record, "hasItalic", false) ? 1 : 0;
+  out->has_strike = reader.Bool(record, "hasStrike", false) ? 1 : 0;
+  out->underline = reader.U8(record, "underline", 0U);
+  out->vert_align = reader.U8(record, "vertAlign", 0U);
+  out->has_family = reader.Bool(record, "hasFamily", false) ? 1 : 0;
+  out->family = reader.U8(record, "family", 0U);
+  out->has_charset = reader.Bool(record, "hasCharset", false) ? 1 : 0;
+  out->charset = reader.U8(record, "charset", 0U);
+  out->scheme = reader.U8(record, "scheme", 0U);
+  out->color_argb = reader.U32(record, "colorArgb", 0xFF000000U);
+  out->color = PullColorSpec(reader, record, "color");
 }
 
 Napi::Object FillRecordToJs(Napi::Env env, const fm_fill_record& f) {
@@ -145,13 +98,13 @@ Napi::Object FillRecordToJs(Napi::Env env, const fm_fill_record& f) {
   return out;
 }
 
-fm_fill_record PullFillRecord(const Napi::Object& record) {
+fm_fill_record PullFillRecord(CheckedSpecReader& reader, const Napi::Object& record) {
   fm_fill_record out{};
-  out.pattern = static_cast<uint8_t>(SpecPullU32(record, "pattern", 0U) & 0xFFU);
-  out.fg_argb = SpecPullU32(record, "fgArgb", 0U);
-  out.bg_argb = SpecPullU32(record, "bgArgb", 0U);
-  out.fg = PullColorSpec(record, "fg");
-  out.bg = PullColorSpec(record, "bg");
+  out.pattern = reader.U8(record, "pattern", 0U);
+  out.fg_argb = reader.U32(record, "fgArgb", 0U);
+  out.bg_argb = reader.U32(record, "bgArgb", 0U);
+  out.fg = PullColorSpec(reader, record, "fg");
+  out.bg = PullColorSpec(reader, record, "bg");
   return out;
 }
 
@@ -175,27 +128,27 @@ Napi::Object BorderRecordToJs(Napi::Env env, const fm_border_record& b) {
   return out;
 }
 
-fm_border_side PullBorderSide(const Napi::Object& owner, const char* key) {
+fm_border_side PullBorderSide(CheckedSpecReader& reader, const Napi::Object& owner, const char* key) {
   fm_border_side s{};
-  if (!SpecHas(owner, key) || !owner.Get(key).IsObject()) {
+  Napi::Object v;
+  if (!reader.Object(owner, key, &v)) {
     return s;
   }
-  Napi::Object v = owner.Get(key).As<Napi::Object>();
-  s.style = static_cast<uint8_t>(SpecPullU32(v, "style", 0U) & 0xFFU);
-  s.color_argb = SpecPullU32(v, "colorArgb", 0U);
-  s.color = PullColorSpec(v, "color");
+  s.style = reader.U8(v, "style", 0U);
+  s.color_argb = reader.U32(v, "colorArgb", 0U);
+  s.color = PullColorSpec(reader, v, "color");
   return s;
 }
 
-fm_border_record PullBorderRecord(const Napi::Object& record) {
+fm_border_record PullBorderRecord(CheckedSpecReader& reader, const Napi::Object& record) {
   fm_border_record out{};
-  out.left = PullBorderSide(record, "left");
-  out.right = PullBorderSide(record, "right");
-  out.top = PullBorderSide(record, "top");
-  out.bottom = PullBorderSide(record, "bottom");
-  out.diagonal = PullBorderSide(record, "diagonal");
-  out.diagonal_up = SpecPullBool(record, "diagonalUp", false) ? 1 : 0;
-  out.diagonal_down = SpecPullBool(record, "diagonalDown", false) ? 1 : 0;
+  out.left = PullBorderSide(reader, record, "left");
+  out.right = PullBorderSide(reader, record, "right");
+  out.top = PullBorderSide(reader, record, "top");
+  out.bottom = PullBorderSide(reader, record, "bottom");
+  out.diagonal = PullBorderSide(reader, record, "diagonal");
+  out.diagonal_up = reader.Bool(record, "diagonalUp", false) ? 1 : 0;
+  out.diagonal_down = reader.Bool(record, "diagonalDown", false) ? 1 : 0;
   return out;
 }
 
@@ -219,6 +172,17 @@ Napi::Object CellXfToJs(Napi::Env env, const fm_cell_xf& xf) {
   out.Set("hasVerticalAlign", Napi::Boolean::New(env, xf.has_vertical_align != 0));
   out.Set("hasWrapText", Napi::Boolean::New(env, xf.has_wrap_text != 0));
   out.Set("hasJustifyLastLine", Napi::Boolean::New(env, xf.has_justify_last_line != 0));
+  out.Set("applyNumberFormat", Napi::Boolean::New(env, xf.apply_number_format != 0));
+  out.Set("applyFont", Napi::Boolean::New(env, xf.apply_font != 0));
+  out.Set("applyFill", Napi::Boolean::New(env, xf.apply_fill != 0));
+  out.Set("applyBorder", Napi::Boolean::New(env, xf.apply_border != 0));
+  out.Set("applyAlignment", Napi::Boolean::New(env, xf.apply_alignment != 0));
+  out.Set("applyProtection", Napi::Boolean::New(env, xf.apply_protection != 0));
+  out.Set("quotePrefix", Napi::Boolean::New(env, xf.quote_prefix != 0));
+  out.Set("hasProtection", Napi::Boolean::New(env, xf.has_protection != 0));
+  // Without a `<protection>` child the model default applies: locked, not hidden.
+  out.Set("locked", Napi::Boolean::New(env, xf.has_protection == 0 || xf.locked != 0));
+  out.Set("hidden", Napi::Boolean::New(env, xf.has_protection != 0 && xf.hidden != 0));
   return out;
 }
 
@@ -240,6 +204,19 @@ void SetCellXfAlignment(Napi::Env env, const fm_cell_xf& xf, Napi::Object* out)
   }
 }
 
+/// Builds the `getCellXf` / `getCellStyleXf` result from the C call's
+/// status and record; a failed read reports the all-default record.
+Napi::Object CellXfResultToJs(Napi::Env env, fm_status_t rc, fm_cell_xf xf) {
+  if (rc != 0) {
+    xf = fm_cell_xf{};
+  }
+  Napi::Object out = CellXfToJs(env, xf);
+  out.Set("status", MakeStatus(env, rc));
+  out.Set("xfId", Napi::Number::New(env, xf.xf_id));
+  SetCellXfAlignment(env, xf, &out);
+  return out;
+}
+
 }  // namespace
 
 // ---- Cell-XF index --------------------------------------------------
@@ -295,14 +272,7 @@ Napi::Value Workbook::GetCellXf(const Napi::CallbackInfo& info) {
   const uint32_t xf_index = ArgU32(info, 0);
   fm_cell_xf xf{};
   const fm_status_t rc = handle_ != nullptr ? fm_styles_get_cell_xf(handle_, xf_index, &xf) : kBindingInvalidHandle;
-  if (rc != 0) {
-    xf = fm_cell_xf{};
-  }
-  Napi::Object out = CellXfToJs(env, xf);
-  out.Set("status", MakeStatus(env, rc));
-  out.Set("xfId", Napi::Number::New(env, xf.xf_id));
-  SetCellXfAlignment(env, xf, &out);
-  return out;
+  return CellXfResultToJs(env, rc, xf);
 }
 
 Napi::Value Workbook::GetFont(const Napi::CallbackInfo& info) {
@@ -405,13 +375,14 @@ Napi::Value Workbook::AddFont(const Napi::CallbackInfo& info) {
     return MakeNumberFieldResult(env, NullHandleError(env), "index", 0);
   }
   Napi::Object record = (info.Length() > 0 && info[0].IsObject()) ? info[0].As<Napi::Object>() : Napi::Object::New(env);
+  CheckedSpecReader reader(env);
   std::string name;
   fm_font_record fr{};
-  PullFontRecord(record, &name, &fr);
-  if (env.IsExceptionPending()) {
-    // A malformed field left a pending JS exception (see SpecPullInt32 /
-    // SpecPullU32 / SpecPullDouble): stop before the C ABI call commits a
-    // default value for it. The exception surfaces to JS on return.
+  PullFontRecord(reader, record, &name, &fr);
+  if (!reader.ok()) {
+    // A malformed field left a pending JS exception: stop before the C ABI
+    // call commits a default value for it. The exception surfaces to JS on
+    // return.
     return env.Undefined();
   }
   uint32_t idx = 0;
@@ -429,10 +400,11 @@ Napi::Value Workbook::SetFont(const Napi::CallbackInfo& info) {
   }
   const uint32_t font_index = ArgU32(info, 0);
   Napi::Object record = (info.Length() > 1 && info[1].IsObject()) ? info[1].As<Napi::Object>() : Napi::Object::New(env);
+  CheckedSpecReader reader(env);
   std::string name;
   fm_font_record fr{};
-  PullFontRecord(record, &name, &fr);
-  if (env.IsExceptionPending()) {
+  PullFontRecord(reader, record, &name, &fr);
+  if (!reader.ok()) {
     // See the matching guard in AddFont.
     return env.Undefined();
   }
@@ -445,10 +417,11 @@ Napi::Value Workbook::SetDefaultFont(const Napi::CallbackInfo& info) {
     return NullHandleError(env);
   }
   Napi::Object record = (info.Length() > 0 && info[0].IsObject()) ? info[0].As<Napi::Object>() : Napi::Object::New(env);
+  CheckedSpecReader reader(env);
   std::string name;
   fm_font_record fr{};
-  PullFontRecord(record, &name, &fr);
-  if (env.IsExceptionPending()) {
+  PullFontRecord(reader, record, &name, &fr);
+  if (!reader.ok()) {
     // See the matching guard in AddFont.
     return env.Undefined();
   }
@@ -461,8 +434,9 @@ Napi::Value Workbook::AddFill(const Napi::CallbackInfo& info) {
     return MakeNumberFieldResult(env, NullHandleError(env), "index", 0);
   }
   Napi::Object record = (info.Length() > 0 && info[0].IsObject()) ? info[0].As<Napi::Object>() : Napi::Object::New(env);
-  const fm_fill_record fr = PullFillRecord(record);
-  if (env.IsExceptionPending()) {
+  CheckedSpecReader reader(env);
+  const fm_fill_record fr = PullFillRecord(reader, record);
+  if (!reader.ok()) {
     // See the matching guard in AddFont. The return value is discarded
     // in favor of the pending exception either way.
     return env.Undefined();
@@ -481,8 +455,9 @@ Napi::Value Workbook::AddBorder(const Napi::CallbackInfo& info) {
     return MakeNumberFieldResult(env, NullHandleError(env), "index", 0);
   }
   Napi::Object record = (info.Length() > 0 && info[0].IsObject()) ? info[0].As<Napi::Object>() : Napi::Object::New(env);
-  const fm_border_record br = PullBorderRecord(record);
-  if (env.IsExceptionPending()) {
+  CheckedSpecReader reader(env);
+  const fm_border_record br = PullBorderRecord(reader, record);
+  if (!reader.ok()) {
     // See the matching guard in AddFont. The return value is discarded
     // in favor of the pending exception either way.
     return env.Undefined();
@@ -515,59 +490,79 @@ Napi::Value Workbook::AddXf(const Napi::CallbackInfo& info) {
     return MakeNumberFieldResult(env, NullHandleError(env), "index", 0);
   }
   Napi::Object record = (info.Length() > 0 && info[0].IsObject()) ? info[0].As<Napi::Object>() : Napi::Object::New(env);
+  CheckedSpecReader reader(env);
   fm_cell_xf xf{};
-  xf.font_index = record.Has("fontIndex") ? record.Get("fontIndex").ToNumber().Uint32Value() : 0U;
-  xf.fill_index = record.Has("fillIndex") ? record.Get("fillIndex").ToNumber().Uint32Value() : 0U;
-  xf.border_index = record.Has("borderIndex") ? record.Get("borderIndex").ToNumber().Uint32Value() : 0U;
-  xf.num_fmt_id = record.Has("numFmtId") ? static_cast<uint16_t>(record.Get("numFmtId").ToNumber().Uint32Value()) : 0U;
-  xf.horizontal_align =
-      record.Has("horizontalAlign") ? static_cast<uint8_t>(record.Get("horizontalAlign").ToNumber().Uint32Value()) : 0U;
-  xf.vertical_align =
-      record.Has("verticalAlign") ? static_cast<uint8_t>(record.Get("verticalAlign").ToNumber().Uint32Value()) : 2U;
-  xf.wrap_text = (record.Has("wrapText") && record.Get("wrapText").ToBoolean().Value()) ? 1 : 0;
-  xf.justify_last_line = SpecPullBool(record, "justifyLastLine", false) ? 1 : 0;
-  xf.xf_id = SpecPullU32(record, "xfId", 0U);
-  xf.has_horizontal_align = SpecHas(record, "hasHorizontalAlign")
-                                ? (SpecPullBool(record, "hasHorizontalAlign", false) ? 1 : 0)
-                                : (SpecHas(record, "horizontalAlign") ? 1 : 0);
-  xf.has_vertical_align = SpecHas(record, "hasVerticalAlign")
-                              ? (SpecPullBool(record, "hasVerticalAlign", false) ? 1 : 0)
-                              : (SpecHas(record, "verticalAlign") ? 1 : 0);
-  xf.has_wrap_text = SpecHas(record, "hasWrapText") ? (SpecPullBool(record, "hasWrapText", false) ? 1 : 0)
-                                                    : (SpecHas(record, "wrapText") ? 1 : 0);
-  xf.has_justify_last_line = SpecHas(record, "hasJustifyLastLine")
-                                 ? (SpecPullBool(record, "hasJustifyLastLine", false) ? 1 : 0)
-                                 : (SpecHas(record, "justifyLastLine") ? 1 : 0);
-  const bool has_explicit_alignment = SpecHas(record, "hasAlignment");
-  const bool has_supplied_alignment =
-      SpecHas(record, "horizontalAlign") || SpecHas(record, "verticalAlign") || SpecHas(record, "wrapText") ||
-      SpecHas(record, "justifyLastLine") || SpecHas(record, "textRotation") || SpecHas(record, "indent") ||
-      SpecHas(record, "relativeIndent") || SpecHas(record, "shrinkToFit") || SpecHas(record, "readingOrder") ||
-      SpecHas(record, "hasHorizontalAlign") || SpecHas(record, "hasVerticalAlign") || SpecHas(record, "hasWrapText") ||
-      SpecHas(record, "hasJustifyLastLine");
-  xf.has_alignment =
-      has_explicit_alignment ? (SpecPullBool(record, "hasAlignment", false) ? 1 : 0) : (has_supplied_alignment ? 1 : 0);
-  if (SpecHas(record, "textRotation")) {
-    xf.has_text_rotation = 1;
-    xf.text_rotation = SpecPullU32(record, "textRotation", 0U);
-  }
-  if (SpecHas(record, "indent")) {
-    xf.has_indent = 1;
-    xf.indent = SpecPullU32(record, "indent", 0U);
-  }
-  if (SpecHas(record, "relativeIndent")) {
-    xf.has_relative_indent = 1;
-    xf.relative_indent = SpecPullInt32(record, "relativeIndent", 0);
-  }
-  if (SpecHas(record, "shrinkToFit")) {
-    xf.has_shrink_to_fit = 1;
-    xf.shrink_to_fit = SpecPullBool(record, "shrinkToFit", false) ? 1 : 0;
-  }
-  if (SpecHas(record, "readingOrder")) {
-    xf.has_reading_order = 1;
-    xf.reading_order = SpecPullU32(record, "readingOrder", 0U);
-  }
-  if (env.IsExceptionPending()) {
+  xf.font_index = reader.U32(record, "fontIndex", 0U);
+  xf.fill_index = reader.U32(record, "fillIndex", 0U);
+  xf.border_index = reader.U32(record, "borderIndex", 0U);
+  xf.num_fmt_id = reader.U16(record, "numFmtId", 0U);
+  bool horizontal_align_present = false;
+  bool vertical_align_present = false;
+  bool wrap_text_present = false;
+  bool justify_last_line_present = false;
+  xf.horizontal_align = reader.U8(record, "horizontalAlign", 0U, &horizontal_align_present);
+  xf.vertical_align = reader.U8(record, "verticalAlign", 2U, &vertical_align_present);
+  xf.wrap_text = reader.Bool(record, "wrapText", false, &wrap_text_present) ? 1 : 0;
+  xf.justify_last_line = reader.Bool(record, "justifyLastLine", false, &justify_last_line_present) ? 1 : 0;
+  xf.xf_id = reader.U32(record, "xfId", 0U);
+  bool has_horizontal_align_present = false;
+  bool has_vertical_align_present = false;
+  bool has_wrap_text_present = false;
+  bool has_justify_last_line_present = false;
+  const bool has_horizontal_align_value =
+      reader.Bool(record, "hasHorizontalAlign", false, &has_horizontal_align_present);
+  const bool has_vertical_align_value = reader.Bool(record, "hasVerticalAlign", false, &has_vertical_align_present);
+  const bool has_wrap_text_value = reader.Bool(record, "hasWrapText", false, &has_wrap_text_present);
+  const bool has_justify_last_line_value =
+      reader.Bool(record, "hasJustifyLastLine", false, &has_justify_last_line_present);
+  xf.has_horizontal_align =
+      has_horizontal_align_present ? (has_horizontal_align_value ? 1 : 0) : (horizontal_align_present ? 1 : 0);
+  xf.has_vertical_align =
+      has_vertical_align_present ? (has_vertical_align_value ? 1 : 0) : (vertical_align_present ? 1 : 0);
+  xf.has_wrap_text = has_wrap_text_present ? (has_wrap_text_value ? 1 : 0) : (wrap_text_present ? 1 : 0);
+  xf.has_justify_last_line =
+      has_justify_last_line_present ? (has_justify_last_line_value ? 1 : 0) : (justify_last_line_present ? 1 : 0);
+  bool has_alignment_present = false;
+  const bool has_alignment_value = reader.Bool(record, "hasAlignment", false, &has_alignment_present);
+  bool text_rotation_present = false;
+  bool indent_present = false;
+  bool relative_indent_present = false;
+  bool shrink_to_fit_present = false;
+  bool reading_order_present = false;
+  xf.text_rotation = reader.U32(record, "textRotation", 0U, &text_rotation_present);
+  xf.indent = reader.U32(record, "indent", 0U, &indent_present);
+  xf.relative_indent = reader.I32(record, "relativeIndent", 0, &relative_indent_present);
+  xf.shrink_to_fit = reader.Bool(record, "shrinkToFit", false, &shrink_to_fit_present) ? 1 : 0;
+  xf.reading_order = reader.U32(record, "readingOrder", 0U, &reading_order_present);
+  xf.has_text_rotation = text_rotation_present ? 1 : 0;
+  xf.has_indent = indent_present ? 1 : 0;
+  xf.has_relative_indent = relative_indent_present ? 1 : 0;
+  xf.has_shrink_to_fit = shrink_to_fit_present ? 1 : 0;
+  xf.has_reading_order = reading_order_present ? 1 : 0;
+  const bool has_supplied_alignment = horizontal_align_present || vertical_align_present || wrap_text_present ||
+                                      justify_last_line_present || text_rotation_present || indent_present ||
+                                      relative_indent_present || shrink_to_fit_present || reading_order_present ||
+                                      has_horizontal_align_present || has_vertical_align_present ||
+                                      has_wrap_text_present || has_justify_last_line_present;
+  xf.has_alignment = has_alignment_present ? (has_alignment_value ? 1 : 0) : (has_supplied_alignment ? 1 : 0);
+  xf.apply_number_format = reader.Bool(record, "applyNumberFormat", false) ? 1 : 0;
+  xf.apply_font = reader.Bool(record, "applyFont", false) ? 1 : 0;
+  xf.apply_fill = reader.Bool(record, "applyFill", false) ? 1 : 0;
+  xf.apply_border = reader.Bool(record, "applyBorder", false) ? 1 : 0;
+  xf.apply_alignment = reader.Bool(record, "applyAlignment", false) ? 1 : 0;
+  xf.apply_protection = reader.Bool(record, "applyProtection", false) ? 1 : 0;
+  xf.quote_prefix = reader.Bool(record, "quotePrefix", false) ? 1 : 0;
+  bool has_protection_present = false;
+  bool locked_present = false;
+  bool hidden_present = false;
+  const bool has_protection_value = reader.Bool(record, "hasProtection", false, &has_protection_present);
+  const bool locked_value = reader.Bool(record, "locked", true, &locked_present);
+  const bool hidden_value = reader.Bool(record, "hidden", false, &hidden_present);
+  xf.has_protection =
+      has_protection_present ? (has_protection_value ? 1 : 0) : ((locked_present || hidden_present) ? 1 : 0);
+  xf.locked = locked_value ? 1 : 0;
+  xf.hidden = hidden_value ? 1 : 0;
+  if (!reader.ok()) {
     // See the matching guard in AddFont. The return value is discarded
     // in favor of the pending exception either way.
     return env.Undefined();
@@ -592,43 +587,40 @@ Napi::Value Workbook::AddDxf(const Napi::CallbackInfo& info) {
   std::string alignment_xml;
   std::string protection_xml;
   fm_dxf_record dxf{};
+  CheckedSpecReader reader(env);
 
-  if (record.Has("font") && record.Get("font").IsObject()) {
+  Napi::Object font;
+  if (reader.Object(record, "font", &font)) {
     dxf.font_engaged = 1;
-    PullFontRecord(record.Get("font").As<Napi::Object>(), &font_name, &dxf.font);
+    PullFontRecord(reader, font, &font_name, &dxf.font);
   }
 
-  if (record.Has("fill") && record.Get("fill").IsObject()) {
+  Napi::Object fill;
+  if (reader.Object(record, "fill", &fill)) {
     dxf.fill_engaged = 1;
-    dxf.fill = PullFillRecord(record.Get("fill").As<Napi::Object>());
+    dxf.fill = PullFillRecord(reader, fill);
   }
 
-  if (record.Has("border") && record.Get("border").IsObject()) {
+  Napi::Object border;
+  if (reader.Object(record, "border", &border)) {
     dxf.border_engaged = 1;
-    dxf.border = PullBorderRecord(record.Get("border").As<Napi::Object>());
+    dxf.border = PullBorderRecord(reader, border);
   }
 
-  if (record.Has("numFmt") && record.Get("numFmt").IsObject()) {
-    Napi::Object num_fmt = record.Get("numFmt").As<Napi::Object>();
+  Napi::Object num_fmt;
+  if (reader.Object(record, "numFmt", &num_fmt)) {
     dxf.num_fmt_engaged = 1;
-    dxf.num_fmt_id = static_cast<uint16_t>(SpecPullU32(num_fmt, "numFmtId", 0U) & 0xFFFFU);
-    if (num_fmt.Has("formatCode") && !num_fmt.Get("formatCode").IsUndefined() && !num_fmt.Get("formatCode").IsNull()) {
-      num_fmt_code = num_fmt.Get("formatCode").ToString().Utf8Value();
-    }
+    dxf.num_fmt_id = reader.U16(num_fmt, "numFmtId", 0U);
+    reader.String(num_fmt, "formatCode", &num_fmt_code);
     dxf.num_fmt_code = num_fmt_code.c_str();
   }
 
-  if (record.Has("alignmentXml") && !record.Get("alignmentXml").IsUndefined() && !record.Get("alignmentXml").IsNull()) {
-    alignment_xml = record.Get("alignmentXml").ToString().Utf8Value();
-  }
-  if (record.Has("protectionXml") && !record.Get("protectionXml").IsUndefined() &&
-      !record.Get("protectionXml").IsNull()) {
-    protection_xml = record.Get("protectionXml").ToString().Utf8Value();
-  }
+  reader.String(record, "alignmentXml", &alignment_xml);
+  reader.String(record, "protectionXml", &protection_xml);
   dxf.alignment_xml = alignment_xml.c_str();
   dxf.protection_xml = protection_xml.c_str();
 
-  if (env.IsExceptionPending()) {
+  if (!reader.ok()) {
     // See the matching guard in AddFont. The return value is discarded
     // in favor of the pending exception either way.
     return env.Undefined();
@@ -656,69 +648,6 @@ Napi::Value Workbook::DxfCount(const Napi::CallbackInfo& info) {
   return MakeNumberResult(env, rc, n);
 }
 
-// ---- Conditional formatting -----------------------------------------
-
-Napi::Value Workbook::EvaluateCfRange(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  Napi::Object out = Napi::Object::New(env);
-  if (handle_ == nullptr) {
-    out.Set("status", NullHandleError(env));
-    out.Set("cells", Napi::Array::New(env));
-    return out;
-  }
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t first_row = ArgU32(info, 1);
-  const uint32_t first_col = ArgU32(info, 2);
-  const uint32_t last_row = ArgU32(info, 3);
-  const uint32_t last_col = ArgU32(info, 4);
-  // A missing `todaySerial` must disable `timePeriod` rules, matching the
-  // Python binding and the C ABI contract. `ArgDouble`'s 0.0 fallback is a
-  // valid Excel serial (1899-12-30), so it would silently evaluate those
-  // rules against that date instead of skipping them.
-  const double today_serial =
-      info.Length() > 5 ? info[5].ToNumber().DoubleValue() : std::numeric_limits<double>::quiet_NaN();
-  fm_cf_results_t* results = nullptr;
-  fm_status_t rc =
-      fm_workbook_cf_evaluate_range(handle_, sheet, first_row, first_col, last_row, last_col, today_serial, &results);
-  if (rc != 0) {
-    out.Set("status", MakeErrorStatus(env, rc));
-    out.Set("cells", Napi::Array::New(env));
-    return out;
-  }
-  const std::size_t cell_count = fm_cf_results_cell_count(results);
-  Napi::Array cells = Napi::Array::New(env, cell_count);
-  std::size_t emitted = 0;
-  for (std::size_t i = 0; i < cell_count; ++i) {
-    uint32_t row = 0;
-    uint32_t col = 0;
-    std::size_t match_count = 0;
-    if (fm_cf_results_cell_at(results, i, &row, &col, &match_count) != 0) {
-      // Defensive: skip entries the C ABI declines to materialise.
-      continue;
-    }
-    Napi::Array matches = Napi::Array::New(env, match_count);
-    std::size_t mj = 0;
-    for (std::size_t j = 0; j < match_count; ++j) {
-      fm_cf_match_t m{};
-      if (fm_cf_results_match_at(results, i, j, &m) != 0) {
-        continue;
-      }
-      matches.Set(static_cast<uint32_t>(mj), TranslateCfMatch(env, m));
-      ++mj;
-    }
-    Napi::Object cell = Napi::Object::New(env);
-    cell.Set("row", Napi::Number::New(env, row));
-    cell.Set("col", Napi::Number::New(env, col));
-    cell.Set("matches", matches);
-    cells.Set(static_cast<uint32_t>(emitted), cell);
-    ++emitted;
-  }
-  fm_cf_results_destroy(results);
-  out.Set("status", MakeOkStatus(env));
-  out.Set("cells", cells);
-  return out;
-}
-
 // ---- Named cell styles ----------------------------------------------
 
 Napi::Value Workbook::CellStyleCount(const Napi::CallbackInfo& info) {
@@ -765,360 +694,187 @@ Napi::Value Workbook::GetCellStyleXf(const Napi::CallbackInfo& info) {
   const uint32_t index = ArgU32(info, 0);
   fm_cell_xf xf{};
   const fm_status_t rc = handle_ != nullptr ? fm_styles_get_cell_style_xf(handle_, index, &xf) : kBindingInvalidHandle;
-  if (rc != 0) {
-    xf = fm_cell_xf{};
-  }
-  Napi::Object out = CellXfToJs(env, xf);
-  out.Set("status", MakeStatus(env, rc));
-  out.Set("xfId", Napi::Number::New(env, xf.xf_id));
-  SetCellXfAlignment(env, xf, &out);
-  return out;
+  return CellXfResultToJs(env, rc, xf);
 }
 
-// ---- Conditional formatting (read / mutate) -------------------------
-
-Napi::Value Workbook::GetConditionalFormats(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::SetCellStyle(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
-  Napi::Array arr = Napi::Array::New(env);
   if (handle_ == nullptr) {
-    return FinishListResult(env, arr, kBindingInvalidHandle);
+    return NullHandleError(env);
   }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  std::size_t count = 0;
-  fm_status_t rc = fm_sheet_cf_count(handle_, sheet, &count);
-  if (rc != 0) {
-    return FinishListResult(env, arr, rc);
-  }
-  std::size_t emitted = 0;
-  for (std::size_t i = 0; i < count; ++i) {
-    fm_cf_rule_t rule{};
-    rc = fm_sheet_cf_get_at(handle_, sheet, i, &rule);
-    if (rc != 0) {
-      return FinishListResult(env, arr, rc);
-    }
-    Napi::Object item = Napi::Object::New(env);
-    item.Set("id", Napi::String::New(env, rule.id != nullptr ? rule.id : ""));
-    item.Set("type", Napi::Number::New(env, static_cast<uint32_t>(rule.type)));
-    item.Set("priority", Napi::Number::New(env, rule.priority));
-    item.Set("stopIfTrue", Napi::Boolean::New(env, rule.stop_if_true != 0));
-    Napi::Array sqref = Napi::Array::New(env, rule.sqref_count);
-    for (uint32_t r = 0; r < rule.sqref_count; ++r) {
-      Napi::Object rng = Napi::Object::New(env);
-      rng.Set("firstRow", Napi::Number::New(env, rule.sqref[r].first_row));
-      rng.Set("firstCol", Napi::Number::New(env, rule.sqref[r].first_col));
-      rng.Set("lastRow", Napi::Number::New(env, rule.sqref[r].last_row));
-      rng.Set("lastCol", Napi::Number::New(env, rule.sqref[r].last_col));
-      sqref.Set(r, rng);
-    }
-    item.Set("sqref", sqref);
-    if (rule.dxf_id_engaged != 0) {
-      item.Set("dxfId", Napi::Number::New(env, rule.dxf_id));
-    }
-    if (rule.formula1 != nullptr) {
-      item.Set("formula1", Napi::String::New(env, rule.formula1));
-    }
-    if (rule.formula2 != nullptr) {
-      item.Set("formula2", Napi::String::New(env, rule.formula2));
-    }
-    if (rule.op_engaged != 0) {
-      item.Set("op", Napi::Number::New(env, static_cast<uint32_t>(rule.op)));
-    }
-    if (rule.rank_engaged != 0) {
-      item.Set("rank", Napi::Number::New(env, rule.rank));
-      item.Set("percent", Napi::Boolean::New(env, rule.percent != 0));
-      item.Set("bottom", Napi::Boolean::New(env, rule.bottom != 0));
-    }
-    // aboveAverage flags are always engineered but only meaningful for
-    // the AboveAverage rule type; surface them only there to mirror the
-    // embind shape.
-    if (rule.type == 6 /* AboveAverage */) {
-      item.Set("aboveAverage", Napi::Boolean::New(env, rule.above_average != 0));
-      item.Set("equalAverage", Napi::Boolean::New(env, rule.equal_average != 0));
-      if (rule.std_dev_engaged != 0) {
-        item.Set("stdDev", Napi::Number::New(env, rule.std_dev));
-      }
-    }
-    if (rule.text != nullptr) {
-      item.Set("text", Napi::String::New(env, rule.text));
-    }
-    if (rule.time_period_engaged != 0) {
-      item.Set("timePeriod", Napi::Number::New(env, static_cast<uint32_t>(rule.time_period)));
-    }
-    if (rule.color_scale_count > 0 && rule.color_scale_thresholds != nullptr && rule.color_scale_colors != nullptr) {
-      Napi::Object color_scale = Napi::Object::New(env);
-      Napi::Array thresholds = Napi::Array::New(env, rule.color_scale_count);
-      Napi::Array colors = Napi::Array::New(env, rule.color_scale_count);
-      for (uint32_t j = 0; j < rule.color_scale_count; ++j) {
-        thresholds.Set(j, CfvoToJs(env, rule.color_scale_thresholds[j]));
-        colors.Set(j, CfColorToJs(env, rule.color_scale_colors[j]));
-      }
-      color_scale.Set("thresholds", thresholds);
-      color_scale.Set("colors", colors);
-      item.Set("colorScale", color_scale);
-    }
-    if (rule.data_bar_engaged != 0) {
-      Napi::Object data_bar = Napi::Object::New(env);
-      data_bar.Set("min", CfvoToJs(env, rule.data_bar_min));
-      data_bar.Set("max", CfvoToJs(env, rule.data_bar_max));
-      data_bar.Set("fill", CfColorToJs(env, rule.data_bar_fill));
-      data_bar.Set("showValue", Napi::Boolean::New(env, rule.data_bar_show_value != 0));
-      data_bar.Set("minLengthPct", Napi::Number::New(env, static_cast<uint32_t>(rule.data_bar_min_length_pct)));
-      data_bar.Set("maxLengthPct", Napi::Number::New(env, static_cast<uint32_t>(rule.data_bar_max_length_pct)));
-      // `x14` extension payload. Each key appears only when the C ABI
-      // reports the matching `*_engaged` flag, so an absent key means the
-      // rule keeps the model default and the object round-trips through
-      // `addConditionalFormat` unchanged. The getter engages all six.
-      if (rule.data_bar_gradient_engaged != 0) {
-        data_bar.Set("gradient", Napi::Boolean::New(env, rule.data_bar_gradient != 0));
-      }
-      if (rule.data_bar_axis_position_engaged != 0) {
-        data_bar.Set("axisPosition", Napi::Number::New(env, static_cast<uint32_t>(rule.data_bar_axis_position)));
-      }
-      if (rule.data_bar_negative_fill_engaged != 0) {
-        data_bar.Set("negativeFill", CfColorToJs(env, rule.data_bar_negative_fill));
-      }
-      if (rule.data_bar_border_engaged != 0) {
-        data_bar.Set("border", CfColorToJs(env, rule.data_bar_border));
-      }
-      if (rule.data_bar_negative_border_engaged != 0) {
-        data_bar.Set("negativeBorder", CfColorToJs(env, rule.data_bar_negative_border));
-      }
-      if (rule.data_bar_axis_color_engaged != 0) {
-        data_bar.Set("axisColor", CfColorToJs(env, rule.data_bar_axis_color));
-      }
-      data_bar.Set("direction", Napi::Number::New(env, static_cast<uint32_t>(rule.data_bar_direction)));
-      item.Set("dataBar", data_bar);
-    }
-    if (rule.icon_set_engaged != 0) {
-      Napi::Object icon_set = Napi::Object::New(env);
-      icon_set.Set("name", Napi::Number::New(env, static_cast<uint32_t>(rule.icon_set_name)));
-      Napi::Array thresholds = Napi::Array::New(env, rule.icon_set_threshold_count);
-      for (uint32_t j = 0; j < rule.icon_set_threshold_count; ++j) {
-        thresholds.Set(j, CfvoToJs(env, rule.icon_set_thresholds[j]));
-      }
-      icon_set.Set("thresholds", thresholds);
-      icon_set.Set("reverse", Napi::Boolean::New(env, rule.icon_set_reverse != 0));
-      icon_set.Set("showValue", Napi::Boolean::New(env, rule.icon_set_show_value != 0));
-      icon_set.Set("percent", Napi::Boolean::New(env, rule.icon_set_percent != 0));
-      if (rule.icon_set_floor_engaged != 0) {
-        icon_set.Set("floor", CfvoToJs(env, rule.icon_set_floor));
-      }
-      item.Set("iconSet", icon_set);
-    }
-    arr.Set(static_cast<uint32_t>(emitted), item);
-    ++emitted;
+  Napi::Object record = (info.Length() > 0 && info[0].IsObject()) ? info[0].As<Napi::Object>() : Napi::Object::New(env);
+  CheckedSpecReader reader(env);
+  std::string name;
+  reader.String(record, "name", &name);
+  fm_cell_style_record_t cs{};
+  cs.name = name.c_str();
+  cs.xf_id = reader.U32(record, "xfId", 0U);
+  cs.builtin_id = reader.U32(record, "builtinId", FM_CELL_STYLE_BUILTIN_ID_NONE);
+  cs.i_level = reader.U32(record, "iLevel", 0U);
+  cs.hidden = reader.Bool(record, "hidden", false) ? 1 : 0;
+  cs.custom_builtin = reader.Bool(record, "customBuiltin", false) ? 1 : 0;
+  if (!reader.ok()) {
+    return env.Undefined();
   }
-  return FinishListResult(env, arr, 0);
+  return MakeStatus(env, fm_styles_set_cell_style(handle_, &cs));
 }
 
-Napi::Value Workbook::AddConditionalFormat(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::RemoveCellStyle(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
-    return MakeNumberFieldResult(env, NullHandleError(env), "index", 0);
-  }
-  if (info.Length() < 2 || !info[0].IsNumber() || !info[1].IsObject()) {
-    Napi::TypeError::New(env, "addConditionalFormat expects (sheet:number, rule:object)").ThrowAsJavaScriptException();
-    return env.Undefined();
+    return NullHandleError(env);
   }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  Napi::Object v = info[1].As<Napi::Object>();
+  const std::string name = ArgString(info, 0);
+  return MakeStatus(env, fm_styles_remove_cell_style(handle_, name.c_str()));
+}
 
-  // Pull every JS field into local storage first; the C ABI receives
-  // borrowed `const char*` views that must stay valid until
-  // `fm_sheet_cf_add_rule` returns. Threshold value strings go into an
-  // arena rather than a vector: the colorScale, dataBar and iconSet
-  // branches below all feed the same store, and a vector would relocate
-  // the earlier strings as the later branches add theirs.
-  std::vector<fm_cf_cell_range_t> ranges_buf;
-  std::vector<fm_cfvo_t> color_scale_thresholds;
-  std::vector<fm_cf_color_t> color_scale_colors;
-  std::vector<fm_cfvo_t> icon_set_thresholds;
-  formulon::c_api::BorrowedStringArena cfvo_strings;
-  if (v.Has("sqref")) {
-    Napi::Value sqref_js = v.Get("sqref");
-    if (sqref_js.IsArray()) {
-      Napi::Array sqref_arr = sqref_js.As<Napi::Array>();
-      const uint32_t n = sqref_arr.Length();
-      ranges_buf.reserve(n);
-      for (uint32_t i = 0; i < n; ++i) {
-        Napi::Value rng_v = sqref_arr.Get(i);
-        if (!rng_v.IsObject()) {
-          continue;
-        }
-        Napi::Object rng = rng_v.As<Napi::Object>();
-        fm_cf_cell_range_t r{};
-        r.first_row = rng.Get("firstRow").ToNumber().Uint32Value();
-        r.first_col = rng.Get("firstCol").ToNumber().Uint32Value();
-        r.last_row = rng.Get("lastRow").ToNumber().Uint32Value();
-        r.last_col = rng.Get("lastCol").ToNumber().Uint32Value();
-        ranges_buf.push_back(r);
-      }
-    }
-  }
-  const std::string id = SpecHas(v, "id") ? v.Get("id").ToString().Utf8Value() : std::string();
-  const std::string formula1 = SpecHas(v, "formula1") ? v.Get("formula1").ToString().Utf8Value() : std::string();
-  const std::string formula2 = SpecHas(v, "formula2") ? v.Get("formula2").ToString().Utf8Value() : std::string();
-  const std::string text = SpecHas(v, "text") ? v.Get("text").ToString().Utf8Value() : std::string();
+// ---- Theme, colour resolution, effective style ----------------------
 
-  fm_cf_rule_t rule{};
-  rule.id = id.empty() ? nullptr : id.c_str();
-  rule.type = static_cast<uint8_t>(SpecPullU32(v, "type", 0U) & 0xFFU);
-  rule.priority = SpecPullInt32(v, "priority", 0);
-  rule.stop_if_true = SpecPullBool(v, "stopIfTrue", false) ? 1 : 0;
-  if (SpecHas(v, "dxfId")) {
-    rule.dxf_id_engaged = 1;
-    rule.dxf_id = SpecPullU32(v, "dxfId", 0U);
-  }
-  rule.sqref = ranges_buf.empty() ? nullptr : ranges_buf.data();
-  rule.sqref_count = static_cast<uint32_t>(ranges_buf.size());
-  rule.formula1 = formula1.empty() ? nullptr : formula1.c_str();
-  rule.formula2 = formula2.empty() ? nullptr : formula2.c_str();
-  if (SpecHas(v, "op")) {
-    rule.op_engaged = 1;
-    rule.op = static_cast<uint8_t>(SpecPullU32(v, "op", 0U) & 0xFFU);
-  }
-  if (SpecHas(v, "rank")) {
-    rule.rank_engaged = 1;
-    rule.rank = SpecPullInt32(v, "rank", 0);
-  }
-  rule.percent = SpecPullBool(v, "percent", false) ? 1 : 0;
-  rule.bottom = SpecPullBool(v, "bottom", false) ? 1 : 0;
-  rule.above_average = SpecPullBool(v, "aboveAverage", true) ? 1 : 0;
-  rule.equal_average = SpecPullBool(v, "equalAverage", false) ? 1 : 0;
-  if (SpecHas(v, "stdDev")) {
-    rule.std_dev_engaged = 1;
-    rule.std_dev = SpecPullDouble(v, "stdDev", 0.0);
-  }
-  rule.text = text.empty() ? nullptr : text.c_str();
-  if (SpecHas(v, "timePeriod")) {
-    rule.time_period_engaged = 1;
-    rule.time_period = static_cast<uint8_t>(SpecPullU32(v, "timePeriod", 0U) & 0xFFU);
-  }
-  if (SpecHas(v, "colorScale") && v.Get("colorScale").IsObject()) {
-    Napi::Object cs = v.Get("colorScale").As<Napi::Object>();
-    if (SpecHas(cs, "thresholds") && cs.Get("thresholds").IsArray()) {
-      Napi::Array arr = cs.Get("thresholds").As<Napi::Array>();
-      color_scale_thresholds.reserve(arr.Length());
-      for (uint32_t i = 0; i < arr.Length(); ++i) {
-        if (arr.Get(i).IsObject()) {
-          color_scale_thresholds.push_back(PullCfvo(arr.Get(i).As<Napi::Object>(), &cfvo_strings));
-        }
-      }
-    }
-    if (SpecHas(cs, "colors") && cs.Get("colors").IsArray()) {
-      Napi::Array arr = cs.Get("colors").As<Napi::Array>();
-      color_scale_colors.reserve(arr.Length());
-      for (uint32_t i = 0; i < arr.Length(); ++i) {
-        if (arr.Get(i).IsObject()) {
-          color_scale_colors.push_back(PullCfColor(arr.Get(i).As<Napi::Object>()));
-        }
-      }
-    }
-    rule.color_scale_thresholds = color_scale_thresholds.empty() ? nullptr : color_scale_thresholds.data();
-    rule.color_scale_colors = color_scale_colors.empty() ? nullptr : color_scale_colors.data();
-    rule.color_scale_count = static_cast<uint32_t>(color_scale_thresholds.size());
-  }
-  if (SpecHas(v, "dataBar") && v.Get("dataBar").IsObject()) {
-    Napi::Object db = v.Get("dataBar").As<Napi::Object>();
-    rule.data_bar_engaged = 1;
-    if (SpecHas(db, "min") && db.Get("min").IsObject()) {
-      rule.data_bar_min = PullCfvo(db.Get("min").As<Napi::Object>(), &cfvo_strings);
-    }
-    if (SpecHas(db, "max") && db.Get("max").IsObject()) {
-      rule.data_bar_max = PullCfvo(db.Get("max").As<Napi::Object>(), &cfvo_strings);
-    }
-    if (SpecHas(db, "fill") && db.Get("fill").IsObject()) {
-      rule.data_bar_fill = PullCfColor(db.Get("fill").As<Napi::Object>());
-    }
-    rule.data_bar_show_value = SpecPullBool(db, "showValue", true) ? 1 : 0;
-    rule.data_bar_min_length_pct = static_cast<uint8_t>(SpecPullU32(db, "minLengthPct", 10U) & 0xFFU);
-    rule.data_bar_max_length_pct = static_cast<uint8_t>(SpecPullU32(db, "maxLengthPct", 90U) & 0xFFU);
-    // `x14` extension payload. An omitted key leaves the `*_engaged` flag
-    // clear, which the C ABI reads as "keep the model default" (gradient
-    // on, automatic axis, negative fill equal to the positive fill, no
-    // border, black axis).
-    if (SpecHas(db, "gradient")) {
-      rule.data_bar_gradient_engaged = 1;
-      rule.data_bar_gradient = SpecPullBool(db, "gradient", true) ? 1 : 0;
-    }
-    if (SpecHas(db, "axisPosition")) {
-      rule.data_bar_axis_position_engaged = 1;
-      rule.data_bar_axis_position = static_cast<uint8_t>(SpecPullU32(db, "axisPosition", 0U) & 0xFFU);
-    }
-    if (SpecHas(db, "negativeFill") && db.Get("negativeFill").IsObject()) {
-      rule.data_bar_negative_fill_engaged = 1;
-      rule.data_bar_negative_fill = PullCfColor(db.Get("negativeFill").As<Napi::Object>());
-    }
-    if (SpecHas(db, "border") && db.Get("border").IsObject()) {
-      rule.data_bar_border_engaged = 1;
-      rule.data_bar_border = PullCfColor(db.Get("border").As<Napi::Object>());
-    }
-    if (SpecHas(db, "negativeBorder") && db.Get("negativeBorder").IsObject()) {
-      rule.data_bar_negative_border_engaged = 1;
-      rule.data_bar_negative_border = PullCfColor(db.Get("negativeBorder").As<Napi::Object>());
-    }
-    if (SpecHas(db, "axisColor") && db.Get("axisColor").IsObject()) {
-      rule.data_bar_axis_color_engaged = 1;
-      rule.data_bar_axis_color = PullCfColor(db.Get("axisColor").As<Napi::Object>());
-    }
-    rule.data_bar_direction = static_cast<uint8_t>(SpecPullU32(db, "direction", 0U) & 0xFFU);
-  }
-  if (SpecHas(v, "iconSet") && v.Get("iconSet").IsObject()) {
-    Napi::Object is = v.Get("iconSet").As<Napi::Object>();
-    rule.icon_set_engaged = 1;
-    rule.icon_set_name = static_cast<uint8_t>(SpecPullU32(is, "name", 0U) & 0xFFU);
-    if (SpecHas(is, "thresholds") && is.Get("thresholds").IsArray()) {
-      Napi::Array arr = is.Get("thresholds").As<Napi::Array>();
-      icon_set_thresholds.reserve(arr.Length());
-      for (uint32_t i = 0; i < arr.Length(); ++i) {
-        if (arr.Get(i).IsObject()) {
-          icon_set_thresholds.push_back(PullCfvo(arr.Get(i).As<Napi::Object>(), &cfvo_strings));
-        }
-      }
-    }
-    rule.icon_set_thresholds = icon_set_thresholds.empty() ? nullptr : icon_set_thresholds.data();
-    rule.icon_set_threshold_count = static_cast<uint32_t>(icon_set_thresholds.size());
-    rule.icon_set_reverse = SpecPullBool(is, "reverse", false) ? 1 : 0;
-    rule.icon_set_show_value = SpecPullBool(is, "showValue", true) ? 1 : 0;
-    rule.icon_set_percent = SpecPullBool(is, "percent", true) ? 1 : 0;
-    // An omitted floor keeps Excel's default, `percent 0`.
-    if (SpecHas(is, "floor") && is.Get("floor").IsObject()) {
-      rule.icon_set_floor_engaged = 1;
-      rule.icon_set_floor = PullCfvo(is.Get("floor").As<Napi::Object>(), &cfvo_strings);
+Napi::Value Workbook::GetTheme(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  fm_theme_colors colors{};
+  fm_theme_fonts fonts{};
+  int32_t source = 0;
+  fm_status_t rc = kBindingInvalidHandle;
+  if (handle_ != nullptr) {
+    rc = fm_workbook_get_theme_colors(handle_, &colors, &source);
+    if (rc == 0) {
+      rc = fm_workbook_get_theme_fonts(handle_, &fonts);
     }
   }
-  if (env.IsExceptionPending()) {
-    // See the matching guard in AddFont. The return value is discarded
-    // in favor of the pending exception either way.
-    return env.Undefined();
-  }
-  std::size_t new_index = 0;
-  fm_status_t rc = fm_sheet_cf_add_rule(handle_, sheet, rule, &new_index);
   if (rc != 0) {
-    return MakeNumberFieldResult(env, MakeErrorStatus(env, rc), "index", 0);
-  }
-  return MakeNumberFieldResult(env, MakeOkStatus(env), "index", static_cast<double>(new_index));
+    colors = fm_theme_colors{};
+    fonts = fm_theme_fonts{};
+    source = 0;
+  }
+  Napi::Array arr = Napi::Array::New(env, 12);
+  for (uint32_t i = 0; i < 12; ++i) {
+    arr.Set(i, Napi::Number::New(env, colors.argb[i]));
+  }
+  const auto face = [&env](const char* s) { return Napi::String::New(env, s != nullptr ? s : ""); };
+  Napi::Object fontsOut = Napi::Object::New(env);
+  fontsOut.Set("majorLatin", face(fonts.major_latin));
+  fontsOut.Set("majorEastAsian", face(fonts.major_east_asian));
+  fontsOut.Set("minorLatin", face(fonts.minor_latin));
+  fontsOut.Set("minorEastAsian", face(fonts.minor_east_asian));
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("status", MakeStatus(env, rc));
+  out.Set("source", Napi::Number::New(env, source));
+  out.Set("colors", arr);
+  out.Set("fonts", fontsOut);
+  return out;
 }
 
-Napi::Value Workbook::RemoveConditionalFormatAt(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::SetThemeColors(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
     return NullHandleError(env);
   }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  const std::size_t index = static_cast<std::size_t>(ArgU32(info, 1));
-  fm_status_t rc = fm_sheet_cf_remove_at(handle_, sheet, index);
-  return MakeStatus(env, rc);
+  if (info.Length() < 1 || !info[0].IsArray() || info[0].As<Napi::Array>().Length() != 12) {
+    return MakeBindingArgumentError(env, "setThemeColors expects an array of 12 ARGB numbers");
+  }
+  Napi::Array arr = info[0].As<Napi::Array>();
+  CheckedSpecReader reader(env);
+  fm_theme_colors colors{};
+  for (uint32_t i = 0; i < 12; ++i) {
+    const std::string key = std::to_string(i);
+    colors.argb[i] = reader.U32(arr, key.c_str(), 0U);
+  }
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  return MakeStatus(env, fm_workbook_set_theme_colors(handle_, &colors));
 }
 
-Napi::Value Workbook::ClearConditionalFormats(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::SetThemeFonts(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
   if (handle_ == nullptr) {
     return NullHandleError(env);
   }
-  const std::size_t sheet = static_cast<std::size_t>(ArgU32(info, 0));
-  fm_status_t rc = fm_sheet_cf_clear(handle_, sheet);
-  return MakeStatus(env, rc);
+  Napi::Object record = (info.Length() > 0 && info[0].IsObject()) ? info[0].As<Napi::Object>() : Napi::Object::New(env);
+  CheckedSpecReader reader(env);
+  std::string major_latin;
+  std::string major_ea;
+  std::string minor_latin;
+  std::string minor_ea;
+  reader.String(record, "majorLatin", &major_latin);
+  reader.String(record, "majorEastAsian", &major_ea);
+  reader.String(record, "minorLatin", &minor_latin);
+  reader.String(record, "minorEastAsian", &minor_ea);
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  fm_theme_fonts fonts{};
+  fonts.major_latin = major_latin.c_str();
+  fonts.major_east_asian = major_ea.c_str();
+  fonts.minor_latin = minor_latin.c_str();
+  fonts.minor_east_asian = minor_ea.c_str();
+  return MakeStatus(env, fm_workbook_set_theme_fonts(handle_, &fonts));
+}
+
+Napi::Value Workbook::ResolveColor(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  CheckedSpecReader reader(env);
+  fm_color_spec spec{};
+  if (info.Length() > 0 && info[0].IsObject()) {
+    Napi::Object holder = Napi::Object::New(env);
+    holder.Set("spec", info[0]);
+    spec = PullColorSpec(reader, holder, "spec");
+  }
+  if (!reader.ok()) {
+    return env.Undefined();
+  }
+  uint32_t argb = 0;
+  int32_t resolution = 0;
+  const fm_status_t rc = handle_ != nullptr
+                             ? fm_workbook_resolve_color(handle_, spec, ArgI32(info, 1), &argb, &resolution)
+                             : kBindingInvalidHandle;
+  if (rc != 0) {
+    argb = 0;
+    resolution = 0;
+  }
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("status", MakeStatus(env, rc));
+  out.Set("argb", Napi::Number::New(env, argb));
+  out.Set("resolution", Napi::Number::New(env, resolution));
+  return out;
+}
+
+Napi::Value Workbook::GetEffectiveStyle(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  fm_effective_style es{};
+  const fm_status_t rc =
+      handle_ != nullptr ? fm_sheet_get_effective_style(handle_, ArgU32(info, 0), ArgU32(info, 1), ArgU32(info, 2), &es)
+                         : kBindingInvalidHandle;
+  if (rc != 0) {
+    es = fm_effective_style{};
+  }
+  const auto colorOf = [&env](uint32_t argb, int32_t resolution) {
+    Napi::Object c = Napi::Object::New(env);
+    c.Set("argb", Napi::Number::New(env, argb));
+    c.Set("resolution", Napi::Number::New(env, resolution));
+    return c;
+  };
+  static const char* const kSides[5] = {"left", "right", "top", "bottom", "diagonal"};
+  Napi::Object borders = Napi::Object::New(env);
+  for (size_t i = 0; i < 5; ++i) {
+    borders.Set(kSides[i], colorOf(es.border_argb[i], es.border_resolution[i]));
+  }
+  Napi::Object out = Napi::Object::New(env);
+  out.Set("status", MakeStatus(env, rc));
+  out.Set("xfIndex", Napi::Number::New(env, es.xf_index));
+  out.Set("source", Napi::Number::New(env, es.source));
+  out.Set("fontIndex", Napi::Number::New(env, es.font_index));
+  out.Set("fillIndex", Napi::Number::New(env, es.fill_index));
+  out.Set("borderIndex", Napi::Number::New(env, es.border_index));
+  out.Set("font", colorOf(es.font_argb, es.font_resolution));
+  out.Set("fillForeground", colorOf(es.fill_fg_argb, es.fill_fg_resolution));
+  out.Set("fillBackground", colorOf(es.fill_bg_argb, es.fill_bg_resolution));
+  out.Set("borders", borders);
+  out.Set("locked", Napi::Boolean::New(env, es.locked != 0));
+  out.Set("hidden", Napi::Boolean::New(env, es.hidden != 0));
+  out.Set("numFmtCode", Napi::String::New(env, es.num_fmt_code != nullptr ? es.num_fmt_code : ""));
+  return out;
 }
 
 }  // namespace formulon_node
diff --git a/src/node_addon/parts/trace_catalog.cc b/src/node_addon/parts/trace_catalog.cc
index fbfac8a49..8efa4934a 100644
--- a/src/node_addon/parts/trace_catalog.cc
+++ b/src/node_addon/parts/trace_catalog.cc
@@ -19,8 +19,12 @@ namespace {
 // objects, and frees the C-owned handle.
 using TraceFn = fm_status_t (*)(const fm_workbook_t*, uint32_t, uint32_t, uint32_t, uint32_t, fm_cell_nodes_t**);
 
-Napi::Array TraceToArray(Napi::Env env, const fm_workbook_t* handle, TraceFn fn, uint32_t sheet, uint32_t row,
-                         uint32_t col, uint32_t depth) {
+Napi::Array TraceToArray(const Napi::CallbackInfo& info, const fm_workbook_t* handle, TraceFn fn) {
+  Napi::Env env = info.Env();
+  const uint32_t sheet = Workbook::ArgU32(info, 0);
+  const uint32_t row = Workbook::ArgU32(info, 1);
+  const uint32_t col = Workbook::ArgU32(info, 2);
+  const uint32_t depth = Workbook::ArgU32(info, 3);
   Napi::Array arr = Napi::Array::New(env);
   if (handle == nullptr) {
     return FinishListResult(env, arr, kBindingInvalidHandle);
@@ -49,26 +53,27 @@ Napi::Array TraceToArray(Napi::Env env, const fm_workbook_t* handle, TraceFn fn,
   return FinishListResult(env, arr, rc);
 }
 
+// Shared bridge for `localizeFunctionName` / `canonicalizeFunctionName`.
+using FunctionNameMapFn = fm_status_t (*)(const char*, int32_t, const char**);
+
+Napi::Value MapFunctionName(const Napi::CallbackInfo& info, FunctionNameMapFn fn) {
+  const std::string name = Workbook::ArgString(info, 0);
+  const std::int32_t locale = info.Length() > 1 ? info[1].ToNumber().Int32Value() : 0;
+  const char* out = nullptr;
+  const fm_status_t rc = fn(name.c_str(), locale, &out);
+  return MakeStringResult(info.Env(), rc, out);
+}
+
 }  // namespace
 
 // ---- Trace precedents / dependents ----------------------------------
 
 Napi::Value Workbook::Precedents(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const uint32_t depth = ArgU32(info, 3);
-  return TraceToArray(env, handle_, fm_workbook_precedents, sheet, row, col, depth);
+  return TraceToArray(info, handle_, fm_workbook_precedents);
 }
 
 Napi::Value Workbook::Dependents(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  const uint32_t sheet = ArgU32(info, 0);
-  const uint32_t row = ArgU32(info, 1);
-  const uint32_t col = ArgU32(info, 2);
-  const uint32_t depth = ArgU32(info, 3);
-  return TraceToArray(env, handle_, fm_workbook_dependents, sheet, row, col, depth);
+  return TraceToArray(info, handle_, fm_workbook_dependents);
 }
 
 // ---- Dynamic-array spill info ---------------------------------------
@@ -185,21 +190,11 @@ Napi::Value Workbook::FunctionNames(const Napi::CallbackInfo& info) {
 }
 
 Napi::Value Workbook::LocalizeFunctionName(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  const std::string canonical = ArgString(info, 0);
-  const std::int32_t locale = info.Length() > 1 ? info[1].ToNumber().Int32Value() : 0;
-  const char* out = nullptr;
-  const fm_status_t rc = fm_function_localize(canonical.c_str(), locale, &out);
-  return MakeStringResult(env, rc, out);
+  return MapFunctionName(info, &fm_function_localize);
 }
 
 Napi::Value Workbook::CanonicalizeFunctionName(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  const std::string localized = ArgString(info, 0);
-  const std::int32_t locale = info.Length() > 1 ? info[1].ToNumber().Int32Value() : 0;
-  const char* out = nullptr;
-  const fm_status_t rc = fm_function_canonicalize(localized.c_str(), locale, &out);
-  return MakeStringResult(env, rc, out);
+  return MapFunctionName(info, &fm_function_canonicalize);
 }
 
 }  // namespace formulon_node
diff --git a/src/node_addon/parts/workbook_class.cc b/src/node_addon/parts/workbook_class.cc
index 7fbfaa355..adb1b0286 100644
--- a/src/node_addon/parts/workbook_class.cc
+++ b/src/node_addon/parts/workbook_class.cc
@@ -5,6 +5,10 @@
 
 #include "node_addon/parts/workbook_class.h"
 
+#include <cmath>
+#include <cstdint>
+#include <limits>
+
 namespace formulon_node {
 namespace {
 
@@ -12,6 +16,173 @@ struct WorkbookClassState {
   Napi::FunctionReference constructor;
 };
 
+// Positional arguments are checked by the registration wrapper before a
+// part-TU method gets to call a coercing N-API helper. The masks are indexed
+// by the JavaScript argument position; an unset bit means that position is
+// either an object/spec or is deliberately handled by the method itself.
+struct PositionalArgSpec {
+  std::uint64_t u32_mask;
+  std::uint64_t i32_mask;
+  std::uint64_t u64_mask;
+  std::uint64_t double_mask;
+  std::uint64_t string_mask;
+  std::uint64_t optional_u32_mask;
+  std::uint64_t optional_u64_mask;
+  std::uint64_t optional_null_mask;
+};
+
+// A uint64 argument arrives as a Number, which is exact only up to 2^53 - 1;
+// a larger value could not name the cursor the caller holds.
+constexpr double kMaxSafeInteger = 9007199254740991.0;
+
+bool RejectArgumentType(const Napi::CallbackInfo& info, std::size_t idx, const char* expected) {
+  Napi::TypeError::New(info.Env(), expected).ThrowAsJavaScriptException();
+  (void)idx;
+  return false;
+}
+
+bool RejectArgumentRange(const Napi::CallbackInfo& info, std::size_t idx, const char* expected) {
+  Napi::RangeError::New(info.Env(), expected).ThrowAsJavaScriptException();
+  (void)idx;
+  return false;
+}
+
+bool ValidatePositionalArgs(const Napi::CallbackInfo& info, const PositionalArgSpec& spec) {
+  const auto validate_number = [&](std::size_t idx, bool integral, bool nonnegative, double max_value,
+                                   const char* type_message, const char* range_message) {
+    if (idx >= info.Length()) {
+      return true;
+    }
+    const Napi::Value value = info[idx];
+    if (!value.IsNumber()) {
+      return RejectArgumentType(info, idx, type_message);
+    }
+    const double number = value.As<Napi::Number>().DoubleValue();
+    if (integral && (!std::isfinite(number) || std::trunc(number) != number)) {
+      return RejectArgumentRange(info, idx, range_message);
+    }
+    if (nonnegative && number < 0.0) {
+      return RejectArgumentRange(info, idx, range_message);
+    }
+    if (number > max_value) {
+      return RejectArgumentRange(info, idx, range_message);
+    }
+    return true;
+  };
+
+  const std::size_t positional_count = info.Length() < 64 ? info.Length() : 64;
+  for (std::size_t idx = 0; idx < positional_count; ++idx) {
+    const std::uint64_t bit = std::uint64_t{1} << idx;
+    if ((spec.u32_mask & bit) != 0 &&
+        !validate_number(idx, true, true, static_cast<double>(std::numeric_limits<std::uint32_t>::max()),
+                         "positional argument must be a number", "positional argument is outside uint32 range")) {
+      return false;
+    }
+    if ((spec.optional_u32_mask & bit) != 0 && idx < info.Length()) {
+      const Napi::Value value = info[idx];
+      if (value.IsNull() && (spec.optional_null_mask & bit) == 0) {
+        return RejectArgumentType(info, idx, "positional argument must be a number");
+      }
+      if (!value.IsUndefined() && !value.IsNull() &&
+          !validate_number(idx, true, true, static_cast<double>(std::numeric_limits<std::uint32_t>::max()),
+                           "positional argument must be a number", "positional argument is outside uint32 range")) {
+        return false;
+      }
+    }
+    if ((spec.i32_mask & bit) != 0) {
+      if (idx >= info.Length()) {
+        continue;
+      }
+      const Napi::Value value = info[idx];
+      if (!value.IsNumber()) {
+        return RejectArgumentType(info, idx, "positional argument must be a number");
+      }
+      const double number = value.As<Napi::Number>().DoubleValue();
+      if (!std::isfinite(number) || std::trunc(number) != number ||
+          number < static_cast<double>(std::numeric_limits<std::int32_t>::min()) ||
+          number > static_cast<double>(std::numeric_limits<std::int32_t>::max())) {
+        return RejectArgumentRange(info, idx, "positional argument is outside int32 range");
+      }
+    }
+    if ((spec.u64_mask & bit) != 0) {
+      if (idx >= info.Length()) {
+        continue;
+      }
+      const Napi::Value value = info[idx];
+      if (!value.IsNumber()) {
+        return RejectArgumentType(info, idx, "positional argument must be a number");
+      }
+      const double number = value.As<Napi::Number>().DoubleValue();
+      if (!std::isfinite(number) || std::trunc(number) != number || number < 0.0 || number > kMaxSafeInteger) {
+        return RejectArgumentRange(info, idx, "positional argument is outside the safe-integer range");
+      }
+    }
+    if ((spec.optional_u64_mask & bit) != 0 && idx < info.Length()) {
+      const Napi::Value value = info[idx];
+      if (value.IsNull() && (spec.optional_null_mask & bit) == 0) {
+        return RejectArgumentType(info, idx, "positional argument must be a number");
+      }
+      if (!value.IsUndefined() && !value.IsNull()) {
+        if (!value.IsNumber()) {
+          return RejectArgumentType(info, idx, "positional argument must be a number");
+        }
+        const double number = value.As<Napi::Number>().DoubleValue();
+        if (!std::isfinite(number) || std::trunc(number) != number || number < 0.0 || number > kMaxSafeInteger) {
+          return RejectArgumentRange(info, idx, "positional argument is outside the safe-integer range");
+        }
+      }
+    }
+    if ((spec.double_mask & bit) != 0 && idx < info.Length() && !info[idx].IsNumber()) {
+      return RejectArgumentType(info, idx, "positional argument must be a number");
+    }
+    if ((spec.string_mask & bit) != 0 && idx < info.Length() && !info[idx].IsString()) {
+      return RejectArgumentType(info, idx, "positional argument must be a string");
+    }
+  }
+  return true;
+}
+
+using InstanceMethodCallback = Napi::Value (Workbook::*)(const Napi::CallbackInfo&);
+
+template <InstanceMethodCallback method, std::uint64_t u32_mask, std::uint64_t i32_mask, std::uint64_t u64_mask,
+          std::uint64_t double_mask, std::uint64_t string_mask, std::uint64_t optional_u32_mask,
+          std::uint64_t optional_u64_mask, std::uint64_t optional_null_mask>
+struct GuardedMethodSpec {
+  static constexpr PositionalArgSpec value{u32_mask,    i32_mask,          u64_mask,          double_mask,
+                                           string_mask, optional_u32_mask, optional_u64_mask, optional_null_mask};
+};
+
+template <InstanceMethodCallback method, std::uint64_t u32_mask, std::uint64_t i32_mask, std::uint64_t u64_mask,
+          std::uint64_t double_mask, std::uint64_t string_mask, std::uint64_t optional_u32_mask,
+          std::uint64_t optional_u64_mask, std::uint64_t optional_null_mask>
+napi_value GuardedInstanceMethodCallback(napi_env raw_env, napi_callback_info raw_info) {
+  return Napi::details::WrapCallback(raw_env, [&] {
+    Napi::CallbackInfo info(raw_env, raw_info);
+    const auto* const spec = static_cast<const PositionalArgSpec*>(info.Data());
+    if (spec == nullptr || !ValidatePositionalArgs(info, *spec)) {
+      return info.Env().Undefined();
+    }
+    Workbook* const instance = Workbook::Unwrap(info.This().As<Napi::Object>());
+    return instance == nullptr ? Napi::Value() : (instance->*method)(info);
+  });
+}
+
+template <InstanceMethodCallback method, std::uint64_t u32_mask = 0, std::uint64_t i32_mask = 0,
+          std::uint64_t u64_mask = 0, std::uint64_t double_mask = 0, std::uint64_t string_mask = 0,
+          std::uint64_t optional_u32_mask = 0, std::uint64_t optional_u64_mask = 0,
+          std::uint64_t optional_null_mask = 0>
+Napi::ClassPropertyDescriptor<Workbook> GuardedInstanceMethod(const char* name) {
+  napi_property_descriptor descriptor{};
+  descriptor.utf8name = name;
+  descriptor.method = &GuardedInstanceMethodCallback<method, u32_mask, i32_mask, u64_mask, double_mask, string_mask,
+                                                     optional_u32_mask, optional_u64_mask, optional_null_mask>;
+  descriptor.data = const_cast<void*>(
+      static_cast<const void*>(&GuardedMethodSpec<method, u32_mask, i32_mask, u64_mask, double_mask, string_mask,
+                                                  optional_u32_mask, optional_u64_mask, optional_null_mask>::value));
+  descriptor.attributes = napi_default;
+  return descriptor;
+}
+
 }  // namespace
 
 Workbook::Workbook(const Napi::CallbackInfo& info) : Napi::ObjectWrap<Workbook>(info) {
@@ -66,6 +237,13 @@ uint32_t Workbook::ArgU32(const Napi::CallbackInfo& info, size_t idx) {
   return info[idx].ToNumber().Uint32Value();
 }
 
+int32_t Workbook::ArgI32(const Napi::CallbackInfo& info, size_t idx) {
+  if (idx >= info.Length()) {
+    return 0;
+  }
+  return info[idx].ToNumber().Int32Value();
+}
+
 double Workbook::ArgDouble(const Napi::CallbackInfo& info, size_t idx) {
   if (idx >= info.Length()) {
     return 0.0;
@@ -100,12 +278,12 @@ Napi::Value Workbook::InvokeRowColEdit(const Napi::CallbackInfo& info, RowColEdi
 
 // ---- Static factories -----------------------------------------------
 
-Napi::Value Workbook::CreateDefault(const Napi::CallbackInfo& info) {
+Napi::Value Workbook::CreateWith(const Napi::CallbackInfo& info, CreateFn create) {
   Napi::Env env = info.Env();
   Napi::Function ctor = GetClass(env);
   Napi::Object jsobj = ctor.New({});
   Workbook* wb = Napi::ObjectWrap<Workbook>::Unwrap(jsobj);
-  fm_status_t rc = fm_workbook_create(&wb->handle_);
+  fm_status_t rc = create(&wb->handle_);
   if (rc != 0) {
     // Even on failure return the wrapper; the caller can inspect
     // `lastErrorMessage()` and the next operation will fail with
@@ -116,17 +294,12 @@ Napi::Value Workbook::CreateDefault(const Napi::CallbackInfo& info) {
   return jsobj;
 }
 
+Napi::Value Workbook::CreateDefault(const Napi::CallbackInfo& info) {
+  return CreateWith(info, &fm_workbook_create);
+}
+
 Napi::Value Workbook::CreateEmpty(const Napi::CallbackInfo& info) {
-  Napi::Env env = info.Env();
-  Napi::Function ctor = GetClass(env);
-  Napi::Object jsobj = ctor.New({});
-  Workbook* wb = Napi::ObjectWrap<Workbook>::Unwrap(jsobj);
-  fm_status_t rc = fm_workbook_create_empty(&wb->handle_);
-  if (rc != 0) {
-    wb->handle_ = nullptr;
-  }
-  wb->SyncExternalMemory(env);
-  return jsobj;
+  return CreateWith(info, &fm_workbook_create_empty);
 }
 
 Napi::Value Workbook::LoadBytes(const Napi::CallbackInfo& info) {
@@ -168,238 +341,289 @@ Napi::Function Workbook::GetClass(Napi::Env env) {
     return state->constructor.Value();
   }
 
+  // clang-format off
   Napi::Function constructor = DefineClass(
       env, "Workbook",
       {
           StaticMethod<&Workbook::CreateDefault>("createDefault"),
           StaticMethod<&Workbook::CreateEmpty>("createEmpty"),
           StaticMethod<&Workbook::LoadBytes>("loadBytes"),
-          InstanceMethod<&Workbook::AddBorder>("addBorder"),
-          InstanceMethod<&Workbook::AddConditionalFormat>("addConditionalFormat"),
-          InstanceMethod<&Workbook::AddDxf>("addDxf"),
-          InstanceMethod<&Workbook::AddFill>("addFill"),
-          InstanceMethod<&Workbook::AddFont>("addFont"),
-          InstanceMethod<&Workbook::AddHyperlink>("addHyperlink"),
-          InstanceMethod<&Workbook::AddHyperlinkRange>("addHyperlinkRange"),
-          InstanceMethod<&Workbook::AddMerge>("addMerge"),
-          InstanceMethod<&Workbook::AddNumFmt>("addNumFmt"),
-          InstanceMethod<&Workbook::AddSheet>("addSheet"),
-          InstanceMethod<&Workbook::AddValidation>("addValidation"),
-          InstanceMethod<&Workbook::AddXf>("addXf"),
-          InstanceMethod<&Workbook::BorderCount>("borderCount"),
-          InstanceMethod<&Workbook::CalcMode>("calcMode"),
-          InstanceMethod<&Workbook::PinnedNow>("pinnedNow"),
-          InstanceMethod<&Workbook::ClearPinnedNow>("clearPinnedNow"),
-          InstanceMethod<&Workbook::CanonicalizeFunctionName>("canonicalizeFunctionName"),
-          InstanceMethod<&Workbook::CellAt>("cellAt"),
-          InstanceMethod<&Workbook::CellCount>("cellCount"),
-          InstanceMethod<&Workbook::CellStyleCount>("cellStyleCount"),
-          InstanceMethod<&Workbook::CellStyleXfCount>("cellStyleXfCount"),
-          InstanceMethod<&Workbook::ClearConditionalFormats>("clearConditionalFormats"),
-          InstanceMethod<&Workbook::ClearHyperlinks>("clearHyperlinks"),
-          InstanceMethod<&Workbook::ClearMerges>("clearMerges"),
-          InstanceMethod<&Workbook::ClearValidations>("clearValidations"),
-          InstanceMethod<&Workbook::DefinedNameAt>("definedNameAt"),
-          InstanceMethod<&Workbook::DefinedNameCount>("definedNameCount"),
-          InstanceMethod<&Workbook::DeleteCols>("deleteCols"),
-          InstanceMethod<&Workbook::DeleteRows>("deleteRows"),
-          InstanceMethod<&Workbook::Dependents>("dependents"),
-          InstanceMethod<&Workbook::Dispose>("dispose"),
-          InstanceMethod<&Workbook::DxfCount>("dxfCount"),
-          InstanceMethod<&Workbook::EvaluateCfRange>("evaluateCfRange"),
-          InstanceMethod<&Workbook::EvaluateConditionalFormula>("evaluateConditionalFormula"),
-          InstanceMethod<&Workbook::EvaluateFormulaArray>("evaluateFormulaArray"),
-          InstanceMethod<&Workbook::EvaluateFormulaText>("evaluateFormulaText"),
-          InstanceMethod<&Workbook::ExcelProfileId>("excelProfileId"),
-          InstanceMethod<&Workbook::FillCount>("fillCount"),
-          InstanceMethod<&Workbook::FontCount>("fontCount"),
-          InstanceMethod<&Workbook::FunctionMetadata>("functionMetadata"),
-          InstanceMethod<&Workbook::FunctionNames>("functionNames"),
-          InstanceMethod<&Workbook::GetBorder>("getBorder"),
-          InstanceMethod<&Workbook::GetCellStyle>("getCellStyle"),
-          InstanceMethod<&Workbook::GetCellStyleXf>("getCellStyleXf"),
-          InstanceMethod<&Workbook::GetCellXf>("getCellXf"),
-          InstanceMethod<&Workbook::GetCellXfIndex>("getCellXfIndex"),
-          InstanceMethod<&Workbook::GetCellPhonetic>("getCellPhonetic"),
-          InstanceMethod<&Workbook::GetCellPhoneticRuns>("getCellPhoneticRuns"),
-          InstanceMethod<&Workbook::GetCellPhoneticProperties>("getCellPhoneticProperties"),
-          InstanceMethod<&Workbook::GetComment>("getComment"),
-          InstanceMethod<&Workbook::GetCommentResult>("getCommentResult"),
-          InstanceMethod<&Workbook::GetComments>("getComments"),
-          InstanceMethod<&Workbook::GetConditionalFormats>("getConditionalFormats"),
-          InstanceMethod<&Workbook::GetDxf>("getDxf"),
-          InstanceMethod<&Workbook::GetExternalLinks>("getExternalLinks"),
-          InstanceMethod<&Workbook::GetFill>("getFill"),
-          InstanceMethod<&Workbook::GetFont>("getFont"),
-          InstanceMethod<&Workbook::GetHyperlinks>("getHyperlinks"),
-          InstanceMethod<&Workbook::GetIterative>("getIterative"),
-          InstanceMethod<&Workbook::GetLambdaText>("getLambdaText"),
-          InstanceMethod<&Workbook::GetMerges>("getMerges"),
-          InstanceMethod<&Workbook::GetNumFmt>("getNumFmt"),
-          InstanceMethod<&Workbook::GetSheetColumns>("getSheetColumns"),
-          InstanceMethod<&Workbook::GetSheetProtection>("getSheetProtection"),
-          InstanceMethod<&Workbook::GetSheetRowOverrides>("getSheetRowOverrides"),
-          InstanceMethod<&Workbook::GetSheetView>("getSheetView"),
-          InstanceMethod<&Workbook::GetValidations>("getValidations"),
-          InstanceMethod<&Workbook::GetValue>("getValue"),
-          InstanceMethod<&Workbook::InsertCols>("insertCols"),
-          InstanceMethod<&Workbook::InsertRows>("insertRows"),
-          InstanceMethod<&Workbook::IsValid>("isValid"),
-          InstanceMethod<&Workbook::LocalizeFunctionName>("localizeFunctionName"),
-          InstanceMethod<&Workbook::MemoryUsage>("memoryUsage"),
-          InstanceMethod<&Workbook::MoveSheet>("moveSheet"),
-          InstanceMethod<&Workbook::PartialRecalc>("partialRecalc"),
-          InstanceMethod<&Workbook::Paginate>("paginate"),
-          InstanceMethod<&Workbook::GetSheetPageSetupXml>("getSheetPageSetupXml"),
-          InstanceMethod<&Workbook::SetSheetPageSetupXml>("setSheetPageSetupXml"),
-          InstanceMethod<&Workbook::GetSheetPageMarginsXml>("getSheetPageMarginsXml"),
-          InstanceMethod<&Workbook::SetSheetPageMarginsXml>("setSheetPageMarginsXml"),
-          InstanceMethod<&Workbook::GetSheetPrintOptionsXml>("getSheetPrintOptionsXml"),
-          InstanceMethod<&Workbook::SetSheetPrintOptionsXml>("setSheetPrintOptionsXml"),
-          InstanceMethod<&Workbook::GetSheetHeaderFooterXml>("getSheetHeaderFooterXml"),
-          InstanceMethod<&Workbook::SetSheetHeaderFooterXml>("setSheetHeaderFooterXml"),
-          InstanceMethod<&Workbook::GetSheetSheetPrXml>("getSheetSheetPrXml"),
-          InstanceMethod<&Workbook::SetSheetSheetPrXml>("setSheetSheetPrXml"),
-          InstanceMethod<&Workbook::SetSheetFitToPage>("setSheetFitToPage"),
-          InstanceMethod<&Workbook::GetSheetPrintArea>("getSheetPrintArea"),
-          InstanceMethod<&Workbook::SetSheetPrintArea>("setSheetPrintArea"),
-          InstanceMethod<&Workbook::GetSheetPrintTitles>("getSheetPrintTitles"),
-          InstanceMethod<&Workbook::SetSheetPrintTitles>("setSheetPrintTitles"),
-          InstanceMethod<&Workbook::AddSheetRowBreak>("addSheetRowBreak"),
-          InstanceMethod<&Workbook::AddSheetColBreak>("addSheetColBreak"),
-          InstanceMethod<&Workbook::RemoveSheetRowBreak>("removeSheetRowBreak"),
-          InstanceMethod<&Workbook::RemoveSheetColBreak>("removeSheetColBreak"),
-          InstanceMethod<&Workbook::ClearSheetBreaks>("clearSheetBreaks"),
-          InstanceMethod<&Workbook::GetSheetRowBreaks>("getSheetRowBreaks"),
-          InstanceMethod<&Workbook::GetSheetColBreaks>("getSheetColBreaks"),
-          InstanceMethod<&Workbook::SetSheetPageSetup>("setSheetPageSetup"),
-          InstanceMethod<&Workbook::SetSheetPageMargins>("setSheetPageMargins"),
-          InstanceMethod<&Workbook::SetSheetPrintOptions>("setSheetPrintOptions"),
-          InstanceMethod<&Workbook::SetSheetHeaderFooter>("setSheetHeaderFooter"),
-          InstanceMethod<&Workbook::GetSheetPageSetup>("getSheetPageSetup"),
-          InstanceMethod<&Workbook::GetSheetPageMargins>("getSheetPageMargins"),
-          InstanceMethod<&Workbook::PassthroughAt>("passthroughAt"),
-          InstanceMethod<&Workbook::PassthroughCount>("passthroughCount"),
-          InstanceMethod<&Workbook::PivotCacheCount>("pivotCacheCount"),
-          InstanceMethod<&Workbook::PivotCacheCreate>("pivotCacheCreate"),
-          InstanceMethod<&Workbook::PivotCacheFieldAdd>("pivotCacheFieldAdd"),
-          InstanceMethod<&Workbook::PivotCacheFieldAddSharedItemBlank>("pivotCacheFieldAddSharedItemBlank"),
-          InstanceMethod<&Workbook::PivotCacheFieldAddSharedItemBool>("pivotCacheFieldAddSharedItemBool"),
-          InstanceMethod<&Workbook::PivotCacheFieldAddSharedItemError>("pivotCacheFieldAddSharedItemError"),
-          InstanceMethod<&Workbook::PivotCacheFieldAddSharedItemNumber>("pivotCacheFieldAddSharedItemNumber"),
-          InstanceMethod<&Workbook::PivotCacheFieldAddSharedItemText>("pivotCacheFieldAddSharedItemText"),
-          InstanceMethod<&Workbook::PivotCacheFieldClear>("pivotCacheFieldClear"),
-          InstanceMethod<&Workbook::PivotCacheFieldClearSharedItems>("pivotCacheFieldClearSharedItems"),
-          InstanceMethod<&Workbook::PivotCacheFieldCount>("pivotCacheFieldCount"),
-          InstanceMethod<&Workbook::PivotCacheFieldName>("pivotCacheFieldName"),
-          InstanceMethod<&Workbook::PivotCacheFieldSharedItemCount>("pivotCacheFieldSharedItemCount"),
-          InstanceMethod<&Workbook::PivotCacheGetWorksheetSource>("pivotCacheGetWorksheetSource"),
-          InstanceMethod<&Workbook::PivotCacheIdAt>("pivotCacheIdAt"),
-          InstanceMethod<&Workbook::PivotCacheRecordAdd>("pivotCacheRecordAdd"),
-          InstanceMethod<&Workbook::PivotCacheRecordClear>("pivotCacheRecordClear"),
-          InstanceMethod<&Workbook::PivotCacheRecordCount>("pivotCacheRecordCount"),
-          InstanceMethod<&Workbook::PivotCacheRecordSetBlank>("pivotCacheRecordSetBlank"),
-          InstanceMethod<&Workbook::PivotCacheRecordSetBool>("pivotCacheRecordSetBool"),
-          InstanceMethod<&Workbook::PivotCacheRecordSetError>("pivotCacheRecordSetError"),
-          InstanceMethod<&Workbook::PivotCacheRecordSetNumber>("pivotCacheRecordSetNumber"),
-          InstanceMethod<&Workbook::PivotCacheRecordSetText>("pivotCacheRecordSetText"),
-          InstanceMethod<&Workbook::PivotCacheRemove>("pivotCacheRemove"),
-          InstanceMethod<&Workbook::PivotCacheSetWorksheetSource>("pivotCacheSetWorksheetSource"),
-          InstanceMethod<&Workbook::PivotCount>("pivotCount"),
-          InstanceMethod<&Workbook::PivotCreate>("pivotCreate"),
-          InstanceMethod<&Workbook::PivotDataFieldAdd>("pivotDataFieldAdd"),
-          InstanceMethod<&Workbook::PivotDataFieldClear>("pivotDataFieldClear"),
-          InstanceMethod<&Workbook::PivotDataFieldCount>("pivotDataFieldCount"),
-          InstanceMethod<&Workbook::PivotDataFieldSet>("pivotDataFieldSet"),
-          InstanceMethod<&Workbook::PivotFieldAdd>("pivotFieldAdd"),
-          InstanceMethod<&Workbook::PivotFieldAddItem>("pivotFieldAddItem"),
-          InstanceMethod<&Workbook::PivotFieldAddItemAt>("pivotFieldAddItemAt"),
-          InstanceMethod<&Workbook::PivotFieldAddSubtotalFn>("pivotFieldAddSubtotalFn"),
-          InstanceMethod<&Workbook::PivotFieldClear>("pivotFieldClear"),
-          InstanceMethod<&Workbook::PivotFieldClearDateGroup>("pivotFieldClearDateGroup"),
-          InstanceMethod<&Workbook::PivotFieldClearItems>("pivotFieldClearItems"),
-          InstanceMethod<&Workbook::PivotFieldClearSubtotalFns>("pivotFieldClearSubtotalFns"),
-          InstanceMethod<&Workbook::PivotFieldCount>("pivotFieldCount"),
-          InstanceMethod<&Workbook::PivotFieldSetAxis>("pivotFieldSetAxis"),
-          InstanceMethod<&Workbook::PivotFieldSetDateGroup>("pivotFieldSetDateGroup"),
-          InstanceMethod<&Workbook::PivotFieldSetItemVisible>("pivotFieldSetItemVisible"),
-          InstanceMethod<&Workbook::PivotFieldSetNumberFormat>("pivotFieldSetNumberFormat"),
-          InstanceMethod<&Workbook::PivotFieldSetSort>("pivotFieldSetSort"),
-          InstanceMethod<&Workbook::PivotFieldSetSubtotalTop>("pivotFieldSetSubtotalTop"),
-          InstanceMethod<&Workbook::PivotFilterAdd>("pivotFilterAdd"),
-          InstanceMethod<&Workbook::PivotFilterAt>("pivotFilterAt"),
-          InstanceMethod<&Workbook::PivotFilterClear>("pivotFilterClear"),
-          InstanceMethod<&Workbook::PivotFilterCount>("pivotFilterCount"),
-          InstanceMethod<&Workbook::PivotFilterRemoveAt>("pivotFilterRemoveAt"),
-          InstanceMethod<&Workbook::PivotLayout>("pivotLayout"),
-          InstanceMethod<&Workbook::PivotRemove>("pivotRemove"),
-          InstanceMethod<&Workbook::PivotSetAnchor>("pivotSetAnchor"),
-          InstanceMethod<&Workbook::PivotSetColFieldOrder>("pivotSetColFieldOrder"),
-          InstanceMethod<&Workbook::PivotSetGrandTotals>("pivotSetGrandTotals"),
-          InstanceMethod<&Workbook::PivotGetLayout>("pivotGetLayout"),
-          InstanceMethod<&Workbook::PivotSetLayout>("pivotSetLayout"),
-          InstanceMethod<&Workbook::PivotSetName>("pivotSetName"),
-          InstanceMethod<&Workbook::PivotSetRowFieldOrder>("pivotSetRowFieldOrder"),
-          InstanceMethod<&Workbook::Precedents>("precedents"),
-          InstanceMethod<&Workbook::Recalc>("recalc"),
-          InstanceMethod<&Workbook::RecalcParallel>("recalcParallel"),
-          InstanceMethod<&Workbook::RemoveConditionalFormatAt>("removeConditionalFormatAt"),
-          InstanceMethod<&Workbook::RemoveHyperlink>("removeHyperlink"),
-          InstanceMethod<&Workbook::RemoveHyperlinkAt>("removeHyperlinkAt"),
-          InstanceMethod<&Workbook::RemoveMerge>("removeMerge"),
-          InstanceMethod<&Workbook::RemoveMergeAt>("removeMergeAt"),
-          InstanceMethod<&Workbook::RemoveSheet>("removeSheet"),
-          InstanceMethod<&Workbook::RemoveValidationAt>("removeValidationAt"),
-          InstanceMethod<&Workbook::RenameSheet>("renameSheet"),
-          InstanceMethod<&Workbook::Save>("save"),
-          InstanceMethod<&Workbook::SaveAs>("saveAs"),
-          InstanceMethod<&Workbook::SaveWithDiagnostics>("saveWithDiagnostics"),
-          InstanceMethod<&Workbook::ReadDiagnostics>("readDiagnostics"),
-          InstanceMethod<&Workbook::SetBlank>("setBlank"),
-          InstanceMethod<&Workbook::SetBool>("setBool"),
-          InstanceMethod<&Workbook::SetCalcMode>("setCalcMode"),
-          InstanceMethod<&Workbook::SetPinnedNow>("setPinnedNow"),
-          InstanceMethod<&Workbook::SetCellXfIndex>("setCellXfIndex"),
-          InstanceMethod<&Workbook::SetCellPhonetic>("setCellPhonetic"),
-          InstanceMethod<&Workbook::SetCellPhoneticRuns>("setCellPhoneticRuns"),
-          InstanceMethod<&Workbook::SetCellPhoneticProperties>("setCellPhoneticProperties"),
-          InstanceMethod<&Workbook::SetRangeXfIndex>("setRangeXfIndex"),
-          InstanceMethod<&Workbook::SetColumnHidden>("setColumnHidden"),
-          InstanceMethod<&Workbook::SetColumnOutline>("setColumnOutline"),
-          InstanceMethod<&Workbook::SetColumnWidth>("setColumnWidth"),
-          InstanceMethod<&Workbook::SetComment>("setComment"),
-          InstanceMethod<&Workbook::SetDefinedName>("setDefinedName"),
-          InstanceMethod<&Workbook::SetDefinedNameScoped>("setDefinedNameScoped"),
-          InstanceMethod<&Workbook::SetDefaultFont>("setDefaultFont"),
-          InstanceMethod<&Workbook::SetFont>("setFont"),
-          InstanceMethod<&Workbook::SetError>("setError"),
-          InstanceMethod<&Workbook::SetExcelProfileId>("setExcelProfileId"),
-          InstanceMethod<&Workbook::SetFormula>("setFormula"),
-          InstanceMethod<&Workbook::SetIterative>("setIterative"),
-          InstanceMethod<&Workbook::SetIterativeProgress>("setIterativeProgress"),
-          InstanceMethod<&Workbook::SetNumber>("setNumber"),
-          InstanceMethod<&Workbook::SetRowHeight>("setRowHeight"),
-          InstanceMethod<&Workbook::SetRowHidden>("setRowHidden"),
-          InstanceMethod<&Workbook::SetRowOutline>("setRowOutline"),
-          InstanceMethod<&Workbook::SetSheetFreeze>("setSheetFreeze"),
-          InstanceMethod<&Workbook::SetSheetProtection>("setSheetProtection"),
-          InstanceMethod<&Workbook::SetSheetRightToLeft>("setSheetRightToLeft"),
-          InstanceMethod<&Workbook::SetSheetShowGridLines>("setSheetShowGridLines"),
-          InstanceMethod<&Workbook::SetSheetShowRowColHeaders>("setSheetShowRowColHeaders"),
-          InstanceMethod<&Workbook::SetSheetShowZeros>("setSheetShowZeros"),
-          InstanceMethod<&Workbook::SetSheetTabHidden>("setSheetTabHidden"),
-          InstanceMethod<&Workbook::SetSheetTabSelected>("setSheetTabSelected"),
-          InstanceMethod<&Workbook::SetSheetViewMode>("setSheetViewMode"),
-          InstanceMethod<&Workbook::SetSheetVisibility>("setSheetVisibility"),
-          InstanceMethod<&Workbook::SetSheetZoom>("setSheetZoom"),
-          InstanceMethod<&Workbook::SetText>("setText"),
-          InstanceMethod<&Workbook::SheetCount>("sheetCount"),
-          InstanceMethod<&Workbook::SheetName>("sheetName"),
-          InstanceMethod<&Workbook::SpillInfo>("spillInfo"),
-          InstanceMethod<&Workbook::TableAt>("tableAt"),
-          InstanceMethod<&Workbook::TableCount>("tableCount"),
-          InstanceMethod<&Workbook::XfCount>("xfCount"),
+          GuardedInstanceMethod<&Workbook::AddBorder>("addBorder"),
+          GuardedInstanceMethod<&Workbook::AddConditionalFormat, 0x1ULL>("addConditionalFormat"),
+          GuardedInstanceMethod<&Workbook::AddDxf>("addDxf"),
+          GuardedInstanceMethod<&Workbook::AddFill>("addFill"),
+          GuardedInstanceMethod<&Workbook::AddFont>("addFont"),
+          GuardedInstanceMethod<&Workbook::AddHyperlink, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x78ULL>("addHyperlink"),
+          GuardedInstanceMethod<&Workbook::AddHyperlinkRange, 0x1FULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x1E0ULL>("addHyperlinkRange"),
+          GuardedInstanceMethod<&Workbook::AddMerge, 0x1ULL>("addMerge"),
+          GuardedInstanceMethod<&Workbook::AddNumFmt, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x1ULL>("addNumFmt"),
+          GuardedInstanceMethod<&Workbook::AddSheet, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x1ULL>("addSheet"),
+          GuardedInstanceMethod<&Workbook::AddValidation, 0x1ULL>("addValidation"),
+          GuardedInstanceMethod<&Workbook::AddPerson>("addPerson"),
+          GuardedInstanceMethod<&Workbook::AddThreadedComment, 0x1ULL>("addThreadedComment"),
+          GuardedInstanceMethod<&Workbook::ApplyAutoFilter, 0x1ULL>("applyAutoFilter"),
+          GuardedInstanceMethod<&Workbook::ApplyTableAutoFilter, 0x1ULL>("applyTableAutoFilter"),
+          GuardedInstanceMethod<&Workbook::ClearAutoFilter, 0x1ULL>("clearAutoFilter"),
+          GuardedInstanceMethod<&Workbook::ClearTableAutoFilter, 0x1ULL>("clearTableAutoFilter"),
+          GuardedInstanceMethod<&Workbook::EditThreadedComment, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x6ULL>("editThreadedComment"),
+          GuardedInstanceMethod<&Workbook::EvaluateAutoFilter, 0x1ULL>("evaluateAutoFilter"),
+          GuardedInstanceMethod<&Workbook::EvaluateTableAutoFilter, 0x1ULL>("evaluateTableAutoFilter"),
+          GuardedInstanceMethod<&Workbook::GetAutoFilter, 0x1ULL>("getAutoFilter"),
+          GuardedInstanceMethod<&Workbook::GetPersons>("getPersons"),
+          GuardedInstanceMethod<&Workbook::GetTableAutoFilter, 0x1ULL>("getTableAutoFilter"),
+          GuardedInstanceMethod<&Workbook::GetThreadedComments, 0x1ULL>("getThreadedComments"),
+          GuardedInstanceMethod<&Workbook::ListInvalidCells, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x4ULL, 0x2ULL, 0x6ULL>("listInvalidCells"),
+          GuardedInstanceMethod<&Workbook::RemoveAutoFilter, 0x1ULL>("removeAutoFilter"),
+          GuardedInstanceMethod<&Workbook::RemovePerson, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x1ULL>("removePerson"),
+          GuardedInstanceMethod<&Workbook::RemoveTableAutoFilter, 0x1ULL>("removeTableAutoFilter"),
+          GuardedInstanceMethod<&Workbook::RemoveThreadedComment, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("removeThreadedComment"),
+          GuardedInstanceMethod<&Workbook::SetAutoFilter, 0x1ULL>("setAutoFilter"),
+          GuardedInstanceMethod<&Workbook::SetTableAutoFilter, 0x1ULL>("setTableAutoFilter"),
+          GuardedInstanceMethod<&Workbook::SetThreadResolved, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("setThreadResolved"),
+          GuardedInstanceMethod<&Workbook::ValidateValue, 0x7ULL>("validateValue"),
+          GuardedInstanceMethod<&Workbook::ProbeImage>("probeImage"),
+          GuardedInstanceMethod<&Workbook::ListDrawingObjects, 0x1ULL>("listDrawingObjects"),
+          GuardedInstanceMethod<&Workbook::GetImage, 0x3ULL>("getImage"),
+          GuardedInstanceMethod<&Workbook::InsertImage, 0x1ULL>("insertImage"),
+          GuardedInstanceMethod<&Workbook::RemoveImage, 0x3ULL>("removeImage"),
+          GuardedInstanceMethod<&Workbook::AddXf>("addXf"),
+          GuardedInstanceMethod<&Workbook::BorderCount>("borderCount"),
+          GuardedInstanceMethod<&Workbook::CalcMode>("calcMode"),
+          GuardedInstanceMethod<&Workbook::ClearRowHeight, 0x3ULL>("clearRowHeight"),
+          GuardedInstanceMethod<&Workbook::ColumnCharsToPt, 0x1ULL, 0x2ULL, 0x0ULL, 0x4ULL>("columnCharsToPt"),
+          GuardedInstanceMethod<&Workbook::ColumnPtToChars, 0x1ULL, 0x2ULL, 0x0ULL, 0x4ULL>("columnPtToChars"),
+          GuardedInstanceMethod<&Workbook::FormatValue, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("formatValue"),
+          GuardedInstanceMethod<&Workbook::GetCellRectPt, 0x1ULL, 0x4ULL>("getCellRectPt"),
+          GuardedInstanceMethod<&Workbook::GetCellsInRange, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL, 0x4ULL, 0xCULL>("getCellsInRange"),
+          GuardedInstanceMethod<&Workbook::GetColumnWidthPt, 0x3ULL, 0x4ULL>("getColumnWidthPt"),
+          GuardedInstanceMethod<&Workbook::GetDisplayText, 0x7ULL>("getDisplayText"),
+          GuardedInstanceMethod<&Workbook::GetFormula, 0x7ULL>("getFormula"),
+          GuardedInstanceMethod<&Workbook::GetFormulaR1C1, 0x7ULL>("getFormulaR1C1"),
+          GuardedInstanceMethod<&Workbook::GetMergesInRange, 0x1ULL>("getMergesInRange"),
+          GuardedInstanceMethod<&Workbook::GetRowHeightPt, 0x3ULL>("getRowHeightPt"),
+          GuardedInstanceMethod<&Workbook::GetSheetFormatDefaults, 0x1ULL>("getSheetFormatDefaults"),
+          GuardedInstanceMethod<&Workbook::GetWidthModel, 0x1ULL, 0x2ULL>("getWidthModel"),
+          GuardedInstanceMethod<&Workbook::PinnedNow>("pinnedNow"),
+          GuardedInstanceMethod<&Workbook::ClearPinnedNow>("clearPinnedNow"),
+          GuardedInstanceMethod<&Workbook::CanonicalizeFunctionName, 0x0ULL, 0x2ULL, 0x0ULL, 0x0ULL, 0x1ULL>("canonicalizeFunctionName"),
+          GuardedInstanceMethod<&Workbook::CellAt, 0x3ULL>("cellAt"),
+          GuardedInstanceMethod<&Workbook::CellCount, 0x1ULL>("cellCount"),
+          GuardedInstanceMethod<&Workbook::CellStyleCount>("cellStyleCount"),
+          GuardedInstanceMethod<&Workbook::CellStyleXfCount>("cellStyleXfCount"),
+          GuardedInstanceMethod<&Workbook::ClearConditionalFormats, 0x1ULL>("clearConditionalFormats"),
+          GuardedInstanceMethod<&Workbook::ClearHyperlinks, 0x1ULL>("clearHyperlinks"),
+          GuardedInstanceMethod<&Workbook::ClearMerges, 0x1ULL>("clearMerges"),
+          GuardedInstanceMethod<&Workbook::ClearValidations, 0x1ULL>("clearValidations"),
+          GuardedInstanceMethod<&Workbook::DefinedNameAt, 0x1ULL>("definedNameAt"),
+          GuardedInstanceMethod<&Workbook::DefinedNameCount>("definedNameCount"),
+          GuardedInstanceMethod<&Workbook::DeleteCols, 0x7ULL>("deleteCols"),
+          GuardedInstanceMethod<&Workbook::DeleteRows, 0x7ULL>("deleteRows"),
+          GuardedInstanceMethod<&Workbook::Dependents, 0xFULL>("dependents"),
+          GuardedInstanceMethod<&Workbook::Dispose>("dispose"),
+          GuardedInstanceMethod<&Workbook::DxfCount>("dxfCount"),
+          GuardedInstanceMethod<&Workbook::EvaluateCfRange, 0x1FULL, 0x0ULL, 0x0ULL, 0x20ULL>("evaluateCfRange"),
+          GuardedInstanceMethod<&Workbook::EvaluateConditionalFormula, 0x1FULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x20ULL>("evaluateConditionalFormula"),
+          GuardedInstanceMethod<&Workbook::EvaluateFormulaArray, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL>("evaluateFormulaArray"),
+          GuardedInstanceMethod<&Workbook::EvaluateFormulaText, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL>("evaluateFormulaText"),
+          GuardedInstanceMethod<&Workbook::ExcelProfileId>("excelProfileId"),
+          GuardedInstanceMethod<&Workbook::FillCount>("fillCount"),
+          GuardedInstanceMethod<&Workbook::FontCount>("fontCount"),
+          GuardedInstanceMethod<&Workbook::FunctionMetadata, 0x0ULL, 0x2ULL, 0x0ULL, 0x0ULL, 0x1ULL>("functionMetadata"),
+          GuardedInstanceMethod<&Workbook::FunctionNames>("functionNames"),
+          GuardedInstanceMethod<&Workbook::GetBorder, 0x1ULL>("getBorder"),
+          GuardedInstanceMethod<&Workbook::GetCellStyle, 0x1ULL>("getCellStyle"),
+          GuardedInstanceMethod<&Workbook::GetCellStyleXf, 0x1ULL>("getCellStyleXf"),
+          GuardedInstanceMethod<&Workbook::GetEffectiveStyle, 0x7ULL>("getEffectiveStyle"),
+          GuardedInstanceMethod<&Workbook::GetTheme>("getTheme"),
+          GuardedInstanceMethod<&Workbook::RemoveCellStyle, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x1ULL>("removeCellStyle"),
+          GuardedInstanceMethod<&Workbook::ResolveColor, 0x0ULL, 0x2ULL>("resolveColor"),
+          GuardedInstanceMethod<&Workbook::SetCellStyle>("setCellStyle"),
+          GuardedInstanceMethod<&Workbook::SetThemeColors>("setThemeColors"),
+          GuardedInstanceMethod<&Workbook::SetThemeFonts>("setThemeFonts"),
+          GuardedInstanceMethod<&Workbook::GetCellXf, 0x1ULL>("getCellXf"),
+          GuardedInstanceMethod<&Workbook::GetCellXfIndex, 0x7ULL>("getCellXfIndex"),
+          GuardedInstanceMethod<&Workbook::GetCellPhonetic, 0x7ULL>("getCellPhonetic"),
+          GuardedInstanceMethod<&Workbook::GetCellPhoneticRuns, 0x7ULL>("getCellPhoneticRuns"),
+          GuardedInstanceMethod<&Workbook::GetCellPhoneticProperties, 0x7ULL>("getCellPhoneticProperties"),
+          GuardedInstanceMethod<&Workbook::GetComment, 0x7ULL>("getComment"),
+          GuardedInstanceMethod<&Workbook::GetCommentResult, 0x7ULL>("getCommentResult"),
+          GuardedInstanceMethod<&Workbook::GetComments, 0x1ULL>("getComments"),
+          GuardedInstanceMethod<&Workbook::GetConditionalFormats, 0x1ULL>("getConditionalFormats"),
+          GuardedInstanceMethod<&Workbook::GetDxf, 0x1ULL>("getDxf"),
+          GuardedInstanceMethod<&Workbook::GetExternalLinks>("getExternalLinks"),
+          GuardedInstanceMethod<&Workbook::GetFill, 0x1ULL>("getFill"),
+          GuardedInstanceMethod<&Workbook::GetFont, 0x1ULL>("getFont"),
+          GuardedInstanceMethod<&Workbook::GetHyperlinks, 0x1ULL>("getHyperlinks"),
+          GuardedInstanceMethod<&Workbook::GetIterative>("getIterative"),
+          GuardedInstanceMethod<&Workbook::GetLambdaText, 0x7ULL>("getLambdaText"),
+          GuardedInstanceMethod<&Workbook::GetMerges, 0x1ULL>("getMerges"),
+          GuardedInstanceMethod<&Workbook::GetNumFmt, 0x1ULL>("getNumFmt"),
+          GuardedInstanceMethod<&Workbook::GetSheetColumns, 0x1ULL>("getSheetColumns"),
+          GuardedInstanceMethod<&Workbook::GetSheetProtection, 0x1ULL>("getSheetProtection"),
+          GuardedInstanceMethod<&Workbook::GetSheetRowOverrides, 0x1ULL>("getSheetRowOverrides"),
+          GuardedInstanceMethod<&Workbook::GetSheetView, 0x1ULL>("getSheetView"),
+          GuardedInstanceMethod<&Workbook::GetValidations, 0x1ULL>("getValidations"),
+          GuardedInstanceMethod<&Workbook::GetValue, 0x7ULL>("getValue"),
+          GuardedInstanceMethod<&Workbook::InsertCols, 0x7ULL>("insertCols"),
+          GuardedInstanceMethod<&Workbook::InsertRows, 0x7ULL>("insertRows"),
+          GuardedInstanceMethod<&Workbook::IsValid>("isValid"),
+          GuardedInstanceMethod<&Workbook::LocalizeFunctionName, 0x0ULL, 0x2ULL, 0x0ULL, 0x0ULL, 0x1ULL>("localizeFunctionName"),
+          GuardedInstanceMethod<&Workbook::MemoryUsage>("memoryUsage"),
+          GuardedInstanceMethod<&Workbook::MoveSheet, 0x3ULL>("moveSheet"),
+          GuardedInstanceMethod<&Workbook::PartialRecalc>("partialRecalc"),
+          GuardedInstanceMethod<&Workbook::Paginate, 0x1ULL>("paginate"),
+          GuardedInstanceMethod<&Workbook::GetSheetPageSetupXml, 0x1ULL>("getSheetPageSetupXml"),
+          GuardedInstanceMethod<&Workbook::SetSheetFormatDefaults, 0x1ULL>("setSheetFormatDefaults"),
+          GuardedInstanceMethod<&Workbook::SetSheetPageSetupXml, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("setSheetPageSetupXml"),
+          GuardedInstanceMethod<&Workbook::GetSheetPageMarginsXml, 0x1ULL>("getSheetPageMarginsXml"),
+          GuardedInstanceMethod<&Workbook::SetSheetPageMarginsXml, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("setSheetPageMarginsXml"),
+          GuardedInstanceMethod<&Workbook::GetSheetPrintOptionsXml, 0x1ULL>("getSheetPrintOptionsXml"),
+          GuardedInstanceMethod<&Workbook::SetSheetPrintOptionsXml, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("setSheetPrintOptionsXml"),
+          GuardedInstanceMethod<&Workbook::GetSheetHeaderFooterXml, 0x1ULL>("getSheetHeaderFooterXml"),
+          GuardedInstanceMethod<&Workbook::SetSheetHeaderFooterXml, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("setSheetHeaderFooterXml"),
+          GuardedInstanceMethod<&Workbook::GetSheetSheetPrXml, 0x1ULL>("getSheetSheetPrXml"),
+          GuardedInstanceMethod<&Workbook::SetSheetSheetPrXml, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("setSheetSheetPrXml"),
+          GuardedInstanceMethod<&Workbook::SetSheetFitToPage, 0x1ULL>("setSheetFitToPage"),
+          GuardedInstanceMethod<&Workbook::GetSheetPrintArea, 0x1ULL>("getSheetPrintArea"),
+          GuardedInstanceMethod<&Workbook::SetSheetPrintArea, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("setSheetPrintArea"),
+          GuardedInstanceMethod<&Workbook::GetSheetPrintTitles, 0x1ULL>("getSheetPrintTitles"),
+          GuardedInstanceMethod<&Workbook::SetSheetPrintTitles, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x6ULL>("setSheetPrintTitles"),
+          GuardedInstanceMethod<&Workbook::AddSheetRowBreak, 0x3ULL>("addSheetRowBreak"),
+          GuardedInstanceMethod<&Workbook::AddSheetColBreak, 0x3ULL>("addSheetColBreak"),
+          GuardedInstanceMethod<&Workbook::RemoveSheetRowBreak, 0x3ULL>("removeSheetRowBreak"),
+          GuardedInstanceMethod<&Workbook::RemoveSheetColBreak, 0x3ULL>("removeSheetColBreak"),
+          GuardedInstanceMethod<&Workbook::ClearSheetBreaks, 0x1ULL>("clearSheetBreaks"),
+          GuardedInstanceMethod<&Workbook::GetSheetRowBreaks, 0x1ULL>("getSheetRowBreaks"),
+          GuardedInstanceMethod<&Workbook::GetSheetColBreaks, 0x1ULL>("getSheetColBreaks"),
+          GuardedInstanceMethod<&Workbook::SetSheetPageSetup, 0x1ULL>("setSheetPageSetup"),
+          GuardedInstanceMethod<&Workbook::SetSheetPageMargins, 0x1ULL>("setSheetPageMargins"),
+          GuardedInstanceMethod<&Workbook::SetSheetPrintOptions, 0x1ULL>("setSheetPrintOptions"),
+          GuardedInstanceMethod<&Workbook::SetSheetHeaderFooter, 0x1ULL>("setSheetHeaderFooter"),
+          GuardedInstanceMethod<&Workbook::GetSheetPageSetup, 0x1ULL>("getSheetPageSetup"),
+          GuardedInstanceMethod<&Workbook::GetSheetPageMargins, 0x1ULL>("getSheetPageMargins"),
+          GuardedInstanceMethod<&Workbook::PassthroughAt, 0x1ULL>("passthroughAt"),
+          GuardedInstanceMethod<&Workbook::PassthroughCount>("passthroughCount"),
+          GuardedInstanceMethod<&Workbook::PivotCacheCount>("pivotCacheCount"),
+          GuardedInstanceMethod<&Workbook::PivotCacheCreate, 0x1ULL>("pivotCacheCreate"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldAdd, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("pivotCacheFieldAdd"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldAddSharedItemBlank, 0x3ULL>("pivotCacheFieldAddSharedItemBlank"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldAddSharedItemBool, 0x3ULL>("pivotCacheFieldAddSharedItemBool"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldAddSharedItemError, 0x3ULL, 0x4ULL>("pivotCacheFieldAddSharedItemError"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldAddSharedItemNumber, 0x3ULL, 0x0ULL, 0x0ULL, 0x4ULL>("pivotCacheFieldAddSharedItemNumber"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldAddSharedItemText, 0x3ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x4ULL>("pivotCacheFieldAddSharedItemText"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldClear, 0x1ULL>("pivotCacheFieldClear"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldClearSharedItems, 0x3ULL>("pivotCacheFieldClearSharedItems"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldCount, 0x1ULL>("pivotCacheFieldCount"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldName, 0x3ULL>("pivotCacheFieldName"),
+          GuardedInstanceMethod<&Workbook::PivotCacheFieldSharedItemCount, 0x3ULL>("pivotCacheFieldSharedItemCount"),
+          GuardedInstanceMethod<&Workbook::PivotCacheGetWorksheetSource, 0x1ULL>("pivotCacheGetWorksheetSource"),
+          GuardedInstanceMethod<&Workbook::PivotCacheIdAt, 0x1ULL>("pivotCacheIdAt"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRecordAdd, 0x1ULL>("pivotCacheRecordAdd"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRecordClear, 0x1ULL>("pivotCacheRecordClear"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRecordCount, 0x1ULL>("pivotCacheRecordCount"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRecordSetBlank, 0x7ULL>("pivotCacheRecordSetBlank"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRecordSetBool, 0x7ULL>("pivotCacheRecordSetBool"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRecordSetError, 0x7ULL, 0x8ULL>("pivotCacheRecordSetError"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRecordSetNumber, 0x7ULL, 0x0ULL, 0x0ULL, 0x8ULL>("pivotCacheRecordSetNumber"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRecordSetText, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL>("pivotCacheRecordSetText"),
+          GuardedInstanceMethod<&Workbook::PivotCacheRemove, 0x1ULL>("pivotCacheRemove"),
+          GuardedInstanceMethod<&Workbook::PivotCacheSetWorksheetSource, 0x1ULL>("pivotCacheSetWorksheetSource"),
+          GuardedInstanceMethod<&Workbook::PivotCount, 0x1ULL>("pivotCount"),
+          GuardedInstanceMethod<&Workbook::PivotCreate, 0x1DULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("pivotCreate"),
+          GuardedInstanceMethod<&Workbook::PivotDataFieldAdd, 0x3ULL>("pivotDataFieldAdd"),
+          GuardedInstanceMethod<&Workbook::PivotDataFieldClear, 0x3ULL>("pivotDataFieldClear"),
+          GuardedInstanceMethod<&Workbook::PivotDataFieldCount, 0x3ULL>("pivotDataFieldCount"),
+          GuardedInstanceMethod<&Workbook::PivotDataFieldSet, 0x7ULL>("pivotDataFieldSet"),
+          GuardedInstanceMethod<&Workbook::PivotFieldAdd, 0x3ULL>("pivotFieldAdd"),
+          GuardedInstanceMethod<&Workbook::PivotFieldAddItem, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL>("pivotFieldAddItem"),
+          GuardedInstanceMethod<&Workbook::PivotFieldAddItemAt, 0xFULL>("pivotFieldAddItemAt"),
+          GuardedInstanceMethod<&Workbook::PivotFieldAddSubtotalFn, 0x7ULL, 0x8ULL>("pivotFieldAddSubtotalFn"),
+          GuardedInstanceMethod<&Workbook::PivotFieldClear, 0x3ULL>("pivotFieldClear"),
+          GuardedInstanceMethod<&Workbook::PivotFieldClearDateGroup, 0x7ULL>("pivotFieldClearDateGroup"),
+          GuardedInstanceMethod<&Workbook::PivotFieldClearItems, 0x7ULL>("pivotFieldClearItems"),
+          GuardedInstanceMethod<&Workbook::PivotFieldClearSubtotalFns, 0x7ULL>("pivotFieldClearSubtotalFns"),
+          GuardedInstanceMethod<&Workbook::PivotFieldCount, 0x3ULL>("pivotFieldCount"),
+          GuardedInstanceMethod<&Workbook::PivotFieldSetAxis, 0x7ULL, 0x8ULL>("pivotFieldSetAxis"),
+          GuardedInstanceMethod<&Workbook::PivotFieldSetDateGroup, 0x87ULL, 0x78ULL, 0x0ULL, 0x300ULL>("pivotFieldSetDateGroup"),
+          GuardedInstanceMethod<&Workbook::PivotFieldSetItemVisible, 0xFULL>("pivotFieldSetItemVisible"),
+          GuardedInstanceMethod<&Workbook::PivotFieldSetNumberFormat, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL>("pivotFieldSetNumberFormat"),
+          GuardedInstanceMethod<&Workbook::PivotFieldSetSort, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x10ULL>("pivotFieldSetSort"),
+          GuardedInstanceMethod<&Workbook::PivotFieldSetSubtotalTop, 0x7ULL>("pivotFieldSetSubtotalTop"),
+          GuardedInstanceMethod<&Workbook::PivotFilterAdd, 0x3ULL>("pivotFilterAdd"),
+          GuardedInstanceMethod<&Workbook::PivotFilterAt, 0x7ULL>("pivotFilterAt"),
+          GuardedInstanceMethod<&Workbook::PivotFilterClear, 0x3ULL>("pivotFilterClear"),
+          GuardedInstanceMethod<&Workbook::PivotFilterCount, 0x3ULL>("pivotFilterCount"),
+          GuardedInstanceMethod<&Workbook::PivotFilterRemoveAt, 0x7ULL>("pivotFilterRemoveAt"),
+          GuardedInstanceMethod<&Workbook::PivotLayout, 0x3ULL>("pivotLayout"),
+          GuardedInstanceMethod<&Workbook::PivotRemove, 0x3ULL>("pivotRemove"),
+          GuardedInstanceMethod<&Workbook::PivotSetAnchor, 0x3FULL>("pivotSetAnchor"),
+          GuardedInstanceMethod<&Workbook::PivotSetColFieldOrder, 0x3ULL>("pivotSetColFieldOrder"),
+          GuardedInstanceMethod<&Workbook::PivotSetGrandTotals, 0x3ULL>("pivotSetGrandTotals"),
+          GuardedInstanceMethod<&Workbook::PivotGetLayout, 0x3ULL>("pivotGetLayout"),
+          GuardedInstanceMethod<&Workbook::PivotSetLayout, 0x3ULL, 0x4ULL>("pivotSetLayout"),
+          GuardedInstanceMethod<&Workbook::PivotSetName, 0x3ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x4ULL>("pivotSetName"),
+          GuardedInstanceMethod<&Workbook::PivotSetRowFieldOrder, 0x3ULL>("pivotSetRowFieldOrder"),
+          GuardedInstanceMethod<&Workbook::Precedents, 0xFULL>("precedents"),
+          GuardedInstanceMethod<&Workbook::Recalc>("recalc"),
+          GuardedInstanceMethod<&Workbook::RecalcParallel>("recalcParallel"),
+          GuardedInstanceMethod<&Workbook::RemoveConditionalFormatAt, 0x3ULL>("removeConditionalFormatAt"),
+          GuardedInstanceMethod<&Workbook::RemoveHyperlink, 0x7ULL>("removeHyperlink"),
+          GuardedInstanceMethod<&Workbook::RemoveHyperlinkAt, 0x3ULL>("removeHyperlinkAt"),
+          GuardedInstanceMethod<&Workbook::RemoveMerge, 0x1ULL>("removeMerge"),
+          GuardedInstanceMethod<&Workbook::RemoveMergeAt, 0x3ULL>("removeMergeAt"),
+          GuardedInstanceMethod<&Workbook::RemoveSheet, 0x1ULL>("removeSheet"),
+          GuardedInstanceMethod<&Workbook::RemoveValidationAt, 0x3ULL>("removeValidationAt"),
+          GuardedInstanceMethod<&Workbook::RenameSheet, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("renameSheet"),
+          GuardedInstanceMethod<&Workbook::Save>("save"),
+          GuardedInstanceMethod<&Workbook::SaveAs, 0x0ULL, 0x1ULL>("saveAs"),
+          GuardedInstanceMethod<&Workbook::SaveWithDiagnostics, 0x0ULL, 0x1ULL>("saveWithDiagnostics"),
+          GuardedInstanceMethod<&Workbook::ReadDiagnostics>("readDiagnostics"),
+          GuardedInstanceMethod<&Workbook::SetBlank, 0x7ULL>("setBlank"),
+          GuardedInstanceMethod<&Workbook::SetBool, 0x7ULL>("setBool"),
+          GuardedInstanceMethod<&Workbook::SetCalcMode, 0x0ULL, 0x1ULL>("setCalcMode"),
+          GuardedInstanceMethod<&Workbook::SetPinnedNow, 0x0ULL, 0x3FULL>("setPinnedNow"),
+          GuardedInstanceMethod<&Workbook::SetCellXfIndex, 0xFULL>("setCellXfIndex"),
+          GuardedInstanceMethod<&Workbook::SetCellPhonetic, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL>("setCellPhonetic"),
+          GuardedInstanceMethod<&Workbook::SetCellPhoneticRuns, 0x7ULL>("setCellPhoneticRuns"),
+          GuardedInstanceMethod<&Workbook::SetCellPhoneticProperties, 0x7ULL>("setCellPhoneticProperties"),
+          GuardedInstanceMethod<&Workbook::SetRangeXfIndex, 0x3FULL>("setRangeXfIndex"),
+          GuardedInstanceMethod<&Workbook::SetColumnHidden, 0x7ULL>("setColumnHidden"),
+          GuardedInstanceMethod<&Workbook::SetColumnOutline, 0xFULL>("setColumnOutline"),
+          GuardedInstanceMethod<&Workbook::SetColumnWidth, 0x7ULL, 0x0ULL, 0x0ULL, 0x8ULL>("setColumnWidth"),
+          GuardedInstanceMethod<&Workbook::SetComment, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x18ULL>("setComment"),
+          GuardedInstanceMethod<&Workbook::SetDefinedName, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x3ULL>("setDefinedName"),
+          GuardedInstanceMethod<&Workbook::SetDefinedNameScoped, 0x0ULL, 0x4ULL, 0x0ULL, 0x0ULL, 0x3ULL>("setDefinedNameScoped"),
+          GuardedInstanceMethod<&Workbook::SetDefaultFont>("setDefaultFont"),
+          GuardedInstanceMethod<&Workbook::SetFont, 0x1ULL>("setFont"),
+          GuardedInstanceMethod<&Workbook::SetError, 0x7ULL, 0x8ULL>("setError"),
+          GuardedInstanceMethod<&Workbook::SetExcelProfileId, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x1ULL>("setExcelProfileId"),
+          GuardedInstanceMethod<&Workbook::SetFormula, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL>("setFormula"),
+          GuardedInstanceMethod<&Workbook::SetIterative, 0x2ULL, 0x0ULL, 0x0ULL, 0x4ULL>("setIterative"),
+          GuardedInstanceMethod<&Workbook::SetIterativeProgress>("setIterativeProgress"),
+          GuardedInstanceMethod<&Workbook::SetNumber, 0x7ULL, 0x0ULL, 0x0ULL, 0x8ULL>("setNumber"),
+          GuardedInstanceMethod<&Workbook::SetRowHeight, 0x3ULL, 0x0ULL, 0x0ULL, 0x4ULL>("setRowHeight"),
+          GuardedInstanceMethod<&Workbook::SetRowHidden, 0x3ULL>("setRowHidden"),
+          GuardedInstanceMethod<&Workbook::SetRowOutline, 0x7ULL>("setRowOutline"),
+          GuardedInstanceMethod<&Workbook::SetSheetFreeze, 0x7ULL>("setSheetFreeze"),
+          GuardedInstanceMethod<&Workbook::SetSheetProtection, 0x1ULL>("setSheetProtection"),
+          GuardedInstanceMethod<&Workbook::SetSheetRightToLeft, 0x1ULL>("setSheetRightToLeft"),
+          GuardedInstanceMethod<&Workbook::SetSheetShowGridLines, 0x1ULL>("setSheetShowGridLines"),
+          GuardedInstanceMethod<&Workbook::SetSheetShowRowColHeaders, 0x1ULL>("setSheetShowRowColHeaders"),
+          GuardedInstanceMethod<&Workbook::SetSheetShowZeros, 0x1ULL>("setSheetShowZeros"),
+          GuardedInstanceMethod<&Workbook::SetSheetTabHidden, 0x1ULL>("setSheetTabHidden"),
+          GuardedInstanceMethod<&Workbook::SetSheetTabSelected, 0x1ULL>("setSheetTabSelected"),
+          GuardedInstanceMethod<&Workbook::SetSheetViewMode, 0x1ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x2ULL>("setSheetViewMode"),
+          GuardedInstanceMethod<&Workbook::SetSheetVisibility, 0x1ULL, 0x2ULL>("setSheetVisibility"),
+          GuardedInstanceMethod<&Workbook::SetSheetZoom, 0x3ULL>("setSheetZoom"),
+          GuardedInstanceMethod<&Workbook::SetText, 0x7ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x8ULL>("setText"),
+          GuardedInstanceMethod<&Workbook::SheetCount>("sheetCount"),
+          GuardedInstanceMethod<&Workbook::SheetName, 0x1ULL>("sheetName"),
+          GuardedInstanceMethod<&Workbook::SpillInfo, 0x7ULL>("spillInfo"),
+          GuardedInstanceMethod<&Workbook::TableAt, 0x1ULL>("tableAt"),
+          GuardedInstanceMethod<&Workbook::TableCount>("tableCount"),
+          GuardedInstanceMethod<&Workbook::XfCount>("xfCount"),
       });
+  // clang-format on
   auto* const state = new WorkbookClassState{};
   state->constructor = Napi::Persistent(constructor);
   env.SetInstanceData(state);
diff --git a/src/node_addon/parts/workbook_class.h b/src/node_addon/parts/workbook_class.h
index 2174e5a4f..f0a1b6492 100644
--- a/src/node_addon/parts/workbook_class.h
+++ b/src/node_addon/parts/workbook_class.h
@@ -156,6 +156,11 @@ class Workbook : public Napi::ObjectWrap<Workbook> {
   // Iteration / metadata.
   Napi::Value CellCount(const Napi::CallbackInfo& info);
   Napi::Value CellAt(const Napi::CallbackInfo& info);
+  Napi::Value GetFormula(const Napi::CallbackInfo& info);
+  Napi::Value GetFormulaR1C1(const Napi::CallbackInfo& info);
+  Napi::Value GetCellsInRange(const Napi::CallbackInfo& info);
+  Napi::Value GetDisplayText(const Napi::CallbackInfo& info);
+  Napi::Value FormatValue(const Napi::CallbackInfo& info);
   Napi::Value DefinedNameCount(const Napi::CallbackInfo& info);
   Napi::Value DefinedNameAt(const Napi::CallbackInfo& info);
   Napi::Value TableCount(const Napi::CallbackInfo& info);
@@ -271,6 +276,15 @@ class Workbook : public Napi::ObjectWrap<Workbook> {
   Napi::Value SetColumnOutline(const Napi::CallbackInfo& info);
   Napi::Value GetSheetRowOverrides(const Napi::CallbackInfo& info);
   Napi::Value SetRowHeight(const Napi::CallbackInfo& info);
+  Napi::Value ClearRowHeight(const Napi::CallbackInfo& info);
+  Napi::Value GetSheetFormatDefaults(const Napi::CallbackInfo& info);
+  Napi::Value SetSheetFormatDefaults(const Napi::CallbackInfo& info);
+  Napi::Value GetCellRectPt(const Napi::CallbackInfo& info);
+  Napi::Value GetColumnWidthPt(const Napi::CallbackInfo& info);
+  Napi::Value GetRowHeightPt(const Napi::CallbackInfo& info);
+  Napi::Value GetWidthModel(const Napi::CallbackInfo& info);
+  Napi::Value ColumnCharsToPt(const Napi::CallbackInfo& info);
+  Napi::Value ColumnPtToChars(const Napi::CallbackInfo& info);
   Napi::Value SetRowHidden(const Napi::CallbackInfo& info);
   Napi::Value SetRowOutline(const Napi::CallbackInfo& info);
 
@@ -303,6 +317,15 @@ class Workbook : public Napi::ObjectWrap<Workbook> {
   Napi::Value CellStyleXfCount(const Napi::CallbackInfo& info);
   Napi::Value GetCellStyle(const Napi::CallbackInfo& info);
   Napi::Value GetCellStyleXf(const Napi::CallbackInfo& info);
+  Napi::Value SetCellStyle(const Napi::CallbackInfo& info);
+  Napi::Value RemoveCellStyle(const Napi::CallbackInfo& info);
+
+  // Theme, colour resolution, effective style.
+  Napi::Value GetTheme(const Napi::CallbackInfo& info);
+  Napi::Value SetThemeColors(const Napi::CallbackInfo& info);
+  Napi::Value SetThemeFonts(const Napi::CallbackInfo& info);
+  Napi::Value ResolveColor(const Napi::CallbackInfo& info);
+  Napi::Value GetEffectiveStyle(const Napi::CallbackInfo& info);
 
   // Sheet UI features (merges, comments, hyperlinks, validations).
   Napi::Value AddMerge(const Napi::CallbackInfo& info);
@@ -310,6 +333,7 @@ class Workbook : public Napi::ObjectWrap<Workbook> {
   Napi::Value RemoveMergeAt(const Napi::CallbackInfo& info);
   Napi::Value ClearMerges(const Napi::CallbackInfo& info);
   Napi::Value GetMerges(const Napi::CallbackInfo& info);
+  Napi::Value GetMergesInRange(const Napi::CallbackInfo& info);
   Napi::Value GetComment(const Napi::CallbackInfo& info);
   Napi::Value GetCommentResult(const Napi::CallbackInfo& info);
   Napi::Value GetComments(const Napi::CallbackInfo& info);
@@ -324,12 +348,48 @@ class Workbook : public Napi::ObjectWrap<Workbook> {
   Napi::Value AddValidation(const Napi::CallbackInfo& info);
   Napi::Value RemoveValidationAt(const Napi::CallbackInfo& info);
   Napi::Value ClearValidations(const Napi::CallbackInfo& info);
+  /// Validates `value` against the rule covering a cell, and lists the
+  /// populated cells that fail their rule (paged like `getCellsInRange`).
+  Napi::Value ValidateValue(const Napi::CallbackInfo& info);
+  Napi::Value ListInvalidCells(const Napi::CallbackInfo& info);
+
+  // Typed AutoFilter, sheet and table scoped.
+  Napi::Value GetAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value SetAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value RemoveAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value ApplyAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value ClearAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value EvaluateAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value GetTableAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value SetTableAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value RemoveTableAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value ApplyTableAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value ClearTableAutoFilter(const Napi::CallbackInfo& info);
+  Napi::Value EvaluateTableAutoFilter(const Napi::CallbackInfo& info);
+
+  // Threaded comments and the workbook person list.
+  Napi::Value GetThreadedComments(const Napi::CallbackInfo& info);
+  Napi::Value AddThreadedComment(const Napi::CallbackInfo& info);
+  Napi::Value EditThreadedComment(const Napi::CallbackInfo& info);
+  Napi::Value SetThreadResolved(const Napi::CallbackInfo& info);
+  Napi::Value RemoveThreadedComment(const Napi::CallbackInfo& info);
+  Napi::Value GetPersons(const Napi::CallbackInfo& info);
+  Napi::Value AddPerson(const Napi::CallbackInfo& info);
+  Napi::Value RemovePerson(const Napi::CallbackInfo& info);
+
+  // Drawing images.
+  Napi::Value ProbeImage(const Napi::CallbackInfo& info);
+  Napi::Value ListDrawingObjects(const Napi::CallbackInfo& info);
+  Napi::Value GetImage(const Napi::CallbackInfo& info);
+  Napi::Value InsertImage(const Napi::CallbackInfo& info);
+  Napi::Value RemoveImage(const Napi::CallbackInfo& info);
 
   // ---- Argument helpers (visible to all part TUs) -------------------
   //
   // Made public-static so per-area TUs can reach them without a friend
   // declaration per part. JS callers never touch them.
   static uint32_t ArgU32(const Napi::CallbackInfo& info, size_t idx);
+  static int32_t ArgI32(const Napi::CallbackInfo& info, size_t idx);
   static double ArgDouble(const Napi::CallbackInfo& info, size_t idx);
   static std::string ArgString(const Napi::CallbackInfo& info, size_t idx);
   static bool ArgBool(const Napi::CallbackInfo& info, size_t idx);
@@ -337,14 +397,16 @@ class Workbook : public Napi::ObjectWrap<Workbook> {
   using RowColEditFn = fm_status_t (*)(fm_workbook_t*, uint32_t, uint32_t, uint32_t);
   Napi::Value InvokeRowColEdit(const Napi::CallbackInfo& info, RowColEditFn fn);
 
-  // Shared bodies for the five raw print-settings fragment pairs and the
-  // two break enumerators. Ten near-identical entry points would otherwise
-  // each carry the same handle check, status envelope and empty-result
-  // shape.
-  using XmlFragmentGetFn = fm_status_t (*)(const fm_workbook_t*, size_t, const char**);
-  using XmlFragmentSetFn = fm_status_t (*)(fm_workbook_t*, size_t, const char*);
-  Napi::Value XmlFragmentGetter(const Napi::CallbackInfo& info, XmlFragmentGetFn getter);
-  Napi::Value XmlFragmentSetter(const Napi::CallbackInfo& info, XmlFragmentSetFn setter);
+  using PivotFieldOrderFn = fm_status_t (*)(fm_workbook_t*, size_t, size_t, const uint32_t*, size_t);
+  Napi::Value InvokePivotFieldOrder(const Napi::CallbackInfo& info, PivotFieldOrderFn fn);
+
+  // Shared bodies for the per-sheet string accessors (the five raw
+  // print-settings fragment pairs and the print area) and the two break
+  // enumerators. The getter returns `{status, <field>: string}`.
+  using SheetStringGetFn = fm_status_t (*)(const fm_workbook_t*, size_t, const char**);
+  using SheetStringSetFn = fm_status_t (*)(fm_workbook_t*, size_t, const char*);
+  Napi::Value SheetStringGetter(const Napi::CallbackInfo& info, SheetStringGetFn getter, const char* field);
+  Napi::Value SheetStringSetter(const Napi::CallbackInfo& info, SheetStringSetFn setter);
   Napi::Value BreaksArray(const Napi::CallbackInfo& info, bool rows);
 
   /// Builds an error-Status envelope when the wrapper has been
@@ -352,6 +414,10 @@ class Workbook : public Napi::ObjectWrap<Workbook> {
   Napi::Object NullHandleError(Napi::Env env) const { return MakeErrorStatus(env, kBindingInvalidHandle); }
 
  private:
+  using CreateFn = fm_status_t (*)(fm_workbook_t**);
+  /// Shared body of the `createDefault` / `createEmpty` factories.
+  static Napi::Value CreateWith(const Napi::CallbackInfo& info, CreateFn create);
+
   /// Matches `fm_iterative_progress_cb`: the header-wide wide-POD boolean
   /// convention (`int32_t`, `0` = abort), not a C `bool`.
   static int32_t IterativeProgressTrampoline(uint32_t iteration, double max_residual, uint32_t max_iterations,
diff --git a/src/eval/aggregate_kernels.cpp b/src/numeric_aggregate_kernels.cpp
similarity index 79%
rename from src/eval/aggregate_kernels.cpp
rename to src/numeric_aggregate_kernels.cpp
index 4f178736a..0f56685de 100644
--- a/src/eval/aggregate_kernels.cpp
+++ b/src/numeric_aggregate_kernels.cpp
@@ -1,23 +1,23 @@
 //
 // Implementation of the numeric aggregation kernels declared in
-// `aggregate_kernels.h`. See that header for the rationale around algorithm
+// `numeric_aggregate_kernels.h`. See that header for the rationale around algorithm
 // choice (two-pass variance, Excel-aligned percentile position formulas).
 
-#include "eval/aggregate_kernels.h"
+#include "numeric_aggregate_kernels.h"
 
 #include <algorithm>
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
-#include <utility>
+#include <optional>
 #include <vector>
 
 #include "utils/expected.h"
+#include "utils/index_sort.h"
 #include "value.h"
 
 namespace formulon {
-namespace eval {
-namespace aggregate_kernels {
+namespace numeric_aggregate_kernels {
 namespace {
 
 // Mean of the two middle elements, computed so that a pair whose sum
@@ -31,6 +31,22 @@ double midpoint_without_overflow(double low, double high) {
   return low * 0.5 + high * 0.5;
 }
 
+// Collects the numeric elements of `view` in source order; `nullopt` elements
+// are skipped.
+std::vector<double> materialize(const NumericInputView& view) {
+  std::vector<double> xs;
+  if (view.get == nullptr) {
+    return xs;
+  }
+  xs.reserve(view.size);
+  for (std::size_t i = 0; i < view.size; ++i) {
+    if (const std::optional<double> value = view.get(view.context, i); value.has_value()) {
+      xs.push_back(*value);
+    }
+  }
+  return xs;
+}
+
 }  // namespace
 
 Expected<double, ErrorCode> run_sum(const std::vector<double>& xs) {
@@ -58,6 +74,10 @@ Expected<double, ErrorCode> run_product(const std::vector<double>& xs) {
   return total;
 }
 
+Expected<double, ErrorCode> run_average(const NumericInputView& values) {
+  return run_average(materialize(values));
+}
+
 Expected<double, ErrorCode> run_average(const std::vector<double>& xs) {
   if (xs.empty()) {
     return ErrorCode::Div0;
@@ -104,6 +124,10 @@ Expected<double, ErrorCode> run_min(const std::vector<double>& xs) {
   return run_extreme(xs, /*want_max=*/false);
 }
 
+Expected<double, ErrorCode> run_variance(const NumericInputView& values, bool sample) {
+  return run_variance(materialize(values), sample);
+}
+
 Expected<double, ErrorCode> run_variance(const std::vector<double>& xs, bool sample) {
   const std::size_t n = xs.size();
   const std::size_t need = sample ? 2U : 1U;
@@ -131,6 +155,10 @@ Expected<double, ErrorCode> run_variance(const std::vector<double>& xs, bool sam
   return var;
 }
 
+Expected<double, ErrorCode> run_stdev(const NumericInputView& values, bool sample) {
+  return run_stdev(materialize(values), sample);
+}
+
 Expected<double, ErrorCode> run_stdev(const std::vector<double>& xs, bool sample) {
   auto var = run_variance(xs, sample);
   if (!var) {
@@ -214,27 +242,23 @@ Expected<double, ErrorCode> run_median(std::vector<double> xs) {
 }
 
 std::vector<ValueRun> group_equal_values(const std::vector<double>& xs) {
-  // Sort a copy by value while carrying source positions. This groups equal
-  // values in O(n log n), then the smallest source position implements
-  // Excel's first-occurrence tie rule without a quadratic frequency table.
-  std::vector<std::pair<double, std::size_t>> ranked;
-  ranked.reserve(xs.size());
-  for (std::size_t i = 0; i < xs.size(); ++i) {
-    ranked.emplace_back(xs[i], i);
-  }
-  std::sort(ranked.begin(), ranked.end(),
-            [](const std::pair<double, std::size_t>& lhs, const std::pair<double, std::size_t>& rhs) {
-              return lhs.first < rhs.first;
-            });
+  // Sort positions by value: equal values group in O(n log n), and the index
+  // sort's position tie-break starts each run at its first occurrence, which
+  // is Excel's tie rule.
+  std::vector<std::uint32_t> ranked;
+  sorted_index_order(ranked, static_cast<std::uint32_t>(xs.size()),
+                     IndexLess{&xs, [](const void* context, std::uint32_t lhs, std::uint32_t rhs) {
+                                 const auto& values = *static_cast<const std::vector<double>*>(context);
+                                 return values[lhs] < values[rhs];
+                               }});
   std::vector<ValueRun> runs;
   for (std::size_t begin = 0; begin < ranked.size();) {
     std::size_t end = begin + 1U;
-    std::size_t first = ranked[begin].second;
-    while (end < ranked.size() && ranked[end].first == ranked[begin].first) {
-      first = std::min(first, ranked[end].second);
+    const double value = xs[ranked[begin]];
+    while (end < ranked.size() && xs[ranked[end]] == value) {
       ++end;
     }
-    runs.push_back(ValueRun{ranked[begin].first, first, end - begin});
+    runs.push_back(ValueRun{value, ranked[begin], end - begin});
     begin = end;
   }
   return runs;
@@ -260,6 +284,5 @@ Expected<double, ErrorCode> mode_first_occurrence(const std::vector<double>& xs)
   return best_value;
 }
 
-}  // namespace aggregate_kernels
-}  // namespace eval
+}  // namespace numeric_aggregate_kernels
 }  // namespace formulon
diff --git a/src/eval/aggregate_kernels.h b/src/numeric_aggregate_kernels.h
similarity index 60%
rename from src/eval/aggregate_kernels.h
rename to src/numeric_aggregate_kernels.h
index b82f5bed9..966db3c74 100644
--- a/src/eval/aggregate_kernels.h
+++ b/src/numeric_aggregate_kernels.h
@@ -1,35 +1,50 @@
 //
-// Numeric aggregation kernels shared by SUBTOTAL (`builtins/subtotal.cpp`),
-// AGGREGATE (`aggregate_lazy.cpp`), and the QUARTILE / PERCENTILE family
-// (`builtins/stats.cpp`).
+// Numeric aggregation kernels shared by SUBTOTAL (`src/eval/builtins/subtotal.cpp`),
+// AGGREGATE (`src/eval/aggregate_lazy.cpp`), AVERAGE (`src/eval/builtins/aggregate.cpp`),
+// the stats family (`src/eval/builtins/stats.cpp`, `src/eval/builtins/stats/stats_order.cpp`),
+// and the pivot aggregator (`src/pivot/aggregator.cpp`).
 //
-// Each kernel consumes a `std::vector<double>` of *already-filtered* numeric
-// values: callers are responsible for dropping non-numeric inputs (Text,
-// Blank, Bool when applicable) and for short-circuiting on Error cells.
-// What the kernels add is the post-collection arithmetic + Excel-visible
-// error-code surfacing (empty-input -> #DIV/0!, non-finite intermediate ->
-// #NUM!, k out of range -> #NUM!, etc.).
+// Each kernel consumes either a `std::vector<double>` of already-filtered
+// numeric values or a `NumericInputView`. The view lets a caller retain its
+// source values and expose only the numeric cells through a small getter;
+// returning `nullopt` skips one input. Callers remain responsible for
+// short-circuiting on Error cells before invoking a view kernel. What the
+// kernels add is the post-collection arithmetic + Excel-visible error-code
+// surfacing (empty-input -> #DIV/0!, non-finite intermediate -> #NUM!, k out
+// of range -> #NUM!, etc.).
 //
 // Algorithm note: `run_variance` and `run_stdev` deliberately use the
 // two-pass mean / sum-of-squared-deviations formulation rather than
 // Welford's online recurrence. Both SUBTOTAL and AGGREGATE were already
 // two-pass before the consolidation, so keeping that algorithm gives
 // bit-identical results to the pre-refactor implementations across the
-// oracle corpus. The same applies to PERCENTILE.INC / .EXC, which match
-// the position formulas Mac Excel 365 reports.
+// oracle corpus; `run_average` is the plain sum / count likewise. The same
+// applies to PERCENTILE.INC / .EXC, which match the position formulas Mac
+// Excel 365 reports.
 
-#ifndef FORMULON_EVAL_AGGREGATE_KERNELS_H_
-#define FORMULON_EVAL_AGGREGATE_KERNELS_H_
+#ifndef FORMULON_NUMERIC_AGGREGATE_KERNELS_H_
+#define FORMULON_NUMERIC_AGGREGATE_KERNELS_H_
 
 #include <cstddef>
+#include <optional>
 #include <vector>
 
 #include "utils/expected.h"
 #include "value.h"
 
 namespace formulon {
-namespace eval {
-namespace aggregate_kernels {
+namespace numeric_aggregate_kernels {
+
+/// Borrowed numeric input. `context` is passed unchanged to `get` for each
+/// index in `[0, size)`. A `nullopt` result means that the source element is
+/// not part of the numeric aggregate. The view never owns or outlives the
+/// pointed-to context; vector overloads below provide the common owning-free
+/// adapter for already-filtered slices.
+struct NumericInputView {
+  const void* context = nullptr;
+  std::size_t size = 0;
+  std::optional<double> (*get)(const void* context, std::size_t index) = nullptr;
+};
 
 /// Sum of all elements. Returns `#NUM!` when the running total goes
 /// non-finite (overflow). Empty input returns 0.
@@ -40,7 +55,9 @@ Expected<double, ErrorCode> run_sum(const std::vector<double>& xs);
 /// for SUBTOTAL/AGGREGATE; not the mathematical identity 1).
 Expected<double, ErrorCode> run_product(const std::vector<double>& xs);
 
-/// Arithmetic mean. Empty input returns `#DIV/0!`. Non-finite mean -> `#NUM!`.
+/// Arithmetic mean (plain sum / count). Empty input returns `#DIV/0!`. A
+/// non-finite result returns `#NUM!`.
+Expected<double, ErrorCode> run_average(const NumericInputView& values);
 Expected<double, ErrorCode> run_average(const std::vector<double>& xs);
 
 /// Maximum / minimum. Empty input returns 0 (matches Excel's SUBTOTAL /
@@ -53,13 +70,13 @@ Expected<double, ErrorCode> run_min(const std::vector<double>& xs);
 /// n-1, requires at least 2 elements); `sample = false` selects the
 /// population variance (denominator n, requires at least 1 element).
 /// Insufficient elements -> `#DIV/0!`; non-finite intermediate ->
-/// `#NUM!`. Two-pass algorithm: `mean = sum/n`, then
-/// `var = sum((x-mean)^2) / denom`.
+/// `#NUM!`.
+Expected<double, ErrorCode> run_variance(const NumericInputView& values, bool sample);
 Expected<double, ErrorCode> run_variance(const std::vector<double>& xs, bool sample);
 
-/// Standard deviation, `sqrt(run_variance(xs, sample))`. Propagates the
-/// variance's `#DIV/0!` / `#NUM!`. A negative variance from floating
-/// rounding becomes `#NUM!`.
+/// Standard deviation: the square root of `run_variance`; a variance that
+/// overflows reports `#NUM!`.
+Expected<double, ErrorCode> run_stdev(const NumericInputView& values, bool sample);
 Expected<double, ErrorCode> run_stdev(const std::vector<double>& xs, bool sample);
 
 /// PERCENTILE.INC at fractional rank `k` in [0, 1]. `xs_sorted` must be
@@ -82,8 +99,8 @@ Expected<double, ErrorCode> percentile_sorted_exc(const std::vector<double>& xs_
 /// so callers must not pre-sort and may `std::move` their vector in.
 /// Returns `#NUM!` for an empty slice and for a non-finite midpoint.
 ///
-/// Shared between MEDIAN (`stats/stats_order.cpp`) and AGGREGATE function
-/// 12 (`aggregate_lazy.cpp`). Excel treats the two spellings as
+/// Shared between MEDIAN (`src/eval/builtins/stats/stats_order.cpp`) and AGGREGATE function
+/// 12 (`src/eval/aggregate_lazy.cpp`). Excel treats the two spellings as
 /// interchangeable, so a single definition is what keeps them from
 /// reporting different error codes for the same filtered input.
 Expected<double, ErrorCode> run_median(std::vector<double> xs);
@@ -93,8 +110,8 @@ Expected<double, ErrorCode> run_median(std::vector<double> xs);
 /// used for tie-breaking. Returns `#N/A` when the slice is empty or no
 /// value repeats. `xs` is consumed in its original (unsorted) order so
 /// the first-occurrence rule is observable; callers must NOT pre-sort.
-/// Shared between MODE / MODE.SNGL (`stats/stats_order.cpp`) and
-/// AGGREGATE function 13 (`aggregate_lazy.cpp`) so the two cannot
+/// Shared between MODE / MODE.SNGL (`src/eval/builtins/stats/stats_order.cpp`) and
+/// AGGREGATE function 13 (`src/eval/aggregate_lazy.cpp`) so the two cannot
 /// diverge on the tie-break rule.
 Expected<double, ErrorCode> mode_first_occurrence(const std::vector<double>& xs);
 
@@ -108,11 +125,10 @@ struct ValueRun {
 
 /// Groups `xs` into runs of exactly equal values, in ascending value order.
 /// Shared by the mode kernel here and `build_mode_frequencies` in
-/// `builtins/stats.cpp` so both apply the same first-occurrence grouping.
+/// `src/eval/builtins/stats.cpp` so both apply the same first-occurrence grouping.
 std::vector<ValueRun> group_equal_values(const std::vector<double>& xs);
 
-}  // namespace aggregate_kernels
-}  // namespace eval
+}  // namespace numeric_aggregate_kernels
 }  // namespace formulon
 
-#endif  // FORMULON_EVAL_AGGREGATE_KERNELS_H_
+#endif  // FORMULON_NUMERIC_AGGREGATE_KERNELS_H_
diff --git a/src/parser/ast.cpp b/src/parser/ast.cpp
index cb16e26fa..546a9efd6 100644
--- a/src/parser/ast.cpp
+++ b/src/parser/ast.cpp
@@ -7,13 +7,11 @@
 #include "parser/ast.h"
 
 #include <cstring>
-#include <string>
 #include <string_view>
 #include <vector>
 
 #include "parser/reference.h"
 #include "parser/token.h"
-#include "utils/a1_column.h"
 #include "utils/arena.h"
 #include "utils/expected.h"  // FM_CHECK
 #include "utils/strings.h"
@@ -958,103 +956,5 @@ ErrorCode AstNode::as_error_literal() const {
   return data_.error_literal;
 }
 
-// ---------------------------------------------------------------------------
-// Reference helper
-// ---------------------------------------------------------------------------
-
-bool sheet_name_needs_quoting(std::string_view name) noexcept {
-  if (name.empty()) {
-    return true;
-  }
-  // A bare sheet name cannot open with a digit: the tokenizer reads the run
-  // as a numeric literal and never reaches the `!`, so `3Q!A1` is not a
-  // reference at all. Quoting is the only way to write such a name.
-  if (name.front() >= '0' && name.front() <= '9') {
-    return true;
-  }
-  // A sheet named TRUE/FALSE (any ASCII case) tokenizes as a Bool literal
-  // before the `!` is ever consulted, so `TRUE!A1` re-parses as `(bool
-  // true)` followed by a dangling `!`. Quoting is the only unambiguous form.
-  if (strings::case_insensitive_eq(name, "TRUE") || strings::case_insensitive_eq(name, "FALSE")) {
-    return true;
-  }
-
-  std::size_t i = 0;
-  while (i < name.size() && ((name[i] >= 'A' && name[i] <= 'Z') || (name[i] >= 'a' && name[i] <= 'z'))) {
-    ++i;
-  }
-  const std::size_t letters = i;
-  const bool cell_ref_prefix = letters >= 1 && letters <= 3 && i < name.size() && name[i] >= '1' && name[i] <= '9';
-  for (char c : name) {
-    const bool bare_name_char =
-        (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '_' || c == '.';
-    if (!bare_name_char) {
-      return true;
-    }
-  }
-  if (!cell_ref_prefix) {
-    return false;
-  }
-  ++i;
-  while (i < name.size() && name[i] >= '0' && name[i] <= '9') {
-    ++i;
-  }
-  return i == name.size();
-}
-
-std::string format_a1(const Reference& r) {
-  FM_CHECK(!(r.is_full_col && r.is_full_row), "format_a1: is_full_col and is_full_row must not both be set");
-  std::string out;
-  if (!r.sheet.empty()) {
-    if (r.sheet_quoted || sheet_name_needs_quoting(r.sheet)) {
-      out.push_back('\'');
-      // Escape any embedded single quotes by doubling them.
-      for (char c : r.sheet) {
-        if (c == '\'') {
-          out.push_back('\'');
-        }
-        out.push_back(c);
-      }
-      out.push_back('\'');
-    } else {
-      out.append(r.sheet);
-    }
-    out.push_back('!');
-  }
-  if (r.is_full_col) {
-    if (r.col_abs) {
-      out.push_back('$');
-    }
-    FM_CHECK(a1::append_column_letters(out, r.col), "reference column is outside Excel's grid");
-    out.push_back(':');
-    if (r.col_abs) {
-      out.push_back('$');
-    }
-    FM_CHECK(a1::append_column_letters(out, r.col), "reference column is outside Excel's grid");
-    return out;
-  }
-  if (r.is_full_row) {
-    if (r.row_abs) {
-      out.push_back('$');
-    }
-    out.append(std::to_string(r.row + 1));
-    out.push_back(':');
-    if (r.row_abs) {
-      out.push_back('$');
-    }
-    out.append(std::to_string(r.row + 1));
-    return out;
-  }
-  if (r.col_abs) {
-    out.push_back('$');
-  }
-  FM_CHECK(a1::append_column_letters(out, r.col), "reference column is outside Excel's grid");
-  if (r.row_abs) {
-    out.push_back('$');
-  }
-  out.append(std::to_string(r.row + 1));
-  return out;
-}
-
 }  // namespace parser
 }  // namespace formulon
diff --git a/src/parser/ast_format.cpp b/src/parser/ast_format.cpp
index 309522ed8..3ae10501d 100644
--- a/src/parser/ast_format.cpp
+++ b/src/parser/ast_format.cpp
@@ -16,12 +16,10 @@
 #include <vector>
 
 #include "parser/ast.h"
-#include "parser/parser.h"
 #include "parser/parser_detail.h"
 #include "parser/reference.h"
 #include "utils/arena.h"
 #include "utils/double_format.h"
-#include "utils/index_sort.h"
 #include "utils/strings.h"
 #include "value.h"
 
@@ -41,36 +39,6 @@ using detail::kBpPow;
 using detail::kBpRange;
 using detail::kBpUnaryPrefix;
 
-const char* BinOpToken(BinOp op) noexcept {
-  switch (op) {
-    case BinOp::Add:
-      return "+";
-    case BinOp::Sub:
-      return "-";
-    case BinOp::Mul:
-      return "*";
-    case BinOp::Div:
-      return "/";
-    case BinOp::Pow:
-      return "^";
-    case BinOp::Concat:
-      return "&";
-    case BinOp::Eq:
-      return "=";
-    case BinOp::NotEq:
-      return "<>";
-    case BinOp::Lt:
-      return "<";
-    case BinOp::LtEq:
-      return "<=";
-    case BinOp::Gt:
-      return ">";
-    case BinOp::GtEq:
-      return ">=";
-  }
-  return "+";
-}
-
 // Returns the binding-power slot for the given binary operator. Every
 // binary operator is left-associative (including `^`, matching Excel 365's
 // left-to-right evaluation of a chained power); the per-side `min_bp` calls
@@ -196,14 +164,7 @@ void AppendNameSheetQualifier(const AstNode& node, std::string& out) {
   if (sheet.empty()) {
     return;
   }
-  const bool quoted = node.as_name_sheet_quoted() || sheet_name_needs_quoting(sheet);
-  if (quoted) {
-    out.push_back('\'');
-    AppendQuoteEscaped(sheet, out);
-    out.push_back('\'');
-  } else {
-    out.append(sheet);
-  }
+  append_sheet_name(sheet, node.as_name_sheet_quoted(), out);
   out.push_back('!');
 }
 
@@ -218,18 +179,7 @@ void FormatExternalRef(const AstNode& node, std::string& out) {
   const std::string_view name = node.as_external_ref_name();
   // The name form carries no sheet at all, and an absent qualifier is not
   // a name that needs quoting: `[1]!SrcTotal`, never `'[1]'!SrcTotal`.
-  const bool quoted = !sheet.empty() && sheet_name_needs_quoting(sheet);
-  if (quoted) {
-    out.push_back('\'');
-  }
-  out.push_back('[');
-  out.append(std::to_string(node.as_external_ref_book()));
-  out.push_back(']');
-  AppendQuoteEscaped(sheet, out);
-  if (quoted) {
-    out.push_back('\'');
-  }
-  out.push_back('!');
+  append_external_qualifier(node.as_external_ref_book(), sheet, out);
   if (!name.empty()) {
     out.append(name);
     return;
@@ -367,7 +317,7 @@ void FormatUnary(const AstNode& node, std::string& out, const ParenCounts& paren
 
 void FormatBinary(const AstNode& node, std::string& out, const ParenCounts& parens) {
   FormatNode(node.as_binary_lhs(), out, parens);
-  out.append(BinOpToken(node.as_binary_op()));
+  out.append(binop_token(node.as_binary_op()));
   FormatNode(node.as_binary_rhs(), out, parens);
 }
 
@@ -879,7 +829,7 @@ struct StorageEmitter {
         return;
       case NodeKind::BinaryOp:
         emit(node.as_binary_lhs(), out);
-        out.append(BinOpToken(node.as_binary_op()));
+        out.append(binop_token(node.as_binary_op()));
         emit(node.as_binary_rhs(), out);
         return;
       case NodeKind::RangeOp:
@@ -1042,6 +992,63 @@ struct StorageEmitter {
 
 }  // namespace
 
+const char* binop_token(BinOp op) noexcept {
+  switch (op) {
+    case BinOp::Add:
+      return "+";
+    case BinOp::Sub:
+      return "-";
+    case BinOp::Mul:
+      return "*";
+    case BinOp::Div:
+      return "/";
+    case BinOp::Pow:
+      return "^";
+    case BinOp::Concat:
+      return "&";
+    case BinOp::Eq:
+      return "=";
+    case BinOp::NotEq:
+      return "<>";
+    case BinOp::Lt:
+      return "<";
+    case BinOp::LtEq:
+      return "<=";
+    case BinOp::Gt:
+      return ">";
+    case BinOp::GtEq:
+      return ">=";
+  }
+  return "+";
+}
+
+void append_sheet_name(std::string_view sheet, bool force_quote, std::string& out) {
+  if (force_quote || sheet_name_needs_quoting(sheet)) {
+    out.push_back('\'');
+    AppendQuoteEscaped(sheet, out);
+    out.push_back('\'');
+  } else {
+    out.append(sheet);
+  }
+}
+
+void append_external_qualifier(std::uint32_t book, std::string_view sheet, std::string& out) {
+  // The name form carries no sheet at all, and an absent qualifier is not
+  // a name that needs quoting: `[1]!SrcTotal`, never `'[1]'!SrcTotal`.
+  const bool quoted = !sheet.empty() && sheet_name_needs_quoting(sheet);
+  if (quoted) {
+    out.push_back('\'');
+  }
+  out.push_back('[');
+  out.append(std::to_string(book));
+  out.push_back(']');
+  AppendQuoteEscaped(sheet, out);
+  if (quoted) {
+    out.push_back('\'');
+  }
+  out.push_back('!');
+}
+
 void collect_parenthesized_nodes(const AstNode& root, std::unordered_map<const AstNode*, std::uint8_t>& out) {
   if (ast_depth_within_limit(root, kMaxFormulaAstDepth)) {
     CollectParens(root, 0, out);
@@ -1073,105 +1080,5 @@ std::string format_formula_storage(const AstNode& node, StorageFunctionNameSpell
   return out;
 }
 
-namespace {
-
-bool IsOperatorCall(const AstNode& node, std::string_view name) {
-  return node.kind() == NodeKind::Call && node.as_call_arity() == 1U &&
-         strings::case_insensitive_eq(node.as_call_name(), name);
-}
-
-bool IsStorageOperatorCall(const AstNode& node) {
-  return IsOperatorCall(node, "SINGLE") || IsOperatorCall(node, "ANCHORARRAY");
-}
-
-bool HasStorageOperatorCall(const AstNode& node) {
-  if (IsStorageOperatorCall(node)) {
-    return true;
-  }
-  for (const AstNode* child : child_nodes(node)) {
-    if (HasStorageOperatorCall(*child)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-/// Rewrites `node`'s source text, copying every part without an operator call
-/// verbatim so spacing and spelling survive.
-class OperatorRespeller {
- public:
-  explicit OperatorRespeller(std::string_view src) : src_(src) {}
-
-  std::string text(const AstNode& node, bool tight_parent) const {
-    const TextRange r = node.range();
-    if (!HasStorageOperatorCall(node)) {
-      return std::string(src_.substr(r.start, r.end - r.start));
-    }
-    if (IsStorageOperatorCall(node)) {
-      const AstNode& arg = node.as_call_arg(0);
-      if (IsOperatorCall(node, "SINGLE")) {
-        // `@` binds looser than `:`, ` ` and `%`, tighter than every infix operator.
-        const bool wrap_arg = arg.kind() == NodeKind::BinaryOp ||
-                              (arg.kind() == NodeKind::UnaryOp && arg.as_unary_op() == UnaryOp::Percent);
-        const std::string at = "@" + parenthesised(arg, wrap_arg);
-        return tight_parent ? "(" + at + ")" : at;
-      }
-      const bool bare = arg.kind() == NodeKind::Ref || arg.kind() == NodeKind::Ref3D ||
-                        arg.kind() == NodeKind::NameRef || arg.kind() == NodeKind::Call ||
-                        arg.kind() == NodeKind::ExternalRef;
-      return parenthesised(arg, !bare) + "#";
-    }
-    const std::vector<const AstNode*> children = child_nodes(node);
-    const auto by_start = [&](std::uint32_t lhs, std::uint32_t rhs) {
-      return children[lhs]->range().start < children[rhs]->range().start;
-    };
-    std::vector<std::uint32_t> order;
-    sorted_index_order(order, static_cast<std::uint32_t>(children.size()), make_index_less(by_start));
-    const bool tight = node.kind() == NodeKind::RangeOp || node.kind() == NodeKind::IntersectOp ||
-                       node.kind() == NodeKind::SpillRef ||
-                       (node.kind() == NodeKind::UnaryOp && node.as_unary_op() == UnaryOp::Percent);
-    std::string out;
-    std::uint32_t at = r.start;
-    for (const std::uint32_t index : order) {
-      const AstNode* child = children[index];
-      if (!HasStorageOperatorCall(*child)) {
-        continue;
-      }
-      out.append(src_.substr(at, child->range().start - at));
-      out.append(text(*child, tight));
-      at = child->range().end;
-    }
-    out.append(src_.substr(at, r.end - at));
-    return out;
-  }
-
- private:
-  std::string parenthesised(const AstNode& node, bool wrap) const {
-    std::string inner = text(node, false);
-    return wrap && (inner.empty() || inner.front() != '(') ? "(" + inner + ")" : inner;
-  }
-
-  std::string_view src_;
-};
-
-}  // namespace
-
-std::string spell_storage_operators(std::string_view formula) {
-  const std::size_t body_at = !formula.empty() && formula.front() == '=' ? 1U : 0U;
-  const std::string_view body = formula.substr(body_at);
-  if (!strings::case_insensitive_contains(body, "SINGLE(") &&
-      !strings::case_insensitive_contains(body, "ANCHORARRAY(")) {
-    return std::string(formula);
-  }
-  Arena arena;
-  const AstNode* root = parse_strict(body, arena);
-  if (root == nullptr || !HasStorageOperatorCall(*root)) {
-    return std::string(formula);
-  }
-  const TextRange r = root->range();
-  const std::string respelled = OperatorRespeller(body).text(*root, false);
-  return std::string(formula.substr(0, body_at + r.start)) + respelled + std::string(body.substr(r.end));
-}
-
 }  // namespace parser
 }  // namespace formulon
diff --git a/src/parser/ast_format.h b/src/parser/ast_format.h
index eb66d207a..441cea014 100644
--- a/src/parser/ast_format.h
+++ b/src/parser/ast_format.h
@@ -44,6 +44,18 @@ namespace parser {
 /// byte-exact stability.
 std::string format_formula(const AstNode& node);
 
+/// Excel's spelling of a binary operator (`+`, `<>`, `&`, ...).
+const char* binop_token(BinOp op) noexcept;
+
+/// Appends a sheet name, wrapped in single quotes (embedded quotes doubled)
+/// when `force_quote` is set or the name needs quoting. No trailing `!`.
+void append_sheet_name(std::string_view sheet, bool force_quote, std::string& out);
+
+/// Appends the `[n]Sheet!` qualifier of a cross-workbook reference. When the
+/// sheet needs quoting the book index goes inside the quotes
+/// (`'[1]My Sheet'!`); an empty sheet yields `[1]!` for a book-level name.
+void append_external_qualifier(std::uint32_t book, std::string_view sheet, std::string& out);
+
 /// Fills `out` with the parenthesis pairs each node of `root` prints with:
 /// the pairs written around it (`AstNode::paren_depth`), or one where its
 /// slot's precedence demands it. Both formatters print exactly these, and a
@@ -86,12 +98,6 @@ using StorageFunctionNameSpeller = std::string (*)(std::string_view name);
 std::string format_formula_storage(const AstNode& node, StorageFunctionNameSpeller spell,
                                    const std::vector<const AstNode*>* omitted_at = nullptr);
 
-/// Respells each one-argument call to `SINGLE` / `ANCHORARRAY` in `formula`
-/// (a leading `=` optional) as the `@x` / `x#` operator Excel's formula bar
-/// shows for it, copying every other character verbatim. Returns `formula`
-/// unchanged when it holds none or does not parse.
-std::string spell_storage_operators(std::string_view formula);
-
 }  // namespace parser
 }  // namespace formulon
 
diff --git a/src/parser/ast_format_r1c1.cpp b/src/parser/ast_format_r1c1.cpp
new file mode 100644
index 000000000..dcec00146
--- /dev/null
+++ b/src/parser/ast_format_r1c1.cpp
@@ -0,0 +1,272 @@
+//
+// R1C1 formatter. Reference-bearing nodes and the operators around them are
+// rendered here; leaves that carry no cell reference (literals, names,
+// structured references, array constants) are delegated to `format_formula`.
+// Parenthesis counts come from `collect_parenthesized_nodes`, so grouping
+// matches the A1 formatter exactly.
+
+#include "parser/ast_format_r1c1.h"
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <unordered_map>
+
+#include "parser/ast.h"
+#include "parser/ast_format.h"
+#include "parser/reference.h"
+
+namespace formulon {
+namespace parser {
+namespace {
+
+using ParenCounts = std::unordered_map<const AstNode*, std::uint8_t>;
+
+struct Host {
+  std::int64_t row;
+  std::int64_t col;
+};
+
+// One axis of a cell reference: `R3` (absolute), `R[-1]` (relative), `R` (same).
+void AppendAxis(char axis, std::int64_t index, std::int64_t host, bool absolute, std::string& out) {
+  out.push_back(axis);
+  if (absolute) {
+    out.append(std::to_string(index + 1));
+    return;
+  }
+  const std::int64_t delta = index - host;
+  if (delta != 0) {
+    out.push_back('[');
+    out.append(std::to_string(delta));
+    out.push_back(']');
+  }
+}
+
+// The cell part of `r` (no sheet): a whole column / row prints its axis only.
+void AppendCell(const Reference& r, const Host& host, std::string& out) {
+  if (!r.is_full_col) {
+    AppendAxis('R', r.row, host.row, r.row_abs, out);
+  }
+  if (!r.is_full_row) {
+    AppendAxis('C', r.col, host.col, r.col_abs, out);
+  }
+}
+
+void AppendSheetQualifier(const Reference& r, std::string& out) {
+  if (r.sheet.empty()) {
+    return;
+  }
+  append_sheet_name(r.sheet, r.sheet_quoted, out);
+  out.push_back('!');
+}
+
+void AppendRef(const Reference& r, const Host& host, std::string& out) {
+  AppendSheetQualifier(r, out);
+  AppendCell(r, host, out);
+}
+
+void AppendExternalRef(const AstNode& node, const Host& host, std::string& out) {
+  const std::string_view sheet = node.as_external_ref_sheet();
+  const std::string_view name = node.as_external_ref_name();
+  append_external_qualifier(node.as_external_ref_book(), sheet, out);
+  if (!name.empty()) {
+    out.append(name);
+    return;
+  }
+  AppendCell(node.as_external_ref_cell(), host, out);
+  if (node.as_external_ref_is_range()) {
+    out.push_back(':');
+    AppendCell(node.as_external_ref_cell_end(), host, out);
+  }
+}
+
+// Excel's R1C1 reading quotes each sheet of a 3-D span on its own
+// (`Data:'My Sheet'!`), unlike the single quoted unit its A1 storage uses.
+void AppendRef3D(const AstNode& node, const Host& host, std::string& out) {
+  append_sheet_name(node.as_ref3d_sheet_begin(), false, out);
+  out.push_back(':');
+  append_sheet_name(node.as_ref3d_sheet_end(), false, out);
+  out.push_back('!');
+  AppendCell(node.as_ref3d_cell(), host, out);
+  if (node.as_ref3d_is_range()) {
+    out.push_back(':');
+    AppendCell(node.as_ref3d_cell_end(), host, out);
+  }
+}
+
+// True for a node whose `@` Excel does not echo back in `FormulaR1C1`.
+bool IsReferenceShaped(const AstNode& node) noexcept {
+  switch (node.kind()) {
+    case NodeKind::Ref:
+    case NodeKind::Ref3D:
+    case NodeKind::ExternalRef:
+    case NodeKind::RangeOp:
+      return true;
+    default:
+      return false;
+  }
+}
+
+struct Emitter {
+  Host host;
+  ParenCounts parens;
+
+  void emit(const AstNode& node, std::string& out) const {
+    switch (node.kind()) {
+      case NodeKind::Literal:
+      case NodeKind::StructuredRef:
+      case NodeKind::NameRef:
+      case NodeKind::ArrayLiteral:
+      case NodeKind::ErrorLiteral:
+      case NodeKind::ErrorPlaceholder:
+        // No cell reference inside; the A1 formatter's text (own parentheses
+        // included) is already correct.
+        out.append(format_formula(node));
+        return;
+      default:
+        break;
+    }
+    const auto it = parens.find(&node);
+    const std::uint8_t n = it == parens.end() ? 0U : it->second;
+    out.append(n, '(');
+    emit_bare(node, out);
+    out.append(n, ')');
+  }
+
+  void emit_args(std::uint32_t count, const AstNode& (AstNode::*arg)(std::uint32_t) const, const AstNode& node,
+                 std::string& out) const {
+    for (std::uint32_t i = 0; i < count; ++i) {
+      if (i > 0) {
+        out.push_back(',');
+      }
+      emit((node.*arg)(i), out);
+    }
+  }
+
+  void emit_bare(const AstNode& node, std::string& out) const {
+    switch (node.kind()) {
+      case NodeKind::Ref:
+        AppendRef(node.as_ref(), host, out);
+        return;
+      case NodeKind::SpillRef:
+        if (const AstNode* anchor = node.as_spill_ref_anchor_expr(); anchor != nullptr) {
+          emit(*anchor, out);
+        } else {
+          AppendRef(node.as_spill_ref(), host, out);
+        }
+        out.push_back('#');
+        return;
+      case NodeKind::Ref3D:
+        AppendRef3D(node, host, out);
+        return;
+      case NodeKind::ExternalRef:
+        AppendExternalRef(node, host, out);
+        return;
+      case NodeKind::UnaryOp:
+        if (node.as_unary_op() == UnaryOp::Percent) {
+          emit(node.as_unary_operand(), out);
+          out.push_back('%');
+        } else {
+          out.push_back(node.as_unary_op() == UnaryOp::Plus ? '+' : '-');
+          emit(node.as_unary_operand(), out);
+        }
+        return;
+      case NodeKind::BinaryOp:
+        emit(node.as_binary_lhs(), out);
+        out.append(binop_token(node.as_binary_op()));
+        emit(node.as_binary_rhs(), out);
+        return;
+      case NodeKind::RangeOp:
+        emit(node.as_range_lhs(), out);
+        out.push_back(':');
+        emit(node.as_range_rhs(), out);
+        return;
+      case NodeKind::UnionOp:
+        emit_args(node.as_union_arity(), &AstNode::as_union_child, node, out);
+        return;
+      case NodeKind::IntersectOp:
+        emit(node.as_intersect_lhs(), out);
+        out.push_back(' ');
+        emit(node.as_intersect_rhs(), out);
+        return;
+      case NodeKind::ImplicitIntersection:
+        if (!IsReferenceShaped(node.as_implicit_intersection_operand())) {
+          out.push_back('@');
+        }
+        emit(node.as_implicit_intersection_operand(), out);
+        return;
+      case NodeKind::Call:
+        out.append(node.as_call_name());
+        out.push_back('(');
+        emit_args(node.as_call_arity(), &AstNode::as_call_arg, node, out);
+        out.push_back(')');
+        return;
+      case NodeKind::Lambda: {
+        out.append("LAMBDA(");
+        const std::uint32_t n = node.as_lambda_param_count();
+        const std::uint32_t first_optional = n - node.as_lambda_optional_count();
+        for (std::uint32_t i = 0; i < n; ++i) {
+          if (i > 0) {
+            out.push_back(',');
+          }
+          const bool optional = i >= first_optional;
+          if (optional) {
+            out.push_back('[');
+          }
+          out.append(node.as_lambda_param(i));
+          if (optional) {
+            out.push_back(']');
+          }
+        }
+        if (n > 0) {
+          out.push_back(',');
+        }
+        emit(node.as_lambda_body(), out);
+        out.push_back(')');
+        return;
+      }
+      case NodeKind::LetBinding:
+        out.append("LET(");
+        for (std::uint32_t i = 0; i < node.as_let_binding_count(); ++i) {
+          out.append(node.as_let_binding_name(i));
+          out.push_back(',');
+          emit(node.as_let_binding_expr(i), out);
+          out.push_back(',');
+        }
+        emit(node.as_let_body(), out);
+        out.push_back(')');
+        return;
+      case NodeKind::LambdaCall:
+        emit(node.as_lambda_call_callee(), out);
+        out.push_back('(');
+        emit_args(node.as_lambda_call_arity(), &AstNode::as_lambda_call_arg, node, out);
+        out.push_back(')');
+        return;
+      case NodeKind::Literal:
+      case NodeKind::StructuredRef:
+      case NodeKind::NameRef:
+      case NodeKind::ArrayLiteral:
+      case NodeKind::ErrorLiteral:
+      case NodeKind::ErrorPlaceholder:
+        // Delegated in `emit`.
+        return;
+    }
+  }
+};
+
+}  // namespace
+
+std::string format_formula_r1c1(const AstNode& node, std::uint32_t anchor_row, std::uint32_t anchor_col) {
+  if (!ast_depth_within_limit(node, kMaxFormulaAstDepth)) {
+    return "#REF!";
+  }
+  Emitter emitter{{static_cast<std::int64_t>(anchor_row), static_cast<std::int64_t>(anchor_col)}, {}};
+  collect_parenthesized_nodes(node, emitter.parens);
+  std::string out;
+  out.reserve(64);
+  emitter.emit(node, out);
+  return out;
+}
+
+}  // namespace parser
+}  // namespace formulon
diff --git a/src/parser/ast_format_r1c1.h b/src/parser/ast_format_r1c1.h
new file mode 100644
index 000000000..475285acb
--- /dev/null
+++ b/src/parser/ast_format_r1c1.h
@@ -0,0 +1,33 @@
+//
+// R1C1-notation formula formatter for `AstNode`.
+//
+// Mirrors `format_formula` (ast_format.h) but prints every cell reference
+// relative to a host cell, the way Excel's `Range.FormulaR1C1` does. Only the
+// reference spelling differs; everything notation-independent is delegated to
+// `format_formula`.
+
+#ifndef FORMULON_PARSER_AST_FORMAT_R1C1_H_
+#define FORMULON_PARSER_AST_FORMAT_R1C1_H_
+
+#include <cstdint>
+#include <string>
+
+#include "parser/ast.h"
+
+namespace formulon {
+namespace parser {
+
+/// Returns the R1C1 rendering of `node` as written in the cell at the 0-based
+/// (`anchor_row`, `anchor_col`).
+///
+/// Relative parts print as `R[-1]C[2]` (`R` / `C` for offset zero, so the host
+/// cell itself is `RC`), absolute parts as `R3C4`. A whole-column or whole-row
+/// reference prints as a single axis (`C[-2]`, `R1`) and a range as
+/// `<start>:<end>`. A `@` in front of a reference or range is dropped. The
+/// result carries no leading `=`.
+std::string format_formula_r1c1(const AstNode& node, std::uint32_t anchor_row, std::uint32_t anchor_col);
+
+}  // namespace parser
+}  // namespace formulon
+
+#endif  // FORMULON_PARSER_AST_FORMAT_R1C1_H_
diff --git a/src/parser/formula_prefix.cpp b/src/parser/formula_prefix.cpp
new file mode 100644
index 000000000..5bfea533a
--- /dev/null
+++ b/src/parser/formula_prefix.cpp
@@ -0,0 +1,123 @@
+//
+// Respelling of the `SINGLE` / `ANCHORARRAY` storage calls as the `@x` / `x#`
+// operators; the contract is declared in `parser/formula_prefix.h`.
+
+#include "parser/formula_prefix.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "utils/arena.h"
+#include "utils/index_sort.h"
+#include "utils/strings.h"
+
+namespace formulon {
+namespace parser {
+
+namespace {
+
+bool IsOperatorCall(const AstNode& node, std::string_view name) {
+  return node.kind() == NodeKind::Call && node.as_call_arity() == 1U &&
+         strings::case_insensitive_eq(node.as_call_name(), name);
+}
+
+bool IsStorageOperatorCall(const AstNode& node) {
+  return IsOperatorCall(node, "SINGLE") || IsOperatorCall(node, "ANCHORARRAY");
+}
+
+bool HasStorageOperatorCall(const AstNode& node) {
+  if (IsStorageOperatorCall(node)) {
+    return true;
+  }
+  for (const AstNode* child : child_nodes(node)) {
+    if (HasStorageOperatorCall(*child)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/// Rewrites `node`'s source text, copying every part without an operator call
+/// verbatim so spacing and spelling survive.
+class OperatorRespeller {
+ public:
+  explicit OperatorRespeller(std::string_view src) : src_(src) {}
+
+  std::string text(const AstNode& node, bool tight_parent) const {
+    const TextRange r = node.range();
+    if (!HasStorageOperatorCall(node)) {
+      return std::string(src_.substr(r.start, r.end - r.start));
+    }
+    if (IsStorageOperatorCall(node)) {
+      const AstNode& arg = node.as_call_arg(0);
+      if (IsOperatorCall(node, "SINGLE")) {
+        // `@` binds looser than `:`, ` ` and `%`, tighter than every infix operator.
+        const bool wrap_arg = arg.kind() == NodeKind::BinaryOp ||
+                              (arg.kind() == NodeKind::UnaryOp && arg.as_unary_op() == UnaryOp::Percent);
+        const std::string at = "@" + parenthesised(arg, wrap_arg);
+        return tight_parent ? "(" + at + ")" : at;
+      }
+      const bool bare = arg.kind() == NodeKind::Ref || arg.kind() == NodeKind::Ref3D ||
+                        arg.kind() == NodeKind::NameRef || arg.kind() == NodeKind::Call ||
+                        arg.kind() == NodeKind::ExternalRef;
+      return parenthesised(arg, !bare) + "#";
+    }
+    const std::vector<const AstNode*> children = child_nodes(node);
+    const auto by_start = [&](std::uint32_t lhs, std::uint32_t rhs) {
+      return children[lhs]->range().start < children[rhs]->range().start;
+    };
+    std::vector<std::uint32_t> order;
+    sorted_index_order(order, static_cast<std::uint32_t>(children.size()), make_index_less(by_start));
+    const bool tight = node.kind() == NodeKind::RangeOp || node.kind() == NodeKind::IntersectOp ||
+                       node.kind() == NodeKind::SpillRef ||
+                       (node.kind() == NodeKind::UnaryOp && node.as_unary_op() == UnaryOp::Percent);
+    std::string out;
+    std::uint32_t at = r.start;
+    for (const std::uint32_t index : order) {
+      const AstNode* child = children[index];
+      if (!HasStorageOperatorCall(*child)) {
+        continue;
+      }
+      out.append(src_.substr(at, child->range().start - at));
+      out.append(text(*child, tight));
+      at = child->range().end;
+    }
+    out.append(src_.substr(at, r.end - at));
+    return out;
+  }
+
+ private:
+  std::string parenthesised(const AstNode& node, bool wrap) const {
+    std::string inner = text(node, false);
+    return wrap && (inner.empty() || inner.front() != '(') ? "(" + inner + ")" : inner;
+  }
+
+  std::string_view src_;
+};
+
+}  // namespace
+
+std::string spell_storage_operators(std::string_view formula) {
+  const std::size_t body_at = !formula.empty() && formula.front() == '=' ? 1U : 0U;
+  const std::string_view body = formula.substr(body_at);
+  if (!strings::case_insensitive_contains(body, "SINGLE(") &&
+      !strings::case_insensitive_contains(body, "ANCHORARRAY(")) {
+    return std::string(formula);
+  }
+  Arena arena;
+  const AstNode* root = parse_strict(body, arena);
+  if (root == nullptr || !HasStorageOperatorCall(*root)) {
+    return std::string(formula);
+  }
+  const TextRange r = root->range();
+  const std::string respelled = OperatorRespeller(body).text(*root, false);
+  return std::string(formula.substr(0, body_at + r.start)) + respelled + std::string(body.substr(r.end));
+}
+
+}  // namespace parser
+}  // namespace formulon
diff --git a/src/parser/formula_prefix.h b/src/parser/formula_prefix.h
index 3a76a1dc1..645f5d31e 100644
--- a/src/parser/formula_prefix.h
+++ b/src/parser/formula_prefix.h
@@ -130,6 +130,12 @@ inline std::string strip_storage_prefixes(std::string_view formula, bool (*known
   return out;
 }
 
+/// Respells each one-argument call to `SINGLE` / `ANCHORARRAY` in `formula`
+/// (a leading `=` optional) as the `@x` / `x#` operator Excel's formula bar
+/// shows for it, copying every other character verbatim. Returns `formula`
+/// unchanged when it holds none or does not parse.
+std::string spell_storage_operators(std::string_view formula);
+
 }  // namespace parser
 }  // namespace formulon
 
diff --git a/src/parser/parse_error.cpp b/src/parser/parse_error.cpp
new file mode 100644
index 000000000..ce7441b40
--- /dev/null
+++ b/src/parser/parse_error.cpp
@@ -0,0 +1,75 @@
+//
+// Default diagnostic messages for `ParseErrorCode`. Declared in
+// `parser/parse_error.h`.
+
+#include "parser/parse_error.h"
+
+namespace formulon {
+namespace parser {
+
+const char* default_message(ParseErrorCode code) noexcept {
+  switch (code) {
+    case ParseErrorCode::LexerInvalidCharacter:
+      return "invalid character";
+    case ParseErrorCode::LexerUnterminatedString:
+      return "unterminated string literal";
+    case ParseErrorCode::LexerUnterminatedSheetQuote:
+      return "unterminated quoted sheet name";
+    case ParseErrorCode::LexerInvalidNumberLiteral:
+      return "invalid number literal";
+    case ParseErrorCode::LexerInvalidErrorLiteral:
+      return "invalid error literal";
+    case ParseErrorCode::LexerInvalidEscape:
+      return "invalid escape sequence";
+    case ParseErrorCode::LexerInvalidReference:
+      return "invalid reference";
+    case ParseErrorCode::LexerExcessiveLength:
+      return "formula exceeds maximum length";
+    case ParseErrorCode::UnexpectedToken:
+      return "unexpected token";
+    case ParseErrorCode::UnexpectedEof:
+      return "unexpected end of input";
+    case ParseErrorCode::ExpectedExpression:
+      return "expected expression";
+    case ParseErrorCode::ExpectedCloseParen:
+      return "expected ')'";
+    case ParseErrorCode::UnbalancedBraces:
+      return "unbalanced braces in array literal";
+    case ParseErrorCode::ArrayRowMismatch:
+      return "array literal rows have inconsistent column counts";
+    case ParseErrorCode::ExpectedRParenOrComma:
+      return "expected ')' or ','";
+    case ParseErrorCode::ExpectedCommaOrSemiInArray:
+      return "expected ',' or ';' in array literal";
+    case ParseErrorCode::InvalidReference:
+      return "invalid reference";
+    case ParseErrorCode::UnsupportedConstruct:
+      return "construct not yet supported";
+    case ParseErrorCode::ExpectedOpenParen:
+      return "expected '('";
+    case ParseErrorCode::ExpectedComma:
+      return "expected ','";
+    case ParseErrorCode::UnbalancedBrackets:
+      return "unbalanced brackets in structured reference";
+    case ParseErrorCode::InvalidRange:
+      return "invalid range expression";
+    case ParseErrorCode::NestedFormulaTooDeep:
+      return "formula nesting depth exceeds the configured limit";
+    case ParseErrorCode::TooManyErrors:
+      return "too many parse errors; stopping";
+    case ParseErrorCode::LetInvalidName:
+      return "invalid LET binding name";
+    case ParseErrorCode::LetWrongArity:
+      return "LET requires an odd number of arguments (name, expr, [name, expr, ...], body)";
+    case ParseErrorCode::LambdaInvalidParam:
+      return "invalid LAMBDA parameter name";
+    case ParseErrorCode::LambdaEmpty:
+      return "LAMBDA requires at least a body expression";
+    case ParseErrorCode::LambdaDuplicateParam:
+      return "LAMBDA parameter names must be unique";
+  }
+  return "parse error";
+}
+
+}  // namespace parser
+}  // namespace formulon
diff --git a/src/parser/parser.cpp b/src/parser/parser.cpp
index 76987f033..eed558cc4 100644
--- a/src/parser/parser.cpp
+++ b/src/parser/parser.cpp
@@ -34,8 +34,9 @@
 //
 // Source layout: this TU owns the parser entry point, the Pratt expression
 // loop, atom dispatch, and the panic-mode plumbing. Per-atom helpers live in
-// `parser_atoms.cpp`; cell-ref decoding, LET special-form handling, and
-// sheet-qualified refs live in `parser_reference.cpp`.
+// `parser_atoms.cpp`; cell-ref decoding and sheet-qualified refs live in
+// `parser_reference.cpp`; LET / LAMBDA special forms live in
+// `parser_let_lambda.cpp`.
 
 #include "parser/parser.h"
 
@@ -183,70 +184,6 @@ ParseErrorCode PromoteLexerCode(LexerErrorCode lc) noexcept {
 
 }  // namespace
 
-const char* default_message(ParseErrorCode code) noexcept {
-  switch (code) {
-    case ParseErrorCode::LexerInvalidCharacter:
-      return "invalid character";
-    case ParseErrorCode::LexerUnterminatedString:
-      return "unterminated string literal";
-    case ParseErrorCode::LexerUnterminatedSheetQuote:
-      return "unterminated quoted sheet name";
-    case ParseErrorCode::LexerInvalidNumberLiteral:
-      return "invalid number literal";
-    case ParseErrorCode::LexerInvalidErrorLiteral:
-      return "invalid error literal";
-    case ParseErrorCode::LexerInvalidEscape:
-      return "invalid escape sequence";
-    case ParseErrorCode::LexerInvalidReference:
-      return "invalid reference";
-    case ParseErrorCode::LexerExcessiveLength:
-      return "formula exceeds maximum length";
-    case ParseErrorCode::UnexpectedToken:
-      return "unexpected token";
-    case ParseErrorCode::UnexpectedEof:
-      return "unexpected end of input";
-    case ParseErrorCode::ExpectedExpression:
-      return "expected expression";
-    case ParseErrorCode::ExpectedCloseParen:
-      return "expected ')'";
-    case ParseErrorCode::UnbalancedBraces:
-      return "unbalanced braces in array literal";
-    case ParseErrorCode::ArrayRowMismatch:
-      return "array literal rows have inconsistent column counts";
-    case ParseErrorCode::ExpectedRParenOrComma:
-      return "expected ')' or ','";
-    case ParseErrorCode::ExpectedCommaOrSemiInArray:
-      return "expected ',' or ';' in array literal";
-    case ParseErrorCode::InvalidReference:
-      return "invalid reference";
-    case ParseErrorCode::UnsupportedConstruct:
-      return "construct not yet supported";
-    case ParseErrorCode::ExpectedOpenParen:
-      return "expected '('";
-    case ParseErrorCode::ExpectedComma:
-      return "expected ','";
-    case ParseErrorCode::UnbalancedBrackets:
-      return "unbalanced brackets in structured reference";
-    case ParseErrorCode::InvalidRange:
-      return "invalid range expression";
-    case ParseErrorCode::NestedFormulaTooDeep:
-      return "formula nesting depth exceeds the configured limit";
-    case ParseErrorCode::TooManyErrors:
-      return "too many parse errors; stopping";
-    case ParseErrorCode::LetInvalidName:
-      return "invalid LET binding name";
-    case ParseErrorCode::LetWrongArity:
-      return "LET requires an odd number of arguments (name, expr, [name, expr, ...], body)";
-    case ParseErrorCode::LambdaInvalidParam:
-      return "invalid LAMBDA parameter name";
-    case ParseErrorCode::LambdaEmpty:
-      return "LAMBDA requires at least a body expression";
-    case ParseErrorCode::LambdaDuplicateParam:
-      return "LAMBDA parameter names must be unique";
-  }
-  return "parse error";
-}
-
 // ---------------------------------------------------------------------------
 // Construction
 // ---------------------------------------------------------------------------
diff --git a/src/parser/parser.h b/src/parser/parser.h
index accf35bfb..0d7a5c2c6 100644
--- a/src/parser/parser.h
+++ b/src/parser/parser.h
@@ -198,6 +198,11 @@ class Parser {
   // reference. Returns a `Ref3D` node, or `nullptr` on a malformed cell
   // reference after recording a diagnostic.
   AstNode* parse_3d_ref(std::string_view sheet1, TextRange sheet1_range);
+  // Parses the part of a 3-D reference after its `!`: a cell, a cell range,
+  // a whole-column (`A:C`) or a whole-row (`1:3`) tail. `*is_range` is set
+  // when the tail names two distinct endpoints, in which case `*last` holds
+  // the second. Records a diagnostic and returns false on a malformed tail.
+  bool parse_3d_ref_tail(Reference* first, Reference* last, bool* is_range, TextRange* tail_range);
   // Parses the tail of a cross-workbook reference, from the `!` onwards.
   // The caller has identified the supporting workbook's 1-based index
   // (`[N]`) and the sheet name that followed the bracket, which is empty
@@ -239,6 +244,16 @@ class Parser {
   // Returns the column index encoded by an Ident token's letters; 0 means
   // not a valid column-letter run.
   static std::uint32_t decode_column_letters(std::string_view lex, bool* col_abs) noexcept;
+  // Decodes a whole-column endpoint (`A`, `$C`) into `out`'s column fields.
+  // Returns false when the token is not a valid column-letter run.
+  static bool decode_full_col_endpoint(const Token& tok, Reference* out) noexcept;
+  // Decodes a whole-row endpoint (`1`, `$3`) from an integer Number token
+  // into `out`'s row fields. Returns false when it is not a valid row.
+  static bool decode_full_row_endpoint(const Token& tok, Reference* out) noexcept;
+  // Builds the node for a whole-column / whole-row pair: `lhs` alone when
+  // both endpoints name the same column or row, otherwise a RangeOp over
+  // the two. The result spans [`lhs_range`, `rhs_range`].
+  AstNode* make_whole_axis_ref(const Reference& lhs, const Reference& rhs, TextRange lhs_range, TextRange rhs_range);
 
   // Promotes any tokenizer-level errors into `errors_`. Errors whose
   // source byte-range falls inside one of the parser-recognised
diff --git a/src/parser/parser_atoms.cpp b/src/parser/parser_atoms.cpp
index 081b80c98..c69d4b6dc 100644
--- a/src/parser/parser_atoms.cpp
+++ b/src/parser/parser_atoms.cpp
@@ -16,11 +16,8 @@
 namespace formulon {
 namespace parser {
 
-using detail::DecodeDigitRunClamped;
-using detail::IsAsciiDigit;
 using detail::kBpAtPrefix;
 using detail::kBpUnaryPrefix;
-using detail::kMaxRow;
 using detail::SpanRange;
 
 namespace {
@@ -71,40 +68,12 @@ AstNode* Parser::parse_number_atom() {
 }
 
 AstNode* Parser::parse_full_row_or_number(const Token& first) {
-  // first is the leading Number, currently at pos_. Validate that both ends
-  // are (optionally `$`-anchored) pure digit lexemes and decode the row
-  // index. An absolute anchor (`$1`) is emitted by the tokenizer as a Number
-  // whose lexeme retains the `$`; strip it here and carry the row_abs flag so
-  // `$1:$1` / `$1:$3` round-trip.
+  // first is the leading Number, currently at pos_. Both ends must be
+  // (optionally `$`-anchored) pure digit lexemes naming a valid row.
   const Token& second = peek_at(2);
-  auto decode_row = [](std::string_view lex, bool* row_abs, std::uint64_t* out_row) -> bool {
-    *row_abs = false;
-    if (!lex.empty() && lex.front() == '$') {
-      *row_abs = true;
-      lex.remove_prefix(1);
-    }
-    if (lex.empty()) {
-      return false;
-    }
-    for (char c : lex) {
-      if (!IsAsciiDigit(c)) {
-        return false;
-      }
-    }
-    // `DecodeDigitRunClamped` stops accumulating once the value is already
-    // past `kMaxRow`, so a pathological 20-digit row literal cannot wrap a
-    // `std::uint64_t` back into the valid range.
-    *out_row = DecodeDigitRunClamped(lex, kMaxRow);
-    return true;
-  };
-  bool lhs_abs = false;
-  bool rhs_abs = false;
-  std::uint64_t lhs_row = 0;
-  std::uint64_t rhs_row = 0;
-  const bool decoded = first.is_integer && second.is_integer && decode_row(first.lexeme, &lhs_abs, &lhs_row) &&
-                       decode_row(second.lexeme, &rhs_abs, &rhs_row) && lhs_row != 0 && rhs_row != 0 &&
-                       lhs_row <= kMaxRow && rhs_row <= kMaxRow;
-  if (!decoded) {
+  Reference lhs_ref;
+  Reference rhs_ref;
+  if (!decode_full_row_endpoint(first, &lhs_ref) || !decode_full_row_endpoint(second, &rhs_ref)) {
     // A `$`-anchored endpoint that failed the whole-row decode (e.g.
     // `$1:$99999999`) is not a valid literal either; surface a diagnostic
     // rather than silently decoding `$1` as the bare number 1.
@@ -123,43 +92,12 @@ AstNode* Parser::parse_full_row_or_number(const Token& first) {
     n->set_range(first.range);
     return n;
   }
-  // Consume Number, Colon, Number.
+  // Consume Number, Colon, Number: `1:1` is a single whole-row Ref, `1:3`
+  // a range spanning two.
   advance();
   advance();
   advance();
-  Reference lhs_ref;
-  lhs_ref.row = static_cast<std::uint32_t>(lhs_row - 1);
-  lhs_ref.row_abs = lhs_abs;
-  lhs_ref.is_full_row = true;
-  if (lhs_row == rhs_row) {
-    // Same row on both sides (`1:1`): a single whole-row Ref.
-    AstNode* n = make_ref(arena_, lhs_ref);
-    if (n == nullptr) {
-      return nullptr;
-    }
-    n->set_range(SpanRange(first.range, second.range));
-    return n;
-  }
-  // Distinct rows (`1:3`): a range spanning two whole-row Refs. The
-  // evaluator's `expand_range` clamps the unbounded column axis to the
-  // sheet's used range.
-  Reference rhs_ref;
-  rhs_ref.row = static_cast<std::uint32_t>(rhs_row - 1);
-  rhs_ref.row_abs = rhs_abs;
-  rhs_ref.is_full_row = true;
-  AstNode* lhs_node = make_ref(arena_, lhs_ref);
-  AstNode* rhs_node = make_ref(arena_, rhs_ref);
-  if (lhs_node == nullptr || rhs_node == nullptr) {
-    return nullptr;
-  }
-  lhs_node->set_range(first.range);
-  rhs_node->set_range(second.range);
-  AstNode* n = make_range_op(arena_, lhs_node, rhs_node);
-  if (n == nullptr) {
-    return nullptr;
-  }
-  n->set_range(SpanRange(first.range, second.range));
-  return n;
+  return make_whole_axis_ref(lhs_ref, rhs_ref, first.range, second.range);
 }
 
 AstNode* Parser::parse_bool_atom() {
@@ -676,49 +614,15 @@ AstNode* Parser::parse_ident_or_call_or_full_col() {
   }
 
   if (next == TokenKind::Colon && peek_kind_at(2) == TokenKind::Ident) {
-    bool lhs_abs = false;
-    bool rhs_abs = false;
-    const std::uint32_t lhs_col = decode_column_letters(ident.lexeme, &lhs_abs);
-    const std::uint32_t rhs_col = decode_column_letters(peek_at(2).lexeme, &rhs_abs);
-    if (lhs_col != 0 && rhs_col != 0) {
-      const TextRange start_range = ident.range;
-      const TextRange end_range = peek_at(2).range;
+    const Token& rhs = peek_at(2);
+    Reference lhs_ref;
+    Reference rhs_ref;
+    if (decode_full_col_endpoint(ident, &lhs_ref) && decode_full_col_endpoint(rhs, &rhs_ref)) {
+      // `A:A` is a single whole-column Ref, `A:C` a range spanning two.
       advance();  // Ident
       advance();  // Colon
       advance();  // Ident
-      Reference lhs_ref;
-      lhs_ref.col = lhs_col - 1;
-      lhs_ref.col_abs = lhs_abs;
-      lhs_ref.is_full_col = true;
-      if (lhs_col == rhs_col) {
-        // Same column on both sides (`A:A`): a single whole-column Ref.
-        AstNode* n = make_ref(arena_, lhs_ref);
-        if (n == nullptr) {
-          return nullptr;
-        }
-        n->set_range(SpanRange(start_range, end_range));
-        return n;
-      }
-      // Distinct columns (`A:C`): a range spanning two whole-column Refs.
-      // The evaluator's `expand_range` clamps the unbounded row axis to the
-      // sheet's used range.
-      Reference rhs_ref;
-      rhs_ref.col = rhs_col - 1;
-      rhs_ref.col_abs = rhs_abs;
-      rhs_ref.is_full_col = true;
-      AstNode* lhs_node = make_ref(arena_, lhs_ref);
-      AstNode* rhs_node = make_ref(arena_, rhs_ref);
-      if (lhs_node == nullptr || rhs_node == nullptr) {
-        return nullptr;
-      }
-      lhs_node->set_range(start_range);
-      rhs_node->set_range(end_range);
-      AstNode* n = make_range_op(arena_, lhs_node, rhs_node);
-      if (n == nullptr) {
-        return nullptr;
-      }
-      n->set_range(SpanRange(start_range, end_range));
-      return n;
+      return make_whole_axis_ref(lhs_ref, rhs_ref, ident.range, rhs.range);
     }
     // Fall through: the Ident is a defined name; the binary `:` rule will
     // pair it with whatever the RHS atom parses to.
diff --git a/src/parser/parser_detail.h b/src/parser/parser_detail.h
index ca28c275e..74e246a42 100644
--- a/src/parser/parser_detail.h
+++ b/src/parser/parser_detail.h
@@ -1,7 +1,7 @@
 //
-// Internal helpers shared between parser.cpp, parser_atoms.cpp, and
-// parser_reference.cpp. Not a public header; do not include from outside
-// src/parser/.
+// Internal helpers shared between parser.cpp, parser_atoms.cpp,
+// parser_reference.cpp, and parser_let_lambda.cpp. Not a public header; do not
+// include from outside src/parser/.
 
 #ifndef FORMULON_PARSER_PARSER_DETAIL_H_
 #define FORMULON_PARSER_PARSER_DETAIL_H_
diff --git a/src/parser/parser_let_lambda.cpp b/src/parser/parser_let_lambda.cpp
new file mode 100644
index 000000000..882b4b3a6
--- /dev/null
+++ b/src/parser/parser_let_lambda.cpp
@@ -0,0 +1,416 @@
+//
+// LET / LAMBDA special-form parsing: binding-name validation and the
+// `parse_let_call` / `parse_lambda_call` Parser members.
+
+#include <cstddef>
+#include <cstdint>
+#include <string_view>
+#include <vector>
+
+#include "parser/ast.h"
+#include "parser/parse_error.h"
+#include "parser/parser.h"
+#include "parser/parser_detail.h"
+#include "parser/token.h"
+#include "utils/strings.h"
+
+namespace formulon {
+namespace parser {
+
+using detail::IsAsciiDigit;
+using detail::IsAsciiLetter;
+using detail::SpanRange;
+
+namespace {
+
+// Returns true iff `name` starts with `[A-Za-z_\]` or any non-ASCII (UTF-8
+// continuation) byte, and continues with `[A-Za-z0-9_.?]` plus non-ASCII
+// bytes. Length must be non-zero and <= 255 bytes. This mirrors the
+// tokenizer's identifier rule (`Tokenizer::is_ident_start_byte` /
+// `is_ident_cont_byte`) and matches the identifier shape Excel accepts for
+// LET bindings and defined names, including hiragana / katakana / kanji and
+// other locale-specific scripts. The shape is still stricter than the
+// tokenizer's Ident rule because it forbids a leading ASCII digit.
+bool IsLetNameShape(std::string_view name) noexcept {
+  if (name.empty() || name.size() > 255) {
+    return false;
+  }
+  const auto first = static_cast<unsigned char>(name[0]);
+  if (!IsAsciiLetter(static_cast<char>(first)) && first != '_' && first != '\\' && first < 0x80) {
+    return false;
+  }
+  for (std::size_t i = 1; i < name.size(); ++i) {
+    const auto byte = static_cast<unsigned char>(name[i]);
+    const char c = static_cast<char>(byte);
+    const bool ok = IsAsciiLetter(c) || IsAsciiDigit(c) || c == '_' || c == '.' || c == '?' || byte >= 0x80;
+    if (!ok) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// Returns true iff `name` has the shape of an A1-style cell reference
+// (`[A-Za-z]{1,3}[1-9][0-9]*`). Excel rejects such identifiers as LET
+// binding names because they would be indistinguishable from cell refs when
+// used in the body.
+bool LooksLikeCellRef(std::string_view name) noexcept {
+  std::size_t i = 0;
+  while (i < name.size() && IsAsciiLetter(name[i])) {
+    ++i;
+  }
+  const std::size_t letters = i;
+  if (letters == 0 || letters > 3) {
+    return false;
+  }
+  // First digit must not be zero so names like `A0` (not a valid ref) still
+  // go through the LET path.
+  if (i >= name.size() || name[i] < '1' || name[i] > '9') {
+    return false;
+  }
+  ++i;
+  while (i < name.size() && IsAsciiDigit(name[i])) {
+    ++i;
+  }
+  return i == name.size();
+}
+
+}  // namespace
+
+// ---------------------------------------------------------------------------
+// LET bindings
+// ---------------------------------------------------------------------------
+
+bool Parser::parse_let_binding_name(std::string_view* out_name, TextRange* out_range) {
+  // The binding-name slot accepts a single Ident token. CellRef tokens
+  // (produced for patterns that match the A1 shape) are rejected because the
+  // tokenizer already routed them away from Ident; this is the expected
+  // behaviour for names like `A1` that collide with cell refs.
+  const Token& tok = peek();
+  if (tok.kind == TokenKind::CellRef) {
+    record_error_with_token(ParseErrorCode::LetInvalidName, tok.range, tok.lexeme);
+    advance();
+    return false;
+  }
+  if (tok.kind != TokenKind::Ident) {
+    record_error_with_token(ParseErrorCode::LetInvalidName, tok.range, tok.lexeme);
+    return false;
+  }
+  if (!IsLetNameShape(tok.lexeme) || LooksLikeCellRef(tok.lexeme)) {
+    record_error_with_token(ParseErrorCode::LetInvalidName, tok.range, tok.lexeme);
+    advance();
+    return false;
+  }
+  *out_name = tok.lexeme;
+  *out_range = tok.range;
+  advance();
+  return true;
+}
+
+AstNode* Parser::parse_let_call(const Token& name_tok) {
+  const TextRange call_start = name_tok.range;
+  advance();  // LET Ident
+  advance();  // LParen
+
+  // Accumulate name / expr pairs until a bare expression (the body) remains.
+  std::vector<std::string_view> names;
+  std::vector<const AstNode*> exprs;
+  AstNode* body = nullptr;
+
+  // Empty arg list is an arity error but still needs recovery; we synthesise
+  // a placeholder body and return below.
+  if (peek_kind() == TokenKind::RParen) {
+    record_error_with_token(ParseErrorCode::LetWrongArity, name_tok.range, name_tok.lexeme);
+    const Token& rparen_empty = advance();
+    return make_recovery_placeholder(SpanRange(call_start, rparen_empty.range));
+  }
+
+  // Slot-walk loop. At each iteration pos_ sits on the first token of the
+  // next slot. A slot is classified as a binding name when it is a lone
+  // well-shaped Ident followed by a comma (so it cannot stand as a complete
+  // expression); any other shape is the body. This works for all odd-arity
+  // well-formed inputs because the body is always the *final* slot, never
+  // followed by a comma.
+  while (true) {
+    if (bailed_) {
+      break;
+    }
+    // CellRef-shaped tokens (e.g. `A1`, `AA10`) that sit in a binding-name
+    // slot are specifically forbidden by Excel: the name would collide with
+    // the A1 cell it spells. Detect the shape here so we emit the dedicated
+    // LetInvalidName diagnostic instead of letting the token fall into the
+    // body path (which would either parse it as a Ref or surface a
+    // non-specific arity error).
+    if (peek_kind() == TokenKind::CellRef && peek_kind_at(1) == TokenKind::Comma) {
+      const Token& bad = peek();
+      record_error_with_token(ParseErrorCode::LetInvalidName, bad.range, bad.lexeme);
+      advance();  // consume the cell-ref
+      if (peek_kind() == TokenKind::Comma) {
+        advance();  // consume the comma
+      }
+      // Parse (and discard) the would-be initialiser so siblings continue.
+      AstNode* expr = parse_expression(0, SyncContext::CallArg);
+      if (expr == nullptr) {
+        return nullptr;
+      }
+      // The LET grammar requires an odd total arity; since we dropped this
+      // pair, the final arity is still consistent: continue to the next slot.
+      if (peek_kind() == TokenKind::Comma) {
+        advance();
+        continue;
+      }
+      // No comma: the expression we just parsed was the tail; promote it
+      // to body if no bindings were valid yet.
+      if (body == nullptr && names.empty()) {
+        body = expr;
+      }
+      break;
+    }
+    const bool is_name_slot = (peek_kind() == TokenKind::Ident) && IsLetNameShape(peek().lexeme) &&
+                              !LooksLikeCellRef(peek().lexeme) && peek_kind_at(1) == TokenKind::Comma;
+    if (is_name_slot) {
+      std::string_view name;
+      // The name's source span is written via parse_let_binding_name; we do
+      // not currently attach it to the LetBinding node, but keeping the slot
+      // lets that diagnostic link land without another signature change.
+      TextRange name_range{};
+      if (!parse_let_binding_name(&name, &name_range)) {
+        (void)name_range;
+        skip_to_sync(SyncContext::CallArg);
+        if (peek_kind() == TokenKind::Comma) {
+          advance();
+        }
+        continue;
+      }
+      // parse_let_binding_name already advanced over the name; the next
+      // token is the comma guaranteed by `is_name_slot`.
+      advance();  // Comma
+      AstNode* expr = parse_expression(0, SyncContext::CallArg);
+      if (expr == nullptr) {
+        return nullptr;  // hard arena failure
+      }
+      names.push_back(name);
+      exprs.push_back(expr);
+      if (peek_kind() == TokenKind::Comma) {
+        advance();
+        continue;  // more slots follow
+      }
+      // No comma after an (name, expr) pair means this was the penultimate
+      // slot and the expr we just parsed was the tail of a well-formed LET
+      // that is missing its body. Treat as an arity error.
+      record_error_with_token(ParseErrorCode::LetWrongArity, name_tok.range, name_tok.lexeme);
+      break;
+    }
+
+    // Body slot: parse a full expression; the next token should be `)`.
+    body = parse_expression(0, SyncContext::CallArg);
+    if (body == nullptr) {
+      return nullptr;  // hard arena failure
+    }
+    if (peek_kind() == TokenKind::Comma) {
+      // Extra argument after the body (even arity). Record and recover by
+      // skipping the rest of the arglist.
+      record_error_with_token(ParseErrorCode::LetWrongArity, name_tok.range, name_tok.lexeme);
+      skip_to_sync(SyncContext::Paren);
+    }
+    break;
+  }
+
+  // At this point we expect `)`; emit diagnostics and recover if not.
+  TextRange end_range = call_start;
+  if (peek_kind() == TokenKind::RParen) {
+    const Token& rparen = advance();
+    end_range = rparen.range;
+  } else if (peek_kind() != TokenKind::Eof) {
+    record_error_with_token(ParseErrorCode::ExpectedCloseParen, call_start, name_tok.lexeme);
+  } else {
+    record_error_with_token(ParseErrorCode::ExpectedCloseParen, call_start, name_tok.lexeme);
+  }
+
+  // Validate arity: need >= 1 binding and a body.
+  if (names.empty() || body == nullptr) {
+    if (body == nullptr) {
+      record_error_with_token(ParseErrorCode::LetWrongArity, call_start, name_tok.lexeme);
+    } else if (names.empty()) {
+      record_error_with_token(ParseErrorCode::LetWrongArity, call_start, name_tok.lexeme);
+    }
+    return make_recovery_placeholder(SpanRange(call_start, end_range));
+  }
+
+  AstNode* n = make_let_binding(arena_, names.data(), exprs.data(), static_cast<std::uint32_t>(names.size()), body);
+  if (n == nullptr) {
+    return nullptr;
+  }
+  n->set_range(SpanRange(call_start, end_range));
+  return n;
+}
+
+// ---------------------------------------------------------------------------
+// LAMBDA parameters
+// ---------------------------------------------------------------------------
+
+AstNode* Parser::parse_lambda_call(const Token& name_tok) {
+  const TextRange call_start = name_tok.range;
+  advance();  // LAMBDA Ident
+  advance();  // LParen
+
+  // Collect parameter names then the body. Slot classification: each
+  // non-final slot must be a bare Ident shape that passes the same
+  // identifier rules used for LET binding names; the final slot is the
+  // body. Excel's grammar requires at least one slot total — `LAMBDA()` is
+  // an error. A single-slot form `LAMBDA(expr)` matches Mac Excel by
+  // treating `expr` as the body of a zero-parameter lambda.
+  //
+  // Parameters introduced with bracket syntax `[name]` are optional. They
+  // must be trailing (no required parameter may follow an optional one);
+  // when omitted at the call site they bind to a sentinel that ISOMITTED
+  // detects.
+  std::vector<std::string_view> params;
+  std::uint32_t optional_count = 0;
+  AstNode* body = nullptr;
+
+  // Empty arg list: LAMBDA requires the body slot.
+  if (peek_kind() == TokenKind::RParen) {
+    record_error_with_token(ParseErrorCode::LambdaEmpty, name_tok.range, name_tok.lexeme);
+    const Token& rparen_empty = advance();
+    return make_recovery_placeholder(SpanRange(call_start, rparen_empty.range));
+  }
+
+  // Slot-walk loop. Each iteration starts at the first token of the next
+  // slot. A slot is a parameter name iff it is a well-shaped Ident followed
+  // by a comma; otherwise it is the body. This matches the LET disambiguation
+  // pattern: the body is always the final slot (never followed by a comma).
+  while (true) {
+    if (bailed_) {
+      break;
+    }
+    // CellRef-shaped tokens (e.g. `A1`, `AA10`) sitting in a parameter slot
+    // collide with the A1 cell they spell; emit the dedicated diagnostic so
+    // siblings keep parsing.
+    if (peek_kind() == TokenKind::CellRef && peek_kind_at(1) == TokenKind::Comma) {
+      const Token& bad = peek();
+      record_error_with_token(ParseErrorCode::LambdaInvalidParam, bad.range, bad.lexeme);
+      advance();  // consume the cell-ref
+      if (peek_kind() == TokenKind::Comma) {
+        advance();
+      }
+      continue;
+    }
+    // Bracketed optional-parameter shape: `[name]` followed by either a
+    // comma (more slots ahead) or `)` (this was actually the body slot —
+    // a `[ref]` structured reference inside the body parses there). We
+    // only treat it as a param when the closing bracket is followed by a
+    // comma; otherwise let the body branch handle it.
+    const bool is_optional_param_slot = (peek_kind() == TokenKind::LBracket) && (peek_kind_at(1) == TokenKind::Ident) &&
+                                        IsLetNameShape(peek_at(1).lexeme) && !LooksLikeCellRef(peek_at(1).lexeme) &&
+                                        (peek_kind_at(2) == TokenKind::RBracket) &&
+                                        (peek_kind_at(3) == TokenKind::Comma);
+    const bool is_param_slot = (peek_kind() == TokenKind::Ident) && IsLetNameShape(peek().lexeme) &&
+                               !LooksLikeCellRef(peek().lexeme) && peek_kind_at(1) == TokenKind::Comma;
+    if (is_optional_param_slot || is_param_slot) {
+      const bool optional = is_optional_param_slot;
+      const Token& tok = optional ? peek_at(1) : peek();
+      const std::string_view pname = tok.lexeme;
+      // Reject duplicates within a single LAMBDA: the second occurrence
+      // would shadow the first at runtime, which is almost certainly a bug
+      // and which Excel itself rejects.
+      bool duplicate = false;
+      for (const auto& existing : params) {
+        if (strings::case_insensitive_eq(existing, pname)) {
+          duplicate = true;
+          break;
+        }
+      }
+      if (duplicate) {
+        record_error_with_token(ParseErrorCode::LambdaDuplicateParam, tok.range, tok.lexeme);
+        if (optional) {
+          advance();  // LBracket
+          advance();  // Ident
+          advance();  // RBracket
+        } else {
+          advance();  // Ident
+        }
+        if (peek_kind() == TokenKind::Comma) {
+          advance();
+        }
+        continue;
+      }
+      params.push_back(pname);
+      if (optional) {
+        ++optional_count;
+        advance();  // LBracket
+        advance();  // Ident
+        advance();  // RBracket
+        advance();  // Comma
+      } else {
+        // A required parameter is illegal once we've started accepting
+        // optional ones: Excel only allows trailing optionals.
+        if (optional_count > 0) {
+          record_error_with_token(ParseErrorCode::LambdaInvalidParam, tok.range, tok.lexeme);
+          // Treat as optional anyway so we don't lose the slot — but the
+          // diagnostic is what matters; the AST will still produce a name.
+          ++optional_count;
+        }
+        advance();  // Ident
+        advance();  // Comma
+      }
+      continue;
+    }
+    // Non-param-slot: this is either the body (final slot, followed by `)`)
+    // or a malformed param slot (not an Ident, but followed by a comma).
+    // Detect the malformed case by looking ahead: if the slot is *not* the
+    // final one (i.e. there will be a comma after the expression) and the
+    // current token is not a valid bare-Ident param shape, surface the
+    // dedicated diagnostic before parsing the slot's expression.
+    //
+    // This catches `LAMBDA(x, x+1, y)`: the middle slot is `x+1` which is
+    // not a bare Ident-Comma shape but is followed by a comma after the
+    // expression closes.
+    //
+    // We cannot know the "followed by comma after expression" answer
+    // without parsing first, so the strategy is: tentatively parse the
+    // slot as an expression; if a comma follows, we wrongly admitted a
+    // non-Ident param slot — emit the diagnostic and discard the
+    // expression. If `)` follows, the expression is the body.
+    AstNode* slot = parse_expression(0, SyncContext::CallArg);
+    if (slot == nullptr) {
+      return nullptr;  // hard arena failure
+    }
+    if (peek_kind() == TokenKind::Comma) {
+      // The slot we just parsed was not the final one, but it was not a
+      // bare-Ident param shape either: the user wrote something like
+      // `LAMBDA(x, x+1, y)` where `x+1` is illegal as a parameter name.
+      record_error_with_token(ParseErrorCode::LambdaInvalidParam, slot->range(), std::string_view{});
+      advance();  // consume the comma so the next iteration starts cleanly
+      continue;
+    }
+    // Final slot: this is the body.
+    body = slot;
+    break;
+  }
+
+  // Expect `)`; emit a diagnostic and recover otherwise.
+  TextRange end_range = call_start;
+  if (peek_kind() == TokenKind::RParen) {
+    const Token& rparen = advance();
+    end_range = rparen.range;
+  } else {
+    record_error_with_token(ParseErrorCode::ExpectedCloseParen, call_start, name_tok.lexeme);
+  }
+
+  if (body == nullptr) {
+    record_error_with_token(ParseErrorCode::LambdaEmpty, call_start, name_tok.lexeme);
+    return make_recovery_placeholder(SpanRange(call_start, end_range));
+  }
+
+  AstNode* n = make_lambda(arena_, params.empty() ? nullptr : params.data(), static_cast<std::uint32_t>(params.size()),
+                           optional_count, body);
+  if (n == nullptr) {
+    return nullptr;
+  }
+  n->set_range(SpanRange(call_start, end_range));
+  return n;
+}
+
+}  // namespace parser
+}  // namespace formulon
diff --git a/src/parser/parser_reference.cpp b/src/parser/parser_reference.cpp
index c71e4ad96..7f8ab5d79 100644
--- a/src/parser/parser_reference.cpp
+++ b/src/parser/parser_reference.cpp
@@ -1,7 +1,6 @@
 
 #include <cstdint>
 #include <string_view>
-#include <vector>
 
 #include "parser/ast.h"
 #include "parser/parse_error.h"
@@ -9,7 +8,6 @@
 #include "parser/parser_detail.h"
 #include "parser/reference.h"
 #include "parser/token.h"
-#include "utils/strings.h"
 
 namespace formulon {
 namespace parser {
@@ -22,62 +20,6 @@ using detail::kMaxExternalBookIndex;
 using detail::kMaxRow;
 using detail::SpanRange;
 
-namespace {
-
-// Returns true iff `name` starts with `[A-Za-z_\]` or any non-ASCII (UTF-8
-// continuation) byte, and continues with `[A-Za-z0-9_.?]` plus non-ASCII
-// bytes. Length must be non-zero and <= 255 bytes. This mirrors the
-// tokenizer's identifier rule (`Tokenizer::is_ident_start_byte` /
-// `is_ident_cont_byte`) and matches the identifier shape Excel accepts for
-// LET bindings and defined names, including hiragana / katakana / kanji and
-// other locale-specific scripts. The shape is still stricter than the
-// tokenizer's Ident rule because it forbids a leading ASCII digit.
-bool IsLetNameShape(std::string_view name) noexcept {
-  if (name.empty() || name.size() > 255) {
-    return false;
-  }
-  const auto first = static_cast<unsigned char>(name[0]);
-  if (!IsAsciiLetter(static_cast<char>(first)) && first != '_' && first != '\\' && first < 0x80) {
-    return false;
-  }
-  for (std::size_t i = 1; i < name.size(); ++i) {
-    const auto byte = static_cast<unsigned char>(name[i]);
-    const char c = static_cast<char>(byte);
-    const bool ok = IsAsciiLetter(c) || IsAsciiDigit(c) || c == '_' || c == '.' || c == '?' || byte >= 0x80;
-    if (!ok) {
-      return false;
-    }
-  }
-  return true;
-}
-
-// Returns true iff `name` has the shape of an A1-style cell reference
-// (`[A-Za-z]{1,3}[1-9][0-9]*`). Excel rejects such identifiers as LET
-// binding names because they would be indistinguishable from cell refs when
-// used in the body.
-bool LooksLikeCellRef(std::string_view name) noexcept {
-  std::size_t i = 0;
-  while (i < name.size() && IsAsciiLetter(name[i])) {
-    ++i;
-  }
-  const std::size_t letters = i;
-  if (letters == 0 || letters > 3) {
-    return false;
-  }
-  // First digit must not be zero so names like `A0` (not a valid ref) still
-  // go through the LET path.
-  if (i >= name.size() || name[i] < '1' || name[i] > '9') {
-    return false;
-  }
-  ++i;
-  while (i < name.size() && IsAsciiDigit(name[i])) {
-    ++i;
-  }
-  return i == name.size();
-}
-
-}  // namespace
-
 // ---------------------------------------------------------------------------
 // Cell-ref decoding
 // ---------------------------------------------------------------------------
@@ -171,338 +113,69 @@ std::uint32_t Parser::decode_column_letters(std::string_view lex, bool* col_abs)
   return v;
 }
 
-// ---------------------------------------------------------------------------
-// LET bindings
-// ---------------------------------------------------------------------------
-
-bool Parser::parse_let_binding_name(std::string_view* out_name, TextRange* out_range) {
-  // The binding-name slot accepts a single Ident token. CellRef tokens
-  // (produced for patterns that match the A1 shape) are rejected because the
-  // tokenizer already routed them away from Ident; this is the expected
-  // behaviour for names like `A1` that collide with cell refs.
-  const Token& tok = peek();
-  if (tok.kind == TokenKind::CellRef) {
-    record_error_with_token(ParseErrorCode::LetInvalidName, tok.range, tok.lexeme);
-    advance();
-    return false;
-  }
-  if (tok.kind != TokenKind::Ident) {
-    record_error_with_token(ParseErrorCode::LetInvalidName, tok.range, tok.lexeme);
-    return false;
-  }
-  if (!IsLetNameShape(tok.lexeme) || LooksLikeCellRef(tok.lexeme)) {
-    record_error_with_token(ParseErrorCode::LetInvalidName, tok.range, tok.lexeme);
-    advance();
+bool Parser::decode_full_col_endpoint(const Token& tok, Reference* out) noexcept {
+  bool col_abs = false;
+  const std::uint32_t col = decode_column_letters(tok.lexeme, &col_abs);
+  if (col == 0) {
     return false;
   }
-  *out_name = tok.lexeme;
-  *out_range = tok.range;
-  advance();
+  out->col = col - 1U;
+  out->col_abs = col_abs;
+  out->is_full_col = true;
   return true;
 }
 
-AstNode* Parser::parse_let_call(const Token& name_tok) {
-  const TextRange call_start = name_tok.range;
-  advance();  // LET Ident
-  advance();  // LParen
-
-  // Accumulate name / expr pairs until a bare expression (the body) remains.
-  std::vector<std::string_view> names;
-  std::vector<const AstNode*> exprs;
-  AstNode* body = nullptr;
-
-  // Empty arg list is an arity error but still needs recovery; we synthesise
-  // a placeholder body and return below.
-  if (peek_kind() == TokenKind::RParen) {
-    record_error_with_token(ParseErrorCode::LetWrongArity, name_tok.range, name_tok.lexeme);
-    const Token& rparen_empty = advance();
-    return make_recovery_placeholder(SpanRange(call_start, rparen_empty.range));
+bool Parser::decode_full_row_endpoint(const Token& tok, Reference* out) noexcept {
+  // The tokenizer keeps an absolute anchor's `$` in the Number lexeme.
+  std::string_view lex = tok.lexeme;
+  const bool row_abs = !lex.empty() && lex.front() == '$';
+  if (row_abs) {
+    lex.remove_prefix(1);
   }
-
-  // Slot-walk loop. At each iteration pos_ sits on the first token of the
-  // next slot. A slot is classified as a binding name when it is a lone
-  // well-shaped Ident followed by a comma (so it cannot stand as a complete
-  // expression); any other shape is the body. This works for all odd-arity
-  // well-formed inputs because the body is always the *final* slot, never
-  // followed by a comma.
-  while (true) {
-    if (bailed_) {
-      break;
-    }
-    // CellRef-shaped tokens (e.g. `A1`, `AA10`) that sit in a binding-name
-    // slot are specifically forbidden by Excel: the name would collide with
-    // the A1 cell it spells. Detect the shape here so we emit the dedicated
-    // LetInvalidName diagnostic instead of letting the token fall into the
-    // body path (which would either parse it as a Ref or surface a
-    // non-specific arity error).
-    if (peek_kind() == TokenKind::CellRef && peek_kind_at(1) == TokenKind::Comma) {
-      const Token& bad = peek();
-      record_error_with_token(ParseErrorCode::LetInvalidName, bad.range, bad.lexeme);
-      advance();  // consume the cell-ref
-      if (peek_kind() == TokenKind::Comma) {
-        advance();  // consume the comma
-      }
-      // Parse (and discard) the would-be initialiser so siblings continue.
-      AstNode* expr = parse_expression(0, SyncContext::CallArg);
-      if (expr == nullptr) {
-        return nullptr;
-      }
-      // The LET grammar requires an odd total arity; since we dropped this
-      // pair, the final arity is still consistent: continue to the next slot.
-      if (peek_kind() == TokenKind::Comma) {
-        advance();
-        continue;
-      }
-      // No comma: the expression we just parsed was the tail; promote it
-      // to body if no bindings were valid yet.
-      if (body == nullptr && names.empty()) {
-        body = expr;
-      }
-      break;
-    }
-    const bool is_name_slot = (peek_kind() == TokenKind::Ident) && IsLetNameShape(peek().lexeme) &&
-                              !LooksLikeCellRef(peek().lexeme) && peek_kind_at(1) == TokenKind::Comma;
-    if (is_name_slot) {
-      std::string_view name;
-      // The name's source span is written via parse_let_binding_name; we do
-      // not currently attach it to the LetBinding node, but keeping the slot
-      // lets that diagnostic link land without another signature change.
-      TextRange name_range{};
-      if (!parse_let_binding_name(&name, &name_range)) {
-        (void)name_range;
-        skip_to_sync(SyncContext::CallArg);
-        if (peek_kind() == TokenKind::Comma) {
-          advance();
-        }
-        continue;
-      }
-      // parse_let_binding_name already advanced over the name; the next
-      // token is the comma guaranteed by `is_name_slot`.
-      advance();  // Comma
-      AstNode* expr = parse_expression(0, SyncContext::CallArg);
-      if (expr == nullptr) {
-        return nullptr;  // hard arena failure
-      }
-      names.push_back(name);
-      exprs.push_back(expr);
-      if (peek_kind() == TokenKind::Comma) {
-        advance();
-        continue;  // more slots follow
-      }
-      // No comma after an (name, expr) pair means this was the penultimate
-      // slot and the expr we just parsed was the tail of a well-formed LET
-      // that is missing its body. Treat as an arity error.
-      record_error_with_token(ParseErrorCode::LetWrongArity, name_tok.range, name_tok.lexeme);
-      break;
-    }
-
-    // Body slot: parse a full expression; the next token should be `)`.
-    body = parse_expression(0, SyncContext::CallArg);
-    if (body == nullptr) {
-      return nullptr;  // hard arena failure
-    }
-    if (peek_kind() == TokenKind::Comma) {
-      // Extra argument after the body (even arity). Record and recover by
-      // skipping the rest of the arglist.
-      record_error_with_token(ParseErrorCode::LetWrongArity, name_tok.range, name_tok.lexeme);
-      skip_to_sync(SyncContext::Paren);
-    }
-    break;
-  }
-
-  // At this point we expect `)`; emit diagnostics and recover if not.
-  TextRange end_range = call_start;
-  if (peek_kind() == TokenKind::RParen) {
-    const Token& rparen = advance();
-    end_range = rparen.range;
-  } else if (peek_kind() != TokenKind::Eof) {
-    record_error_with_token(ParseErrorCode::ExpectedCloseParen, call_start, name_tok.lexeme);
-  } else {
-    record_error_with_token(ParseErrorCode::ExpectedCloseParen, call_start, name_tok.lexeme);
+  if (!tok.is_integer || lex.empty()) {
+    return false;
   }
-
-  // Validate arity: need >= 1 binding and a body.
-  if (names.empty() || body == nullptr) {
-    if (body == nullptr) {
-      record_error_with_token(ParseErrorCode::LetWrongArity, call_start, name_tok.lexeme);
-    } else if (names.empty()) {
-      record_error_with_token(ParseErrorCode::LetWrongArity, call_start, name_tok.lexeme);
+  for (char c : lex) {
+    if (!IsAsciiDigit(c)) {
+      return false;
     }
-    return make_recovery_placeholder(SpanRange(call_start, end_range));
   }
-
-  AstNode* n = make_let_binding(arena_, names.data(), exprs.data(), static_cast<std::uint32_t>(names.size()), body);
-  if (n == nullptr) {
-    return nullptr;
+  // Clamped so a pathological 20-digit row literal cannot wrap a
+  // `std::uint64_t` back into the valid range.
+  const std::uint64_t row = DecodeDigitRunClamped(lex, kMaxRow);
+  if (row == 0 || row > kMaxRow) {
+    return false;
   }
-  n->set_range(SpanRange(call_start, end_range));
-  return n;
+  out->row = static_cast<std::uint32_t>(row - 1U);
+  out->row_abs = row_abs;
+  out->is_full_row = true;
+  return true;
 }
 
-// ---------------------------------------------------------------------------
-// LAMBDA parameters
-// ---------------------------------------------------------------------------
-
-AstNode* Parser::parse_lambda_call(const Token& name_tok) {
-  const TextRange call_start = name_tok.range;
-  advance();  // LAMBDA Ident
-  advance();  // LParen
-
-  // Collect parameter names then the body. Slot classification: each
-  // non-final slot must be a bare Ident shape that passes the same
-  // identifier rules used for LET binding names; the final slot is the
-  // body. Excel's grammar requires at least one slot total — `LAMBDA()` is
-  // an error. A single-slot form `LAMBDA(expr)` matches Mac Excel by
-  // treating `expr` as the body of a zero-parameter lambda.
-  //
-  // Parameters introduced with bracket syntax `[name]` are optional. They
-  // must be trailing (no required parameter may follow an optional one);
-  // when omitted at the call site they bind to a sentinel that ISOMITTED
-  // detects.
-  std::vector<std::string_view> params;
-  std::uint32_t optional_count = 0;
-  AstNode* body = nullptr;
-
-  // Empty arg list: LAMBDA requires the body slot.
-  if (peek_kind() == TokenKind::RParen) {
-    record_error_with_token(ParseErrorCode::LambdaEmpty, name_tok.range, name_tok.lexeme);
-    const Token& rparen_empty = advance();
-    return make_recovery_placeholder(SpanRange(call_start, rparen_empty.range));
-  }
-
-  // Slot-walk loop. Each iteration starts at the first token of the next
-  // slot. A slot is a parameter name iff it is a well-shaped Ident followed
-  // by a comma; otherwise it is the body. This matches the LET disambiguation
-  // pattern: the body is always the final slot (never followed by a comma).
-  while (true) {
-    if (bailed_) {
-      break;
-    }
-    // CellRef-shaped tokens (e.g. `A1`, `AA10`) sitting in a parameter slot
-    // collide with the A1 cell they spell; emit the dedicated diagnostic so
-    // siblings keep parsing.
-    if (peek_kind() == TokenKind::CellRef && peek_kind_at(1) == TokenKind::Comma) {
-      const Token& bad = peek();
-      record_error_with_token(ParseErrorCode::LambdaInvalidParam, bad.range, bad.lexeme);
-      advance();  // consume the cell-ref
-      if (peek_kind() == TokenKind::Comma) {
-        advance();
-      }
-      continue;
-    }
-    // Bracketed optional-parameter shape: `[name]` followed by either a
-    // comma (more slots ahead) or `)` (this was actually the body slot —
-    // a `[ref]` structured reference inside the body parses there). We
-    // only treat it as a param when the closing bracket is followed by a
-    // comma; otherwise let the body branch handle it.
-    const bool is_optional_param_slot = (peek_kind() == TokenKind::LBracket) && (peek_kind_at(1) == TokenKind::Ident) &&
-                                        IsLetNameShape(peek_at(1).lexeme) && !LooksLikeCellRef(peek_at(1).lexeme) &&
-                                        (peek_kind_at(2) == TokenKind::RBracket) &&
-                                        (peek_kind_at(3) == TokenKind::Comma);
-    const bool is_param_slot = (peek_kind() == TokenKind::Ident) && IsLetNameShape(peek().lexeme) &&
-                               !LooksLikeCellRef(peek().lexeme) && peek_kind_at(1) == TokenKind::Comma;
-    if (is_optional_param_slot || is_param_slot) {
-      const bool optional = is_optional_param_slot;
-      const Token& tok = optional ? peek_at(1) : peek();
-      const std::string_view pname = tok.lexeme;
-      // Reject duplicates within a single LAMBDA: the second occurrence
-      // would shadow the first at runtime, which is almost certainly a bug
-      // and which Excel itself rejects.
-      bool duplicate = false;
-      for (const auto& existing : params) {
-        if (strings::case_insensitive_eq(existing, pname)) {
-          duplicate = true;
-          break;
-        }
-      }
-      if (duplicate) {
-        record_error_with_token(ParseErrorCode::LambdaDuplicateParam, tok.range, tok.lexeme);
-        if (optional) {
-          advance();  // LBracket
-          advance();  // Ident
-          advance();  // RBracket
-        } else {
-          advance();  // Ident
-        }
-        if (peek_kind() == TokenKind::Comma) {
-          advance();
-        }
-        continue;
-      }
-      params.push_back(pname);
-      if (optional) {
-        ++optional_count;
-        advance();  // LBracket
-        advance();  // Ident
-        advance();  // RBracket
-        advance();  // Comma
-      } else {
-        // A required parameter is illegal once we've started accepting
-        // optional ones: Excel only allows trailing optionals.
-        if (optional_count > 0) {
-          record_error_with_token(ParseErrorCode::LambdaInvalidParam, tok.range, tok.lexeme);
-          // Treat as optional anyway so we don't lose the slot — but the
-          // diagnostic is what matters; the AST will still produce a name.
-          ++optional_count;
-        }
-        advance();  // Ident
-        advance();  // Comma
-      }
-      continue;
-    }
-    // Non-param-slot: this is either the body (final slot, followed by `)`)
-    // or a malformed param slot (not an Ident, but followed by a comma).
-    // Detect the malformed case by looking ahead: if the slot is *not* the
-    // final one (i.e. there will be a comma after the expression) and the
-    // current token is not a valid bare-Ident param shape, surface the
-    // dedicated diagnostic before parsing the slot's expression.
-    //
-    // This catches `LAMBDA(x, x+1, y)`: the middle slot is `x+1` which is
-    // not a bare Ident-Comma shape but is followed by a comma after the
-    // expression closes.
-    //
-    // We cannot know the "followed by comma after expression" answer
-    // without parsing first, so the strategy is: tentatively parse the
-    // slot as an expression; if a comma follows, we wrongly admitted a
-    // non-Ident param slot — emit the diagnostic and discard the
-    // expression. If `)` follows, the expression is the body.
-    AstNode* slot = parse_expression(0, SyncContext::CallArg);
-    if (slot == nullptr) {
-      return nullptr;  // hard arena failure
-    }
-    if (peek_kind() == TokenKind::Comma) {
-      // The slot we just parsed was not the final one, but it was not a
-      // bare-Ident param shape either: the user wrote something like
-      // `LAMBDA(x, x+1, y)` where `x+1` is illegal as a parameter name.
-      record_error_with_token(ParseErrorCode::LambdaInvalidParam, slot->range(), std::string_view{});
-      advance();  // consume the comma so the next iteration starts cleanly
-      continue;
+AstNode* Parser::make_whole_axis_ref(const Reference& lhs, const Reference& rhs, TextRange lhs_range,
+                                     TextRange rhs_range) {
+  if (lhs.col == rhs.col && lhs.row == rhs.row) {
+    AstNode* n = make_ref(arena_, lhs);
+    if (n == nullptr) {
+      return nullptr;
     }
-    // Final slot: this is the body.
-    body = slot;
-    break;
-  }
-
-  // Expect `)`; emit a diagnostic and recover otherwise.
-  TextRange end_range = call_start;
-  if (peek_kind() == TokenKind::RParen) {
-    const Token& rparen = advance();
-    end_range = rparen.range;
-  } else {
-    record_error_with_token(ParseErrorCode::ExpectedCloseParen, call_start, name_tok.lexeme);
+    n->set_range(SpanRange(lhs_range, rhs_range));
+    return n;
   }
-
-  if (body == nullptr) {
-    record_error_with_token(ParseErrorCode::LambdaEmpty, call_start, name_tok.lexeme);
-    return make_recovery_placeholder(SpanRange(call_start, end_range));
+  // The evaluator's `expand_range` clamps the unbounded axis to the sheet's
+  // used range, and inherits a sheet qualifier on the left endpoint.
+  AstNode* lhs_node = make_ref(arena_, lhs);
+  AstNode* rhs_node = make_ref(arena_, rhs);
+  if (lhs_node == nullptr || rhs_node == nullptr) {
+    return nullptr;
   }
-
-  AstNode* n = make_lambda(arena_, params.empty() ? nullptr : params.data(), static_cast<std::uint32_t>(params.size()),
-                           optional_count, body);
+  lhs_node->set_range(lhs_range);
+  rhs_node->set_range(rhs_range);
+  AstNode* n = make_range_op(arena_, lhs_node, rhs_node);
   if (n == nullptr) {
     return nullptr;
   }
-  n->set_range(SpanRange(call_start, end_range));
+  n->set_range(SpanRange(lhs_range, rhs_range));
   return n;
 }
 
@@ -628,131 +301,19 @@ AstNode* Parser::parse_sheet_qualified_ref(std::string_view sheet, bool quoted,
       record_error_with_token(ParseErrorCode::InvalidReference, peek().range, peek().lexeme);
       return nullptr;
     }
-    if (peek_kind() == TokenKind::Ident && peek_kind_at(1) == TokenKind::Colon && peek_kind_at(2) == TokenKind::Ident) {
-      const Token& lhs = peek();
-      const Token& rhs = peek_at(2);
-      bool lhs_abs = false;
-      bool rhs_abs = false;
-      const std::uint32_t lhs_col = decode_column_letters(lhs.lexeme, &lhs_abs);
-      const std::uint32_t rhs_col = decode_column_letters(rhs.lexeme, &rhs_abs);
-      if (lhs_col == 0 || rhs_col == 0) {
-        record_error_with_token(ParseErrorCode::InvalidReference, lhs.range, lhs.lexeme);
-        return nullptr;
-      }
-      advance();
-      advance();
-      advance();
-      Reference lhs_ref;
-      lhs_ref.col = lhs_col - 1U;
-      lhs_ref.col_abs = lhs_abs;
-      lhs_ref.is_full_col = true;
-      Reference rhs_ref;
-      rhs_ref.col = rhs_col - 1U;
-      rhs_ref.col_abs = rhs_abs;
-      rhs_ref.is_full_col = true;
-      if (lhs_col == rhs_col) {
-        AstNode* n = make_ref3d(arena_, sheet_begin, sheet_end, lhs_ref);
-        if (n == nullptr) {
-          return nullptr;
-        }
-        n->set_range(SpanRange(sheet_range, rhs.range));
-        return n;
-      }
-      AstNode* n = make_ref3d_range(arena_, sheet_begin, sheet_end, lhs_ref, rhs_ref);
-      if (n == nullptr) {
-        return nullptr;
-      }
-      n->set_range(SpanRange(sheet_range, rhs.range));
-      return n;
-    }
-    if (peek_kind() == TokenKind::Number && peek_kind_at(1) == TokenKind::Colon &&
-        peek_kind_at(2) == TokenKind::Number) {
-      const Token& lhs = peek();
-      const Token& rhs = peek_at(2);
-      auto decode_row = [](std::string_view lex, std::uint32_t* out) -> bool {
-        const bool row_abs = !lex.empty() && lex.front() == '$';
-        if (row_abs) {
-          lex.remove_prefix(1);
-        }
-        if (lex.empty()) {
-          return false;
-        }
-        for (char c : lex) {
-          if (!IsAsciiDigit(c)) {
-            return false;
-          }
-        }
-        const std::uint64_t row = DecodeDigitRunClamped(lex, kMaxRow);
-        if (row == 0 || row > kMaxRow) {
-          return false;
-        }
-        *out = static_cast<std::uint32_t>(row - 1U);
-        return true;
-      };
-      std::uint32_t lhs_row = 0;
-      std::uint32_t rhs_row = 0;
-      if (!lhs.is_integer || !rhs.is_integer || !decode_row(lhs.lexeme, &lhs_row) ||
-          !decode_row(rhs.lexeme, &rhs_row)) {
-        record_error_with_token(ParseErrorCode::InvalidReference, lhs.range, lhs.lexeme);
-        return nullptr;
-      }
-      advance();
-      advance();
-      advance();
-      Reference lhs_ref;
-      lhs_ref.row = lhs_row;
-      lhs_ref.row_abs = !lhs.lexeme.empty() && lhs.lexeme.front() == '$';
-      lhs_ref.is_full_row = true;
-      Reference rhs_ref;
-      rhs_ref.row = rhs_row;
-      rhs_ref.row_abs = !rhs.lexeme.empty() && rhs.lexeme.front() == '$';
-      rhs_ref.is_full_row = true;
-      if (lhs_row == rhs_row) {
-        AstNode* n = make_ref3d(arena_, sheet_begin, sheet_end, lhs_ref);
-        if (n == nullptr) {
-          return nullptr;
-        }
-        n->set_range(SpanRange(sheet_range, rhs.range));
-        return n;
-      }
-      AstNode* n = make_ref3d_range(arena_, sheet_begin, sheet_end, lhs_ref, rhs_ref);
-      if (n == nullptr) {
-        return nullptr;
-      }
-      n->set_range(SpanRange(sheet_range, rhs.range));
-      return n;
-    }
-    if (peek_kind() != TokenKind::CellRef) {
-      record_error_with_token(ParseErrorCode::InvalidReference, peek().range, peek().lexeme);
-      return nullptr;
-    }
-    const Token& cell = advance();
-    Reference r;
-    if (!decode_cellref_lexeme(cell.lexeme, &r)) {
-      record_error_with_token(ParseErrorCode::InvalidReference, cell.range, cell.lexeme);
+    Reference first;
+    Reference last;
+    bool is_range = false;
+    TextRange tail_range;
+    if (!parse_3d_ref_tail(&first, &last, &is_range, &tail_range)) {
       return nullptr;
     }
-    // Range tail (`'Data:S2'!A1:B2`): a 3-D range over the sheet span.
-    if (peek_kind() == TokenKind::Colon && peek_kind_at(1) == TokenKind::CellRef) {
-      advance();  // Colon
-      const Token& tail = advance();
-      Reference r2;
-      if (!decode_cellref_lexeme(tail.lexeme, &r2)) {
-        record_error_with_token(ParseErrorCode::InvalidReference, tail.range, tail.lexeme);
-        return nullptr;
-      }
-      AstNode* range_node = make_ref3d_range(arena_, sheet_begin, sheet_end, r, r2);
-      if (range_node == nullptr) {
-        return nullptr;
-      }
-      range_node->set_range(SpanRange(sheet_range, tail.range));
-      return range_node;
-    }
-    AstNode* n = make_ref3d(arena_, sheet_begin, sheet_end, r);
+    AstNode* n = is_range ? make_ref3d_range(arena_, sheet_begin, sheet_end, first, last)
+                          : make_ref3d(arena_, sheet_begin, sheet_end, first);
     if (n == nullptr) {
       return nullptr;
     }
-    n->set_range(SpanRange(sheet_range, cell.range));
+    n->set_range(SpanRange(sheet_range, tail_range));
     return n;
   }
 
@@ -795,127 +356,30 @@ AstNode* Parser::parse_sheet_qualified_ref(std::string_view sheet, bool quoted,
     n->set_range(SpanRange(sheet_range, cell.range));
     return n;
   }
-  if (k == TokenKind::Ident && peek_kind_at(1) == TokenKind::Colon && peek_kind_at(2) == TokenKind::Ident) {
+  // `Sheet1!A:C` / `Sheet1!1:3`. The sheet qualifier stays on the left
+  // endpoint, matching how `Sheet1!A1:B2` parses. Columns that fail to
+  // decode fall through to the defined-name case below.
+  const bool col_pair =
+      k == TokenKind::Ident && peek_kind_at(1) == TokenKind::Colon && peek_kind_at(2) == TokenKind::Ident;
+  const bool row_pair =
+      k == TokenKind::Number && peek_kind_at(1) == TokenKind::Colon && peek_kind_at(2) == TokenKind::Number;
+  if (col_pair || row_pair) {
     const Token& lhs_tok = peek();
     const Token& rhs_tok = peek_at(2);
-    bool lhs_abs = false;
-    bool rhs_abs = false;
-    const std::uint32_t lhs_col = decode_column_letters(lhs_tok.lexeme, &lhs_abs);
-    const std::uint32_t rhs_col = decode_column_letters(rhs_tok.lexeme, &rhs_abs);
-    if (lhs_col != 0 && rhs_col != 0) {
-      const TextRange end_range = rhs_tok.range;
+    Reference lhs_ref;
+    Reference rhs_ref;
+    const bool decoded =
+        col_pair ? decode_full_col_endpoint(lhs_tok, &lhs_ref) && decode_full_col_endpoint(rhs_tok, &rhs_ref)
+                 : decode_full_row_endpoint(lhs_tok, &lhs_ref) && decode_full_row_endpoint(rhs_tok, &rhs_ref);
+    if (decoded) {
+      const TextRange lhs_range = SpanRange(sheet_range, lhs_tok.range);
+      const TextRange rhs_range = rhs_tok.range;
       advance();
       advance();
       advance();
-      Reference lhs_ref;
-      lhs_ref.col = lhs_col - 1;
-      lhs_ref.col_abs = lhs_abs;
-      lhs_ref.is_full_col = true;
       lhs_ref.sheet = sheet;
       lhs_ref.sheet_quoted = quoted;
-      if (lhs_col == rhs_col) {
-        // `Sheet1!A:A`: a single whole-column Ref.
-        AstNode* n = make_ref(arena_, lhs_ref);
-        if (n == nullptr) {
-          return nullptr;
-        }
-        n->set_range(SpanRange(sheet_range, end_range));
-        return n;
-      }
-      // `Sheet1!A:C`: a range spanning two whole-column Refs. The sheet
-      // qualifier stays on the left endpoint, matching how `Sheet1!A1:B2`
-      // parses; `expand_range` inherits it for the whole rectangle.
-      Reference rhs_ref;
-      rhs_ref.col = rhs_col - 1;
-      rhs_ref.col_abs = rhs_abs;
-      rhs_ref.is_full_col = true;
-      AstNode* lhs_node = make_ref(arena_, lhs_ref);
-      AstNode* rhs_node = make_ref(arena_, rhs_ref);
-      if (lhs_node == nullptr || rhs_node == nullptr) {
-        return nullptr;
-      }
-      lhs_node->set_range(SpanRange(sheet_range, lhs_tok.range));
-      rhs_node->set_range(rhs_tok.range);
-      AstNode* n = make_range_op(arena_, lhs_node, rhs_node);
-      if (n == nullptr) {
-        return nullptr;
-      }
-      n->set_range(SpanRange(sheet_range, end_range));
-      return n;
-    }
-  }
-  if (k == TokenKind::Number && peek_kind_at(1) == TokenKind::Colon && peek_kind_at(2) == TokenKind::Number) {
-    const Token& lhs_tok = peek();
-    const Token& rhs_tok = peek_at(2);
-    // Each endpoint may carry a leading `$` (absolute row anchor); the
-    // tokenizer keeps the `$` in the Number lexeme, so strip it here and
-    // record the row_abs flag. `DecodeDigitRunClamped` stops accumulating
-    // once past `kMaxRow`, so a pathological 20-digit row literal cannot
-    // wrap a `std::uint64_t` back into the valid range.
-    auto decode_row = [](std::string_view lex, bool* row_abs, std::uint64_t* out_row) -> bool {
-      *row_abs = false;
-      if (!lex.empty() && lex.front() == '$') {
-        *row_abs = true;
-        lex.remove_prefix(1);
-      }
-      if (lex.empty()) {
-        return false;
-      }
-      for (char c : lex) {
-        if (!IsAsciiDigit(c)) {
-          return false;
-        }
-      }
-      *out_row = DecodeDigitRunClamped(lex, kMaxRow);
-      return true;
-    };
-    bool lhs_abs = false;
-    bool rhs_abs = false;
-    std::uint64_t lhs_row = 0;
-    std::uint64_t rhs_row = 0;
-    if (lhs_tok.is_integer && rhs_tok.is_integer && decode_row(lhs_tok.lexeme, &lhs_abs, &lhs_row) &&
-        decode_row(rhs_tok.lexeme, &rhs_abs, &rhs_row) && lhs_row != 0 && rhs_row != 0 && lhs_row <= kMaxRow &&
-        rhs_row <= kMaxRow) {
-      {
-        const TextRange end_range = rhs_tok.range;
-        advance();
-        advance();
-        advance();
-        Reference lhs_ref;
-        lhs_ref.row = static_cast<std::uint32_t>(lhs_row - 1);
-        lhs_ref.row_abs = lhs_abs;
-        lhs_ref.is_full_row = true;
-        lhs_ref.sheet = sheet;
-        lhs_ref.sheet_quoted = quoted;
-        if (lhs_row == rhs_row) {
-          // `Sheet1!1:1`: a single whole-row Ref.
-          AstNode* n = make_ref(arena_, lhs_ref);
-          if (n == nullptr) {
-            return nullptr;
-          }
-          n->set_range(SpanRange(sheet_range, end_range));
-          return n;
-        }
-        // `Sheet1!1:3`: a range spanning two whole-row Refs. The sheet
-        // qualifier stays on the left endpoint; `expand_range` inherits it.
-        Reference rhs_ref;
-        rhs_ref.row = static_cast<std::uint32_t>(rhs_row - 1);
-        rhs_ref.row_abs = rhs_abs;
-        rhs_ref.is_full_row = true;
-        AstNode* lhs_node = make_ref(arena_, lhs_ref);
-        AstNode* rhs_node = make_ref(arena_, rhs_ref);
-        if (lhs_node == nullptr || rhs_node == nullptr) {
-          return nullptr;
-        }
-        lhs_node->set_range(SpanRange(sheet_range, lhs_tok.range));
-        rhs_node->set_range(rhs_tok.range);
-        AstNode* n = make_range_op(arena_, lhs_node, rhs_node);
-        if (n == nullptr) {
-          return nullptr;
-        }
-        n->set_range(SpanRange(sheet_range, end_range));
-        return n;
-      }
+      return make_whole_axis_ref(lhs_ref, rhs_ref, lhs_range, rhs_range);
     }
   }
   if (k == TokenKind::Ident) {
@@ -935,6 +399,54 @@ AstNode* Parser::parse_sheet_qualified_ref(std::string_view sheet, bool quoted,
 // 3-D references
 // ---------------------------------------------------------------------------
 
+bool Parser::parse_3d_ref_tail(Reference* first, Reference* last, bool* is_range, TextRange* tail_range) {
+  // Whole references are represented with the same flags as their single-
+  // sheet counterparts; evaluation then expands each sheet in the span to
+  // that sheet's populated extent.
+  *is_range = false;
+  if (peek_kind() == TokenKind::CellRef) {
+    const Token& cell = advance();
+    *tail_range = cell.range;
+    if (!decode_cellref_lexeme(cell.lexeme, first)) {
+      record_error_with_token(ParseErrorCode::InvalidReference, cell.range, cell.lexeme);
+      return false;
+    }
+    if (peek_kind() == TokenKind::Colon && peek_kind_at(1) == TokenKind::CellRef) {
+      advance();  // Colon
+      const Token& tail = advance();
+      *tail_range = tail.range;
+      if (!decode_cellref_lexeme(tail.lexeme, last)) {
+        record_error_with_token(ParseErrorCode::InvalidReference, tail.range, tail.lexeme);
+        return false;
+      }
+      *is_range = true;
+    }
+    return true;
+  }
+  const bool col_pair =
+      peek_kind() == TokenKind::Ident && peek_kind_at(1) == TokenKind::Colon && peek_kind_at(2) == TokenKind::Ident;
+  const bool row_pair =
+      peek_kind() == TokenKind::Number && peek_kind_at(1) == TokenKind::Colon && peek_kind_at(2) == TokenKind::Number;
+  if (!col_pair && !row_pair) {
+    record_error_with_token(ParseErrorCode::InvalidReference, peek().range, peek().lexeme);
+    return false;
+  }
+  const Token& lhs = peek();
+  const Token& rhs = peek_at(2);
+  const bool decoded = col_pair ? decode_full_col_endpoint(lhs, first) && decode_full_col_endpoint(rhs, last)
+                                : decode_full_row_endpoint(lhs, first) && decode_full_row_endpoint(rhs, last);
+  if (!decoded) {
+    record_error_with_token(ParseErrorCode::InvalidReference, lhs.range, lhs.lexeme);
+    return false;
+  }
+  *tail_range = rhs.range;
+  advance();
+  advance();
+  advance();
+  *is_range = first->col != last->col || first->row != last->row;
+  return true;
+}
+
 AstNode* Parser::parse_3d_ref(std::string_view sheet1, TextRange sheet1_range) {
   // The caller guarantees the current token is `Colon`, the next is an
   // `Ident` / `SheetName`, and the one after that is `Bang`.
@@ -949,96 +461,11 @@ AstNode* Parser::parse_3d_ref(std::string_view sheet1, TextRange sheet1_range) {
   advance();  // second sheet name
   advance();  // Bang
 
-  // The tail can be a cell, a whole column (`A:A`), or a whole row (`1:1`).
-  // Whole references are represented with the same flags as their single-
-  // sheet counterparts; evaluation then expands each sheet in the span to
-  // that sheet's populated extent.
   Reference r;
   Reference r2;
   bool has_range_tail = false;
   TextRange tail_range;
-  if (peek_kind() == TokenKind::CellRef) {
-    const Token& cell = advance();
-    tail_range = cell.range;
-    if (!decode_cellref_lexeme(cell.lexeme, &r)) {
-      record_error_with_token(ParseErrorCode::InvalidReference, cell.range, cell.lexeme);
-      return nullptr;
-    }
-    if (peek_kind() == TokenKind::Colon && peek_kind_at(1) == TokenKind::CellRef) {
-      advance();  // Colon
-      const Token& tail = advance();
-      tail_range = tail.range;
-      if (!decode_cellref_lexeme(tail.lexeme, &r2)) {
-        record_error_with_token(ParseErrorCode::InvalidReference, tail.range, tail.lexeme);
-        return nullptr;
-      }
-      has_range_tail = true;
-    }
-  } else if (peek_kind() == TokenKind::Ident && peek_kind_at(1) == TokenKind::Colon &&
-             peek_kind_at(2) == TokenKind::Ident) {
-    const Token& lhs = peek();
-    const Token& rhs = peek_at(2);
-    bool lhs_abs = false;
-    bool rhs_abs = false;
-    const std::uint32_t lhs_col = decode_column_letters(lhs.lexeme, &lhs_abs);
-    const std::uint32_t rhs_col = decode_column_letters(rhs.lexeme, &rhs_abs);
-    if (lhs_col == 0 || rhs_col == 0) {
-      record_error_with_token(ParseErrorCode::InvalidReference, lhs.range, lhs.lexeme);
-      return nullptr;
-    }
-    advance();
-    advance();
-    advance();
-    tail_range = rhs.range;
-    r.col = lhs_col - 1U;
-    r.col_abs = lhs_abs;
-    r.is_full_col = true;
-    r2.col = rhs_col - 1U;
-    r2.col_abs = rhs_abs;
-    r2.is_full_col = true;
-    has_range_tail = lhs_col != rhs_col;
-  } else if (peek_kind() == TokenKind::Number && peek_kind_at(1) == TokenKind::Colon &&
-             peek_kind_at(2) == TokenKind::Number) {
-    const Token& lhs = peek();
-    const Token& rhs = peek_at(2);
-    auto decode_row = [](std::string_view lex, std::uint32_t* out) -> bool {
-      if (!lex.empty() && lex.front() == '$') {
-        lex.remove_prefix(1);
-      }
-      if (lex.empty()) {
-        return false;
-      }
-      for (char c : lex) {
-        if (!IsAsciiDigit(c)) {
-          return false;
-        }
-      }
-      const std::uint64_t row = DecodeDigitRunClamped(lex, kMaxRow);
-      if (row == 0 || row > kMaxRow) {
-        return false;
-      }
-      *out = static_cast<std::uint32_t>(row - 1U);
-      return true;
-    };
-    std::uint32_t lhs_row = 0;
-    std::uint32_t rhs_row = 0;
-    if (!lhs.is_integer || !rhs.is_integer || !decode_row(lhs.lexeme, &lhs_row) || !decode_row(rhs.lexeme, &rhs_row)) {
-      record_error_with_token(ParseErrorCode::InvalidReference, lhs.range, lhs.lexeme);
-      return nullptr;
-    }
-    advance();
-    advance();
-    advance();
-    tail_range = rhs.range;
-    r.row = lhs_row;
-    r.row_abs = !lhs.lexeme.empty() && lhs.lexeme.front() == '$';
-    r.is_full_row = true;
-    r2.row = rhs_row;
-    r2.row_abs = !rhs.lexeme.empty() && rhs.lexeme.front() == '$';
-    r2.is_full_row = true;
-    has_range_tail = lhs_row != rhs_row;
-  } else {
-    record_error_with_token(ParseErrorCode::InvalidReference, peek().range, peek().lexeme);
+  if (!parse_3d_ref_tail(&r, &r2, &has_range_tail, &tail_range)) {
     return nullptr;
   }
   // Range tail (`Sheet1:Sheet2!A1:B2`): a 3-D range over the sheet span,
diff --git a/src/parser/reference.cpp b/src/parser/reference.cpp
new file mode 100644
index 000000000..f78e6660e
--- /dev/null
+++ b/src/parser/reference.cpp
@@ -0,0 +1,117 @@
+//
+// Canonical A1 text for a `Reference`; the contract is declared in
+// `parser/reference.h`.
+
+#include "parser/reference.h"
+
+#include <cstddef>
+#include <string>
+#include <string_view>
+
+#include "utils/a1_column.h"
+#include "utils/expected.h"  // FM_CHECK
+#include "utils/strings.h"
+
+namespace formulon {
+namespace parser {
+
+// ---------------------------------------------------------------------------
+// Reference helper
+// ---------------------------------------------------------------------------
+
+bool sheet_name_needs_quoting(std::string_view name) noexcept {
+  if (name.empty()) {
+    return true;
+  }
+  // A bare sheet name cannot open with a digit: the tokenizer reads the run
+  // as a numeric literal and never reaches the `!`, so `3Q!A1` is not a
+  // reference at all. Quoting is the only way to write such a name.
+  if (name.front() >= '0' && name.front() <= '9') {
+    return true;
+  }
+  // A sheet named TRUE/FALSE (any ASCII case) tokenizes as a Bool literal
+  // before the `!` is ever consulted, so `TRUE!A1` re-parses as `(bool
+  // true)` followed by a dangling `!`. Quoting is the only unambiguous form.
+  if (strings::case_insensitive_eq(name, "TRUE") || strings::case_insensitive_eq(name, "FALSE")) {
+    return true;
+  }
+
+  std::size_t i = 0;
+  while (i < name.size() && ((name[i] >= 'A' && name[i] <= 'Z') || (name[i] >= 'a' && name[i] <= 'z'))) {
+    ++i;
+  }
+  const std::size_t letters = i;
+  const bool cell_ref_prefix = letters >= 1 && letters <= 3 && i < name.size() && name[i] >= '1' && name[i] <= '9';
+  for (char c : name) {
+    const bool bare_name_char =
+        (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '_' || c == '.';
+    if (!bare_name_char) {
+      return true;
+    }
+  }
+  if (!cell_ref_prefix) {
+    return false;
+  }
+  ++i;
+  while (i < name.size() && name[i] >= '0' && name[i] <= '9') {
+    ++i;
+  }
+  return i == name.size();
+}
+
+std::string format_a1(const Reference& r) {
+  FM_CHECK(!(r.is_full_col && r.is_full_row), "format_a1: is_full_col and is_full_row must not both be set");
+  std::string out;
+  if (!r.sheet.empty()) {
+    if (r.sheet_quoted || sheet_name_needs_quoting(r.sheet)) {
+      out.push_back('\'');
+      // Escape any embedded single quotes by doubling them.
+      for (char c : r.sheet) {
+        if (c == '\'') {
+          out.push_back('\'');
+        }
+        out.push_back(c);
+      }
+      out.push_back('\'');
+    } else {
+      out.append(r.sheet);
+    }
+    out.push_back('!');
+  }
+  if (r.is_full_col) {
+    if (r.col_abs) {
+      out.push_back('$');
+    }
+    FM_CHECK(a1::append_column_letters(out, r.col), "reference column is outside Excel's grid");
+    out.push_back(':');
+    if (r.col_abs) {
+      out.push_back('$');
+    }
+    FM_CHECK(a1::append_column_letters(out, r.col), "reference column is outside Excel's grid");
+    return out;
+  }
+  if (r.is_full_row) {
+    if (r.row_abs) {
+      out.push_back('$');
+    }
+    out.append(std::to_string(r.row + 1));
+    out.push_back(':');
+    if (r.row_abs) {
+      out.push_back('$');
+    }
+    out.append(std::to_string(r.row + 1));
+    return out;
+  }
+  if (r.col_abs) {
+    out.push_back('$');
+  }
+  FM_CHECK(a1::append_column_letters(out, r.col), "reference column is outside Excel's grid");
+  if (r.row_abs) {
+    out.push_back('$');
+  }
+  out.append(std::to_string(r.row + 1));
+  return out;
+}
+
+}  // namespace parser
+}  // namespace formulon
diff --git a/src/parser/tokenizer.cpp b/src/parser/tokenizer.cpp
index 15dad9858..4c5f0349b 100644
--- a/src/parser/tokenizer.cpp
+++ b/src/parser/tokenizer.cpp
@@ -398,7 +398,7 @@ const std::vector<Token>& Tokenizer::tokens() {
     // Dispatch on the leading byte.
     switch (c) {
       case '"':
-        scan_string();
+        scan_quoted('"', TokenKind::String, LexerErrorCode::UnterminatedString);
         continue;
       case '\'':
         // Inside a bracket an apostrophe is the ECMA-376 18.5.1.10
@@ -406,7 +406,7 @@ const std::vector<Token>& Tokenizer::tokens() {
         if (bracket_depth_ > 0) {
           scan_structured_ref_escape();
         } else {
-          scan_quoted_sheet_name();
+          scan_quoted('\'', TokenKind::SheetName, LexerErrorCode::UnterminatedSheetQuote);
         }
         continue;
       case '#':
@@ -717,19 +717,19 @@ void Tokenizer::scan_whitespace() {
   emit(TokenKind::Whitespace, start);
 }
 
-void Tokenizer::scan_string() {
+void Tokenizer::scan_quoted(char quote, TokenKind kind, LexerErrorCode unterminated) {
   const std::size_t start = byte_pos_;
   mark_start();
-  advance_one();  // consume leading '"'.
+  advance_one();  // consume the opening quote.
 
   std::string buf;
   bool terminated = false;
   while (byte_pos_ < source_.size()) {
     const char ch = source_[byte_pos_];
-    if (ch == '"') {
+    if (ch == quote) {
       // Doubled quote escape.
-      if (byte_pos_ + 1 < source_.size() && source_[byte_pos_ + 1] == '"') {
-        buf.push_back('"');
+      if (byte_pos_ + 1 < source_.size() && source_[byte_pos_ + 1] == quote) {
+        buf.push_back(quote);
         advance_one();
         advance_one();
         continue;
@@ -741,7 +741,7 @@ void Tokenizer::scan_string() {
     }
     const CodepointInfo info = peek_codepoint(byte_pos_);
     if (!info.valid) {
-      // Invalid UTF-8 inside a string: append the raw byte and advance.
+      // Invalid UTF-8 inside the quotes: append the raw byte and advance.
       buf.push_back(ch);
       advance_one();
       continue;
@@ -751,7 +751,7 @@ void Tokenizer::scan_string() {
   }
 
   Token t;
-  t.kind = TokenKind::String;
+  t.kind = kind;
   t.range = make_range();
   t.lexeme = std::string_view(source_.data() + start, byte_pos_ - start);
   // Intern the resolved payload into the arena so the view outlives `buf`.
@@ -759,49 +759,7 @@ void Tokenizer::scan_string() {
   tokens_.push_back(t);
 
   if (!terminated) {
-    record_error(LexerErrorCode::UnterminatedString, start);
-  }
-}
-
-void Tokenizer::scan_quoted_sheet_name() {
-  const std::size_t start = byte_pos_;
-  mark_start();
-  advance_one();  // consume leading '.
-
-  std::string buf;
-  bool terminated = false;
-  while (byte_pos_ < source_.size()) {
-    const char ch = source_[byte_pos_];
-    if (ch == '\'') {
-      if (byte_pos_ + 1 < source_.size() && source_[byte_pos_ + 1] == '\'') {
-        buf.push_back('\'');
-        advance_one();
-        advance_one();
-        continue;
-      }
-      advance_one();
-      terminated = true;
-      break;
-    }
-    const CodepointInfo info = peek_codepoint(byte_pos_);
-    if (!info.valid) {
-      buf.push_back(ch);
-      advance_one();
-      continue;
-    }
-    buf.append(source_.data() + byte_pos_, info.byte_len);
-    advance_one();
-  }
-
-  Token t;
-  t.kind = TokenKind::SheetName;
-  t.range = make_range();
-  t.lexeme = std::string_view(source_.data() + start, byte_pos_ - start);
-  t.text = arena_.intern(std::string_view(buf.data(), buf.size()));
-  tokens_.push_back(t);
-
-  if (!terminated) {
-    record_error(LexerErrorCode::UnterminatedSheetQuote, start);
+    record_error(unterminated, start);
   }
 }
 
diff --git a/src/parser/tokenizer.h b/src/parser/tokenizer.h
index 6987a62d6..d068f68b3 100644
--- a/src/parser/tokenizer.h
+++ b/src/parser/tokenizer.h
@@ -128,8 +128,9 @@ class Tokenizer {
   // Per-kind scanners. Each assumes `byte_pos_` points at the first byte of
   // a token matching its expected prefix.
   void scan_whitespace();
-  void scan_string();
-  void scan_quoted_sheet_name();
+  // Scans a `quote`-delimited run with doubled-quote escapes: a string
+  // literal for `"`, a quoted sheet name for `'`.
+  void scan_quoted(char quote, TokenKind kind, LexerErrorCode unterminated);
   // Consumes an apostrophe inside `[...]` together with the codepoint it
   // escapes (`'#`, `''`, `'[`, `']`) as one `Ident` token, so an escaped
   // bracket never reaches the parser as bracket punctuation.
diff --git a/src/pivot/aggregator.cpp b/src/pivot/aggregator.cpp
index 263e28317..bd5395022 100644
--- a/src/pivot/aggregator.cpp
+++ b/src/pivot/aggregator.cpp
@@ -8,6 +8,7 @@
 #include <optional>
 #include <vector>
 
+#include "numeric_aggregate_kernels.h"
 #include "pivot/pivot_cache.h"
 #include "pivot/pivot_types.h"
 #include "pivot/record_access.h"
@@ -49,14 +50,10 @@ struct ArithmeticSummary {
   double min = std::numeric_limits<double>::infinity();
   double max = -std::numeric_limits<double>::infinity();
   std::size_t count = 0;
-  std::vector<double> samples;
 };
 
-ArithmeticSummary summarize_arithmetic(const std::vector<Value>& values, bool keep_samples = false) {
+ArithmeticSummary summarize_arithmetic(const std::vector<Value>& values) {
   ArithmeticSummary summary;
-  if (keep_samples) {
-    summary.samples.reserve(values.size());
-  }
   for (const auto& v : values) {
     double x = 0.0;
     if (!coerce_arithmetic(v, x)) {
@@ -67,13 +64,30 @@ ArithmeticSummary summarize_arithmetic(const std::vector<Value>& values, bool ke
     summary.min = (summary.count == 0 || x < summary.min) ? x : summary.min;
     summary.max = (summary.count == 0 || x > summary.max) ? x : summary.max;
     ++summary.count;
-    if (keep_samples) {
-      summary.samples.push_back(x);
-    }
   }
   return summary;
 }
 
+std::optional<double> numeric_view_get(const void* context, std::size_t index) {
+  const auto& values = *static_cast<const std::vector<Value>*>(context);
+  double number = 0.0;
+  if (!coerce_arithmetic(values[index], number)) {
+    return std::nullopt;
+  }
+  return number;
+}
+
+numeric_aggregate_kernels::NumericInputView numeric_view(const std::vector<Value>& values) {
+  return numeric_aggregate_kernels::NumericInputView{&values, values.size(), &numeric_view_get};
+}
+
+Value lift_kernel_result(Expected<double, ErrorCode> result) {
+  if (!result) {
+    return Value::error(result.error());
+  }
+  return Value::number(result.value());
+}
+
 Value AggregateSum(const std::vector<Value>& values) {
   if (const Value* err = first_error(values); err != nullptr) {
     return *err;
@@ -120,15 +134,7 @@ Value AggregateAverage(const std::vector<Value>& values) {
   if (const Value* err = first_error(values); err != nullptr) {
     return *err;
   }
-  const ArithmeticSummary summary = summarize_arithmetic(values);
-  if (summary.count == 0) {
-    return Value::error(ErrorCode::Div0);
-  }
-  const double avg = summary.sum / static_cast<double>(summary.count);
-  if (std::isnan(avg) || std::isinf(avg)) {
-    return Value::error(ErrorCode::Num);
-  }
-  return Value::number(avg);
+  return lift_kernel_result(numeric_aggregate_kernels::run_average(numeric_view(values)));
 }
 
 Value AggregateMax(const std::vector<Value>& values) {
@@ -156,36 +162,12 @@ Value AggregateMin(const std::vector<Value>& values) {
   return Value::number(min);
 }
 
-// Two-pass variance computation. Mirrors `VAR.S` / `VAR.P` from
-// `src/eval/builtins/stats.cpp`: collect numerics (booleans coerce as
-// 0/1, text and blanks are ignored), then compute mean and sum of
-// squared deviations. `population` controls the divisor: when true, n;
-// otherwise n - 1. The `min_n` guard rejects samples too small for the
-// chosen variant (n < 2 for sample, n < 1 for population) with
-// `#DIV/0!`, matching Excel's pivot behaviour. Errors in the input
-// dominate (handled by the caller's `first_error` short-circuit).
 Value variance_helper(const std::vector<Value>& values, bool population) {
   if (const Value* err = first_error(values); err != nullptr) {
     return *err;
   }
-  const ArithmeticSummary summary = summarize_arithmetic(values, /*keep_samples=*/true);
-  const std::vector<double>& xs = summary.samples;
-  const std::size_t min_n = population ? 1u : 2u;
-  if (xs.size() < min_n) {
-    return Value::error(ErrorCode::Div0);
-  }
-  const double mean = summary.sum / static_cast<double>(xs.size());
-  double ss = 0.0;
-  for (double x : xs) {
-    const double d = x - mean;
-    ss += d * d;
-  }
-  const double divisor = population ? static_cast<double>(xs.size()) : static_cast<double>(xs.size() - 1u);
-  const double r = ss / divisor;
-  if (std::isnan(r) || std::isinf(r)) {
-    return Value::error(ErrorCode::Num);
-  }
-  return Value::number(r);
+  // Booleans count as 0/1, text and blanks are skipped; too few values yield #DIV/0! as in Excel's pivot.
+  return lift_kernel_result(numeric_aggregate_kernels::run_variance(numeric_view(values), !population));
 }
 
 Value AggregateVar(const std::vector<Value>& values) {
@@ -196,28 +178,19 @@ Value AggregateVarP(const std::vector<Value>& values) {
   return variance_helper(values, /*population=*/true);
 }
 
-Value AggregateStdDev(const std::vector<Value>& values) {
-  Value v = variance_helper(values, /*population=*/false);
-  if (!v.is_number()) {
-    return v;
-  }
-  const double r = std::sqrt(v.as_number());
-  if (std::isnan(r) || std::isinf(r)) {
-    return Value::error(ErrorCode::Num);
+Value stddev_helper(const std::vector<Value>& values, bool population) {
+  if (const Value* err = first_error(values); err != nullptr) {
+    return *err;
   }
-  return Value::number(r);
+  return lift_kernel_result(numeric_aggregate_kernels::run_stdev(numeric_view(values), !population));
+}
+
+Value AggregateStdDev(const std::vector<Value>& values) {
+  return stddev_helper(values, /*population=*/false);
 }
 
 Value AggregateStdDevP(const std::vector<Value>& values) {
-  Value v = variance_helper(values, /*population=*/true);
-  if (!v.is_number()) {
-    return v;
-  }
-  const double r = std::sqrt(v.as_number());
-  if (std::isnan(r) || std::isinf(r)) {
-    return Value::error(ErrorCode::Num);
-  }
-  return Value::number(r);
+  return stddev_helper(values, /*population=*/true);
 }
 
 Value AggregateProduct(const std::vector<Value>& values) {
diff --git a/src/pivot/date_serial.h b/src/pivot/date_serial.h
new file mode 100644
index 000000000..abf0970cf
--- /dev/null
+++ b/src/pivot/date_serial.h
@@ -0,0 +1,27 @@
+// Shared validation for Excel date serials used by pivot grouping and filters.
+
+#ifndef FORMULON_PIVOT_DATE_SERIAL_H_
+#define FORMULON_PIVOT_DATE_SERIAL_H_
+
+#include <cmath>
+
+#include "utils/date_time.h"
+
+namespace formulon::pivot {
+
+/// Excel's maximum supported date serial (9999-12-31). Fractions on that day
+/// remain valid.
+inline double last_valid_date_serial(bool date1904) noexcept {
+  return date_time::serial_from_ymd(9999, 12U, 31U, date1904);
+}
+
+/// Returns whether `serial` belongs to the finite, non-negative Excel date
+/// domain. Callers should convert the serial to a calendar date only after
+/// this check succeeds.
+inline bool is_valid_date_serial(double serial, bool date1904) noexcept {
+  return std::isfinite(serial) && serial >= 0.0 && std::floor(serial) <= last_valid_date_serial(date1904);
+}
+
+}  // namespace formulon::pivot
+
+#endif  // FORMULON_PIVOT_DATE_SERIAL_H_
diff --git a/src/pivot/field_lookup.h b/src/pivot/field_lookup.h
index fd4470883..15d17ed1e 100644
--- a/src/pivot/field_lookup.h
+++ b/src/pivot/field_lookup.h
@@ -31,15 +31,39 @@ inline std::string pivot_field_display_name(const PivotField& field) {
   return field.custom_name.empty() ? field.source_name : field.custom_name;
 }
 
+/// Locates the one field `name` designates directly. Returns `nullopt` for an
+/// unknown name and for a name shared by distinct fields (e.g. a caption two
+/// fields both carry, or one field's caption equal to another's source name).
+/// A field matching through both its names counts once. Comparison is
+/// case-sensitive.
+inline std::optional<std::size_t> find_unique_field_by_name(const PivotTable& table, std::string_view name) {
+  std::optional<std::size_t> match;
+  for (std::size_t i = 0; i < table.fields().size(); ++i) {
+    if (pivot_field_has_name(table.fields()[i], name)) {
+      if (match.has_value()) {
+        return std::nullopt;
+      }
+      match = i;
+    }
+  }
+  return match;
+}
+
 /// Resolves `name` to an index into `table.fields()`. Direct field names win
 /// over data-field display names, so a data field named after another pivot
-/// field cannot shadow it. Returns `nullopt` when nothing matches.
+/// field cannot shadow it. Returns `nullopt` when nothing matches or when the
+/// direct name is ambiguous.
 inline std::optional<std::size_t> resolve_field_by_any_name(const PivotTable& table, std::string_view name) {
-  for (std::size_t i = 0; i < table.fields().size(); ++i) {
-    if (pivot_field_has_name(table.fields()[i], name)) {
-      return i;
+  bool direct_match = false;
+  for (const PivotField& field : table.fields()) {
+    if (pivot_field_has_name(field, name)) {
+      direct_match = true;
+      break;
     }
   }
+  if (direct_match) {
+    return find_unique_field_by_name(table, name);
+  }
   for (const PivotDataField& data_field : table.data_fields()) {
     if (data_field.name == name && data_field.field_index < table.fields().size()) {
       return static_cast<std::size_t>(data_field.field_index);
diff --git a/src/pivot/filter_engine.cpp b/src/pivot/filter_engine.cpp
index 874cef06c..bace00fc7 100644
--- a/src/pivot/filter_engine.cpp
+++ b/src/pivot/filter_engine.cpp
@@ -13,6 +13,7 @@
 #include <variant>
 #include <vector>
 
+#include "pivot/date_serial.h"
 #include "pivot/field_lookup.h"
 #include "pivot/pivot_cache.h"
 #include "pivot/pivot_index.h"
@@ -24,6 +25,7 @@
 #include "utils/checked_index.h"
 #include "utils/date_time.h"
 #include "utils/index_sort.h"
+#include "utils/strings.h"
 #include "value.h"
 
 namespace formulon::pivot {
@@ -86,22 +88,44 @@ std::optional<double> filter_number_value_high(const PivotFilter& f) {
   return std::nullopt;
 }
 
+// Date bounds are a stricter numeric domain than ordinary value filters:
+// non-finite payloads are invalid dates and therefore leave the date filter
+// inert. Ordinary value filters keep their own coercion above, which does not
+// reject non-finite payloads.
+std::optional<double> date_filter_number_value(const PivotFilter& f) {
+  if (const auto* d = std::get_if<double>(&f.value)) {
+    return std::isfinite(*d) ? std::optional<double>(*d) : std::nullopt;
+  }
+  if (const auto* i = std::get_if<int>(&f.value)) {
+    return static_cast<double>(*i);
+  }
+  return std::nullopt;
+}
+
+std::optional<double> date_filter_number_value_high(const PivotFilter& f) {
+  const auto high = filter_number_value_high(f);
+  if (!high || !std::isfinite(*high)) {
+    return std::nullopt;
+  }
+  return high;
+}
+
 // Evaluates a `LabelDate` filter against the underlying numeric value
 // of a record's field. The `field_name` ostensibly identifies a date
 // column, so the cache value should be a date serial; non-numeric cells
 // (text labels, blanks, errors) are not in the date domain and skip the
 // filter rather than being dropped.
-bool label_date_filter_passes(const PivotFilter& f, const Value& v) {
-  if (!v.is_number()) {
+bool label_date_filter_passes(const PivotFilter& f, const Value& v, bool date1904) {
+  if (!v.is_number() || !is_valid_date_serial(v.as_number(), date1904)) {
     return true;  // Non-numeric cells skip the date filter.
   }
   const double serial = v.as_number();
-  const double lo = filter_number_value(f);
-  const auto hi_or = filter_number_value_high(f);
-  if (!hi_or) {
-    return true;  // Half-open / no upper bound: treat as no-op.
+  const auto lo_or = date_filter_number_value(f);
+  const auto hi_or = date_filter_number_value_high(f);
+  if (!lo_or || !hi_or || !is_valid_date_serial(*lo_or, date1904) || !is_valid_date_serial(*hi_or, date1904)) {
+    return true;  // Missing, non-finite or out-of-domain bound: treat as no-op.
   }
-  return serial >= lo && serial <= *hi_or;
+  return serial >= *lo_or && serial <= *hi_or;
 }
 
 // Evaluates a single label-flavoured filter against `label`.
@@ -164,32 +188,12 @@ int CaseInsensitiveCompare(std::string_view lhs, std::string_view rhs) {
   return lhs.size() < rhs.size() ? -1 : 1;
 }
 
-bool CaseInsensitiveEquals(std::string_view lhs, std::string_view rhs) {
-  return lhs.size() == rhs.size() && CaseInsensitiveCompare(lhs, rhs) == 0;
-}
-
-bool CaseInsensitiveContains(std::string_view haystack, std::string_view needle) {
-  if (needle.empty()) {
-    return true;
-  }
-  if (needle.size() > haystack.size()) {
-    return false;
-  }
-  const std::size_t last = haystack.size() - needle.size();
-  for (std::size_t i = 0; i <= last; ++i) {
-    if (CaseInsensitiveEquals(haystack.substr(i, needle.size()), needle)) {
-      return true;
-    }
-  }
-  return false;
-}
-
 bool CaseInsensitiveBeginsWith(std::string_view label, std::string_view value) {
-  return label.size() >= value.size() && CaseInsensitiveEquals(label.substr(0, value.size()), value);
+  return label.size() >= value.size() && strings::case_insensitive_eq(label.substr(0, value.size()), value);
 }
 
 bool CaseInsensitiveEndsWith(std::string_view label, std::string_view value) {
-  return label.size() >= value.size() && CaseInsensitiveEquals(label.substr(label.size() - value.size()), value);
+  return label.size() >= value.size() && strings::case_insensitive_eq(label.substr(label.size() - value.size()), value);
 }
 
 // Evaluates one decoded `<filters>` caption entry against `label`.
@@ -204,9 +208,9 @@ bool caption_filter_passes(const AuthoredCaptionFilter& f, std::string_view labe
   };
   switch (f.predicate) {
     case CaptionPredicate::Equal:
-      return CaseInsensitiveEquals(label, value);
+      return strings::case_insensitive_eq(label, value);
     case CaptionPredicate::NotEqual:
-      return !CaseInsensitiveEquals(label, value);
+      return !strings::case_insensitive_eq(label, value);
     case CaptionPredicate::BeginsWith:
       return CaseInsensitiveBeginsWith(label, value);
     case CaptionPredicate::NotBeginsWith:
@@ -216,9 +220,9 @@ bool caption_filter_passes(const AuthoredCaptionFilter& f, std::string_view labe
     case CaptionPredicate::NotEndsWith:
       return !CaseInsensitiveEndsWith(label, value);
     case CaptionPredicate::Contains:
-      return CaseInsensitiveContains(label, value);
+      return strings::case_insensitive_contains(label, value);
     case CaptionPredicate::NotContains:
-      return !CaseInsensitiveContains(label, value);
+      return !strings::case_insensitive_contains(label, value);
     case CaptionPredicate::GreaterThan:
       return CaseInsensitiveCompare(label, value) > 0;
     case CaptionPredicate::GreaterThanOrEqual:
@@ -389,7 +393,7 @@ bool PreparedRecordFilter::passes(const PivotCacheRecord& record) const {
     if (f.type == FilterType::LabelDate) {
       // Date-range filters need the underlying numeric serial; the
       // rendered label string would lose precision and locale.
-      if (!label_date_filter_passes(f, v)) {
+      if (!label_date_filter_passes(f, v, date1904_)) {
         return false;
       }
       continue;
@@ -422,8 +426,11 @@ bool PreparedRecordFilter::passes(const PivotCacheRecord& record) const {
     if (!f.value_high) {
       continue;  // Unbounded above: no-op, matching `PivotFilter`.
     }
+    if (!is_valid_date_serial(f.value, date1904_) || !is_valid_date_serial(*f.value_high, date1904_)) {
+      continue;  // Invalid bounds are outside the date domain.
+    }
     const Value v = cell_value(cache, record, f.field_index);
-    if (!v.is_number()) {
+    if (!v.is_number() || !is_valid_date_serial(v.as_number(), date1904_)) {
       continue;  // Non-numeric cells are outside the date domain.
     }
     const double serial = v.as_number();
@@ -436,7 +443,7 @@ bool PreparedRecordFilter::passes(const PivotCacheRecord& record) const {
   // absolute `dateBetween` family above.
   for (const ResolvedPeriod& resolved : period_windows_) {
     const Value v = cell_value(cache, record, resolved.field_index);
-    if (!v.is_number()) {
+    if (!v.is_number() || !is_valid_date_serial(v.as_number(), date1904_)) {
       continue;  // Non-numeric cells are outside the date domain.
     }
     const double serial = v.as_number();
@@ -446,13 +453,10 @@ bool PreparedRecordFilter::passes(const PivotCacheRecord& record) const {
   }
   for (const ResolvedRecurring& resolved : recurring_months_) {
     const Value v = cell_value(cache, record, resolved.field_index);
-    if (!v.is_number()) {
+    if (!v.is_number() || !is_valid_date_serial(v.as_number(), date1904_)) {
       continue;  // Non-numeric cells are outside the date domain.
     }
     const double serial = v.as_number();
-    if (serial < 0.0) {
-      continue;  // Outside the serial domain `ymd_from_serial` is defined on.
-    }
     const unsigned month = date_time::ymd_from_serial(std::floor(serial), date1904_).m;
     if (month < resolved.month_low || month > resolved.month_high) {
       return false;
diff --git a/src/pivot/hierarchy_builder.cpp b/src/pivot/hierarchy_builder.cpp
index d6de9f2e2..50074973e 100644
--- a/src/pivot/hierarchy_builder.cpp
+++ b/src/pivot/hierarchy_builder.cpp
@@ -11,6 +11,7 @@
 #include <utility>
 #include <vector>
 
+#include "pivot/date_serial.h"
 #include "pivot/pivot_cache.h"
 #include "pivot/pivot_result.h"
 #include "pivot/pivot_types.h"
@@ -30,9 +31,9 @@ namespace {
 // When a `PivotField` declares a `date_group`, the field's source `Value`
 // (which the cache stores as a date serial) is mapped to a bucket
 // `(sort_key, label)` pair. The sort key feeds the hierarchy's
-// `std::map<Value, HierNode, ValueLess>` so leaves order chronologically
-// (e.g. 2023 < 2024 < 2025); the label is what the renderer / GETPIVOTDATA
-// see as the bucket name.
+// `std::map<HierarchyKey, HierNode, HierarchyKeyLess>` so leaves order
+// chronologically (e.g. 2023 < 2024 < 2025); the label is what the renderer /
+// GETPIVOTDATA see as the bucket name.
 //
 // MVP scope: Year, Quarter, Month, Day for both Gregorian and Japanese
 // calendars; Week / Hour / Minute / Second pass through unchanged
@@ -45,6 +46,7 @@ namespace {
 struct DateBucket {
   Value sort_key;     ///< Numeric sort handle (chronological order).
   std::string label;  ///< Display string for the bucket.
+  HierarchyBand band = HierarchyBand::Normal;
 };
 
 // Two-digit zero-padded decimal append (no <iomanip>).
@@ -94,11 +96,11 @@ DateBucket bucket_date(double serial, const PivotDateGroup& dg, bool date1904) {
   using formulon::japanese_era::classify_era;
   using formulon::japanese_era::EraInfo;
 
-  // Negative / non-finite serials are not valid Excel dates; pass them
-  // through so the existing display path renders the raw number.
-  if (!(serial >= 0.0)) {
+  // Invalid serials are not date buckets; keep the raw number in its own band
+  // so it cannot merge with a synthetic bucket key.
+  if (!is_valid_date_serial(serial, date1904)) {
     Value raw = Value::number(serial);
-    return {raw, display_string(raw)};
+    return {raw, display_string(raw), HierarchyBand::Raw};
   }
   const double serial_floor = std::floor(serial);
   const YMD ymd = ymd_from_serial(serial_floor, date1904);
@@ -171,13 +173,13 @@ DateBucket bucket_date(double serial, const PivotDateGroup& dg, bool date1904) {
         // Catch-all: everything below an explicit Start narrower than the data minimum, sorted first.
         std::string label = "<";
         append_days_group_date(label, start, date1904);
-        return {Value::number(-std::numeric_limits<double>::infinity()), std::move(label)};
+        return {Value::number(-std::numeric_limits<double>::infinity()), std::move(label), HierarchyBand::Before};
       }
       if (serial_floor > end) {
         // Mirror image: everything above an explicit End narrower than the data maximum, sorted last.
         std::string label = ">";
         append_days_group_date(label, end, date1904);
-        return {Value::number(std::numeric_limits<double>::infinity()), std::move(label)};
+        return {Value::number(std::numeric_limits<double>::infinity()), std::move(label), HierarchyBand::After};
       }
       const double bucket_index = std::floor((serial_floor - start) / interval);
       const double bucket_start = start + bucket_index * interval;
@@ -235,7 +237,7 @@ DateBucket bucket_date(double serial, const PivotDateGroup& dg, bool date1904) {
     }
   }
   Value raw = Value::number(serial);
-  return {raw, display_string(raw)};
+  return {raw, display_string(raw), HierarchyBand::Raw};
 }
 
 /// Removes the leaves of `node`'s subtree whose position in `keep` is
@@ -291,11 +293,11 @@ HierNode* insert_path(const PivotCache& cache, const std::vector<HierLevel>& lev
   HierNode* cursor = &root;
   for (const HierLevel& level : levels) {
     const Value raw = cell_value(cache, record, level.field_index);
-    Value key = raw;
+    HierarchyKey key{HierarchyBand::Normal, raw};
     std::string label_override;
     if (level.date_group != nullptr && raw.is_number()) {
       DateBucket bucket = bucket_date(raw.as_number(), *level.date_group, date1904);
-      key = bucket.sort_key;
+      key = {bucket.band, bucket.sort_key};
       label_override = std::move(bucket.label);
     } else if (raw.is_blank()) {
       // A source cell with no value still occupies a group on the axis, so
@@ -315,28 +317,39 @@ HierNode* insert_path(const PivotCache& cache, const std::vector<HierLevel>& lev
   return cursor;
 }
 
-std::string node_label(const Value& key, const HierNode& child) {
+std::string node_label(const HierarchyKey& key, const HierNode& child) {
   if (!child.label_override.empty()) {
     return child.label_override;
   }
-  return display_string(key);
+  return display_string(key.value);
 }
 
 void finalize_hierarchy(HierNode& tree, const std::vector<HierLevel>& levels, std::size_t depth,
-                        std::vector<AxisHierarchyNode>& out, std::vector<HierNode*>& leaves) {
+                        std::vector<AxisHierarchyNode>& out, std::vector<HierNode*>& leaves,
+                        std::deque<std::string>& text_storage) {
   if (tree.children.empty()) {
     return;
   }
   out.reserve(tree.children.size());
   const std::vector<OrderedHierarchyChild> entries = ordered_children(tree, levels, depth);
-  const auto append = [&](const Value& key, HierNode& child) {
+  const auto append = [&](const HierarchyKey& key, HierNode& child) {
     AxisHierarchyNode node;
     node.label = node_label(key, child);
+    // A date-grouped level's keys are synthetic, so its items are addressed by label only.
+    const bool date_grouped = depth < levels.size() && levels[depth].date_group != nullptr;
+    if (key.band == HierarchyBand::Normal && !date_grouped) {
+      if (key.value.is_text()) {
+        text_storage.emplace_back(key.value.as_text());
+        node.identity = Value::text(text_storage.back());
+      } else {
+        node.identity = key.value;
+      }
+    }
     if (child.children.empty()) {
       child.leaf_index = leaves.size();
       leaves.push_back(&child);
     } else {
-      finalize_hierarchy(child, levels, depth + 1U, node.children, leaves);
+      finalize_hierarchy(child, levels, depth + 1U, node.children, leaves, text_storage);
     }
     out.push_back(std::move(node));
   };
diff --git a/src/pivot/hierarchy_builder.h b/src/pivot/hierarchy_builder.h
index fcffa6e7b..49541e8e8 100644
--- a/src/pivot/hierarchy_builder.h
+++ b/src/pivot/hierarchy_builder.h
@@ -1,12 +1,12 @@
 //
 // Hierarchy construction for the pivot evaluator.
 //
-// The hierarchy is built as a nested `std::map<Value, HierNode, ValueLess>`
-// so the ordering emerges naturally from `ValueLess`. After every record
-// is inserted, `finalize_hierarchy` flattens the tree into the public
-// `AxisHierarchyNode` shape and remembers the leaf
-// path that each surviving record lands on so the per-leaf aggregation
-// pass can reuse the work without rewalking the tree.
+// The hierarchy is built as a nested `std::map<HierarchyKey, HierNode,
+// HierarchyKeyLess>` so the ordering emerges naturally from `HierarchyKeyLess`.
+// After every record is inserted, `finalize_hierarchy` flattens the tree into
+// the public `AxisHierarchyNode` shape and remembers the leaf path that each
+// surviving record lands on so the per-leaf aggregation pass can reuse the
+// work without rewalking the tree.
 //
 // Date-grouping is handled inside `insert_path`: when a level carries a
 // `PivotDateGroup`, the raw cache value is bucketed first (year /
@@ -19,6 +19,7 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
+#include <deque>
 #include <map>
 #include <optional>
 #include <string>
@@ -36,8 +37,34 @@
 
 namespace formulon::pivot {
 
+/// Sort bands keep synthetic buckets distinct from values that happen to carry
+/// the same numeric payload. Before/After are the Days catch-all buckets;
+/// Normal holds ordinary keys and date buckets; Raw holds numbers of a
+/// date-grouped field outside the date domain, so they never merge with a
+/// synthetic bucket key and sort after every valid bucket.
+enum class HierarchyBand : std::uint8_t {
+  Before = 0,
+  Normal = 1,
+  Raw = 2,
+  After = 3,
+};
+
+struct HierarchyKey {
+  HierarchyBand band = HierarchyBand::Normal;
+  Value value;
+};
+
+struct HierarchyKeyLess {
+  bool operator()(const HierarchyKey& lhs, const HierarchyKey& rhs) const noexcept {
+    if (lhs.band != rhs.band) {
+      return static_cast<std::uint8_t>(lhs.band) < static_cast<std::uint8_t>(rhs.band);
+    }
+    return value_less(lhs.value, rhs.value);
+  }
+};
+
 struct HierNode {
-  std::map<Value, HierNode, ValueLess> children;
+  std::map<HierarchyKey, HierNode, HierarchyKeyLess> children;
   /// Cache-record indices below this node. They permit value-based sorting
   /// without reconstructing a hierarchy path after aggregation.
   std::vector<std::size_t> record_indices;
@@ -68,7 +95,7 @@ struct HierLevel {
 };
 
 struct OrderedHierarchyChild {
-  const Value* key;
+  const HierarchyKey* key;
   HierNode* node;
 };
 
@@ -89,8 +116,10 @@ inline std::vector<OrderedHierarchyChild> ordered_children(HierNode& tree, const
       depth < levels.size() ? levels[depth].manual_order : nullptr;
   sort_by_index(entries, [&](const OrderedHierarchyChild& lhs, const OrderedHierarchyChild& rhs) {
     if (manual_order != nullptr) {
-      const auto lit = manual_order->find(*lhs.key);
-      const auto rit = manual_order->find(*rhs.key);
+      const auto lit =
+          lhs.key->band == HierarchyBand::Normal ? manual_order->find(lhs.key->value) : manual_order->end();
+      const auto rit =
+          rhs.key->band == HierarchyBand::Normal ? manual_order->find(rhs.key->value) : manual_order->end();
       const bool l_mapped = lit != manual_order->end();
       const bool r_mapped = rit != manual_order->end();
       if (l_mapped && r_mapped) {
@@ -112,7 +141,7 @@ inline std::vector<OrderedHierarchyChild> ordered_children(HierNode& tree, const
         return !ascending;
       }
     }
-    const ValueLess less;
+    const HierarchyKeyLess less;
     return ascending ? less(*lhs.key, *rhs.key) : less(*rhs.key, *lhs.key);
   });
   return entries;
@@ -130,16 +159,19 @@ HierNode* insert_path(const PivotCache& cache, const std::vector<HierLevel>& lev
                       bool date1904 = false);
 
 /// Returns the display label for `(key, child)`: the override if set,
-/// otherwise the standard `display_string(key)`. Used by all hierarchy
+/// otherwise the standard `display_string(key.value)`. Used by all hierarchy
 /// flatten / subtotal-walk sites so date-grouped buckets surface their
 /// formatted label rather than the synthetic numeric sort key.
-std::string node_label(const Value& key, const HierNode& child);
+std::string node_label(const HierarchyKey& key, const HierNode& child);
 
 /// Recursively flattens a hierarchy into `AxisHierarchyNode` form. On the
 /// way, assigns each leaf a dense index and pushes the corresponding
 /// `HierNode*` into `leaves` so a second pass can attach record indices.
+/// Text identities are copied into `text_storage`, whose lifetime is the
+/// resulting `PivotResult`; synthetic Before/After keys have no identity.
 void finalize_hierarchy(HierNode& tree, const std::vector<HierLevel>& levels, std::size_t depth,
-                        std::vector<AxisHierarchyNode>& out, std::vector<HierNode*>& leaves);
+                        std::vector<AxisHierarchyNode>& out, std::vector<HierNode*>& leaves,
+                        std::deque<std::string>& text_storage);
 
 /// Removes the leaves at DFS pre-order positions where `keep[i]` is false,
 /// then drops any node whose subtree becomes empty, including roots. One
diff --git a/src/pivot/pivot_evaluator.cpp b/src/pivot/pivot_evaluator.cpp
index ef664506a..4d06cb291 100644
--- a/src/pivot/pivot_evaluator.cpp
+++ b/src/pivot/pivot_evaluator.cpp
@@ -22,6 +22,7 @@
 #include "pivot/pivot_evaluator.h"
 
 #include <algorithm>
+#include <cmath>
 #include <cstddef>
 #include <cstdint>
 #include <map>
@@ -33,6 +34,7 @@
 #include <vector>
 
 #include "pivot/aggregator.h"
+#include "pivot/date_serial.h"
 #include "pivot/field_lookup.h"
 #include "pivot/filter_engine.h"
 #include "pivot/hierarchy_builder.h"
@@ -273,14 +275,15 @@ void ReaggregateTotalsAfterValueFilter(const PivotTable& table, const PivotCache
       const PivotDataField& df = table.data_fields()[df_idx];
       std::vector<Value> column;
       append_leaf_set_field_values(cache, buckets, rows, surviving_col_leaves, df.field_index, column);
-      subtotal.values[df_idx] = aggregate_or_blank(df.aggregation, column, result);
+      subtotal.values[df_idx] = aggregate_or_blank(subtotal.aggregation.value_or(df.aggregation), column, result);
     }
     for (std::size_t c = 0; c < subtotal.col_values.size() && c < surviving_col_leaves.size(); ++c) {
       for (std::size_t df_idx = 0; df_idx < data_field_count && df_idx < subtotal.col_values[c].size(); ++df_idx) {
         const PivotDataField& df = table.data_fields()[df_idx];
         std::vector<Value> column;
         append_leaf_set_field_values(cache, buckets, rows, {surviving_col_leaves[c]}, df.field_index, column);
-        subtotal.col_values[c][df_idx] = aggregate_or_blank(df.aggregation, column, result);
+        subtotal.col_values[c][df_idx] =
+            aggregate_or_blank(subtotal.aggregation.value_or(df.aggregation), column, result);
       }
     }
     for (std::size_t cs = 0; cs < subtotal.col_subtotal_values.size() && cs < col_subtotal_leaf_sets.size(); ++cs) {
@@ -362,6 +365,28 @@ Expected<PivotResult, Error> evaluate(const PivotTable& table, const PivotCache&
                         "field=" + pivot_field_display_name(table.fields()[fi]) + " field_index=" + std::to_string(fi));
     }
   }
+  for (std::size_t fi = 0; fi < table.fields().size(); ++fi) {
+    const auto& date_group = table.fields()[fi].date_group;
+    if (!date_group.has_value() || date_group->granularity != DateGrouping::Days) {
+      continue;
+    }
+    if (date_group->interval_days == 0) {
+      return make_error(FormulonErrorCode::kEvalPivotInvalid, "date grouping interval_days must be non-zero",
+                        "field_index=" + std::to_string(fi));
+    }
+    // Compare authored bounds before flooring so the core model agrees with
+    // the C API for inverted fractional windows (e.g. 0.9 > 0.1).
+    if (date_group->start_serial.has_value() && date_group->end_serial.has_value() &&
+        *date_group->start_serial > *date_group->end_serial) {
+      return make_error(FormulonErrorCode::kEvalPivotInvalid, "date grouping start must not exceed end",
+                        "field_index=" + std::to_string(fi));
+    }
+    if ((date_group->start_serial.has_value() && !is_valid_date_serial(*date_group->start_serial, env.date1904)) ||
+        (date_group->end_serial.has_value() && !is_valid_date_serial(*date_group->end_serial, env.date1904))) {
+      return make_error(FormulonErrorCode::kEvalPivotInvalid, "date grouping bound is outside the date serial domain",
+                        "field_index=" + std::to_string(fi));
+    }
+  }
 
   // 2. Filter records.
   //
@@ -422,7 +447,7 @@ Expected<PivotResult, Error> evaluate(const PivotTable& table, const PivotCache&
   // filters); every hierarchy level for that field reuses the result.
   std::unordered_map<std::uint32_t, PivotDateGroup> resolved_days_group_cache;
   auto resolved_date_group = [&](std::uint32_t fi, const PivotDateGroup& dg) -> const PivotDateGroup* {
-    if (dg.granularity != DateGrouping::Days || (dg.start_serial.has_value() && dg.end_serial.has_value())) {
+    if (dg.granularity != DateGrouping::Days) {
       return &dg;
     }
     if (auto it = resolved_days_group_cache.find(fi); it != resolved_days_group_cache.end()) {
@@ -434,10 +459,10 @@ Expected<PivotResult, Error> evaluate(const PivotTable& table, const PivotCache&
     double data_max = 0.0;
     for (const PivotCacheRecord& rec : cache.records()) {
       const Value v = cell_value(cache, rec, fi);
-      if (!v.is_number() || !(v.as_number() >= 0.0)) {
+      if (!v.is_number() || !is_valid_date_serial(v.as_number(), resolved_env.date1904)) {
         continue;  // Mirrors bucket_date's own valid-serial domain.
       }
-      const double n = v.as_number();
+      const double n = std::floor(v.as_number());
       if (!have_bound) {
         data_min = n;
         data_max = n;
@@ -447,11 +472,16 @@ Expected<PivotResult, Error> evaluate(const PivotTable& table, const PivotCache&
         data_max = std::max(data_max, n);
       }
     }
-    if (!resolved.start_serial.has_value()) {
+    if (resolved.start_serial.has_value()) {
+      resolved.start_serial = std::floor(*resolved.start_serial);
+    } else {
       resolved.start_serial = have_bound ? data_min : 0.0;
     }
     if (!resolved.end_serial.has_value()) {
-      resolved.end_serial = have_bound ? (data_max + 1.0) : *resolved.start_serial;
+      const double auto_end = have_bound ? (data_max + 1.0) : *resolved.start_serial;
+      resolved.end_serial = std::min(auto_end, last_valid_date_serial(resolved_env.date1904));
+    } else {
+      resolved.end_serial = std::floor(*resolved.end_serial);
     }
     return &resolved_days_group_cache.emplace(fi, resolved).first->second;
   };
@@ -528,8 +558,8 @@ Expected<PivotResult, Error> evaluate(const PivotTable& table, const PivotCache&
   PivotResult result;
   std::vector<HierNode*> row_leaves;
   std::vector<HierNode*> col_leaves;
-  finalize_hierarchy(row_tree, row_levels, 0U, result.rows, row_leaves);
-  finalize_hierarchy(col_tree, col_levels, 0U, result.cols, col_leaves);
+  finalize_hierarchy(row_tree, row_levels, 0U, result.rows, row_leaves, result.text_storage);
+  finalize_hierarchy(col_tree, col_levels, 0U, result.cols, col_leaves, result.text_storage);
   resolve_page_selections(table, cache, options, result);
 
   // Degenerate axis: if a side has no field configured, treat it as a
@@ -687,6 +717,7 @@ Expected<PivotResult, Error> evaluate(const PivotTable& table, const PivotCache&
                            RowSubtotal subtotal;
                            subtotal.labels = labels;
                            subtotal.depth = static_cast<std::uint32_t>(depth);
+                           subtotal.aggregation = spec;
                            subtotal.values = row_values;
                            subtotal.col_values = std::move(col_values);
                            row_subtotal_leaf_sets.emplace_back(
@@ -943,7 +974,14 @@ Expected<PivotResult, Error> evaluate(const PivotTable& table, const PivotCache&
   };
 
   for (const PivotFilter& f : table.active_filters()) {
-    apply_value_filter(f, resolve_field_by_any_name(table, f.field_name));
+    const std::optional<std::size_t> field_index = resolve_field_by_any_name(table, f.field_name);
+    // An unresolved active filter has no field to act on. Treat it as the
+    // no-op promised by PreparedRecordFilter instead of allowing a value
+    // filter to fall back to the innermost axis field.
+    if (!field_index.has_value()) {
+      continue;
+    }
+    apply_value_filter(f, field_index);
   }
   for (const AuthoredValueFilter& authored : table.authored_value_filters()) {
     if (const auto projected = authored_value_filter_as_pivot_filter(table, authored)) {
diff --git a/src/pivot/pivot_result.h b/src/pivot/pivot_result.h
index d3d603c52..0a51b89b8 100644
--- a/src/pivot/pivot_result.h
+++ b/src/pivot/pivot_result.h
@@ -24,6 +24,12 @@ namespace formulon::pivot {
 struct AxisHierarchyNode {
   std::string label;
   std::vector<AxisHierarchyNode> children;
+  /// Typed key for this rendered item. Every node of a date-grouped level
+  /// (its keys are synthetic sort keys, not source values) leaves this empty
+  /// and is addressed by label only. Other nodes retain their Value kind so
+  /// GETPIVOTDATA can distinguish, for example, number 1 from text "1" before
+  /// falling back to a display-label match.
+  std::optional<Value> identity = std::nullopt;
 };
 
 /// One row-axis subtotal emitted after all descendant leaves for `labels`.
@@ -32,6 +38,8 @@ struct AxisHierarchyNode {
 struct RowSubtotal {
   std::vector<std::string> labels;
   std::uint32_t depth = 0;
+  /// A custom subtotal aggregation, or empty to use each data field's aggregation.
+  std::optional<Aggregation> aggregation;
   std::vector<Value> values;
   /// Per-column-leaf subtotal values. `col_values[col_leaf][data_field]`
   /// lets layout render a subtotal row across a populated column axis.
@@ -135,11 +143,11 @@ struct PivotResult {
   std::vector<std::vector<Value>> col_leaf_totals;
 
   /// Lifetime-stable backing store for any `Value::text` payload appearing
-  /// in `values`, `subtotals`, or `grand_total`. The evaluator may need to
-  /// surface text values from the source cache (e.g. when MAX-ing over a
-  /// pure-text column); copying the underlying bytes here decouples the
-  /// result's lifetime from the cache it was computed against, satisfying
-  /// the contract spelled out on this struct's docstring.
+  /// in `values`, `subtotals`, `grand_total`, or axis `identity`. The
+  /// evaluator may need to surface text values from the source cache (e.g.
+  /// when MAX-ing over a pure-text column); copying the underlying bytes here
+  /// decouples the result's lifetime from the cache it was computed against,
+  /// satisfying the contract spelled out on this struct's docstring.
   ///
   /// `std::deque` gives pointer/iterator stability across appends so
   /// `string_view`s into earlier entries remain valid as later entries are
diff --git a/src/pivot/value_order.h b/src/pivot/value_order.h
index a4a001d35..489b10581 100644
--- a/src/pivot/value_order.h
+++ b/src/pivot/value_order.h
@@ -27,6 +27,7 @@
 #ifndef FORMULON_PIVOT_VALUE_ORDER_H_
 #define FORMULON_PIVOT_VALUE_ORDER_H_
 
+#include <cmath>
 #include <cstdint>
 #include <string>
 
@@ -45,8 +46,18 @@ inline bool value_less(const Value& a, const Value& b) noexcept {
     return ra < rb;
   }
   switch (a.kind()) {
-    case ValueKind::Number:
-      return a.as_number() < b.as_number();
+    case ValueKind::Number: {
+      const double av = a.as_number();
+      const double bv = b.as_number();
+      const bool a_nan = std::isnan(av);
+      const bool b_nan = std::isnan(bv);
+      if (a_nan != b_nan) {
+        return !a_nan;
+      }
+      // Treat NaNs as one class after all numeric values; infinities retain
+      // their ordinary numeric order.
+      return !a_nan && av < bv;
+    }
     case ValueKind::Bool:
       // false < true.
       return !a.as_boolean() && b.as_boolean();
diff --git a/src/print/page_setup.cpp b/src/print/page_setup.cpp
index 60f0a607f..7ce99112b 100644
--- a/src/print/page_setup.cpp
+++ b/src/print/page_setup.cpp
@@ -74,6 +74,22 @@ PaperDimensions resolve_paper_dimensions(std::uint32_t paper_size) noexcept {
   }
 }
 
+bool is_known_paper_size(std::uint32_t paper_size) noexcept {
+  switch (paper_size) {
+    case kPaperLetter:
+    case kPaperLegal:
+    case kPaperA3:
+    case kPaperA4:
+    case kPaperA5:
+    case kPaperB4Jis:
+    case kPaperB5Jis:
+    case kPaperA6:
+      return true;
+    default:
+      return false;
+  }
+}
+
 PrintableArea compute_printable_area(const PageSetup& setup, const PageMargins& margins) noexcept {
   const PaperDimensions paper = resolve_paper_dimensions(setup.paper_size);
 
diff --git a/src/print/page_setup.h b/src/print/page_setup.h
index a0ff495b1..923debb42 100644
--- a/src/print/page_setup.h
+++ b/src/print/page_setup.h
@@ -9,6 +9,8 @@
 #ifndef FORMULON_PRINT_PAGE_SETUP_H_
 #define FORMULON_PRINT_PAGE_SETUP_H_
 
+#include <cstdint>
+
 #include "sheet.h"
 
 namespace formulon {
@@ -38,6 +40,10 @@ struct PaperDimensions {
   double height_pt = 0.0;  ///< Portrait height (long edge), in points.
 };
 
+/// True when `paper_size` is one of the codes `resolve_paper_dimensions`
+/// recognises, i.e. when its result is not the A4 fallback.
+bool is_known_paper_size(std::uint32_t paper_size) noexcept;
+
 /// Resolves an OOXML `paperSize` code to physical portrait dimensions.
 ///
 /// Recognised codes: 1 (Letter), 5 (Legal), 8 (A3), 9 (A4), 11 (A5),
diff --git a/src/print/pagination.cpp b/src/print/pagination.cpp
index b864459c2..22ebdd94c 100644
--- a/src/print/pagination.cpp
+++ b/src/print/pagination.cpp
@@ -10,6 +10,7 @@
 #include "cell.h"
 #include "print/page_setup.h"
 #include "print/print_area.h"
+#include "print/sheet_geometry.h"
 #include "sheet.h"
 #include "styles.h"
 #include "utils/index_sort.h"
@@ -20,237 +21,13 @@ namespace formulon {
 namespace print {
 namespace {
 
-// --- Excel column-width geometry constants. ---
-//
-// Excel stores a column's width in "character" units relative to the
-// default font's maximum digit width (MDW). The character-to-pixel
-// conversion below is Excel's documented formula; the constants are
-// named so the arithmetic carries no bare literals.
-//
-// Two distinct quantities share this stored-width input and must not be
-// confused:
-//
-//   * Print-layout width, consumed only by `paginate()`'s own break math
-//     (h_breaks / v_breaks / page count). Comparing a Windows Excel 365
-//     ja-JP build 16.0.20228/16.0.20326 capture taken at 100% display
-//     scaling (96 DPI) against one of the *same build* taken at 175%
-//     (168 DPI) shows `Range.Width` itself is DPI-dependent (Calibri 11
-//     resolves a 30-character column to 161.25 pt at 96 DPI and 171.0 pt
-//     at 168 DPI) -- but the resulting page-break positions are
-//     identical across both captures. Print output cannot depend on the
-//     authoring screen's DPI, so the break math needs a DPI-stable
-//     figure, which the 168-DPI capture's `Range.Width` approximates
-//     and the 96-DPI one does not.
-//   * Display width, `applied_geometry.column_widths_pt` in the workbook
-//     oracle goldens: a diagnostic/reporting figure, not compared by any
-//     verifier today (`workbook_oracle_test.cpp` never reads it). This
-//     is the 96-DPI `Range.Width` figure, unadjusted.
-//
-// Only Calibri 11's print-layout width is directly measured (from the
-// print-track captures' own break positions, not a `Range.Width` sweep).
-// Other fonts/sizes' print-layout widths are unmeasured; they are
-// inferred by scaling that font's *display* calibration by the ratio
-// between Calibri 11's print and display figures, separately for the
-// per-character rate and the padding term (`kPrintMdwRatio` /
-// `kPrintPaddingRatio` below) -- an approximation, not a second sweep.
-
-/// Calibri 11's print-layout points-per-character-unit and per-column
-/// padding: the pre-existing figure that both DPI captures' page breaks
-/// agree with, matching the classic `39/7`, `27/7` sevenths that predate
-/// this file's DPI investigation. This is also the print-layout fallback
-/// for any (Normal font family, size) `kColumnWidthCalibrations` below
-/// does not cover.
-constexpr double kPrintPointsPerColumnCharCalibri11 = 39.0 / 7.0;
-constexpr double kPrintColumnPaddingPtCalibri11 = 27.0 / 7.0;
-
-/// Calibri 11's *display* points-per-character-unit and per-column
-/// padding (`Range.Width` at 96 DPI) -- the `kColumnWidthCalibrations`
-/// entry for `{"Calibri", 11}`, restated here so the print/display
-/// ratios below don't depend on table lookup order.
-constexpr double kDisplayPointsPerColumnCharCalibri11 = 5.25;
-constexpr double kDisplayColumnPaddingPtCalibri11 = 3.75;
-
-/// Print-layout-to-display ratios for the per-character rate and the
-/// padding term, derived from Calibri 11 (the only font with a directly
-/// measured print-layout figure) and applied to every other font's
-/// display calibration to approximate its print-layout one.
-constexpr double kPrintMdwRatio = kPrintPointsPerColumnCharCalibri11 / kDisplayPointsPerColumnCharCalibri11;
-constexpr double kPrintPaddingRatio = kPrintColumnPaddingPtCalibri11 / kDisplayColumnPaddingPtCalibri11;
-
-/// Excel's standard default column width, in character units. Used when
-/// neither a `<col>` override nor `<sheetFormatPr defaultColWidth>`
-/// applies.
-constexpr double kStandardColWidthChars = 8.43;
-
-/// One (Normal font family, size) -> (MDW, padding) *display* calibration
-/// point, measured on Windows Excel 365 ja-JP (build 16.0.20228, 100%
-/// display scaling / 96 DPI) via `Range.Width` at stored widths 30/100
-/// chars. `Calibri`/11 reproduces `kDisplayPointsPerColumnCharCalibri11` /
-/// `kDisplayColumnPaddingPtCalibri11` above exactly.
-struct ColumnWidthCalibration {
-  const char* family;
-  int size;
-  double mdw_pt;
-  double pad_pt;
-};
-
-constexpr ColumnWidthCalibration kColumnWidthCalibrations[] = {
-    {"Calibri", 8, 4.5, 3.75},          {"Calibri", 9, 4.5, 3.75},           {"Calibri", 10, 5.25, 3.75},
-    {"Calibri", 11, 5.25, 3.75},        {"Calibri", 12, 6.0, 3.75},          {"Calibri", 14, 7.5, 5.25},
-    {"Calibri", 16, 8.25, 5.25},        {"Calibri", 18, 9.0, 5.25},          {"ＭＳ Ｐゴシック", 8, 4.5, 3.75},
-    {"ＭＳ Ｐゴシック", 9, 4.5, 3.75},  {"ＭＳ Ｐゴシック", 10, 5.25, 3.75}, {"ＭＳ Ｐゴシック", 11, 6.0, 3.75},
-    {"ＭＳ Ｐゴシック", 12, 6.0, 3.75}, {"ＭＳ Ｐゴシック", 14, 7.5, 5.25},  {"ＭＳ Ｐゴシック", 16, 8.25, 5.25},
-    {"ＭＳ Ｐゴシック", 18, 9.0, 5.25}, {"游ゴシック", 8, 4.5, 3.75},        {"游ゴシック", 9, 5.25, 3.75},
-    {"游ゴシック", 10, 5.25, 3.75},     {"游ゴシック", 11, 6.0, 3.75},       {"游ゴシック", 12, 6.75, 5.25},
-    {"游ゴシック", 14, 8.25, 5.25},     {"游ゴシック", 16, 9.0, 5.25},       {"游ゴシック", 18, 9.75, 6.75},
-    {"Meiryo UI", 8, 5.25, 3.75},       {"Meiryo UI", 9, 5.25, 3.75},        {"Meiryo UI", 10, 6.0, 3.75},
-    {"Meiryo UI", 11, 6.75, 5.25},      {"Meiryo UI", 12, 7.5, 5.25},        {"Meiryo UI", 14, 9.0, 5.25},
-    {"Meiryo UI", 16, 9.75, 6.75},      {"Meiryo UI", 18, 11.25, 6.75},
-};
-
-/// The resolved points-per-character-unit and per-column padding used by
-/// `ColumnCharsToPoints`, for either quantity -- the caller picks which
-/// one via `ResolveColumnPrintGeometry` / `ResolveColumnDisplayGeometry`.
-struct ColumnWidthGeometry {
-  double points_per_char = kPrintPointsPerColumnCharCalibri11;
-  double padding_pt = kPrintColumnPaddingPtCalibri11;
-};
-
-/// Looks up the measured *display* calibration for `(family, size)` in
-/// `kColumnWidthCalibrations`. Falls back to the Calibri-11 display
-/// figure for any family or integer size the table does not cover, and
-/// for any non-integer size -- interpolating between the sampled sizes
-/// would be inventing data the capture does not support. Reported as
-/// `applied_geometry.column_widths_pt` in the workbook oracle goldens;
-/// no verifier compares it today, but pagination's own break math must
-/// not read it directly -- see `ResolveColumnPrintGeometry`.
-ColumnWidthGeometry ResolveColumnDisplayGeometry(const std::string& family, double size) {
-  const int size_int = static_cast<int>(size);
-  if (static_cast<double>(size_int) == size) {
-    for (const ColumnWidthCalibration& row : kColumnWidthCalibrations) {
-      if (row.size == size_int && family == row.family) {
-        return ColumnWidthGeometry{row.mdw_pt, row.pad_pt};
-      }
-    }
-  }
-  return ColumnWidthGeometry{kDisplayPointsPerColumnCharCalibri11, kDisplayColumnPaddingPtCalibri11};
-}
-
-/// The geometry `paginate()`'s break math (h_breaks / v_breaks / page
-/// count) must use: `(family, size)`'s display calibration scaled by
-/// Calibri 11's print/display ratios. Reduces to the measured
-/// `kPrintPointsPerColumnCharCalibri11` / `kPrintColumnPaddingPtCalibri11`
-/// exactly for `{"Calibri", 11}` and for any untabulated font/size (both
-/// fall back to the Calibri-11 display figure before scaling).
-ColumnWidthGeometry ResolveColumnPrintGeometry(const std::string& family, double size) {
-  const ColumnWidthGeometry display = ResolveColumnDisplayGeometry(family, size);
-  return ColumnWidthGeometry{display.points_per_char * kPrintMdwRatio, display.padding_pt * kPrintPaddingRatio};
-}
-
-/// Resolves the workbook's Normal-style font: `cell_styles["Normal"]` ->
-/// `xf_id` -> `cell_style_xfs[xf_id].font_index` -> `fonts[font_index]`.
-/// Falls back to `fonts[0]` (the workbook's default font slot) when no
-/// `"Normal"` cell style is declared, or when its `xf_id` / `font_index`
-/// does not resolve. Returns `nullptr` only if `fonts` itself is empty,
-/// which `StylesTable`'s own seeding invariant rules out for any table
-/// produced by this codebase.
-const FontRecord* ResolveNormalFont(const StylesTable& styles) {
-  if (styles.fonts.empty()) {
-    return nullptr;
-  }
-  for (const CellStyleRecord& cell_style : styles.cell_styles) {
-    if (cell_style.name != "Normal") {
-      continue;
-    }
-    if (cell_style.xf_id < styles.cell_style_xfs.size()) {
-      const std::uint32_t font_index = styles.cell_style_xfs[cell_style.xf_id].font_index;
-      if (font_index < styles.fonts.size()) {
-        return &styles.fonts[font_index];
-      }
-    }
-    break;
-  }
-  return &styles.fonts[0];
-}
-
-/// Excel's default row height, in points, measured the same way as the
-/// column constants above (`applied_geometry.row_heights_pt`). Used when
-/// neither a `<row ht>` override nor `<sheetFormatPr defaultRowHeight>`
-/// applies. The nominal 15.0 is the 96-DPI screen figure; Excel resolves
-/// 102/7.
-constexpr double kStandardRowHeightPt = 102.0 / 7.0;
-
 /// Lower clamp for the effective scale factor (1%). Mirrors Excel's
 /// `<pageSetup scale>` minimum so a degenerate `scale="0"` cannot divide
 /// the printable area by zero.
 constexpr double kMinScaleFactor = 0.01;
 
-/// Converts an Excel column width in character units to a width in points.
-///
-/// A hidden or explicit zero-width column resolves to `chars == 0`; it
-/// must convert to exactly `0.0` pt so it never advances a page break or
-/// shifts the fit-to-page scale (Excel excludes it from pagination
-/// extent entirely -- see `ColumnWidthChars`). The flat padding term
-/// below models the cell-border/margin allowance every *visible* column
-/// carries and does not apply to a column with no printed width at all.
-double ColumnCharsToPoints(double chars, const ColumnWidthGeometry& geometry) {
-  if (chars == 0.0) {
-    return 0.0;
-  }
-  return chars * geometry.points_per_char + geometry.padding_pt;
-}
-
-/// Returns the width, in character units, of column `col` on `sheet`.
-///
-/// Precedence: an explicit `<col>` span covering `col`, then
-/// `<sheetFormatPr defaultColWidth>`, then Excel's 8.43-character
-/// standard default.
-double ColumnWidthChars(const Sheet& sheet, std::uint32_t col) {
-  for (const ColumnLayout& span : sheet.layout().columns) {
-    if (col >= span.first && col <= span.last) {
-      // Hidden columns occupy no printed width, so they never advance the
-      // page grid (Excel excludes them from pagination extent).
-      if (span.hidden) {
-        return 0.0;
-      }
-      return HasExplicitColumnWidth(span)
-                 ? span.width
-                 : (sheet.format_defaults().has_default_col_width ? sheet.format_defaults().default_col_width
-                                                                  : kStandardColWidthChars);
-    }
-  }
-  const SheetFormatDefaults& defaults = sheet.format_defaults();
-  if (defaults.has_default_col_width) {
-    return defaults.default_col_width;
-  }
-  return kStandardColWidthChars;
-}
-
-/// Returns the height, in points, of row `row` on `sheet`.
-///
-/// Precedence: an explicit `<row ht>` override, then
-/// `<sheetFormatPr defaultRowHeight>`, then Excel's 15-point standard
-/// default.
-double RowHeightPoints(const Sheet& sheet, std::uint32_t row) {
-  for (const RowLayout& override_row : sheet.layout().row_overrides) {
-    if (override_row.row == row) {
-      // Hidden rows occupy no printed height, so they never advance the
-      // page grid (Excel excludes them from pagination extent).
-      if (override_row.hidden) {
-        return 0.0;
-      }
-      return (override_row.has_height || override_row.height != 0.0)
-                 ? override_row.height
-                 : (sheet.format_defaults().has_default_row_height ? sheet.format_defaults().default_row_height
-                                                                   : kStandardRowHeightPt);
-    }
-  }
-  const SheetFormatDefaults& defaults = sheet.format_defaults();
-  if (defaults.has_default_row_height) {
-    return defaults.default_row_height;
-  }
-  return kStandardRowHeightPt;
-}
+/// Divisor turning the `<pageSetup scale>` percentage into a factor.
+constexpr double kPercentDivisor = 100.0;
 
 /// Computes the sheet's used range as a single rectangle, walking the
 /// populated cells. Returns false when the sheet has no non-blank cell.
@@ -307,15 +84,17 @@ struct AxisInput {
 /// Walks one axis, accumulating track sizes until the printable limit is
 /// reached. Appends the absolute index each break precedes to `out_breaks`
 /// and returns the number of pages produced (always >= 1 when the axis has
-/// at least one track).
+/// at least one track). `out_page_starts` receives the absolute index of
+/// each page's first track, in ascending order.
 std::uint32_t WalkAxis(const AxisInput& axis, std::vector<std::uint32_t>* out_breaks,
-                       std::vector<std::uint32_t>* out_manual_breaks) {
+                       std::vector<std::uint32_t>* out_manual_breaks, std::vector<std::uint32_t>* out_page_starts) {
   const std::size_t track_count = axis.track_sizes.size();
   if (track_count == 0) {
     return 0;
   }
 
   std::uint32_t pages = 1;
+  out_page_starts->push_back(axis.first);
   double accumulated = 0.0;
   for (std::size_t i = 0; i < track_count; ++i) {
     const auto absolute = static_cast<std::uint32_t>(axis.first + i);
@@ -339,6 +118,7 @@ std::uint32_t WalkAxis(const AxisInput& axis, std::vector<std::uint32_t>* out_br
       // multi_area_row_stacked_col_break` -> v=[3,7,7], where 3 is manual).
       (manual_break ? out_manual_breaks : out_breaks)->push_back(absolute);
       ++pages;
+      out_page_starts->push_back(absolute);
       accumulated = 0.0;
     }
     accumulated += size;
@@ -346,6 +126,13 @@ std::uint32_t WalkAxis(const AxisInput& axis, std::vector<std::uint32_t>* out_br
   return pages;
 }
 
+/// The track range one page covers on one axis, with its scaled extent.
+struct PageSpan {
+  std::uint32_t first = 0;
+  std::uint32_t last = 0;
+  double extent_pt = 0.0;
+};
+
 /// Computes the uniform scale factor applied to cell sizes.
 ///
 /// When `fit_to_page` is set, derives a factor that shrinks the print
@@ -367,7 +154,6 @@ std::uint32_t WalkAxis(const AxisInput& axis, std::vector<std::uint32_t>* out_br
 double ComputeScaleFactor(const PageSetup& setup, const PrintableArea& area, double total_width_pt,
                           double total_height_pt, double title_width_pt, double title_height_pt) {
   if (!setup.fit_to_page) {
-    constexpr double kPercentDivisor = 100.0;
     return std::max(kMinScaleFactor, static_cast<double>(setup.scale) / kPercentDivisor);
   }
 
@@ -395,14 +181,8 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
   }
   const Sheet& sheet = wb.sheet(sheet_index);
 
-  // Column width geometry depends on the workbook's Normal-style font
-  // (MDW varies by family and size); resolve it once for every
-  // ColumnCharsToPoints call below. Break math needs the print-layout
-  // geometry, not the display one -- see the comment block above
-  // `ResolveColumnPrintGeometry`.
-  const FontRecord* normal_font = ResolveNormalFont(wb.styles());
-  const ColumnWidthGeometry column_geometry =
-      normal_font != nullptr ? ResolveColumnPrintGeometry(normal_font->name, normal_font->size) : ColumnWidthGeometry{};
+  // Break math needs the print-layout geometry, not the display one.
+  const ColumnWidthModel column_geometry = resolve_column_width_model(wb.styles(), GeometryMode::kPrint);
 
   // 1. Resolve the print area. The reported `result.print_area` mirrors
   // Excel's `PageSetup.PrintArea` exactly: empty when the workbook
@@ -417,6 +197,28 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
   PaginationResult result;
   result.print_area = area_or.value();
 
+  // Page description that depends only on the page setup, so it is reported
+  // even for a sheet with nothing to print.
+  const SheetPrintSettings& settings = sheet.print_settings();
+  const PageSetup& page_setup = settings.page_setup;
+  const PageMargins& page_margins = settings.page_margins;
+  {
+    const PaperDimensions paper = resolve_paper_dimensions(page_setup.paper_size);
+    result.paper.landscape = page_setup.orientation == Orientation::kLandscape;
+    result.paper.width_pt = result.paper.landscape ? paper.height_pt : paper.width_pt;
+    result.paper.height_pt = result.paper.landscape ? paper.width_pt : paper.height_pt;
+    result.paper.known = is_known_paper_size(page_setup.paper_size);
+    result.margins = MarginsPt{page_margins.left * kPointsPerInch,   page_margins.right * kPointsPerInch,
+                               page_margins.top * kPointsPerInch,    page_margins.bottom * kPointsPerInch,
+                               page_margins.header * kPointsPerInch, page_margins.footer * kPointsPerInch};
+    const PrintableArea printable = compute_printable_area(page_setup, page_margins);
+    result.printable = RectPt{result.margins.left, result.margins.top, printable.width_pt, printable.height_pt};
+    result.page_order = settings.page_setup.page_order;
+    result.scale = page_setup.fit_to_page
+                       ? 1.0
+                       : std::max(kMinScaleFactor, static_cast<double>(page_setup.scale) / kPercentDivisor);
+  }
+
   // Excel's `HPageBreaks` / `VPageBreaks` are populated against the
   // *populated* region of the print area, not its full geometric span:
   // a print area whose four corners are blank effectively paginates
@@ -427,6 +229,8 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
   const bool has_used_range = ComputeUsedRange(sheet, &used_box);
 
   std::vector<CellRange> effective_areas;
+  // Index into `result.print_area` each effective area came from.
+  std::vector<std::uint32_t> area_indices;
   if (result.print_area.empty()) {
     // No explicit print area: fall back to the used range. An empty
     // sheet with no print area produces no pages.
@@ -434,6 +238,7 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
       return result;
     }
     effective_areas.push_back(used_box);
+    area_indices.push_back(0U);
   } else {
     // An explicit print area paginates as declared. Intersecting it with
     // the populated box used to look right on cases whose content reaches
@@ -457,7 +262,8 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
     // sheet whose rectangles all drop out produces none.
     constexpr std::uint32_t kMaxRowIndex = Sheet::kMaxRows - 1U;
     constexpr std::uint32_t kMaxColIndex = Sheet::kMaxCols - 1U;
-    for (const CellRange& r : result.print_area) {
+    for (std::size_t area_index = 0; area_index < result.print_area.size(); ++area_index) {
+      const CellRange& r = result.print_area[area_index];
       CellRange clipped = r;
       if (r.last_row >= kMaxRowIndex) {
         if (!has_used_range) {
@@ -475,6 +281,7 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
         continue;
       }
       effective_areas.push_back(clipped);
+      area_indices.push_back(static_cast<std::uint32_t>(area_index));
     }
     if (effective_areas.empty()) {
       return result;
@@ -482,62 +289,28 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
   }
 
   // Build the resolved track geometry once for the union extent. The old
-  // per-track RowHeightPoints / ColumnWidthChars calls each re-scanned every
+  // per-track effective_row_height_pt / effective_column_width_chars calls each re-scanned every
   // layout override, turning a 50k-row pagination into O(rows * overrides).
   // An override that carries only outline / hidden metadata has no `ht`, so
   // it must retain the sheet default height rather than becoming a 0pt row.
   const CellRange union_box = BoundingBox(effective_areas);
-  const SheetFormatDefaults& defaults = sheet.format_defaults();
-  const double default_row_h = defaults.has_default_row_height ? defaults.default_row_height : kStandardRowHeightPt;
-  const double default_col_w = defaults.has_default_col_width ? defaults.default_col_width : kStandardColWidthChars;
-  std::vector<double> row_heights(static_cast<std::size_t>(union_box.last_row - union_box.first_row) + 1U,
-                                  default_row_h);
-  std::vector<bool> row_overridden(row_heights.size(), false);
-  for (const RowLayout& layout : sheet.layout().row_overrides) {
-    if (layout.row < union_box.first_row || layout.row > union_box.last_row) {
-      continue;
-    }
-    const std::size_t index = static_cast<std::size_t>(layout.row - union_box.first_row);
-    if (row_overridden[index]) {
-      continue;
-    }
-    row_overridden[index] = true;
-    row_heights[index] =
-        layout.hidden ? 0.0 : (layout.has_height || layout.height != 0.0 ? layout.height : default_row_h);
-  }
-  std::vector<double> col_widths(static_cast<std::size_t>(union_box.last_col - union_box.first_col) + 1U,
-                                 default_col_w);
-  std::vector<bool> col_overridden(col_widths.size(), false);
-  for (const ColumnLayout& layout : sheet.layout().columns) {
-    const std::uint32_t first = std::max(layout.first, union_box.first_col);
-    const std::uint32_t last = std::min(layout.last, union_box.last_col);
-    if (first > last) {
-      continue;
-    }
-    for (std::uint32_t col = first; col <= last; ++col) {
-      const std::size_t index = static_cast<std::size_t>(col - union_box.first_col);
-      if (col_overridden[index]) {
-        continue;
-      }
-      col_overridden[index] = true;
-      col_widths[index] = layout.hidden ? 0.0 : (HasExplicitColumnWidth(layout) ? layout.width : default_col_w);
-    }
-  }
+  const double default_row_h = default_row_height_pt(sheet);
+  const std::vector<double> row_heights = row_heights_pt(sheet, union_box.first_row, union_box.last_row);
+  const std::vector<double> col_widths = column_widths_chars(sheet, union_box.first_col, union_box.last_col);
   const auto row_height = [&](std::uint32_t row) {
     if (row >= union_box.first_row && row <= union_box.last_row) {
       return row_heights[static_cast<std::size_t>(row - union_box.first_row)];
     }
-    return RowHeightPoints(sheet, row);
+    return effective_row_height_pt(sheet, row);
   };
   const auto col_width = [&](std::uint32_t col) {
     if (col >= union_box.first_col && col <= union_box.last_col) {
       return col_widths[static_cast<std::size_t>(col - union_box.first_col)];
     }
-    return ColumnWidthChars(sheet, col);
+    return effective_column_width_chars(sheet, col);
   };
 
   // 2. Printable body area is determined once from the page setup.
-  const SheetPrintSettings& settings = sheet.print_settings();
   PrintableArea body = compute_printable_area(settings.page_setup, settings.page_margins);
 
   // Print titles (repeat-rows / repeat-columns) are reprinted on every
@@ -570,7 +343,7 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
   if (titles.repeat_cols.has_value()) {
     const auto [first, last] = *titles.repeat_cols;
     for (std::uint32_t col = first; col <= last; ++col) {
-      title_width += ColumnCharsToPoints(col_width(col), column_geometry);
+      title_width += column_chars_to_points(col_width(col), column_geometry);
     }
   }
 
@@ -581,7 +354,7 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
   // fit factor has to accommodate them alongside the data.
   double union_total_width = 0.0;
   for (double width : col_widths) {
-    union_total_width += ColumnCharsToPoints(width, column_geometry);
+    union_total_width += column_chars_to_points(width, column_geometry);
   }
   double union_total_height = 0.0;
   for (double height : row_heights) {
@@ -597,6 +370,17 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
   // raw model size instead would reserve `1 / scale` times too much
   // band and push data onto later pages -- at scale=50 a five-row title
   // block would claim the page space of ten.
+  result.scale = scale;
+  if (titles.repeat_rows.has_value()) {
+    result.print_titles.has_rows = true;
+    result.print_titles.first_row = titles.repeat_rows->first;
+    result.print_titles.last_row = titles.repeat_rows->second;
+  }
+  if (titles.repeat_cols.has_value()) {
+    result.print_titles.has_cols = true;
+    result.print_titles.first_col = titles.repeat_cols->first;
+    result.print_titles.last_col = titles.repeat_cols->second;
+  }
   body.height_pt = std::max(0.0, body.height_pt - title_height * scale);
   body.width_pt = std::max(0.0, body.width_pt - title_width * scale);
 
@@ -625,7 +409,8 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
     row_axis.track_sizes = std::move(row_points);
     row_axis.manual = &settings.manual_row_breaks;
     row_axis.limit_pt = body.height_pt;
-    const std::uint32_t row_pages = WalkAxis(row_axis, &all_h, &manual_h);
+    std::vector<std::uint32_t> row_starts;
+    const std::uint32_t row_pages = WalkAxis(row_axis, &all_h, &manual_h, &row_starts);
 
     // Column axis: symmetric per-area walk through the same axis walker,
     // against the body width exactly as the row axis walks the body height.
@@ -637,20 +422,72 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
     std::vector<double> col_points;
     col_points.reserve(rect.last_col - rect.first_col + 1);
     for (std::uint32_t col = rect.first_col; col <= rect.last_col; ++col) {
-      col_points.push_back(ColumnCharsToPoints(col_width(col), column_geometry) * scale);
+      col_points.push_back(column_chars_to_points(col_width(col), column_geometry) * scale);
     }
     AxisInput col_axis;
     col_axis.first = rect.first_col;
     col_axis.track_sizes = std::move(col_points);
     col_axis.manual = &settings.manual_col_breaks;
     col_axis.limit_pt = body.width_pt;
-    const std::uint32_t col_pages = WalkAxis(col_axis, &all_v, &manual_v);
+    std::vector<std::uint32_t> col_starts;
+    const std::uint32_t col_pages = WalkAxis(col_axis, &all_v, &manual_v, &col_starts);
 
     total_pages += static_cast<std::uint64_t>(col_pages) * static_cast<std::uint64_t>(row_pages);
     if (total_pages > kMaxPaginationPages) {
       return make_error(FormulonErrorCode::kPrintPageCountOverflow, "Pagination page count exceeds the supported limit",
                         "pages=" + std::to_string(total_pages) + " limit=" + std::to_string(kMaxPaginationPages));
     }
+
+    // Pages of this area: the walk's page starts bound each page's track
+    // range. Print areas follow one another; within one, `page_order`
+    // decides which axis runs fastest.
+    const auto pages_of_axis = [](const AxisInput& axis, const std::vector<std::uint32_t>& starts,
+                                  std::uint32_t area_last) {
+      std::vector<PageSpan> spans;
+      spans.reserve(starts.size());
+      for (std::size_t i = 0; i < starts.size(); ++i) {
+        PageSpan span;
+        span.first = starts[i];
+        span.last = i + 1 < starts.size() ? starts[i + 1] - 1U : area_last;
+        for (std::uint32_t track = span.first; track <= span.last; ++track) {
+          span.extent_pt += axis.track_sizes[track - axis.first];
+        }
+        spans.push_back(span);
+      }
+      return spans;
+    };
+    const std::vector<PageSpan> row_spans = pages_of_axis(row_axis, row_starts, rect.last_row);
+    const std::vector<PageSpan> col_spans = pages_of_axis(col_axis, col_starts, rect.last_col);
+    const auto emit_page = [&](const PageSpan& rows, const PageSpan& cols) {
+      PageLayout page;
+      page.area_index = area_indices[static_cast<std::size_t>(&rect - effective_areas.data())];
+      page.first_row = rows.first;
+      page.last_row = rows.last;
+      page.first_col = cols.first;
+      page.last_col = cols.last;
+      // Titles are reprinted ahead of every page that does not already
+      // contain them.
+      const bool rows_offset = titles.repeat_rows.has_value() && rows.first > titles.repeat_rows->second;
+      const bool cols_offset = titles.repeat_cols.has_value() && cols.first > titles.repeat_cols->second;
+      page.origin_x_pt = result.printable.x + (cols_offset ? title_width * scale : 0.0);
+      page.origin_y_pt = result.printable.y + (rows_offset ? title_height * scale : 0.0);
+      page.width_pt = cols.extent_pt;
+      page.height_pt = rows.extent_pt;
+      result.pages.push_back(page);
+    };
+    if (result.page_order == PageOrder::kOverThenDown) {
+      for (const PageSpan& rows : row_spans) {
+        for (const PageSpan& cols : col_spans) {
+          emit_page(rows, cols);
+        }
+      }
+    } else {
+      for (const PageSpan& cols : col_spans) {
+        for (const PageSpan& rows : row_spans) {
+          emit_page(rows, cols);
+        }
+      }
+    }
   }
 
   // 5. Sort the aggregated break positions. Excel's COM collections are
@@ -667,6 +504,18 @@ Expected<PaginationResult, Error> paginate(const Workbook& wb, std::uint32_t she
   merge_manual(&all_h, &manual_h);
   merge_manual(&all_v, &manual_v);
 
+  // Flag the manual entries. A value that is also an automatic break of
+  // another area appears more than once; the first occurrence is the manual one.
+  const auto flag_manual = [](const std::vector<std::uint32_t>& all, const std::vector<std::uint32_t>& manual) {
+    std::vector<bool> flags(all.size(), false);
+    for (const std::uint32_t value : manual) {
+      flags[static_cast<std::size_t>(std::lower_bound(all.begin(), all.end(), value) - all.begin())] = true;
+    }
+    return flags;
+  };
+  result.h_break_manual = flag_manual(all_h, manual_h);
+  result.v_break_manual = flag_manual(all_v, manual_v);
+
   result.h_breaks = std::move(all_h);
   result.v_breaks = std::move(all_v);
   // Bounded by `kMaxPaginationPages` above, so the narrowing is exact.
diff --git a/src/print/pagination.h b/src/print/pagination.h
index 8eee1b177..08d78444f 100644
--- a/src/print/pagination.h
+++ b/src/print/pagination.h
@@ -22,7 +22,9 @@
 #include <cstdint>
 #include <vector>
 
+#include "print/page_setup.h"
 #include "print/print_area.h"
+#include "print/sheet_geometry.h"
 #include "utils/error.h"
 #include "utils/expected.h"
 
@@ -32,6 +34,53 @@ class Workbook;
 
 namespace print {
 
+/// The physical paper a sheet prints on, orientation-adjusted.
+struct PaperInfo {
+  double width_pt = 0.0;   ///< Page width after the orientation swap, in points.
+  double height_pt = 0.0;  ///< Page height after the orientation swap, in points.
+  bool landscape = false;
+  /// False when `paperSize` is not a recognised code and A4 was substituted.
+  bool known = true;
+};
+
+/// Page margins in points.
+struct MarginsPt {
+  double left = 0.0;
+  double right = 0.0;
+  double top = 0.0;
+  double bottom = 0.0;
+  double header = 0.0;  ///< Page edge to header band.
+  double footer = 0.0;  ///< Page edge to footer band.
+};
+
+/// The repeat-rows / repeat-columns in effect (0-based, inclusive).
+struct PrintTitleSpan {
+  bool has_rows = false;
+  std::uint32_t first_row = 0;
+  std::uint32_t last_row = 0;
+  bool has_cols = false;
+  std::uint32_t first_col = 0;
+  std::uint32_t last_col = 0;
+};
+
+/// One physical page: the cell block it carries and where it sits.
+///
+/// `width_pt` / `height_pt` are the scaled extent of the page's own cell
+/// block (repeated titles excluded). `origin_*_pt` is the block's top-left
+/// corner on the paper; a page that reprints title rows / columns starts
+/// below / right of them.
+struct PageLayout {
+  std::uint32_t area_index = 0;  ///< Index into `PaginationResult::print_area` (0 for the used-range fallback).
+  std::uint32_t first_row = 0;
+  std::uint32_t last_row = 0;
+  std::uint32_t first_col = 0;
+  std::uint32_t last_col = 0;
+  double origin_x_pt = 0.0;
+  double origin_y_pt = 0.0;
+  double width_pt = 0.0;
+  double height_pt = 0.0;
+};
+
 /// The result of paginating one worksheet.
 struct PaginationResult {
   /// The sheet's declared `_xlnm.Print_Area`, as one or more rectangles.
@@ -49,6 +98,25 @@ struct PaginationResult {
   std::vector<std::uint32_t> v_breaks;
   /// Total physical page count: column-pages multiplied by row-pages.
   std::uint32_t page_count = 0;
+  /// Paper after the orientation swap.
+  PaperInfo paper;
+  /// Page margins in points.
+  MarginsPt margins;
+  /// Cell-body rectangle before print-title reservation, in points from the
+  /// page's top-left corner: it starts at the left / top margin.
+  RectPt printable;
+  /// Effective scale as a factor (1.0 is 100%): the `scale` percentage, or
+  /// the fit-to-page factor.
+  double scale = 1.0;
+  PageOrder page_order = PageOrder::kDownThenOver;
+  PrintTitleSpan print_titles;
+  /// Every physical page, in print order (`page_order`; print areas in
+  /// declaration order). `pages.size() == page_count`.
+  std::vector<PageLayout> pages;
+  /// Parallel to `h_breaks` / `v_breaks`: true when that break is a manual
+  /// one rather than computed by the page walk.
+  std::vector<bool> h_break_manual;
+  std::vector<bool> v_break_manual;
 };
 
 /// Paginates sheet `sheet_index` (0-based) of `wb`.
diff --git a/src/print/print_area.cpp b/src/print/print_area.cpp
index 2116bfecb..623b8a8fa 100644
--- a/src/print/print_area.cpp
+++ b/src/print/print_area.cpp
@@ -274,24 +274,22 @@ bool ParseTitleToken(std::string_view token, PrintTitles* out_titles) {
   return true;
 }
 
-}  // namespace
-
-bool parse_area_token(std::string_view token, CellRange* out_range) {
-  return ParseRangeToken(StripAnchors(token), out_range);
-}
-
-Expected<std::vector<CellRange>, Error> resolve_print_area(const Workbook& wb, std::uint32_t sheet_index) {
-  std::vector<CellRange> ranges;
-  const std::string* formula = FindSheetScopedFormula(wb, sheet_index, kPrintAreaName);
+/// Looks up a sheet-scoped defined name and splits its comma-separated body
+/// into cleaned (sheet-unqualified, unanchored) tokens. An absent name yields
+/// an empty vector.
+Expected<std::vector<std::string>, Error> SplitDefinedNameAreas(const Workbook& wb, std::uint32_t sheet_index,
+                                                                std::string_view defined_name,
+                                                                const char* empty_body_msg,
+                                                                const char* empty_token_msg) {
+  std::vector<std::string> tokens;
+  const std::string* formula = FindSheetScopedFormula(wb, sheet_index, defined_name);
   if (formula == nullptr) {
-    // An absent print area is not an error: callers fall back to the
-    // sheet's used range.
-    return ranges;
+    return tokens;
   }
 
   const std::string_view body = Trim(*formula);
   if (body.empty()) {
-    return make_error(FormulonErrorCode::kPrintInvalidArea, "Empty Print_Area formula",
+    return make_error(FormulonErrorCode::kPrintInvalidArea, empty_body_msg,
                       "sheet_index=" + std::to_string(sheet_index));
   }
 
@@ -304,10 +302,30 @@ Expected<std::vector<CellRange>, Error> resolve_print_area(const Workbook& wb, s
     const std::string_view raw = Trim(body.substr(start, comma - start));
     start = comma + 1;
     if (raw.empty()) {
-      return make_error(FormulonErrorCode::kPrintInvalidArea, "Empty area in Print_Area formula",
+      return make_error(FormulonErrorCode::kPrintInvalidArea, empty_token_msg,
                         "sheet_index=" + std::to_string(sheet_index));
     }
-    const std::string cleaned = StripAnchors(StripSheetQualifier(raw));
+    tokens.push_back(StripAnchors(StripSheetQualifier(raw)));
+  }
+  return tokens;
+}
+
+}  // namespace
+
+bool parse_area_token(std::string_view token, CellRange* out_range) {
+  return ParseRangeToken(StripAnchors(token), out_range);
+}
+
+Expected<std::vector<CellRange>, Error> resolve_print_area(const Workbook& wb, std::uint32_t sheet_index) {
+  // An absent print area is not an error (empty result): callers fall back to
+  // the sheet's used range.
+  auto tokens = SplitDefinedNameAreas(wb, sheet_index, kPrintAreaName, "Empty Print_Area formula",
+                                      "Empty area in Print_Area formula");
+  if (!tokens) {
+    return tokens.error();
+  }
+  std::vector<CellRange> ranges;
+  for (const std::string& cleaned : tokens.value()) {
     CellRange range;
     if (!ParseRangeToken(cleaned, &range)) {
       return make_error(FormulonErrorCode::kPrintInvalidArea, "Malformed Print_Area range",
@@ -319,31 +337,13 @@ Expected<std::vector<CellRange>, Error> resolve_print_area(const Workbook& wb, s
 }
 
 Expected<PrintTitles, Error> resolve_print_titles(const Workbook& wb, std::uint32_t sheet_index) {
-  PrintTitles titles;
-  const std::string* formula = FindSheetScopedFormula(wb, sheet_index, kPrintTitlesName);
-  if (formula == nullptr) {
-    return titles;
-  }
-
-  const std::string_view body = Trim(*formula);
-  if (body.empty()) {
-    return make_error(FormulonErrorCode::kPrintInvalidArea, "Empty Print_Titles formula",
-                      "sheet_index=" + std::to_string(sheet_index));
+  auto tokens = SplitDefinedNameAreas(wb, sheet_index, kPrintTitlesName, "Empty Print_Titles formula",
+                                      "Empty token in Print_Titles formula");
+  if (!tokens) {
+    return tokens.error();
   }
-
-  std::size_t start = 0;
-  while (start <= body.size()) {
-    std::size_t comma = FindAreaSeparator(body, start);
-    if (comma == std::string_view::npos) {
-      comma = body.size();
-    }
-    const std::string_view raw = Trim(body.substr(start, comma - start));
-    start = comma + 1;
-    if (raw.empty()) {
-      return make_error(FormulonErrorCode::kPrintInvalidArea, "Empty token in Print_Titles formula",
-                        "sheet_index=" + std::to_string(sheet_index));
-    }
-    const std::string cleaned = StripAnchors(StripSheetQualifier(raw));
+  PrintTitles titles;
+  for (const std::string& cleaned : tokens.value()) {
     if (!ParseTitleToken(cleaned, &titles)) {
       return make_error(FormulonErrorCode::kPrintInvalidArea, "Malformed Print_Titles token",
                         "sheet_index=" + std::to_string(sheet_index) + " token=" + cleaned);
diff --git a/src/print/sheet_geometry.cpp b/src/print/sheet_geometry.cpp
new file mode 100644
index 000000000..18c93dd15
--- /dev/null
+++ b/src/print/sheet_geometry.cpp
@@ -0,0 +1,335 @@
+#include "print/sheet_geometry.h"
+
+#include <algorithm>
+#include <utility>
+
+#include "sheet.h"
+#include "styles.h"
+
+namespace formulon {
+namespace print {
+namespace {
+
+// --- Excel column-width geometry constants. ---
+//
+// Excel stores a column's width in "character" units relative to the
+// default font's maximum digit width (MDW). The character-to-pixel
+// conversion below is Excel's documented formula; the constants are
+// named so the arithmetic carries no bare literals.
+//
+// Two distinct quantities share this stored-width input and must not be
+// confused:
+//
+//   * Print-layout width, consumed only by `paginate()`'s own break math
+//     (h_breaks / v_breaks / page count). Comparing a Windows Excel 365
+//     ja-JP build 16.0.20228/16.0.20326 capture taken at 100% display
+//     scaling (96 DPI) against one of the *same build* taken at 175%
+//     (168 DPI) shows `Range.Width` itself is DPI-dependent (Calibri 11
+//     resolves a 30-character column to 161.25 pt at 96 DPI and 171.0 pt
+//     at 168 DPI) -- but the resulting page-break positions are
+//     identical across both captures. Print output cannot depend on the
+//     authoring screen's DPI, so the break math needs a DPI-stable
+//     figure, which the 168-DPI capture's `Range.Width` approximates
+//     and the 96-DPI one does not.
+//   * Display width, `applied_geometry.column_widths_pt` in the workbook
+//     oracle goldens: a diagnostic/reporting figure, not compared by any
+//     verifier today (`workbook_oracle_test.cpp` never reads it). This
+//     is the 96-DPI `Range.Width` figure, unadjusted.
+//
+// Only Calibri 11's print-layout width is directly measured (from the
+// print-track captures' own break positions, not a `Range.Width` sweep).
+// Other fonts/sizes' print-layout widths are unmeasured; they are
+// inferred by scaling that font's *display* calibration by the ratio
+// between Calibri 11's print and display figures, separately for the
+// per-character rate and the padding term (`kPrintMdwRatio` /
+// `kPrintPaddingRatio` below) -- an approximation, not a second sweep.
+
+/// Calibri 11's print-layout points-per-character-unit and per-column
+/// padding: the pre-existing figure that both DPI captures' page breaks
+/// agree with, matching the classic `39/7`, `27/7` sevenths that predate
+/// this file's DPI investigation. This is also the print-layout fallback
+/// for any (Normal font family, size) `kColumnWidthCalibrations` below
+/// does not cover.
+constexpr double kPrintPointsPerColumnCharCalibri11 = 39.0 / 7.0;
+constexpr double kPrintColumnPaddingPtCalibri11 = 27.0 / 7.0;
+
+/// Calibri 11's *display* points-per-character-unit and per-column
+/// padding (`Range.Width` at 96 DPI) -- the `kColumnWidthCalibrations`
+/// entry for `{"Calibri", 11}`, restated here so the print/display
+/// ratios below don't depend on table lookup order.
+constexpr double kDisplayPointsPerColumnCharCalibri11 = 5.25;
+constexpr double kDisplayColumnPaddingPtCalibri11 = 3.75;
+
+/// Print-layout-to-display ratios for the per-character rate and the
+/// padding term, derived from Calibri 11 (the only font with a directly
+/// measured print-layout figure) and applied to every other font's
+/// display calibration to approximate its print-layout one.
+constexpr double kPrintMdwRatio = kPrintPointsPerColumnCharCalibri11 / kDisplayPointsPerColumnCharCalibri11;
+constexpr double kPrintPaddingRatio = kPrintColumnPaddingPtCalibri11 / kDisplayColumnPaddingPtCalibri11;
+
+/// Excel's standard default column width, in character units. Used when
+/// neither a `<col>` override nor `<sheetFormatPr defaultColWidth>`
+/// applies.
+constexpr double kStandardColWidthChars = 8.43;
+
+/// One (Normal font family, size) -> (MDW, padding) *display* calibration
+/// point, measured on Windows Excel 365 ja-JP (build 16.0.20228, 100%
+/// display scaling / 96 DPI) via `Range.Width` at stored widths 30/100
+/// chars. `Calibri`/11 reproduces `kDisplayPointsPerColumnCharCalibri11` /
+/// `kDisplayColumnPaddingPtCalibri11` above exactly.
+struct ColumnWidthCalibration {
+  const char* family;
+  int size;
+  double mdw_pt;
+  double pad_pt;
+};
+
+constexpr ColumnWidthCalibration kColumnWidthCalibrations[] = {
+    {"Calibri", 8, 4.5, 3.75},          {"Calibri", 9, 4.5, 3.75},           {"Calibri", 10, 5.25, 3.75},
+    {"Calibri", 11, 5.25, 3.75},        {"Calibri", 12, 6.0, 3.75},          {"Calibri", 14, 7.5, 5.25},
+    {"Calibri", 16, 8.25, 5.25},        {"Calibri", 18, 9.0, 5.25},          {"ＭＳ Ｐゴシック", 8, 4.5, 3.75},
+    {"ＭＳ Ｐゴシック", 9, 4.5, 3.75},  {"ＭＳ Ｐゴシック", 10, 5.25, 3.75}, {"ＭＳ Ｐゴシック", 11, 6.0, 3.75},
+    {"ＭＳ Ｐゴシック", 12, 6.0, 3.75}, {"ＭＳ Ｐゴシック", 14, 7.5, 5.25},  {"ＭＳ Ｐゴシック", 16, 8.25, 5.25},
+    {"ＭＳ Ｐゴシック", 18, 9.0, 5.25}, {"游ゴシック", 8, 4.5, 3.75},        {"游ゴシック", 9, 5.25, 3.75},
+    {"游ゴシック", 10, 5.25, 3.75},     {"游ゴシック", 11, 6.0, 3.75},       {"游ゴシック", 12, 6.75, 5.25},
+    {"游ゴシック", 14, 8.25, 5.25},     {"游ゴシック", 16, 9.0, 5.25},       {"游ゴシック", 18, 9.75, 6.75},
+    {"Meiryo UI", 8, 5.25, 3.75},       {"Meiryo UI", 9, 5.25, 3.75},        {"Meiryo UI", 10, 6.0, 3.75},
+    {"Meiryo UI", 11, 6.75, 5.25},      {"Meiryo UI", 12, 7.5, 5.25},        {"Meiryo UI", 14, 9.0, 5.25},
+    {"Meiryo UI", 16, 9.75, 6.75},      {"Meiryo UI", 18, 11.25, 6.75},
+};
+
+/// The resolved points-per-character-unit and per-column padding for either
+/// mode, plus whether the font was a measured calibration point.
+struct ColumnWidthGeometry {
+  double points_per_char = kPrintPointsPerColumnCharCalibri11;
+  double padding_pt = kPrintColumnPaddingPtCalibri11;
+  bool calibrated = false;
+};
+
+/// Looks up the measured *display* calibration for `(family, size)` in
+/// `kColumnWidthCalibrations`. Falls back to the Calibri-11 display
+/// figure (with `calibrated == false`) for any family or integer size the
+/// table does not cover, and for any non-integer size -- interpolating
+/// between the sampled sizes would be inventing data the capture does not
+/// support.
+ColumnWidthGeometry ResolveColumnDisplayGeometry(const std::string& family, double size) {
+  const int size_int = static_cast<int>(size);
+  if (static_cast<double>(size_int) == size) {
+    for (const ColumnWidthCalibration& row : kColumnWidthCalibrations) {
+      if (row.size == size_int && family == row.family) {
+        return ColumnWidthGeometry{row.mdw_pt, row.pad_pt, true};
+      }
+    }
+  }
+  return ColumnWidthGeometry{kDisplayPointsPerColumnCharCalibri11, kDisplayColumnPaddingPtCalibri11, false};
+}
+
+/// The geometry pagination's break math must use: `(family, size)`'s
+/// display calibration scaled by Calibri 11's print/display ratios. Reduces
+/// to the measured `kPrintPointsPerColumnCharCalibri11` /
+/// `kPrintColumnPaddingPtCalibri11` exactly for `{"Calibri", 11}` and for
+/// any untabulated font/size.
+ColumnWidthGeometry ResolveColumnPrintGeometry(const std::string& family, double size) {
+  const ColumnWidthGeometry display = ResolveColumnDisplayGeometry(family, size);
+  return ColumnWidthGeometry{display.points_per_char * kPrintMdwRatio, display.padding_pt * kPrintPaddingRatio,
+                             display.calibrated};
+}
+
+/// Excel's default row height, in points, measured the same way as the
+/// column constants above (`applied_geometry.row_heights_pt`). Used when
+/// neither a `<row ht>` override nor `<sheetFormatPr defaultRowHeight>`
+/// applies. The nominal 15.0 is the 96-DPI screen figure; Excel resolves
+/// 102/7.
+constexpr double kStandardRowHeightPt = 102.0 / 7.0;
+
+/// Height of one row override: hidden is zero, an explicit height wins,
+/// anything else keeps the sheet default.
+double OverrideRowHeight(const RowLayout& layout, double default_height) {
+  if (layout.hidden) {
+    return 0.0;
+  }
+  return (layout.has_height || layout.height != 0.0) ? layout.height : default_height;
+}
+
+/// Width of one column span in character units: hidden is zero, an explicit
+/// width wins, anything else keeps the sheet default.
+double SpanColumnWidth(const ColumnLayout& span, double default_width) {
+  if (span.hidden) {
+    return 0.0;
+  }
+  return HasExplicitColumnWidth(span) ? span.width : default_width;
+}
+
+}  // namespace
+
+const FontRecord* resolve_normal_font(const StylesTable& styles) {
+  if (styles.fonts.empty()) {
+    return nullptr;
+  }
+  for (const CellStyleRecord& cell_style : styles.cell_styles) {
+    if (cell_style.name != "Normal") {
+      continue;
+    }
+    if (cell_style.xf_id < styles.cell_style_xfs.size()) {
+      const std::uint32_t font_index = styles.cell_style_xfs[cell_style.xf_id].font_index;
+      if (font_index < styles.fonts.size()) {
+        return &styles.fonts[font_index];
+      }
+    }
+    break;
+  }
+  return &styles.fonts[0];
+}
+
+ColumnWidthModel resolve_column_width_model(const StylesTable& styles, GeometryMode mode) {
+  const FontRecord* font = resolve_normal_font(styles);
+  ColumnWidthModel model;
+  ColumnWidthGeometry geometry;
+  if (font != nullptr) {
+    geometry = mode == GeometryMode::kDisplay ? ResolveColumnDisplayGeometry(font->name, font->size)
+                                              : ResolveColumnPrintGeometry(font->name, font->size);
+    model.normal_font_name = font->name;
+    model.normal_font_size = font->size;
+  } else {
+    geometry = mode == GeometryMode::kDisplay
+                   ? ColumnWidthGeometry{kDisplayPointsPerColumnCharCalibri11, kDisplayColumnPaddingPtCalibri11, false}
+                   : ColumnWidthGeometry{};
+  }
+  model.points_per_char = geometry.points_per_char;
+  model.padding_pt = geometry.padding_pt;
+  model.calibrated = geometry.calibrated;
+  return model;
+}
+
+double column_chars_to_points(double chars, const ColumnWidthModel& model) {
+  // A hidden or explicit zero-width column converts to exactly zero so it
+  // never advances a page break or shifts the fit-to-page scale (Excel
+  // excludes it from pagination extent); the flat padding term models the
+  // allowance every *visible* column carries.
+  if (chars == 0.0) {
+    return 0.0;
+  }
+  return chars * model.points_per_char + model.padding_pt;
+}
+
+double column_points_to_chars(double points, const ColumnWidthModel& model) {
+  if (points <= 0.0 || model.points_per_char <= 0.0) {
+    return 0.0;
+  }
+  return std::max(0.0, (points - model.padding_pt) / model.points_per_char);
+}
+
+double default_column_width_chars(const Sheet& sheet) {
+  const SheetFormatDefaults& defaults = sheet.format_defaults();
+  return defaults.has_default_col_width ? defaults.default_col_width : kStandardColWidthChars;
+}
+
+double default_row_height_pt(const Sheet& sheet) {
+  const SheetFormatDefaults& defaults = sheet.format_defaults();
+  return defaults.has_default_row_height ? defaults.default_row_height : kStandardRowHeightPt;
+}
+
+double effective_column_width_chars(const Sheet& sheet, std::uint32_t col) {
+  const double default_width = default_column_width_chars(sheet);
+  for (const ColumnLayout& span : sheet.layout().columns) {
+    if (col >= span.first && col <= span.last) {
+      // Hidden columns occupy no printed width, so they never advance the
+      // page grid.
+      return SpanColumnWidth(span, default_width);
+    }
+  }
+  return default_width;
+}
+
+double effective_row_height_pt(const Sheet& sheet, std::uint32_t row) {
+  const double default_height = default_row_height_pt(sheet);
+  for (const RowLayout& override_row : sheet.layout().row_overrides) {
+    if (override_row.row == row) {
+      return OverrideRowHeight(override_row, default_height);
+    }
+  }
+  return default_height;
+}
+
+std::vector<double> column_widths_chars(const Sheet& sheet, std::uint32_t first, std::uint32_t last) {
+  const double default_width = default_column_width_chars(sheet);
+  std::vector<double> widths(static_cast<std::size_t>(last - first) + 1U, default_width);
+  std::vector<bool> assigned(widths.size(), false);
+  for (const ColumnLayout& span : sheet.layout().columns) {
+    const std::uint32_t span_first = std::max(span.first, first);
+    const std::uint32_t span_last = std::min(span.last, last);
+    for (std::uint32_t col = span_first; col <= span_last; ++col) {
+      const auto index = static_cast<std::size_t>(col - first);
+      if (assigned[index]) {
+        continue;
+      }
+      assigned[index] = true;
+      widths[index] = SpanColumnWidth(span, default_width);
+    }
+  }
+  return widths;
+}
+
+std::vector<double> row_heights_pt(const Sheet& sheet, std::uint32_t first, std::uint32_t last) {
+  const double default_height = default_row_height_pt(sheet);
+  std::vector<double> heights(static_cast<std::size_t>(last - first) + 1U, default_height);
+  std::vector<bool> assigned(heights.size(), false);
+  for (const RowLayout& layout : sheet.layout().row_overrides) {
+    if (layout.row < first || layout.row > last) {
+      continue;
+    }
+    const auto index = static_cast<std::size_t>(layout.row - first);
+    if (assigned[index]) {
+      continue;
+    }
+    assigned[index] = true;
+    heights[index] = OverrideRowHeight(layout, default_height);
+  }
+  return heights;
+}
+
+double effective_column_width_pt(const Sheet& sheet, std::uint32_t col, const ColumnWidthModel& model) {
+  return column_chars_to_points(effective_column_width_chars(sheet, col), model);
+}
+
+double column_offset_pt(const Sheet& sheet, std::uint32_t col, const ColumnWidthModel& model) {
+  if (col == 0U) {
+    return 0.0;
+  }
+  double offset = 0.0;
+  for (const double chars : column_widths_chars(sheet, 0U, col - 1U)) {
+    offset += column_chars_to_points(chars, model);
+  }
+  return offset;
+}
+
+double row_offset_pt(const Sheet& sheet, std::uint32_t row) {
+  // Rows are numerous (up to 2^20), so adjust the default-height run by the
+  // overrides instead of materialising every row.
+  const double default_height = default_row_height_pt(sheet);
+  double offset = default_height * static_cast<double>(row);
+  std::vector<std::uint32_t> seen;
+  for (const RowLayout& layout : sheet.layout().row_overrides) {
+    if (layout.row >= row) {
+      continue;
+    }
+    if (std::find(seen.begin(), seen.end(), layout.row) != seen.end()) {
+      continue;
+    }
+    seen.push_back(layout.row);
+    offset += OverrideRowHeight(layout, default_height) - default_height;
+  }
+  return offset;
+}
+
+RectPt cell_rect_pt(const Sheet& sheet, std::uint32_t row, std::uint32_t col, const ColumnWidthModel& model) {
+  RectPt rect;
+  rect.x = column_offset_pt(sheet, col, model);
+  rect.y = row_offset_pt(sheet, row);
+  rect.width = effective_column_width_pt(sheet, col, model);
+  rect.height = effective_row_height_pt(sheet, row);
+  return rect;
+}
+
+}  // namespace print
+}  // namespace formulon
diff --git a/src/print/sheet_geometry.h b/src/print/sheet_geometry.h
new file mode 100644
index 000000000..e21e4f126
--- /dev/null
+++ b/src/print/sheet_geometry.h
@@ -0,0 +1,114 @@
+//
+// Sheet geometry: column widths, row heights and cell rectangles in points.
+//
+// Excel stores a column width in character units relative to the Normal
+// font's maximum digit width (MDW). This module owns the Normal-font
+// resolution, the measured MDW calibration, and the character-unit to point
+// conversion, in two modes:
+//
+//   * `kDisplay` — the Windows screen figure (`Range.Width` at 96 DPI;
+//     Calibri 11 resolves to 5.25 pt per character plus 3.75 pt padding).
+//   * `kPrint` — the DPI-stable figure the pagination break math uses
+//     (Calibri 11: 39/7 pt per character plus 27/7 pt padding).
+//
+// Only Windows calibration exists; Mac Excel follows a different regime and
+// is deliberately not modelled. A Normal font outside the calibrated set
+// falls back to the Calibri 11 figure and reports `calibrated == false`.
+//
+// Cell rectangles have their origin at the top-left of cell A1; hidden rows
+// and columns contribute zero extent.
+
+#ifndef FORMULON_PRINT_SHEET_GEOMETRY_H_
+#define FORMULON_PRINT_SHEET_GEOMETRY_H_
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace formulon {
+
+class Sheet;
+struct FontRecord;
+struct StylesTable;
+
+namespace print {
+
+/// Which Windows column-width figure a conversion uses.
+enum class GeometryMode : std::int32_t {
+  kDisplay = 0,  ///< Screen figure (96 DPI `Range.Width`).
+  kPrint = 1,    ///< Print-layout figure used by pagination.
+};
+
+/// The character-unit to point conversion for one Normal font and mode.
+struct ColumnWidthModel {
+  double points_per_char = 0.0;  ///< Points per character unit (the MDW).
+  double padding_pt = 0.0;       ///< Flat per-visible-column padding, in points.
+  std::string normal_font_name;  ///< Normal-style font family the model was resolved for.
+  double normal_font_size = 0.0;
+  /// False when `(normal_font_name, normal_font_size)` is not a measured
+  /// calibration point and the Calibri 11 figure was used instead.
+  bool calibrated = true;
+  const char* platform = "win";  ///< The only calibrated platform.
+};
+
+/// A rectangle in points, origin at the top-left of the sheet.
+struct RectPt {
+  double x = 0.0;
+  double y = 0.0;
+  double width = 0.0;
+  double height = 0.0;
+};
+
+/// Resolves the workbook's Normal-style font: the `"Normal"` cell style's
+/// font, else `fonts[0]`. Returns `nullptr` only when `styles.fonts` is empty.
+const FontRecord* resolve_normal_font(const StylesTable& styles);
+
+/// Builds the conversion model for `styles`' Normal font in `mode`. An
+/// empty font table yields the Calibri 11 model with `calibrated == false`.
+ColumnWidthModel resolve_column_width_model(const StylesTable& styles, GeometryMode mode);
+
+/// Converts a width in character units to points. Zero characters (a hidden
+/// or zero-width column) is exactly zero points: no padding applies.
+double column_chars_to_points(double chars, const ColumnWidthModel& model);
+
+/// Inverse of `column_chars_to_points`; zero or negative points map to zero.
+double column_points_to_chars(double points, const ColumnWidthModel& model);
+
+/// The sheet's default column width in character units
+/// (`defaultColWidth`, else Excel's 8.43).
+double default_column_width_chars(const Sheet& sheet);
+
+/// The sheet's default row height in points (`defaultRowHeight`, else the
+/// measured 102/7 pt).
+double default_row_height_pt(const Sheet& sheet);
+
+/// Effective width of column `col` in character units; zero when hidden.
+double effective_column_width_chars(const Sheet& sheet, std::uint32_t col);
+
+/// Effective height of row `row` in points; zero when hidden.
+double effective_row_height_pt(const Sheet& sheet, std::uint32_t row);
+
+/// Effective widths of columns `first..last` (inclusive) in character units.
+/// Equivalent to calling `effective_column_width_chars` per column, in one
+/// pass over the layout.
+std::vector<double> column_widths_chars(const Sheet& sheet, std::uint32_t first, std::uint32_t last);
+
+/// Effective heights of rows `first..last` (inclusive) in points.
+std::vector<double> row_heights_pt(const Sheet& sheet, std::uint32_t first, std::uint32_t last);
+
+/// Effective width of column `col` in points under `model`.
+double effective_column_width_pt(const Sheet& sheet, std::uint32_t col, const ColumnWidthModel& model);
+
+/// Distance from the sheet's left edge to the left edge of column `col`.
+double column_offset_pt(const Sheet& sheet, std::uint32_t col, const ColumnWidthModel& model);
+
+/// Distance from the sheet's top edge to the top edge of row `row`.
+double row_offset_pt(const Sheet& sheet, std::uint32_t row);
+
+/// The rectangle of cell (`row`, `col`), 0-based, in points.
+RectPt cell_rect_pt(const Sheet& sheet, std::uint32_t row, std::uint32_t col, const ColumnWidthModel& model);
+
+}  // namespace print
+}  // namespace formulon
+
+#endif  // FORMULON_PRINT_SHEET_GEOMETRY_H_
diff --git a/src/sheet.cpp b/src/sheet.cpp
index e32f6fe8e..cc14ca742 100644
--- a/src/sheet.cpp
+++ b/src/sheet.cpp
@@ -23,6 +23,7 @@
 #include "phonetic.h"
 #include "pivot/pivot_table.h"
 #include "utils/arena.h"
+#include "utils/index_sort.h"
 #include "utils/resource_budget.h"
 #include "utils/utf8_length.h"
 #include "value.h"
@@ -36,14 +37,126 @@ namespace formulon {
 // The table is keyed only by anchor cell and owns each region's payload.
 // Phantom lookup scans these rectangles rather than retaining one hash-map
 // entry per spilled cell: a 1,000 x 100 spill is one region, not 99,999
-// duplicate reverse-index nodes. Iteration order is undefined; consumers
+// duplicate reverse-index nodes. A row-band index narrows that scan to the
+// regions near the queried rows. Iteration order is undefined; consumers
 // that need a deterministic order must sort externally.
 struct SpillTable {
+  // The band index points into `by_anchor`, so a copy would dangle.
+  SpillTable() = default;
+  SpillTable(const SpillTable&) = delete;
+  SpillTable& operator=(const SpillTable&) = delete;
+
+  // Mutate only through `add_region` / `erase_region` / `clear_regions`, which keep the band index in step.
   std::unordered_map<CellAddress, SpillRegion, CellAddressHash> by_anchor;
   // A failed dynamic-array commit leaves the anchor's attempted rectangle
   // here so later writes/removals inside that rectangle can re-dirty the
   // producer without requiring the user to touch the formula again.
   std::unordered_map<CellAddress, BlockedSpillFootprint, CellAddressHash> blocked_by_anchor;
+
+  // Rows per band of the committed-region index. A region spanning more than
+  // `kMaxIndexedBands` bands (a whole-column spill) goes to `tall_regions`,
+  // which every query visits, so insertion stays bounded.
+  static constexpr std::uint32_t kBandRows = 64U;
+  static constexpr std::uint64_t kMaxIndexedBands = 64U;
+
+  // Map nodes are stable across rehash, so the index holds region pointers.
+  std::unordered_map<std::uint32_t, std::vector<const SpillRegion*>> regions_by_band;
+  std::vector<const SpillRegion*> tall_regions;
+
+  bool add_region(const CellAddress& anchor, SpillRegion region) {
+    const auto inserted = by_anchor.emplace(anchor, std::move(region));
+    if (!inserted.second) {
+      return false;
+    }
+    const SpillRegion* stored = &inserted.first->second;
+    const std::uint32_t first_band = first_band_of(*stored);
+    const std::uint32_t last_band = last_band_of(*stored);
+    if (static_cast<std::uint64_t>(last_band) - first_band + 1U > kMaxIndexedBands) {
+      tall_regions.push_back(stored);
+      return true;
+    }
+    for (std::uint32_t band = first_band; band <= last_band; ++band) {
+      regions_by_band[band].push_back(stored);
+    }
+    return true;
+  }
+
+  void erase_region(std::unordered_map<CellAddress, SpillRegion, CellAddressHash>::iterator it) noexcept {
+    const SpillRegion* stored = &it->second;
+    const std::uint32_t first_band = first_band_of(*stored);
+    const std::uint32_t last_band = last_band_of(*stored);
+    if (static_cast<std::uint64_t>(last_band) - first_band + 1U > kMaxIndexedBands) {
+      tall_regions.erase(std::remove(tall_regions.begin(), tall_regions.end(), stored), tall_regions.end());
+    } else {
+      for (std::uint32_t band = first_band; band <= last_band; ++band) {
+        const auto bucket = regions_by_band.find(band);
+        if (bucket == regions_by_band.end()) {
+          continue;
+        }
+        auto& regions = bucket->second;
+        regions.erase(std::remove(regions.begin(), regions.end(), stored), regions.end());
+        if (regions.empty()) {
+          regions_by_band.erase(bucket);
+        }
+      }
+    }
+    by_anchor.erase(it);
+  }
+
+  void clear_regions() noexcept {
+    by_anchor.clear();
+    regions_by_band.clear();
+    tall_regions.clear();
+  }
+
+  // Calls `fn(const SpillRegion&)` for every committed region that may
+  // intersect rows `[row_begin, row_end)`, possibly more than once, until it
+  // returns true. Returns whether it did.
+  template <typename Fn>
+  bool any_region_near_rows(std::uint64_t row_begin, std::uint64_t row_end, Fn&& fn) const {
+    for (const SpillRegion* region : tall_regions) {
+      if (fn(*region)) {
+        return true;
+      }
+    }
+    if (row_end <= row_begin) {
+      return false;
+    }
+    const auto first_band = static_cast<std::uint32_t>(row_begin / kBandRows);
+    const auto last_band = static_cast<std::uint32_t>((row_end - 1U) / kBandRows);
+    if (static_cast<std::uint64_t>(last_band) - first_band + 1U <= regions_by_band.size()) {
+      for (std::uint32_t band = first_band; band <= last_band; ++band) {
+        const auto bucket = regions_by_band.find(band);
+        if (bucket == regions_by_band.end()) {
+          continue;
+        }
+        for (const SpillRegion* region : bucket->second) {
+          if (fn(*region)) {
+            return true;
+          }
+        }
+      }
+      return false;
+    }
+    // A query spanning more bands than are populated walks the populated ones instead.
+    for (const auto& [band, regions] : regions_by_band) {
+      if (band < first_band || band > last_band) {
+        continue;
+      }
+      for (const SpillRegion* region : regions) {
+        if (fn(*region)) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+
+ private:
+  static std::uint32_t first_band_of(const SpillRegion& region) noexcept { return region.anchor_row / kBandRows; }
+  static std::uint32_t last_band_of(const SpillRegion& region) noexcept {
+    return static_cast<std::uint32_t>((static_cast<std::uint64_t>(region.anchor_row) + region.rows - 1U) / kBandRows);
+  }
 };
 
 namespace {
@@ -119,6 +232,33 @@ void Sheet::add_pivot_table(std::unique_ptr<pivot::PivotTable> table) {
   pivot_tables_.push_back(std::move(table));
 }
 
+std::vector<std::pair<std::uint32_t, std::uint32_t>> Sheet::comment_anchor_set() const {
+  // Packed (row << 32 | col) keys sort in the same order as the pairs.
+  std::vector<std::uint64_t> keys;
+  keys.reserve(comments_.size() + threaded_comments_.size());
+  for (const CellComment& c : comments_) {
+    keys.push_back((static_cast<std::uint64_t>(c.row) << 32U) | c.col);
+  }
+  for (const ThreadedComment& c : threaded_comments_) {
+    keys.push_back((static_cast<std::uint64_t>(c.row) << 32U) | c.col);
+  }
+  std::vector<std::uint32_t> order;
+  sorted_index_order(order, static_cast<std::uint32_t>(keys.size()),
+                     IndexLess{&keys, [](const void* context, std::uint32_t lhs, std::uint32_t rhs) {
+                                 const auto& packed = *static_cast<const std::vector<std::uint64_t>*>(context);
+                                 return packed[lhs] < packed[rhs];
+                               }});
+  std::vector<std::pair<std::uint32_t, std::uint32_t>> anchors;
+  anchors.reserve(order.size());
+  for (std::size_t i = 0; i < order.size(); ++i) {
+    const std::uint64_t k = keys[order[i]];
+    if (i == 0 || k != keys[order[i - 1U]]) {
+      anchors.emplace_back(static_cast<std::uint32_t>(k >> 32U), static_cast<std::uint32_t>(k));
+    }
+  }
+  return anchors;
+}
+
 const Cell& RowCells::blank() noexcept {
   // Shared read-only stand-in for a column the row never materialised.
   // `operator[]` hands it out for the leading gap, so index-based scans see a
@@ -452,6 +592,7 @@ void Sheet::set_cell_xf_index(std::uint32_t row, std::uint32_t col, std::uint32_
   RowCells& row_cells = rows_[row];
   Cell& slot = row_cells.ensure(col);
   slot.xf_index = xf_index;
+  slot.has_explicit_xf = true;
   cell_enumeration_revision_.bump();
 }
 
@@ -669,6 +810,129 @@ std::vector<CellAddress> Sheet::formula_cells_in(std::uint32_t first_row, std::u
   return out;
 }
 
+std::uint64_t Sheet::cells_in_range(std::uint32_t first_row, std::uint32_t first_col, std::uint32_t last_row,
+                                    std::uint32_t last_col, std::uint64_t cursor, std::uint32_t limit,
+                                    void (*visit)(const RangeCell& cell, void* ctx), void* ctx) const {
+  constexpr std::uint64_t kStride = kMaxCols;
+  if (!rect_in_grid(first_row, first_col, last_row, last_col) || cursor >= kStride * kMaxRows) {
+    return kCellCursorEnd;
+  }
+  auto start_row = static_cast<std::uint32_t>(cursor / kStride);
+  auto start_col = static_cast<std::uint32_t>(cursor % kStride);
+  if (start_row < first_row) {
+    start_row = first_row;
+    start_col = first_col;
+  }
+  start_col = std::max(start_col, first_col);
+  if (start_col > last_col) {
+    ++start_row;
+    start_col = first_col;
+  }
+  if (start_row > last_row) {
+    return kCellCursorEnd;
+  }
+
+  const std::lock_guard<std::mutex> guard(*spill_mutex_);
+  std::vector<const SpillRegion*> regions;
+  if (spill_table_ != nullptr) {
+    for (const auto& [unused, region] : spill_table_->by_anchor) {
+      (void)unused;
+      if (RectIntersectsSpan(region, start_row, static_cast<std::uint64_t>(last_row) + 1U, first_col,
+                             static_cast<std::uint64_t>(last_col) + 1U)) {
+        regions.push_back(&region);
+      }
+    }
+  }
+
+  // Phantom-free rectangles taller than the stored row count walk the sorted
+  // stored rows instead of probing every row, as `populated_extent` does.
+  std::vector<std::uint32_t> stored_rows;
+  const bool walk_stored =
+      regions.empty() && static_cast<std::uint64_t>(rows_.size()) <= static_cast<std::uint64_t>(last_row - start_row);
+  if (walk_stored) {
+    for (const auto& entry : rows_) {
+      if (entry.first >= start_row && entry.first <= last_row) {
+        stored_rows.push_back(entry.first);
+      }
+    }
+    sort_ascending(stored_rows);
+  }
+
+  std::uint32_t emitted = 0;
+  std::vector<std::uint32_t> cols;
+  const auto scan_row = [&](std::uint32_t row) -> std::uint64_t {
+    const std::uint32_t col_begin = row == start_row ? start_col : first_col;
+    cols.clear();
+    const auto row_it = rows_.find(row);
+    const RowCells* cells = row_it == rows_.end() ? nullptr : &row_it->second;
+    if (cells != nullptr && !cells->empty()) {
+      const std::size_t end = std::min<std::size_t>(static_cast<std::size_t>(last_col) + 1U, cells->size());
+      for (std::size_t col = std::max<std::size_t>(col_begin, cells->first_col()); col < end; ++col) {
+        const Cell& cell = (*cells)[col];
+        if (!cell.formula_text.empty() || !cell.cached_value.is_blank()) {
+          cols.push_back(static_cast<std::uint32_t>(col));
+        }
+      }
+    }
+    bool phantom_cols = false;
+    for (const SpillRegion* region : regions) {
+      if (row < region->anchor_row || row - region->anchor_row >= region->rows) {
+        continue;
+      }
+      const std::uint32_t span_first = std::max(col_begin, region->anchor_col);
+      const std::uint32_t span_last = std::min(last_col, region->anchor_col + region->cols - 1U);
+      for (std::uint32_t col = span_first; col <= span_last; ++col) {
+        if (row != region->anchor_row || col != region->anchor_col) {
+          cols.push_back(col);
+          phantom_cols = true;
+        }
+      }
+    }
+    if (phantom_cols) {
+      sort_ascending(cols);
+      cols.erase(std::unique(cols.begin(), cols.end()), cols.end());
+    }
+    for (const std::uint32_t col : cols) {
+      if (emitted == limit) {
+        return static_cast<std::uint64_t>(row) * kStride + col;
+      }
+      RangeCell out;
+      out.row = row;
+      out.col = col;
+      // Same precedence as `read_formula_cell`: formula cell, then phantom,
+      // then the stored literal.
+      const Cell* cell = cells == nullptr ? nullptr : cells->find(col);
+      if (cell != nullptr && !cell->formula_text.empty()) {
+        out.formula_text = cell->formula_text;
+        out.value = cell->cached_value;
+      } else if (const SpillRegion* covering = spill_region_covering_locked(row, col); covering != nullptr) {
+        out.value = covering->cells[static_cast<std::size_t>(row - covering->anchor_row) * covering->cols +
+                                    (col - covering->anchor_col)];
+      } else if (cell != nullptr) {
+        out.value = cell->cached_value;
+      }
+      visit(out, ctx);
+      ++emitted;
+    }
+    return kCellCursorEnd;
+  };
+
+  if (walk_stored) {
+    for (const std::uint32_t row : stored_rows) {
+      if (const std::uint64_t next = scan_row(row); next != kCellCursorEnd) {
+        return next;
+      }
+    }
+  } else {
+    for (std::uint32_t row = start_row; row <= last_row; ++row) {
+      if (const std::uint64_t next = scan_row(row); next != kCellCursorEnd) {
+        return next;
+      }
+    }
+  }
+  return kCellCursorEnd;
+}
+
 void Sheet::index_formula_cell_locked(std::uint32_t row, std::uint32_t col, bool has_formula) {
   if (has_formula) {
     formula_cells_.insert(formula_cell_key(row, col));
@@ -764,15 +1028,20 @@ std::optional<BlockedSpillFootprint> Sheet::committed_spill_footprint_covering(s
   if (spill_table_ == nullptr) {
     return std::nullopt;
   }
-  for (const auto& [unused, region] : spill_table_->by_anchor) {
-    (void)unused;
-    if (!RectIntersectsSpan(region, row, static_cast<std::uint64_t>(row) + 1U, col,
-                            static_cast<std::uint64_t>(col) + 1U)) {
-      continue;
+  // Committed regions never overlap, so the first covering one is the only one.
+  const SpillRegion* covering = nullptr;
+  const std::uint64_t row_end = static_cast<std::uint64_t>(row) + 1U;
+  spill_table_->any_region_near_rows(row, row_end, [&](const SpillRegion& region) {
+    if (!RectIntersectsSpan(region, row, row_end, col, static_cast<std::uint64_t>(col) + 1U)) {
+      return false;
     }
-    return BlockedSpillFootprint{region.anchor_row, region.anchor_col, region.rows, region.cols};
+    covering = &region;
+    return true;
+  });
+  if (covering == nullptr) {
+    return std::nullopt;
   }
-  return std::nullopt;
+  return BlockedSpillFootprint{covering->anchor_row, covering->anchor_col, covering->rows, covering->cols};
 }
 
 std::vector<SpillFootprint> Sheet::committed_spill_footprints() const {
@@ -870,18 +1139,20 @@ const SpillRegion* Sheet::spill_region_covering_locked(std::uint32_t row, std::u
   if (spill_table_ == nullptr) {
     return nullptr;
   }
-  for (const auto& entry : spill_table_->by_anchor) {
-    const SpillRegion& region = entry.second;
-    if (!RectIntersectsSpan(region, row, static_cast<std::uint64_t>(row) + 1U, col,
-                            static_cast<std::uint64_t>(col) + 1U)) {
-      continue;
-    }
-    if (row == region.anchor_row && col == region.anchor_col) {
-      return nullptr;
+  // Committed regions never overlap, so the first covering one is the only one.
+  const SpillRegion* covering = nullptr;
+  const std::uint64_t row_end = static_cast<std::uint64_t>(row) + 1U;
+  spill_table_->any_region_near_rows(row, row_end, [&](const SpillRegion& region) {
+    if (!RectIntersectsSpan(region, row, row_end, col, static_cast<std::uint64_t>(col) + 1U)) {
+      return false;
     }
-    return &region;
+    covering = &region;
+    return true;
+  });
+  if (covering != nullptr && row == covering->anchor_row && col == covering->anchor_col) {
+    return nullptr;
   }
-  return nullptr;
+  return covering;
 }
 
 bool Sheet::spill_would_collide(std::uint32_t anchor_row, std::uint32_t anchor_col, std::uint32_t rows,
@@ -978,22 +1249,18 @@ Sheet::SpillAdmission Sheet::probe_spill_footprint_locked(std::uint32_t anchor_r
   }
 
   // Spill rectangles and merged ranges are rectangle-intersection tests over
-  // their own tables, so they already cost their table size rather than the
+  // their own tables (spills through the row-band index), never the
   // footprint's area; only the stored-cell sweep needed the sparse walk.
   //
   // A pre-existing region at this anchor is the producer's own spill. It is
   // ignored wholesale: ad-hoc evaluation is read-only and cannot clear it,
   // while commit_spill clears it before reaching this predicate.
-  if (spill_table_ != nullptr) {
-    for (const auto& entry : spill_table_->by_anchor) {
-      const SpillRegion& region = entry.second;
-      if (region.anchor_row == anchor_row && region.anchor_col == anchor_col) {
-        continue;
-      }
-      if (RectIntersectsSpan(region, anchor_row, row_end, anchor_col, col_end)) {
-        return SpillAdmission::kBlocked;
-      }
-    }
+  if (spill_table_ != nullptr &&
+      spill_table_->any_region_near_rows(anchor_row, row_end, [&](const SpillRegion& region) {
+        return !(region.anchor_row == anchor_row && region.anchor_col == anchor_col) &&
+               RectIntersectsSpan(region, anchor_row, row_end, anchor_col, col_end);
+      })) {
+    return SpillAdmission::kBlocked;
   }
   // Merged cells occupy their complete rectangle even when only the top-left
   // coordinate has a stored Cell. Any intersection is a blocker, including a
@@ -1253,8 +1520,8 @@ bool Sheet::commit_spill(std::uint32_t anchor_row, std::uint32_t anchor_col, std
   // `cells[0]` is no longer reachable through `region`.
   const Value first_cell = region.cells[0];
   const CellAddress anchor_addr{anchor_row, anchor_col};
-  const auto inserted = spill_table_->by_anchor.emplace(anchor_addr, std::move(region));
-  assert(inserted.second && "commit_spill: anchor entry already present after clear");
+  const bool inserted = spill_table_->add_region(anchor_addr, std::move(region));
+  assert(inserted && "commit_spill: anchor entry already present after clear");
   (void)inserted;
 
   // Anchor's cached_value mirrors the first cell of the region so that
@@ -1325,7 +1592,7 @@ void Sheet::clear_spill_locked(std::uint32_t anchor_row, std::uint32_t anchor_co
     return;
   }
   if (region_it != spill_table_->by_anchor.end()) {
-    spill_table_->by_anchor.erase(region_it);
+    spill_table_->erase_region(region_it);
   }
   if (blocked_it != spill_table_->blocked_by_anchor.end()) {
     spill_table_->blocked_by_anchor.erase(blocked_it);
@@ -1337,7 +1604,7 @@ void Sheet::clear_committed_spills_locked() noexcept {
   if (spill_table_ == nullptr || spill_table_->by_anchor.empty()) {
     return;
   }
-  spill_table_->by_anchor.clear();
+  spill_table_->clear_regions();
   cell_enumeration_revision_.bump();
 }
 
diff --git a/src/sheet.h b/src/sheet.h
index 7d6d1089c..f313f2a76 100644
--- a/src/sheet.h
+++ b/src/sheet.h
@@ -19,6 +19,7 @@
 #include <atomic>
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 #include <memory>
 #include <mutex>
 #include <optional>
@@ -29,9 +30,12 @@
 #include <utility>
 #include <vector>
 
+#include "auto_filter.h"
 #include "cell.h"
+#include "merge_range.h"
 #include "sheet_layout.h"
 #include "sheet_passthrough.h"
+#include "threaded_comment.h"
 #include "unknown_relationship.h"
 #include "utils/a1_ref.h"
 #include "value.h"
@@ -48,18 +52,6 @@ namespace pivot {
 class PivotTable;
 }  // namespace pivot
 
-/// One `<mergeCell ref="A1:B2"/>` block: a rectangular merged range
-/// stored as 0-based, inclusive `(row, col)` corners. The two corners
-/// are normalised so that `first_row <= last_row` and
-/// `first_col <= last_col`; degenerate `first == last` rectangles are
-/// permitted (single-cell merges, which Excel emits).
-struct MergeRange {
-  std::uint32_t first_row = 0;
-  std::uint32_t first_col = 0;
-  std::uint32_t last_row = 0;
-  std::uint32_t last_col = 0;
-};
-
 /// Moves the ranges of one sqref (a conditional format's, or a retained x14
 /// copy of one) for a row/column edit: `count` rows or columns inserted or
 /// deleted at 0-based `index`. Ranges the edit deletes are removed, and a
@@ -67,6 +59,17 @@ struct MergeRange {
 void shift_sqref_ranges(std::vector<MergeRange>& ranges, std::uint32_t index, std::uint32_t count, bool is_delete,
                         bool row_axis);
 
+/// Moves an AutoFilter for a row/column edit (same arguments as
+/// `shift_sqref_ranges`): its range and sort ranges follow the span rules,
+/// a column delete removes the deleted columns' criteria and renumbers the
+/// later `colId`s down, and an insert strictly inside the range renumbers the
+/// `colId`s at or after it up. Returns false when the filter must be removed:
+/// its range was consumed, or `header_delete_removes` is set and the header
+/// row was deleted (a sheet AutoFilter; Excel cannot delete a table's).
+/// An opaque filter is left untouched.
+bool shift_auto_filter(AutoFilter& filter, std::uint32_t index, std::uint32_t count, bool is_delete, bool row_axis,
+                       bool header_delete_removes);
+
 /// One `<hyperlink>` entry attached to a sheet. The numeric rectangle is the
 /// sole source of truth; the OOXML writer regenerates its `ref` attribute from
 /// these four 0-based inclusive endpoints. The OOXML wire form is
@@ -102,11 +105,18 @@ struct Hyperlink {
 /// rich-text runs. Reads of multi-run rich text concatenate the runs
 /// into `text`; writes always emit the plain form. Authors are
 /// preserved verbatim so the workbook-wide author list round-trips.
+/// `uid` is the comment's `xr:uid` revision id, empty when absent.
 struct CellComment {
+  CellComment() = default;
+  CellComment(std::uint32_t row_in, std::uint32_t col_in, std::string author_in, std::string text_in,
+              std::string uid_in = {})
+      : row(row_in), col(col_in), author(std::move(author_in)), text(std::move(text_in)), uid(std::move(uid_in)) {}
+
   std::uint32_t row = 0;
   std::uint32_t col = 0;
   std::string author;
   std::string text;
+  std::string uid;
 };
 
 /// One `<dataValidation>` block: a list of cell ranges that share a
@@ -683,11 +693,10 @@ class Sheet {
   /// runs, so setting these on an unannotated cell has no on-disk effect.
   void set_cell_phonetic_props(std::uint32_t row, std::uint32_t col, PhoneticProperties props);
 
-  /// Stores the cellXfs index for the cell at `(row, col)`. The cell must
-  /// already exist (created via `set_cell_value` / `set_cell_formula`); on
-  /// an absent cell this method is a no-op. `xf_index = 0` references the
-  /// workbook's default cellXf and is the on-disk default Excel writes when
-  /// no `s=` attribute is present.
+  /// Stores the cellXfs index for the cell at `(row, col)`, materialising a
+  /// blank cell when needed. The assignment is tracked even for
+  /// `xf_index = 0`, so an explicit default XF can override row/column
+  /// inheritance while an unrelated row-vector gap continues to inherit.
   void set_cell_xf_index(std::uint32_t row, std::uint32_t col, std::uint32_t xf_index);
 
   /// Returns a non-owning pointer to the cell at `(row, col)`, or `nullptr`
@@ -759,6 +768,34 @@ class Sheet {
   std::vector<CellAddress> formula_cells_in(std::uint32_t first_row, std::uint32_t first_col, std::uint32_t last_row,
                                             std::uint32_t last_col) const;
 
+  /// One populated coordinate handed to a `cells_in_range` visitor.
+  struct RangeCell {
+    std::uint32_t row = 0;
+    std::uint32_t col = 0;
+    /// Stored formula text verbatim (leading `=` kept); empty for a literal
+    /// or a spill phantom.
+    std::string_view formula_text;
+    /// The effective value; a Text payload aliases sheet storage.
+    Value value = Value::blank();
+  };
+
+  /// `cells_in_range` result once the rectangle holds no further cell.
+  static constexpr std::uint64_t kCellCursorEnd = std::numeric_limits<std::uint64_t>::max();
+
+  /// Visits, in row-major order, at most `limit` populated coordinates of
+  /// `[first_row..last_row] x [first_col..last_col]` starting at `cursor`
+  /// (`row * kMaxCols + col`), and returns the cursor of the next populated
+  /// coordinate, or `kCellCursorEnd`.
+  ///
+  /// Populated means a stored cell with formula text or a non-blank value,
+  /// or a committed spill phantom. Cost is proportional to the rectangle's
+  /// rows from the cursor on plus the cells visited, never to its area.
+  /// `limit` must be positive. `visit` runs under the sheet lock, so it must
+  /// copy what it keeps and must not call back into this sheet.
+  std::uint64_t cells_in_range(std::uint32_t first_row, std::uint32_t first_col, std::uint32_t last_row,
+                               std::uint32_t last_col, std::uint64_t cursor, std::uint32_t limit,
+                               void (*visit)(const RangeCell& cell, void* ctx), void* ctx) const;
+
   /// Monotonically changes whenever the flat stored-cell / spill-phantom
   /// address set changes. C-ABI iteration uses it to invalidate its
   /// per-handle sorted-address cache after any sheet mutation.
@@ -881,14 +918,10 @@ class Sheet {
   /// scans the registered spill rectangles, avoiding a per-phantom index.
   /// Use `spill_region_at_anchor` to look up by anchor.
   ///
-  /// That scan is linear in the number of committed spill anchors, and it
-  /// runs once per coordinate: every scalar read and every write that has to
-  /// check for spill invalidation pays it, so a sheet with many anchors makes
-  /// each of those O(anchors) and a full flat enumeration O(cells x anchors).
-  /// The cost follows the anchor count rather than any rectangle's area,
-  /// which is what keeps it slow rather than pathological; `read_range`
-  /// amortises it over a rectangle, and there is nothing to amortise for a
-  /// single coordinate short of indexing the spill table spatially.
+  /// The scan runs once per coordinate — every scalar read and every write
+  /// that checks for spill invalidation pays it — so it consults a row-band
+  /// index and visits only the regions sharing the coordinate's band, plus
+  /// any region tall enough to be kept outside the index.
   ///
   /// Carries the same borrowed-Text lifetime as `spill_region_at_anchor`.
   const SpillRegion* spill_region_covering(std::uint32_t row, std::uint32_t col) const noexcept;
@@ -1189,6 +1222,16 @@ class Sheet {
   /// without an extra accessor pair per field.
   std::vector<CellComment>& mutable_comments() noexcept { return comments_; }
 
+  /// Threaded comments in file order, each thread followed by its replies.
+  /// A thread's legacy stub note is not in `comments()`. Edits go through
+  /// the validating `Workbook` methods; the mutable accessor serves the reader.
+  const std::vector<ThreadedComment>& threaded_comments() const noexcept { return threaded_comments_; }
+  std::vector<ThreadedComment>& mutable_threaded_comments() noexcept { return threaded_comments_; }
+
+  /// Sorted, de-duplicated `(row, col)` anchors of every note and thread.
+  /// These are the cells the comment VML drawing carries a shape for.
+  std::vector<std::pair<std::uint32_t, std::uint32_t>> comment_anchor_set() const;
+
   // ---------------------------------------------------------------------------
   // Data validations
   // ---------------------------------------------------------------------------
@@ -1289,6 +1332,16 @@ class Sheet {
   const std::string& comment_vml_path() const noexcept { return comment_vml_path_; }
   void set_comment_vml_path(std::string path) { comment_vml_path_ = std::move(path); }
 
+  /// `comment_anchor_set()` as it stood when the VML at `comment_vml_path()`
+  /// was read. The writer re-emits that VML verbatim only while the anchors
+  /// still match, and regenerates it from the model otherwise.
+  const std::vector<std::pair<std::uint32_t, std::uint32_t>>& comment_vml_anchors() const noexcept {
+    return comment_vml_anchors_;
+  }
+  void set_comment_vml_anchors(std::vector<std::pair<std::uint32_t, std::uint32_t>> anchors) {
+    comment_vml_anchors_ = std::move(anchors);
+  }
+
   /// Relationships from this worksheet's `.rels` part that Formulon does
   /// not otherwise model (OLE objects, controls, slicers, and so on).
   /// Their target parts travel through Workbook passthrough storage; keeping
@@ -1299,22 +1352,13 @@ class Sheet {
     unknown_relationships_ = std::move(relationships);
   }
 
-  /// Raw `<autoFilter>` element captured from the worksheet, or empty when
-  /// the sheet has no auto-filter. The engine does not model filter
-  /// criteria yet; the element round-trips verbatim so the filter range
-  /// and any column criteria survive a save cycle. The writer re-emits it
-  /// in ECMA-376 order (after `<sheetProtection>`, before `<mergeCells>`).
-  ///
-  /// A row/column edit rewrites the `ref` rectangle, because a stale `ref`
-  /// leaves the filter attached to the wrong cells. Nothing else inside the
-  /// element moves: a `<filterColumn colId="N">` is an offset from `ref`'s
-  /// first column, so an insert or delete *inside* the filtered span leaves
-  /// its criteria one column off. Excel remaps those offsets; modelling the
-  /// criteria is what it would take to match.
-  const std::string& auto_filter_xml() const noexcept { return auto_filter_xml_; }
-
-  /// Sets the raw `<autoFilter>` element. Plain metadata.
-  void set_auto_filter_xml(std::string xml) { auto_filter_xml_ = std::move(xml); }
+  /// The sheet AutoFilter, or nullptr. May be opaque (`is_opaque()`). The
+  /// setters are plain metadata: the `Workbook` setters also maintain
+  /// `_FilterDatabase` and dirty state.
+  const AutoFilter* auto_filter() const noexcept { return auto_filter_.get(); }
+  bool has_auto_filter() const noexcept { return !auto_filter_.empty(); }
+  void set_auto_filter(AutoFilter filter) { auto_filter_.set(std::move(filter)); }
+  void clear_auto_filter_model() noexcept { auto_filter_.reset(); }
 
   /// Raw worksheet-level `<extLst>` element captured from the worksheet,
   /// or empty. Excel stores the *data* for several 2010+ extensions here —
@@ -1411,8 +1455,7 @@ class Sheet {
   /// deliberately absent: the sheet does not parse them. The workbook edit
   /// moves the x14 ranges and formulas in the first two, since that needs
   /// the file-format readers; `raw_extensions_` children keep their pre-edit
-  /// rectangles. `auto_filter_xml_` is the one raw field whose `ref`
-  /// attribute is shifted here.
+  /// rectangles. The AutoFilter moves through `shift_auto_filter`.
   void shift_sheet_metadata(const StructuralEdit& edit);
 
   // ---------------------------------------------------------------------------
@@ -1529,6 +1572,8 @@ class Sheet {
   std::vector<Hyperlink> hyperlinks_;
   // Per-cell text comments aggregated from `xl/comments<N>.xml`. Empty by default.
   std::vector<CellComment> comments_;
+  // Threaded comments from `xl/threadedComments/threadedComment<N>.xml`.
+  std::vector<ThreadedComment> threaded_comments_;
   // `<dataValidations>` blocks. Empty by default.
   std::vector<DataValidation> validations_;
   // `<sheetProtection>` flags. `protection_.enabled = false` by
@@ -1556,11 +1601,12 @@ class Sheet {
   // writer may assign a new output filename, but uses this path to find the
   // original bytes in passthrough storage.
   std::string comment_vml_path_;
+  // Comment anchors the source VML at `comment_vml_path_` was read with.
+  std::vector<std::pair<std::uint32_t, std::uint32_t>> comment_vml_anchors_;
   // Unmodelled entries from `xl/worksheets/_rels/sheetN.xml.rels`.
   std::vector<UnknownRelationship> unknown_relationships_;
-  // Raw `<autoFilter>` element, or empty. Round-trips verbatim; filter
-  // criteria are not modelled.
-  std::string auto_filter_xml_;
+  // Sheet AutoFilter, or empty.
+  AutoFilterSlot auto_filter_;
   // Raw worksheet-level `<extLst>` element (x14 conditional-formatting
   // data etc.), or empty. Round-trips verbatim.
   std::string ext_lst_xml_;
diff --git a/src/sheet_layout.h b/src/sheet_layout.h
index 8d7e0872b..5bed53844 100644
--- a/src/sheet_layout.h
+++ b/src/sheet_layout.h
@@ -55,6 +55,9 @@ struct RowLayout {
   bool hidden = false;
   std::uint8_t outline_level = 0;
   bool has_height = false;
+  // True when the height is an explicit override (`customHeight="1"` /
+  // BrtRowHdr fUnsynced); false for an auto height that only caches `ht`.
+  bool custom_height = false;
   // A row style is effective only when OOXML `customFormat="1"` is
   // present. `style_xf == 0` remains meaningful when `s` is absent or
   // explicitly set to zero.
@@ -137,6 +140,13 @@ struct ManualBreak {
 /// Page orientation as stored in `<pageSetup orientation="...">`.
 enum class Orientation { kDefault, kPortrait, kLandscape };
 
+/// Order in which a sheet's pages are numbered and printed
+/// (`<pageSetup pageOrder>`).
+enum class PageOrder : std::int32_t {
+  kDownThenOver = 0,  ///< Each column of pages top to bottom, then the next column (default).
+  kOverThenDown = 1,  ///< Each row of pages left to right, then the next row.
+};
+
 /// Structured page setup parsed from `<pageSetup>` and `<sheetPr>`.
 ///
 /// Parsed alongside `SheetPrintSettings::page_setup_xml`; the raw string
@@ -149,9 +159,10 @@ struct PageSetup {
   std::uint32_t paper_size = ooxml_defaults::kPaperSize;
   /// `scale`, as a percentage.
   std::uint32_t scale = ooxml_defaults::kPageScalePercent;
-  std::uint32_t fit_to_width = 1;   ///< `fitToWidth`, in pages.
-  std::uint32_t fit_to_height = 1;  ///< `fitToHeight`, in pages.
-  bool fit_to_page = false;         ///< True when `<sheetPr><pageSetUpPr fitToPage="1"/>`.
+  std::uint32_t fit_to_width = 1;                   ///< `fitToWidth`, in pages.
+  std::uint32_t fit_to_height = 1;                  ///< `fitToHeight`, in pages.
+  bool fit_to_page = false;                         ///< True when `<sheetPr><pageSetUpPr fitToPage="1"/>`.
+  PageOrder page_order = PageOrder::kDownThenOver;  ///< `pageOrder` attribute.
 };
 
 /// Structured page margins parsed from `<pageMargins>`.
diff --git a/src/sheet_row_col_edit.cpp b/src/sheet_row_col_edit.cpp
index 6121e60c4..e6611fa52 100644
--- a/src/sheet_row_col_edit.cpp
+++ b/src/sheet_row_col_edit.cpp
@@ -8,15 +8,12 @@
 #include <memory>
 #include <mutex>
 #include <string>
-#include <string_view>
 #include <utility>
 #include <vector>
 
 #include "cf/cf_types.h"
 #include "pivot/pivot_table.h"
 #include "sheet.h"
-#include "utils/a1_column.h"
-#include "utils/a1_ref.h"
 #include "utils/index_sort.h"
 
 namespace formulon {
@@ -114,6 +111,11 @@ void ShiftSpan(std::uint32_t& first, std::uint32_t& last, std::uint32_t index, s
   if (last < index) {
     return;  // Both endpoints below the insert; unchanged.
   }
+  // A range pushed wholly beyond the sheet has no surviving cells; drop it rather than clamp to a singleton.
+  if (first >= index && static_cast<std::uint64_t>(first) + count >= bound) {
+    *out_drop = true;
+    return;
+  }
   auto shift_one = [count, bound](std::uint32_t value) -> std::uint32_t {
     const std::uint64_t shifted = static_cast<std::uint64_t>(value) + count;
     if (shifted >= bound) {
@@ -212,89 +214,6 @@ void ShiftRowLayouts(std::vector<RowLayout>& rows, std::uint32_t index, std::uin
   ShiftRowAnchored(rows, index, count, is_delete);
 }
 
-/// Renders `[first_row..last_row] x [first_col..last_col]` as an OOXML
-/// `ref` rectangle, collapsing a single-cell rectangle to one address the
-/// way Excel writes it. Returns false when a coordinate is outside the grid.
-bool AppendRefRectangle(std::string& out, const MergeRange& rect) {
-  const auto append_cell = [&out](std::uint32_t row, std::uint32_t col) {
-    if (!a1::append_column_letters(out, col)) {
-      return false;
-    }
-    out += std::to_string(static_cast<std::uint64_t>(row) + 1U);
-    return true;
-  };
-  if (!append_cell(rect.first_row, rect.first_col)) {
-    return false;
-  }
-  if (rect.first_row == rect.last_row && rect.first_col == rect.last_col) {
-    return true;
-  }
-  out += ':';
-  return append_cell(rect.last_row, rect.last_col);
-}
-
-/// Rewrites the `ref` rectangle of a raw `<autoFilter>` element through the
-/// same span rules the modelled rectangles follow, and clears the element
-/// when the edit consumed its whole rectangle.
-///
-/// The element is retained verbatim, so this is the one coordinate inside it
-/// that moves. It is also the one that decides which cells the filter is
-/// attached to: leaving it behind points the filter at whatever occupies the
-/// old rectangle after the edit. The `colId` offsets on any `<filterColumn>`
-/// children are relative to this rectangle's first column and are not
-/// remapped — see the field's declaration for what that costs.
-void ShiftAutoFilterRef(std::string& xml, std::uint32_t index, std::uint32_t count, bool is_delete, bool row_axis) {
-  if (xml.empty()) {
-    return;
-  }
-  // Confine the search to the start tag: only the `<autoFilter>` element
-  // itself carries the rectangle.
-  const std::size_t tag_end = xml.find('>');
-  const std::size_t attr = xml.find("ref=\"");
-  if (tag_end == std::string::npos || attr == std::string::npos || attr > tag_end) {
-    return;
-  }
-  const std::size_t value_begin = attr + 5U;
-  const std::size_t value_end = xml.find('"', value_begin);
-  if (value_end == std::string::npos || value_end > tag_end) {
-    return;
-  }
-
-  const std::string_view value(xml.data() + value_begin, value_end - value_begin);
-  const std::size_t colon = value.find(':');
-  MergeRange rect;
-  if (!a1::parse_a1_ref(value.substr(0, colon), &rect.first_row, &rect.first_col)) {
-    return;  // Not a plain A1 rectangle; leave the element untouched.
-  }
-  if (colon == std::string_view::npos) {
-    rect.last_row = rect.first_row;
-    rect.last_col = rect.first_col;
-  } else if (!a1::parse_a1_ref(value.substr(colon + 1U), &rect.last_row, &rect.last_col)) {
-    return;
-  }
-  if (rect.first_row > rect.last_row || rect.first_col > rect.last_col) {
-    return;
-  }
-
-  bool drop = false;
-  if (row_axis) {
-    ShiftRowRange(rect, index, count, is_delete, &drop);
-  } else {
-    ShiftColRange(rect, index, count, is_delete, &drop);
-  }
-  if (drop) {
-    // Every filtered cell was deleted, which is what Excel resolves by
-    // removing the filter rather than by keeping an empty one.
-    xml.clear();
-    return;
-  }
-  std::string replacement;
-  if (!AppendRefRectangle(replacement, rect)) {
-    return;
-  }
-  xml.replace(value_begin, value_end - value_begin, replacement);
-}
-
 void ShiftColumnLayouts(std::vector<ColumnLayout>& columns, std::uint32_t index, std::uint32_t count, bool is_delete) {
   std::vector<ColumnLayout> retained;
   retained.reserve(columns.size());
@@ -311,32 +230,6 @@ void ShiftColumnLayouts(std::vector<ColumnLayout>& columns, std::uint32_t index,
   columns = std::move(retained);
 }
 
-void ShiftBreaks(std::vector<ManualBreak>& breaks, std::uint32_t index, std::uint32_t count, bool is_delete,
-                 std::uint32_t bound) {
-  std::vector<ManualBreak> retained;
-  retained.reserve(breaks.size());
-  for (ManualBreak& page_break : breaks) {
-    if (page_break.id < index) {
-      retained.push_back(std::move(page_break));
-      continue;
-    }
-    if (is_delete) {
-      if (page_break.id < index + count) {
-        continue;
-      }
-      page_break.id -= count;
-    } else {
-      const std::uint64_t shifted = static_cast<std::uint64_t>(page_break.id) + count;
-      if (shifted >= bound) {
-        continue;
-      }
-      page_break.id = static_cast<std::uint32_t>(shifted);
-    }
-    retained.push_back(std::move(page_break));
-  }
-  breaks = std::move(retained);
-}
-
 void ShiftPivotAnchors(std::vector<std::unique_ptr<pivot::PivotTable>>& pivots, std::uint32_t index,
                        std::uint32_t count, bool is_delete, bool row_axis) {
   for (std::unique_ptr<pivot::PivotTable>& pivot : pivots) {
@@ -349,13 +242,25 @@ void ShiftPivotAnchors(std::vector<std::unique_ptr<pivot::PivotTable>>& pivots,
         anchor = anchor < index + count ? index : anchor - count;
       } else {
         const std::uint64_t shifted = static_cast<std::uint64_t>(anchor) + count;
-        anchor = static_cast<std::uint32_t>(
-            std::min<std::uint64_t>(shifted, row_axis ? Sheet::kMaxRows - 1U : Sheet::kMaxCols - 1U));
+        if (shifted >= (row_axis ? Sheet::kMaxRows : Sheet::kMaxCols)) {
+          pivot.reset();
+          continue;
+        }
+        anchor = static_cast<std::uint32_t>(shifted);
       }
     }
-    pivot->set_anchor(row_axis ? anchor : pivot->anchor_row(), row_axis ? pivot->anchor_col() : anchor,
-                      pivot->span_rows(), pivot->span_cols());
+    std::uint32_t span_rows = pivot->span_rows();
+    std::uint32_t span_cols = pivot->span_cols();
+    // Clip the span on the edited axis to the grid; a zero span stays zero.
+    if (row_axis && span_rows != 0U) {
+      span_rows = std::min(span_rows, Sheet::kMaxRows - anchor);
+    } else if (!row_axis && span_cols != 0U) {
+      span_cols = std::min(span_cols, Sheet::kMaxCols - anchor);
+    }
+    pivot->set_anchor(row_axis ? anchor : pivot->anchor_row(), row_axis ? pivot->anchor_col() : anchor, span_rows,
+                      span_cols);
   }
+  pivots.erase(std::remove(pivots.begin(), pivots.end(), nullptr), pivots.end());
 }
 
 }  // namespace
@@ -388,6 +293,80 @@ void shift_sqref_ranges(std::vector<MergeRange>& ranges, std::uint32_t index, st
   }
 }
 
+bool shift_auto_filter(AutoFilter& filter, std::uint32_t index, std::uint32_t count, bool is_delete, bool row_axis,
+                       bool header_delete_removes) {
+  if (filter.is_opaque()) {
+    return true;
+  }
+  const MergeRange before = filter.range;
+  if (row_axis && is_delete && header_delete_removes && before.first_row >= index && before.first_row - index < count) {
+    return false;
+  }
+  bool drop = false;
+  if (row_axis) {
+    ShiftRowRange(filter.range, index, count, is_delete, &drop);
+  } else {
+    ShiftColRange(filter.range, index, count, is_delete, &drop);
+  }
+  if (drop) {
+    return false;
+  }
+  if (filter.sort) {
+    bool sort_drop = false;
+    if (row_axis) {
+      ShiftRowRange(filter.sort->ref, index, count, is_delete, &sort_drop);
+    } else {
+      ShiftColRange(filter.sort->ref, index, count, is_delete, &sort_drop);
+    }
+    if (sort_drop) {
+      filter.sort.reset();
+    } else {
+      std::vector<SortCondition> kept;
+      for (SortCondition& cond : filter.sort->conditions) {
+        bool cond_drop = false;
+        if (row_axis) {
+          ShiftRowRange(cond.ref, index, count, is_delete, &cond_drop);
+        } else {
+          ShiftColRange(cond.ref, index, count, is_delete, &cond_drop);
+        }
+        if (!cond_drop) {
+          kept.push_back(std::move(cond));
+        }
+      }
+      filter.sort->conditions = std::move(kept);
+    }
+  }
+  if (row_axis) {
+    return true;
+  }
+  // `colId` is an offset from the range's first column. A column delete
+  // drops the criteria of deleted columns and pulls later ones back by the
+  // deleted columns before them; an insert inside the range (not at its left
+  // edge, which moves the whole range) pushes the columns at or after it.
+  std::vector<FilterColumn> kept;
+  kept.reserve(filter.columns.size());
+  for (FilterColumn& col : filter.columns) {
+    const std::uint64_t absolute = static_cast<std::uint64_t>(before.first_col) + col.col_id;
+    if (is_delete) {
+      const std::uint64_t del_end = static_cast<std::uint64_t>(index) + count;
+      if (absolute >= index && absolute < del_end) {
+        continue;
+      }
+      const std::uint64_t lo = std::max<std::uint64_t>(index, before.first_col);
+      const std::uint64_t hi = std::min<std::uint64_t>(del_end, absolute);
+      col.col_id -= static_cast<std::uint32_t>(hi > lo ? hi - lo : 0U);
+    } else if (index > before.first_col && absolute >= index) {
+      col.col_id += count;
+    }
+    if (col.col_id > filter.range.last_col - filter.range.first_col) {
+      continue;  // Pushed past the sheet edge with the clamped range.
+    }
+    kept.push_back(std::move(col));
+  }
+  filter.columns = std::move(kept);
+  return true;
+}
+
 // Every sheet-attached structure derives its new coordinates from the one
 // `StructuralEdit` description. This list is the enumeration: a structure
 // added to `Sheet` and not added here does not follow a row/column edit.
@@ -399,24 +378,33 @@ void Sheet::shift_sheet_metadata(const StructuralEdit& edit) {
   if (row_axis) {
     ShiftHyperlinkList(hyperlinks_, index, count, is_delete, /*row_axis=*/true);
     ShiftRowAnchored(comments_, index, count, is_delete);
+    ShiftRowAnchored(threaded_comments_, index, count, is_delete);
   } else {
     ShiftHyperlinkList(hyperlinks_, index, count, is_delete, /*row_axis=*/false);
     ShiftColAnchored(comments_, index, count, is_delete);
+    ShiftColAnchored(threaded_comments_, index, count, is_delete);
   }
   ShiftRangeList(merges_, index, count, is_delete, row_axis);
   for (DataValidation& dv : validations_) {
     ShiftRangeList(dv.ranges, index, count, is_delete, row_axis);
   }
+  validations_.erase(std::remove_if(validations_.begin(), validations_.end(),
+                                    [](const DataValidation& dv) { return dv.ranges.empty(); }),
+                     validations_.end());
   ShiftConditionalFormats(conditional_formats_, index, count, is_delete, row_axis);
   if (row_axis) {
     ShiftRowLayouts(layout_.row_overrides, index, count, is_delete);
-    ShiftBreaks(print_settings_.manual_row_breaks, index, count, is_delete, Sheet::kMaxRows);
+    ShiftAnchored(print_settings_.manual_row_breaks, &ManualBreak::id, index, count, is_delete, Sheet::kMaxRows);
   } else {
     ShiftColumnLayouts(layout_.columns, index, count, is_delete);
-    ShiftBreaks(print_settings_.manual_col_breaks, index, count, is_delete, Sheet::kMaxCols);
+    ShiftAnchored(print_settings_.manual_col_breaks, &ManualBreak::id, index, count, is_delete, Sheet::kMaxCols);
   }
   ShiftPivotAnchors(pivot_tables_, index, count, is_delete, row_axis);
-  ShiftAutoFilterRef(auto_filter_xml_, index, count, is_delete, row_axis);
+  if (AutoFilter* filter = auto_filter_.get();
+      filter != nullptr && !shift_auto_filter(*filter, index, count, is_delete, row_axis,
+                                              /*header_delete_removes=*/true)) {
+    auto_filter_.reset();
+  }
 }
 
 void Sheet::insert_rows(std::uint32_t row, std::uint32_t count) {
diff --git a/src/style_resolve.cpp b/src/style_resolve.cpp
new file mode 100644
index 000000000..bc52a87d4
--- /dev/null
+++ b/src/style_resolve.cpp
@@ -0,0 +1,106 @@
+#include "style_resolve.h"
+
+#include <algorithm>
+#include <optional>
+#include <string_view>
+
+#include "cell.h"
+#include "sheet.h"
+#include "styles.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+bool cell_owns_style(const Cell& cell) noexcept {
+  return cell.has_explicit_xf || cell.xf_index != 0U || !cell.formula_text.empty() || !cell.cached_value.is_blank();
+}
+
+}  // namespace
+
+EffectiveXf select_effective_xf(const Sheet& sheet, std::uint32_t row, std::uint32_t col) {
+  if (const Cell* cell = sheet.cell_at(row, col)) {
+    if (cell_owns_style(*cell)) {
+      return {cell->xf_index, StyleSource::kCell};
+    }
+  }
+  const SheetLayout& layout = sheet.layout();
+  const auto row_it = std::find_if(layout.row_overrides.begin(), layout.row_overrides.end(),
+                                   [row](const RowLayout& r) { return r.row == row && r.has_style; });
+  if (row_it != layout.row_overrides.end()) {
+    return {row_it->style_xf, StyleSource::kRow};
+  }
+  const auto col_it = std::find_if(layout.columns.begin(), layout.columns.end(), [col](const ColumnLayout& c) {
+    return c.first <= col && col <= c.last && c.has_style;
+  });
+  if (col_it != layout.columns.end()) {
+    return {col_it->style_xf, StyleSource::kColumn};
+  }
+  return {0U, StyleSource::kDefault};
+}
+
+namespace {
+
+/// A record built programmatically may set only its `*_argb` sibling; that
+/// literal is then the colour, matching what the writer emits.
+ColorSpec with_literal_fallback(const ColorSpec& spec, std::uint32_t argb, std::uint32_t none_value) {
+  if (spec.kind != ColorSpec::Kind::kNone || argb == none_value) {
+    return spec;
+  }
+  ColorSpec literal;
+  literal.kind = ColorSpec::Kind::kRgb;
+  literal.rgb = argb;
+  return literal;
+}
+
+}  // namespace
+
+EffectiveStyle effective_style(const Workbook& wb, const Sheet& sheet, std::uint32_t row, std::uint32_t col) {
+  const StylesTable& styles = wb.styles();
+  const EffectiveXf choice = select_effective_xf(sheet, row, col);
+  EffectiveStyle out;
+  out.source = choice.source;
+  out.xf_index = choice.xf_index < styles.cell_xfs.size() ? choice.xf_index : 0U;
+  const CellXf xf = styles.cell_xfs.empty() ? CellXf{} : styles.cell_xfs[out.xf_index];
+
+  const LoadedTheme theme = wb.load_theme();
+  const auto resolve = [&](const ColorSpec& spec, ColorContext context) {
+    return resolve_color(spec, theme.theme, theme.source, styles.indexed_colors, context);
+  };
+
+  out.font_index = xf.font_index < styles.fonts.size() ? xf.font_index : 0U;
+  out.fill_index = xf.fill_index < styles.fills.size() ? xf.fill_index : 0U;
+  out.border_index = xf.border_index < styles.borders.size() ? xf.border_index : 0U;
+  if (out.font_index < styles.fonts.size()) {
+    out.font_color = resolve(
+        with_literal_fallback(styles.fonts[out.font_index].color, styles.fonts[out.font_index].color_argb, 0xFF000000U),
+        ColorContext::kFont);
+  } else {
+    out.font_color = resolve(ColorSpec{}, ColorContext::kFont);
+  }
+  if (out.fill_index < styles.fills.size()) {
+    const FillRecord& fill = styles.fills[out.fill_index];
+    out.fill_pattern = fill.pattern;
+    out.fill_foreground = resolve(with_literal_fallback(fill.fg, fill.fg_argb, 0U), ColorContext::kFillForeground);
+    out.fill_background = resolve(with_literal_fallback(fill.bg, fill.bg_argb, 0U), ColorContext::kFillBackground);
+  } else {
+    out.fill_foreground = resolve(ColorSpec{}, ColorContext::kFillForeground);
+    out.fill_background = resolve(ColorSpec{}, ColorContext::kFillBackground);
+  }
+  const BorderRecord border =
+      out.border_index < styles.borders.size() ? styles.borders[out.border_index] : BorderRecord{};
+  const BorderSide* sides[5] = {&border.left, &border.right, &border.top, &border.bottom, &border.diagonal};
+  for (std::size_t i = 0; i < 5; ++i) {
+    out.border_colors[i] =
+        resolve(with_literal_fallback(sides[i]->color, sides[i]->color_argb, 0U), ColorContext::kBorder);
+  }
+  const std::optional<std::string_view> code = effective_num_fmt(styles, xf.num_fmt_id);
+  out.num_fmt_code = code ? std::string(*code) : std::string("General");
+  if (xf.has_protection) {
+    out.locked = xf.locked;
+    out.hidden = xf.hidden;
+  }
+  return out;
+}
+
+}  // namespace formulon
diff --git a/src/style_resolve.h b/src/style_resolve.h
new file mode 100644
index 000000000..3c1554958
--- /dev/null
+++ b/src/style_resolve.h
@@ -0,0 +1,71 @@
+//
+// Effective cell style: the formatting a cell shows after row, column and cell XF precedence.
+//
+// The style is read from the selected `cellXfs` record directly (font, fill,
+// border and number-format indices as stored); named-style inheritance is not
+// recomputed. Conditional formatting is not applied. A storage slot that was
+// created only as an internal blank gap is not an owning cell for precedence.
+
+#ifndef FORMULON_STYLE_RESOLVE_H_
+#define FORMULON_STYLE_RESOLVE_H_
+
+#include <array>
+#include <cstdint>
+#include <string>
+
+#include "color_resolve.h"
+
+namespace formulon {
+
+class Workbook;
+class Sheet;
+
+/// Which level supplied the XF.
+enum class StyleSource : std::uint8_t {
+  kCell = 0,
+  kRow = 1,
+  kColumn = 2,
+  kDefault = 3,
+};
+
+/// The lightweight result shared by style inspection and display rendering.
+/// `xf_index` is the selected raw cellXfs index and is not range-checked
+/// here; a consumer that reads the styles table (e.g. `effective_style`)
+/// clamps an index beyond it to xf 0 while preserving `source`.
+struct EffectiveXf {
+  std::uint32_t xf_index = 0;
+  StyleSource source = StyleSource::kDefault;
+};
+
+struct EffectiveStyle {
+  std::uint32_t xf_index = 0;
+  StyleSource source = StyleSource::kDefault;
+  std::uint32_t font_index = 0;
+  std::uint32_t fill_index = 0;
+  std::uint32_t border_index = 0;
+  ResolvedColor font_color;
+  std::uint8_t fill_pattern = 0;
+  ResolvedColor fill_foreground;
+  ResolvedColor fill_background;
+  /// Left, right, top, bottom, diagonal.
+  std::array<ResolvedColor, 5> border_colors;
+  std::string num_fmt_code;
+  bool locked = true;
+  bool hidden = false;
+};
+
+/// Selects an XF using cell, row, column, default precedence. A cell owns the
+/// coordinate when it has a formula, a non-blank cached value, a non-zero XF,
+/// or an explicit XF assignment (including XF 0); an implicitly materialized
+/// blank gap is skipped. Row style is effective only when the row carries
+/// `customFormat`. The returned source uses the `StyleSource` values, and
+/// an absent override returns xf 0.
+EffectiveXf select_effective_xf(const Sheet& sheet, std::uint32_t row, std::uint32_t col);
+
+/// XF precedence: an owning cell, then its row (when it carries a style),
+/// then its column, then xf 0. An xf index beyond `cellXfs` falls back to 0.
+EffectiveStyle effective_style(const Workbook& wb, const Sheet& sheet, std::uint32_t row, std::uint32_t col);
+
+}  // namespace formulon
+
+#endif  // FORMULON_STYLE_RESOLVE_H_
diff --git a/src/styles.cpp b/src/styles.cpp
index 8ea4e84a0..b6fbb105c 100644
--- a/src/styles.cpp
+++ b/src/styles.cpp
@@ -7,11 +7,39 @@
 #include "styles.h"
 
 #include <array>
+#include <cstddef>
 #include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
 
 namespace formulon {
 namespace {
 
+/// Copies the alignment attributes (and their presence bits) from `from`.
+void copy_alignment(CellXf& to, const CellXf& from) {
+  to.horizontal_align = from.horizontal_align;
+  to.vertical_align = from.vertical_align;
+  to.wrap_text = from.wrap_text;
+  to.justify_last_line = from.justify_last_line;
+  to.has_alignment = from.has_alignment;
+  to.has_horizontal_align = from.has_horizontal_align;
+  to.has_vertical_align = from.has_vertical_align;
+  to.has_wrap_text = from.has_wrap_text;
+  to.has_justify_last_line = from.has_justify_last_line;
+  to.has_text_rotation = from.has_text_rotation;
+  to.text_rotation = from.text_rotation;
+  to.has_indent = from.has_indent;
+  to.indent = from.indent;
+  to.has_relative_indent = from.has_relative_indent;
+  to.relative_indent = from.relative_indent;
+  to.has_shrink_to_fit = from.has_shrink_to_fit;
+  to.shrink_to_fit = from.shrink_to_fit;
+  to.has_reading_order = from.has_reading_order;
+  to.reading_order = from.reading_order;
+}
+
 // Built-in Excel number-format ids. The id space is sparse (Excel only
 // defines a subset of 0..163; the remaining slots are reserved). Empty
 // strings indicate "not a documented built-in" and behave the same way
@@ -186,6 +214,62 @@ constexpr std::array<const char*, 164> kBuiltinNumFmts = {
 
 }  // namespace
 
+Expected<void, Error> remove_cell_style(StylesTable& styles, std::string_view name) {
+  std::size_t pos = styles.cell_styles.size();
+  for (std::size_t i = 0; i < styles.cell_styles.size(); ++i) {
+    if (styles.cell_styles[i].name == name) {
+      pos = i;
+      break;
+    }
+  }
+  if (pos == styles.cell_styles.size()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "remove_cell_style: no such cell style",
+                      "name=" + std::string(name));
+  }
+  if (styles.cell_styles[pos].builtin_id == 0U) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "remove_cell_style: the Normal style cannot be removed",
+                      "name=" + std::string(name));
+  }
+  const std::uint32_t removed_xf = styles.cell_styles[pos].xf_id;
+  styles.cell_styles.erase(styles.cell_styles.begin() + static_cast<std::ptrdiff_t>(pos));
+  if (removed_xf == 0U) {
+    return Expected<void, Error>::Ok();
+  }
+  for (const CellStyleRecord& other : styles.cell_styles) {
+    if (other.xf_id == removed_xf) {
+      return Expected<void, Error>::Ok();
+    }
+  }
+  const CellXf normal = styles.cell_style_xfs.empty() ? CellXf{} : styles.cell_style_xfs[0];
+  for (CellXf& xf : styles.cell_xfs) {
+    if (xf.xf_id != removed_xf) {
+      continue;
+    }
+    xf.xf_id = 0U;
+    if (!xf.apply_number_format) {
+      xf.num_fmt_id = normal.num_fmt_id;
+    }
+    if (!xf.apply_font) {
+      xf.font_index = normal.font_index;
+    }
+    if (!xf.apply_fill) {
+      xf.fill_index = normal.fill_index;
+    }
+    if (!xf.apply_border) {
+      xf.border_index = normal.border_index;
+    }
+    if (!xf.apply_alignment) {
+      copy_alignment(xf, normal);
+    }
+    if (!xf.apply_protection) {
+      xf.has_protection = normal.has_protection;
+      xf.locked = normal.locked;
+      xf.hidden = normal.hidden;
+    }
+  }
+  return Expected<void, Error>::Ok();
+}
+
 const char* builtin_num_fmt(std::uint16_t id) {
   if (id >= kBuiltinNumFmts.size()) {
     return "";
@@ -193,4 +277,19 @@ const char* builtin_num_fmt(std::uint16_t id) {
   return kBuiltinNumFmts[id];
 }
 
+std::optional<std::string_view> effective_num_fmt(const formulon::StylesTable& styles, std::uint16_t id) {
+  for (const formulon::NumFmtRecord& record : styles.num_fmts) {
+    if (record.id == id && record.format_string_index < styles.num_fmt_strings.size()) {
+      return styles.num_fmt_strings[record.format_string_index];
+    }
+  }
+  if (id < 164U) {
+    const char* builtin = formulon::builtin_num_fmt(id);
+    if (builtin != nullptr && builtin[0] != '\0') {
+      return std::string_view(builtin);
+    }
+  }
+  return std::nullopt;
+}
+
 }  // namespace formulon
diff --git a/src/styles.h b/src/styles.h
index ccf8b629b..2f701a062 100644
--- a/src/styles.h
+++ b/src/styles.h
@@ -13,9 +13,14 @@
 #define FORMULON_STYLES_H_
 
 #include <cstdint>
+#include <optional>
 #include <string>
+#include <string_view>
 #include <vector>
 
+#include "utils/error.h"
+#include "utils/expected.h"
+
 namespace formulon {
 
 /// Original specification of an OOXML `<color>` element, preserved so a
@@ -255,14 +260,17 @@ struct DifferentialFormat {
 /// style ("Normal", "Heading 1", custom user names, etc.) that points
 /// at a record in the parallel `<cellStyleXfs>` table via `xf_id`.
 ///
-/// `builtin_id` is the OOXML built-in style ordinal (`0..47`); the
+/// `builtin_id` is the OOXML built-in style ordinal (`0..kBuiltinIdMax`); the
 /// sentinel `kBuiltinIdNone` indicates the style is custom and the
 /// attribute should be omitted on write. `i_level` is the outline level
 /// for built-in heading styles (0 for everything else).
 struct CellStyleRecord {
   /// Sentinel for "no `builtinId` attribute" — picked above the OOXML
-  /// 0..47 built-in range so it cannot collide with a real id.
+  /// built-in range so it cannot collide with a real id.
   static constexpr std::uint32_t kBuiltinIdNone = 0xFFFFFFFFU;
+  /// Highest built-in style ordinal (53 = Explanatory Text); Excel loads
+  /// and writes the whole 0..53 range.
+  static constexpr std::uint32_t kBuiltinIdMax = 53U;
 
   std::string name;
   std::uint32_t xf_id = 0;
@@ -301,12 +309,19 @@ struct StylesTable {
   std::vector<CellStyleRecord> cell_styles;
   /// `<dxfs>` records referenced by conditional-format `dxfId`.
   std::vector<DifferentialFormat> dxfs;
+  /// `<indexedColors>` palette as AARRGGBB, in palette order. Empty selects
+  /// the built-in palette; a non-empty list overrides entry `i` for
+  /// `i < indexed_colors.size()`.
+  std::vector<std::uint32_t> indexed_colors;
   /// Namespace declarations and compatibility attributes from the
   /// `<styleSheet>` root that raw extension fragments depend on.
   std::string root_extra_attrs;
   /// Unmodelled top-level style sections retained verbatim. Their schema
   /// positions are fixed by `write_styles`, so a style-table edit does not
   /// discard custom palettes, table/pivot style defaults, or extensions.
+  ///
+  /// `colors_xml` holds the `<colors>` element minus its `<indexedColors>`
+  /// child (for example `<mruColors>`); empty when nothing else is present.
   std::string colors_xml;
   std::string table_styles_xml;
   std::string ext_lst_xml;
@@ -316,6 +331,19 @@ struct StylesTable {
   std::vector<std::string> unknown_top_level_xml;
 };
 
+/// Removes the named `<cellStyle>` and detaches the cell xfs that used it.
+///
+/// Every `cell_xfs` entry whose `xf_id` is the removed style's is repointed to
+/// `0`, unless another named style still references that `cell_style_xfs`
+/// record. A group whose `apply_*` flag is false takes the value of
+/// `cell_style_xfs[0]` (Normal); a group whose flag is true keeps its own
+/// value, and the flags themselves are left as they are. `cell_xfs` and
+/// `cell_style_xfs` are never compacted, so every xf index stays valid.
+///
+/// Returns `kInvalidArgument` when no style has that name or when it is the
+/// Normal style (`builtin_id == 0`).
+Expected<void, Error> remove_cell_style(StylesTable& styles, std::string_view name);
+
 /// Returns the format string for a built-in Excel number-format id
 /// (0..163). For ids outside the documented range returns an empty
 /// string. The returned pointer is a static `.rodata` view with
@@ -323,6 +351,12 @@ struct StylesTable {
 /// and writer share a single definition.
 const char* builtin_num_fmt(std::uint16_t id);
 
+/// Resolves a number-format id using the effective OOXML mapping. A valid
+/// custom record wins over the built-in slot, and duplicate ids resolve to
+/// the first valid custom record in document order. `std::nullopt` means that
+/// neither a valid custom record nor a non-empty built-in format exists.
+std::optional<std::string_view> effective_num_fmt(const formulon::StylesTable& styles, std::uint16_t id);
+
 }  // namespace formulon
 
 #endif  // FORMULON_STYLES_H_
diff --git a/src/table.h b/src/table.h
index 01c858253..3495951ae 100644
--- a/src/table.h
+++ b/src/table.h
@@ -13,6 +13,8 @@
 #include <utility>
 #include <vector>
 
+#include "auto_filter.h"
+
 namespace formulon {
 
 /// Per-column metadata for a table.
@@ -74,9 +76,12 @@ struct TableMetadata {
   /// visual style survives a save cycle; the engine does not model table
   /// styles.
   std::string table_style_info_xml;
-  /// Unmodelled table-level filter, sort, and extension payloads retained
-  /// verbatim in their schema positions on write.
-  std::string auto_filter_xml;
+  /// Table AutoFilter. Keeps the name of the raw element it replaced;
+  /// `io/auto_filter_xml.h` reads and writes the element.
+  /// `Workbook::set_table_auto_filter` also dirties row-visibility dependents.
+  AutoFilterSlot auto_filter_xml;
+  /// Unmodelled table-level sort and extension payloads retained verbatim in
+  /// their schema positions on write.
   std::string sort_state_xml;
   std::string ext_lst_xml;
   /// Table-root attributes not represented by the model, including extra
diff --git a/src/theme.cpp b/src/theme.cpp
new file mode 100644
index 000000000..0d67955b6
--- /dev/null
+++ b/src/theme.cpp
@@ -0,0 +1,13 @@
+#include "theme.h"
+
+namespace formulon {
+
+const Theme& default_theme() {
+  static const Theme kTheme = {{0xFF000000U, 0xFFFFFFFFU, 0xFF44546AU, 0xFFE7E6E6U, 0xFF4472C4U, 0xFFED7D31U,
+                                0xFFA5A5A5U, 0xFFFFC000U, 0xFF5B9BD5U, 0xFF70AD47U, 0xFF0563C1U, 0xFF954F72U},
+                               {"Calibri Light", "\xE6\xB8\xB8\xE3\x82\xB4\xE3\x82\xB7\xE3\x83\x83\xE3\x82\xAF Light",
+                                "Calibri", "\xE6\xB8\xB8\xE3\x82\xB4\xE3\x82\xB7\xE3\x83\x83\xE3\x82\xAF"}};
+  return kTheme;
+}
+
+}  // namespace formulon
diff --git a/src/theme.h b/src/theme.h
new file mode 100644
index 000000000..f76ff433d
--- /dev/null
+++ b/src/theme.h
@@ -0,0 +1,56 @@
+//
+// Workbook theme model: colour scheme and major/minor fonts of the theme part.
+//
+// `Workbook::load_theme` and the theme setters read and patch the part
+// through `io/theme_part.h`.
+
+#ifndef FORMULON_THEME_H_
+#define FORMULON_THEME_H_
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+namespace formulon {
+
+/// Number of colours in a theme colour scheme.
+constexpr std::size_t kThemeColorCount = 12;
+
+/// Colour scheme order, as written in `a:clrScheme`: dk1, lt1, dk2, lt2,
+/// accent1..accent6, hlink, folHlink. Note this is not the order of the
+/// `theme="N"` attribute of a spreadsheet colour (see `color_resolve.h`).
+using ThemeColors = std::array<std::uint32_t, kThemeColorCount>;  // 0xFFRRGGBB
+
+/// The four font faces of a theme. `*_ea` is `a:ea` when it names a face,
+/// otherwise the `a:font script="Jpan"` face.
+struct ThemeFonts {
+  std::string major_latin;
+  std::string major_ea;
+  std::string minor_latin;
+  std::string minor_ea;
+};
+
+struct Theme {
+  ThemeColors colors{};
+  ThemeFonts fonts;
+};
+
+/// Where a loaded theme came from.
+enum class ThemeSource : std::uint8_t {
+  kPart = 0,         ///< Parsed from the workbook's theme part.
+  kDefault = 1,      ///< No theme part: the default theme is reported.
+  kUnparseable = 2,  ///< A theme part exists but could not be parsed: the default theme is reported.
+};
+
+struct LoadedTheme {
+  Theme theme;
+  ThemeSource source = ThemeSource::kDefault;
+};
+
+/// The Office 2013-2022 theme (Calibri / Calibri Light, Yu Gothic for East Asian).
+const Theme& default_theme();
+
+}  // namespace formulon
+
+#endif  // FORMULON_THEME_H_
diff --git a/src/threaded_comment.cpp b/src/threaded_comment.cpp
new file mode 100644
index 000000000..305c03c81
--- /dev/null
+++ b/src/threaded_comment.cpp
@@ -0,0 +1,270 @@
+#include "threaded_comment.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "sheet.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "utils/status_macros.h"
+#include "utils/utf8_length.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+constexpr std::string_view kStubPreamble =
+    "[Threaded comment]\n\nYour version of Excel allows you to read this threaded comment; however, any edits to it "
+    "will get removed if the file is opened in a newer version of Excel. Learn more: "
+    "https://go.microsoft.com/fwlink/?linkid=870924\n\nComment:\n    ";
+
+bool IsDigit(char c) noexcept {
+  return c >= '0' && c <= '9';
+}
+
+bool IsUpperHex(char c) noexcept {
+  return IsDigit(c) || (c >= 'A' && c <= 'F');
+}
+
+// Out of line so the string building is emitted once rather than at every validation site.
+[[gnu::noinline]] Error Invalid(std::string_view message, std::string_view value) {
+  std::string detail = "value=";
+  detail.append(value);
+  return make_error(FormulonErrorCode::kThreadedCommentInvalid, std::string(message), std::move(detail));
+}
+
+bool HasPerson(const std::vector<Person>& persons, std::string_view id) noexcept {
+  for (const Person& p : persons) {
+    if (p.id == id) {
+      return true;
+    }
+  }
+  return false;
+}
+
+Expected<void, Error> ValidateText(std::string_view text, const std::vector<Mention>& mentions,
+                                   const std::vector<Person>& persons) {
+  const std::uint64_t units = utf16_units_in(text);
+  for (const Mention& m : mentions) {
+    if (!is_threaded_comment_guid(m.mention_id)) {
+      return Invalid("threaded comment: mention id is not a GUID", m.mention_id);
+    }
+    if (!HasPerson(persons, m.person_id)) {
+      return Invalid("threaded comment: mention names an unknown person", m.person_id);
+    }
+    if (static_cast<std::uint64_t>(m.start) + m.length > units) {
+      return Invalid("threaded comment: mention range lies outside the text", m.mention_id);
+    }
+  }
+  return Expected<void, Error>::Ok();
+}
+
+Expected<Sheet*, Error> SheetAt(Workbook& wb, std::size_t sheet) {
+  if (sheet >= wb.sheet_count()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "threaded comment: sheet index out of range",
+                      "sheet=" + std::to_string(sheet));
+  }
+  return &wb.sheet(sheet);
+}
+
+}  // namespace
+
+bool is_threaded_comment_guid(std::string_view s) noexcept {
+  if (s.size() != 38U || s.front() != '{' || s.back() != '}') {
+    return false;
+  }
+  for (std::size_t i = 1; i + 1 < s.size(); ++i) {
+    const bool dash = i == 9U || i == 14U || i == 19U || i == 24U;
+    if (dash ? s[i] != '-' : !IsUpperHex(s[i])) {
+      return false;
+    }
+  }
+  return true;
+}
+
+bool is_threaded_comment_timestamp(std::string_view s) noexcept {
+  constexpr std::string_view kShape = "dddd-dd-ddTdd:dd:dd.dd";
+  if (s.size() != kShape.size()) {
+    return false;
+  }
+  for (std::size_t i = 0; i < s.size(); ++i) {
+    if (kShape[i] == 'd' ? !IsDigit(s[i]) : s[i] != kShape[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+
+std::size_t find_threaded_comment(const std::vector<ThreadedComment>& list, std::string_view id) noexcept {
+  for (std::size_t i = 0; i < list.size(); ++i) {
+    if (list[i].id == id) {
+      return i;
+    }
+  }
+  return list.size();
+}
+
+std::size_t find_thread_at(const std::vector<ThreadedComment>& list, std::uint32_t row, std::uint32_t col) noexcept {
+  for (std::size_t i = 0; i < list.size(); ++i) {
+    if (list[i].parent_id.empty() && list[i].row == row && list[i].col == col) {
+      return i;
+    }
+  }
+  return list.size();
+}
+
+std::string threaded_comment_stub_text(const std::vector<ThreadedComment>& list, std::size_t root) {
+  std::string out(kStubPreamble);
+  out.append(list[root].text);
+  for (const ThreadedComment& c : list) {
+    if (c.parent_id == list[root].id) {
+      out.append("\nReply:\n    ");
+      out.append(c.text);
+    }
+  }
+  return out;
+}
+
+Expected<void, Error> Workbook::add_person(Person person) {
+  if (!is_threaded_comment_guid(person.id)) {
+    return Invalid("add_person: id is not a GUID", person.id);
+  }
+  if (HasPerson(persons_, person.id)) {
+    return Invalid("add_person: id already listed", person.id);
+  }
+  if (person.display_name.empty()) {
+    return Invalid("add_person: empty display name", person.id);
+  }
+  persons_.push_back(std::move(person));
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::remove_person(std::string_view id) {
+  std::size_t index = persons_.size();
+  for (std::size_t i = 0; i < persons_.size(); ++i) {
+    if (persons_[i].id == id) {
+      index = i;
+      break;
+    }
+  }
+  if (index == persons_.size()) {
+    return Invalid("remove_person: no such person", id);
+  }
+  for (std::size_t s = 0; s < sheet_count(); ++s) {
+    for (const ThreadedComment& c : sheet(s).threaded_comments()) {
+      bool referenced = c.person_id == id;
+      for (const Mention& m : c.mentions) {
+        referenced = referenced || m.person_id == id;
+      }
+      if (referenced) {
+        return Invalid("remove_person: a threaded comment still names this person", id);
+      }
+    }
+  }
+  persons_.erase(persons_.begin() + static_cast<std::ptrdiff_t>(index));
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::add_threaded_comment(std::size_t sheet_index, ThreadedComment comment) {
+  ASSIGN_OR_RETURN(Sheet * target, SheetAt(*this, sheet_index));
+  std::vector<ThreadedComment>& list = target->mutable_threaded_comments();
+  if (!is_threaded_comment_guid(comment.id)) {
+    return Invalid("add_threaded_comment: id is not a GUID", comment.id);
+  }
+  if (find_threaded_comment(list, comment.id) != list.size()) {
+    return Invalid("add_threaded_comment: id already used on this sheet", comment.id);
+  }
+  if (!HasPerson(persons_, comment.person_id)) {
+    return Invalid("add_threaded_comment: author is not in the person list", comment.person_id);
+  }
+  if (!is_threaded_comment_timestamp(comment.created)) {
+    return Invalid("add_threaded_comment: created is not YYYY-MM-DDTHH:MM:SS.ss", comment.created);
+  }
+  RETURN_IF_ERROR(ValidateText(comment.text, comment.mentions, persons_));
+
+  std::size_t insert_at = list.size();
+  if (comment.parent_id.empty()) {
+    if (comment.row >= Sheet::kMaxRows || comment.col >= Sheet::kMaxCols) {
+      return make_error(FormulonErrorCode::kInvalidArgument, "add_threaded_comment: coordinate out of grid",
+                        "row=" + std::to_string(comment.row) + " col=" + std::to_string(comment.col));
+    }
+    if (find_thread_at(list, comment.row, comment.col) != list.size()) {
+      return Invalid("add_threaded_comment: cell already has a thread", comment.id);
+    }
+    for (const CellComment& note : target->comments()) {
+      if (note.row == comment.row && note.col == comment.col) {
+        return Invalid("add_threaded_comment: cell already has a note", comment.id);
+      }
+    }
+  } else {
+    const std::size_t root = find_threaded_comment(list, comment.parent_id);
+    if (root == list.size() || !list[root].parent_id.empty()) {
+      return Invalid("add_threaded_comment: parent is not a thread on this sheet", comment.parent_id);
+    }
+    comment.row = list[root].row;
+    comment.col = list[root].col;
+    comment.done = false;
+    insert_at = root + 1U;
+    for (std::size_t i = insert_at; i < list.size(); ++i) {
+      if (list[i].parent_id == comment.parent_id) {
+        insert_at = i + 1U;
+      }
+    }
+  }
+  list.insert(list.begin() + static_cast<std::ptrdiff_t>(insert_at), std::move(comment));
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::edit_threaded_comment(std::size_t sheet_index, std::string_view id, std::string text,
+                                                      std::vector<Mention> mentions) {
+  ASSIGN_OR_RETURN(Sheet * target, SheetAt(*this, sheet_index));
+  std::vector<ThreadedComment>& list = target->mutable_threaded_comments();
+  const std::size_t index = find_threaded_comment(list, id);
+  if (index == list.size()) {
+    return Invalid("edit_threaded_comment: no such comment", id);
+  }
+  RETURN_IF_ERROR(ValidateText(text, mentions, persons_));
+  list[index].text = std::move(text);
+  list[index].mentions = std::move(mentions);
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::set_thread_resolved(std::size_t sheet_index, std::string_view thread_id, bool done) {
+  ASSIGN_OR_RETURN(Sheet * target, SheetAt(*this, sheet_index));
+  std::vector<ThreadedComment>& list = target->mutable_threaded_comments();
+  const std::size_t index = find_threaded_comment(list, thread_id);
+  if (index == list.size() || !list[index].parent_id.empty()) {
+    return Invalid("set_thread_resolved: no thread with this id", thread_id);
+  }
+  list[index].done = done;
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::remove_threaded_comment(std::size_t sheet_index, std::string_view id) {
+  ASSIGN_OR_RETURN(Sheet * target, SheetAt(*this, sheet_index));
+  std::vector<ThreadedComment>& list = target->mutable_threaded_comments();
+  const std::size_t index = find_threaded_comment(list, id);
+  if (index == list.size()) {
+    return Invalid("remove_threaded_comment: no such comment", id);
+  }
+  if (!list[index].parent_id.empty()) {
+    list.erase(list.begin() + static_cast<std::ptrdiff_t>(index));
+    return Expected<void, Error>::Ok();
+  }
+  const std::string root_id = list[index].id;
+  std::vector<ThreadedComment> kept;
+  kept.reserve(list.size());
+  for (ThreadedComment& c : list) {
+    if (c.id != root_id && c.parent_id != root_id) {
+      kept.push_back(std::move(c));
+    }
+  }
+  list = std::move(kept);
+  return Expected<void, Error>::Ok();
+}
+
+}  // namespace formulon
diff --git a/src/threaded_comment.h b/src/threaded_comment.h
new file mode 100644
index 000000000..6db848772
--- /dev/null
+++ b/src/threaded_comment.h
@@ -0,0 +1,74 @@
+//
+// Threaded comments: threads, replies, mentions and the person list of a workbook.
+//
+// A thread is the top-level `ThreadedComment` of a cell (empty `parent_id`);
+// its replies name the top-level id in `parent_id` and share its anchor.
+// A sheet stores its comments as one flat list in file order, each thread
+// followed by its replies. Ids and timestamps come from the caller: the
+// engine never mints a GUID or reads the clock, so a save is deterministic.
+//
+// Excel also stores every thread as a legacy note ("stub") whose author is
+// `tc={thread id}` so older readers can show it. The stub is not modelled:
+// the reader drops it and the writer regenerates it from the thread.
+
+#ifndef FORMULON_THREADED_COMMENT_H_
+#define FORMULON_THREADED_COMMENT_H_
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace formulon {
+
+/// One `@person` mention inside a threaded comment's text.
+struct Mention {
+  std::string person_id;     ///< `Person::id` of the mentioned person.
+  std::string mention_id;    ///< Brace-wrapped uppercase GUID of the mention itself.
+  std::uint32_t start = 0;   ///< Offset into the text, in UTF-16 code units.
+  std::uint32_t length = 0;  ///< Length of the mention, in UTF-16 code units.
+};
+
+/// One threaded comment: a thread's opening comment or one of its replies.
+struct ThreadedComment {
+  std::string id;  ///< Brace-wrapped uppercase GUID.
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::string person_id;  ///< `Person::id` of the author.
+  std::string created;    ///< `YYYY-MM-DDTHH:MM:SS.ss` (Excel's `dT`).
+  std::string text;
+  std::string parent_id;  ///< Empty for a thread's opening comment.
+  bool done = false;      ///< Resolved state; meaningful on the opening comment only.
+  std::vector<Mention> mentions;
+};
+
+/// One entry of the workbook's person list (`xl/persons/person.xml`).
+struct Person {
+  std::string id;  ///< Brace-wrapped uppercase GUID.
+  std::string display_name;
+  std::string user_id;
+  std::string provider_id;  ///< `AD`, `Windows Live`, `PeoplePicker` or `None`.
+};
+
+/// True for a brace-wrapped uppercase GUID, `{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}`.
+bool is_threaded_comment_guid(std::string_view s) noexcept;
+
+/// True for Excel's threaded-comment timestamp form `YYYY-MM-DDTHH:MM:SS.ss`.
+bool is_threaded_comment_timestamp(std::string_view s) noexcept;
+
+/// Index of the comment with `id` in `list`, or `list.size()` when absent.
+std::size_t find_threaded_comment(const std::vector<ThreadedComment>& list, std::string_view id) noexcept;
+
+/// Index of the thread (opening comment) anchored at `row`/`col`, or
+/// `list.size()` when the cell has none.
+std::size_t find_thread_at(const std::vector<ThreadedComment>& list, std::uint32_t row, std::uint32_t col) noexcept;
+
+/// Text of the legacy note Excel stores for the thread opened at
+/// `list[root]`: a fixed preamble followed by the opening comment and every
+/// reply in list order.
+std::string threaded_comment_stub_text(const std::vector<ThreadedComment>& list, std::size_t root);
+
+}  // namespace formulon
+
+#endif  // FORMULON_THREADED_COMMENT_H_
diff --git a/src/utils/date_time.cpp b/src/utils/date_time.cpp
index a212e174d..53439af37 100644
--- a/src/utils/date_time.cpp
+++ b/src/utils/date_time.cpp
@@ -49,14 +49,30 @@ constexpr double kSecondsPerDay = 86400.0;
 }  // namespace
 
 std::int64_t days_from_civil(int y, unsigned m, unsigned d) noexcept {
+  // Canonicalise the month first. `m` is unsigned, so doing this in the
+  // original Hinnant expression would make month 0 and large month values
+  // wrap before they can roll into the corresponding year.
+  const std::int64_t month0 = static_cast<std::int64_t>(m) - 1;
+  std::int64_t year = static_cast<std::int64_t>(y) + month0 / 12;
+  std::int64_t month_rem = month0 % 12;
+  if (month_rem < 0) {
+    --year;
+    month_rem += 12;
+  }
+  const unsigned canonical_month = static_cast<unsigned>(month_rem) + 1u;
+
   // Hinnant, "chrono-Compatible Low-Level Date Algorithms", algorithm (7).
-  // Normalises any out-of-range month/day as a side effect.
-  y -= static_cast<int>(m <= 2);
-  const int era = (y >= 0 ? y : y - 399) / 400;
-  const unsigned yoe = static_cast<unsigned>(y - era * 400);                 // [0, 399]
-  const unsigned doy = (153u * (m > 2 ? m - 3 : m + 9) + 2u) / 5u + d - 1u;  // [0, 365]
-  const unsigned doe = yoe * 365u + yoe / 4u - yoe / 100u + doy;             // [0, 146096]
-  return static_cast<std::int64_t>(era) * 146097 + static_cast<std::int64_t>(doe) - 719468;
+  // Compute the day count for the canonical month's first day, then add the
+  // (possibly out-of-range) day offset in signed arithmetic. This keeps the
+  // public unsigned day parameter from wrapping at UINT_MAX.
+  year -= static_cast<std::int64_t>(canonical_month <= 2u);
+  const std::int64_t era = (year >= 0 ? year : year - 399) / 400;
+  const std::int64_t yoe = year - era * 400;  // [0, 399]
+  const std::int64_t month_index = canonical_month > 2u ? canonical_month - 3u : canonical_month + 9u;
+  const std::int64_t doy = (153 * month_index + 2) / 5;
+  const std::int64_t doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;  // [0, 146096]
+  const std::int64_t first_of_month = era * 146097 + doe - 719468;
+  return first_of_month + static_cast<std::int64_t>(d) - 1;
 }
 
 YMD civil_from_days(std::int64_t z) noexcept {
@@ -65,12 +81,15 @@ YMD civil_from_days(std::int64_t z) noexcept {
   const std::int64_t era = (z >= 0 ? z : z - 146096) / 146097;
   const unsigned doe = static_cast<unsigned>(z - era * 146097);                    // [0, 146096]
   const unsigned yoe = (doe - doe / 1460u + doe / 36524u - doe / 146096u) / 365u;  // [0, 399]
-  const int y = static_cast<int>(yoe) + static_cast<int>(era) * 400;
-  const unsigned doy = doe - (365u * yoe + yoe / 4u - yoe / 100u);  // [0, 365]
-  const unsigned mp = (5u * doy + 2u) / 153u;                       // [0, 11]
-  const unsigned d = doy - (153u * mp + 2u) / 5u + 1u;              // [1, 31]
-  const unsigned m = mp < 10u ? mp + 3u : mp - 9u;                  // [1, 12]
-  return YMD{y + static_cast<int>(m <= 2u), m, d};
+  const unsigned doy = doe - (365u * yoe + yoe / 4u - yoe / 100u);                 // [0, 365]
+  const unsigned mp = (5u * doy + 2u) / 153u;                                      // [0, 11]
+  const unsigned d = doy - (153u * mp + 2u) / 5u + 1u;                             // [1, 31]
+  const unsigned m = mp < 10u ? mp + 3u : mp - 9u;                                 // [1, 12]
+  // Keep the reconstructed year wide until the Jan/Feb adjustment is done.
+  // The final cast is intentional: only day counts whose civil year fits the
+  // public `int` year field are representable by this API.
+  const std::int64_t year = era * 400 + static_cast<std::int64_t>(yoe) + (m <= 2u ? 1 : 0);
+  return YMD{static_cast<int>(year), m, d};
 }
 
 YMD ymd_from_serial(double serial_floor, bool date1904) noexcept {
diff --git a/src/utils/double_format.cpp b/src/utils/double_format.cpp
index be61c1b5d..26780618d 100644
--- a/src/utils/double_format.cpp
+++ b/src/utils/double_format.cpp
@@ -6,11 +6,12 @@
 
 #include <cmath>
 #include <cstdint>
-#include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <string>
 
+#include "utils/number_text.h"
+
 namespace formulon {
 
 namespace {
@@ -48,7 +49,7 @@ void append_excel_exponent(std::string& out, int exp) {
     out.push_back(static_cast<char>('0' + abs_exp));
   } else {
     char tmp[16];
-    std::snprintf(tmp, sizeof(tmp), "%d", abs_exp);
+    format_signed(tmp, sizeof(tmp), abs_exp);
     out.append(tmp);
   }
 }
@@ -79,7 +80,7 @@ void format_double(std::string& out, double v) {
   // divergences at 16+ sig digits — e.g. literal `1234567890123456` —
   // are documented in tests/divergence.yaml.)
   char buf[40];
-  int n = std::snprintf(buf, sizeof(buf), "%.15g", abs_v);
+  int n = format_general(buf, sizeof(buf), abs_v, 15);
   if (n <= 0 || static_cast<std::size_t>(n) >= sizeof(buf)) {
     // Defensive fallback: should not happen for finite doubles.
     if (negative) {
diff --git a/src/utils/double_format.h b/src/utils/double_format.h
index c48b23fe6..487948021 100644
--- a/src/utils/double_format.h
+++ b/src/utils/double_format.h
@@ -24,7 +24,7 @@
 //        1E+19       ->  "10000000000000000000"(20 chars,  decimal)
 //        1E+20       ->  "1E+20"               (sci, decimal would be 21 chars)
 //
-// Implementation is dependency-free (`<cstdio>`, `<cmath>`, `<string>`).
+// Implementation is dependency-free (`<cmath>`, `<string>`, `number_text.h`).
 
 #ifndef FORMULON_UTILS_DOUBLE_FORMAT_H_
 #define FORMULON_UTILS_DOUBLE_FORMAT_H_
diff --git a/src/utils/error.h b/src/utils/error.h
index 44b7751b4..49e9f4443 100644
--- a/src/utils/error.h
+++ b/src/utils/error.h
@@ -146,6 +146,12 @@ enum class FormulonErrorCode : int32_t {
   /// changed since load; the writer re-emits those bytes verbatim, so the
   /// save is refused rather than dropping the change.
   kIoXlsbRetainedPartStale = 5022,
+  /// Image bytes passed for insertion are not a format the drawing writer
+  /// can embed (PNG, JPEG, GIF, BMP), or their header is truncated.
+  kIoImageUnsupported = 5023,
+  /// A sheet's drawing part could not be parsed, so typed drawing edits on
+  /// it are refused rather than rewriting bytes the model cannot see.
+  kIoDrawingUnparseable = 5024,
 
   // ===== 6000-6999: Crypto / Security =====
   /// Allocated but not currently produced: Formulon does not decrypt
@@ -211,6 +217,9 @@ enum class FormulonErrorCode : int32_t {
   /// count no 32-bit total can hold; pagination reports this instead of
   /// returning a truncated count.
   kPrintPageCountOverflow = 9005,
+  /// A threaded-comment operation named an unknown thread, person or reply,
+  /// or supplied an id or timestamp that is not well formed.
+  kThreadedCommentInvalid = 9006,
 
   // ----- Workbook structural mutation (5050-5069) -----
   // Reuse the I/O band: sheet name validation, sheet rearrangement, and
@@ -435,6 +444,10 @@ inline const char* to_cstring(FormulonErrorCode code) {
       return "kIoXlsbCorrupt";
     case FormulonErrorCode::kIoXlsbRetainedPartStale:
       return "kIoXlsbRetainedPartStale";
+    case FormulonErrorCode::kIoImageUnsupported:
+      return "kIoImageUnsupported";
+    case FormulonErrorCode::kIoDrawingUnparseable:
+      return "kIoDrawingUnparseable";
 
     // Crypto / Security
     case FormulonErrorCode::kCryptoAgileNotSupported:
@@ -497,6 +510,8 @@ inline const char* to_cstring(FormulonErrorCode code) {
       return "kPrintInvalidArea";
     case FormulonErrorCode::kPrintPageCountOverflow:
       return "kPrintPageCountOverflow";
+    case FormulonErrorCode::kThreadedCommentInvalid:
+      return "kThreadedCommentInvalid";
     case FormulonErrorCode::kUiViewStateInvalid:
       return "kUiViewStateInvalid";
     case FormulonErrorCode::kUiSnapshotFailed:
diff --git a/src/utils/number_text.cpp b/src/utils/number_text.cpp
new file mode 100644
index 000000000..2458e3fd5
--- /dev/null
+++ b/src/utils/number_text.cpp
@@ -0,0 +1,386 @@
+//
+// Implementation of the printf-free number formatters. See `number_text.h`.
+//
+// Digits come from double-conversion, which rounds exact decimal ties up
+// where printf rounds them to even. An exact tie is detected with integer
+// arithmetic on the binary significand and resolved here; every other value
+// is correctly rounded by the library already.
+
+#include "utils/number_text.h"
+
+#include <cmath>
+#include <cstdarg>
+#include <cstdint>
+#include <cstring>
+
+#include "double-conversion/double-conversion.h"
+
+namespace formulon {
+namespace {
+
+using double_conversion::DoubleToStringConverter;
+
+// A double has at most 767 significant digits and 1074 fractional places;
+// requests beyond these only add zeros, which the layout pads itself.
+constexpr int kMaxSignificant = 800;
+constexpr int kMaxFraction = 1100;
+// 309 integer digits + kMaxFraction places + one tie digit + NUL.
+constexpr int kDigitBufferSize = 1500;
+
+/// Bounded writer with snprintf's truncate-and-count behaviour.
+class Out {
+ public:
+  Out(char* buf, std::size_t cap) : buf_(buf), cap_(cap) {}
+
+  void put(char c) {
+    if (n_ + 1 < cap_) {
+      buf_[n_] = c;
+    }
+    ++n_;
+  }
+
+  void put_n(char c, int count) {
+    for (int i = 0; i < count; ++i) {
+      put(c);
+    }
+  }
+
+  int finish() {
+    if (cap_ > 0) {
+      buf_[n_ < cap_ ? n_ : cap_ - 1] = '\0';
+    }
+    return static_cast<int>(n_);
+  }
+
+ private:
+  char* buf_;
+  std::size_t cap_;
+  std::size_t n_ = 0;
+};
+
+/// Decimal digits of a value: 0.D1D2... x 10^point. Digits past `len` are zero.
+struct Digits {
+  char d[kDigitBufferSize];
+  int len = 0;
+  int point = 0;
+
+  char at(int idx) const { return (idx >= 0 && idx < len) ? d[idx] : '0'; }
+};
+
+/// Splits |v| into m * 2^e (m a 53-bit integer) and returns its trailing zero
+/// bit count and odd part.
+void decompose(double v, int* z, std::uint64_t* odd, int* e) {
+  std::uint64_t bits;
+  std::memcpy(&bits, &v, sizeof(bits));
+  const int biased = static_cast<int>((bits >> 52) & 0x7FFU);
+  std::uint64_t m = bits & ((std::uint64_t{1} << 52) - 1U);
+  if (biased == 0) {
+    *e = -1074;
+  } else {
+    m |= std::uint64_t{1} << 52;
+    *e = biased - 1075;
+  }
+  int tz = 0;
+  while ((m & 1U) == 0U) {
+    m >>= 1U;
+    ++tz;
+  }
+  *z = tz;
+  *odd = m;
+}
+
+/// True iff |v| is exactly halfway between two multiples of 10^-t, i.e.
+/// 2 * |v| * 10^t is an odd integer. `v` must be finite and nonzero.
+bool is_tie_at(double v, int t) {
+  int z;
+  int e;
+  std::uint64_t odd;
+  decompose(v, &z, &odd, &e);
+  if (t >= 0) {
+    return z + e + t + 1 == 0;
+  }
+  const int s = -t;
+  if (z + e - s + 1 != 0 || s > 22) {
+    return false;
+  }
+  std::uint64_t p5 = 1;
+  for (int i = 0; i < s; ++i) {
+    p5 *= 5U;
+  }
+  return odd % p5 == 0U;
+}
+
+/// Rounds up in place by one unit in the last of the first `keep` digits.
+void increment(Digits* g, int keep) {
+  int i = keep - 1;
+  while (i >= 0 && g->d[i] == '9') {
+    --i;
+  }
+  if (i < 0) {
+    g->d[0] = '1';
+    g->len = 1;
+    ++g->point;
+    return;
+  }
+  ++g->d[i];
+  g->len = i + 1;
+}
+
+/// Drops digits past `keep`, rounding half to even when the dropped part is
+/// exactly one half (the caller has established that it is).
+void round_tie_even(Digits* g, int keep) {
+  g->len = keep;
+  if (keep > 0 && ((g->d[keep - 1] - '0') & 1) != 0) {
+    increment(g, keep);
+  }
+}
+
+void to_ascii(double v, DoubleToStringConverter::DtoaMode mode, int requested, Digits* g) {
+  bool sign;
+  DoubleToStringConverter::DoubleToAscii(v, mode, requested, g->d, kDigitBufferSize, &sign, &g->len, &g->point);
+}
+
+/// Digits of |v| rounded to `frac` places after the point (printf `%f`).
+void fixed_digits(double v, int frac, Digits* g) {
+  if (v == 0.0) {
+    g->len = 0;
+    g->point = 0;
+    return;
+  }
+  if (frac > kMaxFraction) {
+    frac = kMaxFraction;
+  }
+  if (is_tie_at(v, frac)) {
+    // The exact expansion ends in '5' one place further: generate it whole.
+    to_ascii(v, DoubleToStringConverter::FIXED, frac + 1, g);
+    round_tie_even(g, g->len - 1);
+    return;
+  }
+  to_ascii(v, DoubleToStringConverter::FIXED, frac, g);
+}
+
+/// Digits of |v| rounded to `n` significant digits (printf `%e` / `%g`).
+void precision_digits(double v, int n, Digits* g) {
+  if (v == 0.0) {
+    g->d[0] = '0';
+    g->len = 1;
+    g->point = 1;
+    return;
+  }
+  if (n > kMaxSignificant) {
+    n = kMaxSignificant;
+  }
+  // One extra digit settles the rounding unless that digit is a '5'.
+  to_ascii(v, DoubleToStringConverter::PRECISION, n + 1, g);
+  if (g->len <= n) {
+    return;
+  }
+  if (g->d[n] != '5') {
+    if (g->d[n] > '5') {
+      increment(g, n);
+    } else {
+      g->len = n;
+    }
+    return;
+  }
+  if (is_tie_at(v, n - g->point)) {
+    round_tie_even(g, n);
+    return;
+  }
+  to_ascii(v, DoubleToStringConverter::PRECISION, n, g);
+}
+
+void put_special(Out* out, double v) {
+  if (std::signbit(v)) {
+    out->put('-');
+  }
+  const char* text = std::isnan(v) ? "nan" : "inf";
+  while (*text != '\0') {
+    out->put(*text++);
+  }
+}
+
+/// Writes the digits as a fixed-point number with exactly `frac` places.
+void put_fixed(Out* out, const Digits& g, int frac) {
+  if (g.point > 0) {
+    for (int i = 0; i < g.point; ++i) {
+      out->put(g.at(i));
+    }
+  } else {
+    out->put('0');
+  }
+  if (frac > 0) {
+    out->put('.');
+    for (int j = 0; j < frac; ++j) {
+      out->put(g.at(g.point + j));
+    }
+  }
+}
+
+/// Writes `D.DDD` + `e+XX` using the first `frac + 1` digits.
+void put_exponential(Out* out, const Digits& g, int frac) {
+  out->put(g.at(0));
+  if (frac > 0) {
+    out->put('.');
+    for (int j = 1; j <= frac; ++j) {
+      out->put(g.at(j));
+    }
+  }
+  const int exp = g.point - 1;
+  const int mag = exp < 0 ? -exp : exp;
+  out->put('e');
+  out->put(exp < 0 ? '-' : '+');
+  if (mag < 10) {
+    out->put('0');
+  }
+  char tmp[8];
+  int n = 0;
+  for (int m = mag; m > 0; m /= 10) {
+    tmp[n++] = static_cast<char>('0' + m % 10);
+  }
+  while (n > 0) {
+    out->put(tmp[--n]);
+  }
+  if (mag == 0) {
+    out->put('0');
+  }
+}
+
+int format_unsigned_base(char* buf, std::size_t cap, unsigned long long v, int min_width, bool negative, unsigned base,
+                         bool upper) {
+  char tmp[24];
+  int n = 0;
+  do {
+    const unsigned digit = static_cast<unsigned>(v % base);
+    tmp[n++] = static_cast<char>(digit < 10U ? '0' + digit : (upper ? 'A' : 'a') + (digit - 10U));
+    v /= base;
+  } while (v != 0U);
+  Out out(buf, cap);
+  if (negative) {
+    out.put('-');
+  }
+  const int used = n + (negative ? 1 : 0);
+  if (min_width > used) {
+    out.put_n('0', min_width - used);
+  }
+  while (n > 0) {
+    out.put(tmp[--n]);
+  }
+  return out.finish();
+}
+
+}  // namespace
+
+int format_fixed(char* buf, std::size_t cap, double v, int frac_digits) {
+  Out out(buf, cap);
+  if (!std::isfinite(v)) {
+    put_special(&out, v);
+    return out.finish();
+  }
+  if (frac_digits < 0) {
+    frac_digits = 0;
+  }
+  if (std::signbit(v)) {
+    out.put('-');
+  }
+  Digits g;
+  fixed_digits(std::fabs(v), frac_digits, &g);
+  put_fixed(&out, g, frac_digits);
+  return out.finish();
+}
+
+std::string fixed_string(double v, int frac_digits) {
+  std::string out;
+  out.resize(static_cast<std::size_t>(format_fixed(nullptr, 0, v, frac_digits)));
+  format_fixed(&out[0], out.size() + 1, v, frac_digits);
+  return out;
+}
+
+int format_exponential(char* buf, std::size_t cap, double v, int frac_digits) {
+  Out out(buf, cap);
+  if (!std::isfinite(v)) {
+    put_special(&out, v);
+    return out.finish();
+  }
+  if (frac_digits < 0) {
+    frac_digits = 0;
+  }
+  if (std::signbit(v)) {
+    out.put('-');
+  }
+  Digits g;
+  precision_digits(std::fabs(v), frac_digits + 1, &g);
+  put_exponential(&out, g, frac_digits);
+  return out.finish();
+}
+
+int format_general(char* buf, std::size_t cap, double v, int precision) {
+  Out out(buf, cap);
+  if (!std::isfinite(v)) {
+    put_special(&out, v);
+    return out.finish();
+  }
+  if (precision < 1) {
+    precision = 1;
+  }
+  if (std::signbit(v)) {
+    out.put('-');
+  }
+  Digits g;
+  precision_digits(std::fabs(v), precision, &g);
+  // Significant digits without trailing zeros: `%g` drops them.
+  int sig = g.len < precision ? g.len : precision;
+  while (sig > 1 && g.d[sig - 1] == '0') {
+    --sig;
+  }
+  const int x = g.point - 1;
+  if (precision > x && x >= -4) {
+    const int frac = sig > g.point ? sig - g.point : 0;
+    put_fixed(&out, g, frac);
+  } else {
+    put_exponential(&out, g, sig - 1);
+  }
+  return out.finish();
+}
+
+int format_signed(char* buf, std::size_t cap, long long v, int min_width) {
+  const bool negative = v < 0;
+  const unsigned long long mag =
+      negative ? 0ULL - static_cast<unsigned long long>(v) : static_cast<unsigned long long>(v);
+  return format_unsigned_base(buf, cap, mag, min_width, negative, 10U, false);
+}
+
+int format_unsigned(char* buf, std::size_t cap, unsigned long long v, int min_width) {
+  return format_unsigned_base(buf, cap, v, min_width, false, 10U, false);
+}
+
+int format_hex(char* buf, std::size_t cap, unsigned long long v, int min_width, bool upper) {
+  return format_unsigned_base(buf, cap, v, min_width, false, 16U, upper);
+}
+
+}  // namespace formulon
+
+#if defined(FORMULON_WASM)
+// Target of the WASM link's `--wrap=snprintf` (cmake/FormulonWasm.cmake). After
+// the engine moved to number_text, pugixml's XPath number-to-string is the
+// only snprintf caller in the module; it uses exactly "%.*e" and "%.*g". A new
+// snprintf call in engine code would silently land here and fail with -1:
+// engine code must use the formatters above instead.
+extern "C" int __wrap_snprintf(char* buf, std::size_t cap, const char* fmt,
+                               ...) {  // NOLINT(bugprone-reserved-identifier)
+  int result = -1;
+  const bool is_e = std::strcmp(fmt, "%.*e") == 0;
+  if (is_e || std::strcmp(fmt, "%.*g") == 0) {
+    va_list args;
+    va_start(args, fmt);
+    const int precision = va_arg(args, int);
+    const double value = va_arg(args, double);
+    va_end(args);
+    result = is_e ? formulon::format_exponential(buf, cap, value, precision)
+                  : formulon::format_general(buf, cap, value, precision);
+  } else if (cap > 0) {
+    buf[0] = '\0';
+  }
+  return result;
+}
+#endif
diff --git a/src/utils/number_text.h b/src/utils/number_text.h
new file mode 100644
index 000000000..a065d838e
--- /dev/null
+++ b/src/utils/number_text.h
@@ -0,0 +1,48 @@
+//
+// snprintf-compatible number formatting that does not link libc's printf.
+//
+// Each function writes NUL-terminated text into `buf` (capacity `cap`) and
+// returns the length the full text has, like `snprintf`: a result >= `cap`
+// means the text was truncated. Output is byte-identical to the printf
+// conversion named on each declaration, including the exact-tie rounding
+// (ties to even on the exact binary value) that double-conversion alone
+// does not give.
+//
+// Engine code must use these instead of `snprintf`: on the WASM target the
+// only remaining `snprintf` caller is pugixml, routed to `__wrap_snprintf`
+// in number_text.cpp.
+
+#ifndef FORMULON_UTILS_NUMBER_TEXT_H_
+#define FORMULON_UTILS_NUMBER_TEXT_H_
+
+#include <cstddef>
+#include <string>
+
+namespace formulon {
+
+/// Equivalent of `snprintf(buf, cap, "%.*f", frac_digits, v)`.
+int format_fixed(char* buf, std::size_t cap, double v, int frac_digits);
+
+/// `format_fixed` into a string; `fixed_string(v, 6)` replaces `std::to_string(double)`,
+/// which libc++ implements through `snprintf("%f")`.
+std::string fixed_string(double v, int frac_digits);
+
+/// Equivalent of `snprintf(buf, cap, "%.*e", frac_digits, v)`.
+int format_exponential(char* buf, std::size_t cap, double v, int frac_digits);
+
+/// Equivalent of `snprintf(buf, cap, "%.*g", precision, v)`; a precision of 0
+/// is treated as 1.
+int format_general(char* buf, std::size_t cap, double v, int precision);
+
+/// Equivalent of `"%d"` / `"%lld"` (min_width 0) or `"%0<min_width>d"`.
+int format_signed(char* buf, std::size_t cap, long long v, int min_width = 0);
+
+/// Equivalent of `"%u"` / `"%llu"` (min_width 0) or `"%0<min_width>u"`.
+int format_unsigned(char* buf, std::size_t cap, unsigned long long v, int min_width = 0);
+
+/// Equivalent of `"%0<min_width>X"` (`upper`) or `"%0<min_width>x"`.
+int format_hex(char* buf, std::size_t cap, unsigned long long v, int min_width, bool upper);
+
+}  // namespace formulon
+
+#endif  // FORMULON_UTILS_NUMBER_TEXT_H_
diff --git a/src/utils/structured_log.cpp b/src/utils/structured_log.cpp
index c7fc484d5..b32d9b2f3 100644
--- a/src/utils/structured_log.cpp
+++ b/src/utils/structured_log.cpp
@@ -11,12 +11,12 @@
 
 #include <cmath>
 #include <cstdint>
-#include <cstdio>
 #include <mutex>
 #include <string>
 #include <string_view>
 
 #include "utils/error.h"
+#include "utils/number_text.h"
 
 namespace formulon {
 namespace {
@@ -52,7 +52,8 @@ void AppendEscapedJsonString(std::string& out, std::string_view in) {
       default:
         if (c < 0x20) {
           char buf[8];
-          std::snprintf(buf, sizeof(buf), "\\u%04x", c);
+          out.append("\\u");
+          format_hex(buf, sizeof(buf), c, 4, false);
           out.append(buf);
         } else {
           out.push_back(static_cast<char>(c));
@@ -117,7 +118,7 @@ StructuredLog& StructuredLog::field(std::string_view key, std::string_view value
 StructuredLog& StructuredLog::field(std::string_view key, int64_t value) {
   AppendKey(fields_, key);
   char buf[32];
-  std::snprintf(buf, sizeof(buf), "%lld", static_cast<long long>(value));
+  format_signed(buf, sizeof(buf), value);
   fields_.append(buf);
   return *this;
 }
@@ -130,7 +131,7 @@ StructuredLog& StructuredLog::field(std::string_view key, double value) {
     fields_.append(value < 0 ? "\"-Infinity\"" : "\"Infinity\"");
   } else {
     char buf[64];
-    std::snprintf(buf, sizeof(buf), "%.17g", value);
+    format_general(buf, sizeof(buf), value, 17);
     fields_.append(buf);
   }
   return *this;
@@ -145,7 +146,7 @@ StructuredLog& StructuredLog::field(std::string_view key, bool value) {
 StructuredLog& StructuredLog::error_code(FormulonErrorCode code) {
   AppendKey(fields_, "code");
   char buf[32];
-  std::snprintf(buf, sizeof(buf), "%d", static_cast<int>(code));
+  format_signed(buf, sizeof(buf), static_cast<int>(code));
   fields_.append(buf);
   AppendKey(fields_, "code_name");
   AppendEscapedJsonString(fields_, to_cstring(code));
diff --git a/src/value.cpp b/src/value.cpp
index a3b0dbb9b..4aec1e798 100644
--- a/src/value.cpp
+++ b/src/value.cpp
@@ -8,6 +8,7 @@
 
 #include "eval/lambda_value.h"
 #include "utils/expected.h"
+#include "utils/number_text.h"
 
 namespace formulon {
 
@@ -61,7 +62,7 @@ std::string Value::debug_to_string() const {
     case ValueKind::Blank:
       return "Blank";
     case ValueKind::Number:
-      return "Number(" + std::to_string(data_.number) + ")";
+      return "Number(" + fixed_string(data_.number, 6) + ")";
     case ValueKind::Bool:
       return std::string("Bool(") + (data_.boolean ? "true" : "false") + ")";
     case ValueKind::Error:
diff --git a/src/version.h b/src/version.h
index 92ad5f70d..8b0e478f3 100644
--- a/src/version.h
+++ b/src/version.h
@@ -8,7 +8,7 @@
 // together.
 
 #define FORMULON_VERSION_MAJOR 0
-#define FORMULON_VERSION_MINOR 12
+#define FORMULON_VERSION_MINOR 13
 #define FORMULON_VERSION_PATCH 0
 
 #define FORMULON_VERSION_STRINGIFY_(x) #x
diff --git a/src/wasm/formulon.d.ts b/src/wasm/formulon.d.ts
index 81d558378..038b28ad9 100644
--- a/src/wasm/formulon.d.ts
+++ b/src/wasm/formulon.d.ts
@@ -22,7 +22,8 @@ export enum ValueKind {
   Lambda = 7,
 }
 
-/** Result envelope returned by every fallible binding call. */
+/** Status carried by binding result envelopes. Argument validation may
+ *  throw `TypeError` or `RangeError` before returning a result. */
 export interface Status {
   /** True when the underlying C ABI returned `kOk`. */
   ok: boolean;
@@ -610,6 +611,161 @@ export interface PaginationResult {
   horizontalBreaks: number[];
   verticalBreaks: number[];
   pageCount: number;
+  /** Paper the layout ran on, after the orientation swap. `known` is false
+   *  when the stored `paperSize` was unrecognised and A4 was substituted. */
+  paper: PaginationPaper;
+  margins: PaginationMargins;
+  /** Cell-body rectangle before print-title reservation, from the page's top-left corner. */
+  printable: RectPt;
+  /** Effective scale as a factor (1 is 100%). */
+  scale: number;
+  /** 0 = down then over, 1 = over then down. */
+  pageOrder: number;
+  /** Repeat rows / columns in effect (0-based, inclusive); a span is meaningful only when its flag is set. */
+  printTitles: PaginationPrintTitles;
+  /** Physical pages in print order. */
+  pages: PaginationPage[];
+  /** Parallel to `horizontalBreaks`: true for a manual break. */
+  horizontalBreakManual: boolean[];
+  /** Parallel to `verticalBreaks`: true for a manual break. */
+  verticalBreakManual: boolean[];
+}
+
+/** `PaginationResult.paper`. `known` is false when the stored `paperSize` was
+ *  unrecognised and A4 was substituted. */
+export interface PaginationPaper {
+  widthPt: number;
+  heightPt: number;
+  landscape: boolean;
+  known: boolean;
+}
+
+/** `PaginationResult.margins`, in points; `header` / `footer` are measured
+ *  from the page edge to the header / footer band. */
+export interface PaginationMargins {
+  left: number;
+  right: number;
+  top: number;
+  bottom: number;
+  header: number;
+  footer: number;
+}
+
+/** `PaginationResult.printTitles`: repeat rows / columns (0-based,
+ *  inclusive). A span is meaningful only when its `has*` flag is true. */
+export interface PaginationPrintTitles {
+  hasRows: boolean;
+  firstRow: number;
+  lastRow: number;
+  hasCols: boolean;
+  firstCol: number;
+  lastCol: number;
+}
+
+/** A rectangle in points. */
+export interface RectPt {
+  x: number;
+  y: number;
+  width: number;
+  height: number;
+}
+
+/** One physical page of a `PaginationResult`. `widthPt` / `heightPt` are the
+ *  scaled extent of the page's own cell block (repeated titles excluded) and
+ *  `originXPt` / `originYPt` is that block's top-left corner on the paper. */
+export interface PaginationPage {
+  /** Index into `PaginationResult.printArea` (0 for the used-range fallback). */
+  areaIndex: number;
+  firstRow: number;
+  lastRow: number;
+  firstCol: number;
+  lastCol: number;
+  originXPt: number;
+  originYPt: number;
+  widthPt: number;
+  heightPt: number;
+}
+
+/** Which Windows column-width figure a geometry call uses. Mirrors `fm_geometry_mode_t`.
+ *  `Display` is the screen figure (`Range.Width` at 96 DPI); `Print` is the
+ *  DPI-stable figure pagination breaks on. Row heights are identical in both. */
+export enum GeometryMode {
+  Display = 0,
+  Print = 1,
+}
+
+/** Return type of `Workbook.getCellRectPt(...)`. */
+export interface CellRectResult extends RectPt {
+  status: Status;
+}
+
+/** Return type of `Workbook.getWidthModel(...)`. */
+export interface WidthModelResult {
+  status: Status;
+  pointsPerChar: number;
+  paddingPt: number;
+  normalFontSize: number;
+  /** False when the Normal font is not a measured calibration point and the Calibri 11 figure was extrapolated. */
+  calibrated: boolean;
+  normalFontName: string;
+  platform: string;
+}
+
+/** Sheet default column / row metrics (`<sheetFormatPr>`). A width / height is
+ *  meaningful only when its `has*` flag is set. */
+export interface SheetFormatDefaults {
+  /** Character units. */
+  defaultColWidth: number;
+  /** Points. */
+  defaultRowHeight: number;
+  /** Character units; OOXML default 8. */
+  baseColWidth: number;
+  hasDefaultColWidth: boolean;
+  hasDefaultRowHeight: boolean;
+}
+
+/** Return type of `Workbook.getSheetFormatDefaults(sheet)`. */
+export interface SheetFormatDefaultsResult extends SheetFormatDefaults {
+  status: Status;
+}
+
+/** Return type of `Workbook.getFormula` / `getFormulaR1C1`. `formula` is `null` when the cell holds no formula. */
+export interface FormulaResult {
+  status: Status;
+  formula: string | null;
+}
+
+/** One populated cell of `Workbook.getCellsInRange`. */
+export interface RangeCell {
+  row: number;
+  col: number;
+  formula: string | null;
+  value: Value;
+}
+
+/** Return type of `Workbook.getCellsInRange(...)`. */
+export interface CellsInRangeResult {
+  status: Status;
+  cells: RangeCell[];
+  /** Resume position for the next page, or `null` when the range is exhausted. */
+  nextCursor: number | null;
+}
+
+/** Outcome of a display-text rendering. Mirrors `fm_display_status_t`.
+ *  `Overflow`: the value cannot be shown in the format and the text is
+ *  `########`. `InvalidFormat`: the code is malformed and the text is the
+ *  General rendering. */
+export enum DisplayStatus {
+  Ok = 0,
+  Overflow = 1,
+  InvalidFormat = 2,
+}
+
+/** Return type of `Workbook.getDisplayText` / `formatValue`. */
+export interface DisplayTextResult {
+  status: Status;
+  text: string;
+  displayStatus: DisplayStatus;
 }
 
 /** Sheet tab visibility, mirroring OOXML `<sheet state>`.
@@ -735,6 +891,10 @@ export interface RowLayout {
   /** Whether OOXML customFormat=1 makes the row style effective. */
   hasStyle: number;
   styleXf: number;
+  /** Boolean stored as 0/1: whether a height is stored; `height` is meaningful only then. */
+  hasHeight: number;
+  /** Boolean stored as 0/1: an explicit override (`customHeight="1"`) rather than an auto height Excel recomputes. */
+  customHeight: number;
 }
 
 /** Return type of `Workbook.getSheetRowOverrides(sheet)`. */
@@ -807,13 +967,13 @@ export interface DataValidationRange {
  *    * `op`          — 0 between, 1 notBetween, 2 equal, 3 notEqual,
  *                       4 greaterThan, 5 lessThan,
  *                       6 greaterThanOrEqual, 7 lessThanOrEqual.
- *    * `errorStyle`  — 0 stop, 1 warning, 2 information.
+ *    * `errorStyle`  — a `ValidationErrorStyle`.
  */
 export interface DataValidationEntry {
   readonly ranges: ReadonlyArray<DataValidationRange>;
   readonly type: number;
   readonly op: number;
-  readonly errorStyle: number;
+  readonly errorStyle: ValidationErrorStyle;
   readonly allowBlank: boolean;
   readonly showInputMessage: boolean;
   readonly showErrorMessage: boolean;
@@ -837,7 +997,7 @@ export interface DataValidationInput {
   ranges?: ReadonlyArray<DataValidationRange>;
   type: number;
   op?: number;
-  errorStyle?: number;
+  errorStyle?: ValidationErrorStyle;
   allowBlank?: boolean;
   showInputMessage?: boolean;
   showErrorMessage?: boolean;
@@ -1145,6 +1305,21 @@ export interface CellXfResult {
   hasWrapText: boolean;
   /** Whether `justifyLastLine="..."` was explicitly present. */
   hasJustifyLastLine: boolean;
+  /** OOXML `applyNumberFormat` / `applyFont` / `applyFill` / `applyBorder` /
+   *  `applyAlignment` / `applyProtection`: whether this record's value for
+   *  the group overrides its parent named style. */
+  applyNumberFormat: boolean;
+  applyFont: boolean;
+  applyFill: boolean;
+  applyBorder: boolean;
+  applyAlignment: boolean;
+  applyProtection: boolean;
+  /** OOXML `quotePrefix`. */
+  quotePrefix: boolean;
+  /** Whether the record carries a `<protection>` child. When false, `locked` / `hidden` are the model defaults (true / false). */
+  hasProtection: boolean;
+  locked: boolean;
+  hidden: boolean;
   /** OOXML `textRotation`; present only when the source attribute existed. */
   textRotation?: number;
   /** OOXML `indent`; present only when the source attribute existed. */
@@ -1171,7 +1346,7 @@ export interface CellXfResult {
  *  the writer emits the sibling `*Argb` as `rgb`. */
 export interface ColorSpec {
   /** 0=none, 1=rgb, 2=theme, 3=indexed, 4=auto. */
-  kind: number;
+  kind: FilterKind;
   /** AARRGGBB; meaningful when `kind` is 1. */
   rgb: number;
   /** Theme index; meaningful when `kind` is 2. */
@@ -1278,6 +1453,21 @@ export interface CellXf {
   hasWrapText?: boolean;
   /** Whether `justifyLastLine` was explicitly supplied; defaults to inference. */
   hasJustifyLastLine?: boolean;
+  /** OOXML `apply*` flags; each defaults to false. */
+  applyNumberFormat?: boolean;
+  applyFont?: boolean;
+  applyFill?: boolean;
+  applyBorder?: boolean;
+  applyAlignment?: boolean;
+  applyProtection?: boolean;
+  /** OOXML `quotePrefix`; defaults to false. */
+  quotePrefix?: boolean;
+  /** Whether to write a `<protection>` child. Omit to infer from `locked` / `hidden`. */
+  hasProtection?: boolean;
+  /** Defaults to true; ignored unless the record carries a `<protection>` child. */
+  locked?: boolean;
+  /** Defaults to false; ignored unless the record carries a `<protection>` child. */
+  hidden?: boolean;
   /** OOXML `textRotation` (0..180 or 255). Omitted when absent. */
   textRotation?: number;
   /** OOXML `indent` (0..255). Omitted when absent. */
@@ -1420,7 +1610,235 @@ export interface ExternalLinkRecord {
    *  `TargetMode="External"` (the common case). */
   targetExternal: boolean;
   /** One of `ExternalLinkKind.*`. */
-  kind: number;
+  kind: FilterKind;
+}
+
+/** Argument of `Workbook.setCellStyle`. Mirrors `CellStyleResult` without the status. */
+export interface CellStyleRecord {
+  /** Display name of the style. */
+  name: string;
+  /** Index into the `<cellStyleXfs>` table; defaults to 0. */
+  xfId?: number;
+  /** OOXML built-in ordinal (`0..53`); defaults to `0xFFFFFFFF` (custom). */
+  builtinId?: number;
+  /** Outline level of the `RowLevel_n` / `ColLevel_n` styles; defaults to 0. */
+  iLevel?: number;
+  hidden?: boolean;
+  customBuiltin?: boolean;
+}
+
+/** Criterion of an AutoFilter column. Mirrors `fm_filter_kind_t`. */
+export enum FilterKind {
+  None = 0,
+  Values = 1,
+  Custom = 2,
+  Top10 = 3,
+  Dynamic = 4,
+  Color = 5,
+  Icon = 6,
+}
+
+/** Comparison operator of a custom AutoFilter condition. Mirrors `fm_filter_operator_t`. */
+export enum FilterOperator {
+  Equal = 0,
+  LessThan = 1,
+  LessThanOrEqual = 2,
+  NotEqual = 3,
+  GreaterThanOrEqual = 4,
+  GreaterThan = 5,
+}
+
+/** Dynamic AutoFilter type, in `ST_DynamicFilterType` schema order. Mirrors `fm_dynamic_filter_type_t`. */
+export enum DynamicFilterType {
+  Null = 0,
+  AboveAverage = 1,
+  BelowAverage = 2,
+  Tomorrow = 3,
+  Today = 4,
+  Yesterday = 5,
+  NextWeek = 6,
+  ThisWeek = 7,
+  LastWeek = 8,
+  NextMonth = 9,
+  ThisMonth = 10,
+  LastMonth = 11,
+  NextQuarter = 12,
+  ThisQuarter = 13,
+  LastQuarter = 14,
+  NextYear = 15,
+  ThisYear = 16,
+  LastYear = 17,
+  YearToDate = 18,
+  Q1 = 19,
+  Q2 = 20,
+  Q3 = 21,
+  Q4 = 22,
+  M1 = 23,
+  M2 = 24,
+  M3 = 25,
+  M4 = 26,
+  M5 = 27,
+  M6 = 28,
+  M7 = 29,
+  M8 = 30,
+  M9 = 31,
+  M10 = 32,
+  M11 = 33,
+  M12 = 34,
+}
+
+/** What a sort condition sorts by. Mirrors `fm_sort_by_t`. */
+export enum SortBy {
+  Value = 0,
+  CellColor = 1,
+  FontColor = 2,
+  Icon = 3,
+}
+
+/** Sort method of an AutoFilter sort state. Mirrors `fm_sort_method_t`. */
+export enum SortMethod {
+  None = 0,
+  PinYin = 1,
+  Stroke = 2,
+}
+
+/** Granularity of an AutoFilter date-group item. Mirrors `fm_date_time_grouping_t`. */
+export enum DateTimeGrouping {
+  Year = 0,
+  Month = 1,
+  Day = 2,
+  Hour = 3,
+  Minute = 4,
+  Second = 5,
+}
+
+/** Data-validation error style. Mirrors `fm_validation_error_style_t`. */
+export enum ValidationErrorStyle {
+  Stop = 0,
+  Warning = 1,
+  Information = 2,
+}
+
+/** Where a colour is used; decides what an automatic colour means. Mirrors `fm_color_context_t`. */
+export enum ColorContext {
+  Font = 0,
+  FillForeground = 1,
+  FillBackground = 2,
+  Border = 3,
+}
+
+/** Raster format of an image; `Unknown` marks "no image bytes found". Mirrors `fm_image_format_t`. */
+export enum ImageFormat {
+  Unknown = 0,
+  Png = 1,
+  Jpeg = 2,
+  Gif = 3,
+  Bmp = 4,
+}
+
+/** What a drawing anchor holds. Mirrors `fm_drawing_object_kind_t`. */
+export enum DrawingObjectKind {
+  Picture = 0,
+  Shape = 1,
+  Chart = 2,
+  Group = 3,
+  Connector = 4,
+  GraphicFrame = 5,
+  Other = 6,
+}
+
+/** The anchor element type of a drawing object. Mirrors `fm_anchor_kind_t`. */
+export enum AnchorKind {
+  OneCell = 0,
+  TwoCell = 1,
+  Absolute = 2,
+}
+
+/** How a drawing object follows row and column edits. Mirrors `fm_anchor_edit_as_t`. */
+export enum AnchorEditAs {
+  TwoCell = 0,
+  OneCell = 1,
+  Absolute = 2,
+}
+
+/** How a colour was resolved. Mirrors `fm_color_resolution_t`. `Exact` is a literal or workbook-supplied
+ *  colour; `DefaultTheme` / `ThemeUnparseable` mean the default (Office 2013-2022) theme was used because
+ *  the theme part is absent / unparseable; `IndexOutOfRange` is black; `AutoContext` is an automatic colour
+ *  (black for font and border, white for fills). */
+export enum ColorResolution {
+  Exact = 0,
+  DefaultTheme = 1,
+  IndexOutOfRange = 2,
+  ThemeUnparseable = 3,
+  AutoContext = 4,
+}
+
+/** Where `getTheme` read the theme from. Mirrors the C `out_source` values. */
+export enum ThemeSource {
+  Part = 0,
+  Default = 1,
+  Unparseable = 2,
+}
+
+/** Where `getEffectiveStyle` took its xf from. */
+export enum EffectiveStyleSource {
+  Cell = 0,
+  Row = 1,
+  Column = 2,
+  Default = 3,
+}
+
+/** The theme's typefaces; `*EastAsian` is the `a:ea` face, else the `Jpan` script face. */
+export interface ThemeFonts {
+  majorLatin: string;
+  majorEastAsian: string;
+  minorLatin: string;
+  minorEastAsian: string;
+}
+
+/** Return type of `Workbook.getTheme()`. */
+export interface ThemeResult {
+  status: Status;
+  /** One of `ThemeSource.*`. */
+  source: ThemeSource;
+  /** 0xFFRRGGBB in `clrScheme` order: dk1, lt1, dk2, lt2, accent1..6, hlink, folHlink. */
+  colors: number[];
+  fonts: ThemeFonts;
+}
+
+/** A resolved colour: 0xFFRRGGBB plus how it was obtained. */
+export interface ResolvedColor {
+  argb: number;
+  resolution: ColorResolution;
+}
+
+/** Return type of `Workbook.resolveColor(...)`. */
+export interface ResolvedColorResult extends ResolvedColor {
+  status: Status;
+}
+
+/** Return type of `Workbook.getEffectiveStyle(...)`. */
+export interface EffectiveStyleResult {
+  status: Status;
+  xfIndex: number;
+  /** One of `EffectiveStyleSource.*`. */
+  source: EffectiveStyleSource;
+  fontIndex: number;
+  fillIndex: number;
+  borderIndex: number;
+  font: ResolvedColor;
+  fillForeground: ResolvedColor;
+  fillBackground: ResolvedColor;
+  borders: {
+    left: ResolvedColor;
+    right: ResolvedColor;
+    top: ResolvedColor;
+    bottom: ResolvedColor;
+    diagonal: ResolvedColor;
+  };
+  locked: boolean;
+  hidden: boolean;
+  numFmtCode: string;
 }
 
 /** Return type of `Workbook.getCellStyle(index)`. Mirrors
@@ -1492,6 +1910,226 @@ export interface SheetAutoFilterXmlResult {
   xml: string;
 }
 
+/** One `<dateGroupItem>` of a values filter. `grouping` is the granularity
+ *  the item matches at (a `DateTimeGrouping`); fields finer than `grouping` are zero. */
+export interface AutoFilterDateGroup {
+  year: number;
+  month: number;
+  day: number;
+  hour: number;
+  minute: number;
+  second: number;
+  grouping: DateTimeGrouping;
+}
+
+/** One `<filterColumn>`. `colId` is the 0-based offset from the first column
+ *  of the AutoFilter range. `kind` selects the criterion and only that
+ *  criterion's fields are read on input (a `FilterKind`); on output every other criterion's
+ *  fields are zero. Custom operators `op1` / `op2` are
+ *  `FilterOperator`s; `dynamicType` is a `DynamicFilterType`.
+ *  `dxfId` of `4294967295` means absent. `iconSet` is the conditional-format
+ *  icon-set ordinal. Omitted input fields read as zero / false / empty,
+ *  except `showButton` (true) and `dxfId` (absent). */
+export interface AutoFilterColumn {
+  colId: number;
+  hiddenButton: boolean;
+  showButton: boolean;
+  kind: FilterKind;
+  filterBlank: boolean;
+  values: string[];
+  dateGroups: AutoFilterDateGroup[];
+  customAnd: boolean;
+  customCount: number;
+  op1: FilterOperator;
+  val1: string;
+  op2: FilterOperator;
+  val2: string;
+  top: boolean;
+  percent: boolean;
+  hasFilterVal: boolean;
+  topVal: number;
+  filterVal: number;
+  dynamicType: DynamicFilterType;
+  hasDynVal: boolean;
+  hasDynMaxVal: boolean;
+  dynVal: number;
+  dynMaxVal: number;
+  valIso: string;
+  maxValIso: string;
+  dxfId: number;
+  cellColor: boolean;
+  iconSet: number;
+  iconId: number;
+  hasIconId: boolean;
+}
+
+/** One `<sortCondition>`. `sortBy` is a `SortBy`. `dxfId` is read only when `hasDxfId`, `iconId` only when
+ *  `hasIconId`. */
+export interface AutoFilterSortCondition {
+  ref: MergeRange;
+  descending: boolean;
+  sortBy: SortBy;
+  customList: string;
+  dxfId: number;
+  hasDxfId: boolean;
+  iconSet: number;
+  iconId: number;
+  hasIconId: boolean;
+}
+
+/** The `<sortState>` of an AutoFilter. `sortMethod` is a
+ *  `SortMethod`. */
+export interface AutoFilterSortState {
+  ref: MergeRange;
+  columnSort: boolean;
+  caseSensitive: boolean;
+  sortMethod: SortMethod;
+  conditions: AutoFilterSortCondition[];
+}
+
+/** A sheet or table AutoFilter. `range` includes the header row; `columns`
+ *  must be in strictly ascending `colId` order inside it. */
+export interface AutoFilter {
+  range: MergeRange;
+  columns: AutoFilterColumn[];
+  sort: AutoFilterSortState | null;
+}
+
+/** Result of `Workbook.getAutoFilter` / `getTableAutoFilter`. `autoFilter` is
+ *  `null` when there is none. */
+export interface AutoFilterResult {
+  status: Status;
+  autoFilter: AutoFilter | null;
+}
+
+/** Result of `Workbook.evaluateAutoFilter` / `evaluateTableAutoFilter`.
+ *  `match[i]` tells whether body row `firstRow + i` satisfies the criteria. */
+export interface AutoFilterEvalResult {
+  status: Status;
+  firstRow: number;
+  match: boolean[];
+}
+
+/** Result of `Workbook.validateValue`. `hasRule` is false when no rule covers
+ *  the cell, and `valid` is then true. Otherwise `ruleIndex` indexes
+ *  `getValidations` and `errorStyle` is a `ValidationErrorStyle`. */
+export interface ValidationOutcomeResult {
+  status: Status;
+  hasRule: boolean;
+  valid: boolean;
+  ruleIndex: number;
+  errorStyle: ValidationErrorStyle;
+}
+
+/** One `@person` mention in a threaded comment's text; `start` and `length`
+ *  are in UTF-16 code units. */
+export interface Mention {
+  personId: string;
+  mentionId: string;
+  start: number;
+  length: number;
+}
+
+/** One threaded comment: a thread's opening comment, or a reply when
+ *  `parentId` is non-empty. Ids are brace-wrapped uppercase GUIDs and
+ *  `created` is `YYYY-MM-DDTHH:MM:SS.ss`; the caller supplies both. `done`
+ *  is the thread's resolved state, meaningful on the opening comment only. */
+export interface ThreadedComment {
+  id: string;
+  row: number;
+  col: number;
+  personId: string;
+  created: string;
+  text: string;
+  parentId: string;
+  done: boolean;
+  mentions: Mention[];
+}
+
+/** One entry of the workbook's person list. */
+export interface Person {
+  id: string;
+  displayName: string;
+  userId: string;
+  providerId: string;
+}
+
+/** Result of `Workbook.getThreadedComments`, in file order: each thread's
+ *  opening comment followed by its replies. */
+export interface ThreadedCommentsResult {
+  status: Status;
+  comments: ThreadedComment[];
+}
+
+/** Result of `Workbook.getPersons`. */
+export interface PersonsResult {
+  status: Status;
+  persons: Person[];
+}
+
+/** Format and pixel size of an image; zeroed when `status` is not ok. */
+export interface ImageInfoResult {
+  status: Status;
+  format: ImageFormat;
+  pxWidth: number;
+  pxHeight: number;
+}
+
+/** Result of `Workbook.getImage`. `bytes` is a copy, empty on failure. */
+export interface ImageResult extends ImageInfoResult {
+  bytes: Uint8Array;
+}
+
+/** One anchored object of a sheet's drawing. An absolute anchor reports its
+ *  position from A1 as `fromColOff` (x) and `fromRowOff` (y); `toRow` /
+ *  `toCol` and their offsets are zero unless the anchor is two-cell. Offsets
+ *  and `cx` / `cy` are in EMU. `imageFormat` is non-zero for a picture whose
+ *  media part is present; `mediaPath` is empty for a non-picture. */
+export interface DrawingObject {
+  objectId: number;
+  kind: DrawingObjectKind;
+  anchorKind: AnchorKind;
+  editAs: AnchorEditAs;
+  fromRow: number;
+  fromCol: number;
+  fromRowOff: number;
+  fromColOff: number;
+  toRow: number;
+  toCol: number;
+  toRowOff: number;
+  toColOff: number;
+  cx: number;
+  cy: number;
+  imageFormat: ImageFormat;
+  name: string;
+  descr: string;
+  mediaPath: string;
+}
+
+/** Placement of an inserted image. `anchorKind` is `OneCell` (default) or
+ *  `TwoCell`; `editAs` applies to a two-cell anchor only. `row` / `col` is
+ *  the 0-based top-left cell and `rowOffEmu` / `colOffEmu` the offset inside
+ *  it. A zero `widthEmu` / `heightEmu` means the pixel size times 9525. An
+ *  empty `name` becomes `Picture <id>`. */
+export interface ImageInsertOptions {
+  name?: string;
+  descr?: string;
+  anchorKind?: AnchorKind;
+  editAs?: AnchorEditAs;
+  row?: number;
+  col?: number;
+  rowOffEmu?: number;
+  colOffEmu?: number;
+  widthEmu?: number;
+  heightEmu?: number;
+}
+
+/** Result of `Workbook.insertImage`; `objectId` is zero on failure. */
+export interface InsertImageResult {
+  status: Status;
+  objectId: number;
+}
+
 /** Result of the five raw print-settings getters. The empty `xml` string
  * means the sheet declares no such element. */
 export interface SheetPrintXmlResult {
@@ -1705,6 +2343,19 @@ export interface Workbook {
 
   getValue(sheet: number, row: number, col: number): CellResult;
 
+  /** The stored A1 formula (leading `=` included), or `formula: null` for a cell that holds none. */
+  getFormula(sheet: number, row: number, col: number): FormulaResult;
+  /** The formula in R1C1 notation relative to the cell, without a leading `=`; `formula: null` when the cell holds none. */
+  getFormulaR1C1(sheet: number, row: number, col: number): FormulaResult;
+  /** One page of the populated cells (formula or non-blank value, spill phantoms included) inside
+   *  `range`, row-major. `cursor` is the `nextCursor` of the previous page (omit for the first);
+   *  `limit` caps the page (omit or 0 for the maximum, 65536). */
+  getCellsInRange(sheet: number, range: MergeRange, cursor?: number | null, limit?: number | null): CellsInRangeResult;
+  /** The text Excel displays for the cell, from its value and number format under the workbook's date system. */
+  getDisplayText(sheet: number, row: number, col: number): DisplayTextResult;
+  /** Renders `value` (blank, number, boolean, text or error) under the stored-form number format `formatCode`; empty means General. */
+  formatValue(value: Value, formatCode: string): DisplayTextResult;
+
   /** Evaluates `formula` as if entered at `(sheet, row, col)` and returns a
    *  single scalar result, without mutating the workbook. Local and
    *  cross-sheet references, defined names, and `ROW()` / `COLUMN()` resolve
@@ -1890,6 +2541,65 @@ export interface Workbook {
   /** Replaces the worksheet-level `<autoFilter>` XML fragment; empty clears it. */
   setSheetAutoFilterXml(sheet: number, xml: string): Status;
 
+  /** Reads the sheet's typed AutoFilter; `autoFilter` is `null` when absent. */
+  getAutoFilter(sheet: number): AutoFilterResult;
+  /** Replaces the sheet AutoFilter and its hidden `_xlnm._FilterDatabase`
+   *  name. Row visibility is unchanged; call `applyAutoFilter` to hide the
+   *  excluded rows. */
+  setAutoFilter(sheet: number, filter: AutoFilter): Status;
+  /** Removes the sheet AutoFilter. Row visibility is unchanged. */
+  removeAutoFilter(sheet: number): Status;
+  /** Hides every body row the criteria exclude and shows the rest, as
+   *  Excel's Reapply does. Fails with a not-found status when there is no AutoFilter. */
+  applyAutoFilter(sheet: number): Status;
+  /** Drops every column criterion and shows all body rows. */
+  clearAutoFilter(sheet: number): Status;
+  /** Evaluates the sheet AutoFilter without changing the sheet. */
+  evaluateAutoFilter(sheet: number): AutoFilterEvalResult;
+  /** Table counterparts, addressed by the workbook-wide table index
+   *  (`tableAt`). */
+  getTableAutoFilter(table: number): AutoFilterResult;
+  setTableAutoFilter(table: number, filter: AutoFilter): Status;
+  removeTableAutoFilter(table: number): Status;
+  applyTableAutoFilter(table: number): Status;
+  clearTableAutoFilter(table: number): Status;
+  evaluateTableAutoFilter(table: number): AutoFilterEvalResult;
+
+  /** Checks `value` against the validation rule covering `(row, col)` without
+   *  storing it. The first rule in `getValidations` order wins on overlap. */
+  validateValue(sheet: number, row: number, col: number, value: Value): ValidationOutcomeResult;
+  /** Enumerates populated cells whose value fails their validation rule, in
+   *  row-major order, one page at a time; paging as `getCellsInRange`. */
+  listInvalidCells(sheet: number, cursor?: number | null, limit?: number | null): CellsInRangeResult;
+
+  /** Lists the sheet's threaded comments, replies included. */
+  getThreadedComments(sheet: number): ThreadedCommentsResult;
+  /** Adds a threaded comment. An empty `parentId` opens a new thread at
+   *  `row` / `col`; otherwise it replies to that thread. */
+  addThreadedComment(sheet: number, comment: Partial<ThreadedComment> & Pick<ThreadedComment, 'id' | 'text'>): Status;
+  /** Replaces the text and mentions of the comment with `id`. */
+  editThreadedComment(sheet: number, id: string, text: string, mentions: Mention[]): Status;
+  /** Sets the resolved state of the thread opened by `threadId`. */
+  setThreadResolved(sheet: number, threadId: string, done: boolean): Status;
+  /** Removes a comment; removing an opening comment removes its thread. */
+  removeThreadedComment(sheet: number, id: string): Status;
+  /** Lists the workbook's persons. */
+  getPersons(): PersonsResult;
+  addPerson(person: Person): Status;
+  /** Fails while a threaded comment or mention still names the person. */
+  removePerson(id: string): Status;
+
+  /** Sniffs the format and pixel size of PNG, JPEG, GIF or BMP bytes without touching the workbook. */
+  probeImage(bytes: Uint8Array): ImageInfoResult;
+  /** Lists the anchored objects of the sheet's drawing, in document order. */
+  listDrawingObjects(sheet: number): ListResult<DrawingObject>;
+  /** Returns a copy of the media bytes of the picture `objectId`. */
+  getImage(sheet: number, objectId: number): ImageResult;
+  /** Inserts `bytes` as a picture; existing drawing content is kept. */
+  insertImage(sheet: number, bytes: Uint8Array, opts?: ImageInsertOptions): InsertImageResult;
+  /** Removes the picture `objectId` and its media once nothing else references it. */
+  removeImage(sheet: number, objectId: number): Status;
+
   passthroughCount(): NumberResult;
   passthroughAt(idx: number): PassthroughEntry;
 
@@ -2226,6 +2936,27 @@ export interface Workbook {
   setRowHidden(sheet: number, row: number, hidden: boolean): Status;
   /** Sets / replaces the row outline level at `row` (clamped to 0..255). */
   setRowOutline(sheet: number, row: number, level: number): Status;
+  /** Removes the height override at `row`, returning it to the sheet default. */
+  clearRowHeight(sheet: number, row: number): Status;
+
+  /** Reads the sheet's default column / row metrics. */
+  getSheetFormatDefaults(sheet: number): SheetFormatDefaultsResult;
+  /** Replaces the sheet's default column / row metrics. A `has*` flag left out defaults to whether its value was supplied. */
+  setSheetFormatDefaults(sheet: number, defaults: Partial<SheetFormatDefaults>): Status;
+
+  /** Rectangle covering the inclusive cell range, in points from the top-left of A1.
+   *  Hidden rows and columns contribute zero extent. */
+  getCellRectPt(sheet: number, range: MergeRange, mode: GeometryMode): CellRectResult;
+  /** Effective column width in points; zero when hidden. */
+  getColumnWidthPt(sheet: number, col: number, mode: GeometryMode): NumberResult;
+  /** Effective row height in points; zero when hidden. */
+  getRowHeightPt(sheet: number, row: number): NumberResult;
+  /** The character-unit to point conversion model for the workbook's Normal font. */
+  getWidthModel(sheet: number, mode: GeometryMode): WidthModelResult;
+  /** Converts a column width in characters to points. */
+  columnCharsToPt(sheet: number, mode: GeometryMode, chars: number): NumberResult;
+  /** Inverse of `columnCharsToPt`; a width at or below the padding maps to zero characters. */
+  columnPtToChars(sheet: number, mode: GeometryMode, pt: number): NumberResult;
 
   /** Returns `{ status, xfIndex }` for the cell at `(sheet, row, col)`. */
   getCellXfIndex(sheet: number, row: number, col: number): CellXfIndexResult;
@@ -2316,10 +3047,30 @@ export interface Workbook {
    *  `<cellStyleXfs>` index, which is what `setCellStyle` and
    *  `CellXf.xfId` reference. */
   addCellStyleXf(record: CellXf): AddStyleResult;
-  /** Adds or replaces the `<cellStyle>` entry named `name`. `builtinId` is
-   *  an OOXML ordinal `0..47`, or `0xFFFFFFFF` for a custom style; it is
-   *  required because the binding takes a fixed argument count. */
-  setCellStyle(name: string, xfId: number, builtinId: number): Status;
+  /** Adds or replaces the `<cellStyle>` entry named `record.name`. Absent
+   *  fields default to `xfId` 0, a custom style (`0xFFFFFFFF`), level 0 and
+   *  both flags false. */
+  setCellStyle(record: CellStyleRecord): Status;
+  /** Removes the `<cellStyle>` named `name`; cell formats that used it are
+   *  repointed at the Normal style. */
+  removeCellStyle(name: string): Status;
+
+  /** The 12 theme colours (`clrScheme` order) and the theme typefaces. The
+   *  default theme is reported when the part is absent or unparseable;
+   *  `source` tells the cases apart. */
+  getTheme(): ThemeResult;
+  /** Rewrites the 12 scheme colours (`clrScheme` order, alpha ignored). A
+   *  workbook without a theme part first gets a minimal one. */
+  setThemeColors(colors: number[]): Status;
+  /** Rewrites the theme's major and minor typefaces. */
+  setThemeFonts(fonts: ThemeFonts): Status;
+  /** Resolves a colour specification to ARGB against the theme and the
+   *  indexed palette; `context` decides what an automatic colour means. */
+  resolveColor(spec: ColorSpec, context: ColorContext): ResolvedColorResult;
+  /** The formatting a cell shows: the xf chosen from cell, row, column or
+   *  the default, with its colours resolved. Conditional formatting is not
+   *  applied. */
+  getEffectiveStyle(sheet: number, row: number, col: number): EffectiveStyleResult;
 
   /** Returns every external-link record carried by the workbook in
    *  `<externalReferences>` document order. Empty for fresh workbooks
@@ -2337,6 +3088,8 @@ export interface Workbook {
   clearMerges(sheet: number): Status;
   /** Returns every merge range on `sheet` as a JS array. */
   getMerges(sheet: number): ListResult<MergeRange>;
+  /** Returns the merge ranges on `sheet` that intersect `range`, in storage order. */
+  getMergesInRange(sheet: number, range: MergeRange): ListResult<MergeRange>;
 
   /** Returns the cell comment at `(sheet, row, col)`, or `null` when absent. */
   getComment(sheet: number, row: number, col: number): CommentEntry | null;
diff --git a/src/wasm/parts/bindings_register.cpp b/src/wasm/parts/bindings_register.cpp
index f5941b316..f08a8556b 100644
--- a/src/wasm/parts/bindings_register.cpp
+++ b/src/wasm/parts/bindings_register.cpp
@@ -219,6 +219,66 @@ EMSCRIPTEN_BINDINGS(formulon) {
       .function("getCellStyle", &JsWorkbook::getCellStyle)
       .function("getCellStyleXf", &JsWorkbook::getCellStyleXf)
       .function("getCellXf", &JsWorkbook::getCellXf)
+      .function("getCellsInRange", &JsWorkbook::getCellsInRange)
+      .function("getCellsInRange", emscripten::optional_override([](const JsWorkbook& self, uint32_t sheet,
+                                                                    emscripten::val range, emscripten::val cursor) {
+                  return self.getCellsInRange(sheet, range, cursor, emscripten::val::undefined());
+                }))
+      .function("getCellsInRange",
+                emscripten::optional_override([](const JsWorkbook& self, uint32_t sheet, emscripten::val range) {
+                  return self.getCellsInRange(sheet, range, emscripten::val::undefined(), emscripten::val::undefined());
+                }))
+      .function("getAutoFilter", &JsWorkbook::getAutoFilter)
+      .function("setAutoFilter", &JsWorkbook::setAutoFilter)
+      .function("removeAutoFilter", &JsWorkbook::removeAutoFilter)
+      .function("applyAutoFilter", &JsWorkbook::applyAutoFilter)
+      .function("clearAutoFilter", &JsWorkbook::clearAutoFilter)
+      .function("evaluateAutoFilter", &JsWorkbook::evaluateAutoFilter)
+      .function("getTableAutoFilter", &JsWorkbook::getTableAutoFilter)
+      .function("setTableAutoFilter", &JsWorkbook::setTableAutoFilter)
+      .function("removeTableAutoFilter", &JsWorkbook::removeTableAutoFilter)
+      .function("applyTableAutoFilter", &JsWorkbook::applyTableAutoFilter)
+      .function("clearTableAutoFilter", &JsWorkbook::clearTableAutoFilter)
+      .function("evaluateTableAutoFilter", &JsWorkbook::evaluateTableAutoFilter)
+      .function("validateValue", &JsWorkbook::validateValue)
+      .function("listInvalidCells", &JsWorkbook::listInvalidCells)
+      .function("listInvalidCells",
+                emscripten::optional_override([](const JsWorkbook& self, uint32_t sheet, emscripten::val cursor) {
+                  return self.listInvalidCells(sheet, cursor, emscripten::val::undefined());
+                }))
+      .function("listInvalidCells", emscripten::optional_override([](const JsWorkbook& self, uint32_t sheet) {
+                  return self.listInvalidCells(sheet, emscripten::val::undefined(), emscripten::val::undefined());
+                }))
+      .function("getThreadedComments", &JsWorkbook::getThreadedComments)
+      .function("addThreadedComment", &JsWorkbook::addThreadedComment)
+      .function("editThreadedComment", &JsWorkbook::editThreadedComment)
+      .function("setThreadResolved", &JsWorkbook::setThreadResolved)
+      .function("removeThreadedComment", &JsWorkbook::removeThreadedComment)
+      .function("getPersons", &JsWorkbook::getPersons)
+      .function("addPerson", &JsWorkbook::addPerson)
+      .function("removePerson", &JsWorkbook::removePerson)
+      .function("probeImage", &JsWorkbook::probeImage)
+      .function("listDrawingObjects", &JsWorkbook::listDrawingObjects)
+      .function("getImage", &JsWorkbook::getImage)
+      .function("insertImage", &JsWorkbook::insertImage)
+      .function("insertImage",
+                emscripten::optional_override([](JsWorkbook& self, uint32_t sheet, emscripten::val bytes) {
+                  return self.insertImage(sheet, bytes, emscripten::val::object());
+                }))
+      .function("removeImage", &JsWorkbook::removeImage)
+      .function("getCellRectPt", &JsWorkbook::getCellRectPt)
+      .function("getColumnWidthPt", &JsWorkbook::getColumnWidthPt)
+      .function("getDisplayText", &JsWorkbook::getDisplayText)
+      .function("getFormula", &JsWorkbook::getFormula)
+      .function("getFormulaR1C1", &JsWorkbook::getFormulaR1C1)
+      .function("getRowHeightPt", &JsWorkbook::getRowHeightPt)
+      .function("getSheetFormatDefaults", &JsWorkbook::getSheetFormatDefaults)
+      .function("getWidthModel", &JsWorkbook::getWidthModel)
+      .function("formatValue", &JsWorkbook::formatValue)
+      .function("clearRowHeight", &JsWorkbook::clearRowHeight)
+      .function("setSheetFormatDefaults", &JsWorkbook::setSheetFormatDefaults)
+      .function("columnCharsToPt", &JsWorkbook::columnCharsToPt)
+      .function("columnPtToChars", &JsWorkbook::columnPtToChars)
       .function("getCellXfIndex", &JsWorkbook::getCellXfIndex)
       .function("getCellPhonetic", &JsWorkbook::getCellPhonetic)
       .function("getCellPhoneticRuns", &JsWorkbook::getCellPhoneticRuns)
@@ -235,6 +295,7 @@ EMSCRIPTEN_BINDINGS(formulon) {
       .function("getIterative", &JsWorkbook::getIterative)
       .function("getLambdaText", &JsWorkbook::getLambdaText)
       .function("getMerges", &JsWorkbook::getMerges)
+      .function("getMergesInRange", &JsWorkbook::getMergesInRange)
       .function("getNumFmt", &JsWorkbook::getNumFmt)
       .function("getSheetColumns", &JsWorkbook::getSheetColumns)
       .function("getSheetAutoFilterXml", &JsWorkbook::getSheetAutoFilterXml)
@@ -349,6 +410,12 @@ EMSCRIPTEN_BINDINGS(formulon) {
       .function("setRangeXfIndex", &JsWorkbook::setRangeXfIndex)
       .function("clearSheetBreaks", &JsWorkbook::clearSheetBreaks)
       .function("setCellStyle", &JsWorkbook::setCellStyle)
+      .function("removeCellStyle", &JsWorkbook::removeCellStyle)
+      .function("getTheme", &JsWorkbook::getTheme)
+      .function("setThemeColors", &JsWorkbook::setThemeColors)
+      .function("setThemeFonts", &JsWorkbook::setThemeFonts)
+      .function("resolveColor", &JsWorkbook::resolveColor)
+      .function("getEffectiveStyle", &JsWorkbook::getEffectiveStyle)
       .function("setCellPhonetic", &JsWorkbook::setCellPhonetic)
       .function("setCellPhoneticRuns", &JsWorkbook::setCellPhoneticRuns)
       .function("setCellPhoneticProperties", &JsWorkbook::setCellPhoneticProperties)
diff --git a/src/wasm/parts/embind_common.cpp b/src/wasm/parts/embind_common.cpp
index 1b396206c..4e01bf01a 100644
--- a/src/wasm/parts/embind_common.cpp
+++ b/src/wasm/parts/embind_common.cpp
@@ -1,16 +1,20 @@
 //
 // Out-of-line implementation of the shared embind helpers declared in
 // `parts/embind_common.h`. The status builders capture the thread-local
-// diagnostic surface that follows every C-ABI call, and the translation
-// helpers project a `fm_*` POD into an embind-friendly mirror.
+// diagnostic surface that follows every C-ABI call, the translation
+// helpers project a `fm_*` POD into an embind-friendly mirror, and the
+// field readers pull caller-supplied JS records apart.
 
 #include "wasm/parts/embind_common.h"
 
 #include <emscripten/bind.h>
+#include <emscripten/em_js.h>
 #include <emscripten/val.h>
 
+#include <cmath>
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 #include <string>
 #include <vector>
 
@@ -20,6 +24,136 @@ namespace formulon {
 namespace wasm {
 namespace parts {
 
+namespace {
+
+// The operation codes are deliberately kept private to this translation
+// unit. Every operation that can invoke caller-controlled JavaScript runs in
+// this one try/catch boundary; no C++ `val` property/call path is allowed to
+// observe a user getter directly while exceptions are disabled.
+enum SafeReaderOperation : int32_t {
+  kSafeGet = 0,
+  kSafeHasOwn = 1,
+  kSafeIsArray = 2,
+  kSafeStringSnapshot = 3,
+  kSafeBytesSnapshot = 4,
+};
+
+// The error class the pre-js wrapper raises for a reader rejection.
+enum ArgumentErrorKind : int32_t {
+  kArgumentErrorType = 0,
+  kArgumentErrorRange = 1,
+  kArgumentErrorAccess = 2,
+};
+
+}  // namespace
+
+// `success` reports whether the operation itself completed. A completed
+// string/bytes snapshot may still return `undefined` for an unsupported
+// input; the C++ reader turns that into its normal type error. A thrown proxy,
+// getter, or typed-array hook reports success == 0 and returns an owned
+// `undefined` handle. The body is JavaScript source; keep formatting disabled
+// so clang-format cannot rewrite its operators.
+// FORMULON-ALLOW: this JavaScript try/catch is the required no-escape boundary
+// for caller-owned getters and typed-array operations in a -fno-exceptions WASM
+// build; a C++ try/catch cannot safely intercept those throws here.
+// clang-format off
+EM_JS(emscripten::EM_VAL, fm_wasm_safe_reader_operation,
+      (emscripten::EM_VAL owner_handle, emscripten::EM_VAL key_handle, int32_t operation, int32_t* success), {
+  try {
+    var owner = Emval.toValue(owner_handle);
+    var key = Emval.toValue(key_handle);
+    var result;
+    if (operation === 0) {
+      result = owner[key];
+    } else if (operation === 1) {
+      result = Object.prototype.hasOwnProperty.call(owner, key);
+    } else if (operation === 2) {
+      result = Array.isArray(owner);
+    } else if (operation === 3) {
+      if (typeof owner === 'string') {
+        result = owner;
+      } else if (owner instanceof ArrayBuffer) {
+        var bufferCopy = new Uint8Array(owner.byteLength);
+        bufferCopy.set(new Uint8Array(owner));
+        result = bufferCopy;
+      } else if (ArrayBuffer.isView(owner) && owner.BYTES_PER_ELEMENT === 1) {
+        var viewCopy = new Uint8Array(owner.byteLength);
+        viewCopy.set(new Uint8Array(owner.buffer, owner.byteOffset, owner.byteLength));
+        result = viewCopy;
+      } else {
+        result = undefined;
+      }
+    } else if (operation === 4) {
+      if (owner instanceof Uint8Array) {
+        var bytesCopy = new Uint8Array(owner.length);
+        bytesCopy.set(owner);
+        result = bytesCopy;
+      } else {
+        result = undefined;
+      }
+    } else {
+      result = undefined;
+    }
+    HEAP32[success >> 2] = 1;
+    return Emval.toHandle(result);
+  } catch (e) {
+    var errors = Module[Symbol.for('formulon.argumentErrors')];
+    if (errors) {
+      errors.thrown = { value: e };
+    }
+    HEAP32[success >> 2] = 0;
+    return Emval.toHandle(undefined);
+  }
+});
+// clang-format on
+
+EM_JS_DEPS(fm_wasm_safe_reader, "$Emval");
+
+// Hands a reader's first rejection to the pre-js method wrapper, which throws
+// it once the native method has returned: kind 0 is a TypeError, 1 a
+// RangeError, 2 rethrows the caller's getter exception. Outside a wrapped call
+// there is no wrapper to throw, so the envelope's status stays the report.
+// clang-format off
+EM_JS(void, fm_wasm_record_argument_error, (int32_t kind, const char* message), {
+  var errors = Module[Symbol.for('formulon.argumentErrors')];
+  if (!errors || errors.depth === 0 || errors.pending !== undefined) {
+    return;
+  }
+  var thrown = kind === 2 ? errors.thrown : undefined;
+  errors.thrown = undefined;
+  errors.pending = { kind: kind, message: UTF8ToString(message), thrown: thrown };
+});
+// clang-format on
+
+EM_JS_DEPS(fm_wasm_argument_error, "$UTF8ToString");
+
+// Copies a previously snapshotted plain Uint8Array into a C++ vector's
+// allocation. The source is produced by the trampoline above, and both the
+// length read and the typed-array copy are kept inside this second boundary so
+// a modified intrinsic cannot throw through a C++ frame.
+// FORMULON-ALLOW: this JavaScript try/catch is required to catch a hostile
+// typed-array operation while C++ exceptions are disabled for the WASM ABI.
+// clang-format off
+EM_JS(int32_t, fm_wasm_copy_safe_bytes,
+      (emscripten::EM_VAL source_handle, uintptr_t destination, uint32_t capacity, uint32_t* written), {
+  try {
+    var source = Emval.toValue(source_handle);
+    if (!(source instanceof Uint8Array) || source.length > capacity) {
+      HEAPU32[written >> 2] = 0;
+      return 0;
+    }
+    HEAPU8.set(source, destination);
+    HEAPU32[written >> 2] = source.length;
+    return 1;
+  } catch (e) {
+    HEAPU32[written >> 2] = 0;
+    return -1;
+  }
+});
+// clang-format on
+
+EM_JS_DEPS(fm_wasm_safe_bytes, "$Emval");
+
 JsStatus ok_status() {
   return JsStatus{true, 0, std::string(), std::string()};
 }
@@ -52,6 +186,406 @@ JsStatus status_from_rc(fm_status_t rc) {
   return rc == 0 ? ok_status() : error_status(rc);
 }
 
+JsNarrowNumericReader::JsNarrowNumericReader(const char* operation)
+    : operation_(operation != nullptr ? operation : "WASM binding") {}
+
+void JsNarrowNumericReader::reject_access(const char* key, const char* field) {
+  if (!message_.empty()) {
+    return;
+  }
+  const char* name = field != nullptr ? field : key;
+  message_ = operation_ + ": `" + (name != nullptr ? name : "<field>") + "` field access threw";
+  fm_wasm_record_argument_error(kArgumentErrorAccess, message_.c_str());
+}
+
+void JsNarrowNumericReader::reject(const char* key, const char* field, const char* range) {
+  if (!message_.empty()) {
+    return;
+  }
+  const char* name = field != nullptr ? field : key;
+  message_ = operation_ + ": `" + (name != nullptr ? name : "<field>") + "` must be a finite integer in " + range;
+  fm_wasm_record_argument_error(kArgumentErrorRange, message_.c_str());
+}
+
+void JsNarrowNumericReader::reject_type(const char* field, const char* expected) {
+  if (!message_.empty()) {
+    return;
+  }
+  message_ = operation_ + ": `" + (field != nullptr ? field : "<field>") + "` must be " +
+             (expected != nullptr ? expected : "the expected type");
+  fm_wasm_record_argument_error(kArgumentErrorType, message_.c_str());
+}
+
+emscripten::val JsNarrowNumericReader::safe_operation(const emscripten::val& owner, const emscripten::val& key,
+                                                      int32_t operation, bool* succeeded) {
+  int32_t success = 0;
+  const emscripten::EM_VAL handle =
+      fm_wasm_safe_reader_operation(owner.as_handle(), key.as_handle(), operation, &success);
+  if (succeeded != nullptr) {
+    *succeeded = success != 0;
+  }
+  return emscripten::val::take_ownership(handle);
+}
+
+emscripten::val JsNarrowNumericReader::safe_get(const emscripten::val& owner, const emscripten::val& key,
+                                                const char* field, bool* succeeded) {
+  bool completed = false;
+  emscripten::val result = safe_operation(owner, key, kSafeGet, &completed);
+  if (!completed) {
+    reject_access(nullptr, field);
+  }
+  if (succeeded != nullptr) {
+    *succeeded = completed;
+  }
+  return result;
+}
+
+bool JsNarrowNumericReader::read_integer(const emscripten::val& value, const char* key, const char* field, double lower,
+                                         double upper, const char* range, double* number) {
+  if (value.isUndefined() || value.isNull()) {
+    return false;
+  }
+  // Check the JavaScript primitive before asking embind for a C++ value.
+  // In particular, Symbol and BigInt must never reach val::as on this path.
+  if (!value.isNumber()) {
+    reject_type(field != nullptr ? field : key, "a Number");
+    return false;
+  }
+  const double candidate = value.as<double>();
+  if (!std::isfinite(candidate) || std::floor(candidate) != candidate || candidate < lower || candidate > upper) {
+    reject(key, field, range);
+    return false;
+  }
+  *number = candidate;
+  return true;
+}
+
+bool JsNarrowNumericReader::read_number(const emscripten::val& value, const char* key, const char* field,
+                                        double* number) {
+  if (value.isUndefined() || value.isNull()) {
+    return false;
+  }
+  if (!value.isNumber()) {
+    reject_type(field != nullptr ? field : key, "a Number");
+    return false;
+  }
+  *number = value.as<double>();
+  return true;
+}
+
+uint32_t JsNarrowNumericReader::u32(const emscripten::val& owner, const char* key, uint32_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, key, field, 0.0, 4294967295.0, "[0, 4294967295]", &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0U;
+  }
+  return static_cast<uint32_t>(number);
+}
+
+int32_t JsNarrowNumericReader::i32(const emscripten::val& owner, const char* key, int32_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, key, field, -2147483648.0, 2147483647.0, "[-2147483648, 2147483647]", &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0;
+  }
+  return static_cast<int32_t>(number);
+}
+
+uint8_t JsNarrowNumericReader::u8(const emscripten::val& owner, const char* key, uint8_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, key, field, 0.0, 255.0, "[0, 255]", &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0U;
+  }
+  return static_cast<uint8_t>(number);
+}
+
+uint16_t JsNarrowNumericReader::u16(const emscripten::val& owner, const char* key, uint16_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, key, field, 0.0, 65535.0, "[0, 65535]", &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0U;
+  }
+  return static_cast<uint16_t>(number);
+}
+
+uint8_t JsNarrowNumericReader::u8_value(const emscripten::val& value, uint8_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, field, field, 0.0, 255.0, "[0, 255]", &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0U;
+  }
+  return static_cast<uint8_t>(number);
+}
+
+uint16_t JsNarrowNumericReader::u16_value(const emscripten::val& value, uint16_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, field, field, 0.0, 65535.0, "[0, 65535]", &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0U;
+  }
+  return static_cast<uint16_t>(number);
+}
+
+uint32_t JsNarrowNumericReader::u32_value(const emscripten::val& value, uint32_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, field, field, 0.0, 4294967295.0, "[0, 4294967295]", &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0U;
+  }
+  return static_cast<uint32_t>(number);
+}
+
+int32_t JsNarrowNumericReader::i32_value(const emscripten::val& value, int32_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, field, field, -2147483648.0, 2147483647.0, "[-2147483648, 2147483647]", &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0;
+  }
+  return static_cast<int32_t>(number);
+}
+
+int64_t JsNarrowNumericReader::i64(const emscripten::val& owner, const char* key, int64_t dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_integer(value, key, field, -0x1p63, 0x1p63, "[-2^63, 2^63)", &number)) {
+    return dflt;
+  }
+  if (number >= 0x1p63) {
+    reject(key, field, "[-2^63, 2^63)");
+    return dflt;
+  }
+  // `-2^63` is exactly representable as a JS Number, but converting that
+  // boundary through a floating-point cast is implementation-defined on
+  // some targets. Spell out the one value that needs the full signed range.
+  if (number == -0x1p63) {
+    return std::numeric_limits<int64_t>::min();
+  }
+  return static_cast<int64_t>(number);
+}
+
+double JsNarrowNumericReader::number(const emscripten::val& owner, const char* key, double dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return dflt;
+  }
+  return number_value(value, dflt, field != nullptr ? field : key);
+}
+
+double JsNarrowNumericReader::number_value(const emscripten::val& value, double dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  double number = 0.0;
+  if (!read_number(value, field, field, &number)) {
+    return (value.isUndefined() || value.isNull()) ? dflt : 0.0;
+  }
+  return number;
+}
+
+bool JsNarrowNumericReader::boolean(const emscripten::val& owner, const char* key, bool dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return dflt;
+  }
+  return boolean_value(value, dflt, field != nullptr ? field : key);
+}
+
+bool JsNarrowNumericReader::boolean_value(const emscripten::val& value, bool dflt, const char* field) {
+  if (!ok()) {
+    return dflt;
+  }
+  (void)field;
+  if (value.isUndefined() || value.isNull()) {
+    return dflt;
+  }
+  // JavaScript `!` is a primitive truthiness operation and never performs
+  // user-defined valueOf/toString conversion, including for Symbol values.
+  return !value.operator!();
+}
+
+std::string JsNarrowNumericReader::string(const emscripten::val& owner, const char* key, const char* field) {
+  if (!ok()) {
+    return std::string();
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return std::string();
+  }
+  return string_value(value, field != nullptr ? field : key);
+}
+
+std::string JsNarrowNumericReader::string_value(const emscripten::val& value, const char* field) {
+  if (!ok() || value.isUndefined() || value.isNull()) {
+    return std::string();
+  }
+  bool completed = false;
+  const emscripten::val safe_value =
+      safe_operation(value, emscripten::val::undefined(), kSafeStringSnapshot, &completed);
+  if (!completed) {
+    reject_access(nullptr, field);
+    return std::string();
+  }
+  if (safe_value.isUndefined() || safe_value.isNull()) {
+    reject_type(field, "a string or one-byte buffer");
+    return std::string();
+  }
+  return safe_value.as<std::string>();
+}
+
+const char* JsNarrowNumericReader::optional_string(const emscripten::val& owner, const char* key, std::string& storage,
+                                                   const char* field) {
+  if (!ok() || owner.isUndefined() || owner.isNull()) {
+    return nullptr;
+  }
+  bool completed = false;
+  const emscripten::val value = safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+  if (!completed) {
+    return nullptr;
+  }
+  return optional_string_value(value, storage, field != nullptr ? field : key);
+}
+
+const char* JsNarrowNumericReader::optional_string_value(const emscripten::val& value, std::string& storage,
+                                                         const char* field) {
+  if (!ok() || value.isUndefined() || value.isNull()) {
+    return nullptr;
+  }
+  storage = string_value(value, field);
+  return ok() ? storage.c_str() : nullptr;
+}
+
+emscripten::val JsNarrowNumericReader::value(const emscripten::val& owner, const char* key, const char* field) {
+  if (!ok()) {
+    return emscripten::val::undefined();
+  }
+  if (owner.isUndefined() || owner.isNull()) {
+    reject_type(field != nullptr ? field : key, "an object");
+    return emscripten::val::undefined();
+  }
+  const emscripten::val type = owner.typeOf();
+  const std::string type_name = type.as<std::string>();
+  if (type_name != "object" && type_name != "function") {
+    reject_type(field != nullptr ? field : key, "an object");
+    return emscripten::val::undefined();
+  }
+  bool completed = false;
+  return safe_get(owner, emscripten::val(key), field != nullptr ? field : key, &completed);
+}
+
+bool JsNarrowNumericReader::has_own(const emscripten::val& owner, const char* key, const char* field) {
+  if (!ok() || owner.isUndefined() || owner.isNull()) {
+    return false;
+  }
+  bool completed = false;
+  const emscripten::val result = safe_operation(owner, emscripten::val(key), kSafeHasOwn, &completed);
+  if (!completed) {
+    reject_access(key, field);
+    return false;
+  }
+  return result.isTrue();
+}
+
+bool JsNarrowNumericReader::is_array(const emscripten::val& value, const char* field) {
+  if (!ok() || value.isUndefined() || value.isNull()) {
+    return false;
+  }
+  bool completed = false;
+  const emscripten::val result = safe_operation(value, emscripten::val::undefined(), kSafeIsArray, &completed);
+  if (!completed) {
+    reject_access(nullptr, field);
+    return false;
+  }
+  return result.isTrue();
+}
+
+uint32_t JsNarrowNumericReader::length(const emscripten::val& array, const char* field) {
+  if (!ok()) {
+    return 0U;
+  }
+  bool completed = false;
+  const emscripten::val length_value = safe_get(array, emscripten::val("length"), field, &completed);
+  if (!completed) {
+    return 0U;
+  }
+  return u32_value(length_value, 0U, field != nullptr ? field : "length");
+}
+
+emscripten::val JsNarrowNumericReader::array_element(const emscripten::val& array, uint32_t index, const char* field) {
+  if (!ok()) {
+    return emscripten::val::undefined();
+  }
+  if (!is_array(array, field)) {
+    if (!ok()) {
+      return emscripten::val::undefined();
+    }
+    reject_type(field, "an array");
+    return emscripten::val::undefined();
+  }
+  bool completed = false;
+  return safe_get(array, emscripten::val(index), field, &completed);
+}
+
+bool JsNarrowNumericReader::ok() const {
+  return message_.empty();
+}
+
+const std::string& JsNarrowNumericReader::message() const {
+  return message_;
+}
+
 JsNumberResult number_result(fm_status_t rc, double value) {
   JsNumberResult out;
   out.status = status_from_rc(rc);
@@ -153,26 +687,47 @@ emscripten::val pivot_cell_to_val(const fm_pivot_cell_t& cell) {
   item.set("value", translate_value(cell.value));
   item.set("kind", static_cast<int32_t>(cell.kind));
   item.set("depth", cell.depth);
-  item.set("fieldName", cell.field_name != nullptr ? std::string(cell.field_name) : std::string());
-  item.set("numberFormat", cell.number_format != nullptr ? std::string(cell.number_format) : std::string());
+  js_set_cstr(item, "fieldName", cell.field_name);
+  js_set_cstr(item, "numberFormat", cell.number_format);
   return item;
 }
 
-std::vector<uint8_t> val_to_bytes(const emscripten::val& v) {
-  const emscripten::val uint8_array = emscripten::val::global("Uint8Array");
-  if (v.isNull() || v.isUndefined() || !v.instanceof (uint8_array)) {
-    return {};
+JsBytesReadResult val_to_bytes_checked(const emscripten::val& v) {
+  JsBytesReadResult result;
+  int32_t completed = 0;
+  const emscripten::val snapshot = emscripten::val::take_ownership(fm_wasm_safe_reader_operation(
+      v.as_handle(), emscripten::val::undefined().as_handle(), kSafeBytesSnapshot, &completed));
+  if (completed == 0) {
+    result.ok = false;
+    result.message = "bytes: field access threw";
+    return result;
   }
-  const std::size_t len = v["length"].as<std::size_t>();
-  std::vector<uint8_t> out(len);
-  if (len == 0) {
-    return out;
+  if (snapshot.isUndefined() || snapshot.isNull()) {
+    result.ok = false;
+    result.message = "bytes must be a Uint8Array";
+    return result;
   }
-  // `typed_memory_view` gives JS a view of the vector's WASM allocation;
-  // Uint8Array#set copies the whole input in one JS operation. This avoids
-  // one embind boundary crossing per byte for workbook-sized inputs.
-  emscripten::val(emscripten::typed_memory_view(len, out.data())).call<void>("set", v);
-  return out;
+
+  JsNarrowNumericReader reader("bytes");
+  const uint32_t length = reader.length(snapshot, "bytes.length");
+  if (!reader.ok()) {
+    result.ok = false;
+    result.message = reader.message();
+    return result;
+  }
+  result.bytes.resize(length);
+  if (length == 0U) {
+    return result;
+  }
+  uint32_t written = 0;
+  const int32_t copied =
+      fm_wasm_copy_safe_bytes(snapshot.as_handle(), reinterpret_cast<uintptr_t>(result.bytes.data()), length, &written);
+  if (copied != 1 || written != length) {
+    result.ok = false;
+    result.bytes.clear();
+    result.message = copied < 0 ? "bytes: field access threw" : "bytes must be a Uint8Array";
+  }
+  return result;
 }
 
 emscripten::val bytes_to_val(const uint8_t* data, std::size_t len) {
@@ -185,6 +740,115 @@ emscripten::val bytes_to_val(const uint8_t* data, std::size_t len) {
   return u8;
 }
 
+fm_merge_range js_pull_range(const emscripten::val& v, JsNarrowNumericReader* reader) {
+  if (reader == nullptr) {
+    return fm_merge_range{};
+  }
+  fm_merge_range m{};
+  if (v.isUndefined() || v.isNull()) {
+    return m;
+  }
+  m.first_row = reader->u32_value(reader->value(v, "firstRow", "range.firstRow"), 0U, "range.firstRow");
+  m.last_row = reader->u32_value(reader->value(v, "lastRow", "range.lastRow"), 0U, "range.lastRow");
+  m.first_col = reader->u32_value(reader->value(v, "firstCol", "range.firstCol"), 0U, "range.firstCol");
+  m.last_col = reader->u32_value(reader->value(v, "lastCol", "range.lastCol"), 0U, "range.lastCol");
+  return m;
+}
+
+std::vector<fm_merge_range> js_pull_ranges(const emscripten::val& v, const char* key, JsNarrowNumericReader* reader) {
+  if (reader == nullptr) {
+    return {};
+  }
+  std::vector<fm_merge_range> out;
+  const emscripten::val array = reader->value(v, key, key);
+  if (!reader->ok() || array.isUndefined() || array.isNull()) {
+    return out;
+  }
+  if (!reader->is_array(array, key)) {
+    return out;
+  }
+  const uint32_t n = reader->length(array, key);
+  if (!reader->ok()) {
+    return out;
+  }
+  out.reserve(n);
+  for (uint32_t i = 0; i < n; ++i) {
+    const emscripten::val range = reader->array_element(array, i, "sqref[]");
+    if (!reader->ok()) {
+      return out;
+    }
+    if (range.isUndefined() || range.isNull()) {
+      continue;
+    }
+    fm_merge_range m{};
+    m.first_row = reader->u32(range, "firstRow", 0U, "sqref.firstRow");
+    m.last_row = reader->u32(range, "lastRow", 0U, "sqref.lastRow");
+    m.first_col = reader->u32(range, "firstCol", 0U, "sqref.firstCol");
+    m.last_col = reader->u32(range, "lastCol", 0U, "sqref.lastCol");
+    out.push_back(m);
+  }
+  return out;
+}
+
+fm_color_spec js_pull_color_spec(const emscripten::val& v, const char* key, JsNarrowNumericReader* reader) {
+  fm_color_spec spec{};
+  if (reader == nullptr) {
+    return spec;
+  }
+  const emscripten::val f = reader->value(v, key, key);
+  if (!reader->ok()) {
+    return spec;
+  }
+  if (f.isUndefined() || f.isNull()) {
+    return spec;
+  }
+  spec.kind = reader->u8(f, "kind", 0, "color.kind");
+  spec.rgb = reader->u32(f, "rgb", 0U, "color.rgb");
+  spec.theme = reader->u32(f, "theme", 0U, "color.theme");
+  spec.tint = reader->number(f, "tint", 0.0, "color.tint");
+  spec.indexed = reader->u32(f, "indexed", 0U, "color.indexed");
+  return spec;
+}
+
+fm_border_side js_pull_border_side(const emscripten::val& v, JsNarrowNumericReader* reader) {
+  fm_border_side s{};
+  if (reader == nullptr || v.isUndefined() || v.isNull()) {
+    return s;
+  }
+  s.style = reader->u8(v, "style", 0, "border.style");
+  s.color_argb = reader->u32(v, "colorArgb", 0U, "border.colorArgb");
+  s.color = js_pull_color_spec(v, "color", reader);
+  return s;
+}
+
+void js_set_cstr(emscripten::val& o, const char* key, const char* s) {
+  o.set(key, s != nullptr ? std::string(s) : std::string());
+}
+
+void js_set_cstr_fields(emscripten::val& o, const JsStrField* fields, std::size_t n) {
+  for (std::size_t i = 0; i < n; ++i) {
+    js_set_cstr(o, fields[i].key, fields[i].value);
+  }
+}
+
+emscripten::val js_color_spec(const fm_color_spec& spec) {
+  emscripten::val o = emscripten::val::object();
+  o.set("kind", static_cast<uint32_t>(spec.kind));
+  o.set("rgb", spec.rgb);
+  o.set("theme", spec.theme);
+  o.set("tint", spec.tint);
+  o.set("indexed", spec.indexed);
+  return o;
+}
+
+emscripten::val js_border_side(const fm_border_side& s) {
+  emscripten::val o = emscripten::val::object();
+  o.set("style", static_cast<uint32_t>(s.style));
+  o.set("colorArgb", s.color_argb);
+  o.set("color", js_color_spec(s.color));
+  return o;
+}
+
 }  // namespace parts
 }  // namespace wasm
 }  // namespace formulon
diff --git a/src/wasm/parts/embind_common.h b/src/wasm/parts/embind_common.h
index fafd7b449..e47cac6ad 100644
--- a/src/wasm/parts/embind_common.h
+++ b/src/wasm/parts/embind_common.h
@@ -10,18 +10,13 @@
 //   * Value-object structs (`JsStatus`, `JsValue`, `JsCellResult`, ...)
 //     that the JS-facing API surface returns.
 //   * Translation helpers (`translate_value`, `translate_cf_*`,
-//     `merge_range_to_val`, `bytes_to_val`, `val_to_bytes`).
+//     `merge_range_to_val`, `bytes_to_val`, `val_to_bytes_checked`).
 //   * Status builders (`ok_status`, `error_status`, `status_from_rc`).
-//   * Small `js_pull_*` field-extractor helpers used by the value-object
-//     adders.
+//   * checked nested-field readers and `js_set_*` record builders.
 //
-// The translation helpers are deliberately not inline: they sit on the
-// cold side of the binding surface (one call per failure / read), and
-// keeping a single emission of them in `embind_common.cpp` lets the
-// linker dedupe across the ~9 part TUs. The `js_pull_*` helpers are
-// inline because they fold into the call sites that pull
-// `emscripten::val` fields apart, and inlining yields a measurably
-// smaller `.wasm.br` under `-O3 + wasm-opt -Oz`.
+// The helpers are deliberately out of line: they sit on the cold side of
+// the binding surface, and a single emission in `embind_common.cpp` lets
+// the ~9 part TUs share one copy of each embind bridge sequence.
 
 #ifndef FORMULON_WASM_PARTS_EMBIND_COMMON_H_
 #define FORMULON_WASM_PARTS_EMBIND_COMMON_H_
@@ -287,6 +282,60 @@ JsStatus binding_error_status(int32_t code, const char* message);
 /// Bridges a `fm_status_t` into a `JsStatus` envelope.
 JsStatus status_from_rc(fm_status_t rc);
 
+/// Per-call validator for fields in nested binding records. Binding parsers
+/// share this reader to reject lossy conversions before the C ABI mutates a
+/// workbook. Every access
+/// to caller-owned JavaScript values goes through a JS try/catch trampoline so
+/// proxy/getter exceptions become the reader's first error under
+/// `-fno-exceptions`.
+/// Missing, `null`, and `undefined` retain the supplied default.
+class JsNarrowNumericReader {
+ public:
+  explicit JsNarrowNumericReader(const char* operation);
+
+  uint32_t u32(const emscripten::val& owner, const char* key, uint32_t dflt, const char* field = nullptr);
+  int32_t i32(const emscripten::val& owner, const char* key, int32_t dflt, const char* field = nullptr);
+  uint8_t u8(const emscripten::val& owner, const char* key, uint8_t dflt, const char* field = nullptr);
+  uint16_t u16(const emscripten::val& owner, const char* key, uint16_t dflt, const char* field = nullptr);
+  uint8_t u8_value(const emscripten::val& value, uint8_t dflt, const char* field);
+  uint16_t u16_value(const emscripten::val& value, uint16_t dflt, const char* field);
+  uint32_t u32_value(const emscripten::val& value, uint32_t dflt, const char* field);
+  int32_t i32_value(const emscripten::val& value, int32_t dflt, const char* field);
+  int64_t i64(const emscripten::val& owner, const char* key, int64_t dflt, const char* field = nullptr);
+  double number(const emscripten::val& owner, const char* key, double dflt, const char* field = nullptr);
+  double number_value(const emscripten::val& value, double dflt, const char* field);
+  bool boolean(const emscripten::val& owner, const char* key, bool dflt, const char* field = nullptr);
+  bool boolean_value(const emscripten::val& value, bool dflt, const char* field);
+  std::string string(const emscripten::val& owner, const char* key, const char* field = nullptr);
+  std::string string_value(const emscripten::val& value, const char* field);
+  const char* optional_string(const emscripten::val& owner, const char* key, std::string& storage,
+                              const char* field = nullptr);
+  const char* optional_string_value(const emscripten::val& value, std::string& storage, const char* field);
+  emscripten::val value(const emscripten::val& owner, const char* key, const char* field = nullptr);
+  bool has_own(const emscripten::val& owner, const char* key, const char* field = nullptr);
+  bool is_array(const emscripten::val& value, const char* field = nullptr);
+  uint32_t length(const emscripten::val& array, const char* field = nullptr);
+  emscripten::val array_element(const emscripten::val& array, uint32_t index, const char* field = nullptr);
+
+  bool ok() const;
+  const std::string& message() const;
+
+ private:
+  bool read_integer(const emscripten::val& value, const char* key, const char* field, double lower, double upper,
+                    const char* range, double* number);
+  bool read_number(const emscripten::val& value, const char* key, const char* field, double* number);
+  emscripten::val safe_operation(const emscripten::val& owner, const emscripten::val& key, int32_t operation,
+                                 bool* succeeded);
+  emscripten::val safe_get(const emscripten::val& owner, const emscripten::val& key, const char* field,
+                           bool* succeeded);
+  void reject_access(const char* key, const char* field);
+  void reject(const char* key, const char* field, const char* range);
+  void reject_type(const char* field, const char* expected);
+
+  std::string operation_;
+  std::string message_;
+};
+
 /// Builds a `JsNumberResult` from `rc`, carrying `value` only on success.
 JsNumberResult number_result(fm_status_t rc, double value);
 
@@ -353,131 +402,79 @@ emscripten::val empty_pivot_layout_result(JsStatus status);
 /// inclusion in the pivotLayout `cells` array.
 emscripten::val pivot_cell_to_val(const fm_pivot_cell_t& cell);
 
-/// Copies the contents of a JS Uint8Array (passed via `emscripten::val`)
-/// into a `std::vector<uint8_t>`. Returns an empty vector when the
-/// argument is not a typed array.
-std::vector<uint8_t> val_to_bytes(const emscripten::val& v);
+/// Result of a guarded byte-array read. `ok == false` means the input was not
+/// the accepted Uint8Array shape or a JS proxy/typed-array operation threw;
+/// `message` is suitable for a binding-level invalid-argument envelope.
+struct JsBytesReadResult {
+  bool ok = true;
+  std::vector<uint8_t> bytes;
+  std::string message;
+};
+
+/// Reads a caller-supplied Uint8Array through the JS try/catch boundary. The
+/// result distinguishes an invalid input from a valid empty array so factory
+/// callers can preserve their existing invalid-workbook contract.
+JsBytesReadResult val_to_bytes_checked(const emscripten::val& v);
 
 /// Materialises a fresh JS `Uint8Array` from a contiguous byte range.
 /// Element-by-element copy via `set(i, val)` for layout independence.
 emscripten::val bytes_to_val(const uint8_t* data, std::size_t len);
 
-// ---- JS field-extraction helpers ---------------------------------------
+// ---- JS field readers and record builders -----------------------------
 //
-// These replace the repetitive
-// `record["x"].isUndefined() ? dflt : record["x"].as<T>()` pattern that
-// previously appeared inside `addFont` / `addFill` / `addBorder` /
-// `addXf` / `addValidation`. Centralising them lets the compiler emit
-// one copy of the embind glue (`val::operator[]`, `val::isUndefined`,
-// `val::as<T>`) per field type instead of per call site, which is a
-// measurable WASM size win because every embind operation pulls in
-// non-trivial JS-bridge stubs.
+// Every read of a caller-supplied `emscripten::val` record goes through
+// these helpers rather than an inline `v[key].isUndefined() ? ... :
+// v[key].as<T>()` chain. Each embind operation expands to a JS-bridge
+// stub, so one out-of-line copy per field type is markedly smaller than
+// the same glue repeated at every call site.
 //
-// They are deliberately `inline`: empirically `-Oz` keeps the inlined
-// forms smaller after `wasm-opt --converge` than the call-shaped forms.
-
-/// Returns the `uint32_t` value of `v[key]`, or `dflt` when the field
-/// is missing / undefined / null.
-inline uint32_t js_pull_u32(const emscripten::val& v, const char* key, uint32_t dflt) {
-  emscripten::val f = v[key];
-  if (f.isUndefined() || f.isNull()) {
-    return dflt;
-  }
-  return f.as<uint32_t>();
-}
+// "Missing" means `undefined` or `null` throughout. Required fields keep
+// reading through `val::as<T>` directly so a missing one converts exactly
+// as before.
 
-/// Returns the low-byte `uint8_t` value of `v[key]`, or `dflt` when
-/// missing.
-inline uint8_t js_pull_u8(const emscripten::val& v, const char* key, uint8_t dflt) {
-  return static_cast<uint8_t>(js_pull_u32(v, key, dflt) & 0xFFU);
-}
+/// Reads a range record with the explicit numeric reader. Missing / nullish
+/// fields retain the all-zero defaults.
+fm_merge_range js_pull_range(const emscripten::val& v, JsNarrowNumericReader* reader);
 
-/// Returns the `uint16_t` value of `v[key]`, or `dflt` when missing.
-inline uint16_t js_pull_u16(const emscripten::val& v, const char* key, uint16_t dflt) {
-  return static_cast<uint16_t>(js_pull_u32(v, key, dflt) & 0xFFFFU);
-}
-
-/// Returns the `double` value of `v[key]`, or `dflt` when missing.
-inline double js_pull_double(const emscripten::val& v, const char* key, double dflt) {
-  emscripten::val f = v[key];
-  if (f.isUndefined() || f.isNull()) {
-    return dflt;
-  }
-  return f.as<double>();
-}
-
-/// Returns the `bool` value of `v[key]`, or `dflt` when missing.
-inline bool js_pull_bool(const emscripten::val& v, const char* key, bool dflt) {
-  emscripten::val f = v[key];
-  if (f.isUndefined() || f.isNull()) {
-    return dflt;
-  }
-  return f.as<bool>();
-}
-
-/// Returns the string value of `v[key]`, or an empty string when
-/// missing.
-inline std::string js_pull_string(const emscripten::val& v, const char* key) {
-  emscripten::val f = v[key];
-  if (f.isUndefined() || f.isNull()) {
-    return std::string();
-  }
-  return f.as<std::string>();
-}
+/// Reads a range list with the explicit numeric reader. Other WASM families
+/// must use the same per-call reader before invoking a C mutator.
+std::vector<fm_merge_range> js_pull_ranges(const emscripten::val& v, const char* key, JsNarrowNumericReader* reader);
 
 /// Pulls the `{kind, rgb, theme, tint, indexed}` colour specification out
 /// of `v[key]`. An absent object leaves `kind` at `kFmColorNone`, which
 /// makes the writer emit the sibling `*Argb` as literal `rgb`. A supplied
 /// selector is authoritative; the binding does not resolve theme/indexed /
 /// auto colours.
-inline fm_color_spec js_pull_color_spec(const emscripten::val& v, const char* key) {
-  fm_color_spec spec{};
-  emscripten::val f = v[key];
-  if (f.isUndefined() || f.isNull()) {
-    return spec;
-  }
-  spec.kind = js_pull_u8(f, "kind", 0);
-  spec.rgb = js_pull_u32(f, "rgb", 0U);
-  spec.theme = js_pull_u32(f, "theme", 0U);
-  spec.tint = js_pull_double(f, "tint", 0.0);
-  spec.indexed = js_pull_u32(f, "indexed", 0U);
-  return spec;
+fm_color_spec js_pull_color_spec(const emscripten::val& v, const char* key, JsNarrowNumericReader* reader);
+
+/// Pulls a `{style, colorArgb, color}` border-side record out of `v`,
+/// defaulting every absent field to zero.
+fm_border_side js_pull_border_side(const emscripten::val& v, JsNarrowNumericReader* reader);
+
+/// One string field of a record built by `js_set_cstr_fields`.
+struct JsStrField {
+  const char* key;
+  const char* value;  ///< NULL is emitted as the empty string.
+};
+
+/// Sets `o[key]` to `s`, or to the empty string when `s` is NULL.
+void js_set_cstr(emscripten::val& o, const char* key, const char* s);
+
+/// Sets every field of `fields` on `o` as `js_set_cstr` would.
+void js_set_cstr_fields(emscripten::val& o, const JsStrField* fields, std::size_t n);
+
+template <std::size_t N>
+inline void js_set_cstr_fields(emscripten::val& o, const JsStrField (&fields)[N]) {
+  js_set_cstr_fields(o, fields, N);
 }
 
 /// Builds the JS mirror of a colour specification. Reads emit it
 /// unconditionally so a get / edit / add cycle passes the theme or
 /// indexed colour straight back and keeps hitting style-table dedup.
-inline emscripten::val js_color_spec(const fm_color_spec& spec) {
-  emscripten::val o = emscripten::val::object();
-  o.set("kind", static_cast<uint32_t>(spec.kind));
-  o.set("rgb", spec.rgb);
-  o.set("theme", spec.theme);
-  o.set("tint", spec.tint);
-  o.set("indexed", spec.indexed);
-  return o;
-}
-
-/// Pulls a `{style, colorArgb, color}` border-side record out of `v`,
-/// defaulting every absent field to zero.
-inline fm_border_side js_pull_border_side(const emscripten::val& v) {
-  fm_border_side s{};
-  if (v.isUndefined() || v.isNull()) {
-    return s;
-  }
-  s.style = js_pull_u8(v, "style", 0);
-  s.color_argb = js_pull_u32(v, "colorArgb", 0U);
-  s.color = js_pull_color_spec(v, "color");
-  return s;
-}
+emscripten::val js_color_spec(const fm_color_spec& spec);
 
 /// Builds the JS mirror of a border side.
-inline emscripten::val js_border_side(const fm_border_side& s) {
-  emscripten::val o = emscripten::val::object();
-  o.set("style", static_cast<uint32_t>(s.style));
-  o.set("colorArgb", s.color_argb);
-  o.set("color", js_color_spec(s.color));
-  return o;
-}
+emscripten::val js_border_side(const fm_border_side& s);
 
 }  // namespace parts
 }  // namespace wasm
diff --git a/src/wasm/parts/workbook.h b/src/wasm/parts/workbook.h
index 25d411bcb..8fc2bc383 100644
--- a/src/wasm/parts/workbook.h
+++ b/src/wasm/parts/workbook.h
@@ -97,6 +97,22 @@ class JsWorkbook {
   JsStatus setBlank(uint32_t sheet, uint32_t row, uint32_t col);
   JsStatus setFormula(uint32_t sheet, uint32_t row, uint32_t col, const std::string& formula);
 
+  /// `{ status, formula }`: the stored A1 formula, or `null` for a cell that
+  /// holds none.
+  emscripten::val getFormula(uint32_t sheet, uint32_t row, uint32_t col) const;
+  /// R1C1 counterpart of `getFormula`, relative to the cell, without `=`.
+  emscripten::val getFormulaR1C1(uint32_t sheet, uint32_t row, uint32_t col) const;
+  /// One page of the populated cells inside `range`:
+  /// `{ status, cells: [{ row, col, formula, value }], nextCursor }`.
+  /// `cursor` / `limit` may be omitted or `null`; `nextCursor` is `null`
+  /// once the range is exhausted.
+  emscripten::val getCellsInRange(uint32_t sheet, emscripten::val range, emscripten::val cursor,
+                                  emscripten::val limit) const;
+  /// `{ status, text, displayStatus }`: the text Excel displays for a cell.
+  emscripten::val getDisplayText(uint32_t sheet, uint32_t row, uint32_t col) const;
+  /// Renders a `Value` under a stored-form number format code.
+  emscripten::val formatValue(emscripten::val value, const std::string& formatCode) const;
+
   JsCellResult getValue(uint32_t sheet, uint32_t row, uint32_t col) const;
   emscripten::val getCellPhonetic(uint32_t sheet, uint32_t row, uint32_t col) const;
   /// Reads a cell's furigana as `{ status, runs: [{ sb, eb, text }] }`,
@@ -245,7 +261,7 @@ class JsWorkbook {
 
   JsSheetViewResult getSheetView(uint32_t sheet) const;
   JsSheetProtectionResult getSheetProtection(uint32_t sheet) const;
-  JsStatus setSheetProtection(uint32_t sheet, JsSheetProtection in);
+  JsStatus setSheetProtection(uint32_t sheet, emscripten::val in);
   JsStatus setSheetZoom(uint32_t sheet, uint32_t zoomScale);
   JsStatus setSheetFreeze(uint32_t sheet, uint32_t freezeRows, uint32_t freezeCols);
   JsStatus setSheetTabHidden(uint32_t sheet, bool hidden);
@@ -270,6 +286,23 @@ class JsWorkbook {
   JsStatus setRowHeight(uint32_t sheet, uint32_t row, double height);
   JsStatus setRowHidden(uint32_t sheet, uint32_t row, bool hidden);
   JsStatus setRowOutline(uint32_t sheet, uint32_t row, uint32_t level);
+  /// Drops the height override at `row`, returning it to the sheet default.
+  JsStatus clearRowHeight(uint32_t sheet, uint32_t row);
+
+  /// Sheet default column / row metrics (`<sheetFormatPr>`).
+  emscripten::val getSheetFormatDefaults(uint32_t sheet) const;
+  JsStatus setSheetFormatDefaults(uint32_t sheet, emscripten::val defaults);
+
+  // ---- Point geometry (`mode`: 0 = display, 1 = print) --------------------
+
+  /// `{ status, x, y, width, height }` of an inclusive cell range, in points
+  /// from the top-left of A1.
+  emscripten::val getCellRectPt(uint32_t sheet, emscripten::val range, int32_t mode) const;
+  JsNumberResult getColumnWidthPt(uint32_t sheet, uint32_t col, int32_t mode) const;
+  JsNumberResult getRowHeightPt(uint32_t sheet, uint32_t row) const;
+  emscripten::val getWidthModel(uint32_t sheet, int32_t mode) const;
+  JsNumberResult columnCharsToPt(uint32_t sheet, int32_t mode, double chars) const;
+  JsNumberResult columnPtToChars(uint32_t sheet, int32_t mode, double pt) const;
 
   /** Complete worksheet-level `<autoFilter>` fragment. The empty string
    * means no filter; the status form distinguishes that from a bad sheet. */
@@ -314,7 +347,21 @@ class JsWorkbook {
   emscripten::val getCellStyle(uint32_t index) const;
   emscripten::val getCellStyleXf(uint32_t index) const;
   JsAddStyleResult addCellStyleXf(emscripten::val record);
-  JsStatus setCellStyle(const std::string& name, uint32_t xfId, uint32_t builtinId);
+  /// Adds or replaces a `<cellStyle>` from `{ name, xfId, builtinId, iLevel, hidden, customBuiltin }`.
+  JsStatus setCellStyle(emscripten::val record);
+  /// Removes the named style; cell formats that used it fall back to Normal.
+  JsStatus removeCellStyle(const std::string& name);
+
+  // ---- Theme, colour resolution and effective style ----------------------
+
+  /// `{ status, source, colors, fonts }`: the 12 scheme colours in `a:clrScheme` order and the theme typefaces.
+  emscripten::val getTheme() const;
+  JsStatus setThemeColors(emscripten::val colors);
+  JsStatus setThemeFonts(emscripten::val fonts);
+  /// `{ status, argb, resolution }` for a `ColorSpec` used in `context` (`ColorContext.*`).
+  emscripten::val resolveColor(emscripten::val spec, int32_t context) const;
+  /// `{ status, xfIndex, source, ..., font, borders, numFmtCode }`: the formatting a cell shows.
+  emscripten::val getEffectiveStyle(uint32_t sheet, uint32_t row, uint32_t col) const;
 
   emscripten::val getExternalLinks() const;
 
@@ -340,6 +387,41 @@ class JsWorkbook {
   JsStatus clearHyperlinks(uint32_t sheet);
   emscripten::val getHyperlinks(uint32_t sheet) const;
   emscripten::val getMerges(uint32_t sheet) const;
+  /// The merges intersecting `range`, in storage order.
+  emscripten::val getMergesInRange(uint32_t sheet, emscripten::val range) const;
+
+  /// Typed AutoFilter model for a sheet or (workbook-wide table index) a table.
+  emscripten::val getAutoFilter(uint32_t sheet) const;
+  JsStatus setAutoFilter(uint32_t sheet, emscripten::val filter);
+  JsStatus removeAutoFilter(uint32_t sheet);
+  JsStatus applyAutoFilter(uint32_t sheet);
+  JsStatus clearAutoFilter(uint32_t sheet);
+  emscripten::val evaluateAutoFilter(uint32_t sheet) const;
+  emscripten::val getTableAutoFilter(uint32_t table) const;
+  JsStatus setTableAutoFilter(uint32_t table, emscripten::val filter);
+  JsStatus removeTableAutoFilter(uint32_t table);
+  JsStatus applyTableAutoFilter(uint32_t table);
+  JsStatus clearTableAutoFilter(uint32_t table);
+  emscripten::val evaluateTableAutoFilter(uint32_t table) const;
+
+  emscripten::val validateValue(uint32_t sheet, uint32_t row, uint32_t col, emscripten::val value) const;
+  emscripten::val listInvalidCells(uint32_t sheet, emscripten::val cursor, emscripten::val limit) const;
+
+  emscripten::val getThreadedComments(uint32_t sheet) const;
+  JsStatus addThreadedComment(uint32_t sheet, emscripten::val comment);
+  JsStatus editThreadedComment(uint32_t sheet, const std::string& id, const std::string& text,
+                               emscripten::val mentions);
+  JsStatus setThreadResolved(uint32_t sheet, const std::string& threadId, bool done);
+  JsStatus removeThreadedComment(uint32_t sheet, const std::string& id);
+  emscripten::val getPersons() const;
+  JsStatus addPerson(emscripten::val person);
+  JsStatus removePerson(const std::string& id);
+
+  emscripten::val probeImage(emscripten::val bytes) const;
+  emscripten::val listDrawingObjects(uint32_t sheet) const;
+  emscripten::val getImage(uint32_t sheet, uint32_t objectId) const;
+  emscripten::val insertImage(uint32_t sheet, emscripten::val bytes, emscripten::val opts);
+  JsStatus removeImage(uint32_t sheet, uint32_t objectId);
 
   emscripten::val getValidations(uint32_t sheet) const;
   JsStatus addValidation(uint32_t sheet, emscripten::val v);
diff --git a/src/wasm/parts/workbook_cells.cpp b/src/wasm/parts/workbook_cells.cpp
index 12ecb3ab4..4fb5f4c9a 100644
--- a/src/wasm/parts/workbook_cells.cpp
+++ b/src/wasm/parts/workbook_cells.cpp
@@ -77,21 +77,33 @@ JsStatus JsWorkbook::setCellPhoneticRuns(uint32_t sheet, uint32_t row, uint32_t
   if (handle_ == nullptr) {
     return error_status(kBindingInvalidHandle);
   }
-  if (!runs.isArray()) {
+  JsNarrowNumericReader reader("setCellPhoneticRuns");
+  if (!reader.is_array(runs, "setCellPhoneticRuns.runs")) {
     return binding_error_status(static_cast<int32_t>(formulon::FormulonErrorCode::kInvalidArgument),
                                 "setCellPhoneticRuns: `runs` must be an array of { sb, eb, text }");
   }
-  const uint32_t count = runs["length"].as<uint32_t>();
+  const uint32_t count = reader.length(runs, "setCellPhoneticRuns.runs.length");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   // Two passes for the same reason `createTable` needs them: no `c_str()`
   // may be taken before `texts` has finished growing.
   std::vector<std::string> texts;
   texts.reserve(count);
   std::vector<fm_phonetic_run_t> records;
   records.reserve(count);
-  for (uint32_t i = 0; i < count; ++i) {
-    const emscripten::val run = runs[i];
-    texts.push_back(js_pull_string(run, "text"));
-    records.push_back(fm_phonetic_run_t{js_pull_u32(run, "sb", 0U), js_pull_u32(run, "eb", 0U), nullptr});
+  for (uint32_t i = 0; i < count && reader.ok(); ++i) {
+    const emscripten::val run = reader.array_element(runs, i, "setCellPhoneticRuns.run");
+    const emscripten::val sb_value = reader.value(run, "sb", "setCellPhoneticRuns.sb");
+    const emscripten::val eb_value = reader.value(run, "eb", "setCellPhoneticRuns.eb");
+    const emscripten::val text_value = reader.value(run, "text", "setCellPhoneticRuns.text");
+    const uint32_t sb = reader.u32_value(sb_value, 0U, "setCellPhoneticRuns.sb");
+    const uint32_t eb = reader.u32_value(eb_value, 0U, "setCellPhoneticRuns.eb");
+    texts.push_back(reader.string_value(text_value, "setCellPhoneticRuns.text"));
+    records.push_back(fm_phonetic_run_t{sb, eb, nullptr});
+  }
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
   }
   for (uint32_t i = 0; i < count; ++i) {
     records[i].text = texts[i].c_str();
@@ -104,9 +116,14 @@ JsStatus JsWorkbook::setCellPhoneticProperties(uint32_t sheet, uint32_t row, uin
   if (handle_ == nullptr) {
     return error_status(kBindingInvalidHandle);
   }
-  const fm_status_t rc = fm_workbook_set_cell_phonetic_properties(
-      handle_, sheet, row, col, js_pull_u32(properties, "fontId", 0U), js_pull_u32(properties, "type", 0U),
-      js_pull_u32(properties, "alignment", 0U));
+  JsNarrowNumericReader reader("setCellPhoneticProperties");
+  const uint32_t font_id = reader.u32(properties, "fontId", 0U, "phoneticProperties.fontId");
+  const uint32_t type = reader.u32(properties, "type", 0U, "phoneticProperties.type");
+  const uint32_t alignment = reader.u32(properties, "alignment", 0U, "phoneticProperties.alignment");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  const fm_status_t rc = fm_workbook_set_cell_phonetic_properties(handle_, sheet, row, col, font_id, type, alignment);
   return status_from_rc(rc);
 }
 
@@ -158,7 +175,7 @@ emscripten::val JsWorkbook::getCellPhonetic(uint32_t sheet, uint32_t row, uint32
     return o;
   }
   o.set("status", ok_status());
-  o.set("value", std::string(text != nullptr ? text : ""));
+  js_set_cstr(o, "value", text);
   return o;
 }
 
@@ -183,7 +200,7 @@ emscripten::val JsWorkbook::getCellPhoneticRuns(uint32_t sheet, uint32_t row, ui
     entry.set("eb", run.eb);
     // Copied immediately: each read refreshes the handle's scratch, so the
     // previous run's pointer is dead by the time the next one lands.
-    entry.set("text", std::string(run.text != nullptr ? run.text : ""));
+    js_set_cstr(entry, "text", run.text);
     out.call<void>("push", entry);
   }
   if (rc != 0) {
@@ -310,7 +327,7 @@ emscripten::val JsWorkbook::getLambdaText(uint32_t sheet, uint32_t row, uint32_t
     return o;
   }
   o.set("status", ok_status());
-  o.set("text", std::string(text != nullptr ? text : ""));
+  js_set_cstr(o, "text", text);
   return o;
 }
 
@@ -359,8 +376,8 @@ emscripten::val JsWorkbook::definedNameAt(uint32_t idx) const {
     return o;
   }
   o.set("status", ok_status());
-  o.set("name", name != nullptr ? std::string(name) : std::string());
-  o.set("formula", formula != nullptr ? std::string(formula) : std::string());
+  js_set_cstr(o, "name", name);
+  js_set_cstr(o, "formula", formula);
   o.set("localSheetId", local_sheet_id);
   return o;
 }
@@ -381,9 +398,9 @@ emscripten::val JsWorkbook::tableAt(uint32_t idx) const {
     return o;
   }
   o.set("status", ok_status());
-  o.set("name", name != nullptr ? std::string(name) : std::string());
-  o.set("displayName", display != nullptr ? std::string(display) : std::string());
-  o.set("ref", ref != nullptr ? std::string(ref) : std::string());
+  js_set_cstr(o, "name", name);
+  js_set_cstr(o, "displayName", display);
+  js_set_cstr(o, "ref", ref);
   o.set("sheetIndex", static_cast<uint32_t>(sheet_index));
   return o;
 }
@@ -394,29 +411,42 @@ JsAddStyleResult JsWorkbook::createTable(emscripten::val spec) {
     out.status = error_status(7000);
     return out;
   }
-  const uint32_t sheet = js_pull_u32(spec, "sheetIndex", 0U);
-  const std::string ref = js_pull_string(spec, "ref");
-  const std::string name = js_pull_string(spec, "name");
-  std::string display_name = js_pull_string(spec, "displayName");
+  JsNarrowNumericReader reader("createTable");
+  const uint32_t sheet = reader.u32(spec, "sheetIndex", 0U, "createTable.sheetIndex");
+  const std::string ref = reader.string(spec, "ref", "createTable.ref");
+  const std::string name = reader.string(spec, "name", "createTable.name");
+  std::string display_name = reader.string(spec, "displayName", "createTable.displayName");
   if (display_name.empty()) {
     display_name = name;
   }
-  const std::string style_name = js_pull_string(spec, "styleName");
-  const bool header_row = js_pull_bool(spec, "headerRow", true);
-  const bool totals_row = js_pull_bool(spec, "totalsRow", false);
-  emscripten::val columns = spec["columns"];
-  if (!columns.isArray()) {
-    out.status = binding_error_status(static_cast<int32_t>(formulon::FormulonErrorCode::kInvalidArgument),
-                                      "createTable: `columns` must be an array of column names");
+  const std::string style_name = reader.string(spec, "styleName", "createTable.styleName");
+  const bool header_row = reader.boolean(spec, "headerRow", true, "createTable.headerRow");
+  const bool totals_row = reader.boolean(spec, "totalsRow", false, "createTable.totalsRow");
+  const emscripten::val columns = reader.value(spec, "columns", "createTable.columns");
+  if (!reader.ok()) {
+    out.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return out;
+  }
+  if (!reader.is_array(columns, "createTable.columns")) {
+    out.status = binding_error_status(kInvalidArgument, "createTable: `columns` must be an array of column names");
+    return out;
+  }
+  const uint32_t count = reader.length(columns, "createTable.columns.length");
+  if (!reader.ok()) {
+    out.status = binding_error_status(kInvalidArgument, reader.message().c_str());
     return out;
   }
-  const uint32_t count = columns["length"].as<uint32_t>();
   // The pointer vector is filled in a second pass so that no `c_str()` is
   // taken before `names` has finished growing.
   std::vector<std::string> names;
   names.reserve(count);
-  for (uint32_t i = 0; i < count; ++i) {
-    names.push_back(columns[i].as<std::string>());
+  for (uint32_t i = 0; i < count && reader.ok(); ++i) {
+    const emscripten::val column = reader.array_element(columns, i, "createTable.columns[]");
+    names.push_back(reader.string_value(column, "createTable.columns[]"));
+  }
+  if (!reader.ok()) {
+    out.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return out;
   }
   std::vector<const char*> pointers;
   pointers.reserve(count);
@@ -444,9 +474,26 @@ JsStatus JsWorkbook::updateTable(uint32_t idx, emscripten::val spec) {
   // The C ABI keeps `ref` non-null, so an omitted ref is resolved to the
   // current value before forwarding the partial update. Other omitted fields
   // use the C ABI's preservation sentinels directly.
-  emscripten::val ref_value = spec["ref"];
+  JsNarrowNumericReader reader("updateTable");
   std::string ref;
-  if (ref_value.isUndefined() || ref_value.isNull()) {
+  std::string style_name;
+  const char* ref_ptr = reader.optional_string(spec, "ref", ref, "updateTable.ref");
+  const char* style_name_ptr = reader.optional_string(spec, "styleName", style_name, "updateTable.styleName");
+  const auto optional_bool = [&reader, &spec](const char* key, const char* field) {
+    const emscripten::val value = reader.value(spec, key, field);
+    if (!reader.ok() || value.isUndefined() || value.isNull()) {
+      return int32_t{-1};
+    }
+    return reader.boolean_value(value, false, field) ? int32_t{1} : int32_t{0};
+  };
+  const int32_t header_row = optional_bool("headerRow", "updateTable.headerRow");
+  const int32_t totals_row = optional_bool("totalsRow", "updateTable.totalsRow");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+
+  std::string effective_ref;
+  if (ref_ptr == nullptr) {
     const char* current_ref = nullptr;
     const char* ignored_name = nullptr;
     const char* ignored_display_name = nullptr;
@@ -456,28 +503,10 @@ JsStatus JsWorkbook::updateTable(uint32_t idx, emscripten::val spec) {
     if (lookup_rc != 0) {
       return status_from_rc(lookup_rc);
     }
-    ref = current_ref != nullptr ? current_ref : std::string();
-  } else {
-    ref = ref_value.as<std::string>();
-  }
-
-  emscripten::val style_value = spec["styleName"];
-  std::string style_name;
-  const char* style_name_ptr = nullptr;
-  if (!style_value.isUndefined() && !style_value.isNull()) {
-    style_name = style_value.as<std::string>();
-    style_name_ptr = style_name.c_str();
+    effective_ref = current_ref != nullptr ? current_ref : std::string();
+    ref_ptr = effective_ref.c_str();
   }
-
-  const auto optional_bool = [&spec](const char* key) {
-    const emscripten::val value = spec[key];
-    if (value.isUndefined() || value.isNull()) {
-      return int32_t{-1};
-    }
-    return value.as<bool>() ? int32_t{1} : int32_t{0};
-  };
-  return status_from_rc(fm_workbook_table_update(handle_, idx, ref.c_str(), style_name_ptr, optional_bool("headerRow"),
-                                                 optional_bool("totalsRow")));
+  return status_from_rc(fm_workbook_table_update(handle_, idx, ref_ptr, style_name_ptr, header_row, totals_row));
 }
 
 JsStatus JsWorkbook::removeTable(uint32_t idx) {
@@ -500,7 +529,7 @@ emscripten::val JsWorkbook::passthroughAt(uint32_t idx) const {
     return o;
   }
   o.set("status", ok_status());
-  o.set("path", path != nullptr ? std::string(path) : std::string());
+  js_set_cstr(o, "path", path);
   return o;
 }
 
@@ -570,9 +599,9 @@ emscripten::val JsWorkbook::getExternalLinks() const {
     }
     emscripten::val item = emscripten::val::object();
     item.set("index", rec.index);
-    item.set("relId", std::string(rec.rel_id != nullptr ? rec.rel_id : ""));
-    item.set("partPath", std::string(rec.part_path != nullptr ? rec.part_path : ""));
-    item.set("target", std::string(rec.target != nullptr ? rec.target : ""));
+    js_set_cstr(item, "relId", rec.rel_id);
+    js_set_cstr(item, "partPath", rec.part_path);
+    js_set_cstr(item, "target", rec.target);
     item.set("targetExternal", rec.target_external != 0);
     item.set("kind", rec.kind);
     arr.set(emitted, item);
@@ -582,6 +611,230 @@ emscripten::val JsWorkbook::getExternalLinks() const {
   return arr;
 }
 
+// ---- Formula text / range enumeration / display text -------------------
+
+namespace {
+
+emscripten::val formula_envelope(fm_status_t rc, const char* formula) {
+  emscripten::val o = emscripten::val::object();
+  o.set("status", status_from_rc(rc));
+  const bool present = rc == 0 && formula != nullptr && formula[0] != '\0';
+  o.set("formula", present ? emscripten::val(std::string(formula)) : emscripten::val::null());
+  return o;
+}
+
+emscripten::val display_envelope(fm_status_t rc, const char* text, int32_t display_status) {
+  emscripten::val o = emscripten::val::object();
+  o.set("status", status_from_rc(rc));
+  js_set_cstr(o, "text", rc == 0 ? text : nullptr);
+  o.set("displayStatus", rc == 0 ? display_status : 0);
+  return o;
+}
+
+/// Reads an optional non-negative integer argument (`undefined` / `null`
+/// keep `dflt`). Returns false for anything else that is not a safe integer.
+bool js_optional_index(const emscripten::val& v, double dflt, double max, double* out) {
+  if (v.isUndefined() || v.isNull()) {
+    *out = dflt;
+    return true;
+  }
+  const emscripten::val number = emscripten::val::global("Number");
+  if (!number.call<bool>("isInteger", v)) {
+    return false;
+  }
+  const double d = v.as<double>();
+  *out = d;
+  return d >= 0.0 && d <= max;
+}
+
+/// Reads a `{kind, number, boolean, text, errorCode}` value record into
+/// `out`; `text` owns the storage a `FM_VAL_TEXT` payload points at. Returns
+/// false when any nested field fails validation.
+bool pull_value(JsNarrowNumericReader& reader, const emscripten::val& value, std::string& text, fm_value_t* out) {
+  out->kind = static_cast<fm_value_kind_t>(reader.i32(value, "kind", 0, "value.kind"));
+  text = reader.string(value, "text", "value.text");
+  switch (out->kind) {
+    case FM_VAL_NUMBER:
+      out->u.number = reader.number(value, "number", 0.0, "value.number");
+      break;
+    case FM_VAL_BOOL:
+      out->u.boolean = reader.i32(value, "boolean", 0, "value.boolean") != 0 ? 1 : 0;
+      break;
+    case FM_VAL_TEXT:
+      out->u.text = text.c_str();
+      break;
+    case FM_VAL_ERROR:
+      out->u.error_code = reader.i32(value, "errorCode", 0, "value.errorCode");
+      break;
+    default:
+      break;
+  }
+  return reader.ok();
+}
+
+/// Fills `o.cells` / `o.nextCursor` from a cell-range page and destroys it.
+void fill_cells_page(emscripten::val& o, fm_cell_range_t* page) {
+  std::size_t count = 0;
+  uint64_t next = 0;
+  fm_cell_range_count(page, &count);
+  fm_cell_range_next_cursor(page, &next);
+  emscripten::val cells = emscripten::val::array();
+  for (std::size_t i = 0; i < count; ++i) {
+    uint32_t row = 0;
+    uint32_t col = 0;
+    const char* formula = nullptr;
+    fm_value_t v{};
+    if (fm_cell_range_at(page, i, &row, &col, &formula, &v) != 0) {
+      continue;
+    }
+    emscripten::val cell = emscripten::val::object();
+    cell.set("row", row);
+    cell.set("col", col);
+    cell.set("formula", formula != nullptr ? emscripten::val(std::string(formula)) : emscripten::val::null());
+    cell.set("value", translate_value(v));
+    cells.call<void>("push", cell);
+  }
+  fm_cell_range_destroy(page);
+  o.set("status", ok_status());
+  o.set("cells", cells);
+  if (next != UINT64_MAX) {
+    o.set("nextCursor", static_cast<double>(next));
+  }
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::getFormula(uint32_t sheet, uint32_t row, uint32_t col) const {
+  const char* formula = nullptr;
+  const fm_status_t rc = handle_ != nullptr ? fm_workbook_get_formula(handle_, sheet, row, col, &formula) : 7000;
+  return formula_envelope(rc, formula);
+}
+
+emscripten::val JsWorkbook::getFormulaR1C1(uint32_t sheet, uint32_t row, uint32_t col) const {
+  const char* formula = nullptr;
+  const fm_status_t rc = handle_ != nullptr ? fm_workbook_get_formula_r1c1(handle_, sheet, row, col, &formula) : 7000;
+  return formula_envelope(rc, formula);
+}
+
+emscripten::val JsWorkbook::getCellsInRange(uint32_t sheet, emscripten::val range, emscripten::val cursor,
+                                            emscripten::val limit) const {
+  emscripten::val o = emscripten::val::object();
+  o.set("cells", emscripten::val::array());
+  o.set("nextCursor", emscripten::val::null());
+  if (handle_ == nullptr) {
+    o.set("status", error_status(7000));
+    return o;
+  }
+  double cursor_value = 0.0;
+  double limit_value = 0.0;
+  if (!js_optional_index(cursor, 0.0, 9007199254740991.0, &cursor_value) ||
+      !js_optional_index(limit, 0.0, 4294967295.0, &limit_value)) {
+    o.set("status", binding_error_status(static_cast<int32_t>(formulon::FormulonErrorCode::kInvalidArgument),
+                                         "getCellsInRange: `cursor` and `limit` must be non-negative integers"));
+    return o;
+  }
+  JsNarrowNumericReader reader("getCellsInRange");
+  const fm_merge_range bounds = js_pull_range(range, &reader);
+  if (!reader.ok()) {
+    o.set("status", binding_error_status(kInvalidArgument, reader.message().c_str()));
+    return o;
+  }
+  fm_cell_range_t* page = nullptr;
+  const fm_status_t rc =
+      fm_sheet_cells_in_range(handle_, sheet, bounds.first_row, bounds.first_col, bounds.last_row, bounds.last_col,
+                              static_cast<uint64_t>(cursor_value), static_cast<uint32_t>(limit_value), &page);
+  if (rc != 0) {
+    o.set("status", error_status(rc));
+    return o;
+  }
+  fill_cells_page(o, page);
+  return o;
+}
+
+emscripten::val JsWorkbook::listInvalidCells(uint32_t sheet, emscripten::val cursor, emscripten::val limit) const {
+  emscripten::val o = emscripten::val::object();
+  o.set("cells", emscripten::val::array());
+  o.set("nextCursor", emscripten::val::null());
+  if (handle_ == nullptr) {
+    o.set("status", error_status(kBindingInvalidHandle));
+    return o;
+  }
+  double cursor_value = 0.0;
+  double limit_value = 0.0;
+  if (!js_optional_index(cursor, 0.0, 9007199254740991.0, &cursor_value) ||
+      !js_optional_index(limit, 0.0, 4294967295.0, &limit_value)) {
+    o.set("status", binding_error_status(kInvalidArgument,
+                                         "listInvalidCells: `cursor` and `limit` must be non-negative integers"));
+    return o;
+  }
+  fm_cell_range_t* page = nullptr;
+  const fm_status_t rc = fm_sheet_list_invalid_cells(handle_, sheet, static_cast<uint64_t>(cursor_value),
+                                                     static_cast<uint32_t>(limit_value), &page);
+  if (rc != 0) {
+    o.set("status", error_status(rc));
+    return o;
+  }
+  fill_cells_page(o, page);
+  return o;
+}
+
+emscripten::val JsWorkbook::validateValue(uint32_t sheet, uint32_t row, uint32_t col, emscripten::val value) const {
+  emscripten::val o = emscripten::val::object();
+  o.set("hasRule", false);
+  o.set("valid", true);
+  o.set("ruleIndex", 0U);
+  o.set("errorStyle", 0U);
+  if (handle_ == nullptr) {
+    o.set("status", error_status(kBindingInvalidHandle));
+    return o;
+  }
+  std::string text;
+  fm_value_t proposed{};
+  JsNarrowNumericReader reader("validateValue");
+  if (!pull_value(reader, value, text, &proposed)) {
+    o.set("status", binding_error_status(kInvalidArgument, reader.message().c_str()));
+    return o;
+  }
+  fm_validation_outcome outcome{};
+  const fm_status_t rc = fm_sheet_validate_value(handle_, sheet, row, col, &proposed, &outcome);
+  o.set("status", status_from_rc(rc));
+  if (rc == 0) {
+    o.set("hasRule", outcome.has_rule != 0);
+    o.set("valid", outcome.valid != 0);
+    o.set("ruleIndex", outcome.rule_index);
+    o.set("errorStyle", static_cast<uint32_t>(outcome.error_style));
+  }
+  return o;
+}
+
+emscripten::val JsWorkbook::getDisplayText(uint32_t sheet, uint32_t row, uint32_t col) const {
+  const char* text = nullptr;
+  int32_t display_status = 0;
+  const fm_status_t rc =
+      handle_ != nullptr ? fm_workbook_get_display_text(handle_, sheet, row, col, &text, &display_status) : 7000;
+  return display_envelope(rc, text, display_status);
+}
+
+emscripten::val JsWorkbook::formatValue(emscripten::val value, const std::string& formatCode) const {
+  if (handle_ == nullptr) {
+    return display_envelope(7000, nullptr, 0);
+  }
+  std::string text;
+  fm_value_t v{};
+  JsNarrowNumericReader reader("formatValue");
+  if (!pull_value(reader, value, text, &v)) {
+    emscripten::val out = emscripten::val::object();
+    out.set("status", binding_error_status(kInvalidArgument, reader.message().c_str()));
+    out.set("text", std::string());
+    out.set("displayStatus", 0);
+    return out;
+  }
+  const char* out = nullptr;
+  int32_t display_status = 0;
+  const fm_status_t rc = fm_workbook_format_value(handle_, &v, formatCode.c_str(), &out, &display_status);
+  return display_envelope(rc, out, display_status);
+}
+
 }  // namespace parts
 }  // namespace wasm
 }  // namespace formulon
diff --git a/src/wasm/parts/workbook_cf.cpp b/src/wasm/parts/workbook_cf.cpp
index 855e80c93..85ddf1d57 100644
--- a/src/wasm/parts/workbook_cf.cpp
+++ b/src/wasm/parts/workbook_cf.cpp
@@ -23,21 +23,23 @@ namespace wasm {
 namespace parts {
 namespace {
 
-fm_cf_color_t js_pull_cf_color(emscripten::val v) {
+fm_cf_color_t js_pull_cf_color(emscripten::val v, JsNarrowNumericReader& reader) {
   fm_cf_color_t out{};
-  out.r = js_pull_u8(v, "r", 0U);
-  out.g = js_pull_u8(v, "g", 0U);
-  out.b = js_pull_u8(v, "b", 0U);
-  out.a = js_pull_u8(v, "a", 255U);
+  out.r = reader.u8(v, "r", 0U, "color.r");
+  out.g = reader.u8(v, "g", 0U, "color.g");
+  out.b = reader.u8(v, "b", 0U, "color.b");
+  out.a = reader.u8(v, "a", 255U, "color.a");
   return out;
 }
 
-fm_cfvo_t js_pull_cfvo(emscripten::val v, formulon::c_api::BorrowedStringArena* strings) {
+fm_cfvo_t js_pull_cfvo(emscripten::val v, formulon::c_api::BorrowedStringArena* strings,
+                       JsNarrowNumericReader& reader) {
   fm_cfvo_t out{};
-  out.type = js_pull_u8(v, "type", 0U);
-  out.gte = js_pull_bool(v, "gte", true) ? 1 : 0;
-  if (!v["value"].isUndefined() && !v["value"].isNull()) {
-    out.value = strings->emplace(v["value"].as<std::string>());
+  out.type = reader.u8(v, "type", 0U, "cfvo.type");
+  out.gte = reader.boolean(v, "gte", true, "cfvo.gte") ? 1 : 0;
+  const emscripten::val value = reader.value(v, "value", "cfvo.value");
+  if (!value.isUndefined() && !value.isNull()) {
+    out.value = strings->emplace(reader.string_value(value, "cfvo.value"));
   }
   return out;
 }
@@ -134,7 +136,7 @@ emscripten::val JsWorkbook::getConditionalFormats(uint32_t sheet) const {
       return arr;
     }
     emscripten::val item = emscripten::val::object();
-    item.set("id", rule.id != nullptr ? std::string(rule.id) : std::string());
+    js_set_cstr(item, "id", rule.id);
     item.set("type", static_cast<uint32_t>(rule.type));
     item.set("priority", rule.priority);
     item.set("stopIfTrue", rule.stop_if_true != 0);
@@ -262,147 +264,159 @@ JsAddStyleResult JsWorkbook::addConditionalFormat(uint32_t sheet, emscripten::va
   // rather than a vector: the colorScale, dataBar and iconSet branches
   // below all feed the same store, and a vector would relocate the
   // earlier strings as the later branches add theirs.
-  std::vector<fm_cf_cell_range_t> ranges_buf;
   std::vector<fm_cfvo_t> color_scale_thresholds;
   std::vector<fm_cf_color_t> color_scale_colors;
   std::vector<fm_cfvo_t> icon_set_thresholds;
   formulon::c_api::BorrowedStringArena cfvo_strings;
-  if (v.hasOwnProperty("sqref")) {
-    emscripten::val sqref_js = v["sqref"];
-    if (sqref_js.isArray()) {
-      const uint32_t n = sqref_js["length"].as<uint32_t>();
-      ranges_buf.reserve(n);
-      for (uint32_t i = 0; i < n; ++i) {
-        emscripten::val rng = sqref_js[i];
-        fm_cf_cell_range_t r{};
-        r.first_row = rng["firstRow"].as<uint32_t>();
-        r.first_col = rng["firstCol"].as<uint32_t>();
-        r.last_row = rng["lastRow"].as<uint32_t>();
-        r.last_col = rng["lastCol"].as<uint32_t>();
-        ranges_buf.push_back(r);
-      }
-    }
+  JsNarrowNumericReader reader("addConditionalFormat");
+  const std::vector<fm_merge_range> merge_ranges = js_pull_ranges(v, "sqref", &reader);
+  std::vector<fm_cf_cell_range_t> ranges_buf;
+  ranges_buf.reserve(merge_ranges.size());
+  for (const fm_merge_range& m : merge_ranges) {
+    ranges_buf.push_back(fm_cf_cell_range_t{m.first_row, m.first_col, m.last_row, m.last_col});
   }
-  const std::string id = js_pull_string(v, "id");
-  const std::string formula1 = js_pull_string(v, "formula1");
-  const std::string formula2 = js_pull_string(v, "formula2");
-  const std::string text = js_pull_string(v, "text");
+  const std::string id = reader.string(v, "id", "rule.id");
+  const std::string formula1 = reader.string(v, "formula1", "rule.formula1");
+  const std::string formula2 = reader.string(v, "formula2", "rule.formula2");
+  const std::string text = reader.string(v, "text", "rule.text");
 
   fm_cf_rule_t rule{};
   rule.id = id.empty() ? nullptr : id.c_str();
-  rule.type = js_pull_u8(v, "type", 0U);
-  rule.priority = js_pull_u32(v, "priority", 0U) != 0 ? static_cast<int32_t>(js_pull_u32(v, "priority", 0U)) : 0;
-  rule.stop_if_true = js_pull_bool(v, "stopIfTrue", false) ? 1 : 0;
-  if (!v["dxfId"].isUndefined() && !v["dxfId"].isNull()) {
+  rule.type = reader.u8(v, "type", 0U, "rule.type");
+  rule.priority = reader.i32(v, "priority", 0, "rule.priority");
+  rule.stop_if_true = reader.boolean(v, "stopIfTrue", false, "rule.stopIfTrue") ? 1 : 0;
+  const emscripten::val dxf_id = reader.value(v, "dxfId", "rule.dxfId");
+  if (!dxf_id.isUndefined() && !dxf_id.isNull()) {
     rule.dxf_id_engaged = 1;
-    rule.dxf_id = v["dxfId"].as<uint32_t>();
+    rule.dxf_id = reader.u32_value(dxf_id, 0U, "rule.dxfId");
   }
   rule.sqref = ranges_buf.empty() ? nullptr : ranges_buf.data();
   rule.sqref_count = static_cast<uint32_t>(ranges_buf.size());
   rule.formula1 = formula1.empty() ? nullptr : formula1.c_str();
   rule.formula2 = formula2.empty() ? nullptr : formula2.c_str();
-  if (!v["op"].isUndefined() && !v["op"].isNull()) {
+  const emscripten::val op = reader.value(v, "op", "rule.op");
+  if (!op.isUndefined() && !op.isNull()) {
     rule.op_engaged = 1;
-    rule.op = js_pull_u8(v, "op", 0U);
+    rule.op = reader.u8_value(op, 0U, "rule.op");
   }
-  if (!v["rank"].isUndefined() && !v["rank"].isNull()) {
+  const emscripten::val rank = reader.value(v, "rank", "rule.rank");
+  if (!rank.isUndefined() && !rank.isNull()) {
     rule.rank_engaged = 1;
-    rule.rank = static_cast<int32_t>(v["rank"].as<int32_t>());
+    rule.rank = reader.i32_value(rank, 0, "rule.rank");
   }
-  rule.percent = js_pull_bool(v, "percent", false) ? 1 : 0;
-  rule.bottom = js_pull_bool(v, "bottom", false) ? 1 : 0;
-  rule.above_average = js_pull_bool(v, "aboveAverage", true) ? 1 : 0;
-  rule.equal_average = js_pull_bool(v, "equalAverage", false) ? 1 : 0;
-  if (!v["stdDev"].isUndefined() && !v["stdDev"].isNull()) {
+  rule.percent = reader.boolean(v, "percent", false, "rule.percent") ? 1 : 0;
+  rule.bottom = reader.boolean(v, "bottom", false, "rule.bottom") ? 1 : 0;
+  rule.above_average = reader.boolean(v, "aboveAverage", true, "rule.aboveAverage") ? 1 : 0;
+  rule.equal_average = reader.boolean(v, "equalAverage", false, "rule.equalAverage") ? 1 : 0;
+  const emscripten::val std_dev = reader.value(v, "stdDev", "rule.stdDev");
+  if (!std_dev.isUndefined() && !std_dev.isNull()) {
     rule.std_dev_engaged = 1;
-    rule.std_dev = v["stdDev"].as<double>();
+    rule.std_dev = reader.number_value(std_dev, 0.0, "rule.stdDev");
   }
   rule.text = text.empty() ? nullptr : text.c_str();
-  if (!v["timePeriod"].isUndefined() && !v["timePeriod"].isNull()) {
+  const emscripten::val time_period = reader.value(v, "timePeriod", "rule.timePeriod");
+  if (!time_period.isUndefined() && !time_period.isNull()) {
     rule.time_period_engaged = 1;
-    rule.time_period = js_pull_u8(v, "timePeriod", 0U);
+    rule.time_period = reader.u8_value(time_period, 0U, "rule.timePeriod");
   }
-  if (!v["colorScale"].isUndefined() && !v["colorScale"].isNull()) {
-    emscripten::val cs = v["colorScale"];
-    if (cs.hasOwnProperty("thresholds") && cs["thresholds"].isArray()) {
-      const uint32_t n = cs["thresholds"]["length"].as<uint32_t>();
+  const emscripten::val color_scale = reader.value(v, "colorScale", "colorScale");
+  if (!color_scale.isUndefined() && !color_scale.isNull()) {
+    const emscripten::val thresholds = reader.value(color_scale, "thresholds", "colorScale.thresholds");
+    if (reader.is_array(thresholds, "colorScale.thresholds")) {
+      const uint32_t n = reader.length(thresholds, "colorScale.thresholds");
       color_scale_thresholds.reserve(n);
       for (uint32_t i = 0; i < n; ++i) {
-        color_scale_thresholds.push_back(js_pull_cfvo(cs["thresholds"][i], &cfvo_strings));
+        color_scale_thresholds.push_back(
+            js_pull_cfvo(reader.array_element(thresholds, i, "colorScale.thresholds[]"), &cfvo_strings, reader));
       }
     }
-    if (cs.hasOwnProperty("colors") && cs["colors"].isArray()) {
-      const uint32_t n = cs["colors"]["length"].as<uint32_t>();
+    const emscripten::val colors = reader.value(color_scale, "colors", "colorScale.colors");
+    if (reader.is_array(colors, "colorScale.colors")) {
+      const uint32_t n = reader.length(colors, "colorScale.colors");
       color_scale_colors.reserve(n);
       for (uint32_t i = 0; i < n; ++i) {
-        color_scale_colors.push_back(js_pull_cf_color(cs["colors"][i]));
+        color_scale_colors.push_back(js_pull_cf_color(reader.array_element(colors, i, "colorScale.colors[]"), reader));
       }
     }
     rule.color_scale_thresholds = color_scale_thresholds.empty() ? nullptr : color_scale_thresholds.data();
     rule.color_scale_colors = color_scale_colors.empty() ? nullptr : color_scale_colors.data();
     rule.color_scale_count = static_cast<uint32_t>(color_scale_thresholds.size());
   }
-  if (!v["dataBar"].isUndefined() && !v["dataBar"].isNull()) {
-    emscripten::val db = v["dataBar"];
+  const emscripten::val data_bar = reader.value(v, "dataBar", "dataBar");
+  if (!data_bar.isUndefined() && !data_bar.isNull()) {
     rule.data_bar_engaged = 1;
-    rule.data_bar_min = js_pull_cfvo(db["min"], &cfvo_strings);
-    rule.data_bar_max = js_pull_cfvo(db["max"], &cfvo_strings);
-    rule.data_bar_fill = js_pull_cf_color(db["fill"]);
-    rule.data_bar_show_value = js_pull_bool(db, "showValue", true) ? 1 : 0;
-    rule.data_bar_min_length_pct = js_pull_u8(db, "minLengthPct", 10U);
-    rule.data_bar_max_length_pct = js_pull_u8(db, "maxLengthPct", 90U);
+    rule.data_bar_min = js_pull_cfvo(reader.value(data_bar, "min", "dataBar.min"), &cfvo_strings, reader);
+    rule.data_bar_max = js_pull_cfvo(reader.value(data_bar, "max", "dataBar.max"), &cfvo_strings, reader);
+    rule.data_bar_fill = js_pull_cf_color(reader.value(data_bar, "fill", "dataBar.fill"), reader);
+    rule.data_bar_show_value = reader.boolean(data_bar, "showValue", true, "dataBar.showValue") ? 1 : 0;
+    rule.data_bar_min_length_pct = reader.u8(data_bar, "minLengthPct", 10U, "dataBar.minLengthPct");
+    rule.data_bar_max_length_pct = reader.u8(data_bar, "maxLengthPct", 90U, "dataBar.maxLengthPct");
     // `x14` extension payload. An omitted key leaves the corresponding
     // `*_engaged` flag clear, which the C ABI reads as "keep the model
     // default" (gradient on, automatic axis, negative fill equal to the
     // positive fill, no border, black axis).
-    if (!db["gradient"].isUndefined() && !db["gradient"].isNull()) {
+    const emscripten::val gradient = reader.value(data_bar, "gradient", "dataBar.gradient");
+    if (!gradient.isUndefined() && !gradient.isNull()) {
       rule.data_bar_gradient_engaged = 1;
-      rule.data_bar_gradient = js_pull_bool(db, "gradient", true) ? 1 : 0;
+      rule.data_bar_gradient = reader.boolean_value(gradient, true, "dataBar.gradient") ? 1 : 0;
     }
-    if (!db["axisPosition"].isUndefined() && !db["axisPosition"].isNull()) {
+    const emscripten::val axis_position = reader.value(data_bar, "axisPosition", "dataBar.axisPosition");
+    if (!axis_position.isUndefined() && !axis_position.isNull()) {
       rule.data_bar_axis_position_engaged = 1;
-      rule.data_bar_axis_position = js_pull_u8(db, "axisPosition", 0U);
+      rule.data_bar_axis_position = reader.u8_value(axis_position, 0U, "dataBar.axisPosition");
     }
-    if (!db["negativeFill"].isUndefined() && !db["negativeFill"].isNull()) {
+    const emscripten::val negative_fill = reader.value(data_bar, "negativeFill", "dataBar.negativeFill");
+    if (!negative_fill.isUndefined() && !negative_fill.isNull()) {
       rule.data_bar_negative_fill_engaged = 1;
-      rule.data_bar_negative_fill = js_pull_cf_color(db["negativeFill"]);
+      rule.data_bar_negative_fill = js_pull_cf_color(negative_fill, reader);
     }
-    if (!db["border"].isUndefined() && !db["border"].isNull()) {
+    const emscripten::val border = reader.value(data_bar, "border", "dataBar.border");
+    if (!border.isUndefined() && !border.isNull()) {
       rule.data_bar_border_engaged = 1;
-      rule.data_bar_border = js_pull_cf_color(db["border"]);
+      rule.data_bar_border = js_pull_cf_color(border, reader);
     }
-    if (!db["negativeBorder"].isUndefined() && !db["negativeBorder"].isNull()) {
+    const emscripten::val negative_border = reader.value(data_bar, "negativeBorder", "dataBar.negativeBorder");
+    if (!negative_border.isUndefined() && !negative_border.isNull()) {
       rule.data_bar_negative_border_engaged = 1;
-      rule.data_bar_negative_border = js_pull_cf_color(db["negativeBorder"]);
+      rule.data_bar_negative_border = js_pull_cf_color(negative_border, reader);
     }
-    if (!db["axisColor"].isUndefined() && !db["axisColor"].isNull()) {
+    const emscripten::val axis_color = reader.value(data_bar, "axisColor", "dataBar.axisColor");
+    if (!axis_color.isUndefined() && !axis_color.isNull()) {
       rule.data_bar_axis_color_engaged = 1;
-      rule.data_bar_axis_color = js_pull_cf_color(db["axisColor"]);
+      rule.data_bar_axis_color = js_pull_cf_color(axis_color, reader);
     }
-    rule.data_bar_direction = js_pull_u8(db, "direction", 0U);
+    rule.data_bar_direction = reader.u8(data_bar, "direction", 0U, "dataBar.direction");
   }
-  if (!v["iconSet"].isUndefined() && !v["iconSet"].isNull()) {
-    emscripten::val is = v["iconSet"];
+  const emscripten::val icon_set = reader.value(v, "iconSet", "iconSet");
+  if (!icon_set.isUndefined() && !icon_set.isNull()) {
     rule.icon_set_engaged = 1;
-    rule.icon_set_name = js_pull_u8(is, "name", 0U);
-    if (is.hasOwnProperty("thresholds") && is["thresholds"].isArray()) {
-      const uint32_t n = is["thresholds"]["length"].as<uint32_t>();
+    rule.icon_set_name = reader.u8(icon_set, "name", 0U, "iconSet.name");
+    const emscripten::val thresholds = reader.value(icon_set, "thresholds", "iconSet.thresholds");
+    if (reader.is_array(thresholds, "iconSet.thresholds")) {
+      const uint32_t n = reader.length(thresholds, "iconSet.thresholds");
       icon_set_thresholds.reserve(n);
       for (uint32_t i = 0; i < n; ++i) {
-        icon_set_thresholds.push_back(js_pull_cfvo(is["thresholds"][i], &cfvo_strings));
+        icon_set_thresholds.push_back(
+            js_pull_cfvo(reader.array_element(thresholds, i, "iconSet.thresholds[]"), &cfvo_strings, reader));
       }
     }
     rule.icon_set_thresholds = icon_set_thresholds.empty() ? nullptr : icon_set_thresholds.data();
     rule.icon_set_threshold_count = static_cast<uint32_t>(icon_set_thresholds.size());
-    rule.icon_set_reverse = js_pull_bool(is, "reverse", false) ? 1 : 0;
-    rule.icon_set_show_value = js_pull_bool(is, "showValue", true) ? 1 : 0;
-    rule.icon_set_percent = js_pull_bool(is, "percent", true) ? 1 : 0;
+    rule.icon_set_reverse = reader.boolean(icon_set, "reverse", false, "iconSet.reverse") ? 1 : 0;
+    rule.icon_set_show_value = reader.boolean(icon_set, "showValue", true, "iconSet.showValue") ? 1 : 0;
+    rule.icon_set_percent = reader.boolean(icon_set, "percent", true, "iconSet.percent") ? 1 : 0;
     // An omitted floor keeps Excel's default, `percent 0`.
-    if (!is["floor"].isUndefined() && !is["floor"].isNull()) {
+    const emscripten::val floor = reader.value(icon_set, "floor", "iconSet.floor");
+    if (!floor.isUndefined() && !floor.isNull()) {
       rule.icon_set_floor_engaged = 1;
-      rule.icon_set_floor = js_pull_cfvo(is["floor"], &cfvo_strings);
+      rule.icon_set_floor = js_pull_cfvo(floor, &cfvo_strings, reader);
     }
   }
+  if (!reader.ok()) {
+    r.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return r;
+  }
+
   std::size_t new_index = 0;
   fm_status_t rc = fm_sheet_cf_add_rule(handle_, sheet, rule, &new_index);
   if (rc != 0) {
diff --git a/src/wasm/parts/workbook_core.cpp b/src/wasm/parts/workbook_core.cpp
index c46707fb5..f26655792 100644
--- a/src/wasm/parts/workbook_core.cpp
+++ b/src/wasm/parts/workbook_core.cpp
@@ -153,12 +153,16 @@ JsWorkbook* JsWorkbook::createEmpty() {
 
 JsWorkbook* JsWorkbook::loadBytes(emscripten::val bytes) {
   auto wb = std::unique_ptr<JsWorkbook>(new JsWorkbook());
-  const std::vector<uint8_t> buf = val_to_bytes(bytes);
-  if (buf.empty()) {
+  const JsBytesReadResult read = val_to_bytes_checked(bytes);
+  if (!read.ok || read.bytes.empty()) {
+    // `loadBytes` historically returns an invalid wrapper and refreshes the
+    // C diagnostic for malformed, non-Uint8Array, and empty input. Keep that
+    // factory contract while ensuring conversion failures stay inside the JS
+    // boundary.
     (void)fm_workbook_load(nullptr, 0, &wb->handle_);
     return wb.release();
   }
-  (void)fm_workbook_load(buf.data(), buf.size(), &wb->handle_);
+  (void)fm_workbook_load(read.bytes.data(), read.bytes.size(), &wb->handle_);
   return wb.release();
 }
 
@@ -532,12 +536,15 @@ emscripten::val JsWorkbook::partialRecalc(emscripten::val viewport) {
     o.set("recomputed", static_cast<uint32_t>(0));
     return o;
   }
-  fm_viewport vp{};
-  vp.sheet = viewport["sheet"].as<uint32_t>();
-  vp.first_row = viewport["firstRow"].as<uint32_t>();
-  vp.last_row = viewport["lastRow"].as<uint32_t>();
-  vp.first_col = viewport["firstCol"].as<uint32_t>();
-  vp.last_col = viewport["lastCol"].as<uint32_t>();
+  JsNarrowNumericReader reader("partialRecalc");
+  const uint32_t vp_sheet = reader.u32(viewport, "sheet", 0U, "viewport.sheet");
+  const fm_merge_range bounds = js_pull_range(viewport, &reader);
+  if (!reader.ok()) {
+    o.set("status", binding_error_status(kInvalidArgument, reader.message().c_str()));
+    o.set("recomputed", static_cast<uint32_t>(0));
+    return o;
+  }
+  fm_viewport vp{vp_sheet, bounds.first_row, bounds.last_row, bounds.first_col, bounds.last_col};
   uint32_t recomputed = 0;
   progress_callback_threw_ = false;
   fm_status_t rc = fm_workbook_partial_recalc(handle_, &vp, &recomputed);
diff --git a/src/wasm/parts/workbook_misc.cpp b/src/wasm/parts/workbook_misc.cpp
index 2fd2f12a8..a63234556 100644
--- a/src/wasm/parts/workbook_misc.cpp
+++ b/src/wasm/parts/workbook_misc.cpp
@@ -73,7 +73,7 @@ emscripten::val JsWorkbook::functionMetadata(const std::string& name, uint32_t l
     return o;
   }
   o.set("ok", true);
-  o.set("name", md.canonical_name != nullptr ? std::string(md.canonical_name) : std::string());
+  js_set_cstr(o, "name", md.canonical_name);
   o.set("minArity", md.min_arity);
   // `0xFFFFFFFF` is the unbounded / unknown-arity sentinel; surface it as
   // `null` so JS callers do not mistake it for a concrete upper bound.
diff --git a/src/wasm/parts/workbook_pivot.cpp b/src/wasm/parts/workbook_pivot.cpp
index ec325e199..ef658fe26 100644
--- a/src/wasm/parts/workbook_pivot.cpp
+++ b/src/wasm/parts/workbook_pivot.cpp
@@ -23,6 +23,31 @@ namespace formulon {
 namespace wasm {
 namespace parts {
 
+namespace {
+
+bool build_data_field_spec_checked(JsNarrowNumericReader& reader, const emscripten::val& spec,
+                                   fm_pivot_data_field_spec_t& out, std::string& name_buf, std::string& nfmt_buf,
+                                   bool& has_nfmt) {
+  // Read the optional strings before the numeric fields. Once the reader
+  // rejects a numeric value, no further access to the caller's object is
+  // allowed before returning the binding error.
+  out.name = reader.optional_string(spec, "name", name_buf, "pivotDataField.name");
+  out.number_format = reader.optional_string(spec, "numberFormat", nfmt_buf, "pivotDataField.numberFormat");
+  has_nfmt = out.number_format != nullptr;
+  if (!reader.ok()) {
+    return false;
+  }
+  out.field_index = reader.u32(spec, "fieldIndex", 0U, "pivotDataField.fieldIndex");
+  out.aggregation =
+      static_cast<fm_pivot_aggregation_t>(reader.u32(spec, "aggregation", 0U, "pivotDataField.aggregation"));
+  out.show_as = static_cast<fm_pivot_show_as_t>(reader.u32(spec, "showAs", 0U, "pivotDataField.showAs"));
+  out.show_as_base_field = reader.i32(spec, "showAsBaseField", -1, "pivotDataField.showAsBaseField");
+  out.show_as_base_item = reader.i32(spec, "showAsBaseItem", -1, "pivotDataField.showAsBaseItem");
+  return reader.ok();
+}
+
+}  // namespace
+
 // ---- PivotCache --------------------------------------------------------
 
 JsNumberResult JsWorkbook::pivotCacheCount() const {
@@ -97,9 +122,9 @@ emscripten::val JsWorkbook::pivotCacheGetWorksheetSource(uint32_t cacheId) const
   }
   o.set("status", status_from_rc(rc));
   o.set("present", present != 0);
-  o.set("ref", std::string(ref != nullptr ? ref : ""));
-  o.set("sheet", std::string(sheet != nullptr ? sheet : ""));
-  o.set("name", std::string(name != nullptr ? name : ""));
+  js_set_cstr(o, "ref", ref);
+  js_set_cstr(o, "sheet", sheet);
+  js_set_cstr(o, "name", name);
   return o;
 }
 
@@ -107,16 +132,19 @@ JsStatus JsWorkbook::pivotCacheSetWorksheetSource(uint32_t cacheId, emscripten::
   if (handle_ == nullptr) {
     return error_status(7000);
   }
-  const bool present = js_pull_bool(source, "present", true);
-  const bool has_ref = !source["ref"].isUndefined() && !source["ref"].isNull();
-  const bool has_sheet = !source["sheet"].isUndefined() && !source["sheet"].isNull();
-  const bool has_name = !source["name"].isUndefined() && !source["name"].isNull();
-  const std::string ref = has_ref ? source["ref"].as<std::string>() : std::string();
-  const std::string sheet = has_sheet ? source["sheet"].as<std::string>() : std::string();
-  const std::string name = has_name ? source["name"].as<std::string>() : std::string();
-  fm_status_t rc = fm_workbook_pivot_cache_set_worksheet_source(
-      handle_, cacheId, present ? 1 : 0, has_ref ? ref.c_str() : nullptr, has_sheet ? sheet.c_str() : nullptr,
-      has_name ? name.c_str() : nullptr);
+  std::string ref;
+  std::string sheet;
+  std::string name;
+  JsNarrowNumericReader reader("pivotCacheSetWorksheetSource");
+  const bool present = reader.boolean(source, "present", true, "pivotCacheSource.present");
+  const char* ref_ptr = reader.optional_string(source, "ref", ref, "pivotCacheSource.ref");
+  const char* sheet_ptr = reader.optional_string(source, "sheet", sheet, "pivotCacheSource.sheet");
+  const char* name_ptr = reader.optional_string(source, "name", name, "pivotCacheSource.name");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  fm_status_t rc =
+      fm_workbook_pivot_cache_set_worksheet_source(handle_, cacheId, present ? 1 : 0, ref_ptr, sheet_ptr, name_ptr);
   return status_from_rc(rc);
 }
 
@@ -395,22 +423,32 @@ JsAddStyleResult JsWorkbook::pivotFieldAdd(uint32_t sheet, uint32_t pivotIdx, em
     r.status = error_status(7000);
     return r;
   }
-  const bool has_source = !spec["sourceName"].isUndefined() && !spec["sourceName"].isNull();
-  const std::string source_name = has_source ? spec["sourceName"].as<std::string>() : std::string();
-  const bool has_custom = !spec["customName"].isUndefined() && !spec["customName"].isNull();
-  const std::string custom_name = has_custom ? spec["customName"].as<std::string>() : std::string();
-  const bool has_nfmt = !spec["numberFormat"].isUndefined() && !spec["numberFormat"].isNull();
-  const std::string number_format = has_nfmt ? spec["numberFormat"].as<std::string>() : std::string();
+  std::string source_name;
+  std::string custom_name;
+  std::string number_format;
+  JsNarrowNumericReader reader("pivotFieldAdd");
+  // Every nested read uses this per-call reader so getter/proxy failures and
+  // lossy integer conversions are reported before the C ABI is called.
+  const char* source_name_ptr = reader.optional_string(spec, "sourceName", source_name, "pivotField.sourceName");
+  const char* custom_name_ptr = reader.optional_string(spec, "customName", custom_name, "pivotField.customName");
+  const bool subtotal_top = reader.boolean(spec, "subtotalTop", false, "pivotField.subtotalTop");
+  const char* number_format_ptr =
+      reader.optional_string(spec, "numberFormat", number_format, "pivotField.numberFormat");
 
   fm_pivot_field_spec_t c_spec{};
   // `sourceName` is required; an omitted key passes NULL through rather
   // than `js_pull_string`'s empty-string default, which the C ABI's own
   // required-field check does not treat the same as a missing argument.
-  c_spec.source_name = has_source ? source_name.c_str() : nullptr;
-  c_spec.custom_name = has_custom ? custom_name.c_str() : nullptr;
-  c_spec.axis = static_cast<fm_pivot_axis_t>(js_pull_u32(spec, "axis", 0U));
-  c_spec.subtotal_top = js_pull_bool(spec, "subtotalTop", false) ? 1 : 0;
-  c_spec.number_format = has_nfmt ? number_format.c_str() : nullptr;
+  c_spec.source_name = source_name_ptr;
+  c_spec.custom_name = custom_name_ptr;
+  c_spec.axis = static_cast<fm_pivot_axis_t>(reader.u32(spec, "axis", 0U, "pivotField.axis"));
+  c_spec.subtotal_top = subtotal_top ? 1 : 0;
+  c_spec.number_format = number_format_ptr;
+
+  if (!reader.ok()) {
+    r.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return r;
+  }
 
   std::size_t out = 0;
   fm_status_t rc = fm_workbook_pivot_field_add(handle_, sheet, pivotIdx, &c_spec, &out);
@@ -542,39 +580,49 @@ JsStatus JsWorkbook::pivotFieldSetNumberFormat(uint32_t sheet, uint32_t pivotIdx
 
 namespace {
 
-// Reads a JS number array; undefined / null reads as empty.
-std::vector<uint32_t> u32_list_from_val(const emscripten::val& indices) {
+// Shared body of `pivotSetRowFieldOrder` / `pivotSetColFieldOrder`.
+using PivotFieldOrderFn = fm_status_t (*)(fm_workbook_t*, size_t, size_t, const uint32_t*, size_t);
+
+JsStatus set_pivot_field_order(fm_workbook_t* wb, uint32_t sheet, uint32_t pivotIdx, const emscripten::val& indices,
+                               PivotFieldOrderFn fn) {
+  if (wb == nullptr) {
+    return error_status(7000);
+  }
+  JsNarrowNumericReader reader("pivotFieldOrder");
+  if (indices.isUndefined() || indices.isNull()) {
+    return status_from_rc(fn(wb, sheet, pivotIdx, nullptr, 0));
+  }
+  if (!reader.is_array(indices, "pivotFieldOrder")) {
+    return binding_error_status(kInvalidArgument, "pivot field order must be an array");
+  }
+  const uint32_t length = reader.length(indices, "pivotFieldOrder");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   std::vector<uint32_t> v;
-  if (!indices.isUndefined() && !indices.isNull()) {
-    const uint32_t len = indices["length"].as<uint32_t>();
-    v.reserve(len);
-    for (uint32_t i = 0; i < len; ++i) {
-      v.push_back(indices[i].as<uint32_t>());
-    }
+  v.reserve(length);
+  for (uint32_t i = 0; i < length && reader.ok(); ++i) {
+    // Read the raw element once through the guarded property reader, then
+    // let the checked conversion reject a symbol, fraction, non-finite value,
+    // or uint32 overflow. No subsequent JS reads occur after failure.
+    const std::string key = std::to_string(i);
+    const emscripten::val value = reader.value(indices, key.c_str(), "pivotFieldOrder.indices");
+    v.push_back(reader.u32_value(value, 0U, "pivotFieldOrder.indices"));
+  }
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
   }
-  return v;
+  return status_from_rc(fn(wb, sheet, pivotIdx, v.empty() ? nullptr : v.data(), v.size()));
 }
 
 }  // namespace
 
 JsStatus JsWorkbook::pivotSetRowFieldOrder(uint32_t sheet, uint32_t pivotIdx, emscripten::val indices) {
-  if (handle_ == nullptr) {
-    return error_status(7000);
-  }
-  const std::vector<uint32_t> v = u32_list_from_val(indices);
-  fm_status_t rc =
-      fm_workbook_pivot_set_row_field_order(handle_, sheet, pivotIdx, v.empty() ? nullptr : v.data(), v.size());
-  return status_from_rc(rc);
+  return set_pivot_field_order(handle_, sheet, pivotIdx, indices, &fm_workbook_pivot_set_row_field_order);
 }
 
 JsStatus JsWorkbook::pivotSetColFieldOrder(uint32_t sheet, uint32_t pivotIdx, emscripten::val indices) {
-  if (handle_ == nullptr) {
-    return error_status(7000);
-  }
-  const std::vector<uint32_t> v = u32_list_from_val(indices);
-  fm_status_t rc =
-      fm_workbook_pivot_set_col_field_order(handle_, sheet, pivotIdx, v.empty() ? nullptr : v.data(), v.size());
-  return status_from_rc(rc);
+  return set_pivot_field_order(handle_, sheet, pivotIdx, indices, &fm_workbook_pivot_set_col_field_order);
 }
 
 JsNumberResult JsWorkbook::pivotDataFieldCount(uint32_t sheet, uint32_t pivotIdx) const {
@@ -588,29 +636,8 @@ JsNumberResult JsWorkbook::pivotDataFieldCount(uint32_t sheet, uint32_t pivotIdx
 
 void JsWorkbook::build_data_field_spec(emscripten::val spec, fm_pivot_data_field_spec_t& out, std::string& name_buf,
                                        std::string& nfmt_buf, bool& has_nfmt) {
-  // `name` is required; an omitted key passes NULL through rather than
-  // `js_pull_string`'s empty-string default, which the C ABI's own
-  // required-field check does not treat the same as a missing argument.
-  const bool has_name = !spec["name"].isUndefined() && !spec["name"].isNull();
-  name_buf = has_name ? spec["name"].as<std::string>() : std::string();
-  has_nfmt = !spec["numberFormat"].isUndefined() && !spec["numberFormat"].isNull();
-  nfmt_buf = has_nfmt ? spec["numberFormat"].as<std::string>() : std::string();
-  out.name = has_name ? name_buf.c_str() : nullptr;
-  out.field_index = js_pull_u32(spec, "fieldIndex", 0U);
-  out.aggregation = static_cast<fm_pivot_aggregation_t>(js_pull_u32(spec, "aggregation", 0U));
-  out.number_format = has_nfmt ? nfmt_buf.c_str() : nullptr;
-  out.show_as = static_cast<fm_pivot_show_as_t>(js_pull_u32(spec, "showAs", 0U));
-  // -1 sentinels are explicitly modelled as int32; treat absent/null as -1.
-  if (!spec["showAsBaseField"].isUndefined() && !spec["showAsBaseField"].isNull()) {
-    out.show_as_base_field = spec["showAsBaseField"].as<int32_t>();
-  } else {
-    out.show_as_base_field = -1;
-  }
-  if (!spec["showAsBaseItem"].isUndefined() && !spec["showAsBaseItem"].isNull()) {
-    out.show_as_base_item = spec["showAsBaseItem"].as<int32_t>();
-  } else {
-    out.show_as_base_item = -1;
-  }
+  JsNarrowNumericReader reader("buildDataFieldSpec");
+  (void)build_data_field_spec_checked(reader, spec, out, name_buf, nfmt_buf, has_nfmt);
 }
 
 JsAddStyleResult JsWorkbook::pivotDataFieldAdd(uint32_t sheet, uint32_t pivotIdx, emscripten::val spec) {
@@ -623,7 +650,11 @@ JsAddStyleResult JsWorkbook::pivotDataFieldAdd(uint32_t sheet, uint32_t pivotIdx
   std::string name_buf;
   std::string nfmt_buf;
   bool has_nfmt = false;
-  build_data_field_spec(spec, c_spec, name_buf, nfmt_buf, has_nfmt);
+  JsNarrowNumericReader reader("pivotDataFieldAdd");
+  if (!build_data_field_spec_checked(reader, spec, c_spec, name_buf, nfmt_buf, has_nfmt)) {
+    r.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return r;
+  }
   std::size_t out = 0;
   fm_status_t rc = fm_workbook_pivot_data_field_add(handle_, sheet, pivotIdx, &c_spec, &out);
   if (rc != 0) {
@@ -651,7 +682,10 @@ JsStatus JsWorkbook::pivotDataFieldSet(uint32_t sheet, uint32_t pivotIdx, uint32
   std::string name_buf;
   std::string nfmt_buf;
   bool has_nfmt = false;
-  build_data_field_spec(spec, c_spec, name_buf, nfmt_buf, has_nfmt);
+  JsNarrowNumericReader reader("pivotDataFieldSet");
+  if (!build_data_field_spec_checked(reader, spec, c_spec, name_buf, nfmt_buf, has_nfmt)) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   fm_status_t rc = fm_workbook_pivot_data_field_set(handle_, sheet, pivotIdx, dataFieldIdx, &c_spec);
   return status_from_rc(rc);
 }
@@ -672,38 +706,34 @@ JsStatus JsWorkbook::pivotFilterAdd(uint32_t sheet, uint32_t pivotIdx, emscripte
   // `fieldName` is required; an omitted key passes NULL through rather
   // than `js_pull_string`'s empty-string default, which the C ABI's own
   // required-field check does not treat the same as a missing argument.
-  const bool has_field = !spec["fieldName"].isUndefined() && !spec["fieldName"].isNull();
-  const std::string field_name = has_field ? spec["fieldName"].as<std::string>() : std::string();
-  const bool has_text = !spec["valueText"].isUndefined() && !spec["valueText"].isNull();
-  const std::string value_text = has_text ? spec["valueText"].as<std::string>() : std::string();
+  std::string field_name;
+  std::string value_text;
+  JsNarrowNumericReader reader("pivotFilterAdd");
+  const char* field_name_ptr = reader.optional_string(spec, "fieldName", field_name, "pivotFilter.fieldName");
+  const double value_double = reader.number(spec, "valueDouble", 0.0, "pivotFilter.valueDouble");
+  const char* value_text_ptr = reader.optional_string(spec, "valueText", value_text, "pivotFilter.valueText");
+  const double value_high_double = reader.number(spec, "valueHighDouble", 0.0, "pivotFilter.valueHighDouble");
 
   fm_pivot_filter_spec_t c_spec{};
-  c_spec.axis = static_cast<fm_pivot_axis_t>(js_pull_u32(spec, "axis", 0U));
-  c_spec.field_name = has_field ? field_name.c_str() : nullptr;
-  c_spec.type = static_cast<fm_pivot_filter_type_t>(js_pull_u32(spec, "type", 0U));
+  c_spec.axis = static_cast<fm_pivot_axis_t>(reader.u32(spec, "axis", 0U, "pivotFilter.axis"));
+  c_spec.field_name = field_name_ptr;
+  c_spec.type = static_cast<fm_pivot_filter_type_t>(reader.u32(spec, "type", 0U, "pivotFilter.type"));
   // valueKind defaults to NONE (-1) when omitted; the C ABI rejects NONE
   // for non-range filters.
-  if (!spec["valueKind"].isUndefined() && !spec["valueKind"].isNull()) {
-    c_spec.value_kind = static_cast<fm_pivot_filter_value_kind_t>(spec["valueKind"].as<int32_t>());
-  } else {
-    c_spec.value_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  }
-  c_spec.value_int =
-      (!spec["valueInt"].isUndefined() && !spec["valueInt"].isNull()) ? spec["valueInt"].as<int32_t>() : 0;
-  c_spec.value_double =
-      (!spec["valueDouble"].isUndefined() && !spec["valueDouble"].isNull()) ? spec["valueDouble"].as<double>() : 0.0;
-  c_spec.value_text = has_text ? value_text.c_str() : nullptr;
-  if (!spec["valueHighKind"].isUndefined() && !spec["valueHighKind"].isNull()) {
-    c_spec.value_high_kind = static_cast<fm_pivot_filter_value_kind_t>(spec["valueHighKind"].as<int32_t>());
-  } else {
-    c_spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  }
-  c_spec.value_high_int =
-      (!spec["valueHighInt"].isUndefined() && !spec["valueHighInt"].isNull()) ? spec["valueHighInt"].as<int32_t>() : 0;
-  c_spec.value_high_double = (!spec["valueHighDouble"].isUndefined() && !spec["valueHighDouble"].isNull())
-                                 ? spec["valueHighDouble"].as<double>()
-                                 : 0.0;
-  c_spec.data_field_index = js_pull_u32(spec, "dataFieldIndex", 0U);
+  c_spec.value_kind = static_cast<fm_pivot_filter_value_kind_t>(
+      reader.i32(spec, "valueKind", FM_PIVOT_FILTER_VALUE_NONE, "pivotFilter.valueKind"));
+  c_spec.value_int = reader.i32(spec, "valueInt", 0, "pivotFilter.valueInt");
+  c_spec.value_double = value_double;
+  c_spec.value_text = value_text_ptr;
+  c_spec.value_high_kind = static_cast<fm_pivot_filter_value_kind_t>(
+      reader.i32(spec, "valueHighKind", FM_PIVOT_FILTER_VALUE_NONE, "pivotFilter.valueHighKind"));
+  c_spec.value_high_int = reader.i32(spec, "valueHighInt", 0, "pivotFilter.valueHighInt");
+  c_spec.value_high_double = value_high_double;
+  c_spec.data_field_index = reader.u32(spec, "dataFieldIndex", 0U, "pivotFilter.dataFieldIndex");
+
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
 
   fm_status_t rc = fm_workbook_pivot_filter_add(handle_, sheet, pivotIdx, &c_spec);
   return status_from_rc(rc);
@@ -719,13 +749,13 @@ emscripten::val JsWorkbook::pivotFilterAt(uint32_t sheet, uint32_t pivotIdx, uin
   }
   o.set("status", status_from_rc(rc));
   o.set("axis", static_cast<int32_t>(spec.axis));
-  o.set("fieldName", std::string(spec.field_name != nullptr ? spec.field_name : ""));
+  js_set_cstr(o, "fieldName", spec.field_name);
   o.set("type", static_cast<int32_t>(spec.type));
   o.set("dataFieldIndex", spec.data_field_index);
   o.set("valueKind", static_cast<int32_t>(spec.value_kind));
   o.set("valueInt", spec.value_int);
   o.set("valueDouble", spec.value_double);
-  o.set("valueText", std::string(spec.value_text != nullptr ? spec.value_text : ""));
+  js_set_cstr(o, "valueText", spec.value_text);
   o.set("valueHighKind", static_cast<int32_t>(spec.value_high_kind));
   o.set("valueHighInt", spec.value_high_int);
   o.set("valueHighDouble", spec.value_high_double);
diff --git a/src/wasm/parts/workbook_print.cpp b/src/wasm/parts/workbook_print.cpp
index b7805b8d4..fdfdc5af9 100644
--- a/src/wasm/parts/workbook_print.cpp
+++ b/src/wasm/parts/workbook_print.cpp
@@ -9,10 +9,10 @@
 // break enumerators return arrays rather than count + getter pairs,
 // matching the rest of the JS surface.
 //
-// The patch setters read each field with the shared `js_pull_*` helpers and
-// derive the `_engaged` flag from key presence, so `{ orientation: 1 }`
-// changes the orientation and nothing else - the same semantics the C
-// struct spells out with explicit flags.
+// The patch setters snapshot each field through JsNarrowNumericReader before
+// deriving its `_engaged` flag. This keeps getter/proxy failures and lossy
+// primitive conversions inside the binding boundary, while `{ orientation:
+// 1 }` still changes the orientation and nothing else.
 //
 // @size-budget: 8 KB
 
@@ -35,6 +35,10 @@ namespace {
 using XmlGetter = fm_status_t (*)(const fm_workbook_t*, size_t, const char**);
 using XmlSetter = fm_status_t (*)(fm_workbook_t*, size_t, const char*);
 
+bool value_present(const emscripten::val& value) {
+  return !value.isUndefined() && !value.isNull();
+}
+
 emscripten::val xml_result(const fm_workbook_t* handle, uint32_t sheet, XmlGetter getter) {
   emscripten::val out = emscripten::val::object();
   if (handle == nullptr) {
@@ -50,7 +54,7 @@ emscripten::val xml_result(const fm_workbook_t* handle, uint32_t sheet, XmlGette
     return out;
   }
   out.set("status", ok_status());
-  out.set("xml", xml != nullptr ? std::string(xml) : std::string());
+  js_set_cstr(out, "xml", xml);
   return out;
 }
 
@@ -91,23 +95,6 @@ emscripten::val breaks_array(const fm_workbook_t* handle, uint32_t sheet, bool r
   return out;
 }
 
-/// Reads an optional string field as the C tri-state: a missing key stays
-/// `nullptr` (leave the section alone), a present one owns its bytes in
-/// `storage` so the pointer outlives this call.
-const char* pull_optional_string(const emscripten::val& object, const char* key, std::string& storage) {
-  const emscripten::val field = object[key];
-  if (field.isUndefined() || field.isNull()) {
-    return nullptr;
-  }
-  storage = field.as<std::string>();
-  return storage.c_str();
-}
-
-bool has_field(const emscripten::val& object, const char* key) {
-  const emscripten::val field = object[key];
-  return !field.isUndefined() && !field.isNull();
-}
-
 }  // namespace
 
 // ---- Raw XML -----------------------------------------------------------
@@ -176,7 +163,7 @@ emscripten::val JsWorkbook::getSheetPrintArea(uint32_t sheet) const {
     return out;
   }
   out.set("status", ok_status());
-  out.set("ranges", ranges != nullptr ? std::string(ranges) : std::string());
+  js_set_cstr(out, "ranges", ranges);
   return out;
 }
 
@@ -205,8 +192,8 @@ emscripten::val JsWorkbook::getSheetPrintTitles(uint32_t sheet) const {
     return out;
   }
   out.set("status", ok_status());
-  out.set("repeatRows", rows != nullptr ? std::string(rows) : std::string());
-  out.set("repeatCols", cols != nullptr ? std::string(cols) : std::string());
+  js_set_cstr(out, "repeatRows", rows);
+  js_set_cstr(out, "repeatCols", cols);
   return out;
 }
 
@@ -268,19 +255,29 @@ JsStatus JsWorkbook::setSheetPageSetup(uint32_t sheet, emscripten::val setup) {
   if (handle_ == nullptr) {
     return error_status(7000);
   }
+  JsNarrowNumericReader reader("setSheetPageSetup");
   fm_page_setup_t out{};
-  out.orientation_engaged = has_field(setup, "orientation") ? 1 : 0;
-  out.orientation = js_pull_u32(setup, "orientation", 0U);
-  out.paper_size_engaged = has_field(setup, "paperSize") ? 1 : 0;
-  out.paper_size = js_pull_u32(setup, "paperSize", 0U);
-  out.scale_engaged = has_field(setup, "scale") ? 1 : 0;
-  out.scale = js_pull_u32(setup, "scale", 0U);
-  out.fit_to_width_engaged = has_field(setup, "fitToWidth") ? 1 : 0;
-  out.fit_to_width = js_pull_u32(setup, "fitToWidth", 0U);
-  out.fit_to_height_engaged = has_field(setup, "fitToHeight") ? 1 : 0;
-  out.fit_to_height = js_pull_u32(setup, "fitToHeight", 0U);
-  out.fit_to_page_engaged = has_field(setup, "fitToPage") ? 1 : 0;
-  out.fit_to_page = js_pull_bool(setup, "fitToPage", false) ? 1 : 0;
+  const emscripten::val orientation = reader.value(setup, "orientation", "pageSetup.orientation");
+  out.orientation_engaged = value_present(orientation) ? 1 : 0;
+  out.orientation = reader.u32_value(orientation, 0U, "pageSetup.orientation");
+  const emscripten::val paper_size = reader.value(setup, "paperSize", "pageSetup.paperSize");
+  out.paper_size_engaged = value_present(paper_size) ? 1 : 0;
+  out.paper_size = reader.u32_value(paper_size, 0U, "pageSetup.paperSize");
+  const emscripten::val scale = reader.value(setup, "scale", "pageSetup.scale");
+  out.scale_engaged = value_present(scale) ? 1 : 0;
+  out.scale = reader.u32_value(scale, 0U, "pageSetup.scale");
+  const emscripten::val fit_to_width = reader.value(setup, "fitToWidth", "pageSetup.fitToWidth");
+  out.fit_to_width_engaged = value_present(fit_to_width) ? 1 : 0;
+  out.fit_to_width = reader.u32_value(fit_to_width, 0U, "pageSetup.fitToWidth");
+  const emscripten::val fit_to_height = reader.value(setup, "fitToHeight", "pageSetup.fitToHeight");
+  out.fit_to_height_engaged = value_present(fit_to_height) ? 1 : 0;
+  out.fit_to_height = reader.u32_value(fit_to_height, 0U, "pageSetup.fitToHeight");
+  const emscripten::val fit_to_page = reader.value(setup, "fitToPage", "pageSetup.fitToPage");
+  out.fit_to_page_engaged = value_present(fit_to_page) ? 1 : 0;
+  out.fit_to_page = reader.boolean_value(fit_to_page, false, "pageSetup.fitToPage") ? 1 : 0;
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   return status_from_rc(fm_sheet_set_page_setup(handle_, sheet, &out));
 }
 
@@ -288,19 +285,29 @@ JsStatus JsWorkbook::setSheetPageMargins(uint32_t sheet, emscripten::val margins
   if (handle_ == nullptr) {
     return error_status(7000);
   }
+  JsNarrowNumericReader reader("setSheetPageMargins");
   fm_page_margins_t out{};
-  out.left_engaged = has_field(margins, "left") ? 1 : 0;
-  out.left = js_pull_double(margins, "left", 0.0);
-  out.right_engaged = has_field(margins, "right") ? 1 : 0;
-  out.right = js_pull_double(margins, "right", 0.0);
-  out.top_engaged = has_field(margins, "top") ? 1 : 0;
-  out.top = js_pull_double(margins, "top", 0.0);
-  out.bottom_engaged = has_field(margins, "bottom") ? 1 : 0;
-  out.bottom = js_pull_double(margins, "bottom", 0.0);
-  out.header_engaged = has_field(margins, "header") ? 1 : 0;
-  out.header = js_pull_double(margins, "header", 0.0);
-  out.footer_engaged = has_field(margins, "footer") ? 1 : 0;
-  out.footer = js_pull_double(margins, "footer", 0.0);
+  const emscripten::val left = reader.value(margins, "left", "pageMargins.left");
+  out.left_engaged = value_present(left) ? 1 : 0;
+  out.left = reader.number_value(left, 0.0, "pageMargins.left");
+  const emscripten::val right = reader.value(margins, "right", "pageMargins.right");
+  out.right_engaged = value_present(right) ? 1 : 0;
+  out.right = reader.number_value(right, 0.0, "pageMargins.right");
+  const emscripten::val top = reader.value(margins, "top", "pageMargins.top");
+  out.top_engaged = value_present(top) ? 1 : 0;
+  out.top = reader.number_value(top, 0.0, "pageMargins.top");
+  const emscripten::val bottom = reader.value(margins, "bottom", "pageMargins.bottom");
+  out.bottom_engaged = value_present(bottom) ? 1 : 0;
+  out.bottom = reader.number_value(bottom, 0.0, "pageMargins.bottom");
+  const emscripten::val header = reader.value(margins, "header", "pageMargins.header");
+  out.header_engaged = value_present(header) ? 1 : 0;
+  out.header = reader.number_value(header, 0.0, "pageMargins.header");
+  const emscripten::val footer = reader.value(margins, "footer", "pageMargins.footer");
+  out.footer_engaged = value_present(footer) ? 1 : 0;
+  out.footer = reader.number_value(footer, 0.0, "pageMargins.footer");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   return status_from_rc(fm_sheet_set_page_margins(handle_, sheet, &out));
 }
 
@@ -308,15 +315,24 @@ JsStatus JsWorkbook::setSheetPrintOptions(uint32_t sheet, emscripten::val option
   if (handle_ == nullptr) {
     return error_status(7000);
   }
+  JsNarrowNumericReader reader("setSheetPrintOptions");
   fm_print_options_t out{};
-  out.grid_lines_engaged = has_field(options, "gridLines") ? 1 : 0;
-  out.grid_lines = js_pull_bool(options, "gridLines", false) ? 1 : 0;
-  out.headings_engaged = has_field(options, "headings") ? 1 : 0;
-  out.headings = js_pull_bool(options, "headings", false) ? 1 : 0;
-  out.horizontal_centered_engaged = has_field(options, "horizontalCentered") ? 1 : 0;
-  out.horizontal_centered = js_pull_bool(options, "horizontalCentered", false) ? 1 : 0;
-  out.vertical_centered_engaged = has_field(options, "verticalCentered") ? 1 : 0;
-  out.vertical_centered = js_pull_bool(options, "verticalCentered", false) ? 1 : 0;
+  const emscripten::val grid_lines = reader.value(options, "gridLines", "printOptions.gridLines");
+  out.grid_lines_engaged = value_present(grid_lines) ? 1 : 0;
+  out.grid_lines = reader.boolean_value(grid_lines, false, "printOptions.gridLines") ? 1 : 0;
+  const emscripten::val headings = reader.value(options, "headings", "printOptions.headings");
+  out.headings_engaged = value_present(headings) ? 1 : 0;
+  out.headings = reader.boolean_value(headings, false, "printOptions.headings") ? 1 : 0;
+  const emscripten::val horizontal_centered =
+      reader.value(options, "horizontalCentered", "printOptions.horizontalCentered");
+  out.horizontal_centered_engaged = value_present(horizontal_centered) ? 1 : 0;
+  out.horizontal_centered = reader.boolean_value(horizontal_centered, false, "printOptions.horizontalCentered") ? 1 : 0;
+  const emscripten::val vertical_centered = reader.value(options, "verticalCentered", "printOptions.verticalCentered");
+  out.vertical_centered_engaged = value_present(vertical_centered) ? 1 : 0;
+  out.vertical_centered = reader.boolean_value(vertical_centered, false, "printOptions.verticalCentered") ? 1 : 0;
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   return status_from_rc(fm_sheet_set_print_options(handle_, sheet, &out));
 }
 
@@ -332,21 +348,37 @@ JsStatus JsWorkbook::setSheetHeaderFooter(uint32_t sheet, emscripten::val header
   std::string even_footer;
   std::string first_header;
   std::string first_footer;
+  JsNarrowNumericReader reader("setSheetHeaderFooter");
   fm_header_footer_t out{};
-  out.odd_header = pull_optional_string(headerFooter, "oddHeader", odd_header);
-  out.odd_footer = pull_optional_string(headerFooter, "oddFooter", odd_footer);
-  out.even_header = pull_optional_string(headerFooter, "evenHeader", even_header);
-  out.even_footer = pull_optional_string(headerFooter, "evenFooter", even_footer);
-  out.first_header = pull_optional_string(headerFooter, "firstHeader", first_header);
-  out.first_footer = pull_optional_string(headerFooter, "firstFooter", first_footer);
-  out.different_odd_even_engaged = has_field(headerFooter, "differentOddEven") ? 1 : 0;
-  out.different_odd_even = js_pull_bool(headerFooter, "differentOddEven", false) ? 1 : 0;
-  out.different_first_engaged = has_field(headerFooter, "differentFirst") ? 1 : 0;
-  out.different_first = js_pull_bool(headerFooter, "differentFirst", false) ? 1 : 0;
-  out.scale_with_doc_engaged = has_field(headerFooter, "scaleWithDoc") ? 1 : 0;
-  out.scale_with_doc = js_pull_bool(headerFooter, "scaleWithDoc", false) ? 1 : 0;
-  out.align_with_margins_engaged = has_field(headerFooter, "alignWithMargins") ? 1 : 0;
-  out.align_with_margins = js_pull_bool(headerFooter, "alignWithMargins", false) ? 1 : 0;
+  const emscripten::val odd_header_value = reader.value(headerFooter, "oddHeader", "headerFooter.oddHeader");
+  out.odd_header = reader.optional_string_value(odd_header_value, odd_header, "headerFooter.oddHeader");
+  const emscripten::val odd_footer_value = reader.value(headerFooter, "oddFooter", "headerFooter.oddFooter");
+  out.odd_footer = reader.optional_string_value(odd_footer_value, odd_footer, "headerFooter.oddFooter");
+  const emscripten::val even_header_value = reader.value(headerFooter, "evenHeader", "headerFooter.evenHeader");
+  out.even_header = reader.optional_string_value(even_header_value, even_header, "headerFooter.evenHeader");
+  const emscripten::val even_footer_value = reader.value(headerFooter, "evenFooter", "headerFooter.evenFooter");
+  out.even_footer = reader.optional_string_value(even_footer_value, even_footer, "headerFooter.evenFooter");
+  const emscripten::val first_header_value = reader.value(headerFooter, "firstHeader", "headerFooter.firstHeader");
+  out.first_header = reader.optional_string_value(first_header_value, first_header, "headerFooter.firstHeader");
+  const emscripten::val first_footer_value = reader.value(headerFooter, "firstFooter", "headerFooter.firstFooter");
+  out.first_footer = reader.optional_string_value(first_footer_value, first_footer, "headerFooter.firstFooter");
+  const emscripten::val different_odd_even =
+      reader.value(headerFooter, "differentOddEven", "headerFooter.differentOddEven");
+  out.different_odd_even_engaged = value_present(different_odd_even) ? 1 : 0;
+  out.different_odd_even = reader.boolean_value(different_odd_even, false, "headerFooter.differentOddEven") ? 1 : 0;
+  const emscripten::val different_first = reader.value(headerFooter, "differentFirst", "headerFooter.differentFirst");
+  out.different_first_engaged = value_present(different_first) ? 1 : 0;
+  out.different_first = reader.boolean_value(different_first, false, "headerFooter.differentFirst") ? 1 : 0;
+  const emscripten::val scale_with_doc = reader.value(headerFooter, "scaleWithDoc", "headerFooter.scaleWithDoc");
+  out.scale_with_doc_engaged = value_present(scale_with_doc) ? 1 : 0;
+  out.scale_with_doc = reader.boolean_value(scale_with_doc, false, "headerFooter.scaleWithDoc") ? 1 : 0;
+  const emscripten::val align_with_margins =
+      reader.value(headerFooter, "alignWithMargins", "headerFooter.alignWithMargins");
+  out.align_with_margins_engaged = value_present(align_with_margins) ? 1 : 0;
+  out.align_with_margins = reader.boolean_value(align_with_margins, false, "headerFooter.alignWithMargins") ? 1 : 0;
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   return status_from_rc(fm_sheet_set_header_footer(handle_, sheet, &out));
 }
 
diff --git a/src/wasm/parts/workbook_sheet_layout.cpp b/src/wasm/parts/workbook_sheet_layout.cpp
index db3bccaf9..60201a277 100644
--- a/src/wasm/parts/workbook_sheet_layout.cpp
+++ b/src/wasm/parts/workbook_sheet_layout.cpp
@@ -14,6 +14,103 @@ namespace formulon {
 namespace wasm {
 namespace parts {
 
+namespace {
+
+emscripten::val js_rect_pt(const fm_rect_pt& r) {
+  emscripten::val o = emscripten::val::object();
+  o.set("x", r.x);
+  o.set("y", r.y);
+  o.set("width", r.width);
+  o.set("height", r.height);
+  return o;
+}
+
+/// Writes the pagination detail keys onto `result`. A null `pagination`
+/// yields the all-zero record, so the key set does not depend on whether
+/// the layout succeeded.
+void set_pagination_detail(emscripten::val* result, const fm_pagination_t* pagination) {
+  fm_paper_info paper{};
+  fm_margins_pt margins{};
+  fm_rect_pt printable{};
+  double scale = 0.0;
+  int32_t page_order = 0;
+  fm_print_titles titles{};
+  std::size_t page_count = 0;
+  std::size_t horizontal_count = 0;
+  std::size_t vertical_count = 0;
+  if (pagination != nullptr) {
+    fm_pagination_paper(pagination, &paper);
+    fm_pagination_margins(pagination, &margins);
+    fm_pagination_printable(pagination, &printable);
+    fm_pagination_scale(pagination, &scale);
+    fm_pagination_page_order(pagination, &page_order);
+    fm_pagination_print_titles(pagination, &titles);
+    page_count = fm_pagination_page_count(pagination);
+    horizontal_count = fm_pagination_horizontal_break_count(pagination);
+    vertical_count = fm_pagination_vertical_break_count(pagination);
+  }
+  emscripten::val paper_val = emscripten::val::object();
+  paper_val.set("widthPt", paper.width_pt);
+  paper_val.set("heightPt", paper.height_pt);
+  paper_val.set("landscape", paper.landscape != 0);
+  paper_val.set("known", paper.known != 0);
+  result->set("paper", paper_val);
+  emscripten::val margins_val = emscripten::val::object();
+  margins_val.set("left", margins.left);
+  margins_val.set("right", margins.right);
+  margins_val.set("top", margins.top);
+  margins_val.set("bottom", margins.bottom);
+  margins_val.set("header", margins.header);
+  margins_val.set("footer", margins.footer);
+  result->set("margins", margins_val);
+  result->set("printable", js_rect_pt(printable));
+  result->set("scale", scale);
+  result->set("pageOrder", page_order);
+  emscripten::val titles_val = emscripten::val::object();
+  titles_val.set("hasRows", titles.has_rows != 0);
+  titles_val.set("firstRow", titles.first_row);
+  titles_val.set("lastRow", titles.last_row);
+  titles_val.set("hasCols", titles.has_cols != 0);
+  titles_val.set("firstCol", titles.first_col);
+  titles_val.set("lastCol", titles.last_col);
+  result->set("printTitles", titles_val);
+  emscripten::val pages = emscripten::val::array();
+  for (std::size_t i = 0; i < page_count; ++i) {
+    fm_page_layout page{};
+    if (fm_pagination_page_at(pagination, i, &page) != 0) {
+      continue;
+    }
+    emscripten::val item = emscripten::val::object();
+    item.set("areaIndex", page.area_index);
+    item.set("firstRow", page.first_row);
+    item.set("lastRow", page.last_row);
+    item.set("firstCol", page.first_col);
+    item.set("lastCol", page.last_col);
+    item.set("originXPt", page.origin_x_pt);
+    item.set("originYPt", page.origin_y_pt);
+    item.set("widthPt", page.width_pt);
+    item.set("heightPt", page.height_pt);
+    pages.call<void>("push", item);
+  }
+  result->set("pages", pages);
+  emscripten::val horizontal_manual = emscripten::val::array();
+  for (std::size_t i = 0; i < horizontal_count; ++i) {
+    int32_t manual = 0;
+    fm_pagination_horizontal_break_is_manual(pagination, i, &manual);
+    horizontal_manual.call<void>("push", manual != 0);
+  }
+  result->set("horizontalBreakManual", horizontal_manual);
+  emscripten::val vertical_manual = emscripten::val::array();
+  for (std::size_t i = 0; i < vertical_count; ++i) {
+    int32_t manual = 0;
+    fm_pagination_vertical_break_is_manual(pagination, i, &manual);
+    vertical_manual.call<void>("push", manual != 0);
+  }
+  result->set("verticalBreakManual", vertical_manual);
+}
+
+}  // namespace
+
 emscripten::val JsWorkbook::paginate(uint32_t sheet) const {
   emscripten::val result = emscripten::val::object();
   emscripten::val print_area = emscripten::val::array();
@@ -25,6 +122,7 @@ emscripten::val JsWorkbook::paginate(uint32_t sheet) const {
     result.set("horizontalBreaks", horizontal_breaks);
     result.set("verticalBreaks", vertical_breaks);
     result.set("pageCount", 0);
+    set_pagination_detail(&result, nullptr);
     return result;
   }
   fm_pagination_t* pagination = nullptr;
@@ -35,6 +133,7 @@ emscripten::val JsWorkbook::paginate(uint32_t sheet) const {
     result.set("horizontalBreaks", horizontal_breaks);
     result.set("verticalBreaks", vertical_breaks);
     result.set("pageCount", 0);
+    set_pagination_detail(&result, nullptr);
     return result;
   }
   const std::size_t area_count = fm_pagination_print_area_count(pagination);
@@ -69,6 +168,7 @@ emscripten::val JsWorkbook::paginate(uint32_t sheet) const {
   result.set("horizontalBreaks", horizontal_breaks);
   result.set("verticalBreaks", vertical_breaks);
   result.set("pageCount", fm_pagination_page_count(pagination));
+  set_pagination_detail(&result, pagination);
   fm_pagination_destroy(pagination);
   return result;
 }
@@ -138,10 +238,37 @@ JsSheetProtectionResult JsWorkbook::getSheetProtection(uint32_t sheet) const {
   return r;
 }
 
-JsStatus JsWorkbook::setSheetProtection(uint32_t sheet, JsSheetProtection in) {
+JsStatus JsWorkbook::setSheetProtection(uint32_t sheet, emscripten::val input) {
   if (handle_ == nullptr) {
     return error_status(7000);
   }
+  JsNarrowNumericReader reader("setSheetProtection");
+  JsSheetProtection in{};
+  in.enabled = reader.i32(input, "enabled", 0, "protection.enabled");
+  in.algorithmName = reader.string(input, "algorithmName", "protection.algorithmName");
+  in.hashValue = reader.string(input, "hashValue", "protection.hashValue");
+  in.saltValue = reader.string(input, "saltValue", "protection.saltValue");
+  in.spinCount = reader.u32(input, "spinCount", 0U, "protection.spinCount");
+  in.legacyPassword = reader.string(input, "legacyPassword", "protection.legacyPassword");
+  in.sheet = reader.i32(input, "sheet", 0, "protection.sheet");
+  in.objects = reader.i32(input, "objects", 0, "protection.objects");
+  in.scenarios = reader.i32(input, "scenarios", 0, "protection.scenarios");
+  in.formatCells = reader.i32(input, "formatCells", 0, "protection.formatCells");
+  in.formatColumns = reader.i32(input, "formatColumns", 0, "protection.formatColumns");
+  in.formatRows = reader.i32(input, "formatRows", 0, "protection.formatRows");
+  in.insertColumns = reader.i32(input, "insertColumns", 0, "protection.insertColumns");
+  in.insertRows = reader.i32(input, "insertRows", 0, "protection.insertRows");
+  in.insertHyperlinks = reader.i32(input, "insertHyperlinks", 0, "protection.insertHyperlinks");
+  in.deleteColumns = reader.i32(input, "deleteColumns", 0, "protection.deleteColumns");
+  in.deleteRows = reader.i32(input, "deleteRows", 0, "protection.deleteRows");
+  in.selectLockedCells = reader.i32(input, "selectLockedCells", 0, "protection.selectLockedCells");
+  in.selectUnlockedCells = reader.i32(input, "selectUnlockedCells", 0, "protection.selectUnlockedCells");
+  in.sort = reader.i32(input, "sort", 0, "protection.sort");
+  in.autoFilter = reader.i32(input, "autoFilter", 0, "protection.autoFilter");
+  in.pivotTables = reader.i32(input, "pivotTables", 0, "protection.pivotTables");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   fm_sheet_protection_t p{};
   p.enabled = in.enabled;
   p.algorithm_name = in.algorithmName.c_str();
@@ -348,6 +475,8 @@ emscripten::val JsWorkbook::getSheetRowOverrides(uint32_t sheet) const {
     out.set("outlineLevel", static_cast<int32_t>(entry.outline_level));
     out.set("hasStyle", entry.has_style ? 1 : 0);
     out.set("styleXf", entry.style_xf);
+    out.set("hasHeight", entry.has_height ? 1 : 0);
+    out.set("customHeight", entry.custom_height ? 1 : 0);
     rows.set(emitted, out);
     ++emitted;
   }
@@ -383,6 +512,124 @@ JsStatus JsWorkbook::setRowOutline(uint32_t sheet, uint32_t row, uint32_t level)
   return status_from_rc(rc);
 }
 
+JsStatus JsWorkbook::clearRowHeight(uint32_t sheet, uint32_t row) {
+  if (handle_ == nullptr) {
+    return error_status(7000);
+  }
+  return status_from_rc(fm_sheet_clear_row_height(handle_, sheet, row));
+}
+
+// ---- Sheet format defaults and point geometry ---------------------------
+
+emscripten::val JsWorkbook::getSheetFormatDefaults(uint32_t sheet) const {
+  fm_sheet_format_defaults d{};
+  const fm_status_t rc = handle_ != nullptr ? fm_sheet_get_format_defaults(handle_, sheet, &d) : 7000;
+  if (rc != 0) {
+    d = fm_sheet_format_defaults{};
+  }
+  emscripten::val o = emscripten::val::object();
+  o.set("status", status_from_rc(rc));
+  o.set("defaultColWidth", d.default_col_width);
+  o.set("defaultRowHeight", d.default_row_height);
+  o.set("baseColWidth", d.base_col_width);
+  o.set("hasDefaultColWidth", d.has_default_col_width != 0);
+  o.set("hasDefaultRowHeight", d.has_default_row_height != 0);
+  return o;
+}
+
+JsStatus JsWorkbook::setSheetFormatDefaults(uint32_t sheet, emscripten::val defaults) {
+  if (handle_ == nullptr) {
+    return error_status(7000);
+  }
+  JsNarrowNumericReader reader("setSheetFormatDefaults");
+  const emscripten::val default_col_width = reader.value(defaults, "defaultColWidth", "format.defaultColWidth");
+  const emscripten::val default_row_height = reader.value(defaults, "defaultRowHeight", "format.defaultRowHeight");
+  const emscripten::val base_col_width = reader.value(defaults, "baseColWidth", "format.baseColWidth");
+  const emscripten::val has_default_col_width =
+      reader.value(defaults, "hasDefaultColWidth", "format.hasDefaultColWidth");
+  const emscripten::val has_default_row_height =
+      reader.value(defaults, "hasDefaultRowHeight", "format.hasDefaultRowHeight");
+  const bool default_col_width_present = !default_col_width.isUndefined() && !default_col_width.isNull();
+  const bool default_row_height_present = !default_row_height.isUndefined() && !default_row_height.isNull();
+  fm_sheet_format_defaults d{};
+  d.default_col_width = reader.number_value(default_col_width, 0.0, "format.defaultColWidth");
+  d.default_row_height = reader.number_value(default_row_height, 0.0, "format.defaultRowHeight");
+  d.base_col_width = reader.number_value(base_col_width, 8.0, "format.baseColWidth");
+  d.has_default_col_width =
+      reader.boolean_value(has_default_col_width, default_col_width_present, "format.hasDefaultColWidth") ? 1 : 0;
+  d.has_default_row_height =
+      reader.boolean_value(has_default_row_height, default_row_height_present, "format.hasDefaultRowHeight") ? 1 : 0;
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  return status_from_rc(fm_sheet_set_format_defaults(handle_, sheet, &d));
+}
+
+emscripten::val JsWorkbook::getCellRectPt(uint32_t sheet, emscripten::val range, int32_t mode) const {
+  fm_rect_pt r{};
+  JsStatus status;
+  if (handle_ == nullptr) {
+    status = error_status(kBindingInvalidHandle);
+  } else {
+    JsNarrowNumericReader reader("getCellRectPt");
+    const fm_merge_range b = js_pull_range(range, &reader);
+    if (!reader.ok()) {
+      status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    } else {
+      const fm_status_t rc =
+          fm_sheet_cell_rect_pt(handle_, sheet, b.first_row, b.first_col, b.last_row, b.last_col, mode, &r);
+      status = status_from_rc(rc);
+      if (rc != 0) {
+        r = fm_rect_pt{};
+      }
+    }
+  }
+  emscripten::val o = js_rect_pt(r);
+  o.set("status", status);
+  return o;
+}
+
+JsNumberResult JsWorkbook::getColumnWidthPt(uint32_t sheet, uint32_t col, int32_t mode) const {
+  double pt = 0.0;
+  const fm_status_t rc = handle_ != nullptr ? fm_sheet_column_width_pt(handle_, sheet, col, mode, &pt) : 7000;
+  return number_result(rc, pt);
+}
+
+JsNumberResult JsWorkbook::getRowHeightPt(uint32_t sheet, uint32_t row) const {
+  double pt = 0.0;
+  const fm_status_t rc = handle_ != nullptr ? fm_sheet_row_height_pt(handle_, sheet, row, &pt) : 7000;
+  return number_result(rc, pt);
+}
+
+emscripten::val JsWorkbook::getWidthModel(uint32_t sheet, int32_t mode) const {
+  fm_width_model m{};
+  const fm_status_t rc = handle_ != nullptr ? fm_sheet_width_model(handle_, sheet, mode, &m) : 7000;
+  if (rc != 0) {
+    m = fm_width_model{};
+  }
+  emscripten::val o = emscripten::val::object();
+  o.set("status", status_from_rc(rc));
+  o.set("pointsPerChar", m.points_per_char);
+  o.set("paddingPt", m.padding_pt);
+  o.set("normalFontSize", m.normal_font_size);
+  o.set("calibrated", m.calibrated != 0);
+  js_set_cstr(o, "normalFontName", m.normal_font_name);
+  js_set_cstr(o, "platform", m.platform);
+  return o;
+}
+
+JsNumberResult JsWorkbook::columnCharsToPt(uint32_t sheet, int32_t mode, double chars) const {
+  double pt = 0.0;
+  const fm_status_t rc = handle_ != nullptr ? fm_sheet_column_chars_to_pt(handle_, sheet, mode, chars, &pt) : 7000;
+  return number_result(rc, pt);
+}
+
+JsNumberResult JsWorkbook::columnPtToChars(uint32_t sheet, int32_t mode, double pt) const {
+  double chars = 0.0;
+  const fm_status_t rc = handle_ != nullptr ? fm_sheet_column_pt_to_chars(handle_, sheet, mode, pt, &chars) : 7000;
+  return number_result(rc, chars);
+}
+
 }  // namespace parts
 }  // namespace wasm
 }  // namespace formulon
diff --git a/src/wasm/parts/workbook_styles.cpp b/src/wasm/parts/workbook_styles.cpp
index 49d93efe5..4ded4e42b 100644
--- a/src/wasm/parts/workbook_styles.cpp
+++ b/src/wasm/parts/workbook_styles.cpp
@@ -12,6 +12,7 @@
 #include <string>
 
 #include "c_api/formulon_c.h"
+#include "utils/error.h"
 #include "wasm/parts/embind_common.h"
 #include "wasm/parts/workbook.h"
 
@@ -21,82 +22,100 @@ namespace parts {
 
 namespace {
 
-bool js_has_field(const emscripten::val& object, const char* key) {
-  const emscripten::val field = object[key];
-  return !field.isUndefined() && !field.isNull();
-}
-
-std::int32_t js_pull_i32(const emscripten::val& object, const char* key, std::int32_t dflt) {
-  const emscripten::val field = object[key];
-  if (field.isUndefined() || field.isNull()) {
-    return dflt;
-  }
-  return field.as<std::int32_t>();
-}
-
-void js_pull_cell_xf(const emscripten::val& record, fm_cell_xf* xf) {
-  xf->font_index = js_pull_u32(record, "fontIndex", 0U);
-  xf->fill_index = js_pull_u32(record, "fillIndex", 0U);
-  xf->border_index = js_pull_u32(record, "borderIndex", 0U);
-  xf->num_fmt_id = js_pull_u16(record, "numFmtId", 0U);
-  xf->horizontal_align = js_pull_u8(record, "horizontalAlign", 0U);
-  xf->vertical_align = js_pull_u8(record, "verticalAlign", 2U);
-  xf->wrap_text = js_pull_bool(record, "wrapText", false) ? 1 : 0;
-  xf->justify_last_line = js_pull_bool(record, "justifyLastLine", false) ? 1 : 0;
-  xf->xf_id = js_pull_u32(record, "xfId", 0U);
-
-  const bool has_explicit_horizontal_align = js_has_field(record, "hasHorizontalAlign");
-  const bool has_explicit_vertical_align = js_has_field(record, "hasVerticalAlign");
-  const bool has_explicit_wrap_text = js_has_field(record, "hasWrapText");
-  const bool has_explicit_justify_last_line = js_has_field(record, "hasJustifyLastLine");
-  xf->has_horizontal_align = has_explicit_horizontal_align ? (js_pull_bool(record, "hasHorizontalAlign", false) ? 1 : 0)
-                                                           : (js_has_field(record, "horizontalAlign") ? 1 : 0);
-  xf->has_vertical_align = has_explicit_vertical_align ? (js_pull_bool(record, "hasVerticalAlign", false) ? 1 : 0)
-                                                       : (js_has_field(record, "verticalAlign") ? 1 : 0);
-  xf->has_wrap_text = has_explicit_wrap_text ? (js_pull_bool(record, "hasWrapText", false) ? 1 : 0)
-                                             : (js_has_field(record, "wrapText") ? 1 : 0);
-  xf->has_justify_last_line = has_explicit_justify_last_line
-                                  ? (js_pull_bool(record, "hasJustifyLastLine", false) ? 1 : 0)
-                                  : (js_has_field(record, "justifyLastLine") ? 1 : 0);
-  const bool has_explicit_alignment = js_has_field(record, "hasAlignment");
-  const bool has_supplied_alignment = js_has_field(record, "horizontalAlign") ||
-                                      js_has_field(record, "verticalAlign") || js_has_field(record, "wrapText") ||
-                                      js_has_field(record, "justifyLastLine") || js_has_field(record, "textRotation") ||
-                                      js_has_field(record, "indent") || js_has_field(record, "relativeIndent") ||
-                                      js_has_field(record, "shrinkToFit") || js_has_field(record, "readingOrder") ||
-                                      js_has_field(record, "hasHorizontalAlign") ||
-                                      js_has_field(record, "hasVerticalAlign") || js_has_field(record, "hasWrapText") ||
-                                      js_has_field(record, "hasJustifyLastLine");
-  xf->has_alignment =
-      has_explicit_alignment ? (js_pull_bool(record, "hasAlignment", false) ? 1 : 0) : (has_supplied_alignment ? 1 : 0);
-
-  if (js_has_field(record, "textRotation")) {
-    xf->has_text_rotation = 1;
-    xf->text_rotation = js_pull_u32(record, "textRotation", 0U);
-  }
-  if (js_has_field(record, "indent")) {
-    xf->has_indent = 1;
-    xf->indent = js_pull_u32(record, "indent", 0U);
-  }
-  if (js_has_field(record, "relativeIndent")) {
-    xf->has_relative_indent = 1;
-    xf->relative_indent = js_pull_i32(record, "relativeIndent", 0);
-  }
-  if (js_has_field(record, "shrinkToFit")) {
-    xf->has_shrink_to_fit = 1;
-    xf->shrink_to_fit = js_pull_bool(record, "shrinkToFit", false) ? 1 : 0;
-  }
-  if (js_has_field(record, "readingOrder")) {
-    xf->has_reading_order = 1;
-    xf->reading_order = js_pull_u32(record, "readingOrder", 0U);
-  }
+void js_pull_cell_xf(const emscripten::val& record, fm_cell_xf* xf, JsNarrowNumericReader& reader) {
+  xf->font_index = reader.u32(record, "fontIndex", 0U, "xf.fontIndex");
+  xf->fill_index = reader.u32(record, "fillIndex", 0U, "xf.fillIndex");
+  xf->border_index = reader.u32(record, "borderIndex", 0U, "xf.borderIndex");
+  xf->num_fmt_id = reader.u16(record, "numFmtId", 0U, "xf.numFmtId");
+  const auto has_value = [](const emscripten::val& value) { return !value.isUndefined() && !value.isNull(); };
+  const emscripten::val horizontal_align = reader.value(record, "horizontalAlign", "xf.horizontalAlign");
+  const emscripten::val vertical_align = reader.value(record, "verticalAlign", "xf.verticalAlign");
+  const emscripten::val wrap_text = reader.value(record, "wrapText", "xf.wrapText");
+  const emscripten::val justify_last_line = reader.value(record, "justifyLastLine", "xf.justifyLastLine");
+  const bool horizontal_align_present = has_value(horizontal_align);
+  const bool vertical_align_present = has_value(vertical_align);
+  const bool wrap_text_present = has_value(wrap_text);
+  const bool justify_last_line_present = has_value(justify_last_line);
+  xf->horizontal_align = reader.u8_value(horizontal_align, 0U, "xf.horizontalAlign");
+  xf->vertical_align = reader.u8_value(vertical_align, 2U, "xf.verticalAlign");
+  xf->wrap_text = reader.boolean_value(wrap_text, false, "xf.wrapText") ? 1 : 0;
+  xf->justify_last_line = reader.boolean_value(justify_last_line, false, "xf.justifyLastLine") ? 1 : 0;
+  xf->xf_id = reader.u32(record, "xfId", 0U, "xf.xfId");
+  const emscripten::val has_horizontal_align = reader.value(record, "hasHorizontalAlign", "xf.hasHorizontalAlign");
+  const emscripten::val has_vertical_align = reader.value(record, "hasVerticalAlign", "xf.hasVerticalAlign");
+  const emscripten::val has_wrap_text = reader.value(record, "hasWrapText", "xf.hasWrapText");
+  const emscripten::val has_justify_last_line = reader.value(record, "hasJustifyLastLine", "xf.hasJustifyLastLine");
+  const bool has_horizontal_align_present = has_value(has_horizontal_align);
+  const bool has_vertical_align_present = has_value(has_vertical_align);
+  const bool has_wrap_text_present = has_value(has_wrap_text);
+  const bool has_justify_last_line_present = has_value(has_justify_last_line);
+  xf->has_horizontal_align = has_horizontal_align_present
+                                 ? (reader.boolean_value(has_horizontal_align, false, "xf.hasHorizontalAlign") ? 1 : 0)
+                                 : (horizontal_align_present ? 1 : 0);
+  xf->has_vertical_align = has_vertical_align_present
+                               ? (reader.boolean_value(has_vertical_align, false, "xf.hasVerticalAlign") ? 1 : 0)
+                               : (vertical_align_present ? 1 : 0);
+  xf->has_wrap_text = has_wrap_text_present ? (reader.boolean_value(has_wrap_text, false, "xf.hasWrapText") ? 1 : 0)
+                                            : (wrap_text_present ? 1 : 0);
+  xf->has_justify_last_line =
+      has_justify_last_line_present
+          ? (reader.boolean_value(has_justify_last_line, false, "xf.hasJustifyLastLine") ? 1 : 0)
+          : (justify_last_line_present ? 1 : 0);
+  const emscripten::val has_alignment = reader.value(record, "hasAlignment", "xf.hasAlignment");
+  const bool has_alignment_present = has_value(has_alignment);
+  const emscripten::val text_rotation = reader.value(record, "textRotation", "xf.textRotation");
+  const emscripten::val indent = reader.value(record, "indent", "xf.indent");
+  const emscripten::val relative_indent = reader.value(record, "relativeIndent", "xf.relativeIndent");
+  const emscripten::val shrink_to_fit = reader.value(record, "shrinkToFit", "xf.shrinkToFit");
+  const emscripten::val reading_order = reader.value(record, "readingOrder", "xf.readingOrder");
+  const bool text_rotation_present = has_value(text_rotation);
+  const bool indent_present = has_value(indent);
+  const bool relative_indent_present = has_value(relative_indent);
+  const bool shrink_to_fit_present = has_value(shrink_to_fit);
+  const bool reading_order_present = has_value(reading_order);
+  xf->text_rotation = reader.u32_value(text_rotation, 0U, "xf.textRotation");
+  xf->indent = reader.u32_value(indent, 0U, "xf.indent");
+  xf->relative_indent = reader.i32_value(relative_indent, 0, "xf.relativeIndent");
+  xf->shrink_to_fit = reader.boolean_value(shrink_to_fit, false, "xf.shrinkToFit") ? 1 : 0;
+  xf->reading_order = reader.u32_value(reading_order, 0U, "xf.readingOrder");
+  xf->has_text_rotation = text_rotation_present ? 1 : 0;
+  xf->has_indent = indent_present ? 1 : 0;
+  xf->has_relative_indent = relative_indent_present ? 1 : 0;
+  xf->has_shrink_to_fit = shrink_to_fit_present ? 1 : 0;
+  xf->has_reading_order = reading_order_present ? 1 : 0;
+  const bool has_supplied_alignment = horizontal_align_present || vertical_align_present || wrap_text_present ||
+                                      justify_last_line_present || text_rotation_present || indent_present ||
+                                      relative_indent_present || shrink_to_fit_present || reading_order_present ||
+                                      has_horizontal_align_present || has_vertical_align_present ||
+                                      has_wrap_text_present || has_justify_last_line_present;
+  xf->has_alignment = has_alignment_present ? (reader.boolean_value(has_alignment, false, "xf.hasAlignment") ? 1 : 0)
+                                            : (has_supplied_alignment ? 1 : 0);
+
+  xf->apply_number_format = reader.boolean(record, "applyNumberFormat", false, "xf.applyNumberFormat") ? 1 : 0;
+  xf->apply_font = reader.boolean(record, "applyFont", false, "xf.applyFont") ? 1 : 0;
+  xf->apply_fill = reader.boolean(record, "applyFill", false, "xf.applyFill") ? 1 : 0;
+  xf->apply_border = reader.boolean(record, "applyBorder", false, "xf.applyBorder") ? 1 : 0;
+  xf->apply_alignment = reader.boolean(record, "applyAlignment", false, "xf.applyAlignment") ? 1 : 0;
+  xf->apply_protection = reader.boolean(record, "applyProtection", false, "xf.applyProtection") ? 1 : 0;
+  xf->quote_prefix = reader.boolean(record, "quotePrefix", false, "xf.quotePrefix") ? 1 : 0;
+  const emscripten::val has_protection = reader.value(record, "hasProtection", "xf.hasProtection");
+  const emscripten::val locked = reader.value(record, "locked", "xf.locked");
+  const emscripten::val hidden = reader.value(record, "hidden", "xf.hidden");
+  const bool has_protection_present = has_value(has_protection);
+  const bool locked_present = has_value(locked);
+  const bool hidden_present = has_value(hidden);
+  const bool has_protection_value = reader.boolean_value(has_protection, false, "xf.hasProtection");
+  xf->has_protection =
+      has_protection_present ? (has_protection_value ? 1 : 0) : ((locked_present || hidden_present) ? 1 : 0);
+  xf->locked = reader.boolean_value(locked, true, "xf.locked") ? 1 : 0;
+  xf->hidden = reader.boolean_value(hidden, false, "xf.hidden") ? 1 : 0;
 }
 
 /// Builds the JS mirror of a font record. Shared by `getFont` and the
 /// `<dxf>` font projection so both surface the same field set.
 emscripten::val js_font_record(const fm_font_record& f) {
   emscripten::val o = emscripten::val::object();
-  o.set("name", std::string(f.name != nullptr ? f.name : ""));
+  js_set_cstr(o, "name", f.name);
   o.set("size", f.size);
   o.set("colorArgb", f.color_argb);
   o.set("bold", f.bold != 0);
@@ -118,25 +137,26 @@ emscripten::val js_font_record(const fm_font_record& f) {
 
 /// Reads a font record out of a JS object. `name_storage` owns the font
 /// name for the duration of the C ABI call, which borrows the pointer.
-void js_pull_font_record(const emscripten::val& record, std::string* name_storage, fm_font_record* out) {
-  *name_storage = js_pull_string(record, "name");
+void js_pull_font_record(const emscripten::val& record, std::string* name_storage, fm_font_record* out,
+                         JsNarrowNumericReader& reader) {
+  *name_storage = reader.string(record, "name", "font.name");
   out->name = name_storage->c_str();
-  out->size = js_pull_double(record, "size", 11.0);
-  out->bold = js_pull_bool(record, "bold", false) ? 1 : 0;
-  out->italic = js_pull_bool(record, "italic", false) ? 1 : 0;
-  out->strike = js_pull_bool(record, "strike", false) ? 1 : 0;
-  out->has_bold = js_pull_bool(record, "hasBold", false) ? 1 : 0;
-  out->has_italic = js_pull_bool(record, "hasItalic", false) ? 1 : 0;
-  out->has_strike = js_pull_bool(record, "hasStrike", false) ? 1 : 0;
-  out->underline = js_pull_u8(record, "underline", 0U);
-  out->vert_align = js_pull_u8(record, "vertAlign", 0U);
-  out->has_family = js_pull_bool(record, "hasFamily", false) ? 1 : 0;
-  out->family = js_pull_u8(record, "family", 0U);
-  out->has_charset = js_pull_bool(record, "hasCharset", false) ? 1 : 0;
-  out->charset = js_pull_u8(record, "charset", 0U);
-  out->scheme = js_pull_u8(record, "scheme", 0U);
-  out->color_argb = js_pull_u32(record, "colorArgb", 0xFF000000U);
-  out->color = js_pull_color_spec(record, "color");
+  out->size = reader.number(record, "size", 11.0, "font.size");
+  out->bold = reader.boolean(record, "bold", false, "font.bold") ? 1 : 0;
+  out->italic = reader.boolean(record, "italic", false, "font.italic") ? 1 : 0;
+  out->strike = reader.boolean(record, "strike", false, "font.strike") ? 1 : 0;
+  out->has_bold = reader.boolean(record, "hasBold", false, "font.hasBold") ? 1 : 0;
+  out->has_italic = reader.boolean(record, "hasItalic", false, "font.hasItalic") ? 1 : 0;
+  out->has_strike = reader.boolean(record, "hasStrike", false, "font.hasStrike") ? 1 : 0;
+  out->underline = reader.u8(record, "underline", 0U, "font.underline");
+  out->vert_align = reader.u8(record, "vertAlign", 0U, "font.vertAlign");
+  out->has_family = reader.boolean(record, "hasFamily", false, "font.hasFamily") ? 1 : 0;
+  out->family = reader.u8(record, "family", 0U, "font.family");
+  out->has_charset = reader.boolean(record, "hasCharset", false, "font.hasCharset") ? 1 : 0;
+  out->charset = reader.u8(record, "charset", 0U, "font.charset");
+  out->scheme = reader.u8(record, "scheme", 0U, "font.scheme");
+  out->color_argb = reader.u32(record, "colorArgb", 0xFF000000U, "font.colorArgb");
+  out->color = js_pull_color_spec(record, "color", &reader);
 }
 
 emscripten::val js_fill_record(const fm_fill_record& f) {
@@ -149,13 +169,13 @@ emscripten::val js_fill_record(const fm_fill_record& f) {
   return o;
 }
 
-fm_fill_record js_pull_fill_record(const emscripten::val& record) {
+fm_fill_record js_pull_fill_record(const emscripten::val& record, JsNarrowNumericReader& reader) {
   fm_fill_record fr{};
-  fr.pattern = js_pull_u8(record, "pattern", 0U);
-  fr.fg_argb = js_pull_u32(record, "fgArgb", 0U);
-  fr.bg_argb = js_pull_u32(record, "bgArgb", 0U);
-  fr.fg = js_pull_color_spec(record, "fg");
-  fr.bg = js_pull_color_spec(record, "bg");
+  fr.pattern = reader.u8(record, "pattern", 0U, "fill.pattern");
+  fr.fg_argb = reader.u32(record, "fgArgb", 0U, "fill.fgArgb");
+  fr.bg_argb = reader.u32(record, "bgArgb", 0U, "fill.bgArgb");
+  fr.fg = js_pull_color_spec(record, "fg", &reader);
+  fr.bg = js_pull_color_spec(record, "bg", &reader);
   return fr;
 }
 
@@ -192,6 +212,16 @@ emscripten::val js_cell_xf_record(const fm_cell_xf& xf) {
   o.set("hasVerticalAlign", xf.has_vertical_align != 0);
   o.set("hasWrapText", xf.has_wrap_text != 0);
   o.set("hasJustifyLastLine", xf.has_justify_last_line != 0);
+  o.set("applyNumberFormat", xf.apply_number_format != 0);
+  o.set("applyFont", xf.apply_font != 0);
+  o.set("applyFill", xf.apply_fill != 0);
+  o.set("applyBorder", xf.apply_border != 0);
+  o.set("applyAlignment", xf.apply_alignment != 0);
+  o.set("applyProtection", xf.apply_protection != 0);
+  o.set("quotePrefix", xf.quote_prefix != 0);
+  o.set("hasProtection", xf.has_protection != 0);
+  o.set("locked", xf.locked != 0);
+  o.set("hidden", xf.hidden != 0);
   return o;
 }
 
@@ -213,6 +243,19 @@ void js_set_cell_xf_alignment(const fm_cell_xf& xf, emscripten::val* object) {
   }
 }
 
+// Builds the `getCellXf` / `getCellStyleXf` result from the C call's status
+// and record; a failed read reports the all-default record.
+emscripten::val js_cell_xf_result(fm_status_t rc, fm_cell_xf xf) {
+  if (rc != 0) {
+    xf = fm_cell_xf{};
+  }
+  emscripten::val o = js_cell_xf_record(xf);
+  o.set("status", status_from_rc(rc));
+  o.set("xfId", xf.xf_id);
+  js_set_cell_xf_alignment(xf, &o);
+  return o;
+}
+
 }  // namespace
 
 // ---- Per-cell xf index get/set -----------------------------------------
@@ -258,14 +301,7 @@ JsStatus JsWorkbook::setRangeXfIndex(uint32_t sheet, uint32_t firstRow, uint32_t
 emscripten::val JsWorkbook::getCellXf(uint32_t xf_index) const {
   fm_cell_xf xf{};
   const fm_status_t rc = handle_ != nullptr ? fm_styles_get_cell_xf(handle_, xf_index, &xf) : 7000;
-  if (rc != 0) {
-    xf = fm_cell_xf{};
-  }
-  emscripten::val o = js_cell_xf_record(xf);
-  o.set("status", status_from_rc(rc));
-  o.set("xfId", xf.xf_id);
-  js_set_cell_xf_alignment(xf, &o);
-  return o;
+  return js_cell_xf_result(rc, xf);
 }
 
 emscripten::val JsWorkbook::getFont(uint32_t font_index) const {
@@ -308,7 +344,7 @@ emscripten::val JsWorkbook::getNumFmt(uint32_t num_fmt_id) const {
       handle_ != nullptr ? fm_styles_get_num_fmt_string(handle_, static_cast<uint16_t>(num_fmt_id), &s) : 7000;
   o.set("status", status_from_rc(rc));
   o.set("numFmtId", rc == 0 ? num_fmt_id : 0U);
-  o.set("formatCode", std::string(rc == 0 && s != nullptr ? s : ""));
+  js_set_cstr(o, "formatCode", rc == 0 ? s : nullptr);
   return o;
 }
 
@@ -337,7 +373,7 @@ emscripten::val JsWorkbook::getDxf(uint32_t dxf_index) const {
   if (d.num_fmt_engaged != 0) {
     emscripten::val num_fmt = emscripten::val::object();
     num_fmt.set("numFmtId", static_cast<uint32_t>(d.num_fmt_id));
-    num_fmt.set("formatCode", std::string(d.num_fmt_code != nullptr ? d.num_fmt_code : ""));
+    js_set_cstr(num_fmt, "formatCode", d.num_fmt_code);
     o.set("numFmt", num_fmt);
   }
   if (d.alignment_xml != nullptr && d.alignment_xml[0] != '\0') {
@@ -359,7 +395,12 @@ JsAddStyleResult JsWorkbook::addFont(emscripten::val record) {
   }
   std::string name;
   fm_font_record fr{};
-  js_pull_font_record(record, &name, &fr);
+  JsNarrowNumericReader reader("addFont");
+  js_pull_font_record(record, &name, &fr, reader);
+  if (!reader.ok()) {
+    r.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return r;
+  }
   uint32_t idx = 0;
   fm_status_t rc = fm_styles_add_font(handle_, fr, &idx);
   if (rc != 0) {
@@ -377,7 +418,11 @@ JsStatus JsWorkbook::setFont(uint32_t font_index, emscripten::val record) {
   }
   std::string name;
   fm_font_record fr{};
-  js_pull_font_record(record, &name, &fr);
+  JsNarrowNumericReader reader("setFont");
+  js_pull_font_record(record, &name, &fr, reader);
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   return status_from_rc(fm_styles_set_font(handle_, font_index, fr));
 }
 
@@ -387,7 +432,11 @@ JsStatus JsWorkbook::setDefaultFont(emscripten::val record) {
   }
   std::string name;
   fm_font_record fr{};
-  js_pull_font_record(record, &name, &fr);
+  JsNarrowNumericReader reader("setDefaultFont");
+  js_pull_font_record(record, &name, &fr, reader);
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   return status_from_rc(fm_workbook_set_default_font(handle_, fr));
 }
 
@@ -397,7 +446,12 @@ JsAddStyleResult JsWorkbook::addFill(emscripten::val record) {
     r.status = error_status(7000);
     return r;
   }
-  const fm_fill_record fr = js_pull_fill_record(record);
+  JsNarrowNumericReader reader("addFill");
+  const fm_fill_record fr = js_pull_fill_record(record, reader);
+  if (!reader.ok()) {
+    r.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return r;
+  }
   uint32_t idx = 0;
   fm_status_t rc = fm_styles_add_fill(handle_, fr, &idx);
   if (rc != 0) {
@@ -415,14 +469,19 @@ JsAddStyleResult JsWorkbook::addBorder(emscripten::val record) {
     r.status = error_status(7000);
     return r;
   }
+  JsNarrowNumericReader reader("addBorder");
   fm_border_record br{};
-  br.left = js_pull_border_side(record["left"]);
-  br.right = js_pull_border_side(record["right"]);
-  br.top = js_pull_border_side(record["top"]);
-  br.bottom = js_pull_border_side(record["bottom"]);
-  br.diagonal = js_pull_border_side(record["diagonal"]);
-  br.diagonal_up = js_pull_bool(record, "diagonalUp", false) ? 1 : 0;
-  br.diagonal_down = js_pull_bool(record, "diagonalDown", false) ? 1 : 0;
+  br.left = js_pull_border_side(reader.value(record, "left", "border.left"), &reader);
+  br.right = js_pull_border_side(reader.value(record, "right", "border.right"), &reader);
+  br.top = js_pull_border_side(reader.value(record, "top", "border.top"), &reader);
+  br.bottom = js_pull_border_side(reader.value(record, "bottom", "border.bottom"), &reader);
+  br.diagonal = js_pull_border_side(reader.value(record, "diagonal", "border.diagonal"), &reader);
+  br.diagonal_up = reader.boolean(record, "diagonalUp", false, "border.diagonalUp") ? 1 : 0;
+  br.diagonal_down = reader.boolean(record, "diagonalDown", false, "border.diagonalDown") ? 1 : 0;
+  if (!reader.ok()) {
+    r.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return r;
+  }
   uint32_t idx = 0;
   fm_status_t rc = fm_styles_add_border(handle_, br, &idx);
   if (rc != 0) {
@@ -458,7 +517,12 @@ JsAddStyleResult JsWorkbook::addXf(emscripten::val record) {
     return r;
   }
   fm_cell_xf xf{};
-  js_pull_cell_xf(record, &xf);
+  JsNarrowNumericReader reader("addXf");
+  js_pull_cell_xf(record, &xf, reader);
+  if (!reader.ok()) {
+    r.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return r;
+  }
   uint32_t idx = 0;
   fm_status_t rc = fm_styles_add_cell_xf(handle_, xf, &idx);
   if (rc != 0) {
@@ -482,44 +546,50 @@ JsAddStyleResult JsWorkbook::addDxf(emscripten::val record) {
   std::string alignment_xml;
   std::string protection_xml;
   fm_dxf_record dxf{};
+  JsNarrowNumericReader reader("addDxf");
 
-  emscripten::val font = record["font"];
+  emscripten::val font = reader.value(record, "font", "dxf.font");
   if (!font.isUndefined() && !font.isNull()) {
     dxf.font_engaged = 1;
-    js_pull_font_record(font, &font_name, &dxf.font);
+    js_pull_font_record(font, &font_name, &dxf.font, reader);
   }
 
-  emscripten::val fill = record["fill"];
+  emscripten::val fill = reader.value(record, "fill", "dxf.fill");
   if (!fill.isUndefined() && !fill.isNull()) {
     dxf.fill_engaged = 1;
-    dxf.fill = js_pull_fill_record(fill);
+    dxf.fill = js_pull_fill_record(fill, reader);
   }
 
-  emscripten::val border = record["border"];
+  emscripten::val border = reader.value(record, "border", "dxf.border");
   if (!border.isUndefined() && !border.isNull()) {
     dxf.border_engaged = 1;
-    dxf.border.left = js_pull_border_side(border["left"]);
-    dxf.border.right = js_pull_border_side(border["right"]);
-    dxf.border.top = js_pull_border_side(border["top"]);
-    dxf.border.bottom = js_pull_border_side(border["bottom"]);
-    dxf.border.diagonal = js_pull_border_side(border["diagonal"]);
-    dxf.border.diagonal_up = js_pull_bool(border, "diagonalUp", false) ? 1 : 0;
-    dxf.border.diagonal_down = js_pull_bool(border, "diagonalDown", false) ? 1 : 0;
+    dxf.border.left = js_pull_border_side(reader.value(border, "left", "dxf.border.left"), &reader);
+    dxf.border.right = js_pull_border_side(reader.value(border, "right", "dxf.border.right"), &reader);
+    dxf.border.top = js_pull_border_side(reader.value(border, "top", "dxf.border.top"), &reader);
+    dxf.border.bottom = js_pull_border_side(reader.value(border, "bottom", "dxf.border.bottom"), &reader);
+    dxf.border.diagonal = js_pull_border_side(reader.value(border, "diagonal", "dxf.border.diagonal"), &reader);
+    dxf.border.diagonal_up = reader.boolean(border, "diagonalUp", false, "dxf.border.diagonalUp") ? 1 : 0;
+    dxf.border.diagonal_down = reader.boolean(border, "diagonalDown", false, "dxf.border.diagonalDown") ? 1 : 0;
   }
 
-  emscripten::val num_fmt = record["numFmt"];
+  emscripten::val num_fmt = reader.value(record, "numFmt", "dxf.numFmt");
   if (!num_fmt.isUndefined() && !num_fmt.isNull()) {
     dxf.num_fmt_engaged = 1;
-    dxf.num_fmt_id = js_pull_u16(num_fmt, "numFmtId", 0U);
-    num_fmt_code = js_pull_string(num_fmt, "formatCode");
+    dxf.num_fmt_id = reader.u16(num_fmt, "numFmtId", 0U, "dxf.numFmtId");
+    num_fmt_code = reader.string(num_fmt, "formatCode", "dxf.numFmt.formatCode");
     dxf.num_fmt_code = num_fmt_code.c_str();
   }
 
-  alignment_xml = js_pull_string(record, "alignmentXml");
-  protection_xml = js_pull_string(record, "protectionXml");
+  alignment_xml = reader.string(record, "alignmentXml", "dxf.alignmentXml");
+  protection_xml = reader.string(record, "protectionXml", "dxf.protectionXml");
   dxf.alignment_xml = alignment_xml.c_str();
   dxf.protection_xml = protection_xml.c_str();
 
+  if (!reader.ok()) {
+    r.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return r;
+  }
+
   uint32_t idx = 0;
   fm_status_t rc = fm_styles_add_dxf(handle_, dxf, &idx);
   if (rc != 0) {
@@ -574,7 +644,7 @@ emscripten::val JsWorkbook::getCellStyle(uint32_t index) const {
     cs = fm_cell_style_record_t{};
   }
   o.set("status", status_from_rc(rc));
-  o.set("name", std::string(cs.name != nullptr ? cs.name : ""));
+  js_set_cstr(o, "name", cs.name);
   o.set("xfId", cs.xf_id);
   o.set("builtinId", cs.builtin_id);
   o.set("iLevel", cs.i_level);
@@ -586,14 +656,7 @@ emscripten::val JsWorkbook::getCellStyle(uint32_t index) const {
 emscripten::val JsWorkbook::getCellStyleXf(uint32_t index) const {
   fm_cell_xf xf{};
   const fm_status_t rc = handle_ != nullptr ? fm_styles_get_cell_style_xf(handle_, index, &xf) : 7000;
-  if (rc != 0) {
-    xf = fm_cell_xf{};
-  }
-  emscripten::val o = js_cell_xf_record(xf);
-  o.set("status", status_from_rc(rc));
-  o.set("xfId", xf.xf_id);
-  js_set_cell_xf_alignment(xf, &o);
-  return o;
+  return js_cell_xf_result(rc, xf);
 }
 
 JsAddStyleResult JsWorkbook::addCellStyleXf(emscripten::val record) {
@@ -603,7 +666,12 @@ JsAddStyleResult JsWorkbook::addCellStyleXf(emscripten::val record) {
     return out;
   }
   fm_cell_xf xf{};
-  js_pull_cell_xf(record, &xf);
+  JsNarrowNumericReader reader("addCellStyleXf");
+  js_pull_cell_xf(record, &xf, reader);
+  if (!reader.ok()) {
+    out.status = binding_error_status(kInvalidArgument, reader.message().c_str());
+    return out;
+  }
   uint32_t index = 0;
   const fm_status_t rc = fm_styles_add_cell_style_xf(handle_, xf, &index);
   out.status = rc == 0 ? ok_status() : error_status(rc);
@@ -611,11 +679,165 @@ JsAddStyleResult JsWorkbook::addCellStyleXf(emscripten::val record) {
   return out;
 }
 
-JsStatus JsWorkbook::setCellStyle(const std::string& name, uint32_t xfId, uint32_t builtinId) {
+JsStatus JsWorkbook::setCellStyle(emscripten::val record) {
   if (handle_ == nullptr) {
     return error_status(7000);
   }
-  return status_from_rc(fm_styles_set_cell_style(handle_, name.c_str(), xfId, builtinId));
+  JsNarrowNumericReader reader("setCellStyle");
+  const std::string name = reader.string(record, "name", "cellStyle.name");
+  fm_cell_style_record_t cs{};
+  cs.name = name.c_str();
+  cs.xf_id = reader.u32(record, "xfId", 0U, "cellStyle.xfId");
+  cs.builtin_id = reader.u32(record, "builtinId", FM_CELL_STYLE_BUILTIN_ID_NONE, "cellStyle.builtinId");
+  cs.i_level = reader.u32(record, "iLevel", 0U, "cellStyle.iLevel");
+  cs.hidden = reader.boolean(record, "hidden", false, "cellStyle.hidden") ? 1 : 0;
+  cs.custom_builtin = reader.boolean(record, "customBuiltin", false, "cellStyle.customBuiltin") ? 1 : 0;
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  return status_from_rc(fm_styles_set_cell_style(handle_, &cs));
+}
+
+JsStatus JsWorkbook::removeCellStyle(const std::string& name) {
+  if (handle_ == nullptr) {
+    return error_status(7000);
+  }
+  return status_from_rc(fm_styles_remove_cell_style(handle_, name.c_str()));
+}
+
+namespace {
+
+emscripten::val js_resolved_color(uint32_t argb, int32_t resolution) {
+  emscripten::val o = emscripten::val::object();
+  o.set("argb", argb);
+  o.set("resolution", resolution);
+  return o;
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::getTheme() const {
+  fm_theme_colors colors{};
+  fm_theme_fonts fonts{};
+  int32_t source = 0;
+  fm_status_t rc = handle_ != nullptr ? fm_workbook_get_theme_colors(handle_, &colors, &source) : 7000;
+  if (rc == 0) {
+    rc = fm_workbook_get_theme_fonts(handle_, &fonts);
+  }
+  if (rc != 0) {
+    colors = fm_theme_colors{};
+    fonts = fm_theme_fonts{};
+    source = 0;
+  }
+  emscripten::val list = emscripten::val::array();
+  for (uint32_t i = 0; i < 12U; ++i) {
+    list.set(i, colors.argb[i]);
+  }
+  emscripten::val f = emscripten::val::object();
+  js_set_cstr_fields(f, {{"majorLatin", fonts.major_latin},
+                         {"majorEastAsian", fonts.major_east_asian},
+                         {"minorLatin", fonts.minor_latin},
+                         {"minorEastAsian", fonts.minor_east_asian}});
+  emscripten::val o = emscripten::val::object();
+  o.set("status", status_from_rc(rc));
+  o.set("source", source);
+  o.set("colors", list);
+  o.set("fonts", f);
+  return o;
+}
+
+JsStatus JsWorkbook::setThemeColors(emscripten::val colors) {
+  if (handle_ == nullptr) {
+    return error_status(7000);
+  }
+  fm_theme_colors tc{};
+  JsNarrowNumericReader reader("setThemeColors");
+  if (!reader.is_array(colors, "colors") || reader.length(colors, "colors") != 12U) {
+    return binding_error_status(static_cast<int32_t>(formulon::FormulonErrorCode::kInvalidArgument),
+                                "setThemeColors: `colors` must be an array of 12 ARGB numbers");
+  }
+  for (uint32_t i = 0; i < 12U; ++i) {
+    tc.argb[i] = reader.u32_value(reader.array_element(colors, i, "colors[]"), 0U, "colors[]");
+  }
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  return status_from_rc(fm_workbook_set_theme_colors(handle_, &tc));
+}
+
+JsStatus JsWorkbook::setThemeFonts(emscripten::val fonts) {
+  if (handle_ == nullptr) {
+    return error_status(7000);
+  }
+  JsNarrowNumericReader reader("setThemeFonts");
+  const std::string major_latin = reader.string(fonts, "majorLatin", "theme.majorLatin");
+  const std::string major_ea = reader.string(fonts, "majorEastAsian", "theme.majorEastAsian");
+  const std::string minor_latin = reader.string(fonts, "minorLatin", "theme.minorLatin");
+  const std::string minor_ea = reader.string(fonts, "minorEastAsian", "theme.minorEastAsian");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  fm_theme_fonts tf{};
+  tf.major_latin = major_latin.c_str();
+  tf.major_east_asian = major_ea.c_str();
+  tf.minor_latin = minor_latin.c_str();
+  tf.minor_east_asian = minor_ea.c_str();
+  return status_from_rc(fm_workbook_set_theme_fonts(handle_, &tf));
+}
+
+emscripten::val JsWorkbook::resolveColor(emscripten::val spec, int32_t context) const {
+  uint32_t argb = 0;
+  int32_t resolution = 0;
+  emscripten::val o = emscripten::val::object();
+  if (handle_ == nullptr) {
+    o.set("status", error_status(7000));
+    o.set("argb", 0U);
+    o.set("resolution", 0);
+    return o;
+  }
+  emscripten::val holder = emscripten::val::object();
+  holder.set("c", spec);
+  JsNarrowNumericReader reader("resolveColor");
+  const fm_color_spec color = js_pull_color_spec(holder, "c", &reader);
+  if (!reader.ok()) {
+    o.set("status", binding_error_status(kInvalidArgument, reader.message().c_str()));
+    o.set("argb", 0U);
+    o.set("resolution", 0);
+    return o;
+  }
+  const fm_status_t rc = fm_workbook_resolve_color(handle_, color, context, &argb, &resolution);
+  o.set("status", status_from_rc(rc));
+  o.set("argb", rc == 0 ? argb : 0U);
+  o.set("resolution", rc == 0 ? resolution : 0);
+  return o;
+}
+
+emscripten::val JsWorkbook::getEffectiveStyle(uint32_t sheet, uint32_t row, uint32_t col) const {
+  fm_effective_style e{};
+  const fm_status_t rc = handle_ != nullptr ? fm_sheet_get_effective_style(handle_, sheet, row, col, &e) : 7000;
+  if (rc != 0) {
+    e = fm_effective_style{};
+  }
+  emscripten::val o = emscripten::val::object();
+  o.set("status", status_from_rc(rc));
+  o.set("xfIndex", e.xf_index);
+  o.set("source", e.source);
+  o.set("fontIndex", e.font_index);
+  o.set("fillIndex", e.fill_index);
+  o.set("borderIndex", e.border_index);
+  o.set("font", js_resolved_color(e.font_argb, e.font_resolution));
+  o.set("fillForeground", js_resolved_color(e.fill_fg_argb, e.fill_fg_resolution));
+  o.set("fillBackground", js_resolved_color(e.fill_bg_argb, e.fill_bg_resolution));
+  static const char* const kSides[5] = {"left", "right", "top", "bottom", "diagonal"};
+  emscripten::val borders = emscripten::val::object();
+  for (int i = 0; i < 5; ++i) {
+    borders.set(kSides[i], js_resolved_color(e.border_argb[i], e.border_resolution[i]));
+  }
+  o.set("borders", borders);
+  o.set("locked", e.locked != 0);
+  o.set("hidden", e.hidden != 0);
+  js_set_cstr(o, "numFmtCode", e.num_fmt_code);
+  return o;
 }
 
 }  // namespace parts
diff --git a/src/wasm/parts/workbook_ui.cpp b/src/wasm/parts/workbook_ui.cpp
index c5a8047c7..e0dcca769 100644
--- a/src/wasm/parts/workbook_ui.cpp
+++ b/src/wasm/parts/workbook_ui.cpp
@@ -35,7 +35,7 @@ emscripten::val JsWorkbook::getSheetAutoFilterXml(uint32_t sheet) const {
     return out;
   }
   out.set("status", ok_status());
-  out.set("xml", xml != nullptr ? std::string(xml) : std::string());
+  js_set_cstr(out, "xml", xml);
   return out;
 }
 
@@ -52,11 +52,11 @@ JsStatus JsWorkbook::addMerge(uint32_t sheet, emscripten::val range) {
   if (handle_ == nullptr) {
     return error_status(7000);
   }
-  fm_merge_range m;
-  m.first_row = range["firstRow"].as<uint32_t>();
-  m.last_row = range["lastRow"].as<uint32_t>();
-  m.first_col = range["firstCol"].as<uint32_t>();
-  m.last_col = range["lastCol"].as<uint32_t>();
+  JsNarrowNumericReader reader("addMerge");
+  const fm_merge_range m = js_pull_range(range, &reader);
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   fm_status_t rc = fm_sheet_add_merge(handle_, sheet, m);
   return status_from_rc(rc);
 }
@@ -65,11 +65,11 @@ JsStatus JsWorkbook::removeMerge(uint32_t sheet, emscripten::val range) {
   if (handle_ == nullptr) {
     return error_status(7000);
   }
-  fm_merge_range m;
-  m.first_row = range["firstRow"].as<uint32_t>();
-  m.last_row = range["lastRow"].as<uint32_t>();
-  m.first_col = range["firstCol"].as<uint32_t>();
-  m.last_col = range["lastCol"].as<uint32_t>();
+  JsNarrowNumericReader reader("removeMerge");
+  const fm_merge_range m = js_pull_range(range, &reader);
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   fm_status_t rc = fm_sheet_remove_merge(handle_, sheet, m);
   return status_from_rc(rc);
 }
@@ -90,28 +90,82 @@ JsStatus JsWorkbook::clearMerges(uint32_t sheet) {
   return status_from_rc(rc);
 }
 
-emscripten::val JsWorkbook::getMerges(uint32_t sheet) const {
+namespace {
+
+// Reads list element `index` of `sheet` into `*out`; the per-kind half of
+// `sheet_list`.
+using SheetListItemFn = fm_status_t (*)(fm_workbook_t*, uint32_t, uint32_t, emscripten::val*);
+
+// Enumerates a per-sheet list through its count / at-index pair into a
+// `ListResult` array, stopping at the first failed element read.
+emscripten::val sheet_list(fm_workbook_t* wb, uint32_t sheet,
+                           fm_status_t (*count_fn)(fm_workbook_t*, uint32_t, uint32_t*), SheetListItemFn item_fn) {
   emscripten::val arr = emscripten::val::array();
-  if (handle_ == nullptr) {
+  if (wb == nullptr) {
     arr.set("status", error_status(7000));
     return arr;
   }
   uint32_t count = 0;
-  fm_status_t rc = fm_sheet_get_merge_count(handle_, sheet, &count);
+  fm_status_t rc = count_fn(wb, sheet, &count);
   if (rc != 0) {
     arr.set("status", status_from_rc(rc));
     return arr;
   }
-  uint32_t emitted = 0;
   for (uint32_t i = 0; i < count; ++i) {
-    fm_merge_range m{};
-    rc = fm_sheet_get_merge_at(handle_, sheet, i, &m);
+    emscripten::val item = emscripten::val::undefined();
+    rc = item_fn(wb, sheet, i, &item);
     if (rc != 0) {
       arr.set("status", status_from_rc(rc));
       return arr;
     }
-    arr.set(emitted, merge_range_to_val(m));
-    ++emitted;
+    arr.set(i, item);
+  }
+  arr.set("status", ok_status());
+  return arr;
+}
+
+fm_status_t merge_item(fm_workbook_t* wb, uint32_t sheet, uint32_t index, emscripten::val* out) {
+  fm_merge_range m{};
+  const fm_status_t rc = fm_sheet_get_merge_at(wb, sheet, index, &m);
+  if (rc != 0) {
+    return rc;
+  }
+  *out = merge_range_to_val(m);
+  return 0;
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::getMerges(uint32_t sheet) const {
+  return sheet_list(handle_, sheet, &fm_sheet_get_merge_count, &merge_item);
+}
+
+emscripten::val JsWorkbook::getMergesInRange(uint32_t sheet, emscripten::val range) const {
+  emscripten::val arr = emscripten::val::array();
+  if (handle_ == nullptr) {
+    arr.set("status", error_status(7000));
+    return arr;
+  }
+  JsNarrowNumericReader reader("getMergesInRange");
+  const fm_merge_range query = js_pull_range(range, &reader);
+  if (!reader.ok()) {
+    arr.set("status", binding_error_status(kInvalidArgument, reader.message().c_str()));
+    return arr;
+  }
+  uint32_t total = 0;
+  fm_status_t rc = fm_sheet_merges_in_range(handle_, sheet, query, nullptr, 0, &total);
+  std::vector<fm_merge_range> found(rc == 0 ? total : 0);
+  if (rc == 0 && total > 0) {
+    uint32_t written = 0;
+    rc = fm_sheet_merges_in_range(handle_, sheet, query, found.data(), total, &written);
+    found.resize(rc == 0 ? written : 0);
+  }
+  if (rc != 0) {
+    arr.set("status", error_status(rc));
+    return arr;
+  }
+  for (uint32_t i = 0; i < found.size(); ++i) {
+    arr.set(i, merge_range_to_val(found[i]));
   }
   arr.set("status", ok_status());
   return arr;
@@ -128,8 +182,7 @@ emscripten::val JsWorkbook::getComment(uint32_t sheet, uint32_t row, uint32_t co
     return emscripten::val::null();
   }
   emscripten::val o = emscripten::val::object();
-  o.set("author", c.author != nullptr ? std::string(c.author) : std::string());
-  o.set("text", c.text != nullptr ? std::string(c.text) : std::string());
+  js_set_cstr_fields(o, {{"author", c.author}, {"text", c.text}});
   return o;
 }
 
@@ -148,43 +201,32 @@ emscripten::val JsWorkbook::getCommentResult(uint32_t sheet, uint32_t row, uint3
     return out;
   }
   emscripten::val comment = emscripten::val::object();
-  comment.set("author", c.author != nullptr ? std::string(c.author) : std::string());
-  comment.set("text", c.text != nullptr ? std::string(c.text) : std::string());
+  js_set_cstr_fields(comment, {{"author", c.author}, {"text", c.text}});
   out.set("status", ok_status());
   out.set("comment", comment);
   return out;
 }
 
-emscripten::val JsWorkbook::getComments(uint32_t sheet) const {
-  emscripten::val arr = emscripten::val::array();
-  if (handle_ == nullptr) {
-    arr.set("status", error_status(7000));
-    return arr;
-  }
-  uint32_t count = 0;
-  fm_status_t rc = fm_sheet_get_comment_count(handle_, sheet, &count);
+namespace {
+
+fm_status_t comment_item(fm_workbook_t* wb, uint32_t sheet, uint32_t index, emscripten::val* out) {
+  fm_comment c{};
+  const fm_status_t rc = fm_sheet_get_comment_at_index(wb, sheet, index, &c);
   if (rc != 0) {
-    arr.set("status", status_from_rc(rc));
-    return arr;
-  }
-  uint32_t emitted = 0;
-  for (uint32_t i = 0; i < count; ++i) {
-    fm_comment c{};
-    rc = fm_sheet_get_comment_at_index(handle_, sheet, i, &c);
-    if (rc != 0) {
-      arr.set("status", status_from_rc(rc));
-      return arr;
-    }
-    emscripten::val o = emscripten::val::object();
-    o.set("row", c.row);
-    o.set("col", c.col);
-    o.set("author", c.author != nullptr ? std::string(c.author) : std::string());
-    o.set("text", c.text != nullptr ? std::string(c.text) : std::string());
-    arr.set(emitted, o);
-    ++emitted;
+    return rc;
   }
-  arr.set("status", ok_status());
-  return arr;
+  emscripten::val o = emscripten::val::object();
+  o.set("row", c.row);
+  o.set("col", c.col);
+  js_set_cstr_fields(o, {{"author", c.author}, {"text", c.text}});
+  *out = o;
+  return 0;
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::getComments(uint32_t sheet) const {
+  return sheet_list(handle_, sheet, &fm_sheet_get_comment_count, &comment_item);
 }
 
 JsStatus JsWorkbook::setComment(uint32_t sheet, uint32_t row, uint32_t col, const std::string& author,
@@ -248,88 +290,68 @@ JsStatus JsWorkbook::clearHyperlinks(uint32_t sheet) {
   return status_from_rc(rc);
 }
 
-emscripten::val JsWorkbook::getHyperlinks(uint32_t sheet) const {
-  emscripten::val arr = emscripten::val::array();
-  if (handle_ == nullptr) {
-    arr.set("status", error_status(7000));
-    return arr;
-  }
-  uint32_t count = 0;
-  fm_status_t rc = fm_sheet_get_hyperlink_count(handle_, sheet, &count);
+namespace {
+
+fm_status_t hyperlink_item(fm_workbook_t* wb, uint32_t sheet, uint32_t index, emscripten::val* out) {
+  fm_hyperlink h{};
+  const fm_status_t rc = fm_sheet_get_hyperlink_at(wb, sheet, index, &h);
   if (rc != 0) {
-    arr.set("status", status_from_rc(rc));
-    return arr;
+    return rc;
   }
-  uint32_t emitted = 0;
-  for (uint32_t i = 0; i < count; ++i) {
-    fm_hyperlink h{};
-    rc = fm_sheet_get_hyperlink_at(handle_, sheet, i, &h);
-    if (rc != 0) {
-      arr.set("status", status_from_rc(rc));
-      return arr;
-    }
-    emscripten::val item = emscripten::val::object();
-    item.set("row", h.row);
-    item.set("col", h.col);
-    item.set("lastRow", h.last_row);
-    item.set("lastCol", h.last_col);
-    item.set("target", h.target != nullptr ? std::string(h.target) : std::string());
-    item.set("location", h.location != nullptr ? std::string(h.location) : std::string());
-    item.set("display", h.display != nullptr ? std::string(h.display) : std::string());
-    item.set("tooltip", h.tooltip != nullptr ? std::string(h.tooltip) : std::string());
-    arr.set(emitted, item);
-    ++emitted;
-  }
-  arr.set("status", ok_status());
-  return arr;
+  emscripten::val item = emscripten::val::object();
+  item.set("row", h.row);
+  item.set("col", h.col);
+  item.set("lastRow", h.last_row);
+  item.set("lastCol", h.last_col);
+  js_set_cstr_fields(item,
+                     {{"target", h.target}, {"location", h.location}, {"display", h.display}, {"tooltip", h.tooltip}});
+  *out = item;
+  return 0;
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::getHyperlinks(uint32_t sheet) const {
+  return sheet_list(handle_, sheet, &fm_sheet_get_hyperlink_count, &hyperlink_item);
 }
 
 // ---- Data validations --------------------------------------------------
 
-emscripten::val JsWorkbook::getValidations(uint32_t sheet) const {
-  emscripten::val arr = emscripten::val::array();
-  if (handle_ == nullptr) {
-    arr.set("status", error_status(7000));
-    return arr;
-  }
-  uint32_t count = 0;
-  fm_status_t rc = fm_sheet_get_validation_count(handle_, sheet, &count);
+namespace {
+
+fm_status_t validation_item(fm_workbook_t* wb, uint32_t sheet, uint32_t index, emscripten::val* out) {
+  fm_data_validation v{};
+  const fm_status_t rc = fm_sheet_get_validation_at(wb, sheet, index, &v);
   if (rc != 0) {
-    arr.set("status", status_from_rc(rc));
-    return arr;
+    return rc;
   }
-  uint32_t emitted = 0;
-  for (uint32_t i = 0; i < count; ++i) {
-    fm_data_validation v{};
-    rc = fm_sheet_get_validation_at(handle_, sheet, i, &v);
-    if (rc != 0) {
-      arr.set("status", status_from_rc(rc));
-      return arr;
-    }
-    emscripten::val item = emscripten::val::object();
-    emscripten::val ranges = emscripten::val::array();
-    for (uint32_t r = 0; r < v.range_count; ++r) {
-      ranges.set(r, merge_range_to_val(v.ranges[r]));
-    }
-    item.set("ranges", ranges);
-    item.set("type", v.type);
-    item.set("op", v.op);
-    item.set("errorStyle", v.error_style);
-    item.set("allowBlank", v.allow_blank != 0);
-    item.set("showInputMessage", v.show_input_message != 0);
-    item.set("showErrorMessage", v.show_error_message != 0);
-    item.set("showDropDown", v.show_dropdown != 0);
-    item.set("formula1", v.formula1 != nullptr ? std::string(v.formula1) : std::string());
-    item.set("formula2", v.formula2 != nullptr ? std::string(v.formula2) : std::string());
-    item.set("errorTitle", v.error_title != nullptr ? std::string(v.error_title) : std::string());
-    item.set("errorMessage", v.error_message != nullptr ? std::string(v.error_message) : std::string());
-    item.set("promptTitle", v.prompt_title != nullptr ? std::string(v.prompt_title) : std::string());
-    item.set("promptMessage", v.prompt_message != nullptr ? std::string(v.prompt_message) : std::string());
-    arr.set(emitted, item);
-    ++emitted;
+  emscripten::val item = emscripten::val::object();
+  emscripten::val ranges = emscripten::val::array();
+  for (uint32_t r = 0; r < v.range_count; ++r) {
+    ranges.set(r, merge_range_to_val(v.ranges[r]));
   }
-  arr.set("status", ok_status());
-  return arr;
+  item.set("ranges", ranges);
+  item.set("type", v.type);
+  item.set("op", v.op);
+  item.set("errorStyle", v.error_style);
+  item.set("allowBlank", v.allow_blank != 0);
+  item.set("showInputMessage", v.show_input_message != 0);
+  item.set("showErrorMessage", v.show_error_message != 0);
+  item.set("showDropDown", v.show_dropdown != 0);
+  js_set_cstr_fields(item, {{"formula1", v.formula1},
+                            {"formula2", v.formula2},
+                            {"errorTitle", v.error_title},
+                            {"errorMessage", v.error_message},
+                            {"promptTitle", v.prompt_title},
+                            {"promptMessage", v.prompt_message}});
+  *out = item;
+  return 0;
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::getValidations(uint32_t sheet) const {
+  return sheet_list(handle_, sheet, &fm_sheet_get_validation_count, &validation_item);
 }
 
 JsStatus JsWorkbook::addValidation(uint32_t sheet, emscripten::val v) {
@@ -339,40 +361,37 @@ JsStatus JsWorkbook::addValidation(uint32_t sheet, emscripten::val v) {
   // Pull every JS field into local storage first; the C ABI receives
   // borrowed `const char*` views that must stay valid until
   // `fm_sheet_add_validation` returns.
-  std::vector<fm_merge_range> ranges_buf;
-  if (v.hasOwnProperty("ranges")) {
-    emscripten::val ranges_js = v["ranges"];
-    if (ranges_js.isArray()) {
-      const uint32_t n = ranges_js["length"].as<uint32_t>();
-      ranges_buf.reserve(n);
-      for (uint32_t i = 0; i < n; ++i) {
-        emscripten::val rng = ranges_js[i];
-        fm_merge_range m{};
-        m.first_row = rng["firstRow"].as<uint32_t>();
-        m.last_row = rng["lastRow"].as<uint32_t>();
-        m.first_col = rng["firstCol"].as<uint32_t>();
-        m.last_col = rng["lastCol"].as<uint32_t>();
-        ranges_buf.push_back(m);
-      }
-    }
+  JsNarrowNumericReader reader("addValidation");
+  const std::vector<fm_merge_range> ranges_buf = js_pull_ranges(v, "ranges", &reader);
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  const std::string formula1 = reader.string(v, "formula1", "validation.formula1");
+  const std::string formula2 = reader.string(v, "formula2", "validation.formula2");
+  const std::string error_title = reader.string(v, "errorTitle", "validation.errorTitle");
+  const std::string error_message = reader.string(v, "errorMessage", "validation.errorMessage");
+  const std::string prompt_title = reader.string(v, "promptTitle", "validation.promptTitle");
+  const std::string prompt_message = reader.string(v, "promptMessage", "validation.promptMessage");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
   }
-  const std::string formula1 = js_pull_string(v, "formula1");
-  const std::string formula2 = js_pull_string(v, "formula2");
-  const std::string error_title = js_pull_string(v, "errorTitle");
-  const std::string error_message = js_pull_string(v, "errorMessage");
-  const std::string prompt_title = js_pull_string(v, "promptTitle");
-  const std::string prompt_message = js_pull_string(v, "promptMessage");
 
   fm_data_validation dv{};
   dv.ranges = ranges_buf.empty() ? nullptr : ranges_buf.data();
   dv.range_count = static_cast<uint32_t>(ranges_buf.size());
-  dv.type = js_pull_u8(v, "type", 0U);
-  dv.op = js_pull_u8(v, "op", 0U);
-  dv.error_style = js_pull_u8(v, "errorStyle", 0U);
-  dv.allow_blank = js_pull_bool(v, "allowBlank", false) ? 1 : 0;
-  dv.show_input_message = js_pull_bool(v, "showInputMessage", false) ? 1 : 0;
-  dv.show_error_message = js_pull_bool(v, "showErrorMessage", false) ? 1 : 0;
-  dv.show_dropdown = js_pull_bool(v, "showDropDown", true) ? 1 : 0;
+  dv.type = reader.u8(v, "type", 0U, "validation.type");
+  dv.op = reader.u8(v, "op", 0U, "validation.op");
+  dv.error_style = reader.u8(v, "errorStyle", 0U, "validation.errorStyle");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  dv.allow_blank = reader.boolean(v, "allowBlank", false, "validation.allowBlank") ? 1 : 0;
+  dv.show_input_message = reader.boolean(v, "showInputMessage", false, "validation.showInputMessage") ? 1 : 0;
+  dv.show_error_message = reader.boolean(v, "showErrorMessage", false, "validation.showErrorMessage") ? 1 : 0;
+  dv.show_dropdown = reader.boolean(v, "showDropDown", true, "validation.showDropDown") ? 1 : 0;
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
   dv.formula1 = formula1.empty() ? nullptr : formula1.c_str();
   dv.formula2 = formula2.empty() ? nullptr : formula2.c_str();
   dv.error_title = error_title.empty() ? nullptr : error_title.c_str();
@@ -399,6 +418,822 @@ JsStatus JsWorkbook::clearValidations(uint32_t sheet) {
   return status_from_rc(rc);
 }
 
+// ---- Typed AutoFilter --------------------------------------------------
+
+namespace {
+
+/// The six AutoFilter entry points, once for sheets and once for tables, so
+/// every JS method below is written a single time.
+struct AutoFilterOps {
+  fm_status_t (*get)(const fm_workbook_t*, size_t, fm_auto_filter*, int32_t*);
+  fm_status_t (*set)(fm_workbook_t*, size_t, const fm_auto_filter*);
+  fm_status_t (*remove)(fm_workbook_t*, size_t);
+  fm_status_t (*apply)(fm_workbook_t*, size_t);
+  fm_status_t (*clear)(fm_workbook_t*, size_t);
+  fm_status_t (*evaluate)(const fm_workbook_t*, size_t, uint8_t*, size_t, size_t*, uint32_t*);
+};
+
+constexpr AutoFilterOps kSheetAutoFilter = {fm_sheet_get_auto_filter,    fm_sheet_set_auto_filter,
+                                            fm_sheet_remove_auto_filter, fm_sheet_apply_auto_filter,
+                                            fm_sheet_clear_auto_filter,  fm_sheet_evaluate_auto_filter};
+constexpr AutoFilterOps kTableAutoFilter = {fm_table_get_auto_filter,    fm_table_set_auto_filter,
+                                            fm_table_remove_auto_filter, fm_table_apply_auto_filter,
+                                            fm_table_clear_auto_filter,  fm_table_evaluate_auto_filter};
+
+emscripten::val date_group_to_val(const fm_date_group_item& d) {
+  emscripten::val o = emscripten::val::object();
+  o.set("year", static_cast<uint32_t>(d.year));
+  o.set("month", static_cast<uint32_t>(d.month));
+  o.set("day", static_cast<uint32_t>(d.day));
+  o.set("hour", static_cast<uint32_t>(d.hour));
+  o.set("minute", static_cast<uint32_t>(d.minute));
+  o.set("second", static_cast<uint32_t>(d.second));
+  o.set("grouping", static_cast<uint32_t>(d.grouping));
+  return o;
+}
+
+emscripten::val filter_column_to_val(const fm_filter_column& c) {
+  emscripten::val o = emscripten::val::object();
+  o.set("colId", c.col_id);
+  o.set("hiddenButton", c.hidden_button != 0);
+  o.set("showButton", c.show_button != 0);
+  o.set("kind", c.kind);
+  o.set("filterBlank", c.filter_blank != 0);
+  emscripten::val values = emscripten::val::array();
+  for (uint32_t i = 0; i < c.value_count; ++i) {
+    values.set(i, std::string(c.values[i]));
+  }
+  o.set("values", values);
+  emscripten::val groups = emscripten::val::array();
+  for (uint32_t i = 0; i < c.date_group_count; ++i) {
+    groups.set(i, date_group_to_val(c.date_groups[i]));
+  }
+  o.set("dateGroups", groups);
+  o.set("customAnd", c.custom_and != 0);
+  o.set("customCount", c.custom_count);
+  o.set("op1", c.op1);
+  o.set("op2", c.op2);
+  o.set("top", c.top != 0);
+  o.set("percent", c.percent != 0);
+  o.set("hasFilterVal", c.has_filter_val != 0);
+  o.set("topVal", c.top_val);
+  o.set("filterVal", c.filter_val);
+  o.set("dynamicType", c.dynamic_type);
+  o.set("hasDynVal", c.has_dyn_val != 0);
+  o.set("hasDynMaxVal", c.has_dyn_max_val != 0);
+  o.set("dynVal", c.dyn_val);
+  o.set("dynMaxVal", c.dyn_max_val);
+  o.set("dxfId", c.dxf_id);
+  o.set("cellColor", c.cell_color != 0);
+  o.set("iconSet", c.icon_set);
+  o.set("iconId", c.icon_id);
+  o.set("hasIconId", c.has_icon_id != 0);
+  js_set_cstr_fields(o, {{"val1", c.val1}, {"val2", c.val2}, {"valIso", c.val_iso}, {"maxValIso", c.max_val_iso}});
+  return o;
+}
+
+emscripten::val sort_condition_to_val(const fm_sort_condition& c) {
+  emscripten::val o = emscripten::val::object();
+  o.set("ref", merge_range_to_val(c.ref));
+  o.set("descending", c.descending != 0);
+  o.set("sortBy", c.sort_by);
+  o.set("dxfId", c.dxf_id);
+  o.set("hasDxfId", c.has_dxf_id != 0);
+  o.set("iconSet", c.icon_set);
+  o.set("iconId", c.icon_id);
+  o.set("hasIconId", c.has_icon_id != 0);
+  js_set_cstr(o, "customList", c.custom_list);
+  return o;
+}
+
+emscripten::val auto_filter_to_val(const fm_auto_filter& f) {
+  emscripten::val o = emscripten::val::object();
+  o.set("range", merge_range_to_val(f.range));
+  emscripten::val columns = emscripten::val::array();
+  for (uint32_t i = 0; i < f.column_count; ++i) {
+    columns.set(i, filter_column_to_val(f.columns[i]));
+  }
+  o.set("columns", columns);
+  if (f.has_sort == 0) {
+    o.set("sort", emscripten::val::null());
+    return o;
+  }
+  emscripten::val sort = emscripten::val::object();
+  sort.set("ref", merge_range_to_val(f.sort_ref));
+  sort.set("columnSort", f.column_sort != 0);
+  sort.set("caseSensitive", f.case_sensitive != 0);
+  sort.set("sortMethod", f.sort_method);
+  emscripten::val conditions = emscripten::val::array();
+  for (uint32_t i = 0; i < f.condition_count; ++i) {
+    conditions.set(i, sort_condition_to_val(f.conditions[i]));
+  }
+  sort.set("conditions", conditions);
+  o.set("sort", sort);
+  return o;
+}
+
+/// Owns the strings and arrays one `fm_filter_column` points into.
+struct FilterColumnStore {
+  std::vector<std::string> values;
+  std::vector<const char*> value_ptrs;
+  std::vector<fm_date_group_item> date_groups;
+  std::string val1;
+  std::string val2;
+  std::string val_iso;
+  std::string max_val_iso;
+};
+
+/// Reads the JS array `v[key]`; absent or non-array reads as empty. Property
+/// access and Array.isArray both go through the reader's JS try/catch path.
+emscripten::val js_pull_array(const emscripten::val& v, const char* key, JsNarrowNumericReader& reader) {
+  if (v.isUndefined() || v.isNull()) {
+    return emscripten::val::array();
+  }
+  const emscripten::val a = reader.value(v, key, key);
+  if (!reader.ok() || a.isUndefined() || a.isNull()) {
+    return emscripten::val::array();
+  }
+  return reader.is_array(a, key) ? a : emscripten::val::array();
+}
+
+fm_date_group_item pull_date_group(const emscripten::val& v, JsNarrowNumericReader& reader) {
+  fm_date_group_item d{};
+  d.year = reader.u16(v, "year", 0U, "dateGroups[].year");
+  d.month = reader.u8(v, "month", 0U, "dateGroups[].month");
+  d.day = reader.u8(v, "day", 0U, "dateGroups[].day");
+  d.hour = reader.u8(v, "hour", 0U, "dateGroups[].hour");
+  d.minute = reader.u8(v, "minute", 0U, "dateGroups[].minute");
+  d.second = reader.u8(v, "second", 0U, "dateGroups[].second");
+  d.grouping = reader.u8(v, "grouping", 0U, "dateGroups[].grouping");
+  return d;
+}
+
+int32_t pull_flag(const emscripten::val& v, const char* key, JsNarrowNumericReader& reader, bool dflt = false) {
+  return reader.boolean(v, key, dflt, key) ? 1 : 0;
+}
+
+void pull_filter_column(const emscripten::val& v, FilterColumnStore& st, fm_filter_column& c,
+                        JsNarrowNumericReader& reader) {
+  c = fm_filter_column{};
+  c.col_id = reader.u32(v, "colId", 0U, "filterColumn.colId");
+  if (!reader.ok()) {
+    return;
+  }
+  c.hidden_button = pull_flag(v, "hiddenButton", reader);
+  c.show_button = pull_flag(v, "showButton", reader, true);
+  if (!reader.ok()) {
+    return;
+  }
+  c.kind = reader.i32(v, "kind", 0, "filterColumn.kind");
+  if (!reader.ok()) {
+    return;
+  }
+  c.filter_blank = pull_flag(v, "filterBlank", reader);
+  if (!reader.ok()) {
+    return;
+  }
+  const emscripten::val values = js_pull_array(v, "values", reader);
+  const uint32_t value_count = reader.length(values, "filterColumn.values.length");
+  if (!reader.ok()) {
+    return;
+  }
+  st.values.reserve(value_count);
+  for (uint32_t i = 0; i < value_count; ++i) {
+    const emscripten::val value = reader.array_element(values, i, "filterColumn.values[]");
+    if (!reader.ok()) {
+      return;
+    }
+    st.values.push_back(reader.string_value(value, "filterColumn.values[]"));
+    if (!reader.ok()) {
+      return;
+    }
+  }
+  for (const std::string& s : st.values) {
+    st.value_ptrs.push_back(s.c_str());
+  }
+  c.values = st.value_ptrs.empty() ? nullptr : st.value_ptrs.data();
+  c.value_count = static_cast<uint32_t>(st.value_ptrs.size());
+  const emscripten::val groups = js_pull_array(v, "dateGroups", reader);
+  const uint32_t group_count = reader.length(groups, "filterColumn.dateGroups.length");
+  if (!reader.ok()) {
+    return;
+  }
+  for (uint32_t i = 0; i < group_count; ++i) {
+    if (!reader.ok()) {
+      return;
+    }
+    const emscripten::val group = reader.array_element(groups, i, "dateGroups[]");
+    if (!reader.ok()) {
+      return;
+    }
+    if (group.isUndefined() || group.isNull()) {
+      continue;
+    }
+    st.date_groups.push_back(pull_date_group(group, reader));
+  }
+  if (!reader.ok()) {
+    return;
+  }
+  c.date_groups = st.date_groups.empty() ? nullptr : st.date_groups.data();
+  c.date_group_count = static_cast<uint32_t>(st.date_groups.size());
+  c.custom_and = pull_flag(v, "customAnd", reader);
+  c.custom_count = reader.i32(v, "customCount", 0, "filterColumn.customCount");
+  c.op1 = reader.i32(v, "op1", 0, "filterColumn.op1");
+  c.op2 = reader.i32(v, "op2", 0, "filterColumn.op2");
+  if (!reader.ok()) {
+    return;
+  }
+  st.val1 = reader.string(v, "val1", "filterColumn.val1");
+  st.val2 = reader.string(v, "val2", "filterColumn.val2");
+  st.val_iso = reader.string(v, "valIso", "filterColumn.valIso");
+  st.max_val_iso = reader.string(v, "maxValIso", "filterColumn.maxValIso");
+  if (!reader.ok()) {
+    return;
+  }
+  c.val1 = st.val1.c_str();
+  c.val2 = st.val2.c_str();
+  c.val_iso = st.val_iso.c_str();
+  c.max_val_iso = st.max_val_iso.c_str();
+  c.top = pull_flag(v, "top", reader);
+  c.percent = pull_flag(v, "percent", reader);
+  c.has_filter_val = pull_flag(v, "hasFilterVal", reader);
+  c.top_val = reader.number(v, "topVal", 0.0, "filterColumn.topVal");
+  c.filter_val = reader.number(v, "filterVal", 0.0, "filterColumn.filterVal");
+  c.dynamic_type = reader.i32(v, "dynamicType", 0, "filterColumn.dynamicType");
+  if (!reader.ok()) {
+    return;
+  }
+  c.has_dyn_val = pull_flag(v, "hasDynVal", reader);
+  c.has_dyn_max_val = pull_flag(v, "hasDynMaxVal", reader);
+  c.dyn_val = reader.number(v, "dynVal", 0.0, "filterColumn.dynVal");
+  c.dyn_max_val = reader.number(v, "dynMaxVal", 0.0, "filterColumn.dynMaxVal");
+  c.dxf_id = reader.u32(v, "dxfId", UINT32_MAX, "filterColumn.dxfId");
+  if (!reader.ok()) {
+    return;
+  }
+  c.cell_color = pull_flag(v, "cellColor", reader);
+  c.icon_set = reader.i32(v, "iconSet", 0, "filterColumn.iconSet");
+  c.icon_id = reader.i32(v, "iconId", 0, "filterColumn.iconId");
+  if (!reader.ok()) {
+    return;
+  }
+  c.has_icon_id = pull_flag(v, "hasIconId", reader);
+}
+
+void pull_sort_condition(const emscripten::val& v, std::string& custom_list, fm_sort_condition& c,
+                         JsNarrowNumericReader& reader) {
+  c = fm_sort_condition{};
+  c.ref = js_pull_range(reader.value(v, "ref", "sortCondition.ref"), &reader);
+  if (!reader.ok()) {
+    return;
+  }
+  c.descending = pull_flag(v, "descending", reader);
+  c.sort_by = reader.i32(v, "sortBy", 0, "sortCondition.sortBy");
+  if (!reader.ok()) {
+    return;
+  }
+  custom_list = reader.string(v, "customList", "sortCondition.customList");
+  c.custom_list = custom_list.c_str();
+  c.dxf_id = reader.u32(v, "dxfId", 0U, "sortCondition.dxfId");
+  if (!reader.ok()) {
+    return;
+  }
+  c.has_dxf_id = pull_flag(v, "hasDxfId", reader);
+  c.icon_set = reader.i32(v, "iconSet", 0, "sortCondition.iconSet");
+  c.icon_id = reader.i32(v, "iconId", 0, "sortCondition.iconId");
+  if (!reader.ok()) {
+    return;
+  }
+  c.has_icon_id = pull_flag(v, "hasIconId", reader);
+}
+
+emscripten::val get_auto_filter(const fm_workbook_t* wb, const AutoFilterOps& ops, uint32_t index) {
+  emscripten::val o = emscripten::val::object();
+  o.set("autoFilter", emscripten::val::null());
+  if (wb == nullptr) {
+    o.set("status", error_status(kBindingInvalidHandle));
+    return o;
+  }
+  fm_auto_filter f{};
+  int32_t present = 0;
+  const fm_status_t rc = ops.get(wb, index, &f, &present);
+  o.set("status", status_from_rc(rc));
+  if (rc == 0 && present != 0) {
+    o.set("autoFilter", auto_filter_to_val(f));
+  }
+  return o;
+}
+
+JsStatus set_auto_filter(fm_workbook_t* wb, const AutoFilterOps& ops, uint32_t index, const emscripten::val& filter) {
+  if (wb == nullptr) {
+    return error_status(kBindingInvalidHandle);
+  }
+  JsNarrowNumericReader reader("setAutoFilter");
+  fm_auto_filter f{};
+  f.range = js_pull_range(reader.value(filter, "range", "autoFilter.range"), &reader);
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  const emscripten::val columns = js_pull_array(filter, "columns", reader);
+  const uint32_t column_count = reader.length(columns, "autoFilter.columns.length");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  std::vector<FilterColumnStore> stores(column_count);
+  std::vector<fm_filter_column> cols(column_count);
+  for (uint32_t i = 0; i < column_count; ++i) {
+    if (!reader.ok()) {
+      break;
+    }
+    const emscripten::val column = reader.array_element(columns, i, "columns[]");
+    if (!reader.ok()) {
+      break;
+    }
+    if (column.isUndefined() || column.isNull()) {
+      continue;
+    }
+    pull_filter_column(column, stores[i], cols[i], reader);
+  }
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  f.columns = cols.empty() ? nullptr : cols.data();
+  f.column_count = column_count;
+  const emscripten::val sort = reader.value(filter, "sort", "autoFilter.sort");
+  std::vector<std::string> custom_lists;
+  std::vector<fm_sort_condition> conditions;
+  if (!sort.isUndefined() && !sort.isNull()) {
+    f.has_sort = 1;
+    f.sort_ref = js_pull_range(reader.value(sort, "ref", "sort.ref"), &reader);
+    if (!reader.ok()) {
+      return binding_error_status(kInvalidArgument, reader.message().c_str());
+    }
+    f.column_sort = pull_flag(sort, "columnSort", reader);
+    f.case_sensitive = pull_flag(sort, "caseSensitive", reader);
+    f.sort_method = reader.i32(sort, "sortMethod", 0, "sort.sortMethod");
+    if (!reader.ok()) {
+      return binding_error_status(kInvalidArgument, reader.message().c_str());
+    }
+    const emscripten::val list = js_pull_array(sort, "conditions", reader);
+    const uint32_t n = reader.length(list, "sort.conditions.length");
+    if (!reader.ok()) {
+      return binding_error_status(kInvalidArgument, reader.message().c_str());
+    }
+    custom_lists.resize(n);
+    conditions.resize(n);
+    for (uint32_t i = 0; i < n; ++i) {
+      if (!reader.ok()) {
+        break;
+      }
+      const emscripten::val condition = reader.array_element(list, i, "conditions[]");
+      if (!reader.ok()) {
+        break;
+      }
+      if (condition.isUndefined() || condition.isNull()) {
+        continue;
+      }
+      pull_sort_condition(condition, custom_lists[i], conditions[i], reader);
+    }
+    if (!reader.ok()) {
+      return binding_error_status(kInvalidArgument, reader.message().c_str());
+    }
+    f.conditions = conditions.empty() ? nullptr : conditions.data();
+    f.condition_count = n;
+  }
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  return status_from_rc(ops.set(wb, index, &f));
+}
+
+JsStatus run_auto_filter(fm_workbook_t* wb, fm_status_t (*fn)(fm_workbook_t*, size_t), uint32_t index) {
+  return wb == nullptr ? error_status(kBindingInvalidHandle) : status_from_rc(fn(wb, index));
+}
+
+emscripten::val evaluate_auto_filter(const fm_workbook_t* wb, const AutoFilterOps& ops, uint32_t index) {
+  emscripten::val o = emscripten::val::object();
+  o.set("firstRow", 0U);
+  o.set("match", emscripten::val::array());
+  if (wb == nullptr) {
+    o.set("status", error_status(kBindingInvalidHandle));
+    return o;
+  }
+  size_t len = 0;
+  uint32_t first_row = 0;
+  fm_status_t rc = ops.evaluate(wb, index, nullptr, 0, &len, &first_row);
+  std::vector<uint8_t> flags(len);
+  if (rc == 0 && len > 0) {
+    rc = ops.evaluate(wb, index, flags.data(), flags.size(), &len, &first_row);
+  }
+  if (rc != 0) {
+    o.set("status", error_status(rc));
+    return o;
+  }
+  emscripten::val match = emscripten::val::array();
+  for (size_t i = 0; i < flags.size(); ++i) {
+    match.call<void>("push", flags[i] != 0);
+  }
+  o.set("status", ok_status());
+  o.set("firstRow", first_row);
+  o.set("match", match);
+  return o;
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::getAutoFilter(uint32_t sheet) const {
+  return get_auto_filter(handle_, kSheetAutoFilter, sheet);
+}
+
+JsStatus JsWorkbook::setAutoFilter(uint32_t sheet, emscripten::val filter) {
+  return set_auto_filter(handle_, kSheetAutoFilter, sheet, filter);
+}
+
+JsStatus JsWorkbook::removeAutoFilter(uint32_t sheet) {
+  return run_auto_filter(handle_, fm_sheet_remove_auto_filter, sheet);
+}
+
+JsStatus JsWorkbook::applyAutoFilter(uint32_t sheet) {
+  return run_auto_filter(handle_, fm_sheet_apply_auto_filter, sheet);
+}
+
+JsStatus JsWorkbook::clearAutoFilter(uint32_t sheet) {
+  return run_auto_filter(handle_, fm_sheet_clear_auto_filter, sheet);
+}
+
+emscripten::val JsWorkbook::evaluateAutoFilter(uint32_t sheet) const {
+  return evaluate_auto_filter(handle_, kSheetAutoFilter, sheet);
+}
+
+emscripten::val JsWorkbook::getTableAutoFilter(uint32_t table) const {
+  return get_auto_filter(handle_, kTableAutoFilter, table);
+}
+
+JsStatus JsWorkbook::setTableAutoFilter(uint32_t table, emscripten::val filter) {
+  return set_auto_filter(handle_, kTableAutoFilter, table, filter);
+}
+
+JsStatus JsWorkbook::removeTableAutoFilter(uint32_t table) {
+  return run_auto_filter(handle_, fm_table_remove_auto_filter, table);
+}
+
+JsStatus JsWorkbook::applyTableAutoFilter(uint32_t table) {
+  return run_auto_filter(handle_, fm_table_apply_auto_filter, table);
+}
+
+JsStatus JsWorkbook::clearTableAutoFilter(uint32_t table) {
+  return run_auto_filter(handle_, fm_table_clear_auto_filter, table);
+}
+
+emscripten::val JsWorkbook::evaluateTableAutoFilter(uint32_t table) const {
+  return evaluate_auto_filter(handle_, kTableAutoFilter, table);
+}
+
+// ---- Threaded comments and persons -------------------------------------
+
+namespace {
+
+/// Owns the strings behind a list of `fm_mention`.
+struct MentionStore {
+  std::vector<std::string> person_ids;
+  std::vector<std::string> mention_ids;
+  std::vector<fm_mention> items;
+};
+
+void pull_mentions(const emscripten::val& list, MentionStore& st, JsNarrowNumericReader& reader) {
+  const uint32_t n = reader.is_array(list, "mentions") ? reader.length(list, "mentions.length") : 0U;
+  if (!reader.ok()) {
+    return;
+  }
+  st.person_ids.resize(n);
+  st.mention_ids.resize(n);
+  st.items.resize(n);
+  for (uint32_t i = 0; i < n; ++i) {
+    if (!reader.ok()) {
+      break;
+    }
+    const emscripten::val m = reader.array_element(list, i, "mentions[]");
+    if (!reader.ok()) {
+      break;
+    }
+    if (m.isUndefined() || m.isNull()) {
+      continue;
+    }
+    st.person_ids[i] = reader.string(m, "personId", "mention.personId");
+    st.mention_ids[i] = reader.string(m, "mentionId", "mention.mentionId");
+    const uint32_t start = reader.u32(m, "start", 0U, "mention.start");
+    const uint32_t length = reader.u32(m, "length", 0U, "mention.length");
+    st.items[i] = {st.person_ids[i].c_str(), st.mention_ids[i].c_str(), start, length};
+    if (!reader.ok()) {
+      break;
+    }
+  }
+}
+
+emscripten::val mention_to_val(const fm_mention& m) {
+  emscripten::val o = emscripten::val::object();
+  o.set("start", m.start);
+  o.set("length", m.length);
+  js_set_cstr_fields(o, {{"personId", m.person_id}, {"mentionId", m.mention_id}});
+  return o;
+}
+
+emscripten::val threaded_comment_to_val(const fm_threaded_comment& c) {
+  emscripten::val o = emscripten::val::object();
+  o.set("row", c.row);
+  o.set("col", c.col);
+  o.set("done", c.done != 0);
+  js_set_cstr_fields(
+      o,
+      {{"id", c.id}, {"personId", c.person_id}, {"created", c.created}, {"text", c.text}, {"parentId", c.parent_id}});
+  emscripten::val mentions = emscripten::val::array();
+  for (uint32_t i = 0; i < c.mention_count; ++i) {
+    mentions.set(i, mention_to_val(c.mentions[i]));
+  }
+  o.set("mentions", mentions);
+  return o;
+}
+
+emscripten::val person_to_val(const fm_person& p) {
+  emscripten::val o = emscripten::val::object();
+  js_set_cstr_fields(
+      o, {{"id", p.id}, {"displayName", p.display_name}, {"userId", p.user_id}, {"providerId", p.provider_id}});
+  return o;
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::getThreadedComments(uint32_t sheet) const {
+  emscripten::val o = emscripten::val::object();
+  emscripten::val comments = emscripten::val::array();
+  o.set("comments", comments);
+  if (handle_ == nullptr) {
+    o.set("status", error_status(kBindingInvalidHandle));
+    return o;
+  }
+  size_t count = 0;
+  fm_status_t rc = fm_sheet_threaded_comment_count(handle_, sheet, &count);
+  for (size_t i = 0; rc == 0 && i < count; ++i) {
+    fm_threaded_comment c{};
+    rc = fm_sheet_threaded_comment_at(handle_, sheet, i, &c);
+    if (rc == 0) {
+      comments.call<void>("push", threaded_comment_to_val(c));
+    }
+  }
+  o.set("status", status_from_rc(rc));
+  return o;
+}
+
+JsStatus JsWorkbook::addThreadedComment(uint32_t sheet, emscripten::val comment) {
+  if (handle_ == nullptr) {
+    return error_status(kBindingInvalidHandle);
+  }
+  JsNarrowNumericReader reader("addThreadedComment");
+  const std::string id = reader.string(comment, "id", "comment.id");
+  const std::string person_id = reader.string(comment, "personId", "comment.personId");
+  const std::string created = reader.string(comment, "created", "comment.created");
+  const std::string text = reader.string(comment, "text", "comment.text");
+  const std::string parent_id = reader.string(comment, "parentId", "comment.parentId");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  MentionStore mentions;
+  pull_mentions(reader.value(comment, "mentions", "comment.mentions"), mentions, reader);
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  fm_threaded_comment c{};
+  c.id = id.c_str();
+  c.row = reader.u32(comment, "row", 0U, "comment.row");
+  c.col = reader.u32(comment, "col", 0U, "comment.col");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  c.person_id = person_id.c_str();
+  c.created = created.c_str();
+  c.text = text.c_str();
+  c.parent_id = parent_id.c_str();
+  c.done = pull_flag(comment, "done", reader);
+  c.mentions = mentions.items.empty() ? nullptr : mentions.items.data();
+  c.mention_count = static_cast<uint32_t>(mentions.items.size());
+  return status_from_rc(fm_sheet_add_threaded_comment(handle_, sheet, &c));
+}
+
+JsStatus JsWorkbook::editThreadedComment(uint32_t sheet, const std::string& id, const std::string& text,
+                                         emscripten::val mentions) {
+  if (handle_ == nullptr) {
+    return error_status(kBindingInvalidHandle);
+  }
+  JsNarrowNumericReader reader("editThreadedComment");
+  MentionStore store;
+  pull_mentions(mentions, store, reader);
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  return status_from_rc(fm_sheet_edit_threaded_comment(handle_, sheet, id.c_str(), text.c_str(),
+                                                       store.items.empty() ? nullptr : store.items.data(),
+                                                       static_cast<uint32_t>(store.items.size())));
+}
+
+JsStatus JsWorkbook::setThreadResolved(uint32_t sheet, const std::string& threadId, bool done) {
+  if (handle_ == nullptr) {
+    return error_status(kBindingInvalidHandle);
+  }
+  return status_from_rc(fm_sheet_set_thread_resolved(handle_, sheet, threadId.c_str(), done ? 1 : 0));
+}
+
+JsStatus JsWorkbook::removeThreadedComment(uint32_t sheet, const std::string& id) {
+  if (handle_ == nullptr) {
+    return error_status(kBindingInvalidHandle);
+  }
+  return status_from_rc(fm_sheet_remove_threaded_comment(handle_, sheet, id.c_str()));
+}
+
+emscripten::val JsWorkbook::getPersons() const {
+  emscripten::val o = emscripten::val::object();
+  emscripten::val persons = emscripten::val::array();
+  o.set("persons", persons);
+  if (handle_ == nullptr) {
+    o.set("status", error_status(kBindingInvalidHandle));
+    return o;
+  }
+  size_t count = 0;
+  fm_status_t rc = fm_workbook_person_count(handle_, &count);
+  for (size_t i = 0; rc == 0 && i < count; ++i) {
+    fm_person p{};
+    rc = fm_workbook_person_at(handle_, i, &p);
+    if (rc == 0) {
+      persons.call<void>("push", person_to_val(p));
+    }
+  }
+  o.set("status", status_from_rc(rc));
+  return o;
+}
+
+JsStatus JsWorkbook::addPerson(emscripten::val person) {
+  if (handle_ == nullptr) {
+    return error_status(kBindingInvalidHandle);
+  }
+  JsNarrowNumericReader reader("addPerson");
+  const std::string id = reader.string(person, "id", "person.id");
+  const std::string display_name = reader.string(person, "displayName", "person.displayName");
+  const std::string user_id = reader.string(person, "userId", "person.userId");
+  const std::string provider_id = reader.string(person, "providerId", "person.providerId");
+  if (!reader.ok()) {
+    return binding_error_status(kInvalidArgument, reader.message().c_str());
+  }
+  const fm_person p = {id.c_str(), display_name.c_str(), user_id.c_str(), provider_id.c_str()};
+  return status_from_rc(fm_workbook_add_person(handle_, &p));
+}
+
+JsStatus JsWorkbook::removePerson(const std::string& id) {
+  if (handle_ == nullptr) {
+    return error_status(kBindingInvalidHandle);
+  }
+  return status_from_rc(fm_workbook_remove_person(handle_, id.c_str()));
+}
+
+// ---- Drawing images ----------------------------------------------------
+
+namespace {
+
+/// Envelope for the image calls: `status` plus the header info, zeroed on failure.
+emscripten::val image_info_to_val(fm_status_t rc, const fm_image_info& info) {
+  emscripten::val o = emscripten::val::object();
+  o.set("status", status_from_rc(rc));
+  o.set("format", rc == 0 ? info.format : 0);
+  o.set("pxWidth", rc == 0 ? info.px_width : 0U);
+  o.set("pxHeight", rc == 0 ? info.px_height : 0U);
+  return o;
+}
+
+emscripten::val image_info_binding_error(JsStatus status) {
+  emscripten::val o = emscripten::val::object();
+  o.set("status", status);
+  o.set("format", 0);
+  o.set("pxWidth", 0U);
+  o.set("pxHeight", 0U);
+  return o;
+}
+
+emscripten::val drawing_object_to_val(const fm_drawing_object& d) {
+  emscripten::val o = emscripten::val::object();
+  o.set("objectId", d.object_id);
+  o.set("kind", d.kind);
+  o.set("anchorKind", d.anchor_kind);
+  o.set("editAs", d.edit_as);
+  o.set("fromRow", d.from_row);
+  o.set("fromCol", d.from_col);
+  o.set("fromRowOff", static_cast<double>(d.from_row_off));
+  o.set("fromColOff", static_cast<double>(d.from_col_off));
+  o.set("toRow", d.to_row);
+  o.set("toCol", d.to_col);
+  o.set("toRowOff", static_cast<double>(d.to_row_off));
+  o.set("toColOff", static_cast<double>(d.to_col_off));
+  o.set("cx", static_cast<double>(d.cx));
+  o.set("cy", static_cast<double>(d.cy));
+  o.set("imageFormat", d.image_format);
+  js_set_cstr_fields(o, {{"name", d.name}, {"descr", d.descr}, {"mediaPath", d.media_path}});
+  return o;
+}
+
+}  // namespace
+
+emscripten::val JsWorkbook::probeImage(emscripten::val bytes) const {
+  if (handle_ == nullptr) {
+    return image_info_to_val(kBindingInvalidHandle, fm_image_info{});
+  }
+  const JsBytesReadResult bytes_result = val_to_bytes_checked(bytes);
+  if (!bytes_result.ok) {
+    return image_info_binding_error(binding_error_status(kInvalidArgument, bytes_result.message.c_str()));
+  }
+  const std::vector<uint8_t>& data = bytes_result.bytes;
+  fm_image_info info{};
+  const fm_status_t rc = fm_workbook_probe_image(handle_, data.data(), data.size(), &info);
+  return image_info_to_val(rc, info);
+}
+
+emscripten::val JsWorkbook::listDrawingObjects(uint32_t sheet) const {
+  emscripten::val arr = emscripten::val::array();
+  if (handle_ == nullptr) {
+    arr.set("status", error_status(kBindingInvalidHandle));
+    return arr;
+  }
+  size_t count = 0;
+  fm_status_t rc = fm_sheet_drawing_object_count(handle_, sheet, &count);
+  for (size_t i = 0; rc == 0 && i < count; ++i) {
+    fm_drawing_object d{};
+    rc = fm_sheet_drawing_object_at(handle_, sheet, i, &d);
+    if (rc == 0) {
+      arr.call<void>("push", drawing_object_to_val(d));
+    }
+  }
+  arr.set("status", status_from_rc(rc));
+  return arr;
+}
+
+emscripten::val JsWorkbook::getImage(uint32_t sheet, uint32_t objectId) const {
+  emscripten::val o;
+  if (handle_ == nullptr) {
+    o = image_info_to_val(kBindingInvalidHandle, fm_image_info{});
+    o.set("bytes", bytes_to_val(nullptr, 0));
+    return o;
+  }
+  const uint8_t* data = nullptr;
+  size_t len = 0;
+  fm_image_info info{};
+  const fm_status_t rc = fm_sheet_get_image(handle_, sheet, objectId, &data, &len, &info);
+  o = image_info_to_val(rc, info);
+  o.set("bytes", bytes_to_val(rc == 0 ? data : nullptr, rc == 0 ? len : 0));
+  return o;
+}
+
+emscripten::val JsWorkbook::insertImage(uint32_t sheet, emscripten::val bytes, emscripten::val opts) {
+  emscripten::val o = emscripten::val::object();
+  o.set("objectId", 0U);
+  if (handle_ == nullptr) {
+    o.set("status", error_status(kBindingInvalidHandle));
+    return o;
+  }
+  std::string name_store;
+  std::string descr_store;
+  JsNarrowNumericReader reader("insertImage");
+  const emscripten::val options = opts.isUndefined() || opts.isNull() ? emscripten::val::object() : opts;
+  const JsBytesReadResult bytes_result = val_to_bytes_checked(bytes);
+  if (!bytes_result.ok) {
+    o.set("status", binding_error_status(kInvalidArgument, bytes_result.message.c_str()));
+    return o;
+  }
+  const std::vector<uint8_t>& data = bytes_result.bytes;
+  fm_image_insert ins{};
+  ins.name = reader.optional_string(options, "name", name_store, "image.name");
+  ins.descr = reader.optional_string(options, "descr", descr_store, "image.descr");
+  ins.anchor_kind = reader.i32(options, "anchorKind", FM_ANCHOR_KIND_ONE_CELL, "image.anchorKind");
+  ins.edit_as = reader.i32(options, "editAs", FM_ANCHOR_EDIT_AS_TWO_CELL, "image.editAs");
+  ins.row = reader.u32(options, "row", 0U, "image.row");
+  ins.col = reader.u32(options, "col", 0U, "image.col");
+  ins.row_off_emu = reader.i64(options, "rowOffEmu", 0, "image.rowOffEmu");
+  ins.col_off_emu = reader.i64(options, "colOffEmu", 0, "image.colOffEmu");
+  ins.width_emu = reader.i64(options, "widthEmu", 0, "image.widthEmu");
+  ins.height_emu = reader.i64(options, "heightEmu", 0, "image.heightEmu");
+  if (!reader.ok()) {
+    o.set("status", binding_error_status(kInvalidArgument, reader.message().c_str()));
+    return o;
+  }
+  uint32_t id = 0;
+  const fm_status_t rc = fm_sheet_insert_image(handle_, sheet, data.data(), data.size(), &ins, &id);
+  o.set("status", status_from_rc(rc));
+  o.set("objectId", rc == 0 ? id : 0U);
+  return o;
+}
+
+JsStatus JsWorkbook::removeImage(uint32_t sheet, uint32_t objectId) {
+  if (handle_ == nullptr) {
+    return error_status(kBindingInvalidHandle);
+  }
+  return status_from_rc(fm_sheet_remove_image(handle_, sheet, objectId));
+}
+
 }  // namespace parts
 }  // namespace wasm
 }  // namespace formulon
diff --git a/src/workbook.cpp b/src/workbook.cpp
index 2afb6b97a..8d4c6ff37 100644
--- a/src/workbook.cpp
+++ b/src/workbook.cpp
@@ -13,20 +13,25 @@
 #include <mutex>
 #include <string>
 #include <string_view>
+#include <unordered_map>
 #include <utility>
 #include <vector>
 
+#include "auto_filter.h"
 #include "defined_name.h"
+#include "drawing/drawing_edit.h"
 #include "eval/builtin_names.h"
 #include "eval/dep_graph.h"
 #include "eval/iterative_solver.h"
 #include "eval/recalc_engine.h"
 #include "eval/scheduler.h"
 #include "external_link.h"
+#include "io/auto_filter_xml.h"
 #include "io/dynamic_array_formula.h"
 #include "io/format_detect.h"
 #include "io/future_functions.h"
 #include "io/ooxml_writer.h"
+#include "io/theme_part.h"
 #include "io/workbook_kind_ooxml.h"
 #include "io/xlsb/ptg_writer.h"
 #include "io/xlsb/writer.h"
@@ -36,6 +41,7 @@
 #include "parser/formula_prefix.h"
 #include "parser/parser.h"
 #include "parser/ref_transforms.h"
+#include "parser/reference.h"
 #include "passthrough_part.h"
 #include "phonetic.h"
 #include "pivot/pivot_cache.h"
@@ -44,6 +50,7 @@
 #include "sheet_name.h"
 #include "styles.h"
 #include "table.h"
+#include "utils/a1_ref.h"
 #include "utils/arena.h"
 #include "utils/error.h"
 #include "utils/expected.h"
@@ -60,6 +67,12 @@ namespace {
 // sheet-name helpers. Declared here so the early `add_sheet_validated`
 // definition can call it.
 Expected<void, Error> validate_sheet_name(std::string_view name);
+void reindex_formulas_referencing_sheet(std::vector<Sheet>& sheets, const eval::RecalcEngine::LockedMutator& mutator,
+                                        const Workbook& workbook, std::string_view changed_sheet);
+
+parser::AstNode* parse_indexable_formula(std::string_view body, Arena& arena) {
+  return eval::parse_formula_entry(body, arena);
+}
 }  // namespace
 
 Workbook::Workbook() : engine_(std::make_unique<eval::RecalcEngine>()), kind_(WorkbookKind::kXlsx) {}
@@ -67,6 +80,56 @@ Workbook::Workbook(Workbook&&) noexcept = default;
 Workbook& Workbook::operator=(Workbook&&) noexcept = default;
 Workbook::~Workbook() = default;
 
+Expected<void, Error> Workbook::add_passthrough_part(PassthroughPart part) {
+  if (part.path.empty()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "add_passthrough_part: empty part path");
+  }
+  for (const PassthroughPart& existing : passthrough_parts_) {
+    if (existing.path == part.path) {
+      return make_error(FormulonErrorCode::kInvalidArgument, "add_passthrough_part: part already present",
+                        "path=" + part.path);
+    }
+  }
+  passthrough_parts_.push_back(std::move(part));
+  sort_passthrough_parts(passthrough_parts_);
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::replace_passthrough_part(std::string_view path, std::vector<std::uint8_t> bytes) {
+  for (PassthroughPart& existing : passthrough_parts_) {
+    if (existing.path == path) {
+      existing.bytes = std::move(bytes);
+      return Expected<void, Error>::Ok();
+    }
+  }
+  return make_error(FormulonErrorCode::kInvalidArgument, "replace_passthrough_part: no such part",
+                    "path=" + std::string(path));
+}
+
+void Workbook::add_workbook_relationship(std::string type, std::string target) {
+  for (const UnknownRelationship& rel : unknown_workbook_rels_) {
+    if (!rel.target_external && rel.type == type && rel.target == target) {
+      return;
+    }
+  }
+  UnknownRelationship rel;
+  rel.type = std::move(type);
+  rel.target = std::move(target);
+  unknown_workbook_rels_.push_back(std::move(rel));
+}
+
+LoadedTheme Workbook::load_theme() const {
+  return io::load_theme(*this);
+}
+
+Expected<void, Error> Workbook::set_theme_colors(const ThemeColors& colors) {
+  return io::set_theme_colors(*this, colors);
+}
+
+Expected<void, Error> Workbook::set_theme_fonts(const ThemeFonts& fonts) {
+  return io::set_theme_fonts(*this, fonts);
+}
+
 namespace {
 
 /// OOXML pattern ordinal for `gray125`.
@@ -162,6 +225,10 @@ std::size_t Workbook::add_sheet(std::string name) {
     return kMaxSheets;
   }
   sheets_.emplace_back(Sheet{std::move(name)});
+  const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
+  if (mutator.has_ever_registered_formula()) {
+    reindex_formulas_referencing_sheet(sheets_, mutator, *this, sheets_.back().name());
+  }
   return sheets_.size() - 1U;
 }
 
@@ -169,6 +236,10 @@ Expected<std::size_t, Error> Workbook::add_sheet_checked(std::string name) {
   std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
   RETURN_IF_ERROR(check_sheet_headroom(sheets_.size()));
   sheets_.emplace_back(Sheet{std::move(name)});
+  const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
+  if (mutator.has_ever_registered_formula()) {
+    reindex_formulas_referencing_sheet(sheets_, mutator, *this, sheets_.back().name());
+  }
   return sheets_.size() - 1U;
 }
 
@@ -183,6 +254,10 @@ Expected<Sheet*, Error> Workbook::add_sheet_validated(std::string name) {
   }
   RETURN_IF_ERROR(check_sheet_headroom(sheets_.size()));
   sheets_.emplace_back(Sheet{std::move(name)});
+  const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
+  if (mutator.has_ever_registered_formula()) {
+    reindex_formulas_referencing_sheet(sheets_, mutator, *this, sheets_.back().name());
+  }
   return &sheets_.back();
 }
 
@@ -230,7 +305,7 @@ void reindex_all_formulas(std::vector<Sheet>& sheets, const eval::RecalcEngine::
         const eval::CellNodeId node{static_cast<std::uint16_t>(sheet_idx), row, static_cast<std::uint32_t>(col)};
         if (!body.empty()) {
           parser_arena.reset();
-          parser::AstNode* root = parser::parse_strict(body, parser_arena);
+          parser::AstNode* root = parse_indexable_formula(body, parser_arena);
           if (root != nullptr) {
             mutator.register_formula(node, *root, workbook);
           }
@@ -244,7 +319,7 @@ void reindex_all_formulas(std::vector<Sheet>& sheets, const eval::RecalcEngine::
 }
 
 // Which reference spelling `references_any` compares against its candidates.
-enum class RefKind : std::uint8_t { kName, kTable };
+enum class RefKind : std::uint8_t { kName, kTable, kSheet };
 
 // True once any entry of `candidates` (case-insensitive) is named by a
 // reference of `kind` in `node`'s subtree. A name is a `NameRef`, a `[0]!Name`
@@ -258,24 +333,38 @@ enum class RefKind : std::uint8_t { kName, kTable };
 // reference only costs an unnecessary reindex, never a missed one.
 bool references_any(const parser::AstNode& node, const std::vector<std::string>& candidates, RefKind kind) {
   const auto matches = [&](RefKind ref_kind, std::string_view ref) {
-    return ref_kind == kind && std::any_of(candidates.begin(), candidates.end(),
-                                           [&](const std::string& n) { return strings::case_insensitive_eq(n, ref); });
+    if (ref_kind != kind) {
+      return false;
+    }
+    return std::any_of(candidates.begin(), candidates.end(), [&](const std::string& n) {
+      return kind == RefKind::kSheet ? sheet_names::equal(n, ref) : strings::case_insensitive_eq(n, ref);
+    });
   };
   const auto any = [&](const parser::AstNode& child) { return references_any(child, candidates, kind); };
   switch (node.kind()) {
     case parser::NodeKind::NameRef:
-      return matches(RefKind::kName, node.as_name());
+      return matches(RefKind::kSheet, node.as_name_sheet()) || matches(RefKind::kName, node.as_name());
     case parser::NodeKind::StructuredRef:
       return matches(RefKind::kTable, node.as_structured_ref_table());
     case parser::NodeKind::ExternalRef:
-      return parser::is_self_book_name_ref(node) && matches(RefKind::kName, node.as_external_ref_name());
+      // External workbook sheets and literals are outside this workbook. The
+      // self-book form is a defined-name spelling and has no sheet qualifier.
+      return kind != RefKind::kSheet && parser::is_self_book_name_ref(node) &&
+             matches(RefKind::kName, node.as_external_ref_name());
     case parser::NodeKind::Literal:
     case parser::NodeKind::ErrorLiteral:
     case parser::NodeKind::ErrorPlaceholder:
+      return false;
     case parser::NodeKind::Ref:
+      return matches(RefKind::kSheet, node.as_ref().sheet);
     case parser::NodeKind::SpillRef:
+      if (const parser::AstNode* anchor = node.as_spill_ref_anchor_expr(); anchor != nullptr) {
+        return any(*anchor);
+      }
+      return matches(RefKind::kSheet, node.as_spill_ref().sheet);
     case parser::NodeKind::Ref3D:
-      return false;
+      return matches(RefKind::kSheet, node.as_ref3d_sheet_begin()) ||
+             matches(RefKind::kSheet, node.as_ref3d_sheet_end());
     case parser::NodeKind::UnaryOp:
       return any(node.as_unary_operand());
     case parser::NodeKind::BinaryOp:
@@ -343,23 +432,23 @@ bool references_any_table(const parser::AstNode& root, const std::vector<std::st
   return references_any(root, candidates, RefKind::kTable);
 }
 
-// Closure of defined names whose resolved value can change when
-// `changed_name` is added, retargeted, or removed: `changed_name` itself,
-// plus every other defined name whose own formula references it
-// (transitively). `defined_names` is a handful of entries in practice, so
-// the O(names^2) fixpoint here is cheap next to reparsing every formula
-// cell in the workbook, which the caller below does exactly once per
-// affected cell rather than once per cell regardless of relevance.
-std::vector<std::string> collect_affected_names(const std::vector<DefinedName>& defined_names,
-                                                std::string_view changed_name) {
-  std::vector<std::string> affected{std::string(changed_name)};
+bool references_any_sheet(const parser::AstNode& root, const std::vector<std::string>& candidates) {
+  return references_any(root, candidates, RefKind::kSheet);
+}
+
+bool contains_affected_name(const std::vector<std::string>& affected, std::string_view candidate) {
+  return std::any_of(affected.begin(), affected.end(),
+                     [&](const std::string& name) { return strings::case_insensitive_eq(name, candidate); });
+}
+
+std::vector<std::string> close_affected_names(const std::vector<DefinedName>& defined_names,
+                                              std::vector<std::string> affected) {
   Arena arena;
   bool grew = true;
   while (grew) {
     grew = false;
     for (const DefinedName& entry : defined_names) {
-      if (std::any_of(affected.begin(), affected.end(),
-                      [&](const std::string& n) { return strings::case_insensitive_eq(n, entry.name); })) {
+      if (contains_affected_name(affected, entry.name)) {
         continue;
       }
       std::string_view body = entry.formula;
@@ -370,7 +459,7 @@ std::vector<std::string> collect_affected_names(const std::vector<DefinedName>&
         continue;
       }
       arena.reset();
-      const parser::AstNode* root = parser::parse_strict(body, arena);
+      const parser::AstNode* root = parse_indexable_formula(body, arena);
       if (root != nullptr && references_any_name(*root, affected)) {
         affected.emplace_back(entry.name);
         grew = true;
@@ -380,6 +469,44 @@ std::vector<std::string> collect_affected_names(const std::vector<DefinedName>&
   return affected;
 }
 
+// Closure of defined names whose resolved value can change when
+// `changed_name` is added, retargeted, or removed: `changed_name` itself,
+// plus every other defined name whose own formula references it
+// (transitively). `defined_names` is a handful of entries in practice, so
+// the O(names^2) fixpoint here is cheap next to reparsing every formula
+// cell in the workbook, which the caller below does exactly once per
+// affected cell rather than once per cell regardless of relevance.
+std::vector<std::string> collect_affected_names(const std::vector<DefinedName>& defined_names,
+                                                std::string_view changed_name) {
+  return close_affected_names(defined_names, {std::string(changed_name)});
+}
+
+// Seeds the same reverse-alias closure from every defined name whose body
+// mentions `changed_sheet`. Direct sheet references are handled separately;
+// these seeds cover formulas that reach the sheet only through a name.
+std::vector<std::string> collect_affected_names_referencing_sheet(const std::vector<DefinedName>& defined_names,
+                                                                  std::string_view changed_sheet) {
+  std::vector<std::string> affected;
+  const std::vector<std::string> sheet_candidates{std::string(changed_sheet)};
+  Arena arena;
+  for (const DefinedName& entry : defined_names) {
+    std::string_view body = entry.formula;
+    if (!body.empty() && body.front() == '=') {
+      body.remove_prefix(1);
+    }
+    if (body.empty()) {
+      continue;
+    }
+    arena.reset();
+    const parser::AstNode* root = parse_indexable_formula(body, arena);
+    if (root != nullptr && references_any_sheet(*root, sheet_candidates) &&
+        !contains_affected_name(affected, entry.name)) {
+      affected.emplace_back(entry.name);
+    }
+  }
+  return close_affected_names(defined_names, std::move(affected));
+}
+
 // Re-registers and dirties only the formula cells whose value can change
 // when `changed_name` (and every name that transitively references it, per
 // `collect_affected_names`) is added, retargeted, or removed. Unlike
@@ -414,7 +541,7 @@ void reindex_formulas_if(std::vector<Sheet>& sheets, const eval::RecalcEngine::L
           continue;
         }
         parser_arena.reset();
-        parser::AstNode* root = parser::parse_strict(body, parser_arena);
+        parser::AstNode* root = parse_indexable_formula(body, parser_arena);
         if (root == nullptr || !affected(*root)) {
           continue;
         }
@@ -435,6 +562,79 @@ void reindex_formulas_referencing_name(std::vector<Sheet>& sheets, const eval::R
                       [&](const parser::AstNode& root) { return references_any_name(root, affected); });
 }
 
+void reindex_formulas_referencing_sheet(std::vector<Sheet>& sheets, const eval::RecalcEngine::LockedMutator& mutator,
+                                        const Workbook& workbook, std::string_view changed_sheet) {
+  const std::vector<std::string> sheet_candidates{std::string(changed_sheet)};
+  const std::vector<std::string> affected_names =
+      collect_affected_names_referencing_sheet(workbook.defined_names(), changed_sheet);
+  reindex_formulas_if(sheets, mutator, workbook, [&](const parser::AstNode& root) {
+    return references_any_sheet(root, sheet_candidates) || references_any_name(root, affected_names);
+  });
+}
+
+// Hidden sheet-scoped name Excel keeps over a sheet AutoFilter's range.
+constexpr std::string_view kFilterDatabaseName = "_xlnm._FilterDatabase";
+
+/// `Sheet1!$B$2:$F$12`, quoting the sheet name where Excel would.
+std::string filter_database_formula(std::string_view sheet_name, const MergeRange& range) {
+  std::string out;
+  parser::append_sheet_name(sheet_name, false, out);
+  out.push_back('!');
+  const auto append_cell = [&out](std::uint32_t row, std::uint32_t col) {
+    const std::string a1 = a1::encode_a1(row, col);
+    const std::size_t digits = a1.find_first_of("0123456789");
+    out.push_back('$');
+    out.append(a1, 0, digits);
+    out.push_back('$');
+    out.append(a1, digits, std::string::npos);
+  };
+  append_cell(range.first_row, range.first_col);
+  out.push_back(':');
+  append_cell(range.last_row, range.last_col);
+  return out;
+}
+
+/// Removes the `_FilterDatabase` name scoped to `sheet_index`. Returns true
+/// when one existed.
+bool erase_filter_database_name(std::vector<DefinedName>& names, std::size_t sheet_index) {
+  const auto it = std::find_if(names.begin(), names.end(), [sheet_index](const DefinedName& entry) {
+    return entry.local_sheet_id == static_cast<std::int32_t>(sheet_index) &&
+           strings::case_insensitive_eq(entry.name, kFilterDatabaseName);
+  });
+  if (it == names.end()) {
+    return false;
+  }
+  names.erase(it);
+  return true;
+}
+
+/// Body of `Workbook::mark_row_visibility_dependents_dirty`; the caller
+/// holds the engine mutex.
+void mark_row_visibility_dependents_dirty_locked(const std::vector<Sheet>& sheets,
+                                                 const eval::RecalcEngine::LockedMutator& mutator) {
+  for (std::size_t sheet_idx = 0; sheet_idx < sheets.size(); ++sheet_idx) {
+    const Sheet& sheet = sheets[sheet_idx];
+    for (const auto& [row, cells] : sheet.rows()) {
+      for (std::size_t col = 0; col < cells.size(); ++col) {
+        const Cell& cell = cells[col];
+        if (cell.formula_text.empty()) {
+          continue;
+        }
+        // SUBTOTAL/AGGREGATE can only be called by literally spelling one
+        // of these names, so this text scan has no false negatives; a
+        // string literal that happens to contain one costs a harmless
+        // extra dirty mark rather than reparsing every formula in the
+        // workbook to test more precisely.
+        if (strings::case_insensitive_contains(cell.formula_text, "SUBTOTAL") ||
+            strings::case_insensitive_contains(cell.formula_text, "AGGREGATE")) {
+          mutator.mark_dirty(
+              eval::CellNodeId{static_cast<std::uint16_t>(sheet_idx), row, static_cast<std::uint32_t>(col)});
+        }
+      }
+    }
+  }
+}
+
 // Re-registers and dirties only the formula cells whose structured
 // reference resolves through `dep_extractor` into a static rectangle
 // derived from a table's current `ref`/columns (see
@@ -585,6 +785,9 @@ Expected<void, Error> Workbook::rename_sheet(std::uint32_t index, std::string ne
   // name while formatting, then the final name makes all newly-written text
   // resolvable for the next recalc.
   sheets_[index].set_name(std::move(new_name));
+  if (mutator.has_ever_registered_formula()) {
+    reindex_formulas_referencing_sheet(sheets_, mutator, *this, sheets_[index].name());
+  }
   return Expected<void, Error>::Ok();
 }
 
@@ -604,6 +807,19 @@ Expected<void, Error> Workbook::remove_sheet(std::uint32_t index) {
 
   const std::string removed_name = sheets_[index].name();
 
+  std::vector<std::uint32_t> old_to_new(sheets_.size());
+  const std::uint32_t new_last_index = static_cast<std::uint32_t>(sheets_.size() - 2U);
+  for (std::uint32_t old_index = 0; old_index < old_to_new.size(); ++old_index) {
+    if (old_index < index) {
+      old_to_new[old_index] = old_index;
+    } else if (old_index > index) {
+      old_to_new[old_index] = old_index - 1U;
+    } else {
+      old_to_new[old_index] = std::min(index, new_last_index);
+    }
+  }
+  remap_book_views_xml(book_views_xml_, old_to_new);
+
   const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
   std::vector<std::string_view> pre_removal_sheet_order;
   pre_removal_sheet_order.reserve(sheets_.size());
@@ -690,6 +906,20 @@ Expected<void, Error> Workbook::move_sheet(std::uint32_t from_index, std::uint32
     return Expected<void, Error>::Ok();
   }
 
+  std::vector<std::uint32_t> old_to_new(sheets_.size());
+  for (std::uint32_t old_index = 0; old_index < old_to_new.size(); ++old_index) {
+    if (old_index == from_index) {
+      old_to_new[old_index] = to_index;
+    } else if (from_index < to_index && old_index > from_index && old_index <= to_index) {
+      old_to_new[old_index] = old_index - 1U;
+    } else if (from_index > to_index && old_index >= to_index && old_index < from_index) {
+      old_to_new[old_index] = old_index + 1U;
+    } else {
+      old_to_new[old_index] = old_index;
+    }
+  }
+  remap_book_views_xml(book_views_xml_, old_to_new);
+
   // `to_index` is the destination in the *post-removal* sheet list, which
   // matches Excel's UI semantics. Implementation: lift the sheet out,
   // then insert at the destination. The sheet vector mutation and the
@@ -736,6 +966,44 @@ Expected<void, Error> Workbook::move_sheet(std::uint32_t from_index, std::uint32
   return Expected<void, Error>::Ok();
 }
 
+void Workbook::set_defined_names(std::vector<DefinedName> names) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  std::vector<std::string> changed;
+  {
+    // Declaration order matters for duplicate definitions. Metadata and
+    // case-only spelling changes do not alter name resolution.
+    using Definitions = std::vector<std::pair<std::int32_t, std::string_view>>;
+    const auto group = [](const std::vector<DefinedName>& entries) {
+      std::unordered_map<std::string, Definitions> grouped;
+      for (const DefinedName& entry : entries) {
+        grouped[strings::to_ascii_lower(entry.name)].emplace_back(entry.local_sheet_id, entry.formula);
+      }
+      return grouped;
+    };
+    const auto before = group(defined_names_);
+    const auto after = group(names);
+    for (const auto& [name, definitions] : before) {
+      const auto found = after.find(name);
+      if (found == after.end() || definitions != found->second) {
+        changed.push_back(name);
+      }
+    }
+    for (const auto& [name, definitions] : after) {
+      if (before.find(name) == before.end()) {
+        changed.push_back(name);
+      }
+    }
+  }
+  defined_names_ = std::move(names);
+  if (changed.empty()) {
+    return;
+  }
+  const auto affected = close_affected_names(defined_names_, std::move(changed));
+  const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
+  reindex_formulas_if(sheets_, mutator, *this,
+                      [&](const parser::AstNode& root) { return references_any_name(root, affected); });
+}
+
 Expected<void, Error> Workbook::set_defined_name(std::string name, std::string formula) {
   return set_defined_name_scoped(std::move(name), std::move(formula), -1);
 }
@@ -799,6 +1067,105 @@ Expected<void, Error> Workbook::set_defined_name_scoped(std::string name, std::s
   return Expected<void, Error>::Ok();
 }
 
+Expected<void, Error> Workbook::set_defined_name_hidden(std::string_view name, std::int32_t local_sheet_id,
+                                                        bool hidden) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  for (DefinedName& entry : defined_names_) {
+    if (entry.local_sheet_id == local_sheet_id && strings::case_insensitive_eq(entry.name, name)) {
+      entry.hidden = hidden;
+      return Expected<void, Error>::Ok();
+    }
+  }
+  return make_error(FormulonErrorCode::kInvalidArgument, "set_defined_name_hidden: no such defined name",
+                    "name=" + std::string(name) + " local_sheet_id=" + std::to_string(local_sheet_id));
+}
+
+Expected<void, Error> Workbook::set_sheet_auto_filter(std::size_t sheet_index, AutoFilter filter) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (sheet_index >= sheets_.size()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "set_sheet_auto_filter: sheet_index out of range",
+                      "sheet_index=" + std::to_string(sheet_index));
+  }
+  RETURN_IF_ERROR(validate_auto_filter(filter));
+  std::string formula = filter_database_formula(sheets_[sheet_index].name(), filter.range);
+  sheets_[sheet_index].set_auto_filter(std::move(filter));
+  const auto scope = static_cast<std::int32_t>(sheet_index);
+  const auto it = std::find_if(defined_names_.begin(), defined_names_.end(), [scope](const DefinedName& entry) {
+    return entry.local_sheet_id == scope && strings::case_insensitive_eq(entry.name, kFilterDatabaseName);
+  });
+  if (it != defined_names_.end()) {
+    it->formula = std::move(formula);
+    it->hidden = true;
+  } else {
+    DefinedName entry;
+    entry.name = std::string(kFilterDatabaseName);
+    entry.formula = std::move(formula);
+    entry.local_sheet_id = scope;
+    entry.hidden = true;
+    defined_names_.push_back(std::move(entry));
+  }
+  const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
+  reindex_formulas_referencing_name(sheets_, mutator, *this, kFilterDatabaseName);
+  mark_row_visibility_dependents_dirty_locked(sheets_, mutator);
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::remove_sheet_auto_filter(std::size_t sheet_index) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (sheet_index >= sheets_.size()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "remove_sheet_auto_filter: sheet_index out of range",
+                      "sheet_index=" + std::to_string(sheet_index));
+  }
+  sheets_[sheet_index].clear_auto_filter_model();
+  const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
+  if (erase_filter_database_name(defined_names_, sheet_index)) {
+    reindex_formulas_referencing_name(sheets_, mutator, *this, kFilterDatabaseName);
+  }
+  mark_row_visibility_dependents_dirty_locked(sheets_, mutator);
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::set_sheet_auto_filter_xml(std::size_t sheet_index, std::string_view xml) {
+  if (xml.empty()) {
+    return remove_sheet_auto_filter(sheet_index);
+  }
+  Expected<AutoFilter, Error> parsed = io::parse_auto_filter_xml(xml);
+  if (parsed && validate_auto_filter(parsed.value())) {
+    return set_sheet_auto_filter(sheet_index, std::move(parsed.value()));
+  }
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (sheet_index >= sheets_.size()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "set_sheet_auto_filter_xml: sheet_index out of range",
+                      "sheet_index=" + std::to_string(sheet_index));
+  }
+  sheets_[sheet_index].set_auto_filter(io::auto_filter_from_xml(xml));
+  mark_row_visibility_dependents_dirty_locked(sheets_, engine_->locked_mutator());
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::set_table_auto_filter(std::size_t table_index, AutoFilter filter) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (table_index >= tables_.size()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "set_table_auto_filter: table_index out of range",
+                      "table_index=" + std::to_string(table_index));
+  }
+  RETURN_IF_ERROR(validate_auto_filter(filter));
+  tables_[table_index].auto_filter_xml.set(std::move(filter));
+  mark_row_visibility_dependents_dirty_locked(sheets_, engine_->locked_mutator());
+  return Expected<void, Error>::Ok();
+}
+
+Expected<void, Error> Workbook::remove_table_auto_filter(std::size_t table_index) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (table_index >= tables_.size()) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "remove_table_auto_filter: table_index out of range",
+                      "table_index=" + std::to_string(table_index));
+  }
+  tables_[table_index].auto_filter_xml.reset();
+  mark_row_visibility_dependents_dirty_locked(sheets_, engine_->locked_mutator());
+  return Expected<void, Error>::Ok();
+}
+
 void Workbook::reindex_formulas_for_table_change(const std::vector<std::string>& table_names) {
   if (table_names.empty()) {
     return;
@@ -988,25 +1355,22 @@ void mark_blocked_spill_anchors_released_by_cell(const eval::RecalcEngine::Locke
   mark_blocked_spill_anchors_intersecting(mutator, sheet_index, sheets, row, col);
 }
 
-void mark_blocked_spill_anchors_intersecting_merge(const eval::RecalcEngine::LockedMutator& mutator,
-                                                   std::size_t sheet_index, const std::vector<Sheet>& sheets,
-                                                   const MergeRange& merge) {
-  if (merge.first_row > merge.last_row || merge.first_col > merge.last_col ||
-      !Sheet::coord_in_grid(merge.first_row, merge.first_col) ||
-      !Sheet::coord_in_grid(merge.last_row, merge.last_col)) {
-    return;
-  }
-  const std::uint32_t rows = merge.last_row - merge.first_row + 1U;
-  const std::uint32_t cols = merge.last_col - merge.first_col + 1U;
-  for (const CellAddress anchor :
-       sheets[sheet_index].blocked_spill_anchors_intersecting(merge.first_row, merge.first_col, rows, cols)) {
-    mutator.mark_dirty(make_node(sheet_index, anchor.row, anchor.col));
-  }
+/// `Sheet::blocked_spill_anchors_intersecting` or
+/// `Sheet::committed_spill_anchors_intersecting`.
+using SpillAnchorQuery = std::vector<CellAddress> (Sheet::*)(std::uint32_t, std::uint32_t, std::uint32_t,
+                                                             std::uint32_t) const;
+
+MergeRange normalize_merge_range(MergeRange merge) noexcept {
+  const std::uint32_t first_row = std::min(merge.first_row, merge.last_row);
+  const std::uint32_t first_col = std::min(merge.first_col, merge.last_col);
+  const std::uint32_t last_row = std::max(merge.first_row, merge.last_row);
+  const std::uint32_t last_col = std::max(merge.first_col, merge.last_col);
+  return MergeRange{first_row, first_col, last_row, last_col};
 }
 
-void mark_committed_spill_anchors_intersecting_merge(const eval::RecalcEngine::LockedMutator& mutator,
-                                                     std::size_t sheet_index, const std::vector<Sheet>& sheets,
-                                                     const MergeRange& merge) {
+void mark_spill_anchors_intersecting_merge(const eval::RecalcEngine::LockedMutator& mutator, std::size_t sheet_index,
+                                           const std::vector<Sheet>& sheets, const MergeRange& merge,
+                                           SpillAnchorQuery query) {
   if (merge.first_row > merge.last_row || merge.first_col > merge.last_col ||
       !Sheet::coord_in_grid(merge.first_row, merge.first_col) ||
       !Sheet::coord_in_grid(merge.last_row, merge.last_col)) {
@@ -1014,8 +1378,7 @@ void mark_committed_spill_anchors_intersecting_merge(const eval::RecalcEngine::L
   }
   const std::uint32_t rows = merge.last_row - merge.first_row + 1U;
   const std::uint32_t cols = merge.last_col - merge.first_col + 1U;
-  for (const CellAddress anchor :
-       sheets[sheet_index].committed_spill_anchors_intersecting(merge.first_row, merge.first_col, rows, cols)) {
+  for (const CellAddress anchor : (sheets[sheet_index].*query)(merge.first_row, merge.first_col, rows, cols)) {
     mutator.mark_dirty(make_node(sheet_index, anchor.row, anchor.col));
   }
 }
@@ -1168,12 +1531,7 @@ Expected<void, Error> Workbook::set_cell_formula(std::size_t sheet_index, std::u
   }
 
   Arena tmp_arena;
-  parser::AstNode* root = parser::parse_strict(src, tmp_arena);
-  // Excel refuses a sheet- or book-qualified call to a built-in at entry;
-  // treat it like any other formula that fails to parse.
-  if (root != nullptr && eval::find_qualified_builtin_call(*root) != nullptr) {
-    root = nullptr;
-  }
+  parser::AstNode* root = parse_indexable_formula(src, tmp_arena);
 
   // The compound mutation runs under a single hold of the engine mutex
   // so a concurrent `recalc_parallel` does not see a half-applied
@@ -1226,13 +1584,21 @@ Expected<void, Error> Workbook::add_merge(std::size_t sheet_index, MergeRange me
     return make_error(FormulonErrorCode::kInvalidArgument, "add_merge: sheet_index out of range",
                       "sheet_index=" + std::to_string(sheet_index));
   }
+  merge = normalize_merge_range(merge);
+  if (!Sheet::rect_in_grid(merge.first_row, merge.first_col, merge.last_row, merge.last_col)) {
+    return make_error(FormulonErrorCode::kInvalidArgument, "add_merge: range out of grid",
+                      "first_row=" + std::to_string(merge.first_row) + " first_col=" + std::to_string(merge.first_col) +
+                          " last_row=" + std::to_string(merge.last_row) +
+                          " last_col=" + std::to_string(merge.last_col));
+  }
   std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
   const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
   sheets_[sheet_index].add_merge(merge);
   // A merge added over a committed spill becomes a blocker for the next
   // evaluation. Keep the anchor dirty so recalc clears the old rectangle and
   // records the resulting #SPILL! state under the normal commit contract.
-  mark_committed_spill_anchors_intersecting_merge(mutator, sheet_index, sheets_, merge);
+  mark_spill_anchors_intersecting_merge(mutator, sheet_index, sheets_, merge,
+                                        &Sheet::committed_spill_anchors_intersecting);
   return Expected<void, Error>::Ok();
 }
 
@@ -1241,11 +1607,13 @@ Expected<void, Error> Workbook::remove_merges_intersecting(std::size_t sheet_ind
     return make_error(FormulonErrorCode::kInvalidArgument, "remove_merges_intersecting: sheet_index out of range",
                       "sheet_index=" + std::to_string(sheet_index));
   }
+  merge = normalize_merge_range(merge);
   std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
   const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
   const std::vector<MergeRange> removed = sheets_[sheet_index].remove_merges_intersecting(merge);
   for (const MergeRange& erased : removed) {
-    mark_blocked_spill_anchors_intersecting_merge(mutator, sheet_index, sheets_, erased);
+    mark_spill_anchors_intersecting_merge(mutator, sheet_index, sheets_, erased,
+                                          &Sheet::blocked_spill_anchors_intersecting);
   }
   return Expected<void, Error>::Ok();
 }
@@ -1262,7 +1630,8 @@ Expected<void, Error> Workbook::remove_merge_at(std::size_t sheet_index, std::si
     return make_error(FormulonErrorCode::kInvalidArgument, "remove_merge_at: index out of range",
                       "index=" + std::to_string(index));
   }
-  mark_blocked_spill_anchors_intersecting_merge(mutator, sheet_index, sheets_, removed);
+  mark_spill_anchors_intersecting_merge(mutator, sheet_index, sheets_, removed,
+                                        &Sheet::blocked_spill_anchors_intersecting);
   return Expected<void, Error>::Ok();
 }
 
@@ -1289,6 +1658,53 @@ Expected<void, Error> Workbook::recalc_parallel(const eval::FunctionRegistry& re
   return eval::recalc_parallel(*this, registry, cfg, stats);
 }
 
+namespace {
+
+void mark_all_formulas_dirty_locked(const std::vector<Sheet>& sheets,
+                                    const eval::RecalcEngine::LockedMutator& mutator) {
+  for (std::size_t sheet_idx = 0; sheet_idx < sheets.size(); ++sheet_idx) {
+    for (const auto& [row, cells] : sheets[sheet_idx].rows()) {
+      for (std::size_t col = 0; col < cells.size(); ++col) {
+        if (cells[col].formula_text.empty()) {
+          continue;
+        }
+        mutator.mark_dirty(
+            eval::CellNodeId{static_cast<std::uint16_t>(sheet_idx), row, static_cast<std::uint32_t>(col)});
+      }
+    }
+  }
+}
+
+void invalidate_context_dependent_state_locked(std::vector<Sheet>& sheets,
+                                               const eval::RecalcEngine::LockedMutator& mutator) {
+  for (Sheet& sheet : sheets) {
+    for (const std::unique_ptr<pivot::PivotTable>& table : sheet.mutable_pivot_tables()) {
+      if (table == nullptr) {
+        continue;
+      }
+      table->clear_last_result();
+      table->clear_span_authored();
+    }
+  }
+  mark_all_formulas_dirty_locked(sheets, mutator);
+}
+
+bool same_civil_time(const date_time::CivilTime& lhs, const date_time::CivilTime& rhs) noexcept {
+  return lhs.date.y == rhs.date.y && lhs.date.m == rhs.date.m && lhs.date.d == rhs.date.d && lhs.time.h == rhs.time.h &&
+         lhs.time.m == rhs.time.m && lhs.time.s == rhs.time.s;
+}
+
+}  // namespace
+
+void Workbook::set_excel_profile(ExcelProfile profile) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (same_profile(excel_profile_, profile)) {
+    return;
+  }
+  excel_profile_ = profile;
+  invalidate_context_dependent_state_locked(sheets_, engine_->locked_mutator());
+}
+
 void Workbook::set_iterative_options(IterativeOptions opts) {
   // Bound the iteration budget where it enters the model rather than at
   // each producer. The solver has no wall-clock limit, and cancellation
@@ -1300,7 +1716,41 @@ void Workbook::set_iterative_options(IterativeOptions opts) {
   // its own loop without any cyclic component ever forming and so would
   // not be covered by a bound enforced inside the solver.
   opts.max_iterations = std::min(opts.max_iterations, kMaxIterationsCap);
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  const IterativeOptions previous = engine_->iterative_options();
+  const bool changed = previous.enabled != opts.enabled || previous.max_iterations != opts.max_iterations ||
+                       previous.max_change != opts.max_change;
   engine_->set_iterative_options(opts);
+  if (changed) {
+    mark_all_formulas_dirty_locked(sheets_, engine_->locked_mutator());
+  }
+}
+
+void Workbook::set_date1904(bool value) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (date1904_ == value) {
+    return;
+  }
+  date1904_ = value;
+  invalidate_context_dependent_state_locked(sheets_, engine_->locked_mutator());
+}
+
+void Workbook::set_pinned_now(date_time::CivilTime value) {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (pinned_now_.has_value() && same_civil_time(*pinned_now_, value)) {
+    return;
+  }
+  pinned_now_ = value;
+  invalidate_context_dependent_state_locked(sheets_, engine_->locked_mutator());
+}
+
+void Workbook::clear_pinned_now() {
+  std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
+  if (!pinned_now_.has_value()) {
+    return;
+  }
+  pinned_now_.reset();
+  invalidate_context_dependent_state_locked(sheets_, engine_->locked_mutator());
 }
 
 const IterativeOptions& Workbook::iterative_options() const noexcept {
@@ -1318,44 +1768,12 @@ void Workbook::set_iterative_progress(eval::IterativeProgressCb cb, void* user_d
 
 void Workbook::mark_row_visibility_dependents_dirty() {
   std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
-  const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
-  for (std::size_t sheet_idx = 0; sheet_idx < sheets_.size(); ++sheet_idx) {
-    const Sheet& sheet = sheets_[sheet_idx];
-    for (const auto& [row, cells] : sheet.rows()) {
-      for (std::size_t col = 0; col < cells.size(); ++col) {
-        const Cell& cell = cells[col];
-        if (cell.formula_text.empty()) {
-          continue;
-        }
-        // SUBTOTAL/AGGREGATE can only be called by literally spelling one
-        // of these names, so this text scan has no false negatives; a
-        // string literal that happens to contain one costs a harmless
-        // extra dirty mark rather than reparsing every formula in the
-        // workbook to test more precisely.
-        if (strings::case_insensitive_contains(cell.formula_text, "SUBTOTAL") ||
-            strings::case_insensitive_contains(cell.formula_text, "AGGREGATE")) {
-          mutator.mark_dirty(
-              eval::CellNodeId{static_cast<std::uint16_t>(sheet_idx), row, static_cast<std::uint32_t>(col)});
-        }
-      }
-    }
-  }
+  mark_row_visibility_dependents_dirty_locked(sheets_, engine_->locked_mutator());
 }
 
 void Workbook::mark_all_formulas_dirty() {
   std::lock_guard<std::mutex> guard(engine_->mutex_for_compound_mutation());
-  const eval::RecalcEngine::LockedMutator mutator = engine_->locked_mutator();
-  for (std::size_t sheet_idx = 0; sheet_idx < sheets_.size(); ++sheet_idx) {
-    for (const auto& [row, cells] : sheets_[sheet_idx].rows()) {
-      for (std::size_t col = 0; col < cells.size(); ++col) {
-        if (cells[col].formula_text.empty()) {
-          continue;
-        }
-        mutator.mark_dirty(
-            eval::CellNodeId{static_cast<std::uint16_t>(sheet_idx), row, static_cast<std::uint32_t>(col)});
-      }
-    }
-  }
+  mark_all_formulas_dirty_locked(sheets_, engine_->locked_mutator());
 }
 
 namespace {
@@ -1467,26 +1885,10 @@ void rewrite_formulas_for_row_col_edit(std::vector<Sheet>& sheets, const eval::R
         if (cell.formula_text.empty()) {
           continue;
         }
-        std::string_view body = cell.formula_text;
-        bool had_equals = false;
-        if (!body.empty() && body.front() == '=') {
-          body = body.substr(1);
-          had_equals = true;
-        }
-        if (body.empty()) {
-          continue;
-        }
-        parser_arena.reset();
-        parser::Parser parser(body, parser_arena);
-        parser::AstNode* root = parser.parse();
-        if (root == nullptr || !parser.errors().empty()) {
-          continue;  // Unparseable formula; leave alone (matches Excel "carry through unchanged").
-        }
-        const parser::AstNode* shifted = parser::shift_refs(*root, parser_arena, transform);
-        const bool ast_changed = (shifted != nullptr && shifted != root);
 
-        // Resolve the cell's post-shift coordinates. Only cells on the
-        // target sheet move; off-target cells keep their (row, col).
+        // Resolve the cell's post-shift coordinates before parsing the formula.
+        // An opaque formula still moves with its cell; skipping it on parse
+        // failure would leave the dependency graph keyed at the old address.
         std::uint32_t new_row = row;
         std::uint32_t new_col = static_cast<std::uint32_t>(col);
         bool dropped = false;
@@ -1502,21 +1904,39 @@ void rewrite_formulas_for_row_col_edit(std::vector<Sheet>& sheets, const eval::R
         }
         const bool cell_moves = (new_row != row) || (new_col != static_cast<std::uint32_t>(col));
 
+        std::string_view body = cell.formula_text;
+        bool had_equals = false;
+        if (!body.empty() && body.front() == '=') {
+          body = body.substr(1);
+          had_equals = true;
+        }
+
+        bool ast_changed = false;
+        std::string effective_formula = cell.formula_text;
+        parser_arena.reset();
+        if (!body.empty()) {
+          parser::AstNode* root = parse_indexable_formula(body, parser_arena);
+          if (root != nullptr) {
+            const parser::AstNode* shifted = parser::shift_refs(*root, parser_arena, transform);
+            ast_changed = (shifted != nullptr && shifted != root);
+            if (ast_changed) {
+              effective_formula.clear();
+              if (had_equals) {
+                effective_formula.push_back('=');
+              }
+              effective_formula.append(parser::format_formula(*shifted));
+            }
+          }
+        }
+
         if (!ast_changed && !cell_moves && !dropped) {
           continue;  // Cell unaffected by the edit.
         }
 
         // Keep the rewritten text alongside the key transition. It is
         // applied only after every disappearing / moving old key has been
-        // unregistered.
-        std::string effective_formula = cell.formula_text;
-        if (ast_changed) {
-          effective_formula.clear();
-          if (had_equals) {
-            effective_formula.push_back('=');
-          }
-          effective_formula.append(parser::format_formula(*shifted));
-        }
+        // unregistered. Parse failures and an empty body remain opaque and
+        // therefore retain their original text exactly.
 
         const eval::CellNodeId old_node{static_cast<std::uint16_t>(sheet_idx), row, static_cast<std::uint32_t>(col)};
         const eval::CellNodeId new_node{static_cast<std::uint16_t>(sheet_idx), new_row, new_col};
@@ -1552,9 +1972,11 @@ void rewrite_formulas_for_row_col_edit(std::vector<Sheet>& sheets, const eval::R
       body.remove_prefix(1);
     }
     parser_arena.reset();
-    parser::Parser parser(body, parser_arena);
-    parser::AstNode* root = parser.parse();
-    if (root == nullptr || !parser.errors().empty()) {
+    parser::AstNode* root = parse_indexable_formula(body, parser_arena);
+    if (root == nullptr) {
+      // The cell has moved, but its formula is opaque. Keep the text as-is
+      // and wake the new coordinate without inventing dependency edges.
+      mutator.mark_dirty(update.new_node);
       continue;
     }
     mutator.register_formula(update.new_node, *root, workbook);
@@ -1601,7 +2023,7 @@ void reregister_three_d_span_owners_after_row_col_edit(const std::vector<eval::C
       continue;
     }
     parser_arena.reset();
-    parser::AstNode* root = parser::parse_strict(body, parser_arena);
+    parser::AstNode* root = parse_indexable_formula(body, parser_arena);
     if (root == nullptr) {
       continue;
     }
@@ -1678,11 +2100,12 @@ Expected<void, Error> apply_row_col_edit(Workbook& wb, std::size_t sheet_index,
 // invariant for any other reader that consults both under the same
 // lock, and because the dep-graph re-index it can trigger has to run
 // against the rewritten table.
-Expected<void, Error> apply_row_col_edit_operation(Workbook& wb, std::vector<Sheet>& sheets,
-                                                   const eval::RecalcEngine::LockedMutator& mutator,
-                                                   std::vector<DefinedName>& defined_names, std::size_t sheet_index,
-                                                   parser::RowColAxis axis, parser::RowColEdit edit,
-                                                   std::uint32_t origin, std::uint32_t count, const char* op_name) {
+[[gnu::noinline]] Expected<void, Error> apply_row_col_edit_operation(Workbook& wb, std::vector<Sheet>& sheets,
+                                                                     const eval::RecalcEngine::LockedMutator& mutator,
+                                                                     std::vector<DefinedName>& defined_names,
+                                                                     std::size_t sheet_index, parser::RowColAxis axis,
+                                                                     parser::RowColEdit edit, std::uint32_t origin,
+                                                                     std::uint32_t count, const char* op_name) {
   RETURN_IF_ERROR(apply_row_col_edit(wb, sheet_index, axis, edit, origin, count, op_name));
   const std::string target_sheet_name = sheets[sheet_index].name();
   // `apply_row_col_edit` above rejected an out-of-range `sheet_index`, and
@@ -1699,7 +2122,11 @@ Expected<void, Error> apply_row_col_edit_operation(Workbook& wb, std::vector<She
   // the range `MyRef` used to cover. `set_defined_name_scoped` and
   // `remove_sheet` already take this fallback for the same reason.
   const parser::RowColShiftTransform name_transform(target_sheet_name, axis, edit, origin, count);
-  const bool names_changed = rewrite_defined_names(defined_names, name_transform);
+  const parser::RowColShiftTransform local_transform(target_sheet_name, axis, edit, origin, count,
+                                                     /*local_means_target=*/true);
+  std::vector<const parser::RefTransform*> per_sheet_transforms(sheets.size(), &name_transform);
+  per_sheet_transforms[sheet_index] = &local_transform;
+  bool names_changed = rewrite_defined_names(defined_names, per_sheet_transforms, name_transform);
   // Snapshot the pending-footprint records before formula text rewrites.
   // `Sheet::set_cell_formula` quite correctly clears a user-overwritten
   // blocked anchor; a structural rewrite of that same formula is not a user
@@ -1714,6 +2141,18 @@ Expected<void, Error> apply_row_col_edit_operation(Workbook& wb, std::vector<She
   }
   Sheet& target = sheets[sheet_index];
   const std::vector<BlockedSpillFootprint> blocked_before = blocked_before_all[sheet_index];
+  // The edit clears committed spills; snapshot their anchors so those formulas are re-dirtied.
+  const std::vector<SpillFootprint> committed_before = target.committed_spill_footprints();
+  // AutoFilters on the edited sheet, serialized before the move, to detect a
+  // change that alters which hidden rows count as filtered.
+  const bool had_sheet_filter = target.has_auto_filter();
+  std::vector<std::string> filters_before;
+  filters_before.push_back(io::auto_filter_xml(target.auto_filter()));
+  for (const TableMetadata& table : wb.tables()) {
+    if (table.sheet_index == sheet_index) {
+      filters_before.push_back(io::auto_filter_xml(table.auto_filter_xml.get()));
+    }
+  }
   rewrite_formulas_for_row_col_edit(sheets, mutator, wb, target_sheet_name, axis, edit, origin, count);
   // Metadata formulas follow the same per-sheet policy as cell formulas: a
   // qualified reference to the edited sheet shifts no matter which sheet owns
@@ -1721,13 +2160,9 @@ Expected<void, Error> apply_row_col_edit_operation(Workbook& wb, std::vector<She
   // The text is rewritten against pre-edit coordinates, like the cells above
   // and unlike the sqref/anchor rectangles, which `Sheet::insert_rows` and
   // friends move afterwards.
-  const parser::RowColShiftTransform local_transform(target_sheet_name, axis, edit, origin, count,
-                                                     /*local_means_target=*/true);
-  std::vector<const parser::RefTransform*> per_sheet_transforms(sheets.size(), &name_transform);
-  per_sheet_transforms[sheet_index] = &local_transform;
   std::vector<std::uint32_t> ignored_cache_ids;
   rewrite_sheet_metadata_formulas(sheets, per_sheet_transforms, wb.mutable_tables(), wb.mutable_pivot_caches(), {}, {},
-                                  {}, ignored_cache_ids);
+                                  {}, ignored_cache_ids, name_transform);
   if (axis == parser::RowColAxis::kRow) {
     if (edit == parser::RowColEdit::kInsert) {
       target.insert_rows(origin, count);
@@ -1741,6 +2176,29 @@ Expected<void, Error> apply_row_col_edit_operation(Workbook& wb, std::vector<She
   }
   shift_retained_extension_ranges(target, origin, count, edit == parser::RowColEdit::kDelete,
                                   axis == parser::RowColAxis::kRow);
+  shift_drawing_anchors(wb, sheet_index, origin, count, edit == parser::RowColEdit::kDelete,
+                        axis == parser::RowColAxis::kRow);
+  std::vector<std::string> filters_after;
+  filters_after.push_back(io::auto_filter_xml(target.auto_filter()));
+  for (TableMetadata& table : wb.mutable_tables()) {
+    if (table.sheet_index != sheet_index) {
+      continue;
+    }
+    if (AutoFilter* filter = table.auto_filter_xml.get();
+        filter != nullptr && !shift_auto_filter(*filter, origin, count, edit == parser::RowColEdit::kDelete,
+                                                axis == parser::RowColAxis::kRow, /*header_delete_removes=*/false)) {
+      table.auto_filter_xml.reset();
+    }
+    filters_after.push_back(io::auto_filter_xml(table.auto_filter_xml.get()));
+  }
+  // A sheet AutoFilter the edit removed takes its `_FilterDatabase` name
+  // with it; the full re-index below covers formulas naming it.
+  if (had_sheet_filter && !target.has_auto_filter() && erase_filter_database_name(defined_names, sheet_index)) {
+    names_changed = true;
+  }
+  if (filters_after != filters_before) {
+    mark_row_visibility_dependents_dirty_locked(sheets, mutator);
+  }
   // Re-index only after the physical move. Formula text is rewritten while
   // cells still occupy their pre-edit coordinates, so rebuilding the graph
   // before the move would register moved owners (including Ref3D owners) at
@@ -1756,6 +2214,19 @@ Expected<void, Error> apply_row_col_edit_operation(Workbook& wb, std::vector<She
   }
   reregister_three_d_span_owners_after_row_col_edit(three_d_owners, sheets, mutator, wb, sheet_index, axis, edit,
                                                     origin, count);
+  // Map each snapshotted anchor through the edit; deleted anchors and non-formula cells are skipped.
+  for (const SpillFootprint& footprint : committed_before) {
+    const CellShift shift =
+        shift_cell_coords_for_row_col_edit(axis, edit, origin, count, footprint.anchor_row, footprint.anchor_col);
+    if (!shift.kept) {
+      continue;
+    }
+    const Cell* cell = target.cell_at(shift.new_row, shift.new_col);
+    if (cell == nullptr || cell->formula_text.empty()) {
+      continue;
+    }
+    mutator.mark_dirty(make_node(sheet_index, shift.new_row, shift.new_col));
+  }
   std::vector<BlockedSpillFootprint> blocked_mapped =
       remap_blocked_spill_footprints(blocked_before, axis, edit, origin, count);
   // Do not resurrect a record whose formula anchor was deleted or moved past
diff --git a/src/workbook.h b/src/workbook.h
index bed858a65..b598a7778 100644
--- a/src/workbook.h
+++ b/src/workbook.h
@@ -29,6 +29,7 @@
 #include "sheet.h"
 #include "styles.h"
 #include "table.h"
+#include "theme.h"
 #include "unknown_relationship.h"
 #include "utils/date_time.h"
 #include "utils/error.h"
@@ -454,21 +455,21 @@ class Workbook {
   void mark_all_formulas_dirty();
 
   // ---------------------------------------------------------------------------
-  // Passive round-trip metadata (Bundle 2.4)
+  // Defined names and table metadata
   // ---------------------------------------------------------------------------
   //
-  // Defined names and tables are preserved so the OOXML writer slice can
-  // emit them back unchanged. Neither participates in the dep graph at
-  // this layer; named-range / structured-reference resolution at
-  // evaluation time arrives in Phase 4.
+  // Defined names and tables preserve their round-trip metadata and supply
+  // named-range and structured-reference dependencies to the recalc engine.
 
   /// Read-only access to the workbook's defined-name list (in source
   /// declaration order).
   const std::vector<DefinedName>& defined_names() const noexcept { return defined_names_; }
 
-  /// Replaces the workbook's defined-name list. Move-assigns to keep
-  /// the I/O hand-off allocation-free for large name lists.
-  void set_defined_names(std::vector<DefinedName> names) { defined_names_ = std::move(names); }
+  /// Replaces the workbook's defined-name list and refreshes dependencies
+  /// of formulas using changed definitions. Metadata-only changes preserve
+  /// cached values and spill geometry. Formula validation remains deferred
+  /// to evaluation, matching the I/O readers' raw name-list hand-off.
+  void set_defined_names(std::vector<DefinedName> names);
 
   /// Sets the formula text of the workbook-scoped defined name `name`,
   /// or appends it if it does not exist. An empty `formula` removes
@@ -491,6 +492,37 @@ class Workbook {
   /// `local_sheet_id` names a sheet outside the workbook.
   Expected<void, Error> set_defined_name_scoped(std::string name, std::string formula, std::int32_t local_sheet_id);
 
+  /// Sets the hidden flag of the defined name `name` in `local_sheet_id`
+  /// scope (`-1` for workbook scope). Returns `kInvalidArgument` when no
+  /// such name exists.
+  Expected<void, Error> set_defined_name_hidden(std::string_view name, std::int32_t local_sheet_id, bool hidden);
+
+  // --- AutoFilter ---
+  // Every change below dirties row-visibility dependents, since whether a
+  // sheet carries filter criteria decides which hidden rows are filtered.
+
+  /// Replaces the sheet AutoFilter with `filter` and creates or updates the
+  /// sheet's hidden `_xlnm._FilterDatabase` name over its range. Returns
+  /// `kAutoFilterInvalid` when `validate_auto_filter` rejects the model and
+  /// `kInvalidArgument` for a bad sheet index.
+  Expected<void, Error> set_sheet_auto_filter(std::size_t sheet_index, AutoFilter filter);
+
+  /// Removes the sheet AutoFilter and its `_xlnm._FilterDatabase` name.
+  Expected<void, Error> remove_sheet_auto_filter(std::size_t sheet_index);
+
+  /// XML view of `set_sheet_auto_filter`: empty removes the AutoFilter, and
+  /// an element the model cannot represent is stored opaque without touching
+  /// `_FilterDatabase`.
+  Expected<void, Error> set_sheet_auto_filter_xml(std::size_t sheet_index, std::string_view xml);
+
+  /// Replaces the AutoFilter of table `table_index`. Tables carry no
+  /// `_FilterDatabase` name. Returns `kAutoFilterInvalid` or
+  /// `kInvalidArgument` as `set_sheet_auto_filter` does.
+  Expected<void, Error> set_table_auto_filter(std::size_t table_index, AutoFilter filter);
+
+  /// Removes the AutoFilter of table `table_index`.
+  Expected<void, Error> remove_table_auto_filter(std::size_t table_index);
+
   /// Read-only access to the workbook's table-metadata list (in
   /// archive-discovery order, which matches the per-sheet rels walk).
   const std::vector<TableMetadata>& tables() const noexcept { return tables_; }
@@ -526,6 +558,78 @@ class Workbook {
   /// preserved parts.
   void set_passthrough_parts(std::vector<PassthroughPart> parts) { passthrough_parts_ = std::move(parts); }
 
+  /// Adds one passthrough part, keeping the list ordered by path. Returns
+  /// `kInvalidArgument` when a part with the same path is already present or
+  /// the path is empty.
+  Expected<void, Error> add_passthrough_part(PassthroughPart part);
+
+  /// Replaces the bytes of the passthrough part at `path`, leaving its
+  /// content type untouched. Returns `kInvalidArgument` when no such part
+  /// exists.
+  Expected<void, Error> replace_passthrough_part(std::string_view path, std::vector<std::uint8_t> bytes);
+
+  /// Registers a workbook-level relationship of `type` to the package part
+  /// `target` (full package path, e.g. `xl/theme/theme1.xml`). A relationship
+  /// with the same type and target is not added twice. The writer mints the
+  /// rId, and omits the relationship if `target` is not an emitted part.
+  void add_workbook_relationship(std::string type, std::string target);
+
+  /// Parses the theme part (a passthrough part) on every call, never cached.
+  /// Never fails: an absent or unparseable part yields `default_theme()` with
+  /// the matching `ThemeSource`.
+  LoadedTheme load_theme() const;
+
+  /// Sets the 12 scheme colours, patching only `a:clrScheme`. When the
+  /// workbook has no theme part, a minimal valid one is generated first,
+  /// registered with its content type and the workbook relationship. Returns
+  /// the parse error when an existing part is not a parseable theme (the part
+  /// is then left untouched).
+  Expected<void, Error> set_theme_colors(const ThemeColors& colors);
+
+  /// Sets the four theme fonts, patching only `a:fontScheme`; same generation
+  /// and failure rules as `set_theme_colors`.
+  Expected<void, Error> set_theme_fonts(const ThemeFonts& fonts);
+
+  // ---------------------------------------------------------------------------
+  // Threaded comments and persons
+  // ---------------------------------------------------------------------------
+
+  /// The workbook's person list (`xl/persons/person.xml`) in file order.
+  const std::vector<Person>& persons() const noexcept { return persons_; }
+
+  /// Mutable person list for the reader; edits go through `add_person` /
+  /// `remove_person`.
+  std::vector<Person>& mutable_persons() noexcept { return persons_; }
+
+  /// Appends `person`. Fails with `kThreadedCommentInvalid` when the id is
+  /// not a brace-wrapped uppercase GUID, is already listed, or the display
+  /// name is empty.
+  Expected<void, Error> add_person(Person person);
+
+  /// Removes the person with `id`. Fails with `kThreadedCommentInvalid` when
+  /// no such person exists or a threaded comment or mention still names them.
+  Expected<void, Error> remove_person(std::string_view id);
+
+  /// Adds `comment` to sheet `sheet`. An empty `parent_id` opens a new thread
+  /// at `row`/`col`, which must hold neither a note nor a thread; a non-empty
+  /// one appends a reply to that thread, taking its anchor and ignoring
+  /// `row`/`col` and `done`. Ids, timestamps, persons and mention ranges are
+  /// validated; any violation fails with `kThreadedCommentInvalid` and leaves
+  /// the sheet unchanged.
+  Expected<void, Error> add_threaded_comment(std::size_t sheet, ThreadedComment comment);
+
+  /// Replaces the text and mentions of the comment with `id`.
+  Expected<void, Error> edit_threaded_comment(std::size_t sheet, std::string_view id, std::string text,
+                                              std::vector<Mention> mentions);
+
+  /// Sets the resolved state of the thread opened by `thread_id`, which must
+  /// name an opening comment, not a reply.
+  Expected<void, Error> set_thread_resolved(std::size_t sheet, std::string_view thread_id, bool done);
+
+  /// Removes the comment with `id`. Removing an opening comment removes its
+  /// whole thread; removing a reply removes that reply only.
+  Expected<void, Error> remove_threaded_comment(std::size_t sheet, std::string_view id);
+
   /// Read-only access to the verbatim workbook-level `<Relationship>`
   /// entries (from `xl/_rels/workbook.xml.rels`) whose Type URI the
   /// reader did not recognise. Captured so the writer can re-emit
@@ -653,20 +757,18 @@ class Workbook {
   // Mac-authored workbooks. A serial in the 1904 system is 1462 less than
   // the 1900 serial for the same calendar day, so losing this flag on a
   // save shifts every date four years. The flag is parsed from
-  // `<workbookPr date1904>` and re-emitted verbatim via the raw
-  // `<workbookPr>` capture below.
+  // `<workbookPr date1904>` and synchronised with the retained raw
+  // `<workbookPr>` attributes when the writer emits the part.
 
   /// True when the workbook uses the 1904 date system. Defaults to false
   /// (1900 system). Consumed by date-serial conversions
   /// (`date_time::serial_from_ymd` / `ymd_from_serial`).
   bool date1904() const noexcept { return date1904_; }
 
-  /// Sets the 1904-date-system flag. Plain model value; the raw
-  /// `<workbookPr>` capture (`workbook_pr_xml`) is the source of truth for
-  /// re-emission when present, so programmatic callers that need the
-  /// attribute written should clear `workbook_pr_xml` or rely on the
-  /// synthesised fallback the writer emits when no raw block exists.
-  void set_date1904(bool value) noexcept { date1904_ = value; }
+  /// Sets the 1904-date-system flag. The writer synchronises the retained
+  /// `<workbookPr>` fragment's `date1904` / legacy `1904` attributes with
+  /// this model value while preserving the other raw attributes.
+  void set_date1904(bool value);
 
   // ---------------------------------------------------------------------------
   // Clock seam
@@ -690,10 +792,10 @@ class Workbook {
   /// Pins every clock-dependent result to `value`. Intended for tests and
   /// for hosts that need a reproducible recalc; production callers leave it
   /// unset so the host clock shows through.
-  void set_pinned_now(date_time::CivilTime value) noexcept { pinned_now_ = value; }
+  void set_pinned_now(date_time::CivilTime value);
 
   /// Releases the pin so clock-dependent results follow the host clock again.
-  void clear_pinned_now() noexcept { pinned_now_.reset(); }
+  void clear_pinned_now();
 
   // ---------------------------------------------------------------------------
   // Workbook-level element round-trip (`<workbookPr>` / `<workbookProtection>`
@@ -752,7 +854,7 @@ class Workbook {
   ExcelProfile excel_profile() const noexcept { return excel_profile_; }
 
   /// Sets the full formula-behaviour profile used by future recalc calls.
-  void set_excel_profile(ExcelProfile profile) noexcept { excel_profile_ = profile; }
+  void set_excel_profile(ExcelProfile profile);
 
   // ---------------------------------------------------------------------------
   // Styles
@@ -899,6 +1001,8 @@ class Workbook {
   // vbaProject, customXml, ...). Round-trip metadata only; the parts
   // themselves live in `passthrough_parts_`.
   std::vector<UnknownRelationship> unknown_workbook_rels_;
+  // Person list referenced by the sheets' threaded comments.
+  std::vector<Person> persons_;
   // Package-root relationships with unrecognised Type URIs (thumbnail,
   // digital-signature origin, and vendor extensions). Their target parts
   // remain in `passthrough_parts_`.
diff --git a/src/workbook_ref_rewrite.cpp b/src/workbook_ref_rewrite.cpp
index be4ff3706..5f5fa22a0 100644
--- a/src/workbook_ref_rewrite.cpp
+++ b/src/workbook_ref_rewrite.cpp
@@ -15,11 +15,14 @@
 #include "eval/recalc_engine.h"
 #include "io/ext_lst_refs.h"
 #include "io/xlsb/tail_refs.h"
+#include "io/xml_utils.h"
+#include "io/xsd_int.h"
 #include "parser/ast.h"
 #include "parser/ast_format.h"
 #include "parser/ast_shift.h"
 #include "parser/parser.h"
 #include "pivot/pivot_cache.h"
+#include "pugixml.hpp"
 #include "sheet.h"
 #include "sheet_name.h"
 #include "table.h"
@@ -77,13 +80,67 @@ FormulaRewriteResult rewrite_formula(std::string_view formula, const parser::Ref
 
 }  // namespace
 
+bool remap_book_views_xml(std::string& book_views_xml, const std::vector<std::uint32_t>& old_to_new) {
+  if (book_views_xml.empty() || old_to_new.empty()) {
+    return false;
+  }
+
+  pugi::xml_document document;
+  const pugi::xml_parse_result parsed = document.load_buffer(
+      book_views_xml.data(), book_views_xml.size(),
+      pugi::parse_default | pugi::parse_comments | pugi::parse_pi | pugi::parse_ws_pcdata, pugi::encoding_utf8);
+  if (!parsed) {
+    return false;
+  }
+  const pugi::xml_node root = document.document_element();
+  if (!root || std::string_view(root.name()) != "bookViews") {
+    return false;
+  }
+
+  const std::uint32_t default_new_index = old_to_new.front();
+  bool changed = false;
+  const auto remap_attribute = [&](pugi::xml_node view, const char* name) {
+    pugi::xml_attribute attribute = view.attribute(name);
+    if (!attribute) {
+      if (default_new_index == 0U) {
+        return;
+      }
+      view.append_attribute(name).set_value(default_new_index);
+      changed = true;
+      return;
+    }
+
+    std::uint32_t old_index = 0;
+    if (!io::parse_xsd_nonneg_int(attribute.value(), &old_index) || old_index >= old_to_new.size()) {
+      return;
+    }
+    const std::uint32_t new_index = old_to_new[old_index];
+    if (new_index == old_index) {
+      return;
+    }
+    attribute.set_value(new_index);
+    changed = true;
+  };
+
+  for (pugi::xml_node view = root.child("workbookView"); view; view = view.next_sibling("workbookView")) {
+    remap_attribute(view, "activeTab");
+    remap_attribute(view, "firstSheet");
+  }
+  if (!changed) {
+    return false;
+  }
+
+  book_views_xml = io::raw_xml(root);
+  return true;
+}
+
 void rewrite_sheet_metadata_formulas(std::vector<Sheet>& sheets,
                                      const std::vector<const parser::RefTransform*>& per_sheet,
                                      std::vector<TableMetadata>& tables,
                                      std::vector<std::unique_ptr<pivot::PivotCache>>& pivot_caches,
                                      std::string_view direct_sheet_old, std::string_view direct_sheet_new,
-                                     std::string_view removed_sheet_name,
-                                     std::vector<std::uint32_t>& dropped_cache_ids) {
+                                     std::string_view removed_sheet_name, std::vector<std::uint32_t>& dropped_cache_ids,
+                                     const parser::RefTransform& unowned_transform) {
   dropped_cache_ids.clear();
   if (per_sheet.empty()) {
     // No transform to apply at all. A short `per_sheet` is instead absorbed
@@ -184,7 +241,9 @@ void rewrite_sheet_metadata_formulas(std::vector<Sheet>& sheets,
   }
 
   for (TableMetadata& table : tables) {
-    const parser::RefTransform& transform = *per_sheet[table.sheet_index < per_sheet.size() ? table.sheet_index : 0U];
+    const parser::RefTransform& transform =
+        table.sheet_index < sheets.size() ? *per_sheet[table.sheet_index < per_sheet.size() ? table.sheet_index : 0U]
+                                          : unowned_transform;
     rewrite_field(table.ref, transform);
     for (TableColumn& column : table.columns) {
       rewrite_field(column.calculated_column_formula, transform);
@@ -199,14 +258,16 @@ void rewrite_sheet_metadata_formulas(std::vector<Sheet>& sheets,
     if (!direct_sheet_old.empty() && sheet_names::equal(source.sheet, direct_sheet_old)) {
       source.sheet.assign(direct_sheet_new);
     }
-    std::size_t owner_sheet = 0;
+    std::optional<std::size_t> owner_sheet;
     for (std::size_t sheet_idx = 0; sheet_idx < sheets.size(); ++sheet_idx) {
       if (sheet_names::equal(sheets[sheet_idx].name(), source.sheet)) {
         owner_sheet = sheet_idx;
         break;
       }
     }
-    const FormulaRewriteResult ref_result = rewrite_formula(source.ref, *per_sheet[owner_sheet]);
+    const parser::RefTransform& transform =
+        owner_sheet.has_value() ? *per_sheet[*owner_sheet < per_sheet.size() ? *owner_sheet : 0U] : unowned_transform;
+    const FormulaRewriteResult ref_result = rewrite_formula(source.ref, transform);
     if (ref_result.changed) {
       source.ref = ref_result.text;
     }
@@ -272,13 +333,21 @@ void rewrite_workbook_references(std::vector<Sheet>& sheets, std::vector<Defined
   // per-sheet table points at the single transform the caller supplied.
   const std::vector<const parser::RefTransform*> uniform(sheets.size(), &transform);
   rewrite_sheet_metadata_formulas(sheets, uniform, tables, pivot_caches, direct_sheet_old, direct_sheet_new,
-                                  removed_sheet_name, dropped_cache_ids);
+                                  removed_sheet_name, dropped_cache_ids, transform);
 }
 
-bool rewrite_defined_names(std::vector<DefinedName>& names, const parser::RefTransform& transform) {
+bool rewrite_defined_names(std::vector<DefinedName>& names, const std::vector<const parser::RefTransform*>& per_sheet,
+                           const parser::RefTransform& unowned_transform) {
   bool any_changed = false;
   for (DefinedName& entry : names) {
-    FormulaRewriteResult result = rewrite_formula(entry.formula, transform);
+    const parser::RefTransform* transform = &unowned_transform;
+    if (entry.local_sheet_id >= 0) {
+      const std::size_t owner = static_cast<std::size_t>(entry.local_sheet_id);
+      if (owner < per_sheet.size() && per_sheet[owner] != nullptr) {
+        transform = per_sheet[owner];
+      }
+    }
+    FormulaRewriteResult result = rewrite_formula(entry.formula, *transform);
     if (result.changed) {
       entry.formula = std::move(result.text);
       any_changed = true;
diff --git a/src/workbook_ref_rewrite.h b/src/workbook_ref_rewrite.h
index 1c5715f53..861ccc3b4 100644
--- a/src/workbook_ref_rewrite.h
+++ b/src/workbook_ref_rewrite.h
@@ -35,8 +35,9 @@ namespace formulon {
 // Tables and pivot caches hang off the workbook rather than off a `Sheet`, so
 // each resolves its own owner: a table through its `sheet_index`, a cache
 // through the sheet name recorded in its worksheet source. An owner that does
-// not resolve falls back to the first slot, which is the whole table whenever
-// the transform is uniform.
+// not resolve uses `unowned_transform` instead of borrowing slot zero. This is
+// important for a row/column edit: an unqualified reference on a missing
+// worksheet must not be treated as local to the first sheet.
 //
 // `direct_sheet_old/new` covers OOXML's worksheetSource/@sheet field, which is
 // a plain metadata string rather than a formula AST. For removal,
@@ -44,15 +45,15 @@ namespace formulon {
 // source became unavailable.
 //
 // Callers pass one slot per sheet. A short `per_sheet` degrades the excess
-// sheets to the first slot rather than skipping the rewrite, so no exit path
-// leaves a formula holder describing pre-edit coordinates.
+// sheet-attached metadata to the first slot rather than skipping the rewrite,
+// so no exit path leaves a formula holder describing pre-edit coordinates.
 void rewrite_sheet_metadata_formulas(std::vector<Sheet>& sheets,
                                      const std::vector<const parser::RefTransform*>& per_sheet,
                                      std::vector<TableMetadata>& tables,
                                      std::vector<std::unique_ptr<pivot::PivotCache>>& pivot_caches,
                                      std::string_view direct_sheet_old, std::string_view direct_sheet_new,
-                                     std::string_view removed_sheet_name,
-                                     std::vector<std::uint32_t>& dropped_cache_ids);
+                                     std::string_view removed_sheet_name, std::vector<std::uint32_t>& dropped_cache_ids,
+                                     const parser::RefTransform& unowned_transform);
 
 // Applies one AST transform to every formula-bearing holder in the workbook.
 // The caller supplies the transform policy, so rename and removal share the
@@ -76,10 +77,19 @@ void rewrite_workbook_references(std::vector<Sheet>& sheets, std::vector<Defined
                                  std::string_view direct_sheet_new, std::string_view removed_sheet_name,
                                  std::vector<std::uint32_t>& dropped_cache_ids, bool& defined_names_changed);
 
-/// Applies `transform` to every defined name's formula. Returns true when at
-/// least one definition changed, which means every formula that references a
-/// name now resolves to a different range than the dep graph was built from.
-bool rewrite_defined_names(std::vector<DefinedName>& names, const parser::RefTransform& transform);
+/// Remaps valid `<workbookView>` `activeTab` / `firstSheet` indices in the raw
+/// `<bookViews>` fragment. Each entry in `old_to_new` maps one pre-mutation
+/// sheet index to its post-mutation index. Missing index attributes use the
+/// OOXML default of zero and are materialized only when that default changes.
+/// Invalid/out-of-range attributes remain untouched. Malformed fragments,
+/// wrong roots, and fragments that need no valid change remain byte-identical.
+bool remap_book_views_xml(std::string& book_views_xml, const std::vector<std::uint32_t>& old_to_new);
+
+/// Applies the transform associated with each name's owning sheet. Workbook
+/// scoped names and names whose owner is outside `per_sheet` use the explicit
+/// `unowned_transform` policy instead of borrowing a sheet slot.
+bool rewrite_defined_names(std::vector<DefinedName>& names, const std::vector<const parser::RefTransform*>& per_sheet,
+                           const parser::RefTransform& unowned_transform);
 
 // Moves the ranges inside `sheet`'s retained worksheet extensions -- the
 // raw `<extLst>` and the `.xlsb` tail records -- for a row/column edit, by
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 0098e990d..acc7656c7 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -23,14 +23,26 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/value_array_test.cpp
   unit/sheet_test.cpp
   unit/sheet_spill_test.cpp
+  unit/sheet_spill_validation_test.cpp
+  unit/sheet_read_range_test.cpp
+  unit/sheet_spill_lifetime_test.cpp
+  unit/sheet_spill_scale_test.cpp
   unit/sheet_cached_text_test.cpp
   unit/workbook_test.cpp
+  unit/auto_filter_eval_test.cpp
+  unit/auto_filter_model_test.cpp
+  unit/validation_eval_test.cpp
+  unit/theme_test.cpp
+  unit/color_resolve_test.cpp
+  unit/style_resolve_test.cpp
   unit/utils/checked_mul_test.cpp
   unit/utils/a1_column_test.cpp
   unit/utils/budget_charge_test.cpp
+  unit/utils/date_time_test.cpp
   unit/utils/double_format_test.cpp
   unit/utils/double_parse_test.cpp
   unit/utils/index_sort_test.cpp
+  unit/utils/number_text_test.cpp
   unit/utils/rect_iterator_test.cpp
   unit/utils/resource_budget_test.cpp
   unit/utils/thread_launch_test.cpp
@@ -57,7 +69,14 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/io/pivot_cache_reader_test.cpp
   unit/io/pivot_cache_writer_test.cpp
   unit/io/pivot_table_reader_test.cpp
+  unit/io/pivot_table_reader_corruption_test.cpp
+  unit/io/pivot_table_reader_filters_test.cpp
+  unit/io/pivot_table_reader_attributes_test.cpp
   unit/io/pivot_table_writer_test.cpp
+  unit/io/part_dom_test.cpp
+  unit/io/color_spec_xml_test.cpp
+  unit/io/row_custom_height_test.cpp
+  unit/io/threaded_comments_test.cpp
   unit/io/sax_shared_formula_test.cpp
   unit/io/sax_xml_reader_test.cpp
   unit/io/sheet_name_validation_test.cpp
@@ -81,6 +100,8 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/io/pivot_roundtrip_symmetry_test.cpp
   unit/io/sheet_roundtrip_symmetry_test.cpp
   unit/io/xlsb_roundtrip_symmetry_test.cpp
+  unit/io/xlsb_roundtrip_defined_names_test.cpp
+  unit/io/xlsb_roundtrip_numeric_layout_test.cpp
   unit/io/xlsb/book_protection_fixture_test.cpp
   unit/io/xlsb/feature_records_test.cpp
   unit/io/xlsb/func_id_fixture_test.cpp
@@ -88,12 +109,21 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/io/xlsb/ptg_test.cpp
   unit/io/xlsb/ptg_class_fixture_test.cpp
   unit/io/xlsb/ptg_codec_test.cpp
+  unit/io/xlsb/ptg_codec_function_classes_test.cpp
+  unit/io/xlsb/ptg_codec_scalar_array_test.cpp
+  unit/io/xlsb/ptg_codec_decoder_validation_test.cpp
   unit/io/xlsb/reader_test.cpp
+  unit/io/xlsb/reader_formula_test.cpp
+  unit/io/xlsb/reader_validation_test.cpp
+  unit/io/xlsb/reader_passthrough_test.cpp
   unit/io/xlsb/record_test.cpp
   unit/io/xlsb/record_writer_test.cpp
   unit/io/xlsb/sheet_tail_test.cpp
   unit/io/xlsb/sst_writer_test.cpp
   unit/io/xlsb/writer_test.cpp
+  unit/io/xlsb/writer_formula_test.cpp
+  unit/io/xlsb/writer_layout_test.cpp
+  unit/io/xlsb/writer_metadata_test.cpp
   unit/io/xlsb_fidelity_test.cpp
   unit/io/xlsb_phonetic_test.cpp
   unit/io/external_link_fixture_test.cpp
@@ -105,6 +135,7 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/parser/tokenizer_test.cpp
   unit/parser/ast_test.cpp
   unit/parser/ast_dump_test.cpp
+  unit/parser/ast_format_r1c1_test.cpp
   unit/parser/ast_format_test.cpp
   unit/parser/ast_shift_test.cpp
   unit/parser/parser_test.cpp
@@ -122,6 +153,9 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/eval/eval_state_test.cpp
   unit/eval/dep_graph_test.cpp
   unit/eval/dep_extractor_test.cpp
+  unit/eval/dep_extractor_names_test.cpp
+  unit/eval/dep_extractor_structured_refs_test.cpp
+  unit/eval/dep_extractor_3d_dynamic_test.cpp
   unit/eval/dynamic_reference_deps_test.cpp
   unit/eval/dirty_set_test.cpp
   unit/eval/iterative_progress_test.cpp
@@ -129,6 +163,8 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/eval/partial_recalc_test.cpp
   unit/eval/recalc_engine_test.cpp
   unit/eval/cell_evaluator_test.cpp
+  unit/eval/display_text_test.cpp
+  unit/eval/builtins_subtotal_filter_hidden_test.cpp
   unit/eval/volatile_tracker_test.cpp
   unit/eval/cross_sheet_test.cpp
   unit/eval/utf8_length_test.cpp
@@ -174,6 +210,8 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/eval/builtins_stats_a_test.cpp
   unit/eval/builtins_descriptive_stats_test.cpp
   unit/eval/builtins_distributions_test.cpp
+  unit/eval/builtins_distributions_beta_gamma_test.cpp
+  unit/eval/builtins_distributions_tail_test.cpp
   unit/eval/builtins_chisq_test.cpp
   unit/eval/builtins_t_test.cpp
   unit/eval/builtins_f_test.cpp
@@ -181,23 +219,38 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/eval/stats/incomplete_beta_test.cpp
   unit/eval/coerce_test.cpp
   unit/eval/criteria_test.cpp
+  unit/eval/wildcard_test.cpp
   unit/eval/jp_fold_test.cpp
   unit/eval/jis0208_table_test.cpp
   unit/eval/builtins_countif_test.cpp
   unit/eval/builtins_database_test.cpp
   unit/eval/builtins_groupby_test.cpp
   unit/eval/builtins_pivotby_test.cpp
+  unit/eval/builtins_pivotby_multicol_test.cpp
+  unit/eval/builtins_pivotby_aggregators_test.cpp
+  unit/eval/builtins_pivotby_nested_totals_test.cpp
   unit/eval/builtins_ifs_test.cpp
   unit/eval/builtins_lookup_test.cpp
+  unit/eval/builtins_lookup_index_test.cpp
+  unit/eval/builtins_lookup_choose_test.cpp
   unit/eval/builtins_implicit_intersection_test.cpp
   unit/eval/builtins_references_test.cpp
+  unit/eval/builtins_references_indirect_test.cpp
+  unit/eval/builtins_references_offset_test.cpp
+  unit/eval/builtins_references_endpoints_test.cpp
   unit/eval/reference_lazy_test.cpp
   unit/eval/builtins_vlookup_test.cpp
   unit/eval/builtins_xlookup_test.cpp
   unit/eval/builtins_datetime_test.cpp
+  unit/eval/builtins_datetime_1904_test.cpp
+  unit/eval/builtins_datetime_calendar_test.cpp
+  unit/eval/builtins_datetime_clock_test.cpp
+  unit/eval/builtins_datetime_months_test.cpp
   unit/eval/builtins_datevalue_timevalue_test.cpp
   unit/eval/date_time_1904_test.cpp
   unit/eval/builtins_financial_test.cpp
+  unit/eval/builtins_financial_payments_test.cpp
+  unit/eval/builtins_financial_depreciation_test.cpp
   unit/eval/builtins_financial2_test.cpp
   unit/eval/builtins_financial_rates_test.cpp
   unit/eval/builtins_financial_coupon_test.cpp
@@ -256,17 +309,35 @@ set(FORMULON_UNIT_TEST_SOURCES
   unit/parser/spill_ref_test.cpp
   unit/parser/structured_ref_test.cpp
   unit/eval/structured_ref_eval_test.cpp
-  unit/pivot/pivot_evaluator_test.cpp
-  unit/pivot/pivot_filter_test.cpp
-  unit/pivot/pivot_layout_test.cpp
+  unit/pivot/pivot_evaluator_aggregation_test.cpp
+  unit/pivot/pivot_evaluator_filter_test.cpp
+  unit/pivot/pivot_evaluator_grouping_test.cpp
+  unit/pivot/pivot_evaluator_ordering_test.cpp
+  unit/pivot/pivot_evaluator_totals_test.cpp
+  unit/pivot/pivot_filter_date_test.cpp
+  unit/pivot/pivot_filter_label_test.cpp
+  unit/pivot/pivot_filter_page_test.cpp
+  unit/pivot/pivot_filter_value_test.cpp
+  unit/pivot/pivot_layout_axes_test.cpp
+  unit/pivot/pivot_layout_page_test.cpp
+  unit/pivot/pivot_layout_subtotals_test.cpp
   unit/pivot/pivot_show_values_as_test.cpp
   unit/pivot/pivot_types_test.cpp
   unit/cf/cf_evaluator_test.cpp
+  unit/cf/cf_theme_color_test.cpp
+  unit/cf/cf_evaluator_context_test.cpp
+  unit/cf/cf_evaluator_population_test.cpp
+  unit/cf/cf_evaluator_range_test.cpp
   unit/cf/cf_types_test.cpp
   unit/cf/scale_evaluator_test.cpp
   unit/print/page_setup_test.cpp
   unit/print/print_area_test.cpp
+  unit/print/pagination_detail_test.cpp
   unit/print/pagination_test.cpp
+  unit/print/sheet_geometry_test.cpp
+  unit/drawing/drawing_xml_test.cpp
+  unit/drawing/image_header_test.cpp
+  unit/drawing/drawing_edit_test.cpp
   unit/registry_catalog_test.cpp
 )
 
diff --git a/tests/c_api/CMakeLists.txt b/tests/c_api/CMakeLists.txt
index ebdd55b3f..294503ae3 100644
--- a/tests/c_api/CMakeLists.txt
+++ b/tests/c_api/CMakeLists.txt
@@ -5,24 +5,48 @@
 
 set(FORMULON_C_API_TEST_SOURCES
   formulon_c_adhoc_arena_cap_test.cpp
+  formulon_c_auto_filter_test.cpp
   formulon_c_calc_mode_test.cpp
-  formulon_c_cf_test.cpp
+  formulon_c_cell_geometry_test.cpp
+  formulon_c_cf_authoring_test.cpp
+  formulon_c_cf_evaluation_test.cpp
+  formulon_c_cf_overlay_test.cpp
+  formulon_c_cf_validation_test.cpp
+  formulon_c_cf_visual_payload_test.cpp
   formulon_c_clock_test.cpp
+  formulon_c_display_text_test.cpp
+  formulon_c_drawing_test.cpp
   formulon_c_evaluate_formula_test.cpp
   formulon_c_external_links_test.cpp
   formulon_c_function_metadata_test.cpp
   formulon_c_lambda_text_test.cpp
   formulon_c_logging_test.cpp
   formulon_c_named_styles_test.cpp
-  formulon_c_pivot_test.cpp
+  formulon_c_pivot_authoring_test.cpp
+  formulon_c_pivot_filters_test.cpp
+  formulon_c_pivot_grouping_test.cpp
+  formulon_c_pivot_lifecycle_test.cpp
+  formulon_c_pivot_read_test.cpp
   formulon_c_print_settings_test.cpp
   formulon_c_protection_test.cpp
   formulon_c_read_scratch_test.cpp
   formulon_c_sheet_features_test.cpp
   formulon_c_sheet_layout_test.cpp
   formulon_c_spill_test.cpp
-  formulon_c_styles_test.cpp
+  formulon_c_styles_alignment_test.cpp
+  formulon_c_styles_cell_xf_test.cpp
+  formulon_c_styles_dxf_test.cpp
+  formulon_c_styles_fills_borders_test.cpp
+  formulon_c_styles_fonts_test.cpp
+  formulon_c_styles_lifetime_test.cpp
+  formulon_c_styles_mutation_test.cpp
+  formulon_c_styles_num_formats_test.cpp
   formulon_c_test.cpp
+  formulon_c_theme_test.cpp
+  formulon_c_threaded_comments_test.cpp
+  formulon_c_validation_test.cpp
+  formulon_c_values_test.cpp
+  formulon_c_save_test.cpp
   formulon_c_trace_test.cpp
   formulon_c_zip_budget_test.cpp
   partial_recalc_test.cpp
diff --git a/tests/c_api/formulon_c_auto_filter_test.cpp b/tests/c_api/formulon_c_auto_filter_test.cpp
new file mode 100644
index 000000000..a9230a084
--- /dev/null
+++ b/tests/c_api/formulon_c_auto_filter_test.cpp
@@ -0,0 +1,588 @@
+//
+// Stable C ABI tests for the typed sheet and table AutoFilter: the record
+// shapes, get/set/remove, apply/clear/evaluate over the filtered rows, and
+// the state surviving a save and reload.
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+#include <set>
+#include <string>
+#include <vector>
+
+#include "auto_filter.h"
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
+#include "utils/error.h"
+
+namespace {
+
+constexpr bool kWasm32 = sizeof(void*) == 4U;
+static_assert(sizeof(fm_date_group_item) == 8U, "fm_date_group_item ABI layout changed");
+static_assert(sizeof(fm_filter_column) == (kWasm32 ? 152U : 192U), "fm_filter_column ABI layout changed");
+static_assert(sizeof(fm_sort_condition) == (kWasm32 ? 48U : 56U), "fm_sort_condition ABI layout changed");
+static_assert(sizeof(fm_auto_filter) == (kWasm32 ? 64U : 80U), "fm_auto_filter ABI layout changed");
+
+constexpr fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+constexpr fm_status_t kNotFound = static_cast<fm_status_t>(formulon::FormulonErrorCode::kNotFound);
+constexpr fm_status_t kAutoFilterInvalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kAutoFilterInvalid);
+constexpr fm_status_t kBindingNullPointer = static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer);
+constexpr std::uint32_t kAbsentDxf = std::numeric_limits<std::uint32_t>::max();
+
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+};
+
+void SaveAndReload(fm_workbook_t* wb, WorkbookGuard* out) {
+  std::uint8_t* bytes = nullptr;
+  std::size_t len = 0;
+  ASSERT_EQ(fm_workbook_save(wb, &bytes, &len), 0) << fm_last_error_message();
+  const fm_status_t rc = fm_workbook_load(bytes, len, &out->handle);
+  fm_buffer_free(bytes);
+  ASSERT_EQ(rc, 0) << fm_last_error_message();
+}
+
+std::set<std::uint32_t> HiddenRows(const fm_workbook_t* wb) {
+  std::set<std::uint32_t> rows;
+  std::size_t count = 0;
+  EXPECT_EQ(fm_sheet_get_row_override_count(wb, 0, &count), 0);
+  for (std::size_t i = 0; i < count; ++i) {
+    fm_row_layout_t layout{};
+    EXPECT_EQ(fm_sheet_get_row_override(wb, 0, i, &layout), 0);
+    if (layout.hidden != 0) {
+      rows.insert(layout.row);
+    }
+  }
+  return rows;
+}
+
+bool HasDefinedName(const fm_workbook_t* wb, const std::string& wanted) {
+  const std::size_t count = fm_workbook_defined_name_count(wb);
+  for (std::size_t i = 0; i < count; ++i) {
+    const char* name = nullptr;
+    const char* formula = nullptr;
+    int32_t local = 0;
+    EXPECT_EQ(fm_workbook_defined_name_at(wb, i, &name, &formula, &local), 0);
+    if (wanted == name) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/// Header "N" in A1 and the numbers 1..5 in A2:A6.
+void FillNumbers(fm_workbook_t* wb) {
+  ASSERT_EQ(fm_workbook_set_text(wb, 0, 0, 0, "N"), 0);
+  for (std::uint32_t i = 1; i <= 5; ++i) {
+    ASSERT_EQ(fm_workbook_set_number(wb, 0, i, 0, static_cast<double>(i)), 0);
+  }
+}
+
+fm_filter_column ValuesColumn(std::uint32_t col_id, const char* const* values, std::uint32_t count) {
+  fm_filter_column c{};
+  c.col_id = col_id;
+  c.show_button = 1;
+  c.kind = 1;
+  c.values = values;
+  c.value_count = count;
+  return c;
+}
+
+/// Copy of an AutoFilter record whose views may die with the next read.
+struct ColumnCopy {
+  fm_filter_column record{};
+  std::vector<std::string> values;
+  std::vector<fm_date_group_item> date_groups;
+  std::string val1, val2, val_iso, max_val_iso;
+};
+
+struct FilterCopy {
+  fm_auto_filter record{};
+  std::vector<ColumnCopy> columns;
+  std::vector<fm_sort_condition> conditions;
+  std::vector<std::string> custom_lists;
+};
+
+std::string Str(const char* text) {
+  return text != nullptr ? std::string(text) : std::string();
+}
+
+FilterCopy Copy(const fm_auto_filter& in) {
+  FilterCopy out;
+  out.record = in;
+  for (std::uint32_t i = 0; i < in.column_count; ++i) {
+    const fm_filter_column& c = in.columns[i];
+    ColumnCopy col;
+    col.record = c;
+    for (std::uint32_t v = 0; v < c.value_count; ++v) {
+      col.values.push_back(Str(c.values[v]));
+    }
+    col.date_groups.assign(c.date_groups, c.date_groups + c.date_group_count);
+    col.val1 = Str(c.val1);
+    col.val2 = Str(c.val2);
+    col.val_iso = Str(c.val_iso);
+    col.max_val_iso = Str(c.max_val_iso);
+    out.columns.push_back(col);
+  }
+  for (std::uint32_t i = 0; i < in.condition_count; ++i) {
+    out.conditions.push_back(in.conditions[i]);
+    out.custom_lists.push_back(Str(in.conditions[i].custom_list));
+  }
+  return out;
+}
+
+FilterCopy GetSheetFilter(const fm_workbook_t* wb) {
+  fm_auto_filter out{};
+  int32_t present = 0;
+  EXPECT_EQ(fm_sheet_get_auto_filter(wb, 0, &out, &present), 0) << fm_last_error_message();
+  EXPECT_EQ(present, 1);
+  return Copy(out);
+}
+
+/// One column of every criterion kind plus a two-key sort state.
+class EveryKind {
+ public:
+  EveryKind() {
+    columns_[0] = ValuesColumn(0, values_, 2);
+    columns_[0].filter_blank = 1;
+    groups_[0] = fm_date_group_item{2024, 3, 0, 0, 0, 0, 1};
+    columns_[0].date_groups = groups_;
+    columns_[0].date_group_count = 1;
+
+    columns_[1].col_id = 1;
+    columns_[1].show_button = 1;
+    columns_[1].kind = 2;
+    columns_[1].custom_and = 1;
+    columns_[1].custom_count = 2;
+    columns_[1].op1 = 4;
+    columns_[1].val1 = "10";
+    columns_[1].op2 = 3;
+    columns_[1].val2 = "a*";
+
+    columns_[2].col_id = 2;
+    columns_[2].show_button = 1;
+    columns_[2].kind = 3;
+    columns_[2].top = 0;
+    columns_[2].percent = 1;
+    columns_[2].top_val = 25.0;
+    columns_[2].has_filter_val = 1;
+    columns_[2].filter_val = 3.5;
+
+    columns_[3].col_id = 3;
+    columns_[3].show_button = 1;
+    columns_[3].kind = 4;
+    columns_[3].dynamic_type = 1;
+    columns_[3].has_dyn_val = 1;
+    columns_[3].dyn_val = 12.5;
+
+    columns_[4].col_id = 4;
+    columns_[4].show_button = 1;
+    columns_[4].kind = 5;
+    columns_[4].dxf_id = kAbsentDxf;
+    columns_[4].cell_color = 0;
+
+    columns_[5].col_id = 5;
+    columns_[5].hidden_button = 1;
+    columns_[5].show_button = 1;
+    columns_[5].kind = 6;
+    columns_[5].icon_set = 13;
+    columns_[5].icon_id = 2;
+    columns_[5].has_icon_id = 1;
+
+    conditions_[0].ref = fm_merge_range{1, 0, 19, 0};
+    conditions_[0].descending = 1;
+    conditions_[1].ref = fm_merge_range{1, 1, 19, 1};
+    conditions_[1].sort_by = 3;
+    conditions_[1].icon_set = 4;
+    conditions_[1].icon_id = 1;
+    conditions_[1].has_icon_id = 1;
+    conditions_[1].custom_list = "";
+
+    filter_.range = fm_merge_range{0, 0, 19, 6};
+    filter_.columns = columns_;
+    filter_.column_count = 6;
+    filter_.has_sort = 1;
+    filter_.sort_ref = fm_merge_range{1, 0, 19, 6};
+    filter_.case_sensitive = 1;
+    filter_.conditions = conditions_;
+    filter_.condition_count = 2;
+  }
+
+  const fm_auto_filter& record() const { return filter_; }
+
+ private:
+  const char* values_[2] = {"x", "10"};
+  fm_date_group_item groups_[1]{};
+  fm_filter_column columns_[6]{};
+  fm_sort_condition conditions_[2]{};
+  fm_auto_filter filter_{};
+};
+
+void ExpectEveryKind(const FilterCopy& got) {
+  EXPECT_EQ(got.record.range.first_row, 0U);
+  EXPECT_EQ(got.record.range.last_row, 19U);
+  EXPECT_EQ(got.record.range.last_col, 6U);
+  ASSERT_EQ(got.columns.size(), 6U);
+
+  const ColumnCopy& values = got.columns[0];
+  EXPECT_EQ(values.record.kind, 1);
+  EXPECT_EQ(values.record.filter_blank, 1);
+  EXPECT_EQ(values.values, (std::vector<std::string>{"x", "10"}));
+  ASSERT_EQ(values.date_groups.size(), 1U);
+  EXPECT_EQ(values.date_groups[0].year, 2024);
+  EXPECT_EQ(values.date_groups[0].month, 3);
+  EXPECT_EQ(values.date_groups[0].grouping, 1);
+
+  const ColumnCopy& custom = got.columns[1];
+  EXPECT_EQ(custom.record.kind, 2);
+  EXPECT_EQ(custom.record.col_id, 1U);
+  EXPECT_EQ(custom.record.custom_and, 1);
+  EXPECT_EQ(custom.record.custom_count, 2);
+  EXPECT_EQ(custom.record.op1, 4);
+  EXPECT_EQ(custom.val1, "10");
+  EXPECT_EQ(custom.record.op2, 3);
+  EXPECT_EQ(custom.val2, "a*");
+
+  const ColumnCopy& top = got.columns[2];
+  EXPECT_EQ(top.record.kind, 3);
+  EXPECT_EQ(top.record.top, 0);
+  EXPECT_EQ(top.record.percent, 1);
+  EXPECT_DOUBLE_EQ(top.record.top_val, 25.0);
+  EXPECT_EQ(top.record.has_filter_val, 1);
+  EXPECT_DOUBLE_EQ(top.record.filter_val, 3.5);
+
+  const ColumnCopy& dynamic = got.columns[3];
+  EXPECT_EQ(dynamic.record.kind, 4);
+  EXPECT_EQ(dynamic.record.dynamic_type, 1);
+  EXPECT_EQ(dynamic.record.has_dyn_val, 1);
+  EXPECT_DOUBLE_EQ(dynamic.record.dyn_val, 12.5);
+  EXPECT_EQ(dynamic.record.has_dyn_max_val, 0);
+
+  const ColumnCopy& color = got.columns[4];
+  EXPECT_EQ(color.record.kind, 5);
+  EXPECT_EQ(color.record.dxf_id, kAbsentDxf);
+  EXPECT_EQ(color.record.cell_color, 0);
+
+  const ColumnCopy& icon = got.columns[5];
+  EXPECT_EQ(icon.record.kind, 6);
+  EXPECT_EQ(icon.record.hidden_button, 1);
+  EXPECT_EQ(icon.record.icon_set, 13);
+  EXPECT_EQ(icon.record.has_icon_id, 1);
+  EXPECT_EQ(icon.record.icon_id, 2);
+
+  EXPECT_EQ(got.record.has_sort, 1);
+  EXPECT_EQ(got.record.sort_ref.first_row, 1U);
+  EXPECT_EQ(got.record.case_sensitive, 1);
+  ASSERT_EQ(got.conditions.size(), 2U);
+  EXPECT_EQ(got.conditions[0].descending, 1);
+  EXPECT_EQ(got.conditions[0].ref.last_row, 19U);
+  EXPECT_EQ(got.conditions[1].sort_by, 3);
+  EXPECT_EQ(got.conditions[1].icon_set, 4);
+  EXPECT_EQ(got.conditions[1].has_icon_id, 1);
+  EXPECT_EQ(got.conditions[1].icon_id, 1);
+}
+
+TEST(FormulonCApiAutoFilter, AbsentFilterReadsAsNotPresent) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_auto_filter out{};
+  out.column_count = 7U;
+  int32_t present = 1;
+  ASSERT_EQ(fm_sheet_get_auto_filter(wb.handle, 0, &out, &present), 0);
+  EXPECT_EQ(present, 0);
+  EXPECT_EQ(out.column_count, 0U);
+  EXPECT_EQ(out.columns, nullptr);
+
+  std::size_t len = 0;
+  std::uint32_t first_row = 0;
+  EXPECT_EQ(fm_sheet_apply_auto_filter(wb.handle, 0), kNotFound);
+  EXPECT_EQ(fm_sheet_clear_auto_filter(wb.handle, 0), kNotFound);
+  EXPECT_EQ(fm_sheet_evaluate_auto_filter(wb.handle, 0, nullptr, 0, &len, &first_row), kNotFound);
+  EXPECT_EQ(fm_sheet_remove_auto_filter(wb.handle, 0), 0);
+  EXPECT_EQ(fm_sheet_get_auto_filter(wb.handle, 5, &out, &present), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_get_auto_filter(wb.handle, 0, nullptr, &present), kBindingNullPointer);
+}
+
+TEST(FormulonCApiAutoFilter, EveryCriterionKindRoundTrips) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const EveryKind every;
+  ASSERT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &every.record()), 0) << fm_last_error_message();
+  ExpectEveryKind(GetSheetFilter(wb.handle));
+  EXPECT_TRUE(HasDefinedName(wb.handle, "_xlnm._FilterDatabase"));
+
+  WorkbookGuard reloaded;
+  SaveAndReload(wb.handle, &reloaded);
+  ExpectEveryKind(GetSheetFilter(reloaded.handle));
+
+  ASSERT_EQ(fm_sheet_remove_auto_filter(reloaded.handle, 0), 0);
+  fm_auto_filter out{};
+  int32_t present = 1;
+  ASSERT_EQ(fm_sheet_get_auto_filter(reloaded.handle, 0, &out, &present), 0);
+  EXPECT_EQ(present, 0);
+  EXPECT_FALSE(HasDefinedName(reloaded.handle, "_xlnm._FilterDatabase"));
+}
+
+TEST(FormulonCApiAutoFilter, ApplyHidesRowsAndClearShowsThem) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  FillNumbers(wb.handle);
+  const char* values[] = {"2", "4"};
+  const fm_filter_column column = ValuesColumn(0, values, 2);
+  fm_auto_filter filter{};
+  filter.range = fm_merge_range{0, 0, 5, 0};
+  filter.columns = &column;
+  filter.column_count = 1;
+  ASSERT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &filter), 0) << fm_last_error_message();
+  EXPECT_TRUE(HiddenRows(wb.handle).empty());
+
+  std::size_t len = 0;
+  std::uint32_t first_row = 0;
+  ASSERT_EQ(fm_sheet_evaluate_auto_filter(wb.handle, 0, nullptr, 0, &len, &first_row), 0);
+  EXPECT_EQ(len, 5U);
+  EXPECT_EQ(first_row, 1U);
+  std::vector<std::uint8_t> match(len, 9U);
+  ASSERT_EQ(fm_sheet_evaluate_auto_filter(wb.handle, 0, match.data(), match.size(), &len, &first_row), 0);
+  EXPECT_EQ(match, (std::vector<std::uint8_t>{0, 1, 0, 1, 0}));
+  EXPECT_EQ(fm_sheet_evaluate_auto_filter(wb.handle, 0, nullptr, 1, &len, &first_row), kBindingNullPointer);
+
+  ASSERT_EQ(fm_sheet_apply_auto_filter(wb.handle, 0), 0) << fm_last_error_message();
+  EXPECT_EQ(HiddenRows(wb.handle), (std::set<std::uint32_t>{1, 3, 5}));
+
+  WorkbookGuard reloaded;
+  SaveAndReload(wb.handle, &reloaded);
+  EXPECT_EQ(HiddenRows(reloaded.handle), (std::set<std::uint32_t>{1, 3, 5}));
+  const FilterCopy kept = GetSheetFilter(reloaded.handle);
+  ASSERT_EQ(kept.columns.size(), 1U);
+  EXPECT_EQ(kept.columns[0].values, (std::vector<std::string>{"2", "4"}));
+
+  ASSERT_EQ(fm_sheet_clear_auto_filter(reloaded.handle, 0), 0) << fm_last_error_message();
+  EXPECT_TRUE(HiddenRows(reloaded.handle).empty());
+  const FilterCopy cleared = GetSheetFilter(reloaded.handle);
+  EXPECT_EQ(cleared.columns.size(), 0U);
+  EXPECT_EQ(cleared.record.range.last_row, 5U);
+}
+
+TEST(FormulonCApiAutoFilter, ClearKeepsColumnsThatHideTheirButton) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  FillNumbers(wb.handle);
+  const char* values[] = {"3"};
+  fm_filter_column column = ValuesColumn(0, values, 1);
+  column.hidden_button = 1;
+  fm_auto_filter filter{};
+  filter.range = fm_merge_range{0, 0, 5, 0};
+  filter.columns = &column;
+  filter.column_count = 1;
+  ASSERT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &filter), 0);
+  ASSERT_EQ(fm_sheet_apply_auto_filter(wb.handle, 0), 0);
+  EXPECT_EQ(HiddenRows(wb.handle).size(), 4U);
+  ASSERT_EQ(fm_sheet_clear_auto_filter(wb.handle, 0), 0);
+  EXPECT_TRUE(HiddenRows(wb.handle).empty());
+  const FilterCopy cleared = GetSheetFilter(wb.handle);
+  ASSERT_EQ(cleared.columns.size(), 1U);
+  EXPECT_EQ(cleared.columns[0].record.kind, 0);
+  EXPECT_EQ(cleared.columns[0].record.hidden_button, 1);
+}
+
+TEST(FormulonCApiAutoFilter, RejectsMalformedRecords) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const char* values[] = {"1"};
+  fm_filter_column column = ValuesColumn(3, values, 1);
+  fm_auto_filter filter{};
+  filter.range = fm_merge_range{0, 0, 5, 1};
+  filter.columns = &column;
+  filter.column_count = 1;
+  EXPECT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &filter), kAutoFilterInvalid);
+
+  column.col_id = 0;
+  column.kind = 7;
+  EXPECT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &filter), kInvalidArgument);
+
+  column.kind = 1;
+  column.values = nullptr;
+  EXPECT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &filter), kInvalidArgument);
+
+  column.kind = 2;
+  column.custom_count = 3;
+  EXPECT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &filter), kAutoFilterInvalid);
+  column.custom_count = 1;
+  column.op1 = 6;
+  EXPECT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &filter), kInvalidArgument);
+
+  column.op1 = 0;
+  filter.has_sort = 1;
+  filter.sort_method = 3;
+  EXPECT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, &filter), kInvalidArgument);
+
+  EXPECT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, nullptr), kBindingNullPointer);
+  fm_auto_filter out{};
+  int32_t present = 1;
+  ASSERT_EQ(fm_sheet_get_auto_filter(wb.handle, 0, &out, &present), 0);
+  EXPECT_EQ(present, 0);
+}
+
+TEST(FormulonCApiAutoFilter, OpaqueFilterStaysOnTheXmlView) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const char* xml =
+      "<autoFilter ref=\"A1:B5\"><filterColumn colId=\"0\"><customFilters>"
+      "<customFilter operator=\"bogus\" val=\"1\"/></customFilters></filterColumn></autoFilter>";
+  ASSERT_EQ(fm_sheet_set_auto_filter_xml(wb.handle, 0, xml), 0) << fm_last_error_message();
+  fm_auto_filter out{};
+  int32_t present = 0;
+  EXPECT_EQ(fm_sheet_get_auto_filter(wb.handle, 0, &out, &present), kAutoFilterInvalid);
+  EXPECT_EQ(fm_sheet_apply_auto_filter(wb.handle, 0), kAutoFilterInvalid);
+  const char* view = nullptr;
+  ASSERT_EQ(fm_sheet_get_auto_filter_xml(wb.handle, 0, &view), 0);
+  EXPECT_STREQ(view, xml);
+}
+
+TEST(FormulonCApiAutoFilter, TableFilterAppliesAndRoundTrips) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  FillNumbers(wb.handle);
+  const char* names[] = {"N"};
+  std::size_t table = 0;
+  ASSERT_EQ(fm_workbook_table_create(wb.handle, 0, "A1:A6", "Nums", "Nums", names, 1, nullptr, 1, 0, &table), 0)
+      << fm_last_error_message();
+
+  fm_auto_filter out{};
+  int32_t present = 0;
+  ASSERT_EQ(fm_table_get_auto_filter(wb.handle, table, &out, &present), 0);
+  EXPECT_EQ(present, 1);
+  EXPECT_EQ(out.range.last_row, 5U);
+  EXPECT_EQ(out.column_count, 0U);
+
+  fm_filter_column column{};
+  column.kind = 2;
+  column.show_button = 1;
+  column.custom_count = 1;
+  column.op1 = 5;
+  column.val1 = "3";
+  fm_auto_filter filter{};
+  filter.range = fm_merge_range{0, 0, 5, 0};
+  filter.columns = &column;
+  filter.column_count = 1;
+  ASSERT_EQ(fm_table_set_auto_filter(wb.handle, table, &filter), 0) << fm_last_error_message();
+  EXPECT_FALSE(HasDefinedName(wb.handle, "_xlnm._FilterDatabase"));
+
+  std::vector<std::uint8_t> match(5U);
+  std::size_t len = 0;
+  std::uint32_t first_row = 0;
+  ASSERT_EQ(fm_table_evaluate_auto_filter(wb.handle, table, match.data(), match.size(), &len, &first_row), 0);
+  EXPECT_EQ(match, (std::vector<std::uint8_t>{0, 0, 0, 1, 1}));
+  ASSERT_EQ(fm_table_apply_auto_filter(wb.handle, table), 0) << fm_last_error_message();
+  EXPECT_EQ(HiddenRows(wb.handle), (std::set<std::uint32_t>{1, 2, 3}));
+
+  WorkbookGuard reloaded;
+  SaveAndReload(wb.handle, &reloaded);
+  ASSERT_EQ(fm_table_get_auto_filter(reloaded.handle, 0, &out, &present), 0) << fm_last_error_message();
+  EXPECT_EQ(present, 1);
+  ASSERT_EQ(out.column_count, 1U);
+  EXPECT_EQ(out.columns[0].kind, 2);
+  EXPECT_EQ(out.columns[0].op1, 5);
+  EXPECT_STREQ(out.columns[0].val1, "3");
+  EXPECT_EQ(HiddenRows(reloaded.handle), (std::set<std::uint32_t>{1, 2, 3}));
+
+  ASSERT_EQ(fm_table_clear_auto_filter(reloaded.handle, 0), 0);
+  EXPECT_TRUE(HiddenRows(reloaded.handle).empty());
+  ASSERT_EQ(fm_table_remove_auto_filter(reloaded.handle, 0), 0);
+  ASSERT_EQ(fm_table_get_auto_filter(reloaded.handle, 0, &out, &present), 0);
+  EXPECT_EQ(present, 0);
+  EXPECT_EQ(fm_table_apply_auto_filter(reloaded.handle, 0), kNotFound);
+  EXPECT_EQ(fm_table_get_auto_filter(reloaded.handle, 4, &out, &present), kInvalidArgument);
+  EXPECT_EQ(fm_table_set_auto_filter(reloaded.handle, 4, &filter), kInvalidArgument);
+}
+
+/// Unmodelled content on every level: an `xr:uid` and an unknown attribute,
+/// a `calendarType`, an unknown child, column and filter extensions, and a
+/// sort state with an attribute and extension of its own.
+constexpr const char* kUnmodelledXml =
+    "<autoFilter ref=\"A1:C9\" xr:uid=\"{00000000-0000-0000-0000-000000000001}\" x:future=\"1\">"
+    "<filterColumn colId=\"0\" x:col=\"2\"><filters calendarType=\"japan\"><filter val=\"x\"/></filters>"
+    "<futureChild a=\"1\"/><extLst><ext uri=\"{00000000-0000-0000-0000-00000000FFFF}\"><y:other/></ext></extLst>"
+    "</filterColumn>"
+    "<filterColumn colId=\"2\"><customFilters><customFilter operator=\"greaterThan\" val=\"3\"/>"
+    "</customFilters></filterColumn>"
+    "<sortState ref=\"A2:C9\" x:sort=\"3\"><sortCondition ref=\"A2:A9\"/>"
+    "<extLst><ext uri=\"{00000000-0000-0000-0000-00000000DDDD}\"/></extLst></sortState>"
+    "<extLst><ext uri=\"{00000000-0000-0000-0000-00000000EEEE}\"/></extLst></autoFilter>";
+
+/// A settable record rebuilt over the owned strings and arrays of `copy`,
+/// which must outlive it.
+class OwnedRecord {
+ public:
+  explicit OwnedRecord(const FilterCopy& copy) : conditions_(copy.conditions), record_(copy.record) {
+    values_.resize(copy.columns.size());
+    for (std::size_t i = 0; i < copy.columns.size(); ++i) {
+      const ColumnCopy& c = copy.columns[i];
+      for (const std::string& v : c.values) {
+        values_[i].push_back(v.c_str());
+      }
+      fm_filter_column column = c.record;
+      column.values = values_[i].empty() ? nullptr : values_[i].data();
+      column.date_groups = c.date_groups.empty() ? nullptr : c.date_groups.data();
+      column.val1 = c.val1.c_str();
+      column.val2 = c.val2.c_str();
+      column.val_iso = c.val_iso.c_str();
+      column.max_val_iso = c.max_val_iso.c_str();
+      columns_.push_back(column);
+    }
+    for (std::size_t i = 0; i < conditions_.size(); ++i) {
+      conditions_[i].custom_list = copy.custom_lists[i].c_str();
+    }
+    record_.columns = columns_.empty() ? nullptr : columns_.data();
+    record_.conditions = conditions_.empty() ? nullptr : conditions_.data();
+  }
+
+  const fm_auto_filter* get() const { return &record_; }
+
+ private:
+  std::vector<std::vector<const char*>> values_;
+  std::vector<fm_filter_column> columns_;
+  std::vector<fm_sort_condition> conditions_;
+  fm_auto_filter record_{};
+};
+
+TEST(FormulonCApiAutoFilter, GetThenSetKeepsUnmodelledContent) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_sheet_set_auto_filter_xml(wb.handle, 0, kUnmodelledXml), 0) << fm_last_error_message();
+  const std::string before = formulon::io::auto_filter_xml(wb.handle->workbook().sheet(0).auto_filter());
+  ASSERT_NE(before.find("calendarType"), std::string::npos);
+  ASSERT_NE(before.find("x:future"), std::string::npos);
+  const FilterCopy copy = GetSheetFilter(wb.handle);
+  const OwnedRecord record(copy);
+  ASSERT_EQ(fm_sheet_set_auto_filter(wb.handle, 0, record.get()), 0) << fm_last_error_message();
+  EXPECT_EQ(formulon::io::auto_filter_xml(wb.handle->workbook().sheet(0).auto_filter()), before);
+
+  const char* names[] = {"A", "B", "C"};
+  std::size_t table = 0;
+  ASSERT_EQ(fm_workbook_table_create(wb.handle, 0, "E1:G9", "T", "T", names, 3, nullptr, 1, 0, &table), 0);
+  std::string table_xml = kUnmodelledXml;
+  table_xml.replace(table_xml.find("A1:C9"), 5, "E1:G9");
+  table_xml.replace(table_xml.find("A2:C9"), 5, "E2:G9");
+  table_xml.replace(table_xml.find("A2:A9"), 5, "E2:E9");
+  wb.handle->workbook().mutable_tables()[table].auto_filter_xml.set(formulon::io::auto_filter_from_xml(table_xml));
+  const std::string table_before =
+      formulon::io::auto_filter_xml(wb.handle->workbook().tables()[table].auto_filter_xml.get());
+  fm_auto_filter out{};
+  int32_t present = 0;
+  ASSERT_EQ(fm_table_get_auto_filter(wb.handle, table, &out, &present), 0) << fm_last_error_message();
+  ASSERT_EQ(present, 1);
+  const FilterCopy table_copy = Copy(out);
+  const OwnedRecord table_record(table_copy);
+  ASSERT_EQ(fm_table_set_auto_filter(wb.handle, table, table_record.get()), 0) << fm_last_error_message();
+  EXPECT_EQ(formulon::io::auto_filter_xml(wb.handle->workbook().tables()[table].auto_filter_xml.get()), table_before);
+}
+
+}  // namespace
diff --git a/tests/c_api/formulon_c_cell_geometry_test.cpp b/tests/c_api/formulon_c_cell_geometry_test.cpp
new file mode 100644
index 000000000..5fee61c94
--- /dev/null
+++ b/tests/c_api/formulon_c_cell_geometry_test.cpp
@@ -0,0 +1,526 @@
+//
+// Stable C ABI tests for sheet geometry in points, range enumeration with a
+// resumable cursor, formula text in A1 / R1C1, merges by rectangle, and the
+// pagination detail accessors.
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+#include <set>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "gtest/gtest.h"
+#include "utils/error.h"
+
+namespace {
+
+static_assert(sizeof(fm_rect_pt) == 32U);
+static_assert(sizeof(fm_sheet_format_defaults) == 32U);
+static_assert(sizeof(fm_page_layout) == 56U);
+static_assert(offsetof(fm_page_layout, origin_x_pt) == 24U);
+static_assert(sizeof(fm_print_titles) == 24U);
+static_assert(sizeof(fm_paper_info) == 24U);
+static_assert(sizeof(fm_margins_pt) == 48U);
+static_assert(offsetof(fm_width_model, normal_font_name) == 32U);
+
+constexpr fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+constexpr std::uint64_t kCursorEnd = std::numeric_limits<std::uint64_t>::max();
+constexpr std::uint64_t kCursorStride = 16384U;
+
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+};
+
+struct RangeGuard {
+  fm_cell_range_t* handle = nullptr;
+  ~RangeGuard() { fm_cell_range_destroy(handle); }
+  RangeGuard() = default;
+  RangeGuard(const RangeGuard&) = delete;
+  RangeGuard& operator=(const RangeGuard&) = delete;
+};
+
+struct PaginationGuard {
+  fm_pagination_t* handle = nullptr;
+  ~PaginationGuard() { fm_pagination_destroy(handle); }
+  PaginationGuard() = default;
+  PaginationGuard(const PaginationGuard&) = delete;
+  PaginationGuard& operator=(const PaginationGuard&) = delete;
+};
+
+/// One enumerated cell, copied out of its page handle.
+struct SeenCell {
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::string formula;  // empty when the cell holds no formula
+  fm_value_kind_t kind = FM_VAL_BLANK;
+  double number = 0.0;
+  std::string text;
+
+  friend bool operator==(const SeenCell& a, const SeenCell& b) {
+    return std::tie(a.row, a.col, a.formula, a.kind, a.number, a.text) ==
+           std::tie(b.row, b.col, b.formula, b.kind, b.number, b.text);
+  }
+};
+
+/// Fetches one page and appends its cells; returns the next cursor.
+std::uint64_t FetchPage(fm_workbook_t* wb, std::uint32_t first_row, std::uint32_t first_col, std::uint32_t last_row,
+                        std::uint32_t last_col, std::uint64_t cursor, std::uint32_t limit, std::vector<SeenCell>* out) {
+  RangeGuard page;
+  EXPECT_EQ(fm_sheet_cells_in_range(wb, 0, first_row, first_col, last_row, last_col, cursor, limit, &page.handle), 0);
+  if (page.handle == nullptr) {
+    return kCursorEnd;
+  }
+  size_t count = 0;
+  EXPECT_EQ(fm_cell_range_count(page.handle, &count), 0);
+  for (size_t i = 0; i < count; ++i) {
+    SeenCell cell;
+    const char* formula = nullptr;
+    fm_value_t value{};
+    EXPECT_EQ(fm_cell_range_at(page.handle, i, &cell.row, &cell.col, &formula, &value), 0);
+    cell.formula = formula == nullptr ? "" : formula;
+    cell.kind = value.kind;
+    if (value.kind == FM_VAL_NUMBER) {
+      cell.number = value.u.number;
+    } else if (value.kind == FM_VAL_TEXT) {
+      cell.text = value.u.text;
+    }
+    out->push_back(cell);
+  }
+  std::uint64_t next = 0;
+  EXPECT_EQ(fm_cell_range_next_cursor(page.handle, &next), 0);
+  return next;
+}
+
+/// A sparse sheet: literals, text, a formula, and a vertical spill.
+void SeedSparseSheet(fm_workbook_t* wb) {
+  ASSERT_EQ(fm_workbook_set_number(wb, 0, 0, 0, 1.0), 0);
+  ASSERT_EQ(fm_workbook_set_text(wb, 0, 0, 3, "head"), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb, 0, 2, 1, 2.0), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb, 0, 2, 2, "=A1+B3"), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb, 0, 4, 4, "=SEQUENCE(3)"), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb, 0, 900, 7, 9.0), 0);
+  ASSERT_EQ(fm_workbook_set_text(wb, 0, 50000, 100, "far"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb), 0);
+}
+
+}  // namespace
+
+/* -------------------------------------------------------------------------- */
+/* Geometry                                                                   */
+/* -------------------------------------------------------------------------- */
+
+TEST(FormulonCApiCellGeometry, WidthModelReportsCalibratedCalibri) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_width_model display{};
+  ASSERT_EQ(fm_sheet_width_model(wb.handle, 0, FM_GEOMETRY_DISPLAY, &display), 0);
+  EXPECT_DOUBLE_EQ(display.points_per_char, 5.25);
+  EXPECT_DOUBLE_EQ(display.padding_pt, 3.75);
+  EXPECT_EQ(display.calibrated, 1);
+  EXPECT_STREQ(display.normal_font_name, "Calibri");
+  EXPECT_DOUBLE_EQ(display.normal_font_size, 11.0);
+  EXPECT_STREQ(display.platform, "win");
+
+  fm_width_model print{};
+  ASSERT_EQ(fm_sheet_width_model(wb.handle, 0, FM_GEOMETRY_PRINT, &print), 0);
+  EXPECT_DOUBLE_EQ(print.points_per_char, 39.0 / 7.0);
+  EXPECT_DOUBLE_EQ(print.padding_pt, 27.0 / 7.0);
+
+  EXPECT_EQ(fm_sheet_width_model(wb.handle, 0, 2, &print), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_width_model(wb.handle, 0, -1, &print), kInvalidArgument);
+}
+
+TEST(FormulonCApiCellGeometry, CharsAndPointsConvertBothWays) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  double pt = 0.0;
+  ASSERT_EQ(fm_sheet_column_chars_to_pt(wb.handle, 0, FM_GEOMETRY_DISPLAY, 10.0, &pt), 0);
+  EXPECT_DOUBLE_EQ(pt, 10.0 * 5.25 + 3.75);
+  double chars = 0.0;
+  ASSERT_EQ(fm_sheet_column_pt_to_chars(wb.handle, 0, FM_GEOMETRY_DISPLAY, pt, &chars), 0);
+  EXPECT_DOUBLE_EQ(chars, 10.0);
+  ASSERT_EQ(fm_sheet_column_chars_to_pt(wb.handle, 0, FM_GEOMETRY_PRINT, 0.0, &pt), 0);
+  EXPECT_EQ(pt, 0.0);
+
+  EXPECT_EQ(fm_sheet_column_chars_to_pt(wb.handle, 0, FM_GEOMETRY_DISPLAY, -1.0, &pt), kInvalidArgument);
+  EXPECT_EQ(
+      fm_sheet_column_pt_to_chars(wb.handle, 0, FM_GEOMETRY_DISPLAY, std::numeric_limits<double>::infinity(), &chars),
+      kInvalidArgument);
+  EXPECT_NE(fm_sheet_column_chars_to_pt(wb.handle, 0, FM_GEOMETRY_DISPLAY, 1.0, nullptr), 0);
+}
+
+TEST(FormulonCApiCellGeometry, TrackSizesFollowOverridesAndHiddenState) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_sheet_set_column_width(wb.handle, 0, 1U, 1U, 20.0), 0);
+  ASSERT_EQ(fm_sheet_set_column_hidden(wb.handle, 0, 2U, 2U, 1), 0);
+  ASSERT_EQ(fm_sheet_set_row_height(wb.handle, 0, 1U, 30.0), 0);
+  ASSERT_EQ(fm_sheet_set_row_hidden(wb.handle, 0, 2U, 1), 0);
+
+  double width = 0.0;
+  ASSERT_EQ(fm_sheet_column_width_pt(wb.handle, 0, 1U, FM_GEOMETRY_DISPLAY, &width), 0);
+  EXPECT_DOUBLE_EQ(width, 20.0 * 5.25 + 3.75);
+  ASSERT_EQ(fm_sheet_column_width_pt(wb.handle, 0, 2U, FM_GEOMETRY_DISPLAY, &width), 0);
+  EXPECT_EQ(width, 0.0);
+  double height = 0.0;
+  ASSERT_EQ(fm_sheet_row_height_pt(wb.handle, 0, 1U, &height), 0);
+  EXPECT_EQ(height, 30.0);
+  ASSERT_EQ(fm_sheet_row_height_pt(wb.handle, 0, 2U, &height), 0);
+  EXPECT_EQ(height, 0.0);
+
+  EXPECT_EQ(fm_sheet_column_width_pt(wb.handle, 0, 16384U, FM_GEOMETRY_DISPLAY, &width), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_row_height_pt(wb.handle, 0, 1048576U, &height), kInvalidArgument);
+}
+
+TEST(FormulonCApiCellGeometry, CellRectSpansRangeAndSkipsHiddenTracks) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_sheet_set_column_width(wb.handle, 0, 1U, 1U, 20.0), 0);
+  ASSERT_EQ(fm_sheet_set_column_hidden(wb.handle, 0, 2U, 2U, 1), 0);
+  ASSERT_EQ(fm_sheet_set_row_height(wb.handle, 0, 1U, 30.0), 0);
+
+  double col_a = 0.0;
+  double col_b = 0.0;
+  double row_1 = 0.0;
+  double row_3 = 0.0;
+  ASSERT_EQ(fm_sheet_column_width_pt(wb.handle, 0, 0U, FM_GEOMETRY_DISPLAY, &col_a), 0);
+  ASSERT_EQ(fm_sheet_column_width_pt(wb.handle, 0, 1U, FM_GEOMETRY_DISPLAY, &col_b), 0);
+  ASSERT_EQ(fm_sheet_row_height_pt(wb.handle, 0, 0U, &row_1), 0);
+  ASSERT_EQ(fm_sheet_row_height_pt(wb.handle, 0, 2U, &row_3), 0);
+
+  // B2:C3 -- column C is hidden and contributes nothing.
+  fm_rect_pt rect{};
+  ASSERT_EQ(fm_sheet_cell_rect_pt(wb.handle, 0, 1U, 1U, 2U, 2U, FM_GEOMETRY_DISPLAY, &rect), 0);
+  EXPECT_DOUBLE_EQ(rect.x, col_a);
+  EXPECT_DOUBLE_EQ(rect.y, row_1);
+  EXPECT_DOUBLE_EQ(rect.width, col_b);
+  EXPECT_DOUBLE_EQ(rect.height, 30.0 + row_3);
+
+  // A single cell agrees with the per-track getters exactly.
+  ASSERT_EQ(fm_sheet_cell_rect_pt(wb.handle, 0, 1U, 1U, 1U, 1U, FM_GEOMETRY_PRINT, &rect), 0);
+  double col_b_print = 0.0;
+  ASSERT_EQ(fm_sheet_column_width_pt(wb.handle, 0, 1U, FM_GEOMETRY_PRINT, &col_b_print), 0);
+  EXPECT_EQ(rect.width, col_b_print);
+  EXPECT_EQ(rect.height, 30.0);
+
+  EXPECT_EQ(fm_sheet_cell_rect_pt(wb.handle, 0, 2U, 0U, 1U, 0U, FM_GEOMETRY_DISPLAY, &rect), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_cell_rect_pt(wb.handle, 0, 0U, 0U, 0U, 0U, 7, &rect), kInvalidArgument);
+  EXPECT_NE(fm_sheet_cell_rect_pt(wb.handle, 0, 0U, 0U, 0U, 0U, FM_GEOMETRY_DISPLAY, nullptr), 0);
+}
+
+TEST(FormulonCApiCellGeometry, DefaultsDriveUnoverriddenTracks) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_sheet_format_defaults defaults{};
+  defaults.default_col_width = 12.0;
+  defaults.default_row_height = 21.0;
+  defaults.base_col_width = 8.0;
+  defaults.has_default_col_width = 1;
+  defaults.has_default_row_height = 1;
+  ASSERT_EQ(fm_sheet_set_format_defaults(wb.handle, 0, &defaults), 0);
+  double width = 0.0;
+  ASSERT_EQ(fm_sheet_column_width_pt(wb.handle, 0, 5U, FM_GEOMETRY_DISPLAY, &width), 0);
+  EXPECT_DOUBLE_EQ(width, 12.0 * 5.25 + 3.75);
+  double height = 0.0;
+  ASSERT_EQ(fm_sheet_row_height_pt(wb.handle, 0, 5U, &height), 0);
+  EXPECT_EQ(height, 21.0);
+}
+
+/* -------------------------------------------------------------------------- */
+/* Range enumeration and formula text                                         */
+/* -------------------------------------------------------------------------- */
+
+TEST(FormulonCApiCellRange, EnumeratesPopulatedCellsInRowMajorOrder) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedSparseSheet(wb.handle);
+
+  std::vector<SeenCell> cells;
+  EXPECT_EQ(FetchPage(wb.handle, 0U, 0U, 1048575U, 16383U, 0U, 0U, &cells), kCursorEnd);
+  std::vector<std::pair<std::uint32_t, std::uint32_t>> coords;
+  for (const SeenCell& cell : cells) {
+    coords.emplace_back(cell.row, cell.col);
+  }
+  const std::vector<std::pair<std::uint32_t, std::uint32_t>> expected = {
+      {0U, 0U}, {0U, 3U}, {2U, 1U}, {2U, 2U}, {4U, 4U}, {5U, 4U}, {6U, 4U}, {900U, 7U}, {50000U, 100U}};
+  EXPECT_EQ(coords, expected);
+
+  EXPECT_EQ(cells[1].kind, FM_VAL_TEXT);
+  EXPECT_EQ(cells[1].text, "head");
+  EXPECT_EQ(cells[3].formula, "=A1+B3");
+  EXPECT_EQ(cells[3].number, 3.0);
+  // The spill anchor carries the formula; its phantoms carry only values.
+  EXPECT_EQ(cells[4].formula, "=SEQUENCE(3)");
+  EXPECT_EQ(cells[5].formula, "");
+  EXPECT_EQ(cells[5].number, 2.0);
+  EXPECT_EQ(cells[6].number, 3.0);
+}
+
+TEST(FormulonCApiCellRange, CursorResumesWithoutGaps) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedSparseSheet(wb.handle);
+
+  std::vector<SeenCell> whole;
+  ASSERT_EQ(FetchPage(wb.handle, 0U, 0U, 1048575U, 16383U, 0U, 0U, &whole), kCursorEnd);
+
+  for (const std::uint32_t limit : {1U, 2U, 4U}) {
+    std::vector<SeenCell> paged;
+    std::uint64_t cursor = 0;
+    std::size_t pages = 0;
+    while (cursor != kCursorEnd) {
+      const std::size_t before = paged.size();
+      cursor = FetchPage(wb.handle, 0U, 0U, 1048575U, 16383U, cursor, limit, &paged);
+      ASSERT_LE(paged.size() - before, limit);
+      ASSERT_LT(++pages, 100U);
+      if (cursor != kCursorEnd) {
+        // The cursor names the next populated cell itself.
+        EXPECT_EQ(paged.size() - before, limit);
+      }
+    }
+    EXPECT_EQ(paged, whole) << "limit " << limit;
+    std::set<std::pair<std::uint32_t, std::uint32_t>> unique;
+    for (const SeenCell& cell : paged) {
+      unique.emplace(cell.row, cell.col);
+    }
+    EXPECT_EQ(unique.size(), paged.size());
+  }
+}
+
+TEST(FormulonCApiCellRange, ClipsToRectangleAndCursorMayStartMidRow) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedSparseSheet(wb.handle);
+
+  // B1:E6 holds D1, B3, C3, E5 and the first phantom E6.
+  std::vector<SeenCell> cells;
+  EXPECT_EQ(FetchPage(wb.handle, 0U, 1U, 5U, 4U, 0U, 0U, &cells), kCursorEnd);
+  ASSERT_EQ(cells.size(), 5U);
+  EXPECT_EQ(cells.front().col, 3U);
+  EXPECT_EQ(cells.back().row, 5U);
+
+  // A cursor at C3 skips everything before it.
+  cells.clear();
+  EXPECT_EQ(FetchPage(wb.handle, 0U, 1U, 5U, 4U, 2U * kCursorStride + 2U, 0U, &cells), kCursorEnd);
+  ASSERT_EQ(cells.size(), 3U);
+  EXPECT_EQ(cells.front().row, 2U);
+  EXPECT_EQ(cells.front().col, 2U);
+
+  // An empty rectangle ends immediately.
+  cells.clear();
+  EXPECT_EQ(FetchPage(wb.handle, 0U, 10U, 20U, 20U, 10U, 0U, &cells), kCursorEnd);
+  EXPECT_TRUE(cells.empty());
+}
+
+TEST(FormulonCApiCellRange, RejectsBadArguments) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  RangeGuard page;
+  EXPECT_EQ(fm_sheet_cells_in_range(wb.handle, 0, 5U, 0U, 1U, 0U, 0U, 0U, &page.handle), kInvalidArgument);
+  EXPECT_EQ(page.handle, nullptr);
+  EXPECT_EQ(fm_sheet_cells_in_range(wb.handle, 0, 0U, 0U, 1U, 1U, 1048576U * kCursorStride, 0U, &page.handle),
+            kInvalidArgument);
+  EXPECT_EQ(fm_sheet_cells_in_range(wb.handle, 0, 0U, 0U, 1U, 1U, kCursorEnd, 0U, &page.handle), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_cells_in_range(wb.handle, 3, 0U, 0U, 1U, 1U, 0U, 0U, &page.handle), kInvalidArgument);
+  EXPECT_NE(fm_sheet_cells_in_range(wb.handle, 0, 0U, 0U, 1U, 1U, 0U, 0U, nullptr), 0);
+
+  ASSERT_EQ(fm_sheet_cells_in_range(wb.handle, 0, 0U, 0U, 1U, 1U, 0U, 0U, &page.handle), 0);
+  size_t count = 99;
+  ASSERT_EQ(fm_cell_range_count(page.handle, &count), 0);
+  EXPECT_EQ(count, 0U);
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  fm_value_t value{};
+  EXPECT_EQ(fm_cell_range_at(page.handle, 0, &row, &col, nullptr, &value), kInvalidArgument);
+  EXPECT_NE(fm_cell_range_count(nullptr, &count), 0);
+  std::uint64_t next = 0;
+  EXPECT_NE(fm_cell_range_next_cursor(nullptr, &next), 0);
+  fm_cell_range_destroy(nullptr);
+}
+
+TEST(FormulonCApiCellRange, FormulaGettersReadA1AndR1C1) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 4, 2, "=SUM($A$1:B4)+A5"), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.0), 0);
+
+  const char* text = nullptr;
+  ASSERT_EQ(fm_workbook_get_formula(wb.handle, 0, 4, 2, &text), 0);
+  EXPECT_STREQ(text, "=SUM($A$1:B4)+A5");
+  ASSERT_EQ(fm_workbook_get_formula_r1c1(wb.handle, 0, 4, 2, &text), 0);
+  EXPECT_STREQ(text, "SUM(R1C1:R[-1]C[-1])+RC[-2]");
+
+  ASSERT_EQ(fm_workbook_get_formula(wb.handle, 0, 0, 0, &text), 0);
+  EXPECT_STREQ(text, "");
+  ASSERT_EQ(fm_workbook_get_formula_r1c1(wb.handle, 0, 9, 9, &text), 0);
+  EXPECT_STREQ(text, "");
+
+  EXPECT_EQ(fm_workbook_get_formula(wb.handle, 0, 1048576U, 0, &text), kInvalidArgument);
+  EXPECT_EQ(fm_workbook_get_formula_r1c1(wb.handle, 4, 0, 0, &text), kInvalidArgument);
+  EXPECT_NE(fm_workbook_get_formula(wb.handle, 0, 0, 0, nullptr), 0);
+}
+
+TEST(FormulonCApiCellRange, MergesInRangeReportsIntersectingMerges) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_sheet_add_merge(wb.handle, 0, fm_merge_range{0U, 0U, 1U, 1U}), 0);
+  ASSERT_EQ(fm_sheet_add_merge(wb.handle, 0, fm_merge_range{5U, 5U, 6U, 8U}), 0);
+  ASSERT_EQ(fm_sheet_add_merge(wb.handle, 0, fm_merge_range{20U, 0U, 20U, 3U}), 0);
+
+  std::uint32_t total = 0;
+  // Corners given transposed: rows 1..6, columns 1..6.
+  ASSERT_EQ(fm_sheet_merges_in_range(wb.handle, 0, fm_merge_range{6U, 6U, 1U, 1U}, nullptr, 0U, &total), 0);
+  EXPECT_EQ(total, 2U);
+  fm_merge_range out[1] = {};
+  ASSERT_EQ(fm_sheet_merges_in_range(wb.handle, 0, fm_merge_range{1U, 1U, 6U, 6U}, out, 1U, &total), 0);
+  EXPECT_EQ(total, 2U);
+  EXPECT_EQ(out[0].first_row, 0U);
+  EXPECT_EQ(out[0].last_col, 1U);
+
+  EXPECT_NE(fm_sheet_merges_in_range(wb.handle, 0, fm_merge_range{0U, 0U, 1U, 1U}, nullptr, 1U, &total), 0);
+  EXPECT_EQ(fm_sheet_merges_in_range(wb.handle, 9, fm_merge_range{0U, 0U, 1U, 1U}, nullptr, 0U, &total),
+            kInvalidArgument);
+}
+
+/* -------------------------------------------------------------------------- */
+/* Pagination detail                                                          */
+/* -------------------------------------------------------------------------- */
+
+namespace {
+
+/// Fills `A1:T200` so the sheet spans several pages on both axes.
+void FillGrid(fm_workbook_t* wb) {
+  for (std::uint32_t row = 0; row < 200U; ++row) {
+    for (std::uint32_t col = 0; col < 20U; ++col) {
+      ASSERT_EQ(fm_workbook_set_number(wb, 0, row, col, 1.0), 0);
+    }
+  }
+}
+
+}  // namespace
+
+TEST(FormulonCApiPaginationDetail, ReportsPaperMarginsScaleAndTitles) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  FillGrid(wb.handle);
+  ASSERT_EQ(fm_sheet_set_page_setup_xml(wb.handle, 0, "<pageSetup paperSize=\"9\" orientation=\"landscape\"/>"), 0);
+  ASSERT_EQ(fm_sheet_set_print_titles(wb.handle, 0, "1:1", ""), 0);
+
+  PaginationGuard p;
+  ASSERT_EQ(fm_workbook_paginate(wb.handle, 0, &p.handle), 0);
+  fm_paper_info paper{};
+  ASSERT_EQ(fm_pagination_paper(p.handle, &paper), 0);
+  EXPECT_EQ(paper.landscape, 1);
+  EXPECT_EQ(paper.known, 1);
+  EXPECT_GT(paper.width_pt, paper.height_pt);
+
+  fm_margins_pt margins{};
+  ASSERT_EQ(fm_pagination_margins(p.handle, &margins), 0);
+  EXPECT_DOUBLE_EQ(margins.left, 0.7 * 72.0);
+  EXPECT_DOUBLE_EQ(margins.top, 0.75 * 72.0);
+
+  fm_rect_pt printable{};
+  ASSERT_EQ(fm_pagination_printable(p.handle, &printable), 0);
+  EXPECT_DOUBLE_EQ(printable.x, margins.left);
+  EXPECT_GT(printable.width, 0.0);
+
+  double scale = 0.0;
+  ASSERT_EQ(fm_pagination_scale(p.handle, &scale), 0);
+  EXPECT_EQ(scale, 1.0);
+
+  fm_print_titles titles{};
+  ASSERT_EQ(fm_pagination_print_titles(p.handle, &titles), 0);
+  EXPECT_EQ(titles.has_rows, 1);
+  EXPECT_EQ(titles.first_row, 0U);
+  EXPECT_EQ(titles.last_row, 0U);
+  EXPECT_EQ(titles.has_cols, 0);
+
+  EXPECT_NE(fm_pagination_paper(nullptr, &paper), 0);
+  EXPECT_NE(fm_pagination_margins(p.handle, nullptr), 0);
+  EXPECT_NE(fm_pagination_scale(p.handle, nullptr), 0);
+  EXPECT_NE(fm_pagination_print_titles(nullptr, &titles), 0);
+  EXPECT_NE(fm_pagination_printable(nullptr, &printable), 0);
+}
+
+TEST(FormulonCApiPaginationDetail, UnknownPaperFallsBackAndSaysSo) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.0), 0);
+  ASSERT_EQ(fm_sheet_set_page_setup_xml(wb.handle, 0, "<pageSetup paperSize=\"999\"/>"), 0);
+  PaginationGuard p;
+  ASSERT_EQ(fm_workbook_paginate(wb.handle, 0, &p.handle), 0);
+  fm_paper_info paper{};
+  ASSERT_EQ(fm_pagination_paper(p.handle, &paper), 0);
+  EXPECT_EQ(paper.known, 0);
+}
+
+TEST(FormulonCApiPaginationDetail, PagesFollowPageOrderAndCoverEveryPage) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  FillGrid(wb.handle);
+  ASSERT_EQ(fm_sheet_set_page_setup_xml(wb.handle, 0, "<pageSetup pageOrder=\"overThenDown\"/>"), 0);
+
+  PaginationGuard p;
+  ASSERT_EQ(fm_workbook_paginate(wb.handle, 0, &p.handle), 0);
+  int32_t order = -1;
+  ASSERT_EQ(fm_pagination_page_order(p.handle, &order), 0);
+  EXPECT_EQ(order, 1);
+
+  const std::uint32_t page_count = fm_pagination_page_count(p.handle);
+  ASSERT_GT(fm_pagination_vertical_break_count(p.handle), 0U);
+  ASSERT_GT(page_count, 2U);
+  std::vector<fm_page_layout> pages(page_count);
+  for (std::uint32_t i = 0; i < page_count; ++i) {
+    ASSERT_EQ(fm_pagination_page_at(p.handle, i, &pages[i]), 0);
+    EXPECT_GT(pages[i].width_pt, 0.0);
+    EXPECT_GT(pages[i].height_pt, 0.0);
+  }
+  // Over then down: the second page sits right of the first, same row band.
+  EXPECT_EQ(pages[1].first_row, pages[0].first_row);
+  EXPECT_GT(pages[1].first_col, pages[0].last_col);
+  fm_page_layout extra{};
+  EXPECT_EQ(fm_pagination_page_at(p.handle, page_count, &extra), kInvalidArgument);
+  EXPECT_NE(fm_pagination_page_order(nullptr, &order), 0);
+}
+
+TEST(FormulonCApiPaginationDetail, ManualBreaksAreFlagged) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  FillGrid(wb.handle);
+  ASSERT_EQ(fm_sheet_add_row_break(wb.handle, 0, 10U, 1), 0);
+
+  PaginationGuard p;
+  ASSERT_EQ(fm_workbook_paginate(wb.handle, 0, &p.handle), 0);
+  const size_t h_count = fm_pagination_horizontal_break_count(p.handle);
+  ASSERT_GT(h_count, 1U);
+  std::size_t manual_breaks = 0;
+  for (size_t i = 0; i < h_count; ++i) {
+    std::uint32_t row = 0;
+    int32_t manual = -1;
+    ASSERT_EQ(fm_pagination_horizontal_break_at(p.handle, i, &row), 0);
+    ASSERT_EQ(fm_pagination_horizontal_break_is_manual(p.handle, i, &manual), 0);
+    EXPECT_EQ(manual, row == 10U ? 1 : 0) << "break before row " << row;
+    manual_breaks += static_cast<std::size_t>(manual);
+  }
+  EXPECT_EQ(manual_breaks, 1U);
+
+  const size_t v_count = fm_pagination_vertical_break_count(p.handle);
+  for (size_t i = 0; i < v_count; ++i) {
+    int32_t manual = -1;
+    ASSERT_EQ(fm_pagination_vertical_break_is_manual(p.handle, i, &manual), 0);
+    EXPECT_EQ(manual, 0);
+  }
+  int32_t manual = 0;
+  EXPECT_EQ(fm_pagination_horizontal_break_is_manual(p.handle, h_count, &manual), kInvalidArgument);
+  EXPECT_EQ(fm_pagination_vertical_break_is_manual(p.handle, v_count, &manual), kInvalidArgument);
+  EXPECT_NE(fm_pagination_vertical_break_is_manual(nullptr, 0, &manual), 0);
+}
diff --git a/tests/c_api/formulon_c_cf_authoring_test.cpp b/tests/c_api/formulon_c_cf_authoring_test.cpp
new file mode 100644
index 000000000..4ad40685d
--- /dev/null
+++ b/tests/c_api/formulon_c_cf_authoring_test.cpp
@@ -0,0 +1,308 @@
+// Stable C ABI conditional-format authoring tests.
+
+#include "formulon_c_cf_test_helpers.h"
+
+TEST(FormulonCApiCfMutate, AddCellIsRuleRoundTrips) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDxfs(wb.handle, 1);
+
+  fm_cf_cell_range_t sqref{};
+  sqref.first_row = 0;
+  sqref.first_col = 0;
+  sqref.last_row = 9;
+  sqref.last_col = 0;
+
+  fm_cf_rule_t rule{};
+  rule.type = 1;  // CellIs
+  rule.op_engaged = 1;
+  rule.op = 5;  // GreaterThan
+  std::string formula = "50";
+  rule.formula1 = formula.c_str();
+  rule.dxf_id_engaged = 1;
+  rule.dxf_id = 0;
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0);
+  EXPECT_EQ(rule_index, 0U);
+
+  std::size_t count = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 1U);
+
+  fm_cf_rule_t out{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
+  EXPECT_EQ(out.type, 1U);
+  EXPECT_EQ(out.op_engaged, 1);
+  EXPECT_EQ(out.op, 5U);
+  EXPECT_EQ(out.priority, 1);  // auto-assigned since input <= 0
+  EXPECT_EQ(out.dxf_id_engaged, 1);
+  EXPECT_EQ(out.dxf_id, 0U);
+  ASSERT_NE(out.formula1, nullptr);
+  EXPECT_STREQ(out.formula1, "50");
+  ASSERT_NE(out.sqref, nullptr);
+  EXPECT_EQ(out.sqref_count, 1U);
+  EXPECT_EQ(out.sqref[0].first_row, 0U);
+  EXPECT_EQ(out.sqref[0].last_row, 9U);
+  ASSERT_NE(out.id, nullptr);
+  EXPECT_FALSE(std::string(out.id).empty());
+}
+
+TEST(FormulonCApiCfMutate, AddRuleRejectsDxfIdPastTheStylesTable) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDxfs(wb.handle, 2);
+
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 1;  // CellIs
+  rule.op_engaged = 1;
+  rule.op = 5;  // GreaterThan
+  rule.formula1 = "50";
+  rule.dxf_id_engaged = 1;
+  rule.dxf_id = 2;  // one past the last registered `<dxf>`
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+
+  std::size_t rule_index = 99U;
+  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_STREQ(fm_last_error_message(), "fm_sheet_cf_add_rule: dxf_id out of range");
+
+  // The rejected rule is not appended, so a workbook saved after the failed
+  // call carries no `<cfRule>` whose `dxfId` Excel cannot resolve.
+  std::size_t count = 99U;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 0U);
+
+  // The last in-range index is still accepted.
+  rule.dxf_id = 1;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 1U);
+}
+
+TEST(FormulonCApiCfMutate, AddRuleWithoutDxfIdIgnoresTheEmptyStylesTable) {
+  // A rule that engages no differential format must stay addable on a
+  // workbook that has registered no `<dxf>` at all.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 1;  // CellIs
+  rule.op_engaged = 1;
+  rule.op = 5;  // GreaterThan
+  rule.formula1 = "50";
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+
+  std::size_t rule_index = 99U;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+  EXPECT_EQ(rule_index, 0U);
+
+  fm_cf_rule_t out{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
+  EXPECT_EQ(out.dxf_id_engaged, 0);
+}
+
+TEST(FormulonCApiCfMutate, AddMultipleRulesAutoIncrementsPriority) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cf_cell_range_t sqref{0, 0, 0, 0};
+  for (int i = 0; i < 3; ++i) {
+    fm_cf_rule_t rule{};
+    rule.type = 0;  // Expression
+    std::string f = "TRUE";
+    rule.formula1 = f.c_str();
+    rule.sqref = &sqref;
+    rule.sqref_count = 1;
+    std::size_t rule_index = 0;
+    ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0);
+    EXPECT_EQ(rule_index, static_cast<std::size_t>(i));
+  }
+
+  std::size_t count = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 3U);
+  for (std::size_t i = 0; i < 3; ++i) {
+    fm_cf_rule_t out{};
+    ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, i, &out), 0);
+    EXPECT_EQ(out.priority, static_cast<int32_t>(i + 1));
+  }
+}
+
+TEST(FormulonCApiCfMutate, RemoveAtFlattensIndices) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cf_cell_range_t sqref{0, 0, 0, 0};
+  std::vector<std::string> formulas{"A1", "A2", "A3"};
+  std::size_t expected_index = 0;
+  for (const auto& f : formulas) {
+    fm_cf_rule_t rule{};
+    rule.type = 0;  // Expression
+    rule.formula1 = f.c_str();
+    rule.sqref = &sqref;
+    rule.sqref_count = 1;
+    std::size_t rule_index = 0;
+    ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0);
+    EXPECT_EQ(rule_index, expected_index);
+    ++expected_index;
+  }
+  std::size_t count = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  ASSERT_EQ(count, 3U);
+
+  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 1), 0);
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 2U);
+
+  // A record's storage belongs to the handle and the next get takes it
+  // back, so each rule is read before the following one is fetched.
+  fm_cf_rule_t out0{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out0), 0);
+  EXPECT_STREQ(out0.formula1, "A1");
+  fm_cf_rule_t out1{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 1, &out1), 0);
+  EXPECT_STREQ(out1.formula1, "A3");
+}
+
+TEST(FormulonCApiCfMutate, ClearRemovesAllBlocks) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 0, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 0;
+  std::string f = "TRUE";
+  rule.formula1 = f.c_str();
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0);
+  EXPECT_EQ(rule_index, 0U);
+
+  ASSERT_EQ(fm_sheet_cf_clear(wb.handle, 0), 0);
+  std::size_t count = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 0U);
+}
+
+TEST(FormulonCApiCfMutate, AddsVisualRuleTypesAndPreservesThroughSaveLoad) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 0, 0};
+
+  fm_cf_rule_t rule{};
+  rule.type = 2;  // ColorScale
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+  fm_cfvo_t thresholds[3]{};
+  thresholds[0].type = 3;  // Min
+  thresholds[0].gte = 1;
+  thresholds[1].type = 1;  // Percent
+  thresholds[1].value = "50";
+  thresholds[1].gte = 1;
+  thresholds[2].type = 4;  // Max
+  thresholds[2].gte = 1;
+  fm_cf_color_t colors[3]{{255, 0, 0, 255}, {255, 255, 0, 255}, {0, 255, 0, 255}};
+  rule.color_scale_thresholds = thresholds;
+  rule.color_scale_colors = colors;
+  rule.color_scale_count = 3;
+  std::size_t color_rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &color_rule_index), 0);
+  EXPECT_EQ(color_rule_index, 0U);
+
+  fm_cf_cell_range_t db_sqref{1, 0, 1, 0};
+  fm_cf_rule_t db_rule{};
+  db_rule.type = 3;  // DataBar
+  db_rule.sqref = &db_sqref;
+  db_rule.sqref_count = 1;
+  db_rule.data_bar_engaged = 1;
+  db_rule.data_bar_min.type = 3;  // Min
+  db_rule.data_bar_min.gte = 1;
+  db_rule.data_bar_max.type = 4;  // Max
+  db_rule.data_bar_max.gte = 1;
+  db_rule.data_bar_fill = fm_cf_color_t{99, 142, 198, 255};
+  db_rule.data_bar_show_value = 1;
+  db_rule.data_bar_min_length_pct = 10;
+  db_rule.data_bar_max_length_pct = 90;
+  std::size_t data_bar_rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, db_rule, &data_bar_rule_index), 0);
+  EXPECT_EQ(data_bar_rule_index, 1U);
+
+  fm_cf_cell_range_t icon_sqref{2, 0, 2, 0};
+  fm_cf_rule_t icon_rule{};
+  icon_rule.type = 4;  // IconSet
+  icon_rule.sqref = &icon_sqref;
+  icon_rule.sqref_count = 1;
+  icon_rule.icon_set_engaged = 1;
+  icon_rule.icon_set_name = 0;  // Three_Arrows
+  fm_cfvo_t icon_thresholds[2]{};
+  icon_thresholds[0].type = 1;  // Percent
+  icon_thresholds[0].value = "33";
+  icon_thresholds[0].gte = 1;
+  icon_thresholds[1].type = 1;  // Percent
+  icon_thresholds[1].value = "67";
+  icon_thresholds[1].gte = 1;
+  icon_rule.icon_set_thresholds = icon_thresholds;
+  icon_rule.icon_set_threshold_count = 2;
+  icon_rule.icon_set_show_value = 1;
+  icon_rule.icon_set_percent = 1;
+  std::size_t icon_rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, icon_rule, &icon_rule_index), 0);
+  EXPECT_EQ(icon_rule_index, 2U);
+
+  const auto& blocks = wb.handle->workbook().sheet(0).conditional_formats();
+  ASSERT_EQ(blocks.size(), 3U);
+  ASSERT_EQ(blocks[0].rules.size(), 1U);
+  ASSERT_TRUE(blocks[0].rules[0].color_scale.has_value());
+  ASSERT_EQ(blocks[0].rules[0].color_scale->thresholds.size(), 3U);
+  EXPECT_EQ(blocks[0].rules[0].color_scale->thresholds[1].value, "50");
+  EXPECT_EQ(blocks[0].rules[0].color_scale->colors[2].g, 255U);
+  ASSERT_TRUE(blocks[1].rules[0].data_bar.has_value());
+  EXPECT_EQ(blocks[1].rules[0].data_bar->fill.b, 198U);
+  ASSERT_TRUE(blocks[2].rules[0].icon_set.has_value());
+  EXPECT_EQ(blocks[2].rules[0].icon_set->thresholds[1].value, "67");
+
+  fm_cf_rule_t out_color{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out_color), 0);
+  ASSERT_EQ(out_color.color_scale_count, 3U);
+  ASSERT_NE(out_color.color_scale_thresholds, nullptr);
+  ASSERT_NE(out_color.color_scale_colors, nullptr);
+  EXPECT_EQ(out_color.color_scale_thresholds[1].type, 1U);
+  EXPECT_STREQ(out_color.color_scale_thresholds[1].value, "50");
+  EXPECT_EQ(out_color.color_scale_colors[2].g, 255U);
+
+  fm_cf_rule_t out_bar{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 1, &out_bar), 0);
+  EXPECT_EQ(out_bar.data_bar_engaged, 1);
+  EXPECT_EQ(out_bar.data_bar_fill.b, 198U);
+  EXPECT_EQ(out_bar.data_bar_min_length_pct, 10U);
+  EXPECT_EQ(out_bar.data_bar_max_length_pct, 90U);
+
+  fm_cf_rule_t out_icon{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 2, &out_icon), 0);
+  EXPECT_EQ(out_icon.icon_set_engaged, 1);
+  EXPECT_EQ(out_icon.icon_set_threshold_count, 2U);
+  ASSERT_NE(out_icon.icon_set_thresholds, nullptr);
+  EXPECT_STREQ(out_icon.icon_set_thresholds[1].value, "67");
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+  const auto& reloaded_blocks = reloaded.handle->workbook().sheet(0).conditional_formats();
+  ASSERT_EQ(reloaded_blocks.size(), 3U);
+  ASSERT_EQ(reloaded_blocks[0].rules.size(), 1U);
+  ASSERT_TRUE(reloaded_blocks[0].rules[0].color_scale.has_value());
+  EXPECT_EQ(reloaded_blocks[0].rules[0].color_scale->colors[0].r, 255U);
+  ASSERT_TRUE(reloaded_blocks[1].rules[0].data_bar.has_value());
+  EXPECT_EQ(reloaded_blocks[1].rules[0].data_bar->fill.g, 142U);
+  ASSERT_TRUE(reloaded_blocks[2].rules[0].icon_set.has_value());
+  EXPECT_EQ(reloaded_blocks[2].rules[0].icon_set->thresholds.size(), 2U);
+}
diff --git a/tests/c_api/formulon_c_cf_evaluation_test.cpp b/tests/c_api/formulon_c_cf_evaluation_test.cpp
new file mode 100644
index 000000000..5013265d0
--- /dev/null
+++ b/tests/c_api/formulon_c_cf_evaluation_test.cpp
@@ -0,0 +1,457 @@
+// Stable C ABI conditional-format evaluation and readback tests.
+
+#include <cmath>
+#include <tuple>
+#include <utility>
+
+#include "color_resolve.h"
+#include "formulon_c_cf_test_helpers.h"
+
+TEST(FormulonCApiCf, EvaluateRangeOnEmptyCfWorkbookReturnsZero) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 9, 9, std::nan(""), &results.handle), 0);
+  ASSERT_NE(results.handle, nullptr);
+  EXPECT_EQ(fm_cf_results_cell_count(results.handle), 0U);
+}
+
+TEST(FormulonCApiCf, EvaluateRangeWithCellIsRule) {
+  WorkbookGuard wb = WorkbookFromMutator([](formulon::Workbook& w) {
+    auto& sheet = w.sheet(0);
+    sheet.set_cell_value(0, 0, formulon::Value::number(10.0));
+    sheet.set_cell_value(1, 0, formulon::Value::number(60.0));
+    sheet.set_cell_value(2, 0, formulon::Value::number(90.0));
+
+    formulon::cf::ConditionalFormat block{};
+    block.sqref.push_back(MakeRange(0, 0, 2, 0));
+    formulon::cf::CFRule rule;
+    rule.type = formulon::cf::RuleType::CellIs;
+    rule.priority = 1;
+    rule.dxf_id = 7U;
+    rule.op = formulon::cf::CellIsOperator::GreaterThan;
+    rule.formula1 = "50";
+    block.rules.push_back(std::move(rule));
+    sheet.mutable_conditional_formats().push_back(std::move(block));
+  });
+  ASSERT_NE(wb.handle, nullptr);
+  // Recalc so cached cell values are populated for the loaded handle;
+  // CF evaluation reads the cached values via `EvalContext`.
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 2, 0, std::nan(""), &results.handle), 0);
+  ASSERT_NE(results.handle, nullptr);
+  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 2U);
+
+  // First matched cell: A2 (row=1).
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::size_t match_count = 0;
+  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 0, &row, &col, &match_count), 0);
+  EXPECT_EQ(row, 1U);
+  EXPECT_EQ(col, 0U);
+  ASSERT_EQ(match_count, 1U);
+  fm_cf_match_t m{};
+  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &m), 0);
+  EXPECT_EQ(m.kind, FM_CF_DIFFERENTIAL_FORMAT);
+  EXPECT_EQ(m.priority, 1);
+  EXPECT_EQ(m.dxf_id_engaged, 1);
+  EXPECT_EQ(m.dxf_id, 7U);
+
+  // Second matched cell: A3 (row=2).
+  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 1, &row, &col, &match_count), 0);
+  EXPECT_EQ(row, 2U);
+  EXPECT_EQ(col, 0U);
+  ASSERT_EQ(match_count, 1U);
+  ASSERT_EQ(fm_cf_results_match_at(results.handle, 1, 0, &m), 0);
+  EXPECT_EQ(m.kind, FM_CF_DIFFERENTIAL_FORMAT);
+  EXPECT_EQ(m.dxf_id, 7U);
+}
+
+TEST(FormulonCApiCf, EvaluateRangeRejectsRequestPastViewportCeiling) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  // Two full columns are past the viewport ceiling the engine enforces;
+  // the binding must surface the refusal instead of returning a handle.
+  CfResultsGuard results;
+  EXPECT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, formulon::cf::kCfMaxRows - 1U, 1, std::nan(""),
+                                          &results.handle),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kSecResourceLimit));
+  EXPECT_EQ(results.handle, nullptr);
+}
+
+TEST(FormulonCApiCf, EvaluateWholeColumnRangeReturnsBlockMatches) {
+  WorkbookGuard wb = WorkbookFromMutator([](formulon::Workbook& w) {
+    auto& sheet = w.sheet(0);
+    sheet.set_cell_value(0, 0, formulon::Value::number(10.0));
+    sheet.set_cell_value(1, 0, formulon::Value::number(60.0));
+
+    formulon::cf::ConditionalFormat block{};
+    block.sqref.push_back(MakeRange(0, 0, 1, 0));
+    formulon::cf::CFRule rule;
+    rule.type = formulon::cf::RuleType::CellIs;
+    rule.priority = 1;
+    rule.dxf_id = 7U;
+    rule.op = formulon::cf::CellIsOperator::GreaterThan;
+    rule.formula1 = "50";
+    block.rules.push_back(std::move(rule));
+    sheet.mutable_conditional_formats().push_back(std::move(block));
+  });
+  ASSERT_NE(wb.handle, nullptr);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  // A whole column sits exactly at the ceiling and is answered from the
+  // block, not from the column's million rows.
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, formulon::cf::kCfMaxRows - 1U, 0, std::nan(""),
+                                          &results.handle),
+            0)
+      << fm_last_error_message();
+  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 1U);
+
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::size_t match_count = 0;
+  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 0, &row, &col, &match_count), 0);
+  EXPECT_EQ(row, 1U);
+  EXPECT_EQ(col, 0U);
+  ASSERT_EQ(match_count, 1U);
+  fm_cf_match_t m{};
+  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &m), 0);
+  EXPECT_EQ(m.dxf_id_engaged, 1);
+  EXPECT_EQ(m.dxf_id, 7U);
+}
+
+TEST(FormulonCApiCf, EvaluateRangeWithColorScale) {
+  WorkbookGuard wb = WorkbookFromMutator([](formulon::Workbook& w) {
+    auto& sheet = w.sheet(0);
+    sheet.set_cell_value(0, 0, formulon::Value::number(0.0));
+    sheet.set_cell_value(1, 0, formulon::Value::number(50.0));
+    sheet.set_cell_value(2, 0, formulon::Value::number(100.0));
+
+    formulon::cf::ConditionalFormat block{};
+    block.sqref.push_back(MakeRange(0, 0, 2, 0));
+
+    formulon::cf::CFRule rule;
+    rule.type = formulon::cf::RuleType::ColorScale;
+    rule.priority = 1;
+
+    formulon::cf::ColorScaleSpec spec;
+    spec.thresholds.push_back({formulon::cf::CfvoType::Min, "", true});
+    spec.thresholds.push_back({formulon::cf::CfvoType::Percentile, "50", true});
+    spec.thresholds.push_back({formulon::cf::CfvoType::Max, "", true});
+    spec.colors.push_back({255, 0, 0, 255});    // red
+    spec.colors.push_back({255, 255, 0, 255});  // yellow
+    spec.colors.push_back({0, 255, 0, 255});    // green
+    rule.color_scale = std::move(spec);
+
+    block.rules.push_back(std::move(rule));
+    sheet.mutable_conditional_formats().push_back(std::move(block));
+  });
+  ASSERT_NE(wb.handle, nullptr);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 2, 0, std::nan(""), &results.handle), 0);
+  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 3U);
+
+  const std::vector<std::tuple<std::uint8_t, std::uint8_t, std::uint8_t>> expected = {
+      {255, 0, 0},    // A1 = 0  → red endpoint
+      {255, 255, 0},  // A2 = 50 → yellow midpoint
+      {0, 255, 0},    // A3 = 100 → green endpoint
+  };
+
+  for (std::size_t i = 0; i < expected.size(); ++i) {
+    std::uint32_t row = 0;
+    std::uint32_t col = 0;
+    std::size_t match_count = 0;
+    ASSERT_EQ(fm_cf_results_cell_at(results.handle, i, &row, &col, &match_count), 0);
+    ASSERT_EQ(match_count, 1U) << "i=" << i;
+    fm_cf_match_t m{};
+    ASSERT_EQ(fm_cf_results_match_at(results.handle, i, 0, &m), 0) << "i=" << i;
+    EXPECT_EQ(m.kind, FM_CF_COLOR_SCALE) << "i=" << i;
+    const auto& [er, eg, eb] = expected[i];
+    EXPECT_NEAR(static_cast<int>(m.color.r), static_cast<int>(er), 1) << "i=" << i;
+    EXPECT_NEAR(static_cast<int>(m.color.g), static_cast<int>(eg), 1) << "i=" << i;
+    EXPECT_NEAR(static_cast<int>(m.color.b), static_cast<int>(eb), 1) << "i=" << i;
+  }
+}
+
+TEST(FormulonCApiCf, DestroyHandlesNullSafely) {
+  fm_cf_results_destroy(nullptr);
+  // No assertion needed; we just exercise the null path for ASan.
+  SUCCEED();
+}
+
+TEST(FormulonCApiCf, OutOfRangeIndicesReturnInvalidArgument) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 0, 0, std::nan(""), &results.handle), 0);
+  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 0U);
+
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::size_t match_count = 0;
+  fm_status_t rc = fm_cf_results_cell_at(results.handle, 0, &row, &col, &match_count);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  fm_cf_match_t m{};
+  rc = fm_cf_results_match_at(results.handle, 0, 0, &m);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+}
+
+TEST(FormulonCApiCf, NullWorkbookSetsBindingError) {
+  fm_cf_results_t* out = reinterpret_cast<fm_cf_results_t*>(static_cast<std::uintptr_t>(1));
+  fm_status_t rc = fm_workbook_cf_evaluate_range(nullptr, 0, 0, 0, 0, 0, std::nan(""), &out);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+  EXPECT_EQ(out, nullptr);
+  fm_cf_results_destroy(out);
+}
+
+TEST(FormulonCApiCf, OutOfRangeSheetIndexReturnsInvalidArgument) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_results_t* out = reinterpret_cast<fm_cf_results_t*>(static_cast<std::uintptr_t>(1));
+  fm_status_t rc = fm_workbook_cf_evaluate_range(wb.handle, 99, 0, 0, 0, 0, std::nan(""), &out);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(out, nullptr);
+  fm_cf_results_destroy(out);
+}
+
+TEST(FormulonCApiCf, OutOfGridOrReversedRectReturnsInvalidArgument) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_results_t* out = reinterpret_cast<fm_cf_results_t*>(static_cast<std::uintptr_t>(1));
+  // A reversed rectangle (last < first) would wrap the iteration span.
+  EXPECT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 5, 5, 0, 0, std::nan(""), &out),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(out, nullptr);
+  // A corner past the grid ceiling would materialize billions of cells.
+  out = reinterpret_cast<fm_cf_results_t*>(static_cast<std::uintptr_t>(1));
+  EXPECT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, formulon::Sheet::kMaxRows, 0, std::nan(""), &out),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(out, nullptr);
+  fm_cf_results_destroy(out);
+}
+
+TEST(FormulonCApiCf, ExpressionRuleEvaluatesFunctionsAndQualifiedRefs) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDxfs(wb.handle, 4);
+  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Sheet2"), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 11.0), 0);  // Sheet1!A1
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 1, 0, 0, 5.0), 0);   // Sheet2!A1
+
+  fm_cf_cell_range_t sqref{0, 0, 0, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 0;  // Expression
+  rule.formula1 = "AND(A1>10,Sheet2!A1=5)";
+  rule.dxf_id_engaged = 1;
+  rule.dxf_id = 3;
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+  EXPECT_EQ(rule_index, 0U);
+
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 0, 0, std::nan(""), &results.handle), 0)
+      << fm_last_error_message();
+  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 1U);
+
+  fm_cf_match_t match{};
+  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &match), 0);
+  EXPECT_EQ(match.kind, FM_CF_DIFFERENTIAL_FORMAT);
+  EXPECT_EQ(match.dxf_id_engaged, 1);
+  EXPECT_EQ(match.dxf_id, 3U);
+}
+
+TEST(FormulonCApiCf, ExpressionRuleRecursivelyEvaluatesFormulaCells) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDxfs(wb.handle, 5);
+  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Sheet2"), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 1, 0, 0, 7.0), 0);                   // Sheet2!A1
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SUM(Sheet2!A1,5)"), 0);  // Sheet1!A1
+
+  fm_cf_cell_range_t sqref{0, 0, 0, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 0;  // Expression
+  rule.formula1 = "A1>10";
+  rule.dxf_id_engaged = 1;
+  rule.dxf_id = 4;
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+  EXPECT_EQ(rule_index, 0U);
+
+  // No explicit recalc: CF evaluation should use a recursive EvalState
+  // instead of reading the formula cell's stale blank cached value.
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 0, 0, std::nan(""), &results.handle), 0)
+      << fm_last_error_message();
+  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 1U);
+
+  fm_cf_match_t match{};
+  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &match), 0);
+  EXPECT_EQ(match.kind, FM_CF_DIFFERENTIAL_FORMAT);
+  EXPECT_EQ(match.dxf_id_engaged, 1);
+  EXPECT_EQ(match.dxf_id, 4U);
+}
+
+namespace {
+
+formulon::cf::Color ThemeColor(std::uint32_t theme, double tint) {
+  formulon::cf::Color c{};
+  c.spec.kind = formulon::ColorSpec::Kind::kTheme;
+  c.spec.theme = theme;
+  c.spec.tint = tint;
+  return c;
+}
+
+std::uint32_t ResolvedArgb(const formulon::Workbook& wb, const formulon::cf::Color& c, formulon::ColorContext context) {
+  return formulon::resolve_color(wb, c.spec, context).argb;
+}
+
+std::uint32_t PackArgb(const fm_cf_color_t& c) {
+  return (static_cast<std::uint32_t>(c.a) << 24U) | (static_cast<std::uint32_t>(c.r) << 16U) |
+         (static_cast<std::uint32_t>(c.g) << 8U) | static_cast<std::uint32_t>(c.b);
+}
+
+WorkbookGuard ThemeColorWorkbook() {
+  return WorkbookFromMutator([](formulon::Workbook& w) {
+    auto& sheet = w.sheet(0);
+    for (std::uint32_t r = 0; r < 3; ++r) {
+      sheet.set_cell_value(r, 0, formulon::Value::number(r * 50.0));
+      sheet.set_cell_value(r, 1, formulon::Value::number(r * 50.0));
+    }
+    formulon::cf::ConditionalFormat scale_block{};
+    scale_block.sqref.push_back(MakeRange(0, 0, 2, 0));
+    formulon::cf::CFRule scale;
+    scale.type = formulon::cf::RuleType::ColorScale;
+    scale.priority = 1;
+    formulon::cf::ColorScaleSpec spec;
+    spec.thresholds.push_back({formulon::cf::CfvoType::Min, "", true});
+    spec.thresholds.push_back({formulon::cf::CfvoType::Max, "", true});
+    spec.colors.push_back(ThemeColor(4, 0.39997558519241921));
+    spec.colors.push_back(ThemeColor(5, -0.249977111117893));
+    scale.color_scale = std::move(spec);
+    scale_block.rules.push_back(std::move(scale));
+    sheet.mutable_conditional_formats().push_back(std::move(scale_block));
+
+    formulon::cf::ConditionalFormat bar_block{};
+    bar_block.sqref.push_back(MakeRange(0, 1, 2, 1));
+    formulon::cf::CFRule bar;
+    bar.type = formulon::cf::RuleType::DataBar;
+    bar.priority = 2;
+    formulon::cf::DataBarSpec bar_spec;
+    bar_spec.min = {formulon::cf::CfvoType::Min, "", true};
+    bar_spec.max = {formulon::cf::CfvoType::Max, "", true};
+    bar_spec.fill = ThemeColor(8, 0.59999389629810485);
+    bar_spec.negative_fill = bar_spec.fill;
+    bar.data_bar = std::move(bar_spec);
+    bar_block.rules.push_back(std::move(bar));
+    sheet.mutable_conditional_formats().push_back(std::move(bar_block));
+  });
+}
+
+}  // namespace
+
+TEST(FormulonCApiCf, ThemeColorScalePayloadIsResolvedNotBlack) {
+  WorkbookGuard wb = ThemeColorWorkbook();
+  ASSERT_NE(wb.handle, nullptr);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 2, 0, std::nan(""), &results.handle), 0);
+  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 3U);
+  const auto& block = wb.handle->workbook().sheet(0).conditional_formats()[0];
+  const std::uint32_t low = ResolvedArgb(wb.handle->workbook(), block.rules[0].color_scale->colors[0],
+                                         formulon::ColorContext::kFillForeground);
+  const std::uint32_t high = ResolvedArgb(wb.handle->workbook(), block.rules[0].color_scale->colors[1],
+                                          formulon::ColorContext::kFillForeground);
+  ASSERT_NE(low & 0xFFFFFFU, 0U);
+
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::size_t match_count = 0;
+  fm_cf_match_t m{};
+  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 0, &row, &col, &match_count), 0);
+  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &m), 0);
+  EXPECT_EQ(PackArgb(m.color), low);
+  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 2, &row, &col, &match_count), 0);
+  ASSERT_EQ(fm_cf_results_match_at(results.handle, 2, 0, &m), 0);
+  EXPECT_EQ(PackArgb(m.color), high);
+  EXPECT_NE(PackArgb(m.color) & 0xFFFFFFU, 0U);
+}
+
+TEST(FormulonCApiCf, ThemeColorDataBarEvaluatedPayloadIsResolvedNotBlack) {
+  WorkbookGuard wb = ThemeColorWorkbook();
+  ASSERT_NE(wb.handle, nullptr);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  CfResultsGuard results;
+  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 1, 2, 1, std::nan(""), &results.handle), 0);
+  ASSERT_GT(fm_cf_results_cell_count(results.handle), 0U);
+  const auto& bar = *wb.handle->workbook().sheet(0).conditional_formats()[1].rules[0].data_bar;
+  const std::uint32_t expected = ResolvedArgb(wb.handle->workbook(), bar.fill, formulon::ColorContext::kFillForeground);
+  ASSERT_NE(expected & 0xFFFFFFU, 0U);
+
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::size_t match_count = 0;
+  fm_cf_match_t m{};
+  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 0, &row, &col, &match_count), 0);
+  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &m), 0);
+  EXPECT_EQ(m.kind, FM_CF_DATA_BAR);
+  EXPECT_EQ(PackArgb(m.bar_fill), expected);
+}
+
+TEST(FormulonCApiCf, ThemeColorRuleReadbackReportsResolvedChannels) {
+  WorkbookGuard wb = ThemeColorWorkbook();
+  ASSERT_NE(wb.handle, nullptr);
+  const auto& blocks = wb.handle->workbook().sheet(0).conditional_formats();
+  const std::uint32_t scale_low = ResolvedArgb(wb.handle->workbook(), blocks[0].rules[0].color_scale->colors[0],
+                                               formulon::ColorContext::kFillForeground);
+  const std::uint32_t bar_fill =
+      ResolvedArgb(wb.handle->workbook(), blocks[1].rules[0].data_bar->fill, formulon::ColorContext::kFillForeground);
+
+  fm_cf_rule_t rule{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &rule), 0) << fm_last_error_message();
+  ASSERT_GE(rule.color_scale_count, 2U);
+  EXPECT_EQ(PackArgb(rule.color_scale_colors[0]), scale_low);
+  EXPECT_NE(PackArgb(rule.color_scale_colors[0]) & 0xFFFFFFU, 0U);
+
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 1, &rule), 0) << fm_last_error_message();
+  EXPECT_EQ(PackArgb(rule.data_bar_fill), bar_fill);
+  EXPECT_NE(PackArgb(rule.data_bar_fill) & 0xFFFFFFU, 0U);
+}
+
+TEST(FormulonCApiCf, ThemeColorSurvivesXlsbSaveAndLoad) {
+  WorkbookGuard wb = ThemeColorWorkbook();
+  ASSERT_NE(wb.handle, nullptr);
+  BufferGuard xlsb;
+  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSB, &xlsb.data, &xlsb.len), 0)
+      << fm_last_error_message();
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(xlsb.data, xlsb.len, &loaded.handle), 0) << fm_last_error_message();
+
+  const auto& blocks = loaded.handle->workbook().sheet(0).conditional_formats();
+  ASSERT_EQ(blocks.size(), 2U);
+  const auto& colors = blocks[0].rules[0].color_scale->colors;
+  ASSERT_EQ(colors.size(), 2U);
+  EXPECT_EQ(colors[0].spec.kind, formulon::ColorSpec::Kind::kTheme);
+  EXPECT_EQ(colors[0].spec.theme, 4U);
+  EXPECT_NEAR(colors[0].spec.tint, 0.39997558519241921, 1e-4);
+  EXPECT_EQ(colors[1].spec.theme, 5U);
+  EXPECT_NEAR(colors[1].spec.tint, -0.249977111117893, 1e-4);
+  const auto& fill = blocks[1].rules[0].data_bar->fill;
+  EXPECT_EQ(fill.spec.kind, formulon::ColorSpec::Kind::kTheme);
+  EXPECT_EQ(fill.spec.theme, 8U);
+}
diff --git a/tests/c_api/formulon_c_cf_overlay_test.cpp b/tests/c_api/formulon_c_cf_overlay_test.cpp
new file mode 100644
index 000000000..c92f28501
--- /dev/null
+++ b/tests/c_api/formulon_c_cf_overlay_test.cpp
@@ -0,0 +1,223 @@
+// Stable C ABI conditional-format extended-overlay tests.
+
+#include <initializer_list>
+#include <utility>
+
+#include "formulon_c_cf_test_helpers.h"
+
+namespace {
+
+constexpr const char* kX14IdA = "{11111111-1111-1111-1111-111111111111}";
+constexpr const char* kX14IdB = "{22222222-2222-2222-2222-222222222222}";
+
+// Builds an Excel-shaped worksheet-level x14 overlay carrying one
+// dataBar `<x14:cfRule>` per id.
+std::string X14OverlayFor(std::initializer_list<const char*> ids) {
+  std::string rules;
+  for (const char* id : ids) {
+    rules.append("<x14:cfRule type=\"dataBar\" id=\"");
+    rules.append(id);
+    rules.append(
+        "\"><x14:dataBar minLength=\"0\" maxLength=\"100\"><x14:cfvo type=\"autoMin\"/>"
+        "<x14:cfvo type=\"autoMax\"/><x14:negativeFillColor rgb=\"FFFF0000\"/></x14:dataBar></x14:cfRule>");
+  }
+  return "<extLst><ext uri=\"{78C0D931-6437-407d-A8EE-F0AAD7539E65}\" "
+         "xmlns:x14=\"http://schemas.microsoft.com/office/spreadsheetml/2009/9/main\">"
+         "<x14:conditionalFormattings>"
+         "<x14:conditionalFormatting xmlns:xm=\"http://schemas.microsoft.com/office/excel/2006/main\">" +
+         rules + "<xm:sqref>A1:A10</xm:sqref></x14:conditionalFormatting></x14:conditionalFormattings></ext></extLst>";
+}
+
+// Builds the nested `<extLst>` link a legacy `<cfRule>` carries to reach
+// its x14 counterpart. This, not an `id` attribute on the `<cfRule>`, is
+// how Excel spells the cross-reference, so a rule loaded from an
+// x14-bearing file always has one.
+std::string X14RuleLinkFor(const char* id) {
+  return std::string(
+             "<extLst><ext uri=\"{B025F937-C7B1-47D3-B67F-A62EFF666E3E}\" "
+             "xmlns:x14=\"http://schemas.microsoft.com/office/spreadsheetml/2009/9/main\"><x14:id>") +
+         id + "</x14:id></ext></extLst>";
+}
+
+// Seeds sheet 0 with one CF block holding two id-bearing dataBar rules
+// plus the matching two-entry x14 overlay, mirroring the state produced
+// by loading an Excel 2010+ file with extended data bars.
+void SeedDataBarRulesWithOverlay(fm_workbook_t* handle) {
+  auto& sheet = handle->workbook().sheet(0);
+  formulon::cf::ConditionalFormat block{};
+  block.sqref.push_back(MakeRange(0, 0, 9, 0));
+  for (const char* id : {kX14IdA, kX14IdB}) {
+    formulon::cf::CFRule rule;
+    rule.type = formulon::cf::RuleType::DataBar;
+    rule.id = id;
+    rule.ext_lst_raw = X14RuleLinkFor(id);
+    rule.data_bar = formulon::cf::DataBarSpec{};
+    block.rules.push_back(std::move(rule));
+  }
+  sheet.mutable_conditional_formats().push_back(std::move(block));
+  sheet.set_ext_lst_xml(X14OverlayFor({kX14IdA, kX14IdB}));
+}
+
+bool ContainsSubstring(const std::string& haystack, const std::string& needle) {
+  return haystack.find(needle) != std::string::npos;
+}
+
+}  // namespace
+
+TEST(FormulonCApiCfMutate, RemoveAtPrunesRemovedRuleFromX14Overlay) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDataBarRulesWithOverlay(wb.handle);
+
+  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
+
+  const std::string& overlay = wb.handle->workbook().sheet(0).ext_lst_xml();
+  EXPECT_FALSE(ContainsSubstring(overlay, kX14IdA));
+  EXPECT_TRUE(ContainsSubstring(overlay, kX14IdB));
+}
+
+TEST(FormulonCApiCfMutate, ClearEmptiesX14Overlay) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDataBarRulesWithOverlay(wb.handle);
+
+  ASSERT_EQ(fm_sheet_cf_clear(wb.handle, 0), 0);
+  EXPECT_TRUE(wb.handle->workbook().sheet(0).ext_lst_xml().empty());
+}
+
+TEST(FormulonCApiCfMutate, MalformedOverlayDroppedWhollyOnRemove) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDataBarRulesWithOverlay(wb.handle);
+  wb.handle->workbook().sheet(0).set_ext_lst_xml("<extLst><ext><x14:conditionalFormattings>");
+
+  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
+  EXPECT_TRUE(wb.handle->workbook().sheet(0).ext_lst_xml().empty());
+}
+
+TEST(FormulonCApiCfMutate, RemovedRuleDoesNotResurfaceThroughSaveLoad) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDataBarRulesWithOverlay(wb.handle);
+
+  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+  const auto& sheet = reloaded.handle->workbook().sheet(0);
+  ASSERT_EQ(sheet.conditional_formats().size(), 1U);
+  ASSERT_EQ(sheet.conditional_formats()[0].rules.size(), 1U);
+  EXPECT_EQ(sheet.conditional_formats()[0].rules[0].id, kX14IdB);
+  EXPECT_FALSE(ContainsSubstring(sheet.ext_lst_xml(), kX14IdA));
+  EXPECT_TRUE(ContainsSubstring(sheet.ext_lst_xml(), kX14IdB));
+}
+
+TEST(FormulonCApiCfMutate, DataBarExtensionFieldsSurviveSaveAndLoad) {
+  // Reaching the model is not enough: axis, gradient and the negative
+  // colours have no legacy `<dataBar>` attribute, so a save that does not
+  // build the x14 extension loses every one of them and the caller gets a
+  // plain bar back. This is the only test on this path that crosses the
+  // ABI boundary in both directions.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule = MakeDataBarRule(&sqref);
+  rule.data_bar_gradient_engaged = 1;
+  rule.data_bar_gradient = 0;
+  rule.data_bar_axis_position_engaged = 1;
+  rule.data_bar_axis_position = 1;  // middle
+  rule.data_bar_negative_fill_engaged = 1;
+  rule.data_bar_negative_fill = fm_cf_color_t{255, 0, 0, 255};
+  rule.data_bar_border_engaged = 1;
+  rule.data_bar_border = fm_cf_color_t{1, 2, 3, 255};
+  rule.data_bar_negative_border_engaged = 1;
+  rule.data_bar_negative_border = fm_cf_color_t{4, 5, 6, 255};
+  rule.data_bar_axis_color_engaged = 1;
+  rule.data_bar_axis_color = fm_cf_color_t{7, 8, 9, 255};
+  rule.data_bar_direction = 2;  // right to left
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+
+  fm_cf_rule_t back{};
+  ASSERT_EQ(fm_sheet_cf_get_at(reloaded.handle, 0, 0, &back), 0) << fm_last_error_message();
+  EXPECT_EQ(back.data_bar_gradient, 0);
+  EXPECT_EQ(back.data_bar_axis_position, 1U);
+  EXPECT_EQ(back.data_bar_negative_fill.r, 255U);
+  EXPECT_EQ(back.data_bar_negative_fill.g, 0U);
+  EXPECT_EQ(back.data_bar_border_engaged, 1);
+  EXPECT_EQ(back.data_bar_border.b, 3U);
+  EXPECT_EQ(back.data_bar_negative_border_engaged, 1);
+  EXPECT_EQ(back.data_bar_negative_border.b, 6U);
+  EXPECT_EQ(back.data_bar_axis_color.r, 7U);
+  EXPECT_EQ(back.data_bar_axis_color.b, 9U);
+  EXPECT_EQ(back.data_bar_direction, 2U);
+}
+
+TEST(FormulonCApiCfMutate, IconSetFloorSurvivesSaveAndLoad) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 4;  // IconSet
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+  rule.icon_set_engaged = 1;
+  rule.icon_set_name = 2;  // Three_Flags
+  fm_cfvo_t thresholds[2]{};
+  thresholds[0].type = 0;  // Number
+  thresholds[0].value = "7";
+  thresholds[0].gte = 1;
+  thresholds[1].type = 0;
+  thresholds[1].value = "9";
+  thresholds[1].gte = 1;
+  rule.icon_set_thresholds = thresholds;
+  rule.icon_set_threshold_count = 2;
+  rule.icon_set_show_value = 1;
+  rule.icon_set_percent = 1;
+  rule.icon_set_floor_engaged = 1;
+  rule.icon_set_floor.type = 0;  // Number
+  rule.icon_set_floor.value = "5";
+  rule.icon_set_floor.gte = 0;
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+  fm_cf_rule_t back{};
+  ASSERT_EQ(fm_sheet_cf_get_at(reloaded.handle, 0, 0, &back), 0) << fm_last_error_message();
+  EXPECT_EQ(back.icon_set_floor_engaged, 1);
+  EXPECT_EQ(back.icon_set_floor.type, 0U);
+  EXPECT_STREQ(back.icon_set_floor.value, "5");
+  EXPECT_EQ(back.icon_set_floor.gte, 0);
+}
+
+TEST(FormulonCApiCfMutate, UnengagedIconSetFloorIsExcelsDefault) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 4;  // IconSet
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+  rule.icon_set_engaged = 1;
+  fm_cfvo_t thresholds[2]{};
+  rule.icon_set_thresholds = thresholds;
+  rule.icon_set_threshold_count = 2;
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+  const auto& floor = wb.handle->workbook().sheet(0).conditional_formats()[0].rules[0].icon_set->floor;
+  EXPECT_EQ(floor.type, formulon::cf::CfvoType::Percent);
+  EXPECT_EQ(floor.value, "0");
+  EXPECT_TRUE(floor.gte);
+}
diff --git a/tests/c_api/formulon_c_cf_test.cpp b/tests/c_api/formulon_c_cf_test.cpp
deleted file mode 100644
index 7d3377dea..000000000
--- a/tests/c_api/formulon_c_cf_test.cpp
+++ /dev/null
@@ -1,1651 +0,0 @@
-//
-// Stable C ABI conditional-format end-to-end tests.
-//
-// Drives the `fm_workbook_cf_evaluate_range` / `fm_cf_results_*` surface
-// declared in `c_api/formulon_c.h` through the same opaque-handle
-// pattern the rest of the C ABI suite uses. Evaluation tests seed CF
-// blocks through OOXML round-trip; mutation tests below drive the
-// public `fm_sheet_cf_*` add/remove/clear surface directly.
-
-#include <cmath>
-#include <cstdint>
-#include <initializer_list>
-#include <string>
-#include <utility>
-#include <vector>
-
-#include "c_api/borrowed_arena.h"
-#include "c_api/formulon_c.h"
-#include "c_api/parts/common.h"
-#include "cf/cf_types.h"
-#include "gtest/gtest.h"
-#include "sheet.h"
-#include "utils/error.h"
-#include "utils/expected.h"
-#include "value.h"
-#include "workbook.h"
-
-namespace {
-
-// RAII guard so the workbook handle is released even on test failure.
-// Move-only so factory functions can return one by value.
-struct WorkbookGuard {
-  fm_workbook_t* handle = nullptr;
-  ~WorkbookGuard() { fm_workbook_destroy(handle); }
-  WorkbookGuard() = default;
-  WorkbookGuard(const WorkbookGuard&) = delete;
-  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
-  WorkbookGuard(WorkbookGuard&& other) noexcept : handle(other.handle) { other.handle = nullptr; }
-  WorkbookGuard& operator=(WorkbookGuard&& other) noexcept {
-    if (this != &other) {
-      fm_workbook_destroy(handle);
-      handle = other.handle;
-      other.handle = nullptr;
-    }
-    return *this;
-  }
-};
-
-// RAII guard for `fm_cf_results_t` handles.
-struct CfResultsGuard {
-  fm_cf_results_t* handle = nullptr;
-  ~CfResultsGuard() { fm_cf_results_destroy(handle); }
-  CfResultsGuard() = default;
-  CfResultsGuard(const CfResultsGuard&) = delete;
-  CfResultsGuard& operator=(const CfResultsGuard&) = delete;
-};
-
-struct BufferGuard {
-  uint8_t* data = nullptr;
-  size_t len = 0;
-  ~BufferGuard() { fm_buffer_free(data); }
-  BufferGuard() = default;
-  BufferGuard(const BufferGuard&) = delete;
-  BufferGuard& operator=(const BufferGuard&) = delete;
-};
-
-// Builds a `Workbook`, applies `mutate` to seed cells / CF blocks, then
-// serialises it through OOXML and loads the resulting bytes through the
-// C ABI. The returned guard owns a populated `fm_workbook_t*` ready for
-// CF evaluation.
-template <typename MutateFn>
-WorkbookGuard WorkbookFromMutator(MutateFn&& mutate) {
-  formulon::Workbook wb = formulon::Workbook::create();
-  // Registers the `<dxf>` records the CF rules below reference. The
-  // writer omits any `dxfId` its styles part cannot resolve, so a rule
-  // whose differential format was never registered would come back from
-  // the load with no `dxf_id` at all.
-  wb.mutable_styles().dxfs.resize(8);
-  mutate(wb);
-  auto bytes = wb.save();
-  EXPECT_TRUE(static_cast<bool>(bytes)) << "Workbook::save: " << (bytes ? "" : bytes.error().message);
-  WorkbookGuard guard;
-  if (!bytes) {
-    return guard;
-  }
-  const auto& src = bytes.value();
-  EXPECT_EQ(fm_workbook_load(src.data(), src.size(), &guard.handle), 0)
-      << "fm_workbook_load: " << fm_last_error_message();
-  return guard;
-}
-
-// Registers `count` `<dxf>` slots on an existing handle. `fm_sheet_cf_add_rule`
-// refuses a `dxf_id` past the end of the table, so a mutation test that
-// engages a differential format has to seed the table first.
-void SeedDxfs(fm_workbook_t* handle, std::size_t count) {
-  handle->workbook().mutable_styles().dxfs.resize(count);
-}
-
-formulon::cf::CFCellRange MakeRange(std::uint32_t r1, std::uint32_t c1, std::uint32_t r2, std::uint32_t c2) {
-  return {{r1, c1}, {r2, c2}};
-}
-
-}  // namespace
-
-TEST(FormulonCApiCf, EvaluateRangeOnEmptyCfWorkbookReturnsZero) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  CfResultsGuard results;
-  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 9, 9, std::nan(""), &results.handle), 0);
-  ASSERT_NE(results.handle, nullptr);
-  EXPECT_EQ(fm_cf_results_cell_count(results.handle), 0U);
-}
-
-TEST(FormulonCApiCf, EvaluateRangeWithCellIsRule) {
-  WorkbookGuard wb = WorkbookFromMutator([](formulon::Workbook& w) {
-    auto& sheet = w.sheet(0);
-    sheet.set_cell_value(0, 0, formulon::Value::number(10.0));
-    sheet.set_cell_value(1, 0, formulon::Value::number(60.0));
-    sheet.set_cell_value(2, 0, formulon::Value::number(90.0));
-
-    formulon::cf::ConditionalFormat block{};
-    block.sqref.push_back(MakeRange(0, 0, 2, 0));
-    formulon::cf::CFRule rule;
-    rule.type = formulon::cf::RuleType::CellIs;
-    rule.priority = 1;
-    rule.dxf_id = 7U;
-    rule.op = formulon::cf::CellIsOperator::GreaterThan;
-    rule.formula1 = "50";
-    block.rules.push_back(std::move(rule));
-    sheet.mutable_conditional_formats().push_back(std::move(block));
-  });
-  ASSERT_NE(wb.handle, nullptr);
-  // Recalc so cached cell values are populated for the loaded handle;
-  // CF evaluation reads the cached values via `EvalContext`.
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  CfResultsGuard results;
-  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 2, 0, std::nan(""), &results.handle), 0);
-  ASSERT_NE(results.handle, nullptr);
-  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 2U);
-
-  // First matched cell: A2 (row=1).
-  std::uint32_t row = 0;
-  std::uint32_t col = 0;
-  std::size_t match_count = 0;
-  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 0, &row, &col, &match_count), 0);
-  EXPECT_EQ(row, 1U);
-  EXPECT_EQ(col, 0U);
-  ASSERT_EQ(match_count, 1U);
-  fm_cf_match_t m{};
-  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &m), 0);
-  EXPECT_EQ(m.kind, FM_CF_DIFFERENTIAL_FORMAT);
-  EXPECT_EQ(m.priority, 1);
-  EXPECT_EQ(m.dxf_id_engaged, 1);
-  EXPECT_EQ(m.dxf_id, 7U);
-
-  // Second matched cell: A3 (row=2).
-  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 1, &row, &col, &match_count), 0);
-  EXPECT_EQ(row, 2U);
-  EXPECT_EQ(col, 0U);
-  ASSERT_EQ(match_count, 1U);
-  ASSERT_EQ(fm_cf_results_match_at(results.handle, 1, 0, &m), 0);
-  EXPECT_EQ(m.kind, FM_CF_DIFFERENTIAL_FORMAT);
-  EXPECT_EQ(m.dxf_id, 7U);
-}
-
-TEST(FormulonCApiCf, EvaluateRangeRejectsRequestPastViewportCeiling) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  // Two full columns are past the viewport ceiling the engine enforces;
-  // the binding must surface the refusal instead of returning a handle.
-  CfResultsGuard results;
-  EXPECT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, formulon::cf::kCfMaxRows - 1U, 1, std::nan(""),
-                                          &results.handle),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kSecResourceLimit));
-  EXPECT_EQ(results.handle, nullptr);
-}
-
-TEST(FormulonCApiCf, EvaluateWholeColumnRangeReturnsBlockMatches) {
-  WorkbookGuard wb = WorkbookFromMutator([](formulon::Workbook& w) {
-    auto& sheet = w.sheet(0);
-    sheet.set_cell_value(0, 0, formulon::Value::number(10.0));
-    sheet.set_cell_value(1, 0, formulon::Value::number(60.0));
-
-    formulon::cf::ConditionalFormat block{};
-    block.sqref.push_back(MakeRange(0, 0, 1, 0));
-    formulon::cf::CFRule rule;
-    rule.type = formulon::cf::RuleType::CellIs;
-    rule.priority = 1;
-    rule.dxf_id = 7U;
-    rule.op = formulon::cf::CellIsOperator::GreaterThan;
-    rule.formula1 = "50";
-    block.rules.push_back(std::move(rule));
-    sheet.mutable_conditional_formats().push_back(std::move(block));
-  });
-  ASSERT_NE(wb.handle, nullptr);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  // A whole column sits exactly at the ceiling and is answered from the
-  // block, not from the column's million rows.
-  CfResultsGuard results;
-  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, formulon::cf::kCfMaxRows - 1U, 0, std::nan(""),
-                                          &results.handle),
-            0)
-      << fm_last_error_message();
-  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 1U);
-
-  std::uint32_t row = 0;
-  std::uint32_t col = 0;
-  std::size_t match_count = 0;
-  ASSERT_EQ(fm_cf_results_cell_at(results.handle, 0, &row, &col, &match_count), 0);
-  EXPECT_EQ(row, 1U);
-  EXPECT_EQ(col, 0U);
-  ASSERT_EQ(match_count, 1U);
-  fm_cf_match_t m{};
-  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &m), 0);
-  EXPECT_EQ(m.dxf_id_engaged, 1);
-  EXPECT_EQ(m.dxf_id, 7U);
-}
-
-TEST(FormulonCApiCf, EvaluateRangeWithColorScale) {
-  WorkbookGuard wb = WorkbookFromMutator([](formulon::Workbook& w) {
-    auto& sheet = w.sheet(0);
-    sheet.set_cell_value(0, 0, formulon::Value::number(0.0));
-    sheet.set_cell_value(1, 0, formulon::Value::number(50.0));
-    sheet.set_cell_value(2, 0, formulon::Value::number(100.0));
-
-    formulon::cf::ConditionalFormat block{};
-    block.sqref.push_back(MakeRange(0, 0, 2, 0));
-
-    formulon::cf::CFRule rule;
-    rule.type = formulon::cf::RuleType::ColorScale;
-    rule.priority = 1;
-
-    formulon::cf::ColorScaleSpec spec;
-    spec.thresholds.push_back({formulon::cf::CfvoType::Min, "", true});
-    spec.thresholds.push_back({formulon::cf::CfvoType::Percentile, "50", true});
-    spec.thresholds.push_back({formulon::cf::CfvoType::Max, "", true});
-    spec.colors.push_back({255, 0, 0, 255});    // red
-    spec.colors.push_back({255, 255, 0, 255});  // yellow
-    spec.colors.push_back({0, 255, 0, 255});    // green
-    rule.color_scale = std::move(spec);
-
-    block.rules.push_back(std::move(rule));
-    sheet.mutable_conditional_formats().push_back(std::move(block));
-  });
-  ASSERT_NE(wb.handle, nullptr);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  CfResultsGuard results;
-  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 2, 0, std::nan(""), &results.handle), 0);
-  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 3U);
-
-  const std::vector<std::tuple<std::uint8_t, std::uint8_t, std::uint8_t>> expected = {
-      {255, 0, 0},    // A1 = 0  → red endpoint
-      {255, 255, 0},  // A2 = 50 → yellow midpoint
-      {0, 255, 0},    // A3 = 100 → green endpoint
-  };
-
-  for (std::size_t i = 0; i < expected.size(); ++i) {
-    std::uint32_t row = 0;
-    std::uint32_t col = 0;
-    std::size_t match_count = 0;
-    ASSERT_EQ(fm_cf_results_cell_at(results.handle, i, &row, &col, &match_count), 0);
-    ASSERT_EQ(match_count, 1U) << "i=" << i;
-    fm_cf_match_t m{};
-    ASSERT_EQ(fm_cf_results_match_at(results.handle, i, 0, &m), 0) << "i=" << i;
-    EXPECT_EQ(m.kind, FM_CF_COLOR_SCALE) << "i=" << i;
-    const auto& [er, eg, eb] = expected[i];
-    EXPECT_NEAR(static_cast<int>(m.color.r), static_cast<int>(er), 1) << "i=" << i;
-    EXPECT_NEAR(static_cast<int>(m.color.g), static_cast<int>(eg), 1) << "i=" << i;
-    EXPECT_NEAR(static_cast<int>(m.color.b), static_cast<int>(eb), 1) << "i=" << i;
-  }
-}
-
-TEST(FormulonCApiCf, DestroyHandlesNullSafely) {
-  fm_cf_results_destroy(nullptr);
-  // No assertion needed; we just exercise the null path for ASan.
-  SUCCEED();
-}
-
-TEST(FormulonCApiCf, OutOfRangeIndicesReturnInvalidArgument) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  CfResultsGuard results;
-  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 0, 0, std::nan(""), &results.handle), 0);
-  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 0U);
-
-  std::uint32_t row = 0;
-  std::uint32_t col = 0;
-  std::size_t match_count = 0;
-  fm_status_t rc = fm_cf_results_cell_at(results.handle, 0, &row, &col, &match_count);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  fm_cf_match_t m{};
-  rc = fm_cf_results_match_at(results.handle, 0, 0, &m);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-}
-
-TEST(FormulonCApiCf, NullWorkbookSetsBindingError) {
-  fm_cf_results_t* out = reinterpret_cast<fm_cf_results_t*>(static_cast<std::uintptr_t>(1));
-  fm_status_t rc = fm_workbook_cf_evaluate_range(nullptr, 0, 0, 0, 0, 0, std::nan(""), &out);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-  EXPECT_EQ(out, nullptr);
-  fm_cf_results_destroy(out);
-}
-
-TEST(FormulonCApiCf, OutOfRangeSheetIndexReturnsInvalidArgument) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_results_t* out = reinterpret_cast<fm_cf_results_t*>(static_cast<std::uintptr_t>(1));
-  fm_status_t rc = fm_workbook_cf_evaluate_range(wb.handle, 99, 0, 0, 0, 0, std::nan(""), &out);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(out, nullptr);
-  fm_cf_results_destroy(out);
-}
-
-TEST(FormulonCApiCf, OutOfGridOrReversedRectReturnsInvalidArgument) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_results_t* out = reinterpret_cast<fm_cf_results_t*>(static_cast<std::uintptr_t>(1));
-  // A reversed rectangle (last < first) would wrap the iteration span.
-  EXPECT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 5, 5, 0, 0, std::nan(""), &out),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(out, nullptr);
-  // A corner past the grid ceiling would materialize billions of cells.
-  out = reinterpret_cast<fm_cf_results_t*>(static_cast<std::uintptr_t>(1));
-  EXPECT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, formulon::Sheet::kMaxRows, 0, std::nan(""), &out),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(out, nullptr);
-  fm_cf_results_destroy(out);
-}
-
-TEST(FormulonCApiCf, ExpressionRuleEvaluatesFunctionsAndQualifiedRefs) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDxfs(wb.handle, 4);
-  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Sheet2"), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 11.0), 0);  // Sheet1!A1
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 1, 0, 0, 5.0), 0);   // Sheet2!A1
-
-  fm_cf_cell_range_t sqref{0, 0, 0, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 0;  // Expression
-  rule.formula1 = "AND(A1>10,Sheet2!A1=5)";
-  rule.dxf_id_engaged = 1;
-  rule.dxf_id = 3;
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-  EXPECT_EQ(rule_index, 0U);
-
-  CfResultsGuard results;
-  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 0, 0, std::nan(""), &results.handle), 0)
-      << fm_last_error_message();
-  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 1U);
-
-  fm_cf_match_t match{};
-  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &match), 0);
-  EXPECT_EQ(match.kind, FM_CF_DIFFERENTIAL_FORMAT);
-  EXPECT_EQ(match.dxf_id_engaged, 1);
-  EXPECT_EQ(match.dxf_id, 3U);
-}
-
-TEST(FormulonCApiCf, ExpressionRuleRecursivelyEvaluatesFormulaCells) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDxfs(wb.handle, 5);
-  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Sheet2"), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 1, 0, 0, 7.0), 0);                   // Sheet2!A1
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SUM(Sheet2!A1,5)"), 0);  // Sheet1!A1
-
-  fm_cf_cell_range_t sqref{0, 0, 0, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 0;  // Expression
-  rule.formula1 = "A1>10";
-  rule.dxf_id_engaged = 1;
-  rule.dxf_id = 4;
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-  EXPECT_EQ(rule_index, 0U);
-
-  // No explicit recalc: CF evaluation should use a recursive EvalState
-  // instead of reading the formula cell's stale blank cached value.
-  CfResultsGuard results;
-  ASSERT_EQ(fm_workbook_cf_evaluate_range(wb.handle, 0, 0, 0, 0, 0, std::nan(""), &results.handle), 0)
-      << fm_last_error_message();
-  ASSERT_EQ(fm_cf_results_cell_count(results.handle), 1U);
-
-  fm_cf_match_t match{};
-  ASSERT_EQ(fm_cf_results_match_at(results.handle, 0, 0, &match), 0);
-  EXPECT_EQ(match.kind, FM_CF_DIFFERENTIAL_FORMAT);
-  EXPECT_EQ(match.dxf_id_engaged, 1);
-  EXPECT_EQ(match.dxf_id, 4U);
-}
-
-// ---------------------------------------------------------------------------
-// CF mutation API (fm_sheet_cf_count / get_at / add_rule / remove_at / clear)
-// ---------------------------------------------------------------------------
-
-TEST(FormulonCApiCfMutate, AddCellIsRuleRoundTrips) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDxfs(wb.handle, 1);
-
-  fm_cf_cell_range_t sqref{};
-  sqref.first_row = 0;
-  sqref.first_col = 0;
-  sqref.last_row = 9;
-  sqref.last_col = 0;
-
-  fm_cf_rule_t rule{};
-  rule.type = 1;  // CellIs
-  rule.op_engaged = 1;
-  rule.op = 5;  // GreaterThan
-  std::string formula = "50";
-  rule.formula1 = formula.c_str();
-  rule.dxf_id_engaged = 1;
-  rule.dxf_id = 0;
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0);
-  EXPECT_EQ(rule_index, 0U);
-
-  std::size_t count = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 1U);
-
-  fm_cf_rule_t out{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
-  EXPECT_EQ(out.type, 1U);
-  EXPECT_EQ(out.op_engaged, 1);
-  EXPECT_EQ(out.op, 5U);
-  EXPECT_EQ(out.priority, 1);  // auto-assigned since input <= 0
-  EXPECT_EQ(out.dxf_id_engaged, 1);
-  EXPECT_EQ(out.dxf_id, 0U);
-  ASSERT_NE(out.formula1, nullptr);
-  EXPECT_STREQ(out.formula1, "50");
-  ASSERT_NE(out.sqref, nullptr);
-  EXPECT_EQ(out.sqref_count, 1U);
-  EXPECT_EQ(out.sqref[0].first_row, 0U);
-  EXPECT_EQ(out.sqref[0].last_row, 9U);
-  ASSERT_NE(out.id, nullptr);
-  EXPECT_FALSE(std::string(out.id).empty());
-}
-
-TEST(FormulonCApiCfMutate, AddRuleRejectsDxfIdPastTheStylesTable) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDxfs(wb.handle, 2);
-
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 1;  // CellIs
-  rule.op_engaged = 1;
-  rule.op = 5;  // GreaterThan
-  rule.formula1 = "50";
-  rule.dxf_id_engaged = 1;
-  rule.dxf_id = 2;  // one past the last registered `<dxf>`
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-
-  std::size_t rule_index = 99U;
-  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_STREQ(fm_last_error_message(), "fm_sheet_cf_add_rule: dxf_id out of range");
-
-  // The rejected rule is not appended, so a workbook saved after the failed
-  // call carries no `<cfRule>` whose `dxfId` Excel cannot resolve.
-  std::size_t count = 99U;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 0U);
-
-  // The last in-range index is still accepted.
-  rule.dxf_id = 1;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 1U);
-}
-
-TEST(FormulonCApiCfMutate, AddRuleWithoutDxfIdIgnoresTheEmptyStylesTable) {
-  // A rule that engages no differential format must stay addable on a
-  // workbook that has registered no `<dxf>` at all.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 1;  // CellIs
-  rule.op_engaged = 1;
-  rule.op = 5;  // GreaterThan
-  rule.formula1 = "50";
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-
-  std::size_t rule_index = 99U;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-  EXPECT_EQ(rule_index, 0U);
-
-  fm_cf_rule_t out{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
-  EXPECT_EQ(out.dxf_id_engaged, 0);
-}
-
-TEST(FormulonCApiCfMutate, AddMultipleRulesAutoIncrementsPriority) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cf_cell_range_t sqref{0, 0, 0, 0};
-  for (int i = 0; i < 3; ++i) {
-    fm_cf_rule_t rule{};
-    rule.type = 0;  // Expression
-    std::string f = "TRUE";
-    rule.formula1 = f.c_str();
-    rule.sqref = &sqref;
-    rule.sqref_count = 1;
-    std::size_t rule_index = 0;
-    ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0);
-    EXPECT_EQ(rule_index, static_cast<std::size_t>(i));
-  }
-
-  std::size_t count = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 3U);
-  for (std::size_t i = 0; i < 3; ++i) {
-    fm_cf_rule_t out{};
-    ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, i, &out), 0);
-    EXPECT_EQ(out.priority, static_cast<int32_t>(i + 1));
-  }
-}
-
-TEST(FormulonCApiCfMutate, RemoveAtFlattensIndices) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cf_cell_range_t sqref{0, 0, 0, 0};
-  std::vector<std::string> formulas{"A1", "A2", "A3"};
-  std::size_t expected_index = 0;
-  for (const auto& f : formulas) {
-    fm_cf_rule_t rule{};
-    rule.type = 0;  // Expression
-    rule.formula1 = f.c_str();
-    rule.sqref = &sqref;
-    rule.sqref_count = 1;
-    std::size_t rule_index = 0;
-    ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0);
-    EXPECT_EQ(rule_index, expected_index);
-    ++expected_index;
-  }
-  std::size_t count = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  ASSERT_EQ(count, 3U);
-
-  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 1), 0);
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 2U);
-
-  // A record's storage belongs to the handle and the next get takes it
-  // back, so each rule is read before the following one is fetched.
-  fm_cf_rule_t out0{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out0), 0);
-  EXPECT_STREQ(out0.formula1, "A1");
-  fm_cf_rule_t out1{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 1, &out1), 0);
-  EXPECT_STREQ(out1.formula1, "A3");
-}
-
-TEST(FormulonCApiCfMutate, ClearRemovesAllBlocks) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 0, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 0;
-  std::string f = "TRUE";
-  rule.formula1 = f.c_str();
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0);
-  EXPECT_EQ(rule_index, 0U);
-
-  ASSERT_EQ(fm_sheet_cf_clear(wb.handle, 0), 0);
-  std::size_t count = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 0U);
-}
-
-TEST(FormulonCApiCfMutate, AddsVisualRuleTypesAndPreservesThroughSaveLoad) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 0, 0};
-
-  fm_cf_rule_t rule{};
-  rule.type = 2;  // ColorScale
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-  fm_cfvo_t thresholds[3]{};
-  thresholds[0].type = 3;  // Min
-  thresholds[0].gte = 1;
-  thresholds[1].type = 1;  // Percent
-  thresholds[1].value = "50";
-  thresholds[1].gte = 1;
-  thresholds[2].type = 4;  // Max
-  thresholds[2].gte = 1;
-  fm_cf_color_t colors[3]{{255, 0, 0, 255}, {255, 255, 0, 255}, {0, 255, 0, 255}};
-  rule.color_scale_thresholds = thresholds;
-  rule.color_scale_colors = colors;
-  rule.color_scale_count = 3;
-  std::size_t color_rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &color_rule_index), 0);
-  EXPECT_EQ(color_rule_index, 0U);
-
-  fm_cf_cell_range_t db_sqref{1, 0, 1, 0};
-  fm_cf_rule_t db_rule{};
-  db_rule.type = 3;  // DataBar
-  db_rule.sqref = &db_sqref;
-  db_rule.sqref_count = 1;
-  db_rule.data_bar_engaged = 1;
-  db_rule.data_bar_min.type = 3;  // Min
-  db_rule.data_bar_min.gte = 1;
-  db_rule.data_bar_max.type = 4;  // Max
-  db_rule.data_bar_max.gte = 1;
-  db_rule.data_bar_fill = fm_cf_color_t{99, 142, 198, 255};
-  db_rule.data_bar_show_value = 1;
-  db_rule.data_bar_min_length_pct = 10;
-  db_rule.data_bar_max_length_pct = 90;
-  std::size_t data_bar_rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, db_rule, &data_bar_rule_index), 0);
-  EXPECT_EQ(data_bar_rule_index, 1U);
-
-  fm_cf_cell_range_t icon_sqref{2, 0, 2, 0};
-  fm_cf_rule_t icon_rule{};
-  icon_rule.type = 4;  // IconSet
-  icon_rule.sqref = &icon_sqref;
-  icon_rule.sqref_count = 1;
-  icon_rule.icon_set_engaged = 1;
-  icon_rule.icon_set_name = 0;  // Three_Arrows
-  fm_cfvo_t icon_thresholds[2]{};
-  icon_thresholds[0].type = 1;  // Percent
-  icon_thresholds[0].value = "33";
-  icon_thresholds[0].gte = 1;
-  icon_thresholds[1].type = 1;  // Percent
-  icon_thresholds[1].value = "67";
-  icon_thresholds[1].gte = 1;
-  icon_rule.icon_set_thresholds = icon_thresholds;
-  icon_rule.icon_set_threshold_count = 2;
-  icon_rule.icon_set_show_value = 1;
-  icon_rule.icon_set_percent = 1;
-  std::size_t icon_rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, icon_rule, &icon_rule_index), 0);
-  EXPECT_EQ(icon_rule_index, 2U);
-
-  const auto& blocks = wb.handle->workbook().sheet(0).conditional_formats();
-  ASSERT_EQ(blocks.size(), 3U);
-  ASSERT_EQ(blocks[0].rules.size(), 1U);
-  ASSERT_TRUE(blocks[0].rules[0].color_scale.has_value());
-  ASSERT_EQ(blocks[0].rules[0].color_scale->thresholds.size(), 3U);
-  EXPECT_EQ(blocks[0].rules[0].color_scale->thresholds[1].value, "50");
-  EXPECT_EQ(blocks[0].rules[0].color_scale->colors[2].g, 255U);
-  ASSERT_TRUE(blocks[1].rules[0].data_bar.has_value());
-  EXPECT_EQ(blocks[1].rules[0].data_bar->fill.b, 198U);
-  ASSERT_TRUE(blocks[2].rules[0].icon_set.has_value());
-  EXPECT_EQ(blocks[2].rules[0].icon_set->thresholds[1].value, "67");
-
-  fm_cf_rule_t out_color{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out_color), 0);
-  ASSERT_EQ(out_color.color_scale_count, 3U);
-  ASSERT_NE(out_color.color_scale_thresholds, nullptr);
-  ASSERT_NE(out_color.color_scale_colors, nullptr);
-  EXPECT_EQ(out_color.color_scale_thresholds[1].type, 1U);
-  EXPECT_STREQ(out_color.color_scale_thresholds[1].value, "50");
-  EXPECT_EQ(out_color.color_scale_colors[2].g, 255U);
-
-  fm_cf_rule_t out_bar{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 1, &out_bar), 0);
-  EXPECT_EQ(out_bar.data_bar_engaged, 1);
-  EXPECT_EQ(out_bar.data_bar_fill.b, 198U);
-  EXPECT_EQ(out_bar.data_bar_min_length_pct, 10U);
-  EXPECT_EQ(out_bar.data_bar_max_length_pct, 90U);
-
-  fm_cf_rule_t out_icon{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 2, &out_icon), 0);
-  EXPECT_EQ(out_icon.icon_set_engaged, 1);
-  EXPECT_EQ(out_icon.icon_set_threshold_count, 2U);
-  ASSERT_NE(out_icon.icon_set_thresholds, nullptr);
-  EXPECT_STREQ(out_icon.icon_set_thresholds[1].value, "67");
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-  const auto& reloaded_blocks = reloaded.handle->workbook().sheet(0).conditional_formats();
-  ASSERT_EQ(reloaded_blocks.size(), 3U);
-  ASSERT_EQ(reloaded_blocks[0].rules.size(), 1U);
-  ASSERT_TRUE(reloaded_blocks[0].rules[0].color_scale.has_value());
-  EXPECT_EQ(reloaded_blocks[0].rules[0].color_scale->colors[0].r, 255U);
-  ASSERT_TRUE(reloaded_blocks[1].rules[0].data_bar.has_value());
-  EXPECT_EQ(reloaded_blocks[1].rules[0].data_bar->fill.g, 142U);
-  ASSERT_TRUE(reloaded_blocks[2].rules[0].icon_set.has_value());
-  EXPECT_EQ(reloaded_blocks[2].rules[0].icon_set->thresholds.size(), 2U);
-}
-
-namespace {
-
-// Minimal valid DataBar rule. Extension fields stay zero-initialized so
-// each test below engages only what it is about to assert.
-fm_cf_rule_t MakeDataBarRule(const fm_cf_cell_range_t* sqref) {
-  fm_cf_rule_t rule{};
-  rule.type = 3;  // DataBar
-  rule.sqref = sqref;
-  rule.sqref_count = 1;
-  rule.data_bar_engaged = 1;
-  rule.data_bar_min.type = 3;  // Min
-  rule.data_bar_min.gte = 1;
-  rule.data_bar_max.type = 4;  // Max
-  rule.data_bar_max.gte = 1;
-  rule.data_bar_fill = fm_cf_color_t{99, 142, 198, 255};
-  rule.data_bar_show_value = 1;
-  rule.data_bar_min_length_pct = 10;
-  rule.data_bar_max_length_pct = 90;
-  return rule;
-}
-
-const formulon::cf::DataBarSpec& OnlyDataBarSpec(fm_workbook_t* handle) {
-  const auto& blocks = handle->workbook().sheet(0).conditional_formats();
-  EXPECT_EQ(blocks.size(), 1U);
-  EXPECT_EQ(blocks[0].rules.size(), 1U);
-  EXPECT_TRUE(blocks[0].rules[0].data_bar.has_value());
-  return *blocks[0].rules[0].data_bar;
-}
-
-}  // namespace
-
-TEST(FormulonCApiCfMutate, ZeroInitializedDataBarExtensionKeepsTheModelDefaults) {
-  // The extension fields were appended to a struct callers already
-  // zero-initialize. Leaving every `*_engaged` flag at zero must produce
-  // exactly the spec the ABI produced before those fields existed.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  const fm_cf_rule_t rule = MakeDataBarRule(&sqref);
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-
-  const formulon::cf::DataBarSpec& spec = OnlyDataBarSpec(wb.handle);
-  EXPECT_TRUE(spec.gradient);
-  EXPECT_EQ(spec.axis_position, formulon::cf::DataBarAxisPosition::Automatic);
-  // Unengaged negative fill still mirrors the positive fill.
-  EXPECT_EQ(spec.negative_fill.r, spec.fill.r);
-  EXPECT_EQ(spec.negative_fill.g, spec.fill.g);
-  EXPECT_EQ(spec.negative_fill.b, spec.fill.b);
-  EXPECT_EQ(spec.negative_fill.a, spec.fill.a);
-  EXPECT_FALSE(spec.border.has_value());
-  EXPECT_FALSE(spec.negative_border.has_value());
-  EXPECT_EQ(spec.axis_color.r, 0U);
-  EXPECT_EQ(spec.axis_color.g, 0U);
-  EXPECT_EQ(spec.axis_color.b, 0U);
-  EXPECT_EQ(spec.axis_color.a, 255U);
-}
-
-TEST(FormulonCApiCfMutate, DataBarExtensionFieldsReachTheModelWhenEngaged) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule = MakeDataBarRule(&sqref);
-  rule.data_bar_gradient_engaged = 1;
-  rule.data_bar_gradient = 0;  // solid, not gradient
-  rule.data_bar_axis_position_engaged = 1;
-  rule.data_bar_axis_position = 1;  // middle
-  rule.data_bar_negative_fill_engaged = 1;
-  rule.data_bar_negative_fill = fm_cf_color_t{255, 0, 0, 255};
-  rule.data_bar_border_engaged = 1;
-  rule.data_bar_border = fm_cf_color_t{1, 2, 3, 255};
-  rule.data_bar_negative_border_engaged = 1;
-  rule.data_bar_negative_border = fm_cf_color_t{4, 5, 6, 255};
-  rule.data_bar_axis_color_engaged = 1;
-  rule.data_bar_axis_color = fm_cf_color_t{7, 8, 9, 255};
-
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-
-  const formulon::cf::DataBarSpec& spec = OnlyDataBarSpec(wb.handle);
-  EXPECT_FALSE(spec.gradient);
-  EXPECT_EQ(spec.axis_position, formulon::cf::DataBarAxisPosition::Middle);
-  EXPECT_EQ(spec.negative_fill.r, 255U);
-  EXPECT_EQ(spec.negative_fill.g, 0U);
-  ASSERT_TRUE(spec.border.has_value());
-  EXPECT_EQ(spec.border->r, 1U);
-  EXPECT_EQ(spec.border->b, 3U);
-  ASSERT_TRUE(spec.negative_border.has_value());
-  EXPECT_EQ(spec.negative_border->r, 4U);
-  EXPECT_EQ(spec.negative_border->b, 6U);
-  EXPECT_EQ(spec.axis_color.r, 7U);
-  EXPECT_EQ(spec.axis_color.b, 9U);
-}
-
-TEST(FormulonCApiCfMutate, DataBarRuleSurvivesGetAtFedBackIntoAddRule) {
-  // The only way to edit a CF rule through this ABI is get -> remove ->
-  // add, so that path has to be an identity on the rule model, and the
-  // record has to stay readable across the removal without the caller
-  // copying anything out of it. Before the extension fields existed the
-  // sequence silently reset axis, gradient and the negative colours to
-  // their defaults.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t seed = MakeDataBarRule(&sqref);
-  seed.data_bar_gradient_engaged = 1;
-  seed.data_bar_gradient = 0;
-  seed.data_bar_axis_position_engaged = 1;
-  seed.data_bar_axis_position = 1;  // middle
-  seed.data_bar_negative_fill_engaged = 1;
-  seed.data_bar_negative_fill = fm_cf_color_t{200, 30, 40, 255};
-  seed.data_bar_border_engaged = 1;
-  seed.data_bar_border = fm_cf_color_t{11, 22, 33, 255};
-  seed.data_bar_axis_color_engaged = 1;
-  seed.data_bar_axis_color = fm_cf_color_t{44, 55, 66, 255};
-  std::size_t seed_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, seed, &seed_index), 0) << fm_last_error_message();
-
-  // Read it back, change one unrelated field, and write it out again.
-  fm_cf_rule_t round_trip{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &round_trip), 0);
-  EXPECT_EQ(round_trip.data_bar_gradient_engaged, 1);
-  EXPECT_EQ(round_trip.data_bar_gradient, 0);
-  EXPECT_EQ(round_trip.data_bar_axis_position_engaged, 1);
-  EXPECT_EQ(round_trip.data_bar_axis_position, 1U);
-  EXPECT_EQ(round_trip.data_bar_negative_fill_engaged, 1);
-  EXPECT_EQ(round_trip.data_bar_negative_fill.r, 200U);
-  EXPECT_EQ(round_trip.data_bar_border_engaged, 1);
-  EXPECT_EQ(round_trip.data_bar_border.g, 22U);
-  // No negative border was set, so the getter must report it absent
-  // rather than handing back an engaged black.
-  EXPECT_EQ(round_trip.data_bar_negative_border_engaged, 0);
-  EXPECT_EQ(round_trip.data_bar_axis_color_engaged, 1);
-  EXPECT_EQ(round_trip.data_bar_axis_color.b, 66U);
-
-  round_trip.stop_if_true = 1;
-  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
-  std::size_t rewritten_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, round_trip, &rewritten_index), 0) << fm_last_error_message();
-
-  const formulon::cf::DataBarSpec& spec = OnlyDataBarSpec(wb.handle);
-  EXPECT_FALSE(spec.gradient);
-  EXPECT_EQ(spec.axis_position, formulon::cf::DataBarAxisPosition::Middle);
-  EXPECT_EQ(spec.negative_fill.r, 200U);
-  EXPECT_EQ(spec.negative_fill.g, 30U);
-  ASSERT_TRUE(spec.border.has_value());
-  EXPECT_EQ(spec.border->b, 33U);
-  EXPECT_FALSE(spec.negative_border.has_value());
-  EXPECT_EQ(spec.axis_color.g, 55U);
-}
-
-TEST(FormulonCApiCfMutate, GetAtRecordStaysReadableUntilTheNextGet) {
-  // The record the getter fills has to outlive the mutations of the ABI's
-  // own edit procedure, and unrelated reads that recycle the handle's text
-  // scratch must not disturb it either. Only the next successful CF get
-  // takes the storage back.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 5, 5, "unrelated"), 0);
-
-  fm_cf_cell_range_t sqref[2]{{0, 0, 9, 0}, {4, 3, 14, 3}};
-  fm_cf_rule_t seed{};
-  seed.id = "{AB000000-0000-0000-0000-000000000001}";
-  seed.type = 2;  // ColorScale
-  seed.sqref = sqref;
-  seed.sqref_count = 2;
-  seed.formula1 = "SEEDFORMULA";
-  fm_cfvo_t thresholds[2]{};
-  thresholds[0].type = 0;  // Number
-  thresholds[0].value = "11";
-  thresholds[1].type = 0;
-  thresholds[1].value = "33";
-  fm_cf_color_t colors[2]{{255, 0, 0, 255}, {0, 255, 0, 255}};
-  seed.color_scale_thresholds = thresholds;
-  seed.color_scale_colors = colors;
-  seed.color_scale_count = 2;
-  std::size_t seed_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, seed, &seed_index), 0) << fm_last_error_message();
-
-  fm_cf_rule_t held{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &held), 0);
-  ASSERT_NE(held.sqref, nullptr);
-  ASSERT_EQ(held.sqref_count, 2U);
-  ASSERT_EQ(held.color_scale_count, 2U);
-
-  // A removal frees the block the rule lived in.
-  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
-  std::size_t remaining = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &remaining), 0);
-  ASSERT_EQ(remaining, 0U);
-  EXPECT_STREQ(held.id, "{AB000000-0000-0000-0000-000000000001}");
-  EXPECT_STREQ(held.formula1, "SEEDFORMULA");
-  EXPECT_EQ(held.sqref[1].first_col, 3U);
-  EXPECT_EQ(held.sqref[1].last_row, 14U);
-  EXPECT_STREQ(held.color_scale_thresholds[1].value, "33");
-
-  // An unrelated text read recycles `read_scratch`.
-  fm_value_t unrelated{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 5, 5, &unrelated), 0);
-  EXPECT_STREQ(held.id, "{AB000000-0000-0000-0000-000000000001}");
-  EXPECT_STREQ(held.color_scale_thresholds[0].value, "11");
-
-  // Feeding the held record straight back is the documented edit path; it
-  // must not need a caller-side copy of anything.
-  std::size_t rewritten_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, held, &rewritten_index), 0) << fm_last_error_message();
-  const auto& blocks = wb.handle->workbook().sheet(0).conditional_formats();
-  ASSERT_EQ(blocks.size(), 1U);
-  ASSERT_EQ(blocks[0].sqref.size(), 2U);
-  EXPECT_EQ(blocks[0].sqref[1], MakeRange(4, 3, 14, 3));
-  EXPECT_EQ(blocks[0].rules[0].id, "{AB000000-0000-0000-0000-000000000001}");
-  ASSERT_TRUE(blocks[0].rules[0].color_scale.has_value());
-  EXPECT_EQ(blocks[0].rules[0].color_scale->thresholds[1].value, "33");
-}
-
-TEST(FormulonCApiCfMutate, DataBarRejectsInvertedLengthsAndUnknownAxisPosition) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-
-  fm_cf_rule_t inverted = MakeDataBarRule(&sqref);
-  inverted.data_bar_min_length_pct = 90;
-  inverted.data_bar_max_length_pct = 10;
-  std::size_t rule_index = 0;
-  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, inverted, &rule_index),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  fm_cf_rule_t bad_axis = MakeDataBarRule(&sqref);
-  bad_axis.data_bar_axis_position_engaged = 1;
-  bad_axis.data_bar_axis_position = 3;  // one past `none`
-  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, bad_axis, &rule_index),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  // An unengaged out-of-domain axis ordinal is ignored, not rejected: the
-  // flag is what makes the value meaningful.
-  fm_cf_rule_t stale_axis = MakeDataBarRule(&sqref);
-  stale_axis.data_bar_axis_position = 3;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, stale_axis, &rule_index), 0) << fm_last_error_message();
-  EXPECT_EQ(OnlyDataBarSpec(wb.handle).axis_position, formulon::cf::DataBarAxisPosition::Automatic);
-}
-
-TEST(FormulonCApiCfMutate, ThresholdStringsStayLiveWhileLaterPayloadsArePulled) {
-  // Mirrors what the JS bindings do for a rule object that carries more
-  // than one payload key: every threshold string is pulled into one
-  // caller-side store, and the record keeps a borrowed view of each. The
-  // store must therefore not relocate bytes an earlier pull already
-  // published into the record - which is what a growing vector does on
-  // the second short string it holds.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  formulon::c_api::BorrowedStringArena strings;
-
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 2;  // ColorScale
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-
-  fm_cfvo_t thresholds[3]{};
-  const char* const kThresholdValues[3] = {"11", "22", "33"};
-  for (std::size_t i = 0; i < 3; ++i) {
-    thresholds[i].type = 0;  // Number
-    thresholds[i].gte = 1;
-    thresholds[i].value = strings.emplace(kThresholdValues[i]);
-  }
-  fm_cf_color_t colors[3]{{255, 0, 0, 255}, {255, 255, 0, 255}, {0, 255, 0, 255}};
-  rule.color_scale_thresholds = thresholds;
-  rule.color_scale_colors = colors;
-  rule.color_scale_count = 3;
-
-  // The same JS object also carried `dataBar` and `iconSet` keys, so the
-  // binding pulls their threshold strings into the same store after the
-  // colorScale views are already in the record.
-  rule.data_bar_engaged = 1;
-  rule.data_bar_min.type = 0;
-  rule.data_bar_min.value = strings.emplace("5");
-  rule.data_bar_max.type = 0;
-  rule.data_bar_max.value = strings.emplace("95");
-  fm_cfvo_t icon_thresholds[2]{};
-  icon_thresholds[0].type = 1;  // Percent
-  icon_thresholds[0].value = strings.emplace("40");
-  icon_thresholds[1].type = 1;
-  icon_thresholds[1].value = strings.emplace("80");
-  rule.icon_set_engaged = 1;
-  rule.icon_set_thresholds = icon_thresholds;
-  rule.icon_set_threshold_count = 2;
-
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-
-  const auto& blocks = wb.handle->workbook().sheet(0).conditional_formats();
-  ASSERT_EQ(blocks.size(), 1U);
-  ASSERT_TRUE(blocks[0].rules[0].color_scale.has_value());
-  const auto& stored = blocks[0].rules[0].color_scale->thresholds;
-  ASSERT_EQ(stored.size(), 3U);
-  EXPECT_EQ(stored[0].value, "11");
-  EXPECT_EQ(stored[1].value, "22");
-  EXPECT_EQ(stored[2].value, "33");
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-  const auto& reloaded_blocks = reloaded.handle->workbook().sheet(0).conditional_formats();
-  ASSERT_EQ(reloaded_blocks.size(), 1U);
-  ASSERT_TRUE(reloaded_blocks[0].rules[0].color_scale.has_value());
-  const auto& reloaded_thresholds = reloaded_blocks[0].rules[0].color_scale->thresholds;
-  ASSERT_EQ(reloaded_thresholds.size(), 3U);
-  EXPECT_EQ(reloaded_thresholds[0].value, "11");
-  EXPECT_EQ(reloaded_thresholds[1].value, "22");
-  EXPECT_EQ(reloaded_thresholds[2].value, "33");
-}
-
-TEST(FormulonCApiCfMutate, RuleEngagingSeveralVisualPayloadsSurfacesLivePointers) {
-  // `cf::CFRule` declares the three visual payloads mutually exclusive,
-  // but a rule can only be trusted to honour that once every producer
-  // does. The getter must keep every pointer it writes into the record
-  // valid until it returns, including for a rule that engages two.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  auto& sheet = wb.handle->workbook().sheet(0);
-  formulon::cf::ConditionalFormat block{};
-  block.sqref.push_back(MakeRange(0, 0, 9, 0));
-  formulon::cf::CFRule rule;
-  rule.type = formulon::cf::RuleType::ColorScale;
-  rule.priority = 1;
-  formulon::cf::ColorScaleSpec color_scale;
-  for (const char* value : {"11", "22", "33"}) {
-    formulon::cf::CfValueObject cfvo;
-    cfvo.type = formulon::cf::CfvoType::Number;
-    cfvo.value = value;
-    color_scale.thresholds.push_back(cfvo);
-    color_scale.colors.push_back(formulon::cf::Color{255, 0, 0, 255});
-  }
-  rule.color_scale = std::move(color_scale);
-  formulon::cf::IconSetSpec icon_set;
-  for (const char* value : {"40", "80"}) {
-    formulon::cf::CfValueObject cfvo;
-    cfvo.type = formulon::cf::CfvoType::Percent;
-    cfvo.value = value;
-    icon_set.thresholds.push_back(cfvo);
-  }
-  rule.icon_set = std::move(icon_set);
-  block.rules.push_back(std::move(rule));
-  sheet.mutable_conditional_formats().push_back(std::move(block));
-
-  fm_cf_rule_t out{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
-  ASSERT_EQ(out.color_scale_count, 3U);
-  ASSERT_NE(out.color_scale_thresholds, nullptr);
-  ASSERT_NE(out.color_scale_colors, nullptr);
-  // Read after the iconSet payload was filled: the colorScale array must
-  // not have moved out from under the pointer already in the record.
-  EXPECT_STREQ(out.color_scale_thresholds[0].value, "11");
-  EXPECT_STREQ(out.color_scale_thresholds[2].value, "33");
-  EXPECT_EQ(out.color_scale_colors[0].r, 255U);
-  ASSERT_EQ(out.icon_set_threshold_count, 2U);
-  ASSERT_NE(out.icon_set_thresholds, nullptr);
-  EXPECT_STREQ(out.icon_set_thresholds[1].value, "80");
-}
-
-TEST(FormulonCApiCfMutate, OutOfGridSqrefRejectedAndLeavesTheModelUnchanged) {
-  // An out-of-grid rectangle has no A1 spelling, so letting one into the
-  // model leaves the save path with a reference it cannot write.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_rule_t rule{};
-  rule.type = 0;  // Expression
-  rule.formula1 = "TRUE";
-  rule.sqref_count = 1;
-  std::size_t rule_index = 0;
-
-  // One past the last column, on a whole-column range.
-  fm_cf_cell_range_t past_last_col{0, formulon::Sheet::kMaxCols, formulon::Sheet::kMaxRows - 1U,
-                                   formulon::Sheet::kMaxCols};
-  rule.sqref = &past_last_col;
-  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  // One past the last row.
-  fm_cf_cell_range_t past_last_row{0, 0, formulon::Sheet::kMaxRows, 0};
-  rule.sqref = &past_last_row;
-  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  // Inverted rectangle.
-  fm_cf_cell_range_t inverted{5, 0, 1, 0};
-  rule.sqref = &inverted;
-  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  // A rejected range leaves no block behind, and the rejection is
-  // reported rather than aborting the process at save time.
-  EXPECT_TRUE(wb.handle->workbook().sheet(0).conditional_formats().empty());
-  BufferGuard rejected_save;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &rejected_save.data, &rejected_save.len), 0);
-
-  // The widest legal whole-column range still round-trips.
-  fm_cf_cell_range_t whole_col{0, 0, formulon::Sheet::kMaxRows - 1U, 0};
-  rule.sqref = &whole_col;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-  const auto& blocks = reloaded.handle->workbook().sheet(0).conditional_formats();
-  ASSERT_EQ(blocks.size(), 1U);
-  ASSERT_EQ(blocks[0].sqref.size(), 1U);
-  EXPECT_EQ(blocks[0].sqref[0], MakeRange(0, 0, formulon::Sheet::kMaxRows - 1U, 0));
-}
-
-TEST(FormulonCApiCfMutate, EmptySqrefRejected) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_rule_t rule{};
-  rule.type = 0;
-  rule.sqref = nullptr;
-  rule.sqref_count = 0;
-  std::size_t rule_index = 0;
-  fm_status_t rc = fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-}
-
-TEST(FormulonCApiCfMutate, AddRuleRejectsExcessiveSqrefCount) {
-  // Hostile caller passes the maximum unsigned 32-bit value as
-  // `sqref_count`. The `sqref` pointer is non-null so the early
-  // null-check does not short-circuit, but the binding's range-count
-  // cap must reject the call before the body attempts a 4 GiB
-  // `reserve()`. Sheet state must be unchanged on rejection.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::size_t before = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &before), 0);
-
-  fm_cf_cell_range_t sqref{0, 0, 0, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 0;  // Expression
-  std::string f = "TRUE";
-  rule.formula1 = f.c_str();
-  rule.sqref = &sqref;
-  rule.sqref_count = 0xFFFFFFFFu;
-  std::size_t rule_index = 0;
-  fm_status_t rc = fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  std::size_t after = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &after), 0);
-  EXPECT_EQ(before, after);
-}
-
-TEST(FormulonCApiCfMutate, GetAtDisengagesADxfIdTheStylesTableCannotResolve) {
-  // A package can carry a `dxfId` past the end of its own `<dxfs>`, and
-  // the loader keeps the rule. Surfacing that index would hand the caller
-  // a value `fm_styles_get_dxf` rejects and `fm_sheet_cf_add_rule`
-  // refuses, so the get / remove / add-back edit path would not close.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDxfs(wb.handle, 2);
-
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 1;  // CellIs
-  rule.op_engaged = 1;
-  rule.op = 5;  // GreaterThan
-  rule.formula1 = "50";
-  rule.dxf_id_engaged = 1;
-  rule.dxf_id = 1;
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-
-  // Shrink the table under the rule, the way a package whose styles part
-  // and worksheet part disagree arrives.
-  wb.handle->workbook().mutable_styles().dxfs.resize(1);
-
-  fm_cf_rule_t out{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0) << fm_last_error_message();
-  EXPECT_EQ(out.dxf_id_engaged, 0);
-
-  // The record still feeds straight back in, which is what the disengage
-  // buys: with the raw index it would be rejected.
-  std::size_t reinserted = 0;
-  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, out, &reinserted), 0) << fm_last_error_message();
-
-  // A resolvable index is still reported.
-  SeedDxfs(wb.handle, 2);
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
-  EXPECT_EQ(out.dxf_id_engaged, 1);
-  EXPECT_EQ(out.dxf_id, 1U);
-}
-
-TEST(FormulonCApiCfMutate, AddRuleRejectsNonGuidId) {
-  // The id becomes an `ST_Guid`-typed attribute in the saved package, so
-  // a host key like "sales-databar" would make Excel repair the workbook
-  // and drop every conditional format in it.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 0;  // Expression
-  rule.formula1 = "TRUE";
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-
-  std::size_t rule_index = 99U;
-  for (const char* rejected : {"sales-databar", "{}", "FC000000-0000-0000-0000-000000000001",
-                               "{FC000000-0000-0000-0000-00000000000}", "{GC000000-0000-0000-0000-000000000001}"}) {
-    rule.id = rejected;
-    EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
-              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument))
-        << rejected;
-  }
-
-  std::size_t count = 99U;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 0U);
-
-  // A GUID-shaped id is accepted and comes back verbatim.
-  rule.id = "{3B4F1C22-0000-4000-8000-0123456789AB}";
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-  fm_cf_rule_t out{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
-  EXPECT_STREQ(out.id, "{3B4F1C22-0000-4000-8000-0123456789AB}");
-
-  // An absent id is the "synthesize one for me" request, not a malformed
-  // one, and the id it produces is itself GUID-shaped.
-  rule.id = "";
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, rule_index, &out), 0);
-  ASSERT_NE(out.id, nullptr);
-  const std::string synthesized(out.id);
-  EXPECT_EQ(synthesized.size(), 38U);
-  EXPECT_EQ(synthesized.front(), '{');
-  EXPECT_EQ(synthesized.back(), '}');
-}
-
-TEST(FormulonCApiCfMutate, AddRuleRejectsEnumOrdinalsPastTheirDomain) {
-  // Each of these would otherwise be `static_cast` into its enum and
-  // collapse onto the consuming switch's default: an unknown `op` writes
-  // `operator="equal"`, an unknown `time_period` writes `today`. The
-  // caller sees `kOk` and a rule that means something else.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t base{};
-  base.formula1 = "TRUE";
-  base.sqref = &sqref;
-  base.sqref_count = 1;
-
-  const auto expect_rejected = [&wb](fm_cf_rule_t rule, const char* what) {
-    std::size_t rule_index = 99U;
-    EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
-              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument))
-        << what;
-  };
-
-  fm_cf_rule_t unknown_type = base;
-  unknown_type.type = static_cast<std::uint8_t>(formulon::cf::RuleType::UniqueValues) + 1U;
-  expect_rejected(unknown_type, "type");
-
-  fm_cf_rule_t unknown_op = base;
-  unknown_op.type = 1;  // CellIs
-  unknown_op.op_engaged = 1;
-  unknown_op.op = static_cast<std::uint8_t>(formulon::cf::CellIsOperator::NotBetween) + 1U;
-  expect_rejected(unknown_op, "op");
-
-  fm_cf_rule_t unknown_period = base;
-  unknown_period.type = 15;  // TimePeriod
-  unknown_period.time_period_engaged = 1;
-  unknown_period.time_period = static_cast<std::uint8_t>(formulon::cf::TimePeriod::NextMonth) + 1U;
-  expect_rejected(unknown_period, "time_period");
-
-  fm_cfvo_t icon_thresholds[3]{};
-  icon_thresholds[1].type = static_cast<std::uint8_t>(formulon::cf::CfvoType::AutoMax) + 1U;
-  fm_cf_rule_t unknown_cfvo = base;
-  unknown_cfvo.type = 4;  // IconSet
-  unknown_cfvo.icon_set_engaged = 1;
-  unknown_cfvo.icon_set_thresholds = icon_thresholds;
-  unknown_cfvo.icon_set_threshold_count = 3;
-  expect_rejected(unknown_cfvo, "icon_set_thresholds[].type");
-
-  fm_cfvo_t legal_thresholds[3]{};
-  fm_cf_rule_t unknown_icon_set = base;
-  unknown_icon_set.type = 4;  // IconSet
-  unknown_icon_set.icon_set_engaged = 1;
-  unknown_icon_set.icon_set_name = static_cast<std::uint8_t>(formulon::cf::IconSetName::Five_Quarters) + 1U;
-  unknown_icon_set.icon_set_thresholds = legal_thresholds;
-  unknown_icon_set.icon_set_threshold_count = 3;
-  expect_rejected(unknown_icon_set, "icon_set_name");
-
-  fm_cfvo_t color_thresholds[2]{};
-  fm_cf_color_t colors[2]{};
-  color_thresholds[0].type = static_cast<std::uint8_t>(formulon::cf::CfvoType::AutoMax) + 1U;
-  fm_cf_rule_t unknown_color_cfvo = base;
-  unknown_color_cfvo.type = 2;  // ColorScale
-  unknown_color_cfvo.color_scale_thresholds = color_thresholds;
-  unknown_color_cfvo.color_scale_colors = colors;
-  unknown_color_cfvo.color_scale_count = 2;
-  expect_rejected(unknown_color_cfvo, "color_scale_thresholds[].type");
-
-  fm_cf_rule_t unknown_floor = base;
-  unknown_floor.type = 4;  // IconSet
-  unknown_floor.icon_set_engaged = 1;
-  unknown_floor.icon_set_thresholds = legal_thresholds;
-  unknown_floor.icon_set_threshold_count = 2;
-  unknown_floor.icon_set_floor_engaged = 1;
-  unknown_floor.icon_set_floor.type = static_cast<std::uint8_t>(formulon::cf::CfvoType::AutoMax) + 1U;
-  expect_rejected(unknown_floor, "icon_set_floor.type");
-
-  fm_cf_rule_t unknown_direction = base;
-  unknown_direction.type = 3;  // DataBar
-  unknown_direction.data_bar_engaged = 1;
-  unknown_direction.data_bar_max.type = 4;  // Max
-  unknown_direction.data_bar_min.type = 3;  // Min
-  unknown_direction.data_bar_min_length_pct = 10;
-  unknown_direction.data_bar_max_length_pct = 90;
-  unknown_direction.data_bar_direction = static_cast<std::uint8_t>(formulon::cf::DataBarDirection::RightToLeft) + 1U;
-  expect_rejected(unknown_direction, "data_bar_direction");
-
-  // Every rejection left the sheet as it was.
-  std::size_t count = 99U;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 0U);
-}
-
-TEST(FormulonCApiCfMutate, OutOfRangeIndexReturnsInvalidArgument) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_rule_t out{};
-  fm_status_t rc = fm_sheet_cf_get_at(wb.handle, 0, 99, &out);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  rc = fm_sheet_cf_remove_at(wb.handle, 0, 99);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-}
-
-TEST(FormulonCApiCfMutate, PreLoadedRulesEnumerableViaFlatIndex) {
-  WorkbookGuard wb = WorkbookFromMutator([](formulon::Workbook& w) {
-    auto& sheet = w.sheet(0);
-    formulon::cf::ConditionalFormat block;
-    block.sqref = {MakeRange(0, 0, 9, 0)};
-    formulon::cf::CFRule r;
-    r.type = formulon::cf::RuleType::CellIs;
-    r.priority = 1;
-    r.op = formulon::cf::CellIsOperator::GreaterThan;
-    r.formula1 = "50";
-    r.dxf_id = 0;
-    block.rules.push_back(std::move(r));
-    sheet.mutable_conditional_formats().push_back(std::move(block));
-  });
-  std::size_t count = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 1U);
-  fm_cf_rule_t out{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
-  EXPECT_EQ(out.type, 1U);
-  ASSERT_NE(out.formula1, nullptr);
-  EXPECT_STREQ(out.formula1, "50");
-}
-
-TEST(FormulonCApiCfMutate, DuplicatePredicateRulesGetDistinctStableIndices) {
-  // Two rules with the identical predicate (same type/op/formula/sqref)
-  // must still be tracked as distinct entries: `fm_sheet_cf_add_rule`
-  // always appends a new block rather than deduping against an existing
-  // one, so the returned index must reflect append order, not predicate
-  // identity.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDxfs(wb.handle, 1);
-
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 1;  // CellIs
-  rule.op_engaged = 1;
-  rule.op = 5;  // GreaterThan
-  rule.formula1 = "50";
-  rule.dxf_id_engaged = 1;
-  rule.dxf_id = 0;
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-
-  std::size_t first_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &first_index), 0) << fm_last_error_message();
-
-  // Re-populate the rule: `fm_sheet_cf_add_rule` deep-copies string /
-  // range payloads, but reuse a fresh `fm_cf_rule_t` to avoid relying on
-  // stale scratch state from the first call.
-  fm_cf_rule_t rule2{};
-  rule2.type = 1;  // CellIs
-  rule2.op_engaged = 1;
-  rule2.op = 5;  // GreaterThan
-  rule2.formula1 = "50";
-  rule2.dxf_id_engaged = 1;
-  rule2.dxf_id = 0;
-  rule2.sqref = &sqref;
-  rule2.sqref_count = 1;
-
-  std::size_t second_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule2, &second_index), 0) << fm_last_error_message();
-
-  EXPECT_EQ(first_index, 0U);
-  EXPECT_EQ(second_index, 1U);
-  EXPECT_NE(first_index, second_index);
-
-  std::size_t count = 0;
-  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 2U);
-
-  // The indices returned by add_rule must match what a subsequent
-  // flattened readback reports for rule order/position.
-  fm_cf_rule_t readback_first{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, first_index, &readback_first), 0);
-  EXPECT_EQ(readback_first.priority, 1);  // auto-assigned to the first rule added
-
-  fm_cf_rule_t readback_second{};
-  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, second_index, &readback_second), 0);
-  EXPECT_EQ(readback_second.priority, 2);  // auto-assigned one past the first
-}
-
-namespace {
-
-constexpr const char* kX14IdA = "{11111111-1111-1111-1111-111111111111}";
-constexpr const char* kX14IdB = "{22222222-2222-2222-2222-222222222222}";
-
-// Builds an Excel-shaped worksheet-level x14 overlay carrying one
-// dataBar `<x14:cfRule>` per id.
-std::string X14OverlayFor(std::initializer_list<const char*> ids) {
-  std::string rules;
-  for (const char* id : ids) {
-    rules.append("<x14:cfRule type=\"dataBar\" id=\"");
-    rules.append(id);
-    rules.append(
-        "\"><x14:dataBar minLength=\"0\" maxLength=\"100\"><x14:cfvo type=\"autoMin\"/>"
-        "<x14:cfvo type=\"autoMax\"/><x14:negativeFillColor rgb=\"FFFF0000\"/></x14:dataBar></x14:cfRule>");
-  }
-  return "<extLst><ext uri=\"{78C0D931-6437-407d-A8EE-F0AAD7539E65}\" "
-         "xmlns:x14=\"http://schemas.microsoft.com/office/spreadsheetml/2009/9/main\">"
-         "<x14:conditionalFormattings>"
-         "<x14:conditionalFormatting xmlns:xm=\"http://schemas.microsoft.com/office/excel/2006/main\">" +
-         rules + "<xm:sqref>A1:A10</xm:sqref></x14:conditionalFormatting></x14:conditionalFormattings></ext></extLst>";
-}
-
-// Builds the nested `<extLst>` link a legacy `<cfRule>` carries to reach
-// its x14 counterpart. This, not an `id` attribute on the `<cfRule>`, is
-// how Excel spells the cross-reference, so a rule loaded from an
-// x14-bearing file always has one.
-std::string X14RuleLinkFor(const char* id) {
-  return std::string(
-             "<extLst><ext uri=\"{B025F937-C7B1-47D3-B67F-A62EFF666E3E}\" "
-             "xmlns:x14=\"http://schemas.microsoft.com/office/spreadsheetml/2009/9/main\"><x14:id>") +
-         id + "</x14:id></ext></extLst>";
-}
-
-// Seeds sheet 0 with one CF block holding two id-bearing dataBar rules
-// plus the matching two-entry x14 overlay, mirroring the state produced
-// by loading an Excel 2010+ file with extended data bars.
-void SeedDataBarRulesWithOverlay(fm_workbook_t* handle) {
-  auto& sheet = handle->workbook().sheet(0);
-  formulon::cf::ConditionalFormat block{};
-  block.sqref.push_back(MakeRange(0, 0, 9, 0));
-  for (const char* id : {kX14IdA, kX14IdB}) {
-    formulon::cf::CFRule rule;
-    rule.type = formulon::cf::RuleType::DataBar;
-    rule.id = id;
-    rule.ext_lst_raw = X14RuleLinkFor(id);
-    rule.data_bar = formulon::cf::DataBarSpec{};
-    block.rules.push_back(std::move(rule));
-  }
-  sheet.mutable_conditional_formats().push_back(std::move(block));
-  sheet.set_ext_lst_xml(X14OverlayFor({kX14IdA, kX14IdB}));
-}
-
-bool ContainsSubstring(const std::string& haystack, const std::string& needle) {
-  return haystack.find(needle) != std::string::npos;
-}
-
-}  // namespace
-
-TEST(FormulonCApiCfMutate, RemoveAtPrunesRemovedRuleFromX14Overlay) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDataBarRulesWithOverlay(wb.handle);
-
-  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
-
-  const std::string& overlay = wb.handle->workbook().sheet(0).ext_lst_xml();
-  EXPECT_FALSE(ContainsSubstring(overlay, kX14IdA));
-  EXPECT_TRUE(ContainsSubstring(overlay, kX14IdB));
-}
-
-TEST(FormulonCApiCfMutate, ClearEmptiesX14Overlay) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDataBarRulesWithOverlay(wb.handle);
-
-  ASSERT_EQ(fm_sheet_cf_clear(wb.handle, 0), 0);
-  EXPECT_TRUE(wb.handle->workbook().sheet(0).ext_lst_xml().empty());
-}
-
-TEST(FormulonCApiCfMutate, MalformedOverlayDroppedWhollyOnRemove) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDataBarRulesWithOverlay(wb.handle);
-  wb.handle->workbook().sheet(0).set_ext_lst_xml("<extLst><ext><x14:conditionalFormattings>");
-
-  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
-  EXPECT_TRUE(wb.handle->workbook().sheet(0).ext_lst_xml().empty());
-}
-
-TEST(FormulonCApiCfMutate, RemovedRuleDoesNotResurfaceThroughSaveLoad) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  SeedDataBarRulesWithOverlay(wb.handle);
-
-  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-  const auto& sheet = reloaded.handle->workbook().sheet(0);
-  ASSERT_EQ(sheet.conditional_formats().size(), 1U);
-  ASSERT_EQ(sheet.conditional_formats()[0].rules.size(), 1U);
-  EXPECT_EQ(sheet.conditional_formats()[0].rules[0].id, kX14IdB);
-  EXPECT_FALSE(ContainsSubstring(sheet.ext_lst_xml(), kX14IdA));
-  EXPECT_TRUE(ContainsSubstring(sheet.ext_lst_xml(), kX14IdB));
-}
-
-TEST(FormulonCApiCfMutate, DataBarExtensionFieldsSurviveSaveAndLoad) {
-  // Reaching the model is not enough: axis, gradient and the negative
-  // colours have no legacy `<dataBar>` attribute, so a save that does not
-  // build the x14 extension loses every one of them and the caller gets a
-  // plain bar back. This is the only test on this path that crosses the
-  // ABI boundary in both directions.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule = MakeDataBarRule(&sqref);
-  rule.data_bar_gradient_engaged = 1;
-  rule.data_bar_gradient = 0;
-  rule.data_bar_axis_position_engaged = 1;
-  rule.data_bar_axis_position = 1;  // middle
-  rule.data_bar_negative_fill_engaged = 1;
-  rule.data_bar_negative_fill = fm_cf_color_t{255, 0, 0, 255};
-  rule.data_bar_border_engaged = 1;
-  rule.data_bar_border = fm_cf_color_t{1, 2, 3, 255};
-  rule.data_bar_negative_border_engaged = 1;
-  rule.data_bar_negative_border = fm_cf_color_t{4, 5, 6, 255};
-  rule.data_bar_axis_color_engaged = 1;
-  rule.data_bar_axis_color = fm_cf_color_t{7, 8, 9, 255};
-  rule.data_bar_direction = 2;  // right to left
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-
-  fm_cf_rule_t back{};
-  ASSERT_EQ(fm_sheet_cf_get_at(reloaded.handle, 0, 0, &back), 0) << fm_last_error_message();
-  EXPECT_EQ(back.data_bar_gradient, 0);
-  EXPECT_EQ(back.data_bar_axis_position, 1U);
-  EXPECT_EQ(back.data_bar_negative_fill.r, 255U);
-  EXPECT_EQ(back.data_bar_negative_fill.g, 0U);
-  EXPECT_EQ(back.data_bar_border_engaged, 1);
-  EXPECT_EQ(back.data_bar_border.b, 3U);
-  EXPECT_EQ(back.data_bar_negative_border_engaged, 1);
-  EXPECT_EQ(back.data_bar_negative_border.b, 6U);
-  EXPECT_EQ(back.data_bar_axis_color.r, 7U);
-  EXPECT_EQ(back.data_bar_axis_color.b, 9U);
-  EXPECT_EQ(back.data_bar_direction, 2U);
-}
-
-TEST(FormulonCApiCfMutate, IconSetFloorSurvivesSaveAndLoad) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 4;  // IconSet
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-  rule.icon_set_engaged = 1;
-  rule.icon_set_name = 2;  // Three_Flags
-  fm_cfvo_t thresholds[2]{};
-  thresholds[0].type = 0;  // Number
-  thresholds[0].value = "7";
-  thresholds[0].gte = 1;
-  thresholds[1].type = 0;
-  thresholds[1].value = "9";
-  thresholds[1].gte = 1;
-  rule.icon_set_thresholds = thresholds;
-  rule.icon_set_threshold_count = 2;
-  rule.icon_set_show_value = 1;
-  rule.icon_set_percent = 1;
-  rule.icon_set_floor_engaged = 1;
-  rule.icon_set_floor.type = 0;  // Number
-  rule.icon_set_floor.value = "5";
-  rule.icon_set_floor.gte = 0;
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-  fm_cf_rule_t back{};
-  ASSERT_EQ(fm_sheet_cf_get_at(reloaded.handle, 0, 0, &back), 0) << fm_last_error_message();
-  EXPECT_EQ(back.icon_set_floor_engaged, 1);
-  EXPECT_EQ(back.icon_set_floor.type, 0U);
-  EXPECT_STREQ(back.icon_set_floor.value, "5");
-  EXPECT_EQ(back.icon_set_floor.gte, 0);
-}
-
-TEST(FormulonCApiCfMutate, UnengagedIconSetFloorIsExcelsDefault) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cf_cell_range_t sqref{0, 0, 9, 0};
-  fm_cf_rule_t rule{};
-  rule.type = 4;  // IconSet
-  rule.sqref = &sqref;
-  rule.sqref_count = 1;
-  rule.icon_set_engaged = 1;
-  fm_cfvo_t thresholds[2]{};
-  rule.icon_set_thresholds = thresholds;
-  rule.icon_set_threshold_count = 2;
-  std::size_t rule_index = 0;
-  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
-  const auto& floor = wb.handle->workbook().sheet(0).conditional_formats()[0].rules[0].icon_set->floor;
-  EXPECT_EQ(floor.type, formulon::cf::CfvoType::Percent);
-  EXPECT_EQ(floor.value, "0");
-  EXPECT_TRUE(floor.gte);
-}
diff --git a/tests/c_api/formulon_c_cf_test_helpers.h b/tests/c_api/formulon_c_cf_test_helpers.h
new file mode 100644
index 000000000..c10e181d0
--- /dev/null
+++ b/tests/c_api/formulon_c_cf_test_helpers.h
@@ -0,0 +1,114 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "c_api/borrowed_arena.h"
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "cf/cf_types.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace {
+
+// RAII guard so the workbook handle is released even on test failure.
+// Move-only so factory functions can return one by value.
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+  WorkbookGuard(WorkbookGuard&& other) noexcept : handle(other.handle) { other.handle = nullptr; }
+  WorkbookGuard& operator=(WorkbookGuard&& other) noexcept {
+    if (this != &other) {
+      fm_workbook_destroy(handle);
+      handle = other.handle;
+      other.handle = nullptr;
+    }
+    return *this;
+  }
+};
+
+// RAII guard for `fm_cf_results_t` handles.
+struct CfResultsGuard {
+  fm_cf_results_t* handle = nullptr;
+  ~CfResultsGuard() { fm_cf_results_destroy(handle); }
+  CfResultsGuard() = default;
+  CfResultsGuard(const CfResultsGuard&) = delete;
+  CfResultsGuard& operator=(const CfResultsGuard&) = delete;
+};
+
+struct BufferGuard {
+  uint8_t* data = nullptr;
+  size_t len = 0;
+  ~BufferGuard() { fm_buffer_free(data); }
+  BufferGuard() = default;
+  BufferGuard(const BufferGuard&) = delete;
+  BufferGuard& operator=(const BufferGuard&) = delete;
+};
+
+// Builds a `Workbook`, applies `mutate` to seed cells / CF blocks, then
+// serialises it through OOXML and loads the resulting bytes through the
+// C ABI. The returned guard owns a populated `fm_workbook_t*` ready for
+// CF evaluation.
+template <typename MutateFn>
+[[maybe_unused]] inline WorkbookGuard WorkbookFromMutator(MutateFn&& mutate) {
+  formulon::Workbook wb = formulon::Workbook::create();
+  // Registers the `<dxf>` records the CF rules below reference. The
+  // writer omits any `dxfId` its styles part cannot resolve, so a rule
+  // whose differential format was never registered would come back from
+  // the load with no `dxf_id` at all.
+  wb.mutable_styles().dxfs.resize(8);
+  mutate(wb);
+  auto bytes = wb.save();
+  EXPECT_TRUE(static_cast<bool>(bytes)) << "Workbook::save: " << (bytes ? "" : bytes.error().message);
+  WorkbookGuard guard;
+  if (!bytes) {
+    return guard;
+  }
+  const auto& src = bytes.value();
+  EXPECT_EQ(fm_workbook_load(src.data(), src.size(), &guard.handle), 0)
+      << "fm_workbook_load: " << fm_last_error_message();
+  return guard;
+}
+
+// Registers `count` `<dxf>` slots on an existing handle. `fm_sheet_cf_add_rule`
+// refuses a `dxf_id` past the end of the table, so a mutation test that
+// engages a differential format has to seed the table first.
+[[maybe_unused]] inline void SeedDxfs(fm_workbook_t* handle, std::size_t count) {
+  handle->workbook().mutable_styles().dxfs.resize(count);
+}
+
+[[maybe_unused]] inline formulon::cf::CFCellRange MakeRange(std::uint32_t r1, std::uint32_t c1, std::uint32_t r2,
+                                                            std::uint32_t c2) {
+  return {{r1, c1}, {r2, c2}};
+}
+
+// Minimal valid DataBar rule. Extension fields stay zero-initialized so
+// each test below engages only what it is about to assert.
+[[maybe_unused]] inline fm_cf_rule_t MakeDataBarRule(const fm_cf_cell_range_t* sqref) {
+  fm_cf_rule_t rule{};
+  rule.type = 3;  // DataBar
+  rule.sqref = sqref;
+  rule.sqref_count = 1;
+  rule.data_bar_engaged = 1;
+  rule.data_bar_min.type = 3;  // Min
+  rule.data_bar_min.gte = 1;
+  rule.data_bar_max.type = 4;  // Max
+  rule.data_bar_max.gte = 1;
+  rule.data_bar_fill = fm_cf_color_t{99, 142, 198, 255};
+  rule.data_bar_show_value = 1;
+  rule.data_bar_min_length_pct = 10;
+  rule.data_bar_max_length_pct = 90;
+  return rule;
+}
+
+}  // namespace
diff --git a/tests/c_api/formulon_c_cf_validation_test.cpp b/tests/c_api/formulon_c_cf_validation_test.cpp
new file mode 100644
index 000000000..04989892d
--- /dev/null
+++ b/tests/c_api/formulon_c_cf_validation_test.cpp
@@ -0,0 +1,367 @@
+// Stable C ABI conditional-format validation tests.
+
+#include <utility>
+
+#include "formulon_c_cf_test_helpers.h"
+
+TEST(FormulonCApiCfMutate, OutOfGridSqrefRejectedAndLeavesTheModelUnchanged) {
+  // An out-of-grid rectangle has no A1 spelling, so letting one into the
+  // model leaves the save path with a reference it cannot write.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_rule_t rule{};
+  rule.type = 0;  // Expression
+  rule.formula1 = "TRUE";
+  rule.sqref_count = 1;
+  std::size_t rule_index = 0;
+
+  // One past the last column, on a whole-column range.
+  fm_cf_cell_range_t past_last_col{0, formulon::Sheet::kMaxCols, formulon::Sheet::kMaxRows - 1U,
+                                   formulon::Sheet::kMaxCols};
+  rule.sqref = &past_last_col;
+  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  // One past the last row.
+  fm_cf_cell_range_t past_last_row{0, 0, formulon::Sheet::kMaxRows, 0};
+  rule.sqref = &past_last_row;
+  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  // Inverted rectangle.
+  fm_cf_cell_range_t inverted{5, 0, 1, 0};
+  rule.sqref = &inverted;
+  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  // A rejected range leaves no block behind, and the rejection is
+  // reported rather than aborting the process at save time.
+  EXPECT_TRUE(wb.handle->workbook().sheet(0).conditional_formats().empty());
+  BufferGuard rejected_save;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &rejected_save.data, &rejected_save.len), 0);
+
+  // The widest legal whole-column range still round-trips.
+  fm_cf_cell_range_t whole_col{0, 0, formulon::Sheet::kMaxRows - 1U, 0};
+  rule.sqref = &whole_col;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+  const auto& blocks = reloaded.handle->workbook().sheet(0).conditional_formats();
+  ASSERT_EQ(blocks.size(), 1U);
+  ASSERT_EQ(blocks[0].sqref.size(), 1U);
+  EXPECT_EQ(blocks[0].sqref[0], MakeRange(0, 0, formulon::Sheet::kMaxRows - 1U, 0));
+}
+
+TEST(FormulonCApiCfMutate, EmptySqrefRejected) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_rule_t rule{};
+  rule.type = 0;
+  rule.sqref = nullptr;
+  rule.sqref_count = 0;
+  std::size_t rule_index = 0;
+  fm_status_t rc = fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+}
+
+TEST(FormulonCApiCfMutate, AddRuleRejectsExcessiveSqrefCount) {
+  // Hostile caller passes the maximum unsigned 32-bit value as
+  // `sqref_count`. The `sqref` pointer is non-null so the early
+  // null-check does not short-circuit, but the binding's range-count
+  // cap must reject the call before the body attempts a 4 GiB
+  // `reserve()`. Sheet state must be unchanged on rejection.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::size_t before = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &before), 0);
+
+  fm_cf_cell_range_t sqref{0, 0, 0, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 0;  // Expression
+  std::string f = "TRUE";
+  rule.formula1 = f.c_str();
+  rule.sqref = &sqref;
+  rule.sqref_count = 0xFFFFFFFFu;
+  std::size_t rule_index = 0;
+  fm_status_t rc = fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  std::size_t after = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &after), 0);
+  EXPECT_EQ(before, after);
+}
+
+TEST(FormulonCApiCfMutate, GetAtDisengagesADxfIdTheStylesTableCannotResolve) {
+  // A package can carry a `dxfId` past the end of its own `<dxfs>`, and
+  // the loader keeps the rule. Surfacing that index would hand the caller
+  // a value `fm_styles_get_dxf` rejects and `fm_sheet_cf_add_rule`
+  // refuses, so the get / remove / add-back edit path would not close.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDxfs(wb.handle, 2);
+
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 1;  // CellIs
+  rule.op_engaged = 1;
+  rule.op = 5;  // GreaterThan
+  rule.formula1 = "50";
+  rule.dxf_id_engaged = 1;
+  rule.dxf_id = 1;
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+
+  // Shrink the table under the rule, the way a package whose styles part
+  // and worksheet part disagree arrives.
+  wb.handle->workbook().mutable_styles().dxfs.resize(1);
+
+  fm_cf_rule_t out{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0) << fm_last_error_message();
+  EXPECT_EQ(out.dxf_id_engaged, 0);
+
+  // The record still feeds straight back in, which is what the disengage
+  // buys: with the raw index it would be rejected.
+  std::size_t reinserted = 0;
+  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, out, &reinserted), 0) << fm_last_error_message();
+
+  // A resolvable index is still reported.
+  SeedDxfs(wb.handle, 2);
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
+  EXPECT_EQ(out.dxf_id_engaged, 1);
+  EXPECT_EQ(out.dxf_id, 1U);
+}
+
+TEST(FormulonCApiCfMutate, AddRuleRejectsNonGuidId) {
+  // The id becomes an `ST_Guid`-typed attribute in the saved package, so
+  // a host key like "sales-databar" would make Excel repair the workbook
+  // and drop every conditional format in it.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 0;  // Expression
+  rule.formula1 = "TRUE";
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+
+  std::size_t rule_index = 99U;
+  for (const char* rejected : {"sales-databar", "{}", "FC000000-0000-0000-0000-000000000001",
+                               "{FC000000-0000-0000-0000-00000000000}", "{GC000000-0000-0000-0000-000000000001}"}) {
+    rule.id = rejected;
+    EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
+              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument))
+        << rejected;
+  }
+
+  std::size_t count = 99U;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 0U);
+
+  // A GUID-shaped id is accepted and comes back verbatim.
+  rule.id = "{3B4F1C22-0000-4000-8000-0123456789AB}";
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+  fm_cf_rule_t out{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
+  EXPECT_STREQ(out.id, "{3B4F1C22-0000-4000-8000-0123456789AB}");
+
+  // An absent id is the "synthesize one for me" request, not a malformed
+  // one, and the id it produces is itself GUID-shaped.
+  rule.id = "";
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, rule_index, &out), 0);
+  ASSERT_NE(out.id, nullptr);
+  const std::string synthesized(out.id);
+  EXPECT_EQ(synthesized.size(), 38U);
+  EXPECT_EQ(synthesized.front(), '{');
+  EXPECT_EQ(synthesized.back(), '}');
+}
+
+TEST(FormulonCApiCfMutate, AddRuleRejectsEnumOrdinalsPastTheirDomain) {
+  // Each of these would otherwise be `static_cast` into its enum and
+  // collapse onto the consuming switch's default: an unknown `op` writes
+  // `operator="equal"`, an unknown `time_period` writes `today`. The
+  // caller sees `kOk` and a rule that means something else.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t base{};
+  base.formula1 = "TRUE";
+  base.sqref = &sqref;
+  base.sqref_count = 1;
+
+  const auto expect_rejected = [&wb](fm_cf_rule_t rule, const char* what) {
+    std::size_t rule_index = 99U;
+    EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index),
+              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument))
+        << what;
+  };
+
+  fm_cf_rule_t unknown_type = base;
+  unknown_type.type = static_cast<std::uint8_t>(formulon::cf::RuleType::UniqueValues) + 1U;
+  expect_rejected(unknown_type, "type");
+
+  fm_cf_rule_t unknown_op = base;
+  unknown_op.type = 1;  // CellIs
+  unknown_op.op_engaged = 1;
+  unknown_op.op = static_cast<std::uint8_t>(formulon::cf::CellIsOperator::NotBetween) + 1U;
+  expect_rejected(unknown_op, "op");
+
+  fm_cf_rule_t unknown_period = base;
+  unknown_period.type = 15;  // TimePeriod
+  unknown_period.time_period_engaged = 1;
+  unknown_period.time_period = static_cast<std::uint8_t>(formulon::cf::TimePeriod::NextMonth) + 1U;
+  expect_rejected(unknown_period, "time_period");
+
+  fm_cfvo_t icon_thresholds[3]{};
+  icon_thresholds[1].type = static_cast<std::uint8_t>(formulon::cf::CfvoType::AutoMax) + 1U;
+  fm_cf_rule_t unknown_cfvo = base;
+  unknown_cfvo.type = 4;  // IconSet
+  unknown_cfvo.icon_set_engaged = 1;
+  unknown_cfvo.icon_set_thresholds = icon_thresholds;
+  unknown_cfvo.icon_set_threshold_count = 3;
+  expect_rejected(unknown_cfvo, "icon_set_thresholds[].type");
+
+  fm_cfvo_t legal_thresholds[3]{};
+  fm_cf_rule_t unknown_icon_set = base;
+  unknown_icon_set.type = 4;  // IconSet
+  unknown_icon_set.icon_set_engaged = 1;
+  unknown_icon_set.icon_set_name = static_cast<std::uint8_t>(formulon::cf::IconSetName::Five_Quarters) + 1U;
+  unknown_icon_set.icon_set_thresholds = legal_thresholds;
+  unknown_icon_set.icon_set_threshold_count = 3;
+  expect_rejected(unknown_icon_set, "icon_set_name");
+
+  fm_cfvo_t color_thresholds[2]{};
+  fm_cf_color_t colors[2]{};
+  color_thresholds[0].type = static_cast<std::uint8_t>(formulon::cf::CfvoType::AutoMax) + 1U;
+  fm_cf_rule_t unknown_color_cfvo = base;
+  unknown_color_cfvo.type = 2;  // ColorScale
+  unknown_color_cfvo.color_scale_thresholds = color_thresholds;
+  unknown_color_cfvo.color_scale_colors = colors;
+  unknown_color_cfvo.color_scale_count = 2;
+  expect_rejected(unknown_color_cfvo, "color_scale_thresholds[].type");
+
+  fm_cf_rule_t unknown_floor = base;
+  unknown_floor.type = 4;  // IconSet
+  unknown_floor.icon_set_engaged = 1;
+  unknown_floor.icon_set_thresholds = legal_thresholds;
+  unknown_floor.icon_set_threshold_count = 2;
+  unknown_floor.icon_set_floor_engaged = 1;
+  unknown_floor.icon_set_floor.type = static_cast<std::uint8_t>(formulon::cf::CfvoType::AutoMax) + 1U;
+  expect_rejected(unknown_floor, "icon_set_floor.type");
+
+  fm_cf_rule_t unknown_direction = base;
+  unknown_direction.type = 3;  // DataBar
+  unknown_direction.data_bar_engaged = 1;
+  unknown_direction.data_bar_max.type = 4;  // Max
+  unknown_direction.data_bar_min.type = 3;  // Min
+  unknown_direction.data_bar_min_length_pct = 10;
+  unknown_direction.data_bar_max_length_pct = 90;
+  unknown_direction.data_bar_direction = static_cast<std::uint8_t>(formulon::cf::DataBarDirection::RightToLeft) + 1U;
+  expect_rejected(unknown_direction, "data_bar_direction");
+
+  // Every rejection left the sheet as it was.
+  std::size_t count = 99U;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 0U);
+}
+
+TEST(FormulonCApiCfMutate, OutOfRangeIndexReturnsInvalidArgument) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_rule_t out{};
+  fm_status_t rc = fm_sheet_cf_get_at(wb.handle, 0, 99, &out);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  rc = fm_sheet_cf_remove_at(wb.handle, 0, 99);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+}
+
+TEST(FormulonCApiCfMutate, PreLoadedRulesEnumerableViaFlatIndex) {
+  WorkbookGuard wb = WorkbookFromMutator([](formulon::Workbook& w) {
+    auto& sheet = w.sheet(0);
+    formulon::cf::ConditionalFormat block;
+    block.sqref = {MakeRange(0, 0, 9, 0)};
+    formulon::cf::CFRule r;
+    r.type = formulon::cf::RuleType::CellIs;
+    r.priority = 1;
+    r.op = formulon::cf::CellIsOperator::GreaterThan;
+    r.formula1 = "50";
+    r.dxf_id = 0;
+    block.rules.push_back(std::move(r));
+    sheet.mutable_conditional_formats().push_back(std::move(block));
+  });
+  std::size_t count = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 1U);
+  fm_cf_rule_t out{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
+  EXPECT_EQ(out.type, 1U);
+  ASSERT_NE(out.formula1, nullptr);
+  EXPECT_STREQ(out.formula1, "50");
+}
+
+TEST(FormulonCApiCfMutate, DuplicatePredicateRulesGetDistinctStableIndices) {
+  // Two rules with the identical predicate (same type/op/formula/sqref)
+  // must still be tracked as distinct entries: `fm_sheet_cf_add_rule`
+  // always appends a new block rather than deduping against an existing
+  // one, so the returned index must reflect append order, not predicate
+  // identity.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  SeedDxfs(wb.handle, 1);
+
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 1;  // CellIs
+  rule.op_engaged = 1;
+  rule.op = 5;  // GreaterThan
+  rule.formula1 = "50";
+  rule.dxf_id_engaged = 1;
+  rule.dxf_id = 0;
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+
+  std::size_t first_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &first_index), 0) << fm_last_error_message();
+
+  // Re-populate the rule: `fm_sheet_cf_add_rule` deep-copies string /
+  // range payloads, but reuse a fresh `fm_cf_rule_t` to avoid relying on
+  // stale scratch state from the first call.
+  fm_cf_rule_t rule2{};
+  rule2.type = 1;  // CellIs
+  rule2.op_engaged = 1;
+  rule2.op = 5;  // GreaterThan
+  rule2.formula1 = "50";
+  rule2.dxf_id_engaged = 1;
+  rule2.dxf_id = 0;
+  rule2.sqref = &sqref;
+  rule2.sqref_count = 1;
+
+  std::size_t second_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule2, &second_index), 0) << fm_last_error_message();
+
+  EXPECT_EQ(first_index, 0U);
+  EXPECT_EQ(second_index, 1U);
+  EXPECT_NE(first_index, second_index);
+
+  std::size_t count = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 2U);
+
+  // The indices returned by add_rule must match what a subsequent
+  // flattened readback reports for rule order/position.
+  fm_cf_rule_t readback_first{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, first_index, &readback_first), 0);
+  EXPECT_EQ(readback_first.priority, 1);  // auto-assigned to the first rule added
+
+  fm_cf_rule_t readback_second{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, second_index, &readback_second), 0);
+  EXPECT_EQ(readback_second.priority, 2);  // auto-assigned one past the first
+}
diff --git a/tests/c_api/formulon_c_cf_visual_payload_test.cpp b/tests/c_api/formulon_c_cf_visual_payload_test.cpp
new file mode 100644
index 000000000..0ba3f1fcd
--- /dev/null
+++ b/tests/c_api/formulon_c_cf_visual_payload_test.cpp
@@ -0,0 +1,348 @@
+// Stable C ABI conditional-format visual payload tests.
+
+#include <utility>
+
+#include "formulon_c_cf_test_helpers.h"
+
+namespace {
+
+const formulon::cf::DataBarSpec& OnlyDataBarSpec(fm_workbook_t* handle) {
+  const auto& blocks = handle->workbook().sheet(0).conditional_formats();
+  EXPECT_EQ(blocks.size(), 1U);
+  EXPECT_EQ(blocks[0].rules.size(), 1U);
+  EXPECT_TRUE(blocks[0].rules[0].data_bar.has_value());
+  return *blocks[0].rules[0].data_bar;
+}
+
+}  // namespace
+
+TEST(FormulonCApiCfMutate, ZeroInitializedDataBarExtensionKeepsTheModelDefaults) {
+  // The extension fields were appended to a struct callers already
+  // zero-initialize. Leaving every `*_engaged` flag at zero must produce
+  // exactly the spec the ABI produced before those fields existed.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  const fm_cf_rule_t rule = MakeDataBarRule(&sqref);
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+
+  const formulon::cf::DataBarSpec& spec = OnlyDataBarSpec(wb.handle);
+  EXPECT_TRUE(spec.gradient);
+  EXPECT_EQ(spec.axis_position, formulon::cf::DataBarAxisPosition::Automatic);
+  // Unengaged negative fill still mirrors the positive fill.
+  EXPECT_EQ(spec.negative_fill.r, spec.fill.r);
+  EXPECT_EQ(spec.negative_fill.g, spec.fill.g);
+  EXPECT_EQ(spec.negative_fill.b, spec.fill.b);
+  EXPECT_EQ(spec.negative_fill.a, spec.fill.a);
+  EXPECT_FALSE(spec.border.has_value());
+  EXPECT_FALSE(spec.negative_border.has_value());
+  EXPECT_EQ(spec.axis_color.r, 0U);
+  EXPECT_EQ(spec.axis_color.g, 0U);
+  EXPECT_EQ(spec.axis_color.b, 0U);
+  EXPECT_EQ(spec.axis_color.a, 255U);
+}
+
+TEST(FormulonCApiCfMutate, DataBarExtensionFieldsReachTheModelWhenEngaged) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule = MakeDataBarRule(&sqref);
+  rule.data_bar_gradient_engaged = 1;
+  rule.data_bar_gradient = 0;  // solid, not gradient
+  rule.data_bar_axis_position_engaged = 1;
+  rule.data_bar_axis_position = 1;  // middle
+  rule.data_bar_negative_fill_engaged = 1;
+  rule.data_bar_negative_fill = fm_cf_color_t{255, 0, 0, 255};
+  rule.data_bar_border_engaged = 1;
+  rule.data_bar_border = fm_cf_color_t{1, 2, 3, 255};
+  rule.data_bar_negative_border_engaged = 1;
+  rule.data_bar_negative_border = fm_cf_color_t{4, 5, 6, 255};
+  rule.data_bar_axis_color_engaged = 1;
+  rule.data_bar_axis_color = fm_cf_color_t{7, 8, 9, 255};
+
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+
+  const formulon::cf::DataBarSpec& spec = OnlyDataBarSpec(wb.handle);
+  EXPECT_FALSE(spec.gradient);
+  EXPECT_EQ(spec.axis_position, formulon::cf::DataBarAxisPosition::Middle);
+  EXPECT_EQ(spec.negative_fill.r, 255U);
+  EXPECT_EQ(spec.negative_fill.g, 0U);
+  ASSERT_TRUE(spec.border.has_value());
+  EXPECT_EQ(spec.border->r, 1U);
+  EXPECT_EQ(spec.border->b, 3U);
+  ASSERT_TRUE(spec.negative_border.has_value());
+  EXPECT_EQ(spec.negative_border->r, 4U);
+  EXPECT_EQ(spec.negative_border->b, 6U);
+  EXPECT_EQ(spec.axis_color.r, 7U);
+  EXPECT_EQ(spec.axis_color.b, 9U);
+}
+
+TEST(FormulonCApiCfMutate, DataBarRuleSurvivesGetAtFedBackIntoAddRule) {
+  // The only way to edit a CF rule through this ABI is get -> remove ->
+  // add, so that path has to be an identity on the rule model, and the
+  // record has to stay readable across the removal without the caller
+  // copying anything out of it. Before the extension fields existed the
+  // sequence silently reset axis, gradient and the negative colours to
+  // their defaults.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t seed = MakeDataBarRule(&sqref);
+  seed.data_bar_gradient_engaged = 1;
+  seed.data_bar_gradient = 0;
+  seed.data_bar_axis_position_engaged = 1;
+  seed.data_bar_axis_position = 1;  // middle
+  seed.data_bar_negative_fill_engaged = 1;
+  seed.data_bar_negative_fill = fm_cf_color_t{200, 30, 40, 255};
+  seed.data_bar_border_engaged = 1;
+  seed.data_bar_border = fm_cf_color_t{11, 22, 33, 255};
+  seed.data_bar_axis_color_engaged = 1;
+  seed.data_bar_axis_color = fm_cf_color_t{44, 55, 66, 255};
+  std::size_t seed_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, seed, &seed_index), 0) << fm_last_error_message();
+
+  // Read it back, change one unrelated field, and write it out again.
+  fm_cf_rule_t round_trip{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &round_trip), 0);
+  EXPECT_EQ(round_trip.data_bar_gradient_engaged, 1);
+  EXPECT_EQ(round_trip.data_bar_gradient, 0);
+  EXPECT_EQ(round_trip.data_bar_axis_position_engaged, 1);
+  EXPECT_EQ(round_trip.data_bar_axis_position, 1U);
+  EXPECT_EQ(round_trip.data_bar_negative_fill_engaged, 1);
+  EXPECT_EQ(round_trip.data_bar_negative_fill.r, 200U);
+  EXPECT_EQ(round_trip.data_bar_border_engaged, 1);
+  EXPECT_EQ(round_trip.data_bar_border.g, 22U);
+  // No negative border was set, so the getter must report it absent
+  // rather than handing back an engaged black.
+  EXPECT_EQ(round_trip.data_bar_negative_border_engaged, 0);
+  EXPECT_EQ(round_trip.data_bar_axis_color_engaged, 1);
+  EXPECT_EQ(round_trip.data_bar_axis_color.b, 66U);
+
+  round_trip.stop_if_true = 1;
+  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
+  std::size_t rewritten_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, round_trip, &rewritten_index), 0) << fm_last_error_message();
+
+  const formulon::cf::DataBarSpec& spec = OnlyDataBarSpec(wb.handle);
+  EXPECT_FALSE(spec.gradient);
+  EXPECT_EQ(spec.axis_position, formulon::cf::DataBarAxisPosition::Middle);
+  EXPECT_EQ(spec.negative_fill.r, 200U);
+  EXPECT_EQ(spec.negative_fill.g, 30U);
+  ASSERT_TRUE(spec.border.has_value());
+  EXPECT_EQ(spec.border->b, 33U);
+  EXPECT_FALSE(spec.negative_border.has_value());
+  EXPECT_EQ(spec.axis_color.g, 55U);
+}
+
+TEST(FormulonCApiCfMutate, GetAtRecordStaysReadableUntilTheNextGet) {
+  // The record the getter fills has to outlive the mutations of the ABI's
+  // own edit procedure, and unrelated reads that recycle the handle's text
+  // scratch must not disturb it either. Only the next successful CF get
+  // takes the storage back.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 5, 5, "unrelated"), 0);
+
+  fm_cf_cell_range_t sqref[2]{{0, 0, 9, 0}, {4, 3, 14, 3}};
+  fm_cf_rule_t seed{};
+  seed.id = "{AB000000-0000-0000-0000-000000000001}";
+  seed.type = 2;  // ColorScale
+  seed.sqref = sqref;
+  seed.sqref_count = 2;
+  seed.formula1 = "SEEDFORMULA";
+  fm_cfvo_t thresholds[2]{};
+  thresholds[0].type = 0;  // Number
+  thresholds[0].value = "11";
+  thresholds[1].type = 0;
+  thresholds[1].value = "33";
+  fm_cf_color_t colors[2]{{255, 0, 0, 255}, {0, 255, 0, 255}};
+  seed.color_scale_thresholds = thresholds;
+  seed.color_scale_colors = colors;
+  seed.color_scale_count = 2;
+  std::size_t seed_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, seed, &seed_index), 0) << fm_last_error_message();
+
+  fm_cf_rule_t held{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &held), 0);
+  ASSERT_NE(held.sqref, nullptr);
+  ASSERT_EQ(held.sqref_count, 2U);
+  ASSERT_EQ(held.color_scale_count, 2U);
+
+  // A removal frees the block the rule lived in.
+  ASSERT_EQ(fm_sheet_cf_remove_at(wb.handle, 0, 0), 0);
+  std::size_t remaining = 0;
+  ASSERT_EQ(fm_sheet_cf_count(wb.handle, 0, &remaining), 0);
+  ASSERT_EQ(remaining, 0U);
+  EXPECT_STREQ(held.id, "{AB000000-0000-0000-0000-000000000001}");
+  EXPECT_STREQ(held.formula1, "SEEDFORMULA");
+  EXPECT_EQ(held.sqref[1].first_col, 3U);
+  EXPECT_EQ(held.sqref[1].last_row, 14U);
+  EXPECT_STREQ(held.color_scale_thresholds[1].value, "33");
+
+  // An unrelated text read recycles `read_scratch`.
+  fm_value_t unrelated{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 5, 5, &unrelated), 0);
+  EXPECT_STREQ(held.id, "{AB000000-0000-0000-0000-000000000001}");
+  EXPECT_STREQ(held.color_scale_thresholds[0].value, "11");
+
+  // Feeding the held record straight back is the documented edit path; it
+  // must not need a caller-side copy of anything.
+  std::size_t rewritten_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, held, &rewritten_index), 0) << fm_last_error_message();
+  const auto& blocks = wb.handle->workbook().sheet(0).conditional_formats();
+  ASSERT_EQ(blocks.size(), 1U);
+  ASSERT_EQ(blocks[0].sqref.size(), 2U);
+  EXPECT_EQ(blocks[0].sqref[1], MakeRange(4, 3, 14, 3));
+  EXPECT_EQ(blocks[0].rules[0].id, "{AB000000-0000-0000-0000-000000000001}");
+  ASSERT_TRUE(blocks[0].rules[0].color_scale.has_value());
+  EXPECT_EQ(blocks[0].rules[0].color_scale->thresholds[1].value, "33");
+}
+
+TEST(FormulonCApiCfMutate, DataBarRejectsInvertedLengthsAndUnknownAxisPosition) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+
+  fm_cf_rule_t inverted = MakeDataBarRule(&sqref);
+  inverted.data_bar_min_length_pct = 90;
+  inverted.data_bar_max_length_pct = 10;
+  std::size_t rule_index = 0;
+  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, inverted, &rule_index),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  fm_cf_rule_t bad_axis = MakeDataBarRule(&sqref);
+  bad_axis.data_bar_axis_position_engaged = 1;
+  bad_axis.data_bar_axis_position = 3;  // one past `none`
+  EXPECT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, bad_axis, &rule_index),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  // An unengaged out-of-domain axis ordinal is ignored, not rejected: the
+  // flag is what makes the value meaningful.
+  fm_cf_rule_t stale_axis = MakeDataBarRule(&sqref);
+  stale_axis.data_bar_axis_position = 3;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, stale_axis, &rule_index), 0) << fm_last_error_message();
+  EXPECT_EQ(OnlyDataBarSpec(wb.handle).axis_position, formulon::cf::DataBarAxisPosition::Automatic);
+}
+
+TEST(FormulonCApiCfMutate, ThresholdStringsStayLiveWhileLaterPayloadsArePulled) {
+  // Mirrors what the JS bindings do for a rule object that carries more
+  // than one payload key: every threshold string is pulled into one
+  // caller-side store, and the record keeps a borrowed view of each. The
+  // store must therefore not relocate bytes an earlier pull already
+  // published into the record - which is what a growing vector does on
+  // the second short string it holds.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  formulon::c_api::BorrowedStringArena strings;
+
+  fm_cf_cell_range_t sqref{0, 0, 9, 0};
+  fm_cf_rule_t rule{};
+  rule.type = 2;  // ColorScale
+  rule.sqref = &sqref;
+  rule.sqref_count = 1;
+
+  fm_cfvo_t thresholds[3]{};
+  const char* const kThresholdValues[3] = {"11", "22", "33"};
+  for (std::size_t i = 0; i < 3; ++i) {
+    thresholds[i].type = 0;  // Number
+    thresholds[i].gte = 1;
+    thresholds[i].value = strings.emplace(kThresholdValues[i]);
+  }
+  fm_cf_color_t colors[3]{{255, 0, 0, 255}, {255, 255, 0, 255}, {0, 255, 0, 255}};
+  rule.color_scale_thresholds = thresholds;
+  rule.color_scale_colors = colors;
+  rule.color_scale_count = 3;
+
+  // The same JS object also carried `dataBar` and `iconSet` keys, so the
+  // binding pulls their threshold strings into the same store after the
+  // colorScale views are already in the record.
+  rule.data_bar_engaged = 1;
+  rule.data_bar_min.type = 0;
+  rule.data_bar_min.value = strings.emplace("5");
+  rule.data_bar_max.type = 0;
+  rule.data_bar_max.value = strings.emplace("95");
+  fm_cfvo_t icon_thresholds[2]{};
+  icon_thresholds[0].type = 1;  // Percent
+  icon_thresholds[0].value = strings.emplace("40");
+  icon_thresholds[1].type = 1;
+  icon_thresholds[1].value = strings.emplace("80");
+  rule.icon_set_engaged = 1;
+  rule.icon_set_thresholds = icon_thresholds;
+  rule.icon_set_threshold_count = 2;
+
+  std::size_t rule_index = 0;
+  ASSERT_EQ(fm_sheet_cf_add_rule(wb.handle, 0, rule, &rule_index), 0) << fm_last_error_message();
+
+  const auto& blocks = wb.handle->workbook().sheet(0).conditional_formats();
+  ASSERT_EQ(blocks.size(), 1U);
+  ASSERT_TRUE(blocks[0].rules[0].color_scale.has_value());
+  const auto& stored = blocks[0].rules[0].color_scale->thresholds;
+  ASSERT_EQ(stored.size(), 3U);
+  EXPECT_EQ(stored[0].value, "11");
+  EXPECT_EQ(stored[1].value, "22");
+  EXPECT_EQ(stored[2].value, "33");
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+  const auto& reloaded_blocks = reloaded.handle->workbook().sheet(0).conditional_formats();
+  ASSERT_EQ(reloaded_blocks.size(), 1U);
+  ASSERT_TRUE(reloaded_blocks[0].rules[0].color_scale.has_value());
+  const auto& reloaded_thresholds = reloaded_blocks[0].rules[0].color_scale->thresholds;
+  ASSERT_EQ(reloaded_thresholds.size(), 3U);
+  EXPECT_EQ(reloaded_thresholds[0].value, "11");
+  EXPECT_EQ(reloaded_thresholds[1].value, "22");
+  EXPECT_EQ(reloaded_thresholds[2].value, "33");
+}
+
+TEST(FormulonCApiCfMutate, RuleEngagingSeveralVisualPayloadsSurfacesLivePointers) {
+  // `cf::CFRule` declares the three visual payloads mutually exclusive,
+  // but a rule can only be trusted to honour that once every producer
+  // does. The getter must keep every pointer it writes into the record
+  // valid until it returns, including for a rule that engages two.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  auto& sheet = wb.handle->workbook().sheet(0);
+  formulon::cf::ConditionalFormat block{};
+  block.sqref.push_back(MakeRange(0, 0, 9, 0));
+  formulon::cf::CFRule rule;
+  rule.type = formulon::cf::RuleType::ColorScale;
+  rule.priority = 1;
+  formulon::cf::ColorScaleSpec color_scale;
+  for (const char* value : {"11", "22", "33"}) {
+    formulon::cf::CfValueObject cfvo;
+    cfvo.type = formulon::cf::CfvoType::Number;
+    cfvo.value = value;
+    color_scale.thresholds.push_back(cfvo);
+    color_scale.colors.push_back(formulon::cf::Color{255, 0, 0, 255});
+  }
+  rule.color_scale = std::move(color_scale);
+  formulon::cf::IconSetSpec icon_set;
+  for (const char* value : {"40", "80"}) {
+    formulon::cf::CfValueObject cfvo;
+    cfvo.type = formulon::cf::CfvoType::Percent;
+    cfvo.value = value;
+    icon_set.thresholds.push_back(cfvo);
+  }
+  rule.icon_set = std::move(icon_set);
+  block.rules.push_back(std::move(rule));
+  sheet.mutable_conditional_formats().push_back(std::move(block));
+
+  fm_cf_rule_t out{};
+  ASSERT_EQ(fm_sheet_cf_get_at(wb.handle, 0, 0, &out), 0);
+  ASSERT_EQ(out.color_scale_count, 3U);
+  ASSERT_NE(out.color_scale_thresholds, nullptr);
+  ASSERT_NE(out.color_scale_colors, nullptr);
+  // Read after the iconSet payload was filled: the colorScale array must
+  // not have moved out from under the pointer already in the record.
+  EXPECT_STREQ(out.color_scale_thresholds[0].value, "11");
+  EXPECT_STREQ(out.color_scale_thresholds[2].value, "33");
+  EXPECT_EQ(out.color_scale_colors[0].r, 255U);
+  ASSERT_EQ(out.icon_set_threshold_count, 2U);
+  ASSERT_NE(out.icon_set_thresholds, nullptr);
+  EXPECT_STREQ(out.icon_set_thresholds[1].value, "80");
+}
diff --git a/tests/c_api/formulon_c_display_text_test.cpp b/tests/c_api/formulon_c_display_text_test.cpp
new file mode 100644
index 000000000..f3258bfab
--- /dev/null
+++ b/tests/c_api/formulon_c_display_text_test.cpp
@@ -0,0 +1,778 @@
+//
+// Stable C ABI tests for cell display text and ad-hoc value formatting.
+
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <map>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "gtest/gtest.h"
+#include "io/zip_reader.h"
+#include "miniz.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace {
+
+constexpr fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+};
+
+fm_value_t Number(double v) {
+  fm_value_t value{};
+  value.kind = FM_VAL_NUMBER;
+  value.u.number = v;
+  return value;
+}
+
+/// Renders through `fm_workbook_format_value` and returns `(text, status)`.
+std::pair<std::string, int32_t> Format(fm_workbook_t* wb, const fm_value_t& value, const char* code) {
+  const char* text = nullptr;
+  int32_t status = -1;
+  EXPECT_EQ(fm_workbook_format_value(wb, &value, code, &text, &status), 0);
+  return {text == nullptr ? std::string() : std::string(text), status};
+}
+
+using Bytes = std::vector<std::uint8_t>;
+
+Bytes SavePackage(fm_workbook_t* wb) {
+  std::uint8_t* data = nullptr;
+  std::size_t len = 0;
+  EXPECT_EQ(fm_workbook_save(wb, &data, &len), 0);
+  Bytes result;
+  if (data != nullptr) {
+    result.assign(data, data + len);
+  }
+  fm_buffer_free(data);
+  return result;
+}
+
+void LoadPackage(const Bytes& bytes, WorkbookGuard* out) {
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &out->handle), 0);
+}
+
+/// Rewrites a package entry while preserving every unrelated OOXML part.
+/// This is the same fixture shape used by the effective-style C API tests.
+Bytes ReplaceEntries(const Bytes& package, const std::map<std::string, std::string>& replacements) {
+  formulon::io::ZipReader input;
+  EXPECT_TRUE(static_cast<bool>(input.open(formulon::io::ByteSpan{package.data(), package.size()})));
+  mz_zip_archive writer{};
+  EXPECT_EQ(mz_zip_writer_init_heap(&writer, 0, 4096), MZ_TRUE);
+  std::size_t replaced = 0;
+  for (const std::string& name : input.list_entries()) {
+    auto body = input.read_entry(name);
+    EXPECT_TRUE(static_cast<bool>(body)) << name;
+    if (!body) {
+      continue;
+    }
+    Bytes content = body.value();
+    if (auto it = replacements.find(name); it != replacements.end()) {
+      content.assign(it->second.begin(), it->second.end());
+      ++replaced;
+    }
+    EXPECT_EQ(mz_zip_writer_add_mem(&writer, name.c_str(), content.data(), content.size(),
+                                    static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)),
+              MZ_TRUE);
+  }
+  EXPECT_EQ(replaced, replacements.size());
+  void* archive = nullptr;
+  std::size_t archive_size = 0;
+  EXPECT_EQ(mz_zip_writer_finalize_heap_archive(&writer, &archive, &archive_size), MZ_TRUE);
+  EXPECT_EQ(mz_zip_writer_end(&writer), MZ_TRUE);
+  Bytes result(static_cast<const std::uint8_t*>(archive), static_cast<const std::uint8_t*>(archive) + archive_size);
+  mz_free(archive);
+  return result;
+}
+
+Bytes PackageWithSheetXml(fm_workbook_t* wb, std::string sheet_xml) {
+  return ReplaceEntries(SavePackage(wb), {{"xl/worksheets/sheet1.xml", std::move(sheet_xml)}});
+}
+
+Bytes PackageWithColumnPercentSpill(fm_workbook_t* wb, uint32_t column_xf) {
+  const std::string sheet =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+      "<cols><col min=\"2\" max=\"2\" style=\"" +
+      std::to_string(column_xf) +
+      "\"/></cols><sheetData><row r=\"1\"><c r=\"A1\" cm=\"1\"><f>SEQUENCE(1,2)</f><v>1</v></c>"
+      "</row></sheetData></worksheet>";
+  return PackageWithSheetXml(wb, sheet);
+}
+
+Bytes SaveXlsbPackage(fm_workbook_t* wb) {
+  std::uint8_t* data = nullptr;
+  std::size_t len = 0;
+  EXPECT_EQ(fm_workbook_save_as(wb, FM_WORKBOOK_FORMAT_XLSB, &data, &len), 0);
+  Bytes result;
+  if (data != nullptr) {
+    result.assign(data, data + len);
+  }
+  fm_buffer_free(data);
+  return result;
+}
+
+Bytes PackageWithNonGeneralDefaultXf(fm_workbook_t* wb, std::string sheet_xml) {
+  const Bytes package = SavePackage(wb);
+  formulon::io::ZipReader input;
+  EXPECT_TRUE(static_cast<bool>(input.open(formulon::io::ByteSpan{package.data(), package.size()})));
+  auto styles_entry = input.read_entry("xl/styles.xml");
+  EXPECT_TRUE(static_cast<bool>(styles_entry));
+  if (!styles_entry) {
+    return {};
+  }
+  std::string styles(styles_entry.value().begin(), styles_entry.value().end());
+  const std::size_t cell_xfs_begin = styles.find("<cellXfs");
+  EXPECT_NE(cell_xfs_begin, std::string::npos);
+  const std::size_t first_xf = styles.find("<xf", cell_xfs_begin);
+  EXPECT_NE(first_xf, std::string::npos);
+  const std::size_t first_xf_end = styles.find('>', first_xf);
+  EXPECT_NE(first_xf_end, std::string::npos);
+  const std::size_t general_id = styles.find("numFmtId=\"0\"", first_xf);
+  EXPECT_NE(general_id, std::string::npos);
+  if (cell_xfs_begin == std::string::npos || first_xf == std::string::npos || first_xf_end == std::string::npos ||
+      general_id == std::string::npos || general_id > first_xf_end) {
+    return {};
+  }
+  styles.replace(general_id, std::string("numFmtId=\"0\"").size(), "numFmtId=\"2\"");
+  return ReplaceEntries(package,
+                        {{"xl/styles.xml", std::move(styles)}, {"xl/worksheets/sheet1.xml", std::move(sheet_xml)}});
+}
+
+}  // namespace
+
+TEST(FormulonCApiDisplayText, CellUsesItsNumberFormat) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf xf{};
+  xf.num_fmt_id = 2;  // built-in 0.00
+  uint32_t xf_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_index), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.5), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, xf_index), 0);
+  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 1, 0, "plain"), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 0, 0, &text, &status), 0);
+  EXPECT_STREQ(text, "1.50");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 1, 0, &text, &status), 0);
+  EXPECT_STREQ(text, "plain");
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 5, 5, &text, &status), 0);
+  EXPECT_STREQ(text, "");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+}
+
+TEST(FormulonCApiDisplayText, SpillCellsDisplayResolvedValuesWithTheirOwnFormat) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(2,2)"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 1, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_EQ(value.u.number, 4.0);
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 1, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "4");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+
+  fm_cell_xf xf{};
+  xf.num_fmt_id = 2;  // 0.00
+  uint32_t xf_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_index), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 1, 1, xf_index), 0);
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 1, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "4.00");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 1, 1, &value), 0);
+  EXPECT_EQ(value.u.number, 4.0);
+
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,1)"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 1, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "");
+}
+
+TEST(FormulonCApiDisplayText, SpillPhantomsUseColumnRowAndCellStylePrecedence) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  fm_cell_xf decimal{};
+  decimal.num_fmt_id = 2;  // 0.00
+  uint32_t row_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, decimal, &row_xf), 0);
+  fm_cell_xf explicit_cell{};
+  explicit_cell.num_fmt_id = 9;  // 0%
+  uint32_t cell_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, explicit_cell, &cell_xf), 0);
+
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(2,2)"), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 1, 2, 0.125), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 1, 2, cell_xf), 0);
+  const std::string sheet =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+      "<cols><col min=\"2\" max=\"2\" style=\"" +
+      std::to_string(column_xf) +
+      "\"/></cols><sheetData>"
+      "<row r=\"1\"><c r=\"A1\" cm=\"1\"><f>SEQUENCE(2,2)</f><v>1</v></c></row>"
+      "<row r=\"2\" s=\"" +
+      std::to_string(row_xf) + "\" customFormat=\"1\"><c r=\"C2\" s=\"" + std::to_string(cell_xf) +
+      "\"><v>0.125</v></c></row>"
+      "</sheetData></worksheet>";
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithSheetXml(wb.handle, sheet), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "200.00%");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 1, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "4.00");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  // C2 carries an explicit xf and therefore beats row 2's inherited decimal
+  // format, even though the row and the cell both sit outside the spill.
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 1, 2, &text, &status), 0);
+  EXPECT_STREQ(text, "13%");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 2);  // column
+  EXPECT_STREQ(style.num_fmt_code, "0.00%");
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 1, 1, &style), 0);
+  EXPECT_EQ(style.source, 1);  // customFormat row
+  EXPECT_STREQ(style.num_fmt_code, "0.00");
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 1, 2, &style), 0);
+  EXPECT_EQ(style.source, 0);  // explicit cell
+  EXPECT_STREQ(style.num_fmt_code, "0%");
+}
+
+TEST(FormulonCApiDisplayText, SpillPhantomWithoutLayoutUsesDefaultXfZero) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // An unassigned non-default XF must not leak.
+  uint32_t percent_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &percent_xf), 0);
+  ASSERT_NE(percent_xf, 0U);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(2,2)"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "2");
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 1, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "4");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(wb.handle, 0, 1, 1, &style), 0);
+  EXPECT_EQ(style.source, 3);  // default xf 0
+  EXPECT_STREQ(style.num_fmt_code, "General");
+}
+
+TEST(FormulonCApiDisplayText, SpillPhantomUsesNonGeneralDefaultXfZero) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(2,2)"), 0);
+  const std::string sheet =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+      "<sheetData><row r=\"1\"><c r=\"A1\" cm=\"1\"><f>SEQUENCE(2,2)</f><v>1</v></c></row></sheetData>"
+      "</worksheet>";
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithNonGeneralDefaultXf(wb.handle, sheet), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 1, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "4.00");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 1, 1, &style), 0);
+  EXPECT_EQ(style.source, 3);  // the non-General default xf 0
+  EXPECT_STREQ(style.num_fmt_code, "0.00");
+}
+
+TEST(FormulonCApiDisplayText, InvalidRowXfFallsBackToDefaultRecord) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(2,2)"), 0);
+  const std::string sheet =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+      "<sheetData><row r=\"1\"><c r=\"A1\" cm=\"1\"><f>SEQUENCE(2,2)</f><v>1</v></c></row>"
+      "<row r=\"2\" s=\"9999\" customFormat=\"1\"/></sheetData>"
+      "</worksheet>";
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithNonGeneralDefaultXf(wb.handle, sheet), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 1, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "4.00");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 1, 1, &style), 0);
+  EXPECT_EQ(style.source, 1);     // the row override still supplies precedence
+  EXPECT_EQ(style.xf_index, 0U);  // its raw index is out of range
+  EXPECT_STREQ(style.num_fmt_code, "0.00");
+}
+
+TEST(FormulonCApiDisplayText, MaterializedBlankGapDoesNotShadowColumnStyle) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 2, "=B1"), 0);
+  const std::string sheet =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+      "<cols><col min=\"2\" max=\"2\" style=\"" +
+      std::to_string(column_xf) +
+      "\"/></cols><sheetData>"
+      "<row r=\"1\"><c r=\"A1\" cm=\"1\"><f>SEQUENCE(1,2)</f><v>1</v></c>"
+      "<c r=\"C1\"><f>B1</f><v>2</v></c></row>"
+      "</sheetData></worksheet>";
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithSheetXml(wb.handle, sheet), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "200.00%");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 0, 2, &text, &status), 0);
+  EXPECT_STREQ(text, "2");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 2);  // column, despite the materialized blank gap
+  EXPECT_STREQ(style.num_fmt_code, "0.00%");
+}
+
+TEST(FormulonCApiDisplayText, ExplicitDefaultCellXfOverridesInheritedColumnFormat) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  ASSERT_NE(column_xf, 0U);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithColumnPercentSpill(wb.handle, column_xf), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "200.00%");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+
+  ASSERT_EQ(fm_cell_set_xf_index(loaded.handle, 0, 0, 1, 0), 0);
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "2");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);  // explicit cell, even though its xf is the default record
+  EXPECT_EQ(style.xf_index, 0U);
+  EXPECT_STREQ(style.num_fmt_code, "General");
+
+  const Bytes saved = SavePackage(loaded.handle);
+  ASSERT_FALSE(saved.empty());
+  WorkbookGuard reloaded;
+  LoadPackage(saved, &reloaded);
+  ASSERT_EQ(fm_workbook_recalc(reloaded.handle), 0);
+  ASSERT_EQ(fm_workbook_get_display_text(reloaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "2");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  ASSERT_EQ(fm_sheet_get_effective_style(reloaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);
+  EXPECT_EQ(style.xf_index, 0U);
+  EXPECT_STREQ(style.num_fmt_code, "General");
+}
+
+TEST(FormulonCApiDisplayText, ExplicitDefaultRangeXfOverridesInheritedColumnFormat) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  ASSERT_NE(column_xf, 0U);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithColumnPercentSpill(wb.handle, column_xf), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  ASSERT_EQ(fm_sheet_set_range_xf_index(loaded.handle, 0, 0, 1, 0, 1, 0), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "2");
+  EXPECT_EQ(status, FM_DISPLAY_OK);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);  // explicit range cell
+  EXPECT_EQ(style.xf_index, 0U);
+  EXPECT_STREQ(style.num_fmt_code, "General");
+}
+
+TEST(FormulonCApiDisplayText, XlsbPreservesNonDefaultXfOnBlankCell) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  fm_cell_xf decimal{};
+  decimal.num_fmt_id = 2;  // 0.00
+  uint32_t cell_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, decimal, &cell_xf), 0);
+  ASSERT_NE(cell_xf, 0U);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithColumnPercentSpill(wb.handle, column_xf), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  // B2 is outside the one-row spill, so this blank cell exercises ordinary
+  // cell serialization while inheriting the column format when unstyled.
+  ASSERT_EQ(fm_cell_set_xf_index(loaded.handle, 0, 1, 1, cell_xf), 0);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 1, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);
+  EXPECT_EQ(style.xf_index, cell_xf);
+  EXPECT_STREQ(style.num_fmt_code, "0.00");
+
+  const Bytes saved = SaveXlsbPackage(loaded.handle);
+  ASSERT_FALSE(saved.empty());
+  WorkbookGuard reloaded;
+  LoadPackage(saved, &reloaded);
+  ASSERT_EQ(fm_sheet_get_effective_style(reloaded.handle, 0, 1, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);
+  EXPECT_EQ(style.xf_index, cell_xf);
+  EXPECT_STREQ(style.num_fmt_code, "0.00");
+}
+
+TEST(FormulonCApiDisplayText, XlsbPreservesExplicitDefaultXfOnBlankCell) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithColumnPercentSpill(wb.handle, column_xf), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  // An explicit default XF must block inherited column formatting even though
+  // B2 remains a blank cell outside the spill footprint.
+  ASSERT_EQ(fm_cell_set_xf_index(loaded.handle, 0, 1, 1, 0), 0);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 1, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);
+  EXPECT_EQ(style.xf_index, 0U);
+  EXPECT_STREQ(style.num_fmt_code, "General");
+
+  const Bytes saved = SaveXlsbPackage(loaded.handle);
+  ASSERT_FALSE(saved.empty());
+  WorkbookGuard reloaded;
+  LoadPackage(saved, &reloaded);
+  ASSERT_EQ(fm_sheet_get_effective_style(reloaded.handle, 0, 1, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);
+  EXPECT_EQ(style.xf_index, 0U);
+  EXPECT_STREQ(style.num_fmt_code, "General");
+}
+
+TEST(FormulonCApiDisplayText, XlsbKeepsInheritedFormatOnUnstyledSpillPhantom) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  ASSERT_NE(column_xf, 0U);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithColumnPercentSpill(wb.handle, column_xf), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "200.00%");
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 0, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 2.0);
+
+  const Bytes saved = SaveXlsbPackage(loaded.handle);
+  ASSERT_FALSE(saved.empty());
+  WorkbookGuard reloaded;
+  LoadPackage(saved, &reloaded);
+  ASSERT_EQ(fm_workbook_recalc(reloaded.handle), 0);
+  ASSERT_EQ(fm_workbook_get_display_text(reloaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "200.00%");
+  ASSERT_EQ(fm_workbook_get_value(reloaded.handle, 0, 0, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 2.0);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(reloaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);  // serialized effective XF on the phantom cell
+  EXPECT_EQ(style.xf_index, column_xf);
+  EXPECT_STREQ(style.num_fmt_code, "0.00%");
+}
+
+TEST(FormulonCApiDisplayText, XlsbKeepsExplicitDefaultXfOnSpillPhantom) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  ASSERT_NE(column_xf, 0U);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithColumnPercentSpill(wb.handle, column_xf), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(loaded.handle, 0, 0, 1, 0), 0);
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(loaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "2");
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 0, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 2.0);
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(loaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);  // explicit cell XF0
+  EXPECT_EQ(style.xf_index, 0U);
+  EXPECT_STREQ(style.num_fmt_code, "General");
+
+  const Bytes saved = SaveXlsbPackage(loaded.handle);
+  ASSERT_FALSE(saved.empty());
+  WorkbookGuard reloaded;
+  LoadPackage(saved, &reloaded);
+  ASSERT_EQ(fm_workbook_recalc(reloaded.handle), 0);
+  ASSERT_EQ(fm_workbook_get_display_text(reloaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "2");
+  ASSERT_EQ(fm_workbook_get_value(reloaded.handle, 0, 0, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 2.0);
+  ASSERT_EQ(fm_sheet_get_effective_style(reloaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);  // explicit cell XF0 survived the phantom record
+  EXPECT_EQ(style.xf_index, 0U);
+  EXPECT_STREQ(style.num_fmt_code, "General");
+}
+
+TEST(FormulonCApiDisplayText, XlsxKeepsInheritedFormatOnUnstyledSpillPhantom) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  ASSERT_NE(column_xf, 0U);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithColumnPercentSpill(wb.handle, column_xf), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+
+  const Bytes saved = SavePackage(loaded.handle);
+  ASSERT_FALSE(saved.empty());
+  WorkbookGuard reloaded;
+  LoadPackage(saved, &reloaded);
+  ASSERT_EQ(fm_workbook_recalc(reloaded.handle), 0);
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(reloaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "200.00%");
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(reloaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);  // serialized effective XF on the phantom cell
+  EXPECT_EQ(style.xf_index, column_xf);
+  EXPECT_STREQ(style.num_fmt_code, "0.00%");
+}
+
+TEST(FormulonCApiDisplayText, XlsxKeepsExplicitDefaultXfOnSpillPhantom) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf percent{};
+  percent.num_fmt_id = 10;  // 0.00%
+  uint32_t column_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, percent, &column_xf), 0);
+  ASSERT_NE(column_xf, 0U);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=SEQUENCE(1,2)"), 0);
+
+  WorkbookGuard loaded;
+  LoadPackage(PackageWithColumnPercentSpill(wb.handle, column_xf), &loaded);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(loaded.handle, 0, 0, 1, 0), 0);
+
+  const Bytes saved = SavePackage(loaded.handle);
+  ASSERT_FALSE(saved.empty());
+  WorkbookGuard reloaded;
+  LoadPackage(saved, &reloaded);
+  ASSERT_EQ(fm_workbook_recalc(reloaded.handle), 0);
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(reloaded.handle, 0, 0, 1, &text, &status), 0);
+  EXPECT_STREQ(text, "2");
+  fm_effective_style style{};
+  ASSERT_EQ(fm_sheet_get_effective_style(reloaded.handle, 0, 0, 1, &style), 0);
+  EXPECT_EQ(style.source, 0);  // explicit cell XF0 survived the phantom cell
+  EXPECT_EQ(style.xf_index, 0U);
+  EXPECT_STREQ(style.num_fmt_code, "General");
+}
+
+TEST(FormulonCApiDisplayText, ReferencesPreserveValuesAndUseDestinationFormats) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf xf{};
+  xf.num_fmt_id = 2;  // 0.00
+  uint32_t decimal_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &decimal_xf), 0);
+  xf.num_fmt_id = 10;  // 0.00%
+  uint32_t percent_xf = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &percent_xf), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 0.125), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, decimal_xf), 0);
+  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 1, 0, "0012.345"), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 3, 0, "=1/0"), 0);
+  for (uint32_t row = 0; row < 4; ++row) {
+    const std::string formula = "=A" + std::to_string(row + 1);
+    ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, row, 1, formula.c_str()), 0);
+    ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, row, 1, percent_xf), 0);
+  }
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 2, "=A1*100"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  const char* text = nullptr;
+  int32_t status = -1;
+  ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, 0, 0, &text, &status), 0);
+  EXPECT_STREQ(text, "0.13");
+  const char* expected[] = {"12.50%", "0012.345", "0.00%", "#DIV/0!"};
+  for (uint32_t row = 0; row < 4; ++row) {
+    ASSERT_EQ(fm_workbook_get_display_text(wb.handle, 0, row, 1, &text, &status), 0);
+    EXPECT_STREQ(text, expected[row]);
+    EXPECT_EQ(status, FM_DISPLAY_OK);
+  }
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_EQ(value.u.number, 0.125);
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 1, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_TEXT);
+  EXPECT_STREQ(value.u.text, "0012.345");
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 2, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_EQ(value.u.number, 0.0);
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 3, 1, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_ERROR);
+  EXPECT_EQ(value.u.error_code, static_cast<int32_t>(formulon::ErrorCode::Div0));
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 2, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_EQ(value.u.number, 12.5);
+}
+
+TEST(FormulonCApiDisplayText, OutOfCalendarDateOverflows) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const auto rendered = Format(wb.handle, Number(-1.0), "yyyy/m/d");
+  EXPECT_EQ(rendered.first, "########");
+  EXPECT_EQ(rendered.second, FM_DISPLAY_OVERFLOW);
+}
+
+TEST(FormulonCApiDisplayText, FormatValueCoversEveryScalarKind) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  EXPECT_EQ(Format(wb.handle, Number(1234.5), "#,##0").first, "1,235");
+  EXPECT_EQ(Format(wb.handle, Number(0.25), "").first, "0.25");
+
+  fm_value_t boolean{};
+  boolean.kind = FM_VAL_BOOL;
+  boolean.u.boolean = 1;
+  EXPECT_EQ(Format(wb.handle, boolean, "General").first, "TRUE");
+
+  fm_value_t text{};
+  text.kind = FM_VAL_TEXT;
+  text.u.text = "abc";
+  EXPECT_EQ(Format(wb.handle, text, "General").first, "abc");
+
+  fm_value_t error{};
+  error.kind = FM_VAL_ERROR;
+  error.u.error_code = 1;  // #DIV/0!
+  EXPECT_EQ(Format(wb.handle, error, "0.00").first, "#DIV/0!");
+
+  fm_value_t blank{};
+  blank.kind = FM_VAL_BLANK;
+  EXPECT_EQ(Format(wb.handle, blank, "0.00").first, "");
+}
+
+TEST(FormulonCApiDisplayText, FormatValueFollowsWorkbookDateSystem) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  EXPECT_EQ(Format(wb.handle, Number(1.0), "yyyy-mm-dd").first, "1900-01-01");
+  wb.handle->workbook().set_date1904(true);
+  EXPECT_EQ(Format(wb.handle, Number(1.0), "yyyy-mm-dd").first, "1904-01-02");
+}
+
+TEST(FormulonCApiDisplayText, RejectsBadArguments) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const char* text = nullptr;
+  int32_t status = 0;
+  EXPECT_EQ(fm_workbook_get_display_text(wb.handle, 3, 0, 0, &text, &status), kInvalidArgument);
+  EXPECT_EQ(fm_workbook_get_display_text(wb.handle, 0, 0, 16384U, &text, &status), kInvalidArgument);
+  EXPECT_NE(fm_workbook_get_display_text(wb.handle, 0, 0, 0, nullptr, &status), 0);
+
+  fm_value_t value = Number(std::numeric_limits<double>::quiet_NaN());
+  EXPECT_EQ(fm_workbook_format_value(wb.handle, &value, "0", &text, &status), kInvalidArgument);
+  value.kind = FM_VAL_ARRAY;
+  EXPECT_EQ(fm_workbook_format_value(wb.handle, &value, "0", &text, &status), kInvalidArgument);
+  value.kind = FM_VAL_ERROR;
+  value.u.error_code = 9999;
+  EXPECT_EQ(fm_workbook_format_value(wb.handle, &value, "0", &text, &status), kInvalidArgument);
+  value.kind = FM_VAL_TEXT;
+  value.u.text = nullptr;
+  EXPECT_NE(fm_workbook_format_value(wb.handle, &value, "0", &text, &status), 0);
+  value = Number(1.0);
+  EXPECT_NE(fm_workbook_format_value(wb.handle, &value, nullptr, &text, &status), 0);
+  EXPECT_NE(fm_workbook_format_value(nullptr, &value, "0", &text, &status), 0);
+}
diff --git a/tests/c_api/formulon_c_drawing_test.cpp b/tests/c_api/formulon_c_drawing_test.cpp
new file mode 100644
index 000000000..f2c7193c7
--- /dev/null
+++ b/tests/c_api/formulon_c_drawing_test.cpp
@@ -0,0 +1,347 @@
+//
+// Stable C ABI tests for drawing images: probing, listing next to other
+// drawing objects, reading, inserting, removing, and a save and reload.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "formulon_c_test_helpers.h"
+#include "gtest/gtest.h"
+#include "passthrough_part.h"
+#include "sheet.h"
+#include "unknown_relationship.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+namespace {
+
+using Bytes = std::vector<std::uint8_t>;
+
+constexpr bool kWasm32 = sizeof(void*) == 4U;
+static_assert(sizeof(fm_image_info) == 12U, "fm_image_info ABI layout changed");
+static_assert(sizeof(fm_drawing_object) == (kWasm32 ? 96U : 112U), "fm_drawing_object ABI layout changed");
+static_assert(sizeof(fm_image_insert) == (kWasm32 ? 56U : 64U), "fm_image_insert ABI layout changed");
+
+constexpr fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+constexpr fm_status_t kBindingNullPointer = static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer);
+constexpr fm_status_t kIoImageUnsupported = static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoImageUnsupported);
+constexpr fm_status_t kIoDrawingUnparseable =
+    static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoDrawingUnparseable);
+
+constexpr const char* kDrawingPath = "xl/drawings/drawing1.xml";
+constexpr const char* kRelDrawing = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing";
+
+Bytes Png(std::uint32_t w, std::uint32_t h) {
+  Bytes b = {0x89, 'P', 'N', 'G', 0x0D, 0x0A, 0x1A, 0x0A, 0, 0, 0, 13, 'I', 'H', 'D', 'R'};
+  for (std::uint32_t v : {w, h}) {
+    for (int shift = 24; shift >= 0; shift -= 8) {
+      b.push_back(static_cast<std::uint8_t>(v >> shift));
+    }
+  }
+  b.insert(b.end(), {8, 6, 0, 0, 0, 0x1F, 0x15, 0xC4, 0x89});
+  return b;
+}
+
+Bytes Jpeg(std::uint16_t w, std::uint16_t h) {
+  return {0xFF,
+          0xD8,
+          0xFF,
+          0xC0,
+          0x00,
+          0x11,
+          0x08,
+          static_cast<std::uint8_t>(h >> 8),
+          static_cast<std::uint8_t>(h),
+          static_cast<std::uint8_t>(w >> 8),
+          static_cast<std::uint8_t>(w),
+          0x03,
+          0xFF,
+          0xD9};
+}
+
+Bytes Gif(std::uint16_t w, std::uint16_t h) {
+  return {'G',
+          'I',
+          'F',
+          '8',
+          '9',
+          'a',
+          static_cast<std::uint8_t>(w),
+          static_cast<std::uint8_t>(w >> 8),
+          static_cast<std::uint8_t>(h),
+          static_cast<std::uint8_t>(h >> 8),
+          0,
+          0,
+          0};
+}
+
+Bytes Bmp(std::int32_t w, std::int32_t h) {
+  Bytes b(26, 0);
+  b[0] = 'B';
+  b[1] = 'M';
+  b[14] = 12;  // BITMAPCOREHEADER
+  b[18] = static_cast<std::uint8_t>(w);
+  b[19] = static_cast<std::uint8_t>(w >> 8);
+  b[20] = static_cast<std::uint8_t>(h);
+  b[21] = static_cast<std::uint8_t>(h >> 8);
+  b[22] = 1;
+  b[24] = 24;
+  return b;
+}
+
+fm_image_insert Defaults() {
+  fm_image_insert opts{};
+  opts.anchor_kind = FM_ANCHOR_KIND_ONE_CELL;
+  opts.edit_as = FM_ANCHOR_EDIT_AS_TWO_CELL;
+  return opts;
+}
+
+void SaveAndReload(fm_workbook_t* wb, WorkbookGuard* out) {
+  BufferGuard buf;
+  ASSERT_EQ(fm_workbook_save(wb, &buf.data, &buf.len), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &out->handle), 0) << fm_last_error_message();
+}
+
+/// Fills the first sheet's drawing with a chart anchor and a shape anchor.
+void AddChartDrawing(fm_workbook_t* wb) {
+  const std::string drawing =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\r\n"
+      "<xdr:wsDr xmlns:xdr=\"http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing\" "
+      "xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\">"
+      "<xdr:twoCellAnchor><xdr:from><xdr:col>0</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>0</xdr:row>"
+      "<xdr:rowOff>0</xdr:rowOff></xdr:from><xdr:to><xdr:col>6</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>14</xdr:row>"
+      "<xdr:rowOff>0</xdr:rowOff></xdr:to><xdr:graphicFrame macro=\"\"><xdr:nvGraphicFramePr>"
+      "<xdr:cNvPr id=\"2\" name=\"Chart 1\"/><xdr:cNvGraphicFramePr/></xdr:nvGraphicFramePr><xdr:xfrm>"
+      "<a:off x=\"0\" y=\"0\"/><a:ext cx=\"0\" cy=\"0\"/></xdr:xfrm><a:graphic>"
+      "<a:graphicData uri=\"http://schemas.openxmlformats.org/drawingml/2006/chart\">"
+      "<c:chart xmlns:c=\"http://schemas.openxmlformats.org/drawingml/2006/chart\" "
+      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" r:id=\"rId1\"/>"
+      "</a:graphicData></a:graphic></xdr:graphicFrame><xdr:clientData/></xdr:twoCellAnchor></xdr:wsDr>";
+  const std::string rels =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\r\n"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
+      "<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/chart\" "
+      "Target=\"../charts/chart1.xml\"/></Relationships>";
+  const std::string chart = "<c:chartSpace xmlns:c=\"http://schemas.openxmlformats.org/drawingml/2006/chart\"/>";
+  formulon::Workbook& model = wb->workbook();
+  ASSERT_TRUE(static_cast<bool>(model.add_passthrough_part(
+      formulon::PassthroughPart(kDrawingPath, "application/vnd.openxmlformats-officedocument.drawing+xml",
+                                Bytes(drawing.begin(), drawing.end())))));
+  ASSERT_TRUE(static_cast<bool>(model.add_passthrough_part(
+      formulon::PassthroughPart("xl/drawings/_rels/drawing1.xml.rels", "", Bytes(rels.begin(), rels.end())))));
+  ASSERT_TRUE(static_cast<bool>(model.add_passthrough_part(formulon::PassthroughPart(
+      "xl/charts/chart1.xml", "application/vnd.openxmlformats-officedocument.drawingml.chart+xml",
+      Bytes(chart.begin(), chart.end())))));
+  model.sheet(0).set_drawing_rel_target(kDrawingPath);
+}
+
+TEST(FormulonCApiDrawing, EnumOrdinals) {
+  EXPECT_EQ(FM_IMAGE_FORMAT_UNKNOWN, 0);
+  EXPECT_EQ(FM_IMAGE_FORMAT_PNG, 1);
+  EXPECT_EQ(FM_IMAGE_FORMAT_JPEG, 2);
+  EXPECT_EQ(FM_IMAGE_FORMAT_GIF, 3);
+  EXPECT_EQ(FM_IMAGE_FORMAT_BMP, 4);
+  EXPECT_EQ(FM_DRAWING_OBJECT_PICTURE, 0);
+  EXPECT_EQ(FM_DRAWING_OBJECT_SHAPE, 1);
+  EXPECT_EQ(FM_DRAWING_OBJECT_CHART, 2);
+  EXPECT_EQ(FM_DRAWING_OBJECT_GROUP, 3);
+  EXPECT_EQ(FM_DRAWING_OBJECT_CONNECTOR, 4);
+  EXPECT_EQ(FM_DRAWING_OBJECT_GRAPHIC_FRAME, 5);
+  EXPECT_EQ(FM_DRAWING_OBJECT_OTHER, 6);
+  EXPECT_EQ(FM_ANCHOR_KIND_ONE_CELL, 0);
+  EXPECT_EQ(FM_ANCHOR_KIND_TWO_CELL, 1);
+  EXPECT_EQ(FM_ANCHOR_KIND_ABSOLUTE, 2);
+  EXPECT_EQ(FM_ANCHOR_EDIT_AS_TWO_CELL, 0);
+  EXPECT_EQ(FM_ANCHOR_EDIT_AS_ONE_CELL, 1);
+  EXPECT_EQ(FM_ANCHOR_EDIT_AS_ABSOLUTE, 2);
+}
+
+TEST(FormulonCApiDrawing, ProbeEachFormat) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  struct Case {
+    Bytes bytes;
+    int32_t format;
+    uint32_t w, h;
+  };
+  const Case cases[] = {{Png(16, 8), FM_IMAGE_FORMAT_PNG, 16, 8},
+                        {Jpeg(30, 20), FM_IMAGE_FORMAT_JPEG, 30, 20},
+                        {Gif(5, 7), FM_IMAGE_FORMAT_GIF, 5, 7},
+                        {Bmp(9, 4), FM_IMAGE_FORMAT_BMP, 9, 4}};
+  for (const Case& c : cases) {
+    fm_image_info info{};
+    ASSERT_EQ(fm_workbook_probe_image(wb.handle, c.bytes.data(), c.bytes.size(), &info), 0) << fm_last_error_message();
+    EXPECT_EQ(info.format, c.format);
+    EXPECT_EQ(info.px_width, c.w);
+    EXPECT_EQ(info.px_height, c.h);
+  }
+}
+
+TEST(FormulonCApiDrawing, ProbeRejectsUnknownBytesAndNulls) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const Bytes junk = {'n', 'o', 't', ' ', 'a', 'n', ' ', 'i', 'm', 'a', 'g', 'e'};
+  fm_image_info info{};
+  EXPECT_EQ(fm_workbook_probe_image(wb.handle, junk.data(), junk.size(), &info), kIoImageUnsupported);
+  EXPECT_EQ(fm_workbook_probe_image(wb.handle, junk.data(), 0, &info), kIoImageUnsupported);
+  EXPECT_EQ(fm_workbook_probe_image(wb.handle, nullptr, 0, &info), kBindingNullPointer);
+  EXPECT_EQ(fm_workbook_probe_image(wb.handle, junk.data(), junk.size(), nullptr), kBindingNullPointer);
+}
+
+TEST(FormulonCApiDrawing, InsertListGetRemoveNextToChart) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  AddChartDrawing(wb.handle);
+  const Bytes png = Png(16, 8);
+  fm_image_insert opts = Defaults();
+  opts.name = "Logo";
+  opts.descr = "alt";
+  opts.row = 3;
+  opts.col = 2;
+  opts.row_off_emu = 1000;
+  opts.col_off_emu = 2000;
+  uint32_t id = 0;
+  ASSERT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), &opts, &id), 0) << fm_last_error_message();
+  EXPECT_EQ(id, 3U);
+
+  size_t count = 0;
+  ASSERT_EQ(fm_sheet_drawing_object_count(wb.handle, 0, &count), 0);
+  ASSERT_EQ(count, 2U);
+  fm_drawing_object chart{};
+  ASSERT_EQ(fm_sheet_drawing_object_at(wb.handle, 0, 0, &chart), 0);
+  EXPECT_EQ(chart.kind, FM_DRAWING_OBJECT_CHART);
+  EXPECT_EQ(chart.anchor_kind, FM_ANCHOR_KIND_TWO_CELL);
+  EXPECT_EQ(chart.to_col, 6U);
+  EXPECT_EQ(chart.to_row, 14U);
+  EXPECT_EQ(chart.image_format, FM_IMAGE_FORMAT_UNKNOWN);
+  EXPECT_STREQ(chart.name, "Chart 1");
+  fm_drawing_object pic{};
+  ASSERT_EQ(fm_sheet_drawing_object_at(wb.handle, 0, 1, &pic), 0);
+  EXPECT_EQ(pic.object_id, id);
+  EXPECT_EQ(pic.kind, FM_DRAWING_OBJECT_PICTURE);
+  EXPECT_EQ(pic.anchor_kind, FM_ANCHOR_KIND_ONE_CELL);
+  EXPECT_EQ(pic.from_row, 3U);
+  EXPECT_EQ(pic.from_col, 2U);
+  EXPECT_EQ(pic.from_row_off, 1000);
+  EXPECT_EQ(pic.from_col_off, 2000);
+  EXPECT_EQ(pic.cx, 16 * 9525);
+  EXPECT_EQ(pic.cy, 8 * 9525);
+  EXPECT_EQ(pic.image_format, FM_IMAGE_FORMAT_PNG);
+  EXPECT_STREQ(pic.name, "Logo");
+  EXPECT_STREQ(pic.descr, "alt");
+  EXPECT_NE(std::string(pic.media_path).find("xl/media/image"), std::string::npos);
+  // The previous record's strings live until the next successful read.
+  fm_drawing_object again{};
+  ASSERT_EQ(fm_sheet_drawing_object_at(wb.handle, 0, 1, &again), 0);
+  EXPECT_STREQ(again.name, "Logo");
+
+  const uint8_t* got = nullptr;
+  size_t got_len = 0;
+  fm_image_info info{};
+  ASSERT_EQ(fm_sheet_get_image(wb.handle, 0, id, &got, &got_len, &info), 0) << fm_last_error_message();
+  EXPECT_EQ(Bytes(got, got + got_len), png);
+  EXPECT_EQ(info.format, FM_IMAGE_FORMAT_PNG);
+  EXPECT_EQ(info.px_width, 16U);
+  EXPECT_EQ(info.px_height, 8U);
+  // A chart is not a picture; an unknown id is not found.
+  EXPECT_EQ(fm_sheet_get_image(wb.handle, 0, 2, &got, &got_len, &info), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_get_image(wb.handle, 0, 99, &got, &got_len, &info), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_get_image(wb.handle, 0, id, nullptr, &got_len, &info), kBindingNullPointer);
+
+  EXPECT_EQ(fm_sheet_remove_image(wb.handle, 0, 2), kInvalidArgument);
+  ASSERT_EQ(fm_sheet_remove_image(wb.handle, 0, id), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_sheet_drawing_object_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 1U);
+  EXPECT_EQ(fm_sheet_get_image(wb.handle, 0, id, &got, &got_len, &info), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_drawing_object_at(wb.handle, 0, 1, &pic), kInvalidArgument);
+}
+
+TEST(FormulonCApiDrawing, InsertSaveReloadKeepsBytes) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const Bytes png = Png(16, 8);
+  const Bytes jpeg = Jpeg(30, 20);
+  fm_image_insert opts = Defaults();
+  opts.row = 1;
+  uint32_t first = 0;
+  uint32_t second = 0;
+  ASSERT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), &opts, &first), 0) << fm_last_error_message();
+  opts.anchor_kind = FM_ANCHOR_KIND_TWO_CELL;
+  opts.edit_as = FM_ANCHOR_EDIT_AS_ONE_CELL;
+  opts.row = 5;
+  ASSERT_EQ(fm_sheet_insert_image(wb.handle, 0, jpeg.data(), jpeg.size(), &opts, &second), 0)
+      << fm_last_error_message();
+  EXPECT_NE(first, second);
+
+  WorkbookGuard reloaded;
+  SaveAndReload(wb.handle, &reloaded);
+  size_t count = 0;
+  ASSERT_EQ(fm_sheet_drawing_object_count(reloaded.handle, 0, &count), 0);
+  ASSERT_EQ(count, 2U);
+  const uint8_t* got = nullptr;
+  size_t got_len = 0;
+  fm_image_info info{};
+  ASSERT_EQ(fm_sheet_get_image(reloaded.handle, 0, first, &got, &got_len, &info), 0) << fm_last_error_message();
+  EXPECT_EQ(Bytes(got, got + got_len), png);
+  EXPECT_EQ(info.format, FM_IMAGE_FORMAT_PNG);
+  ASSERT_EQ(fm_sheet_get_image(reloaded.handle, 0, second, &got, &got_len, &info), 0) << fm_last_error_message();
+  EXPECT_EQ(Bytes(got, got + got_len), jpeg);
+  EXPECT_EQ(info.format, FM_IMAGE_FORMAT_JPEG);
+  fm_drawing_object obj{};
+  ASSERT_EQ(fm_sheet_drawing_object_at(reloaded.handle, 0, 1, &obj), 0);
+  EXPECT_EQ(obj.anchor_kind, FM_ANCHOR_KIND_TWO_CELL);
+  EXPECT_EQ(obj.edit_as, FM_ANCHOR_EDIT_AS_ONE_CELL);
+  EXPECT_EQ(obj.from_row, 5U);
+}
+
+TEST(FormulonCApiDrawing, InsertRejectsBadArguments) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const Bytes png = Png(4, 4);
+  const Bytes junk = {1, 2, 3, 4};
+  fm_image_insert opts = Defaults();
+  uint32_t id = 0;
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, junk.data(), junk.size(), &opts, &id), kIoImageUnsupported);
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, nullptr, 0, &opts, &id), kBindingNullPointer);
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), nullptr, &id), kBindingNullPointer);
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), &opts, nullptr), kBindingNullPointer);
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 7, png.data(), png.size(), &opts, &id), kInvalidArgument);
+  opts.anchor_kind = FM_ANCHOR_KIND_ABSOLUTE;
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), &opts, &id), kInvalidArgument);
+  opts.anchor_kind = 3;
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), &opts, &id), kInvalidArgument);
+  opts = Defaults();
+  opts.edit_as = -1;
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), &opts, &id), kInvalidArgument);
+  opts = Defaults();
+  opts.width_emu = -1;
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), &opts, &id), kInvalidArgument);
+  size_t count = 99;
+  ASSERT_EQ(fm_sheet_drawing_object_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 0U);
+}
+
+TEST(FormulonCApiDrawing, XlsbRetainedDrawingRefusesInsert) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const std::string drawing =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\r\n"
+      "<xdr:wsDr xmlns:xdr=\"http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing\"></xdr:wsDr>";
+  formulon::Workbook& model = wb.handle->workbook();
+  ASSERT_TRUE(static_cast<bool>(model.add_passthrough_part(
+      formulon::PassthroughPart(kDrawingPath, "application/vnd.openxmlformats-officedocument.drawing+xml",
+                                Bytes(drawing.begin(), drawing.end())))));
+  model.sheet(0).set_unknown_relationships({formulon::UnknownRelationship{"rId1", kRelDrawing, kDrawingPath, false}});
+  const Bytes png = Png(4, 4);
+  fm_image_insert opts = Defaults();
+  uint32_t id = 0;
+  EXPECT_EQ(fm_sheet_insert_image(wb.handle, 0, png.data(), png.size(), &opts, &id), kIoDrawingUnparseable);
+  EXPECT_EQ(fm_sheet_remove_image(wb.handle, 0, 2), kIoDrawingUnparseable);
+  EXPECT_EQ(model.passthrough_parts().size(), 1U);
+}
+
+}  // namespace
diff --git a/tests/c_api/formulon_c_header_compile.c b/tests/c_api/formulon_c_header_compile.c
index 59157fa15..8b1279c48 100644
--- a/tests/c_api/formulon_c_header_compile.c
+++ b/tests/c_api/formulon_c_header_compile.c
@@ -48,8 +48,9 @@ int main(void) {
   _Static_assert(sizeof(fm_save_diagnostics_t) == 5 * sizeof(uint32_t), "fm_save_diagnostics_t must be packed");
   // Pinned from C as well as C++: a C consumer built against a narrower
   // definition of either record is miscompiled rather than diagnosed.
-  _Static_assert(sizeof(fm_cell_xf) == 88, "fm_cell_xf ABI layout changed");
-  _Static_assert(sizeof(fm_sheet_view_t) == (sizeof(void*) == 4 ? 40 : 48), "fm_sheet_view_t ABI layout changed");
+  _Static_assert(sizeof(fm_cell_xf) == 128, "fm_cell_xf ABI layout changed");
+  _Static_assert(sizeof(fm_row_layout_t) == 40, "fm_row_layout_t ABI layout changed");
+  _Static_assert(sizeof(fm_sheet_view_t) == (sizeof(void*) == 4 ? 44 : 48), "fm_sheet_view_t ABI layout changed");
   // The three records a C consumer marshals without help from any binding:
   // `fm_value_t` comes back from every cell read, `fm_print_range_t` from
   // pagination, and `fm_styles_batch` is passed in by pointer with fifteen
@@ -62,6 +63,62 @@ int main(void) {
   _Static_assert(sizeof(fm_styles_batch) == 15 * sizeof(void*), "fm_styles_batch ABI layout changed");
   _Static_assert(offsetof(fm_styles_batch, num_fmt_ids) == 14 * sizeof(void*),
                  "fm_styles_batch.num_fmt_ids offset changed");
+  // Records the geometry, display and pagination-detail entry points write
+  // through caller pointers. All but the width model are target-independent.
+  _Static_assert(sizeof(fm_sheet_format_defaults) == 32, "fm_sheet_format_defaults ABI layout changed");
+  _Static_assert(sizeof(fm_rect_pt) == 32, "fm_rect_pt ABI layout changed");
+  _Static_assert(sizeof(fm_width_model) == (sizeof(void*) == 4 ? 40 : 48), "fm_width_model ABI layout changed");
+  _Static_assert(sizeof(fm_paper_info) == 24, "fm_paper_info ABI layout changed");
+  _Static_assert(sizeof(fm_margins_pt) == 48, "fm_margins_pt ABI layout changed");
+  _Static_assert(sizeof(fm_print_titles) == 24, "fm_print_titles ABI layout changed");
+  _Static_assert(sizeof(fm_page_layout) == 56, "fm_page_layout ABI layout changed");
+  fm_status_t (*cells_in_range)(const fm_workbook_t*, size_t, uint32_t, uint32_t, uint32_t, uint32_t, uint64_t,
+                                uint32_t, fm_cell_range_t**) = fm_sheet_cells_in_range;
+  fm_status_t (*format_value)(const fm_workbook_t*, const fm_value_t*, const char*, const char**, int32_t*) =
+      fm_workbook_format_value;
+  // Records the AutoFilter, validation and threaded-comment entry points read
+  // and write. The pointer-bearing ones are pinned per target.
+  _Static_assert(sizeof(fm_date_group_item) == 8, "fm_date_group_item ABI layout changed");
+  _Static_assert(sizeof(fm_filter_column) == (sizeof(void*) == 4 ? 152 : 192), "fm_filter_column ABI layout changed");
+  _Static_assert(sizeof(fm_sort_condition) == (sizeof(void*) == 4 ? 48 : 56), "fm_sort_condition ABI layout changed");
+  _Static_assert(sizeof(fm_auto_filter) == (sizeof(void*) == 4 ? 64 : 80), "fm_auto_filter ABI layout changed");
+  _Static_assert(sizeof(fm_validation_outcome) == 16, "fm_validation_outcome ABI layout changed");
+  _Static_assert(sizeof(fm_mention) == (sizeof(void*) == 4 ? 16 : 24), "fm_mention ABI layout changed");
+  _Static_assert(sizeof(fm_threaded_comment) == (sizeof(void*) == 4 ? 40 : 72),
+                 "fm_threaded_comment ABI layout changed");
+  _Static_assert(sizeof(fm_person) == 4 * sizeof(void*), "fm_person ABI layout changed");
+  _Static_assert(sizeof(fm_image_info) == 12, "fm_image_info ABI layout changed");
+  _Static_assert(sizeof(fm_drawing_object) == (sizeof(void*) == 4 ? 96 : 112), "fm_drawing_object ABI layout changed");
+  _Static_assert(sizeof(fm_image_insert) == (sizeof(void*) == 4 ? 56 : 64), "fm_image_insert ABI layout changed");
+  fm_status_t (*get_auto_filter)(const fm_workbook_t*, size_t, fm_auto_filter*, int32_t*) = fm_sheet_get_auto_filter;
+  fm_status_t (*set_table_auto_filter)(fm_workbook_t*, size_t, const fm_auto_filter*) = fm_table_set_auto_filter;
+  fm_status_t (*evaluate_auto_filter)(const fm_workbook_t*, size_t, uint8_t*, size_t, size_t*, uint32_t*) =
+      fm_sheet_evaluate_auto_filter;
+  fm_status_t (*validate_value)(const fm_workbook_t*, size_t, uint32_t, uint32_t, const fm_value_t*,
+                                fm_validation_outcome*) = fm_sheet_validate_value;
+  fm_status_t (*list_invalid_cells)(const fm_workbook_t*, size_t, uint64_t, uint32_t, fm_cell_range_t**) =
+      fm_sheet_list_invalid_cells;
+  fm_status_t (*add_threaded_comment)(fm_workbook_t*, size_t, const fm_threaded_comment*) =
+      fm_sheet_add_threaded_comment;
+  fm_status_t (*edit_threaded_comment)(fm_workbook_t*, size_t, const char*, const char*, const fm_mention*, uint32_t) =
+      fm_sheet_edit_threaded_comment;
+  fm_status_t (*person_at)(const fm_workbook_t*, size_t, fm_person*) = fm_workbook_person_at;
+  fm_status_t (*insert_image)(fm_workbook_t*, size_t, const uint8_t*, size_t, const fm_image_insert*, uint32_t*) =
+      fm_sheet_insert_image;
+  fm_status_t (*get_image)(const fm_workbook_t*, size_t, uint32_t, const uint8_t**, size_t*, fm_image_info*) =
+      fm_sheet_get_image;
+  (void)cells_in_range;
+  (void)format_value;
+  (void)get_auto_filter;
+  (void)set_table_auto_filter;
+  (void)evaluate_auto_filter;
+  (void)validate_value;
+  (void)list_invalid_cells;
+  (void)add_threaded_comment;
+  (void)edit_threaded_comment;
+  (void)person_at;
+  (void)insert_image;
+  (void)get_image;
   (void)save_diagnostics;
   (void)read_diagnostics;
   (void)save_as;
diff --git a/tests/c_api/formulon_c_named_styles_test.cpp b/tests/c_api/formulon_c_named_styles_test.cpp
index c6871e8f2..51a0164a4 100644
--- a/tests/c_api/formulon_c_named_styles_test.cpp
+++ b/tests/c_api/formulon_c_named_styles_test.cpp
@@ -7,6 +7,7 @@
 // behaviour.
 
 #include <cstdint>
+#include <cstring>
 
 #include "c_api/formulon_c.h"
 #include "gtest/gtest.h"
@@ -14,6 +15,12 @@
 
 namespace {
 
+static_assert(sizeof(fm_cell_style_record_t) == (sizeof(void*) == 4U ? 24U : 32U),
+              "fm_cell_style_record_t ABI layout changed");
+
+constexpr fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+constexpr fm_status_t kNullPointer = static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer);
+
 struct WorkbookGuard {
   fm_workbook_t* handle = nullptr;
   ~WorkbookGuard() { fm_workbook_destroy(handle); }
@@ -22,6 +29,43 @@ struct WorkbookGuard {
   WorkbookGuard& operator=(const WorkbookGuard&) = delete;
 };
 
+fm_cell_style_record_t StyleRecord(const char* name, uint32_t xf_id, uint32_t builtin_id) {
+  fm_cell_style_record_t record{};
+  record.name = name;
+  record.xf_id = xf_id;
+  record.builtin_id = builtin_id;
+  return record;
+}
+
+/// Returns the index of the named style, or `UINT32_MAX` when absent.
+uint32_t FindStyle(fm_workbook_t* wb, const char* name, fm_cell_style_record_t* out) {
+  uint32_t count = 0;
+  EXPECT_EQ(fm_styles_get_cell_style_count(wb, &count), 0);
+  for (uint32_t i = 0; i < count; ++i) {
+    EXPECT_EQ(fm_styles_get_cell_style(wb, i, out), 0);
+    if (std::strcmp(out->name, name) == 0) {
+      return i;
+    }
+  }
+  return UINT32_MAX;
+}
+
+/// Adds a named-style xf distinct from Normal's (a bold font and a date format).
+uint32_t AddBoldDateStyleXf(fm_workbook_t* wb, uint32_t* out_font) {
+  fm_font_record font{};
+  font.name = "Calibri";
+  font.size = 11.0;
+  font.bold = 1;
+  font.has_bold = 1;
+  EXPECT_EQ(fm_styles_add_font(wb, font, out_font), 0);
+  fm_cell_xf xf{};
+  xf.font_index = *out_font;
+  xf.num_fmt_id = 14;
+  uint32_t xf_id = 0;
+  EXPECT_EQ(fm_styles_add_cell_style_xf(wb, xf, &xf_id), 0);
+  return xf_id;
+}
+
 }  // namespace
 
 TEST(FormulonCApiNamedStyles, FreshWorkbookHasSeededNormalStyle) {
@@ -130,3 +174,174 @@ TEST(FormulonCApiNamedStyles, RoundTripPreservesSeededNamedStyles) {
   EXPECT_EQ(normal_xf.vertical_align, 2U);
   EXPECT_EQ(normal_xf.wrap_text, 0);
 }
+
+TEST(FormulonCApiNamedStyles, BuiltinId53RoundTrips) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t font = 0;
+  const uint32_t xf_id = AddBoldDateStyleXf(wb.handle, &font);
+  const fm_cell_style_record_t record = StyleRecord("Explanatory Text", xf_id, 53U);
+  ASSERT_EQ(fm_styles_set_cell_style(wb.handle, &record), 0);
+
+  uint8_t* saved_data = nullptr;
+  size_t saved_len = 0;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved_data, &saved_len), 0);
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(saved_data, saved_len, &loaded.handle), 0);
+  fm_buffer_free(saved_data);
+
+  fm_cell_style_record_t reread{};
+  ASSERT_NE(FindStyle(loaded.handle, "Explanatory Text", &reread), UINT32_MAX);
+  EXPECT_EQ(reread.builtin_id, 53U);
+}
+
+TEST(FormulonCApiNamedStyles, SetCellStyleCarriesEveryFieldAndReplacesByName) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t font = 0;
+  const uint32_t xf_id = AddBoldDateStyleXf(wb.handle, &font);
+  fm_cell_style_record_t record = StyleRecord("RowLevel_4", xf_id, 1U);
+  record.i_level = 3;
+  record.hidden = 1;
+  record.custom_builtin = 1;
+  ASSERT_EQ(fm_styles_set_cell_style(wb.handle, &record), 0);
+
+  uint8_t* saved_data = nullptr;
+  size_t saved_len = 0;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved_data, &saved_len), 0);
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(saved_data, saved_len, &loaded.handle), 0);
+  fm_buffer_free(saved_data);
+  fm_cell_style_record_t reread{};
+  ASSERT_NE(FindStyle(loaded.handle, "RowLevel_4", &reread), UINT32_MAX);
+  EXPECT_EQ(reread.xf_id, xf_id);
+  EXPECT_EQ(reread.builtin_id, 1U);
+  EXPECT_EQ(reread.i_level, 3U);
+  EXPECT_EQ(reread.hidden, 1);
+  EXPECT_EQ(reread.custom_builtin, 1);
+
+  // Setting the same name again overwrites every field instead of appending.
+  uint32_t before = 0;
+  ASSERT_EQ(fm_styles_get_cell_style_count(wb.handle, &before), 0);
+  const fm_cell_style_record_t replacement = StyleRecord("RowLevel_4", 0U, FM_CELL_STYLE_BUILTIN_ID_NONE);
+  ASSERT_EQ(fm_styles_set_cell_style(wb.handle, &replacement), 0);
+  uint32_t after = 0;
+  ASSERT_EQ(fm_styles_get_cell_style_count(wb.handle, &after), 0);
+  EXPECT_EQ(after, before);
+  ASSERT_NE(FindStyle(wb.handle, "RowLevel_4", &reread), UINT32_MAX);
+  EXPECT_EQ(reread.xf_id, 0U);
+  EXPECT_EQ(reread.builtin_id, FM_CELL_STYLE_BUILTIN_ID_NONE);
+  EXPECT_EQ(reread.i_level, 0U);
+  EXPECT_EQ(reread.hidden, 0);
+  EXPECT_EQ(reread.custom_builtin, 0);
+}
+
+TEST(FormulonCApiNamedStyles, SetCellStyleRejectsInvalidRecords) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_style_record_t record = StyleRecord("Styled", 0U, FM_CELL_STYLE_BUILTIN_ID_NONE);
+  EXPECT_EQ(fm_styles_set_cell_style(nullptr, &record), kNullPointer);
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, nullptr), kNullPointer);
+  record.name = nullptr;
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &record), kNullPointer);
+  record.name = "";
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &record), kInvalidArgument);
+
+  record = StyleRecord("Styled", 1U, FM_CELL_STYLE_BUILTIN_ID_NONE);
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &record), kInvalidArgument);
+  record = StyleRecord("Styled", 0U, 54U);
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &record), kInvalidArgument);
+
+  // An outline level belongs to RowLevel_n / ColLevel_n only, and stops at 6.
+  record = StyleRecord("ColLevel_7", 0U, 2U);
+  record.i_level = 6;
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &record), 0);
+  record.i_level = 7;
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &record), kInvalidArgument);
+  record = StyleRecord("Heading 1", 0U, 16U);
+  record.i_level = 1;
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &record), kInvalidArgument);
+  record.i_level = 0;
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &record), 0);
+}
+
+TEST(FormulonCApiNamedStyles, RemoveCellStyleRepointsXfs) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t bold = 0;
+  const uint32_t xf_id = AddBoldDateStyleXf(wb.handle, &bold);
+  const fm_cell_style_record_t record = StyleRecord("Dated", xf_id, FM_CELL_STYLE_BUILTIN_ID_NONE);
+  ASSERT_EQ(fm_styles_set_cell_style(wb.handle, &record), 0);
+
+  // The font is the cell's own (apply_font); the number format is inherited.
+  fm_cell_xf cell_xf{};
+  cell_xf.xf_id = xf_id;
+  cell_xf.font_index = bold;
+  cell_xf.num_fmt_id = 14;
+  cell_xf.apply_font = 1;
+  uint32_t cell_xf_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, cell_xf, &cell_xf_index), 0);
+
+  uint32_t xf_count = 0;
+  uint32_t style_xf_count = 0;
+  uint32_t style_count = 0;
+  ASSERT_EQ(fm_styles_get_cell_xf_count(wb.handle, &xf_count), 0);
+  ASSERT_EQ(fm_styles_get_cell_style_xf_count(wb.handle, &style_xf_count), 0);
+  ASSERT_EQ(fm_styles_get_cell_style_count(wb.handle, &style_count), 0);
+
+  ASSERT_EQ(fm_styles_remove_cell_style(wb.handle, "Dated"), 0);
+
+  fm_cell_xf reread{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, cell_xf_index, &reread), 0);
+  EXPECT_EQ(reread.xf_id, 0U);
+  EXPECT_EQ(reread.font_index, bold);
+  EXPECT_EQ(reread.num_fmt_id, 0U);
+  EXPECT_EQ(reread.apply_font, 1);
+  EXPECT_EQ(reread.apply_number_format, 0);
+
+  // Neither xf table is compacted; only the cellStyle record is gone.
+  uint32_t count = 0;
+  ASSERT_EQ(fm_styles_get_cell_xf_count(wb.handle, &count), 0);
+  EXPECT_EQ(count, xf_count);
+  ASSERT_EQ(fm_styles_get_cell_style_xf_count(wb.handle, &count), 0);
+  EXPECT_EQ(count, style_xf_count);
+  ASSERT_EQ(fm_styles_get_cell_style_count(wb.handle, &count), 0);
+  EXPECT_EQ(count, style_count - 1U);
+  fm_cell_style_record_t found{};
+  EXPECT_EQ(FindStyle(wb.handle, "Dated", &found), UINT32_MAX);
+}
+
+TEST(FormulonCApiNamedStyles, RemoveCellStyleKeepsXfsOfASharedStyleXf) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t bold = 0;
+  const uint32_t xf_id = AddBoldDateStyleXf(wb.handle, &bold);
+  const fm_cell_style_record_t first = StyleRecord("First", xf_id, FM_CELL_STYLE_BUILTIN_ID_NONE);
+  const fm_cell_style_record_t second = StyleRecord("Second", xf_id, FM_CELL_STYLE_BUILTIN_ID_NONE);
+  ASSERT_EQ(fm_styles_set_cell_style(wb.handle, &first), 0);
+  ASSERT_EQ(fm_styles_set_cell_style(wb.handle, &second), 0);
+  fm_cell_xf cell_xf{};
+  cell_xf.xf_id = xf_id;
+  cell_xf.font_index = bold;
+  cell_xf.num_fmt_id = 14;
+  uint32_t cell_xf_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, cell_xf, &cell_xf_index), 0);
+
+  ASSERT_EQ(fm_styles_remove_cell_style(wb.handle, "First"), 0);
+  fm_cell_xf reread{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, cell_xf_index, &reread), 0);
+  EXPECT_EQ(reread.xf_id, xf_id);
+  EXPECT_EQ(reread.num_fmt_id, 14U);
+}
+
+TEST(FormulonCApiNamedStyles, RemoveCellStyleRejectsNormalAndUnknownNames) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  EXPECT_EQ(fm_styles_remove_cell_style(wb.handle, "Normal"), kInvalidArgument);
+  EXPECT_EQ(fm_styles_remove_cell_style(wb.handle, "Missing"), kInvalidArgument);
+  EXPECT_EQ(fm_styles_remove_cell_style(nullptr, "Normal"), kNullPointer);
+  EXPECT_EQ(fm_styles_remove_cell_style(wb.handle, nullptr), kNullPointer);
+  uint32_t count = 0;
+  ASSERT_EQ(fm_styles_get_cell_style_count(wb.handle, &count), 0);
+  EXPECT_EQ(count, 1U);
+}
diff --git a/tests/c_api/formulon_c_pivot_authoring_test.cpp b/tests/c_api/formulon_c_pivot_authoring_test.cpp
new file mode 100644
index 000000000..a900cf872
--- /dev/null
+++ b/tests/c_api/formulon_c_pivot_authoring_test.cpp
@@ -0,0 +1,718 @@
+// Stable C ABI PivotTable authoring and cache tests.
+
+#include <iterator>
+#include <limits>
+
+#include "formulon_c_pivot_test_helpers.h"
+#include "utils/date_time.h"
+
+TEST(FormulonCApiPivot, CreatePivotFromScratch) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  std::size_t cache_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_count(wb.handle, &cache_count), 0);
+  EXPECT_EQ(cache_count, 1U);
+
+  std::size_t pivot_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 0, &pivot_count), 0);
+  EXPECT_EQ(pivot_count, 1U);
+
+  std::size_t records = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_record_count(wb.handle, cache_id, &records), 0);
+  EXPECT_EQ(records, 4U);
+
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+
+  const std::vector<fm_pivot_cell_t> cells = CollectCells(projected.handle);
+  ASSERT_FALSE(cells.empty());
+
+  // North (regions 0, 2) sum = 400; South (regions 1, 3) sum = 600.
+  // Grand total = 1000.
+  bool saw_north = false;
+  bool saw_south = false;
+  bool saw_grand = false;
+  for (const fm_pivot_cell_t& c : cells) {
+    if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER) {
+      if (c.value.u.number == 400.0) {
+        saw_north = true;
+      } else if (c.value.u.number == 600.0) {
+        saw_south = true;
+      }
+    }
+    if (c.kind == FM_PIVOT_CELL_GRAND_TOTAL && c.value.kind == FM_VAL_NUMBER && c.value.u.number == 1000.0) {
+      saw_grand = true;
+    }
+  }
+  EXPECT_TRUE(saw_north);
+  EXPECT_TRUE(saw_south);
+  EXPECT_TRUE(saw_grand);
+}
+
+TEST(FormulonCApiPivot, SaveRejectsAPivotCacheWithNoWorksheetSource) {
+  // The failure this replaces was silent: the package saved, validated
+  // against the schema, and round-tripped through our own reader, and only
+  // Excel -- offering to repair it -- ever said otherwise. A host has no
+  // way to discover that from the API, so the save has to say it.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, /*present=*/0, nullptr, nullptr, nullptr),
+            0)
+      << fm_last_error_message();
+
+  BufferGuard saved;
+  EXPECT_NE(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << "a cache with no source must not save silently";
+  EXPECT_NE(std::string(fm_last_error_message()).find("worksheet source"), std::string::npos)
+      << "message must name what is missing: " << fm_last_error_message();
+
+  // Restoring the source makes the same workbook savable again, so the
+  // check is about the cache's state and not about some other damage.
+  ASSERT_EQ(
+      fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, /*present=*/1, "A1:B5", "Sheet1", nullptr), 0);
+  BufferGuard retry;
+  EXPECT_EQ(fm_workbook_save(wb.handle, &retry.data, &retry.len), 0) << fm_last_error_message();
+}
+
+TEST(FormulonCApiPivot, SavedScratchPivotEmitsLocationRequiredDefaults) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  ASSERT_EQ(fm_workbook_pivot_set_anchor(wb.handle, 0, pivot_idx, 0U, 3U, 5U, 2U), 0) << fm_last_error_message();
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
+  const std::vector<std::uint8_t> package(saved.data, saved.data + saved.len);
+  const std::string pivot_xml = ExtractZipEntry(package, "xl/pivotTables/pivotTable1.xml");
+  ASSERT_FALSE(pivot_xml.empty());
+  EXPECT_NE(pivot_xml.find("<location ref=\"D1:E5\" firstHeaderRow=\"1\" firstDataRow=\"1\" firstDataCol=\"1\"/>"),
+            std::string::npos)
+      << "xml=" << pivot_xml;
+}
+
+TEST(FormulonCApiPivot, SavedPivotLocationRefCoversTheProjectedGrid) {
+  // `fm_workbook_pivot_create` installs a 1x1 placeholder span and nothing
+  // revises it as fields are added, so a pivot built purely through the C
+  // surface used to save a `ref` describing a single cell. Excel opens such
+  // a file cleanly and recognises the pivot, then terminates the moment the
+  // report is refreshed -- the defect is invisible to a round trip and has
+  // to be pinned on the emitted bytes.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  // Deliberately no `fm_workbook_pivot_set_anchor`: this is the path a host
+  // takes when it never reasons about the report's extent at all.
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+  std::uint32_t top = 0;
+  std::uint32_t left = 0;
+  std::uint32_t rows = 0;
+  std::uint32_t cols = 0;
+  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
+  ASSERT_GT(rows, 1U) << "projection must be larger than the placeholder for this test to mean anything";
+  ASSERT_GT(cols, 1U);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
+  const std::vector<std::uint8_t> package(saved.data, saved.data + saved.len);
+  const std::string pivot_xml = ExtractZipEntry(package, "xl/pivotTables/pivotTable1.xml");
+  ASSERT_FALSE(pivot_xml.empty());
+
+  // Anchored at D1, projected 4 rows x 2 cols -> D1:E4.
+  EXPECT_NE(pivot_xml.find("<location ref=\"D1:E4\""), std::string::npos) << "xml=" << pivot_xml;
+  EXPECT_EQ(pivot_xml.find("<location ref=\"D1:D1\""), std::string::npos) << "xml=" << pivot_xml;
+}
+
+TEST(FormulonCApiPivot, PivotCacheMutationInvalidatesMemoisedLayout) {
+  // fm_workbook_pivot_layout memoises the pivot's evaluated result. A cache
+  // mutation must invalidate that memo so a re-layout reflects the change
+  // instead of returning the stale projection.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  auto has_data_value = [](fm_pivot_cells_t* handle, double want) -> bool {
+    for (const fm_pivot_cell_t& c : CollectCells(handle)) {
+      if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER && c.value.u.number == want) {
+        return true;
+      }
+    }
+    return false;
+  };
+
+  // Baseline: North (records 0, 2 = 100 + 300) sums to 400.
+  {
+    PivotCellsGuard projected;
+    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+    EXPECT_TRUE(has_data_value(projected.handle, 400.0));
+  }
+
+  // Bump record 0's amount (field index 1) from 100 to 1100 (+1000).
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, 1, 1100.0), 0) << fm_last_error_message();
+
+  // Re-layout must reflect the mutated cache: North is now 1100 + 300 = 1400,
+  // and the stale 400 must be gone.
+  {
+    PivotCellsGuard projected;
+    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+    EXPECT_TRUE(has_data_value(projected.handle, 1400.0)) << "layout returned a stale memoised projection";
+    EXPECT_FALSE(has_data_value(projected.handle, 400.0)) << "stale North value survived the cache mutation";
+  }
+}
+
+TEST(FormulonCApiPivot, PivotMutationsInvalidateGetPivotDataFormula) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  // A1 is outside the report at D1, so this exercises the normal formula
+  // dependency path rather than reading a projected pivot cell directly.
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=GETPIVOTDATA(\"Sum of Amount\",D1,\"Region\",\"North\")"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  auto get_a1 = [&]() {
+    fm_value_t value{};
+    EXPECT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &value), 0);
+    return value;
+  };
+  fm_value_t value = get_a1();
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 400.0);
+
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, 1, 1100.0), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+  value = get_a1();
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 1400.0);
+
+  fm_pivot_data_field_spec_t average_spec{};
+  average_spec.name = "Sum of Amount";
+  average_spec.field_index = 1U;
+  average_spec.aggregation = FM_PIVOT_AGG_AVERAGE;
+  average_spec.number_format = "";
+  average_spec.show_as = FM_PIVOT_SHOW_AS_NORMAL;
+  average_spec.show_as_base_field = -1;
+  average_spec.show_as_base_item = -1;
+  ASSERT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &average_spec), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+  value = get_a1();
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 700.0);
+
+  // Keeping this formula's result warm before removal proves that the
+  // successful lifecycle mutation itself dirties formula cells.
+  ASSERT_EQ(fm_workbook_pivot_remove(wb.handle, 0, pivot_idx), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+  value = get_a1();
+  ASSERT_EQ(value.kind, FM_VAL_ERROR);
+  EXPECT_EQ(value.u.error_code, static_cast<std::int32_t>(formulon::ErrorCode::Ref));
+}
+
+TEST(FormulonCApiPivot, LoadedPivotCacheMutationReprojectsAuthoredLocation) {
+  WorkbookGuard original;
+  ASSERT_EQ(fm_workbook_create(&original.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(original.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(original.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
+
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &loaded.handle), 0) << fm_last_error_message();
+  EXPECT_NE(SavedPivotXml(loaded.handle).find("<location ref=\"D1:E4\""), std::string::npos);
+
+  // The loaded location is marked authored. Add a new shared item and record
+  // so the evaluated report grows by one row; saving must then use the new
+  // projected extent instead of preserving the stale authored ref.
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_text(loaded.handle, cache_id, 0, "West"), 0)
+      << fm_last_error_message();
+  std::size_t new_record = 99;
+  ASSERT_EQ(fm_workbook_pivot_cache_record_add(loaded.handle, cache_id, &new_record), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(loaded.handle, cache_id, new_record, 0, 2.0), 0)
+      << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(loaded.handle, cache_id, new_record, 1, 500.0), 0)
+      << fm_last_error_message();
+
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(loaded.handle, 0, 0, &projected.handle), 0) << fm_last_error_message();
+  std::uint32_t top = 0;
+  std::uint32_t left = 0;
+  std::uint32_t rows = 0;
+  std::uint32_t cols = 0;
+  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
+  EXPECT_EQ(top, 0U);
+  EXPECT_EQ(left, 3U);
+  EXPECT_EQ(rows, 5U);
+  EXPECT_EQ(cols, 2U);
+
+  const std::string pivot_xml = SavedPivotXml(loaded.handle);
+  EXPECT_NE(pivot_xml.find("<location ref=\"D1:E5\""), std::string::npos) << pivot_xml;
+}
+
+TEST(FormulonCApiPivot, PivotCacheSharedItemsAcceptErrorValues) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  std::size_t count = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_field_shared_item_count(wb.handle, cache_id, 0, &count), 0);
+  EXPECT_EQ(count, 2U);
+
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_error(wb.handle, cache_id, 0,
+                                                                1),  // ErrorCode::Div0
+            0)
+      << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_pivot_cache_field_shared_item_count(wb.handle, cache_id, 0, &count), 0);
+  EXPECT_EQ(count, 3U);
+}
+
+TEST(FormulonCApiPivot, PivotCacheSharedItemIndexToleratesOutOfDomainNumbers) {
+  // `BuildScratchPivot` leaves `cell_is_index` empty, so "Region" (field 0)
+  // reads its numeric cells as indices into its two shared items. The record
+  // setter accepts any double, so the layout below is the point where an
+  // out-of-domain index would be narrowed. It must resolve to a blank label
+  // rather than reading past the shared items or trapping the instance.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  const double bad_indices[] = {
+      std::numeric_limits<double>::quiet_NaN(),
+      std::numeric_limits<double>::infinity(),
+      -std::numeric_limits<double>::infinity(),
+      -1.0,
+      1e30,
+      4.3e9,  // Past the wasm32 `size_t` range.
+      2.0,    // One past the last shared item.
+  };
+  for (const double bad : bad_indices) {
+    ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, 0, bad), 0) << fm_last_error_message();
+    PivotCellsGuard projected;
+    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+    EXPECT_FALSE(CollectCells(projected.handle).empty());
+  }
+
+  // A valid index still resolves after all of that.
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, 0, 0.0), 0) << fm_last_error_message();
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+  bool saw_north_total = false;
+  for (const fm_pivot_cell_t& c : CollectCells(projected.handle)) {
+    if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER && c.value.u.number == 400.0) {
+      saw_north_total = true;
+    }
+  }
+  EXPECT_TRUE(saw_north_total);
+}
+
+TEST(FormulonCApiPivot, PivotCacheWorksheetSourceRoundTripsThroughApi) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  int32_t present = -1;
+  const char* ref = nullptr;
+  const char* sheet = nullptr;
+  const char* name = nullptr;
+  // `BuildScratchPivot` installs a source because a cache without one
+  // cannot be saved. Clear it here so the absent state this test is about
+  // is established by the test rather than inherited from the helper.
+  ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, 0, nullptr, nullptr, nullptr), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_get_worksheet_source(wb.handle, cache_id, &present, &ref, &sheet, &name), 0);
+  EXPECT_EQ(present, 0);
+  EXPECT_STREQ(ref, "");
+  EXPECT_STREQ(sheet, "");
+  EXPECT_STREQ(name, "");
+
+  ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, 1, "$A$1:$C$5", "Data", nullptr), 0)
+      << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_pivot_cache_get_worksheet_source(wb.handle, cache_id, &present, &ref, &sheet, &name), 0);
+  EXPECT_EQ(present, 1);
+  EXPECT_STREQ(ref, "$A$1:$C$5");
+  EXPECT_STREQ(sheet, "Data");
+  EXPECT_STREQ(name, "");
+
+  ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, 0, "ignored", "ignored", "ignored"), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_get_worksheet_source(wb.handle, cache_id, &present, &ref, &sheet, &name), 0);
+  EXPECT_EQ(present, 0);
+  EXPECT_STREQ(ref, "");
+  EXPECT_STREQ(sheet, "");
+  EXPECT_STREQ(name, "");
+}
+
+TEST(FormulonCApiPivot, PivotReportLayoutRoundTripsThroughApi) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_layout_t layout = FM_PIVOT_LAYOUT_TABULAR;
+  ASSERT_EQ(fm_workbook_pivot_get_layout(wb.handle, 0, pivot_idx, &layout), 0);
+  EXPECT_EQ(layout, FM_PIVOT_LAYOUT_COMPACT);
+
+  ASSERT_EQ(fm_workbook_pivot_set_layout(wb.handle, 0, pivot_idx, FM_PIVOT_LAYOUT_TABULAR), 0);
+  ASSERT_EQ(fm_workbook_pivot_get_layout(wb.handle, 0, pivot_idx, &layout), 0);
+  EXPECT_EQ(layout, FM_PIVOT_LAYOUT_TABULAR);
+
+  ASSERT_EQ(fm_workbook_pivot_set_layout(wb.handle, 0, pivot_idx, FM_PIVOT_LAYOUT_OUTLINE), 0);
+  ASSERT_EQ(fm_workbook_pivot_get_layout(wb.handle, 0, pivot_idx, &layout), 0);
+  EXPECT_EQ(layout, FM_PIVOT_LAYOUT_OUTLINE);
+
+  // The setter accepts a raw int32_t so FFI callers can probe the complete
+  // invalid domain without constructing an out-of-domain C enum.
+  const std::int32_t invalid_layouts[] = {
+      99,
+      std::numeric_limits<std::int32_t>::min(),
+      std::numeric_limits<std::int32_t>::max(),
+  };
+  for (const std::int32_t raw : invalid_layouts) {
+    EXPECT_EQ(fm_workbook_pivot_set_layout(wb.handle, 0, pivot_idx, raw),
+              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument))
+        << raw;
+  }
+}
+
+TEST(FormulonCApiPivot, ScalarEnumMutatorsRejectRawValuesWithoutMutation) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  BufferGuard before;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &before.data, &before.len), 0) << fm_last_error_message();
+  const std::vector<std::uint8_t> snapshot(before.data, before.data + before.len);
+  const std::int32_t invalid[] = {99, std::numeric_limits<std::int32_t>::min(),
+                                  std::numeric_limits<std::int32_t>::max()};
+  const fm_status_t expected = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  for (const std::int32_t raw : invalid) {
+    EXPECT_EQ(fm_workbook_pivot_field_set_axis(wb.handle, 0, pivot_idx, 0, raw), expected) << raw;
+    EXPECT_EQ(fm_workbook_pivot_field_add_subtotal_fn(wb.handle, 0, pivot_idx, 0, raw), expected) << raw;
+    EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, raw, 0, -1, -1, 1, -1.0, -1.0),
+              expected)
+        << raw;
+    EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, 3, raw, -1, -1, 1, -1.0, -1.0),
+              expected)
+        << raw;
+  }
+
+  BufferGuard after;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &after.data, &after.len), 0) << fm_last_error_message();
+  EXPECT_EQ(std::vector<std::uint8_t>(after.data, after.data + after.len), snapshot);
+}
+
+TEST(FormulonCApiPivot, DateGroupRejectsZeroIntervalAndInvertedWindowWithoutMutation) {
+  // FM_PIVOT_DATE_DAYS-only validation: a zero interval and an explicit
+  // Start past an explicit End are both nonsensical groupings, so
+  // neither may reach the model.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  BufferGuard before;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &before.data, &before.len), 0) << fm_last_error_message();
+  const std::vector<std::uint8_t> snapshot(before.data, before.data + before.len);
+  const fm_status_t expected = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+
+  // interval_days == 0.
+  EXPECT_EQ(
+      fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, FM_PIVOT_DATE_DAYS,
+                                             FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, /*interval_days=*/0, -1.0, -1.0),
+      expected);
+  // start_serial_or_neg1 > end_serial_or_neg1 (both explicit).
+  EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, FM_PIVOT_DATE_DAYS,
+                                                   FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, /*interval_days=*/7,
+                                                   /*start_serial=*/61.0, /*end_serial=*/60.0),
+            expected);
+  // Compare the raw values before flooring: 0.9 > 0.1 is still inverted.
+  EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, FM_PIVOT_DATE_DAYS,
+                                                   FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, /*interval_days=*/7,
+                                                   /*start_serial=*/0.9, /*end_serial=*/0.1),
+            expected);
+
+  BufferGuard after;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &after.data, &after.len), 0) << fm_last_error_message();
+  EXPECT_EQ(std::vector<std::uint8_t>(after.data, after.data + after.len), snapshot);
+}
+
+TEST(FormulonCApiPivot, DateGroupRejectsInvalidSerialBoundsWithoutMutation) {
+  const fm_status_t expected = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  for (const bool date1904 : {false, true}) {
+    WorkbookGuard wb;
+    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+    if (date1904) {
+      wb.handle->workbook().set_date1904(true);
+    }
+    std::uint32_t cache_id = 0;
+    std::size_t pivot_idx = 0;
+    const double dates[] = {
+        formulon::date_time::serial_from_ymd(2024, 1U, 1U, date1904),
+        formulon::date_time::serial_from_ymd(2025, 1U, 1U, date1904),
+        formulon::date_time::serial_from_ymd(2024, 6U, 1U, date1904),
+        formulon::date_time::serial_from_ymd(2025, 6U, 1U, date1904),
+    };
+    const double amounts[] = {100.0, 200.0, 300.0, 400.0};
+
+    ASSERT_EQ(fm_workbook_pivot_cache_create(wb.handle, 0, &cache_id), 0) << fm_last_error_message();
+    ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, 1, "A1:B5", "Sheet1", nullptr), 0)
+        << fm_last_error_message();
+    std::size_t date_cache_field = 99;
+    std::size_t amount_cache_field = 99;
+    ASSERT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, "Date", &date_cache_field), 0)
+        << fm_last_error_message();
+    ASSERT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, "Amount", &amount_cache_field), 0)
+        << fm_last_error_message();
+    for (std::size_t record = 0; record < std::size(dates); ++record) {
+      std::size_t record_idx = 99;
+      ASSERT_EQ(fm_workbook_pivot_cache_record_add(wb.handle, cache_id, &record_idx), 0) << fm_last_error_message();
+      ASSERT_EQ(
+          fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, record_idx, date_cache_field, dates[record]),
+          0)
+          << fm_last_error_message();
+      ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, record_idx, amount_cache_field,
+                                                          amounts[record]),
+                0)
+          << fm_last_error_message();
+    }
+
+    ASSERT_EQ(fm_workbook_pivot_create(wb.handle, 0, "PT", cache_id, 0U, 3U, &pivot_idx), 0) << fm_last_error_message();
+    fm_pivot_field_spec_t date_spec{};
+    date_spec.source_name = "Date";
+    date_spec.custom_name = "";
+    date_spec.axis = FM_PIVOT_AXIS_ROW;
+    date_spec.subtotal_top = 0;
+    date_spec.number_format = "";
+    std::size_t date_field = 99;
+    ASSERT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, pivot_idx, &date_spec, &date_field), 0)
+        << fm_last_error_message();
+    const std::uint32_t row_order[] = {static_cast<std::uint32_t>(date_field)};
+    ASSERT_EQ(fm_workbook_pivot_set_row_field_order(wb.handle, 0, pivot_idx, row_order, 1U), 0)
+        << fm_last_error_message();
+    fm_pivot_field_spec_t amount_spec{};
+    amount_spec.source_name = "Amount";
+    amount_spec.custom_name = "";
+    amount_spec.axis = FM_PIVOT_AXIS_VALUE;
+    amount_spec.subtotal_top = 0;
+    amount_spec.number_format = "";
+    std::size_t amount_field = 99;
+    ASSERT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, pivot_idx, &amount_spec, &amount_field), 0)
+        << fm_last_error_message();
+    fm_pivot_data_field_spec_t data_spec{};
+    data_spec.name = "Sum of Amount";
+    data_spec.field_index = static_cast<std::uint32_t>(amount_field);
+    data_spec.aggregation = FM_PIVOT_AGG_SUM;
+    data_spec.number_format = "";
+    data_spec.show_as = FM_PIVOT_SHOW_AS_NORMAL;
+    data_spec.show_as_base_field = -1;
+    data_spec.show_as_base_item = -1;
+    std::size_t data_field = 99;
+    ASSERT_EQ(fm_workbook_pivot_data_field_add(wb.handle, 0, pivot_idx, &data_spec, &data_field), 0)
+        << fm_last_error_message();
+    ASSERT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, date_field, FM_PIVOT_DATE_YEAR,
+                                                     FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, 1, -1.0, -1.0),
+              0)
+        << fm_last_error_message();
+
+    auto has_data_value = [&](fm_pivot_cells_t* cells, double want) {
+      for (const fm_pivot_cell_t& cell : CollectCells(cells)) {
+        if (cell.kind == FM_PIVOT_CELL_DATA && cell.value.kind == FM_VAL_NUMBER && cell.value.u.number == want) {
+          return true;
+        }
+      }
+      return false;
+    };
+    {
+      PivotCellsGuard projected;
+      ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+      EXPECT_TRUE(LayoutHasText(wb.handle, pivot_idx, "2024"));
+      EXPECT_TRUE(LayoutHasText(wb.handle, pivot_idx, "2025"));
+      EXPECT_TRUE(has_data_value(projected.handle, 400.0));
+      EXPECT_TRUE(has_data_value(projected.handle, 600.0));
+    }
+
+    BufferGuard before;
+    ASSERT_EQ(fm_workbook_save(wb.handle, &before.data, &before.len), 0) << fm_last_error_message();
+    const std::vector<std::uint8_t> snapshot(before.data, before.data + before.len);
+    const double last_valid = formulon::date_time::serial_from_ymd(9999, 12U, 31U, date1904);
+    const double invalid[] = {
+        -2.0,
+        -0.1,
+        std::numeric_limits<double>::quiet_NaN(),
+        std::numeric_limits<double>::infinity(),
+        -std::numeric_limits<double>::infinity(),
+        last_valid + 1.0,
+        std::numeric_limits<double>::max(),
+    };
+    for (const double raw : invalid) {
+      EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, date_field, FM_PIVOT_DATE_DAYS,
+                                                       FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, 7, raw, 70.0),
+                expected)
+          << "invalid start=" << raw << " date1904=" << date1904;
+      EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, date_field, FM_PIVOT_DATE_DAYS,
+                                                       FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, 7, 0.0, raw),
+                expected)
+          << "invalid end=" << raw << " date1904=" << date1904;
+    }
+
+    // Force the memoised result through the cache mutation path before
+    // re-evaluating. The successful no-op write also proves the rejected
+    // setters did not leave the field in an invalid state.
+    ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, 1, 100.0), 0)
+        << fm_last_error_message();
+    {
+      PivotCellsGuard projected;
+      ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+      EXPECT_TRUE(LayoutHasText(wb.handle, pivot_idx, "2024"));
+      EXPECT_TRUE(LayoutHasText(wb.handle, pivot_idx, "2025"));
+      EXPECT_TRUE(has_data_value(projected.handle, 400.0));
+      EXPECT_TRUE(has_data_value(projected.handle, 600.0));
+    }
+
+    BufferGuard after;
+    ASSERT_EQ(fm_workbook_save(wb.handle, &after.data, &after.len), 0) << fm_last_error_message();
+    EXPECT_EQ(std::vector<std::uint8_t>(after.data, after.data + after.len), snapshot);
+  }
+}
+
+TEST(FormulonCApiPivot, StructEnumMutatorsRejectRawValuesWithoutMutation) {
+  // The struct-taking twins of the scalar mutators above must enforce the
+  // same domains. Without that, an out-of-domain `axis` collapses onto
+  // `PivotAxis::Row` and an out-of-domain `show_as` onto `Normal`, and
+  // the call reports success on a pivot that means something else.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  BufferGuard before;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &before.data, &before.len), 0) << fm_last_error_message();
+  const std::vector<std::uint8_t> snapshot(before.data, before.data + before.len);
+  const fm_status_t expected = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+
+  fm_pivot_field_spec_t field_spec{};
+  field_spec.source_name = "Region";
+  field_spec.axis = RawEnumValue<fm_pivot_axis_t>(99);
+  std::size_t field_idx = 99U;
+  EXPECT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, pivot_idx, &field_spec, &field_idx), expected);
+
+  fm_pivot_data_field_spec_t df_spec{};
+  df_spec.name = "Total";
+  df_spec.field_index = 1;
+  df_spec.aggregation = RawEnumValue<fm_pivot_aggregation_t>(99);
+  std::size_t df_idx = 99U;
+  EXPECT_EQ(fm_workbook_pivot_data_field_add(wb.handle, 0, pivot_idx, &df_spec, &df_idx), expected);
+  EXPECT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &df_spec), expected);
+
+  df_spec.aggregation = FM_PIVOT_AGG_SUM;
+  df_spec.show_as = RawEnumValue<fm_pivot_show_as_t>(99);
+  EXPECT_EQ(fm_workbook_pivot_data_field_add(wb.handle, 0, pivot_idx, &df_spec, &df_idx), expected);
+  EXPECT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &df_spec), expected);
+
+  BufferGuard after;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &after.data, &after.len), 0) << fm_last_error_message();
+  EXPECT_EQ(std::vector<std::uint8_t>(after.data, after.data + after.len), snapshot);
+}
+
+TEST(FormulonCApiPivot, PivotProjectionUsesWorkbookLocaleAndReportLayout) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  ASSERT_EQ(fm_workbook_pivot_set_layout(wb.handle, 0, pivot_idx, FM_PIVOT_LAYOUT_TABULAR), 0);
+
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+  std::uint32_t top = 0;
+  std::uint32_t left = 0;
+  std::uint32_t rows = 0;
+  std::uint32_t cols = 0;
+  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
+  EXPECT_EQ(cols, 2U);  // Tabular exposes its two row-field columns.
+
+  bool saw_japanese_total = false;
+  const std::size_t cell_count = fm_pivot_cells_count(projected.handle);
+  for (std::size_t i = 0; i < cell_count; ++i) {
+    fm_pivot_cell_t cell{};
+    ASSERT_EQ(fm_pivot_cells_at(projected.handle, i, &cell), 0);
+    if (cell.value.kind == FM_VAL_TEXT && cell.value.u.text != nullptr &&
+        std::string_view(cell.value.u.text) == "総計") {
+      saw_japanese_total = true;
+    }
+  }
+  EXPECT_TRUE(saw_japanese_total);
+}
+
+TEST(FormulonCApiPivot, PivotCacheErrorSettersRejectInvalidErrorCodes) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_error(wb.handle, cache_id, 0, -1),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_error(wb.handle, cache_id, 0, 999),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_error(wb.handle, cache_id, 0, 1, -1),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_error(wb.handle, cache_id, 0, 1, 999),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+}
+
+TEST(FormulonCApiPivot, PivotCacheRecordSettersRejectOutOfRangeFieldIndex) {
+  // BuildScratchPivot declares two cache fields (Region=0, Amount=1), so
+  // field_idx 2 is the first out-of-range value. A large / wrapping field_idx
+  // must be rejected before `grow_record_cells` resizes `field_idx + 1`
+  // cells — otherwise SIZE_MAX wraps to 0 and the subsequent cell write lands
+  // out of bounds.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  const auto kInvalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  const std::size_t kFieldCount = 2;
+  const std::size_t kMax = static_cast<std::size_t>(-1);
+
+  // In-range write still succeeds (guards against an over-tight bound).
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, kFieldCount - 1, 1.0), 0);
+
+  // field_idx == field_count and beyond are rejected on every setter.
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, kFieldCount, 1.0), kInvalid);
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, kMax, 1.0), kInvalid);
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_text(wb.handle, cache_id, 0, kMax, "x"), kInvalid);
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_bool(wb.handle, cache_id, 0, kMax, 1), kInvalid);
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_blank(wb.handle, cache_id, 0, kMax), kInvalid);
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_error(wb.handle, cache_id, 0, kMax, 0), kInvalid);
+}
diff --git a/tests/c_api/formulon_c_pivot_filters_test.cpp b/tests/c_api/formulon_c_pivot_filters_test.cpp
new file mode 100644
index 000000000..61c1831d6
--- /dev/null
+++ b/tests/c_api/formulon_c_pivot_filters_test.cpp
@@ -0,0 +1,565 @@
+// Stable C ABI PivotTable filter tests.
+
+#include "formulon_c_pivot_test_helpers.h"
+
+TEST(FormulonCApiPivot, MutateExistingPivotFilter) {
+  // Build a scratch pivot — the OOXML reader populates only `custom_name`
+  // from `<pivotField name="...">`, while the filter resolver matches on
+  // `source_name`, so a filter applied to a loaded workbook would silently
+  // no-op. Building from scratch lets us exercise the same surface against
+  // a pivot whose `source_name` is set the way the resolver expects.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  // Baseline projection contains "South" because no filter is active.
+  {
+    PivotCellsGuard projected;
+    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0);
+    bool saw_south = false;
+    for (const fm_pivot_cell_t& c : CollectCells(projected.handle)) {
+      if (c.kind == FM_PIVOT_CELL_ROW_LABEL && c.value.kind == FM_VAL_TEXT && c.value.u.text != nullptr &&
+          std::string_view(c.value.u.text) == "South") {
+        saw_south = true;
+      }
+    }
+    EXPECT_TRUE(saw_south);
+  }
+
+  // Add a label filter that only retains "North".
+  fm_pivot_filter_spec_t spec{};
+  spec.axis = FM_PIVOT_AXIS_ROW;
+  spec.field_name = "Region";
+  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
+  spec.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
+  spec.value_text = "N";
+  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), 0) << fm_last_error_message();
+
+  std::size_t filter_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &filter_count), 0);
+  EXPECT_EQ(filter_count, 1U);
+
+  // Re-project — "South" must be dropped.
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0);
+  bool saw_south = false;
+  bool saw_north = false;
+  for (const fm_pivot_cell_t& c : CollectCells(projected.handle)) {
+    if (c.kind == FM_PIVOT_CELL_ROW_LABEL && c.value.kind == FM_VAL_TEXT && c.value.u.text != nullptr) {
+      if (std::string_view(c.value.u.text) == "South") {
+        saw_south = true;
+      }
+      if (std::string_view(c.value.u.text) == "North") {
+        saw_north = true;
+      }
+    }
+  }
+  EXPECT_TRUE(saw_north);
+  EXPECT_FALSE(saw_south);
+
+  // Verify remove_at clears the filter.
+  ASSERT_EQ(fm_workbook_pivot_filter_remove_at(wb.handle, 0, pivot_idx, 0), 0);
+  std::size_t after_count = 99;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &after_count), 0);
+  EXPECT_EQ(after_count, 0U);
+}
+
+TEST(FormulonCApiPivot, InspectPivotFiltersByIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t int_filter{};
+  int_filter.axis = FM_PIVOT_AXIS_VALUE;
+  int_filter.field_name = "Amount";
+  int_filter.type = FM_PIVOT_FILTER_VALUE_TOP_10;
+  int_filter.value_kind = FM_PIVOT_FILTER_VALUE_INT;
+  int_filter.value_int = 3;
+  int_filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  int_filter.data_field_index = 0;
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &int_filter), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t double_filter{};
+  double_filter.axis = FM_PIVOT_AXIS_VALUE;
+  double_filter.field_name = "Amount";
+  double_filter.type = FM_PIVOT_FILTER_VALUE_GREATER_THAN;
+  double_filter.value_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
+  double_filter.value_double = 50.5;
+  double_filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  double_filter.data_field_index = 0;
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &double_filter), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t text_filter{};
+  text_filter.axis = FM_PIVOT_AXIS_ROW;
+  text_filter.field_name = "Region";
+  text_filter.type = FM_PIVOT_FILTER_LABEL_CONTAINS;
+  text_filter.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
+  text_filter.value_text = "o";
+  text_filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &text_filter), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t range_int_double{};
+  range_int_double.axis = FM_PIVOT_AXIS_VALUE;
+  range_int_double.field_name = "Amount";
+  range_int_double.type = FM_PIVOT_FILTER_VALUE_BETWEEN;
+  range_int_double.value_kind = FM_PIVOT_FILTER_VALUE_INT;
+  range_int_double.value_int = 100;
+  range_int_double.value_high_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
+  range_int_double.value_high_double = 500.25;
+  range_int_double.data_field_index = 0;
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &range_int_double), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t range_double_int{};
+  range_double_int.axis = FM_PIVOT_AXIS_VALUE;
+  range_double_int.field_name = "Amount";
+  range_double_int.type = FM_PIVOT_FILTER_VALUE_BETWEEN;
+  range_double_int.value_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
+  range_double_int.value_double = 99.75;
+  range_double_int.value_high_kind = FM_PIVOT_FILTER_VALUE_INT;
+  range_double_int.value_high_int = 450;
+  range_double_int.data_field_index = 0;
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &range_double_int), 0) << fm_last_error_message();
+
+  std::size_t filter_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &filter_count), 0);
+  ASSERT_EQ(filter_count, 5U);
+
+  // Establish a projected result before inspection; a read must not change
+  // either the active-filter count or the memoised evaluation state.
+  PivotCellsGuard before_projection;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &before_projection.handle), 0) << fm_last_error_message();
+  const std::vector<fm_pivot_cell_t> before_cells = CollectCells(before_projection.handle);
+
+  fm_pivot_filter_spec_t got{};
+  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 0, &got), 0);
+  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_VALUE);
+  ASSERT_NE(got.field_name, nullptr);
+  EXPECT_STREQ(got.field_name, "Amount");
+  EXPECT_EQ(got.type, FM_PIVOT_FILTER_VALUE_TOP_10);
+  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_INT);
+  EXPECT_EQ(got.value_int, 3);
+  EXPECT_DOUBLE_EQ(got.value_double, 0.0);
+  EXPECT_EQ(got.value_text, nullptr);
+  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_NONE);
+  EXPECT_EQ(got.value_high_int, 0);
+  EXPECT_DOUBLE_EQ(got.value_high_double, 0.0);
+  EXPECT_EQ(got.data_field_index, 0U);
+
+  got = {};
+  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 1, &got), 0);
+  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_VALUE);
+  ASSERT_NE(got.field_name, nullptr);
+  EXPECT_STREQ(got.field_name, "Amount");
+  EXPECT_EQ(got.type, FM_PIVOT_FILTER_VALUE_GREATER_THAN);
+  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_DOUBLE);
+  EXPECT_EQ(got.value_int, 0);
+  EXPECT_DOUBLE_EQ(got.value_double, 50.5);
+  EXPECT_EQ(got.value_text, nullptr);
+  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_NONE);
+  EXPECT_EQ(got.value_high_int, 0);
+  EXPECT_DOUBLE_EQ(got.value_high_double, 0.0);
+  EXPECT_EQ(got.data_field_index, 0U);
+
+  got = {};
+  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 2, &got), 0);
+  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_ROW);
+  ASSERT_NE(got.field_name, nullptr);
+  EXPECT_STREQ(got.field_name, "Region");
+  EXPECT_EQ(got.type, FM_PIVOT_FILTER_LABEL_CONTAINS);
+  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_TEXT);
+  EXPECT_EQ(got.value_int, 0);
+  EXPECT_DOUBLE_EQ(got.value_double, 0.0);
+  ASSERT_NE(got.value_text, nullptr);
+  EXPECT_STREQ(got.value_text, "o");
+  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_NONE);
+  EXPECT_EQ(got.value_high_int, 0);
+  EXPECT_DOUBLE_EQ(got.value_high_double, 0.0);
+  EXPECT_EQ(got.data_field_index, 0U);
+
+  got = {};
+  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 3, &got), 0);
+  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_VALUE);
+  ASSERT_NE(got.field_name, nullptr);
+  EXPECT_STREQ(got.field_name, "Amount");
+  EXPECT_EQ(got.type, FM_PIVOT_FILTER_VALUE_BETWEEN);
+  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_INT);
+  EXPECT_EQ(got.value_int, 100);
+  EXPECT_DOUBLE_EQ(got.value_double, 0.0);
+  EXPECT_EQ(got.value_text, nullptr);
+  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_DOUBLE);
+  EXPECT_EQ(got.value_high_int, 0);
+  EXPECT_DOUBLE_EQ(got.value_high_double, 500.25);
+  EXPECT_EQ(got.data_field_index, 0U);
+
+  got = {};
+  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 4, &got), 0);
+  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_VALUE);
+  ASSERT_NE(got.field_name, nullptr);
+  EXPECT_STREQ(got.field_name, "Amount");
+  EXPECT_EQ(got.type, FM_PIVOT_FILTER_VALUE_BETWEEN);
+  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_DOUBLE);
+  EXPECT_EQ(got.value_int, 0);
+  EXPECT_DOUBLE_EQ(got.value_double, 99.75);
+  EXPECT_EQ(got.value_text, nullptr);
+  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_INT);
+  EXPECT_EQ(got.value_high_int, 450);
+  EXPECT_DOUBLE_EQ(got.value_high_double, 0.0);
+  EXPECT_EQ(got.data_field_index, 0U);
+
+  std::size_t unchanged_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &unchanged_count), 0);
+  EXPECT_EQ(unchanged_count, filter_count);
+  PivotCellsGuard after_projection;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &after_projection.handle), 0) << fm_last_error_message();
+  const std::vector<fm_pivot_cell_t> after_cells = CollectCells(after_projection.handle);
+  ASSERT_EQ(after_cells.size(), before_cells.size());
+  for (std::size_t i = 0; i < before_cells.size(); ++i) {
+    EXPECT_EQ(after_cells[i].row, before_cells[i].row);
+    EXPECT_EQ(after_cells[i].col, before_cells[i].col);
+    EXPECT_EQ(after_cells[i].kind, before_cells[i].kind);
+    EXPECT_EQ(after_cells[i].value.kind, before_cells[i].value.kind);
+    if (before_cells[i].value.kind == FM_VAL_NUMBER) {
+      EXPECT_DOUBLE_EQ(after_cells[i].value.u.number, before_cells[i].value.u.number);
+    } else if (before_cells[i].value.kind == FM_VAL_TEXT) {
+      ASSERT_NE(before_cells[i].value.u.text, nullptr);
+      ASSERT_NE(after_cells[i].value.u.text, nullptr);
+      EXPECT_STREQ(after_cells[i].value.u.text, before_cells[i].value.u.text);
+    }
+  }
+
+  // Adding a filter invalidates the old model-backed views. Do not inspect
+  // those pointers after the mutation; reacquire the entry instead.
+  fm_pivot_filter_spec_t mutation{};
+  mutation.axis = FM_PIVOT_AXIS_ROW;
+  mutation.field_name = "Region";
+  mutation.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
+  mutation.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
+  mutation.value_text = "N";
+  mutation.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &mutation), 0) << fm_last_error_message();
+  fm_pivot_filter_spec_t reacquired{};
+  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 2, &reacquired), 0);
+  EXPECT_EQ(reacquired.value_kind, FM_PIVOT_FILTER_VALUE_TEXT);
+  ASSERT_NE(reacquired.value_text, nullptr);
+  EXPECT_STREQ(reacquired.value_text, "o");
+
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  const auto make_sentinel = [] {
+    fm_pivot_filter_spec_t sentinel{};
+    sentinel.axis = FM_PIVOT_AXIS_PAGE;
+    sentinel.field_name = "sentinel-field";
+    sentinel.type = FM_PIVOT_FILTER_LABEL_DATE;
+    sentinel.value_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
+    sentinel.value_int = -123456789;
+    sentinel.value_double = -9876.5;
+    sentinel.value_text = "sentinel-text";
+    sentinel.value_high_kind = FM_PIVOT_FILTER_VALUE_INT;
+    sentinel.value_high_int = 13579;
+    sentinel.value_high_double = 24680.5;
+    sentinel.data_field_index = 0xDEADBEEFU;
+    return sentinel;
+  };
+  const auto expect_unchanged = [](const fm_pivot_filter_spec_t& expected, const fm_pivot_filter_spec_t& actual) {
+    EXPECT_EQ(actual.axis, expected.axis);
+    EXPECT_EQ(actual.field_name, expected.field_name);
+    EXPECT_EQ(actual.type, expected.type);
+    EXPECT_EQ(actual.value_kind, expected.value_kind);
+    EXPECT_EQ(actual.value_int, expected.value_int);
+    EXPECT_DOUBLE_EQ(actual.value_double, expected.value_double);
+    EXPECT_EQ(actual.value_text, expected.value_text);
+    EXPECT_EQ(actual.value_high_kind, expected.value_high_kind);
+    EXPECT_EQ(actual.value_high_int, expected.value_high_int);
+    EXPECT_DOUBLE_EQ(actual.value_high_double, expected.value_high_double);
+    EXPECT_EQ(actual.data_field_index, expected.data_field_index);
+  };
+  const auto expect_error_preserves_output = [&](const auto& invoke, fm_status_t expected_status) {
+    fm_pivot_filter_spec_t invalid_out = make_sentinel();
+    const fm_pivot_filter_spec_t before = invalid_out;
+    EXPECT_EQ(invoke(&invalid_out), expected_status);
+    expect_unchanged(before, invalid_out);
+  };
+  expect_error_preserves_output(
+      [&](fm_pivot_filter_spec_t* out) { return fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 6, out); },
+      invalid);
+  expect_error_preserves_output(
+      [&](fm_pivot_filter_spec_t* out) { return fm_workbook_pivot_filter_at(wb.handle, 1, pivot_idx, 0, out); },
+      invalid);
+  expect_error_preserves_output(
+      [&](fm_pivot_filter_spec_t* out) { return fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx + 1, 0, out); },
+      invalid);
+  expect_error_preserves_output(
+      [&](fm_pivot_filter_spec_t* out) { return fm_workbook_pivot_filter_at(nullptr, 0, pivot_idx, 0, out); },
+      static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+  EXPECT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 0, nullptr),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+}
+
+TEST(FormulonCApiPivot, GetterRejectsUnrepresentableModelEnumsWithoutMutation) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  auto* table = wb.handle->workbook().sheet(0).mutable_pivot_tables()[pivot_idx].get();
+  ASSERT_NE(table, nullptr);
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  const auto make_sentinel = [] {
+    fm_pivot_filter_spec_t sentinel{};
+    sentinel.axis = FM_PIVOT_AXIS_PAGE;
+    sentinel.field_name = "sentinel-field";
+    sentinel.type = FM_PIVOT_FILTER_LABEL_DATE;
+    sentinel.value_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
+    sentinel.value_int = -123456789;
+    sentinel.value_double = -9876.5;
+    sentinel.value_text = "sentinel-text";
+    sentinel.value_high_kind = FM_PIVOT_FILTER_VALUE_INT;
+    sentinel.value_high_int = 13579;
+    sentinel.value_high_double = 24680.5;
+    sentinel.data_field_index = 0xDEADBEEFU;
+    return sentinel;
+  };
+  const auto inject_and_expect_rejected = [&](formulon::pivot::PivotAxis axis, formulon::pivot::FilterType type) {
+    table->mutable_active_filters().clear();
+    formulon::pivot::PivotFilter filter;
+    filter.axis = axis;
+    filter.field_name = "Region";
+    filter.type = type;
+    filter.value = std::string("N");
+    table->mutable_active_filters().push_back(filter);
+
+    fm_pivot_filter_spec_t out = make_sentinel();
+    const fm_pivot_filter_spec_t before = out;
+    EXPECT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 0, &out), invalid);
+    EXPECT_EQ(std::memcmp(&out, &before, sizeof(out)), 0);
+  };
+
+  inject_and_expect_rejected(formulon::pivot::PivotAxis::None, formulon::pivot::FilterType::LabelContains);
+  inject_and_expect_rejected(formulon::pivot::PivotAxis::Row, static_cast<formulon::pivot::FilterType>(0xFF));
+}
+
+TEST(FormulonCApiPivot, PivotFilterAddRejectsRawAxisAndTypeWithoutMutation) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t spec{};
+  spec.axis = RawEnumValue<fm_pivot_axis_t>(99);
+  spec.field_name = "Region";
+  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
+  spec.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
+  spec.value_text = "N";
+  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
+
+  std::size_t count = 99;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
+  EXPECT_EQ(count, 0U);
+
+  spec.axis = FM_PIVOT_AXIS_ROW;
+  spec.type = RawEnumValue<fm_pivot_filter_type_t>(99);
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
+  EXPECT_EQ(count, 0U);
+}
+
+TEST(FormulonCApiPivot, PivotFilterRejectsInvalidDataFieldWithoutMutation) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t spec{};
+  spec.axis = FM_PIVOT_AXIS_ROW;
+  spec.field_name = "Region";
+  spec.type = FM_PIVOT_FILTER_VALUE_TOP_10;
+  spec.value_kind = FM_PIVOT_FILTER_VALUE_INT;
+  spec.value_int = 1;
+  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  spec.data_field_index = 1;  // BuildScratchPivot has only slot 0.
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
+
+  std::size_t count = 99;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
+  EXPECT_EQ(count, 0U);
+}
+
+TEST(FormulonCApiPivot, PivotFilterRejectsSelectorWhenNoDataFields) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_pivot_data_field_clear(wb.handle, 0, pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t spec{};
+  spec.axis = FM_PIVOT_AXIS_ROW;
+  spec.field_name = "Region";
+  spec.type = FM_PIVOT_FILTER_VALUE_TOP_10;
+  spec.value_kind = FM_PIVOT_FILTER_VALUE_INT;
+  spec.value_int = 1;
+  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  spec.data_field_index = 0;
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
+
+  std::size_t count = 99;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
+  EXPECT_EQ(count, 0U);
+}
+
+TEST(FormulonCApiPivot, PivotFilterRejectsUnknownFieldNameWithoutMutation) {
+  // A label filter naming no pivot field would be a silent no-op inside the
+  // engine, so the mutator rejects it instead of reporting success.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t spec{};
+  spec.axis = FM_PIVOT_AXIS_ROW;
+  spec.field_name = "NoSuchField";
+  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
+  spec.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
+  spec.value_text = "N";
+  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
+
+  std::size_t count = 99;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
+  EXPECT_EQ(count, 0U);
+
+  // The data field's display name resolves through to its source field, so
+  // the same call shape is accepted for it.
+  spec.field_name = "Sum of Amount";
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
+  EXPECT_EQ(count, 1U);
+}
+
+TEST(FormulonCApiPivot, ValueFilterRejectsUnknownFieldNameWithoutMutation) {
+  // The engine skips a filter whose field does not resolve, so a value filter
+  // naming no pivot field must be rejected rather than accepted as a no-op.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t spec{};
+  spec.axis = FM_PIVOT_AXIS_ROW;
+  spec.field_name = "NoSuchField";
+  spec.type = FM_PIVOT_FILTER_VALUE_TOP_10;
+  spec.value_kind = FM_PIVOT_FILTER_VALUE_INT;
+  spec.value_int = 1;
+  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  spec.data_field_index = 0;
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
+
+  std::size_t count = 99;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
+  EXPECT_EQ(count, 0U);
+
+  spec.field_name = "Region";
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), 0) << fm_last_error_message();
+}
+
+TEST(FormulonCApiPivot, FilterRejectsAmbiguousFieldNameWithoutMutation) {
+  // A caption shared by two distinct fields names neither of them, exactly
+  // like an unknown name.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_field_spec_t dup_spec{};
+  dup_spec.source_name = "Amount";
+  dup_spec.custom_name = "Region";
+  dup_spec.axis = FM_PIVOT_AXIS_VALUE;
+  dup_spec.number_format = "";
+  std::size_t dup_field = 99;
+  ASSERT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, pivot_idx, &dup_spec, &dup_field), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t spec{};
+  spec.axis = FM_PIVOT_AXIS_ROW;
+  spec.field_name = "Region";
+  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
+  spec.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
+  spec.value_text = "N";
+  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
+
+  std::size_t count = 99;
+  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
+  EXPECT_EQ(count, 0U);
+}
+
+TEST(FormulonCApiPivot, FilterErrorUsesApiName) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  fm_pivot_filter_spec_t spec{};
+  spec.axis = FM_PIVOT_AXIS_ROW;
+  spec.field_name = "Region";
+  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
+  spec.value_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
+  EXPECT_EQ(std::string_view(fm_last_error_message()).find("fm_workbook_pivot_filter_add:"), 0U);
+}
+
+TEST(FormulonCApiPivot, MutateShowValuesAs) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  // Re-set the data field to PercentOfRow.
+  std::size_t df_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_data_field_count(wb.handle, 0, pivot_idx, &df_count), 0);
+  ASSERT_EQ(df_count, 1U);
+
+  fm_pivot_data_field_spec_t df_spec{};
+  df_spec.name = "Sum of Amount";
+  df_spec.field_index = 1U;  // Amount is the second pivot field.
+  df_spec.aggregation = FM_PIVOT_AGG_SUM;
+  df_spec.number_format = "";
+  df_spec.show_as = FM_PIVOT_SHOW_AS_PERCENT_OF_ROW;
+  df_spec.show_as_base_field = -1;
+  df_spec.show_as_base_item = -1;
+  ASSERT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &df_spec), 0) << fm_last_error_message();
+
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+
+  // Each FM_PIVOT_CELL_DATA cell should equal 1.0 (single data column ->
+  // each row's percent-of-row is 100% of itself).
+  std::size_t data_count = 0;
+  for (const fm_pivot_cell_t& c : CollectCells(projected.handle)) {
+    if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER) {
+      EXPECT_DOUBLE_EQ(c.value.u.number, 1.0);
+      ++data_count;
+    }
+  }
+  EXPECT_GT(data_count, 0U);
+}
diff --git a/tests/c_api/formulon_c_pivot_grouping_test.cpp b/tests/c_api/formulon_c_pivot_grouping_test.cpp
new file mode 100644
index 000000000..badfb1cec
--- /dev/null
+++ b/tests/c_api/formulon_c_pivot_grouping_test.cpp
@@ -0,0 +1,373 @@
+// Stable C ABI PivotTable grouping and item-binding tests.
+
+#include <utility>
+
+#include "formulon_c_pivot_test_helpers.h"
+
+namespace {
+
+fm_status_t BuildDaysGroupedPivot(fm_workbook_t* wb, double start_serial, std::size_t* out_pivot_index) {
+  std::uint32_t cache_id = 0;
+  fm_status_t st = fm_workbook_pivot_cache_create(wb, 0, &cache_id);
+  if (st != 0) {
+    return st;
+  }
+  st = fm_workbook_pivot_cache_set_worksheet_source(wb, cache_id, /*present=*/1, "A1:B71", "Sheet1", nullptr);
+  if (st != 0) {
+    return st;
+  }
+  std::size_t date_idx = 99;
+  st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Date", &date_idx);
+  if (st != 0) {
+    return st;
+  }
+  std::size_t amount_idx = 99;
+  st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Amount", &amount_idx);
+  if (st != 0) {
+    return st;
+  }
+  for (double serial = 0.0; serial <= 70.0; serial += 1.0) {
+    std::size_t rec_idx = 99;
+    st = fm_workbook_pivot_cache_record_add(wb, cache_id, &rec_idx);
+    if (st != 0) {
+      return st;
+    }
+    st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, date_idx, serial);
+    if (st != 0) {
+      return st;
+    }
+    st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, amount_idx, 1.0);
+    if (st != 0) {
+      return st;
+    }
+  }
+  std::size_t pivot_idx = 99;
+  st = fm_workbook_pivot_create(wb, 0, "PT", cache_id, /*anchor_row=*/0U, /*anchor_col=*/3U, &pivot_idx);
+  if (st != 0) {
+    return st;
+  }
+  fm_pivot_field_spec_t date_spec{};
+  date_spec.source_name = "Date";
+  date_spec.custom_name = "";
+  date_spec.axis = FM_PIVOT_AXIS_ROW;
+  date_spec.subtotal_top = 0;
+  date_spec.number_format = "";
+  std::size_t date_field = 99;
+  st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &date_spec, &date_field);
+  if (st != 0) {
+    return st;
+  }
+  st = fm_workbook_pivot_field_set_date_group(wb, 0, pivot_idx, date_field, FM_PIVOT_DATE_DAYS,
+                                              FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, /*interval_days=*/7, start_serial,
+                                              /*end_serial_or_neg1=*/-1.0);
+  if (st != 0) {
+    return st;
+  }
+  fm_pivot_field_spec_t amount_spec{};
+  amount_spec.source_name = "Amount";
+  amount_spec.custom_name = "";
+  amount_spec.axis = FM_PIVOT_AXIS_VALUE;
+  amount_spec.subtotal_top = 0;
+  amount_spec.number_format = "";
+  std::size_t amount_field = 99;
+  st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &amount_spec, &amount_field);
+  if (st != 0) {
+    return st;
+  }
+  const std::uint32_t row_order[] = {static_cast<std::uint32_t>(date_field)};
+  st = fm_workbook_pivot_set_row_field_order(wb, 0, pivot_idx, row_order, 1U);
+  if (st != 0) {
+    return st;
+  }
+  fm_pivot_data_field_spec_t df_spec{};
+  df_spec.name = "Sum of Amount";
+  df_spec.field_index = static_cast<std::uint32_t>(amount_field);
+  df_spec.aggregation = FM_PIVOT_AGG_SUM;
+  df_spec.number_format = "";
+  df_spec.show_as = FM_PIVOT_SHOW_AS_NORMAL;
+  df_spec.show_as_base_field = -1;
+  df_spec.show_as_base_item = -1;
+  std::size_t df_idx = 99;
+  st = fm_workbook_pivot_data_field_add(wb, 0, pivot_idx, &df_spec, &df_idx);
+  if (st != 0) {
+    return st;
+  }
+  if (out_pivot_index != nullptr) {
+    *out_pivot_index = pivot_idx;
+  }
+  return 0;
+}
+
+// Collects (row label, Sum(Amount)) pairs from a one-row-field,
+// one-data-field pivot's projected grid, in row order.
+std::vector<std::pair<std::string, double>> CollectDaysGroupRows(fm_pivot_cells_t* handle) {
+  std::vector<fm_pivot_cell_t> cells = CollectCells(handle);
+  std::vector<std::pair<std::string, double>> labels_by_row;
+  std::vector<double> sums_by_row;
+  for (const fm_pivot_cell_t& c : cells) {
+    if (c.kind == FM_PIVOT_CELL_ROW_LABEL && c.value.kind == FM_VAL_TEXT) {
+      labels_by_row.emplace_back(std::string(c.value.u.text), 0.0);
+    } else if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER) {
+      sums_by_row.push_back(c.value.u.number);
+    }
+  }
+  EXPECT_EQ(labels_by_row.size(), sums_by_row.size());
+  for (std::size_t i = 0; i < labels_by_row.size() && i < sums_by_row.size(); ++i) {
+    labels_by_row[i].second = sums_by_row[i];
+  }
+  return labels_by_row;
+}
+
+// Region shared items are `[0] = "North"`, `[1] = blank`; the two records
+// carry one of each. The blank shared item deliberately does NOT sit at index
+// 0, which is what a name-addressed item silently binds to.
+fm_status_t BuildBlankItemPivot(fm_workbook_t* wb, std::uint32_t* out_cache_id, std::size_t* out_pivot_index) {
+  std::uint32_t cache_id = 0;
+  if (fm_status_t st = fm_workbook_pivot_cache_create(wb, 0U, &cache_id); st != 0) {
+    return st;
+  }
+  std::size_t region_idx = 99;
+  std::size_t amount_idx = 99;
+  if (fm_status_t st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Region", &region_idx); st != 0) {
+    return st;
+  }
+  if (fm_status_t st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Amount", &amount_idx); st != 0) {
+    return st;
+  }
+  if (fm_status_t st = fm_workbook_pivot_cache_field_add_shared_item_text(wb, cache_id, region_idx, "North"); st != 0) {
+    return st;
+  }
+  if (fm_status_t st = fm_workbook_pivot_cache_field_add_shared_item_blank(wb, cache_id, region_idx); st != 0) {
+    return st;
+  }
+
+  std::size_t rec_idx = 99;
+  if (fm_status_t st = fm_workbook_pivot_cache_record_add(wb, cache_id, &rec_idx); st != 0) {
+    return st;
+  }
+  if (fm_status_t st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, region_idx, 0.0); st != 0) {
+    return st;
+  }
+  if (fm_status_t st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, amount_idx, 100.0); st != 0) {
+    return st;
+  }
+  if (fm_status_t st = fm_workbook_pivot_cache_record_add(wb, cache_id, &rec_idx); st != 0) {
+    return st;
+  }
+  if (fm_status_t st = fm_workbook_pivot_cache_record_set_blank(wb, cache_id, rec_idx, region_idx); st != 0) {
+    return st;
+  }
+  if (fm_status_t st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, amount_idx, 200.0); st != 0) {
+    return st;
+  }
+
+  std::size_t pivot_idx = 99;
+  if (fm_status_t st = fm_workbook_pivot_create(wb, 0, "PT", cache_id, 0U, 0U, &pivot_idx); st != 0) {
+    return st;
+  }
+  fm_pivot_field_spec_t region_spec{};
+  region_spec.source_name = "Region";
+  region_spec.custom_name = "";
+  region_spec.axis = FM_PIVOT_AXIS_ROW;
+  region_spec.subtotal_top = 0;
+  region_spec.number_format = "";
+  std::size_t region_field = 99;
+  if (fm_status_t st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &region_spec, &region_field); st != 0) {
+    return st;
+  }
+  fm_pivot_field_spec_t amount_spec{};
+  amount_spec.source_name = "Amount";
+  amount_spec.custom_name = "";
+  amount_spec.axis = FM_PIVOT_AXIS_VALUE;
+  amount_spec.subtotal_top = 0;
+  amount_spec.number_format = "";
+  std::size_t amount_field = 99;
+  if (fm_status_t st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &amount_spec, &amount_field); st != 0) {
+    return st;
+  }
+  const std::uint32_t row_order[] = {static_cast<std::uint32_t>(region_field)};
+  if (fm_status_t st = fm_workbook_pivot_set_row_field_order(wb, 0, pivot_idx, row_order, 1U); st != 0) {
+    return st;
+  }
+  fm_pivot_data_field_spec_t df_spec{};
+  df_spec.name = "Sum of Amount";
+  df_spec.field_index = static_cast<std::uint32_t>(amount_field);
+  df_spec.aggregation = FM_PIVOT_AGG_SUM;
+  df_spec.number_format = "";
+  df_spec.show_as = FM_PIVOT_SHOW_AS_NORMAL;
+  df_spec.show_as_base_field = -1;
+  df_spec.show_as_base_item = -1;
+  std::size_t df_idx = 99;
+  if (fm_status_t st = fm_workbook_pivot_data_field_add(wb, 0, pivot_idx, &df_spec, &df_idx); st != 0) {
+    return st;
+  }
+  if (out_cache_id != nullptr) {
+    *out_cache_id = cache_id;
+  }
+  if (out_pivot_index != nullptr) {
+    *out_pivot_index = pivot_idx;
+  }
+  return 0;
+}
+
+// Sum of every `FM_PIVOT_CELL_DATA` cell in the projected layout.
+double SumDataCells(fm_pivot_cells_t* handle) {
+  double total = 0.0;
+  const std::size_t n = fm_pivot_cells_count(handle);
+  for (std::size_t i = 0; i < n; ++i) {
+    fm_pivot_cell_t cell{};
+    EXPECT_EQ(fm_pivot_cells_at(handle, i, &cell), 0);
+    if (cell.kind == FM_PIVOT_CELL_DATA && cell.value.kind == FM_VAL_NUMBER) {
+      total += cell.value.u.number;
+    }
+  }
+  return total;
+}
+
+}  // namespace
+
+TEST(FormulonCApiPivot, DaysGroupMatchesPivotWeek1900FixtureThroughTheAbi) {
+  // Ground truth transcribed from
+  // tests/fixtures/excel/win/pivot_week_1900/results.json (Windows Excel
+  // 365 ja-JP, build 16.0.20228): four Start variants of the same
+  // By-7-days grouping, read from the real Excel-rendered pivot. `auto`
+  // (Start=True) and `start0` (Start=0) coincide because 0 is already
+  // the data minimum.
+  const double kAuto = -1.0;
+  const std::vector<std::pair<std::string, double>> kAutoAndStart0Rows = {
+      {"1900/1/0 - 1900/1/6", 7.0},   {"1900/1/7 - 1900/1/13", 7.0},  {"1900/1/14 - 1900/1/20", 7.0},
+      {"1900/1/21 - 1900/1/27", 7.0}, {"1900/1/28 - 1900/2/3", 7.0},  {"1900/2/4 - 1900/2/10", 7.0},
+      {"1900/2/11 - 1900/2/17", 7.0}, {"1900/2/18 - 1900/2/24", 7.0}, {"1900/2/25 - 1900/3/2", 7.0},
+      {"1900/3/3 - 1900/3/9", 7.0},   {"1900/3/10 - 1900/3/11", 1.0},
+  };
+  const std::vector<std::pair<std::string, double>> kStart1Rows = {
+      {"<1900/1/1", 1.0},
+      {"1900/1/1 - 1900/1/7", 7.0},
+      {"1900/1/8 - 1900/1/14", 7.0},
+      {"1900/1/15 - 1900/1/21", 7.0},
+      {"1900/1/22 - 1900/1/28", 7.0},
+      {"1900/1/29 - 1900/2/4", 7.0},
+      {"1900/2/5 - 1900/2/11", 7.0},
+      {"1900/2/12 - 1900/2/18", 7.0},
+      {"1900/2/19 - 1900/2/25", 7.0},
+      {"1900/2/26 - 1900/3/3", 7.0},
+      {"1900/3/4 - 1900/3/10", 7.0},
+  };
+  const std::vector<std::pair<std::string, double>> kStart61Rows = {
+      {"<1900/3/1", 61.0},
+      {"1900/3/1 - 1900/3/7", 7.0},
+      {"1900/3/8 - 1900/3/11", 3.0},
+  };
+
+  const struct {
+    const char* name;
+    double start_serial;
+    const std::vector<std::pair<std::string, double>>* expected;
+  } variants[] = {
+      {"auto", kAuto, &kAutoAndStart0Rows},
+      {"start0", 0.0, &kAutoAndStart0Rows},
+      {"start1", 1.0, &kStart1Rows},
+      {"start61", 61.0, &kStart61Rows},
+  };
+
+  for (const auto& variant : variants) {
+    WorkbookGuard wb;
+    ASSERT_EQ(fm_workbook_create(&wb.handle), 0) << variant.name;
+    std::size_t pivot_idx = 0;
+    ASSERT_EQ(BuildDaysGroupedPivot(wb.handle, variant.start_serial, &pivot_idx), 0)
+        << variant.name << ": " << fm_last_error_message();
+
+    PivotCellsGuard projected;
+    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0)
+        << variant.name << ": " << fm_last_error_message();
+
+    const std::vector<std::pair<std::string, double>> rows = CollectDaysGroupRows(projected.handle);
+    ASSERT_EQ(rows.size(), variant.expected->size()) << variant.name;
+    for (std::size_t i = 0; i < rows.size(); ++i) {
+      EXPECT_EQ(rows[i].first, (*variant.expected)[i].first) << variant.name << " row " << i;
+      EXPECT_DOUBLE_EQ(rows[i].second, (*variant.expected)[i].second) << variant.name << " row " << i;
+    }
+  }
+}
+
+TEST(FormulonCApiPivot, AddItemAtBindsTheBlankItemByCacheIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildBlankItemPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  // Both source rows contribute before any manual filter exists.
+  {
+    PivotCellsGuard projected;
+    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+    EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 300.0);
+  }
+
+  // The blank shared item is at cache index 1, so the index-addressed adder is
+  // the only way to name it: an empty label carries no binding of its own.
+  ASSERT_EQ(fm_workbook_pivot_field_add_item(wb.handle, 0, pivot_idx, 0, "North", 1), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_add_item_at(wb.handle, 0, pivot_idx, 0, /*cache_index=*/1U, /*visible=*/0), 0);
+  {
+    PivotCellsGuard projected;
+    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+    EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 100.0);
+  }
+}
+
+TEST(FormulonCApiPivot, AddItemWithEmptyNameCannotHideTheBlankRow) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildBlankItemPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  // A name-addressed item defaults to cache index 0, which here holds
+  // "North". The item is unlabelled, so it takes its label from that binding
+  // and hides North, never the blank row. This is the gap
+  // `fm_workbook_pivot_field_add_item_at` closes.
+  ASSERT_EQ(fm_workbook_pivot_field_add_item(wb.handle, 0, pivot_idx, 0, "North", 1), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_add_item(wb.handle, 0, pivot_idx, 0, "", 0), 0);
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+  EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 200.0);
+}
+
+TEST(FormulonCApiPivot, AddItemAtHidesANonBlankItemBeforeAnyReload) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_pivot_field_clear_items(wb.handle, 0, pivot_idx, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_add_item_at(wb.handle, 0, pivot_idx, 0, /*cache_index=*/1U, /*visible=*/0), 0);
+  {
+    PivotCellsGuard projected;
+    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+    EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 400.0);  // North only: 100 + 300.
+  }
+  EXPECT_FALSE(LayoutHasText(wb.handle, pivot_idx, "South"));
+
+  // The label is derived at evaluation time, so repopulating the shared
+  // items after the item was added changes nothing.
+  ASSERT_EQ(fm_workbook_pivot_cache_field_clear_shared_items(wb.handle, cache_id, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_text(wb.handle, cache_id, 0, "North"), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_text(wb.handle, cache_id, 0, "South"), 0);
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+  EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 400.0);
+}
+
+TEST(FormulonCApiPivot, SoleVisiblePageItemAddedByCacheIndexNamesItsValue) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_pivot_set_row_field_order(wb.handle, 0, pivot_idx, nullptr, 0U), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_set_axis(wb.handle, 0, pivot_idx, 0, FM_PIVOT_AXIS_PAGE), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_clear_items(wb.handle, 0, pivot_idx, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_add_item_at(wb.handle, 0, pivot_idx, 0, /*cache_index=*/0U, /*visible=*/0), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_add_item_at(wb.handle, 0, pivot_idx, 0, /*cache_index=*/1U, /*visible=*/1), 0);
+  EXPECT_TRUE(LayoutHasText(wb.handle, pivot_idx, "South"));
+}
diff --git a/tests/c_api/formulon_c_pivot_lifecycle_test.cpp b/tests/c_api/formulon_c_pivot_lifecycle_test.cpp
new file mode 100644
index 000000000..e4d7ddfe5
--- /dev/null
+++ b/tests/c_api/formulon_c_pivot_lifecycle_test.cpp
@@ -0,0 +1,368 @@
+// Stable C ABI PivotTable lifecycle and number-format tests.
+
+#include <limits>
+
+#include "formulon_c_pivot_test_helpers.h"
+
+TEST(FormulonCApiPivot, RemovePivotAndCache) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  std::size_t before_pivots = 0;
+  std::size_t before_caches = 0;
+  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 0, &before_pivots), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_count(wb.handle, &before_caches), 0);
+  EXPECT_EQ(before_pivots, 1U);
+  EXPECT_EQ(before_caches, 1U);
+
+  // Remove the pivot first, then the cache.
+  ASSERT_EQ(fm_workbook_pivot_remove(wb.handle, 0, pivot_idx), 0);
+  std::size_t after_remove_pivots = 99;
+  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 0, &after_remove_pivots), 0);
+  EXPECT_EQ(after_remove_pivots, 0U);
+
+  ASSERT_EQ(fm_workbook_pivot_cache_remove(wb.handle, cache_id), 0);
+  std::size_t after_caches = 99;
+  ASSERT_EQ(fm_workbook_pivot_cache_count(wb.handle, &after_caches), 0);
+  EXPECT_EQ(after_caches, 0U);
+}
+
+TEST(FormulonCApiPivot, AutoPivotCacheIdRejectsOverflowAndPreservesOutput) {
+  const std::uint32_t max_id = std::numeric_limits<std::uint32_t>::max();
+  const fm_status_t invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+
+  WorkbookGuard at_ceiling;
+  ASSERT_EQ(fm_workbook_create(&at_ceiling.handle), 0);
+  std::uint32_t assigned = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_create(at_ceiling.handle, max_id, &assigned), 0) << fm_last_error_message();
+  EXPECT_EQ(assigned, max_id);
+  std::size_t cache_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_count(at_ceiling.handle, &cache_count), 0);
+  EXPECT_EQ(cache_count, 1U);
+
+  assigned = 0xA5A5A5A5U;
+  EXPECT_EQ(fm_workbook_pivot_cache_create(at_ceiling.handle, 0U, &assigned), invalid);
+  EXPECT_EQ(assigned, 0xA5A5A5A5U);
+  ASSERT_EQ(fm_workbook_pivot_cache_count(at_ceiling.handle, &cache_count), 0);
+  EXPECT_EQ(cache_count, 1U);
+
+  // A free explicit id below the ceiling remains valid, and auto-assignment
+  // can still allocate the next id when max(existing_ids) is max-1.
+  WorkbookGuard below_ceiling;
+  ASSERT_EQ(fm_workbook_create(&below_ceiling.handle), 0);
+  assigned = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_create(below_ceiling.handle, max_id - 1U, &assigned), 0) << fm_last_error_message();
+  EXPECT_EQ(assigned, max_id - 1U);
+  assigned = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_create(below_ceiling.handle, 0U, &assigned), 0) << fm_last_error_message();
+  EXPECT_EQ(assigned, max_id);
+}
+
+TEST(FormulonCApiPivot, RecreatedPivotWakesGetPivotDataAfterRef) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=GETPIVOTDATA(\"Sum of Amount\",D1,\"Region\",\"North\")"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  ASSERT_EQ(fm_workbook_pivot_remove(wb.handle, 0, pivot_idx), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_ERROR);
+  EXPECT_EQ(value.u.error_code, static_cast<std::int32_t>(formulon::ErrorCode::Ref));
+
+  // Recreating and configuring a pivot at the same anchor must dirty the
+  // already existing formula, so a subsequent recalc recovers from #REF!.
+  std::uint32_t recreated_cache_id = 0;
+  std::size_t recreated_pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &recreated_cache_id, &recreated_pivot_idx), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &value), 0);
+  ASSERT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 400.0);
+}
+
+TEST(FormulonCApiPivot, CacheRemoveBlockedByPivot) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  EXPECT_EQ(fm_workbook_pivot_cache_remove(wb.handle, cache_id),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  // Removing a non-existent cache id must also surface kInvalidArgument.
+  EXPECT_EQ(fm_workbook_pivot_cache_remove(wb.handle, 9999U),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+}
+
+TEST(FormulonCApiPivot, NullPointerArgumentsRejected) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_create(wb.handle, 0, &cache_id), 0);
+  std::size_t field_idx = 99;
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, "F", &field_idx), 0);
+
+  std::size_t out_count = 0;
+  EXPECT_EQ(fm_workbook_pivot_cache_count(nullptr, &out_count),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+  EXPECT_EQ(fm_workbook_pivot_cache_count(wb.handle, nullptr),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+
+  std::size_t fc = 0;
+  EXPECT_EQ(fm_workbook_pivot_cache_field_count(nullptr, cache_id, &fc),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+
+  EXPECT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, nullptr, &field_idx),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+
+  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_text(wb.handle, cache_id, field_idx, nullptr),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+
+  std::size_t pivot_idx = 99;
+  EXPECT_EQ(fm_workbook_pivot_create(wb.handle, 0, nullptr, cache_id, 0, 0, &pivot_idx),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+
+  // spec arguments
+  EXPECT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, 0, nullptr, &pivot_idx),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+
+  fm_pivot_filter_spec_t bad_filter{};
+  bad_filter.field_name = nullptr;
+  bad_filter.type = FM_PIVOT_FILTER_LABEL_CONTAINS;
+  bad_filter.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
+  bad_filter.value_text = "X";
+  bad_filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, 0, &bad_filter),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+}
+
+TEST(FormulonCApiPivot, NullHandleStatusMatchesRecordedError) {
+  // The shared-item and record setters resolve their target through a
+  // common lookup helper. The status each returns must be the code that
+  // helper recorded, so a caller branching on the return value and a
+  // caller reading `fm_last_error_message` reach the same conclusion.
+  const auto null_pointer = static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer);
+  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+
+  const auto expect_null_handle = [&](fm_status_t status) {
+    EXPECT_EQ(status, null_pointer);
+    EXPECT_NE(std::string(fm_last_error_message()).find("wb is NULL"), std::string::npos)
+        << "message: " << fm_last_error_message();
+  };
+
+  expect_null_handle(fm_workbook_pivot_cache_field_add_shared_item_number(nullptr, 0U, 0U, 1.0));
+  expect_null_handle(fm_workbook_pivot_cache_field_add_shared_item_bool(nullptr, 0U, 0U, 1));
+  expect_null_handle(fm_workbook_pivot_cache_field_add_shared_item_blank(nullptr, 0U, 0U));
+  expect_null_handle(fm_workbook_pivot_cache_field_add_shared_item_error(nullptr, 0U, 0U, /*error=*/1));
+  expect_null_handle(fm_workbook_pivot_cache_field_clear_shared_items(nullptr, 0U, 0U));
+  expect_null_handle(fm_workbook_pivot_cache_record_set_number(nullptr, 0U, 0U, 0U, 1.0));
+  expect_null_handle(fm_workbook_pivot_cache_record_set_text(nullptr, 0U, 0U, 0U, "x"));
+  expect_null_handle(fm_workbook_pivot_cache_record_set_bool(nullptr, 0U, 0U, 0U, 1));
+  expect_null_handle(fm_workbook_pivot_cache_record_set_blank(nullptr, 0U, 0U, 0U));
+  expect_null_handle(fm_workbook_pivot_cache_record_set_error(nullptr, 0U, 0U, 0U, /*error=*/1));
+
+  // A live handle with an out-of-range coordinate keeps reporting
+  // kInvalidArgument through the same helpers.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_create(wb.handle, 0, &cache_id), 0);
+  std::size_t field_idx = 99;
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, "F", &field_idx), 0);
+
+  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_number(wb.handle, cache_id, field_idx + 1U, 1.0), invalid);
+  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_number(wb.handle, cache_id + 100U, field_idx, 1.0), invalid);
+  EXPECT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, /*record_idx=*/0U, field_idx, 1.0), invalid);
+}
+
+TEST(FormulonCApiPivot, OutOfGridAnchorRejected) {
+  // Excel grid ceilings; kept as literals so this test needs no core
+  // header. Mirrors Sheet::kMaxRows / kMaxCols.
+  constexpr std::uint32_t kMaxRows = 1'048'576U;
+  constexpr std::uint32_t kMaxCols = 16'384U;
+
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_create(wb.handle, 0, &cache_id), 0);
+  std::size_t field_idx = 99;
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, "F", &field_idx), 0);
+
+  // create() with an anchor past the grid must be rejected, not stored.
+  std::size_t pivot_idx = 99;
+  EXPECT_EQ(fm_workbook_pivot_create(wb.handle, 0, "PT", cache_id, kMaxRows, 0U, &pivot_idx),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(fm_workbook_pivot_create(wb.handle, 0, "PT", cache_id, 0U, kMaxCols, &pivot_idx),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  // A valid create succeeds, then set_anchor must reject a span whose far
+  // corner leaves the grid (the wrap the audit flagged) and a zero span.
+  ASSERT_EQ(fm_workbook_pivot_create(wb.handle, 0, "PT", cache_id, 0U, 0U, &pivot_idx), 0);
+  EXPECT_EQ(
+      fm_workbook_pivot_set_anchor(wb.handle, 0, pivot_idx, kMaxRows - 1U, 0U, /*span_rows=*/2U, /*span_cols=*/1U),
+      static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(fm_workbook_pivot_set_anchor(wb.handle, 0, pivot_idx, 0U, 0U, /*span_rows=*/0U, /*span_cols=*/1U),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  // An in-grid span still succeeds.
+  EXPECT_EQ(fm_workbook_pivot_set_anchor(wb.handle, 0, pivot_idx, 0U, 0U, /*span_rows=*/3U, /*span_cols=*/2U), 0);
+}
+
+TEST(FormulonCApiPivot, MutationAndClearExportsCompleteTheirLifecycles) {
+  // Exercise the C ABI setters that are not needed by the projected-layout
+  // examples above.  Each mutation is followed by the corresponding clear
+  // where one exists, which also verifies that the handle remains usable
+  // across each invalidation boundary.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+
+  std::uint32_t id_at_zero = 0;
+  ASSERT_EQ(fm_workbook_pivot_cache_id_at(wb.handle, 0, &id_at_zero), 0);
+  EXPECT_EQ(id_at_zero, cache_id);
+
+  const char* field_name = nullptr;
+  ASSERT_EQ(fm_workbook_pivot_cache_field_name(wb.handle, cache_id, 0, &field_name), 0);
+  EXPECT_STREQ(field_name, "Region");
+
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_number(wb.handle, cache_id, 0, 7.0), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_bool(wb.handle, cache_id, 0, 1), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_blank(wb.handle, cache_id, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_field_clear_shared_items(wb.handle, cache_id, 0), 0);
+  std::size_t shared_count = 99;
+  ASSERT_EQ(fm_workbook_pivot_cache_field_shared_item_count(wb.handle, cache_id, 0, &shared_count), 0);
+  EXPECT_EQ(shared_count, 0U);
+
+  std::size_t record_idx = 99;
+  ASSERT_EQ(fm_workbook_pivot_cache_record_add(wb.handle, cache_id, &record_idx), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_text(wb.handle, cache_id, record_idx, 0, "North"), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_bool(wb.handle, cache_id, record_idx, 0, 1), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_blank(wb.handle, cache_id, record_idx, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_record_set_error(wb.handle, cache_id, record_idx, 0, 1), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_record_clear(wb.handle, cache_id), 0);
+  std::size_t record_count = 99;
+  ASSERT_EQ(fm_workbook_pivot_cache_record_count(wb.handle, cache_id, &record_count), 0);
+  EXPECT_EQ(record_count, 0U);
+
+  ASSERT_EQ(fm_workbook_pivot_set_name(wb.handle, 0, pivot_idx, "Renamed"), 0);
+  ASSERT_EQ(fm_workbook_pivot_set_grand_totals(wb.handle, 0, pivot_idx, 0, 1), 0);
+  std::size_t field_count = 99;
+  ASSERT_EQ(fm_workbook_pivot_field_count(wb.handle, 0, pivot_idx, &field_count), 0);
+  ASSERT_EQ(field_count, 2U);
+
+  ASSERT_EQ(fm_workbook_pivot_field_set_axis(wb.handle, 0, pivot_idx, 0, FM_PIVOT_AXIS_ROW), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_set_sort(wb.handle, 0, pivot_idx, 0, 0, "Amount"), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_set_subtotal_top(wb.handle, 0, pivot_idx, 0, 1), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_set_item_visible(wb.handle, 0, pivot_idx, 0, 0, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_clear_items(wb.handle, 0, pivot_idx, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_add_subtotal_fn(wb.handle, 0, pivot_idx, 0, FM_PIVOT_AGG_COUNT), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_clear_subtotal_fns(wb.handle, 0, pivot_idx, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, FM_PIVOT_DATE_YEAR,
+                                                   FM_PIVOT_CALENDAR_GREGORIAN, 2020, 2026, 1, -1.0, -1.0),
+            0);
+  ASSERT_EQ(fm_workbook_pivot_field_clear_date_group(wb.handle, 0, pivot_idx, 0), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, "4"), 0);
+  const std::uint32_t col_order[] = {1U};
+  ASSERT_EQ(fm_workbook_pivot_set_col_field_order(wb.handle, 0, pivot_idx, col_order, 1U), 0);
+
+  ASSERT_EQ(fm_workbook_pivot_data_field_clear(wb.handle, 0, pivot_idx), 0);
+  std::size_t data_field_count = 99;
+  ASSERT_EQ(fm_workbook_pivot_data_field_count(wb.handle, 0, pivot_idx, &data_field_count), 0);
+  EXPECT_EQ(data_field_count, 0U);
+
+  fm_pivot_filter_spec_t filter{};
+  filter.axis = FM_PIVOT_AXIS_ROW;
+  filter.field_name = "Region";
+  filter.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
+  filter.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
+  filter.value_text = "N";
+  filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
+  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &filter), 0);
+  ASSERT_EQ(fm_workbook_pivot_filter_clear(wb.handle, 0, pivot_idx), 0);
+
+  ASSERT_EQ(fm_workbook_pivot_field_clear(wb.handle, 0, pivot_idx), 0);
+  ASSERT_EQ(fm_workbook_pivot_field_count(wb.handle, 0, pivot_idx, &field_count), 0);
+  EXPECT_EQ(field_count, 0U);
+  ASSERT_EQ(fm_workbook_pivot_cache_field_clear(wb.handle, cache_id), 0);
+  ASSERT_EQ(fm_workbook_pivot_cache_field_count(wb.handle, cache_id, &field_count), 0);
+  EXPECT_EQ(field_count, 0U);
+}
+
+TEST(FormulonCApiPivot, FieldNumberFormatRoundTripsAsNumFmtId) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+  std::uint16_t custom_id = 0;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "0.000", &custom_id), 0) << fm_last_error_message();
+  const std::string custom = std::to_string(custom_id);
+  ASSERT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, custom.c_str()), 0)
+      << fm_last_error_message();
+
+  const std::string first = SavedPivotXml(wb.handle);
+  const std::string attr = "numFmtId=\"" + custom + "\"";
+  EXPECT_EQ(CountOccurrences(first, attr), 1U) << first;
+
+  // A reload reads the attribute into the model rather than into the
+  // passthrough bin, so the next save still emits it exactly once.
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0) << fm_last_error_message();
+  const std::string second = SavedPivotXml(reloaded.handle);
+  EXPECT_EQ(CountOccurrences(second, attr), 1U) << second;
+  EXPECT_NE(second.find("<pivotField dataField=\"1\" " + attr), std::string::npos) << second;
+}
+
+TEST(FormulonCApiPivot, NumberFormatRejectsAnythingButAKnownNumFmtId) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  std::uint32_t cache_id = 0;
+  std::size_t pivot_idx = 0;
+  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
+  const fm_status_t invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+
+  // A format code, a signed id, an id nothing registered, one past uint16.
+  for (const char* bad : {"0.00", "-4", "200", "65536"}) {
+    EXPECT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, bad), invalid) << bad;
+
+    fm_pivot_field_spec_t field_spec{};
+    field_spec.source_name = "Amount";
+    field_spec.axis = FM_PIVOT_AXIS_VALUE;
+    field_spec.number_format = bad;
+    std::size_t field_idx = 99;
+    EXPECT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, pivot_idx, &field_spec, &field_idx), invalid) << bad;
+
+    fm_pivot_data_field_spec_t df_spec{};
+    df_spec.name = "Sum of Amount";
+    df_spec.field_index = 1U;
+    df_spec.aggregation = FM_PIVOT_AGG_SUM;
+    df_spec.number_format = bad;
+    df_spec.show_as_base_field = -1;
+    df_spec.show_as_base_item = -1;
+    std::size_t df_idx = 99;
+    EXPECT_EQ(fm_workbook_pivot_data_field_add(wb.handle, 0, pivot_idx, &df_spec, &df_idx), invalid) << bad;
+    EXPECT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &df_spec), invalid) << bad;
+  }
+  std::size_t field_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_field_count(wb.handle, 0, pivot_idx, &field_count), 0);
+  EXPECT_EQ(field_count, 2U);
+  std::size_t df_count = 0;
+  ASSERT_EQ(fm_workbook_pivot_data_field_count(wb.handle, 0, pivot_idx, &df_count), 0);
+  EXPECT_EQ(df_count, 1U);
+
+  // A built-in id and the empty string (clear) are accepted.
+  EXPECT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, "4"), 0) << fm_last_error_message();
+  EXPECT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, ""), 0) << fm_last_error_message();
+}
diff --git a/tests/c_api/formulon_c_pivot_read_test.cpp b/tests/c_api/formulon_c_pivot_read_test.cpp
new file mode 100644
index 000000000..cd239d113
--- /dev/null
+++ b/tests/c_api/formulon_c_pivot_read_test.cpp
@@ -0,0 +1,267 @@
+// Stable C ABI PivotTable read and loaded-package tests.
+
+#include "formulon_c_pivot_test_helpers.h"
+
+namespace {
+
+std::vector<std::uint8_t> BuildPivotWorkbookBytes() {
+  const std::string_view content_types =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">\n"
+      "  <Default Extension=\"rels\" "
+      "ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>\n"
+      "  <Default Extension=\"xml\" ContentType=\"application/xml\"/>\n"
+      "  <Override PartName=\"/xl/workbook.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/>\n"
+      "  <Override PartName=\"/xl/worksheets/sheet1.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/>\n"
+      "  <Override PartName=\"/xl/worksheets/sheet2.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/>\n"
+      "  <Override PartName=\"/xl/pivotCache/pivotCacheDefinition1.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml\"/>\n"
+      "  <Override PartName=\"/xl/pivotCache/pivotCacheRecords1.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheRecords+xml\"/>\n"
+      "  <Override PartName=\"/xl/pivotTables/pivotTable1.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml\"/>\n"
+      "</Types>\n";
+
+  const std::string_view package_rels =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
+      "  <Relationship Id=\"rId1\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" "
+      "Target=\"xl/workbook.xml\"/>\n"
+      "</Relationships>\n";
+
+  const std::string_view workbook_xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<workbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
+      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\">\n"
+      "  <sheets>\n"
+      "    <sheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/>\n"
+      "    <sheet name=\"Sheet2\" sheetId=\"2\" r:id=\"rId2\"/>\n"
+      "  </sheets>\n"
+      "  <pivotCaches>\n"
+      "    <pivotCache cacheId=\"0\" r:id=\"rId3\"/>\n"
+      "  </pivotCaches>\n"
+      "</workbook>\n";
+
+  const std::string_view workbook_rels =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
+      "  <Relationship Id=\"rId1\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
+      "Target=\"worksheets/sheet1.xml\"/>\n"
+      "  <Relationship Id=\"rId2\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
+      "Target=\"worksheets/sheet2.xml\"/>\n"
+      "  <Relationship Id=\"rId3\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheDefinition\" "
+      "Target=\"pivotCache/pivotCacheDefinition1.xml\"/>\n"
+      "</Relationships>\n";
+
+  const std::string_view sheet_xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n"
+      "  <sheetData/>\n"
+      "</worksheet>\n";
+
+  const std::string_view sheet2_rels =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
+      "  <Relationship Id=\"rId1\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotTable\" "
+      "Target=\"../pivotTables/pivotTable1.xml\"/>\n"
+      "</Relationships>\n";
+
+  const std::string_view pivot_cache_def =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<pivotCacheDefinition xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
+      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" "
+      "r:id=\"rId1\" recordCount=\"3\">\n"
+      // Excel always names the range the records came from. The bare
+      // `<cacheSource type="worksheet"/>` this once carried is a form no
+      // Excel-authored package uses, and one Excel refuses to open.
+      "  <cacheSource type=\"worksheet\"><worksheetSource ref=\"A1:B4\" sheet=\"Sheet1\"/></cacheSource>\n"
+      "  <cacheFields count=\"2\">\n"
+      "    <cacheField name=\"Region\"><sharedItems count=\"2\"><s v=\"North\"/><s "
+      "v=\"South\"/></sharedItems></cacheField>\n"
+      "    <cacheField name=\"Amount\"><sharedItems containsNumber=\"1\"/></cacheField>\n"
+      "  </cacheFields>\n"
+      "</pivotCacheDefinition>\n";
+
+  const std::string_view pivot_cache_def_rels =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
+      "  <Relationship Id=\"rId1\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheRecords\" "
+      "Target=\"pivotCacheRecords1.xml\"/>\n"
+      "</Relationships>\n";
+
+  const std::string_view pivot_cache_records =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<pivotCacheRecords xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" count=\"3\">\n"
+      "  <r><x v=\"0\"/><n v=\"100\"/></r>\n"
+      "  <r><x v=\"1\"/><n v=\"200\"/></r>\n"
+      "  <r><x v=\"0\"/><n v=\"300\"/></r>\n"
+      "</pivotCacheRecords>\n";
+
+  const std::string_view pivot_table_def =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<pivotTableDefinition xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
+      "name=\"PivotTable1\" cacheId=\"0\">\n"
+      "  <location ref=\"D1:E5\"/>\n"
+      "  <pivotFields count=\"2\">\n"
+      "    <pivotField axis=\"axisRow\" name=\"Region\"><items count=\"3\"><item x=\"0\"/><item x=\"1\"/><item "
+      "t=\"default\"/></items></pivotField>\n"
+      "    <pivotField dataField=\"1\" name=\"Amount\"/>\n"
+      "  </pivotFields>\n"
+      "  <rowFields count=\"1\"><field x=\"0\"/></rowFields>\n"
+      "  <dataFields count=\"1\"><dataField name=\"Sum of Amount\" fld=\"1\" subtotal=\"sum\"/></dataFields>\n"
+      "</pivotTableDefinition>\n";
+
+  return BuildZip({
+      {"[Content_Types].xml", content_types},
+      {"_rels/.rels", package_rels},
+      {"xl/workbook.xml", workbook_xml},
+      {"xl/_rels/workbook.xml.rels", workbook_rels},
+      {"xl/worksheets/sheet1.xml", sheet_xml},
+      {"xl/worksheets/sheet2.xml", sheet_xml},
+      {"xl/worksheets/_rels/sheet2.xml.rels", sheet2_rels},
+      {"xl/pivotCache/pivotCacheDefinition1.xml", pivot_cache_def},
+      {"xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels", pivot_cache_def_rels},
+      {"xl/pivotCache/pivotCacheRecords1.xml", pivot_cache_records},
+      {"xl/pivotTables/pivotTable1.xml", pivot_table_def},
+  });
+}
+
+const fm_pivot_cell_t* FindCell(const std::vector<fm_pivot_cell_t>& cells, std::uint32_t row, std::uint32_t col) {
+  for (const fm_pivot_cell_t& cell : cells) {
+    if (cell.row == row && cell.col == col) {
+      return &cell;
+    }
+  }
+  return nullptr;
+}
+
+}  // namespace
+
+TEST(FormulonCApiPivot, CountAndLayoutLoadedPivot) {
+  const std::vector<std::uint8_t> bytes = BuildPivotWorkbookBytes();
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb.handle), 0) << fm_last_error_message();
+  ASSERT_NE(wb.handle, nullptr);
+
+  std::size_t count = 99;
+  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 0, &count), 0);
+  EXPECT_EQ(count, 0U);
+  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 1, &count), 0);
+  EXPECT_EQ(count, 1U);
+
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 1, 0, &projected.handle), 0) << fm_last_error_message();
+  ASSERT_NE(projected.handle, nullptr);
+
+  std::uint32_t top = 0;
+  std::uint32_t left = 0;
+  std::uint32_t rows = 0;
+  std::uint32_t cols = 0;
+  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
+  EXPECT_EQ(top, 0U);
+  EXPECT_EQ(left, 3U);
+  EXPECT_EQ(rows, 4U);
+  EXPECT_EQ(cols, 2U);
+
+  std::vector<fm_pivot_cell_t> cells;
+  const std::size_t cell_count = fm_pivot_cells_count(projected.handle);
+  ASSERT_GT(cell_count, 0U);
+  cells.resize(cell_count);
+  for (std::size_t i = 0; i < cell_count; ++i) {
+    ASSERT_EQ(fm_pivot_cells_at(projected.handle, i, &cells[i]), 0);
+  }
+
+  const fm_pivot_cell_t* row_labels = FindCell(cells, 0, 3);
+  ASSERT_NE(row_labels, nullptr);
+  EXPECT_EQ(row_labels->kind, FM_PIVOT_CELL_HEADER);
+  EXPECT_EQ(row_labels->value.kind, FM_VAL_TEXT);
+  ASSERT_NE(row_labels->value.u.text, nullptr);
+  EXPECT_STREQ(row_labels->value.u.text, "行ラベル");
+
+  const fm_pivot_cell_t* north_label = FindCell(cells, 1, 3);
+  ASSERT_NE(north_label, nullptr);
+  EXPECT_EQ(north_label->kind, FM_PIVOT_CELL_ROW_LABEL);
+  EXPECT_EQ(north_label->value.kind, FM_VAL_TEXT);
+  EXPECT_STREQ(north_label->value.u.text, "North");
+
+  const fm_pivot_cell_t* north_sum = FindCell(cells, 1, 4);
+  ASSERT_NE(north_sum, nullptr);
+  EXPECT_EQ(north_sum->kind, FM_PIVOT_CELL_DATA);
+  EXPECT_EQ(north_sum->value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(north_sum->value.u.number, 400.0);
+  ASSERT_NE(north_sum->field_name, nullptr);
+  EXPECT_STREQ(north_sum->field_name, "Sum of Amount");
+
+  const fm_pivot_cell_t* grand_total = FindCell(cells, 3, 4);
+  ASSERT_NE(grand_total, nullptr);
+  EXPECT_EQ(grand_total->kind, FM_PIVOT_CELL_GRAND_TOTAL);
+  EXPECT_EQ(grand_total->value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(grand_total->value.u.number, 600.0);
+}
+
+TEST(FormulonCApiPivot, InvalidPivotArgsReturnErrors) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  std::size_t count = 0;
+  EXPECT_EQ(fm_workbook_pivot_count(nullptr, 0, &count),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+  EXPECT_EQ(fm_workbook_pivot_count(wb.handle, 99, &count),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  fm_pivot_cells_t* cells = nullptr;
+  EXPECT_EQ(fm_workbook_pivot_layout(wb.handle, 0, 0, &cells),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(cells, nullptr);
+
+  fm_pivot_cell_t cell{};
+  EXPECT_EQ(fm_pivot_cells_at(nullptr, 0, &cell),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+}
+
+TEST(FormulonCApiPivot, AddingAFieldAfterLoadReprojectsTheLocationRef) {
+  // The loaded package declares `ref="D1:E5"`, which described the report
+  // as Excel left it. Adding a column field widens the grid, so re-emitting
+  // the authored span would now under-size it -- the same crash, reached by
+  // loading rather than by building.
+  WorkbookGuard wb;
+  const std::vector<std::uint8_t> package = BuildPivotWorkbookBytes();
+  ASSERT_EQ(fm_workbook_load(package.data(), package.size(), &wb.handle), 0) << fm_last_error_message();
+
+  fm_pivot_field_spec_t region_spec{};
+  region_spec.source_name = "Region";
+  region_spec.custom_name = "";
+  region_spec.axis = FM_PIVOT_AXIS_COL;
+  region_spec.subtotal_top = 0;
+  region_spec.number_format = "";
+  std::size_t added = 99;
+  ASSERT_EQ(fm_workbook_pivot_field_add(wb.handle, 1, 0, &region_spec, &added), 0) << fm_last_error_message();
+  const std::uint32_t col_order[] = {static_cast<std::uint32_t>(added)};
+  ASSERT_EQ(fm_workbook_pivot_set_col_field_order(wb.handle, 1, 0, col_order, 1), 0) << fm_last_error_message();
+
+  PivotCellsGuard projected;
+  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 1, 0, &projected.handle), 0) << fm_last_error_message();
+  std::uint32_t top = 0;
+  std::uint32_t left = 0;
+  std::uint32_t rows = 0;
+  std::uint32_t cols = 0;
+  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
+  ASSERT_GT(cols, 2U) << "the added column field must widen the report";
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
+  const std::vector<std::uint8_t> written(saved.data, saved.data + saved.len);
+  const std::string pivot_xml = ExtractZipEntry(written, "xl/pivotTables/pivotTable1.xml");
+  ASSERT_FALSE(pivot_xml.empty());
+  EXPECT_EQ(pivot_xml.find("<location ref=\"D1:E5\""), std::string::npos)
+      << "the authored span no longer describes the report; xml=" << pivot_xml;
+}
diff --git a/tests/c_api/formulon_c_pivot_test.cpp b/tests/c_api/formulon_c_pivot_test.cpp
deleted file mode 100644
index 74830814e..000000000
--- a/tests/c_api/formulon_c_pivot_test.cpp
+++ /dev/null
@@ -1,2200 +0,0 @@
-//
-// Stable C ABI PivotTable layout tests. The workbook is loaded through the
-// C surface from a minimal OOXML package; assertions then use only C ABI
-// entry points to count and project the pivot.
-
-#include <cstddef>
-#include <cstdint>
-#include <cstring>
-#include <limits>
-#include <string>
-#include <string_view>
-#include <vector>
-
-#include "c_api/formulon_c.h"
-#include "c_api/parts/common.h"
-#include "gtest/gtest.h"
-#include "miniz.h"
-#include "pivot/pivot_table.h"
-#include "utils/error.h"
-
-namespace {
-
-struct WorkbookGuard {
-  fm_workbook_t* handle = nullptr;
-  ~WorkbookGuard() { fm_workbook_destroy(handle); }
-  WorkbookGuard() = default;
-  WorkbookGuard(const WorkbookGuard&) = delete;
-  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
-};
-
-struct PivotCellsGuard {
-  fm_pivot_cells_t* handle = nullptr;
-  ~PivotCellsGuard() { fm_pivot_cells_destroy(handle); }
-  PivotCellsGuard() = default;
-  PivotCellsGuard(const PivotCellsGuard&) = delete;
-  PivotCellsGuard& operator=(const PivotCellsGuard&) = delete;
-};
-
-struct BufferGuard {
-  std::uint8_t* data = nullptr;
-  std::size_t len = 0;
-  ~BufferGuard() { fm_buffer_free(data); }
-  BufferGuard() = default;
-  BufferGuard(const BufferGuard&) = delete;
-  BufferGuard& operator=(const BufferGuard&) = delete;
-};
-
-struct PartFile {
-  const char* path;
-  std::string_view body;
-};
-
-// A foreign-ABI caller can put any int-sized value into an enum field, which is
-// exactly what the C surface has to reject. Writing the bytes reproduces that
-// without a constant conversion: an enumerator outside the enum's implied value
-// range is unspecified, and GCC rejects it under -Wconversion.
-template <typename Enum>
-Enum RawEnumValue(std::uint32_t raw) {
-  static_assert(sizeof(Enum) == sizeof(std::uint32_t), "C ABI enums are int-sized");
-  Enum value{};
-  std::memcpy(&value, &raw, sizeof(value));
-  return value;
-}
-
-std::vector<std::uint8_t> BuildZip(const std::vector<PartFile>& parts) {
-  mz_zip_archive writer{};
-  EXPECT_NE(mz_zip_writer_init_heap(&writer, 0, 4096), MZ_FALSE);
-  for (const auto& p : parts) {
-    EXPECT_NE(mz_zip_writer_add_mem(&writer, p.path, p.body.data(), p.body.size(),
-                                    static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)),
-              MZ_FALSE)
-        << "miniz add failed for " << p.path;
-  }
-  void* archive_ptr = nullptr;
-  std::size_t archive_size = 0;
-  EXPECT_NE(mz_zip_writer_finalize_heap_archive(&writer, &archive_ptr, &archive_size), MZ_FALSE);
-  EXPECT_NE(mz_zip_writer_end(&writer), MZ_FALSE);
-  std::vector<std::uint8_t> out(static_cast<const std::uint8_t*>(archive_ptr),
-                                static_cast<const std::uint8_t*>(archive_ptr) + archive_size);
-  mz_free(archive_ptr);
-  return out;
-}
-
-std::string ExtractZipEntry(const std::vector<std::uint8_t>& archive_bytes, std::string_view path) {
-  mz_zip_archive reader{};
-  if (mz_zip_reader_init_mem(&reader, archive_bytes.data(), archive_bytes.size(), 0) == MZ_FALSE) {
-    ADD_FAILURE() << "mz_zip_reader_init_mem failed";
-    return {};
-  }
-  const int index = mz_zip_reader_locate_file(&reader, std::string(path).c_str(), nullptr, 0);
-  if (index < 0) {
-    ADD_FAILURE() << "entry not found: " << path;
-    mz_zip_reader_end(&reader);
-    return {};
-  }
-  std::size_t extracted_size = 0;
-  void* extracted = mz_zip_reader_extract_to_heap(&reader, static_cast<mz_uint>(index), &extracted_size, 0);
-  if (extracted == nullptr) {
-    ADD_FAILURE() << "extract_to_heap failed for: " << path;
-    mz_zip_reader_end(&reader);
-    return {};
-  }
-  std::string body(static_cast<const char*>(extracted), extracted_size);
-  mz_free(extracted);
-  mz_zip_reader_end(&reader);
-  return body;
-}
-
-std::vector<std::uint8_t> BuildPivotWorkbookBytes() {
-  const std::string_view content_types =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">\n"
-      "  <Default Extension=\"rels\" "
-      "ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>\n"
-      "  <Default Extension=\"xml\" ContentType=\"application/xml\"/>\n"
-      "  <Override PartName=\"/xl/workbook.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/>\n"
-      "  <Override PartName=\"/xl/worksheets/sheet1.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/>\n"
-      "  <Override PartName=\"/xl/worksheets/sheet2.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/>\n"
-      "  <Override PartName=\"/xl/pivotCache/pivotCacheDefinition1.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml\"/>\n"
-      "  <Override PartName=\"/xl/pivotCache/pivotCacheRecords1.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheRecords+xml\"/>\n"
-      "  <Override PartName=\"/xl/pivotTables/pivotTable1.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml\"/>\n"
-      "</Types>\n";
-
-  const std::string_view package_rels =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
-      "  <Relationship Id=\"rId1\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" "
-      "Target=\"xl/workbook.xml\"/>\n"
-      "</Relationships>\n";
-
-  const std::string_view workbook_xml =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<workbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
-      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\">\n"
-      "  <sheets>\n"
-      "    <sheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/>\n"
-      "    <sheet name=\"Sheet2\" sheetId=\"2\" r:id=\"rId2\"/>\n"
-      "  </sheets>\n"
-      "  <pivotCaches>\n"
-      "    <pivotCache cacheId=\"0\" r:id=\"rId3\"/>\n"
-      "  </pivotCaches>\n"
-      "</workbook>\n";
-
-  const std::string_view workbook_rels =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
-      "  <Relationship Id=\"rId1\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
-      "Target=\"worksheets/sheet1.xml\"/>\n"
-      "  <Relationship Id=\"rId2\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
-      "Target=\"worksheets/sheet2.xml\"/>\n"
-      "  <Relationship Id=\"rId3\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheDefinition\" "
-      "Target=\"pivotCache/pivotCacheDefinition1.xml\"/>\n"
-      "</Relationships>\n";
-
-  const std::string_view sheet_xml =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n"
-      "  <sheetData/>\n"
-      "</worksheet>\n";
-
-  const std::string_view sheet2_rels =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
-      "  <Relationship Id=\"rId1\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotTable\" "
-      "Target=\"../pivotTables/pivotTable1.xml\"/>\n"
-      "</Relationships>\n";
-
-  const std::string_view pivot_cache_def =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<pivotCacheDefinition xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
-      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" "
-      "r:id=\"rId1\" recordCount=\"3\">\n"
-      // Excel always names the range the records came from. The bare
-      // `<cacheSource type="worksheet"/>` this once carried is a form no
-      // Excel-authored package uses, and one Excel refuses to open.
-      "  <cacheSource type=\"worksheet\"><worksheetSource ref=\"A1:B4\" sheet=\"Sheet1\"/></cacheSource>\n"
-      "  <cacheFields count=\"2\">\n"
-      "    <cacheField name=\"Region\"><sharedItems count=\"2\"><s v=\"North\"/><s "
-      "v=\"South\"/></sharedItems></cacheField>\n"
-      "    <cacheField name=\"Amount\"><sharedItems containsNumber=\"1\"/></cacheField>\n"
-      "  </cacheFields>\n"
-      "</pivotCacheDefinition>\n";
-
-  const std::string_view pivot_cache_def_rels =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
-      "  <Relationship Id=\"rId1\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheRecords\" "
-      "Target=\"pivotCacheRecords1.xml\"/>\n"
-      "</Relationships>\n";
-
-  const std::string_view pivot_cache_records =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<pivotCacheRecords xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" count=\"3\">\n"
-      "  <r><x v=\"0\"/><n v=\"100\"/></r>\n"
-      "  <r><x v=\"1\"/><n v=\"200\"/></r>\n"
-      "  <r><x v=\"0\"/><n v=\"300\"/></r>\n"
-      "</pivotCacheRecords>\n";
-
-  const std::string_view pivot_table_def =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<pivotTableDefinition xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
-      "name=\"PivotTable1\" cacheId=\"0\">\n"
-      "  <location ref=\"D1:E5\"/>\n"
-      "  <pivotFields count=\"2\">\n"
-      "    <pivotField axis=\"axisRow\" name=\"Region\"><items count=\"3\"><item x=\"0\"/><item x=\"1\"/><item "
-      "t=\"default\"/></items></pivotField>\n"
-      "    <pivotField dataField=\"1\" name=\"Amount\"/>\n"
-      "  </pivotFields>\n"
-      "  <rowFields count=\"1\"><field x=\"0\"/></rowFields>\n"
-      "  <dataFields count=\"1\"><dataField name=\"Sum of Amount\" fld=\"1\" subtotal=\"sum\"/></dataFields>\n"
-      "</pivotTableDefinition>\n";
-
-  return BuildZip({
-      {"[Content_Types].xml", content_types},
-      {"_rels/.rels", package_rels},
-      {"xl/workbook.xml", workbook_xml},
-      {"xl/_rels/workbook.xml.rels", workbook_rels},
-      {"xl/worksheets/sheet1.xml", sheet_xml},
-      {"xl/worksheets/sheet2.xml", sheet_xml},
-      {"xl/worksheets/_rels/sheet2.xml.rels", sheet2_rels},
-      {"xl/pivotCache/pivotCacheDefinition1.xml", pivot_cache_def},
-      {"xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels", pivot_cache_def_rels},
-      {"xl/pivotCache/pivotCacheRecords1.xml", pivot_cache_records},
-      {"xl/pivotTables/pivotTable1.xml", pivot_table_def},
-  });
-}
-
-const fm_pivot_cell_t* FindCell(const std::vector<fm_pivot_cell_t>& cells, std::uint32_t row, std::uint32_t col) {
-  for (const fm_pivot_cell_t& cell : cells) {
-    if (cell.row == row && cell.col == col) {
-      return &cell;
-    }
-  }
-  return nullptr;
-}
-
-}  // namespace
-
-TEST(FormulonCApiPivot, CountAndLayoutLoadedPivot) {
-  const std::vector<std::uint8_t> bytes = BuildPivotWorkbookBytes();
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb.handle), 0) << fm_last_error_message();
-  ASSERT_NE(wb.handle, nullptr);
-
-  std::size_t count = 99;
-  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 0, &count), 0);
-  EXPECT_EQ(count, 0U);
-  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 1, &count), 0);
-  EXPECT_EQ(count, 1U);
-
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 1, 0, &projected.handle), 0) << fm_last_error_message();
-  ASSERT_NE(projected.handle, nullptr);
-
-  std::uint32_t top = 0;
-  std::uint32_t left = 0;
-  std::uint32_t rows = 0;
-  std::uint32_t cols = 0;
-  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
-  EXPECT_EQ(top, 0U);
-  EXPECT_EQ(left, 3U);
-  EXPECT_EQ(rows, 4U);
-  EXPECT_EQ(cols, 2U);
-
-  std::vector<fm_pivot_cell_t> cells;
-  const std::size_t cell_count = fm_pivot_cells_count(projected.handle);
-  ASSERT_GT(cell_count, 0U);
-  cells.resize(cell_count);
-  for (std::size_t i = 0; i < cell_count; ++i) {
-    ASSERT_EQ(fm_pivot_cells_at(projected.handle, i, &cells[i]), 0);
-  }
-
-  const fm_pivot_cell_t* row_labels = FindCell(cells, 0, 3);
-  ASSERT_NE(row_labels, nullptr);
-  EXPECT_EQ(row_labels->kind, FM_PIVOT_CELL_HEADER);
-  EXPECT_EQ(row_labels->value.kind, FM_VAL_TEXT);
-  ASSERT_NE(row_labels->value.u.text, nullptr);
-  EXPECT_STREQ(row_labels->value.u.text, "行ラベル");
-
-  const fm_pivot_cell_t* north_label = FindCell(cells, 1, 3);
-  ASSERT_NE(north_label, nullptr);
-  EXPECT_EQ(north_label->kind, FM_PIVOT_CELL_ROW_LABEL);
-  EXPECT_EQ(north_label->value.kind, FM_VAL_TEXT);
-  EXPECT_STREQ(north_label->value.u.text, "North");
-
-  const fm_pivot_cell_t* north_sum = FindCell(cells, 1, 4);
-  ASSERT_NE(north_sum, nullptr);
-  EXPECT_EQ(north_sum->kind, FM_PIVOT_CELL_DATA);
-  EXPECT_EQ(north_sum->value.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(north_sum->value.u.number, 400.0);
-  ASSERT_NE(north_sum->field_name, nullptr);
-  EXPECT_STREQ(north_sum->field_name, "Sum of Amount");
-
-  const fm_pivot_cell_t* grand_total = FindCell(cells, 3, 4);
-  ASSERT_NE(grand_total, nullptr);
-  EXPECT_EQ(grand_total->kind, FM_PIVOT_CELL_GRAND_TOTAL);
-  EXPECT_EQ(grand_total->value.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(grand_total->value.u.number, 600.0);
-}
-
-TEST(FormulonCApiPivot, InvalidPivotArgsReturnErrors) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  std::size_t count = 0;
-  EXPECT_EQ(fm_workbook_pivot_count(nullptr, 0, &count),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-  EXPECT_EQ(fm_workbook_pivot_count(wb.handle, 99, &count),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  fm_pivot_cells_t* cells = nullptr;
-  EXPECT_EQ(fm_workbook_pivot_layout(wb.handle, 0, 0, &cells),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(cells, nullptr);
-
-  fm_pivot_cell_t cell{};
-  EXPECT_EQ(fm_pivot_cells_at(nullptr, 0, &cell),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-}
-
-// ----------------------------------------------------------------------------
-// Pivot mutation surface
-// ----------------------------------------------------------------------------
-
-namespace {
-
-// Builds a pivot cache + table from scratch via the C ABI:
-//   * 2 fields: "Region" (text) and "Amount" (numeric).
-//   * 4 records: (North, 100), (South, 200), (North, 300), (South, 400).
-//   * Pivot table on sheet 0, name "PT", anchor (0, 3), with Region as the
-//     row field and Amount aggregated as Sum.
-fm_status_t BuildScratchPivot(fm_workbook_t* wb, std::uint32_t* out_cache_id, std::size_t* out_pivot_index) {
-  std::uint32_t cache_id = 0;
-  fm_status_t st = fm_workbook_pivot_cache_create(wb, 0, &cache_id);
-  if (st != 0) {
-    return st;
-  }
-  // Excel refuses a package whose cache declares no source, so a cache
-  // that is going to be saved needs one. The range only has to describe
-  // where the records came from; it is not required to hold data, since
-  // the records themselves carry the values.
-  st = fm_workbook_pivot_cache_set_worksheet_source(wb, cache_id, /*present=*/1, "A1:B5", "Sheet1", nullptr);
-  if (st != 0) {
-    return st;
-  }
-  std::size_t region_idx = 99;
-  st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Region", &region_idx);
-  if (st != 0) {
-    return st;
-  }
-  std::size_t amount_idx = 99;
-  st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Amount", &amount_idx);
-  if (st != 0) {
-    return st;
-  }
-  // Shared items for "Region": index 0 = "North", index 1 = "South".
-  st = fm_workbook_pivot_cache_field_add_shared_item_text(wb, cache_id, region_idx, "North");
-  if (st != 0) {
-    return st;
-  }
-  st = fm_workbook_pivot_cache_field_add_shared_item_text(wb, cache_id, region_idx, "South");
-  if (st != 0) {
-    return st;
-  }
-  // 4 records.
-  const struct {
-    double region_index;
-    double amount;
-  } rows[] = {{0.0, 100.0}, {1.0, 200.0}, {0.0, 300.0}, {1.0, 400.0}};
-  for (const auto& row : rows) {
-    std::size_t rec_idx = 99;
-    st = fm_workbook_pivot_cache_record_add(wb, cache_id, &rec_idx);
-    if (st != 0) {
-      return st;
-    }
-    st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, region_idx, row.region_index);
-    if (st != 0) {
-      return st;
-    }
-    st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, amount_idx, row.amount);
-    if (st != 0) {
-      return st;
-    }
-  }
-  // Pivot table.
-  std::size_t pivot_idx = 99;
-  st = fm_workbook_pivot_create(wb, 0, "PT", cache_id, /*anchor_row=*/0U, /*anchor_col=*/3U, &pivot_idx);
-  if (st != 0) {
-    return st;
-  }
-  // Region (row) + items 0 and 1, plus the OOXML "default" subtotal item.
-  fm_pivot_field_spec_t region_spec{};
-  region_spec.source_name = "Region";
-  region_spec.custom_name = "";
-  region_spec.axis = FM_PIVOT_AXIS_ROW;
-  region_spec.subtotal_top = 0;
-  region_spec.number_format = "";
-  std::size_t region_field = 99;
-  st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &region_spec, &region_field);
-  if (st != 0) {
-    return st;
-  }
-  st = fm_workbook_pivot_field_add_item(wb, 0, pivot_idx, region_field, "North", 1);
-  if (st != 0) {
-    return st;
-  }
-  st = fm_workbook_pivot_field_add_item(wb, 0, pivot_idx, region_field, "South", 1);
-  if (st != 0) {
-    return st;
-  }
-  // Amount (value-axis source field).
-  fm_pivot_field_spec_t amount_spec{};
-  amount_spec.source_name = "Amount";
-  amount_spec.custom_name = "";
-  amount_spec.axis = FM_PIVOT_AXIS_VALUE;
-  amount_spec.subtotal_top = 0;
-  amount_spec.number_format = "";
-  std::size_t amount_field = 99;
-  st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &amount_spec, &amount_field);
-  if (st != 0) {
-    return st;
-  }
-  // Row-field order.
-  const std::uint32_t row_order[] = {static_cast<std::uint32_t>(region_field)};
-  st = fm_workbook_pivot_set_row_field_order(wb, 0, pivot_idx, row_order, 1U);
-  if (st != 0) {
-    return st;
-  }
-  // Data field: Sum of Amount.
-  fm_pivot_data_field_spec_t df_spec{};
-  df_spec.name = "Sum of Amount";
-  df_spec.field_index = static_cast<std::uint32_t>(amount_field);
-  df_spec.aggregation = FM_PIVOT_AGG_SUM;
-  df_spec.number_format = "";
-  df_spec.show_as = FM_PIVOT_SHOW_AS_NORMAL;
-  df_spec.show_as_base_field = -1;
-  df_spec.show_as_base_item = -1;
-  std::size_t df_idx = 99;
-  st = fm_workbook_pivot_data_field_add(wb, 0, pivot_idx, &df_spec, &df_idx);
-  if (st != 0) {
-    return st;
-  }
-  if (out_cache_id != nullptr) {
-    *out_cache_id = cache_id;
-  }
-  if (out_pivot_index != nullptr) {
-    *out_pivot_index = pivot_idx;
-  }
-  return 0;
-}
-
-std::vector<fm_pivot_cell_t> CollectCells(fm_pivot_cells_t* handle) {
-  const std::size_t n = fm_pivot_cells_count(handle);
-  std::vector<fm_pivot_cell_t> out(n);
-  for (std::size_t i = 0; i < n; ++i) {
-    EXPECT_EQ(fm_pivot_cells_at(handle, i, &out[i]), 0);
-  }
-  return out;
-}
-
-}  // namespace
-
-TEST(FormulonCApiPivot, CreatePivotFromScratch) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  std::size_t cache_count = 0;
-  ASSERT_EQ(fm_workbook_pivot_cache_count(wb.handle, &cache_count), 0);
-  EXPECT_EQ(cache_count, 1U);
-
-  std::size_t pivot_count = 0;
-  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 0, &pivot_count), 0);
-  EXPECT_EQ(pivot_count, 1U);
-
-  std::size_t records = 0;
-  ASSERT_EQ(fm_workbook_pivot_cache_record_count(wb.handle, cache_id, &records), 0);
-  EXPECT_EQ(records, 4U);
-
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-
-  const std::vector<fm_pivot_cell_t> cells = CollectCells(projected.handle);
-  ASSERT_FALSE(cells.empty());
-
-  // North (regions 0, 2) sum = 400; South (regions 1, 3) sum = 600.
-  // Grand total = 1000.
-  bool saw_north = false;
-  bool saw_south = false;
-  bool saw_grand = false;
-  for (const fm_pivot_cell_t& c : cells) {
-    if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER) {
-      if (c.value.u.number == 400.0) {
-        saw_north = true;
-      } else if (c.value.u.number == 600.0) {
-        saw_south = true;
-      }
-    }
-    if (c.kind == FM_PIVOT_CELL_GRAND_TOTAL && c.value.kind == FM_VAL_NUMBER && c.value.u.number == 1000.0) {
-      saw_grand = true;
-    }
-  }
-  EXPECT_TRUE(saw_north);
-  EXPECT_TRUE(saw_south);
-  EXPECT_TRUE(saw_grand);
-}
-
-// Builds, entirely through the C ABI, the pivot
-// tests/fixtures/excel/win/pivot_week_1900.xlsx pins: a "Date"/"Amount"
-// source (71 records, Excel serials 0..70 under the 1900 date system,
-// amount 1 each), Date on the row axis grouped `FM_PIVOT_DATE_DAYS` at
-// a 7-day interval, Sum(Amount) as the one data field. `start_serial`
-// mirrors the fixture's Start variants (`-1.0` = auto).
-fm_status_t BuildDaysGroupedPivot(fm_workbook_t* wb, double start_serial, std::size_t* out_pivot_index) {
-  std::uint32_t cache_id = 0;
-  fm_status_t st = fm_workbook_pivot_cache_create(wb, 0, &cache_id);
-  if (st != 0) {
-    return st;
-  }
-  st = fm_workbook_pivot_cache_set_worksheet_source(wb, cache_id, /*present=*/1, "A1:B71", "Sheet1", nullptr);
-  if (st != 0) {
-    return st;
-  }
-  std::size_t date_idx = 99;
-  st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Date", &date_idx);
-  if (st != 0) {
-    return st;
-  }
-  std::size_t amount_idx = 99;
-  st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Amount", &amount_idx);
-  if (st != 0) {
-    return st;
-  }
-  for (double serial = 0.0; serial <= 70.0; serial += 1.0) {
-    std::size_t rec_idx = 99;
-    st = fm_workbook_pivot_cache_record_add(wb, cache_id, &rec_idx);
-    if (st != 0) {
-      return st;
-    }
-    st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, date_idx, serial);
-    if (st != 0) {
-      return st;
-    }
-    st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, amount_idx, 1.0);
-    if (st != 0) {
-      return st;
-    }
-  }
-  std::size_t pivot_idx = 99;
-  st = fm_workbook_pivot_create(wb, 0, "PT", cache_id, /*anchor_row=*/0U, /*anchor_col=*/3U, &pivot_idx);
-  if (st != 0) {
-    return st;
-  }
-  fm_pivot_field_spec_t date_spec{};
-  date_spec.source_name = "Date";
-  date_spec.custom_name = "";
-  date_spec.axis = FM_PIVOT_AXIS_ROW;
-  date_spec.subtotal_top = 0;
-  date_spec.number_format = "";
-  std::size_t date_field = 99;
-  st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &date_spec, &date_field);
-  if (st != 0) {
-    return st;
-  }
-  st = fm_workbook_pivot_field_set_date_group(wb, 0, pivot_idx, date_field, FM_PIVOT_DATE_DAYS,
-                                              FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, /*interval_days=*/7, start_serial,
-                                              /*end_serial_or_neg1=*/-1.0);
-  if (st != 0) {
-    return st;
-  }
-  fm_pivot_field_spec_t amount_spec{};
-  amount_spec.source_name = "Amount";
-  amount_spec.custom_name = "";
-  amount_spec.axis = FM_PIVOT_AXIS_VALUE;
-  amount_spec.subtotal_top = 0;
-  amount_spec.number_format = "";
-  std::size_t amount_field = 99;
-  st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &amount_spec, &amount_field);
-  if (st != 0) {
-    return st;
-  }
-  const std::uint32_t row_order[] = {static_cast<std::uint32_t>(date_field)};
-  st = fm_workbook_pivot_set_row_field_order(wb, 0, pivot_idx, row_order, 1U);
-  if (st != 0) {
-    return st;
-  }
-  fm_pivot_data_field_spec_t df_spec{};
-  df_spec.name = "Sum of Amount";
-  df_spec.field_index = static_cast<std::uint32_t>(amount_field);
-  df_spec.aggregation = FM_PIVOT_AGG_SUM;
-  df_spec.number_format = "";
-  df_spec.show_as = FM_PIVOT_SHOW_AS_NORMAL;
-  df_spec.show_as_base_field = -1;
-  df_spec.show_as_base_item = -1;
-  std::size_t df_idx = 99;
-  st = fm_workbook_pivot_data_field_add(wb, 0, pivot_idx, &df_spec, &df_idx);
-  if (st != 0) {
-    return st;
-  }
-  if (out_pivot_index != nullptr) {
-    *out_pivot_index = pivot_idx;
-  }
-  return 0;
-}
-
-// Collects (row label, Sum(Amount)) pairs from a one-row-field,
-// one-data-field pivot's projected grid, in row order.
-std::vector<std::pair<std::string, double>> CollectDaysGroupRows(fm_pivot_cells_t* handle) {
-  std::vector<fm_pivot_cell_t> cells = CollectCells(handle);
-  std::vector<std::pair<std::string, double>> labels_by_row;
-  std::vector<double> sums_by_row;
-  for (const fm_pivot_cell_t& c : cells) {
-    if (c.kind == FM_PIVOT_CELL_ROW_LABEL && c.value.kind == FM_VAL_TEXT) {
-      labels_by_row.emplace_back(std::string(c.value.u.text), 0.0);
-    } else if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER) {
-      sums_by_row.push_back(c.value.u.number);
-    }
-  }
-  EXPECT_EQ(labels_by_row.size(), sums_by_row.size());
-  for (std::size_t i = 0; i < labels_by_row.size() && i < sums_by_row.size(); ++i) {
-    labels_by_row[i].second = sums_by_row[i];
-  }
-  return labels_by_row;
-}
-
-TEST(FormulonCApiPivot, DaysGroupMatchesPivotWeek1900FixtureThroughTheAbi) {
-  // Ground truth transcribed from
-  // tests/fixtures/excel/win/pivot_week_1900/results.json (Windows Excel
-  // 365 ja-JP, build 16.0.20228): four Start variants of the same
-  // By-7-days grouping, read from the real Excel-rendered pivot. `auto`
-  // (Start=True) and `start0` (Start=0) coincide because 0 is already
-  // the data minimum.
-  const double kAuto = -1.0;
-  const std::vector<std::pair<std::string, double>> kAutoAndStart0Rows = {
-      {"1900/1/0 - 1900/1/6", 7.0},   {"1900/1/7 - 1900/1/13", 7.0},  {"1900/1/14 - 1900/1/20", 7.0},
-      {"1900/1/21 - 1900/1/27", 7.0}, {"1900/1/28 - 1900/2/3", 7.0},  {"1900/2/4 - 1900/2/10", 7.0},
-      {"1900/2/11 - 1900/2/17", 7.0}, {"1900/2/18 - 1900/2/24", 7.0}, {"1900/2/25 - 1900/3/2", 7.0},
-      {"1900/3/3 - 1900/3/9", 7.0},   {"1900/3/10 - 1900/3/11", 1.0},
-  };
-  const std::vector<std::pair<std::string, double>> kStart1Rows = {
-      {"<1900/1/1", 1.0},
-      {"1900/1/1 - 1900/1/7", 7.0},
-      {"1900/1/8 - 1900/1/14", 7.0},
-      {"1900/1/15 - 1900/1/21", 7.0},
-      {"1900/1/22 - 1900/1/28", 7.0},
-      {"1900/1/29 - 1900/2/4", 7.0},
-      {"1900/2/5 - 1900/2/11", 7.0},
-      {"1900/2/12 - 1900/2/18", 7.0},
-      {"1900/2/19 - 1900/2/25", 7.0},
-      {"1900/2/26 - 1900/3/3", 7.0},
-      {"1900/3/4 - 1900/3/10", 7.0},
-  };
-  const std::vector<std::pair<std::string, double>> kStart61Rows = {
-      {"<1900/3/1", 61.0},
-      {"1900/3/1 - 1900/3/7", 7.0},
-      {"1900/3/8 - 1900/3/11", 3.0},
-  };
-
-  const struct {
-    const char* name;
-    double start_serial;
-    const std::vector<std::pair<std::string, double>>* expected;
-  } variants[] = {
-      {"auto", kAuto, &kAutoAndStart0Rows},
-      {"start0", 0.0, &kAutoAndStart0Rows},
-      {"start1", 1.0, &kStart1Rows},
-      {"start61", 61.0, &kStart61Rows},
-  };
-
-  for (const auto& variant : variants) {
-    WorkbookGuard wb;
-    ASSERT_EQ(fm_workbook_create(&wb.handle), 0) << variant.name;
-    std::size_t pivot_idx = 0;
-    ASSERT_EQ(BuildDaysGroupedPivot(wb.handle, variant.start_serial, &pivot_idx), 0)
-        << variant.name << ": " << fm_last_error_message();
-
-    PivotCellsGuard projected;
-    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0)
-        << variant.name << ": " << fm_last_error_message();
-
-    const std::vector<std::pair<std::string, double>> rows = CollectDaysGroupRows(projected.handle);
-    ASSERT_EQ(rows.size(), variant.expected->size()) << variant.name;
-    for (std::size_t i = 0; i < rows.size(); ++i) {
-      EXPECT_EQ(rows[i].first, (*variant.expected)[i].first) << variant.name << " row " << i;
-      EXPECT_DOUBLE_EQ(rows[i].second, (*variant.expected)[i].second) << variant.name << " row " << i;
-    }
-  }
-}
-
-TEST(FormulonCApiPivot, SaveRejectsAPivotCacheWithNoWorksheetSource) {
-  // The failure this replaces was silent: the package saved, validated
-  // against the schema, and round-tripped through our own reader, and only
-  // Excel -- offering to repair it -- ever said otherwise. A host has no
-  // way to discover that from the API, so the save has to say it.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, /*present=*/0, nullptr, nullptr, nullptr),
-            0)
-      << fm_last_error_message();
-
-  BufferGuard saved;
-  EXPECT_NE(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << "a cache with no source must not save silently";
-  EXPECT_NE(std::string(fm_last_error_message()).find("worksheet source"), std::string::npos)
-      << "message must name what is missing: " << fm_last_error_message();
-
-  // Restoring the source makes the same workbook savable again, so the
-  // check is about the cache's state and not about some other damage.
-  ASSERT_EQ(
-      fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, /*present=*/1, "A1:B5", "Sheet1", nullptr), 0);
-  BufferGuard retry;
-  EXPECT_EQ(fm_workbook_save(wb.handle, &retry.data, &retry.len), 0) << fm_last_error_message();
-}
-
-TEST(FormulonCApiPivot, SavedScratchPivotEmitsLocationRequiredDefaults) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  ASSERT_EQ(fm_workbook_pivot_set_anchor(wb.handle, 0, pivot_idx, 0U, 3U, 5U, 2U), 0) << fm_last_error_message();
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
-  const std::vector<std::uint8_t> package(saved.data, saved.data + saved.len);
-  const std::string pivot_xml = ExtractZipEntry(package, "xl/pivotTables/pivotTable1.xml");
-  ASSERT_FALSE(pivot_xml.empty());
-  EXPECT_NE(pivot_xml.find("<location ref=\"D1:E5\" firstHeaderRow=\"1\" firstDataRow=\"1\" firstDataCol=\"1\"/>"),
-            std::string::npos)
-      << "xml=" << pivot_xml;
-}
-
-TEST(FormulonCApiPivot, SavedPivotLocationRefCoversTheProjectedGrid) {
-  // `fm_workbook_pivot_create` installs a 1x1 placeholder span and nothing
-  // revises it as fields are added, so a pivot built purely through the C
-  // surface used to save a `ref` describing a single cell. Excel opens such
-  // a file cleanly and recognises the pivot, then terminates the moment the
-  // report is refreshed -- the defect is invisible to a round trip and has
-  // to be pinned on the emitted bytes.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  // Deliberately no `fm_workbook_pivot_set_anchor`: this is the path a host
-  // takes when it never reasons about the report's extent at all.
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-  std::uint32_t top = 0;
-  std::uint32_t left = 0;
-  std::uint32_t rows = 0;
-  std::uint32_t cols = 0;
-  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
-  ASSERT_GT(rows, 1U) << "projection must be larger than the placeholder for this test to mean anything";
-  ASSERT_GT(cols, 1U);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
-  const std::vector<std::uint8_t> package(saved.data, saved.data + saved.len);
-  const std::string pivot_xml = ExtractZipEntry(package, "xl/pivotTables/pivotTable1.xml");
-  ASSERT_FALSE(pivot_xml.empty());
-
-  // Anchored at D1, projected 4 rows x 2 cols -> D1:E4.
-  EXPECT_NE(pivot_xml.find("<location ref=\"D1:E4\""), std::string::npos) << "xml=" << pivot_xml;
-  EXPECT_EQ(pivot_xml.find("<location ref=\"D1:D1\""), std::string::npos) << "xml=" << pivot_xml;
-}
-
-TEST(FormulonCApiPivot, AddingAFieldAfterLoadReprojectsTheLocationRef) {
-  // The loaded package declares `ref="D1:E5"`, which described the report
-  // as Excel left it. Adding a column field widens the grid, so re-emitting
-  // the authored span would now under-size it -- the same crash, reached by
-  // loading rather than by building.
-  WorkbookGuard wb;
-  const std::vector<std::uint8_t> package = BuildPivotWorkbookBytes();
-  ASSERT_EQ(fm_workbook_load(package.data(), package.size(), &wb.handle), 0) << fm_last_error_message();
-
-  fm_pivot_field_spec_t region_spec{};
-  region_spec.source_name = "Region";
-  region_spec.custom_name = "";
-  region_spec.axis = FM_PIVOT_AXIS_COL;
-  region_spec.subtotal_top = 0;
-  region_spec.number_format = "";
-  std::size_t added = 99;
-  ASSERT_EQ(fm_workbook_pivot_field_add(wb.handle, 1, 0, &region_spec, &added), 0) << fm_last_error_message();
-  const std::uint32_t col_order[] = {static_cast<std::uint32_t>(added)};
-  ASSERT_EQ(fm_workbook_pivot_set_col_field_order(wb.handle, 1, 0, col_order, 1), 0) << fm_last_error_message();
-
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 1, 0, &projected.handle), 0) << fm_last_error_message();
-  std::uint32_t top = 0;
-  std::uint32_t left = 0;
-  std::uint32_t rows = 0;
-  std::uint32_t cols = 0;
-  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
-  ASSERT_GT(cols, 2U) << "the added column field must widen the report";
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
-  const std::vector<std::uint8_t> written(saved.data, saved.data + saved.len);
-  const std::string pivot_xml = ExtractZipEntry(written, "xl/pivotTables/pivotTable1.xml");
-  ASSERT_FALSE(pivot_xml.empty());
-  EXPECT_EQ(pivot_xml.find("<location ref=\"D1:E5\""), std::string::npos)
-      << "the authored span no longer describes the report; xml=" << pivot_xml;
-}
-
-TEST(FormulonCApiPivot, PivotCacheMutationInvalidatesMemoisedLayout) {
-  // fm_workbook_pivot_layout memoises the pivot's evaluated result. A cache
-  // mutation must invalidate that memo so a re-layout reflects the change
-  // instead of returning the stale projection.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  auto has_data_value = [](fm_pivot_cells_t* handle, double want) -> bool {
-    for (const fm_pivot_cell_t& c : CollectCells(handle)) {
-      if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER && c.value.u.number == want) {
-        return true;
-      }
-    }
-    return false;
-  };
-
-  // Baseline: North (records 0, 2 = 100 + 300) sums to 400.
-  {
-    PivotCellsGuard projected;
-    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-    EXPECT_TRUE(has_data_value(projected.handle, 400.0));
-  }
-
-  // Bump record 0's amount (field index 1) from 100 to 1100 (+1000).
-  ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, 1, 1100.0), 0) << fm_last_error_message();
-
-  // Re-layout must reflect the mutated cache: North is now 1100 + 300 = 1400,
-  // and the stale 400 must be gone.
-  {
-    PivotCellsGuard projected;
-    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-    EXPECT_TRUE(has_data_value(projected.handle, 1400.0)) << "layout returned a stale memoised projection";
-    EXPECT_FALSE(has_data_value(projected.handle, 400.0)) << "stale North value survived the cache mutation";
-  }
-}
-
-TEST(FormulonCApiPivot, PivotCacheSharedItemsAcceptErrorValues) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  std::size_t count = 0;
-  ASSERT_EQ(fm_workbook_pivot_cache_field_shared_item_count(wb.handle, cache_id, 0, &count), 0);
-  EXPECT_EQ(count, 2U);
-
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_error(wb.handle, cache_id, 0,
-                                                                1),  // ErrorCode::Div0
-            0)
-      << fm_last_error_message();
-  ASSERT_EQ(fm_workbook_pivot_cache_field_shared_item_count(wb.handle, cache_id, 0, &count), 0);
-  EXPECT_EQ(count, 3U);
-}
-
-TEST(FormulonCApiPivot, PivotCacheSharedItemIndexToleratesOutOfDomainNumbers) {
-  // `BuildScratchPivot` leaves `cell_is_index` empty, so "Region" (field 0)
-  // reads its numeric cells as indices into its two shared items. The record
-  // setter accepts any double, so the layout below is the point where an
-  // out-of-domain index would be narrowed. It must resolve to a blank label
-  // rather than reading past the shared items or trapping the instance.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  const double bad_indices[] = {
-      std::numeric_limits<double>::quiet_NaN(),
-      std::numeric_limits<double>::infinity(),
-      -std::numeric_limits<double>::infinity(),
-      -1.0,
-      1e30,
-      4.3e9,  // Past the wasm32 `size_t` range.
-      2.0,    // One past the last shared item.
-  };
-  for (const double bad : bad_indices) {
-    ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, 0, bad), 0) << fm_last_error_message();
-    PivotCellsGuard projected;
-    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-    EXPECT_FALSE(CollectCells(projected.handle).empty());
-  }
-
-  // A valid index still resolves after all of that.
-  ASSERT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, 0, 0.0), 0) << fm_last_error_message();
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-  bool saw_north_total = false;
-  for (const fm_pivot_cell_t& c : CollectCells(projected.handle)) {
-    if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER && c.value.u.number == 400.0) {
-      saw_north_total = true;
-    }
-  }
-  EXPECT_TRUE(saw_north_total);
-}
-
-TEST(FormulonCApiPivot, PivotCacheWorksheetSourceRoundTripsThroughApi) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  int32_t present = -1;
-  const char* ref = nullptr;
-  const char* sheet = nullptr;
-  const char* name = nullptr;
-  // `BuildScratchPivot` installs a source because a cache without one
-  // cannot be saved. Clear it here so the absent state this test is about
-  // is established by the test rather than inherited from the helper.
-  ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, 0, nullptr, nullptr, nullptr), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_get_worksheet_source(wb.handle, cache_id, &present, &ref, &sheet, &name), 0);
-  EXPECT_EQ(present, 0);
-  EXPECT_STREQ(ref, "");
-  EXPECT_STREQ(sheet, "");
-  EXPECT_STREQ(name, "");
-
-  ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, 1, "$A$1:$C$5", "Data", nullptr), 0)
-      << fm_last_error_message();
-  ASSERT_EQ(fm_workbook_pivot_cache_get_worksheet_source(wb.handle, cache_id, &present, &ref, &sheet, &name), 0);
-  EXPECT_EQ(present, 1);
-  EXPECT_STREQ(ref, "$A$1:$C$5");
-  EXPECT_STREQ(sheet, "Data");
-  EXPECT_STREQ(name, "");
-
-  ASSERT_EQ(fm_workbook_pivot_cache_set_worksheet_source(wb.handle, cache_id, 0, "ignored", "ignored", "ignored"), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_get_worksheet_source(wb.handle, cache_id, &present, &ref, &sheet, &name), 0);
-  EXPECT_EQ(present, 0);
-  EXPECT_STREQ(ref, "");
-  EXPECT_STREQ(sheet, "");
-  EXPECT_STREQ(name, "");
-}
-
-TEST(FormulonCApiPivot, PivotReportLayoutRoundTripsThroughApi) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  fm_pivot_layout_t layout = FM_PIVOT_LAYOUT_TABULAR;
-  ASSERT_EQ(fm_workbook_pivot_get_layout(wb.handle, 0, pivot_idx, &layout), 0);
-  EXPECT_EQ(layout, FM_PIVOT_LAYOUT_COMPACT);
-
-  ASSERT_EQ(fm_workbook_pivot_set_layout(wb.handle, 0, pivot_idx, FM_PIVOT_LAYOUT_TABULAR), 0);
-  ASSERT_EQ(fm_workbook_pivot_get_layout(wb.handle, 0, pivot_idx, &layout), 0);
-  EXPECT_EQ(layout, FM_PIVOT_LAYOUT_TABULAR);
-
-  ASSERT_EQ(fm_workbook_pivot_set_layout(wb.handle, 0, pivot_idx, FM_PIVOT_LAYOUT_OUTLINE), 0);
-  ASSERT_EQ(fm_workbook_pivot_get_layout(wb.handle, 0, pivot_idx, &layout), 0);
-  EXPECT_EQ(layout, FM_PIVOT_LAYOUT_OUTLINE);
-
-  // The setter accepts a raw int32_t so FFI callers can probe the complete
-  // invalid domain without constructing an out-of-domain C enum.
-  const std::int32_t invalid_layouts[] = {
-      99,
-      std::numeric_limits<std::int32_t>::min(),
-      std::numeric_limits<std::int32_t>::max(),
-  };
-  for (const std::int32_t raw : invalid_layouts) {
-    EXPECT_EQ(fm_workbook_pivot_set_layout(wb.handle, 0, pivot_idx, raw),
-              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument))
-        << raw;
-  }
-}
-
-TEST(FormulonCApiPivot, ScalarEnumMutatorsRejectRawValuesWithoutMutation) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  BufferGuard before;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &before.data, &before.len), 0) << fm_last_error_message();
-  const std::vector<std::uint8_t> snapshot(before.data, before.data + before.len);
-  const std::int32_t invalid[] = {99, std::numeric_limits<std::int32_t>::min(),
-                                  std::numeric_limits<std::int32_t>::max()};
-  const fm_status_t expected = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  for (const std::int32_t raw : invalid) {
-    EXPECT_EQ(fm_workbook_pivot_field_set_axis(wb.handle, 0, pivot_idx, 0, raw), expected) << raw;
-    EXPECT_EQ(fm_workbook_pivot_field_add_subtotal_fn(wb.handle, 0, pivot_idx, 0, raw), expected) << raw;
-    EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, raw, 0, -1, -1, 1, -1.0, -1.0),
-              expected)
-        << raw;
-    EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, 3, raw, -1, -1, 1, -1.0, -1.0),
-              expected)
-        << raw;
-  }
-
-  BufferGuard after;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &after.data, &after.len), 0) << fm_last_error_message();
-  EXPECT_EQ(std::vector<std::uint8_t>(after.data, after.data + after.len), snapshot);
-}
-
-TEST(FormulonCApiPivot, DateGroupRejectsZeroIntervalAndInvertedWindowWithoutMutation) {
-  // FM_PIVOT_DATE_DAYS-only validation: a zero interval and an explicit
-  // Start past an explicit End are both nonsensical groupings, so
-  // neither may reach the model.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  BufferGuard before;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &before.data, &before.len), 0) << fm_last_error_message();
-  const std::vector<std::uint8_t> snapshot(before.data, before.data + before.len);
-  const fm_status_t expected = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-
-  // interval_days == 0.
-  EXPECT_EQ(
-      fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, FM_PIVOT_DATE_DAYS,
-                                             FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, /*interval_days=*/0, -1.0, -1.0),
-      expected);
-  // start_serial_or_neg1 > end_serial_or_neg1 (both explicit).
-  EXPECT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, FM_PIVOT_DATE_DAYS,
-                                                   FM_PIVOT_CALENDAR_GREGORIAN, -1, -1, /*interval_days=*/7,
-                                                   /*start_serial=*/61.0, /*end_serial=*/60.0),
-            expected);
-
-  BufferGuard after;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &after.data, &after.len), 0) << fm_last_error_message();
-  EXPECT_EQ(std::vector<std::uint8_t>(after.data, after.data + after.len), snapshot);
-}
-
-TEST(FormulonCApiPivot, StructEnumMutatorsRejectRawValuesWithoutMutation) {
-  // The struct-taking twins of the scalar mutators above must enforce the
-  // same domains. Without that, an out-of-domain `axis` collapses onto
-  // `PivotAxis::Row` and an out-of-domain `show_as` onto `Normal`, and
-  // the call reports success on a pivot that means something else.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  BufferGuard before;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &before.data, &before.len), 0) << fm_last_error_message();
-  const std::vector<std::uint8_t> snapshot(before.data, before.data + before.len);
-  const fm_status_t expected = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-
-  fm_pivot_field_spec_t field_spec{};
-  field_spec.source_name = "Region";
-  field_spec.axis = RawEnumValue<fm_pivot_axis_t>(99);
-  std::size_t field_idx = 99U;
-  EXPECT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, pivot_idx, &field_spec, &field_idx), expected);
-
-  fm_pivot_data_field_spec_t df_spec{};
-  df_spec.name = "Total";
-  df_spec.field_index = 1;
-  df_spec.aggregation = RawEnumValue<fm_pivot_aggregation_t>(99);
-  std::size_t df_idx = 99U;
-  EXPECT_EQ(fm_workbook_pivot_data_field_add(wb.handle, 0, pivot_idx, &df_spec, &df_idx), expected);
-  EXPECT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &df_spec), expected);
-
-  df_spec.aggregation = FM_PIVOT_AGG_SUM;
-  df_spec.show_as = RawEnumValue<fm_pivot_show_as_t>(99);
-  EXPECT_EQ(fm_workbook_pivot_data_field_add(wb.handle, 0, pivot_idx, &df_spec, &df_idx), expected);
-  EXPECT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &df_spec), expected);
-
-  BufferGuard after;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &after.data, &after.len), 0) << fm_last_error_message();
-  EXPECT_EQ(std::vector<std::uint8_t>(after.data, after.data + after.len), snapshot);
-}
-
-TEST(FormulonCApiPivot, PivotProjectionUsesWorkbookLocaleAndReportLayout) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  ASSERT_EQ(fm_workbook_pivot_set_layout(wb.handle, 0, pivot_idx, FM_PIVOT_LAYOUT_TABULAR), 0);
-
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-  std::uint32_t top = 0;
-  std::uint32_t left = 0;
-  std::uint32_t rows = 0;
-  std::uint32_t cols = 0;
-  ASSERT_EQ(fm_pivot_cells_bounds(projected.handle, &top, &left, &rows, &cols), 0);
-  EXPECT_EQ(cols, 2U);  // Tabular exposes its two row-field columns.
-
-  bool saw_japanese_total = false;
-  const std::size_t cell_count = fm_pivot_cells_count(projected.handle);
-  for (std::size_t i = 0; i < cell_count; ++i) {
-    fm_pivot_cell_t cell{};
-    ASSERT_EQ(fm_pivot_cells_at(projected.handle, i, &cell), 0);
-    if (cell.value.kind == FM_VAL_TEXT && cell.value.u.text != nullptr &&
-        std::string_view(cell.value.u.text) == "総計") {
-      saw_japanese_total = true;
-    }
-  }
-  EXPECT_TRUE(saw_japanese_total);
-}
-
-TEST(FormulonCApiPivot, PivotCacheErrorSettersRejectInvalidErrorCodes) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_error(wb.handle, cache_id, 0, -1),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_error(wb.handle, cache_id, 0, 999),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_error(wb.handle, cache_id, 0, 1, -1),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_error(wb.handle, cache_id, 0, 1, 999),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-}
-
-TEST(FormulonCApiPivot, PivotCacheRecordSettersRejectOutOfRangeFieldIndex) {
-  // BuildScratchPivot declares two cache fields (Region=0, Amount=1), so
-  // field_idx 2 is the first out-of-range value. A large / wrapping field_idx
-  // must be rejected before `grow_record_cells` resizes `field_idx + 1`
-  // cells — otherwise SIZE_MAX wraps to 0 and the subsequent cell write lands
-  // out of bounds.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  const auto kInvalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  const std::size_t kFieldCount = 2;
-  const std::size_t kMax = static_cast<std::size_t>(-1);
-
-  // In-range write still succeeds (guards against an over-tight bound).
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, kFieldCount - 1, 1.0), 0);
-
-  // field_idx == field_count and beyond are rejected on every setter.
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, kFieldCount, 1.0), kInvalid);
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, 0, kMax, 1.0), kInvalid);
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_text(wb.handle, cache_id, 0, kMax, "x"), kInvalid);
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_bool(wb.handle, cache_id, 0, kMax, 1), kInvalid);
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_blank(wb.handle, cache_id, 0, kMax), kInvalid);
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_error(wb.handle, cache_id, 0, kMax, 0), kInvalid);
-}
-
-TEST(FormulonCApiPivot, MutateExistingPivotFilter) {
-  // Build a scratch pivot — the OOXML reader populates only `custom_name`
-  // from `<pivotField name="...">`, while the filter resolver matches on
-  // `source_name`, so a filter applied to a loaded workbook would silently
-  // no-op. Building from scratch lets us exercise the same surface against
-  // a pivot whose `source_name` is set the way the resolver expects.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  // Baseline projection contains "South" because no filter is active.
-  {
-    PivotCellsGuard projected;
-    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0);
-    bool saw_south = false;
-    for (const fm_pivot_cell_t& c : CollectCells(projected.handle)) {
-      if (c.kind == FM_PIVOT_CELL_ROW_LABEL && c.value.kind == FM_VAL_TEXT && c.value.u.text != nullptr &&
-          std::string_view(c.value.u.text) == "South") {
-        saw_south = true;
-      }
-    }
-    EXPECT_TRUE(saw_south);
-  }
-
-  // Add a label filter that only retains "North".
-  fm_pivot_filter_spec_t spec{};
-  spec.axis = FM_PIVOT_AXIS_ROW;
-  spec.field_name = "Region";
-  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
-  spec.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
-  spec.value_text = "N";
-  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), 0) << fm_last_error_message();
-
-  std::size_t filter_count = 0;
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &filter_count), 0);
-  EXPECT_EQ(filter_count, 1U);
-
-  // Re-project — "South" must be dropped.
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0);
-  bool saw_south = false;
-  bool saw_north = false;
-  for (const fm_pivot_cell_t& c : CollectCells(projected.handle)) {
-    if (c.kind == FM_PIVOT_CELL_ROW_LABEL && c.value.kind == FM_VAL_TEXT && c.value.u.text != nullptr) {
-      if (std::string_view(c.value.u.text) == "South") {
-        saw_south = true;
-      }
-      if (std::string_view(c.value.u.text) == "North") {
-        saw_north = true;
-      }
-    }
-  }
-  EXPECT_TRUE(saw_north);
-  EXPECT_FALSE(saw_south);
-
-  // Verify remove_at clears the filter.
-  ASSERT_EQ(fm_workbook_pivot_filter_remove_at(wb.handle, 0, pivot_idx, 0), 0);
-  std::size_t after_count = 99;
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &after_count), 0);
-  EXPECT_EQ(after_count, 0U);
-}
-
-TEST(FormulonCApiPivot, InspectPivotFiltersByIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t int_filter{};
-  int_filter.axis = FM_PIVOT_AXIS_VALUE;
-  int_filter.field_name = "Amount";
-  int_filter.type = FM_PIVOT_FILTER_VALUE_TOP_10;
-  int_filter.value_kind = FM_PIVOT_FILTER_VALUE_INT;
-  int_filter.value_int = 3;
-  int_filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  int_filter.data_field_index = 0;
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &int_filter), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t double_filter{};
-  double_filter.axis = FM_PIVOT_AXIS_VALUE;
-  double_filter.field_name = "Amount";
-  double_filter.type = FM_PIVOT_FILTER_VALUE_GREATER_THAN;
-  double_filter.value_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
-  double_filter.value_double = 50.5;
-  double_filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  double_filter.data_field_index = 0;
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &double_filter), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t text_filter{};
-  text_filter.axis = FM_PIVOT_AXIS_ROW;
-  text_filter.field_name = "Region";
-  text_filter.type = FM_PIVOT_FILTER_LABEL_CONTAINS;
-  text_filter.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
-  text_filter.value_text = "o";
-  text_filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &text_filter), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t range_int_double{};
-  range_int_double.axis = FM_PIVOT_AXIS_VALUE;
-  range_int_double.field_name = "Amount";
-  range_int_double.type = FM_PIVOT_FILTER_VALUE_BETWEEN;
-  range_int_double.value_kind = FM_PIVOT_FILTER_VALUE_INT;
-  range_int_double.value_int = 100;
-  range_int_double.value_high_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
-  range_int_double.value_high_double = 500.25;
-  range_int_double.data_field_index = 0;
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &range_int_double), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t range_double_int{};
-  range_double_int.axis = FM_PIVOT_AXIS_VALUE;
-  range_double_int.field_name = "Amount";
-  range_double_int.type = FM_PIVOT_FILTER_VALUE_BETWEEN;
-  range_double_int.value_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
-  range_double_int.value_double = 99.75;
-  range_double_int.value_high_kind = FM_PIVOT_FILTER_VALUE_INT;
-  range_double_int.value_high_int = 450;
-  range_double_int.data_field_index = 0;
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &range_double_int), 0) << fm_last_error_message();
-
-  std::size_t filter_count = 0;
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &filter_count), 0);
-  ASSERT_EQ(filter_count, 5U);
-
-  // Establish a projected result before inspection; a read must not change
-  // either the active-filter count or the memoised evaluation state.
-  PivotCellsGuard before_projection;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &before_projection.handle), 0) << fm_last_error_message();
-  const std::vector<fm_pivot_cell_t> before_cells = CollectCells(before_projection.handle);
-
-  fm_pivot_filter_spec_t got{};
-  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 0, &got), 0);
-  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_VALUE);
-  ASSERT_NE(got.field_name, nullptr);
-  EXPECT_STREQ(got.field_name, "Amount");
-  EXPECT_EQ(got.type, FM_PIVOT_FILTER_VALUE_TOP_10);
-  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_INT);
-  EXPECT_EQ(got.value_int, 3);
-  EXPECT_DOUBLE_EQ(got.value_double, 0.0);
-  EXPECT_EQ(got.value_text, nullptr);
-  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_NONE);
-  EXPECT_EQ(got.value_high_int, 0);
-  EXPECT_DOUBLE_EQ(got.value_high_double, 0.0);
-  EXPECT_EQ(got.data_field_index, 0U);
-
-  got = {};
-  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 1, &got), 0);
-  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_VALUE);
-  ASSERT_NE(got.field_name, nullptr);
-  EXPECT_STREQ(got.field_name, "Amount");
-  EXPECT_EQ(got.type, FM_PIVOT_FILTER_VALUE_GREATER_THAN);
-  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_DOUBLE);
-  EXPECT_EQ(got.value_int, 0);
-  EXPECT_DOUBLE_EQ(got.value_double, 50.5);
-  EXPECT_EQ(got.value_text, nullptr);
-  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_NONE);
-  EXPECT_EQ(got.value_high_int, 0);
-  EXPECT_DOUBLE_EQ(got.value_high_double, 0.0);
-  EXPECT_EQ(got.data_field_index, 0U);
-
-  got = {};
-  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 2, &got), 0);
-  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_ROW);
-  ASSERT_NE(got.field_name, nullptr);
-  EXPECT_STREQ(got.field_name, "Region");
-  EXPECT_EQ(got.type, FM_PIVOT_FILTER_LABEL_CONTAINS);
-  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_TEXT);
-  EXPECT_EQ(got.value_int, 0);
-  EXPECT_DOUBLE_EQ(got.value_double, 0.0);
-  ASSERT_NE(got.value_text, nullptr);
-  EXPECT_STREQ(got.value_text, "o");
-  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_NONE);
-  EXPECT_EQ(got.value_high_int, 0);
-  EXPECT_DOUBLE_EQ(got.value_high_double, 0.0);
-  EXPECT_EQ(got.data_field_index, 0U);
-
-  got = {};
-  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 3, &got), 0);
-  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_VALUE);
-  ASSERT_NE(got.field_name, nullptr);
-  EXPECT_STREQ(got.field_name, "Amount");
-  EXPECT_EQ(got.type, FM_PIVOT_FILTER_VALUE_BETWEEN);
-  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_INT);
-  EXPECT_EQ(got.value_int, 100);
-  EXPECT_DOUBLE_EQ(got.value_double, 0.0);
-  EXPECT_EQ(got.value_text, nullptr);
-  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_DOUBLE);
-  EXPECT_EQ(got.value_high_int, 0);
-  EXPECT_DOUBLE_EQ(got.value_high_double, 500.25);
-  EXPECT_EQ(got.data_field_index, 0U);
-
-  got = {};
-  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 4, &got), 0);
-  EXPECT_EQ(got.axis, FM_PIVOT_AXIS_VALUE);
-  ASSERT_NE(got.field_name, nullptr);
-  EXPECT_STREQ(got.field_name, "Amount");
-  EXPECT_EQ(got.type, FM_PIVOT_FILTER_VALUE_BETWEEN);
-  EXPECT_EQ(got.value_kind, FM_PIVOT_FILTER_VALUE_DOUBLE);
-  EXPECT_EQ(got.value_int, 0);
-  EXPECT_DOUBLE_EQ(got.value_double, 99.75);
-  EXPECT_EQ(got.value_text, nullptr);
-  EXPECT_EQ(got.value_high_kind, FM_PIVOT_FILTER_VALUE_INT);
-  EXPECT_EQ(got.value_high_int, 450);
-  EXPECT_DOUBLE_EQ(got.value_high_double, 0.0);
-  EXPECT_EQ(got.data_field_index, 0U);
-
-  std::size_t unchanged_count = 0;
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &unchanged_count), 0);
-  EXPECT_EQ(unchanged_count, filter_count);
-  PivotCellsGuard after_projection;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &after_projection.handle), 0) << fm_last_error_message();
-  const std::vector<fm_pivot_cell_t> after_cells = CollectCells(after_projection.handle);
-  ASSERT_EQ(after_cells.size(), before_cells.size());
-  for (std::size_t i = 0; i < before_cells.size(); ++i) {
-    EXPECT_EQ(after_cells[i].row, before_cells[i].row);
-    EXPECT_EQ(after_cells[i].col, before_cells[i].col);
-    EXPECT_EQ(after_cells[i].kind, before_cells[i].kind);
-    EXPECT_EQ(after_cells[i].value.kind, before_cells[i].value.kind);
-    if (before_cells[i].value.kind == FM_VAL_NUMBER) {
-      EXPECT_DOUBLE_EQ(after_cells[i].value.u.number, before_cells[i].value.u.number);
-    } else if (before_cells[i].value.kind == FM_VAL_TEXT) {
-      ASSERT_NE(before_cells[i].value.u.text, nullptr);
-      ASSERT_NE(after_cells[i].value.u.text, nullptr);
-      EXPECT_STREQ(after_cells[i].value.u.text, before_cells[i].value.u.text);
-    }
-  }
-
-  // Adding a filter invalidates the old model-backed views. Do not inspect
-  // those pointers after the mutation; reacquire the entry instead.
-  fm_pivot_filter_spec_t mutation{};
-  mutation.axis = FM_PIVOT_AXIS_ROW;
-  mutation.field_name = "Region";
-  mutation.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
-  mutation.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
-  mutation.value_text = "N";
-  mutation.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &mutation), 0) << fm_last_error_message();
-  fm_pivot_filter_spec_t reacquired{};
-  ASSERT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 2, &reacquired), 0);
-  EXPECT_EQ(reacquired.value_kind, FM_PIVOT_FILTER_VALUE_TEXT);
-  ASSERT_NE(reacquired.value_text, nullptr);
-  EXPECT_STREQ(reacquired.value_text, "o");
-
-  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  const auto make_sentinel = [] {
-    fm_pivot_filter_spec_t sentinel{};
-    sentinel.axis = FM_PIVOT_AXIS_PAGE;
-    sentinel.field_name = "sentinel-field";
-    sentinel.type = FM_PIVOT_FILTER_LABEL_DATE;
-    sentinel.value_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
-    sentinel.value_int = -123456789;
-    sentinel.value_double = -9876.5;
-    sentinel.value_text = "sentinel-text";
-    sentinel.value_high_kind = FM_PIVOT_FILTER_VALUE_INT;
-    sentinel.value_high_int = 13579;
-    sentinel.value_high_double = 24680.5;
-    sentinel.data_field_index = 0xDEADBEEFU;
-    return sentinel;
-  };
-  const auto expect_unchanged = [](const fm_pivot_filter_spec_t& expected, const fm_pivot_filter_spec_t& actual) {
-    EXPECT_EQ(actual.axis, expected.axis);
-    EXPECT_EQ(actual.field_name, expected.field_name);
-    EXPECT_EQ(actual.type, expected.type);
-    EXPECT_EQ(actual.value_kind, expected.value_kind);
-    EXPECT_EQ(actual.value_int, expected.value_int);
-    EXPECT_DOUBLE_EQ(actual.value_double, expected.value_double);
-    EXPECT_EQ(actual.value_text, expected.value_text);
-    EXPECT_EQ(actual.value_high_kind, expected.value_high_kind);
-    EXPECT_EQ(actual.value_high_int, expected.value_high_int);
-    EXPECT_DOUBLE_EQ(actual.value_high_double, expected.value_high_double);
-    EXPECT_EQ(actual.data_field_index, expected.data_field_index);
-  };
-  const auto expect_error_preserves_output = [&](const auto& invoke, fm_status_t expected_status) {
-    fm_pivot_filter_spec_t invalid_out = make_sentinel();
-    const fm_pivot_filter_spec_t before = invalid_out;
-    EXPECT_EQ(invoke(&invalid_out), expected_status);
-    expect_unchanged(before, invalid_out);
-  };
-  expect_error_preserves_output(
-      [&](fm_pivot_filter_spec_t* out) { return fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 6, out); },
-      invalid);
-  expect_error_preserves_output(
-      [&](fm_pivot_filter_spec_t* out) { return fm_workbook_pivot_filter_at(wb.handle, 1, pivot_idx, 0, out); },
-      invalid);
-  expect_error_preserves_output(
-      [&](fm_pivot_filter_spec_t* out) { return fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx + 1, 0, out); },
-      invalid);
-  expect_error_preserves_output(
-      [&](fm_pivot_filter_spec_t* out) { return fm_workbook_pivot_filter_at(nullptr, 0, pivot_idx, 0, out); },
-      static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-  EXPECT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 0, nullptr),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-}
-
-TEST(FormulonCApiPivot, GetterRejectsUnrepresentableModelEnumsWithoutMutation) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  auto* table = wb.handle->workbook().sheet(0).mutable_pivot_tables()[pivot_idx].get();
-  ASSERT_NE(table, nullptr);
-  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  const auto make_sentinel = [] {
-    fm_pivot_filter_spec_t sentinel{};
-    sentinel.axis = FM_PIVOT_AXIS_PAGE;
-    sentinel.field_name = "sentinel-field";
-    sentinel.type = FM_PIVOT_FILTER_LABEL_DATE;
-    sentinel.value_kind = FM_PIVOT_FILTER_VALUE_DOUBLE;
-    sentinel.value_int = -123456789;
-    sentinel.value_double = -9876.5;
-    sentinel.value_text = "sentinel-text";
-    sentinel.value_high_kind = FM_PIVOT_FILTER_VALUE_INT;
-    sentinel.value_high_int = 13579;
-    sentinel.value_high_double = 24680.5;
-    sentinel.data_field_index = 0xDEADBEEFU;
-    return sentinel;
-  };
-  const auto inject_and_expect_rejected = [&](formulon::pivot::PivotAxis axis, formulon::pivot::FilterType type) {
-    table->mutable_active_filters().clear();
-    formulon::pivot::PivotFilter filter;
-    filter.axis = axis;
-    filter.field_name = "Region";
-    filter.type = type;
-    filter.value = std::string("N");
-    table->mutable_active_filters().push_back(filter);
-
-    fm_pivot_filter_spec_t out = make_sentinel();
-    const fm_pivot_filter_spec_t before = out;
-    EXPECT_EQ(fm_workbook_pivot_filter_at(wb.handle, 0, pivot_idx, 0, &out), invalid);
-    EXPECT_EQ(std::memcmp(&out, &before, sizeof(out)), 0);
-  };
-
-  inject_and_expect_rejected(formulon::pivot::PivotAxis::None, formulon::pivot::FilterType::LabelContains);
-  inject_and_expect_rejected(formulon::pivot::PivotAxis::Row, static_cast<formulon::pivot::FilterType>(0xFF));
-}
-
-TEST(FormulonCApiPivot, PivotFilterAddRejectsRawAxisAndTypeWithoutMutation) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t spec{};
-  spec.axis = RawEnumValue<fm_pivot_axis_t>(99);
-  spec.field_name = "Region";
-  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
-  spec.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
-  spec.value_text = "N";
-  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
-
-  std::size_t count = 99;
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
-  EXPECT_EQ(count, 0U);
-
-  spec.axis = FM_PIVOT_AXIS_ROW;
-  spec.type = RawEnumValue<fm_pivot_filter_type_t>(99);
-  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
-  EXPECT_EQ(count, 0U);
-}
-
-TEST(FormulonCApiPivot, PivotFilterRejectsInvalidDataFieldWithoutMutation) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t spec{};
-  spec.axis = FM_PIVOT_AXIS_ROW;
-  spec.field_name = "Region";
-  spec.type = FM_PIVOT_FILTER_VALUE_TOP_10;
-  spec.value_kind = FM_PIVOT_FILTER_VALUE_INT;
-  spec.value_int = 1;
-  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  spec.data_field_index = 1;  // BuildScratchPivot has only slot 0.
-  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
-
-  std::size_t count = 99;
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
-  EXPECT_EQ(count, 0U);
-}
-
-TEST(FormulonCApiPivot, PivotFilterRejectsSelectorWhenNoDataFields) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-  ASSERT_EQ(fm_workbook_pivot_data_field_clear(wb.handle, 0, pivot_idx), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t spec{};
-  spec.axis = FM_PIVOT_AXIS_ROW;
-  spec.field_name = "Region";
-  spec.type = FM_PIVOT_FILTER_VALUE_TOP_10;
-  spec.value_kind = FM_PIVOT_FILTER_VALUE_INT;
-  spec.value_int = 1;
-  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  spec.data_field_index = 0;
-  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
-
-  std::size_t count = 99;
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
-  EXPECT_EQ(count, 0U);
-}
-
-TEST(FormulonCApiPivot, PivotFilterRejectsUnknownFieldNameWithoutMutation) {
-  // A label filter naming no pivot field would be a silent no-op inside the
-  // engine, so the mutator rejects it instead of reporting success.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t spec{};
-  spec.axis = FM_PIVOT_AXIS_ROW;
-  spec.field_name = "NoSuchField";
-  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
-  spec.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
-  spec.value_text = "N";
-  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
-
-  std::size_t count = 99;
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
-  EXPECT_EQ(count, 0U);
-
-  // The data field's display name resolves through to its source field, so
-  // the same call shape is accepted for it.
-  spec.field_name = "Sum of Amount";
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), 0) << fm_last_error_message();
-  ASSERT_EQ(fm_workbook_pivot_filter_count(wb.handle, 0, pivot_idx, &count), 0);
-  EXPECT_EQ(count, 1U);
-}
-
-TEST(FormulonCApiPivot, FilterErrorUsesApiName) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  fm_pivot_filter_spec_t spec{};
-  spec.axis = FM_PIVOT_AXIS_ROW;
-  spec.field_name = "Region";
-  spec.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
-  spec.value_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  spec.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &spec), invalid);
-  EXPECT_EQ(std::string_view(fm_last_error_message()).find("fm_workbook_pivot_filter_add:"), 0U);
-}
-
-TEST(FormulonCApiPivot, MutateShowValuesAs) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  // Re-set the data field to PercentOfRow.
-  std::size_t df_count = 0;
-  ASSERT_EQ(fm_workbook_pivot_data_field_count(wb.handle, 0, pivot_idx, &df_count), 0);
-  ASSERT_EQ(df_count, 1U);
-
-  fm_pivot_data_field_spec_t df_spec{};
-  df_spec.name = "Sum of Amount";
-  df_spec.field_index = 1U;  // Amount is the second pivot field.
-  df_spec.aggregation = FM_PIVOT_AGG_SUM;
-  df_spec.number_format = "";
-  df_spec.show_as = FM_PIVOT_SHOW_AS_PERCENT_OF_ROW;
-  df_spec.show_as_base_field = -1;
-  df_spec.show_as_base_item = -1;
-  ASSERT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &df_spec), 0) << fm_last_error_message();
-
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-
-  // Each FM_PIVOT_CELL_DATA cell should equal 1.0 (single data column ->
-  // each row's percent-of-row is 100% of itself).
-  std::size_t data_count = 0;
-  for (const fm_pivot_cell_t& c : CollectCells(projected.handle)) {
-    if (c.kind == FM_PIVOT_CELL_DATA && c.value.kind == FM_VAL_NUMBER) {
-      EXPECT_DOUBLE_EQ(c.value.u.number, 1.0);
-      ++data_count;
-    }
-  }
-  EXPECT_GT(data_count, 0U);
-}
-
-TEST(FormulonCApiPivot, RemovePivotAndCache) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  std::size_t before_pivots = 0;
-  std::size_t before_caches = 0;
-  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 0, &before_pivots), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_count(wb.handle, &before_caches), 0);
-  EXPECT_EQ(before_pivots, 1U);
-  EXPECT_EQ(before_caches, 1U);
-
-  // Remove the pivot first, then the cache.
-  ASSERT_EQ(fm_workbook_pivot_remove(wb.handle, 0, pivot_idx), 0);
-  std::size_t after_remove_pivots = 99;
-  ASSERT_EQ(fm_workbook_pivot_count(wb.handle, 0, &after_remove_pivots), 0);
-  EXPECT_EQ(after_remove_pivots, 0U);
-
-  ASSERT_EQ(fm_workbook_pivot_cache_remove(wb.handle, cache_id), 0);
-  std::size_t after_caches = 99;
-  ASSERT_EQ(fm_workbook_pivot_cache_count(wb.handle, &after_caches), 0);
-  EXPECT_EQ(after_caches, 0U);
-}
-
-TEST(FormulonCApiPivot, CacheRemoveBlockedByPivot) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  EXPECT_EQ(fm_workbook_pivot_cache_remove(wb.handle, cache_id),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  // Removing a non-existent cache id must also surface kInvalidArgument.
-  EXPECT_EQ(fm_workbook_pivot_cache_remove(wb.handle, 9999U),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-}
-
-TEST(FormulonCApiPivot, NullPointerArgumentsRejected) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  ASSERT_EQ(fm_workbook_pivot_cache_create(wb.handle, 0, &cache_id), 0);
-  std::size_t field_idx = 99;
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, "F", &field_idx), 0);
-
-  std::size_t out_count = 0;
-  EXPECT_EQ(fm_workbook_pivot_cache_count(nullptr, &out_count),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-  EXPECT_EQ(fm_workbook_pivot_cache_count(wb.handle, nullptr),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-
-  std::size_t fc = 0;
-  EXPECT_EQ(fm_workbook_pivot_cache_field_count(nullptr, cache_id, &fc),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-
-  EXPECT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, nullptr, &field_idx),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-
-  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_text(wb.handle, cache_id, field_idx, nullptr),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-
-  std::size_t pivot_idx = 99;
-  EXPECT_EQ(fm_workbook_pivot_create(wb.handle, 0, nullptr, cache_id, 0, 0, &pivot_idx),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-
-  // spec arguments
-  EXPECT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, 0, nullptr, &pivot_idx),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-
-  fm_pivot_filter_spec_t bad_filter{};
-  bad_filter.field_name = nullptr;
-  bad_filter.type = FM_PIVOT_FILTER_LABEL_CONTAINS;
-  bad_filter.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
-  bad_filter.value_text = "X";
-  bad_filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  EXPECT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, 0, &bad_filter),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-}
-
-TEST(FormulonCApiPivot, NullHandleStatusMatchesRecordedError) {
-  // The shared-item and record setters resolve their target through a
-  // common lookup helper. The status each returns must be the code that
-  // helper recorded, so a caller branching on the return value and a
-  // caller reading `fm_last_error_message` reach the same conclusion.
-  const auto null_pointer = static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer);
-  const auto invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-
-  const auto expect_null_handle = [&](fm_status_t status) {
-    EXPECT_EQ(status, null_pointer);
-    EXPECT_NE(std::string(fm_last_error_message()).find("wb is NULL"), std::string::npos)
-        << "message: " << fm_last_error_message();
-  };
-
-  expect_null_handle(fm_workbook_pivot_cache_field_add_shared_item_number(nullptr, 0U, 0U, 1.0));
-  expect_null_handle(fm_workbook_pivot_cache_field_add_shared_item_bool(nullptr, 0U, 0U, 1));
-  expect_null_handle(fm_workbook_pivot_cache_field_add_shared_item_blank(nullptr, 0U, 0U));
-  expect_null_handle(fm_workbook_pivot_cache_field_add_shared_item_error(nullptr, 0U, 0U, /*error=*/1));
-  expect_null_handle(fm_workbook_pivot_cache_field_clear_shared_items(nullptr, 0U, 0U));
-  expect_null_handle(fm_workbook_pivot_cache_record_set_number(nullptr, 0U, 0U, 0U, 1.0));
-  expect_null_handle(fm_workbook_pivot_cache_record_set_text(nullptr, 0U, 0U, 0U, "x"));
-  expect_null_handle(fm_workbook_pivot_cache_record_set_bool(nullptr, 0U, 0U, 0U, 1));
-  expect_null_handle(fm_workbook_pivot_cache_record_set_blank(nullptr, 0U, 0U, 0U));
-  expect_null_handle(fm_workbook_pivot_cache_record_set_error(nullptr, 0U, 0U, 0U, /*error=*/1));
-
-  // A live handle with an out-of-range coordinate keeps reporting
-  // kInvalidArgument through the same helpers.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  ASSERT_EQ(fm_workbook_pivot_cache_create(wb.handle, 0, &cache_id), 0);
-  std::size_t field_idx = 99;
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, "F", &field_idx), 0);
-
-  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_number(wb.handle, cache_id, field_idx + 1U, 1.0), invalid);
-  EXPECT_EQ(fm_workbook_pivot_cache_field_add_shared_item_number(wb.handle, cache_id + 100U, field_idx, 1.0), invalid);
-  EXPECT_EQ(fm_workbook_pivot_cache_record_set_number(wb.handle, cache_id, /*record_idx=*/0U, field_idx, 1.0), invalid);
-}
-
-TEST(FormulonCApiPivot, OutOfGridAnchorRejected) {
-  // Excel grid ceilings; kept as literals so this test needs no core
-  // header. Mirrors Sheet::kMaxRows / kMaxCols.
-  constexpr std::uint32_t kMaxRows = 1'048'576U;
-  constexpr std::uint32_t kMaxCols = 16'384U;
-
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  ASSERT_EQ(fm_workbook_pivot_cache_create(wb.handle, 0, &cache_id), 0);
-  std::size_t field_idx = 99;
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add(wb.handle, cache_id, "F", &field_idx), 0);
-
-  // create() with an anchor past the grid must be rejected, not stored.
-  std::size_t pivot_idx = 99;
-  EXPECT_EQ(fm_workbook_pivot_create(wb.handle, 0, "PT", cache_id, kMaxRows, 0U, &pivot_idx),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(fm_workbook_pivot_create(wb.handle, 0, "PT", cache_id, 0U, kMaxCols, &pivot_idx),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  // A valid create succeeds, then set_anchor must reject a span whose far
-  // corner leaves the grid (the wrap the audit flagged) and a zero span.
-  ASSERT_EQ(fm_workbook_pivot_create(wb.handle, 0, "PT", cache_id, 0U, 0U, &pivot_idx), 0);
-  EXPECT_EQ(
-      fm_workbook_pivot_set_anchor(wb.handle, 0, pivot_idx, kMaxRows - 1U, 0U, /*span_rows=*/2U, /*span_cols=*/1U),
-      static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(fm_workbook_pivot_set_anchor(wb.handle, 0, pivot_idx, 0U, 0U, /*span_rows=*/0U, /*span_cols=*/1U),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  // An in-grid span still succeeds.
-  EXPECT_EQ(fm_workbook_pivot_set_anchor(wb.handle, 0, pivot_idx, 0U, 0U, /*span_rows=*/3U, /*span_cols=*/2U), 0);
-}
-
-TEST(FormulonCApiPivot, MutationAndClearExportsCompleteTheirLifecycles) {
-  // Exercise the C ABI setters that are not needed by the projected-layout
-  // examples above.  Each mutation is followed by the corresponding clear
-  // where one exists, which also verifies that the handle remains usable
-  // across each invalidation boundary.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  std::uint32_t id_at_zero = 0;
-  ASSERT_EQ(fm_workbook_pivot_cache_id_at(wb.handle, 0, &id_at_zero), 0);
-  EXPECT_EQ(id_at_zero, cache_id);
-
-  const char* field_name = nullptr;
-  ASSERT_EQ(fm_workbook_pivot_cache_field_name(wb.handle, cache_id, 0, &field_name), 0);
-  EXPECT_STREQ(field_name, "Region");
-
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_number(wb.handle, cache_id, 0, 7.0), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_bool(wb.handle, cache_id, 0, 1), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_blank(wb.handle, cache_id, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_field_clear_shared_items(wb.handle, cache_id, 0), 0);
-  std::size_t shared_count = 99;
-  ASSERT_EQ(fm_workbook_pivot_cache_field_shared_item_count(wb.handle, cache_id, 0, &shared_count), 0);
-  EXPECT_EQ(shared_count, 0U);
-
-  std::size_t record_idx = 99;
-  ASSERT_EQ(fm_workbook_pivot_cache_record_add(wb.handle, cache_id, &record_idx), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_record_set_text(wb.handle, cache_id, record_idx, 0, "North"), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_record_set_bool(wb.handle, cache_id, record_idx, 0, 1), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_record_set_blank(wb.handle, cache_id, record_idx, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_record_set_error(wb.handle, cache_id, record_idx, 0, 1), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_record_clear(wb.handle, cache_id), 0);
-  std::size_t record_count = 99;
-  ASSERT_EQ(fm_workbook_pivot_cache_record_count(wb.handle, cache_id, &record_count), 0);
-  EXPECT_EQ(record_count, 0U);
-
-  ASSERT_EQ(fm_workbook_pivot_set_name(wb.handle, 0, pivot_idx, "Renamed"), 0);
-  ASSERT_EQ(fm_workbook_pivot_set_grand_totals(wb.handle, 0, pivot_idx, 0, 1), 0);
-  std::size_t field_count = 99;
-  ASSERT_EQ(fm_workbook_pivot_field_count(wb.handle, 0, pivot_idx, &field_count), 0);
-  ASSERT_EQ(field_count, 2U);
-
-  ASSERT_EQ(fm_workbook_pivot_field_set_axis(wb.handle, 0, pivot_idx, 0, FM_PIVOT_AXIS_ROW), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_set_sort(wb.handle, 0, pivot_idx, 0, 0, "Amount"), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_set_subtotal_top(wb.handle, 0, pivot_idx, 0, 1), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_set_item_visible(wb.handle, 0, pivot_idx, 0, 0, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_clear_items(wb.handle, 0, pivot_idx, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_add_subtotal_fn(wb.handle, 0, pivot_idx, 0, FM_PIVOT_AGG_COUNT), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_clear_subtotal_fns(wb.handle, 0, pivot_idx, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_set_date_group(wb.handle, 0, pivot_idx, 0, FM_PIVOT_DATE_YEAR,
-                                                   FM_PIVOT_CALENDAR_GREGORIAN, 2020, 2026, 1, -1.0, -1.0),
-            0);
-  ASSERT_EQ(fm_workbook_pivot_field_clear_date_group(wb.handle, 0, pivot_idx, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, "4"), 0);
-  const std::uint32_t col_order[] = {1U};
-  ASSERT_EQ(fm_workbook_pivot_set_col_field_order(wb.handle, 0, pivot_idx, col_order, 1U), 0);
-
-  ASSERT_EQ(fm_workbook_pivot_data_field_clear(wb.handle, 0, pivot_idx), 0);
-  std::size_t data_field_count = 99;
-  ASSERT_EQ(fm_workbook_pivot_data_field_count(wb.handle, 0, pivot_idx, &data_field_count), 0);
-  EXPECT_EQ(data_field_count, 0U);
-
-  fm_pivot_filter_spec_t filter{};
-  filter.axis = FM_PIVOT_AXIS_ROW;
-  filter.field_name = "Region";
-  filter.type = FM_PIVOT_FILTER_LABEL_BEGINS_WITH;
-  filter.value_kind = FM_PIVOT_FILTER_VALUE_TEXT;
-  filter.value_text = "N";
-  filter.value_high_kind = FM_PIVOT_FILTER_VALUE_NONE;
-  ASSERT_EQ(fm_workbook_pivot_filter_add(wb.handle, 0, pivot_idx, &filter), 0);
-  ASSERT_EQ(fm_workbook_pivot_filter_clear(wb.handle, 0, pivot_idx), 0);
-
-  ASSERT_EQ(fm_workbook_pivot_field_clear(wb.handle, 0, pivot_idx), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_count(wb.handle, 0, pivot_idx, &field_count), 0);
-  EXPECT_EQ(field_count, 0U);
-  ASSERT_EQ(fm_workbook_pivot_cache_field_clear(wb.handle, cache_id), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_field_count(wb.handle, cache_id, &field_count), 0);
-  EXPECT_EQ(field_count, 0U);
-}
-
-namespace {
-
-// Region shared items are `[0] = "North"`, `[1] = blank`; the two records
-// carry one of each. The blank shared item deliberately does NOT sit at index
-// 0, which is what a name-addressed item silently binds to.
-fm_status_t BuildBlankItemPivot(fm_workbook_t* wb, std::uint32_t* out_cache_id, std::size_t* out_pivot_index) {
-  std::uint32_t cache_id = 0;
-  if (fm_status_t st = fm_workbook_pivot_cache_create(wb, 0U, &cache_id); st != 0) {
-    return st;
-  }
-  std::size_t region_idx = 99;
-  std::size_t amount_idx = 99;
-  if (fm_status_t st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Region", &region_idx); st != 0) {
-    return st;
-  }
-  if (fm_status_t st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Amount", &amount_idx); st != 0) {
-    return st;
-  }
-  if (fm_status_t st = fm_workbook_pivot_cache_field_add_shared_item_text(wb, cache_id, region_idx, "North"); st != 0) {
-    return st;
-  }
-  if (fm_status_t st = fm_workbook_pivot_cache_field_add_shared_item_blank(wb, cache_id, region_idx); st != 0) {
-    return st;
-  }
-
-  std::size_t rec_idx = 99;
-  if (fm_status_t st = fm_workbook_pivot_cache_record_add(wb, cache_id, &rec_idx); st != 0) {
-    return st;
-  }
-  if (fm_status_t st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, region_idx, 0.0); st != 0) {
-    return st;
-  }
-  if (fm_status_t st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, amount_idx, 100.0); st != 0) {
-    return st;
-  }
-  if (fm_status_t st = fm_workbook_pivot_cache_record_add(wb, cache_id, &rec_idx); st != 0) {
-    return st;
-  }
-  if (fm_status_t st = fm_workbook_pivot_cache_record_set_blank(wb, cache_id, rec_idx, region_idx); st != 0) {
-    return st;
-  }
-  if (fm_status_t st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, amount_idx, 200.0); st != 0) {
-    return st;
-  }
-
-  std::size_t pivot_idx = 99;
-  if (fm_status_t st = fm_workbook_pivot_create(wb, 0, "PT", cache_id, 0U, 0U, &pivot_idx); st != 0) {
-    return st;
-  }
-  fm_pivot_field_spec_t region_spec{};
-  region_spec.source_name = "Region";
-  region_spec.custom_name = "";
-  region_spec.axis = FM_PIVOT_AXIS_ROW;
-  region_spec.subtotal_top = 0;
-  region_spec.number_format = "";
-  std::size_t region_field = 99;
-  if (fm_status_t st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &region_spec, &region_field); st != 0) {
-    return st;
-  }
-  fm_pivot_field_spec_t amount_spec{};
-  amount_spec.source_name = "Amount";
-  amount_spec.custom_name = "";
-  amount_spec.axis = FM_PIVOT_AXIS_VALUE;
-  amount_spec.subtotal_top = 0;
-  amount_spec.number_format = "";
-  std::size_t amount_field = 99;
-  if (fm_status_t st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &amount_spec, &amount_field); st != 0) {
-    return st;
-  }
-  const std::uint32_t row_order[] = {static_cast<std::uint32_t>(region_field)};
-  if (fm_status_t st = fm_workbook_pivot_set_row_field_order(wb, 0, pivot_idx, row_order, 1U); st != 0) {
-    return st;
-  }
-  fm_pivot_data_field_spec_t df_spec{};
-  df_spec.name = "Sum of Amount";
-  df_spec.field_index = static_cast<std::uint32_t>(amount_field);
-  df_spec.aggregation = FM_PIVOT_AGG_SUM;
-  df_spec.number_format = "";
-  df_spec.show_as = FM_PIVOT_SHOW_AS_NORMAL;
-  df_spec.show_as_base_field = -1;
-  df_spec.show_as_base_item = -1;
-  std::size_t df_idx = 99;
-  if (fm_status_t st = fm_workbook_pivot_data_field_add(wb, 0, pivot_idx, &df_spec, &df_idx); st != 0) {
-    return st;
-  }
-  if (out_cache_id != nullptr) {
-    *out_cache_id = cache_id;
-  }
-  if (out_pivot_index != nullptr) {
-    *out_pivot_index = pivot_idx;
-  }
-  return 0;
-}
-
-// Sum of every `FM_PIVOT_CELL_DATA` cell in the projected layout.
-double SumDataCells(fm_pivot_cells_t* handle) {
-  double total = 0.0;
-  const std::size_t n = fm_pivot_cells_count(handle);
-  for (std::size_t i = 0; i < n; ++i) {
-    fm_pivot_cell_t cell{};
-    EXPECT_EQ(fm_pivot_cells_at(handle, i, &cell), 0);
-    if (cell.kind == FM_PIVOT_CELL_DATA && cell.value.kind == FM_VAL_NUMBER) {
-      total += cell.value.u.number;
-    }
-  }
-  return total;
-}
-
-}  // namespace
-
-TEST(FormulonCApiPivot, AddItemAtBindsTheBlankItemByCacheIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildBlankItemPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  // Both source rows contribute before any manual filter exists.
-  {
-    PivotCellsGuard projected;
-    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-    EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 300.0);
-  }
-
-  // The blank shared item is at cache index 1, so the index-addressed adder is
-  // the only way to name it: an empty label carries no binding of its own.
-  ASSERT_EQ(fm_workbook_pivot_field_add_item(wb.handle, 0, pivot_idx, 0, "North", 1), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_add_item_at(wb.handle, 0, pivot_idx, 0, /*cache_index=*/1U, /*visible=*/0), 0);
-  {
-    PivotCellsGuard projected;
-    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-    EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 100.0);
-  }
-}
-
-TEST(FormulonCApiPivot, AddItemWithEmptyNameCannotHideTheBlankRow) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildBlankItemPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-
-  // A name-addressed item defaults to cache index 0, which here holds
-  // "North". The item is unlabelled, so it takes its label from that binding
-  // and hides North, never the blank row. This is the gap
-  // `fm_workbook_pivot_field_add_item_at` closes.
-  ASSERT_EQ(fm_workbook_pivot_field_add_item(wb.handle, 0, pivot_idx, 0, "North", 1), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_add_item(wb.handle, 0, pivot_idx, 0, "", 0), 0);
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-  EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 200.0);
-}
-
-namespace {
-
-std::size_t CountOccurrences(const std::string& haystack, std::string_view needle) {
-  std::size_t count = 0;
-  for (std::size_t at = haystack.find(needle); at != std::string::npos; at = haystack.find(needle, at + 1U)) {
-    ++count;
-  }
-  return count;
-}
-
-std::string SavedPivotXml(fm_workbook_t* wb) {
-  BufferGuard saved;
-  EXPECT_EQ(fm_workbook_save(wb, &saved.data, &saved.len), 0) << fm_last_error_message();
-  return ExtractZipEntry(std::vector<std::uint8_t>(saved.data, saved.data + saved.len),
-                         "xl/pivotTables/pivotTable1.xml");
-}
-
-// True when the projected layout holds a text cell spelling `text`.
-bool LayoutHasText(fm_workbook_t* wb, std::size_t pivot_idx, std::string_view text) {
-  PivotCellsGuard projected;
-  EXPECT_EQ(fm_workbook_pivot_layout(wb, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-  for (const fm_pivot_cell_t& cell : CollectCells(projected.handle)) {
-    if (cell.value.kind == FM_VAL_TEXT && cell.value.u.text != nullptr && text == cell.value.u.text) {
-      return true;
-    }
-  }
-  return false;
-}
-
-}  // namespace
-
-TEST(FormulonCApiPivot, FieldNumberFormatRoundTripsAsNumFmtId) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-  std::uint16_t custom_id = 0;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "0.000", &custom_id), 0) << fm_last_error_message();
-  const std::string custom = std::to_string(custom_id);
-  ASSERT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, custom.c_str()), 0)
-      << fm_last_error_message();
-
-  const std::string first = SavedPivotXml(wb.handle);
-  const std::string attr = "numFmtId=\"" + custom + "\"";
-  EXPECT_EQ(CountOccurrences(first, attr), 1U) << first;
-
-  // A reload reads the attribute into the model rather than into the
-  // passthrough bin, so the next save still emits it exactly once.
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0) << fm_last_error_message();
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0) << fm_last_error_message();
-  const std::string second = SavedPivotXml(reloaded.handle);
-  EXPECT_EQ(CountOccurrences(second, attr), 1U) << second;
-  EXPECT_NE(second.find("<pivotField dataField=\"1\" " + attr), std::string::npos) << second;
-}
-
-TEST(FormulonCApiPivot, NumberFormatRejectsAnythingButAKnownNumFmtId) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-  const fm_status_t invalid = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-
-  // A format code, a signed id, an id nothing registered, one past uint16.
-  for (const char* bad : {"0.00", "-4", "200", "65536"}) {
-    EXPECT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, bad), invalid) << bad;
-
-    fm_pivot_field_spec_t field_spec{};
-    field_spec.source_name = "Amount";
-    field_spec.axis = FM_PIVOT_AXIS_VALUE;
-    field_spec.number_format = bad;
-    std::size_t field_idx = 99;
-    EXPECT_EQ(fm_workbook_pivot_field_add(wb.handle, 0, pivot_idx, &field_spec, &field_idx), invalid) << bad;
-
-    fm_pivot_data_field_spec_t df_spec{};
-    df_spec.name = "Sum of Amount";
-    df_spec.field_index = 1U;
-    df_spec.aggregation = FM_PIVOT_AGG_SUM;
-    df_spec.number_format = bad;
-    df_spec.show_as_base_field = -1;
-    df_spec.show_as_base_item = -1;
-    std::size_t df_idx = 99;
-    EXPECT_EQ(fm_workbook_pivot_data_field_add(wb.handle, 0, pivot_idx, &df_spec, &df_idx), invalid) << bad;
-    EXPECT_EQ(fm_workbook_pivot_data_field_set(wb.handle, 0, pivot_idx, 0, &df_spec), invalid) << bad;
-  }
-  std::size_t field_count = 0;
-  ASSERT_EQ(fm_workbook_pivot_field_count(wb.handle, 0, pivot_idx, &field_count), 0);
-  EXPECT_EQ(field_count, 2U);
-  std::size_t df_count = 0;
-  ASSERT_EQ(fm_workbook_pivot_data_field_count(wb.handle, 0, pivot_idx, &df_count), 0);
-  EXPECT_EQ(df_count, 1U);
-
-  // A built-in id and the empty string (clear) are accepted.
-  EXPECT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, "4"), 0) << fm_last_error_message();
-  EXPECT_EQ(fm_workbook_pivot_field_set_number_format(wb.handle, 0, pivot_idx, 1, ""), 0) << fm_last_error_message();
-}
-
-// An item added by cache index carries no name until a load resolves it, so
-// evaluation labels it from its binding: hiding index 1 hides "South".
-TEST(FormulonCApiPivot, AddItemAtHidesANonBlankItemBeforeAnyReload) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-  ASSERT_EQ(fm_workbook_pivot_field_clear_items(wb.handle, 0, pivot_idx, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_add_item_at(wb.handle, 0, pivot_idx, 0, /*cache_index=*/1U, /*visible=*/0), 0);
-  {
-    PivotCellsGuard projected;
-    ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-    EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 400.0);  // North only: 100 + 300.
-  }
-  EXPECT_FALSE(LayoutHasText(wb.handle, pivot_idx, "South"));
-
-  // The label is derived at evaluation time, so repopulating the shared
-  // items after the item was added changes nothing.
-  ASSERT_EQ(fm_workbook_pivot_cache_field_clear_shared_items(wb.handle, cache_id, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_text(wb.handle, cache_id, 0, "North"), 0);
-  ASSERT_EQ(fm_workbook_pivot_cache_field_add_shared_item_text(wb.handle, cache_id, 0, "South"), 0);
-  PivotCellsGuard projected;
-  ASSERT_EQ(fm_workbook_pivot_layout(wb.handle, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
-  EXPECT_DOUBLE_EQ(SumDataCells(projected.handle), 400.0);
-}
-
-TEST(FormulonCApiPivot, SoleVisiblePageItemAddedByCacheIndexNamesItsValue) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  std::uint32_t cache_id = 0;
-  std::size_t pivot_idx = 0;
-  ASSERT_EQ(BuildScratchPivot(wb.handle, &cache_id, &pivot_idx), 0) << fm_last_error_message();
-  ASSERT_EQ(fm_workbook_pivot_set_row_field_order(wb.handle, 0, pivot_idx, nullptr, 0U), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_set_axis(wb.handle, 0, pivot_idx, 0, FM_PIVOT_AXIS_PAGE), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_clear_items(wb.handle, 0, pivot_idx, 0), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_add_item_at(wb.handle, 0, pivot_idx, 0, /*cache_index=*/0U, /*visible=*/0), 0);
-  ASSERT_EQ(fm_workbook_pivot_field_add_item_at(wb.handle, 0, pivot_idx, 0, /*cache_index=*/1U, /*visible=*/1), 0);
-  EXPECT_TRUE(LayoutHasText(wb.handle, pivot_idx, "South"));
-}
diff --git a/tests/c_api/formulon_c_pivot_test_helpers.h b/tests/c_api/formulon_c_pivot_test_helpers.h
new file mode 100644
index 000000000..2ab0ed9f4
--- /dev/null
+++ b/tests/c_api/formulon_c_pivot_test_helpers.h
@@ -0,0 +1,268 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "gtest/gtest.h"
+#include "miniz.h"
+#include "pivot/pivot_table.h"
+#include "utils/error.h"
+
+namespace {
+
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+};
+
+struct PivotCellsGuard {
+  fm_pivot_cells_t* handle = nullptr;
+  ~PivotCellsGuard() { fm_pivot_cells_destroy(handle); }
+  PivotCellsGuard() = default;
+  PivotCellsGuard(const PivotCellsGuard&) = delete;
+  PivotCellsGuard& operator=(const PivotCellsGuard&) = delete;
+};
+
+struct BufferGuard {
+  std::uint8_t* data = nullptr;
+  std::size_t len = 0;
+  ~BufferGuard() { fm_buffer_free(data); }
+  BufferGuard() = default;
+  BufferGuard(const BufferGuard&) = delete;
+  BufferGuard& operator=(const BufferGuard&) = delete;
+};
+
+struct PartFile {
+  const char* path;
+  std::string_view body;
+};
+
+// A foreign-ABI caller can put any int-sized value into an enum field, which is
+// exactly what the C surface has to reject. Writing the bytes reproduces that
+// without a constant conversion: an enumerator outside the enum's implied value
+// range is unspecified, and GCC rejects it under -Wconversion.
+template <typename Enum>
+[[maybe_unused]] inline Enum RawEnumValue(std::uint32_t raw) {
+  static_assert(sizeof(Enum) == sizeof(std::uint32_t), "C ABI enums are int-sized");
+  Enum value{};
+  std::memcpy(&value, &raw, sizeof(value));
+  return value;
+}
+
+[[maybe_unused]] inline std::vector<std::uint8_t> BuildZip(const std::vector<PartFile>& parts) {
+  mz_zip_archive writer{};
+  EXPECT_NE(mz_zip_writer_init_heap(&writer, 0, 4096), MZ_FALSE);
+  for (const auto& p : parts) {
+    EXPECT_NE(mz_zip_writer_add_mem(&writer, p.path, p.body.data(), p.body.size(),
+                                    static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)),
+              MZ_FALSE)
+        << "miniz add failed for " << p.path;
+  }
+  void* archive_ptr = nullptr;
+  std::size_t archive_size = 0;
+  EXPECT_NE(mz_zip_writer_finalize_heap_archive(&writer, &archive_ptr, &archive_size), MZ_FALSE);
+  EXPECT_NE(mz_zip_writer_end(&writer), MZ_FALSE);
+  std::vector<std::uint8_t> out(static_cast<const std::uint8_t*>(archive_ptr),
+                                static_cast<const std::uint8_t*>(archive_ptr) + archive_size);
+  mz_free(archive_ptr);
+  return out;
+}
+
+[[maybe_unused]] inline std::string ExtractZipEntry(const std::vector<std::uint8_t>& archive_bytes,
+                                                    std::string_view path) {
+  mz_zip_archive reader{};
+  if (mz_zip_reader_init_mem(&reader, archive_bytes.data(), archive_bytes.size(), 0) == MZ_FALSE) {
+    ADD_FAILURE() << "mz_zip_reader_init_mem failed";
+    return {};
+  }
+  const int index = mz_zip_reader_locate_file(&reader, std::string(path).c_str(), nullptr, 0);
+  if (index < 0) {
+    ADD_FAILURE() << "entry not found: " << path;
+    mz_zip_reader_end(&reader);
+    return {};
+  }
+  std::size_t extracted_size = 0;
+  void* extracted = mz_zip_reader_extract_to_heap(&reader, static_cast<mz_uint>(index), &extracted_size, 0);
+  if (extracted == nullptr) {
+    ADD_FAILURE() << "extract_to_heap failed for: " << path;
+    mz_zip_reader_end(&reader);
+    return {};
+  }
+  std::string body(static_cast<const char*>(extracted), extracted_size);
+  mz_free(extracted);
+  mz_zip_reader_end(&reader);
+  return body;
+}
+
+[[maybe_unused]] inline std::vector<fm_pivot_cell_t> CollectCells(fm_pivot_cells_t* handle) {
+  const std::size_t n = fm_pivot_cells_count(handle);
+  std::vector<fm_pivot_cell_t> out(n);
+  for (std::size_t i = 0; i < n; ++i) {
+    EXPECT_EQ(fm_pivot_cells_at(handle, i, &out[i]), 0);
+  }
+  return out;
+}
+
+[[maybe_unused]] inline std::size_t CountOccurrences(const std::string& haystack, std::string_view needle) {
+  std::size_t count = 0;
+  for (std::size_t at = haystack.find(needle); at != std::string::npos; at = haystack.find(needle, at + 1U)) {
+    ++count;
+  }
+  return count;
+}
+
+[[maybe_unused]] inline std::string SavedPivotXml(fm_workbook_t* wb) {
+  BufferGuard saved;
+  EXPECT_EQ(fm_workbook_save(wb, &saved.data, &saved.len), 0) << fm_last_error_message();
+  return ExtractZipEntry(std::vector<std::uint8_t>(saved.data, saved.data + saved.len),
+                         "xl/pivotTables/pivotTable1.xml");
+}
+
+// True when the projected layout holds a text cell spelling `text`.
+[[maybe_unused]] inline bool LayoutHasText(fm_workbook_t* wb, std::size_t pivot_idx, std::string_view text) {
+  PivotCellsGuard projected;
+  EXPECT_EQ(fm_workbook_pivot_layout(wb, 0, pivot_idx, &projected.handle), 0) << fm_last_error_message();
+  for (const fm_pivot_cell_t& cell : CollectCells(projected.handle)) {
+    if (cell.value.kind == FM_VAL_TEXT && cell.value.u.text != nullptr && text == cell.value.u.text) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// Builds a pivot cache + table from scratch via the C ABI:
+//   * 2 fields: "Region" (text) and "Amount" (numeric).
+//   * 4 records: (North, 100), (South, 200), (North, 300), (South, 400).
+//   * Pivot table on sheet 0, name "PT", anchor (0, 3), with Region as the
+//     row field and Amount aggregated as Sum.
+[[maybe_unused]] inline fm_status_t BuildScratchPivot(fm_workbook_t* wb, std::uint32_t* out_cache_id,
+                                                      std::size_t* out_pivot_index) {
+  std::uint32_t cache_id = 0;
+  fm_status_t st = fm_workbook_pivot_cache_create(wb, 0, &cache_id);
+  if (st != 0) {
+    return st;
+  }
+  // Excel refuses a package whose cache declares no source, so a cache
+  // that is going to be saved needs one. The range only has to describe
+  // where the records came from; it is not required to hold data, since
+  // the records themselves carry the values.
+  st = fm_workbook_pivot_cache_set_worksheet_source(wb, cache_id, /*present=*/1, "A1:B5", "Sheet1", nullptr);
+  if (st != 0) {
+    return st;
+  }
+  std::size_t region_idx = 99;
+  st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Region", &region_idx);
+  if (st != 0) {
+    return st;
+  }
+  std::size_t amount_idx = 99;
+  st = fm_workbook_pivot_cache_field_add(wb, cache_id, "Amount", &amount_idx);
+  if (st != 0) {
+    return st;
+  }
+  // Shared items for "Region": index 0 = "North", index 1 = "South".
+  st = fm_workbook_pivot_cache_field_add_shared_item_text(wb, cache_id, region_idx, "North");
+  if (st != 0) {
+    return st;
+  }
+  st = fm_workbook_pivot_cache_field_add_shared_item_text(wb, cache_id, region_idx, "South");
+  if (st != 0) {
+    return st;
+  }
+  // 4 records.
+  const struct {
+    double region_index;
+    double amount;
+  } rows[] = {{0.0, 100.0}, {1.0, 200.0}, {0.0, 300.0}, {1.0, 400.0}};
+  for (const auto& row : rows) {
+    std::size_t rec_idx = 99;
+    st = fm_workbook_pivot_cache_record_add(wb, cache_id, &rec_idx);
+    if (st != 0) {
+      return st;
+    }
+    st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, region_idx, row.region_index);
+    if (st != 0) {
+      return st;
+    }
+    st = fm_workbook_pivot_cache_record_set_number(wb, cache_id, rec_idx, amount_idx, row.amount);
+    if (st != 0) {
+      return st;
+    }
+  }
+  // Pivot table.
+  std::size_t pivot_idx = 99;
+  st = fm_workbook_pivot_create(wb, 0, "PT", cache_id, /*anchor_row=*/0U, /*anchor_col=*/3U, &pivot_idx);
+  if (st != 0) {
+    return st;
+  }
+  // Region (row) + items 0 and 1, plus the OOXML "default" subtotal item.
+  fm_pivot_field_spec_t region_spec{};
+  region_spec.source_name = "Region";
+  region_spec.custom_name = "";
+  region_spec.axis = FM_PIVOT_AXIS_ROW;
+  region_spec.subtotal_top = 0;
+  region_spec.number_format = "";
+  std::size_t region_field = 99;
+  st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &region_spec, &region_field);
+  if (st != 0) {
+    return st;
+  }
+  st = fm_workbook_pivot_field_add_item(wb, 0, pivot_idx, region_field, "North", 1);
+  if (st != 0) {
+    return st;
+  }
+  st = fm_workbook_pivot_field_add_item(wb, 0, pivot_idx, region_field, "South", 1);
+  if (st != 0) {
+    return st;
+  }
+  // Amount (value-axis source field).
+  fm_pivot_field_spec_t amount_spec{};
+  amount_spec.source_name = "Amount";
+  amount_spec.custom_name = "";
+  amount_spec.axis = FM_PIVOT_AXIS_VALUE;
+  amount_spec.subtotal_top = 0;
+  amount_spec.number_format = "";
+  std::size_t amount_field = 99;
+  st = fm_workbook_pivot_field_add(wb, 0, pivot_idx, &amount_spec, &amount_field);
+  if (st != 0) {
+    return st;
+  }
+  // Row-field order.
+  const std::uint32_t row_order[] = {static_cast<std::uint32_t>(region_field)};
+  st = fm_workbook_pivot_set_row_field_order(wb, 0, pivot_idx, row_order, 1U);
+  if (st != 0) {
+    return st;
+  }
+  // Data field: Sum of Amount.
+  fm_pivot_data_field_spec_t df_spec{};
+  df_spec.name = "Sum of Amount";
+  df_spec.field_index = static_cast<std::uint32_t>(amount_field);
+  df_spec.aggregation = FM_PIVOT_AGG_SUM;
+  df_spec.number_format = "";
+  df_spec.show_as = FM_PIVOT_SHOW_AS_NORMAL;
+  df_spec.show_as_base_field = -1;
+  df_spec.show_as_base_item = -1;
+  std::size_t df_idx = 99;
+  st = fm_workbook_pivot_data_field_add(wb, 0, pivot_idx, &df_spec, &df_idx);
+  if (st != 0) {
+    return st;
+  }
+  if (out_cache_id != nullptr) {
+    *out_cache_id = cache_id;
+  }
+  if (out_pivot_index != nullptr) {
+    *out_pivot_index = pivot_idx;
+  }
+  return 0;
+}
+
+}  // namespace
diff --git a/tests/c_api/formulon_c_save_test.cpp b/tests/c_api/formulon_c_save_test.cpp
new file mode 100644
index 000000000..0d6ec2c3a
--- /dev/null
+++ b/tests/c_api/formulon_c_save_test.cpp
@@ -0,0 +1,647 @@
+// Stable C ABI (`src/c_api/formulon_c.h`) end-to-end tests.
+//
+// The test driver is C++ for gtest convenience but everything it
+// touches across the boundary is the pure-C surface declared in
+// `formulon_c.h`.
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <iterator>
+#include <limits>
+#include <string>
+#include <string_view>
+#include <thread>
+#include <utility>
+#include <vector>
+
+#include "c_api/parts/common.h"
+#include "formulon_c_test_helpers.h"
+#include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
+#include "io/format_detect.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "passthrough_part.h"
+#include "sheet.h"
+#include "unknown_relationship.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace {
+
+void MarkZipEntriesEncrypted(std::vector<std::uint8_t>& bytes) {
+  for (std::size_t i = 0; i + 8U <= bytes.size(); ++i) {
+    const bool local = bytes[i] == 'P' && bytes[i + 1U] == 'K' && bytes[i + 2U] == 3U && bytes[i + 3U] == 4U;
+    const bool central = bytes[i] == 'P' && bytes[i + 1U] == 'K' && bytes[i + 2U] == 1U && bytes[i + 3U] == 2U;
+    if (local || central) {
+      const std::size_t flag_offset = i + (local ? 6U : 8U);
+      bytes[flag_offset] = static_cast<std::uint8_t>(bytes[flag_offset] | 0x01U);
+    }
+  }
+}
+
+std::vector<std::uint8_t> AppendEmptyZipEntry(const std::vector<std::uint8_t>& bytes, std::string_view name) {
+  const std::uint8_t signature[] = {0x50, 0x4b, 0x05, 0x06};
+  const auto eocd_it = std::find_end(bytes.begin(), bytes.end(), std::begin(signature), std::end(signature));
+  EXPECT_NE(eocd_it, bytes.end());
+  if (eocd_it == bytes.end()) {
+    return {};
+  }
+  const std::size_t eocd = static_cast<std::size_t>(eocd_it - bytes.begin());
+  const auto read16 = [&](std::size_t offset) {
+    return static_cast<std::uint16_t>(bytes[offset] | (static_cast<std::uint16_t>(bytes[offset + 1U]) << 8U));
+  };
+  const auto read32 = [&](std::size_t offset) {
+    return static_cast<std::uint32_t>(bytes[offset] | (static_cast<std::uint32_t>(bytes[offset + 1U]) << 8U) |
+                                      (static_cast<std::uint32_t>(bytes[offset + 2U]) << 16U) |
+                                      (static_cast<std::uint32_t>(bytes[offset + 3U]) << 24U));
+  };
+  const std::uint16_t count = read16(eocd + 10U);
+  const std::uint32_t central_size = read32(eocd + 12U);
+  const std::uint32_t central_offset = read32(eocd + 16U);
+  const auto put16 = [](std::vector<std::uint8_t>& out, std::uint16_t value) {
+    out.push_back(static_cast<std::uint8_t>(value));
+    out.push_back(static_cast<std::uint8_t>(value >> 8U));
+  };
+  const auto put32 = [](std::vector<std::uint8_t>& out, std::uint32_t value) {
+    out.push_back(static_cast<std::uint8_t>(value));
+    out.push_back(static_cast<std::uint8_t>(value >> 8U));
+    out.push_back(static_cast<std::uint8_t>(value >> 16U));
+    out.push_back(static_cast<std::uint8_t>(value >> 24U));
+  };
+  const std::string encoded_name(name);
+  std::vector<std::uint8_t> local;
+  put32(local, 0x04034b50U);
+  put16(local, 20);
+  put16(local, 0);
+  put16(local, 0);
+  put16(local, 0);
+  put16(local, 0);
+  put32(local, 0);
+  put32(local, 0);
+  put32(local, 0);
+  put16(local, static_cast<std::uint16_t>(encoded_name.size()));
+  put16(local, 0);
+  local.insert(local.end(), encoded_name.begin(), encoded_name.end());
+  std::vector<std::uint8_t> central;
+  put32(central, 0x02014b50U);
+  put16(central, 20);
+  put16(central, 20);
+  put16(central, 0);
+  put16(central, 0);
+  put16(central, 0);
+  put16(central, 0);
+  put32(central, 0);
+  put32(central, 0);
+  put32(central, 0);
+  put16(central, static_cast<std::uint16_t>(encoded_name.size()));
+  put16(central, 0);
+  put16(central, 0);
+  put16(central, 0);
+  put16(central, 0);
+  put32(central, 0);
+  put32(central, central_offset);
+  central.insert(central.end(), encoded_name.begin(), encoded_name.end());
+  std::vector<std::uint8_t> out;
+  out.insert(out.end(), bytes.begin(), bytes.begin() + central_offset);
+  out.insert(out.end(), local.begin(), local.end());
+  out.insert(out.end(), bytes.begin() + central_offset, bytes.begin() + central_offset + central_size);
+  out.insert(out.end(), central.begin(), central.end());
+  put32(out, 0x06054b50U);
+  put16(out, 0);
+  put16(out, 0);
+  put16(out, count + 1U);
+  put16(out, count + 1U);
+  put32(out, central_size + static_cast<std::uint32_t>(central.size()));
+  put32(out, central_offset + static_cast<std::uint32_t>(local.size()));
+  put16(out, 0);
+  return out;
+}
+
+}  // namespace
+
+TEST(FormulonCApi, LoadMapsCorruptAndEncryptedContainersToIoErrors) {
+  fm_workbook_t* loaded = reinterpret_cast<fm_workbook_t*>(0x1);
+  const std::vector<std::uint8_t> garbage = {0x01U, 0x02U, 0x03U, 0x04U};
+  EXPECT_EQ(fm_workbook_load(garbage.data(), garbage.size(), &loaded),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoZipCorrupt));
+  EXPECT_EQ(loaded, nullptr);
+
+  loaded = reinterpret_cast<fm_workbook_t*>(0x1);
+  const std::vector<std::uint8_t> cdfv2 = {0xD0U, 0xCFU, 0x11U, 0xE0U, 0xA1U, 0xB1U, 0x1AU, 0xE1U};
+  EXPECT_EQ(fm_workbook_load(cdfv2.data(), cdfv2.size(), &loaded),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoZipEncrypted));
+  EXPECT_EQ(loaded, nullptr);
+
+  formulon::Workbook source = formulon::Workbook::create();
+  auto saved = source.save();
+  ASSERT_TRUE(static_cast<bool>(saved));
+  std::vector<std::uint8_t> encrypted = saved.value();
+  MarkZipEntriesEncrypted(encrypted);
+  loaded = reinterpret_cast<fm_workbook_t*>(0x1);
+  EXPECT_EQ(fm_workbook_load(encrypted.data(), encrypted.size(), &loaded),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoZipEncrypted));
+  EXPECT_EQ(loaded, nullptr);
+}
+TEST(FormulonCApi, SaveLoadRoundTrip) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Second"), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 7.0), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 1, 0, "=A1+1"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  BufferGuard buf;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &buf.data, &buf.len), 0);
+  ASSERT_NE(buf.data, nullptr);
+  EXPECT_GT(buf.len, 0U);
+
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &loaded.handle), 0);
+  EXPECT_EQ(fm_workbook_sheet_count(loaded.handle), 2U);
+
+  const char* sheet0 = nullptr;
+  ASSERT_EQ(fm_workbook_sheet_name(loaded.handle, 0, &sheet0), 0);
+  EXPECT_STREQ(sheet0, "Sheet1");
+
+  // The literal A1=7 must round-trip; the formula B1=A1+1 may need a
+  // recalc on the loaded workbook to populate its cached value.
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  fm_value_t a1{};
+  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 0, 0, &a1), 0);
+  EXPECT_EQ(a1.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(a1.u.number, 7.0);
+}
+TEST(FormulonCApi, SaveExXlsxMatchesSave) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 7.0), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  BufferGuard xlsx_buf;
+  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSX, &xlsx_buf.data, &xlsx_buf.len), 0);
+  ASSERT_NE(xlsx_buf.data, nullptr);
+  EXPECT_GT(xlsx_buf.len, 0U);
+
+  // `FM_WORKBOOK_FORMAT_XLSX` must produce an OOXML container, so the
+  // C ABI's own format sniff (used by `fm_workbook_load`) reports it as
+  // such rather than xlsb.
+  formulon::io::ByteSpan xlsx_span{xlsx_buf.data, xlsx_buf.len};
+  EXPECT_EQ(formulon::io::detect_workbook_format(xlsx_span), formulon::WorkbookFormat::Ooxml);
+}
+TEST(FormulonCApi, SaveExXlsbProducesLoadableXlsbContainer) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 42.0), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  BufferGuard xlsb_buf;
+  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSB, &xlsb_buf.data, &xlsb_buf.len), 0);
+  ASSERT_NE(xlsb_buf.data, nullptr);
+  EXPECT_GT(xlsb_buf.len, 0U);
+
+  // The bytes must be a real MS-XLSB package (declares `xl/workbook.bin`,
+  // not `xl/workbook.xml`), and must load back through the byte-only
+  // C ABI, which auto-detects the container from its contents.
+  formulon::io::ByteSpan xlsb_span{xlsb_buf.data, xlsb_buf.len};
+  EXPECT_EQ(formulon::io::detect_workbook_format(xlsb_span), formulon::WorkbookFormat::Xlsb);
+
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(xlsb_buf.data, xlsb_buf.len, &loaded.handle), 0);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(v.u.number, 42.0);
+}
+TEST(FormulonCApi, SaveWithDiagnosticsReportsTheXlsbCountersAndLeavesTheXlsxOnesZero) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=T[C]"), 0);
+
+  auto& sheet = wb.handle->workbook().sheet(0);
+  formulon::Hyperlink hyperlink;
+  hyperlink.target = "https://example.com";
+  sheet.mutable_hyperlinks().push_back(std::move(hyperlink));
+  sheet.mutable_validations().push_back(formulon::DataValidation{});
+  sheet.set_auto_filter(formulon::io::auto_filter_from_xml("<autoFilter ref=\"A1:B2\"/>"));
+
+  // The OOXML writer represents all of the above, so a clean XLSX save
+  // reports nothing lost -- including on the two fields both writers own.
+  BufferGuard xlsx_buf;
+  fm_save_diagnostics_t xlsx{99U, 99U, 99U, 99U, 99U};
+  ASSERT_EQ(fm_workbook_save_with_diagnostics(wb.handle, FM_WORKBOOK_FORMAT_XLSX, &xlsx_buf.data, &xlsx_buf.len, &xlsx),
+            0);
+  EXPECT_EQ(xlsx.downgraded_formula_count, 0U);
+  EXPECT_EQ(xlsx.deferred_feature_count, 0U);
+  EXPECT_EQ(xlsx.dropped_part_count, 0U);
+  EXPECT_EQ(xlsx.dropped_relationship_count, 0U);
+  EXPECT_EQ(xlsx.renumbered_part_count, 0U);
+
+  BufferGuard xlsb_buf;
+  fm_save_diagnostics_t xlsb{};
+  ASSERT_EQ(fm_workbook_save_with_diagnostics(wb.handle, FM_WORKBOOK_FORMAT_XLSB, &xlsb_buf.data, &xlsb_buf.len, &xlsb),
+            0);
+  EXPECT_EQ(xlsb.downgraded_formula_count, 1U);
+  // Auto-filter state remains deferred. Hyperlinks and validations are
+  // written from the model and are therefore not counted here.
+  EXPECT_EQ(xlsb.deferred_feature_count, 1U);
+  // `renumbered_part_count` has no XLSB source: the binary writer never
+  // reassigns a part id.
+  EXPECT_EQ(xlsb.renumbered_part_count, 0U);
+}
+TEST(FormulonCApi, SaveWithDiagnosticsCarriesTheOoxmlWriterCountersAcrossTheAbi) {
+  // The OOXML writer's own counters are unit-tested at the io layer; this
+  // pins that they survive the projection onto `fm_save_diagnostics_t`
+  // instead of arriving as zero.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.0), 0);
+
+  // A preserved copy of a part the writer always generates loses the
+  // collision and is dropped; a relationship whose target part is absent is
+  // dropped rather than left dangling.
+  formulon::PassthroughPart stale;
+  stale.path = "xl/styles.xml";
+  stale.content_type = "application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml";
+  stale.bytes = {'<', '/', '>'};
+  wb.handle->workbook().set_passthrough_parts({std::move(stale)});
+  formulon::UnknownRelationship orphan;
+  orphan.id = "rId9";
+  orphan.type = "http://schemas.example.com/orphan";
+  orphan.target = "xl/missing.xml";
+  wb.handle->workbook().set_unknown_workbook_rels({std::move(orphan)});
+
+  BufferGuard buf;
+  fm_save_diagnostics_t d{99U, 99U, 99U, 99U, 99U};
+  ASSERT_EQ(fm_workbook_save_with_diagnostics(wb.handle, FM_WORKBOOK_FORMAT_XLSX, &buf.data, &buf.len, &d), 0);
+  EXPECT_GT(buf.len, 0U);
+  EXPECT_EQ(d.dropped_part_count, 1U);
+  EXPECT_EQ(d.dropped_relationship_count, 1U);
+  EXPECT_EQ(d.downgraded_formula_count, 0U);
+  EXPECT_EQ(d.deferred_feature_count, 0U);
+  EXPECT_EQ(d.renumbered_part_count, 0U);
+}
+TEST(FormulonCApi, ReadDiagnosticsAreZeroForCleanRoundTrip) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 42.0), 0);
+
+  for (const fm_workbook_format_t format : {FM_WORKBOOK_FORMAT_XLSX, FM_WORKBOOK_FORMAT_XLSB}) {
+    BufferGuard bytes;
+    ASSERT_EQ(fm_workbook_save_as(wb.handle, format, &bytes.data, &bytes.len), 0);
+    WorkbookGuard loaded;
+    ASSERT_EQ(fm_workbook_load(bytes.data, bytes.len, &loaded.handle), 0);
+
+    fm_read_diagnostics_t d{99U, 99U, 99U, 99U, 99U};
+    ASSERT_EQ(fm_workbook_read_diagnostics(loaded.handle, &d), 0);
+    EXPECT_EQ(d.undecoded_formula_count, 0U) << "format=" << format;
+    EXPECT_EQ(d.undecoded_defined_name_count, 0U) << "format=" << format;
+    EXPECT_EQ(d.undecoded_part_count, 0U) << "format=" << format;
+    EXPECT_EQ(d.skipped_feature_count, 0U) << "format=" << format;
+    EXPECT_EQ(d.unknown_content_type_count, 0U) << "format=" << format;
+  }
+}
+TEST(FormulonCApi, DiagnosticsEntryPointsInitializeOutputsOnFailure) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  // A workbook that was never loaded reports every counter as zero rather
+  // than leaving the caller's struct untouched.
+  fm_read_diagnostics_t read{99U, 99U, 99U, 99U, 99U};
+  ASSERT_EQ(fm_workbook_read_diagnostics(wb.handle, &read), 0);
+  EXPECT_EQ(read.undecoded_formula_count, 0U);
+  EXPECT_EQ(read.skipped_feature_count, 0U);
+
+  uint8_t* bytes = reinterpret_cast<uint8_t*>(static_cast<uintptr_t>(1));
+  size_t len = 99U;
+  fm_save_diagnostics_t save{99U, 99U, 99U, 99U, 99U};
+  EXPECT_NE(fm_workbook_save_with_diagnostics(wb.handle, FM_WORKBOOK_FORMAT_UNKNOWN, &bytes, &len, &save), 0);
+  EXPECT_EQ(bytes, nullptr);
+  EXPECT_EQ(len, 0U);
+  EXPECT_EQ(save.downgraded_formula_count, 0U);
+  EXPECT_EQ(save.deferred_feature_count, 0U);
+  EXPECT_EQ(save.dropped_part_count, 0U);
+  EXPECT_EQ(save.dropped_relationship_count, 0U);
+  EXPECT_EQ(save.renumbered_part_count, 0U);
+
+  read = fm_read_diagnostics_t{99U, 99U, 99U, 99U, 99U};
+  EXPECT_NE(fm_workbook_read_diagnostics(nullptr, &read), 0);
+  EXPECT_EQ(read.undecoded_formula_count, 0U);
+  EXPECT_EQ(read.undecoded_defined_name_count, 0U);
+  EXPECT_EQ(read.undecoded_part_count, 0U);
+  EXPECT_EQ(read.skipped_feature_count, 0U);
+  EXPECT_EQ(read.unknown_content_type_count, 0U);
+}
+TEST(FormulonCApi, ReadDiagnosticsPreservesUnknownPartFromDeterministicFixture) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  BufferGuard bytes;
+  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSB, &bytes.data, &bytes.len), 0);
+  const std::vector<std::uint8_t> fixture =
+      AppendEmptyZipEntry(std::vector<std::uint8_t>(bytes.data, bytes.data + bytes.len), "xl/dropped.bin");
+  ASSERT_FALSE(fixture.empty());
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(fixture.data(), fixture.size(), &loaded.handle), 0);
+  fm_read_diagnostics_t d{};
+  ASSERT_EQ(fm_workbook_read_diagnostics(loaded.handle, &d), 0);
+  EXPECT_EQ(d.undecoded_formula_count, 0U);
+  EXPECT_EQ(d.undecoded_defined_name_count, 0U);
+  // Unknown package parts are retained as passthrough data, so loading the
+  // fixture is lossless and the undecoded-part diagnostic remains zero.
+  EXPECT_EQ(d.undecoded_part_count, 0U);
+}
+TEST(FormulonCApi, DiagnosticFailuresNameTheInvokedSymbol) {
+  fm_read_diagnostics_t read{77U, 77U, 77U, 77U, 77U};
+  EXPECT_NE(fm_workbook_read_diagnostics(nullptr, &read), 0);
+  EXPECT_EQ(read.undecoded_formula_count, 0U);
+  EXPECT_EQ(read.skipped_feature_count, 0U);
+  EXPECT_STREQ(fm_last_error_message(), "fm_workbook_read_diagnostics: NULL argument");
+
+  uint8_t* bytes = reinterpret_cast<uint8_t*>(static_cast<uintptr_t>(1));
+  size_t len = 77U;
+  EXPECT_NE(fm_workbook_save_as(nullptr, FM_WORKBOOK_FORMAT_XLSB, &bytes, &len), 0);
+  EXPECT_EQ(bytes, nullptr);
+  EXPECT_EQ(len, 0U);
+  EXPECT_STREQ(fm_last_error_message(), "fm_workbook_save_as: NULL argument");
+
+  fm_save_diagnostics_t save{77U, 77U, 77U, 77U, 77U};
+  bytes = reinterpret_cast<uint8_t*>(static_cast<uintptr_t>(1));
+  len = 77U;
+  EXPECT_NE(fm_workbook_save_with_diagnostics(nullptr, FM_WORKBOOK_FORMAT_XLSB, &bytes, &len, &save), 0);
+  EXPECT_EQ(bytes, nullptr);
+  EXPECT_EQ(len, 0U);
+  EXPECT_EQ(save.downgraded_formula_count, 0U);
+  EXPECT_EQ(save.renumbered_part_count, 0U);
+  EXPECT_STREQ(fm_last_error_message(), "fm_workbook_save_with_diagnostics: NULL argument");
+}
+TEST(FormulonCApi, EverySaveEntryPointZeroesOutParamsOnFailure) {
+  // The whole save family shares one failure-path contract, so a caller may
+  // reuse the same out variables across calls and free unconditionally. A
+  // member that left a previous call's pointer in place would hand that
+  // stale pointer to `fm_buffer_free` a second time.
+  uint8_t* const poison = reinterpret_cast<uint8_t*>(static_cast<uintptr_t>(1));
+
+  uint8_t* bytes = poison;
+  size_t len = 77U;
+  EXPECT_NE(fm_workbook_save(nullptr, &bytes, &len), 0);
+  EXPECT_EQ(bytes, nullptr);
+  EXPECT_EQ(len, 0U);
+  EXPECT_STREQ(fm_last_error_message(), "fm_workbook_save: NULL argument");
+
+  bytes = poison;
+  len = 77U;
+  EXPECT_NE(fm_workbook_save_as(nullptr, FM_WORKBOOK_FORMAT_XLSX, &bytes, &len), 0);
+  EXPECT_EQ(bytes, nullptr);
+  EXPECT_EQ(len, 0U);
+
+  bytes = poison;
+  len = 77U;
+  fm_save_diagnostics_t save{77U, 77U, 77U, 77U, 77U};
+  EXPECT_NE(fm_workbook_save_with_diagnostics(nullptr, FM_WORKBOOK_FORMAT_XLSX, &bytes, &len, &save), 0);
+  EXPECT_EQ(bytes, nullptr);
+  EXPECT_EQ(len, 0U);
+  EXPECT_EQ(save.downgraded_formula_count, 0U);
+  EXPECT_EQ(save.deferred_feature_count, 0U);
+  EXPECT_EQ(save.dropped_part_count, 0U);
+  EXPECT_EQ(save.dropped_relationship_count, 0U);
+  EXPECT_EQ(save.renumbered_part_count, 0U);
+
+  // A NULL out-parameter is rejected without being dereferenced, on the base
+  // entry point as well as the extended ones.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  len = 77U;
+  EXPECT_NE(fm_workbook_save(wb.handle, nullptr, &len), 0);
+  EXPECT_EQ(len, 0U);
+  bytes = poison;
+  EXPECT_NE(fm_workbook_save(wb.handle, &bytes, nullptr), 0);
+  EXPECT_EQ(bytes, nullptr);
+}
+TEST(FormulonCApi, BaseSaveProducesTheSameBytesAsTheXlsxFormatSelector) {
+  // The header declares the two equivalent; delegating the base entry point
+  // to the shared implementation is what keeps that true.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=1+2"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  BufferGuard base;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &base.data, &base.len), 0);
+  BufferGuard selected;
+  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSX, &selected.data, &selected.len), 0);
+
+  ASSERT_EQ(base.len, selected.len);
+  ASSERT_GT(base.len, 0U);
+  EXPECT_EQ(std::memcmp(base.data, selected.data, base.len), 0);
+}
+TEST(FormulonCApi, ReservedStatusCodesKeepTheirSlotsAndSpelling) {
+  // Some documented codes are allocated but no shipping path builds them.
+  // The header promises numeric identity with `formulon::FormulonErrorCode`,
+  // so those slots must not be reused or renumbered, and `fm_status_string`
+  // must keep naming them exactly: only a value outside the enum may fall
+  // back to `"kUnknownError"`.
+  struct Reserved {
+    fm_status_t code;
+    const char* name;
+  };
+  const Reserved reserved[] = {
+      {5008, "kIoXmlDoctype"},
+      {5009, "kIoXmlEntityExplosion"},
+      {5015, "kIoCsvEncodingDetect"},
+      {6000, "kCryptoAgileNotSupported"},
+      {6001, "kCryptoStandardNotSupported"},
+      {6002, "kCryptoBadPassword"},
+      {6003, "kCryptoHashMismatch"},
+      {6004, "kCryptoKeyDerivationFailed"},
+  };
+  for (const Reserved& entry : reserved) {
+    EXPECT_STREQ(fm_status_string(entry.code), entry.name) << "code=" << entry.code;
+  }
+
+  // The reserved crypto band is not what an encrypted package reports; a
+  // binding offering a password prompt must branch on `kIoZipEncrypted`.
+  EXPECT_STREQ(fm_status_string(static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoZipEncrypted)),
+               "kIoZipEncrypted");
+  EXPECT_STREQ(fm_status_string(123456), "kUnknownError");
+}
+TEST(FormulonCApi, MemoryUsageTracksTheWorkbookAndRejectsNulls) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  size_t empty = 0U;
+  ASSERT_EQ(fm_workbook_memory_usage(wb.handle, &empty), 0);
+  EXPECT_GT(empty, 0U);
+
+  for (uint32_t row = 0; row < 200U; ++row) {
+    ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, row, 0, "=1+2"), 0);
+  }
+  size_t filled = 0U;
+  ASSERT_EQ(fm_workbook_memory_usage(wb.handle, &filled), 0);
+  EXPECT_GT(filled, empty);
+
+  // Both NULL arguments are rejected rather than silently reporting 0,
+  // which is what lets a binding distinguish "empty" from "broken".
+  size_t scratch = 0U;
+  EXPECT_NE(fm_workbook_memory_usage(nullptr, &scratch), 0);
+  EXPECT_NE(fm_workbook_memory_usage(wb.handle, nullptr), 0);
+}
+TEST(FormulonCApi, SaveExRejectsUnknownFormat) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  const std::int32_t invalid_formats[] = {99, std::numeric_limits<std::int32_t>::min(),
+                                          std::numeric_limits<std::int32_t>::max()};
+  for (const std::int32_t raw : invalid_formats) {
+    BufferGuard buf;
+    EXPECT_EQ(fm_workbook_save_as(wb.handle, raw, &buf.data, &buf.len),
+              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+    EXPECT_EQ(buf.data, nullptr);
+    EXPECT_EQ(buf.len, 0U);
+    fm_save_diagnostics_t save{99U, 99U, 99U, 99U, 99U};
+    EXPECT_EQ(fm_workbook_save_with_diagnostics(wb.handle, raw, &buf.data, &buf.len, &save),
+              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+    EXPECT_EQ(buf.data, nullptr);
+    EXPECT_EQ(buf.len, 0U);
+    EXPECT_EQ(save.downgraded_formula_count, 0U);
+    EXPECT_EQ(save.deferred_feature_count, 0U);
+    EXPECT_EQ(save.dropped_part_count, 0U);
+    EXPECT_EQ(save.dropped_relationship_count, 0U);
+    EXPECT_EQ(save.renumbered_part_count, 0U);
+  }
+}
+TEST(FormulonCApi, LoadRoutesXlsbBytesToXlsbReader) {
+  // Build a minimal `.xlsb` byte stream via the engine writer, then load
+  // it through the byte-only C ABI. The load boundary must detect the
+  // xlsb container and route to `read_xlsb` rather than failing in the
+  // OOXML reader with a "missing xl/workbook.xml" diagnostic.
+  formulon::Workbook src = formulon::Workbook::create_empty();
+  formulon::Sheet& s = src.sheet(src.add_sheet("S"));
+  s.set_cell_value(0U, 0U, formulon::Value::number(123.5));
+  auto xlsb_or = formulon::io::xlsb::write_xlsb(src);
+  ASSERT_TRUE(static_cast<bool>(xlsb_or)) << xlsb_or.error().message;
+  const std::vector<std::uint8_t>& xlsb = xlsb_or.value();
+
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(xlsb.data(), xlsb.size(), &loaded.handle), 0);
+  EXPECT_EQ(fm_workbook_sheet_count(loaded.handle), 1U);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(v.u.number, 123.5);
+}
+TEST(FormulonCApi, SaveLoadFormulaTextResult) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 1, 0, "=UPPER(\"world\")"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  BufferGuard buf;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &buf.data, &buf.len), 0);
+  ASSERT_NE(buf.data, nullptr);
+  EXPECT_GT(buf.len, 0U);
+
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &loaded.handle), 0);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 1, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_TEXT);
+  ASSERT_NE(v.u.text, nullptr);
+  EXPECT_STREQ(v.u.text, "WORLD");
+}
+TEST(FormulonCApi, SaveLoadFormulaBoolResult) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 2, 0, "=TRUE()"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  BufferGuard buf;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &buf.data, &buf.len), 0);
+  ASSERT_NE(buf.data, nullptr);
+  EXPECT_GT(buf.len, 0U);
+
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &loaded.handle), 0);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 2, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_BOOL);
+  EXPECT_EQ(v.u.boolean, 1);
+}
+TEST(FormulonCApi, SaveLoadFormulaErrorResult) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 3, 0, "=1/0"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  BufferGuard buf;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &buf.data, &buf.len), 0);
+  ASSERT_NE(buf.data, nullptr);
+  EXPECT_GT(buf.len, 0U);
+
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &loaded.handle), 0);
+  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 3, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_ERROR);
+  EXPECT_EQ(v.u.error_code, 1);
+}
+
+TEST(FormulonCApi, ThreadLocalLastErrorIsolation) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  // Establish a known last-error on the main thread.
+  fm_value_t v{};
+  ASSERT_NE(fm_workbook_get_value(nullptr, 0, 0, 0, &v), 0);
+  const std::string main_msg = fm_last_error_message();
+  EXPECT_GT(main_msg.size(), 0U);
+
+  // A worker thread triggers a *different* error path; the main
+  // thread's last error must remain untouched.
+  std::atomic<fm_status_t> worker_rc{0};
+  std::thread worker([&]() {
+    // Out-of-range sheet on a freshly created workbook on this thread.
+    fm_workbook_t* local = nullptr;
+    if (fm_workbook_create(&local) != 0) {
+      return;
+    }
+    worker_rc.store(fm_workbook_set_number(local, 99, 0, 0, 1.0));
+    fm_workbook_destroy(local);
+  });
+  worker.join();
+  EXPECT_NE(worker_rc.load(), 0);
+
+  // Main thread's diagnostic survived the worker's run.
+  EXPECT_EQ(std::string(fm_last_error_message()), main_msg);
+}
+TEST(FormulonCApi, StatusStringCoversKnownCodes) {
+  // Spot-check a handful of band-spanning codes; the source-of-truth is
+  // `formulon::to_cstring`, which the C API forwards to.
+  EXPECT_STREQ(fm_status_string(0), "kOk");
+  EXPECT_STREQ(fm_status_string(2), "kInvalidArgument");
+  EXPECT_STREQ(fm_status_string(7000), "kBindingInvalidHandle");
+  EXPECT_STREQ(fm_status_string(7001), "kBindingNullPointer");
+  // Unknown numeric values must still return a non-NULL fallback.
+  const char* unknown = fm_status_string(123456);
+  ASSERT_NE(unknown, nullptr);
+  EXPECT_GT(std::strlen(unknown), 0U);
+}
+TEST(FormulonCApi, ErrorDisplayNameUsesExcelLiterals) {
+  EXPECT_STREQ(fm_error_display_name(0), "#NULL!");
+  EXPECT_STREQ(fm_error_display_name(1), "#DIV/0!");
+  EXPECT_STREQ(fm_error_display_name(3), "#REF!");
+  EXPECT_STREQ(fm_error_display_name(-1), "#UNKNOWN!");
+  EXPECT_STREQ(fm_error_display_name(999), "#UNKNOWN!");
+}
+TEST(FormulonCApi, VersionStringNonEmpty) {
+  const char* v = fm_version_string();
+  ASSERT_NE(v, nullptr);
+  EXPECT_GT(std::strlen(v), 0U);
+}
diff --git a/tests/c_api/formulon_c_sheet_features_test.cpp b/tests/c_api/formulon_c_sheet_features_test.cpp
index 6107abf45..5ad6fbbcb 100644
--- a/tests/c_api/formulon_c_sheet_features_test.cpp
+++ b/tests/c_api/formulon_c_sheet_features_test.cpp
@@ -6,10 +6,13 @@
 
 #include <cstdint>
 #include <cstring>
+#include <string>
 
 #include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
 #include "gtest/gtest.h"
 #include "sheet.h"
+#include "threaded_comment.h"
 #include "utils/error.h"
 
 namespace {
@@ -131,6 +134,34 @@ TEST_F(FormulonCApiSheetFeatures, CommentSetGetAndRemove) {
             static_cast<fm_status_t>(formulon::FormulonErrorCode::kNotFound));
 }
 
+TEST_F(FormulonCApiSheetFeatures, CommentRejectedOnThreadedCell) {
+  formulon::Workbook& wb = wb_->workbook();
+  const std::string person = "{11111111-AAAA-4BBB-8CCC-DDDDDDDDDDDD}";
+  ASSERT_TRUE(static_cast<bool>(wb.add_person(formulon::Person{person, "Alice", "alice@example.com", "AD"})));
+  formulon::ThreadedComment thread;
+  thread.id = "{22222222-1111-4222-8333-444444444444}";
+  thread.row = 2;
+  thread.col = 3;
+  thread.person_id = person;
+  thread.created = "2026-10-05T10:00:00.00";
+  thread.text = "Thread";
+  ASSERT_TRUE(static_cast<bool>(wb.add_threaded_comment(0, thread)));
+  EXPECT_EQ(fm_sheet_set_comment(wb_, 0, 2, 3, "Bob", "Note"),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kThreadedCommentInvalid));
+  fm_comment got{};
+  EXPECT_EQ(fm_sheet_get_comment_at(wb_, 0, 2, 3, &got),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kNotFound));
+  // A neighbouring cell still takes a note.
+  EXPECT_EQ(fm_sheet_set_comment(wb_, 0, 2, 4, "Bob", "Note"), 0);
+}
+
+TEST_F(FormulonCApiSheetFeatures, CommentReplaceKeepsRevisionUid) {
+  ASSERT_EQ(fm_sheet_set_comment(wb_, 0, 1, 1, "Alice", "Hello"), 0);
+  wb_->workbook().sheet(0).mutable_comments()[0].uid = "{AAAAAAAA-0000-4000-8000-000000000001}";
+  ASSERT_EQ(fm_sheet_set_comment(wb_, 0, 1, 1, "Bob", "World"), 0);
+  EXPECT_EQ(wb_->workbook().sheet(0).comments()[0].uid, "{AAAAAAAA-0000-4000-8000-000000000001}");
+}
+
 TEST_F(FormulonCApiSheetFeatures, CommentLookupDistinguishesAbsenceFromInvalidSheet) {
   fm_comment got{};
   EXPECT_EQ(fm_sheet_get_comment_at(wb_, 0, 0, 0, &got),
diff --git a/tests/c_api/formulon_c_sheet_layout_test.cpp b/tests/c_api/formulon_c_sheet_layout_test.cpp
index 273c03740..344e5a117 100644
--- a/tests/c_api/formulon_c_sheet_layout_test.cpp
+++ b/tests/c_api/formulon_c_sheet_layout_test.cpp
@@ -26,7 +26,9 @@ static_assert(offsetof(fm_column_layout_t, style_xf) == 32U);
 static_assert(sizeof(fm_column_layout_t) == 40U);
 static_assert(offsetof(fm_row_layout_t, has_style) == 24U);
 static_assert(offsetof(fm_row_layout_t, style_xf) == 28U);
-static_assert(sizeof(fm_row_layout_t) == 32U);
+static_assert(offsetof(fm_row_layout_t, has_height) == 32U);
+static_assert(offsetof(fm_row_layout_t, custom_height) == 36U);
+static_assert(sizeof(fm_row_layout_t) == 40U);
 // `fm_sheet_get_view` writes through a caller-supplied pointer, so a caller
 // compiled against a narrower definition of this struct is overwritten past
 // the end of its own storage rather than getting a diagnosable error. Pin the
@@ -711,3 +713,109 @@ TEST(FormulonCApiSheetLayout, LastGridCoordinateIsStillAccepted) {
   EXPECT_EQ(row.hidden, 1);
   EXPECT_EQ(row.outline_level, 2U);
 }
+
+TEST(FormulonCApiSheetLayout, RowOverrideReportsHeightPresenceAndCustomFlag) {
+  // An auto height that only caches `ht` arrives through the reader; the
+  // setter produces an explicit override.
+  formulon::Workbook source = formulon::Workbook::create();
+  formulon::RowLayout auto_row;
+  auto_row.row = 2U;
+  auto_row.height = 18.0;
+  auto_row.has_height = true;
+  source.sheet(0).mutable_layout().row_overrides = {auto_row};
+  auto source_bytes = source.save();
+  ASSERT_TRUE(static_cast<bool>(source_bytes)) << source_bytes.error().message;
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_load(source_bytes.value().data(), source_bytes.value().size(), &wb.handle), 0);
+  ASSERT_EQ(fm_sheet_set_row_height(wb.handle, 0, 5U, 30.0), 0);
+
+  size_t count = 0;
+  ASSERT_EQ(fm_sheet_get_row_override_count(wb.handle, 0, &count), 0);
+  ASSERT_EQ(count, 2U);
+  for (size_t i = 0; i < count; ++i) {
+    fm_row_layout_t r{};
+    ASSERT_EQ(fm_sheet_get_row_override(wb.handle, 0, i, &r), 0);
+    EXPECT_EQ(r.has_height, 1);
+    EXPECT_EQ(r.custom_height, r.row == 5U ? 1 : 0) << "row " << r.row;
+  }
+}
+
+TEST(FormulonCApiSheetLayout, ClearRowHeightDropsBareOverride) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_sheet_set_row_height(wb.handle, 0, 3U, 25.0), 0);
+  ASSERT_EQ(fm_sheet_set_row_height(wb.handle, 0, 4U, 25.0), 0);
+  ASSERT_EQ(fm_sheet_set_row_hidden(wb.handle, 0, 4U, 1), 0);
+
+  ASSERT_EQ(fm_sheet_clear_row_height(wb.handle, 0, 3U), 0);
+  ASSERT_EQ(fm_sheet_clear_row_height(wb.handle, 0, 4U), 0);
+  // A row without an override is a no-op.
+  ASSERT_EQ(fm_sheet_clear_row_height(wb.handle, 0, 9U), 0);
+
+  size_t count = 0;
+  ASSERT_EQ(fm_sheet_get_row_override_count(wb.handle, 0, &count), 0);
+  ASSERT_EQ(count, 1U);
+  fm_row_layout_t r{};
+  ASSERT_EQ(fm_sheet_get_row_override(wb.handle, 0, 0, &r), 0);
+  EXPECT_EQ(r.row, 4U);
+  EXPECT_EQ(r.hidden, 1);
+  EXPECT_EQ(r.has_height, 0);
+  EXPECT_EQ(r.custom_height, 0);
+
+  EXPECT_EQ(fm_sheet_clear_row_height(wb.handle, 0, kLastRow + 1U), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_clear_row_height(wb.handle, 7, 0U), kInvalidArgument);
+}
+
+TEST(FormulonCApiSheetLayout, FormatDefaultsRoundTripThroughSave) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_sheet_format_defaults d{};
+  ASSERT_EQ(fm_sheet_get_format_defaults(wb.handle, 0, &d), 0);
+  EXPECT_EQ(d.base_col_width, 8.0);
+
+  fm_sheet_format_defaults next{};
+  next.default_col_width = 12.5;
+  next.default_row_height = 20.25;
+  next.base_col_width = 10.0;
+  next.has_default_col_width = 1;
+  next.has_default_row_height = 1;
+  ASSERT_EQ(fm_sheet_set_format_defaults(wb.handle, 0, &next), 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+  fm_sheet_format_defaults got{};
+  ASSERT_EQ(fm_sheet_get_format_defaults(reloaded.handle, 0, &got), 0);
+  EXPECT_EQ(got.default_col_width, 12.5);
+  EXPECT_EQ(got.default_row_height, 20.25);
+  EXPECT_EQ(got.base_col_width, 10.0);
+  EXPECT_EQ(got.has_default_col_width, 1);
+  EXPECT_EQ(got.has_default_row_height, 1);
+}
+
+TEST(FormulonCApiSheetLayout, FormatDefaultsIgnoreUnstatedValuesAndRejectBadNumbers) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_sheet_format_defaults unstated{};
+  unstated.default_col_width = kNaN;  // ignored: has flag is zero
+  unstated.base_col_width = 8.0;
+  ASSERT_EQ(fm_sheet_set_format_defaults(wb.handle, 0, &unstated), 0);
+  fm_sheet_format_defaults got{};
+  ASSERT_EQ(fm_sheet_get_format_defaults(wb.handle, 0, &got), 0);
+  EXPECT_EQ(got.has_default_col_width, 0);
+  EXPECT_EQ(got.default_col_width, 0.0);
+
+  fm_sheet_format_defaults bad{};
+  bad.has_default_row_height = 1;
+  bad.default_row_height = -1.0;
+  bad.base_col_width = 8.0;
+  EXPECT_EQ(fm_sheet_set_format_defaults(wb.handle, 0, &bad), kInvalidArgument);
+  bad.default_row_height = 15.0;
+  bad.base_col_width = kInfinity;
+  EXPECT_EQ(fm_sheet_set_format_defaults(wb.handle, 0, &bad), kInvalidArgument);
+  ASSERT_EQ(fm_sheet_get_format_defaults(wb.handle, 0, &got), 0);
+  EXPECT_EQ(got.has_default_row_height, 0);
+  EXPECT_NE(fm_sheet_set_format_defaults(wb.handle, 0, nullptr), 0);
+  EXPECT_NE(fm_sheet_get_format_defaults(wb.handle, 0, nullptr), 0);
+}
diff --git a/tests/c_api/formulon_c_styles_alignment_test.cpp b/tests/c_api/formulon_c_styles_alignment_test.cpp
new file mode 100644
index 000000000..5d8ca4d7b
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_alignment_test.cpp
@@ -0,0 +1,440 @@
+// Stable C ABI alignment and presence-flag tests.
+
+#include "formulon_c_styles_test_helpers.h"
+
+TEST(FormulonCApiStyles, CellXfAlignmentEnumsValidateRangesBeforeMutation) {
+  const auto expect_invalid = [](fm_status_t status, const char* api) {
+    EXPECT_EQ(status, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+    const char* message = fm_last_error_message();
+    ASSERT_NE(message, nullptr);
+    EXPECT_EQ(std::string(message).rfind(api, 0), 0U) << message;
+  };
+
+  // The upper boundary of each ordinal is accepted.
+  {
+    WorkbookGuard wb;
+    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+    fm_cell_xf record{};
+    record.horizontal_align = 7;  // distributed
+    record.has_horizontal_align = 1;
+    record.vertical_align = 4;  // distributed
+    record.has_vertical_align = 1;
+    uint32_t index = 0;
+    ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, record, &index), 0);
+  }
+
+  // The presence flag decides whether a value is read at all, so an
+  // out-of-range ordinal on an omitted attribute is ignored rather than
+  // rejected: the record it describes has no such attribute to be invalid.
+  {
+    WorkbookGuard wb;
+    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+    fm_cell_xf record{};
+    record.horizontal_align = 8;
+    record.vertical_align = 5;
+    uint32_t index = 0xAABBCCDDU;
+    ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, record, &index), 0);
+    EXPECT_NE(index, 0xAABBCCDDU);
+    fm_cell_xf got{};
+    ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, index, &got), 0);
+    EXPECT_EQ(got.horizontal_align, 0U);
+    EXPECT_EQ(got.vertical_align, 2U);
+  }
+
+  // Every add shape validates before it creates default roots or changes the
+  // output index. Keep each case isolated so the size checks cover all paths.
+  {
+    WorkbookGuard wb;
+    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+    fm_cell_xf record{};
+    record.horizontal_align = 8;
+    record.has_horizontal_align = 1;
+    uint32_t index = 0xAABBCCDDU;
+    const std::size_t before = wb.handle->workbook().styles().cell_xfs.size();
+    expect_invalid(fm_styles_add_cell_xf(wb.handle, record, &index), "fm_styles_add_cell_xf:");
+    EXPECT_EQ(index, 0xAABBCCDDU);
+    EXPECT_EQ(wb.handle->workbook().styles().cell_xfs.size(), before);
+  }
+  {
+    WorkbookGuard wb;
+    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+    fm_cell_xf record{};
+    record.vertical_align = 5;
+    record.has_vertical_align = 1;
+    uint32_t index = 0xAABBCCDDU;
+    const std::size_t before = wb.handle->workbook().styles().cell_style_xfs.size();
+    expect_invalid(fm_styles_add_cell_style_xf(wb.handle, record, &index), "fm_styles_add_cell_style_xf:");
+    EXPECT_EQ(index, 0xAABBCCDDU);
+    EXPECT_EQ(wb.handle->workbook().styles().cell_style_xfs.size(), before);
+  }
+  {
+    WorkbookGuard wb;
+    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+    fm_cell_xf record{};
+    record.horizontal_align = 8;
+    record.has_horizontal_align = 1;
+    uint32_t indices[] = {0xAABBCCDDU};
+    const fm_styles_batch batch{nullptr, 0U,      nullptr, nullptr, 0U,      nullptr, nullptr, 0U,
+                                nullptr, &record, 1U,      indices, nullptr, 0U,      nullptr};
+    const std::size_t before = wb.handle->workbook().styles().cell_xfs.size();
+    expect_invalid(fm_styles_add_batch(wb.handle, &batch), "fm_styles_add_batch:");
+    EXPECT_EQ(indices[0], 0xAABBCCDDU);
+    EXPECT_EQ(wb.handle->workbook().styles().cell_xfs.size(), before);
+  }
+  // A batch record naming a `<cellStyleXfs>` entry that does not exist is
+  // rejected rather than emitted as a dangling `xfId`.
+  {
+    WorkbookGuard wb;
+    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+    fm_cell_xf record{};
+    record.xf_id = 3U;
+    uint32_t indices[] = {0xAABBCCDDU};
+    const fm_styles_batch batch{nullptr, 0U,      nullptr, nullptr, 0U,      nullptr, nullptr, 0U,
+                                nullptr, &record, 1U,      indices, nullptr, 0U,      nullptr};
+    expect_invalid(fm_styles_add_batch(wb.handle, &batch), "fm_styles_add_batch:");
+    EXPECT_EQ(indices[0], 0xAABBCCDDU);
+  }
+}
+
+TEST(FormulonCApiStyles, AddBatchEmitsAlignmentOnlyForFlaggedAttributes) {
+  const auto batch_xf_alignment = [](const fm_cell_xf& record) {
+    WorkbookGuard wb;
+    EXPECT_EQ(fm_workbook_create(&wb.handle), 0);
+    uint32_t xf_indices[] = {0xDEADBEEFU};
+    const fm_styles_batch batch{nullptr, 0U,      nullptr, nullptr,    0U,      nullptr, nullptr, 0U,
+                                nullptr, &record, 1U,      xf_indices, nullptr, 0U,      nullptr};
+    EXPECT_EQ(fm_styles_add_batch(wb.handle, &batch), 0) << fm_last_error_message();
+    fm_cell_xf got{};
+    EXPECT_EQ(fm_styles_get_cell_xf(wb.handle, xf_indices[0], &got), 0);
+    return got;
+  };
+
+  // The pre-collapse caller shape: a value with no presence flag.
+  fm_cell_xf inferred{};
+  inferred.horizontal_align = 3;  // center-continuous
+  const fm_cell_xf without_flag = batch_xf_alignment(inferred);
+  EXPECT_EQ(without_flag.has_alignment, 0);
+  EXPECT_EQ(without_flag.has_horizontal_align, 0);
+  EXPECT_EQ(without_flag.horizontal_align, 0U);
+
+  // The same value, now declared present, is the post-collapse spelling.
+  fm_cell_xf flagged{};
+  flagged.horizontal_align = 3;
+  flagged.has_horizontal_align = 1;
+  const fm_cell_xf with_flag = batch_xf_alignment(flagged);
+  EXPECT_EQ(with_flag.has_alignment, 1);
+  EXPECT_EQ(with_flag.has_horizontal_align, 1);
+  EXPECT_EQ(with_flag.horizontal_align, 3U);
+}
+
+TEST(FormulonCApiStyles, ZeroInitializedCellXfUsesDefaultAlignment) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cell_xf record{};
+  uint32_t index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, record, &index), 0);
+  EXPECT_EQ(index, 0U);
+
+  fm_cell_xf got{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, index, &got), 0);
+  EXPECT_EQ(got.horizontal_align, 0U);
+  EXPECT_EQ(got.vertical_align, 2U);
+  EXPECT_EQ(got.wrap_text, 0);
+  EXPECT_EQ(got.justify_last_line, 0);
+  EXPECT_EQ(got.has_alignment, 0);
+  EXPECT_EQ(got.has_horizontal_align, 0);
+  EXPECT_EQ(got.has_vertical_align, 0);
+  EXPECT_EQ(got.has_wrap_text, 0);
+  EXPECT_EQ(got.has_justify_last_line, 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
+  const std::size_t cell_xfs_end = styles_xml.find("</cellXfs>", cell_xfs_begin);
+  ASSERT_NE(cell_xfs_begin, std::string::npos);
+  ASSERT_NE(cell_xfs_end, std::string::npos);
+  EXPECT_EQ(styles_xml.substr(cell_xfs_begin, cell_xfs_end - cell_xfs_begin).find("<alignment"), std::string::npos);
+}
+
+TEST(FormulonCApiStyles, CellXfIgnoresPoisonForOmittedAlignmentAttributes) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cell_xf poison{};
+  poison.horizontal_align = 0xFFU;
+  poison.vertical_align = 0xFFU;
+  poison.wrap_text = 7;
+  poison.justify_last_line = 9;
+
+  uint32_t omitted_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, poison, &omitted_index), 0);
+  EXPECT_EQ(omitted_index, 0U);
+
+  poison.has_alignment = 1;
+  uint32_t explicit_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, poison, &explicit_index), 0);
+
+  fm_cell_xf empty{};
+  empty.has_alignment = 1;
+  uint32_t empty_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, empty, &empty_index), 0);
+  EXPECT_EQ(empty_index, explicit_index);
+
+  fm_cell_xf got{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, explicit_index, &got), 0);
+  EXPECT_EQ(got.horizontal_align, 0U);
+  EXPECT_EQ(got.vertical_align, 2U);
+  EXPECT_EQ(got.wrap_text, 0);
+  EXPECT_EQ(got.justify_last_line, 0);
+  EXPECT_EQ(got.has_alignment, 1);
+  EXPECT_EQ(got.has_horizontal_align, 0);
+  EXPECT_EQ(got.has_vertical_align, 0);
+  EXPECT_EQ(got.has_wrap_text, 0);
+  EXPECT_EQ(got.has_justify_last_line, 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
+  const std::size_t cell_xfs_end = styles_xml.find("</cellXfs>", cell_xfs_begin);
+  ASSERT_NE(cell_xfs_begin, std::string::npos);
+  ASSERT_NE(cell_xfs_end, std::string::npos);
+  const std::string cell_xfs = styles_xml.substr(cell_xfs_begin, cell_xfs_end - cell_xfs_begin);
+  EXPECT_NE(cell_xfs.find("<alignment/>"), std::string::npos);
+}
+
+TEST(FormulonCApiStyles, CellXfExplicitTopAlignmentRemainsPresent) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cell_xf record{};
+  record.vertical_align = 0;  // top
+  record.has_vertical_align = 1;
+  uint32_t index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, record, &index), 0);
+
+  fm_cell_xf got{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, index, &got), 0);
+  EXPECT_EQ(got.vertical_align, 0U);
+  EXPECT_EQ(got.has_vertical_align, 1);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
+  const std::size_t cell_xfs_end = styles_xml.find("</cellXfs>", cell_xfs_begin);
+  ASSERT_NE(cell_xfs_begin, std::string::npos);
+  ASSERT_NE(cell_xfs_end, std::string::npos);
+  EXPECT_NE(styles_xml.substr(cell_xfs_begin, cell_xfs_end - cell_xfs_begin).find("<alignment vertical=\"top\"/>"),
+            std::string::npos);
+}
+
+TEST(FormulonCApiStyles, ZeroInitializedCellStyleXfUsesDefaultAlignment) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cell_xf record{};
+  uint32_t index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, record, &index), 0);
+
+  fm_cell_xf got{};
+  ASSERT_EQ(fm_styles_get_cell_style_xf(wb.handle, index, &got), 0);
+  EXPECT_EQ(got.horizontal_align, 0U);
+  EXPECT_EQ(got.vertical_align, 2U);
+  EXPECT_EQ(got.wrap_text, 0);
+  EXPECT_EQ(got.justify_last_line, 0);
+  EXPECT_EQ(got.has_alignment, 0);
+  EXPECT_EQ(got.has_vertical_align, 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  const std::size_t style_xfs_begin = styles_xml.find("<cellStyleXfs");
+  const std::size_t style_xfs_end = styles_xml.find("</cellStyleXfs>", style_xfs_begin);
+  ASSERT_NE(style_xfs_begin, std::string::npos);
+  ASSERT_NE(style_xfs_end, std::string::npos);
+  EXPECT_EQ(styles_xml.substr(style_xfs_begin, style_xfs_end - style_xfs_begin).find("<alignment"), std::string::npos);
+}
+
+TEST(FormulonCApiStyles, CellXfVerticalAlignZeroIsExplicitTopOnlyWithItsPresenceFlag) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  // Without the presence flag, `vertical_align` is not read at all: the record
+  // describes an omitted attribute and canonicalizes to the model default.
+  fm_cell_xf omitted{};
+  omitted.vertical_align = 0;  // top
+  uint32_t omitted_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, omitted, &omitted_index), 0);
+  fm_cell_xf got_omitted{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, omitted_index, &got_omitted), 0);
+  EXPECT_EQ(got_omitted.vertical_align, 2U);  // bottom
+  EXPECT_EQ(got_omitted.has_vertical_align, 0);
+
+  fm_cell_xf explicit_top{};
+  explicit_top.has_alignment = 1;
+  explicit_top.vertical_align = 0;  // top
+  explicit_top.has_vertical_align = 1;
+  uint32_t explicit_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, explicit_top, &explicit_index), 0);
+  EXPECT_NE(explicit_index, omitted_index);
+
+  fm_cell_xf got_explicit{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, explicit_index, &got_explicit), 0);
+  EXPECT_EQ(got_explicit.vertical_align, 0U);
+  EXPECT_EQ(got_explicit.has_vertical_align, 1);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
+  const std::size_t cell_xfs_end = styles_xml.find("</cellXfs>", cell_xfs_begin);
+  ASSERT_NE(cell_xfs_begin, std::string::npos);
+  ASSERT_NE(cell_xfs_end, std::string::npos);
+  EXPECT_NE(styles_xml.substr(cell_xfs_begin, cell_xfs_end - cell_xfs_begin).find("<alignment vertical=\"top\"/>"),
+            std::string::npos);
+}
+
+TEST(FormulonCApiStyles, CellXfPreservesOptionalAlignmentAndPresence) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cell_xf xf{};
+  xf.vertical_align = 2;
+  xf.justify_last_line = 1;
+  xf.xf_id = 0;
+  xf.has_alignment = 1;
+  xf.has_text_rotation = 1;
+  xf.text_rotation = 255;
+  xf.has_indent = 1;
+  xf.indent = 7;
+  xf.has_relative_indent = 1;
+  xf.relative_indent = -3;
+  xf.has_shrink_to_fit = 1;
+  xf.shrink_to_fit = 0;
+  xf.has_reading_order = 1;
+  xf.reading_order = 2;
+  xf.has_horizontal_align = 1;
+  xf.has_vertical_align = 1;
+  xf.has_wrap_text = 1;
+  xf.has_justify_last_line = 1;
+
+  uint32_t index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
+  uint32_t duplicate = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &duplicate), 0);
+  EXPECT_EQ(duplicate, index);
+
+  fm_cell_xf reread{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, index, &reread), 0);
+  EXPECT_EQ(reread.justify_last_line, 1);
+  EXPECT_EQ(reread.xf_id, 0U);
+  EXPECT_EQ(reread.has_alignment, 1);
+  EXPECT_EQ(reread.has_text_rotation, 1);
+  EXPECT_EQ(reread.text_rotation, 255U);
+  EXPECT_EQ(reread.has_indent, 1);
+  EXPECT_EQ(reread.indent, 7U);
+  EXPECT_EQ(reread.has_relative_indent, 1);
+  EXPECT_EQ(reread.relative_indent, -3);
+  EXPECT_EQ(reread.has_shrink_to_fit, 1);
+  EXPECT_EQ(reread.shrink_to_fit, 0);
+  EXPECT_EQ(reread.has_reading_order, 1);
+  EXPECT_EQ(reread.reading_order, 2U);
+  EXPECT_EQ(reread.has_horizontal_align, 1);
+  EXPECT_EQ(reread.has_vertical_align, 1);
+  EXPECT_EQ(reread.has_wrap_text, 1);
+  EXPECT_EQ(reread.has_justify_last_line, 1);
+
+  // Presence is part of the dedup key: explicit zero / false differs from
+  // an omitted attribute even when the effective value is the same.
+  fm_cell_xf absent = xf;
+  absent.has_text_rotation = 0;
+  absent.has_indent = 0;
+  absent.has_relative_indent = 0;
+  absent.has_shrink_to_fit = 0;
+  absent.has_reading_order = 0;
+  uint32_t absent_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, absent, &absent_index), 0);
+  EXPECT_NE(absent_index, index);
+}
+
+TEST(FormulonCApiStyles, CellXfRejectsInvalidExcelAlignmentRanges) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf xf{};
+  uint32_t index = 0;
+
+  xf.has_text_rotation = 1;
+  xf.text_rotation = 181;
+  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
+  xf.text_rotation = 255;
+  EXPECT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
+
+  xf.has_text_rotation = 0;
+  xf.has_indent = 1;
+  xf.indent = 256;
+  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
+  xf.indent = 255;
+  EXPECT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
+
+  xf.has_indent = 0;
+  xf.has_reading_order = 1;
+  xf.reading_order = 3;
+  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
+}
+
+TEST(FormulonCApiStyles, CellXfPresenceFlagsDistinguishExplicitDefaults) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cell_xf explicit_defaults{};
+  explicit_defaults.vertical_align = 2;
+  explicit_defaults.has_alignment = 1;
+  explicit_defaults.has_horizontal_align = 1;
+  explicit_defaults.has_vertical_align = 1;
+  explicit_defaults.has_wrap_text = 1;
+  explicit_defaults.has_justify_last_line = 1;
+  uint32_t explicit_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, explicit_defaults, &explicit_index), 0);
+
+  fm_cell_xf omitted_defaults = explicit_defaults;
+  omitted_defaults.has_horizontal_align = 0;
+  omitted_defaults.has_vertical_align = 0;
+  omitted_defaults.has_wrap_text = 0;
+  omitted_defaults.has_justify_last_line = 0;
+  uint32_t omitted_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, omitted_defaults, &omitted_index), 0);
+  EXPECT_NE(explicit_index, omitted_index);
+
+  fm_cell_xf reread{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, explicit_index, &reread), 0);
+  EXPECT_EQ(reread.has_horizontal_align, 1);
+  EXPECT_EQ(reread.has_vertical_align, 1);
+  EXPECT_EQ(reread.has_wrap_text, 1);
+  EXPECT_EQ(reread.has_justify_last_line, 1);
+}
+
+TEST(FormulonCApiStyles, CellStyleXfRoundTripsOptionalAlignment) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf style{};
+  style.has_text_rotation = 1;
+  style.text_rotation = 0;
+  style.has_relative_indent = 1;
+  style.relative_indent = -2;
+  style.has_shrink_to_fit = 1;
+  style.shrink_to_fit = false;
+  uint32_t style_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, style, &style_index), 0);
+
+  fm_cell_xf reread{};
+  ASSERT_EQ(fm_styles_get_cell_style_xf(wb.handle, style_index, &reread), 0);
+  EXPECT_EQ(reread.has_text_rotation, 1);
+  EXPECT_EQ(reread.text_rotation, 0U);
+  EXPECT_EQ(reread.has_relative_indent, 1);
+  EXPECT_EQ(reread.relative_indent, -2);
+  EXPECT_EQ(reread.has_shrink_to_fit, 1);
+  EXPECT_EQ(reread.shrink_to_fit, 0);
+}
diff --git a/tests/c_api/formulon_c_styles_cell_xf_test.cpp b/tests/c_api/formulon_c_styles_cell_xf_test.cpp
new file mode 100644
index 000000000..a73963da5
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_cell_xf_test.cpp
@@ -0,0 +1,389 @@
+// Stable C ABI cell XF index and mutation tests.
+
+#include "formulon_c_styles_test_helpers.h"
+
+TEST(FormulonCApiStyles, CellXfIndexDefaultsToZero) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t xf = 99;
+  EXPECT_EQ(fm_cell_get_xf_index(wb.handle, 0, 0, 0, &xf), 0);
+  EXPECT_EQ(xf, 0U);
+}
+
+TEST(FormulonCApiStyles, CellXfIndexRoundTrips) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  EXPECT_EQ(fm_cell_set_xf_index(wb.handle, 0, 5, 7, 42), 0);
+  uint32_t xf = 0;
+  EXPECT_EQ(fm_cell_get_xf_index(wb.handle, 0, 5, 7, &xf), 0);
+  EXPECT_EQ(xf, 42U);
+}
+
+TEST(FormulonCApiStyles, SetXfIndexRejectsBadSheet) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  // sheet 99 does not exist.
+  EXPECT_NE(fm_cell_set_xf_index(wb.handle, 99, 0, 0, 1), 0);
+}
+
+TEST(FormulonCApiStyles, NullArgumentRejected) {
+  uint32_t xf = 0;
+  EXPECT_NE(fm_cell_get_xf_index(nullptr, 0, 0, 0, &xf), 0);
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  EXPECT_NE(fm_cell_get_xf_index(wb.handle, 0, 0, 0, nullptr), 0);
+}
+
+TEST(FormulonCApiStyles, GetCellXfRejectsOutOfRange) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf xf{};
+  // A fresh workbook seeds one default xf, so index 0 resolves and index
+  // 1 is the first out-of-range one.
+  EXPECT_EQ(fm_styles_get_cell_xf(wb.handle, 0, &xf), 0);
+  EXPECT_NE(fm_styles_get_cell_xf(wb.handle, 1, &xf), 0);
+}
+
+TEST(FormulonCApiStyles, CellXfGetterDiagnosticsUseInvokedApi) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  auto expect_prefix = [](fm_status_t status, const char* prefix) {
+    EXPECT_NE(status, 0);
+    const char* message = fm_last_error_message();
+    ASSERT_NE(message, nullptr);
+    EXPECT_EQ(std::string(message).rfind(prefix, 0), 0U) << message;
+  };
+
+  // Index 1 is past both seeded single-entry tables, so each getter takes
+  // its out-of-range path and must name itself in the diagnostic.
+  fm_cell_xf cell_xf{};
+  expect_prefix(fm_styles_get_cell_xf(wb.handle, 1, &cell_xf), "fm_styles_get_cell_xf:");
+  expect_prefix(fm_styles_get_cell_style_xf(wb.handle, 1, &cell_xf), "fm_styles_get_cell_style_xf:");
+}
+
+TEST(FormulonCApiStyles, CellXfAdderDiagnosticsUseInvokedApi) {
+  auto expect_prefix = [](fm_status_t status, const char* prefix) {
+    EXPECT_NE(status, 0);
+    const char* message = fm_last_error_message();
+    ASSERT_NE(message, nullptr);
+    EXPECT_EQ(std::string(message).rfind(prefix, 0), 0U) << message;
+  };
+
+  uint32_t index = 0;
+  fm_cell_xf cell_xf{};
+  expect_prefix(fm_styles_add_cell_xf(nullptr, cell_xf, &index), "fm_styles_add_cell_xf:");
+
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  cell_xf.font_index = 1U;
+  expect_prefix(fm_styles_add_cell_xf(wb.handle, cell_xf, &index), "fm_styles_add_cell_xf:");
+
+  cell_xf = fm_cell_xf{};
+  cell_xf.xf_id = 1U;
+  expect_prefix(fm_styles_add_cell_xf(wb.handle, cell_xf, &index), "fm_styles_add_cell_xf:");
+
+  cell_xf = fm_cell_xf{};
+  cell_xf.has_text_rotation = 1;
+  cell_xf.text_rotation = 181U;
+  expect_prefix(fm_styles_add_cell_xf(wb.handle, cell_xf, &index), "fm_styles_add_cell_xf:");
+}
+
+TEST(FormulonCApiStyles, SetThenSaveLoadPreservesXfIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  // Register the xf records the stamp below names. A `<c s="7">` against
+  // a shorter `<cellXfs>` resolves to no style, so the reader falls back
+  // to the default rather than handing back an index whose record
+  // `fm_styles_get_cell_xf` would then refuse to return.
+  wb.handle->workbook().mutable_styles().cell_xfs.resize(8);
+
+  // Stamp xf_index = 7 on cell A1 and save.
+  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 3.14), 0);
+  EXPECT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, 7), 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+
+  WorkbookGuard wb2;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &wb2.handle), 0);
+  uint32_t xf = 0;
+  EXPECT_EQ(fm_cell_get_xf_index(wb2.handle, 0, 0, 0, &xf), 0);
+  EXPECT_EQ(xf, 7U);
+}
+
+TEST(FormulonCApiStyles, AddCellXfDedupReturnsExistingIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t font_idx = 0;
+  uint32_t fill_idx = 0;
+  uint32_t border_idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
+
+  fm_cell_xf xf{};
+  xf.font_index = font_idx;
+  xf.fill_index = fill_idx;
+  xf.border_index = border_idx;
+  xf.num_fmt_id = 0;  // built-in General
+  xf.horizontal_align = 1;
+  xf.vertical_align = 2;
+  xf.wrap_text = 1;
+
+  uint32_t a = 0xFFFFFFFFU;
+  uint32_t b = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &a), 0);
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &b), 0);
+  EXPECT_EQ(a, b);
+}
+
+TEST(FormulonCApiStyles, AddCellXfDistinctReturnsNewIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t font_idx = 0;
+  uint32_t fill_idx = 0;
+  uint32_t border_idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
+
+  fm_cell_xf xf{};
+  xf.font_index = font_idx;
+  xf.fill_index = fill_idx;
+  xf.border_index = border_idx;
+  xf.num_fmt_id = 0;
+  xf.horizontal_align = 1;
+  xf.vertical_align = 2;
+  xf.wrap_text = 1;
+
+  xf.has_wrap_text = 1;
+
+  uint32_t a = 0;
+  uint32_t b = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &a), 0);
+  // Flip wrap_text — distinct record.
+  xf.wrap_text = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &b), 0);
+  EXPECT_NE(a, b);
+}
+
+TEST(FormulonCApiStyles, AddCellXfGrowsTable) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t font_idx = 0;
+  uint32_t fill_idx = 0;
+  uint32_t border_idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
+  uint32_t before = 0;
+  ASSERT_EQ(fm_styles_get_cell_xf_count(wb.handle, &before), 0);
+  fm_cell_xf xf{};
+  xf.font_index = font_idx;
+  xf.fill_index = fill_idx;
+  xf.border_index = border_idx;
+  xf.num_fmt_id = 0;
+  // Distinguish this record from the all-zero placeholder xf that
+  // `ensure_default_cell_xf` seeds at index 0 so the caller's record is
+  // guaranteed to land at a fresh index instead of deduping to it. The
+  // presence flag is what makes the value part of the record.
+  xf.wrap_text = 1;
+  xf.has_wrap_text = 1;
+  uint32_t idx = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &idx), 0);
+  uint32_t after = 0;
+  ASSERT_EQ(fm_styles_get_cell_xf_count(wb.handle, &after), 0);
+  // Index 0 is the seeded default xf.
+  EXPECT_EQ(before, 1U);
+  EXPECT_EQ(after, 2U);
+  EXPECT_EQ(idx, 1U);
+}
+
+TEST(FormulonCApiStyles, AddCellXfOnFreshWorkbookKeepsZeroAsDefault) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t font_idx = 0;
+  uint32_t fill_idx = 0;
+  uint32_t border_idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
+
+  // A fresh workbook seeds Excel's reserved slots, so the caller's first
+  // record lands after them: one default font, one empty border, and the
+  // two fills (`none`, `gray125`) Excel always writes first.
+  EXPECT_EQ(font_idx, 1U);
+  EXPECT_EQ(fill_idx, 2U);
+  EXPECT_EQ(border_idx, 1U);
+
+  fm_cell_xf xf{};
+  xf.font_index = font_idx;
+  xf.fill_index = fill_idx;
+  xf.border_index = border_idx;
+  xf.num_fmt_id = 0;
+  // Distinguish this record from the all-zero placeholder xf that
+  // `ensure_default_cell_xf` seeds at index 0 so the caller's record is
+  // guaranteed to land at a fresh index instead of deduping to it. The
+  // presence flag is what makes the value part of the record.
+  xf.wrap_text = 1;
+  xf.has_wrap_text = 1;
+
+  uint32_t xf_idx = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx), 0);
+  EXPECT_NE(xf_idx, 0U);
+
+  fm_cell_xf default_xf{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, 0, &default_xf), 0);
+  EXPECT_EQ(default_xf.font_index, 0U);
+  EXPECT_EQ(default_xf.fill_index, 0U);
+  EXPECT_EQ(default_xf.border_index, 0U);
+  EXPECT_EQ(default_xf.num_fmt_id, 0U);
+  EXPECT_EQ(default_xf.wrap_text, 0);
+}
+
+TEST(FormulonCApiStyles, AddCellXfRejectsOutOfRangeIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  // Empty styles table: any non-zero index is out of range.
+  fm_cell_xf xf{};
+  xf.font_index = 5;  // intentionally OOR
+  xf.fill_index = 0;
+  xf.border_index = 0;
+  xf.num_fmt_id = 0;
+  uint32_t idx = 0xFFFFFFFFU;
+  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &idx), 0);
+}
+
+TEST(FormulonCApiStyles, AddCellXfRejectsUnknownNumFmt) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t font_idx = 0;
+  uint32_t fill_idx = 0;
+  uint32_t border_idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
+
+  fm_cell_xf xf{};
+  xf.font_index = font_idx;
+  xf.fill_index = fill_idx;
+  xf.border_index = border_idx;
+  xf.num_fmt_id = 200;  // not a registered custom and not a documented built-in
+  uint32_t idx = 0xFFFFFFFFU;
+  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &idx), 0);
+}
+
+TEST(FormulonCApiStyles, AddNullArgumentRejected) {
+  uint32_t idx = 0;
+  EXPECT_NE(fm_styles_add_font(nullptr, MakeArial(), &idx), 0);
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  EXPECT_NE(fm_styles_add_font(wb.handle, MakeArial(), nullptr), 0);
+  uint16_t id = 0;
+  EXPECT_NE(fm_styles_add_num_fmt(nullptr, "General", &id), 0);
+  EXPECT_NE(fm_styles_add_num_fmt(wb.handle, "General", nullptr), 0);
+  EXPECT_NE(fm_styles_add_dxf(nullptr, fm_dxf_record{}, &idx), 0);
+  EXPECT_NE(fm_styles_add_dxf(wb.handle, fm_dxf_record{}, nullptr), 0);
+}
+
+namespace {
+
+// A record that sets every apply flag, quotePrefix and an explicit
+// `<protection>` child whose values differ from the schema defaults.
+fm_cell_xf MakeFlaggedXf() {
+  fm_cell_xf xf{};
+  xf.apply_number_format = 1;
+  xf.apply_font = 1;
+  xf.apply_fill = 1;
+  xf.apply_border = 1;
+  xf.apply_alignment = 1;
+  xf.apply_protection = 1;
+  xf.quote_prefix = 1;
+  xf.has_protection = 1;
+  xf.locked = 0;
+  xf.hidden = 1;
+  return xf;
+}
+
+void ExpectFlagged(const fm_cell_xf& xf) {
+  EXPECT_EQ(xf.apply_number_format, 1);
+  EXPECT_EQ(xf.apply_font, 1);
+  EXPECT_EQ(xf.apply_fill, 1);
+  EXPECT_EQ(xf.apply_border, 1);
+  EXPECT_EQ(xf.apply_alignment, 1);
+  EXPECT_EQ(xf.apply_protection, 1);
+  EXPECT_EQ(xf.quote_prefix, 1);
+  EXPECT_EQ(xf.has_protection, 1);
+  EXPECT_EQ(xf.locked, 0);
+  EXPECT_EQ(xf.hidden, 1);
+}
+
+}  // namespace
+
+TEST(FormulonCApiStyles, XfApplyFlagsRoundTrip) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t xf_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, MakeFlaggedXf(), &xf_index), 0);
+  ASSERT_NE(xf_index, 0U);
+  uint32_t style_xf_id = 0;
+  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, MakeFlaggedXf(), &style_xf_id), 0);
+
+  fm_cell_xf got{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, xf_index, &got), 0);
+  ExpectFlagged(got);
+
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.0), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, xf_index), 0);
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  EXPECT_NE(styles_xml.find("applyNumberFormat=\"1\" applyFont=\"1\" applyFill=\"1\" applyBorder=\"1\" "
+                            "applyAlignment=\"1\" applyProtection=\"1\" quotePrefix=\"1\""),
+            std::string::npos)
+      << styles_xml;
+  EXPECT_NE(styles_xml.find("<protection locked=\"0\" hidden=\"1\"/>"), std::string::npos) << styles_xml;
+
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+  uint32_t reloaded_index = 0;
+  ASSERT_EQ(fm_cell_get_xf_index(reloaded.handle, 0, 0, 0, &reloaded_index), 0);
+  fm_cell_xf after{};
+  ASSERT_EQ(fm_styles_get_cell_xf(reloaded.handle, reloaded_index, &after), 0);
+  ExpectFlagged(after);
+  fm_cell_xf style_after{};
+  ASSERT_EQ(fm_styles_get_cell_style_xf(reloaded.handle, style_xf_id, &style_after), 0);
+  ExpectFlagged(style_after);
+}
+
+TEST(FormulonCApiStyles, XfProtectionDistinguishesDedup) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf locked{};
+  locked.has_protection = 1;
+  locked.locked = 1;
+  fm_cell_xf unlocked = locked;
+  unlocked.locked = 0;
+  uint32_t a = 0;
+  uint32_t b = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, locked, &a), 0);
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, unlocked, &b), 0);
+  EXPECT_NE(a, b);
+
+  // Without the child, `locked` / `hidden` are ignored: the record
+  // deduplicates with the default XF and reads back the schema defaults.
+  fm_cell_xf absent{};
+  absent.locked = 0;
+  absent.hidden = 1;
+  uint32_t c = 99;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, absent, &c), 0);
+  EXPECT_EQ(c, 0U);
+  fm_cell_xf got{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, c, &got), 0);
+  EXPECT_EQ(got.has_protection, 0);
+  EXPECT_EQ(got.locked, 1);
+  EXPECT_EQ(got.hidden, 0);
+}
diff --git a/tests/c_api/formulon_c_styles_dxf_test.cpp b/tests/c_api/formulon_c_styles_dxf_test.cpp
new file mode 100644
index 000000000..992e636da
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_dxf_test.cpp
@@ -0,0 +1,210 @@
+// Stable C ABI differential-format tests.
+
+#include "formulon_c_styles_test_helpers.h"
+
+TEST(FormulonCApiStyles, DifferentialFormatGetterExposesCfDxfTable) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  formulon::StylesTable& styles = wb.handle->workbook().mutable_styles();
+  formulon::DifferentialFormat dxf;
+  dxf.has_font = true;
+  dxf.font.bold = true;
+  dxf.font.color_argb = 0xFFFF0000U;
+  dxf.has_fill = true;
+  dxf.fill.pattern = 1;
+  dxf.fill.fg_argb = 0xFFFFFF00U;
+  dxf.has_border = true;
+  dxf.border.left.style = 1;
+  dxf.border.left.color_argb = 0xFF000000U;
+  dxf.has_num_fmt = true;
+  dxf.num_fmt_id = 164;
+  dxf.num_fmt_code = "0.00";
+  styles.dxfs.push_back(dxf);
+
+  uint32_t count = 0;
+  ASSERT_EQ(fm_styles_get_dxf_count(wb.handle, &count), 0);
+  EXPECT_EQ(count, 1U);
+
+  fm_dxf_record out{};
+  ASSERT_EQ(fm_styles_get_dxf(wb.handle, 0, &out), 0);
+  EXPECT_EQ(out.font_engaged, 1);
+  EXPECT_EQ(out.font.bold, 1);
+  EXPECT_EQ(out.font.color_argb, 0xFFFF0000U);
+  EXPECT_EQ(out.fill_engaged, 1);
+  EXPECT_EQ(out.fill.pattern, 1U);
+  EXPECT_EQ(out.fill.fg_argb, 0xFFFFFF00U);
+  EXPECT_EQ(out.border_engaged, 1);
+  EXPECT_EQ(out.border.left.style, 1U);
+  EXPECT_EQ(out.border.left.color_argb, 0xFF000000U);
+  EXPECT_EQ(out.num_fmt_engaged, 1);
+  EXPECT_EQ(out.num_fmt_id, 164U);
+  ASSERT_NE(out.num_fmt_code, nullptr);
+  EXPECT_STREQ(out.num_fmt_code, "0.00");
+
+  EXPECT_NE(fm_styles_get_dxf(wb.handle, 1, &out), 0);
+}
+
+TEST(FormulonCApiStyles, AddDxfDedupsAndReadsBack) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_dxf_record dxf{};
+  dxf.font_engaged = 1;
+  dxf.font.name = "Arial";
+  dxf.font.size = 12.0;
+  dxf.font.bold = 1;
+  dxf.font.color_argb = 0xFFFF0000U;
+  dxf.fill_engaged = 1;
+  dxf.fill.pattern = 1;
+  dxf.fill.fg_argb = 0xFFFFFF00U;
+  dxf.num_fmt_engaged = 1;
+  dxf.num_fmt_id = 164;
+  dxf.num_fmt_code = "0.00";
+
+  uint32_t a = 0xFFFFFFFFU;
+  uint32_t b = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, dxf, &a), 0);
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, dxf, &b), 0);
+  EXPECT_EQ(a, b);
+
+  uint32_t count = 0;
+  ASSERT_EQ(fm_styles_get_dxf_count(wb.handle, &count), 0);
+  EXPECT_EQ(count, 1U);
+
+  fm_dxf_record out{};
+  ASSERT_EQ(fm_styles_get_dxf(wb.handle, a, &out), 0);
+  EXPECT_EQ(out.font_engaged, 1);
+  EXPECT_STREQ(out.font.name, "Arial");
+  EXPECT_EQ(out.font.bold, 1);
+  EXPECT_EQ(out.font.color_argb, 0xFFFF0000U);
+  EXPECT_EQ(out.fill_engaged, 1);
+  EXPECT_EQ(out.fill.pattern, 1U);
+  EXPECT_EQ(out.fill.fg_argb, 0xFFFFFF00U);
+  EXPECT_EQ(out.num_fmt_engaged, 1);
+  EXPECT_EQ(out.num_fmt_id, 164U);
+  ASSERT_NE(out.num_fmt_code, nullptr);
+  EXPECT_STREQ(out.num_fmt_code, "0.00");
+}
+
+TEST(FormulonCApiStyles, DxfFontRoundTripsVerticalAlignmentThroughOoxml) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_dxf_record dxf{};
+  dxf.font_engaged = 1;
+  dxf.font.name = "Calibri";
+  dxf.font.size = 9.0;
+  dxf.font.color_argb = 0xFF112233U;
+  dxf.font.vert_align = 1;  // superscript
+  uint32_t index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, dxf, &index), 0);
+
+  const std::string xml = formulon::io::write_styles(wb.handle->workbook().styles());
+  EXPECT_NE(xml.find("<vertAlign val=\"superscript\"/>"), std::string::npos);
+
+  fm_dxf_record loaded{};
+  ASSERT_EQ(fm_styles_get_dxf(wb.handle, index, &loaded), 0);
+  EXPECT_EQ(loaded.font.vert_align, 1U);
+
+  uint32_t count_before = 0;
+  ASSERT_EQ(fm_styles_get_dxf_count(wb.handle, &count_before), 0);
+  uint32_t reindex = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, loaded, &reindex), 0);
+  EXPECT_EQ(reindex, index);
+  uint32_t count_after = 0;
+  ASSERT_EQ(fm_styles_get_dxf_count(wb.handle, &count_after), 0);
+  EXPECT_EQ(count_after, count_before);
+}
+
+TEST(FormulonCApiStyles, DxfAlignmentAndProtectionPreserveIdentityThroughOoxml) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  std::string alignment_input = "<alignment horizontal=\"center\" wrapText=\"1\"/>";
+  std::string protection_input = "<protection locked=\"0\" hidden=\"1\"/>";
+  fm_dxf_record alignment{};
+  alignment.alignment_xml = alignment_input.c_str();
+  fm_dxf_record protection{};
+  protection.protection_xml = protection_input.c_str();
+
+  uint32_t alignment_index = 0xFFFFFFFFU;
+  uint32_t protection_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, alignment, &alignment_index), 0);
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, protection, &protection_index), 0);
+  EXPECT_NE(alignment_index, protection_index);
+  alignment_input = "caller-owned alignment text replaced";
+  protection_input = "caller-owned protection text replaced";
+
+  fm_dxf_record got_alignment{};
+  fm_dxf_record got_protection{};
+  ASSERT_EQ(fm_styles_get_dxf(wb.handle, alignment_index, &got_alignment), 0);
+  ASSERT_EQ(fm_styles_get_dxf(wb.handle, protection_index, &got_protection), 0);
+  ASSERT_NE(got_alignment.alignment_xml, nullptr);
+  ASSERT_NE(got_alignment.protection_xml, nullptr);
+  ASSERT_NE(got_protection.alignment_xml, nullptr);
+  ASSERT_NE(got_protection.protection_xml, nullptr);
+  EXPECT_STREQ(got_alignment.alignment_xml, "<alignment horizontal=\"center\" wrapText=\"1\"/>");
+  EXPECT_STREQ(got_alignment.protection_xml, "");
+  EXPECT_STREQ(got_protection.alignment_xml, "");
+  EXPECT_STREQ(got_protection.protection_xml, "<protection locked=\"0\" hidden=\"1\"/>");
+
+  uint32_t alignment_again = 0xFFFFFFFFU;
+  uint32_t protection_again = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, got_alignment, &alignment_again), 0);
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, got_protection, &protection_again), 0);
+  EXPECT_EQ(alignment_again, alignment_index);
+  EXPECT_EQ(protection_again, protection_index);
+
+  const std::string before_save = formulon::io::write_styles(wb.handle->workbook().styles());
+  EXPECT_NE(before_save.find("<alignment horizontal=\"center\" wrapText=\"1\"/>"), std::string::npos);
+  EXPECT_NE(before_save.find("<protection locked=\"0\" hidden=\"1\"/>"), std::string::npos);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+
+  fm_dxf_record reloaded_alignment{};
+  fm_dxf_record reloaded_protection{};
+  ASSERT_EQ(fm_styles_get_dxf(reloaded.handle, alignment_index, &reloaded_alignment), 0);
+  ASSERT_EQ(fm_styles_get_dxf(reloaded.handle, protection_index, &reloaded_protection), 0);
+  EXPECT_STREQ(reloaded_alignment.alignment_xml, "<alignment horizontal=\"center\" wrapText=\"1\"/>");
+  EXPECT_STREQ(reloaded_alignment.protection_xml, "");
+  EXPECT_STREQ(reloaded_protection.alignment_xml, "");
+  EXPECT_STREQ(reloaded_protection.protection_xml, "<protection locked=\"0\" hidden=\"1\"/>");
+
+  uint32_t reloaded_alignment_again = 0xFFFFFFFFU;
+  uint32_t reloaded_protection_again = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(reloaded.handle, reloaded_alignment, &reloaded_alignment_again), 0);
+  ASSERT_EQ(fm_styles_add_dxf(reloaded.handle, reloaded_protection, &reloaded_protection_again), 0);
+  EXPECT_EQ(reloaded_alignment_again, alignment_index);
+  EXPECT_EQ(reloaded_protection_again, protection_index);
+
+  const std::string after_load = formulon::io::write_styles(reloaded.handle->workbook().styles());
+  EXPECT_NE(after_load.find("<alignment horizontal=\"center\" wrapText=\"1\"/>"), std::string::npos);
+  EXPECT_NE(after_load.find("<protection locked=\"0\" hidden=\"1\"/>"), std::string::npos);
+}
+
+TEST(FormulonCApiStyles, DxfFontDistinguishesAnExplicitBoldOffFromAnAbsentToggle) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  formulon::DifferentialFormat stored;
+  stored.has_font = true;
+  stored.font.has_bold = true;  // `<b val="0"/>`: switch bold off
+  stored.font.bold = false;
+  wb.handle->workbook().mutable_styles().dxfs.push_back(stored);
+
+  // A rule that leaves bold alone must not fold onto the switch-it-off one.
+  fm_dxf_record leave_bold_alone{};
+  leave_bold_alone.font_engaged = 1;
+  leave_bold_alone.font.name = "";
+  leave_bold_alone.font.size = 11.0;
+  leave_bold_alone.font.color_argb = 0xFF000000U;
+  uint32_t index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, leave_bold_alone, &index), 0);
+  EXPECT_NE(index, 0U);
+
+  const std::string xml = formulon::io::write_styles(wb.handle->workbook().styles());
+  EXPECT_NE(xml.find("<b val=\"0\"/>"), std::string::npos);
+}
diff --git a/tests/c_api/formulon_c_styles_fills_borders_test.cpp b/tests/c_api/formulon_c_styles_fills_borders_test.cpp
new file mode 100644
index 000000000..aa49645a1
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_fills_borders_test.cpp
@@ -0,0 +1,258 @@
+// Stable C ABI fill and border tests.
+
+#include "formulon_c_styles_test_helpers.h"
+
+TEST(FormulonCApiStyles, AddFillAndBorderAreIdentityAgainstAFileLoadedTable) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadExcelAuthoredStyles(wb.handle));
+
+  uint32_t fills = 0;
+  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &fills), 0);
+  ASSERT_EQ(fills, 2U);
+  for (uint32_t i = 0; i < fills; ++i) {
+    fm_fill_record loaded{};
+    ASSERT_EQ(fm_styles_get_fill(wb.handle, i, &loaded), 0) << "fill " << i;
+    uint32_t reindex = 0xFFFFFFFFU;
+    ASSERT_EQ(fm_styles_add_fill(wb.handle, loaded, &reindex), 0) << "fill " << i;
+    EXPECT_EQ(reindex, i);
+  }
+
+  uint32_t borders = 0;
+  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &borders), 0);
+  ASSERT_EQ(borders, 2U);
+  for (uint32_t i = 0; i < borders; ++i) {
+    fm_border_record loaded{};
+    ASSERT_EQ(fm_styles_get_border(wb.handle, i, &loaded), 0) << "border " << i;
+    uint32_t reindex = 0xFFFFFFFFU;
+    ASSERT_EQ(fm_styles_add_border(wb.handle, loaded, &reindex), 0) << "border " << i;
+    EXPECT_EQ(reindex, i);
+  }
+
+  uint32_t fills_after = 0;
+  uint32_t borders_after = 0;
+  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &fills_after), 0);
+  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &borders_after), 0);
+  EXPECT_EQ(fills_after, fills);
+  EXPECT_EQ(borders_after, borders);
+}
+
+TEST(FormulonCApiStyles, AddFillAndBorderDistinguishColourSpecifications) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadExcelAuthoredStyles(wb.handle));
+
+  fm_fill_record themed_fill{};
+  ASSERT_EQ(fm_styles_get_fill(wb.handle, 1U, &themed_fill), 0);
+  ASSERT_EQ(themed_fill.fg.kind, static_cast<uint8_t>(kFmColorTheme));
+  fm_fill_record literal_fill = themed_fill;
+  literal_fill.fg = fm_color_spec{};
+  literal_fill.fg_argb = themed_fill.fg_argb;
+  uint32_t fill_index = 0;
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, literal_fill, &fill_index), 0);
+  EXPECT_NE(fill_index, 1U);
+
+  fm_border_record themed_border{};
+  ASSERT_EQ(fm_styles_get_border(wb.handle, 1U, &themed_border), 0);
+  ASSERT_EQ(themed_border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
+  fm_border_record literal_border = themed_border;
+  literal_border.left.color = fm_color_spec{};
+  uint32_t border_index = 0;
+  ASSERT_EQ(fm_styles_add_border(wb.handle, literal_border, &border_index), 0);
+  EXPECT_NE(border_index, 1U);
+
+  const std::string xml = formulon::io::write_styles(wb.handle->workbook().styles());
+  EXPECT_NE(xml.find("<fgColor theme=\"4\" tint=\"0.5\"/>"), std::string::npos);
+  EXPECT_NE(xml.find("<bgColor indexed=\"64\"/>"), std::string::npos);
+}
+
+TEST(FormulonCApiStyles, SelectorColoursRemainAuthoritativeAcrossGetAddAndSaveLoad) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_color_spec theme{};
+  theme.kind = static_cast<uint8_t>(kFmColorTheme);
+  theme.theme = 3U;
+  theme.tint = 0.5;
+  fm_color_spec indexed{};
+  indexed.kind = static_cast<uint8_t>(kFmColorIndexed);
+  indexed.indexed = 9U;
+  fm_color_spec automatic{};
+  automatic.kind = static_cast<uint8_t>(kFmColorAuto);
+
+  fm_font_record font = MakeArial();
+  font.color_argb = 0x01020304U;  // compatibility fallback, not a render result
+  font.color = theme;
+  uint32_t font_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, font, &font_index), 0);
+  fm_font_record got_font{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, font_index, &got_font), 0);
+  EXPECT_EQ(got_font.color.kind, static_cast<uint8_t>(kFmColorTheme));
+  EXPECT_EQ(got_font.color.theme, 3U);
+  EXPECT_DOUBLE_EQ(got_font.color.tint, 0.5);
+  EXPECT_EQ(got_font.color_argb, 0x01020304U);
+  uint32_t font_again = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, got_font, &font_again), 0);
+  EXPECT_EQ(font_again, font_index);
+
+  fm_fill_record fill = MakeRedFill();
+  fill.fg_argb = 0x05060708U;
+  fill.bg_argb = 0x090A0B0CU;
+  fill.fg = indexed;
+  fill.bg = automatic;
+  uint32_t fill_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, fill, &fill_index), 0);
+  fm_fill_record got_fill{};
+  ASSERT_EQ(fm_styles_get_fill(wb.handle, fill_index, &got_fill), 0);
+  EXPECT_EQ(got_fill.fg.kind, static_cast<uint8_t>(kFmColorIndexed));
+  EXPECT_EQ(got_fill.fg.indexed, 9U);
+  EXPECT_EQ(got_fill.bg.kind, static_cast<uint8_t>(kFmColorAuto));
+  uint32_t fill_again = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, got_fill, &fill_again), 0);
+  EXPECT_EQ(fill_again, fill_index);
+
+  fm_border_record border = MakeThinBoxBorder();
+  border.left.color = theme;
+  border.right.color = indexed;
+  uint32_t border_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_border(wb.handle, border, &border_index), 0);
+  fm_border_record got_border{};
+  ASSERT_EQ(fm_styles_get_border(wb.handle, border_index, &got_border), 0);
+  EXPECT_EQ(got_border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
+  EXPECT_EQ(got_border.left.color.theme, 3U);
+  EXPECT_EQ(got_border.right.color.kind, static_cast<uint8_t>(kFmColorIndexed));
+  EXPECT_EQ(got_border.right.color.indexed, 9U);
+  uint32_t border_again = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_border(wb.handle, got_border, &border_again), 0);
+  EXPECT_EQ(border_again, border_index);
+
+  fm_dxf_record dxf{};
+  dxf.font_engaged = 1;
+  dxf.font = font;
+  dxf.font.color = automatic;
+  dxf.fill_engaged = 1;
+  dxf.fill = fill;
+  dxf.border_engaged = 1;
+  dxf.border = border;
+  uint32_t dxf_index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, dxf, &dxf_index), 0);
+  fm_dxf_record got_dxf{};
+  ASSERT_EQ(fm_styles_get_dxf(wb.handle, dxf_index, &got_dxf), 0);
+  EXPECT_EQ(got_dxf.font.color.kind, static_cast<uint8_t>(kFmColorAuto));
+  EXPECT_EQ(got_dxf.fill.fg.kind, static_cast<uint8_t>(kFmColorIndexed));
+  EXPECT_EQ(got_dxf.border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
+  uint32_t dxf_again = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_dxf(wb.handle, got_dxf, &dxf_again), 0);
+  EXPECT_EQ(dxf_again, dxf_index);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+
+  fm_font_record reloaded_font{};
+  ASSERT_EQ(fm_styles_get_font(reloaded.handle, font_index, &reloaded_font), 0);
+  EXPECT_EQ(reloaded_font.color.kind, static_cast<uint8_t>(kFmColorTheme));
+  EXPECT_EQ(reloaded_font.color.theme, 3U);
+  EXPECT_DOUBLE_EQ(reloaded_font.color.tint, 0.5);
+  fm_fill_record reloaded_fill{};
+  ASSERT_EQ(fm_styles_get_fill(reloaded.handle, fill_index, &reloaded_fill), 0);
+  EXPECT_EQ(reloaded_fill.fg.kind, static_cast<uint8_t>(kFmColorIndexed));
+  EXPECT_EQ(reloaded_fill.fg.indexed, 9U);
+  EXPECT_EQ(reloaded_fill.bg.kind, static_cast<uint8_t>(kFmColorAuto));
+  fm_border_record reloaded_border{};
+  ASSERT_EQ(fm_styles_get_border(reloaded.handle, border_index, &reloaded_border), 0);
+  EXPECT_EQ(reloaded_border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
+  fm_dxf_record reloaded_dxf{};
+  ASSERT_EQ(fm_styles_get_dxf(reloaded.handle, dxf_index, &reloaded_dxf), 0);
+  EXPECT_EQ(reloaded_dxf.font.color.kind, static_cast<uint8_t>(kFmColorAuto));
+  EXPECT_EQ(reloaded_dxf.border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
+}
+
+TEST(FormulonCApiStyles, AddFillDedupReturnsExistingIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t a = 0xFFFFFFFFU;
+  uint32_t b = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &a), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &b), 0);
+  EXPECT_EQ(a, b);
+}
+
+TEST(FormulonCApiStyles, AddFillDistinctReturnsNewIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t a = 0;
+  uint32_t b = 0;
+  fm_fill_record red = MakeRedFill();
+  fm_fill_record blue = MakeRedFill();
+  blue.fg_argb = 0xFF0000FFU;
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, red, &a), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, blue, &b), 0);
+  EXPECT_NE(a, b);
+}
+
+TEST(FormulonCApiStyles, AddFillGrowsTable) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t before = 0;
+  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &before), 0);
+  uint32_t idx = 0;
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &idx), 0);
+  uint32_t after = 0;
+  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &after), 0);
+  // The seeded table reserves `none` and `gray125` at 0 and 1, matching
+  // what Excel puts in every workbook, so the caller's fill starts at 2.
+  EXPECT_EQ(before, 2U);
+  EXPECT_EQ(after, 3U);
+  EXPECT_EQ(idx, 2U);
+  fm_fill_record out{};
+  ASSERT_EQ(fm_styles_get_fill(wb.handle, idx, &out), 0);
+  EXPECT_EQ(out.pattern, 1U);
+  EXPECT_EQ(out.fg_argb, 0xFFFF0000U);
+}
+
+TEST(FormulonCApiStyles, AddBorderDedupReturnsExistingIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t a = 0xFFFFFFFFU;
+  uint32_t b = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &a), 0);
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &b), 0);
+  EXPECT_EQ(a, b);
+}
+
+TEST(FormulonCApiStyles, AddBorderDistinctReturnsNewIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t a = 0;
+  uint32_t b = 0;
+  fm_border_record thin = MakeThinBoxBorder();
+  fm_border_record dashed = MakeThinBoxBorder();
+  dashed.left.style = 3;  // dashed
+  ASSERT_EQ(fm_styles_add_border(wb.handle, thin, &a), 0);
+  ASSERT_EQ(fm_styles_add_border(wb.handle, dashed, &b), 0);
+  EXPECT_NE(a, b);
+}
+
+TEST(FormulonCApiStyles, AddBorderGrowsTable) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t before = 0;
+  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &before), 0);
+  uint32_t idx = 0;
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &idx), 0);
+  uint32_t after = 0;
+  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &after), 0);
+  // Index 0 is the seeded empty border.
+  EXPECT_EQ(before, 1U);
+  EXPECT_EQ(after, 2U);
+  EXPECT_EQ(idx, 1U);
+  fm_border_record out{};
+  ASSERT_EQ(fm_styles_get_border(wb.handle, idx, &out), 0);
+  EXPECT_EQ(out.left.style, 1U);
+  EXPECT_EQ(out.right.style, 1U);
+  EXPECT_EQ(out.diagonal_up, 0);
+  EXPECT_EQ(out.diagonal_down, 0);
+}
diff --git a/tests/c_api/formulon_c_styles_fonts_test.cpp b/tests/c_api/formulon_c_styles_fonts_test.cpp
new file mode 100644
index 000000000..8d2fffc72
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_fonts_test.cpp
@@ -0,0 +1,164 @@
+// Stable C ABI font tests.
+
+#include "formulon_c_styles_test_helpers.h"
+
+TEST(FormulonCApiStyles, AddFontDedupReturnsExistingIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t a = 0xFFFFFFFFU;
+  uint32_t b = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &a), 0);
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &b), 0);
+  EXPECT_EQ(a, b);
+}
+
+TEST(FormulonCApiStyles, AddFontDistinctReturnsNewIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t a = 0;
+  uint32_t b = 0;
+  fm_font_record arial = MakeArial();
+  fm_font_record calibri = MakeArial();
+  calibri.name = "Calibri";
+  ASSERT_EQ(fm_styles_add_font(wb.handle, arial, &a), 0);
+  ASSERT_EQ(fm_styles_add_font(wb.handle, calibri, &b), 0);
+  EXPECT_NE(a, b);
+}
+
+TEST(FormulonCApiStyles, AddFontGrowsTable) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t before = 0;
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &before), 0);
+  uint32_t idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &idx), 0);
+  uint32_t after = 0;
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &after), 0);
+  // A new workbook seeds the default font at index 0, so the caller's
+  // first font lands at index 1.
+  EXPECT_EQ(before, 1U);
+  EXPECT_EQ(after, 2U);
+  EXPECT_EQ(idx, 1U);
+  // Round-trip: the freshly added font should read back equal.
+  fm_font_record out{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, idx, &out), 0);
+  EXPECT_STREQ(out.name, "Arial");
+  EXPECT_DOUBLE_EQ(out.size, 12.0);
+  EXPECT_EQ(out.color_argb, 0xFF112233U);
+  EXPECT_EQ(out.bold, 1);
+}
+
+TEST(FormulonCApiStyles, GetFontRoundTripIsIdentityForSuperscript) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_font_record superscript = MakeArial();
+  superscript.vert_align = 1;
+  uint32_t idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, superscript, &idx), 0);
+
+  fm_font_record loaded{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, idx, &loaded), 0);
+  EXPECT_STREQ(loaded.name, "Arial");
+  EXPECT_EQ(loaded.vert_align, 1U);
+
+  uint32_t count_before = 0;
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count_before), 0);
+  uint32_t reindex = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, loaded, &reindex), 0);
+  EXPECT_EQ(reindex, idx);
+  uint32_t count_after = 0;
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count_after), 0);
+  EXPECT_EQ(count_after, count_before);
+}
+
+TEST(FormulonCApiStyles, GetEditAddFontPreservesTheUneditedFields) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_font_record superscript = MakeArial();
+  superscript.vert_align = 1;
+  superscript.has_family = 1;
+  superscript.family = 2;
+  superscript.has_charset = 1;
+  superscript.charset = 128;
+  uint32_t idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, superscript, &idx), 0);
+
+  fm_font_record edited{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, idx, &edited), 0);
+  edited.color_argb = 0xFF00FF00U;
+  uint32_t recolored = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, edited, &recolored), 0);
+  EXPECT_NE(recolored, idx);
+
+  fm_font_record reread{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, recolored, &reread), 0);
+  EXPECT_EQ(reread.color_argb, 0xFF00FF00U);
+  EXPECT_EQ(reread.vert_align, 1U);
+  EXPECT_EQ(reread.has_family, 1);
+  EXPECT_EQ(reread.family, 2U);
+  EXPECT_EQ(reread.has_charset, 1);
+  EXPECT_EQ(reread.charset, 128U);
+}
+
+TEST(FormulonCApiStyles, AddFontIsIdentityAgainstAFileLoadedTable) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadExcelAuthoredStyles(wb.handle));
+
+  uint32_t count = 0;
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count), 0);
+  ASSERT_EQ(count, 3U);
+  for (uint32_t i = 0; i < count; ++i) {
+    fm_font_record loaded{};
+    ASSERT_EQ(fm_styles_get_font(wb.handle, i, &loaded), 0) << "font " << i;
+    uint32_t reindex = 0xFFFFFFFFU;
+    ASSERT_EQ(fm_styles_add_font(wb.handle, loaded, &reindex), 0) << "font " << i;
+    EXPECT_EQ(reindex, i);
+  }
+  uint32_t count_after = 0;
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count_after), 0);
+  EXPECT_EQ(count_after, count);
+}
+
+TEST(FormulonCApiStyles, AddFontDoesNotAliasAThemeColourOntoLiteralRgb) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadExcelAuthoredStyles(wb.handle));
+
+  // Font 0 is `<color theme="1"/>`. Its sibling ARGB is only a compatibility
+  // fallback, so folding it together with a caller's literal RGB record
+  // would lose the selector and change the template's body text semantics.
+  fm_font_record themed{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, 0U, &themed), 0);
+  ASSERT_EQ(themed.color.kind, static_cast<uint8_t>(kFmColorTheme));
+
+  fm_font_record literal_rgb = themed;
+  literal_rgb.color = fm_color_spec{};
+  uint32_t index = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, literal_rgb, &index), 0);
+  EXPECT_NE(index, 0U);
+
+  // The theme record is untouched and still serialises as a theme colour.
+  const std::string xml = formulon::io::write_styles(wb.handle->workbook().styles());
+  EXPECT_NE(xml.find("<color theme=\"1\"/>"), std::string::npos);
+  EXPECT_NE(xml.find("<color theme=\"0\" tint=\"-0.25\"/>"), std::string::npos);
+}
+
+TEST(FormulonCApiStyles, AddFontDistinguishesAnExplicitOffToggleFromAnAbsentOne) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_font_record absent = MakeArial();
+  absent.bold = 0;
+  absent.has_bold = 0;
+  fm_font_record explicit_off = absent;
+  explicit_off.has_bold = 1;
+
+  uint32_t absent_index = 0;
+  uint32_t explicit_index = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, absent, &absent_index), 0);
+  ASSERT_EQ(fm_styles_add_font(wb.handle, explicit_off, &explicit_index), 0);
+  EXPECT_NE(absent_index, explicit_index);
+}
diff --git a/tests/c_api/formulon_c_styles_lifetime_test.cpp b/tests/c_api/formulon_c_styles_lifetime_test.cpp
new file mode 100644
index 000000000..ca28b44ec
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_lifetime_test.cpp
@@ -0,0 +1,185 @@
+// Stable C ABI style-table lifetime and default-slot tests.
+
+#include "formulon_c_styles_test_helpers.h"
+
+TEST(FormulonCApiStyles, CreateEmptySeedsReservedStyleSlots) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create_empty(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Sheet1"), 0);
+
+  uint32_t font_count = 0;
+  uint32_t fill_count = 0;
+  uint32_t border_count = 0;
+  uint32_t cell_xf_count = 0;
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &font_count), 0);
+  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &fill_count), 0);
+  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &border_count), 0);
+  ASSERT_EQ(fm_styles_get_cell_xf_count(wb.handle, &cell_xf_count), 0);
+  EXPECT_EQ(font_count, 1U);
+  EXPECT_EQ(fill_count, 2U);
+  EXPECT_EQ(border_count, 1U);
+  EXPECT_EQ(cell_xf_count, 1U);
+
+  // Excel reserves fill 0 for `none` and fill 1 for `gray125`, so a caller's
+  // own fill must never take either slot; the same holds for font 0 and
+  // border 0. A non-zero index is what proves the reserved slots survived.
+  fm_font_record font{};
+  font.name = "Arial";
+  font.size = 12.0;
+  uint32_t font_index = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, font, &font_index), 0);
+  EXPECT_GT(font_index, 0U);
+
+  fm_fill_record fill{};
+  fill.pattern = 1U; /* solid */
+  fill.fg_argb = 0xFFFF0000U;
+  uint32_t fill_index = 0;
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, fill, &fill_index), 0);
+  EXPECT_GT(fill_index, 1U);
+
+  fm_border_record border{};
+  border.left.style = 1U; /* thin */
+  uint32_t border_index = 0;
+  ASSERT_EQ(fm_styles_add_border(wb.handle, border, &border_index), 0);
+  EXPECT_GT(border_index, 0U);
+
+  fm_cell_xf xf{};
+  xf.font_index = font_index;
+  xf.fill_index = fill_index;
+  xf.border_index = border_index;
+  uint32_t xf_index = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_index), 0);
+  EXPECT_GT(xf_index, 0U);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  EXPECT_NE(styles_xml.find("gray125"), std::string::npos);
+  EXPECT_NE(styles_xml.find("name=\"Normal\""), std::string::npos);
+  // Cell xf 0 stays the unformatted default: it must not pick up the
+  // caller's fill.
+  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
+  ASSERT_NE(cell_xfs_begin, std::string::npos);
+  const std::size_t first_xf = styles_xml.find("<xf", cell_xfs_begin);
+  ASSERT_NE(first_xf, std::string::npos);
+  const std::size_t first_xf_end = styles_xml.find('>', first_xf);
+  ASSERT_NE(first_xf_end, std::string::npos);
+  EXPECT_NE(styles_xml.substr(first_xf, first_xf_end - first_xf).find("fillId=\"0\""), std::string::npos);
+}
+
+TEST(FormulonCApiStyles, DefaultFontDeclaresWhatAnUnstyledCellSavesAs) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 0, 0, "unstyled"), 0);
+
+  // The seeded default is Excel's Calibri 11, and `add_font` can only append
+  // beside it -- which is exactly why the declaring entry point exists.
+  fm_font_record seeded{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, 0, &seeded), 0);
+  EXPECT_STREQ(seeded.name, "Calibri");
+  fm_font_record appended{};
+  appended.name = "游ゴシック";
+  appended.size = 11.0;
+  uint32_t appended_index = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, appended, &appended_index), 0);
+  EXPECT_GT(appended_index, 0U);
+
+  fm_font_record declared{};
+  declared.name = "游ゴシック";
+  declared.size = 11.0;
+  declared.has_family = 1;
+  declared.family = 2;
+  declared.has_charset = 1;
+  declared.charset = 128;
+  declared.color_argb = 0xFF000000U;
+  ASSERT_EQ(fm_workbook_set_default_font(wb.handle, declared), 0);
+
+  fm_font_record read_back{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, 0, &read_back), 0);
+  EXPECT_STREQ(read_back.name, "游ゴシック");
+  EXPECT_EQ(read_back.charset, 128U);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  const std::size_t fonts_begin = styles_xml.find("<fonts");
+  ASSERT_NE(fonts_begin, std::string::npos);
+  const std::size_t first_font = styles_xml.find("<font>", fonts_begin);
+  ASSERT_NE(first_font, std::string::npos);
+  const std::size_t first_font_end = styles_xml.find("</font>", first_font);
+  ASSERT_NE(first_font_end, std::string::npos);
+  const std::string first = styles_xml.substr(first_font, first_font_end - first_font);
+  EXPECT_NE(first.find("<name val=\"游ゴシック\"/>"), std::string::npos);
+  EXPECT_EQ(first.find("Calibri"), std::string::npos);
+}
+
+TEST(FormulonCApiStyles, SetFontOverwritesInPlaceAndRejectsAnAbsentIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_font_record added{};
+  added.name = "Meiryo";
+  added.size = 12.0;
+  uint32_t index = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, added, &index), 0);
+  ASSERT_GT(index, 0U);
+
+  fm_font_record replacement{};
+  replacement.name = "MS Gothic";
+  replacement.size = 9.0;
+  ASSERT_EQ(fm_styles_set_font(wb.handle, index, replacement), 0);
+
+  fm_font_record read_back{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, index, &read_back), 0);
+  EXPECT_STREQ(read_back.name, "MS Gothic");
+  EXPECT_DOUBLE_EQ(read_back.size, 9.0);
+
+  // Overwriting does not grow the table, and an index past its end is
+  // refused rather than filled in with default records.
+  uint32_t count = 0;
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count), 0);
+  EXPECT_EQ(count, index + 1U);
+  EXPECT_NE(fm_styles_set_font(wb.handle, count, replacement), 0);
+  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count), 0);
+  EXPECT_EQ(count, index + 1U);
+
+  EXPECT_NE(fm_styles_set_font(nullptr, 0, replacement), 0);
+  EXPECT_NE(fm_workbook_set_default_font(nullptr, replacement), 0);
+}
+
+TEST(FormulonCApiStyles, FontSchemeSurvivesAReadModifyWriteThroughTheAbi) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_font_record body{};
+  body.name = "游ゴシック";
+  body.size = 11.0;
+  body.has_charset = 1;
+  body.charset = 128;
+  body.scheme = 2;  // minor: the theme's body font
+  ASSERT_EQ(fm_workbook_set_default_font(wb.handle, body), 0);
+
+  // The link has to come back out of the projection, or a host that reads a
+  // font, edits one field and writes it back silently unlinks it.
+  fm_font_record read_back{};
+  ASSERT_EQ(fm_styles_get_font(wb.handle, 0, &read_back), 0);
+  EXPECT_EQ(read_back.scheme, 2U);
+  read_back.size = 12.0;
+  ASSERT_EQ(fm_styles_set_font(wb.handle, 0, read_back), 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  const std::string styles_xml = ExtractStylesXml(saved);
+  EXPECT_NE(styles_xml.find("<charset val=\"128\"/><scheme val=\"minor\"/>"), std::string::npos);
+
+  // A record left at the default writes no element, so `add_font` sees a
+  // distinct entry rather than folding the two together.
+  fm_font_record unlinked{};
+  unlinked.name = "游ゴシック";
+  unlinked.size = 12.0;
+  unlinked.has_charset = 1;
+  unlinked.charset = 128;
+  uint32_t unlinked_index = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, unlinked, &unlinked_index), 0);
+  EXPECT_GT(unlinked_index, 0U);
+}
diff --git a/tests/c_api/formulon_c_styles_mutation_test.cpp b/tests/c_api/formulon_c_styles_mutation_test.cpp
new file mode 100644
index 000000000..9aca165ef
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_mutation_test.cpp
@@ -0,0 +1,309 @@
+// Stable C ABI style mutation and round-trip tests.
+
+#include "formulon_c_styles_test_helpers.h"
+
+TEST(FormulonCApiStyles, FullLifecycleSurvivesSaveLoad) {
+  // Build font -> xf -> stamp on cell -> save -> reload -> the font is
+  // resolvable via the read-side accessors.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  uint32_t font_idx = 0;
+  uint32_t fill_idx = 0;
+  uint32_t border_idx = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
+  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
+
+  fm_cell_xf xf{};
+  xf.font_index = font_idx;
+  xf.fill_index = fill_idx;
+  xf.border_index = border_idx;
+  xf.num_fmt_id = 0;
+  uint32_t xf_idx = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx), 0);
+
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.5), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, xf_idx), 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+
+  WorkbookGuard wb2;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &wb2.handle), 0);
+  uint32_t reread_xf = 0;
+  EXPECT_EQ(fm_cell_get_xf_index(wb2.handle, 0, 0, 0, &reread_xf), 0);
+  fm_cell_xf reloaded{};
+  EXPECT_EQ(fm_styles_get_cell_xf(wb2.handle, reread_xf, &reloaded), 0);
+  fm_font_record reloaded_font{};
+  ASSERT_EQ(fm_styles_get_font(wb2.handle, reloaded.font_index, &reloaded_font), 0);
+  EXPECT_STREQ(reloaded_font.name, "Arial");
+  EXPECT_DOUBLE_EQ(reloaded_font.size, 12.0);
+  EXPECT_EQ(reloaded_font.bold, 1);
+}
+
+TEST(FormulonCApiStyles, AddXfWithNonDefaultFontFillNumFmtRoundTripsThroughSaveLoad) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  uint32_t font_idx = 0xFFFFFFFFU;
+  uint32_t fill_idx = 0xFFFFFFFFU;
+  uint16_t num_fmt_id = 0;
+  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
+  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "0.00%", &num_fmt_id), 0);
+
+  fm_cell_xf xf{};
+  xf.font_index = font_idx;
+  xf.fill_index = fill_idx;
+  xf.border_index = 0;
+  xf.num_fmt_id = num_fmt_id;
+  uint32_t xf_idx = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx), 0);
+  ASSERT_NE(xf_idx, 0U) << "non-default font/fill/numFmt must not dedup to the "
+                           "all-zero placeholder xf at index 0";
+
+  // Stability: re-adding the identical record must return the same index.
+  uint32_t xf_idx_again = 0xFFFFFFFFU;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx_again), 0);
+  EXPECT_EQ(xf_idx, xf_idx_again);
+
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 1, 1, 0.4225), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 1, 1, xf_idx), 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  ASSERT_GT(saved.len, 0U);
+
+  WorkbookGuard wb2;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &wb2.handle), 0);
+
+  uint32_t reread_xf = 0;
+  ASSERT_EQ(fm_cell_get_xf_index(wb2.handle, 0, 1, 1, &reread_xf), 0);
+  ASSERT_EQ(reread_xf, xf_idx);
+
+  fm_cell_xf reloaded{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb2.handle, reread_xf, &reloaded), 0);
+  EXPECT_EQ(reloaded.font_index, font_idx);
+  EXPECT_EQ(reloaded.fill_index, fill_idx);
+  EXPECT_EQ(reloaded.num_fmt_id, num_fmt_id);
+
+  fm_font_record reloaded_font{};
+  ASSERT_EQ(fm_styles_get_font(wb2.handle, reloaded.font_index, &reloaded_font), 0);
+  EXPECT_STREQ(reloaded_font.name, "Arial");
+  EXPECT_DOUBLE_EQ(reloaded_font.size, 12.0);
+  EXPECT_EQ(reloaded_font.bold, 1);
+
+  fm_fill_record reloaded_fill{};
+  ASSERT_EQ(fm_styles_get_fill(wb2.handle, reloaded.fill_index, &reloaded_fill), 0);
+  EXPECT_EQ(reloaded_fill.pattern, 1U);
+  EXPECT_EQ(reloaded_fill.fg_argb, 0xFFFF0000U);
+
+  const char* reloaded_fmt = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb2.handle, reloaded.num_fmt_id, &reloaded_fmt), 0);
+  ASSERT_NE(reloaded_fmt, nullptr);
+  EXPECT_STREQ(reloaded_fmt, "0.00%");
+}
+
+TEST(FormulonCApiStyles, JustifyLastLineRoundTripsThroughSaveLoad) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_cell_xf xf{};
+  xf.has_alignment = 1;
+  xf.horizontal_align = 7;  // distributed
+  xf.has_horizontal_align = 1;
+  xf.vertical_align = 2;  // bottom
+  xf.justify_last_line = 1;
+  xf.has_justify_last_line = 1;
+  uint32_t xf_idx = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx), 0);
+
+  uint32_t duplicate_idx = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &duplicate_idx), 0);
+  EXPECT_EQ(duplicate_idx, xf_idx);
+
+  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 0, 0, "distributed"), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, xf_idx), 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+
+  WorkbookGuard reloaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
+  uint32_t reread_idx = 0;
+  ASSERT_EQ(fm_cell_get_xf_index(reloaded.handle, 0, 0, 0, &reread_idx), 0);
+  fm_cell_xf reread{};
+  ASSERT_EQ(fm_styles_get_cell_xf(reloaded.handle, reread_idx, &reread), 0);
+  EXPECT_EQ(reread.horizontal_align, 7U);
+  EXPECT_EQ(reread.justify_last_line, 1);
+}
+
+TEST(FormulonCApiStyles, NamedCellStyleRoundTripsThroughSaveLoad) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_cell_xf style_xf{};
+  style_xf.has_alignment = 1;
+  style_xf.horizontal_align = 2;
+  style_xf.has_horizontal_align = 1;
+  uint32_t xf_id = 0;
+  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, style_xf, &xf_id), 0);
+  fm_cell_style_record_t highlight{};
+  highlight.name = "Highlight";
+  highlight.xf_id = xf_id;
+  highlight.builtin_id = FM_CELL_STYLE_BUILTIN_ID_NONE;
+  ASSERT_EQ(fm_styles_set_cell_style(wb.handle, &highlight), 0);
+
+  fm_cell_xf cell_xf{};
+  cell_xf.has_alignment = 1;
+  cell_xf.horizontal_align = 2;
+  cell_xf.has_horizontal_align = 1;
+  cell_xf.xf_id = xf_id;
+  uint32_t cell_xf_id = 0;
+  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, cell_xf, &cell_xf_id), 0);
+  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 0, 0, "styled"), 0);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, cell_xf_id), 0);
+
+  BufferGuard saved;
+  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
+  WorkbookGuard loaded;
+  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &loaded.handle), 0);
+  uint32_t style_count = 0;
+  ASSERT_EQ(fm_styles_get_cell_style_count(loaded.handle, &style_count), 0);
+  // The seeded `Normal` keeps index 0; `Highlight` is appended after it.
+  ASSERT_EQ(style_count, 2U);
+  fm_cell_style_record_t style{};
+  ASSERT_EQ(fm_styles_get_cell_style(loaded.handle, 1, &style), 0);
+  EXPECT_STREQ(style.name, "Highlight");
+  uint32_t reread_cell_xf = 0;
+  ASSERT_EQ(fm_cell_get_xf_index(loaded.handle, 0, 0, 0, &reread_cell_xf), 0);
+  fm_cell_xf reread{};
+  ASSERT_EQ(fm_styles_get_cell_xf(loaded.handle, reread_cell_xf, &reread), 0);
+  EXPECT_EQ(reread.xf_id, style.xf_id);
+}
+
+TEST(FormulonCApiStyles, NamedStyleXfRejectsDanglingReferences) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  // A cell xf may only inherit from a named-style xf that already exists.
+  fm_cell_xf cell_xf{};
+  cell_xf.xf_id = 3;
+  uint32_t cell_xf_index = 0;
+  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, cell_xf, &cell_xf_index), 0);
+
+  // The named-style table validates its own font / fill / border / numFmt
+  // references exactly like the cell-xf table does.
+  fm_cell_xf style_xf{};
+  style_xf.font_index = 9;
+  uint32_t xf_id = 0;
+  EXPECT_NE(fm_styles_add_cell_style_xf(wb.handle, style_xf, &xf_id), 0);
+
+  style_xf.font_index = 0;
+  style_xf.has_alignment = 1;
+  style_xf.justify_last_line = 1;
+  style_xf.has_justify_last_line = 1;
+  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, style_xf, &xf_id), 0);
+  fm_cell_xf reread{};
+  ASSERT_EQ(fm_styles_get_cell_style_xf(wb.handle, xf_id, &reread), 0);
+  EXPECT_EQ(reread.justify_last_line, 1);
+
+  // 0..53 is the whole OOXML ordinal space; anything else needs the sentinel.
+  fm_cell_style_record_t custom{};
+  custom.name = "Custom";
+  custom.xf_id = xf_id;
+  custom.builtin_id = 54;
+  EXPECT_NE(fm_styles_set_cell_style(wb.handle, &custom), 0);
+  custom.builtin_id = FM_CELL_STYLE_BUILTIN_ID_NONE;
+  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, &custom), 0);
+  custom.xf_id = xf_id + 1U;
+  EXPECT_NE(fm_styles_set_cell_style(wb.handle, &custom), 0);
+}
+
+TEST(FormulonCApiStyles, AddBatchDeduplicatesAllStyleTables) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  const fm_font_record fonts[] = {MakeArial(), MakeArial()};
+  const fm_fill_record fills[] = {MakeRedFill(), MakeRedFill()};
+  fm_border_record border{};
+  border.left.style = 1;
+  border.left.color_argb = 0xFF000000U;
+  const fm_border_record borders[] = {border, border};
+  uint32_t font_indices[2]{};
+  uint32_t fill_indices[2]{};
+  uint32_t border_indices[2]{};
+  const char* const num_fmt_codes[] = {"0.000%", "0.000%"};
+  uint16_t num_fmt_ids[2]{};
+  fm_cell_xf xf{};
+  xf.font_index = 1U;
+  xf.fill_index = 1U;
+  xf.border_index = 1U;
+  const fm_cell_xf xfs[] = {xf, xf};
+  uint32_t xf_indices[2]{};
+  const fm_styles_batch batch{fonts, 2U, font_indices, fills,         2U, fill_indices, borders, 2U, border_indices,
+                              xfs,   2U, xf_indices,   num_fmt_codes, 2U, num_fmt_ids};
+
+  ASSERT_EQ(fm_styles_add_batch(wb.handle, &batch), 0);
+  EXPECT_EQ(font_indices[0], font_indices[1]);
+  EXPECT_EQ(fill_indices[0], fill_indices[1]);
+  EXPECT_EQ(border_indices[0], border_indices[1]);
+  EXPECT_EQ(xf_indices[0], xf_indices[1]);
+  EXPECT_EQ(num_fmt_ids[0], num_fmt_ids[1]);
+}
+
+TEST(FormulonCApiStyles, AddBatchCommitsNumFmtReferencesTransactionally) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  const fm_font_record font = MakeArial();
+  uint32_t font_index = 0;
+  const char* const codes[] = {"0.000%"};
+  uint16_t num_fmt_ids[] = {0xBEEF};
+  fm_cell_xf xf{};
+  xf.font_index = 1U;  // default root plus the staged font
+  xf.num_fmt_id = 164U;
+  uint32_t xf_indices[] = {0xDEADBEEFU};
+  const fm_styles_batch batch{&font,   1U,  &font_index, nullptr,    0U,    nullptr, nullptr,    0U,
+                              nullptr, &xf, 1U,          xf_indices, codes, 1U,      num_fmt_ids};
+
+  ASSERT_EQ(fm_styles_add_batch(wb.handle, &batch), 0);
+  EXPECT_EQ(font_index, 1U);
+  EXPECT_EQ(num_fmt_ids[0], 164U);
+  EXPECT_EQ(xf_indices[0], 1U);
+  ASSERT_EQ(wb.handle->workbook().styles().num_fmts.size(), 1U);
+  EXPECT_EQ(wb.handle->workbook().styles().num_fmts[0].id, 164U);
+  ASSERT_EQ(wb.handle->workbook().styles().cell_xfs.size(), 2U);
+  EXPECT_EQ(wb.handle->workbook().styles().cell_xfs[1].num_fmt_id, 164U);
+}
+
+TEST(FormulonCApiStyles, AddBatchFailureLeavesTableAndOutputsUnchanged) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  const std::string before_xml = formulon::io::write_styles(wb.handle->workbook().styles());
+  const std::size_t before_fonts = wb.handle->workbook().styles().fonts.size();
+  const std::size_t before_num_fmts = wb.handle->workbook().styles().num_fmts.size();
+  const std::size_t before_cell_xfs = wb.handle->workbook().styles().cell_xfs.size();
+
+  const fm_font_record font = MakeArial();
+  uint32_t font_index = 0xA1A2A3A4U;
+  const char* const codes[] = {"0.000%"};
+  uint16_t num_fmt_ids[] = {0xBEEF};
+  fm_cell_xf xf{};
+  xf.font_index = 1U;    // valid after staging the font
+  xf.num_fmt_id = 999U;  // neither built-in nor registered
+  uint32_t xf_indices[] = {0xDEADBEEFU};
+  const fm_styles_batch batch{&font,   1U,  &font_index, nullptr,    0U,    nullptr, nullptr,    0U,
+                              nullptr, &xf, 1U,          xf_indices, codes, 1U,      num_fmt_ids};
+
+  EXPECT_NE(fm_styles_add_batch(wb.handle, &batch), 0);
+  EXPECT_EQ(font_index, 0xA1A2A3A4U);
+  EXPECT_EQ(num_fmt_ids[0], 0xBEEFU);
+  EXPECT_EQ(xf_indices[0], 0xDEADBEEFU);
+  EXPECT_EQ(wb.handle->workbook().styles().fonts.size(), before_fonts);
+  EXPECT_EQ(wb.handle->workbook().styles().num_fmts.size(), before_num_fmts);
+  EXPECT_EQ(wb.handle->workbook().styles().cell_xfs.size(), before_cell_xfs);
+  EXPECT_EQ(formulon::io::write_styles(wb.handle->workbook().styles()), before_xml);
+}
diff --git a/tests/c_api/formulon_c_styles_num_formats_test.cpp b/tests/c_api/formulon_c_styles_num_formats_test.cpp
new file mode 100644
index 000000000..2e3f56806
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_num_formats_test.cpp
@@ -0,0 +1,254 @@
+// Stable C ABI number-format tests.
+
+#include "formulon_c_styles_test_helpers.h"
+
+TEST(FormulonCApiStyles, BuiltinNumFmtResolves) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const char* s = nullptr;
+  EXPECT_EQ(fm_styles_get_num_fmt_string(wb.handle, 0, &s), 0);
+  ASSERT_NE(s, nullptr);
+  EXPECT_STREQ(s, "General");
+  EXPECT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14, &s), 0);
+  ASSERT_NE(s, nullptr);
+  EXPECT_STREQ(s, "mm-dd-yy");
+}
+
+TEST(FormulonCApiStyles, CustomNumFmtOverridingBuiltinIdWins) {
+  // A file may define a custom <numFmt> whose numFmtId collides with a
+  // built-in slot; Excel honours the file's definition. Parse a production-
+  // shaped styles.xml and install the resulting table rather than manually
+  // constructing the record.
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadNumFmtOverrideStyles(wb.handle));
+
+  const char* s = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14, &s), 0);
+  ASSERT_NE(s, nullptr);
+  EXPECT_STREQ(s, "yyyy");
+}
+
+TEST(FormulonCApiStyles, AddNumFmtUsesEffectiveBuiltinMapping) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadNumFmtOverrideStyles(wb.handle));
+
+  const char* resolved = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
+  ASSERT_NE(resolved, nullptr);
+  EXPECT_STREQ(resolved, "yyyy");
+
+  uint16_t override_id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "yyyy", &override_id), 0);
+  EXPECT_EQ(override_id, 14U);
+
+  uint16_t builtin_code_id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "mm-dd-yy", &builtin_code_id), 0);
+  EXPECT_GE(builtin_code_id, 164U);
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, builtin_code_id, &resolved), 0);
+  ASSERT_NE(resolved, nullptr);
+  EXPECT_STREQ(resolved, "mm-dd-yy");
+
+  uint16_t builtin_code_again = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "mm-dd-yy", &builtin_code_again), 0);
+  EXPECT_EQ(builtin_code_again, builtin_code_id);
+}
+
+TEST(FormulonCApiStyles, AddBatchNumFmtUsesEffectiveBuiltinMapping) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadNumFmtOverrideStyles(wb.handle));
+
+  const char* const codes[] = {"General", "yyyy", "mm-dd-yy", "mm-dd-yy"};
+  uint16_t ids[] = {0xFFFFU, 0xFFFFU, 0xFFFFU, 0xFFFFU};
+  fm_styles_batch batch{};
+  batch.num_fmt_codes = codes;
+  batch.num_fmt_count = 4U;
+  batch.num_fmt_ids = ids;
+
+  ASSERT_EQ(fm_styles_add_batch(wb.handle, &batch), 0);
+  EXPECT_EQ(ids[0], 0U);
+  EXPECT_EQ(ids[1], 14U);
+  EXPECT_GE(ids[2], 164U);
+  EXPECT_EQ(ids[3], ids[2]);
+  for (size_t i = 0; i < 4U; ++i) {
+    const char* resolved = nullptr;
+    ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, ids[i], &resolved), 0);
+    ASSERT_NE(resolved, nullptr);
+    EXPECT_STREQ(resolved, codes[i]);
+  }
+}
+
+TEST(FormulonCApiStyles, InvalidCustomNumFmtStringIndexDoesNotShadowBuiltin) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadNumFmtOverrideStyles(wb.handle));
+
+  auto& styles = wb.handle->workbook().mutable_styles();
+  ASSERT_EQ(styles.num_fmts.size(), 1U);
+  styles.num_fmts[0].format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
+
+  const char* resolved = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
+  ASSERT_NE(resolved, nullptr);
+  EXPECT_STREQ(resolved, "mm-dd-yy");
+
+  uint16_t id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "mm-dd-yy", &id), 0);
+  EXPECT_EQ(id, 14U);
+}
+
+TEST(FormulonCApiStyles, DuplicateNumFmtFirstValidRecordWins) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadNumFmtDuplicateStyles(wb.handle));
+
+  const char* resolved = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
+  ASSERT_NE(resolved, nullptr);
+  EXPECT_STREQ(resolved, "yyyy");
+
+  uint16_t first_id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "yyyy", &first_id), 0);
+  EXPECT_EQ(first_id, 14U);
+
+  uint16_t shadowed_id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "dd/mm/yyyy", &shadowed_id), 0);
+  EXPECT_GE(shadowed_id, 164U);
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, shadowed_id, &resolved), 0);
+  ASSERT_NE(resolved, nullptr);
+  EXPECT_STREQ(resolved, "dd/mm/yyyy");
+}
+
+TEST(FormulonCApiStyles, DuplicateNumFmtInvalidFirstThenValidRecordWins) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadNumFmtDuplicateStyles(wb.handle));
+
+  auto& styles = wb.handle->workbook().mutable_styles();
+  ASSERT_EQ(styles.num_fmts.size(), 2U);
+  styles.num_fmts[0].format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
+
+  const char* resolved = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
+  ASSERT_NE(resolved, nullptr);
+  EXPECT_STREQ(resolved, "dd/mm/yyyy");
+
+  uint16_t valid_id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "dd/mm/yyyy", &valid_id), 0);
+  EXPECT_EQ(valid_id, 14U);
+
+  uint16_t invalid_id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "yyyy", &invalid_id), 0);
+  EXPECT_GE(invalid_id, 164U);
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, invalid_id, &resolved), 0);
+  ASSERT_NE(resolved, nullptr);
+  EXPECT_STREQ(resolved, "yyyy");
+}
+
+TEST(FormulonCApiStyles, DuplicateNumFmtAllInvalidRecordsFallBackToBuiltin) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NO_FATAL_FAILURE(LoadNumFmtDuplicateStyles(wb.handle));
+
+  auto& styles = wb.handle->workbook().mutable_styles();
+  ASSERT_EQ(styles.num_fmts.size(), 2U);
+  const std::uint32_t invalid_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
+  for (auto& record : styles.num_fmts) {
+    record.format_string_index = invalid_index;
+  }
+
+  const char* resolved = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
+  ASSERT_NE(resolved, nullptr);
+  EXPECT_STREQ(resolved, "mm-dd-yy");
+
+  uint16_t builtin_id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "mm-dd-yy", &builtin_id), 0);
+  EXPECT_EQ(builtin_id, 14U);
+}
+
+TEST(FormulonCApiStyles, UnknownNumFmtIdRejected) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const char* s = nullptr;
+  // Reserved built-in slot (id 5) without a custom override surfaces
+  // an error rather than an empty string.
+  EXPECT_NE(fm_styles_get_num_fmt_string(wb.handle, 5, &s), 0);
+}
+
+TEST(FormulonCApiStyles, AddNumFmtBuiltinReturnsBuiltinId) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint16_t id = 0xFFFFU;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "General", &id), 0);
+  EXPECT_EQ(id, 0U);
+  // Adding a built-in must not create a custom entry.
+  uint32_t font_count = 7;  // unrelated, just ensure other tables untouched
+  EXPECT_EQ(fm_styles_get_font_count(wb.handle, &font_count), 0);
+  EXPECT_EQ(font_count, 1U);  // the seeded default only
+}
+
+TEST(FormulonCApiStyles, AddNumFmtCustomReturnsCustomId) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint16_t id = 0;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "\"USD\" #,##0", &id), 0);
+  EXPECT_GE(id, 164U);
+  // Resolves through the read-side getter.
+  const char* s = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, id, &s), 0);
+  ASSERT_NE(s, nullptr);
+  EXPECT_STREQ(s, "\"USD\" #,##0");
+}
+
+TEST(FormulonCApiStyles, AddNumFmtCustomDedup) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint16_t a = 0;
+  uint16_t b = 0;
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "\"USD\" #,##0", &a), 0);
+  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "\"USD\" #,##0", &b), 0);
+  EXPECT_EQ(a, b);
+}
+
+TEST(FormulonCApiStyles, AddNumFmtExhaustionReturnsPreconditionWithoutMutation) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  auto& styles = wb.handle->workbook().mutable_styles();
+  formulon::NumFmtRecord max_record;
+  max_record.id = 65535U;
+  max_record.format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
+  styles.num_fmt_strings.emplace_back("existing");
+  styles.num_fmts.push_back(max_record);
+  const std::size_t strings_before = styles.num_fmt_strings.size();
+  const std::size_t records_before = styles.num_fmts.size();
+  uint16_t out = 0xBEEFU;
+  EXPECT_EQ(fm_styles_add_num_fmt(wb.handle, "new-format", &out),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kPreconditionFailed));
+  EXPECT_EQ(out, 0xBEEFU);
+  EXPECT_EQ(styles.num_fmt_strings.size(), strings_before);
+  EXPECT_EQ(styles.num_fmts.size(), records_before);
+}
+
+TEST(FormulonCApiStyles, AddBatchNumFmtExhaustionIsTransactional) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  auto& styles = wb.handle->workbook().mutable_styles();
+  formulon::NumFmtRecord max_record;
+  max_record.id = 65535U;
+  max_record.format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
+  styles.num_fmt_strings.emplace_back("existing");
+  styles.num_fmts.push_back(max_record);
+  const std::string before_xml = formulon::io::write_styles(styles);
+  const char* codes[] = {"first", "second"};
+  uint16_t ids[] = {0xAAAAU, 0xBBBBU};
+  const fm_styles_batch batch{nullptr, 0U,      nullptr, nullptr, 0U,    nullptr, nullptr, 0U,
+                              nullptr, nullptr, 0U,      nullptr, codes, 2U,      ids};
+  EXPECT_EQ(fm_styles_add_batch(wb.handle, &batch),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kPreconditionFailed));
+  EXPECT_EQ(ids[0], 0xAAAAU);
+  EXPECT_EQ(ids[1], 0xBBBBU);
+  EXPECT_EQ(formulon::io::write_styles(styles), before_xml);
+}
diff --git a/tests/c_api/formulon_c_styles_test.cpp b/tests/c_api/formulon_c_styles_test.cpp
deleted file mode 100644
index ed3e1482e..000000000
--- a/tests/c_api/formulon_c_styles_test.cpp
+++ /dev/null
@@ -1,2337 +0,0 @@
-//
-// Stable C ABI tests for the styles surface
-// (`fm_cell_get_xf_index`, `fm_cell_set_xf_index`,
-// `fm_styles_get_cell_xf`, `fm_styles_get_font`,
-// `fm_styles_get_num_fmt_string`).
-//
-// The test driver is C++ for gtest convenience but everything it
-// touches across the boundary is the pure-C surface.
-
-#include <cstdint>
-#include <cstring>
-#include <string>
-#include <vector>
-
-#include "c_api/formulon_c.h"
-#include "c_api/parts/common.h"
-#include "gtest/gtest.h"
-#include "io/styles_reader.h"
-#include "io/styles_writer.h"
-#include "io/zip_reader.h"
-#include "workbook.h"
-
-namespace {
-
-// `fm_styles_add_cell_xf` takes this struct BY VALUE, so its size is part of
-// the calling convention rather than merely of a buffer: a caller compiled
-// against a different definition reads its arguments from the wrong registers
-// and stack slots with no diagnosable failure. Pin the layout here so a change
-// has to break the build and be acknowledged.
-static_assert(sizeof(fm_cell_xf) == 88U, "fm_cell_xf ABI layout changed");
-static_assert(offsetof(fm_cell_xf, font_index) == 0U, "fm_cell_xf.font_index offset changed");
-static_assert(offsetof(fm_cell_xf, fill_index) == 4U, "fm_cell_xf.fill_index offset changed");
-static_assert(offsetof(fm_cell_xf, border_index) == 8U, "fm_cell_xf.border_index offset changed");
-static_assert(offsetof(fm_cell_xf, num_fmt_id) == 12U, "fm_cell_xf.num_fmt_id offset changed");
-static_assert(offsetof(fm_cell_xf, horizontal_align) == 14U, "fm_cell_xf.horizontal_align offset changed");
-static_assert(offsetof(fm_cell_xf, vertical_align) == 15U, "fm_cell_xf.vertical_align offset changed");
-static_assert(offsetof(fm_cell_xf, wrap_text) == 16U, "fm_cell_xf.wrap_text offset changed");
-static_assert(offsetof(fm_cell_xf, justify_last_line) == 20U, "fm_cell_xf.justify_last_line offset changed");
-static_assert(offsetof(fm_cell_xf, xf_id) == 24U, "fm_cell_xf.xf_id offset changed");
-static_assert(offsetof(fm_cell_xf, has_alignment) == 28U, "fm_cell_xf.has_alignment offset changed");
-static_assert(offsetof(fm_cell_xf, has_text_rotation) == 32U, "fm_cell_xf.has_text_rotation offset changed");
-static_assert(offsetof(fm_cell_xf, reading_order) == 68U, "fm_cell_xf.reading_order offset changed");
-static_assert(offsetof(fm_cell_xf, has_horizontal_align) == 72U, "fm_cell_xf.has_horizontal_align offset changed");
-static_assert(offsetof(fm_cell_xf, has_vertical_align) == 76U, "fm_cell_xf.has_vertical_align offset changed");
-static_assert(offsetof(fm_cell_xf, has_wrap_text) == 80U, "fm_cell_xf.has_wrap_text offset changed");
-static_assert(offsetof(fm_cell_xf, has_justify_last_line) == 84U, "fm_cell_xf.has_justify_last_line offset changed");
-static_assert(sizeof(fm_dxf_record) == (sizeof(void*) == 4U ? 368U : 376U), "fm_dxf_record ABI layout changed");
-static_assert(offsetof(fm_dxf_record, num_fmt_code) == 352U, "fm_dxf_record.num_fmt_code offset changed");
-static_assert(offsetof(fm_dxf_record, alignment_xml) == (sizeof(void*) == 4U ? 356U : 360U),
-              "fm_dxf_record.alignment_xml offset changed");
-static_assert(offsetof(fm_dxf_record, protection_xml) == (sizeof(void*) == 4U ? 360U : 368U),
-              "fm_dxf_record.protection_xml offset changed");
-
-// `fm_styles_batch` is fifteen pointer-width slots: five (array, count,
-// out-indices) triples whose `size_t` counts are the same width as a pointer on
-// both targets. Unlike its neighbours it is reached by no binding -- only the C
-// and C++ callers of `fm_styles_add_batch` -- so nothing cross-checks it from
-// the other side of the boundary and every offset is pinned here instead. A
-// reorder within the struct moves no total size, which is exactly why the
-// per-member offsets and not just `sizeof` are recorded.
-static_assert(sizeof(fm_styles_batch) == 15U * sizeof(void*), "fm_styles_batch ABI layout changed");
-static_assert(alignof(fm_styles_batch) == alignof(void*), "fm_styles_batch ABI alignment changed");
-static_assert(offsetof(fm_styles_batch, fonts) == 0U * sizeof(void*), "fm_styles_batch.fonts offset changed");
-static_assert(offsetof(fm_styles_batch, font_count) == 1U * sizeof(void*), "fm_styles_batch.font_count offset changed");
-static_assert(offsetof(fm_styles_batch, font_indices) == 2U * sizeof(void*),
-              "fm_styles_batch.font_indices offset changed");
-static_assert(offsetof(fm_styles_batch, fills) == 3U * sizeof(void*), "fm_styles_batch.fills offset changed");
-static_assert(offsetof(fm_styles_batch, fill_count) == 4U * sizeof(void*), "fm_styles_batch.fill_count offset changed");
-static_assert(offsetof(fm_styles_batch, fill_indices) == 5U * sizeof(void*),
-              "fm_styles_batch.fill_indices offset changed");
-static_assert(offsetof(fm_styles_batch, borders) == 6U * sizeof(void*), "fm_styles_batch.borders offset changed");
-static_assert(offsetof(fm_styles_batch, border_count) == 7U * sizeof(void*),
-              "fm_styles_batch.border_count offset changed");
-static_assert(offsetof(fm_styles_batch, border_indices) == 8U * sizeof(void*),
-              "fm_styles_batch.border_indices offset changed");
-static_assert(offsetof(fm_styles_batch, cell_xfs) == 9U * sizeof(void*), "fm_styles_batch.cell_xfs offset changed");
-static_assert(offsetof(fm_styles_batch, cell_xf_count) == 10U * sizeof(void*),
-              "fm_styles_batch.cell_xf_count offset changed");
-static_assert(offsetof(fm_styles_batch, cell_xf_indices) == 11U * sizeof(void*),
-              "fm_styles_batch.cell_xf_indices offset changed");
-static_assert(offsetof(fm_styles_batch, num_fmt_codes) == 12U * sizeof(void*),
-              "fm_styles_batch.num_fmt_codes offset changed");
-static_assert(offsetof(fm_styles_batch, num_fmt_count) == 13U * sizeof(void*),
-              "fm_styles_batch.num_fmt_count offset changed");
-static_assert(offsetof(fm_styles_batch, num_fmt_ids) == 14U * sizeof(void*),
-              "fm_styles_batch.num_fmt_ids offset changed");
-// The slots are pointer-width because `size_t` is, on every target this ABI
-// ships to. Pinned separately so a target where that stops holding fails here
-// rather than silently re-laying the struct out.
-static_assert(sizeof(size_t) == sizeof(void*), "fm_styles_batch assumes size_t is pointer-width");
-
-struct WorkbookGuard {
-  fm_workbook_t* handle = nullptr;
-  ~WorkbookGuard() { fm_workbook_destroy(handle); }
-  WorkbookGuard() = default;
-  WorkbookGuard(const WorkbookGuard&) = delete;
-  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
-};
-
-struct BufferGuard {
-  uint8_t* data = nullptr;
-  size_t len = 0;
-  ~BufferGuard() { fm_buffer_free(data); }
-  BufferGuard() = default;
-  BufferGuard(const BufferGuard&) = delete;
-  BufferGuard& operator=(const BufferGuard&) = delete;
-};
-
-constexpr char kNumFmtOverrideStyles[] =
-    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
-    "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
-    "<numFmts count=\"1\"><numFmt numFmtId=\"14\" formatCode=\"yyyy\"/></numFmts>"
-    "<fonts count=\"1\"><font><sz val=\"11\"/><name val=\"Calibri\"/></font></fonts>"
-    "<fills count=\"2\"><fill><patternFill patternType=\"none\"/></fill>"
-    "<fill><patternFill patternType=\"gray125\"/></fill></fills>"
-    "<borders count=\"1\"><border><left/><right/><top/><bottom/><diagonal/></border></borders>"
-    "<cellXfs count=\"1\"><xf numFmtId=\"0\" fontId=\"0\" fillId=\"0\" borderId=\"0\"/></cellXfs>"
-    "</styleSheet>";
-
-constexpr char kNumFmtDuplicateStyles[] =
-    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
-    "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
-    "<numFmts count=\"2\"><numFmt numFmtId=\"14\" formatCode=\"yyyy\"/>"
-    "<numFmt numFmtId=\"14\" formatCode=\"dd/mm/yyyy\"/></numFmts>"
-    "<fonts count=\"1\"><font><sz val=\"11\"/><name val=\"Calibri\"/></font></fonts>"
-    "<fills count=\"2\"><fill><patternFill patternType=\"none\"/></fill>"
-    "<fill><patternFill patternType=\"gray125\"/></fill></fills>"
-    "<borders count=\"1\"><border><left/><right/><top/><bottom/><diagonal/></border></borders>"
-    "<cellXfs count=\"1\"><xf numFmtId=\"0\" fontId=\"0\" fillId=\"0\" borderId=\"0\"/></cellXfs>"
-    "</styleSheet>";
-
-void LoadParsedStyles(fm_workbook_t* handle, const char* xml) {
-  const std::vector<std::uint8_t> bytes(xml, xml + std::strlen(xml));
-  auto parsed = formulon::io::read_styles(bytes);
-  ASSERT_TRUE(parsed.has_value());
-  handle->workbook().mutable_styles() = std::move(parsed.value());
-}
-
-void LoadNumFmtOverrideStyles(fm_workbook_t* handle) {
-  LoadParsedStyles(handle, kNumFmtOverrideStyles);
-}
-
-void LoadNumFmtDuplicateStyles(fm_workbook_t* handle) {
-  LoadParsedStyles(handle, kNumFmtDuplicateStyles);
-}
-
-std::string ExtractStylesXml(const BufferGuard& saved) {
-  formulon::io::ZipReader zip;
-  const auto opened = zip.open(formulon::io::ByteSpan{saved.data, saved.len});
-  if (!opened) {
-    ADD_FAILURE() << opened.error().message;
-    return {};
-  }
-  auto styles_part = zip.read_entry("xl/styles.xml");
-  if (!styles_part) {
-    ADD_FAILURE() << styles_part.error().message;
-    return {};
-  }
-  return {styles_part.value().begin(), styles_part.value().end()};
-}
-
-}  // namespace
-
-TEST(FormulonCApiStyles, CellXfIndexDefaultsToZero) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t xf = 99;
-  EXPECT_EQ(fm_cell_get_xf_index(wb.handle, 0, 0, 0, &xf), 0);
-  EXPECT_EQ(xf, 0U);
-}
-
-TEST(FormulonCApiStyles, CellXfIndexRoundTrips) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  EXPECT_EQ(fm_cell_set_xf_index(wb.handle, 0, 5, 7, 42), 0);
-  uint32_t xf = 0;
-  EXPECT_EQ(fm_cell_get_xf_index(wb.handle, 0, 5, 7, &xf), 0);
-  EXPECT_EQ(xf, 42U);
-}
-
-TEST(FormulonCApiStyles, SetXfIndexRejectsBadSheet) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  // sheet 99 does not exist.
-  EXPECT_NE(fm_cell_set_xf_index(wb.handle, 99, 0, 0, 1), 0);
-}
-
-TEST(FormulonCApiStyles, NullArgumentRejected) {
-  uint32_t xf = 0;
-  EXPECT_NE(fm_cell_get_xf_index(nullptr, 0, 0, 0, &xf), 0);
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  EXPECT_NE(fm_cell_get_xf_index(wb.handle, 0, 0, 0, nullptr), 0);
-}
-
-TEST(FormulonCApiStyles, BuiltinNumFmtResolves) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  const char* s = nullptr;
-  EXPECT_EQ(fm_styles_get_num_fmt_string(wb.handle, 0, &s), 0);
-  ASSERT_NE(s, nullptr);
-  EXPECT_STREQ(s, "General");
-  EXPECT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14, &s), 0);
-  ASSERT_NE(s, nullptr);
-  EXPECT_STREQ(s, "mm-dd-yy");
-}
-
-TEST(FormulonCApiStyles, CustomNumFmtOverridingBuiltinIdWins) {
-  // A file may define a custom <numFmt> whose numFmtId collides with a
-  // built-in slot; Excel honours the file's definition. Parse a production-
-  // shaped styles.xml and install the resulting table rather than manually
-  // constructing the record.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadNumFmtOverrideStyles(wb.handle));
-
-  const char* s = nullptr;
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14, &s), 0);
-  ASSERT_NE(s, nullptr);
-  EXPECT_STREQ(s, "yyyy");
-}
-
-TEST(FormulonCApiStyles, AddNumFmtUsesEffectiveBuiltinMapping) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadNumFmtOverrideStyles(wb.handle));
-
-  const char* resolved = nullptr;
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
-  ASSERT_NE(resolved, nullptr);
-  EXPECT_STREQ(resolved, "yyyy");
-
-  uint16_t override_id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "yyyy", &override_id), 0);
-  EXPECT_EQ(override_id, 14U);
-
-  uint16_t builtin_code_id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "mm-dd-yy", &builtin_code_id), 0);
-  EXPECT_GE(builtin_code_id, 164U);
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, builtin_code_id, &resolved), 0);
-  ASSERT_NE(resolved, nullptr);
-  EXPECT_STREQ(resolved, "mm-dd-yy");
-
-  uint16_t builtin_code_again = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "mm-dd-yy", &builtin_code_again), 0);
-  EXPECT_EQ(builtin_code_again, builtin_code_id);
-}
-
-TEST(FormulonCApiStyles, AddBatchNumFmtUsesEffectiveBuiltinMapping) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadNumFmtOverrideStyles(wb.handle));
-
-  const char* const codes[] = {"General", "yyyy", "mm-dd-yy", "mm-dd-yy"};
-  uint16_t ids[] = {0xFFFFU, 0xFFFFU, 0xFFFFU, 0xFFFFU};
-  fm_styles_batch batch{};
-  batch.num_fmt_codes = codes;
-  batch.num_fmt_count = 4U;
-  batch.num_fmt_ids = ids;
-
-  ASSERT_EQ(fm_styles_add_batch(wb.handle, &batch), 0);
-  EXPECT_EQ(ids[0], 0U);
-  EXPECT_EQ(ids[1], 14U);
-  EXPECT_GE(ids[2], 164U);
-  EXPECT_EQ(ids[3], ids[2]);
-  for (size_t i = 0; i < 4U; ++i) {
-    const char* resolved = nullptr;
-    ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, ids[i], &resolved), 0);
-    ASSERT_NE(resolved, nullptr);
-    EXPECT_STREQ(resolved, codes[i]);
-  }
-}
-
-TEST(FormulonCApiStyles, InvalidCustomNumFmtStringIndexDoesNotShadowBuiltin) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadNumFmtOverrideStyles(wb.handle));
-
-  auto& styles = wb.handle->workbook().mutable_styles();
-  ASSERT_EQ(styles.num_fmts.size(), 1U);
-  styles.num_fmts[0].format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
-
-  const char* resolved = nullptr;
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
-  ASSERT_NE(resolved, nullptr);
-  EXPECT_STREQ(resolved, "mm-dd-yy");
-
-  uint16_t id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "mm-dd-yy", &id), 0);
-  EXPECT_EQ(id, 14U);
-}
-
-TEST(FormulonCApiStyles, DuplicateNumFmtFirstValidRecordWins) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadNumFmtDuplicateStyles(wb.handle));
-
-  const char* resolved = nullptr;
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
-  ASSERT_NE(resolved, nullptr);
-  EXPECT_STREQ(resolved, "yyyy");
-
-  uint16_t first_id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "yyyy", &first_id), 0);
-  EXPECT_EQ(first_id, 14U);
-
-  uint16_t shadowed_id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "dd/mm/yyyy", &shadowed_id), 0);
-  EXPECT_GE(shadowed_id, 164U);
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, shadowed_id, &resolved), 0);
-  ASSERT_NE(resolved, nullptr);
-  EXPECT_STREQ(resolved, "dd/mm/yyyy");
-}
-
-TEST(FormulonCApiStyles, DuplicateNumFmtInvalidFirstThenValidRecordWins) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadNumFmtDuplicateStyles(wb.handle));
-
-  auto& styles = wb.handle->workbook().mutable_styles();
-  ASSERT_EQ(styles.num_fmts.size(), 2U);
-  styles.num_fmts[0].format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
-
-  const char* resolved = nullptr;
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
-  ASSERT_NE(resolved, nullptr);
-  EXPECT_STREQ(resolved, "dd/mm/yyyy");
-
-  uint16_t valid_id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "dd/mm/yyyy", &valid_id), 0);
-  EXPECT_EQ(valid_id, 14U);
-
-  uint16_t invalid_id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "yyyy", &invalid_id), 0);
-  EXPECT_GE(invalid_id, 164U);
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, invalid_id, &resolved), 0);
-  ASSERT_NE(resolved, nullptr);
-  EXPECT_STREQ(resolved, "yyyy");
-}
-
-TEST(FormulonCApiStyles, DuplicateNumFmtAllInvalidRecordsFallBackToBuiltin) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadNumFmtDuplicateStyles(wb.handle));
-
-  auto& styles = wb.handle->workbook().mutable_styles();
-  ASSERT_EQ(styles.num_fmts.size(), 2U);
-  const std::uint32_t invalid_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
-  for (auto& record : styles.num_fmts) {
-    record.format_string_index = invalid_index;
-  }
-
-  const char* resolved = nullptr;
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14U, &resolved), 0);
-  ASSERT_NE(resolved, nullptr);
-  EXPECT_STREQ(resolved, "mm-dd-yy");
-
-  uint16_t builtin_id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "mm-dd-yy", &builtin_id), 0);
-  EXPECT_EQ(builtin_id, 14U);
-}
-
-TEST(FormulonCApiStyles, UnknownNumFmtIdRejected) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  const char* s = nullptr;
-  // Reserved built-in slot (id 5) without a custom override surfaces
-  // an error rather than an empty string.
-  EXPECT_NE(fm_styles_get_num_fmt_string(wb.handle, 5, &s), 0);
-}
-
-TEST(FormulonCApiStyles, DifferentialFormatGetterExposesCfDxfTable) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  formulon::StylesTable& styles = wb.handle->workbook().mutable_styles();
-  formulon::DifferentialFormat dxf;
-  dxf.has_font = true;
-  dxf.font.bold = true;
-  dxf.font.color_argb = 0xFFFF0000U;
-  dxf.has_fill = true;
-  dxf.fill.pattern = 1;
-  dxf.fill.fg_argb = 0xFFFFFF00U;
-  dxf.has_border = true;
-  dxf.border.left.style = 1;
-  dxf.border.left.color_argb = 0xFF000000U;
-  dxf.has_num_fmt = true;
-  dxf.num_fmt_id = 164;
-  dxf.num_fmt_code = "0.00";
-  styles.dxfs.push_back(dxf);
-
-  uint32_t count = 0;
-  ASSERT_EQ(fm_styles_get_dxf_count(wb.handle, &count), 0);
-  EXPECT_EQ(count, 1U);
-
-  fm_dxf_record out{};
-  ASSERT_EQ(fm_styles_get_dxf(wb.handle, 0, &out), 0);
-  EXPECT_EQ(out.font_engaged, 1);
-  EXPECT_EQ(out.font.bold, 1);
-  EXPECT_EQ(out.font.color_argb, 0xFFFF0000U);
-  EXPECT_EQ(out.fill_engaged, 1);
-  EXPECT_EQ(out.fill.pattern, 1U);
-  EXPECT_EQ(out.fill.fg_argb, 0xFFFFFF00U);
-  EXPECT_EQ(out.border_engaged, 1);
-  EXPECT_EQ(out.border.left.style, 1U);
-  EXPECT_EQ(out.border.left.color_argb, 0xFF000000U);
-  EXPECT_EQ(out.num_fmt_engaged, 1);
-  EXPECT_EQ(out.num_fmt_id, 164U);
-  ASSERT_NE(out.num_fmt_code, nullptr);
-  EXPECT_STREQ(out.num_fmt_code, "0.00");
-
-  EXPECT_NE(fm_styles_get_dxf(wb.handle, 1, &out), 0);
-}
-
-TEST(FormulonCApiStyles, AddDxfDedupsAndReadsBack) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_dxf_record dxf{};
-  dxf.font_engaged = 1;
-  dxf.font.name = "Arial";
-  dxf.font.size = 12.0;
-  dxf.font.bold = 1;
-  dxf.font.color_argb = 0xFFFF0000U;
-  dxf.fill_engaged = 1;
-  dxf.fill.pattern = 1;
-  dxf.fill.fg_argb = 0xFFFFFF00U;
-  dxf.num_fmt_engaged = 1;
-  dxf.num_fmt_id = 164;
-  dxf.num_fmt_code = "0.00";
-
-  uint32_t a = 0xFFFFFFFFU;
-  uint32_t b = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, dxf, &a), 0);
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, dxf, &b), 0);
-  EXPECT_EQ(a, b);
-
-  uint32_t count = 0;
-  ASSERT_EQ(fm_styles_get_dxf_count(wb.handle, &count), 0);
-  EXPECT_EQ(count, 1U);
-
-  fm_dxf_record out{};
-  ASSERT_EQ(fm_styles_get_dxf(wb.handle, a, &out), 0);
-  EXPECT_EQ(out.font_engaged, 1);
-  EXPECT_STREQ(out.font.name, "Arial");
-  EXPECT_EQ(out.font.bold, 1);
-  EXPECT_EQ(out.font.color_argb, 0xFFFF0000U);
-  EXPECT_EQ(out.fill_engaged, 1);
-  EXPECT_EQ(out.fill.pattern, 1U);
-  EXPECT_EQ(out.fill.fg_argb, 0xFFFFFF00U);
-  EXPECT_EQ(out.num_fmt_engaged, 1);
-  EXPECT_EQ(out.num_fmt_id, 164U);
-  ASSERT_NE(out.num_fmt_code, nullptr);
-  EXPECT_STREQ(out.num_fmt_code, "0.00");
-}
-
-TEST(FormulonCApiStyles, DxfFontRoundTripsVerticalAlignmentThroughOoxml) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_dxf_record dxf{};
-  dxf.font_engaged = 1;
-  dxf.font.name = "Calibri";
-  dxf.font.size = 9.0;
-  dxf.font.color_argb = 0xFF112233U;
-  dxf.font.vert_align = 1;  // superscript
-  uint32_t index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, dxf, &index), 0);
-
-  const std::string xml = formulon::io::write_styles(wb.handle->workbook().styles());
-  EXPECT_NE(xml.find("<vertAlign val=\"superscript\"/>"), std::string::npos);
-
-  fm_dxf_record loaded{};
-  ASSERT_EQ(fm_styles_get_dxf(wb.handle, index, &loaded), 0);
-  EXPECT_EQ(loaded.font.vert_align, 1U);
-
-  uint32_t count_before = 0;
-  ASSERT_EQ(fm_styles_get_dxf_count(wb.handle, &count_before), 0);
-  uint32_t reindex = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, loaded, &reindex), 0);
-  EXPECT_EQ(reindex, index);
-  uint32_t count_after = 0;
-  ASSERT_EQ(fm_styles_get_dxf_count(wb.handle, &count_after), 0);
-  EXPECT_EQ(count_after, count_before);
-}
-
-TEST(FormulonCApiStyles, DxfAlignmentAndProtectionPreserveIdentityThroughOoxml) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  std::string alignment_input = "<alignment horizontal=\"center\" wrapText=\"1\"/>";
-  std::string protection_input = "<protection locked=\"0\" hidden=\"1\"/>";
-  fm_dxf_record alignment{};
-  alignment.alignment_xml = alignment_input.c_str();
-  fm_dxf_record protection{};
-  protection.protection_xml = protection_input.c_str();
-
-  uint32_t alignment_index = 0xFFFFFFFFU;
-  uint32_t protection_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, alignment, &alignment_index), 0);
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, protection, &protection_index), 0);
-  EXPECT_NE(alignment_index, protection_index);
-  alignment_input = "caller-owned alignment text replaced";
-  protection_input = "caller-owned protection text replaced";
-
-  fm_dxf_record got_alignment{};
-  fm_dxf_record got_protection{};
-  ASSERT_EQ(fm_styles_get_dxf(wb.handle, alignment_index, &got_alignment), 0);
-  ASSERT_EQ(fm_styles_get_dxf(wb.handle, protection_index, &got_protection), 0);
-  ASSERT_NE(got_alignment.alignment_xml, nullptr);
-  ASSERT_NE(got_alignment.protection_xml, nullptr);
-  ASSERT_NE(got_protection.alignment_xml, nullptr);
-  ASSERT_NE(got_protection.protection_xml, nullptr);
-  EXPECT_STREQ(got_alignment.alignment_xml, "<alignment horizontal=\"center\" wrapText=\"1\"/>");
-  EXPECT_STREQ(got_alignment.protection_xml, "");
-  EXPECT_STREQ(got_protection.alignment_xml, "");
-  EXPECT_STREQ(got_protection.protection_xml, "<protection locked=\"0\" hidden=\"1\"/>");
-
-  uint32_t alignment_again = 0xFFFFFFFFU;
-  uint32_t protection_again = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, got_alignment, &alignment_again), 0);
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, got_protection, &protection_again), 0);
-  EXPECT_EQ(alignment_again, alignment_index);
-  EXPECT_EQ(protection_again, protection_index);
-
-  const std::string before_save = formulon::io::write_styles(wb.handle->workbook().styles());
-  EXPECT_NE(before_save.find("<alignment horizontal=\"center\" wrapText=\"1\"/>"), std::string::npos);
-  EXPECT_NE(before_save.find("<protection locked=\"0\" hidden=\"1\"/>"), std::string::npos);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-
-  fm_dxf_record reloaded_alignment{};
-  fm_dxf_record reloaded_protection{};
-  ASSERT_EQ(fm_styles_get_dxf(reloaded.handle, alignment_index, &reloaded_alignment), 0);
-  ASSERT_EQ(fm_styles_get_dxf(reloaded.handle, protection_index, &reloaded_protection), 0);
-  EXPECT_STREQ(reloaded_alignment.alignment_xml, "<alignment horizontal=\"center\" wrapText=\"1\"/>");
-  EXPECT_STREQ(reloaded_alignment.protection_xml, "");
-  EXPECT_STREQ(reloaded_protection.alignment_xml, "");
-  EXPECT_STREQ(reloaded_protection.protection_xml, "<protection locked=\"0\" hidden=\"1\"/>");
-
-  uint32_t reloaded_alignment_again = 0xFFFFFFFFU;
-  uint32_t reloaded_protection_again = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(reloaded.handle, reloaded_alignment, &reloaded_alignment_again), 0);
-  ASSERT_EQ(fm_styles_add_dxf(reloaded.handle, reloaded_protection, &reloaded_protection_again), 0);
-  EXPECT_EQ(reloaded_alignment_again, alignment_index);
-  EXPECT_EQ(reloaded_protection_again, protection_index);
-
-  const std::string after_load = formulon::io::write_styles(reloaded.handle->workbook().styles());
-  EXPECT_NE(after_load.find("<alignment horizontal=\"center\" wrapText=\"1\"/>"), std::string::npos);
-  EXPECT_NE(after_load.find("<protection locked=\"0\" hidden=\"1\"/>"), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, DxfFontDistinguishesAnExplicitBoldOffFromAnAbsentToggle) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  formulon::DifferentialFormat stored;
-  stored.has_font = true;
-  stored.font.has_bold = true;  // `<b val="0"/>`: switch bold off
-  stored.font.bold = false;
-  wb.handle->workbook().mutable_styles().dxfs.push_back(stored);
-
-  // A rule that leaves bold alone must not fold onto the switch-it-off one.
-  fm_dxf_record leave_bold_alone{};
-  leave_bold_alone.font_engaged = 1;
-  leave_bold_alone.font.name = "";
-  leave_bold_alone.font.size = 11.0;
-  leave_bold_alone.font.color_argb = 0xFF000000U;
-  uint32_t index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, leave_bold_alone, &index), 0);
-  EXPECT_NE(index, 0U);
-
-  const std::string xml = formulon::io::write_styles(wb.handle->workbook().styles());
-  EXPECT_NE(xml.find("<b val=\"0\"/>"), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, GetCellXfRejectsOutOfRange) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cell_xf xf{};
-  // A fresh workbook seeds one default xf, so index 0 resolves and index
-  // 1 is the first out-of-range one.
-  EXPECT_EQ(fm_styles_get_cell_xf(wb.handle, 0, &xf), 0);
-  EXPECT_NE(fm_styles_get_cell_xf(wb.handle, 1, &xf), 0);
-}
-
-TEST(FormulonCApiStyles, CellXfGetterDiagnosticsUseInvokedApi) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  auto expect_prefix = [](fm_status_t status, const char* prefix) {
-    EXPECT_NE(status, 0);
-    const char* message = fm_last_error_message();
-    ASSERT_NE(message, nullptr);
-    EXPECT_EQ(std::string(message).rfind(prefix, 0), 0U) << message;
-  };
-
-  // Index 1 is past both seeded single-entry tables, so each getter takes
-  // its out-of-range path and must name itself in the diagnostic.
-  fm_cell_xf cell_xf{};
-  expect_prefix(fm_styles_get_cell_xf(wb.handle, 1, &cell_xf), "fm_styles_get_cell_xf:");
-  expect_prefix(fm_styles_get_cell_style_xf(wb.handle, 1, &cell_xf), "fm_styles_get_cell_style_xf:");
-}
-
-TEST(FormulonCApiStyles, CellXfAdderDiagnosticsUseInvokedApi) {
-  auto expect_prefix = [](fm_status_t status, const char* prefix) {
-    EXPECT_NE(status, 0);
-    const char* message = fm_last_error_message();
-    ASSERT_NE(message, nullptr);
-    EXPECT_EQ(std::string(message).rfind(prefix, 0), 0U) << message;
-  };
-
-  uint32_t index = 0;
-  fm_cell_xf cell_xf{};
-  expect_prefix(fm_styles_add_cell_xf(nullptr, cell_xf, &index), "fm_styles_add_cell_xf:");
-
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  cell_xf.font_index = 1U;
-  expect_prefix(fm_styles_add_cell_xf(wb.handle, cell_xf, &index), "fm_styles_add_cell_xf:");
-
-  cell_xf = fm_cell_xf{};
-  cell_xf.xf_id = 1U;
-  expect_prefix(fm_styles_add_cell_xf(wb.handle, cell_xf, &index), "fm_styles_add_cell_xf:");
-
-  cell_xf = fm_cell_xf{};
-  cell_xf.has_text_rotation = 1;
-  cell_xf.text_rotation = 181U;
-  expect_prefix(fm_styles_add_cell_xf(wb.handle, cell_xf, &index), "fm_styles_add_cell_xf:");
-}
-
-TEST(FormulonCApiStyles, CellXfAlignmentEnumsValidateRangesBeforeMutation) {
-  const auto expect_invalid = [](fm_status_t status, const char* api) {
-    EXPECT_EQ(status, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-    const char* message = fm_last_error_message();
-    ASSERT_NE(message, nullptr);
-    EXPECT_EQ(std::string(message).rfind(api, 0), 0U) << message;
-  };
-
-  // The upper boundary of each ordinal is accepted.
-  {
-    WorkbookGuard wb;
-    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-    fm_cell_xf record{};
-    record.horizontal_align = 7;  // distributed
-    record.has_horizontal_align = 1;
-    record.vertical_align = 4;  // distributed
-    record.has_vertical_align = 1;
-    uint32_t index = 0;
-    ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, record, &index), 0);
-  }
-
-  // The presence flag decides whether a value is read at all, so an
-  // out-of-range ordinal on an omitted attribute is ignored rather than
-  // rejected: the record it describes has no such attribute to be invalid.
-  {
-    WorkbookGuard wb;
-    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-    fm_cell_xf record{};
-    record.horizontal_align = 8;
-    record.vertical_align = 5;
-    uint32_t index = 0xAABBCCDDU;
-    ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, record, &index), 0);
-    EXPECT_NE(index, 0xAABBCCDDU);
-    fm_cell_xf got{};
-    ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, index, &got), 0);
-    EXPECT_EQ(got.horizontal_align, 0U);
-    EXPECT_EQ(got.vertical_align, 2U);
-  }
-
-  // Every add shape validates before it creates default roots or changes the
-  // output index. Keep each case isolated so the size checks cover all paths.
-  {
-    WorkbookGuard wb;
-    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-    fm_cell_xf record{};
-    record.horizontal_align = 8;
-    record.has_horizontal_align = 1;
-    uint32_t index = 0xAABBCCDDU;
-    const std::size_t before = wb.handle->workbook().styles().cell_xfs.size();
-    expect_invalid(fm_styles_add_cell_xf(wb.handle, record, &index), "fm_styles_add_cell_xf:");
-    EXPECT_EQ(index, 0xAABBCCDDU);
-    EXPECT_EQ(wb.handle->workbook().styles().cell_xfs.size(), before);
-  }
-  {
-    WorkbookGuard wb;
-    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-    fm_cell_xf record{};
-    record.vertical_align = 5;
-    record.has_vertical_align = 1;
-    uint32_t index = 0xAABBCCDDU;
-    const std::size_t before = wb.handle->workbook().styles().cell_style_xfs.size();
-    expect_invalid(fm_styles_add_cell_style_xf(wb.handle, record, &index), "fm_styles_add_cell_style_xf:");
-    EXPECT_EQ(index, 0xAABBCCDDU);
-    EXPECT_EQ(wb.handle->workbook().styles().cell_style_xfs.size(), before);
-  }
-  {
-    WorkbookGuard wb;
-    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-    fm_cell_xf record{};
-    record.horizontal_align = 8;
-    record.has_horizontal_align = 1;
-    uint32_t indices[] = {0xAABBCCDDU};
-    const fm_styles_batch batch{nullptr, 0U,      nullptr, nullptr, 0U,      nullptr, nullptr, 0U,
-                                nullptr, &record, 1U,      indices, nullptr, 0U,      nullptr};
-    const std::size_t before = wb.handle->workbook().styles().cell_xfs.size();
-    expect_invalid(fm_styles_add_batch(wb.handle, &batch), "fm_styles_add_batch:");
-    EXPECT_EQ(indices[0], 0xAABBCCDDU);
-    EXPECT_EQ(wb.handle->workbook().styles().cell_xfs.size(), before);
-  }
-  // A batch record naming a `<cellStyleXfs>` entry that does not exist is
-  // rejected rather than emitted as a dangling `xfId`.
-  {
-    WorkbookGuard wb;
-    ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-    fm_cell_xf record{};
-    record.xf_id = 3U;
-    uint32_t indices[] = {0xAABBCCDDU};
-    const fm_styles_batch batch{nullptr, 0U,      nullptr, nullptr, 0U,      nullptr, nullptr, 0U,
-                                nullptr, &record, 1U,      indices, nullptr, 0U,      nullptr};
-    expect_invalid(fm_styles_add_batch(wb.handle, &batch), "fm_styles_add_batch:");
-    EXPECT_EQ(indices[0], 0xAABBCCDDU);
-  }
-}
-
-TEST(FormulonCApiStyles, SetThenSaveLoadPreservesXfIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  // Register the xf records the stamp below names. A `<c s="7">` against
-  // a shorter `<cellXfs>` resolves to no style, so the reader falls back
-  // to the default rather than handing back an index whose record
-  // `fm_styles_get_cell_xf` would then refuse to return.
-  wb.handle->workbook().mutable_styles().cell_xfs.resize(8);
-
-  // Stamp xf_index = 7 on cell A1 and save.
-  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 3.14), 0);
-  EXPECT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, 7), 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-
-  WorkbookGuard wb2;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &wb2.handle), 0);
-  uint32_t xf = 0;
-  EXPECT_EQ(fm_cell_get_xf_index(wb2.handle, 0, 0, 0, &xf), 0);
-  EXPECT_EQ(xf, 7U);
-}
-
-// ---- Add-side dedup primitives -------------------------------------
-
-namespace {
-
-fm_font_record MakeArial() {
-  fm_font_record r{};
-  r.name = "Arial";
-  r.size = 12.0;
-  r.color_argb = 0xFF112233U;
-  r.bold = 1;
-  r.italic = 0;
-  r.strike = 0;
-  r.underline = 0;
-  return r;
-}
-
-fm_fill_record MakeRedFill() {
-  fm_fill_record r{};
-  r.pattern = 1;  // solid
-  r.fg_argb = 0xFFFF0000U;
-  r.bg_argb = 0xFF000000U;
-  return r;
-}
-
-fm_border_record MakeThinBoxBorder() {
-  fm_border_record r{};
-  r.left.style = 1;  // thin
-  r.left.color_argb = 0xFF000000U;
-  r.right = r.left;
-  r.top = r.left;
-  r.bottom = r.left;
-  r.diagonal.style = 0;
-  r.diagonal.color_argb = 0;
-  r.diagonal_up = 0;
-  r.diagonal_down = 0;
-  return r;
-}
-
-}  // namespace
-
-TEST(FormulonCApiStyles, AddFontDedupReturnsExistingIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t a = 0xFFFFFFFFU;
-  uint32_t b = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &a), 0);
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &b), 0);
-  EXPECT_EQ(a, b);
-}
-
-TEST(FormulonCApiStyles, AddFontDistinctReturnsNewIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t a = 0;
-  uint32_t b = 0;
-  fm_font_record arial = MakeArial();
-  fm_font_record calibri = MakeArial();
-  calibri.name = "Calibri";
-  ASSERT_EQ(fm_styles_add_font(wb.handle, arial, &a), 0);
-  ASSERT_EQ(fm_styles_add_font(wb.handle, calibri, &b), 0);
-  EXPECT_NE(a, b);
-}
-
-TEST(FormulonCApiStyles, AddFontGrowsTable) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t before = 0;
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &before), 0);
-  uint32_t idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &idx), 0);
-  uint32_t after = 0;
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &after), 0);
-  // A new workbook seeds the default font at index 0, so the caller's
-  // first font lands at index 1.
-  EXPECT_EQ(before, 1U);
-  EXPECT_EQ(after, 2U);
-  EXPECT_EQ(idx, 1U);
-  // Round-trip: the freshly added font should read back equal.
-  fm_font_record out{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, idx, &out), 0);
-  EXPECT_STREQ(out.name, "Arial");
-  EXPECT_DOUBLE_EQ(out.size, 12.0);
-  EXPECT_EQ(out.color_argb, 0xFF112233U);
-  EXPECT_EQ(out.bold, 1);
-}
-
-TEST(FormulonCApiStyles, GetFontRoundTripIsIdentityForSuperscript) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_font_record superscript = MakeArial();
-  superscript.vert_align = 1;
-  uint32_t idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, superscript, &idx), 0);
-
-  fm_font_record loaded{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, idx, &loaded), 0);
-  EXPECT_STREQ(loaded.name, "Arial");
-  EXPECT_EQ(loaded.vert_align, 1U);
-
-  uint32_t count_before = 0;
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count_before), 0);
-  uint32_t reindex = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, loaded, &reindex), 0);
-  EXPECT_EQ(reindex, idx);
-  uint32_t count_after = 0;
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count_after), 0);
-  EXPECT_EQ(count_after, count_before);
-}
-
-TEST(FormulonCApiStyles, GetEditAddFontPreservesTheUneditedFields) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_font_record superscript = MakeArial();
-  superscript.vert_align = 1;
-  superscript.has_family = 1;
-  superscript.family = 2;
-  superscript.has_charset = 1;
-  superscript.charset = 128;
-  uint32_t idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, superscript, &idx), 0);
-
-  fm_font_record edited{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, idx, &edited), 0);
-  edited.color_argb = 0xFF00FF00U;
-  uint32_t recolored = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, edited, &recolored), 0);
-  EXPECT_NE(recolored, idx);
-
-  fm_font_record reread{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, recolored, &reread), 0);
-  EXPECT_EQ(reread.color_argb, 0xFF00FF00U);
-  EXPECT_EQ(reread.vert_align, 1U);
-  EXPECT_EQ(reread.has_family, 1);
-  EXPECT_EQ(reread.family, 2U);
-  EXPECT_EQ(reread.has_charset, 1);
-  EXPECT_EQ(reread.charset, 128U);
-}
-
-namespace {
-
-// An Excel-authored `<fonts>` section: the theme colour, `<family>` and
-// `<charset>` children are what a template carries and what a record built
-// from scratch through the C ABI cannot reproduce unless the ABI exposes
-// them.
-constexpr char kExcelAuthoredStyles[] =
-    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
-    "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
-    "<fonts count=\"3\">"
-    "<font><sz val=\"11\"/><color theme=\"1\"/><name val=\"Calibri\"/><family val=\"2\"/>"
-    "<charset val=\"128\"/></font>"
-    "<font><b/><sz val=\"11\"/><color theme=\"0\" tint=\"-0.25\"/><name val=\"Calibri\"/>"
-    "<family val=\"2\"/></font>"
-    "<font><vertAlign val=\"superscript\"/><sz val=\"9\"/><color rgb=\"FF112233\"/>"
-    "<name val=\"Calibri\"/></font>"
-    "</fonts>"
-    "<fills count=\"2\">"
-    "<fill><patternFill patternType=\"none\"/></fill>"
-    "<fill><patternFill patternType=\"solid\"><fgColor theme=\"4\" tint=\"0.5\"/>"
-    "<bgColor indexed=\"64\"/></patternFill></fill>"
-    "</fills>"
-    "<borders count=\"2\">"
-    "<border><left/><right/><top/><bottom/><diagonal/></border>"
-    "<border><left style=\"thin\"><color theme=\"3\"/></left><right/><top/><bottom/>"
-    "<diagonal/></border>"
-    "</borders>"
-    "<cellXfs count=\"1\"><xf numFmtId=\"0\" fontId=\"0\" fillId=\"0\" borderId=\"0\"/></cellXfs>"
-    "</styleSheet>";
-
-/// Installs `kExcelAuthoredStyles` as the workbook's styles table.
-void LoadExcelAuthoredStyles(fm_workbook_t* handle) {
-  const std::vector<std::uint8_t> bytes(kExcelAuthoredStyles, kExcelAuthoredStyles + std::strlen(kExcelAuthoredStyles));
-  auto parsed = formulon::io::read_styles(bytes);
-  ASSERT_TRUE(parsed.has_value());
-  handle->workbook().mutable_styles() = std::move(parsed.value());
-}
-
-}  // namespace
-
-TEST(FormulonCApiStyles, AddFontIsIdentityAgainstAFileLoadedTable) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadExcelAuthoredStyles(wb.handle));
-
-  uint32_t count = 0;
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count), 0);
-  ASSERT_EQ(count, 3U);
-  for (uint32_t i = 0; i < count; ++i) {
-    fm_font_record loaded{};
-    ASSERT_EQ(fm_styles_get_font(wb.handle, i, &loaded), 0) << "font " << i;
-    uint32_t reindex = 0xFFFFFFFFU;
-    ASSERT_EQ(fm_styles_add_font(wb.handle, loaded, &reindex), 0) << "font " << i;
-    EXPECT_EQ(reindex, i);
-  }
-  uint32_t count_after = 0;
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count_after), 0);
-  EXPECT_EQ(count_after, count);
-}
-
-TEST(FormulonCApiStyles, AddFillAndBorderAreIdentityAgainstAFileLoadedTable) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadExcelAuthoredStyles(wb.handle));
-
-  uint32_t fills = 0;
-  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &fills), 0);
-  ASSERT_EQ(fills, 2U);
-  for (uint32_t i = 0; i < fills; ++i) {
-    fm_fill_record loaded{};
-    ASSERT_EQ(fm_styles_get_fill(wb.handle, i, &loaded), 0) << "fill " << i;
-    uint32_t reindex = 0xFFFFFFFFU;
-    ASSERT_EQ(fm_styles_add_fill(wb.handle, loaded, &reindex), 0) << "fill " << i;
-    EXPECT_EQ(reindex, i);
-  }
-
-  uint32_t borders = 0;
-  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &borders), 0);
-  ASSERT_EQ(borders, 2U);
-  for (uint32_t i = 0; i < borders; ++i) {
-    fm_border_record loaded{};
-    ASSERT_EQ(fm_styles_get_border(wb.handle, i, &loaded), 0) << "border " << i;
-    uint32_t reindex = 0xFFFFFFFFU;
-    ASSERT_EQ(fm_styles_add_border(wb.handle, loaded, &reindex), 0) << "border " << i;
-    EXPECT_EQ(reindex, i);
-  }
-
-  uint32_t fills_after = 0;
-  uint32_t borders_after = 0;
-  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &fills_after), 0);
-  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &borders_after), 0);
-  EXPECT_EQ(fills_after, fills);
-  EXPECT_EQ(borders_after, borders);
-}
-
-TEST(FormulonCApiStyles, AddFontDoesNotAliasAThemeColourOntoLiteralRgb) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadExcelAuthoredStyles(wb.handle));
-
-  // Font 0 is `<color theme="1"/>`. Its sibling ARGB is only a compatibility
-  // fallback, so folding it together with a caller's literal RGB record
-  // would lose the selector and change the template's body text semantics.
-  fm_font_record themed{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, 0U, &themed), 0);
-  ASSERT_EQ(themed.color.kind, static_cast<uint8_t>(kFmColorTheme));
-
-  fm_font_record literal_rgb = themed;
-  literal_rgb.color = fm_color_spec{};
-  uint32_t index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, literal_rgb, &index), 0);
-  EXPECT_NE(index, 0U);
-
-  // The theme record is untouched and still serialises as a theme colour.
-  const std::string xml = formulon::io::write_styles(wb.handle->workbook().styles());
-  EXPECT_NE(xml.find("<color theme=\"1\"/>"), std::string::npos);
-  EXPECT_NE(xml.find("<color theme=\"0\" tint=\"-0.25\"/>"), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, AddFillAndBorderDistinguishColourSpecifications) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NO_FATAL_FAILURE(LoadExcelAuthoredStyles(wb.handle));
-
-  fm_fill_record themed_fill{};
-  ASSERT_EQ(fm_styles_get_fill(wb.handle, 1U, &themed_fill), 0);
-  ASSERT_EQ(themed_fill.fg.kind, static_cast<uint8_t>(kFmColorTheme));
-  fm_fill_record literal_fill = themed_fill;
-  literal_fill.fg = fm_color_spec{};
-  literal_fill.fg_argb = themed_fill.fg_argb;
-  uint32_t fill_index = 0;
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, literal_fill, &fill_index), 0);
-  EXPECT_NE(fill_index, 1U);
-
-  fm_border_record themed_border{};
-  ASSERT_EQ(fm_styles_get_border(wb.handle, 1U, &themed_border), 0);
-  ASSERT_EQ(themed_border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
-  fm_border_record literal_border = themed_border;
-  literal_border.left.color = fm_color_spec{};
-  uint32_t border_index = 0;
-  ASSERT_EQ(fm_styles_add_border(wb.handle, literal_border, &border_index), 0);
-  EXPECT_NE(border_index, 1U);
-
-  const std::string xml = formulon::io::write_styles(wb.handle->workbook().styles());
-  EXPECT_NE(xml.find("<fgColor theme=\"4\" tint=\"0.5\"/>"), std::string::npos);
-  EXPECT_NE(xml.find("<bgColor indexed=\"64\"/>"), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, SelectorColoursRemainAuthoritativeAcrossGetAddAndSaveLoad) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_color_spec theme{};
-  theme.kind = static_cast<uint8_t>(kFmColorTheme);
-  theme.theme = 3U;
-  theme.tint = 0.5;
-  fm_color_spec indexed{};
-  indexed.kind = static_cast<uint8_t>(kFmColorIndexed);
-  indexed.indexed = 9U;
-  fm_color_spec automatic{};
-  automatic.kind = static_cast<uint8_t>(kFmColorAuto);
-
-  fm_font_record font = MakeArial();
-  font.color_argb = 0x01020304U;  // compatibility fallback, not a render result
-  font.color = theme;
-  uint32_t font_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, font, &font_index), 0);
-  fm_font_record got_font{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, font_index, &got_font), 0);
-  EXPECT_EQ(got_font.color.kind, static_cast<uint8_t>(kFmColorTheme));
-  EXPECT_EQ(got_font.color.theme, 3U);
-  EXPECT_DOUBLE_EQ(got_font.color.tint, 0.5);
-  EXPECT_EQ(got_font.color_argb, 0x01020304U);
-  uint32_t font_again = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, got_font, &font_again), 0);
-  EXPECT_EQ(font_again, font_index);
-
-  fm_fill_record fill = MakeRedFill();
-  fill.fg_argb = 0x05060708U;
-  fill.bg_argb = 0x090A0B0CU;
-  fill.fg = indexed;
-  fill.bg = automatic;
-  uint32_t fill_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, fill, &fill_index), 0);
-  fm_fill_record got_fill{};
-  ASSERT_EQ(fm_styles_get_fill(wb.handle, fill_index, &got_fill), 0);
-  EXPECT_EQ(got_fill.fg.kind, static_cast<uint8_t>(kFmColorIndexed));
-  EXPECT_EQ(got_fill.fg.indexed, 9U);
-  EXPECT_EQ(got_fill.bg.kind, static_cast<uint8_t>(kFmColorAuto));
-  uint32_t fill_again = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, got_fill, &fill_again), 0);
-  EXPECT_EQ(fill_again, fill_index);
-
-  fm_border_record border = MakeThinBoxBorder();
-  border.left.color = theme;
-  border.right.color = indexed;
-  uint32_t border_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_border(wb.handle, border, &border_index), 0);
-  fm_border_record got_border{};
-  ASSERT_EQ(fm_styles_get_border(wb.handle, border_index, &got_border), 0);
-  EXPECT_EQ(got_border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
-  EXPECT_EQ(got_border.left.color.theme, 3U);
-  EXPECT_EQ(got_border.right.color.kind, static_cast<uint8_t>(kFmColorIndexed));
-  EXPECT_EQ(got_border.right.color.indexed, 9U);
-  uint32_t border_again = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_border(wb.handle, got_border, &border_again), 0);
-  EXPECT_EQ(border_again, border_index);
-
-  fm_dxf_record dxf{};
-  dxf.font_engaged = 1;
-  dxf.font = font;
-  dxf.font.color = automatic;
-  dxf.fill_engaged = 1;
-  dxf.fill = fill;
-  dxf.border_engaged = 1;
-  dxf.border = border;
-  uint32_t dxf_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, dxf, &dxf_index), 0);
-  fm_dxf_record got_dxf{};
-  ASSERT_EQ(fm_styles_get_dxf(wb.handle, dxf_index, &got_dxf), 0);
-  EXPECT_EQ(got_dxf.font.color.kind, static_cast<uint8_t>(kFmColorAuto));
-  EXPECT_EQ(got_dxf.fill.fg.kind, static_cast<uint8_t>(kFmColorIndexed));
-  EXPECT_EQ(got_dxf.border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
-  uint32_t dxf_again = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_dxf(wb.handle, got_dxf, &dxf_again), 0);
-  EXPECT_EQ(dxf_again, dxf_index);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-
-  fm_font_record reloaded_font{};
-  ASSERT_EQ(fm_styles_get_font(reloaded.handle, font_index, &reloaded_font), 0);
-  EXPECT_EQ(reloaded_font.color.kind, static_cast<uint8_t>(kFmColorTheme));
-  EXPECT_EQ(reloaded_font.color.theme, 3U);
-  EXPECT_DOUBLE_EQ(reloaded_font.color.tint, 0.5);
-  fm_fill_record reloaded_fill{};
-  ASSERT_EQ(fm_styles_get_fill(reloaded.handle, fill_index, &reloaded_fill), 0);
-  EXPECT_EQ(reloaded_fill.fg.kind, static_cast<uint8_t>(kFmColorIndexed));
-  EXPECT_EQ(reloaded_fill.fg.indexed, 9U);
-  EXPECT_EQ(reloaded_fill.bg.kind, static_cast<uint8_t>(kFmColorAuto));
-  fm_border_record reloaded_border{};
-  ASSERT_EQ(fm_styles_get_border(reloaded.handle, border_index, &reloaded_border), 0);
-  EXPECT_EQ(reloaded_border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
-  fm_dxf_record reloaded_dxf{};
-  ASSERT_EQ(fm_styles_get_dxf(reloaded.handle, dxf_index, &reloaded_dxf), 0);
-  EXPECT_EQ(reloaded_dxf.font.color.kind, static_cast<uint8_t>(kFmColorAuto));
-  EXPECT_EQ(reloaded_dxf.border.left.color.kind, static_cast<uint8_t>(kFmColorTheme));
-}
-
-TEST(FormulonCApiStyles, AddFontDistinguishesAnExplicitOffToggleFromAnAbsentOne) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_font_record absent = MakeArial();
-  absent.bold = 0;
-  absent.has_bold = 0;
-  fm_font_record explicit_off = absent;
-  explicit_off.has_bold = 1;
-
-  uint32_t absent_index = 0;
-  uint32_t explicit_index = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, absent, &absent_index), 0);
-  ASSERT_EQ(fm_styles_add_font(wb.handle, explicit_off, &explicit_index), 0);
-  EXPECT_NE(absent_index, explicit_index);
-}
-
-TEST(FormulonCApiStyles, AddFillDedupReturnsExistingIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t a = 0xFFFFFFFFU;
-  uint32_t b = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &a), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &b), 0);
-  EXPECT_EQ(a, b);
-}
-
-TEST(FormulonCApiStyles, AddFillDistinctReturnsNewIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t a = 0;
-  uint32_t b = 0;
-  fm_fill_record red = MakeRedFill();
-  fm_fill_record blue = MakeRedFill();
-  blue.fg_argb = 0xFF0000FFU;
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, red, &a), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, blue, &b), 0);
-  EXPECT_NE(a, b);
-}
-
-TEST(FormulonCApiStyles, AddFillGrowsTable) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t before = 0;
-  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &before), 0);
-  uint32_t idx = 0;
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &idx), 0);
-  uint32_t after = 0;
-  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &after), 0);
-  // The seeded table reserves `none` and `gray125` at 0 and 1, matching
-  // what Excel puts in every workbook, so the caller's fill starts at 2.
-  EXPECT_EQ(before, 2U);
-  EXPECT_EQ(after, 3U);
-  EXPECT_EQ(idx, 2U);
-  fm_fill_record out{};
-  ASSERT_EQ(fm_styles_get_fill(wb.handle, idx, &out), 0);
-  EXPECT_EQ(out.pattern, 1U);
-  EXPECT_EQ(out.fg_argb, 0xFFFF0000U);
-}
-
-TEST(FormulonCApiStyles, AddBorderDedupReturnsExistingIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t a = 0xFFFFFFFFU;
-  uint32_t b = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &a), 0);
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &b), 0);
-  EXPECT_EQ(a, b);
-}
-
-TEST(FormulonCApiStyles, AddBorderDistinctReturnsNewIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t a = 0;
-  uint32_t b = 0;
-  fm_border_record thin = MakeThinBoxBorder();
-  fm_border_record dashed = MakeThinBoxBorder();
-  dashed.left.style = 3;  // dashed
-  ASSERT_EQ(fm_styles_add_border(wb.handle, thin, &a), 0);
-  ASSERT_EQ(fm_styles_add_border(wb.handle, dashed, &b), 0);
-  EXPECT_NE(a, b);
-}
-
-TEST(FormulonCApiStyles, AddBorderGrowsTable) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t before = 0;
-  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &before), 0);
-  uint32_t idx = 0;
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &idx), 0);
-  uint32_t after = 0;
-  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &after), 0);
-  // Index 0 is the seeded empty border.
-  EXPECT_EQ(before, 1U);
-  EXPECT_EQ(after, 2U);
-  EXPECT_EQ(idx, 1U);
-  fm_border_record out{};
-  ASSERT_EQ(fm_styles_get_border(wb.handle, idx, &out), 0);
-  EXPECT_EQ(out.left.style, 1U);
-  EXPECT_EQ(out.right.style, 1U);
-  EXPECT_EQ(out.diagonal_up, 0);
-  EXPECT_EQ(out.diagonal_down, 0);
-}
-
-TEST(FormulonCApiStyles, AddNumFmtBuiltinReturnsBuiltinId) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint16_t id = 0xFFFFU;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "General", &id), 0);
-  EXPECT_EQ(id, 0U);
-  // Adding a built-in must not create a custom entry.
-  uint32_t font_count = 7;  // unrelated, just ensure other tables untouched
-  EXPECT_EQ(fm_styles_get_font_count(wb.handle, &font_count), 0);
-  EXPECT_EQ(font_count, 1U);  // the seeded default only
-}
-
-TEST(FormulonCApiStyles, AddNumFmtCustomReturnsCustomId) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint16_t id = 0;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "\"USD\" #,##0", &id), 0);
-  EXPECT_GE(id, 164U);
-  // Resolves through the read-side getter.
-  const char* s = nullptr;
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, id, &s), 0);
-  ASSERT_NE(s, nullptr);
-  EXPECT_STREQ(s, "\"USD\" #,##0");
-}
-
-TEST(FormulonCApiStyles, AddNumFmtCustomDedup) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint16_t a = 0;
-  uint16_t b = 0;
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "\"USD\" #,##0", &a), 0);
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "\"USD\" #,##0", &b), 0);
-  EXPECT_EQ(a, b);
-}
-
-TEST(FormulonCApiStyles, AddNumFmtExhaustionReturnsPreconditionWithoutMutation) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  auto& styles = wb.handle->workbook().mutable_styles();
-  formulon::NumFmtRecord max_record;
-  max_record.id = 65535U;
-  max_record.format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
-  styles.num_fmt_strings.emplace_back("existing");
-  styles.num_fmts.push_back(max_record);
-  const std::size_t strings_before = styles.num_fmt_strings.size();
-  const std::size_t records_before = styles.num_fmts.size();
-  uint16_t out = 0xBEEFU;
-  EXPECT_EQ(fm_styles_add_num_fmt(wb.handle, "new-format", &out),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kPreconditionFailed));
-  EXPECT_EQ(out, 0xBEEFU);
-  EXPECT_EQ(styles.num_fmt_strings.size(), strings_before);
-  EXPECT_EQ(styles.num_fmts.size(), records_before);
-}
-
-TEST(FormulonCApiStyles, AddBatchNumFmtExhaustionIsTransactional) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  auto& styles = wb.handle->workbook().mutable_styles();
-  formulon::NumFmtRecord max_record;
-  max_record.id = 65535U;
-  max_record.format_string_index = static_cast<std::uint32_t>(styles.num_fmt_strings.size());
-  styles.num_fmt_strings.emplace_back("existing");
-  styles.num_fmts.push_back(max_record);
-  const std::string before_xml = formulon::io::write_styles(styles);
-  const char* codes[] = {"first", "second"};
-  uint16_t ids[] = {0xAAAAU, 0xBBBBU};
-  const fm_styles_batch batch{nullptr, 0U,      nullptr, nullptr, 0U,    nullptr, nullptr, 0U,
-                              nullptr, nullptr, 0U,      nullptr, codes, 2U,      ids};
-  EXPECT_EQ(fm_styles_add_batch(wb.handle, &batch),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kPreconditionFailed));
-  EXPECT_EQ(ids[0], 0xAAAAU);
-  EXPECT_EQ(ids[1], 0xBBBBU);
-  EXPECT_EQ(formulon::io::write_styles(styles), before_xml);
-}
-
-TEST(FormulonCApiStyles, AddCellXfDedupReturnsExistingIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t font_idx = 0;
-  uint32_t fill_idx = 0;
-  uint32_t border_idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
-
-  fm_cell_xf xf{};
-  xf.font_index = font_idx;
-  xf.fill_index = fill_idx;
-  xf.border_index = border_idx;
-  xf.num_fmt_id = 0;  // built-in General
-  xf.horizontal_align = 1;
-  xf.vertical_align = 2;
-  xf.wrap_text = 1;
-
-  uint32_t a = 0xFFFFFFFFU;
-  uint32_t b = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &a), 0);
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &b), 0);
-  EXPECT_EQ(a, b);
-}
-
-TEST(FormulonCApiStyles, AddCellXfDistinctReturnsNewIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t font_idx = 0;
-  uint32_t fill_idx = 0;
-  uint32_t border_idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
-
-  fm_cell_xf xf{};
-  xf.font_index = font_idx;
-  xf.fill_index = fill_idx;
-  xf.border_index = border_idx;
-  xf.num_fmt_id = 0;
-  xf.horizontal_align = 1;
-  xf.vertical_align = 2;
-  xf.wrap_text = 1;
-
-  xf.has_wrap_text = 1;
-
-  uint32_t a = 0;
-  uint32_t b = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &a), 0);
-  // Flip wrap_text — distinct record.
-  xf.wrap_text = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &b), 0);
-  EXPECT_NE(a, b);
-}
-
-TEST(FormulonCApiStyles, AddCellXfGrowsTable) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t font_idx = 0;
-  uint32_t fill_idx = 0;
-  uint32_t border_idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
-  uint32_t before = 0;
-  ASSERT_EQ(fm_styles_get_cell_xf_count(wb.handle, &before), 0);
-  fm_cell_xf xf{};
-  xf.font_index = font_idx;
-  xf.fill_index = fill_idx;
-  xf.border_index = border_idx;
-  xf.num_fmt_id = 0;
-  // Distinguish this record from the all-zero placeholder xf that
-  // `ensure_default_cell_xf` seeds at index 0 so the caller's record is
-  // guaranteed to land at a fresh index instead of deduping to it. The
-  // presence flag is what makes the value part of the record.
-  xf.wrap_text = 1;
-  xf.has_wrap_text = 1;
-  uint32_t idx = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &idx), 0);
-  uint32_t after = 0;
-  ASSERT_EQ(fm_styles_get_cell_xf_count(wb.handle, &after), 0);
-  // Index 0 is the seeded default xf.
-  EXPECT_EQ(before, 1U);
-  EXPECT_EQ(after, 2U);
-  EXPECT_EQ(idx, 1U);
-}
-
-TEST(FormulonCApiStyles, AddCellXfOnFreshWorkbookKeepsZeroAsDefault) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t font_idx = 0;
-  uint32_t fill_idx = 0;
-  uint32_t border_idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
-
-  // A fresh workbook seeds Excel's reserved slots, so the caller's first
-  // record lands after them: one default font, one empty border, and the
-  // two fills (`none`, `gray125`) Excel always writes first.
-  EXPECT_EQ(font_idx, 1U);
-  EXPECT_EQ(fill_idx, 2U);
-  EXPECT_EQ(border_idx, 1U);
-
-  fm_cell_xf xf{};
-  xf.font_index = font_idx;
-  xf.fill_index = fill_idx;
-  xf.border_index = border_idx;
-  xf.num_fmt_id = 0;
-  // Distinguish this record from the all-zero placeholder xf that
-  // `ensure_default_cell_xf` seeds at index 0 so the caller's record is
-  // guaranteed to land at a fresh index instead of deduping to it. The
-  // presence flag is what makes the value part of the record.
-  xf.wrap_text = 1;
-  xf.has_wrap_text = 1;
-
-  uint32_t xf_idx = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx), 0);
-  EXPECT_NE(xf_idx, 0U);
-
-  fm_cell_xf default_xf{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, 0, &default_xf), 0);
-  EXPECT_EQ(default_xf.font_index, 0U);
-  EXPECT_EQ(default_xf.fill_index, 0U);
-  EXPECT_EQ(default_xf.border_index, 0U);
-  EXPECT_EQ(default_xf.num_fmt_id, 0U);
-  EXPECT_EQ(default_xf.wrap_text, 0);
-}
-
-TEST(FormulonCApiStyles, AddCellXfRejectsOutOfRangeIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  // Empty styles table: any non-zero index is out of range.
-  fm_cell_xf xf{};
-  xf.font_index = 5;  // intentionally OOR
-  xf.fill_index = 0;
-  xf.border_index = 0;
-  xf.num_fmt_id = 0;
-  uint32_t idx = 0xFFFFFFFFU;
-  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &idx), 0);
-}
-
-TEST(FormulonCApiStyles, AddCellXfRejectsUnknownNumFmt) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  uint32_t font_idx = 0;
-  uint32_t fill_idx = 0;
-  uint32_t border_idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
-
-  fm_cell_xf xf{};
-  xf.font_index = font_idx;
-  xf.fill_index = fill_idx;
-  xf.border_index = border_idx;
-  xf.num_fmt_id = 200;  // not a registered custom and not a documented built-in
-  uint32_t idx = 0xFFFFFFFFU;
-  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &idx), 0);
-}
-
-TEST(FormulonCApiStyles, AddNullArgumentRejected) {
-  uint32_t idx = 0;
-  EXPECT_NE(fm_styles_add_font(nullptr, MakeArial(), &idx), 0);
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  EXPECT_NE(fm_styles_add_font(wb.handle, MakeArial(), nullptr), 0);
-  uint16_t id = 0;
-  EXPECT_NE(fm_styles_add_num_fmt(nullptr, "General", &id), 0);
-  EXPECT_NE(fm_styles_add_num_fmt(wb.handle, "General", nullptr), 0);
-  EXPECT_NE(fm_styles_add_dxf(nullptr, fm_dxf_record{}, &idx), 0);
-  EXPECT_NE(fm_styles_add_dxf(wb.handle, fm_dxf_record{}, nullptr), 0);
-}
-
-TEST(FormulonCApiStyles, FullLifecycleSurvivesSaveLoad) {
-  // Build font -> xf -> stamp on cell -> save -> reload -> the font is
-  // resolvable via the read-side accessors.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  uint32_t font_idx = 0;
-  uint32_t fill_idx = 0;
-  uint32_t border_idx = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
-  ASSERT_EQ(fm_styles_add_border(wb.handle, MakeThinBoxBorder(), &border_idx), 0);
-
-  fm_cell_xf xf{};
-  xf.font_index = font_idx;
-  xf.fill_index = fill_idx;
-  xf.border_index = border_idx;
-  xf.num_fmt_id = 0;
-  uint32_t xf_idx = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx), 0);
-
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.5), 0);
-  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, xf_idx), 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-
-  WorkbookGuard wb2;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &wb2.handle), 0);
-  uint32_t reread_xf = 0;
-  EXPECT_EQ(fm_cell_get_xf_index(wb2.handle, 0, 0, 0, &reread_xf), 0);
-  fm_cell_xf reloaded{};
-  EXPECT_EQ(fm_styles_get_cell_xf(wb2.handle, reread_xf, &reloaded), 0);
-  fm_font_record reloaded_font{};
-  ASSERT_EQ(fm_styles_get_font(wb2.handle, reloaded.font_index, &reloaded_font), 0);
-  EXPECT_STREQ(reloaded_font.name, "Arial");
-  EXPECT_DOUBLE_EQ(reloaded_font.size, 12.0);
-  EXPECT_EQ(reloaded_font.bold, 1);
-}
-
-// Regression coverage for the externally-reported symptom fixed by removing
-// the spurious `ensure_default_style_roots` seeding from the font/fill/
-// border adders: a non-default font + fill + custom numFmt combined into an
-// `<xf>` must produce an `<xf>` index that is distinct from (and does not
-// dedup to) the all-zero placeholder xf, and that index must survive
-// `setCellXfIndex` -> save -> reload with the font, fill, and numFmt content
-// intact on the reloaded workbook. Note that a fresh workbook's font/fill
-// tables legitimately start at index 0 (that is the behavior the fix
-// restored), so this test asserts on round-tripped *content*, not on the
-// font/fill indices being non-zero. The WASM (`src/wasm/parts/
-// workbook_styles.cpp`) and Node addon (`src/node_addon/parts/styles.cc`)
-// bindings marshal the identical field set into `fm_cell_xf` and call this
-// same `fm_styles_add_cell_xf` entry point, so this test also exercises
-// their shared code path end to end.
-TEST(FormulonCApiStyles, AddXfWithNonDefaultFontFillNumFmtRoundTripsThroughSaveLoad) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  uint32_t font_idx = 0xFFFFFFFFU;
-  uint32_t fill_idx = 0xFFFFFFFFU;
-  uint16_t num_fmt_id = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, MakeArial(), &font_idx), 0);
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, MakeRedFill(), &fill_idx), 0);
-  ASSERT_EQ(fm_styles_add_num_fmt(wb.handle, "0.00%", &num_fmt_id), 0);
-
-  fm_cell_xf xf{};
-  xf.font_index = font_idx;
-  xf.fill_index = fill_idx;
-  xf.border_index = 0;
-  xf.num_fmt_id = num_fmt_id;
-  uint32_t xf_idx = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx), 0);
-  ASSERT_NE(xf_idx, 0U) << "non-default font/fill/numFmt must not dedup to the "
-                           "all-zero placeholder xf at index 0";
-
-  // Stability: re-adding the identical record must return the same index.
-  uint32_t xf_idx_again = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx_again), 0);
-  EXPECT_EQ(xf_idx, xf_idx_again);
-
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 1, 1, 0.4225), 0);
-  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 1, 1, xf_idx), 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  ASSERT_GT(saved.len, 0U);
-
-  WorkbookGuard wb2;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &wb2.handle), 0);
-
-  uint32_t reread_xf = 0;
-  ASSERT_EQ(fm_cell_get_xf_index(wb2.handle, 0, 1, 1, &reread_xf), 0);
-  ASSERT_EQ(reread_xf, xf_idx);
-
-  fm_cell_xf reloaded{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb2.handle, reread_xf, &reloaded), 0);
-  EXPECT_EQ(reloaded.font_index, font_idx);
-  EXPECT_EQ(reloaded.fill_index, fill_idx);
-  EXPECT_EQ(reloaded.num_fmt_id, num_fmt_id);
-
-  fm_font_record reloaded_font{};
-  ASSERT_EQ(fm_styles_get_font(wb2.handle, reloaded.font_index, &reloaded_font), 0);
-  EXPECT_STREQ(reloaded_font.name, "Arial");
-  EXPECT_DOUBLE_EQ(reloaded_font.size, 12.0);
-  EXPECT_EQ(reloaded_font.bold, 1);
-
-  fm_fill_record reloaded_fill{};
-  ASSERT_EQ(fm_styles_get_fill(wb2.handle, reloaded.fill_index, &reloaded_fill), 0);
-  EXPECT_EQ(reloaded_fill.pattern, 1U);
-  EXPECT_EQ(reloaded_fill.fg_argb, 0xFFFF0000U);
-
-  const char* reloaded_fmt = nullptr;
-  ASSERT_EQ(fm_styles_get_num_fmt_string(wb2.handle, reloaded.num_fmt_id, &reloaded_fmt), 0);
-  ASSERT_NE(reloaded_fmt, nullptr);
-  EXPECT_STREQ(reloaded_fmt, "0.00%");
-}
-
-TEST(FormulonCApiStyles, JustifyLastLineRoundTripsThroughSaveLoad) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cell_xf xf{};
-  xf.has_alignment = 1;
-  xf.horizontal_align = 7;  // distributed
-  xf.has_horizontal_align = 1;
-  xf.vertical_align = 2;  // bottom
-  xf.justify_last_line = 1;
-  xf.has_justify_last_line = 1;
-  uint32_t xf_idx = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_idx), 0);
-
-  uint32_t duplicate_idx = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &duplicate_idx), 0);
-  EXPECT_EQ(duplicate_idx, xf_idx);
-
-  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 0, 0, "distributed"), 0);
-  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, xf_idx), 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-
-  WorkbookGuard reloaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &reloaded.handle), 0);
-  uint32_t reread_idx = 0;
-  ASSERT_EQ(fm_cell_get_xf_index(reloaded.handle, 0, 0, 0, &reread_idx), 0);
-  fm_cell_xf reread{};
-  ASSERT_EQ(fm_styles_get_cell_xf(reloaded.handle, reread_idx, &reread), 0);
-  EXPECT_EQ(reread.horizontal_align, 7U);
-  EXPECT_EQ(reread.justify_last_line, 1);
-}
-
-TEST(FormulonCApiStyles, NamedCellStyleRoundTripsThroughSaveLoad) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cell_xf style_xf{};
-  style_xf.has_alignment = 1;
-  style_xf.horizontal_align = 2;
-  style_xf.has_horizontal_align = 1;
-  uint32_t xf_id = 0;
-  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, style_xf, &xf_id), 0);
-  ASSERT_EQ(fm_styles_set_cell_style(wb.handle, "Highlight", xf_id, FM_CELL_STYLE_BUILTIN_ID_NONE), 0);
-
-  fm_cell_xf cell_xf{};
-  cell_xf.has_alignment = 1;
-  cell_xf.horizontal_align = 2;
-  cell_xf.has_horizontal_align = 1;
-  cell_xf.xf_id = xf_id;
-  uint32_t cell_xf_id = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, cell_xf, &cell_xf_id), 0);
-  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 0, 0, "styled"), 0);
-  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, cell_xf_id), 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  WorkbookGuard loaded;
-  ASSERT_EQ(fm_workbook_load(saved.data, saved.len, &loaded.handle), 0);
-  uint32_t style_count = 0;
-  ASSERT_EQ(fm_styles_get_cell_style_count(loaded.handle, &style_count), 0);
-  // The seeded `Normal` keeps index 0; `Highlight` is appended after it.
-  ASSERT_EQ(style_count, 2U);
-  fm_cell_style_record_t style{};
-  ASSERT_EQ(fm_styles_get_cell_style(loaded.handle, 1, &style), 0);
-  EXPECT_STREQ(style.name, "Highlight");
-  uint32_t reread_cell_xf = 0;
-  ASSERT_EQ(fm_cell_get_xf_index(loaded.handle, 0, 0, 0, &reread_cell_xf), 0);
-  fm_cell_xf reread{};
-  ASSERT_EQ(fm_styles_get_cell_xf(loaded.handle, reread_cell_xf, &reread), 0);
-  EXPECT_EQ(reread.xf_id, style.xf_id);
-}
-
-TEST(FormulonCApiStyles, NamedStyleXfRejectsDanglingReferences) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  // A cell xf may only inherit from a named-style xf that already exists.
-  fm_cell_xf cell_xf{};
-  cell_xf.xf_id = 3;
-  uint32_t cell_xf_index = 0;
-  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, cell_xf, &cell_xf_index), 0);
-
-  // The named-style table validates its own font / fill / border / numFmt
-  // references exactly like the cell-xf table does.
-  fm_cell_xf style_xf{};
-  style_xf.font_index = 9;
-  uint32_t xf_id = 0;
-  EXPECT_NE(fm_styles_add_cell_style_xf(wb.handle, style_xf, &xf_id), 0);
-
-  style_xf.font_index = 0;
-  style_xf.has_alignment = 1;
-  style_xf.justify_last_line = 1;
-  style_xf.has_justify_last_line = 1;
-  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, style_xf, &xf_id), 0);
-  fm_cell_xf reread{};
-  ASSERT_EQ(fm_styles_get_cell_style_xf(wb.handle, xf_id, &reread), 0);
-  EXPECT_EQ(reread.justify_last_line, 1);
-
-  // 0..47 is the whole OOXML ordinal space; anything else needs the sentinel.
-  EXPECT_NE(fm_styles_set_cell_style(wb.handle, "Custom", xf_id, 48), 0);
-  EXPECT_EQ(fm_styles_set_cell_style(wb.handle, "Custom", xf_id, FM_CELL_STYLE_BUILTIN_ID_NONE), 0);
-  EXPECT_NE(fm_styles_set_cell_style(wb.handle, "Custom", xf_id + 1U, FM_CELL_STYLE_BUILTIN_ID_NONE), 0);
-}
-
-TEST(FormulonCApiStyles, AddBatchDeduplicatesAllStyleTables) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  const fm_font_record fonts[] = {MakeArial(), MakeArial()};
-  const fm_fill_record fills[] = {MakeRedFill(), MakeRedFill()};
-  fm_border_record border{};
-  border.left.style = 1;
-  border.left.color_argb = 0xFF000000U;
-  const fm_border_record borders[] = {border, border};
-  uint32_t font_indices[2]{};
-  uint32_t fill_indices[2]{};
-  uint32_t border_indices[2]{};
-  const char* const num_fmt_codes[] = {"0.000%", "0.000%"};
-  uint16_t num_fmt_ids[2]{};
-  fm_cell_xf xf{};
-  xf.font_index = 1U;
-  xf.fill_index = 1U;
-  xf.border_index = 1U;
-  const fm_cell_xf xfs[] = {xf, xf};
-  uint32_t xf_indices[2]{};
-  const fm_styles_batch batch{fonts, 2U, font_indices, fills,         2U, fill_indices, borders, 2U, border_indices,
-                              xfs,   2U, xf_indices,   num_fmt_codes, 2U, num_fmt_ids};
-
-  ASSERT_EQ(fm_styles_add_batch(wb.handle, &batch), 0);
-  EXPECT_EQ(font_indices[0], font_indices[1]);
-  EXPECT_EQ(fill_indices[0], fill_indices[1]);
-  EXPECT_EQ(border_indices[0], border_indices[1]);
-  EXPECT_EQ(xf_indices[0], xf_indices[1]);
-  EXPECT_EQ(num_fmt_ids[0], num_fmt_ids[1]);
-}
-
-// The batch adder shares the single-record presence-flag contract, which is a
-// behavioural change rather than a layout one: a caller that set an alignment
-// value and relied on it being inferred as present still compiles against the
-// widened record and still succeeds, but now emits no `<alignment>` child.
-// Pin both halves so the silent half cannot regress unnoticed.
-TEST(FormulonCApiStyles, AddBatchEmitsAlignmentOnlyForFlaggedAttributes) {
-  const auto batch_xf_alignment = [](const fm_cell_xf& record) {
-    WorkbookGuard wb;
-    EXPECT_EQ(fm_workbook_create(&wb.handle), 0);
-    uint32_t xf_indices[] = {0xDEADBEEFU};
-    const fm_styles_batch batch{nullptr, 0U,      nullptr, nullptr,    0U,      nullptr, nullptr, 0U,
-                                nullptr, &record, 1U,      xf_indices, nullptr, 0U,      nullptr};
-    EXPECT_EQ(fm_styles_add_batch(wb.handle, &batch), 0) << fm_last_error_message();
-    fm_cell_xf got{};
-    EXPECT_EQ(fm_styles_get_cell_xf(wb.handle, xf_indices[0], &got), 0);
-    return got;
-  };
-
-  // The pre-collapse caller shape: a value with no presence flag.
-  fm_cell_xf inferred{};
-  inferred.horizontal_align = 3;  // center-continuous
-  const fm_cell_xf without_flag = batch_xf_alignment(inferred);
-  EXPECT_EQ(without_flag.has_alignment, 0);
-  EXPECT_EQ(without_flag.has_horizontal_align, 0);
-  EXPECT_EQ(without_flag.horizontal_align, 0U);
-
-  // The same value, now declared present, is the post-collapse spelling.
-  fm_cell_xf flagged{};
-  flagged.horizontal_align = 3;
-  flagged.has_horizontal_align = 1;
-  const fm_cell_xf with_flag = batch_xf_alignment(flagged);
-  EXPECT_EQ(with_flag.has_alignment, 1);
-  EXPECT_EQ(with_flag.has_horizontal_align, 1);
-  EXPECT_EQ(with_flag.horizontal_align, 3U);
-}
-
-TEST(FormulonCApiStyles, AddBatchCommitsNumFmtReferencesTransactionally) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  const fm_font_record font = MakeArial();
-  uint32_t font_index = 0;
-  const char* const codes[] = {"0.000%"};
-  uint16_t num_fmt_ids[] = {0xBEEF};
-  fm_cell_xf xf{};
-  xf.font_index = 1U;  // default root plus the staged font
-  xf.num_fmt_id = 164U;
-  uint32_t xf_indices[] = {0xDEADBEEFU};
-  const fm_styles_batch batch{&font,   1U,  &font_index, nullptr,    0U,    nullptr, nullptr,    0U,
-                              nullptr, &xf, 1U,          xf_indices, codes, 1U,      num_fmt_ids};
-
-  ASSERT_EQ(fm_styles_add_batch(wb.handle, &batch), 0);
-  EXPECT_EQ(font_index, 1U);
-  EXPECT_EQ(num_fmt_ids[0], 164U);
-  EXPECT_EQ(xf_indices[0], 1U);
-  ASSERT_EQ(wb.handle->workbook().styles().num_fmts.size(), 1U);
-  EXPECT_EQ(wb.handle->workbook().styles().num_fmts[0].id, 164U);
-  ASSERT_EQ(wb.handle->workbook().styles().cell_xfs.size(), 2U);
-  EXPECT_EQ(wb.handle->workbook().styles().cell_xfs[1].num_fmt_id, 164U);
-}
-
-TEST(FormulonCApiStyles, AddBatchFailureLeavesTableAndOutputsUnchanged) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  const std::string before_xml = formulon::io::write_styles(wb.handle->workbook().styles());
-  const std::size_t before_fonts = wb.handle->workbook().styles().fonts.size();
-  const std::size_t before_num_fmts = wb.handle->workbook().styles().num_fmts.size();
-  const std::size_t before_cell_xfs = wb.handle->workbook().styles().cell_xfs.size();
-
-  const fm_font_record font = MakeArial();
-  uint32_t font_index = 0xA1A2A3A4U;
-  const char* const codes[] = {"0.000%"};
-  uint16_t num_fmt_ids[] = {0xBEEF};
-  fm_cell_xf xf{};
-  xf.font_index = 1U;    // valid after staging the font
-  xf.num_fmt_id = 999U;  // neither built-in nor registered
-  uint32_t xf_indices[] = {0xDEADBEEFU};
-  const fm_styles_batch batch{&font,   1U,  &font_index, nullptr,    0U,    nullptr, nullptr,    0U,
-                              nullptr, &xf, 1U,          xf_indices, codes, 1U,      num_fmt_ids};
-
-  EXPECT_NE(fm_styles_add_batch(wb.handle, &batch), 0);
-  EXPECT_EQ(font_index, 0xA1A2A3A4U);
-  EXPECT_EQ(num_fmt_ids[0], 0xBEEFU);
-  EXPECT_EQ(xf_indices[0], 0xDEADBEEFU);
-  EXPECT_EQ(wb.handle->workbook().styles().fonts.size(), before_fonts);
-  EXPECT_EQ(wb.handle->workbook().styles().num_fmts.size(), before_num_fmts);
-  EXPECT_EQ(wb.handle->workbook().styles().cell_xfs.size(), before_cell_xfs);
-  EXPECT_EQ(formulon::io::write_styles(wb.handle->workbook().styles()), before_xml);
-}
-
-TEST(FormulonCApiStyles, ZeroInitializedCellXfUsesDefaultAlignment) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cell_xf record{};
-  uint32_t index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, record, &index), 0);
-  EXPECT_EQ(index, 0U);
-
-  fm_cell_xf got{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, index, &got), 0);
-  EXPECT_EQ(got.horizontal_align, 0U);
-  EXPECT_EQ(got.vertical_align, 2U);
-  EXPECT_EQ(got.wrap_text, 0);
-  EXPECT_EQ(got.justify_last_line, 0);
-  EXPECT_EQ(got.has_alignment, 0);
-  EXPECT_EQ(got.has_horizontal_align, 0);
-  EXPECT_EQ(got.has_vertical_align, 0);
-  EXPECT_EQ(got.has_wrap_text, 0);
-  EXPECT_EQ(got.has_justify_last_line, 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  const std::string styles_xml = ExtractStylesXml(saved);
-  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
-  const std::size_t cell_xfs_end = styles_xml.find("</cellXfs>", cell_xfs_begin);
-  ASSERT_NE(cell_xfs_begin, std::string::npos);
-  ASSERT_NE(cell_xfs_end, std::string::npos);
-  EXPECT_EQ(styles_xml.substr(cell_xfs_begin, cell_xfs_end - cell_xfs_begin).find("<alignment"), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, CellXfIgnoresPoisonForOmittedAlignmentAttributes) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cell_xf poison{};
-  poison.horizontal_align = 0xFFU;
-  poison.vertical_align = 0xFFU;
-  poison.wrap_text = 7;
-  poison.justify_last_line = 9;
-
-  uint32_t omitted_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, poison, &omitted_index), 0);
-  EXPECT_EQ(omitted_index, 0U);
-
-  poison.has_alignment = 1;
-  uint32_t explicit_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, poison, &explicit_index), 0);
-
-  fm_cell_xf empty{};
-  empty.has_alignment = 1;
-  uint32_t empty_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, empty, &empty_index), 0);
-  EXPECT_EQ(empty_index, explicit_index);
-
-  fm_cell_xf got{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, explicit_index, &got), 0);
-  EXPECT_EQ(got.horizontal_align, 0U);
-  EXPECT_EQ(got.vertical_align, 2U);
-  EXPECT_EQ(got.wrap_text, 0);
-  EXPECT_EQ(got.justify_last_line, 0);
-  EXPECT_EQ(got.has_alignment, 1);
-  EXPECT_EQ(got.has_horizontal_align, 0);
-  EXPECT_EQ(got.has_vertical_align, 0);
-  EXPECT_EQ(got.has_wrap_text, 0);
-  EXPECT_EQ(got.has_justify_last_line, 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  const std::string styles_xml = ExtractStylesXml(saved);
-  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
-  const std::size_t cell_xfs_end = styles_xml.find("</cellXfs>", cell_xfs_begin);
-  ASSERT_NE(cell_xfs_begin, std::string::npos);
-  ASSERT_NE(cell_xfs_end, std::string::npos);
-  const std::string cell_xfs = styles_xml.substr(cell_xfs_begin, cell_xfs_end - cell_xfs_begin);
-  EXPECT_NE(cell_xfs.find("<alignment/>"), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, CellXfExplicitTopAlignmentRemainsPresent) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cell_xf record{};
-  record.vertical_align = 0;  // top
-  record.has_vertical_align = 1;
-  uint32_t index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, record, &index), 0);
-
-  fm_cell_xf got{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, index, &got), 0);
-  EXPECT_EQ(got.vertical_align, 0U);
-  EXPECT_EQ(got.has_vertical_align, 1);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  const std::string styles_xml = ExtractStylesXml(saved);
-  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
-  const std::size_t cell_xfs_end = styles_xml.find("</cellXfs>", cell_xfs_begin);
-  ASSERT_NE(cell_xfs_begin, std::string::npos);
-  ASSERT_NE(cell_xfs_end, std::string::npos);
-  EXPECT_NE(styles_xml.substr(cell_xfs_begin, cell_xfs_end - cell_xfs_begin).find("<alignment vertical=\"top\"/>"),
-            std::string::npos);
-}
-
-TEST(FormulonCApiStyles, ZeroInitializedCellStyleXfUsesDefaultAlignment) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cell_xf record{};
-  uint32_t index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, record, &index), 0);
-
-  fm_cell_xf got{};
-  ASSERT_EQ(fm_styles_get_cell_style_xf(wb.handle, index, &got), 0);
-  EXPECT_EQ(got.horizontal_align, 0U);
-  EXPECT_EQ(got.vertical_align, 2U);
-  EXPECT_EQ(got.wrap_text, 0);
-  EXPECT_EQ(got.justify_last_line, 0);
-  EXPECT_EQ(got.has_alignment, 0);
-  EXPECT_EQ(got.has_vertical_align, 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  const std::string styles_xml = ExtractStylesXml(saved);
-  const std::size_t style_xfs_begin = styles_xml.find("<cellStyleXfs");
-  const std::size_t style_xfs_end = styles_xml.find("</cellStyleXfs>", style_xfs_begin);
-  ASSERT_NE(style_xfs_begin, std::string::npos);
-  ASSERT_NE(style_xfs_end, std::string::npos);
-  EXPECT_EQ(styles_xml.substr(style_xfs_begin, style_xfs_end - style_xfs_begin).find("<alignment"), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, CellXfVerticalAlignZeroIsExplicitTopOnlyWithItsPresenceFlag) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  // Without the presence flag, `vertical_align` is not read at all: the record
-  // describes an omitted attribute and canonicalizes to the model default.
-  fm_cell_xf omitted{};
-  omitted.vertical_align = 0;  // top
-  uint32_t omitted_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, omitted, &omitted_index), 0);
-  fm_cell_xf got_omitted{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, omitted_index, &got_omitted), 0);
-  EXPECT_EQ(got_omitted.vertical_align, 2U);  // bottom
-  EXPECT_EQ(got_omitted.has_vertical_align, 0);
-
-  fm_cell_xf explicit_top{};
-  explicit_top.has_alignment = 1;
-  explicit_top.vertical_align = 0;  // top
-  explicit_top.has_vertical_align = 1;
-  uint32_t explicit_index = 0xFFFFFFFFU;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, explicit_top, &explicit_index), 0);
-  EXPECT_NE(explicit_index, omitted_index);
-
-  fm_cell_xf got_explicit{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, explicit_index, &got_explicit), 0);
-  EXPECT_EQ(got_explicit.vertical_align, 0U);
-  EXPECT_EQ(got_explicit.has_vertical_align, 1);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  const std::string styles_xml = ExtractStylesXml(saved);
-  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
-  const std::size_t cell_xfs_end = styles_xml.find("</cellXfs>", cell_xfs_begin);
-  ASSERT_NE(cell_xfs_begin, std::string::npos);
-  ASSERT_NE(cell_xfs_end, std::string::npos);
-  EXPECT_NE(styles_xml.substr(cell_xfs_begin, cell_xfs_end - cell_xfs_begin).find("<alignment vertical=\"top\"/>"),
-            std::string::npos);
-}
-
-TEST(FormulonCApiStyles, CellXfPreservesOptionalAlignmentAndPresence) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cell_xf xf{};
-  xf.vertical_align = 2;
-  xf.justify_last_line = 1;
-  xf.xf_id = 0;
-  xf.has_alignment = 1;
-  xf.has_text_rotation = 1;
-  xf.text_rotation = 255;
-  xf.has_indent = 1;
-  xf.indent = 7;
-  xf.has_relative_indent = 1;
-  xf.relative_indent = -3;
-  xf.has_shrink_to_fit = 1;
-  xf.shrink_to_fit = 0;
-  xf.has_reading_order = 1;
-  xf.reading_order = 2;
-  xf.has_horizontal_align = 1;
-  xf.has_vertical_align = 1;
-  xf.has_wrap_text = 1;
-  xf.has_justify_last_line = 1;
-
-  uint32_t index = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
-  uint32_t duplicate = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &duplicate), 0);
-  EXPECT_EQ(duplicate, index);
-
-  fm_cell_xf reread{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, index, &reread), 0);
-  EXPECT_EQ(reread.justify_last_line, 1);
-  EXPECT_EQ(reread.xf_id, 0U);
-  EXPECT_EQ(reread.has_alignment, 1);
-  EXPECT_EQ(reread.has_text_rotation, 1);
-  EXPECT_EQ(reread.text_rotation, 255U);
-  EXPECT_EQ(reread.has_indent, 1);
-  EXPECT_EQ(reread.indent, 7U);
-  EXPECT_EQ(reread.has_relative_indent, 1);
-  EXPECT_EQ(reread.relative_indent, -3);
-  EXPECT_EQ(reread.has_shrink_to_fit, 1);
-  EXPECT_EQ(reread.shrink_to_fit, 0);
-  EXPECT_EQ(reread.has_reading_order, 1);
-  EXPECT_EQ(reread.reading_order, 2U);
-  EXPECT_EQ(reread.has_horizontal_align, 1);
-  EXPECT_EQ(reread.has_vertical_align, 1);
-  EXPECT_EQ(reread.has_wrap_text, 1);
-  EXPECT_EQ(reread.has_justify_last_line, 1);
-
-  // Presence is part of the dedup key: explicit zero / false differs from
-  // an omitted attribute even when the effective value is the same.
-  fm_cell_xf absent = xf;
-  absent.has_text_rotation = 0;
-  absent.has_indent = 0;
-  absent.has_relative_indent = 0;
-  absent.has_shrink_to_fit = 0;
-  absent.has_reading_order = 0;
-  uint32_t absent_index = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, absent, &absent_index), 0);
-  EXPECT_NE(absent_index, index);
-}
-
-TEST(FormulonCApiStyles, CellXfRejectsInvalidExcelAlignmentRanges) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cell_xf xf{};
-  uint32_t index = 0;
-
-  xf.has_text_rotation = 1;
-  xf.text_rotation = 181;
-  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
-  xf.text_rotation = 255;
-  EXPECT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
-
-  xf.has_text_rotation = 0;
-  xf.has_indent = 1;
-  xf.indent = 256;
-  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
-  xf.indent = 255;
-  EXPECT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
-
-  xf.has_indent = 0;
-  xf.has_reading_order = 1;
-  xf.reading_order = 3;
-  EXPECT_NE(fm_styles_add_cell_xf(wb.handle, xf, &index), 0);
-}
-
-TEST(FormulonCApiStyles, CellXfPresenceFlagsDistinguishExplicitDefaults) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_cell_xf explicit_defaults{};
-  explicit_defaults.vertical_align = 2;
-  explicit_defaults.has_alignment = 1;
-  explicit_defaults.has_horizontal_align = 1;
-  explicit_defaults.has_vertical_align = 1;
-  explicit_defaults.has_wrap_text = 1;
-  explicit_defaults.has_justify_last_line = 1;
-  uint32_t explicit_index = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, explicit_defaults, &explicit_index), 0);
-
-  fm_cell_xf omitted_defaults = explicit_defaults;
-  omitted_defaults.has_horizontal_align = 0;
-  omitted_defaults.has_vertical_align = 0;
-  omitted_defaults.has_wrap_text = 0;
-  omitted_defaults.has_justify_last_line = 0;
-  uint32_t omitted_index = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, omitted_defaults, &omitted_index), 0);
-  EXPECT_NE(explicit_index, omitted_index);
-
-  fm_cell_xf reread{};
-  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, explicit_index, &reread), 0);
-  EXPECT_EQ(reread.has_horizontal_align, 1);
-  EXPECT_EQ(reread.has_vertical_align, 1);
-  EXPECT_EQ(reread.has_wrap_text, 1);
-  EXPECT_EQ(reread.has_justify_last_line, 1);
-}
-
-TEST(FormulonCApiStyles, CellStyleXfRoundTripsOptionalAlignment) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_cell_xf style{};
-  style.has_text_rotation = 1;
-  style.text_rotation = 0;
-  style.has_relative_indent = 1;
-  style.relative_indent = -2;
-  style.has_shrink_to_fit = 1;
-  style.shrink_to_fit = false;
-  uint32_t style_index = 0;
-  ASSERT_EQ(fm_styles_add_cell_style_xf(wb.handle, style, &style_index), 0);
-
-  fm_cell_xf reread{};
-  ASSERT_EQ(fm_styles_get_cell_style_xf(wb.handle, style_index, &reread), 0);
-  EXPECT_EQ(reread.has_text_rotation, 1);
-  EXPECT_EQ(reread.text_rotation, 0U);
-  EXPECT_EQ(reread.has_relative_indent, 1);
-  EXPECT_EQ(reread.relative_indent, -2);
-  EXPECT_EQ(reread.has_shrink_to_fit, 1);
-  EXPECT_EQ(reread.shrink_to_fit, 0);
-}
-
-TEST(FormulonCApiStyles, CreateEmptySeedsReservedStyleSlots) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create_empty(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Sheet1"), 0);
-
-  uint32_t font_count = 0;
-  uint32_t fill_count = 0;
-  uint32_t border_count = 0;
-  uint32_t cell_xf_count = 0;
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &font_count), 0);
-  ASSERT_EQ(fm_styles_get_fill_count(wb.handle, &fill_count), 0);
-  ASSERT_EQ(fm_styles_get_border_count(wb.handle, &border_count), 0);
-  ASSERT_EQ(fm_styles_get_cell_xf_count(wb.handle, &cell_xf_count), 0);
-  EXPECT_EQ(font_count, 1U);
-  EXPECT_EQ(fill_count, 2U);
-  EXPECT_EQ(border_count, 1U);
-  EXPECT_EQ(cell_xf_count, 1U);
-
-  // Excel reserves fill 0 for `none` and fill 1 for `gray125`, so a caller's
-  // own fill must never take either slot; the same holds for font 0 and
-  // border 0. A non-zero index is what proves the reserved slots survived.
-  fm_font_record font{};
-  font.name = "Arial";
-  font.size = 12.0;
-  uint32_t font_index = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, font, &font_index), 0);
-  EXPECT_GT(font_index, 0U);
-
-  fm_fill_record fill{};
-  fill.pattern = 1U; /* solid */
-  fill.fg_argb = 0xFFFF0000U;
-  uint32_t fill_index = 0;
-  ASSERT_EQ(fm_styles_add_fill(wb.handle, fill, &fill_index), 0);
-  EXPECT_GT(fill_index, 1U);
-
-  fm_border_record border{};
-  border.left.style = 1U; /* thin */
-  uint32_t border_index = 0;
-  ASSERT_EQ(fm_styles_add_border(wb.handle, border, &border_index), 0);
-  EXPECT_GT(border_index, 0U);
-
-  fm_cell_xf xf{};
-  xf.font_index = font_index;
-  xf.fill_index = fill_index;
-  xf.border_index = border_index;
-  uint32_t xf_index = 0;
-  ASSERT_EQ(fm_styles_add_cell_xf(wb.handle, xf, &xf_index), 0);
-  EXPECT_GT(xf_index, 0U);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  const std::string styles_xml = ExtractStylesXml(saved);
-  EXPECT_NE(styles_xml.find("gray125"), std::string::npos);
-  EXPECT_NE(styles_xml.find("name=\"Normal\""), std::string::npos);
-  // Cell xf 0 stays the unformatted default: it must not pick up the
-  // caller's fill.
-  const std::size_t cell_xfs_begin = styles_xml.find("<cellXfs");
-  ASSERT_NE(cell_xfs_begin, std::string::npos);
-  const std::size_t first_xf = styles_xml.find("<xf", cell_xfs_begin);
-  ASSERT_NE(first_xf, std::string::npos);
-  const std::size_t first_xf_end = styles_xml.find('>', first_xf);
-  ASSERT_NE(first_xf_end, std::string::npos);
-  EXPECT_NE(styles_xml.substr(first_xf, first_xf_end - first_xf).find("fillId=\"0\""), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, DefaultFontDeclaresWhatAnUnstyledCellSavesAs) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 0, 0, "unstyled"), 0);
-
-  // The seeded default is Excel's Calibri 11, and `add_font` can only append
-  // beside it -- which is exactly why the declaring entry point exists.
-  fm_font_record seeded{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, 0, &seeded), 0);
-  EXPECT_STREQ(seeded.name, "Calibri");
-  fm_font_record appended{};
-  appended.name = "游ゴシック";
-  appended.size = 11.0;
-  uint32_t appended_index = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, appended, &appended_index), 0);
-  EXPECT_GT(appended_index, 0U);
-
-  fm_font_record declared{};
-  declared.name = "游ゴシック";
-  declared.size = 11.0;
-  declared.has_family = 1;
-  declared.family = 2;
-  declared.has_charset = 1;
-  declared.charset = 128;
-  declared.color_argb = 0xFF000000U;
-  ASSERT_EQ(fm_workbook_set_default_font(wb.handle, declared), 0);
-
-  fm_font_record read_back{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, 0, &read_back), 0);
-  EXPECT_STREQ(read_back.name, "游ゴシック");
-  EXPECT_EQ(read_back.charset, 128U);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  const std::string styles_xml = ExtractStylesXml(saved);
-  const std::size_t fonts_begin = styles_xml.find("<fonts");
-  ASSERT_NE(fonts_begin, std::string::npos);
-  const std::size_t first_font = styles_xml.find("<font>", fonts_begin);
-  ASSERT_NE(first_font, std::string::npos);
-  const std::size_t first_font_end = styles_xml.find("</font>", first_font);
-  ASSERT_NE(first_font_end, std::string::npos);
-  const std::string first = styles_xml.substr(first_font, first_font_end - first_font);
-  EXPECT_NE(first.find("<name val=\"游ゴシック\"/>"), std::string::npos);
-  EXPECT_EQ(first.find("Calibri"), std::string::npos);
-}
-
-TEST(FormulonCApiStyles, SetFontOverwritesInPlaceAndRejectsAnAbsentIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_font_record added{};
-  added.name = "Meiryo";
-  added.size = 12.0;
-  uint32_t index = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, added, &index), 0);
-  ASSERT_GT(index, 0U);
-
-  fm_font_record replacement{};
-  replacement.name = "MS Gothic";
-  replacement.size = 9.0;
-  ASSERT_EQ(fm_styles_set_font(wb.handle, index, replacement), 0);
-
-  fm_font_record read_back{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, index, &read_back), 0);
-  EXPECT_STREQ(read_back.name, "MS Gothic");
-  EXPECT_DOUBLE_EQ(read_back.size, 9.0);
-
-  // Overwriting does not grow the table, and an index past its end is
-  // refused rather than filled in with default records.
-  uint32_t count = 0;
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count), 0);
-  EXPECT_EQ(count, index + 1U);
-  EXPECT_NE(fm_styles_set_font(wb.handle, count, replacement), 0);
-  ASSERT_EQ(fm_styles_get_font_count(wb.handle, &count), 0);
-  EXPECT_EQ(count, index + 1U);
-
-  EXPECT_NE(fm_styles_set_font(nullptr, 0, replacement), 0);
-  EXPECT_NE(fm_workbook_set_default_font(nullptr, replacement), 0);
-}
-
-TEST(FormulonCApiStyles, FontSchemeSurvivesAReadModifyWriteThroughTheAbi) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  fm_font_record body{};
-  body.name = "游ゴシック";
-  body.size = 11.0;
-  body.has_charset = 1;
-  body.charset = 128;
-  body.scheme = 2;  // minor: the theme's body font
-  ASSERT_EQ(fm_workbook_set_default_font(wb.handle, body), 0);
-
-  // The link has to come back out of the projection, or a host that reads a
-  // font, edits one field and writes it back silently unlinks it.
-  fm_font_record read_back{};
-  ASSERT_EQ(fm_styles_get_font(wb.handle, 0, &read_back), 0);
-  EXPECT_EQ(read_back.scheme, 2U);
-  read_back.size = 12.0;
-  ASSERT_EQ(fm_styles_set_font(wb.handle, 0, read_back), 0);
-
-  BufferGuard saved;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &saved.data, &saved.len), 0);
-  const std::string styles_xml = ExtractStylesXml(saved);
-  EXPECT_NE(styles_xml.find("<charset val=\"128\"/><scheme val=\"minor\"/>"), std::string::npos);
-
-  // A record left at the default writes no element, so `add_font` sees a
-  // distinct entry rather than folding the two together.
-  fm_font_record unlinked{};
-  unlinked.name = "游ゴシック";
-  unlinked.size = 12.0;
-  unlinked.has_charset = 1;
-  unlinked.charset = 128;
-  uint32_t unlinked_index = 0;
-  ASSERT_EQ(fm_styles_add_font(wb.handle, unlinked, &unlinked_index), 0);
-  EXPECT_GT(unlinked_index, 0U);
-}
diff --git a/tests/c_api/formulon_c_styles_test_helpers.h b/tests/c_api/formulon_c_styles_test_helpers.h
new file mode 100644
index 000000000..c59b84c80
--- /dev/null
+++ b/tests/c_api/formulon_c_styles_test_helpers.h
@@ -0,0 +1,231 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "c_api/parts/common.h"
+#include "gtest/gtest.h"
+#include "io/styles_reader.h"
+#include "io/styles_writer.h"
+#include "io/zip_reader.h"
+#include "workbook.h"
+
+namespace {
+
+// `fm_styles_add_cell_xf` takes this struct BY VALUE, so its size is part of
+// the calling convention rather than merely of a buffer: a caller compiled
+// against a different definition reads its arguments from the wrong registers
+// and stack slots with no diagnosable failure. Pin the layout here so a change
+// has to break the build and be acknowledged.
+static_assert(sizeof(fm_cell_xf) == 128U, "fm_cell_xf ABI layout changed");
+static_assert(offsetof(fm_cell_xf, font_index) == 0U, "fm_cell_xf.font_index offset changed");
+static_assert(offsetof(fm_cell_xf, fill_index) == 4U, "fm_cell_xf.fill_index offset changed");
+static_assert(offsetof(fm_cell_xf, border_index) == 8U, "fm_cell_xf.border_index offset changed");
+static_assert(offsetof(fm_cell_xf, num_fmt_id) == 12U, "fm_cell_xf.num_fmt_id offset changed");
+static_assert(offsetof(fm_cell_xf, horizontal_align) == 14U, "fm_cell_xf.horizontal_align offset changed");
+static_assert(offsetof(fm_cell_xf, vertical_align) == 15U, "fm_cell_xf.vertical_align offset changed");
+static_assert(offsetof(fm_cell_xf, wrap_text) == 16U, "fm_cell_xf.wrap_text offset changed");
+static_assert(offsetof(fm_cell_xf, justify_last_line) == 20U, "fm_cell_xf.justify_last_line offset changed");
+static_assert(offsetof(fm_cell_xf, xf_id) == 24U, "fm_cell_xf.xf_id offset changed");
+static_assert(offsetof(fm_cell_xf, has_alignment) == 28U, "fm_cell_xf.has_alignment offset changed");
+static_assert(offsetof(fm_cell_xf, has_text_rotation) == 32U, "fm_cell_xf.has_text_rotation offset changed");
+static_assert(offsetof(fm_cell_xf, reading_order) == 68U, "fm_cell_xf.reading_order offset changed");
+static_assert(offsetof(fm_cell_xf, has_horizontal_align) == 72U, "fm_cell_xf.has_horizontal_align offset changed");
+static_assert(offsetof(fm_cell_xf, has_vertical_align) == 76U, "fm_cell_xf.has_vertical_align offset changed");
+static_assert(offsetof(fm_cell_xf, has_wrap_text) == 80U, "fm_cell_xf.has_wrap_text offset changed");
+static_assert(offsetof(fm_cell_xf, has_justify_last_line) == 84U, "fm_cell_xf.has_justify_last_line offset changed");
+static_assert(offsetof(fm_cell_xf, apply_number_format) == 88U, "fm_cell_xf.apply_number_format offset changed");
+static_assert(offsetof(fm_cell_xf, quote_prefix) == 112U, "fm_cell_xf.quote_prefix offset changed");
+static_assert(offsetof(fm_cell_xf, has_protection) == 116U, "fm_cell_xf.has_protection offset changed");
+static_assert(offsetof(fm_cell_xf, hidden) == 124U, "fm_cell_xf.hidden offset changed");
+static_assert(sizeof(fm_dxf_record) == (sizeof(void*) == 4U ? 368U : 376U), "fm_dxf_record ABI layout changed");
+static_assert(offsetof(fm_dxf_record, num_fmt_code) == 352U, "fm_dxf_record.num_fmt_code offset changed");
+static_assert(offsetof(fm_dxf_record, alignment_xml) == (sizeof(void*) == 4U ? 356U : 360U),
+              "fm_dxf_record.alignment_xml offset changed");
+static_assert(offsetof(fm_dxf_record, protection_xml) == (sizeof(void*) == 4U ? 360U : 368U),
+              "fm_dxf_record.protection_xml offset changed");
+
+// `fm_styles_batch` is fifteen pointer-width slots: five (array, count,
+// out-indices) triples whose `size_t` counts are the same width as a pointer on
+// both targets. Unlike its neighbours it is reached by no binding -- only the C
+// and C++ callers of `fm_styles_add_batch` -- so nothing cross-checks it from
+// the other side of the boundary and every offset is pinned here instead. A
+// reorder within the struct moves no total size, which is exactly why the
+// per-member offsets and not just `sizeof` are recorded.
+static_assert(sizeof(fm_styles_batch) == 15U * sizeof(void*), "fm_styles_batch ABI layout changed");
+static_assert(alignof(fm_styles_batch) == alignof(void*), "fm_styles_batch ABI alignment changed");
+static_assert(offsetof(fm_styles_batch, fonts) == 0U * sizeof(void*), "fm_styles_batch.fonts offset changed");
+static_assert(offsetof(fm_styles_batch, font_count) == 1U * sizeof(void*), "fm_styles_batch.font_count offset changed");
+static_assert(offsetof(fm_styles_batch, font_indices) == 2U * sizeof(void*),
+              "fm_styles_batch.font_indices offset changed");
+static_assert(offsetof(fm_styles_batch, fills) == 3U * sizeof(void*), "fm_styles_batch.fills offset changed");
+static_assert(offsetof(fm_styles_batch, fill_count) == 4U * sizeof(void*), "fm_styles_batch.fill_count offset changed");
+static_assert(offsetof(fm_styles_batch, fill_indices) == 5U * sizeof(void*),
+              "fm_styles_batch.fill_indices offset changed");
+static_assert(offsetof(fm_styles_batch, borders) == 6U * sizeof(void*), "fm_styles_batch.borders offset changed");
+static_assert(offsetof(fm_styles_batch, border_count) == 7U * sizeof(void*),
+              "fm_styles_batch.border_count offset changed");
+static_assert(offsetof(fm_styles_batch, border_indices) == 8U * sizeof(void*),
+              "fm_styles_batch.border_indices offset changed");
+static_assert(offsetof(fm_styles_batch, cell_xfs) == 9U * sizeof(void*), "fm_styles_batch.cell_xfs offset changed");
+static_assert(offsetof(fm_styles_batch, cell_xf_count) == 10U * sizeof(void*),
+              "fm_styles_batch.cell_xf_count offset changed");
+static_assert(offsetof(fm_styles_batch, cell_xf_indices) == 11U * sizeof(void*),
+              "fm_styles_batch.cell_xf_indices offset changed");
+static_assert(offsetof(fm_styles_batch, num_fmt_codes) == 12U * sizeof(void*),
+              "fm_styles_batch.num_fmt_codes offset changed");
+static_assert(offsetof(fm_styles_batch, num_fmt_count) == 13U * sizeof(void*),
+              "fm_styles_batch.num_fmt_count offset changed");
+static_assert(offsetof(fm_styles_batch, num_fmt_ids) == 14U * sizeof(void*),
+              "fm_styles_batch.num_fmt_ids offset changed");
+// The slots are pointer-width because `size_t` is, on every target this ABI
+// ships to. Pinned separately so a target where that stops holding fails here
+// rather than silently re-laying the struct out.
+static_assert(sizeof(size_t) == sizeof(void*), "fm_styles_batch assumes size_t is pointer-width");
+
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+};
+
+struct BufferGuard {
+  uint8_t* data = nullptr;
+  size_t len = 0;
+  ~BufferGuard() { fm_buffer_free(data); }
+  BufferGuard() = default;
+  BufferGuard(const BufferGuard&) = delete;
+  BufferGuard& operator=(const BufferGuard&) = delete;
+};
+
+[[maybe_unused]] constexpr char kNumFmtOverrideStyles[] =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
+    "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+    "<numFmts count=\"1\"><numFmt numFmtId=\"14\" formatCode=\"yyyy\"/></numFmts>"
+    "<fonts count=\"1\"><font><sz val=\"11\"/><name val=\"Calibri\"/></font></fonts>"
+    "<fills count=\"2\"><fill><patternFill patternType=\"none\"/></fill>"
+    "<fill><patternFill patternType=\"gray125\"/></fill></fills>"
+    "<borders count=\"1\"><border><left/><right/><top/><bottom/><diagonal/></border></borders>"
+    "<cellXfs count=\"1\"><xf numFmtId=\"0\" fontId=\"0\" fillId=\"0\" borderId=\"0\"/></cellXfs>"
+    "</styleSheet>";
+
+[[maybe_unused]] constexpr char kNumFmtDuplicateStyles[] =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
+    "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+    "<numFmts count=\"2\"><numFmt numFmtId=\"14\" formatCode=\"yyyy\"/>"
+    "<numFmt numFmtId=\"14\" formatCode=\"dd/mm/yyyy\"/></numFmts>"
+    "<fonts count=\"1\"><font><sz val=\"11\"/><name val=\"Calibri\"/></font></fonts>"
+    "<fills count=\"2\"><fill><patternFill patternType=\"none\"/></fill>"
+    "<fill><patternFill patternType=\"gray125\"/></fill></fills>"
+    "<borders count=\"1\"><border><left/><right/><top/><bottom/><diagonal/></border></borders>"
+    "<cellXfs count=\"1\"><xf numFmtId=\"0\" fontId=\"0\" fillId=\"0\" borderId=\"0\"/></cellXfs>"
+    "</styleSheet>";
+
+[[maybe_unused]] inline void LoadParsedStyles(fm_workbook_t* handle, const char* xml) {
+  const std::vector<std::uint8_t> bytes(xml, xml + std::strlen(xml));
+  auto parsed = formulon::io::read_styles(bytes);
+  ASSERT_TRUE(parsed.has_value());
+  handle->workbook().mutable_styles() = std::move(parsed.value());
+}
+
+[[maybe_unused]] inline void LoadNumFmtOverrideStyles(fm_workbook_t* handle) {
+  LoadParsedStyles(handle, kNumFmtOverrideStyles);
+}
+
+[[maybe_unused]] inline void LoadNumFmtDuplicateStyles(fm_workbook_t* handle) {
+  LoadParsedStyles(handle, kNumFmtDuplicateStyles);
+}
+
+[[maybe_unused]] inline std::string ExtractStylesXml(const BufferGuard& saved) {
+  formulon::io::ZipReader zip;
+  const auto opened = zip.open(formulon::io::ByteSpan{saved.data, saved.len});
+  if (!opened) {
+    ADD_FAILURE() << opened.error().message;
+    return {};
+  }
+  auto styles_part = zip.read_entry("xl/styles.xml");
+  if (!styles_part) {
+    ADD_FAILURE() << styles_part.error().message;
+    return {};
+  }
+  return {styles_part.value().begin(), styles_part.value().end()};
+}
+
+[[maybe_unused]] inline fm_font_record MakeArial() {
+  fm_font_record r{};
+  r.name = "Arial";
+  r.size = 12.0;
+  r.color_argb = 0xFF112233U;
+  r.bold = 1;
+  r.italic = 0;
+  r.strike = 0;
+  r.underline = 0;
+  return r;
+}
+
+[[maybe_unused]] inline fm_fill_record MakeRedFill() {
+  fm_fill_record r{};
+  r.pattern = 1;  // solid
+  r.fg_argb = 0xFFFF0000U;
+  r.bg_argb = 0xFF000000U;
+  return r;
+}
+
+[[maybe_unused]] inline fm_border_record MakeThinBoxBorder() {
+  fm_border_record r{};
+  r.left.style = 1;  // thin
+  r.left.color_argb = 0xFF000000U;
+  r.right = r.left;
+  r.top = r.left;
+  r.bottom = r.left;
+  r.diagonal.style = 0;
+  r.diagonal.color_argb = 0;
+  r.diagonal_up = 0;
+  r.diagonal_down = 0;
+  return r;
+}
+
+// An Excel-authored `<fonts>` section: the theme colour, `<family>` and
+// `<charset>` children are what a template carries and what a record built
+// from scratch through the C ABI cannot reproduce unless the ABI exposes
+// them.
+[[maybe_unused]] constexpr char kExcelAuthoredStyles[] =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
+    "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+    "<fonts count=\"3\">"
+    "<font><sz val=\"11\"/><color theme=\"1\"/><name val=\"Calibri\"/><family val=\"2\"/>"
+    "<charset val=\"128\"/></font>"
+    "<font><b/><sz val=\"11\"/><color theme=\"0\" tint=\"-0.25\"/><name val=\"Calibri\"/>"
+    "<family val=\"2\"/></font>"
+    "<font><vertAlign val=\"superscript\"/><sz val=\"9\"/><color rgb=\"FF112233\"/>"
+    "<name val=\"Calibri\"/></font>"
+    "</fonts>"
+    "<fills count=\"2\">"
+    "<fill><patternFill patternType=\"none\"/></fill>"
+    "<fill><patternFill patternType=\"solid\"><fgColor theme=\"4\" tint=\"0.5\"/>"
+    "<bgColor indexed=\"64\"/></patternFill></fill>"
+    "</fills>"
+    "<borders count=\"2\">"
+    "<border><left/><right/><top/><bottom/><diagonal/></border>"
+    "<border><left style=\"thin\"><color theme=\"3\"/></left><right/><top/><bottom/>"
+    "<diagonal/></border>"
+    "</borders>"
+    "<cellXfs count=\"1\"><xf numFmtId=\"0\" fontId=\"0\" fillId=\"0\" borderId=\"0\"/></cellXfs>"
+    "</styleSheet>";
+
+/// Installs `kExcelAuthoredStyles` as the workbook's styles table.
+[[maybe_unused]] inline void LoadExcelAuthoredStyles(fm_workbook_t* handle) {
+  const std::vector<std::uint8_t> bytes(kExcelAuthoredStyles, kExcelAuthoredStyles + std::strlen(kExcelAuthoredStyles));
+  auto parsed = formulon::io::read_styles(bytes);
+  ASSERT_TRUE(parsed.has_value());
+  handle->workbook().mutable_styles() = std::move(parsed.value());
+}
+
+}  // namespace
diff --git a/tests/c_api/formulon_c_test.cpp b/tests/c_api/formulon_c_test.cpp
index e8aa6c343..4d05119ee 100644
--- a/tests/c_api/formulon_c_test.cpp
+++ b/tests/c_api/formulon_c_test.cpp
@@ -1,36 +1,18 @@
-//
 // Stable C ABI (`src/c_api/formulon_c.h`) end-to-end tests.
 //
 // The test driver is C++ for gtest convenience but everything it
 // touches across the boundary is the pure-C surface declared in
-// `formulon_c.h`. The same surface drives the CLI binary, the WASM
-// embind layer, and any external language binding, so this file is the
-// regression harness for the contract.
-
-#include "c_api/formulon_c.h"
+// `formulon_c.h`.
 
-#include <algorithm>
-#include <atomic>
 #include <cstddef>
-#include <cstdint>
-#include <cstring>
-#include <limits>
 #include <string>
-#include <string_view>
-#include <thread>
-#include <utility>
-#include <vector>
 
 #include "c_api/parts/common.h"
+#include "formulon_c_test_helpers.h"
 #include "gtest/gtest.h"
-#include "io/format_detect.h"
-#include "io/xlsb/writer.h"
+#include "io/auto_filter_xml.h"
 #include "io/zip_reader.h"
-#include "passthrough_part.h"
 #include "sheet.h"
-#include "unknown_relationship.h"
-#include "utils/error.h"
-#include "value.h"
 #include "workbook.h"
 
 static_assert(offsetof(fm_parallel_recalc_stats, cells_evaluated) == 0U);
@@ -82,130 +64,6 @@ static_assert(offsetof(fm_print_range_t, first_col) == 4U, "fm_print_range_t.fir
 static_assert(offsetof(fm_print_range_t, last_row) == 8U, "fm_print_range_t.last_row offset changed");
 static_assert(offsetof(fm_print_range_t, last_col) == 12U, "fm_print_range_t.last_col offset changed");
 
-namespace {
-
-// RAII wrapper so the workbook handle is released even on test failure.
-struct WorkbookGuard {
-  fm_workbook_t* handle = nullptr;
-  ~WorkbookGuard() { fm_workbook_destroy(handle); }
-  WorkbookGuard() = default;
-  WorkbookGuard(const WorkbookGuard&) = delete;
-  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
-};
-
-// RAII wrapper for buffers returned by `fm_workbook_save`.
-struct BufferGuard {
-  uint8_t* data = nullptr;
-  size_t len = 0;
-  ~BufferGuard() { fm_buffer_free(data); }
-  BufferGuard() = default;
-  BufferGuard(const BufferGuard&) = delete;
-  BufferGuard& operator=(const BufferGuard&) = delete;
-};
-
-void MarkZipEntriesEncrypted(std::vector<std::uint8_t>& bytes) {
-  for (std::size_t i = 0; i + 8U <= bytes.size(); ++i) {
-    const bool local = bytes[i] == 'P' && bytes[i + 1U] == 'K' && bytes[i + 2U] == 3U && bytes[i + 3U] == 4U;
-    const bool central = bytes[i] == 'P' && bytes[i + 1U] == 'K' && bytes[i + 2U] == 1U && bytes[i + 3U] == 2U;
-    if (local || central) {
-      const std::size_t flag_offset = i + (local ? 6U : 8U);
-      bytes[flag_offset] = static_cast<std::uint8_t>(bytes[flag_offset] | 0x01U);
-    }
-  }
-}
-
-std::vector<std::uint8_t> AppendEmptyZipEntry(const std::vector<std::uint8_t>& bytes, std::string_view name) {
-  const std::uint8_t signature[] = {0x50, 0x4b, 0x05, 0x06};
-  const auto eocd_it = std::find_end(bytes.begin(), bytes.end(), std::begin(signature), std::end(signature));
-  EXPECT_NE(eocd_it, bytes.end());
-  if (eocd_it == bytes.end()) {
-    return {};
-  }
-  const std::size_t eocd = static_cast<std::size_t>(eocd_it - bytes.begin());
-  const auto read16 = [&](std::size_t offset) {
-    return static_cast<std::uint16_t>(bytes[offset] | (static_cast<std::uint16_t>(bytes[offset + 1U]) << 8U));
-  };
-  const auto read32 = [&](std::size_t offset) {
-    return static_cast<std::uint32_t>(bytes[offset] | (static_cast<std::uint32_t>(bytes[offset + 1U]) << 8U) |
-                                      (static_cast<std::uint32_t>(bytes[offset + 2U]) << 16U) |
-                                      (static_cast<std::uint32_t>(bytes[offset + 3U]) << 24U));
-  };
-  const std::uint16_t count = read16(eocd + 10U);
-  const std::uint32_t central_size = read32(eocd + 12U);
-  const std::uint32_t central_offset = read32(eocd + 16U);
-  const auto put16 = [](std::vector<std::uint8_t>& out, std::uint16_t value) {
-    out.push_back(static_cast<std::uint8_t>(value));
-    out.push_back(static_cast<std::uint8_t>(value >> 8U));
-  };
-  const auto put32 = [](std::vector<std::uint8_t>& out, std::uint32_t value) {
-    out.push_back(static_cast<std::uint8_t>(value));
-    out.push_back(static_cast<std::uint8_t>(value >> 8U));
-    out.push_back(static_cast<std::uint8_t>(value >> 16U));
-    out.push_back(static_cast<std::uint8_t>(value >> 24U));
-  };
-  const std::string encoded_name(name);
-  std::vector<std::uint8_t> local;
-  put32(local, 0x04034b50U);
-  put16(local, 20);
-  put16(local, 0);
-  put16(local, 0);
-  put16(local, 0);
-  put16(local, 0);
-  put32(local, 0);
-  put32(local, 0);
-  put32(local, 0);
-  put16(local, static_cast<std::uint16_t>(encoded_name.size()));
-  put16(local, 0);
-  local.insert(local.end(), encoded_name.begin(), encoded_name.end());
-  std::vector<std::uint8_t> central;
-  put32(central, 0x02014b50U);
-  put16(central, 20);
-  put16(central, 20);
-  put16(central, 0);
-  put16(central, 0);
-  put16(central, 0);
-  put16(central, 0);
-  put32(central, 0);
-  put32(central, 0);
-  put32(central, 0);
-  put16(central, static_cast<std::uint16_t>(encoded_name.size()));
-  put16(central, 0);
-  put16(central, 0);
-  put16(central, 0);
-  put16(central, 0);
-  put32(central, 0);
-  put32(central, central_offset);
-  central.insert(central.end(), encoded_name.begin(), encoded_name.end());
-  std::vector<std::uint8_t> out;
-  out.insert(out.end(), bytes.begin(), bytes.begin() + central_offset);
-  out.insert(out.end(), local.begin(), local.end());
-  out.insert(out.end(), bytes.begin() + central_offset, bytes.begin() + central_offset + central_size);
-  out.insert(out.end(), central.begin(), central.end());
-  put32(out, 0x06054b50U);
-  put16(out, 0);
-  put16(out, 0);
-  put16(out, count + 1U);
-  put16(out, count + 1U);
-  put32(out, central_size + static_cast<std::uint32_t>(central.size()));
-  put32(out, central_offset + static_cast<std::uint32_t>(local.size()));
-  put16(out, 0);
-  return out;
-}
-
-}  // namespace
-
-TEST(FormulonCApi, CreateAndDestroy) {
-  WorkbookGuard wb;
-  EXPECT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_NE(wb.handle, nullptr);
-  // create() always seeds a single Sheet1.
-  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 1U);
-  const char* name = nullptr;
-  EXPECT_EQ(fm_workbook_sheet_name(wb.handle, 0, &name), 0);
-  ASSERT_NE(name, nullptr);
-  EXPECT_STREQ(name, "Sheet1");
-}
-
 TEST(FormulonCApi, TableCreateUpdateRemoveRoundTripsThroughOoxml) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -238,7 +96,6 @@ TEST(FormulonCApi, TableCreateUpdateRemoveRoundTripsThroughOoxml) {
   ASSERT_EQ(fm_workbook_table_remove(loaded.handle, 0), 0);
   EXPECT_EQ(fm_workbook_table_count(loaded.handle), 0U);
 }
-
 TEST(FormulonCApi, TableMutationsReindexStructuredRefDependents) {
   // A `StructuredRef` resolves to a static rectangle once, at formula
   // registration time (`eval/dep_extractor.cpp`'s `walk_structured_ref`),
@@ -282,7 +139,6 @@ TEST(FormulonCApi, TableMutationsReindexStructuredRefDependents) {
   EXPECT_NE(v.kind, FM_VAL_NUMBER)
       << "table_remove must reindex the formula so it re-evaluates against a missing table";
 }
-
 TEST(FormulonCApi, TableRangeMustMatchTheColumnList) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -305,7 +161,6 @@ TEST(FormulonCApi, TableRangeMustMatchTheColumnList) {
   EXPECT_NE(fm_workbook_table_create(wb.handle, 0, "D1:E3", "Other", "Other", duplicate_columns, 2, "", 1, 0, &index),
             0);
 }
-
 TEST(FormulonCApi, TableUpdatePreservesRawMetadataAcrossSaveLoad) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -317,9 +172,9 @@ TEST(FormulonCApi, TableUpdatePreservesRawMetadataAcrossSaveLoad) {
   // Seed payload that the C ABI deliberately does not model. The update must
   // rewrite only the opening autoFilter ref and retain every raw payload.
   auto& table = wb.handle->wb->mutable_tables()[index];
-  table.auto_filter_xml =
+  table.auto_filter_xml.set(formulon::io::auto_filter_from_xml(
       "<autoFilter ref=\"A1:B3\"><filterColumn colId=\"0\"><filters><filter val=\"West\"/></filters></filterColumn>"
-      "</autoFilter>";
+      "</autoFilter>"));
   table.sort_state_xml = "<sortState ref=\"A1:B3\"><sortCondition ref=\"B2:B3\" descending=\"1\"/></sortState>";
   table.table_style_info_xml = "<tableStyleInfo name=\"CustomStyle\" showRowStripes=\"0\"/>";
   table.ext_lst_xml = "<extLst><ext uri=\"urn:formulon:test\"><futureTableData value=\"kept\"/></ext></extLst>";
@@ -328,8 +183,8 @@ TEST(FormulonCApi, TableUpdatePreservesRawMetadataAcrossSaveLoad) {
   EXPECT_EQ(table.ref, "A1:B4");
   EXPECT_TRUE(table.header_row);
   EXPECT_TRUE(table.totals_row);
-  EXPECT_NE(table.auto_filter_xml.find("ref=\"A1:B4\""), std::string::npos);
-  EXPECT_NE(table.auto_filter_xml.find("filterColumn"), std::string::npos);
+  EXPECT_NE(formulon::io::auto_filter_xml(table.auto_filter_xml.get()).find("ref=\"A1:B4\""), std::string::npos);
+  EXPECT_NE(formulon::io::auto_filter_xml(table.auto_filter_xml.get()).find("filterColumn"), std::string::npos);
   EXPECT_NE(table.sort_state_xml.find("ref=\"A1:B3\""), std::string::npos);
   EXPECT_NE(table.sort_state_xml.find("sortCondition"), std::string::npos);
   EXPECT_EQ(table.table_style_info_xml, "<tableStyleInfo name=\"CustomStyle\" showRowStripes=\"0\"/>");
@@ -344,9 +199,9 @@ TEST(FormulonCApi, TableUpdatePreservesRawMetadataAcrossSaveLoad) {
   EXPECT_EQ(reloaded.ref, "A1:B4");
   EXPECT_TRUE(reloaded.header_row);
   EXPECT_TRUE(reloaded.totals_row);
-  EXPECT_NE(reloaded.auto_filter_xml.find("ref=\"A1:B4\""), std::string::npos);
-  EXPECT_NE(reloaded.auto_filter_xml.find("filterColumn"), std::string::npos);
-  EXPECT_NE(reloaded.auto_filter_xml.find("West"), std::string::npos);
+  EXPECT_NE(formulon::io::auto_filter_xml(reloaded.auto_filter_xml.get()).find("ref=\"A1:B4\""), std::string::npos);
+  EXPECT_NE(formulon::io::auto_filter_xml(reloaded.auto_filter_xml.get()).find("filterColumn"), std::string::npos);
+  EXPECT_NE(formulon::io::auto_filter_xml(reloaded.auto_filter_xml.get()).find("West"), std::string::npos);
   EXPECT_EQ(reloaded.sort_state_xml,
             "<sortState ref=\"A1:B3\"><sortCondition ref=\"B2:B3\" descending=\"1\"/></sortState>");
   EXPECT_EQ(reloaded.table_style_info_xml, "<tableStyleInfo name=\"CustomStyle\" showRowStripes=\"0\"/>");
@@ -377,7 +232,6 @@ TEST(FormulonCApi, TableUpdatePreservesRawMetadataAcrossSaveLoad) {
   EXPECT_NE(table_xml.find("sortCondition ref=\"B2:B3\""), std::string::npos);
   EXPECT_NE(table_xml.find("futureTableData value=\"kept\""), std::string::npos);
 }
-
 TEST(FormulonCApi, PaginationSnapshotExposesBreaksAndUsedRangeFallback) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -413,7 +267,6 @@ TEST(FormulonCApi, PaginationSnapshotExposesBreaksAndUsedRangeFallback) {
   EXPECT_NE(fm_workbook_paginate(nullptr, 0, &pagination), 0);
   EXPECT_NE(fm_workbook_paginate(wb.handle, 0, nullptr), 0);
 }
-
 TEST(FormulonCApi, CellPhoneticCanBeReadClearedAndRejectsInvalidArguments) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -441,7 +294,6 @@ TEST(FormulonCApi, CellPhoneticCanBeReadClearedAndRejectsInvalidArguments) {
   EXPECT_NE(fm_workbook_set_cell_phonetic(wb.handle, 0, formulon::Sheet::kMaxRows, 0, "x"), 0);
   EXPECT_NE(fm_workbook_get_cell_phonetic(wb.handle, 0, 0, 0, nullptr), 0);
 }
-
 TEST(FormulonCApi, CellPhoneticSettersDirtyPhoneticFormulaDependents) {
   // `PHONETIC(A1)` depends on A1 through the same reference edge any other
   // function argument creates, so changing what A1's reading is (without
@@ -473,7 +325,6 @@ TEST(FormulonCApi, CellPhoneticSettersDirtyPhoneticFormulaDependents) {
   ASSERT_EQ(v.kind, FM_VAL_TEXT);
   EXPECT_STREQ(v.u.text, "らん") << "changing A1's phonetic runs must dirty PHONETIC(A1)";
 }
-
 TEST(FormulonCApi, CellPhoneticRunsPreserveTheirSpans) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -513,7 +364,6 @@ TEST(FormulonCApi, CellPhoneticRunsPreserveTheirSpans) {
   ASSERT_EQ(fm_workbook_get_cell_phonetic_run_count(wb.handle, 0, 5, 5, &count), 0);
   EXPECT_EQ(count, 0U);
 }
-
 TEST(FormulonCApi, CellPhoneticRunsRejectMalformedInput) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -543,7 +393,6 @@ TEST(FormulonCApi, CellPhoneticRunsRejectMalformedInput) {
   EXPECT_NE(fm_workbook_get_cell_phonetic_run(wb.handle, 0, 0, 0, 0U, nullptr), 0);
   EXPECT_NE(fm_workbook_get_cell_phonetic_run_count(wb.handle, 0, 0, 0, nullptr), 0);
 }
-
 TEST(FormulonCApi, CellPhoneticPropertiesAreIndependentOfTheRuns) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -583,7 +432,6 @@ TEST(FormulonCApi, CellPhoneticPropertiesAreIndependentOfTheRuns) {
   EXPECT_EQ(type, 0U);
   EXPECT_EQ(alignment, 0U);
 }
-
 TEST(FormulonCApi, CellPhoneticPropertiesRejectValuesTheContainerCannotHold) {
   WorkbookGuard wb;
   ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
@@ -610,878 +458,3 @@ TEST(FormulonCApi, CellPhoneticPropertiesRejectValuesTheContainerCannotHold) {
   EXPECT_EQ(type, FM_PHONETIC_TYPE_NO_CONVERSION);
   EXPECT_EQ(alignment, FM_PHONETIC_ALIGNMENT_DISTRIBUTED);
 }
-
-TEST(FormulonCApi, LoadMapsCorruptAndEncryptedContainersToIoErrors) {
-  fm_workbook_t* loaded = reinterpret_cast<fm_workbook_t*>(0x1);
-  const std::vector<std::uint8_t> garbage = {0x01U, 0x02U, 0x03U, 0x04U};
-  EXPECT_EQ(fm_workbook_load(garbage.data(), garbage.size(), &loaded),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoZipCorrupt));
-  EXPECT_EQ(loaded, nullptr);
-
-  loaded = reinterpret_cast<fm_workbook_t*>(0x1);
-  const std::vector<std::uint8_t> cdfv2 = {0xD0U, 0xCFU, 0x11U, 0xE0U, 0xA1U, 0xB1U, 0x1AU, 0xE1U};
-  EXPECT_EQ(fm_workbook_load(cdfv2.data(), cdfv2.size(), &loaded),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoZipEncrypted));
-  EXPECT_EQ(loaded, nullptr);
-
-  formulon::Workbook source = formulon::Workbook::create();
-  auto saved = source.save();
-  ASSERT_TRUE(static_cast<bool>(saved));
-  std::vector<std::uint8_t> encrypted = saved.value();
-  MarkZipEntriesEncrypted(encrypted);
-  loaded = reinterpret_cast<fm_workbook_t*>(0x1);
-  EXPECT_EQ(fm_workbook_load(encrypted.data(), encrypted.size(), &loaded),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoZipEncrypted));
-  EXPECT_EQ(loaded, nullptr);
-}
-
-TEST(FormulonCApi, CreateEmptyAndAddSheet) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create_empty(&wb.handle), 0);
-  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 0U);
-  EXPECT_EQ(fm_workbook_add_sheet(wb.handle, "Data"), 0);
-  EXPECT_EQ(fm_workbook_add_sheet(wb.handle, "Stats"), 0);
-  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 2U);
-
-  const char* n0 = nullptr;
-  const char* n1 = nullptr;
-  ASSERT_EQ(fm_workbook_sheet_name(wb.handle, 0, &n0), 0);
-  ASSERT_EQ(fm_workbook_sheet_name(wb.handle, 1, &n1), 0);
-  EXPECT_STREQ(n0, "Data");
-  EXPECT_STREQ(n1, "Stats");
-}
-
-TEST(FormulonCApi, AddSheetValidatesNameAndRejectsDuplicate) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create_empty(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Data"), 0);
-  // Duplicate (case-insensitive), forbidden character, and empty name are
-  // all rejected now that the public add surface shares the rename
-  // validator instead of silently accepting anything.
-  EXPECT_NE(fm_workbook_add_sheet(wb.handle, "data"), 0);
-  EXPECT_NE(fm_workbook_add_sheet(wb.handle, "a/b"), 0);
-  EXPECT_NE(fm_workbook_add_sheet(wb.handle, ""), 0);
-  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 1U);
-  // A valid, distinct name still succeeds.
-  EXPECT_EQ(fm_workbook_add_sheet(wb.handle, "Stats"), 0);
-  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 2U);
-}
-
-TEST(FormulonCApi, NumberLiteralRoundTrip) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 42.5), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(v.u.number, 42.5);
-}
-
-TEST(FormulonCApi, GetValueRejectsCoordinatesOutsideTheGrid) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  const fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  fm_value_t v{};
-  EXPECT_EQ(fm_workbook_get_value(wb.handle, 0, formulon::Sheet::kMaxRows, 0, &v), kInvalidArgument);
-  EXPECT_EQ(fm_workbook_get_value(wb.handle, 0, 0, formulon::Sheet::kMaxCols, &v), kInvalidArgument);
-  // The last addressable cell is still readable.
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, formulon::Sheet::kMaxRows - 1, formulon::Sheet::kMaxCols - 1, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_BLANK);
-}
-
-TEST(FormulonCApi, SetNumberRejectsNaNAndInfinity) {
-  // A Number-kind cell must always hold a finite double: ISNUMBER,
-  // arithmetic on the cell, and a save/reload round trip would otherwise
-  // disagree about whether it is a number or an error (save() downgrades a
-  // non-finite literal to #NUM!, per io/ooxml_writer_cell.cpp).
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  const fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
-  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, std::numeric_limits<double>::quiet_NaN()), kInvalidArgument);
-  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, std::numeric_limits<double>::infinity()), kInvalidArgument);
-  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, -std::numeric_limits<double>::infinity()), kInvalidArgument);
-
-  // A rejected call must not have written anything: the cell stays blank.
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_BLANK);
-
-  // A finite value still succeeds.
-  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.5), 0);
-}
-
-TEST(FormulonCApi, ParallelRecalcMatchesSerialOnWideIndependentDag) {
-  WorkbookGuard serial;
-  WorkbookGuard parallel;
-  ASSERT_EQ(fm_workbook_create(&serial.handle), 0);
-  ASSERT_EQ(fm_workbook_create(&parallel.handle), 0);
-
-  constexpr std::uint32_t kRows = 48U;
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    const double input = static_cast<double>(row + 1U);
-    const std::string formula = "=A" + std::to_string(row + 1U) + "*2+1";
-    ASSERT_EQ(fm_workbook_set_number(serial.handle, 0U, row, 0U, input), 0);
-    ASSERT_EQ(fm_workbook_set_number(parallel.handle, 0U, row, 0U, input), 0);
-    ASSERT_EQ(fm_workbook_set_formula(serial.handle, 0U, row, 1U, formula.c_str()), 0);
-    ASSERT_EQ(fm_workbook_set_formula(parallel.handle, 0U, row, 1U, formula.c_str()), 0);
-  }
-
-  ASSERT_EQ(fm_workbook_recalc(serial.handle), 0);
-  fm_parallel_recalc_stats stats{};
-  ASSERT_EQ(fm_workbook_recalc_parallel(parallel.handle, 4U, &stats), 0);
-  EXPECT_EQ(stats.cells_evaluated, kRows);
-  EXPECT_GE(stats.sccs_processed, kRows);
-  EXPECT_GE(stats.parallel_steps, 1U);
-  EXPECT_GE(stats.worker_threads_started, 2U);
-  EXPECT_GE(stats.worker_threads_used, 1U);
-
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    fm_value_t serial_value{};
-    fm_value_t parallel_value{};
-    ASSERT_EQ(fm_workbook_get_value(serial.handle, 0U, row, 1U, &serial_value), 0);
-    ASSERT_EQ(fm_workbook_get_value(parallel.handle, 0U, row, 1U, &parallel_value), 0);
-    ASSERT_EQ(serial_value.kind, FM_VAL_NUMBER);
-    ASSERT_EQ(parallel_value.kind, FM_VAL_NUMBER);
-    EXPECT_DOUBLE_EQ(parallel_value.u.number, serial_value.u.number);
-    EXPECT_DOUBLE_EQ(parallel_value.u.number, static_cast<double>(row + 1U) * 2.0 + 1.0);
-  }
-}
-
-TEST(FormulonCApi, ParallelRecalcCountOneStartsNoWorkers) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0U, 0U, 0U, 7.0), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0U, 0U, 1U, "=A1+1"), 0);
-
-  fm_parallel_recalc_stats stats{};
-  ASSERT_EQ(fm_workbook_recalc_parallel(wb.handle, 1U, &stats), 0);
-  EXPECT_EQ(stats.cells_evaluated, 1U);
-  EXPECT_EQ(stats.worker_threads_started, 0U);
-  EXPECT_EQ(stats.worker_threads_used, 0U);
-
-  // The output is optional for callers that only need the status code.
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0U, 0U, 0U, 9.0), 0);
-  EXPECT_EQ(fm_workbook_recalc_parallel(wb.handle, 1U, nullptr), 0);
-}
-
-TEST(FormulonCApi, ParallelRecalcInvalidAndNullPathsResetStats) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  const fm_parallel_recalc_stats poison = {1U, 2U, 3U, 4U, 5U, 6U, 7U};
-  const fm_parallel_recalc_stats zero{};
-  fm_parallel_recalc_stats stats = poison;
-  EXPECT_EQ(fm_workbook_recalc_parallel(wb.handle, 9U, &stats),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(std::memcmp(&stats, &zero, sizeof(stats)), 0);
-
-  stats = poison;
-  EXPECT_EQ(fm_workbook_recalc_parallel(nullptr, 1U, &stats),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-  EXPECT_EQ(std::memcmp(&stats, &zero, sizeof(stats)), 0);
-
-  EXPECT_EQ(fm_workbook_recalc_parallel(wb.handle, 1U, nullptr), 0);
-}
-
-TEST(FormulonCApi, BoolAndBlankSetters) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_bool(wb.handle, 0, 0, 0, 1), 0);
-  ASSERT_EQ(fm_workbook_set_bool(wb.handle, 0, 1, 0, 0), 0);
-  ASSERT_EQ(fm_workbook_set_blank(wb.handle, 0, 2, 0), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_BOOL);
-  EXPECT_EQ(v.u.boolean, 1);
-
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 1, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_BOOL);
-  EXPECT_EQ(v.u.boolean, 0);
-
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 2, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_BLANK);
-}
-
-TEST(FormulonCApi, ErrorSetterStoresStaticErrorLiteral) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_error(wb.handle, 0, 0, 0, 1), 0);  // ErrorCode::Div0
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_ERROR);
-  EXPECT_EQ(v.u.error_code, 1);
-}
-
-TEST(FormulonCApi, ErrorSetterRejectsInvalidErrorCode) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  EXPECT_NE(fm_workbook_set_error(wb.handle, 0, 0, 0, -1), 0);
-  EXPECT_NE(fm_workbook_set_error(wb.handle, 0, 0, 0, 999), 0);
-}
-
-TEST(FormulonCApi, FormulaNumericResult) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 10.0), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 1, 0, "=A1*2"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 1, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(v.u.number, 20.0);
-}
-
-TEST(FormulonCApi, FormulaTextResult) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=UPPER(\"hello\")"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_TEXT);
-  ASSERT_NE(v.u.text, nullptr);
-  EXPECT_STREQ(v.u.text, "HELLO");
-}
-
-TEST(FormulonCApi, TextSetterRoundTrip) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  // Use a stack buffer that goes out of scope before recalc to confirm
-  // the handle interns the bytes.
-  {
-    char tmp[] = "hello";
-    ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 0, 0, tmp), 0);
-    // Mutate the source buffer to prove we're not aliasing.
-    tmp[0] = 'X';
-    (void)tmp[0];
-  }
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_TEXT);
-  ASSERT_NE(v.u.text, nullptr);
-  EXPECT_STREQ(v.u.text, "hello");
-  // Verify the returned pointer is actually NUL-terminated by inspecting
-  // strlen against the documented length.
-  EXPECT_EQ(std::strlen(v.u.text), 5U);
-}
-
-TEST(FormulonCApi, FormulaErrorSurfacesAsValueError) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=1/0"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_ERROR);
-  // Excel's `#DIV/0!` is `ErrorCode::Div0`, ordinal 1.
-  EXPECT_EQ(v.u.error_code, 1);
-}
-
-TEST(FormulonCApi, NullWorkbookSetsBindingError) {
-  fm_value_t v{};
-  fm_status_t rc = fm_workbook_get_value(nullptr, 0, 0, 0, &v);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-  EXPECT_GT(std::strlen(fm_last_error_message()), 0U);
-
-  // Also exercise the create-side NULL path.
-  rc = fm_workbook_create(nullptr);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
-  EXPECT_GT(std::strlen(fm_last_error_message()), 0U);
-}
-
-TEST(FormulonCApi, OutOfRangeSheetIndex) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  fm_status_t rc = fm_workbook_set_number(wb.handle, 99, 0, 0, 1.0);
-  EXPECT_NE(rc, 0);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  // Context should reference the offending sheet index.
-  std::string ctx = fm_last_error_context();
-  EXPECT_NE(ctx.find("sheet_index"), std::string::npos) << "context=" << ctx;
-}
-
-TEST(FormulonCApi, OutOfGridCoordinateIsRejected) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  // A column near the top of the u32 range would otherwise resize a row
-  // vector to billions of cells. It must be rejected before the storage
-  // layer, not turned into a multi-GB allocation.
-  const std::uint32_t kBadCol = 4'000'000'000U;
-  fm_status_t rc = fm_workbook_set_number(wb.handle, 0, 0, kBadCol, 1.0);
-  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  std::string ctx = fm_last_error_context();
-  EXPECT_NE(ctx.find("col"), std::string::npos) << "context=" << ctx;
-
-  // Row at the Excel ceiling (kMaxRows) is one past the last addressable
-  // row and must also be rejected.
-  EXPECT_EQ(fm_workbook_set_formula(wb.handle, 0, formulon::Sheet::kMaxRows, 0, "=1"),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-  EXPECT_EQ(fm_workbook_set_blank(wb.handle, 0, 0, formulon::Sheet::kMaxCols),
-            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-
-  // The last in-grid cell still round-trips.
-  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, formulon::Sheet::kMaxRows - 1U, formulon::Sheet::kMaxCols - 1U, 3.0),
-            0);
-}
-
-TEST(FormulonCApi, SuccessClearsPreviousLastError) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  // First, force an error so the thread-local diagnostic is populated.
-  fm_value_t v{};
-  ASSERT_NE(fm_workbook_get_value(nullptr, 0, 0, 0, &v), 0);
-  EXPECT_GT(std::strlen(fm_last_error_message()), 0U);
-  // Now drive a success and confirm the diagnostic was cleared.
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.0), 0);
-  EXPECT_EQ(std::strlen(fm_last_error_message()), 0U);
-  EXPECT_EQ(std::strlen(fm_last_error_context()), 0U);
-}
-
-TEST(FormulonCApi, SaveLoadRoundTrip) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Second"), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 7.0), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 1, 0, "=A1+1"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  BufferGuard buf;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &buf.data, &buf.len), 0);
-  ASSERT_NE(buf.data, nullptr);
-  EXPECT_GT(buf.len, 0U);
-
-  WorkbookGuard loaded;
-  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &loaded.handle), 0);
-  EXPECT_EQ(fm_workbook_sheet_count(loaded.handle), 2U);
-
-  const char* sheet0 = nullptr;
-  ASSERT_EQ(fm_workbook_sheet_name(loaded.handle, 0, &sheet0), 0);
-  EXPECT_STREQ(sheet0, "Sheet1");
-
-  // The literal A1=7 must round-trip; the formula B1=A1+1 may need a
-  // recalc on the loaded workbook to populate its cached value.
-  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
-  fm_value_t a1{};
-  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 0, 0, &a1), 0);
-  EXPECT_EQ(a1.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(a1.u.number, 7.0);
-}
-
-TEST(FormulonCApi, SaveExXlsxMatchesSave) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 7.0), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  BufferGuard xlsx_buf;
-  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSX, &xlsx_buf.data, &xlsx_buf.len), 0);
-  ASSERT_NE(xlsx_buf.data, nullptr);
-  EXPECT_GT(xlsx_buf.len, 0U);
-
-  // `FM_WORKBOOK_FORMAT_XLSX` must produce an OOXML container, so the
-  // C ABI's own format sniff (used by `fm_workbook_load`) reports it as
-  // such rather than xlsb.
-  formulon::io::ByteSpan xlsx_span{xlsx_buf.data, xlsx_buf.len};
-  EXPECT_EQ(formulon::io::detect_workbook_format(xlsx_span), formulon::WorkbookFormat::Ooxml);
-}
-
-TEST(FormulonCApi, SaveExXlsbProducesLoadableXlsbContainer) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 42.0), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  BufferGuard xlsb_buf;
-  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSB, &xlsb_buf.data, &xlsb_buf.len), 0);
-  ASSERT_NE(xlsb_buf.data, nullptr);
-  EXPECT_GT(xlsb_buf.len, 0U);
-
-  // The bytes must be a real MS-XLSB package (declares `xl/workbook.bin`,
-  // not `xl/workbook.xml`), and must load back through the byte-only
-  // C ABI, which auto-detects the container from its contents.
-  formulon::io::ByteSpan xlsb_span{xlsb_buf.data, xlsb_buf.len};
-  EXPECT_EQ(formulon::io::detect_workbook_format(xlsb_span), formulon::WorkbookFormat::Xlsb);
-
-  WorkbookGuard loaded;
-  ASSERT_EQ(fm_workbook_load(xlsb_buf.data, xlsb_buf.len, &loaded.handle), 0);
-  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(v.u.number, 42.0);
-}
-
-TEST(FormulonCApi, SaveWithDiagnosticsReportsTheXlsbCountersAndLeavesTheXlsxOnesZero) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=T[C]"), 0);
-
-  auto& sheet = wb.handle->workbook().sheet(0);
-  formulon::Hyperlink hyperlink;
-  hyperlink.target = "https://example.com";
-  sheet.mutable_hyperlinks().push_back(std::move(hyperlink));
-  sheet.mutable_validations().push_back(formulon::DataValidation{});
-  sheet.set_auto_filter_xml("<autoFilter ref=\"A1:B2\"/>");
-
-  // The OOXML writer represents all of the above, so a clean XLSX save
-  // reports nothing lost -- including on the two fields both writers own.
-  BufferGuard xlsx_buf;
-  fm_save_diagnostics_t xlsx{99U, 99U, 99U, 99U, 99U};
-  ASSERT_EQ(fm_workbook_save_with_diagnostics(wb.handle, FM_WORKBOOK_FORMAT_XLSX, &xlsx_buf.data, &xlsx_buf.len, &xlsx),
-            0);
-  EXPECT_EQ(xlsx.downgraded_formula_count, 0U);
-  EXPECT_EQ(xlsx.deferred_feature_count, 0U);
-  EXPECT_EQ(xlsx.dropped_part_count, 0U);
-  EXPECT_EQ(xlsx.dropped_relationship_count, 0U);
-  EXPECT_EQ(xlsx.renumbered_part_count, 0U);
-
-  BufferGuard xlsb_buf;
-  fm_save_diagnostics_t xlsb{};
-  ASSERT_EQ(fm_workbook_save_with_diagnostics(wb.handle, FM_WORKBOOK_FORMAT_XLSB, &xlsb_buf.data, &xlsb_buf.len, &xlsb),
-            0);
-  EXPECT_EQ(xlsb.downgraded_formula_count, 1U);
-  // Auto-filter state remains deferred. Hyperlinks and validations are
-  // written from the model and are therefore not counted here.
-  EXPECT_EQ(xlsb.deferred_feature_count, 1U);
-  // `renumbered_part_count` has no XLSB source: the binary writer never
-  // reassigns a part id.
-  EXPECT_EQ(xlsb.renumbered_part_count, 0U);
-}
-
-TEST(FormulonCApi, SaveWithDiagnosticsCarriesTheOoxmlWriterCountersAcrossTheAbi) {
-  // The OOXML writer's own counters are unit-tested at the io layer; this
-  // pins that they survive the projection onto `fm_save_diagnostics_t`
-  // instead of arriving as zero.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.0), 0);
-
-  // A preserved copy of a part the writer always generates loses the
-  // collision and is dropped; a relationship whose target part is absent is
-  // dropped rather than left dangling.
-  formulon::PassthroughPart stale;
-  stale.path = "xl/styles.xml";
-  stale.content_type = "application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml";
-  stale.bytes = {'<', '/', '>'};
-  wb.handle->workbook().set_passthrough_parts({std::move(stale)});
-  formulon::UnknownRelationship orphan;
-  orphan.id = "rId9";
-  orphan.type = "http://schemas.example.com/orphan";
-  orphan.target = "xl/missing.xml";
-  wb.handle->workbook().set_unknown_workbook_rels({std::move(orphan)});
-
-  BufferGuard buf;
-  fm_save_diagnostics_t d{99U, 99U, 99U, 99U, 99U};
-  ASSERT_EQ(fm_workbook_save_with_diagnostics(wb.handle, FM_WORKBOOK_FORMAT_XLSX, &buf.data, &buf.len, &d), 0);
-  EXPECT_GT(buf.len, 0U);
-  EXPECT_EQ(d.dropped_part_count, 1U);
-  EXPECT_EQ(d.dropped_relationship_count, 1U);
-  EXPECT_EQ(d.downgraded_formula_count, 0U);
-  EXPECT_EQ(d.deferred_feature_count, 0U);
-  EXPECT_EQ(d.renumbered_part_count, 0U);
-}
-
-TEST(FormulonCApi, ReadDiagnosticsAreZeroForCleanRoundTrip) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 42.0), 0);
-
-  for (const fm_workbook_format_t format : {FM_WORKBOOK_FORMAT_XLSX, FM_WORKBOOK_FORMAT_XLSB}) {
-    BufferGuard bytes;
-    ASSERT_EQ(fm_workbook_save_as(wb.handle, format, &bytes.data, &bytes.len), 0);
-    WorkbookGuard loaded;
-    ASSERT_EQ(fm_workbook_load(bytes.data, bytes.len, &loaded.handle), 0);
-
-    fm_read_diagnostics_t d{99U, 99U, 99U, 99U, 99U};
-    ASSERT_EQ(fm_workbook_read_diagnostics(loaded.handle, &d), 0);
-    EXPECT_EQ(d.undecoded_formula_count, 0U) << "format=" << format;
-    EXPECT_EQ(d.undecoded_defined_name_count, 0U) << "format=" << format;
-    EXPECT_EQ(d.undecoded_part_count, 0U) << "format=" << format;
-    EXPECT_EQ(d.skipped_feature_count, 0U) << "format=" << format;
-    EXPECT_EQ(d.unknown_content_type_count, 0U) << "format=" << format;
-  }
-}
-
-TEST(FormulonCApi, DiagnosticsEntryPointsInitializeOutputsOnFailure) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  // A workbook that was never loaded reports every counter as zero rather
-  // than leaving the caller's struct untouched.
-  fm_read_diagnostics_t read{99U, 99U, 99U, 99U, 99U};
-  ASSERT_EQ(fm_workbook_read_diagnostics(wb.handle, &read), 0);
-  EXPECT_EQ(read.undecoded_formula_count, 0U);
-  EXPECT_EQ(read.skipped_feature_count, 0U);
-
-  uint8_t* bytes = reinterpret_cast<uint8_t*>(static_cast<uintptr_t>(1));
-  size_t len = 99U;
-  fm_save_diagnostics_t save{99U, 99U, 99U, 99U, 99U};
-  EXPECT_NE(fm_workbook_save_with_diagnostics(wb.handle, FM_WORKBOOK_FORMAT_UNKNOWN, &bytes, &len, &save), 0);
-  EXPECT_EQ(bytes, nullptr);
-  EXPECT_EQ(len, 0U);
-  EXPECT_EQ(save.downgraded_formula_count, 0U);
-  EXPECT_EQ(save.deferred_feature_count, 0U);
-  EXPECT_EQ(save.dropped_part_count, 0U);
-  EXPECT_EQ(save.dropped_relationship_count, 0U);
-  EXPECT_EQ(save.renumbered_part_count, 0U);
-
-  read = fm_read_diagnostics_t{99U, 99U, 99U, 99U, 99U};
-  EXPECT_NE(fm_workbook_read_diagnostics(nullptr, &read), 0);
-  EXPECT_EQ(read.undecoded_formula_count, 0U);
-  EXPECT_EQ(read.undecoded_defined_name_count, 0U);
-  EXPECT_EQ(read.undecoded_part_count, 0U);
-  EXPECT_EQ(read.skipped_feature_count, 0U);
-  EXPECT_EQ(read.unknown_content_type_count, 0U);
-}
-
-TEST(FormulonCApi, ReadDiagnosticsPreservesUnknownPartFromDeterministicFixture) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  BufferGuard bytes;
-  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSB, &bytes.data, &bytes.len), 0);
-  const std::vector<std::uint8_t> fixture =
-      AppendEmptyZipEntry(std::vector<std::uint8_t>(bytes.data, bytes.data + bytes.len), "xl/dropped.bin");
-  ASSERT_FALSE(fixture.empty());
-  WorkbookGuard loaded;
-  ASSERT_EQ(fm_workbook_load(fixture.data(), fixture.size(), &loaded.handle), 0);
-  fm_read_diagnostics_t d{};
-  ASSERT_EQ(fm_workbook_read_diagnostics(loaded.handle, &d), 0);
-  EXPECT_EQ(d.undecoded_formula_count, 0U);
-  EXPECT_EQ(d.undecoded_defined_name_count, 0U);
-  // Unknown package parts are retained as passthrough data, so loading the
-  // fixture is lossless and the undecoded-part diagnostic remains zero.
-  EXPECT_EQ(d.undecoded_part_count, 0U);
-}
-
-TEST(FormulonCApi, DiagnosticFailuresNameTheInvokedSymbol) {
-  fm_read_diagnostics_t read{77U, 77U, 77U, 77U, 77U};
-  EXPECT_NE(fm_workbook_read_diagnostics(nullptr, &read), 0);
-  EXPECT_EQ(read.undecoded_formula_count, 0U);
-  EXPECT_EQ(read.skipped_feature_count, 0U);
-  EXPECT_STREQ(fm_last_error_message(), "fm_workbook_read_diagnostics: NULL argument");
-
-  uint8_t* bytes = reinterpret_cast<uint8_t*>(static_cast<uintptr_t>(1));
-  size_t len = 77U;
-  EXPECT_NE(fm_workbook_save_as(nullptr, FM_WORKBOOK_FORMAT_XLSB, &bytes, &len), 0);
-  EXPECT_EQ(bytes, nullptr);
-  EXPECT_EQ(len, 0U);
-  EXPECT_STREQ(fm_last_error_message(), "fm_workbook_save_as: NULL argument");
-
-  fm_save_diagnostics_t save{77U, 77U, 77U, 77U, 77U};
-  bytes = reinterpret_cast<uint8_t*>(static_cast<uintptr_t>(1));
-  len = 77U;
-  EXPECT_NE(fm_workbook_save_with_diagnostics(nullptr, FM_WORKBOOK_FORMAT_XLSB, &bytes, &len, &save), 0);
-  EXPECT_EQ(bytes, nullptr);
-  EXPECT_EQ(len, 0U);
-  EXPECT_EQ(save.downgraded_formula_count, 0U);
-  EXPECT_EQ(save.renumbered_part_count, 0U);
-  EXPECT_STREQ(fm_last_error_message(), "fm_workbook_save_with_diagnostics: NULL argument");
-}
-
-TEST(FormulonCApi, EverySaveEntryPointZeroesOutParamsOnFailure) {
-  // The whole save family shares one failure-path contract, so a caller may
-  // reuse the same out variables across calls and free unconditionally. A
-  // member that left a previous call's pointer in place would hand that
-  // stale pointer to `fm_buffer_free` a second time.
-  uint8_t* const poison = reinterpret_cast<uint8_t*>(static_cast<uintptr_t>(1));
-
-  uint8_t* bytes = poison;
-  size_t len = 77U;
-  EXPECT_NE(fm_workbook_save(nullptr, &bytes, &len), 0);
-  EXPECT_EQ(bytes, nullptr);
-  EXPECT_EQ(len, 0U);
-  EXPECT_STREQ(fm_last_error_message(), "fm_workbook_save: NULL argument");
-
-  bytes = poison;
-  len = 77U;
-  EXPECT_NE(fm_workbook_save_as(nullptr, FM_WORKBOOK_FORMAT_XLSX, &bytes, &len), 0);
-  EXPECT_EQ(bytes, nullptr);
-  EXPECT_EQ(len, 0U);
-
-  bytes = poison;
-  len = 77U;
-  fm_save_diagnostics_t save{77U, 77U, 77U, 77U, 77U};
-  EXPECT_NE(fm_workbook_save_with_diagnostics(nullptr, FM_WORKBOOK_FORMAT_XLSX, &bytes, &len, &save), 0);
-  EXPECT_EQ(bytes, nullptr);
-  EXPECT_EQ(len, 0U);
-  EXPECT_EQ(save.downgraded_formula_count, 0U);
-  EXPECT_EQ(save.deferred_feature_count, 0U);
-  EXPECT_EQ(save.dropped_part_count, 0U);
-  EXPECT_EQ(save.dropped_relationship_count, 0U);
-  EXPECT_EQ(save.renumbered_part_count, 0U);
-
-  // A NULL out-parameter is rejected without being dereferenced, on the base
-  // entry point as well as the extended ones.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  len = 77U;
-  EXPECT_NE(fm_workbook_save(wb.handle, nullptr, &len), 0);
-  EXPECT_EQ(len, 0U);
-  bytes = poison;
-  EXPECT_NE(fm_workbook_save(wb.handle, &bytes, nullptr), 0);
-  EXPECT_EQ(bytes, nullptr);
-}
-
-TEST(FormulonCApi, BaseSaveProducesTheSameBytesAsTheXlsxFormatSelector) {
-  // The header declares the two equivalent; delegating the base entry point
-  // to the shared implementation is what keeps that true.
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=1+2"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  BufferGuard base;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &base.data, &base.len), 0);
-  BufferGuard selected;
-  ASSERT_EQ(fm_workbook_save_as(wb.handle, FM_WORKBOOK_FORMAT_XLSX, &selected.data, &selected.len), 0);
-
-  ASSERT_EQ(base.len, selected.len);
-  ASSERT_GT(base.len, 0U);
-  EXPECT_EQ(std::memcmp(base.data, selected.data, base.len), 0);
-}
-
-TEST(FormulonCApi, ReservedStatusCodesKeepTheirSlotsAndSpelling) {
-  // Some documented codes are allocated but no shipping path builds them.
-  // The header promises numeric identity with `formulon::FormulonErrorCode`,
-  // so those slots must not be reused or renumbered, and `fm_status_string`
-  // must keep naming them exactly: only a value outside the enum may fall
-  // back to `"kUnknownError"`.
-  struct Reserved {
-    fm_status_t code;
-    const char* name;
-  };
-  const Reserved reserved[] = {
-      {5008, "kIoXmlDoctype"},
-      {5009, "kIoXmlEntityExplosion"},
-      {5015, "kIoCsvEncodingDetect"},
-      {6000, "kCryptoAgileNotSupported"},
-      {6001, "kCryptoStandardNotSupported"},
-      {6002, "kCryptoBadPassword"},
-      {6003, "kCryptoHashMismatch"},
-      {6004, "kCryptoKeyDerivationFailed"},
-  };
-  for (const Reserved& entry : reserved) {
-    EXPECT_STREQ(fm_status_string(entry.code), entry.name) << "code=" << entry.code;
-  }
-
-  // The reserved crypto band is not what an encrypted package reports; a
-  // binding offering a password prompt must branch on `kIoZipEncrypted`.
-  EXPECT_STREQ(fm_status_string(static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoZipEncrypted)),
-               "kIoZipEncrypted");
-  EXPECT_STREQ(fm_status_string(123456), "kUnknownError");
-}
-
-TEST(FormulonCApi, MemoryUsageTracksTheWorkbookAndRejectsNulls) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  size_t empty = 0U;
-  ASSERT_EQ(fm_workbook_memory_usage(wb.handle, &empty), 0);
-  EXPECT_GT(empty, 0U);
-
-  for (uint32_t row = 0; row < 200U; ++row) {
-    ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, row, 0, "=1+2"), 0);
-  }
-  size_t filled = 0U;
-  ASSERT_EQ(fm_workbook_memory_usage(wb.handle, &filled), 0);
-  EXPECT_GT(filled, empty);
-
-  // Both NULL arguments are rejected rather than silently reporting 0,
-  // which is what lets a binding distinguish "empty" from "broken".
-  size_t scratch = 0U;
-  EXPECT_NE(fm_workbook_memory_usage(nullptr, &scratch), 0);
-  EXPECT_NE(fm_workbook_memory_usage(wb.handle, nullptr), 0);
-}
-
-TEST(FormulonCApi, SaveExRejectsUnknownFormat) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  const std::int32_t invalid_formats[] = {99, std::numeric_limits<std::int32_t>::min(),
-                                          std::numeric_limits<std::int32_t>::max()};
-  for (const std::int32_t raw : invalid_formats) {
-    BufferGuard buf;
-    EXPECT_EQ(fm_workbook_save_as(wb.handle, raw, &buf.data, &buf.len),
-              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-    EXPECT_EQ(buf.data, nullptr);
-    EXPECT_EQ(buf.len, 0U);
-    fm_save_diagnostics_t save{99U, 99U, 99U, 99U, 99U};
-    EXPECT_EQ(fm_workbook_save_with_diagnostics(wb.handle, raw, &buf.data, &buf.len, &save),
-              static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
-    EXPECT_EQ(buf.data, nullptr);
-    EXPECT_EQ(buf.len, 0U);
-    EXPECT_EQ(save.downgraded_formula_count, 0U);
-    EXPECT_EQ(save.deferred_feature_count, 0U);
-    EXPECT_EQ(save.dropped_part_count, 0U);
-    EXPECT_EQ(save.dropped_relationship_count, 0U);
-    EXPECT_EQ(save.renumbered_part_count, 0U);
-  }
-}
-
-TEST(FormulonCApi, LoadRoutesXlsbBytesToXlsbReader) {
-  // Build a minimal `.xlsb` byte stream via the engine writer, then load
-  // it through the byte-only C ABI. The load boundary must detect the
-  // xlsb container and route to `read_xlsb` rather than failing in the
-  // OOXML reader with a "missing xl/workbook.xml" diagnostic.
-  formulon::Workbook src = formulon::Workbook::create_empty();
-  formulon::Sheet& s = src.sheet(src.add_sheet("S"));
-  s.set_cell_value(0U, 0U, formulon::Value::number(123.5));
-  auto xlsb_or = formulon::io::xlsb::write_xlsb(src);
-  ASSERT_TRUE(static_cast<bool>(xlsb_or)) << xlsb_or.error().message;
-  const std::vector<std::uint8_t>& xlsb = xlsb_or.value();
-
-  WorkbookGuard loaded;
-  ASSERT_EQ(fm_workbook_load(xlsb.data(), xlsb.size(), &loaded.handle), 0);
-  EXPECT_EQ(fm_workbook_sheet_count(loaded.handle), 1U);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 0, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(v.u.number, 123.5);
-}
-
-TEST(FormulonCApi, SaveLoadFormulaTextResult) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 1, 0, "=UPPER(\"world\")"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  BufferGuard buf;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &buf.data, &buf.len), 0);
-  ASSERT_NE(buf.data, nullptr);
-  EXPECT_GT(buf.len, 0U);
-
-  WorkbookGuard loaded;
-  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &loaded.handle), 0);
-  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 1, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_TEXT);
-  ASSERT_NE(v.u.text, nullptr);
-  EXPECT_STREQ(v.u.text, "WORLD");
-}
-
-TEST(FormulonCApi, SaveLoadFormulaBoolResult) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 2, 0, "=TRUE()"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  BufferGuard buf;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &buf.data, &buf.len), 0);
-  ASSERT_NE(buf.data, nullptr);
-  EXPECT_GT(buf.len, 0U);
-
-  WorkbookGuard loaded;
-  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &loaded.handle), 0);
-  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 2, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_BOOL);
-  EXPECT_EQ(v.u.boolean, 1);
-}
-
-TEST(FormulonCApi, SaveLoadFormulaErrorResult) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 3, 0, "=1/0"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  BufferGuard buf;
-  ASSERT_EQ(fm_workbook_save(wb.handle, &buf.data, &buf.len), 0);
-  ASSERT_NE(buf.data, nullptr);
-  EXPECT_GT(buf.len, 0U);
-
-  WorkbookGuard loaded;
-  ASSERT_EQ(fm_workbook_load(buf.data, buf.len, &loaded.handle), 0);
-  ASSERT_EQ(fm_workbook_recalc(loaded.handle), 0);
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(loaded.handle, 0, 3, 0, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_ERROR);
-  EXPECT_EQ(v.u.error_code, 1);
-}
-
-TEST(FormulonCApi, IterativeOptionsConverge) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-  ASSERT_EQ(fm_workbook_set_iterative(wb.handle, 1, 100, 1e-6), 0);
-
-  // A1 = 0.5 * (A1 + 2) converges to 2 from the blank initial cache
-  // value. Unlike Newton's method, this intentionally needs no separate
-  // numeric seed, because setting a formula replaces that cell's cache.
-  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=0.5*(A1+2)"), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
-  ASSERT_EQ(v.kind, FM_VAL_NUMBER);
-  EXPECT_NEAR(v.u.number, 2.0, 1e-3);
-}
-
-TEST(FormulonCApi, ThreadLocalLastErrorIsolation) {
-  WorkbookGuard wb;
-  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
-
-  // Establish a known last-error on the main thread.
-  fm_value_t v{};
-  ASSERT_NE(fm_workbook_get_value(nullptr, 0, 0, 0, &v), 0);
-  const std::string main_msg = fm_last_error_message();
-  EXPECT_GT(main_msg.size(), 0U);
-
-  // A worker thread triggers a *different* error path; the main
-  // thread's last error must remain untouched.
-  std::atomic<fm_status_t> worker_rc{0};
-  std::thread worker([&]() {
-    // Out-of-range sheet on a freshly created workbook on this thread.
-    fm_workbook_t* local = nullptr;
-    if (fm_workbook_create(&local) != 0) {
-      return;
-    }
-    worker_rc.store(fm_workbook_set_number(local, 99, 0, 0, 1.0));
-    fm_workbook_destroy(local);
-  });
-  worker.join();
-  EXPECT_NE(worker_rc.load(), 0);
-
-  // Main thread's diagnostic survived the worker's run.
-  EXPECT_EQ(std::string(fm_last_error_message()), main_msg);
-}
-
-TEST(FormulonCApi, StatusStringCoversKnownCodes) {
-  // Spot-check a handful of band-spanning codes; the source-of-truth is
-  // `formulon::to_cstring`, which the C API forwards to.
-  EXPECT_STREQ(fm_status_string(0), "kOk");
-  EXPECT_STREQ(fm_status_string(2), "kInvalidArgument");
-  EXPECT_STREQ(fm_status_string(7000), "kBindingInvalidHandle");
-  EXPECT_STREQ(fm_status_string(7001), "kBindingNullPointer");
-  // Unknown numeric values must still return a non-NULL fallback.
-  const char* unknown = fm_status_string(123456);
-  ASSERT_NE(unknown, nullptr);
-  EXPECT_GT(std::strlen(unknown), 0U);
-}
-
-TEST(FormulonCApi, ErrorDisplayNameUsesExcelLiterals) {
-  EXPECT_STREQ(fm_error_display_name(0), "#NULL!");
-  EXPECT_STREQ(fm_error_display_name(1), "#DIV/0!");
-  EXPECT_STREQ(fm_error_display_name(3), "#REF!");
-  EXPECT_STREQ(fm_error_display_name(-1), "#UNKNOWN!");
-  EXPECT_STREQ(fm_error_display_name(999), "#UNKNOWN!");
-}
-
-TEST(FormulonCApi, VersionStringNonEmpty) {
-  const char* v = fm_version_string();
-  ASSERT_NE(v, nullptr);
-  EXPECT_GT(std::strlen(v), 0U);
-}
diff --git a/tests/c_api/formulon_c_test_helpers.h b/tests/c_api/formulon_c_test_helpers.h
new file mode 100644
index 000000000..96bd4e246
--- /dev/null
+++ b/tests/c_api/formulon_c_test_helpers.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+#include "c_api/formulon_c.h"
+
+// Small ownership guards shared by the C ABI topic tests.  Keeping the
+// lifetime rules in one header makes each topic file focus on its contract.
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+};
+
+struct BufferGuard {
+  std::uint8_t* data = nullptr;
+  std::size_t len = 0;
+  ~BufferGuard() { fm_buffer_free(data); }
+  BufferGuard() = default;
+  BufferGuard(const BufferGuard&) = delete;
+  BufferGuard& operator=(const BufferGuard&) = delete;
+};
diff --git a/tests/c_api/formulon_c_theme_test.cpp b/tests/c_api/formulon_c_theme_test.cpp
new file mode 100644
index 000000000..d237a74ef
--- /dev/null
+++ b/tests/c_api/formulon_c_theme_test.cpp
@@ -0,0 +1,501 @@
+// C ABI tests for the workbook theme, colour resolution and effective style.
+
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <map>
+#include <string>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "formulon_c_test_helpers.h"
+#include "gtest/gtest.h"
+#include "io/zip_reader.h"
+#include "miniz.h"
+#include "utils/error.h"
+
+namespace {
+
+static_assert(sizeof(fm_theme_colors) == 48U, "fm_theme_colors ABI layout changed");
+static_assert(sizeof(fm_theme_fonts) == 4U * sizeof(void*), "fm_theme_fonts ABI layout changed");
+static_assert(offsetof(fm_effective_style, font_argb) == 20U, "fm_effective_style.font_argb offset changed");
+static_assert(offsetof(fm_effective_style, border_argb) == 44U, "fm_effective_style.border_argb offset changed");
+static_assert(offsetof(fm_effective_style, border_resolution) == 64U,
+              "fm_effective_style.border_resolution offset changed");
+static_assert(offsetof(fm_effective_style, hidden) == 88U, "fm_effective_style.hidden offset changed");
+static_assert(offsetof(fm_effective_style, num_fmt_code) == (sizeof(void*) == 4U ? 92U : 96U),
+              "fm_effective_style.num_fmt_code offset changed");
+static_assert(sizeof(fm_effective_style) == (sizeof(void*) == 4U ? 96U : 104U),
+              "fm_effective_style ABI layout changed");
+
+using Bytes = std::vector<std::uint8_t>;
+
+constexpr fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+constexpr fm_status_t kNullPointer = static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer);
+constexpr fm_status_t kXmlParse = static_cast<fm_status_t>(formulon::FormulonErrorCode::kIoXmlParse);
+
+constexpr int32_t kSourcePart = 0;
+constexpr int32_t kSourceDefault = 1;
+constexpr int32_t kSourceUnparseable = 2;
+
+constexpr uint32_t kDefaultScheme[12] = {0xFF000000U, 0xFFFFFFFFU, 0xFF44546AU, 0xFFE7E6E6U, 0xFF4472C4U, 0xFFED7D31U,
+                                         0xFFA5A5A5U, 0xFFFFC000U, 0xFF5B9BD5U, 0xFF70AD47U, 0xFF0563C1U, 0xFF954F72U};
+constexpr const char* kYuGothic = "\xE6\xB8\xB8\xE3\x82\xB4\xE3\x82\xB7\xE3\x83\x83\xE3\x82\xAF";
+constexpr const char* kYuGothicLight = "\xE6\xB8\xB8\xE3\x82\xB4\xE3\x82\xB7\xE3\x83\x83\xE3\x82\xAF Light";
+
+Bytes Save(fm_workbook_t* wb) {
+  BufferGuard buffer;
+  EXPECT_EQ(fm_workbook_save(wb, &buffer.data, &buffer.len), 0);
+  return Bytes(buffer.data, buffer.data + buffer.len);
+}
+
+void Load(const Bytes& bytes, WorkbookGuard* out) {
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &out->handle), 0);
+}
+
+/// Rewrites a package, replacing the entries named in `replacements`. Every
+/// replaced entry must already exist, so a misspelt path fails the test.
+Bytes ReplaceEntries(const Bytes& package, const std::map<std::string, std::string>& replacements) {
+  formulon::io::ZipReader input;
+  EXPECT_TRUE(static_cast<bool>(input.open(formulon::io::ByteSpan{package.data(), package.size()})));
+  mz_zip_archive writer{};
+  EXPECT_EQ(mz_zip_writer_init_heap(&writer, 0, 4096), MZ_TRUE);
+  std::size_t replaced = 0;
+  for (const std::string& name : input.list_entries()) {
+    auto body = input.read_entry(name);
+    EXPECT_TRUE(static_cast<bool>(body)) << name;
+    if (!body) {
+      continue;
+    }
+    Bytes content = body.value();
+    if (auto it = replacements.find(name); it != replacements.end()) {
+      content.assign(it->second.begin(), it->second.end());
+      ++replaced;
+    }
+    EXPECT_EQ(mz_zip_writer_add_mem(&writer, name.c_str(), content.data(), content.size(),
+                                    static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)),
+              MZ_TRUE);
+  }
+  EXPECT_EQ(replaced, replacements.size());
+  void* archive = nullptr;
+  std::size_t archive_size = 0;
+  EXPECT_EQ(mz_zip_writer_finalize_heap_archive(&writer, &archive, &archive_size), MZ_TRUE);
+  EXPECT_EQ(mz_zip_writer_end(&writer), MZ_TRUE);
+  Bytes result(static_cast<const std::uint8_t*>(archive), static_cast<const std::uint8_t*>(archive) + archive_size);
+  mz_free(archive);
+  return result;
+}
+
+fm_color_spec ThemeSpec(uint32_t index, double tint) {
+  fm_color_spec spec{};
+  spec.kind = kFmColorTheme;
+  spec.theme = index;
+  spec.tint = tint;
+  return spec;
+}
+
+fm_color_spec IndexedSpec(uint32_t index) {
+  fm_color_spec spec{};
+  spec.kind = kFmColorIndexed;
+  spec.indexed = index;
+  return spec;
+}
+
+struct Resolved {
+  fm_status_t status = -1;
+  uint32_t argb = 0;
+  int32_t resolution = -1;
+};
+
+Resolved Resolve(fm_workbook_t* wb, fm_color_spec spec, int32_t context) {
+  Resolved out;
+  out.status = fm_workbook_resolve_color(wb, spec, context, &out.argb, &out.resolution);
+  return out;
+}
+
+fm_theme_colors ReadColors(fm_workbook_t* wb, int32_t* source) {
+  fm_theme_colors colors{};
+  EXPECT_EQ(fm_workbook_get_theme_colors(wb, &colors, source), 0);
+  return colors;
+}
+
+}  // namespace
+
+TEST(FormulonCApiTheme, WorkbookWithoutThemePartReportsDefaultTheme) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  int32_t source = -1;
+  const fm_theme_colors colors = ReadColors(wb.handle, &source);
+  EXPECT_EQ(source, kSourceDefault);
+  for (std::size_t i = 0; i < 12U; ++i) {
+    EXPECT_EQ(colors.argb[i], kDefaultScheme[i]) << i;
+  }
+  fm_theme_fonts fonts{};
+  ASSERT_EQ(fm_workbook_get_theme_fonts(wb.handle, &fonts), 0);
+  EXPECT_STREQ(fonts.major_latin, "Calibri Light");
+  EXPECT_STREQ(fonts.major_east_asian, kYuGothicLight);
+  EXPECT_STREQ(fonts.minor_latin, "Calibri");
+  EXPECT_STREQ(fonts.minor_east_asian, kYuGothic);
+}
+
+TEST(FormulonCApiTheme, SetColorsOnWorkbookWithoutThemeSurvivesSaveReload) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_theme_colors colors{};
+  for (uint32_t i = 0; i < 12U; ++i) {
+    colors.argb[i] = 0xFF101010U + i;
+  }
+  colors.argb[4] = 0x00123456U;  // the alpha byte is not stored
+  ASSERT_EQ(fm_workbook_set_theme_colors(wb.handle, &colors), 0);
+
+  int32_t source = -1;
+  fm_theme_colors live = ReadColors(wb.handle, &source);
+  EXPECT_EQ(source, kSourcePart);
+  EXPECT_EQ(live.argb[0], 0xFF101010U);
+  EXPECT_EQ(live.argb[4], 0xFF123456U);
+  EXPECT_EQ(live.argb[11], 0xFF10101BU);
+  // The generated part carries the default fonts.
+  fm_theme_fonts fonts{};
+  ASSERT_EQ(fm_workbook_get_theme_fonts(wb.handle, &fonts), 0);
+  EXPECT_STREQ(fonts.minor_latin, "Calibri");
+
+  WorkbookGuard loaded;
+  Load(Save(wb.handle), &loaded);
+  source = -1;
+  const fm_theme_colors reread = ReadColors(loaded.handle, &source);
+  EXPECT_EQ(source, kSourcePart);
+  for (std::size_t i = 0; i < 12U; ++i) {
+    EXPECT_EQ(reread.argb[i], live.argb[i]) << i;
+  }
+}
+
+TEST(FormulonCApiTheme, SetFontsSurvivesSaveReload) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_theme_fonts fonts{};
+  fonts.major_latin = "Georgia";
+  fonts.major_east_asian = "MS Mincho";
+  fonts.minor_latin = "Arial";
+  fonts.minor_east_asian = "Meiryo";
+  ASSERT_EQ(fm_workbook_set_theme_fonts(wb.handle, &fonts), 0);
+
+  WorkbookGuard loaded;
+  Load(Save(wb.handle), &loaded);
+  fm_theme_fonts reread{};
+  ASSERT_EQ(fm_workbook_get_theme_fonts(loaded.handle, &reread), 0);
+  EXPECT_STREQ(reread.major_latin, "Georgia");
+  EXPECT_STREQ(reread.major_east_asian, "MS Mincho");
+  EXPECT_STREQ(reread.minor_latin, "Arial");
+  EXPECT_STREQ(reread.minor_east_asian, "Meiryo");
+  // Setting the fonts generated the part with the default colours.
+  int32_t source = -1;
+  const fm_theme_colors colors = ReadColors(loaded.handle, &source);
+  EXPECT_EQ(source, kSourcePart);
+  EXPECT_EQ(colors.argb[4], kDefaultScheme[4]);
+}
+
+TEST(FormulonCApiTheme, UnparseablePartIsReportedAndRefusesEdits) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_theme_colors colors{};
+  for (uint32_t i = 0; i < 12U; ++i) {
+    colors.argb[i] = 0xFF202020U;
+  }
+  ASSERT_EQ(fm_workbook_set_theme_colors(wb.handle, &colors), 0);
+  const Bytes broken =
+      ReplaceEntries(Save(wb.handle), {{"xl/theme/theme1.xml", "<a:theme>not a colour scheme</a:theme>"}});
+
+  WorkbookGuard loaded;
+  Load(broken, &loaded);
+  int32_t source = -1;
+  const fm_theme_colors reread = ReadColors(loaded.handle, &source);
+  EXPECT_EQ(source, kSourceUnparseable);
+  EXPECT_EQ(reread.argb[4], kDefaultScheme[4]);
+  EXPECT_EQ(fm_workbook_set_theme_colors(loaded.handle, &colors), kXmlParse);
+  fm_theme_fonts fonts{};
+  fonts.major_latin = fonts.major_east_asian = fonts.minor_latin = fonts.minor_east_asian = "Arial";
+  EXPECT_EQ(fm_workbook_set_theme_fonts(loaded.handle, &fonts), kXmlParse);
+
+  const Resolved accent = Resolve(loaded.handle, ThemeSpec(4, 0.0), FM_COLOR_CONTEXT_FONT);
+  ASSERT_EQ(accent.status, 0);
+  EXPECT_EQ(accent.argb, kDefaultScheme[4]);
+  EXPECT_EQ(accent.resolution, FM_COLOR_RESOLUTION_THEME_UNPARSEABLE);
+}
+
+TEST(FormulonCApiTheme, ThemeAccessorsRejectNullArguments) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_theme_colors colors{};
+  fm_theme_fonts fonts{};
+  int32_t source = 0;
+  EXPECT_EQ(fm_workbook_get_theme_colors(nullptr, &colors, &source), kNullPointer);
+  EXPECT_EQ(fm_workbook_get_theme_colors(wb.handle, nullptr, &source), kNullPointer);
+  EXPECT_EQ(fm_workbook_get_theme_colors(wb.handle, &colors, nullptr), kNullPointer);
+  EXPECT_EQ(fm_workbook_set_theme_colors(nullptr, &colors), kNullPointer);
+  EXPECT_EQ(fm_workbook_set_theme_colors(wb.handle, nullptr), kNullPointer);
+  EXPECT_EQ(fm_workbook_get_theme_fonts(nullptr, &fonts), kNullPointer);
+  EXPECT_EQ(fm_workbook_get_theme_fonts(wb.handle, nullptr), kNullPointer);
+  fonts.major_latin = "A";
+  fonts.major_east_asian = "B";
+  fonts.minor_latin = "C";
+  EXPECT_EQ(fm_workbook_set_theme_fonts(wb.handle, &fonts), kNullPointer);
+  // A rejected edit generates no theme part.
+  ReadColors(wb.handle, &source);
+  EXPECT_EQ(source, kSourceDefault);
+}
+
+TEST(FormulonCApiTheme, ResolveColorReportsResolution) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  fm_color_spec rgb{};
+  rgb.kind = kFmColorRgb;
+  rgb.rgb = 0xFF123456U;
+  Resolved got = Resolve(wb.handle, rgb, FM_COLOR_CONTEXT_FILL_FG);
+  ASSERT_EQ(got.status, 0);
+  EXPECT_EQ(got.argb, 0xFF123456U);
+  EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_EXACT);
+
+  // No theme part: theme colours resolve against the default theme.
+  got = Resolve(wb.handle, ThemeSpec(4, 0.0), FM_COLOR_CONTEXT_FONT);
+  EXPECT_EQ(got.argb, 0xFF4472C4U);
+  EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_DEFAULT_THEME);
+  got = Resolve(wb.handle, ThemeSpec(12, 0.0), FM_COLOR_CONTEXT_FONT);
+  EXPECT_EQ(got.argb, 0xFF000000U);
+  EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_INDEX_OUT_OF_RANGE);
+
+  fm_theme_colors colors{};
+  for (std::size_t i = 0; i < 12U; ++i) {
+    colors.argb[i] = kDefaultScheme[i];
+  }
+  ASSERT_EQ(fm_workbook_set_theme_colors(wb.handle, &colors), 0);
+  // Theme index 0 is lt1 and 1 is dk1: the first pairs swap against the scheme.
+  got = Resolve(wb.handle, ThemeSpec(0, 0.0), FM_COLOR_CONTEXT_FONT);
+  EXPECT_EQ(got.argb, 0xFFFFFFFFU);
+  EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_EXACT);
+  got = Resolve(wb.handle, ThemeSpec(1, 0.0), FM_COLOR_CONTEXT_FONT);
+  EXPECT_EQ(got.argb, 0xFF000000U);
+  // Excel's "Accent 1, Lighter 40%" and "Darker 25%".
+  got = Resolve(wb.handle, ThemeSpec(4, 0.4), FM_COLOR_CONTEXT_FILL_FG);
+  EXPECT_EQ(got.argb, 0xFF8EA9DBU);
+  EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_EXACT);
+  got = Resolve(wb.handle, ThemeSpec(4, -0.25), FM_COLOR_CONTEXT_FILL_FG);
+  EXPECT_EQ(got.argb, 0xFF305496U);
+
+  got = Resolve(wb.handle, IndexedSpec(2), FM_COLOR_CONTEXT_FONT);
+  EXPECT_EQ(got.argb, 0xFFFF0000U);
+  EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_EXACT);
+  got = Resolve(wb.handle, IndexedSpec(80), FM_COLOR_CONTEXT_FONT);
+  EXPECT_EQ(got.argb, 0xFF000000U);
+  EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_INDEX_OUT_OF_RANGE);
+
+  // System foreground (64) and automatic colours depend on the context.
+  fm_color_spec automatic{};
+  automatic.kind = kFmColorAuto;
+  const struct {
+    int32_t context;
+    uint32_t argb;
+  } kContexts[] = {
+      {FM_COLOR_CONTEXT_FONT, 0xFF000000U},
+      {FM_COLOR_CONTEXT_FILL_FG, 0xFFFFFFFFU},
+      {FM_COLOR_CONTEXT_FILL_BG, 0xFFFFFFFFU},
+      {FM_COLOR_CONTEXT_BORDER, 0xFF000000U},
+  };
+  for (const auto& c : kContexts) {
+    got = Resolve(wb.handle, automatic, c.context);
+    ASSERT_EQ(got.status, 0) << c.context;
+    EXPECT_EQ(got.argb, c.argb) << c.context;
+    EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_AUTO_CONTEXT) << c.context;
+    got = Resolve(wb.handle, IndexedSpec(64), c.context);
+    EXPECT_EQ(got.argb, c.argb) << c.context;
+    EXPECT_EQ(got.resolution, FM_COLOR_RESOLUTION_AUTO_CONTEXT) << c.context;
+  }
+}
+
+TEST(FormulonCApiTheme, ResolveColorRejectsInvalidArguments) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  uint32_t argb = 0;
+  int32_t resolution = 0;
+  EXPECT_EQ(fm_workbook_resolve_color(nullptr, ThemeSpec(4, 0.0), 0, &argb, &resolution), kNullPointer);
+  EXPECT_EQ(fm_workbook_resolve_color(wb.handle, ThemeSpec(4, 0.0), 0, nullptr, &resolution), kNullPointer);
+  EXPECT_EQ(fm_workbook_resolve_color(wb.handle, ThemeSpec(4, 0.0), 0, &argb, nullptr), kNullPointer);
+  EXPECT_EQ(Resolve(wb.handle, ThemeSpec(4, 0.0), 4).status, kInvalidArgument);
+  EXPECT_EQ(Resolve(wb.handle, ThemeSpec(4, 0.0), -1).status, kInvalidArgument);
+  fm_color_spec unknown{};
+  unknown.kind = 5;
+  EXPECT_EQ(Resolve(wb.handle, unknown, FM_COLOR_CONTEXT_FONT).status, kInvalidArgument);
+  EXPECT_EQ(Resolve(wb.handle, ThemeSpec(4, std::numeric_limits<double>::quiet_NaN()), FM_COLOR_CONTEXT_FONT).status,
+            kInvalidArgument);
+}
+
+namespace {
+
+/// Style table for the precedence tests: a distinct xf per level, the cell
+/// one carrying a themed font, a solid literal fill, an indexed left border,
+/// a date format and explicit protection.
+struct PrecedenceXfs {
+  uint32_t cell = 0;
+  uint32_t row = 0;
+  uint32_t column = 0;
+};
+
+PrecedenceXfs AddPrecedenceXfs(fm_workbook_t* wb) {
+  fm_font_record font{};
+  font.name = "Calibri";
+  font.size = 11.0;
+  font.color.kind = kFmColorTheme;
+  font.color.theme = 4;
+  font.color.tint = 0.4;
+  uint32_t font_index = 0;
+  EXPECT_EQ(fm_styles_add_font(wb, font, &font_index), 0);
+  fm_fill_record fill{};
+  fill.pattern = 1;
+  fill.fg.kind = kFmColorRgb;
+  fill.fg.rgb = 0xFFFF0000U;
+  fill.fg_argb = 0xFFFF0000U;
+  uint32_t fill_index = 0;
+  EXPECT_EQ(fm_styles_add_fill(wb, fill, &fill_index), 0);
+  fm_border_record border{};
+  border.left.style = 1;
+  border.left.color.kind = kFmColorIndexed;
+  border.left.color.indexed = 12;
+  uint32_t border_index = 0;
+  EXPECT_EQ(fm_styles_add_border(wb, border, &border_index), 0);
+
+  PrecedenceXfs out;
+  fm_cell_xf cell{};
+  cell.font_index = font_index;
+  cell.fill_index = fill_index;
+  cell.border_index = border_index;
+  cell.num_fmt_id = 14;
+  cell.has_protection = 1;
+  cell.locked = 0;
+  cell.hidden = 1;
+  EXPECT_EQ(fm_styles_add_cell_xf(wb, cell, &out.cell), 0);
+  fm_cell_xf row{};
+  row.num_fmt_id = 10;
+  EXPECT_EQ(fm_styles_add_cell_xf(wb, row, &out.row), 0);
+  fm_cell_xf column{};
+  column.num_fmt_id = 3;
+  EXPECT_EQ(fm_styles_add_cell_xf(wb, column, &out.column), 0);
+  return out;
+}
+
+/// Saves `wb` with its only sheet replaced: column C styled, row 5 styled
+/// with `customFormat`, row 7 carrying a style without it, and a cell at A5.
+Bytes PrecedencePackage(fm_workbook_t* wb, const PrecedenceXfs& xfs) {
+  const std::string sheet =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+      "<cols><col min=\"3\" max=\"3\" width=\"9\" style=\"" +
+      std::to_string(xfs.column) +
+      "\"/></cols><sheetData>"
+      "<row r=\"5\" s=\"" +
+      std::to_string(xfs.row) + "\" customFormat=\"1\"><c r=\"A5\" s=\"" + std::to_string(xfs.cell) +
+      "\"><v>1</v></c></row>"
+      "<row r=\"7\" s=\"" +
+      std::to_string(xfs.row) +
+      "\"><c r=\"D7\"><v>2</v></c></row>"
+      "</sheetData></worksheet>";
+  return ReplaceEntries(Save(wb), {{"xl/worksheets/sheet1.xml", sheet}});
+}
+
+fm_effective_style Effective(fm_workbook_t* wb, uint32_t row, uint32_t col) {
+  fm_effective_style style{};
+  EXPECT_EQ(fm_sheet_get_effective_style(wb, 0, row, col, &style), 0);
+  return style;
+}
+
+}  // namespace
+
+TEST(FormulonCApiEffectiveStyle, CellRowColumnDefaultPrecedence) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const PrecedenceXfs xfs = AddPrecedenceXfs(wb.handle);
+  WorkbookGuard loaded;
+  Load(PrecedencePackage(wb.handle, xfs), &loaded);
+
+  const struct {
+    uint32_t row;
+    uint32_t col;
+    int32_t source;
+    uint32_t xf;
+  } kCases[] = {
+      {4, 0, 0, xfs.cell},    // A5: the cell's own xf
+      {4, 1, 1, xfs.row},     // B5: no cell, the customFormat row
+      {4, 2, 1, xfs.row},     // C5: the row wins over the column
+      {0, 2, 2, xfs.column},  // C1: the column
+      {6, 2, 2, xfs.column},  // C7: a row style without customFormat is inert
+      {6, 0, 3, 0U},          // A7: nothing applies
+      {0, 0, 3, 0U},          // A1: nothing applies
+  };
+  for (const auto& c : kCases) {
+    const fm_effective_style style = Effective(loaded.handle, c.row, c.col);
+    EXPECT_EQ(style.source, c.source) << c.row << "," << c.col;
+    EXPECT_EQ(style.xf_index, c.xf) << c.row << "," << c.col;
+  }
+  // An existing cell without its own style still reads as the cell level.
+  const fm_effective_style d7 = Effective(loaded.handle, 6, 3);
+  EXPECT_EQ(d7.source, 0);
+  EXPECT_EQ(d7.xf_index, 0U);
+}
+
+TEST(FormulonCApiEffectiveStyle, ResolvesColorsFormatAndProtection) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const PrecedenceXfs xfs = AddPrecedenceXfs(wb.handle);
+  ASSERT_EQ(fm_cell_set_xf_index(wb.handle, 0, 0, 0, xfs.cell), 0);
+
+  const fm_effective_style style = Effective(wb.handle, 0, 0);
+  fm_cell_xf xf{};
+  ASSERT_EQ(fm_styles_get_cell_xf(wb.handle, xfs.cell, &xf), 0);
+  EXPECT_EQ(style.font_index, xf.font_index);
+  EXPECT_EQ(style.fill_index, xf.fill_index);
+  EXPECT_EQ(style.border_index, xf.border_index);
+  // No theme part: the themed font resolves against the default theme.
+  EXPECT_EQ(style.font_argb, 0xFF8EA9DBU);
+  EXPECT_EQ(style.font_resolution, FM_COLOR_RESOLUTION_DEFAULT_THEME);
+  EXPECT_EQ(style.fill_fg_argb, 0xFFFF0000U);
+  EXPECT_EQ(style.fill_fg_resolution, FM_COLOR_RESOLUTION_EXACT);
+  EXPECT_EQ(style.fill_bg_argb, 0xFFFFFFFFU);
+  EXPECT_EQ(style.fill_bg_resolution, FM_COLOR_RESOLUTION_AUTO_CONTEXT);
+  EXPECT_EQ(style.border_argb[0], 0xFF0000FFU);  // palette index 12
+  EXPECT_EQ(style.border_resolution[0], FM_COLOR_RESOLUTION_EXACT);
+  for (std::size_t side = 1; side < 5U; ++side) {
+    EXPECT_EQ(style.border_argb[side], 0xFF000000U) << side;
+    EXPECT_EQ(style.border_resolution[side], FM_COLOR_RESOLUTION_AUTO_CONTEXT) << side;
+  }
+  EXPECT_EQ(style.locked, 0);
+  EXPECT_EQ(style.hidden, 1);
+  const char* date_code = nullptr;
+  ASSERT_EQ(fm_styles_get_num_fmt_string(wb.handle, 14, &date_code), 0);
+  ASSERT_NE(style.num_fmt_code, nullptr);
+  EXPECT_STREQ(style.num_fmt_code, date_code);
+
+  // Once the theme part exists the same font colour is exact.
+  fm_theme_colors colors{};
+  for (std::size_t i = 0; i < 12U; ++i) {
+    colors.argb[i] = kDefaultScheme[i];
+  }
+  ASSERT_EQ(fm_workbook_set_theme_colors(wb.handle, &colors), 0);
+  EXPECT_EQ(Effective(wb.handle, 0, 0).font_resolution, FM_COLOR_RESOLUTION_EXACT);
+
+  const fm_effective_style plain = Effective(wb.handle, 3, 3);
+  EXPECT_EQ(plain.source, 3);
+  EXPECT_EQ(plain.locked, 1);
+  EXPECT_EQ(plain.hidden, 0);
+  EXPECT_STREQ(plain.num_fmt_code, "General");
+}
+
+TEST(FormulonCApiEffectiveStyle, RejectsInvalidArguments) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_effective_style style{};
+  EXPECT_EQ(fm_sheet_get_effective_style(nullptr, 0, 0, 0, &style), kNullPointer);
+  EXPECT_EQ(fm_sheet_get_effective_style(wb.handle, 0, 0, 0, nullptr), kNullPointer);
+  EXPECT_EQ(fm_sheet_get_effective_style(wb.handle, 9, 0, 0, &style), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_get_effective_style(wb.handle, 0, 1048576U, 0, &style), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_get_effective_style(wb.handle, 0, 0, 16384U, &style), kInvalidArgument);
+}
diff --git a/tests/c_api/formulon_c_threaded_comments_test.cpp b/tests/c_api/formulon_c_threaded_comments_test.cpp
new file mode 100644
index 000000000..7108aa0a0
--- /dev/null
+++ b/tests/c_api/formulon_c_threaded_comments_test.cpp
@@ -0,0 +1,276 @@
+//
+// Stable C ABI tests for threaded comments and the workbook person list:
+// record shapes, CRUD, the note/thread exclusivity, and a save and reload.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "gtest/gtest.h"
+#include "utils/error.h"
+
+namespace {
+
+constexpr bool kWasm32 = sizeof(void*) == 4U;
+static_assert(sizeof(fm_mention) == (kWasm32 ? 16U : 24U), "fm_mention ABI layout changed");
+static_assert(sizeof(fm_threaded_comment) == (kWasm32 ? 40U : 72U), "fm_threaded_comment ABI layout changed");
+static_assert(sizeof(fm_person) == 4U * sizeof(void*), "fm_person ABI layout changed");
+
+constexpr fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+constexpr fm_status_t kBindingNullPointer = static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer);
+constexpr fm_status_t kThreadedCommentInvalid =
+    static_cast<fm_status_t>(formulon::FormulonErrorCode::kThreadedCommentInvalid);
+
+constexpr const char* kAlice = "{0A1B2C3D-0000-4000-8000-000000000001}";
+constexpr const char* kBob = "{0A1B2C3D-0000-4000-8000-000000000002}";
+constexpr const char* kThread = "{6F1E0D2C-1111-4111-8111-000000000001}";
+constexpr const char* kReply = "{6F1E0D2C-1111-4111-8111-000000000002}";
+constexpr const char* kMention = "{6F1E0D2C-1111-4111-8111-0000000000AA}";
+constexpr const char* kCreated = "2026-01-02T03:04:05.67";
+
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+};
+
+void SaveAndReload(fm_workbook_t* wb, WorkbookGuard* out) {
+  std::uint8_t* bytes = nullptr;
+  std::size_t len = 0;
+  ASSERT_EQ(fm_workbook_save(wb, &bytes, &len), 0) << fm_last_error_message();
+  const fm_status_t rc = fm_workbook_load(bytes, len, &out->handle);
+  fm_buffer_free(bytes);
+  ASSERT_EQ(rc, 0) << fm_last_error_message();
+}
+
+std::string Str(const char* text) {
+  return text != nullptr ? std::string(text) : std::string();
+}
+
+/// Copy of one comment record whose views may die with the next read.
+struct CommentCopy {
+  std::string id, person_id, created, text, parent_id;
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  int32_t done = 0;
+  struct MentionCopy {
+    std::string person_id, mention_id;
+    std::uint32_t start = 0;
+    std::uint32_t length = 0;
+  };
+  std::vector<MentionCopy> mentions;
+};
+
+std::vector<CommentCopy> ReadComments(const fm_workbook_t* wb) {
+  std::vector<CommentCopy> out;
+  std::size_t count = 0;
+  EXPECT_EQ(fm_sheet_threaded_comment_count(wb, 0, &count), 0);
+  for (std::size_t i = 0; i < count; ++i) {
+    fm_threaded_comment c{};
+    EXPECT_EQ(fm_sheet_threaded_comment_at(wb, 0, i, &c), 0) << fm_last_error_message();
+    CommentCopy copy;
+    copy.id = Str(c.id);
+    copy.person_id = Str(c.person_id);
+    copy.created = Str(c.created);
+    copy.text = Str(c.text);
+    copy.parent_id = Str(c.parent_id);
+    copy.row = c.row;
+    copy.col = c.col;
+    copy.done = c.done;
+    for (std::uint32_t m = 0; m < c.mention_count; ++m) {
+      copy.mentions.push_back(
+          {Str(c.mentions[m].person_id), Str(c.mentions[m].mention_id), c.mentions[m].start, c.mentions[m].length});
+    }
+    out.push_back(copy);
+  }
+  return out;
+}
+
+std::vector<std::string> PersonNames(const fm_workbook_t* wb) {
+  std::vector<std::string> names;
+  std::size_t count = 0;
+  EXPECT_EQ(fm_workbook_person_count(wb, &count), 0);
+  for (std::size_t i = 0; i < count; ++i) {
+    fm_person p{};
+    EXPECT_EQ(fm_workbook_person_at(wb, i, &p), 0);
+    names.push_back(Str(p.display_name));
+  }
+  return names;
+}
+
+void AddPeople(fm_workbook_t* wb) {
+  const fm_person alice{kAlice, "Alice", "alice@example.com", "None"};
+  const fm_person bob{kBob, "Bob", "bob@example.com", "None"};
+  ASSERT_EQ(fm_workbook_add_person(wb, &alice), 0) << fm_last_error_message();
+  ASSERT_EQ(fm_workbook_add_person(wb, &bob), 0) << fm_last_error_message();
+}
+
+fm_threaded_comment Comment(const char* id, std::uint32_t row, std::uint32_t col, const char* person, const char* text,
+                            const char* parent) {
+  fm_threaded_comment c{};
+  c.id = id;
+  c.row = row;
+  c.col = col;
+  c.person_id = person;
+  c.created = kCreated;
+  c.text = text;
+  c.parent_id = parent;
+  return c;
+}
+
+/// A thread on B2 by Alice mentioning Bob, and Bob's reply.
+void AddThread(fm_workbook_t* wb) {
+  const fm_mention mention{kBob, kMention, 0, 4};
+  fm_threaded_comment opening = Comment(kThread, 1, 1, kAlice, "@Bob please check", nullptr);
+  opening.mentions = &mention;
+  opening.mention_count = 1;
+  ASSERT_EQ(fm_sheet_add_threaded_comment(wb, 0, &opening), 0) << fm_last_error_message();
+  // A reply takes the thread's anchor, whatever coordinates it carries.
+  const fm_threaded_comment reply = Comment(kReply, 7, 7, kBob, "Done", kThread);
+  ASSERT_EQ(fm_sheet_add_threaded_comment(wb, 0, &reply), 0) << fm_last_error_message();
+}
+
+TEST(FormulonCApiThreadedComments, PersonsAddListAndRemove) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  AddPeople(wb.handle);
+  EXPECT_EQ(PersonNames(wb.handle), (std::vector<std::string>{"Alice", "Bob"}));
+  fm_person p{};
+  ASSERT_EQ(fm_workbook_person_at(wb.handle, 1, &p), 0);
+  EXPECT_STREQ(p.id, kBob);
+  EXPECT_STREQ(p.user_id, "bob@example.com");
+  EXPECT_STREQ(p.provider_id, "None");
+  EXPECT_EQ(fm_workbook_person_at(wb.handle, 2, &p), kInvalidArgument);
+
+  const fm_person duplicate{kAlice, "Again", nullptr, nullptr};
+  EXPECT_EQ(fm_workbook_add_person(wb.handle, &duplicate), kThreadedCommentInvalid);
+  const fm_person lowercase{"{0a1b2c3d-0000-4000-8000-000000000009}", "Low", nullptr, nullptr};
+  EXPECT_EQ(fm_workbook_add_person(wb.handle, &lowercase), kThreadedCommentInvalid);
+  EXPECT_EQ(fm_workbook_add_person(wb.handle, nullptr), kBindingNullPointer);
+
+  ASSERT_EQ(fm_workbook_remove_person(wb.handle, kAlice), 0);
+  EXPECT_EQ(PersonNames(wb.handle), (std::vector<std::string>{"Bob"}));
+  EXPECT_EQ(fm_workbook_remove_person(wb.handle, kAlice), kThreadedCommentInvalid);
+}
+
+TEST(FormulonCApiThreadedComments, ThreadRepliesAndMentionsRoundTrip) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  AddPeople(wb.handle);
+  AddThread(wb.handle);
+  ASSERT_EQ(fm_sheet_set_thread_resolved(wb.handle, 0, kThread, 1), 0) << fm_last_error_message();
+  EXPECT_EQ(fm_sheet_set_thread_resolved(wb.handle, 0, kReply, 1), kThreadedCommentInvalid);
+
+  const fm_mention edited_mention{kAlice, kMention, 5, 6};
+  ASSERT_EQ(fm_sheet_edit_threaded_comment(wb.handle, 0, kReply, "Done @Alice", &edited_mention, 1), 0)
+      << fm_last_error_message();
+
+  WorkbookGuard reloaded;
+  SaveAndReload(wb.handle, &reloaded);
+  EXPECT_EQ(PersonNames(reloaded.handle), (std::vector<std::string>{"Alice", "Bob"}));
+  const std::vector<CommentCopy> comments = ReadComments(reloaded.handle);
+  ASSERT_EQ(comments.size(), 2U);
+
+  const CommentCopy& opening = comments[0];
+  EXPECT_EQ(opening.id, kThread);
+  EXPECT_EQ(opening.row, 1U);
+  EXPECT_EQ(opening.col, 1U);
+  EXPECT_EQ(opening.person_id, kAlice);
+  EXPECT_EQ(opening.created, kCreated);
+  EXPECT_EQ(opening.text, "@Bob please check");
+  EXPECT_EQ(opening.parent_id, "");
+  EXPECT_EQ(opening.done, 1);
+  ASSERT_EQ(opening.mentions.size(), 1U);
+  EXPECT_EQ(opening.mentions[0].person_id, kBob);
+  EXPECT_EQ(opening.mentions[0].mention_id, kMention);
+  EXPECT_EQ(opening.mentions[0].start, 0U);
+  EXPECT_EQ(opening.mentions[0].length, 4U);
+
+  const CommentCopy& reply = comments[1];
+  EXPECT_EQ(reply.id, kReply);
+  EXPECT_EQ(reply.parent_id, kThread);
+  EXPECT_EQ(reply.row, 1U);
+  EXPECT_EQ(reply.col, 1U);
+  EXPECT_EQ(reply.text, "Done @Alice");
+  ASSERT_EQ(reply.mentions.size(), 1U);
+  EXPECT_EQ(reply.mentions[0].person_id, kAlice);
+  EXPECT_EQ(reply.mentions[0].start, 5U);
+
+  // The legacy stub Excel stores for the thread is not listed as a note.
+  std::uint32_t notes = 9;
+  ASSERT_EQ(fm_sheet_get_comment_count(reloaded.handle, 0, &notes), 0);
+  EXPECT_EQ(notes, 0U);
+}
+
+TEST(FormulonCApiThreadedComments, RemovingTheOpeningCommentRemovesTheThread) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  AddPeople(wb.handle);
+  AddThread(wb.handle);
+  EXPECT_EQ(fm_workbook_remove_person(wb.handle, kBob), kThreadedCommentInvalid);
+
+  ASSERT_EQ(fm_sheet_remove_threaded_comment(wb.handle, 0, kReply), 0);
+  EXPECT_EQ(ReadComments(wb.handle).size(), 1U);
+  const fm_threaded_comment reply = Comment(kReply, 0, 0, kBob, "Again", kThread);
+  ASSERT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &reply), 0) << fm_last_error_message();
+  EXPECT_EQ(ReadComments(wb.handle).size(), 2U);
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, nullptr), kBindingNullPointer);
+  ASSERT_EQ(fm_sheet_remove_threaded_comment(wb.handle, 0, kThread), 0);
+  EXPECT_TRUE(ReadComments(wb.handle).empty());
+  EXPECT_EQ(fm_sheet_remove_threaded_comment(wb.handle, 0, kThread), kThreadedCommentInvalid);
+  ASSERT_EQ(fm_workbook_remove_person(wb.handle, kBob), 0);
+}
+
+TEST(FormulonCApiThreadedComments, CellCarriesNoteOrThreadNotBoth) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  AddPeople(wb.handle);
+  ASSERT_EQ(fm_sheet_set_comment(wb.handle, 0, 4, 2, "Alice", "a note"), 0);
+  const fm_threaded_comment on_note = Comment(kThread, 4, 2, kAlice, "hi", nullptr);
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &on_note), kThreadedCommentInvalid);
+
+  AddThread(wb.handle);
+  EXPECT_EQ(fm_sheet_set_comment(wb.handle, 0, 1, 1, "Alice", "a note"), kThreadedCommentInvalid);
+  const fm_threaded_comment second = Comment("{6F1E0D2C-1111-4111-8111-000000000003}", 1, 1, kAlice, "x", nullptr);
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &second), kThreadedCommentInvalid);
+}
+
+TEST(FormulonCApiThreadedComments, RejectsMalformedInput) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  AddPeople(wb.handle);
+  fm_threaded_comment c = Comment(kThread, 0, 0, kAlice, "text", nullptr);
+  c.created = "2026-01-02 03:04:05";
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &c), kThreadedCommentInvalid);
+  c.created = kCreated;
+  c.person_id = "{0A1B2C3D-0000-4000-8000-0000000000FF}";
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &c), kThreadedCommentInvalid);
+  c.person_id = kAlice;
+  c.mention_count = 1;
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &c), kInvalidArgument);
+  const fm_mention beyond{kBob, kMention, 2, 10};
+  c.mentions = &beyond;
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &c), kThreadedCommentInvalid);
+  c.mentions = nullptr;
+  c.mention_count = 0;
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 3, &c), kInvalidArgument);
+  ASSERT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &c), 0) << fm_last_error_message();
+  EXPECT_EQ(fm_sheet_add_threaded_comment(wb.handle, 0, &c), kThreadedCommentInvalid);
+
+  EXPECT_EQ(fm_sheet_edit_threaded_comment(wb.handle, 0, nullptr, "x", nullptr, 0), kBindingNullPointer);
+  EXPECT_EQ(fm_sheet_edit_threaded_comment(wb.handle, 0, kThread, "x", nullptr, 2), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_edit_threaded_comment(wb.handle, 0, kReply, "x", nullptr, 0), kThreadedCommentInvalid);
+  EXPECT_EQ(fm_sheet_set_thread_resolved(wb.handle, 0, nullptr, 1), kBindingNullPointer);
+  EXPECT_EQ(fm_sheet_remove_threaded_comment(wb.handle, 0, nullptr), kBindingNullPointer);
+
+  std::size_t count = 0;
+  EXPECT_EQ(fm_sheet_threaded_comment_count(wb.handle, 5, &count), kInvalidArgument);
+  fm_threaded_comment out{};
+  EXPECT_EQ(fm_sheet_threaded_comment_at(wb.handle, 0, 1, &out), kInvalidArgument);
+}
+
+}  // namespace
diff --git a/tests/c_api/formulon_c_validation_test.cpp b/tests/c_api/formulon_c_validation_test.cpp
new file mode 100644
index 000000000..8bda755c6
--- /dev/null
+++ b/tests/c_api/formulon_c_validation_test.cpp
@@ -0,0 +1,240 @@
+//
+// Stable C ABI tests for data-validation evaluation: checking a proposed
+// value against the covering rule, and paging through the invalid cells.
+
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <utility>
+#include <vector>
+
+#include "c_api/formulon_c.h"
+#include "gtest/gtest.h"
+#include "utils/error.h"
+
+namespace {
+
+static_assert(sizeof(fm_validation_outcome) == 16U, "fm_validation_outcome ABI layout changed");
+
+constexpr fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+constexpr fm_status_t kBindingNullPointer = static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer);
+constexpr std::uint64_t kCursorEnd = std::numeric_limits<std::uint64_t>::max();
+constexpr std::uint64_t kCursorStride = 16384U;
+
+struct WorkbookGuard {
+  fm_workbook_t* handle = nullptr;
+  ~WorkbookGuard() { fm_workbook_destroy(handle); }
+  WorkbookGuard() = default;
+  WorkbookGuard(const WorkbookGuard&) = delete;
+  WorkbookGuard& operator=(const WorkbookGuard&) = delete;
+};
+
+struct RangeGuard {
+  fm_cell_range_t* handle = nullptr;
+  ~RangeGuard() { fm_cell_range_destroy(handle); }
+  RangeGuard() = default;
+  RangeGuard(const RangeGuard&) = delete;
+  RangeGuard& operator=(const RangeGuard&) = delete;
+};
+
+void SaveAndReload(fm_workbook_t* wb, WorkbookGuard* out) {
+  std::uint8_t* bytes = nullptr;
+  std::size_t len = 0;
+  ASSERT_EQ(fm_workbook_save(wb, &bytes, &len), 0) << fm_last_error_message();
+  const fm_status_t rc = fm_workbook_load(bytes, len, &out->handle);
+  fm_buffer_free(bytes);
+  ASSERT_EQ(rc, 0) << fm_last_error_message();
+}
+
+fm_value_t Number(double v) {
+  fm_value_t value{};
+  value.kind = FM_VAL_NUMBER;
+  value.u.number = v;
+  return value;
+}
+
+fm_value_t Text(const char* text) {
+  fm_value_t value{};
+  value.kind = FM_VAL_TEXT;
+  value.u.text = text;
+  return value;
+}
+
+/// Adds a whole-number rule over `range` (between `low` and `high`).
+void AddWholeBetween(fm_workbook_t* wb, fm_merge_range range, const char* low, const char* high,
+                     std::uint8_t error_style) {
+  fm_data_validation v{};
+  v.ranges = &range;
+  v.range_count = 1;
+  v.type = 1;
+  v.op = 0;
+  v.error_style = error_style;
+  v.show_error_message = 1;
+  v.formula1 = low;
+  v.formula2 = high;
+  ASSERT_EQ(fm_sheet_add_validation(wb, 0, v), 0) << fm_last_error_message();
+}
+
+fm_validation_outcome Validate(const fm_workbook_t* wb, std::uint32_t row, std::uint32_t col, fm_value_t value) {
+  fm_validation_outcome out{};
+  EXPECT_EQ(fm_sheet_validate_value(wb, 0, row, col, &value, &out), 0) << fm_last_error_message();
+  return out;
+}
+
+/// Lists every invalid cell, `limit` per page, as `(row, col)` pairs.
+std::vector<std::pair<std::uint32_t, std::uint32_t>> ListInvalid(const fm_workbook_t* wb, std::uint32_t limit,
+                                                                 std::size_t* pages) {
+  std::vector<std::pair<std::uint32_t, std::uint32_t>> cells;
+  std::uint64_t cursor = 0;
+  *pages = 0;
+  while (cursor != kCursorEnd && *pages < 16U) {
+    RangeGuard page;
+    EXPECT_EQ(fm_sheet_list_invalid_cells(wb, 0, cursor, limit, &page.handle), 0) << fm_last_error_message();
+    if (page.handle == nullptr) {
+      break;
+    }
+    ++*pages;
+    std::size_t count = 0;
+    EXPECT_EQ(fm_cell_range_count(page.handle, &count), 0);
+    EXPECT_LE(count, limit == 0U ? 65536U : limit);
+    for (std::size_t i = 0; i < count; ++i) {
+      std::uint32_t row = 0;
+      std::uint32_t col = 0;
+      fm_value_t value{};
+      EXPECT_EQ(fm_cell_range_at(page.handle, i, &row, &col, nullptr, &value), 0);
+      cells.emplace_back(row, col);
+    }
+    EXPECT_EQ(fm_cell_range_next_cursor(page.handle, &cursor), 0);
+  }
+  return cells;
+}
+
+/// A2:A10 whole 1..10 (warning) over B2:B10 whole 5..6 (stop); A1 is free.
+void BuildRules(fm_workbook_t* wb) {
+  AddWholeBetween(wb, fm_merge_range{1, 0, 9, 0}, "1", "10", 1);
+  AddWholeBetween(wb, fm_merge_range{1, 1, 9, 1}, "5", "6", 0);
+}
+
+void ExpectVerdicts(const fm_workbook_t* wb) {
+  const fm_validation_outcome free_cell = Validate(wb, 0, 0, Number(99));
+  EXPECT_EQ(free_cell.has_rule, 0);
+  EXPECT_EQ(free_cell.valid, 1);
+
+  const fm_validation_outcome ok = Validate(wb, 1, 0, Number(5));
+  EXPECT_EQ(ok.has_rule, 1);
+  EXPECT_EQ(ok.valid, 1);
+  EXPECT_EQ(ok.rule_index, 0U);
+  EXPECT_EQ(ok.error_style, 1);
+
+  const fm_validation_outcome too_big = Validate(wb, 1, 0, Number(20));
+  EXPECT_EQ(too_big.has_rule, 1);
+  EXPECT_EQ(too_big.valid, 0);
+
+  // Text is never a whole number, even when it spells one.
+  EXPECT_EQ(Validate(wb, 1, 0, Text("5")).valid, 0);
+  EXPECT_EQ(Validate(wb, 1, 0, Number(2.5)).valid, 0);
+
+  const fm_validation_outcome second = Validate(wb, 4, 1, Number(7));
+  EXPECT_EQ(second.has_rule, 1);
+  EXPECT_EQ(second.valid, 0);
+  EXPECT_EQ(second.rule_index, 1U);
+  EXPECT_EQ(second.error_style, 0);
+}
+
+TEST(FormulonCApiValidation, ValidateValueUsesTheCoveringRule) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  BuildRules(wb.handle);
+  ExpectVerdicts(wb.handle);
+}
+
+TEST(FormulonCApiValidation, OverlappingRulesApplyTheFirst) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  AddWholeBetween(wb.handle, fm_merge_range{0, 0, 4, 0}, "1", "3", 0);
+  AddWholeBetween(wb.handle, fm_merge_range{0, 0, 9, 0}, "1", "100", 2);
+  const fm_validation_outcome overlap = Validate(wb.handle, 2, 0, Number(50));
+  EXPECT_EQ(overlap.rule_index, 0U);
+  EXPECT_EQ(overlap.valid, 0);
+  const fm_validation_outcome tail = Validate(wb.handle, 7, 0, Number(50));
+  EXPECT_EQ(tail.rule_index, 1U);
+  EXPECT_EQ(tail.valid, 1);
+  EXPECT_EQ(tail.error_style, 2);
+}
+
+TEST(FormulonCApiValidation, InvalidCellsPageWithoutGaps) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  BuildRules(wb.handle);
+  // A1 is outside every rule; A2, B3, A5 and B9 break theirs.
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 500), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 1, 0, 50), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 1, 1, 5), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 2, 1, 9), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 3, 0, 3), 0);
+  ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 4, 0, "x"), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 8, 1, 1), 0);
+
+  const std::vector<std::pair<std::uint32_t, std::uint32_t>> expected = {{1, 0}, {2, 1}, {4, 0}, {8, 1}};
+  std::size_t pages = 0;
+  EXPECT_EQ(ListInvalid(wb.handle, 0, &pages), expected);
+  EXPECT_EQ(pages, 1U);
+  EXPECT_EQ(ListInvalid(wb.handle, 2, &pages), expected);
+  EXPECT_EQ(pages, 2U);
+  EXPECT_EQ(ListInvalid(wb.handle, 1, &pages), expected);
+  EXPECT_EQ(pages, 4U);
+
+  // A page that ends exactly at the last invalid cell reports no further one.
+  RangeGuard last;
+  ASSERT_EQ(fm_sheet_list_invalid_cells(wb.handle, 0, 4 * kCursorStride + 1, 1, &last.handle), 0);
+  std::uint64_t next = 0;
+  ASSERT_EQ(fm_cell_range_next_cursor(last.handle, &next), 0);
+  EXPECT_EQ(next, kCursorEnd);
+  std::size_t count = 0;
+  ASSERT_EQ(fm_cell_range_count(last.handle, &count), 0);
+  EXPECT_EQ(count, 1U);
+
+  WorkbookGuard reloaded;
+  SaveAndReload(wb.handle, &reloaded);
+  ExpectVerdicts(reloaded.handle);
+  EXPECT_EQ(ListInvalid(reloaded.handle, 3, &pages), expected);
+}
+
+TEST(FormulonCApiValidation, NoRulesListsNothing) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1), 0);
+  RangeGuard page;
+  ASSERT_EQ(fm_sheet_list_invalid_cells(wb.handle, 0, 0, 0, &page.handle), 0);
+  std::size_t count = 9;
+  ASSERT_EQ(fm_cell_range_count(page.handle, &count), 0);
+  EXPECT_EQ(count, 0U);
+  std::uint64_t next = 0;
+  ASSERT_EQ(fm_cell_range_next_cursor(page.handle, &next), 0);
+  EXPECT_EQ(next, kCursorEnd);
+}
+
+TEST(FormulonCApiValidation, RejectsBadArguments) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_validation_outcome out{};
+  fm_value_t value = Number(1);
+  EXPECT_EQ(fm_sheet_validate_value(wb.handle, 3, 0, 0, &value, &out), kInvalidArgument);
+  EXPECT_EQ(fm_sheet_validate_value(wb.handle, 0, 0, 0, nullptr, &out), kBindingNullPointer);
+  EXPECT_EQ(fm_sheet_validate_value(wb.handle, 0, 0, 0, &value, nullptr), kBindingNullPointer);
+  EXPECT_EQ(fm_sheet_validate_value(wb.handle, 0, 2000000, 0, &value, &out), kInvalidArgument);
+  value.kind = FM_VAL_ARRAY;
+  EXPECT_EQ(fm_sheet_validate_value(wb.handle, 0, 0, 0, &value, &out), kInvalidArgument);
+  value = Text(nullptr);
+  EXPECT_EQ(fm_sheet_validate_value(wb.handle, 0, 0, 0, &value, &out), kBindingNullPointer);
+  value = Number(std::numeric_limits<double>::infinity());
+  EXPECT_EQ(fm_sheet_validate_value(wb.handle, 0, 0, 0, &value, &out), kInvalidArgument);
+
+  RangeGuard page;
+  EXPECT_EQ(fm_sheet_list_invalid_cells(wb.handle, 0, 0, 0, nullptr), kBindingNullPointer);
+  EXPECT_EQ(fm_sheet_list_invalid_cells(wb.handle, 0, 1048576ULL * kCursorStride, 0, &page.handle), kInvalidArgument);
+  EXPECT_EQ(page.handle, nullptr);
+  EXPECT_EQ(fm_sheet_list_invalid_cells(wb.handle, 2, 0, 0, &page.handle), kInvalidArgument);
+}
+
+}  // namespace
diff --git a/tests/c_api/formulon_c_values_test.cpp b/tests/c_api/formulon_c_values_test.cpp
new file mode 100644
index 000000000..c42c25066
--- /dev/null
+++ b/tests/c_api/formulon_c_values_test.cpp
@@ -0,0 +1,344 @@
+// Stable C ABI (`src/c_api/formulon_c.h`) end-to-end tests.
+//
+// The test driver is C++ for gtest convenience but everything it
+// touches across the boundary is the pure-C surface declared in
+// `formulon_c.h`.
+
+#include <atomic>
+#include <cstddef>
+#include <cstring>
+#include <limits>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "formulon_c_test_helpers.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+TEST(FormulonCApi, CreateAndDestroy) {
+  WorkbookGuard wb;
+  EXPECT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_NE(wb.handle, nullptr);
+  // create() always seeds a single Sheet1.
+  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 1U);
+  const char* name = nullptr;
+  EXPECT_EQ(fm_workbook_sheet_name(wb.handle, 0, &name), 0);
+  ASSERT_NE(name, nullptr);
+  EXPECT_STREQ(name, "Sheet1");
+}
+TEST(FormulonCApi, CreateEmptyAndAddSheet) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create_empty(&wb.handle), 0);
+  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 0U);
+  EXPECT_EQ(fm_workbook_add_sheet(wb.handle, "Data"), 0);
+  EXPECT_EQ(fm_workbook_add_sheet(wb.handle, "Stats"), 0);
+  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 2U);
+
+  const char* n0 = nullptr;
+  const char* n1 = nullptr;
+  ASSERT_EQ(fm_workbook_sheet_name(wb.handle, 0, &n0), 0);
+  ASSERT_EQ(fm_workbook_sheet_name(wb.handle, 1, &n1), 0);
+  EXPECT_STREQ(n0, "Data");
+  EXPECT_STREQ(n1, "Stats");
+}
+TEST(FormulonCApi, AddSheetValidatesNameAndRejectsDuplicate) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create_empty(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_add_sheet(wb.handle, "Data"), 0);
+  // Duplicate (case-insensitive), forbidden character, and empty name are
+  // all rejected now that the public add surface shares the rename
+  // validator instead of silently accepting anything.
+  EXPECT_NE(fm_workbook_add_sheet(wb.handle, "data"), 0);
+  EXPECT_NE(fm_workbook_add_sheet(wb.handle, "a/b"), 0);
+  EXPECT_NE(fm_workbook_add_sheet(wb.handle, ""), 0);
+  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 1U);
+  // A valid, distinct name still succeeds.
+  EXPECT_EQ(fm_workbook_add_sheet(wb.handle, "Stats"), 0);
+  EXPECT_EQ(fm_workbook_sheet_count(wb.handle), 2U);
+}
+TEST(FormulonCApi, NumberLiteralRoundTrip) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 42.5), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(v.u.number, 42.5);
+}
+TEST(FormulonCApi, GetValueRejectsCoordinatesOutsideTheGrid) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  fm_value_t v{};
+  EXPECT_EQ(fm_workbook_get_value(wb.handle, 0, formulon::Sheet::kMaxRows, 0, &v), kInvalidArgument);
+  EXPECT_EQ(fm_workbook_get_value(wb.handle, 0, 0, formulon::Sheet::kMaxCols, &v), kInvalidArgument);
+  // The last addressable cell is still readable.
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, formulon::Sheet::kMaxRows - 1, formulon::Sheet::kMaxCols - 1, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_BLANK);
+}
+TEST(FormulonCApi, SetNumberRejectsNaNAndInfinity) {
+  // A Number-kind cell must always hold a finite double: ISNUMBER,
+  // arithmetic on the cell, and a save/reload round trip would otherwise
+  // disagree about whether it is a number or an error (save() downgrades a
+  // non-finite literal to #NUM!, per io/ooxml_writer_cell.cpp).
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  const fm_status_t kInvalidArgument = static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, std::numeric_limits<double>::quiet_NaN()), kInvalidArgument);
+  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, std::numeric_limits<double>::infinity()), kInvalidArgument);
+  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, -std::numeric_limits<double>::infinity()), kInvalidArgument);
+
+  // A rejected call must not have written anything: the cell stays blank.
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_BLANK);
+
+  // A finite value still succeeds.
+  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.5), 0);
+}
+TEST(FormulonCApi, ParallelRecalcMatchesSerialOnWideIndependentDag) {
+  WorkbookGuard serial;
+  WorkbookGuard parallel;
+  ASSERT_EQ(fm_workbook_create(&serial.handle), 0);
+  ASSERT_EQ(fm_workbook_create(&parallel.handle), 0);
+
+  constexpr std::uint32_t kRows = 48U;
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    const double input = static_cast<double>(row + 1U);
+    const std::string formula = "=A" + std::to_string(row + 1U) + "*2+1";
+    ASSERT_EQ(fm_workbook_set_number(serial.handle, 0U, row, 0U, input), 0);
+    ASSERT_EQ(fm_workbook_set_number(parallel.handle, 0U, row, 0U, input), 0);
+    ASSERT_EQ(fm_workbook_set_formula(serial.handle, 0U, row, 1U, formula.c_str()), 0);
+    ASSERT_EQ(fm_workbook_set_formula(parallel.handle, 0U, row, 1U, formula.c_str()), 0);
+  }
+
+  ASSERT_EQ(fm_workbook_recalc(serial.handle), 0);
+  fm_parallel_recalc_stats stats{};
+  ASSERT_EQ(fm_workbook_recalc_parallel(parallel.handle, 4U, &stats), 0);
+  EXPECT_EQ(stats.cells_evaluated, kRows);
+  EXPECT_GE(stats.sccs_processed, kRows);
+  EXPECT_GE(stats.parallel_steps, 1U);
+  EXPECT_GE(stats.worker_threads_started, 2U);
+  EXPECT_GE(stats.worker_threads_used, 1U);
+
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    fm_value_t serial_value{};
+    fm_value_t parallel_value{};
+    ASSERT_EQ(fm_workbook_get_value(serial.handle, 0U, row, 1U, &serial_value), 0);
+    ASSERT_EQ(fm_workbook_get_value(parallel.handle, 0U, row, 1U, &parallel_value), 0);
+    ASSERT_EQ(serial_value.kind, FM_VAL_NUMBER);
+    ASSERT_EQ(parallel_value.kind, FM_VAL_NUMBER);
+    EXPECT_DOUBLE_EQ(parallel_value.u.number, serial_value.u.number);
+    EXPECT_DOUBLE_EQ(parallel_value.u.number, static_cast<double>(row + 1U) * 2.0 + 1.0);
+  }
+}
+TEST(FormulonCApi, ParallelRecalcCountOneStartsNoWorkers) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0U, 0U, 0U, 7.0), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0U, 0U, 1U, "=A1+1"), 0);
+
+  fm_parallel_recalc_stats stats{};
+  ASSERT_EQ(fm_workbook_recalc_parallel(wb.handle, 1U, &stats), 0);
+  EXPECT_EQ(stats.cells_evaluated, 1U);
+  EXPECT_EQ(stats.worker_threads_started, 0U);
+  EXPECT_EQ(stats.worker_threads_used, 0U);
+
+  // The output is optional for callers that only need the status code.
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0U, 0U, 0U, 9.0), 0);
+  EXPECT_EQ(fm_workbook_recalc_parallel(wb.handle, 1U, nullptr), 0);
+}
+TEST(FormulonCApi, ParallelRecalcInvalidAndNullPathsResetStats) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+
+  const fm_parallel_recalc_stats poison = {1U, 2U, 3U, 4U, 5U, 6U, 7U};
+  const fm_parallel_recalc_stats zero{};
+  fm_parallel_recalc_stats stats = poison;
+  EXPECT_EQ(fm_workbook_recalc_parallel(wb.handle, 9U, &stats),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(std::memcmp(&stats, &zero, sizeof(stats)), 0);
+
+  stats = poison;
+  EXPECT_EQ(fm_workbook_recalc_parallel(nullptr, 1U, &stats),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+  EXPECT_EQ(std::memcmp(&stats, &zero, sizeof(stats)), 0);
+
+  EXPECT_EQ(fm_workbook_recalc_parallel(wb.handle, 1U, nullptr), 0);
+}
+TEST(FormulonCApi, BoolAndBlankSetters) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_bool(wb.handle, 0, 0, 0, 1), 0);
+  ASSERT_EQ(fm_workbook_set_bool(wb.handle, 0, 1, 0, 0), 0);
+  ASSERT_EQ(fm_workbook_set_blank(wb.handle, 0, 2, 0), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_BOOL);
+  EXPECT_EQ(v.u.boolean, 1);
+
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 1, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_BOOL);
+  EXPECT_EQ(v.u.boolean, 0);
+
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 2, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_BLANK);
+}
+TEST(FormulonCApi, ErrorSetterStoresStaticErrorLiteral) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_error(wb.handle, 0, 0, 0, 1), 0);  // ErrorCode::Div0
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_ERROR);
+  EXPECT_EQ(v.u.error_code, 1);
+}
+TEST(FormulonCApi, ErrorSetterRejectsInvalidErrorCode) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  EXPECT_NE(fm_workbook_set_error(wb.handle, 0, 0, 0, -1), 0);
+  EXPECT_NE(fm_workbook_set_error(wb.handle, 0, 0, 0, 999), 0);
+}
+TEST(FormulonCApi, FormulaNumericResult) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 10.0), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 1, 0, "=A1*2"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 1, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(v.u.number, 20.0);
+}
+TEST(FormulonCApi, FormulaTextResult) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=UPPER(\"hello\")"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_TEXT);
+  ASSERT_NE(v.u.text, nullptr);
+  EXPECT_STREQ(v.u.text, "HELLO");
+}
+TEST(FormulonCApi, TextSetterRoundTrip) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  // Use a stack buffer that goes out of scope before recalc to confirm
+  // the handle interns the bytes.
+  {
+    char tmp[] = "hello";
+    ASSERT_EQ(fm_workbook_set_text(wb.handle, 0, 0, 0, tmp), 0);
+    // Mutate the source buffer to prove we're not aliasing.
+    tmp[0] = 'X';
+    (void)tmp[0];
+  }
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_TEXT);
+  ASSERT_NE(v.u.text, nullptr);
+  EXPECT_STREQ(v.u.text, "hello");
+  // Verify the returned pointer is actually NUL-terminated by inspecting
+  // strlen against the documented length.
+  EXPECT_EQ(std::strlen(v.u.text), 5U);
+}
+TEST(FormulonCApi, FormulaErrorSurfacesAsValueError) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=1/0"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_ERROR);
+  // Excel's `#DIV/0!` is `ErrorCode::Div0`, ordinal 1.
+  EXPECT_EQ(v.u.error_code, 1);
+}
+TEST(FormulonCApi, NullWorkbookSetsBindingError) {
+  fm_value_t v{};
+  fm_status_t rc = fm_workbook_get_value(nullptr, 0, 0, 0, &v);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+  EXPECT_GT(std::strlen(fm_last_error_message()), 0U);
+
+  // Also exercise the create-side NULL path.
+  rc = fm_workbook_create(nullptr);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kBindingNullPointer));
+  EXPECT_GT(std::strlen(fm_last_error_message()), 0U);
+}
+TEST(FormulonCApi, OutOfRangeSheetIndex) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  fm_status_t rc = fm_workbook_set_number(wb.handle, 99, 0, 0, 1.0);
+  EXPECT_NE(rc, 0);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  // Context should reference the offending sheet index.
+  std::string ctx = fm_last_error_context();
+  EXPECT_NE(ctx.find("sheet_index"), std::string::npos) << "context=" << ctx;
+}
+TEST(FormulonCApi, OutOfGridCoordinateIsRejected) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  // A column near the top of the u32 range would otherwise resize a row
+  // vector to billions of cells. It must be rejected before the storage
+  // layer, not turned into a multi-GB allocation.
+  const std::uint32_t kBadCol = 4'000'000'000U;
+  fm_status_t rc = fm_workbook_set_number(wb.handle, 0, 0, kBadCol, 1.0);
+  EXPECT_EQ(rc, static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  std::string ctx = fm_last_error_context();
+  EXPECT_NE(ctx.find("col"), std::string::npos) << "context=" << ctx;
+
+  // Row at the Excel ceiling (kMaxRows) is one past the last addressable
+  // row and must also be rejected.
+  EXPECT_EQ(fm_workbook_set_formula(wb.handle, 0, formulon::Sheet::kMaxRows, 0, "=1"),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+  EXPECT_EQ(fm_workbook_set_blank(wb.handle, 0, 0, formulon::Sheet::kMaxCols),
+            static_cast<fm_status_t>(formulon::FormulonErrorCode::kInvalidArgument));
+
+  // The last in-grid cell still round-trips.
+  EXPECT_EQ(fm_workbook_set_number(wb.handle, 0, formulon::Sheet::kMaxRows - 1U, formulon::Sheet::kMaxCols - 1U, 3.0),
+            0);
+}
+TEST(FormulonCApi, SuccessClearsPreviousLastError) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  // First, force an error so the thread-local diagnostic is populated.
+  fm_value_t v{};
+  ASSERT_NE(fm_workbook_get_value(nullptr, 0, 0, 0, &v), 0);
+  EXPECT_GT(std::strlen(fm_last_error_message()), 0U);
+  // Now drive a success and confirm the diagnostic was cleared.
+  ASSERT_EQ(fm_workbook_set_number(wb.handle, 0, 0, 0, 1.0), 0);
+  EXPECT_EQ(std::strlen(fm_last_error_message()), 0U);
+  EXPECT_EQ(std::strlen(fm_last_error_context()), 0U);
+}
+
+TEST(FormulonCApi, IterativeOptionsConverge) {
+  WorkbookGuard wb;
+  ASSERT_EQ(fm_workbook_create(&wb.handle), 0);
+  ASSERT_EQ(fm_workbook_set_iterative(wb.handle, 1, 100, 1e-6), 0);
+
+  // A1 = 0.5 * (A1 + 2) converges to 2 from the blank initial cache
+  // value. Unlike Newton's method, this intentionally needs no separate
+  // numeric seed, because setting a formula replaces that cell's cache.
+  ASSERT_EQ(fm_workbook_set_formula(wb.handle, 0, 0, 0, "=0.5*(A1+2)"), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb.handle), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb.handle, 0, 0, 0, &v), 0);
+  ASSERT_EQ(v.kind, FM_VAL_NUMBER);
+  EXPECT_NEAR(v.u.number, 2.0, 1e-3);
+}
diff --git a/tests/cli/CMakeLists.txt b/tests/cli/CMakeLists.txt
index 0d5ce5004..ec249af61 100644
--- a/tests/cli/CMakeLists.txt
+++ b/tests/cli/CMakeLists.txt
@@ -6,7 +6,11 @@
 # `FORMULON_CLI_PATH` so the tests do not depend on `$PATH`.
 
 set(FORMULON_CLI_TEST_SOURCES
-  cli_test.cpp
+  cli_commands_version_eval_test.cpp
+  cli_recalc_semantics_test.cpp
+  cli_atomic_paths_test.cpp
+  cli_dump_paginate_test.cpp
+  cli_test_support.cpp
   # `cli/file_io.cpp`: the atomic-write helper ships only in the CLI
   # binary, and a leaked descriptor cannot be observed from outside a
   # one-shot process, so it is compiled in and called directly.
diff --git a/tests/cli/cli_atomic_paths_test.cpp b/tests/cli/cli_atomic_paths_test.cpp
new file mode 100644
index 000000000..8f51834f8
--- /dev/null
+++ b/tests/cli/cli_atomic_paths_test.cpp
@@ -0,0 +1,400 @@
+// `formulon_cli` end-to-end tests grouped by command surface.
+#include <cstring>
+
+#include "cli/cli.h"
+#include "cli_test_support.h"
+
+using namespace formulon::cli_test;
+
+TEST(FormulonCli, RecalcInPlaceOverwritesSamePathAndLeavesNoTemp) {
+  // Input and output are the same path: the atomic write must serialize the
+  // recalculated workbook fully before replacing the original, and must not
+  // leave its sibling temp file behind on success.
+  std::string path = temp_path("inplace.xlsx");
+  std::string tmp_sidecar = path + ".formulon-tmp";
+  PathGuard g_path(path);
+  PathGuard g_tmp(tmp_sidecar);
+  ASSERT_TRUE(write_fixture_workbook(path));
+
+  CliRun r = run_cli({"recalc", path, "-o", path, "--quiet"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+
+  // The temp sidecar must be gone (renamed into place).
+  {
+    std::ifstream leftover(tmp_sidecar, std::ios::binary);
+    EXPECT_FALSE(leftover.good()) << "temp sidecar left behind after in-place recalc";
+  }
+
+  // The overwritten file still loads and recalculates correctly.
+  std::ifstream f(path, std::ios::binary);
+  ASSERT_TRUE(f);
+  f.seekg(0, std::ios::end);
+  const std::streamsize size = f.tellg();
+  ASSERT_GT(size, 0);
+  f.seekg(0, std::ios::beg);
+  std::vector<std::uint8_t> bytes(static_cast<std::size_t>(size));
+  f.read(reinterpret_cast<char*>(bytes.data()), size);
+  ASSERT_TRUE(f);
+
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb), 0);
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb, 0, 0, 1, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(v.u.number, 8.0);
+  fm_workbook_destroy(wb);
+}
+
+TEST(FormulonCli, RecalcDoesNotReusePredictableLegacyTempPath) {
+  const std::string input = temp_path("safe_temp_in.xlsx");
+  const std::string output = temp_path("safe_temp_out.xlsx");
+  const std::string legacy_temp = output + ".formulon-tmp";
+  PathGuard g_input(input);
+  PathGuard g_output(output);
+  PathGuard g_legacy_temp(legacy_temp);
+  ASSERT_TRUE(write_fixture_workbook(input));
+  {
+    std::ofstream sentinel(legacy_temp, std::ios::binary);
+    ASSERT_TRUE(sentinel);
+    sentinel << "unrelated file";
+  }
+
+  CliRun r = run_cli({"recalc", input, "-o", output, "--quiet"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  std::ifstream sentinel(legacy_temp, std::ios::binary);
+  ASSERT_TRUE(sentinel);
+  std::string contents;
+  std::getline(sentinel, contents);
+  EXPECT_EQ(contents, "unrelated file");
+}
+
+TEST(FormulonCli, RecalcThroughSymlinkUpdatesTargetAndKeepsLink) {
+  // Saving through a symlink must update the file the link names. A
+  // rename onto the link path would replace the link with a regular
+  // file and leave the real workbook holding stale values -- the same
+  // silent-loss shape the atomic write exists to prevent.
+  const std::string input = temp_path("symlink_in.xlsx");
+  const std::string target = temp_path("symlink_target.xlsx");
+  const std::string link = temp_path("symlink_link.xlsx");
+  PathGuard g_input(input);
+  PathGuard g_target(target);
+  PathGuard g_link(link);
+  ASSERT_TRUE(write_fixture_workbook(input));
+  ASSERT_TRUE(write_fixture_workbook(target));
+  std::remove(link.c_str());
+  ASSERT_EQ(::symlink(target.c_str(), link.c_str()), 0);
+
+  CliRun r = run_cli({"recalc", input, "-o", link, "--quiet"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+
+  // The link survives as a link...
+  struct stat link_stat {};
+  ASSERT_EQ(::lstat(link.c_str(), &link_stat), 0);
+  EXPECT_TRUE(S_ISLNK(link_stat.st_mode)) << "symlink was replaced by a regular file";
+
+  // ...and the file it names is the one that got rewritten.
+  std::ifstream written(target, std::ios::binary);
+  ASSERT_TRUE(written);
+  written.seekg(0, std::ios::end);
+  EXPECT_GT(written.tellg(), 0);
+
+  // No temp sidecar is left next to either path.
+  for (const std::string& sidecar : {target + ".formulon-tmp", link + ".formulon-tmp"}) {
+    std::ifstream leftover(sidecar, std::ios::binary);
+    EXPECT_FALSE(leftover.good()) << "temp sidecar left behind: " << sidecar;
+  }
+}
+
+TEST(FormulonCli, RecalcDanglingSymlinkIsReplacedInPlace) {
+  // A link with no target has nothing to preserve, so the write lands
+  // on the link path itself rather than failing.
+  const std::string input = temp_path("dangling_in.xlsx");
+  const std::string link = temp_path("dangling_link.xlsx");
+  PathGuard g_input(input);
+  PathGuard g_link(link);
+  ASSERT_TRUE(write_fixture_workbook(input));
+  std::remove(link.c_str());
+  ASSERT_EQ(::symlink(temp_path("dangling_absent.xlsx").c_str(), link.c_str()), 0);
+
+  CliRun r = run_cli({"recalc", input, "-o", link, "--quiet"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  std::ifstream written(link, std::ios::binary);
+  ASSERT_TRUE(written);
+  written.seekg(0, std::ios::end);
+  EXPECT_GT(written.tellg(), 0);
+}
+
+TEST(FormulonCli, RecalcLeavesOutputIntactWhenTheWriteCannotStart) {
+  // Stand-in for a disk-full failure: an unwritable directory makes the
+  // temp file impossible to create. The pre-existing output must be left
+  // exactly as it was, with no partial content and no sidecar.
+  const std::string dir = temp_path("readonly_dir");
+  const std::string input = temp_path("readonly_in.xlsx");
+  const std::string output = dir + "/out.xlsx";
+  PathGuard g_input(input);
+  ASSERT_TRUE(write_fixture_workbook(input));
+  ASSERT_EQ(::mkdir(dir.c_str(), 0700), 0) << dir << ": " << std::strerror(errno);
+  DirGuard g_dir(dir);
+  ASSERT_TRUE(write_fixture_workbook(output));
+
+  std::vector<std::uint8_t> before;
+  {
+    std::ifstream original(output, std::ios::binary);
+    ASSERT_TRUE(original);
+    before.assign(std::istreambuf_iterator<char>(original), std::istreambuf_iterator<char>());
+  }
+  ASSERT_FALSE(before.empty());
+  ASSERT_EQ(::chmod(dir.c_str(), 0500), 0);
+
+  CliRun r = run_cli({"recalc", input, "-o", output, "--quiet"});
+  EXPECT_NE(r.exit_code, 0) << "write into an unwritable directory should fail";
+
+  // Restore write permission so the fixture can be inspected; `g_dir`
+  // removes it either way.
+  ASSERT_EQ(::chmod(dir.c_str(), 0700), 0);
+  std::vector<std::uint8_t> after;
+  {
+    std::ifstream survivor(output, std::ios::binary);
+    ASSERT_TRUE(survivor) << "existing output was destroyed by a failed write";
+    after.assign(std::istreambuf_iterator<char>(survivor), std::istreambuf_iterator<char>());
+  }
+  EXPECT_EQ(before, after) << "existing output was modified by a failed write";
+
+  // "Unchanged" covers the whole directory, not just the output's bytes:
+  // a sidecar the failed write forgot to clean up would still be sitting
+  // next to it.
+  EXPECT_EQ(list_directory(dir), std::vector<std::string>{"out.xlsx"});
+}
+
+TEST(FormulonCli, RecalcPreservesExistingOutputPermissions) {
+  std::string in = temp_path("mode_in.xlsx");
+  std::string out_path = temp_path("mode_out.xlsx");
+  PathGuard g_in(in);
+  PathGuard g_out(out_path);
+  ASSERT_TRUE(write_fixture_workbook(in));
+  ASSERT_TRUE(write_fixture_workbook(out_path));
+  ASSERT_EQ(::chmod(out_path.c_str(), 0600), 0);
+
+  CliRun r = run_cli({"recalc", in, "-o", out_path, "--quiet"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+
+  struct stat saved_stat {};
+  ASSERT_EQ(::stat(out_path.c_str(), &saved_stat), 0);
+  EXPECT_EQ(saved_stat.st_mode & 0777U, 0600U);
+}
+
+TEST(FormulonCli, RecalcCreatesNewOutputWithUmaskDefaultPermissions) {
+  // A fresh output path must come out with the mode an ordinary file
+  // creation would produce, not the private mode the atomic-write
+  // temporary is created with. The reference file below is created the
+  // ordinary way, so the expectation follows whatever umask is in effect.
+  std::string in = temp_path("newmode_in.xlsx");
+  std::string out_path = temp_path("newmode_out.xlsx");
+  std::string reference = temp_path("newmode_reference");
+  PathGuard g_in(in);
+  PathGuard g_out(out_path);
+  PathGuard g_reference(reference);
+  ASSERT_TRUE(write_fixture_workbook(in));
+  std::remove(out_path.c_str());
+  std::remove(reference.c_str());
+
+  const int reference_fd = ::open(reference.c_str(), O_CREAT | O_WRONLY | O_EXCL, 0666);
+  ASSERT_GE(reference_fd, 0);
+  ASSERT_EQ(::close(reference_fd), 0);
+  struct stat reference_stat {};
+  ASSERT_EQ(::stat(reference.c_str(), &reference_stat), 0);
+
+  CliRun r = run_cli({"recalc", in, "-o", out_path, "--quiet"});
+  ASSERT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+
+  struct stat created_stat {};
+  ASSERT_EQ(::stat(out_path.c_str(), &created_stat), 0);
+  EXPECT_EQ(created_stat.st_mode & 0777U, reference_stat.st_mode & 0777U);
+
+  // Re-running against the now-existing path keeps that same mode, so the
+  // permissions do not depend on whether the output already existed.
+  CliRun again = run_cli({"recalc", in, "-o", out_path, "--quiet"});
+  ASSERT_EQ(again.exit_code, 0) << "stderr=" << again.stderr_text;
+  struct stat rerun_stat {};
+  ASSERT_EQ(::stat(out_path.c_str(), &rerun_stat), 0);
+  EXPECT_EQ(rerun_stat.st_mode & 0777U, created_stat.st_mode & 0777U);
+}
+
+TEST(FormulonCli, RecalcMissingOutputExits64) {
+  std::string in = temp_path("in_missing_o.xlsx");
+  PathGuard g_in(in);
+  ASSERT_TRUE(write_fixture_workbook(in));
+  CliRun r = run_cli({"recalc", in});
+  EXPECT_EQ(r.exit_code, 64);
+}
+
+TEST(FormulonCli, RecalcEmptyOutputPathIsDiagnosedApartFromAMissingOne) {
+  // `-o "$OUT"` with an unset variable supplies the flag and an empty
+  // value. Reporting that as a missing flag sends the user looking at the
+  // wrong line of their script, so the two states get their own wording.
+  std::string in = temp_path("empty_output_flag.xlsx");
+  PathGuard g_in(in);
+  ASSERT_TRUE(write_fixture_workbook(in));
+
+  CliRun empty = run_cli({"recalc", in, "-o", ""});
+  EXPECT_EQ(empty.exit_code, 64);
+  EXPECT_NE(empty.stderr_text.find("non-empty path"), std::string::npos) << empty.stderr_text;
+
+  CliRun missing = run_cli({"recalc", in});
+  EXPECT_EQ(missing.exit_code, 64);
+  EXPECT_NE(missing.stderr_text.find("missing -o/--output"), std::string::npos) << missing.stderr_text;
+
+  EXPECT_NE(empty.stderr_text, missing.stderr_text);
+}
+
+TEST(FormulonCli, RecalcMissingInputExits64) {
+  CliRun r = run_cli({"recalc", "-o", temp_path("unused.xlsx")});
+  EXPECT_EQ(r.exit_code, 64);
+}
+
+TEST(FormulonCli, RecalcNonexistentFileFailsCleanly) {
+  CliRun r = run_cli({"recalc", temp_path("absent_input.xlsx"), "-o", temp_path("unused.xlsx")});
+  EXPECT_EQ(r.exit_code, 1);
+  EXPECT_EQ(r.stderr_text.find("warning:"), std::string::npos);
+}
+
+TEST(FormulonCli, RecalcOptionTerminatorAcceptsDashLeadingRelativePaths) {
+  const std::string input = "-fm_cli_recalc_dash_input.xlsx";
+  const std::string output = "-fm_cli_recalc_dash_output.xlsx";
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  std::remove(output.c_str());
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun result = run_cli({"recalc", "--threads", "1", "-o", output, "--", input});
+  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
+
+  std::ifstream saved(output, std::ios::binary);
+  ASSERT_TRUE(saved);
+  const std::vector<std::uint8_t> bytes((std::istreambuf_iterator<char>(saved)), std::istreambuf_iterator<char>());
+  ASSERT_FALSE(bytes.empty());
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb), 0);
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_get_value(wb, 0U, 0U, 1U, &value), 0);
+  EXPECT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 8.0);
+  fm_workbook_destroy(wb);
+}
+
+TEST(FormulonCli, RecalcDashLeadingInputWithoutTerminatorIsUsageError) {
+  const std::string input = "-fm_cli_recalc_dash_without_terminator_input.xlsx";
+  const std::string output = "-fm_cli_recalc_dash_without_terminator_output.xlsx";
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  std::remove(output.c_str());
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun result = run_cli({"recalc", input, "-o", output});
+  EXPECT_EQ(result.exit_code, 64);
+  EXPECT_TRUE(result.stdout_text.empty());
+  EXPECT_FALSE(std::ifstream(output, std::ios::binary).good());
+}
+
+TEST(FormulonCli, RecalcAcceptsDoubleDashAsOutputPathValue) {
+  const std::string input = "fm_cli_recalc_double_dash_input.xlsx";
+  const std::string output = "--";
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  std::remove(output.c_str());
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun result = run_cli({"recalc", input, "-o", output});
+  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
+
+  std::ifstream saved(output, std::ios::binary);
+  ASSERT_TRUE(saved);
+  const std::vector<std::uint8_t> bytes((std::istreambuf_iterator<char>(saved)), std::istreambuf_iterator<char>());
+  ASSERT_FALSE(bytes.empty());
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb), 0);
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_get_value(wb, 0U, 0U, 1U, &value), 0);
+  EXPECT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 8.0);
+  fm_workbook_destroy(wb);
+}
+
+TEST(FormulonCli, OptionTerminatorRequiresExactlyOnePositional) {
+  const std::string output = temp_path("terminator_recalc_output.xlsx");
+  PathGuard output_guard(output);
+
+  for (const std::vector<std::string>& args : {
+           std::vector<std::string>{"eval", "--"},
+           std::vector<std::string>{"dump", "--"},
+           std::vector<std::string>{"paginate", "--"},
+       }) {
+    const CliRun result = run_cli(args);
+    EXPECT_EQ(result.exit_code, 64) << "bare terminator command=" << args.front();
+  }
+
+  std::remove(output.c_str());
+  CliRun recalc_bare = run_cli({"recalc", "-o", output, "--"});
+  EXPECT_EQ(recalc_bare.exit_code, 64);
+  EXPECT_FALSE(std::ifstream(output, std::ios::binary).good());
+
+  for (const std::vector<std::string>& args : {
+           std::vector<std::string>{"eval", "--", "-1+2", "--json"},
+           std::vector<std::string>{"dump", "--", "-fm_cli_missing.xlsx", "--sheets"},
+           std::vector<std::string>{"paginate", "--", "-fm_cli_missing.xlsx", "--sheet"},
+       }) {
+    const CliRun result = run_cli(args);
+    EXPECT_EQ(result.exit_code, 64) << "post-terminator extra command=" << args.front();
+  }
+
+  std::remove(output.c_str());
+  CliRun recalc_extra = run_cli({"recalc", "-o", output, "--", "-fm_cli_missing.xlsx", "--quiet"});
+  EXPECT_EQ(recalc_extra.exit_code, 64);
+  EXPECT_FALSE(std::ifstream(output, std::ios::binary).good());
+}
+
+TEST(FormulonCliFileIo, AtomicWriteLeavesNoDescriptorOrTemporaryBehind) {
+  const std::string dir = temp_path("atomic_write_dir");
+  ASSERT_EQ(::mkdir(dir.c_str(), 0700), 0) << dir << ": " << std::strerror(errno);
+  DirGuard guard(dir);
+  const std::string output = dir + "/out.bin";
+  const std::vector<std::uint8_t> payload{'f', 'o', 'r', 'm'};
+
+  const int baseline = open_descriptor_count();
+  for (int attempt = 0; attempt < 8; ++attempt) {
+    ASSERT_EQ(formulon::cli::write_file_atomically(output, payload.data(), payload.size()), 0) << attempt;
+  }
+  EXPECT_EQ(open_descriptor_count(), baseline) << "successful writes leaked a descriptor";
+  EXPECT_EQ(list_directory(dir), std::vector<std::string>{"out.bin"});
+
+  // A destination that is a directory runs the whole sequence -- create,
+  // write, sync, close -- and only then fails, at the rename. Repeating
+  // it makes a per-call leak visible as growth rather than as a single
+  // descriptor that could be noise, and the temporary it created has to
+  // be gone from the parent directory afterwards.
+  const std::string occupied = dir + "/sub";
+  ASSERT_EQ(::mkdir(occupied.c_str(), 0700), 0) << occupied << ": " << std::strerror(errno);
+  for (int attempt = 0; attempt < 8; ++attempt) {
+    EXPECT_NE(formulon::cli::write_file_atomically(occupied, payload.data(), payload.size()), 0) << attempt;
+  }
+  EXPECT_EQ(open_descriptor_count(), baseline) << "failed writes leaked a descriptor";
+  EXPECT_EQ(list_directory(dir), (std::vector<std::string>{"out.bin", "sub"}));
+
+  // An unwritable directory covers the other end: the failure happens
+  // before anything is created at all.
+  ASSERT_EQ(::chmod(dir.c_str(), 0500), 0);
+  for (int attempt = 0; attempt < 8; ++attempt) {
+    EXPECT_NE(formulon::cli::write_file_atomically(output, payload.data(), payload.size()), 0) << attempt;
+  }
+  EXPECT_EQ(open_descriptor_count(), baseline) << "failed writes leaked a descriptor";
+  ASSERT_EQ(::chmod(dir.c_str(), 0700), 0);
+  EXPECT_EQ(list_directory(dir), (std::vector<std::string>{"out.bin", "sub"}));
+
+  std::ifstream written(output, std::ios::binary);
+  ASSERT_TRUE(written);
+  const std::vector<std::uint8_t> contents((std::istreambuf_iterator<char>(written)), std::istreambuf_iterator<char>());
+  EXPECT_EQ(contents, payload);
+}
diff --git a/tests/cli/cli_commands_version_eval_test.cpp b/tests/cli/cli_commands_version_eval_test.cpp
new file mode 100644
index 000000000..4668a50cf
--- /dev/null
+++ b/tests/cli/cli_commands_version_eval_test.cpp
@@ -0,0 +1,286 @@
+// `formulon_cli` end-to-end tests grouped by command surface.
+#include "cli/cli.h"
+#include "cli_test_support.h"
+
+using namespace formulon::cli_test;
+
+TEST(FormulonCli, VersionPrintsNonEmpty) {
+  CliRun r = run_cli({"--version"});
+  EXPECT_EQ(r.exit_code, 0);
+  EXPECT_GT(r.stdout_text.size(), 0U);
+}
+
+TEST(FormulonCli, HelpExitsZero) {
+  CliRun r = run_cli({"--help"});
+  EXPECT_EQ(r.exit_code, 0);
+  EXPECT_NE(r.stdout_text.find("Usage"), std::string::npos);
+}
+
+TEST(FormulonCli, VersionAndHelpFailWhenTheirOutputCannotBeWritten) {
+  // A release script doing `ver=$(formulon --version)` must not be handed
+  // an empty string with a success status, so the version and usage
+  // banners go through the same flush check `dump` and `eval` use for
+  // their results.
+  for (const char* flag : {"--version", "--help"}) {
+    CliRun r = run_cli({flag}, /*merge_streams=*/false, /*close_stdout=*/true);
+    EXPECT_EQ(r.exit_code, 1) << flag;
+    EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos) << flag << " stderr=" << r.stderr_text;
+  }
+}
+
+TEST(FormulonCli, SubcommandVersionAndHelpFailWhenTheirOutputCannotBeWritten) {
+  for (const char* subcommand : {"eval", "recalc", "dump", "paginate"}) {
+    for (const char* flag : {"--version", "--help"}) {
+      CliRun r = run_cli({subcommand, flag}, /*merge_streams=*/false, /*close_stdout=*/true);
+      EXPECT_EQ(r.exit_code, 1) << subcommand << ' ' << flag;
+      EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos)
+          << subcommand << ' ' << flag << " stderr=" << r.stderr_text;
+    }
+  }
+}
+
+TEST(FormulonCli, VersionIsAcceptedBySubcommandsLikeHelp) {
+  // The usage banner lists `--version` under the same "Common options"
+  // heading as `-h`, so every subcommand must accept it and print the
+  // same line the top-level flag prints.
+  CliRun top = run_cli({"--version"});
+  ASSERT_EQ(top.exit_code, 0);
+  ASSERT_FALSE(top.stdout_text.empty());
+
+  for (const char* subcommand : {"eval", "recalc", "dump", "paginate"}) {
+    CliRun r = run_cli({subcommand, "--version"});
+    EXPECT_EQ(r.exit_code, 0) << subcommand << " stderr=" << r.stderr_text;
+    EXPECT_EQ(r.stdout_text, top.stdout_text) << subcommand;
+  }
+}
+
+TEST(FormulonCli, RecalcHelpDocumentsActualSuccessStatus) {
+  CliRun r = run_cli({"recalc", "--help"});
+  EXPECT_EQ(r.exit_code, 0);
+  EXPECT_NE(r.stdout_text.find("formulon: recalc: ok, wrote M bytes to 'OUT'"), std::string::npos);
+  EXPECT_NE(r.stdout_text.find("--threads N"), std::string::npos);
+  EXPECT_NE(r.stdout_text.find("recalc remains serial"), std::string::npos);
+}
+
+TEST(FormulonCli, NoArgsExits64) {
+  CliRun r = run_cli({});
+  EXPECT_EQ(r.exit_code, 64);
+}
+
+TEST(FormulonCli, UnknownCommandExits64) {
+  CliRun r = run_cli({"frobnicate"});
+  EXPECT_EQ(r.exit_code, 64);
+}
+
+TEST(FormulonCli, ExitCodesNeverEncodeLargeInternalStatusValues) {
+  EXPECT_EQ(formulon::cli::exit_code_for_status(0), 0);
+  EXPECT_EQ(formulon::cli::exit_code_for_status(formulon::cli::kExitUsage), 64);
+  EXPECT_EQ(formulon::cli::exit_code_for_status(128), 1);
+  EXPECT_EQ(formulon::cli::exit_code_for_status(7000), 1);
+  EXPECT_EQ(formulon::cli::exit_code_for_status(8000), 1);
+}
+
+TEST(FormulonCli, EvalSumLiterals) {
+  CliRun r = run_cli({"eval", "=SUM(1,2,3)"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "6\n");
+}
+
+TEST(FormulonCli, EvalIfTrue) {
+  CliRun r = run_cli({"eval", "=IF(TRUE,1,2)"});
+  EXPECT_EQ(r.exit_code, 0);
+  EXPECT_EQ(r.stdout_text, "1\n");
+}
+
+TEST(FormulonCli, EvalConcatTextNoQuoting) {
+  CliRun r = run_cli({"eval", "=CONCAT(\"hello\",\" \",\"world\")"});
+  EXPECT_EQ(r.exit_code, 0);
+  EXPECT_EQ(r.stdout_text, "hello world\n");
+}
+
+TEST(FormulonCli, EvalCellLevelErrorIsStillExitZero) {
+  // The ad-hoc evaluator reads A1 without first writing the expression to
+  // A1, so it sees the empty cell rather than making a self-reference cycle.
+  CliRun r = run_cli({"eval", "=A1+1"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "1\n");
+}
+
+TEST(FormulonCli, EvalMalformedSyntaxYieldsTheSameNameErrorEveryBindingReturns) {
+  // The ad-hoc evaluator resolves a parser recovery placeholder to a
+  // cell-level `#NAME?`. That is what the WASM, Node and Python bindings
+  // return over the same C ABI entry point, so the CLI returns it too:
+  // a formula prototyped here has to behave identically when it is moved
+  // into a script driving one of the other surfaces.
+  for (const char* formula : {"=1+", "=1+*2"}) {
+    CliRun r = run_cli({"eval", formula});
+    EXPECT_EQ(r.exit_code, 0) << formula << " stderr=" << r.stderr_text;
+    EXPECT_EQ(r.stdout_text, "#NAME?\n") << formula;
+  }
+}
+
+TEST(FormulonCli, EvalMalformedSyntaxMatchesTheAdHocCApiEntryPoint) {
+  // Same formula, same C ABI call the CLI makes, in-process: a future
+  // pre-parse gate on either side would break this comparison.
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_create_empty(&wb), 0);
+  ASSERT_EQ(fm_workbook_add_sheet(wb, "Sheet1"), 0);
+  std::uint32_t rows = 0;
+  std::uint32_t cols = 0;
+  ASSERT_EQ(fm_workbook_evaluate_formula_array(wb, 0, 0, 0, "=1+", &rows, &cols), 0);
+  EXPECT_EQ(rows, 1U);
+  EXPECT_EQ(cols, 1U);
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_evaluate_formula_array_cell(wb, 0, &value), 0);
+  EXPECT_EQ(value.kind, FM_VAL_ERROR);
+  fm_workbook_destroy(wb);
+
+  CliRun r = run_cli({"eval", "=1+"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "#NAME?\n");
+}
+
+TEST(FormulonCli, EvalUnknownFunctionRemainsCellLevelNameError) {
+  CliRun r = run_cli({"eval", "=NOTAREALFUNC(1,2)"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "#NAME?\n");
+}
+
+TEST(FormulonCli, EvalDynamicArrayPrintsWholeGrid) {
+  CliRun r = run_cli({"eval", "=SEQUENCE(2,3)"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "1\t2\t3\n4\t5\t6\n");
+}
+
+TEST(FormulonCli, EvalPlainGridKeepsItsShapeWhenCellsCarryTabsAndNewlines) {
+  // Plain output is a TAB-separated grid, so a cell holding a TAB or a
+  // newline would add fields and rows that a `cut`/`awk`/TSV consumer
+  // reads as real ones. Exactly `rows` lines of `cols` fields must
+  // survive any payload.
+  CliRun r = run_cli({"eval", "=HSTACK(CHAR(9),CHAR(10),\"tail\")"});
+  ASSERT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "\\t\t\\n\ttail\n");
+
+  const auto field_count = [](const std::string& line) {
+    return 1 + static_cast<int>(std::count(line.begin(), line.end(), '\t'));
+  };
+  std::vector<std::string> lines;
+  for (std::size_t start = 0; start < r.stdout_text.size();) {
+    const std::size_t end = r.stdout_text.find('\n', start);
+    ASSERT_NE(end, std::string::npos) << "grid output must be newline-terminated";
+    lines.push_back(r.stdout_text.substr(start, end - start));
+    start = end + 1;
+  }
+  ASSERT_EQ(lines.size(), 1U);
+  EXPECT_EQ(field_count(lines[0]), 3);
+}
+
+TEST(FormulonCli, EvalPlainGridEscapesMultiRowPayloadsToo) {
+  // The two-row case pins the row count as well: an unescaped newline in
+  // the first row would make the result look like three rows.
+  CliRun r = run_cli({"eval", "=VSTACK(HSTACK(CHAR(10),1),HSTACK(2,3))"});
+  ASSERT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "\\n\t1\n2\t3\n");
+  EXPECT_EQ(std::count(r.stdout_text.begin(), r.stdout_text.end(), '\n'), 2);
+}
+
+TEST(FormulonCli, EvalDynamicArrayJsonPrintsNestedArrays) {
+  CliRun r = run_cli({"eval", "--json", "=SEQUENCE(2,2)"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text,
+            "[[{\"kind\":\"number\",\"value\":1},{\"kind\":\"number\",\"value\":2}],"
+            "[{\"kind\":\"number\",\"value\":3},{\"kind\":\"number\",\"value\":4}]]\n");
+}
+
+TEST(FormulonCli, EvalDivByZeroSurfacesAsExcelErrorString) {
+  CliRun r = run_cli({"eval", "=1/0"});
+  EXPECT_EQ(r.exit_code, 0);
+  EXPECT_EQ(r.stdout_text, "#DIV/0!\n");
+}
+
+TEST(FormulonCli, EvalJsonOutputShape) {
+  CliRun r = run_cli({"eval", "--json", "=SUM(1,2,3)"});
+  EXPECT_EQ(r.exit_code, 0);
+  // Compact form: `{"kind":"number","value":6}`.
+  EXPECT_NE(r.stdout_text.find("\"kind\":\"number\""), std::string::npos) << "stdout=" << r.stdout_text;
+  EXPECT_NE(r.stdout_text.find("\"value\":6"), std::string::npos) << "stdout=" << r.stdout_text;
+}
+
+TEST(FormulonCli, EvalMissingFormulaExits64) {
+  CliRun r = run_cli({"eval"});
+  EXPECT_EQ(r.exit_code, 64);
+}
+
+TEST(FormulonCli, EvalUnknownFlagExits64) {
+  CliRun r = run_cli({"eval", "--bogus"});
+  EXPECT_EQ(r.exit_code, 64);
+}
+
+TEST(FormulonCli, EvalNegativeFormulaWithoutTerminatorExits64) {
+  CliRun r = run_cli({"eval", "-1+2"});
+  EXPECT_EQ(r.exit_code, 64);
+  EXPECT_TRUE(r.stdout_text.empty());
+}
+
+TEST(FormulonCli, EvalOptionTerminatorAcceptsNegativeFormula) {
+  CliRun r = run_cli({"eval", "--", "-1+2"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "1\n");
+}
+
+TEST(FormulonCli, EvalRepeatRunsMultipleTimes) {
+  CliRun r = run_cli({"eval", "--repeat", "3", "=SUM(1,2,3)"});
+  EXPECT_EQ(r.exit_code, 0);
+  EXPECT_EQ(r.stdout_text, "6\n");
+  // The timing line goes to stderr.
+  EXPECT_NE(r.stderr_text.find("3 iterations"), std::string::npos);
+}
+
+TEST(FormulonCli, EvalRepeatReportsTimingForEveryAcceptedCount) {
+  // `--repeat` is an explicit request to measure. Every count the flag
+  // accepts gets the report, including the smallest one -- a user timing
+  // a single evaluation must not be answered with silence and status 0.
+  for (const char* count : {"1", "2", "5"}) {
+    CliRun r = run_cli({"eval", "--repeat", count, "=1"});
+    EXPECT_EQ(r.exit_code, 0) << count << " stderr=" << r.stderr_text;
+    EXPECT_EQ(r.stdout_text, "1\n") << count;
+    EXPECT_NE(r.stderr_text.find(std::string(count) + " iterations in"), std::string::npos)
+        << count << " stderr=" << r.stderr_text;
+  }
+}
+
+TEST(FormulonCli, EvalWithoutRepeatFlagReportsNoTiming) {
+  // Only the default single evaluation is silent, and it stays silent
+  // even though it runs the same one pass `--repeat 1` runs.
+  CliRun r = run_cli({"eval", "=1"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "1\n");
+  EXPECT_EQ(r.stderr_text.find("iterations"), std::string::npos) << "stderr=" << r.stderr_text;
+}
+
+TEST(FormulonCli, EvalWriteFailureReturnsOutputError) {
+  CliRun r = run_cli({"eval", "=SUM(1,2,3)"}, /*merge_streams=*/false, /*close_stdout=*/true);
+  EXPECT_EQ(r.exit_code, 1);
+  EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos);
+}
+
+TEST(FormulonCli, EvalRepeatWriteFailureSkipsTimingOutput) {
+  CliRun r = run_cli({"eval", "--repeat", "3", "=SUM(1,2,3)"}, /*merge_streams=*/false,
+                     /*close_stdout=*/true);
+  EXPECT_EQ(r.exit_code, 1);
+  EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos);
+  EXPECT_EQ(r.stderr_text.find("iterations"), std::string::npos);
+}
+
+TEST(FormulonCli, EvalRepeatOverflowExits64) {
+  CliRun r = run_cli({"eval", "--repeat", "999999999999999999999999999999", "=1"});
+  EXPECT_EQ(r.exit_code, 64);
+  EXPECT_NE(r.stderr_text.find("positive integer"), std::string::npos);
+}
+
+TEST(FormulonCli, EvalRepeatHighCountStillCorrect) {
+  CliRun r = run_cli({"eval", "--repeat", "100", "=SUM(1,2,3)"});
+  EXPECT_EQ(r.exit_code, 0);
+  EXPECT_EQ(r.stdout_text, "6\n");
+  EXPECT_NE(r.stderr_text.find("100 iterations"), std::string::npos);
+}
diff --git a/tests/cli/cli_dump_paginate_test.cpp b/tests/cli/cli_dump_paginate_test.cpp
new file mode 100644
index 000000000..eaabdbb34
--- /dev/null
+++ b/tests/cli/cli_dump_paginate_test.cpp
@@ -0,0 +1,243 @@
+// `formulon_cli` end-to-end tests grouped by command surface.
+#include "cli/cli.h"
+#include "cli_test_support.h"
+
+using namespace formulon::cli_test;
+
+TEST(FormulonCli, PaginatePrintsResolvedGeometry) {
+  const std::string path = temp_path("paginate.xlsx");
+  PathGuard guard(path);
+  ASSERT_TRUE(write_fixture_workbook(path));
+
+  CliRun r = run_cli({"paginate", path});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "sheet=0\npages=1\nprint_area=\nhorizontal_breaks=\nvertical_breaks=\n");
+}
+
+TEST(FormulonCli, PaginateWriteFailureReturnsOutputError) {
+  const std::string path = temp_path("paginate_write_failure.xlsx");
+  PathGuard guard(path);
+  ASSERT_TRUE(write_fixture_workbook(path));
+
+  CliRun r = run_cli({"paginate", path}, /*merge_streams=*/false, /*close_stdout=*/true);
+  EXPECT_EQ(r.exit_code, 1);
+  EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos);
+}
+
+TEST(FormulonCli, DumpAndPaginateReportLoadLossesTheWayRecalcDoes) {
+  // Whoever reads a `dump` snapshot or a `paginate` geometry treats it as
+  // a faithful account of the input file, so both have to say what the
+  // load could not carry across -- in the same words `recalc` uses, since
+  // the counters come from one emitter.
+  const std::string ooxml = temp_path("shared_read_diag_ooxml.xlsx");
+  const std::string xlsb = temp_path("shared_read_diag.xlsb");
+  const std::string recalc_output = temp_path("shared_read_diag_out.xlsx");
+  PathGuard g_ooxml(ooxml);
+  PathGuard g_xlsb(xlsb);
+  PathGuard g_output(recalc_output);
+  ASSERT_TRUE(write_lossy_ooxml_fixture(ooxml));
+  ASSERT_TRUE(write_dropped_xlsb_fixture(xlsb));
+
+  for (const std::string& fixture : {ooxml, xlsb}) {
+    const CliRun recalc = run_cli({"recalc", "--quiet", fixture, "-o", recalc_output});
+    ASSERT_EQ(recalc.exit_code, 0) << fixture << " stderr=" << recalc.stderr_text;
+    const std::vector<std::string> expected = read_diagnostic_lines(recalc.stderr_text);
+    ASSERT_FALSE(expected.empty()) << "fixture loads losslessly: " << fixture;
+
+    const CliRun dump = run_cli({"dump", "--sheets", fixture});
+    EXPECT_EQ(dump.exit_code, 0) << fixture << " stderr=" << dump.stderr_text;
+    EXPECT_EQ(read_diagnostic_lines(dump.stderr_text), expected) << fixture;
+    EXPECT_NE(dump.stderr_text.find("formulon: dump: warning:"), std::string::npos) << dump.stderr_text;
+
+    const CliRun paginate = run_cli({"paginate", fixture});
+    EXPECT_EQ(paginate.exit_code, 0) << fixture << " stderr=" << paginate.stderr_text;
+    EXPECT_EQ(read_diagnostic_lines(paginate.stderr_text), expected) << fixture;
+    EXPECT_NE(paginate.stderr_text.find("formulon: paginate: warning:"), std::string::npos) << paginate.stderr_text;
+  }
+}
+
+TEST(FormulonCli, DumpReportsUndecodedCountsBeforeItsSnapshot) {
+  // The warning has to precede the snapshot on the wire, not trail it:
+  // a user piping stdout into `diff` still needs to see the caveat while
+  // the comparison is being set up.
+  const std::string fixture = temp_path("dump_read_diag.xlsb");
+  PathGuard guard(fixture);
+  ASSERT_TRUE(write_dropped_xlsb_fixture(fixture));
+
+  const CliRun merged = run_cli({"dump", "--sheets", fixture}, /*merge_streams=*/true);
+  ASSERT_EQ(merged.exit_code, 0) << merged.stdout_text;
+  const std::size_t warning = merged.stdout_text.find("undecoded_part_count=1");
+  const std::size_t snapshot = merged.stdout_text.find("Sheet1");
+  ASSERT_NE(warning, std::string::npos) << merged.stdout_text;
+  ASSERT_NE(snapshot, std::string::npos) << merged.stdout_text;
+  EXPECT_LT(warning, snapshot);
+}
+
+TEST(FormulonCli, DumpSheetsListsInOrder) {
+  std::string in = temp_path("dump_sheets.xlsx");
+  PathGuard g_in(in);
+  ASSERT_TRUE(write_fixture_workbook(in));
+  CliRun r = run_cli({"dump", "--sheets", in});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_EQ(r.stdout_text, "Sheet1\n");
+}
+
+TEST(FormulonCli, DumpFormulasListsFormulaCells) {
+  std::string in = temp_path("dump_formulas.xlsx");
+  PathGuard g_in(in);
+  ASSERT_TRUE(write_fixture_workbook(in));
+  CliRun r = run_cli({"dump", "--formulas", in});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  // B1 = `=A1+1` is the only formula; A1 is a literal.
+  EXPECT_NE(r.stdout_text.find("Sheet1!B1"), std::string::npos) << "stdout=" << r.stdout_text;
+  EXPECT_EQ(r.stdout_text.find("Sheet1!A1"), std::string::npos) << "literal A1 must not appear in --formulas dump";
+}
+
+TEST(FormulonCli, DumpMetadataPrintsSectionHeaders) {
+  std::string in = temp_path("dump_metadata.xlsx");
+  PathGuard g_in(in);
+  ASSERT_TRUE(write_fixture_workbook(in));
+  CliRun r = run_cli({"dump", "--metadata", in});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_NE(r.stdout_text.find("[defined_names]"), std::string::npos);
+  EXPECT_NE(r.stdout_text.find("[tables]"), std::string::npos);
+  EXPECT_NE(r.stdout_text.find("[passthrough_parts]"), std::string::npos);
+}
+
+TEST(FormulonCli, DumpWriteFailureReturnsOutputError) {
+  std::string in = temp_path("dump_write_failure.xlsx");
+  PathGuard guard(in);
+  ASSERT_TRUE(write_fixture_workbook(in));
+  CliRun r = run_cli({"dump", "--sheets", in}, /*merge_streams=*/false, /*close_stdout=*/true);
+  EXPECT_EQ(r.exit_code, 1);
+  EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos);
+}
+
+TEST(FormulonCli, DumpValuesEscapesEmbeddedNewlines) {
+  std::string in = temp_path("dump_escaped.xlsx");
+  PathGuard guard(in);
+  ASSERT_TRUE(write_fixture_workbook(in, "first\nsecond"));
+  CliRun r = run_cli({"dump", "--values", in});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_NE(r.stdout_text.find("Sheet1!A2 first\\nsecond\n"), std::string::npos) << r.stdout_text;
+  EXPECT_EQ(r.stdout_text.find("first\nsecond"), std::string::npos) << r.stdout_text;
+}
+
+TEST(FormulonCli, DumpMissingInputExits64) {
+  CliRun r = run_cli({"dump", "--sheets"});
+  EXPECT_EQ(r.exit_code, 64);
+}
+
+TEST(FormulonCli, DumpOptionTerminatorAcceptsDashLeadingRelativePath) {
+  const std::string input = "-fm_cli_dump_dash_input.xlsx";
+  PathGuard guard(input);
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun without_terminator = run_cli({"dump", "--sheets", input});
+  EXPECT_EQ(without_terminator.exit_code, 64);
+
+  const CliRun with_terminator = run_cli({"dump", "--sheets", "--", input});
+  EXPECT_EQ(with_terminator.exit_code, 0) << with_terminator.stderr_text;
+  EXPECT_EQ(with_terminator.stdout_text, "Sheet1\n");
+}
+
+TEST(FormulonCli, DumpPostTerminatorHelpIsAnInputPath) {
+  const std::string input = "-h";
+  PathGuard guard(input);
+  std::remove(input.c_str());
+
+  const CliRun result = run_cli({"dump", "--", input});
+  EXPECT_EQ(result.exit_code, 1);
+  EXPECT_TRUE(result.stdout_text.empty());
+  EXPECT_NE(result.stderr_text.find("cannot read"), std::string::npos);
+}
+
+TEST(FormulonCli, SecondLiteralTerminatorIsAnExtraPositional) {
+  const std::string input = "-fm_cli_second_literal_terminator.xlsx";
+  PathGuard guard(input);
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun dump = run_cli({"dump", "--", input, "--"});
+  EXPECT_EQ(dump.exit_code, 64);
+  const CliRun paginate = run_cli({"paginate", "--", input, "--"});
+  EXPECT_EQ(paginate.exit_code, 64);
+}
+
+TEST(FormulonCli, DumpMetadataDistinguishesDefinedNameScope) {
+  std::string in = temp_path("dump_metadata_scoped.xlsx");
+  PathGuard g_in(in);
+
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_create(&wb), 0);
+  ASSERT_EQ(fm_workbook_set_number(wb, 0, 0, 0, 1.0), 0);
+  ASSERT_EQ(fm_workbook_set_defined_name(wb, "WorkbookConst", "=1"), 0);
+  ASSERT_EQ(fm_workbook_set_defined_name_scoped(wb, "SheetLocal", "=Sheet1!$A$1", 0), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb), 0);
+  std::uint8_t* bytes = nullptr;
+  std::size_t len = 0;
+  ASSERT_EQ(fm_workbook_save(wb, &bytes, &len), 0);
+  std::ofstream out(in, std::ios::binary | std::ios::trunc);
+  ASSERT_TRUE(out);
+  out.write(reinterpret_cast<const char*>(bytes), static_cast<std::streamsize>(len));
+  out.close();
+  fm_buffer_free(bytes);
+  fm_workbook_destroy(wb);
+
+  CliRun r = run_cli({"dump", "--metadata", in});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  // Workbook-scoped names print bare; sheet-scoped names are prefixed
+  // with `SheetName!` so the two scopes don't collide in the dump.
+  EXPECT_NE(r.stdout_text.find("WorkbookConst =1"), std::string::npos) << "stdout=" << r.stdout_text;
+  EXPECT_NE(r.stdout_text.find("Sheet1!SheetLocal ="), std::string::npos) << "stdout=" << r.stdout_text;
+}
+
+TEST(FormulonCli, DumpMetadataRecoversFromOutOfRangeDefinedNameScope) {
+  std::string in = temp_path("dump_metadata_out_of_range_scope.xlsx");
+  PathGuard guard(in);
+  ASSERT_TRUE(write_out_of_range_defined_names_fixture(in));
+
+  CliRun r = run_cli({"dump", "--metadata", in});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_TRUE(r.stderr_text.empty());
+  EXPECT_EQ(r.stdout_text,
+            "[defined_names]\n"
+            "Before =1\n"
+            "#99!Bad =Sheet1!$A$1\n"
+            "After =2\n"
+            "[tables]\n"
+            "[passthrough_parts]\n");
+}
+
+TEST(FormulonCli, PaginateOptionTerminatorAcceptsDashLeadingRelativePath) {
+  const std::string input = "-fm_cli_paginate_dash_input.xlsx";
+  PathGuard guard(input);
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun without_terminator = run_cli({"paginate", "--sheet", "0", input});
+  EXPECT_EQ(without_terminator.exit_code, 64);
+
+  const CliRun with_terminator = run_cli({"paginate", "--sheet", "0", "--", input});
+  EXPECT_EQ(with_terminator.exit_code, 0) << with_terminator.stderr_text;
+  EXPECT_EQ(with_terminator.stdout_text, "sheet=0\npages=1\nprint_area=\nhorizontal_breaks=\nvertical_breaks=\n");
+}
+
+TEST(FormulonCli, PaginatePostTerminatorHelpIsAnInputPath) {
+  const std::string input = "-h";
+  PathGuard guard(input);
+  std::remove(input.c_str());
+
+  const CliRun result = run_cli({"paginate", "--", input});
+  EXPECT_EQ(result.exit_code, 1);
+  EXPECT_TRUE(result.stdout_text.empty());
+  EXPECT_NE(result.stderr_text.find("cannot read"), std::string::npos);
+}
+
+TEST(FormulonCli, PaginateConsumesTerminatorAsSheetValue) {
+  const std::string input = "-fm_cli_paginate_sheet_value_terminator.xlsx";
+  PathGuard guard(input);
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun result = run_cli({"paginate", "--sheet", "--", input});
+  EXPECT_EQ(result.exit_code, 64);
+  EXPECT_TRUE(result.stdout_text.empty());
+}
diff --git a/tests/cli/cli_recalc_semantics_test.cpp b/tests/cli/cli_recalc_semantics_test.cpp
new file mode 100644
index 000000000..c640655a4
--- /dev/null
+++ b/tests/cli/cli_recalc_semantics_test.cpp
@@ -0,0 +1,230 @@
+// `formulon_cli` end-to-end tests grouped by command surface.
+#include "cli/cli.h"
+#include "cli_test_support.h"
+
+using namespace formulon::cli_test;
+
+TEST(FormulonCli, RecalcRoundTripsFormulae) {
+  // Build a fixture in /tmp.
+  std::string in = temp_path("in.xlsx");
+  std::string out_path = temp_path("out.xlsx");
+  PathGuard g_in(in);
+  PathGuard g_out(out_path);
+  ASSERT_TRUE(write_fixture_workbook(in));
+
+  CliRun r = run_cli({"recalc", in, "-o", out_path, "--quiet"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+
+  // Load the output back through the C ABI and assert B1 still
+  // recalculates correctly.
+  std::ifstream f(out_path, std::ios::binary);
+  ASSERT_TRUE(f);
+  f.seekg(0, std::ios::end);
+  const std::streamsize size = f.tellg();
+  ASSERT_GT(size, 0);
+  f.seekg(0, std::ios::beg);
+  std::vector<std::uint8_t> bytes(static_cast<std::size_t>(size));
+  f.read(reinterpret_cast<char*>(bytes.data()), size);
+  ASSERT_TRUE(f);
+
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb), 0);
+
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb, 0, 0, 1, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(v.u.number, 8.0);
+  fm_workbook_destroy(wb);
+}
+
+TEST(FormulonCli, RecalcWithoutThreadsKeepsSerialStatusShape) {
+  const std::string input = temp_path("default_recalc_input.xlsx");
+  const std::string output = temp_path("default_recalc_output.xlsx");
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun result = run_cli({"recalc", input, "-o", output});
+  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
+  EXPECT_EQ(result.stderr_text.find("threads="), std::string::npos);
+  EXPECT_NE(result.stderr_text.find("formulon: recalc: ok, wrote "), std::string::npos);
+  EXPECT_NE(result.stderr_text.find(" bytes to '" + output + "'"), std::string::npos);
+}
+
+TEST(FormulonCli, RecalcThreadsUsesParallelSchedulerAndSavesWideDag) {
+  const std::string input = temp_path("parallel_recalc_input.xlsx");
+  const std::string output = temp_path("parallel_recalc_output.xlsx");
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  ASSERT_TRUE(write_wide_recalc_fixture(input));
+
+  const CliRun result = run_cli({"recalc", "--threads", "4", input, "-o", output});
+  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
+  EXPECT_TRUE(result.stdout_text.empty());
+  EXPECT_NE(result.stderr_text.find("threads=4"), std::string::npos);
+  EXPECT_NE(result.stderr_text.find("cells_evaluated=48"), std::string::npos);
+  EXPECT_NE(result.stderr_text.find("sccs_processed="), std::string::npos);
+  EXPECT_NE(result.stderr_text.find("parallel_steps="), std::string::npos);
+  EXPECT_NE(result.stderr_text.find("worker_threads_started="), std::string::npos);
+  EXPECT_NE(result.stderr_text.find("worker_threads_used="), std::string::npos);
+
+  std::ifstream in(output, std::ios::binary);
+  ASSERT_TRUE(in);
+  const std::vector<std::uint8_t> bytes((std::istreambuf_iterator<char>(in)), std::istreambuf_iterator<char>());
+  ASSERT_FALSE(bytes.empty());
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
+  fm_value_t value{};
+  ASSERT_EQ(fm_workbook_get_value(wb, 0U, 47U, 1U, &value), 0);
+  EXPECT_EQ(value.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(value.u.number, 97.0);
+  fm_workbook_destroy(wb);
+}
+
+TEST(FormulonCli, RecalcThreadsOneStartsNoWorkers) {
+  const std::string input = temp_path("serial_threads_input.xlsx");
+  const std::string output = temp_path("serial_threads_output.xlsx");
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  ASSERT_TRUE(write_fixture_workbook(input));
+
+  const CliRun result = run_cli({"recalc", "--threads", "1", input, "-o", output});
+  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
+  EXPECT_NE(result.stderr_text.find("threads=1"), std::string::npos);
+  EXPECT_NE(result.stderr_text.find("worker_threads_started=0"), std::string::npos);
+  EXPECT_NE(result.stderr_text.find("worker_threads_used=0"), std::string::npos);
+}
+
+TEST(FormulonCli, RecalcThreadsRejectsInvalidValuesBeforeWriting) {
+  const std::string input = temp_path("invalid_threads_input.xlsx");
+  const std::string output = temp_path("invalid_threads_output.xlsx");
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  ASSERT_TRUE(write_fixture_workbook(input));
+  std::remove(output.c_str());
+
+  for (const char* value : {"9", "-1", "abc", "4294967296", "--"}) {
+    const CliRun result = run_cli({"recalc", "--threads", value, input, "-o", output});
+    EXPECT_EQ(result.exit_code, 64) << value << " stderr=" << result.stderr_text;
+    EXPECT_NE(result.stderr_text.find("--threads"), std::string::npos);
+    std::ifstream absent(output, std::ios::binary);
+    EXPECT_FALSE(absent.good()) << "invalid value wrote output: " << value;
+  }
+}
+
+TEST(FormulonCli, RecalcLossWarningsAreNonfatalAndNotSuppressedByQuiet) {
+  const std::string input = temp_path("lossy_input.xlsx");
+  const std::string output = temp_path("lossy_output.xlsb");
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  ASSERT_TRUE(write_lossy_xlsx_fixture(input));
+
+  CliRun r = run_cli({"recalc", "--quiet", input, "-o", output});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_TRUE(r.stdout_text.empty());
+  EXPECT_NE(r.stderr_text.find("warning: XLSB write diagnostics"), std::string::npos);
+  EXPECT_NE(r.stderr_text.find("downgraded_formula_count=1"), std::string::npos);
+  // Only the autoFilter is deferred; the data validation is written to .xlsb.
+  EXPECT_NE(r.stderr_text.find("deferred_feature_count=1"), std::string::npos);
+}
+
+TEST(FormulonCli, RecalcReportsOoxmlReadDiagnosticsSeparatelyFromXlsbOnes) {
+  const std::string input = temp_path("lossy_ooxml_input.xlsx");
+  const std::string output = temp_path("lossy_ooxml_output.xlsx");
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  ASSERT_TRUE(write_lossy_ooxml_fixture(input));
+
+  CliRun r = run_cli({"recalc", "--quiet", input, "-o", output});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_NE(r.stderr_text.find("warning: OOXML read diagnostics"), std::string::npos) << r.stderr_text;
+  // One unparseable merge ref plus one conditional-formatting block with no
+  // `sqref`; the unrecognised workbook content type is reported separately.
+  EXPECT_NE(r.stderr_text.find("skipped_feature_count=2"), std::string::npos) << r.stderr_text;
+  EXPECT_NE(r.stderr_text.find("unknown_content_type_count=1"), std::string::npos) << r.stderr_text;
+  // The XLSB line must not appear: an `.xlsx` load produces none of its
+  // counters, and a zero counter is never printed.
+  EXPECT_EQ(r.stderr_text.find("XLSB read diagnostics"), std::string::npos) << r.stderr_text;
+}
+
+TEST(FormulonCli, RecalcDroppedPartWarningIsNonfatalAndQuietStillReportsIt) {
+  const std::string input = temp_path("dropped_input.xlsb");
+  const std::string output = temp_path("dropped_output.xlsx");
+  PathGuard input_guard(input);
+  PathGuard output_guard(output);
+  ASSERT_TRUE(write_dropped_xlsb_fixture(input));
+
+  CliRun r = run_cli({"recalc", "--quiet", input, "-o", output});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+  EXPECT_NE(r.stderr_text.find("undecoded_part_count=1"), std::string::npos);
+  EXPECT_NE(r.stderr_text.find("warning: XLSB read diagnostics"), std::string::npos);
+}
+
+TEST(FormulonCli, RecalcIterativePreservesExistingIterationSettings) {
+  std::string in = temp_path("iterative_in.xlsx");
+  std::string out_path = temp_path("iterative_out.xlsx");
+  PathGuard g_in(in);
+  PathGuard g_out(out_path);
+  ASSERT_TRUE(write_fixture_workbook(in, {}, /*iterative=*/true, /*max_iterations=*/500, /*max_change=*/0.01));
+
+  CliRun r = run_cli({"recalc", "--iterative", in, "-o", out_path, "--quiet"});
+  ASSERT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+
+  std::ifstream f(out_path, std::ios::binary);
+  ASSERT_TRUE(f);
+  f.seekg(0, std::ios::end);
+  const std::streamsize size = f.tellg();
+  ASSERT_GT(size, 0);
+  f.seekg(0, std::ios::beg);
+  std::vector<std::uint8_t> bytes(static_cast<std::size_t>(size));
+  ASSERT_TRUE(f.read(reinterpret_cast<char*>(bytes.data()), size));
+
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
+  int32_t enabled = 0;
+  uint32_t max_iterations = 0;
+  double max_change = 0.0;
+  ASSERT_EQ(fm_workbook_get_iterative(wb, &enabled, &max_iterations, &max_change), 0);
+  EXPECT_EQ(enabled, 1);
+  EXPECT_EQ(max_iterations, 500U);
+  EXPECT_DOUBLE_EQ(max_change, 0.01);
+  fm_workbook_destroy(wb);
+}
+
+TEST(FormulonCli, RecalcXlsbOutputExtensionWritesXlsbContainer) {
+  // `-o out.xlsb` must select the MS-XLSB writer, not silently emit an
+  // OOXML package under an `.xlsb` name.
+  std::string in = temp_path("in_for_xlsb.xlsx");
+  std::string out_path = temp_path("out.xlsb");
+  PathGuard g_in(in);
+  PathGuard g_out(out_path);
+  ASSERT_TRUE(write_fixture_workbook(in));
+
+  CliRun r = run_cli({"recalc", in, "-o", out_path, "--quiet"});
+  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
+
+  std::ifstream f(out_path, std::ios::binary);
+  ASSERT_TRUE(f);
+  f.seekg(0, std::ios::end);
+  const std::streamsize size = f.tellg();
+  ASSERT_GT(size, 0);
+  f.seekg(0, std::ios::beg);
+  std::vector<std::uint8_t> bytes(static_cast<std::size_t>(size));
+  f.read(reinterpret_cast<char*>(bytes.data()), size);
+  ASSERT_TRUE(f);
+
+  // The written package must declare `xl/workbook.bin` (xlsb), not
+  // `xl/workbook.xml` (ooxml).
+  formulon::io::ByteSpan span{bytes.data(), bytes.size()};
+  EXPECT_EQ(formulon::io::detect_workbook_format(span), formulon::WorkbookFormat::Xlsb);
+
+  fm_workbook_t* wb = nullptr;
+  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
+  ASSERT_EQ(fm_workbook_recalc(wb), 0);
+  fm_value_t v{};
+  ASSERT_EQ(fm_workbook_get_value(wb, 0, 0, 1, &v), 0);
+  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
+  EXPECT_DOUBLE_EQ(v.u.number, 8.0);
+  fm_workbook_destroy(wb);
+}
diff --git a/tests/cli/cli_test.cpp b/tests/cli/cli_test.cpp
deleted file mode 100644
index 0130e7c26..000000000
--- a/tests/cli/cli_test.cpp
+++ /dev/null
@@ -1,1688 +0,0 @@
-//
-// `formulon_cli` end-to-end tests. Each test spawns the binary at the
-// CMake-injected `FORMULON_CLI_PATH` and asserts on (exit_code, stdout,
-// stderr). The harness uses `popen` because it is the simplest
-// portable way to run a subprocess and capture output without pulling
-// in a third-party library; `popen` does not give us stderr capture
-// natively, so we redirect stderr to stdout via the shell. Tests that
-// need to distinguish the streams use the explicit `--quiet` flag or
-// inspect output ordering.
-
-#include "cli/cli.h"
-
-#include <dirent.h>
-#include <fcntl.h>
-#include <gtest/gtest.h>
-#include <sys/stat.h>
-#include <unistd.h>
-
-#include <algorithm>
-#include <cstdint>
-#include <cstdio>
-#include <cstdlib>
-#include <cstring>
-#include <fstream>
-#include <ios>
-#include <iterator>
-#include <string>
-#include <string_view>
-#include <vector>
-
-#include "c_api/formulon_c.h"
-#include "cli/file_io.h"
-#include "defined_name.h"
-#include "io/format_detect.h"
-#include "support/ooxml_package_fixture.h"
-#include "workbook.h"
-
-#ifndef FORMULON_CLI_PATH
-#error "FORMULON_CLI_PATH must be defined by the build system"
-#endif
-
-namespace {
-
-// Output of one CLI subprocess invocation. `stdout_text` is captured
-// verbatim; `stderr_text` is only populated when `redirect_stderr` was
-// requested. `exit_code` is the wait-status's low byte.
-struct CliRun {
-  int exit_code = -1;
-  std::string stdout_text;
-  std::string stderr_text;
-};
-
-// Quotes `s` in single quotes for `/bin/sh`, doubling any embedded
-// single quotes via `'\''`. Sufficient for the file paths and short
-// flag values the tests pass; not a full shell quoter.
-std::string sh_quote(const std::string& s) {
-  std::string out;
-  out.reserve(s.size() + 2);
-  out.push_back('\'');
-  for (char c : s) {
-    if (c == '\'') {
-      out.append("'\\''");
-    } else {
-      out.push_back(c);
-    }
-  }
-  out.push_back('\'');
-  return out;
-}
-
-// Prefix every temp fixture in this file is built from.
-//
-// The paths are derived from the pid rather than fixed, so two runs of
-// this binary -- a `ctest -j` fan-out, or a rerun started while an
-// earlier one is still finishing -- never share a fixture and never fail
-// on each other's leftovers. `TMPDIR` is honoured where the platform
-// sets one, falling back to `/tmp`.
-const std::string& temp_prefix() {
-  static const std::string prefix = [] {
-    const char* configured = std::getenv("TMPDIR");
-    std::string dir = (configured != nullptr && configured[0] != '\0') ? configured : "/tmp";
-    if (dir.back() != '/') {
-      dir.push_back('/');
-    }
-    return dir + "fm_cli_" + std::to_string(::getpid()) + "_";
-  }();
-  return prefix;
-}
-
-// Absolute path of a temp fixture named `name`, unique to this process.
-std::string temp_path(std::string_view name) {
-  return temp_prefix() + std::string(name);
-}
-
-// Entries of `dir` excluding `.` and `..`, sorted so a comparison against
-// an expected listing is stable. An unreadable directory yields an empty
-// listing, which reads the same as "nothing was left behind" -- callers
-// that care assert on the readable case.
-std::vector<std::string> list_directory(const std::string& dir) {
-  std::vector<std::string> entries;
-  DIR* handle = ::opendir(dir.c_str());
-  if (handle == nullptr) {
-    return entries;
-  }
-  while (const dirent* entry = ::readdir(handle)) {
-    const std::string name(entry->d_name);
-    if (name != "." && name != "..") {
-      entries.push_back(name);
-    }
-  }
-  ::closedir(handle);
-  std::sort(entries.begin(), entries.end());
-  return entries;
-}
-
-// Spawns the CLI with `args` (each argument is sh-quoted before being
-// joined into a single command line). When `merge_streams` is true,
-// stderr is folded into stdout via `2>&1`; otherwise stderr is
-// captured to a temp file via `2>` and read back. The temp-file path
-// avoids races with shell escaping.
-CliRun run_cli(const std::vector<std::string>& args, bool merge_streams = false, bool close_stdout = false) {
-  CliRun out;
-  std::string cmd = sh_quote(FORMULON_CLI_PATH);
-  for (const auto& a : args) {
-    cmd.push_back(' ');
-    cmd.append(sh_quote(a));
-  }
-  // Capture stderr separately to a temp file so we can assert on it
-  // without ambiguity. The shell's `>` redirect is portable on macOS
-  // and Linux. We append rather than truncate so the temp file is
-  // self-contained per call.
-  std::string tmpl = temp_path("stderr_XXXXXX");
-  const int fd = mkstemp(tmpl.data());
-  if (fd < 0) {
-    out.exit_code = -2;
-    return out;
-  }
-  ::close(fd);
-  if (close_stdout) {
-    cmd.append(" 1>&- 2>");
-    cmd.append(sh_quote(tmpl));
-  } else if (merge_streams) {
-    cmd.append(" 2>&1");
-  } else {
-    cmd.append(" 2>");
-    cmd.append(sh_quote(tmpl));
-  }
-
-  FILE* pipe = popen(cmd.c_str(), "r");
-  if (pipe == nullptr) {
-    out.exit_code = -3;
-    std::remove(tmpl.c_str());
-    return out;
-  }
-  char buf[4096];
-  while (std::fgets(buf, sizeof(buf), pipe) != nullptr) {
-    out.stdout_text.append(buf);
-  }
-  const int wait_rc = pclose(pipe);
-  // `pclose` returns the wait status; on POSIX, `WEXITSTATUS` is in
-  // the upper byte. We approximate it with `(wait_rc >> 8) & 0xff`,
-  // which matches `/bin/sh` semantics.
-  if (wait_rc < 0) {
-    out.exit_code = -4;
-  } else {
-    out.exit_code = (wait_rc >> 8) & 0xff;
-  }
-
-  if (!merge_streams) {
-    std::ifstream in(tmpl);
-    if (in) {
-      std::string line;
-      while (std::getline(in, line)) {
-        out.stderr_text.append(line);
-        out.stderr_text.push_back('\n');
-      }
-    }
-  }
-  std::remove(tmpl.c_str());
-  return out;
-}
-
-// Small RAII guard: removes the file at `path` on destruction. Used to
-// keep temp xlsx files from leaking when a test asserts mid-flow.
-struct PathGuard {
-  std::string path;
-  explicit PathGuard(std::string p) : path(std::move(p)) {}
-  PathGuard(const PathGuard&) = delete;
-  PathGuard& operator=(const PathGuard&) = delete;
-  ~PathGuard() {
-    if (!path.empty()) {
-      std::remove(path.c_str());
-    }
-  }
-};
-
-// Removes a directory and its contents on destruction, restoring write
-// permission first.
-//
-// Tests that make a directory unwritable have to put it back on every
-// exit path, not just the one where all the assertions passed: a failed
-// `ASSERT_*` returns from the middle of the test, and a mode-0500
-// directory with a file inside would then survive to the next run and
-// make it fail during setup instead of at the behaviour under test.
-struct DirGuard {
-  std::string path;
-  explicit DirGuard(std::string p) : path(std::move(p)) {}
-  DirGuard(const DirGuard&) = delete;
-  DirGuard& operator=(const DirGuard&) = delete;
-  ~DirGuard() {
-    ::chmod(path.c_str(), 0700);
-    for (const std::string& entry : list_directory(path)) {
-      const std::string full = path + "/" + entry;
-      if (std::remove(full.c_str()) != 0) {
-        ::rmdir(full.c_str());
-      }
-    }
-    ::rmdir(path.c_str());
-  }
-};
-
-// The load-diagnostic warning lines in `text`, with the
-// `formulon: <subcommand>: ` prefix stripped so reports emitted by
-// different subcommands compare equal. Save-side warnings are left out:
-// only the command that writes a workbook produces those.
-std::vector<std::string> read_diagnostic_lines(const std::string& text) {
-  std::vector<std::string> lines;
-  std::size_t start = 0;
-  while (start < text.size()) {
-    const std::size_t end = text.find('\n', start);
-    const std::string line = text.substr(start, end == std::string::npos ? std::string::npos : end - start);
-    const std::size_t marker = line.find("warning: ");
-    if (marker != std::string::npos && line.find("read diagnostics") != std::string::npos) {
-      lines.push_back(line.substr(marker));
-    }
-    if (end == std::string::npos) {
-      break;
-    }
-    start = end + 1;
-  }
-  return lines;
-}
-
-// Number of descriptors this process currently holds open. Only the
-// delta across a call matters, so scanning a fixed low range is enough:
-// the tests below open a handful of files and never approach the cap.
-int open_descriptor_count() {
-  int count = 0;
-  for (int fd = 0; fd < 256; ++fd) {
-    if (::fcntl(fd, F_GETFD) != -1) {
-      ++count;
-    }
-  }
-  return count;
-}
-
-// Builds a tiny `.xlsx` workbook in memory via the C ABI and writes
-// it to `path`. Used by `recalc` and `dump` tests that need a fixture
-// on disk. Returns `true` on success.
-bool write_fixture_workbook(const std::string& path, std::string_view extra_text = {}, bool iterative = false,
-                            int32_t max_iterations = 100, double max_change = 0.001) {
-  fm_workbook_t* wb = nullptr;
-  if (fm_workbook_create(&wb) != 0) {
-    return false;
-  }
-  // A1 = 7 (literal), B1 = =A1+1 (formula).
-  if (fm_workbook_set_number(wb, 0, 0, 0, 7.0) != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  if (fm_workbook_set_formula(wb, 0, 0, 1, "=A1+1") != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  if (iterative && fm_workbook_set_iterative(wb, 1, max_iterations, max_change) != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  if (fm_workbook_recalc(wb) != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  if (!extra_text.empty() && fm_workbook_set_text(wb, 0, 1, 0, std::string(extra_text).c_str()) != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  std::uint8_t* bytes = nullptr;
-  std::size_t len = 0;
-  if (fm_workbook_save(wb, &bytes, &len) != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  std::ofstream out(path, std::ios::binary | std::ios::trunc);
-  if (!out) {
-    fm_buffer_free(bytes);
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  out.write(reinterpret_cast<const char*>(bytes), static_cast<std::streamsize>(len));
-  out.close();
-  fm_buffer_free(bytes);
-  fm_workbook_destroy(wb);
-  return out.good();
-}
-
-// A wide, pure formula layer makes the CLI's parallel route observable
-// without relying on volatile functions or timing. The caller receives an
-// ordinary .xlsx that the command must load, recalculate, save, and whose
-// last lane we inspect after reopening.
-bool write_wide_recalc_fixture(const std::string& path) {
-  fm_workbook_t* wb = nullptr;
-  if (fm_workbook_create(&wb) != 0) {
-    return false;
-  }
-  constexpr std::uint32_t kRows = 48U;
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    const std::string formula = "=A" + std::to_string(row + 1U) + "*2+1";
-    if (fm_workbook_set_number(wb, 0U, row, 0U, static_cast<double>(row + 1U)) != 0 ||
-        fm_workbook_set_formula(wb, 0U, row, 1U, formula.c_str()) != 0) {
-      fm_workbook_destroy(wb);
-      return false;
-    }
-  }
-  std::uint8_t* bytes = nullptr;
-  std::size_t len = 0U;
-  if (fm_workbook_save(wb, &bytes, &len) != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  std::ofstream out(path, std::ios::binary | std::ios::trunc);
-  if (!out) {
-    fm_buffer_free(bytes);
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  out.write(reinterpret_cast<const char*>(bytes), static_cast<std::streamsize>(len));
-  out.close();
-  fm_buffer_free(bytes);
-  fm_workbook_destroy(wb);
-  return out.good();
-}
-
-bool write_out_of_range_defined_names_fixture(const std::string& path) {
-  formulon::Workbook wb = formulon::Workbook::create();
-  for (std::size_t i = 1; i < 7; ++i) {
-    wb.add_sheet("Sheet" + std::to_string(i + 1));
-  }
-
-  std::vector<formulon::DefinedName> names;
-  names.push_back(formulon::DefinedName{"Before", "=1", -1, false, ""});
-  names.push_back(formulon::DefinedName{"Bad", "=Sheet1!$A$1", 99, false, ""});
-  names.push_back(formulon::DefinedName{"After", "=2", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-
-  auto saved = wb.save();
-  if (!saved) {
-    return false;
-  }
-  std::ofstream out(path, std::ios::binary | std::ios::trunc);
-  if (!out) {
-    return false;
-  }
-  const std::vector<std::uint8_t>& bytes = saved.value();
-  out.write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
-  out.close();
-  return out.good();
-}
-
-bool write_lossy_xlsx_fixture(const std::string& path) {
-  fm_workbook_t* wb = nullptr;
-  if (fm_workbook_create(&wb) != 0) {
-    return false;
-  }
-  if (fm_workbook_set_formula(wb, 0, 0, 0, "=T[C]") != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  fm_hyperlink hyperlink{};
-  hyperlink.target = "https://example.com";
-  if (fm_sheet_add_hyperlink(wb, 0, hyperlink) != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  fm_merge_range range{0, 0, 0, 0};
-  fm_data_validation validation{};
-  validation.ranges = &range;
-  validation.range_count = 1;
-  validation.type = 3;
-  validation.formula1 = "$A$1:$A$2";
-  if (fm_sheet_add_validation(wb, 0, validation) != 0 ||
-      fm_sheet_set_auto_filter_xml(wb, 0, "<autoFilter ref=\"A1:B2\"/>") != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  std::uint8_t* bytes = nullptr;
-  std::size_t len = 0;
-  if (fm_workbook_save(wb, &bytes, &len) != 0) {
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  std::ofstream out(path, std::ios::binary | std::ios::trunc);
-  if (!out) {
-    fm_buffer_free(bytes);
-    fm_workbook_destroy(wb);
-    return false;
-  }
-  out.write(reinterpret_cast<const char*>(bytes), static_cast<std::streamsize>(len));
-  out.close();
-  fm_buffer_free(bytes);
-  fm_workbook_destroy(wb);
-  return out.good();
-}
-
-std::vector<std::uint8_t> append_empty_zip_entry(const std::vector<std::uint8_t>& bytes, std::string_view name) {
-  const std::uint8_t sig[] = {0x50, 0x4b, 0x05, 0x06};
-  const auto it = std::find_end(bytes.begin(), bytes.end(), std::begin(sig), std::end(sig));
-  if (it == bytes.end())
-    return {};
-  const std::size_t eocd = static_cast<std::size_t>(it - bytes.begin());
-  const auto read16 = [&](std::size_t p) { return static_cast<std::uint16_t>(bytes[p] | (bytes[p + 1] << 8U)); };
-  const auto read32 = [&](std::size_t p) {
-    return static_cast<std::uint32_t>(bytes[p] | (bytes[p + 1] << 8U) | (bytes[p + 2] << 16U) | (bytes[p + 3] << 24U));
-  };
-  const std::uint16_t count = read16(eocd + 10U);
-  const std::uint32_t central_size = read32(eocd + 12U);
-  const std::uint32_t central_offset = read32(eocd + 16U);
-  const auto put16 = [](std::vector<std::uint8_t>& out, std::uint16_t x) {
-    out.push_back(static_cast<std::uint8_t>(x));
-    out.push_back(static_cast<std::uint8_t>(x >> 8U));
-  };
-  const auto put32 = [](std::vector<std::uint8_t>& out, std::uint32_t x) {
-    out.push_back(static_cast<std::uint8_t>(x));
-    out.push_back(static_cast<std::uint8_t>(x >> 8U));
-    out.push_back(static_cast<std::uint8_t>(x >> 16U));
-    out.push_back(static_cast<std::uint8_t>(x >> 24U));
-  };
-  const std::string n(name);
-  std::vector<std::uint8_t> local;
-  put32(local, 0x04034b50U);
-  put16(local, 20);
-  put16(local, 0);
-  put16(local, 0);
-  put16(local, 0);
-  put16(local, 0);
-  put32(local, 0);
-  put32(local, 0);
-  put32(local, 0);
-  put16(local, static_cast<std::uint16_t>(n.size()));
-  put16(local, 0);
-  local.insert(local.end(), n.begin(), n.end());
-  std::vector<std::uint8_t> central;
-  put32(central, 0x02014b50U);
-  put16(central, 20);
-  put16(central, 20);
-  put16(central, 0);
-  put16(central, 0);
-  put16(central, 0);
-  put16(central, 0);
-  put32(central, 0);
-  put32(central, 0);
-  put32(central, 0);
-  put16(central, static_cast<std::uint16_t>(n.size()));
-  put16(central, 0);
-  put16(central, 0);
-  put16(central, 0);
-  put16(central, 0);
-  put32(central, 0);
-  put32(central, central_offset);
-  central.insert(central.end(), n.begin(), n.end());
-  std::vector<std::uint8_t> out(bytes.begin(), bytes.begin() + central_offset);
-  out.insert(out.end(), local.begin(), local.end());
-  out.insert(out.end(), bytes.begin() + central_offset, bytes.begin() + central_offset + central_size);
-  out.insert(out.end(), central.begin(), central.end());
-  put32(out, 0x06054b50U);
-  put16(out, 0);
-  put16(out, 0);
-  put16(out, count + 1U);
-  put16(out, count + 1U);
-  put32(out, central_size + static_cast<std::uint32_t>(central.size()));
-  put32(out, central_offset + static_cast<std::uint32_t>(local.size()));
-  put16(out, 0);
-  return out;
-}
-
-// An `.xlsx` whose sheet carries one unusable reference per overlay kind and
-// whose workbook part declares a content type the reader does not recognise.
-// The engine's writer never produces either, so the package is assembled by
-// hand.
-bool write_lossy_ooxml_fixture(const std::string& path) {
-  const std::string content_types = formulon::test::OoxmlContentTypes("application/vnd.formulon-test.unknown+xml");
-  const std::vector<std::uint8_t> bytes = formulon::test::BuildOoxmlPackage(
-      content_types,
-      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"><sheetData/>"
-      "<mergeCells><mergeCell ref=\"nope\"/></mergeCells>"
-      "<conditionalFormatting><cfRule type=\"expression\" priority=\"1\"/></conditionalFormatting>"
-      "</worksheet>");
-  if (bytes.empty()) {
-    return false;
-  }
-  std::ofstream out(path, std::ios::binary | std::ios::trunc);
-  out.write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
-  return out.good();
-}
-
-bool write_dropped_xlsb_fixture(const std::string& path) {
-  fm_workbook_t* wb = nullptr;
-  if (fm_workbook_create(&wb) != 0)
-    return false;
-  std::uint8_t* raw = nullptr;
-  std::size_t len = 0;
-  const bool saved = fm_workbook_save_as(wb, FM_WORKBOOK_FORMAT_XLSB, &raw, &len) == 0;
-  fm_workbook_destroy(wb);
-  if (!saved)
-    return false;
-  std::vector<std::uint8_t> fixture =
-      append_empty_zip_entry(std::vector<std::uint8_t>(raw, raw + len), "xl/dropped.unknown");
-  fm_buffer_free(raw);
-  if (fixture.empty())
-    return false;
-  std::ofstream out(path, std::ios::binary | std::ios::trunc);
-  out.write(reinterpret_cast<const char*>(fixture.data()), static_cast<std::streamsize>(fixture.size()));
-  return out.good();
-}
-
-}  // namespace
-
-// ---------------------------------------------------------------------------
-// Top-level usage / version
-// ---------------------------------------------------------------------------
-
-TEST(FormulonCli, VersionPrintsNonEmpty) {
-  CliRun r = run_cli({"--version"});
-  EXPECT_EQ(r.exit_code, 0);
-  EXPECT_GT(r.stdout_text.size(), 0U);
-}
-
-TEST(FormulonCli, HelpExitsZero) {
-  CliRun r = run_cli({"--help"});
-  EXPECT_EQ(r.exit_code, 0);
-  EXPECT_NE(r.stdout_text.find("Usage"), std::string::npos);
-}
-
-TEST(FormulonCli, VersionAndHelpFailWhenTheirOutputCannotBeWritten) {
-  // A release script doing `ver=$(formulon --version)` must not be handed
-  // an empty string with a success status, so the version and usage
-  // banners go through the same flush check `dump` and `eval` use for
-  // their results.
-  for (const char* flag : {"--version", "--help"}) {
-    CliRun r = run_cli({flag}, /*merge_streams=*/false, /*close_stdout=*/true);
-    EXPECT_EQ(r.exit_code, 1) << flag;
-    EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos) << flag << " stderr=" << r.stderr_text;
-  }
-}
-
-TEST(FormulonCli, SubcommandVersionAndHelpFailWhenTheirOutputCannotBeWritten) {
-  for (const char* subcommand : {"eval", "recalc", "dump", "paginate"}) {
-    for (const char* flag : {"--version", "--help"}) {
-      CliRun r = run_cli({subcommand, flag}, /*merge_streams=*/false, /*close_stdout=*/true);
-      EXPECT_EQ(r.exit_code, 1) << subcommand << ' ' << flag;
-      EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos)
-          << subcommand << ' ' << flag << " stderr=" << r.stderr_text;
-    }
-  }
-}
-
-TEST(FormulonCli, VersionIsAcceptedBySubcommandsLikeHelp) {
-  // The usage banner lists `--version` under the same "Common options"
-  // heading as `-h`, so every subcommand must accept it and print the
-  // same line the top-level flag prints.
-  CliRun top = run_cli({"--version"});
-  ASSERT_EQ(top.exit_code, 0);
-  ASSERT_FALSE(top.stdout_text.empty());
-
-  for (const char* subcommand : {"eval", "recalc", "dump", "paginate"}) {
-    CliRun r = run_cli({subcommand, "--version"});
-    EXPECT_EQ(r.exit_code, 0) << subcommand << " stderr=" << r.stderr_text;
-    EXPECT_EQ(r.stdout_text, top.stdout_text) << subcommand;
-  }
-}
-
-TEST(FormulonCli, RecalcHelpDocumentsActualSuccessStatus) {
-  CliRun r = run_cli({"recalc", "--help"});
-  EXPECT_EQ(r.exit_code, 0);
-  EXPECT_NE(r.stdout_text.find("formulon: recalc: ok, wrote M bytes to 'OUT'"), std::string::npos);
-  EXPECT_NE(r.stdout_text.find("--threads N"), std::string::npos);
-  EXPECT_NE(r.stdout_text.find("recalc remains serial"), std::string::npos);
-}
-
-TEST(FormulonCli, PaginatePrintsResolvedGeometry) {
-  const std::string path = temp_path("paginate.xlsx");
-  PathGuard guard(path);
-  ASSERT_TRUE(write_fixture_workbook(path));
-
-  CliRun r = run_cli({"paginate", path});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "sheet=0\npages=1\nprint_area=\nhorizontal_breaks=\nvertical_breaks=\n");
-}
-
-TEST(FormulonCli, PaginateWriteFailureReturnsOutputError) {
-  const std::string path = temp_path("paginate_write_failure.xlsx");
-  PathGuard guard(path);
-  ASSERT_TRUE(write_fixture_workbook(path));
-
-  CliRun r = run_cli({"paginate", path}, /*merge_streams=*/false, /*close_stdout=*/true);
-  EXPECT_EQ(r.exit_code, 1);
-  EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos);
-}
-
-TEST(FormulonCli, NoArgsExits64) {
-  CliRun r = run_cli({});
-  EXPECT_EQ(r.exit_code, 64);
-}
-
-TEST(FormulonCli, UnknownCommandExits64) {
-  CliRun r = run_cli({"frobnicate"});
-  EXPECT_EQ(r.exit_code, 64);
-}
-
-TEST(FormulonCli, ExitCodesNeverEncodeLargeInternalStatusValues) {
-  EXPECT_EQ(formulon::cli::exit_code_for_status(0), 0);
-  EXPECT_EQ(formulon::cli::exit_code_for_status(formulon::cli::kExitUsage), 64);
-  EXPECT_EQ(formulon::cli::exit_code_for_status(128), 1);
-  EXPECT_EQ(formulon::cli::exit_code_for_status(7000), 1);
-  EXPECT_EQ(formulon::cli::exit_code_for_status(8000), 1);
-}
-
-// ---------------------------------------------------------------------------
-// eval
-// ---------------------------------------------------------------------------
-
-TEST(FormulonCli, EvalSumLiterals) {
-  CliRun r = run_cli({"eval", "=SUM(1,2,3)"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "6\n");
-}
-
-TEST(FormulonCli, EvalIfTrue) {
-  CliRun r = run_cli({"eval", "=IF(TRUE,1,2)"});
-  EXPECT_EQ(r.exit_code, 0);
-  EXPECT_EQ(r.stdout_text, "1\n");
-}
-
-TEST(FormulonCli, EvalConcatTextNoQuoting) {
-  CliRun r = run_cli({"eval", "=CONCAT(\"hello\",\" \",\"world\")"});
-  EXPECT_EQ(r.exit_code, 0);
-  EXPECT_EQ(r.stdout_text, "hello world\n");
-}
-
-TEST(FormulonCli, EvalCellLevelErrorIsStillExitZero) {
-  // The ad-hoc evaluator reads A1 without first writing the expression to
-  // A1, so it sees the empty cell rather than making a self-reference cycle.
-  CliRun r = run_cli({"eval", "=A1+1"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "1\n");
-}
-
-TEST(FormulonCli, EvalMalformedSyntaxYieldsTheSameNameErrorEveryBindingReturns) {
-  // The ad-hoc evaluator resolves a parser recovery placeholder to a
-  // cell-level `#NAME?`. That is what the WASM, Node and Python bindings
-  // return over the same C ABI entry point, so the CLI returns it too:
-  // a formula prototyped here has to behave identically when it is moved
-  // into a script driving one of the other surfaces.
-  for (const char* formula : {"=1+", "=1+*2"}) {
-    CliRun r = run_cli({"eval", formula});
-    EXPECT_EQ(r.exit_code, 0) << formula << " stderr=" << r.stderr_text;
-    EXPECT_EQ(r.stdout_text, "#NAME?\n") << formula;
-  }
-}
-
-TEST(FormulonCli, EvalMalformedSyntaxMatchesTheAdHocCApiEntryPoint) {
-  // Same formula, same C ABI call the CLI makes, in-process: a future
-  // pre-parse gate on either side would break this comparison.
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_create_empty(&wb), 0);
-  ASSERT_EQ(fm_workbook_add_sheet(wb, "Sheet1"), 0);
-  std::uint32_t rows = 0;
-  std::uint32_t cols = 0;
-  ASSERT_EQ(fm_workbook_evaluate_formula_array(wb, 0, 0, 0, "=1+", &rows, &cols), 0);
-  EXPECT_EQ(rows, 1U);
-  EXPECT_EQ(cols, 1U);
-  fm_value_t value{};
-  ASSERT_EQ(fm_workbook_evaluate_formula_array_cell(wb, 0, &value), 0);
-  EXPECT_EQ(value.kind, FM_VAL_ERROR);
-  fm_workbook_destroy(wb);
-
-  CliRun r = run_cli({"eval", "=1+"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "#NAME?\n");
-}
-
-TEST(FormulonCli, EvalUnknownFunctionRemainsCellLevelNameError) {
-  CliRun r = run_cli({"eval", "=NOTAREALFUNC(1,2)"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "#NAME?\n");
-}
-
-TEST(FormulonCli, EvalDynamicArrayPrintsWholeGrid) {
-  CliRun r = run_cli({"eval", "=SEQUENCE(2,3)"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "1\t2\t3\n4\t5\t6\n");
-}
-
-TEST(FormulonCli, EvalPlainGridKeepsItsShapeWhenCellsCarryTabsAndNewlines) {
-  // Plain output is a TAB-separated grid, so a cell holding a TAB or a
-  // newline would add fields and rows that a `cut`/`awk`/TSV consumer
-  // reads as real ones. Exactly `rows` lines of `cols` fields must
-  // survive any payload.
-  CliRun r = run_cli({"eval", "=HSTACK(CHAR(9),CHAR(10),\"tail\")"});
-  ASSERT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "\\t\t\\n\ttail\n");
-
-  const auto field_count = [](const std::string& line) {
-    return 1 + static_cast<int>(std::count(line.begin(), line.end(), '\t'));
-  };
-  std::vector<std::string> lines;
-  for (std::size_t start = 0; start < r.stdout_text.size();) {
-    const std::size_t end = r.stdout_text.find('\n', start);
-    ASSERT_NE(end, std::string::npos) << "grid output must be newline-terminated";
-    lines.push_back(r.stdout_text.substr(start, end - start));
-    start = end + 1;
-  }
-  ASSERT_EQ(lines.size(), 1U);
-  EXPECT_EQ(field_count(lines[0]), 3);
-}
-
-TEST(FormulonCli, EvalPlainGridEscapesMultiRowPayloadsToo) {
-  // The two-row case pins the row count as well: an unescaped newline in
-  // the first row would make the result look like three rows.
-  CliRun r = run_cli({"eval", "=VSTACK(HSTACK(CHAR(10),1),HSTACK(2,3))"});
-  ASSERT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "\\n\t1\n2\t3\n");
-  EXPECT_EQ(std::count(r.stdout_text.begin(), r.stdout_text.end(), '\n'), 2);
-}
-
-TEST(FormulonCli, EvalDynamicArrayJsonPrintsNestedArrays) {
-  CliRun r = run_cli({"eval", "--json", "=SEQUENCE(2,2)"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text,
-            "[[{\"kind\":\"number\",\"value\":1},{\"kind\":\"number\",\"value\":2}],"
-            "[{\"kind\":\"number\",\"value\":3},{\"kind\":\"number\",\"value\":4}]]\n");
-}
-
-TEST(FormulonCli, EvalDivByZeroSurfacesAsExcelErrorString) {
-  CliRun r = run_cli({"eval", "=1/0"});
-  EXPECT_EQ(r.exit_code, 0);
-  EXPECT_EQ(r.stdout_text, "#DIV/0!\n");
-}
-
-TEST(FormulonCli, EvalJsonOutputShape) {
-  CliRun r = run_cli({"eval", "--json", "=SUM(1,2,3)"});
-  EXPECT_EQ(r.exit_code, 0);
-  // Compact form: `{"kind":"number","value":6}`.
-  EXPECT_NE(r.stdout_text.find("\"kind\":\"number\""), std::string::npos) << "stdout=" << r.stdout_text;
-  EXPECT_NE(r.stdout_text.find("\"value\":6"), std::string::npos) << "stdout=" << r.stdout_text;
-}
-
-TEST(FormulonCli, EvalMissingFormulaExits64) {
-  CliRun r = run_cli({"eval"});
-  EXPECT_EQ(r.exit_code, 64);
-}
-
-TEST(FormulonCli, EvalUnknownFlagExits64) {
-  CliRun r = run_cli({"eval", "--bogus"});
-  EXPECT_EQ(r.exit_code, 64);
-}
-
-TEST(FormulonCli, EvalNegativeFormulaWithoutTerminatorExits64) {
-  CliRun r = run_cli({"eval", "-1+2"});
-  EXPECT_EQ(r.exit_code, 64);
-  EXPECT_TRUE(r.stdout_text.empty());
-}
-
-TEST(FormulonCli, EvalOptionTerminatorAcceptsNegativeFormula) {
-  CliRun r = run_cli({"eval", "--", "-1+2"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "1\n");
-}
-
-TEST(FormulonCli, EvalRepeatRunsMultipleTimes) {
-  CliRun r = run_cli({"eval", "--repeat", "3", "=SUM(1,2,3)"});
-  EXPECT_EQ(r.exit_code, 0);
-  EXPECT_EQ(r.stdout_text, "6\n");
-  // The timing line goes to stderr.
-  EXPECT_NE(r.stderr_text.find("3 iterations"), std::string::npos);
-}
-
-TEST(FormulonCli, EvalRepeatReportsTimingForEveryAcceptedCount) {
-  // `--repeat` is an explicit request to measure. Every count the flag
-  // accepts gets the report, including the smallest one -- a user timing
-  // a single evaluation must not be answered with silence and status 0.
-  for (const char* count : {"1", "2", "5"}) {
-    CliRun r = run_cli({"eval", "--repeat", count, "=1"});
-    EXPECT_EQ(r.exit_code, 0) << count << " stderr=" << r.stderr_text;
-    EXPECT_EQ(r.stdout_text, "1\n") << count;
-    EXPECT_NE(r.stderr_text.find(std::string(count) + " iterations in"), std::string::npos)
-        << count << " stderr=" << r.stderr_text;
-  }
-}
-
-TEST(FormulonCli, EvalWithoutRepeatFlagReportsNoTiming) {
-  // Only the default single evaluation is silent, and it stays silent
-  // even though it runs the same one pass `--repeat 1` runs.
-  CliRun r = run_cli({"eval", "=1"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "1\n");
-  EXPECT_EQ(r.stderr_text.find("iterations"), std::string::npos) << "stderr=" << r.stderr_text;
-}
-
-TEST(FormulonCli, EvalWriteFailureReturnsOutputError) {
-  CliRun r = run_cli({"eval", "=SUM(1,2,3)"}, /*merge_streams=*/false, /*close_stdout=*/true);
-  EXPECT_EQ(r.exit_code, 1);
-  EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos);
-}
-
-TEST(FormulonCli, EvalRepeatWriteFailureSkipsTimingOutput) {
-  CliRun r = run_cli({"eval", "--repeat", "3", "=SUM(1,2,3)"}, /*merge_streams=*/false,
-                     /*close_stdout=*/true);
-  EXPECT_EQ(r.exit_code, 1);
-  EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos);
-  EXPECT_EQ(r.stderr_text.find("iterations"), std::string::npos);
-}
-
-TEST(FormulonCli, EvalRepeatOverflowExits64) {
-  CliRun r = run_cli({"eval", "--repeat", "999999999999999999999999999999", "=1"});
-  EXPECT_EQ(r.exit_code, 64);
-  EXPECT_NE(r.stderr_text.find("positive integer"), std::string::npos);
-}
-
-// Each --repeat pass executes the ad-hoc evaluator, so a high repeat count
-// still yields the result without mutating the temporary workbook.
-TEST(FormulonCli, EvalRepeatHighCountStillCorrect) {
-  CliRun r = run_cli({"eval", "--repeat", "100", "=SUM(1,2,3)"});
-  EXPECT_EQ(r.exit_code, 0);
-  EXPECT_EQ(r.stdout_text, "6\n");
-  EXPECT_NE(r.stderr_text.find("100 iterations"), std::string::npos);
-}
-
-// ---------------------------------------------------------------------------
-// recalc
-// ---------------------------------------------------------------------------
-
-TEST(FormulonCli, RecalcRoundTripsFormulae) {
-  // Build a fixture in /tmp.
-  std::string in = temp_path("in.xlsx");
-  std::string out_path = temp_path("out.xlsx");
-  PathGuard g_in(in);
-  PathGuard g_out(out_path);
-  ASSERT_TRUE(write_fixture_workbook(in));
-
-  CliRun r = run_cli({"recalc", in, "-o", out_path, "--quiet"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-
-  // Load the output back through the C ABI and assert B1 still
-  // recalculates correctly.
-  std::ifstream f(out_path, std::ios::binary);
-  ASSERT_TRUE(f);
-  f.seekg(0, std::ios::end);
-  const std::streamsize size = f.tellg();
-  ASSERT_GT(size, 0);
-  f.seekg(0, std::ios::beg);
-  std::vector<std::uint8_t> bytes(static_cast<std::size_t>(size));
-  f.read(reinterpret_cast<char*>(bytes.data()), size);
-  ASSERT_TRUE(f);
-
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb), 0);
-
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb, 0, 0, 1, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(v.u.number, 8.0);
-  fm_workbook_destroy(wb);
-}
-
-TEST(FormulonCli, RecalcWithoutThreadsKeepsSerialStatusShape) {
-  const std::string input = temp_path("default_recalc_input.xlsx");
-  const std::string output = temp_path("default_recalc_output.xlsx");
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun result = run_cli({"recalc", input, "-o", output});
-  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
-  EXPECT_EQ(result.stderr_text.find("threads="), std::string::npos);
-  EXPECT_NE(result.stderr_text.find("formulon: recalc: ok, wrote "), std::string::npos);
-  EXPECT_NE(result.stderr_text.find(" bytes to '" + output + "'"), std::string::npos);
-}
-
-TEST(FormulonCli, RecalcThreadsUsesParallelSchedulerAndSavesWideDag) {
-  const std::string input = temp_path("parallel_recalc_input.xlsx");
-  const std::string output = temp_path("parallel_recalc_output.xlsx");
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  ASSERT_TRUE(write_wide_recalc_fixture(input));
-
-  const CliRun result = run_cli({"recalc", "--threads", "4", input, "-o", output});
-  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
-  EXPECT_TRUE(result.stdout_text.empty());
-  EXPECT_NE(result.stderr_text.find("threads=4"), std::string::npos);
-  EXPECT_NE(result.stderr_text.find("cells_evaluated=48"), std::string::npos);
-  EXPECT_NE(result.stderr_text.find("sccs_processed="), std::string::npos);
-  EXPECT_NE(result.stderr_text.find("parallel_steps="), std::string::npos);
-  EXPECT_NE(result.stderr_text.find("worker_threads_started="), std::string::npos);
-  EXPECT_NE(result.stderr_text.find("worker_threads_used="), std::string::npos);
-
-  std::ifstream in(output, std::ios::binary);
-  ASSERT_TRUE(in);
-  const std::vector<std::uint8_t> bytes((std::istreambuf_iterator<char>(in)), std::istreambuf_iterator<char>());
-  ASSERT_FALSE(bytes.empty());
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
-  fm_value_t value{};
-  ASSERT_EQ(fm_workbook_get_value(wb, 0U, 47U, 1U, &value), 0);
-  EXPECT_EQ(value.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(value.u.number, 97.0);
-  fm_workbook_destroy(wb);
-}
-
-TEST(FormulonCli, RecalcThreadsOneStartsNoWorkers) {
-  const std::string input = temp_path("serial_threads_input.xlsx");
-  const std::string output = temp_path("serial_threads_output.xlsx");
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun result = run_cli({"recalc", "--threads", "1", input, "-o", output});
-  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
-  EXPECT_NE(result.stderr_text.find("threads=1"), std::string::npos);
-  EXPECT_NE(result.stderr_text.find("worker_threads_started=0"), std::string::npos);
-  EXPECT_NE(result.stderr_text.find("worker_threads_used=0"), std::string::npos);
-}
-
-TEST(FormulonCli, RecalcThreadsRejectsInvalidValuesBeforeWriting) {
-  const std::string input = temp_path("invalid_threads_input.xlsx");
-  const std::string output = temp_path("invalid_threads_output.xlsx");
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  ASSERT_TRUE(write_fixture_workbook(input));
-  std::remove(output.c_str());
-
-  for (const char* value : {"9", "-1", "abc", "4294967296", "--"}) {
-    const CliRun result = run_cli({"recalc", "--threads", value, input, "-o", output});
-    EXPECT_EQ(result.exit_code, 64) << value << " stderr=" << result.stderr_text;
-    EXPECT_NE(result.stderr_text.find("--threads"), std::string::npos);
-    std::ifstream absent(output, std::ios::binary);
-    EXPECT_FALSE(absent.good()) << "invalid value wrote output: " << value;
-  }
-}
-
-TEST(FormulonCli, RecalcLossWarningsAreNonfatalAndNotSuppressedByQuiet) {
-  const std::string input = temp_path("lossy_input.xlsx");
-  const std::string output = temp_path("lossy_output.xlsb");
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  ASSERT_TRUE(write_lossy_xlsx_fixture(input));
-
-  CliRun r = run_cli({"recalc", "--quiet", input, "-o", output});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_TRUE(r.stdout_text.empty());
-  EXPECT_NE(r.stderr_text.find("warning: XLSB write diagnostics"), std::string::npos);
-  EXPECT_NE(r.stderr_text.find("downgraded_formula_count=1"), std::string::npos);
-  // Only the autoFilter is deferred; the data validation is written to .xlsb.
-  EXPECT_NE(r.stderr_text.find("deferred_feature_count=1"), std::string::npos);
-}
-
-TEST(FormulonCli, RecalcReportsOoxmlReadDiagnosticsSeparatelyFromXlsbOnes) {
-  const std::string input = temp_path("lossy_ooxml_input.xlsx");
-  const std::string output = temp_path("lossy_ooxml_output.xlsx");
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  ASSERT_TRUE(write_lossy_ooxml_fixture(input));
-
-  CliRun r = run_cli({"recalc", "--quiet", input, "-o", output});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_NE(r.stderr_text.find("warning: OOXML read diagnostics"), std::string::npos) << r.stderr_text;
-  // One unparseable merge ref plus one conditional-formatting block with no
-  // `sqref`; the unrecognised workbook content type is reported separately.
-  EXPECT_NE(r.stderr_text.find("skipped_feature_count=2"), std::string::npos) << r.stderr_text;
-  EXPECT_NE(r.stderr_text.find("unknown_content_type_count=1"), std::string::npos) << r.stderr_text;
-  // The XLSB line must not appear: an `.xlsx` load produces none of its
-  // counters, and a zero counter is never printed.
-  EXPECT_EQ(r.stderr_text.find("XLSB read diagnostics"), std::string::npos) << r.stderr_text;
-}
-
-TEST(FormulonCli, RecalcDroppedPartWarningIsNonfatalAndQuietStillReportsIt) {
-  const std::string input = temp_path("dropped_input.xlsb");
-  const std::string output = temp_path("dropped_output.xlsx");
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  ASSERT_TRUE(write_dropped_xlsb_fixture(input));
-
-  CliRun r = run_cli({"recalc", "--quiet", input, "-o", output});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_NE(r.stderr_text.find("undecoded_part_count=1"), std::string::npos);
-  EXPECT_NE(r.stderr_text.find("warning: XLSB read diagnostics"), std::string::npos);
-}
-
-TEST(FormulonCli, DumpAndPaginateReportLoadLossesTheWayRecalcDoes) {
-  // Whoever reads a `dump` snapshot or a `paginate` geometry treats it as
-  // a faithful account of the input file, so both have to say what the
-  // load could not carry across -- in the same words `recalc` uses, since
-  // the counters come from one emitter.
-  const std::string ooxml = temp_path("shared_read_diag_ooxml.xlsx");
-  const std::string xlsb = temp_path("shared_read_diag.xlsb");
-  const std::string recalc_output = temp_path("shared_read_diag_out.xlsx");
-  PathGuard g_ooxml(ooxml);
-  PathGuard g_xlsb(xlsb);
-  PathGuard g_output(recalc_output);
-  ASSERT_TRUE(write_lossy_ooxml_fixture(ooxml));
-  ASSERT_TRUE(write_dropped_xlsb_fixture(xlsb));
-
-  for (const std::string& fixture : {ooxml, xlsb}) {
-    const CliRun recalc = run_cli({"recalc", "--quiet", fixture, "-o", recalc_output});
-    ASSERT_EQ(recalc.exit_code, 0) << fixture << " stderr=" << recalc.stderr_text;
-    const std::vector<std::string> expected = read_diagnostic_lines(recalc.stderr_text);
-    ASSERT_FALSE(expected.empty()) << "fixture loads losslessly: " << fixture;
-
-    const CliRun dump = run_cli({"dump", "--sheets", fixture});
-    EXPECT_EQ(dump.exit_code, 0) << fixture << " stderr=" << dump.stderr_text;
-    EXPECT_EQ(read_diagnostic_lines(dump.stderr_text), expected) << fixture;
-    EXPECT_NE(dump.stderr_text.find("formulon: dump: warning:"), std::string::npos) << dump.stderr_text;
-
-    const CliRun paginate = run_cli({"paginate", fixture});
-    EXPECT_EQ(paginate.exit_code, 0) << fixture << " stderr=" << paginate.stderr_text;
-    EXPECT_EQ(read_diagnostic_lines(paginate.stderr_text), expected) << fixture;
-    EXPECT_NE(paginate.stderr_text.find("formulon: paginate: warning:"), std::string::npos) << paginate.stderr_text;
-  }
-}
-
-TEST(FormulonCli, DumpReportsUndecodedCountsBeforeItsSnapshot) {
-  // The warning has to precede the snapshot on the wire, not trail it:
-  // a user piping stdout into `diff` still needs to see the caveat while
-  // the comparison is being set up.
-  const std::string fixture = temp_path("dump_read_diag.xlsb");
-  PathGuard guard(fixture);
-  ASSERT_TRUE(write_dropped_xlsb_fixture(fixture));
-
-  const CliRun merged = run_cli({"dump", "--sheets", fixture}, /*merge_streams=*/true);
-  ASSERT_EQ(merged.exit_code, 0) << merged.stdout_text;
-  const std::size_t warning = merged.stdout_text.find("undecoded_part_count=1");
-  const std::size_t snapshot = merged.stdout_text.find("Sheet1");
-  ASSERT_NE(warning, std::string::npos) << merged.stdout_text;
-  ASSERT_NE(snapshot, std::string::npos) << merged.stdout_text;
-  EXPECT_LT(warning, snapshot);
-}
-
-TEST(FormulonCli, RecalcInPlaceOverwritesSamePathAndLeavesNoTemp) {
-  // Input and output are the same path: the atomic write must serialize the
-  // recalculated workbook fully before replacing the original, and must not
-  // leave its sibling temp file behind on success.
-  std::string path = temp_path("inplace.xlsx");
-  std::string tmp_sidecar = path + ".formulon-tmp";
-  PathGuard g_path(path);
-  PathGuard g_tmp(tmp_sidecar);
-  ASSERT_TRUE(write_fixture_workbook(path));
-
-  CliRun r = run_cli({"recalc", path, "-o", path, "--quiet"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-
-  // The temp sidecar must be gone (renamed into place).
-  {
-    std::ifstream leftover(tmp_sidecar, std::ios::binary);
-    EXPECT_FALSE(leftover.good()) << "temp sidecar left behind after in-place recalc";
-  }
-
-  // The overwritten file still loads and recalculates correctly.
-  std::ifstream f(path, std::ios::binary);
-  ASSERT_TRUE(f);
-  f.seekg(0, std::ios::end);
-  const std::streamsize size = f.tellg();
-  ASSERT_GT(size, 0);
-  f.seekg(0, std::ios::beg);
-  std::vector<std::uint8_t> bytes(static_cast<std::size_t>(size));
-  f.read(reinterpret_cast<char*>(bytes.data()), size);
-  ASSERT_TRUE(f);
-
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb), 0);
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb, 0, 0, 1, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(v.u.number, 8.0);
-  fm_workbook_destroy(wb);
-}
-
-TEST(FormulonCli, RecalcDoesNotReusePredictableLegacyTempPath) {
-  const std::string input = temp_path("safe_temp_in.xlsx");
-  const std::string output = temp_path("safe_temp_out.xlsx");
-  const std::string legacy_temp = output + ".formulon-tmp";
-  PathGuard g_input(input);
-  PathGuard g_output(output);
-  PathGuard g_legacy_temp(legacy_temp);
-  ASSERT_TRUE(write_fixture_workbook(input));
-  {
-    std::ofstream sentinel(legacy_temp, std::ios::binary);
-    ASSERT_TRUE(sentinel);
-    sentinel << "unrelated file";
-  }
-
-  CliRun r = run_cli({"recalc", input, "-o", output, "--quiet"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  std::ifstream sentinel(legacy_temp, std::ios::binary);
-  ASSERT_TRUE(sentinel);
-  std::string contents;
-  std::getline(sentinel, contents);
-  EXPECT_EQ(contents, "unrelated file");
-}
-
-TEST(FormulonCli, RecalcThroughSymlinkUpdatesTargetAndKeepsLink) {
-  // Saving through a symlink must update the file the link names. A
-  // rename onto the link path would replace the link with a regular
-  // file and leave the real workbook holding stale values -- the same
-  // silent-loss shape the atomic write exists to prevent.
-  const std::string input = temp_path("symlink_in.xlsx");
-  const std::string target = temp_path("symlink_target.xlsx");
-  const std::string link = temp_path("symlink_link.xlsx");
-  PathGuard g_input(input);
-  PathGuard g_target(target);
-  PathGuard g_link(link);
-  ASSERT_TRUE(write_fixture_workbook(input));
-  ASSERT_TRUE(write_fixture_workbook(target));
-  std::remove(link.c_str());
-  ASSERT_EQ(::symlink(target.c_str(), link.c_str()), 0);
-
-  CliRun r = run_cli({"recalc", input, "-o", link, "--quiet"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-
-  // The link survives as a link...
-  struct stat link_stat {};
-  ASSERT_EQ(::lstat(link.c_str(), &link_stat), 0);
-  EXPECT_TRUE(S_ISLNK(link_stat.st_mode)) << "symlink was replaced by a regular file";
-
-  // ...and the file it names is the one that got rewritten.
-  std::ifstream written(target, std::ios::binary);
-  ASSERT_TRUE(written);
-  written.seekg(0, std::ios::end);
-  EXPECT_GT(written.tellg(), 0);
-
-  // No temp sidecar is left next to either path.
-  for (const std::string& sidecar : {target + ".formulon-tmp", link + ".formulon-tmp"}) {
-    std::ifstream leftover(sidecar, std::ios::binary);
-    EXPECT_FALSE(leftover.good()) << "temp sidecar left behind: " << sidecar;
-  }
-}
-
-TEST(FormulonCli, RecalcDanglingSymlinkIsReplacedInPlace) {
-  // A link with no target has nothing to preserve, so the write lands
-  // on the link path itself rather than failing.
-  const std::string input = temp_path("dangling_in.xlsx");
-  const std::string link = temp_path("dangling_link.xlsx");
-  PathGuard g_input(input);
-  PathGuard g_link(link);
-  ASSERT_TRUE(write_fixture_workbook(input));
-  std::remove(link.c_str());
-  ASSERT_EQ(::symlink(temp_path("dangling_absent.xlsx").c_str(), link.c_str()), 0);
-
-  CliRun r = run_cli({"recalc", input, "-o", link, "--quiet"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  std::ifstream written(link, std::ios::binary);
-  ASSERT_TRUE(written);
-  written.seekg(0, std::ios::end);
-  EXPECT_GT(written.tellg(), 0);
-}
-
-TEST(FormulonCli, RecalcLeavesOutputIntactWhenTheWriteCannotStart) {
-  // Stand-in for a disk-full failure: an unwritable directory makes the
-  // temp file impossible to create. The pre-existing output must be left
-  // exactly as it was, with no partial content and no sidecar.
-  const std::string dir = temp_path("readonly_dir");
-  const std::string input = temp_path("readonly_in.xlsx");
-  const std::string output = dir + "/out.xlsx";
-  PathGuard g_input(input);
-  ASSERT_TRUE(write_fixture_workbook(input));
-  ASSERT_EQ(::mkdir(dir.c_str(), 0700), 0) << dir << ": " << std::strerror(errno);
-  DirGuard g_dir(dir);
-  ASSERT_TRUE(write_fixture_workbook(output));
-
-  std::vector<std::uint8_t> before;
-  {
-    std::ifstream original(output, std::ios::binary);
-    ASSERT_TRUE(original);
-    before.assign(std::istreambuf_iterator<char>(original), std::istreambuf_iterator<char>());
-  }
-  ASSERT_FALSE(before.empty());
-  ASSERT_EQ(::chmod(dir.c_str(), 0500), 0);
-
-  CliRun r = run_cli({"recalc", input, "-o", output, "--quiet"});
-  EXPECT_NE(r.exit_code, 0) << "write into an unwritable directory should fail";
-
-  // Restore write permission so the fixture can be inspected; `g_dir`
-  // removes it either way.
-  ASSERT_EQ(::chmod(dir.c_str(), 0700), 0);
-  std::vector<std::uint8_t> after;
-  {
-    std::ifstream survivor(output, std::ios::binary);
-    ASSERT_TRUE(survivor) << "existing output was destroyed by a failed write";
-    after.assign(std::istreambuf_iterator<char>(survivor), std::istreambuf_iterator<char>());
-  }
-  EXPECT_EQ(before, after) << "existing output was modified by a failed write";
-
-  // "Unchanged" covers the whole directory, not just the output's bytes:
-  // a sidecar the failed write forgot to clean up would still be sitting
-  // next to it.
-  EXPECT_EQ(list_directory(dir), std::vector<std::string>{"out.xlsx"});
-}
-
-TEST(FormulonCli, RecalcPreservesExistingOutputPermissions) {
-  std::string in = temp_path("mode_in.xlsx");
-  std::string out_path = temp_path("mode_out.xlsx");
-  PathGuard g_in(in);
-  PathGuard g_out(out_path);
-  ASSERT_TRUE(write_fixture_workbook(in));
-  ASSERT_TRUE(write_fixture_workbook(out_path));
-  ASSERT_EQ(::chmod(out_path.c_str(), 0600), 0);
-
-  CliRun r = run_cli({"recalc", in, "-o", out_path, "--quiet"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-
-  struct stat saved_stat {};
-  ASSERT_EQ(::stat(out_path.c_str(), &saved_stat), 0);
-  EXPECT_EQ(saved_stat.st_mode & 0777U, 0600U);
-}
-
-TEST(FormulonCli, RecalcCreatesNewOutputWithUmaskDefaultPermissions) {
-  // A fresh output path must come out with the mode an ordinary file
-  // creation would produce, not the private mode the atomic-write
-  // temporary is created with. The reference file below is created the
-  // ordinary way, so the expectation follows whatever umask is in effect.
-  std::string in = temp_path("newmode_in.xlsx");
-  std::string out_path = temp_path("newmode_out.xlsx");
-  std::string reference = temp_path("newmode_reference");
-  PathGuard g_in(in);
-  PathGuard g_out(out_path);
-  PathGuard g_reference(reference);
-  ASSERT_TRUE(write_fixture_workbook(in));
-  std::remove(out_path.c_str());
-  std::remove(reference.c_str());
-
-  const int reference_fd = ::open(reference.c_str(), O_CREAT | O_WRONLY | O_EXCL, 0666);
-  ASSERT_GE(reference_fd, 0);
-  ASSERT_EQ(::close(reference_fd), 0);
-  struct stat reference_stat {};
-  ASSERT_EQ(::stat(reference.c_str(), &reference_stat), 0);
-
-  CliRun r = run_cli({"recalc", in, "-o", out_path, "--quiet"});
-  ASSERT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-
-  struct stat created_stat {};
-  ASSERT_EQ(::stat(out_path.c_str(), &created_stat), 0);
-  EXPECT_EQ(created_stat.st_mode & 0777U, reference_stat.st_mode & 0777U);
-
-  // Re-running against the now-existing path keeps that same mode, so the
-  // permissions do not depend on whether the output already existed.
-  CliRun again = run_cli({"recalc", in, "-o", out_path, "--quiet"});
-  ASSERT_EQ(again.exit_code, 0) << "stderr=" << again.stderr_text;
-  struct stat rerun_stat {};
-  ASSERT_EQ(::stat(out_path.c_str(), &rerun_stat), 0);
-  EXPECT_EQ(rerun_stat.st_mode & 0777U, created_stat.st_mode & 0777U);
-}
-
-TEST(FormulonCli, RecalcIterativePreservesExistingIterationSettings) {
-  std::string in = temp_path("iterative_in.xlsx");
-  std::string out_path = temp_path("iterative_out.xlsx");
-  PathGuard g_in(in);
-  PathGuard g_out(out_path);
-  ASSERT_TRUE(write_fixture_workbook(in, {}, /*iterative=*/true, /*max_iterations=*/500, /*max_change=*/0.01));
-
-  CliRun r = run_cli({"recalc", "--iterative", in, "-o", out_path, "--quiet"});
-  ASSERT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-
-  std::ifstream f(out_path, std::ios::binary);
-  ASSERT_TRUE(f);
-  f.seekg(0, std::ios::end);
-  const std::streamsize size = f.tellg();
-  ASSERT_GT(size, 0);
-  f.seekg(0, std::ios::beg);
-  std::vector<std::uint8_t> bytes(static_cast<std::size_t>(size));
-  ASSERT_TRUE(f.read(reinterpret_cast<char*>(bytes.data()), size));
-
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
-  int32_t enabled = 0;
-  uint32_t max_iterations = 0;
-  double max_change = 0.0;
-  ASSERT_EQ(fm_workbook_get_iterative(wb, &enabled, &max_iterations, &max_change), 0);
-  EXPECT_EQ(enabled, 1);
-  EXPECT_EQ(max_iterations, 500U);
-  EXPECT_DOUBLE_EQ(max_change, 0.01);
-  fm_workbook_destroy(wb);
-}
-
-TEST(FormulonCli, RecalcXlsbOutputExtensionWritesXlsbContainer) {
-  // `-o out.xlsb` must select the MS-XLSB writer, not silently emit an
-  // OOXML package under an `.xlsb` name.
-  std::string in = temp_path("in_for_xlsb.xlsx");
-  std::string out_path = temp_path("out.xlsb");
-  PathGuard g_in(in);
-  PathGuard g_out(out_path);
-  ASSERT_TRUE(write_fixture_workbook(in));
-
-  CliRun r = run_cli({"recalc", in, "-o", out_path, "--quiet"});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-
-  std::ifstream f(out_path, std::ios::binary);
-  ASSERT_TRUE(f);
-  f.seekg(0, std::ios::end);
-  const std::streamsize size = f.tellg();
-  ASSERT_GT(size, 0);
-  f.seekg(0, std::ios::beg);
-  std::vector<std::uint8_t> bytes(static_cast<std::size_t>(size));
-  f.read(reinterpret_cast<char*>(bytes.data()), size);
-  ASSERT_TRUE(f);
-
-  // The written package must declare `xl/workbook.bin` (xlsb), not
-  // `xl/workbook.xml` (ooxml).
-  formulon::io::ByteSpan span{bytes.data(), bytes.size()};
-  EXPECT_EQ(formulon::io::detect_workbook_format(span), formulon::WorkbookFormat::Xlsb);
-
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb), 0);
-  fm_value_t v{};
-  ASSERT_EQ(fm_workbook_get_value(wb, 0, 0, 1, &v), 0);
-  EXPECT_EQ(v.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(v.u.number, 8.0);
-  fm_workbook_destroy(wb);
-}
-
-TEST(FormulonCli, RecalcMissingOutputExits64) {
-  std::string in = temp_path("in_missing_o.xlsx");
-  PathGuard g_in(in);
-  ASSERT_TRUE(write_fixture_workbook(in));
-  CliRun r = run_cli({"recalc", in});
-  EXPECT_EQ(r.exit_code, 64);
-}
-
-TEST(FormulonCli, RecalcEmptyOutputPathIsDiagnosedApartFromAMissingOne) {
-  // `-o "$OUT"` with an unset variable supplies the flag and an empty
-  // value. Reporting that as a missing flag sends the user looking at the
-  // wrong line of their script, so the two states get their own wording.
-  std::string in = temp_path("empty_output_flag.xlsx");
-  PathGuard g_in(in);
-  ASSERT_TRUE(write_fixture_workbook(in));
-
-  CliRun empty = run_cli({"recalc", in, "-o", ""});
-  EXPECT_EQ(empty.exit_code, 64);
-  EXPECT_NE(empty.stderr_text.find("non-empty path"), std::string::npos) << empty.stderr_text;
-
-  CliRun missing = run_cli({"recalc", in});
-  EXPECT_EQ(missing.exit_code, 64);
-  EXPECT_NE(missing.stderr_text.find("missing -o/--output"), std::string::npos) << missing.stderr_text;
-
-  EXPECT_NE(empty.stderr_text, missing.stderr_text);
-}
-
-TEST(FormulonCli, RecalcMissingInputExits64) {
-  CliRun r = run_cli({"recalc", "-o", temp_path("unused.xlsx")});
-  EXPECT_EQ(r.exit_code, 64);
-}
-
-TEST(FormulonCli, RecalcNonexistentFileFailsCleanly) {
-  CliRun r = run_cli({"recalc", temp_path("absent_input.xlsx"), "-o", temp_path("unused.xlsx")});
-  EXPECT_EQ(r.exit_code, 1);
-  EXPECT_EQ(r.stderr_text.find("warning:"), std::string::npos);
-}
-
-TEST(FormulonCli, RecalcOptionTerminatorAcceptsDashLeadingRelativePaths) {
-  const std::string input = "-fm_cli_recalc_dash_input.xlsx";
-  const std::string output = "-fm_cli_recalc_dash_output.xlsx";
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  std::remove(output.c_str());
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun result = run_cli({"recalc", "--threads", "1", "-o", output, "--", input});
-  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
-
-  std::ifstream saved(output, std::ios::binary);
-  ASSERT_TRUE(saved);
-  const std::vector<std::uint8_t> bytes((std::istreambuf_iterator<char>(saved)), std::istreambuf_iterator<char>());
-  ASSERT_FALSE(bytes.empty());
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb), 0);
-  fm_value_t value{};
-  ASSERT_EQ(fm_workbook_get_value(wb, 0U, 0U, 1U, &value), 0);
-  EXPECT_EQ(value.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(value.u.number, 8.0);
-  fm_workbook_destroy(wb);
-}
-
-TEST(FormulonCli, RecalcDashLeadingInputWithoutTerminatorIsUsageError) {
-  const std::string input = "-fm_cli_recalc_dash_without_terminator_input.xlsx";
-  const std::string output = "-fm_cli_recalc_dash_without_terminator_output.xlsx";
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  std::remove(output.c_str());
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun result = run_cli({"recalc", input, "-o", output});
-  EXPECT_EQ(result.exit_code, 64);
-  EXPECT_TRUE(result.stdout_text.empty());
-  EXPECT_FALSE(std::ifstream(output, std::ios::binary).good());
-}
-
-TEST(FormulonCli, RecalcAcceptsDoubleDashAsOutputPathValue) {
-  const std::string input = "fm_cli_recalc_double_dash_input.xlsx";
-  const std::string output = "--";
-  PathGuard input_guard(input);
-  PathGuard output_guard(output);
-  std::remove(output.c_str());
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun result = run_cli({"recalc", input, "-o", output});
-  ASSERT_EQ(result.exit_code, 0) << result.stderr_text;
-
-  std::ifstream saved(output, std::ios::binary);
-  ASSERT_TRUE(saved);
-  const std::vector<std::uint8_t> bytes((std::istreambuf_iterator<char>(saved)), std::istreambuf_iterator<char>());
-  ASSERT_FALSE(bytes.empty());
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_load(bytes.data(), bytes.size(), &wb), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb), 0);
-  fm_value_t value{};
-  ASSERT_EQ(fm_workbook_get_value(wb, 0U, 0U, 1U, &value), 0);
-  EXPECT_EQ(value.kind, FM_VAL_NUMBER);
-  EXPECT_DOUBLE_EQ(value.u.number, 8.0);
-  fm_workbook_destroy(wb);
-}
-
-TEST(FormulonCli, OptionTerminatorRequiresExactlyOnePositional) {
-  const std::string output = temp_path("terminator_recalc_output.xlsx");
-  PathGuard output_guard(output);
-
-  for (const std::vector<std::string>& args : {
-           std::vector<std::string>{"eval", "--"},
-           std::vector<std::string>{"dump", "--"},
-           std::vector<std::string>{"paginate", "--"},
-       }) {
-    const CliRun result = run_cli(args);
-    EXPECT_EQ(result.exit_code, 64) << "bare terminator command=" << args.front();
-  }
-
-  std::remove(output.c_str());
-  CliRun recalc_bare = run_cli({"recalc", "-o", output, "--"});
-  EXPECT_EQ(recalc_bare.exit_code, 64);
-  EXPECT_FALSE(std::ifstream(output, std::ios::binary).good());
-
-  for (const std::vector<std::string>& args : {
-           std::vector<std::string>{"eval", "--", "-1+2", "--json"},
-           std::vector<std::string>{"dump", "--", "-fm_cli_missing.xlsx", "--sheets"},
-           std::vector<std::string>{"paginate", "--", "-fm_cli_missing.xlsx", "--sheet"},
-       }) {
-    const CliRun result = run_cli(args);
-    EXPECT_EQ(result.exit_code, 64) << "post-terminator extra command=" << args.front();
-  }
-
-  std::remove(output.c_str());
-  CliRun recalc_extra = run_cli({"recalc", "-o", output, "--", "-fm_cli_missing.xlsx", "--quiet"});
-  EXPECT_EQ(recalc_extra.exit_code, 64);
-  EXPECT_FALSE(std::ifstream(output, std::ios::binary).good());
-}
-
-// ---------------------------------------------------------------------------
-// dump
-// ---------------------------------------------------------------------------
-
-TEST(FormulonCli, DumpSheetsListsInOrder) {
-  std::string in = temp_path("dump_sheets.xlsx");
-  PathGuard g_in(in);
-  ASSERT_TRUE(write_fixture_workbook(in));
-  CliRun r = run_cli({"dump", "--sheets", in});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_EQ(r.stdout_text, "Sheet1\n");
-}
-
-TEST(FormulonCli, DumpFormulasListsFormulaCells) {
-  std::string in = temp_path("dump_formulas.xlsx");
-  PathGuard g_in(in);
-  ASSERT_TRUE(write_fixture_workbook(in));
-  CliRun r = run_cli({"dump", "--formulas", in});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  // B1 = `=A1+1` is the only formula; A1 is a literal.
-  EXPECT_NE(r.stdout_text.find("Sheet1!B1"), std::string::npos) << "stdout=" << r.stdout_text;
-  EXPECT_EQ(r.stdout_text.find("Sheet1!A1"), std::string::npos) << "literal A1 must not appear in --formulas dump";
-}
-
-TEST(FormulonCli, DumpMetadataPrintsSectionHeaders) {
-  std::string in = temp_path("dump_metadata.xlsx");
-  PathGuard g_in(in);
-  ASSERT_TRUE(write_fixture_workbook(in));
-  CliRun r = run_cli({"dump", "--metadata", in});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_NE(r.stdout_text.find("[defined_names]"), std::string::npos);
-  EXPECT_NE(r.stdout_text.find("[tables]"), std::string::npos);
-  EXPECT_NE(r.stdout_text.find("[passthrough_parts]"), std::string::npos);
-}
-
-TEST(FormulonCli, DumpWriteFailureReturnsOutputError) {
-  std::string in = temp_path("dump_write_failure.xlsx");
-  PathGuard guard(in);
-  ASSERT_TRUE(write_fixture_workbook(in));
-  CliRun r = run_cli({"dump", "--sheets", in}, /*merge_streams=*/false, /*close_stdout=*/true);
-  EXPECT_EQ(r.exit_code, 1);
-  EXPECT_NE(r.stderr_text.find("failed to write output"), std::string::npos);
-}
-
-TEST(FormulonCli, DumpValuesEscapesEmbeddedNewlines) {
-  std::string in = temp_path("dump_escaped.xlsx");
-  PathGuard guard(in);
-  ASSERT_TRUE(write_fixture_workbook(in, "first\nsecond"));
-  CliRun r = run_cli({"dump", "--values", in});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_NE(r.stdout_text.find("Sheet1!A2 first\\nsecond\n"), std::string::npos) << r.stdout_text;
-  EXPECT_EQ(r.stdout_text.find("first\nsecond"), std::string::npos) << r.stdout_text;
-}
-
-TEST(FormulonCli, DumpMissingInputExits64) {
-  CliRun r = run_cli({"dump", "--sheets"});
-  EXPECT_EQ(r.exit_code, 64);
-}
-
-TEST(FormulonCli, DumpOptionTerminatorAcceptsDashLeadingRelativePath) {
-  const std::string input = "-fm_cli_dump_dash_input.xlsx";
-  PathGuard guard(input);
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun without_terminator = run_cli({"dump", "--sheets", input});
-  EXPECT_EQ(without_terminator.exit_code, 64);
-
-  const CliRun with_terminator = run_cli({"dump", "--sheets", "--", input});
-  EXPECT_EQ(with_terminator.exit_code, 0) << with_terminator.stderr_text;
-  EXPECT_EQ(with_terminator.stdout_text, "Sheet1\n");
-}
-
-TEST(FormulonCli, DumpPostTerminatorHelpIsAnInputPath) {
-  const std::string input = "-h";
-  PathGuard guard(input);
-  std::remove(input.c_str());
-
-  const CliRun result = run_cli({"dump", "--", input});
-  EXPECT_EQ(result.exit_code, 1);
-  EXPECT_TRUE(result.stdout_text.empty());
-  EXPECT_NE(result.stderr_text.find("cannot read"), std::string::npos);
-}
-
-TEST(FormulonCli, SecondLiteralTerminatorIsAnExtraPositional) {
-  const std::string input = "-fm_cli_second_literal_terminator.xlsx";
-  PathGuard guard(input);
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun dump = run_cli({"dump", "--", input, "--"});
-  EXPECT_EQ(dump.exit_code, 64);
-  const CliRun paginate = run_cli({"paginate", "--", input, "--"});
-  EXPECT_EQ(paginate.exit_code, 64);
-}
-
-TEST(FormulonCli, DumpMetadataDistinguishesDefinedNameScope) {
-  std::string in = temp_path("dump_metadata_scoped.xlsx");
-  PathGuard g_in(in);
-
-  fm_workbook_t* wb = nullptr;
-  ASSERT_EQ(fm_workbook_create(&wb), 0);
-  ASSERT_EQ(fm_workbook_set_number(wb, 0, 0, 0, 1.0), 0);
-  ASSERT_EQ(fm_workbook_set_defined_name(wb, "WorkbookConst", "=1"), 0);
-  ASSERT_EQ(fm_workbook_set_defined_name_scoped(wb, "SheetLocal", "=Sheet1!$A$1", 0), 0);
-  ASSERT_EQ(fm_workbook_recalc(wb), 0);
-  std::uint8_t* bytes = nullptr;
-  std::size_t len = 0;
-  ASSERT_EQ(fm_workbook_save(wb, &bytes, &len), 0);
-  std::ofstream out(in, std::ios::binary | std::ios::trunc);
-  ASSERT_TRUE(out);
-  out.write(reinterpret_cast<const char*>(bytes), static_cast<std::streamsize>(len));
-  out.close();
-  fm_buffer_free(bytes);
-  fm_workbook_destroy(wb);
-
-  CliRun r = run_cli({"dump", "--metadata", in});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  // Workbook-scoped names print bare; sheet-scoped names are prefixed
-  // with `SheetName!` so the two scopes don't collide in the dump.
-  EXPECT_NE(r.stdout_text.find("WorkbookConst =1"), std::string::npos) << "stdout=" << r.stdout_text;
-  EXPECT_NE(r.stdout_text.find("Sheet1!SheetLocal ="), std::string::npos) << "stdout=" << r.stdout_text;
-}
-
-TEST(FormulonCli, DumpMetadataRecoversFromOutOfRangeDefinedNameScope) {
-  std::string in = temp_path("dump_metadata_out_of_range_scope.xlsx");
-  PathGuard guard(in);
-  ASSERT_TRUE(write_out_of_range_defined_names_fixture(in));
-
-  CliRun r = run_cli({"dump", "--metadata", in});
-  EXPECT_EQ(r.exit_code, 0) << "stderr=" << r.stderr_text;
-  EXPECT_TRUE(r.stderr_text.empty());
-  EXPECT_EQ(r.stdout_text,
-            "[defined_names]\n"
-            "Before =1\n"
-            "#99!Bad =Sheet1!$A$1\n"
-            "After =2\n"
-            "[tables]\n"
-            "[passthrough_parts]\n");
-}
-
-TEST(FormulonCli, PaginateOptionTerminatorAcceptsDashLeadingRelativePath) {
-  const std::string input = "-fm_cli_paginate_dash_input.xlsx";
-  PathGuard guard(input);
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun without_terminator = run_cli({"paginate", "--sheet", "0", input});
-  EXPECT_EQ(without_terminator.exit_code, 64);
-
-  const CliRun with_terminator = run_cli({"paginate", "--sheet", "0", "--", input});
-  EXPECT_EQ(with_terminator.exit_code, 0) << with_terminator.stderr_text;
-  EXPECT_EQ(with_terminator.stdout_text, "sheet=0\npages=1\nprint_area=\nhorizontal_breaks=\nvertical_breaks=\n");
-}
-
-TEST(FormulonCli, PaginatePostTerminatorHelpIsAnInputPath) {
-  const std::string input = "-h";
-  PathGuard guard(input);
-  std::remove(input.c_str());
-
-  const CliRun result = run_cli({"paginate", "--", input});
-  EXPECT_EQ(result.exit_code, 1);
-  EXPECT_TRUE(result.stdout_text.empty());
-  EXPECT_NE(result.stderr_text.find("cannot read"), std::string::npos);
-}
-
-// ---------------------------------------------------------------------------
-// file_io
-//
-// Called in-process rather than through the binary: a descriptor leak is
-// invisible from outside a one-shot process that exits straight after the
-// write.
-// ---------------------------------------------------------------------------
-
-TEST(FormulonCliFileIo, AtomicWriteLeavesNoDescriptorOrTemporaryBehind) {
-  const std::string dir = temp_path("atomic_write_dir");
-  ASSERT_EQ(::mkdir(dir.c_str(), 0700), 0) << dir << ": " << std::strerror(errno);
-  DirGuard guard(dir);
-  const std::string output = dir + "/out.bin";
-  const std::vector<std::uint8_t> payload{'f', 'o', 'r', 'm'};
-
-  const int baseline = open_descriptor_count();
-  for (int attempt = 0; attempt < 8; ++attempt) {
-    ASSERT_EQ(formulon::cli::write_file_atomically(output, payload.data(), payload.size()), 0) << attempt;
-  }
-  EXPECT_EQ(open_descriptor_count(), baseline) << "successful writes leaked a descriptor";
-  EXPECT_EQ(list_directory(dir), std::vector<std::string>{"out.bin"});
-
-  // A destination that is a directory runs the whole sequence -- create,
-  // write, sync, close -- and only then fails, at the rename. Repeating
-  // it makes a per-call leak visible as growth rather than as a single
-  // descriptor that could be noise, and the temporary it created has to
-  // be gone from the parent directory afterwards.
-  const std::string occupied = dir + "/sub";
-  ASSERT_EQ(::mkdir(occupied.c_str(), 0700), 0) << occupied << ": " << std::strerror(errno);
-  for (int attempt = 0; attempt < 8; ++attempt) {
-    EXPECT_NE(formulon::cli::write_file_atomically(occupied, payload.data(), payload.size()), 0) << attempt;
-  }
-  EXPECT_EQ(open_descriptor_count(), baseline) << "failed writes leaked a descriptor";
-  EXPECT_EQ(list_directory(dir), (std::vector<std::string>{"out.bin", "sub"}));
-
-  // An unwritable directory covers the other end: the failure happens
-  // before anything is created at all.
-  ASSERT_EQ(::chmod(dir.c_str(), 0500), 0);
-  for (int attempt = 0; attempt < 8; ++attempt) {
-    EXPECT_NE(formulon::cli::write_file_atomically(output, payload.data(), payload.size()), 0) << attempt;
-  }
-  EXPECT_EQ(open_descriptor_count(), baseline) << "failed writes leaked a descriptor";
-  ASSERT_EQ(::chmod(dir.c_str(), 0700), 0);
-  EXPECT_EQ(list_directory(dir), (std::vector<std::string>{"out.bin", "sub"}));
-
-  std::ifstream written(output, std::ios::binary);
-  ASSERT_TRUE(written);
-  const std::vector<std::uint8_t> contents((std::istreambuf_iterator<char>(written)), std::istreambuf_iterator<char>());
-  EXPECT_EQ(contents, payload);
-}
-
-TEST(FormulonCli, PaginateConsumesTerminatorAsSheetValue) {
-  const std::string input = "-fm_cli_paginate_sheet_value_terminator.xlsx";
-  PathGuard guard(input);
-  ASSERT_TRUE(write_fixture_workbook(input));
-
-  const CliRun result = run_cli({"paginate", "--sheet", "--", input});
-  EXPECT_EQ(result.exit_code, 64);
-  EXPECT_TRUE(result.stdout_text.empty());
-}
diff --git a/tests/cli/cli_test_support.cpp b/tests/cli/cli_test_support.cpp
new file mode 100644
index 000000000..b22201d41
--- /dev/null
+++ b/tests/cli/cli_test_support.cpp
@@ -0,0 +1,475 @@
+#include "cli_test_support.h"
+
+#include <dirent.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <cstdio>
+#include <cstdlib>
+#include <fstream>
+#include <iterator>
+#include <utility>
+
+#include "c_api/formulon_c.h"
+#include "defined_name.h"
+#include "support/ooxml_package_fixture.h"
+
+namespace formulon::cli_test {
+
+// Quotes `s` in single quotes for `/bin/sh`, doubling any embedded
+// single quotes via `'\''`. Sufficient for the file paths and short
+// flag values the tests pass; not a full shell quoter.
+std::string sh_quote(const std::string& s) {
+  std::string out;
+  out.reserve(s.size() + 2);
+  out.push_back('\'');
+  for (char c : s) {
+    if (c == '\'') {
+      out.append("'\\''");
+    } else {
+      out.push_back(c);
+    }
+  }
+  out.push_back('\'');
+  return out;
+}
+
+PathGuard::PathGuard(std::string p) : path(std::move(p)) {}
+
+PathGuard::~PathGuard() {
+  if (!path.empty()) {
+    std::remove(path.c_str());
+  }
+}
+
+DirGuard::DirGuard(std::string p) : path(std::move(p)) {}
+
+DirGuard::~DirGuard() {
+  ::chmod(path.c_str(), 0700);
+  for (const std::string& entry : list_directory(path)) {
+    const std::string full = path + "/" + entry;
+    if (std::remove(full.c_str()) != 0) {
+      ::rmdir(full.c_str());
+    }
+  }
+  ::rmdir(path.c_str());
+}
+
+// Prefix every temp fixture in this file is built from.
+//
+// The paths are derived from the pid rather than fixed, so two runs of
+// this binary -- a `ctest -j` fan-out, or a rerun started while an
+// earlier one is still finishing -- never share a fixture and never fail
+// on each other's leftovers. `TMPDIR` is honoured where the platform
+// sets one, falling back to `/tmp`.
+const std::string& temp_prefix() {
+  static const std::string prefix = [] {
+    const char* configured = std::getenv("TMPDIR");
+    std::string dir = (configured != nullptr && configured[0] != '\0') ? configured : "/tmp";
+    if (dir.back() != '/') {
+      dir.push_back('/');
+    }
+    return dir + "fm_cli_" + std::to_string(::getpid()) + "_";
+  }();
+  return prefix;
+}
+
+// Absolute path of a temp fixture named `name`, unique to this process.
+std::string temp_path(std::string_view name) {
+  return temp_prefix() + std::string(name);
+}
+
+// Entries of `dir` excluding `.` and `..`, sorted so a comparison against
+// an expected listing is stable. An unreadable directory yields an empty
+// listing, which reads the same as "nothing was left behind" -- callers
+// that care assert on the readable case.
+std::vector<std::string> list_directory(const std::string& dir) {
+  std::vector<std::string> entries;
+  DIR* handle = ::opendir(dir.c_str());
+  if (handle == nullptr) {
+    return entries;
+  }
+  while (const dirent* entry = ::readdir(handle)) {
+    const std::string name(entry->d_name);
+    if (name != "." && name != "..") {
+      entries.push_back(name);
+    }
+  }
+  ::closedir(handle);
+  std::sort(entries.begin(), entries.end());
+  return entries;
+}
+
+// Spawns the CLI with `args` (each argument is sh-quoted before being
+// joined into a single command line). When `merge_streams` is true,
+// stderr is folded into stdout via `2>&1`; otherwise stderr is
+// captured to a temp file via `2>` and read back. The temp-file path
+// avoids races with shell escaping.
+CliRun run_cli(const std::vector<std::string>& args, bool merge_streams, bool close_stdout) {
+  CliRun out;
+  std::string cmd = sh_quote(FORMULON_CLI_PATH);
+  for (const auto& a : args) {
+    cmd.push_back(' ');
+    cmd.append(sh_quote(a));
+  }
+  // Capture stderr separately to a temp file so we can assert on it
+  // without ambiguity. The shell's `>` redirect is portable on macOS
+  // and Linux. We append rather than truncate so the temp file is
+  // self-contained per call.
+  std::string tmpl = temp_path("stderr_XXXXXX");
+  const int fd = mkstemp(tmpl.data());
+  if (fd < 0) {
+    out.exit_code = -2;
+    return out;
+  }
+  ::close(fd);
+  if (close_stdout) {
+    cmd.append(" 1>&- 2>");
+    cmd.append(sh_quote(tmpl));
+  } else if (merge_streams) {
+    cmd.append(" 2>&1");
+  } else {
+    cmd.append(" 2>");
+    cmd.append(sh_quote(tmpl));
+  }
+
+  FILE* pipe = popen(cmd.c_str(), "r");
+  if (pipe == nullptr) {
+    out.exit_code = -3;
+    std::remove(tmpl.c_str());
+    return out;
+  }
+  char buf[4096];
+  while (std::fgets(buf, sizeof(buf), pipe) != nullptr) {
+    out.stdout_text.append(buf);
+  }
+  const int wait_rc = pclose(pipe);
+  // `pclose` returns the wait status; on POSIX, `WEXITSTATUS` is in
+  // the upper byte. We approximate it with `(wait_rc >> 8) & 0xff`,
+  // which matches `/bin/sh` semantics.
+  if (wait_rc < 0) {
+    out.exit_code = -4;
+  } else {
+    out.exit_code = (wait_rc >> 8) & 0xff;
+  }
+
+  if (!merge_streams) {
+    std::ifstream in(tmpl);
+    if (in) {
+      std::string line;
+      while (std::getline(in, line)) {
+        out.stderr_text.append(line);
+        out.stderr_text.push_back('\n');
+      }
+    }
+  }
+  std::remove(tmpl.c_str());
+  return out;
+}
+
+// The load-diagnostic warning lines in `text`, with the
+// `formulon: <subcommand>: ` prefix stripped so reports emitted by
+// different subcommands compare equal. Save-side warnings are left out:
+// only the command that writes a workbook produces those.
+std::vector<std::string> read_diagnostic_lines(const std::string& text) {
+  std::vector<std::string> lines;
+  std::size_t start = 0;
+  while (start < text.size()) {
+    const std::size_t end = text.find('\n', start);
+    const std::string line = text.substr(start, end == std::string::npos ? std::string::npos : end - start);
+    const std::size_t marker = line.find("warning: ");
+    if (marker != std::string::npos && line.find("read diagnostics") != std::string::npos) {
+      lines.push_back(line.substr(marker));
+    }
+    if (end == std::string::npos) {
+      break;
+    }
+    start = end + 1;
+  }
+  return lines;
+}
+
+// Number of descriptors this process currently holds open. Only the
+// delta across a call matters, so scanning a fixed low range is enough:
+// the tests below open a handful of files and never approach the cap.
+int open_descriptor_count() {
+  int count = 0;
+  for (int fd = 0; fd < 256; ++fd) {
+    if (::fcntl(fd, F_GETFD) != -1) {
+      ++count;
+    }
+  }
+  return count;
+}
+
+// Builds a tiny `.xlsx` workbook in memory via the C ABI and writes
+// it to `path`. Used by `recalc` and `dump` tests that need a fixture
+// on disk. Returns `true` on success.
+bool write_fixture_workbook(const std::string& path, std::string_view extra_text, bool iterative,
+                            int32_t max_iterations, double max_change) {
+  fm_workbook_t* wb = nullptr;
+  if (fm_workbook_create(&wb) != 0) {
+    return false;
+  }
+  // A1 = 7 (literal), B1 = =A1+1 (formula).
+  if (fm_workbook_set_number(wb, 0, 0, 0, 7.0) != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  if (fm_workbook_set_formula(wb, 0, 0, 1, "=A1+1") != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  if (iterative && fm_workbook_set_iterative(wb, 1, max_iterations, max_change) != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  if (fm_workbook_recalc(wb) != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  if (!extra_text.empty() && fm_workbook_set_text(wb, 0, 1, 0, std::string(extra_text).c_str()) != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  std::uint8_t* bytes = nullptr;
+  std::size_t len = 0;
+  if (fm_workbook_save(wb, &bytes, &len) != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  std::ofstream out(path, std::ios::binary | std::ios::trunc);
+  if (!out) {
+    fm_buffer_free(bytes);
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  out.write(reinterpret_cast<const char*>(bytes), static_cast<std::streamsize>(len));
+  out.close();
+  fm_buffer_free(bytes);
+  fm_workbook_destroy(wb);
+  return out.good();
+}
+
+// A wide, pure formula layer makes the CLI's parallel route observable
+// without relying on volatile functions or timing. The caller receives an
+// ordinary .xlsx that the command must load, recalculate, save, and whose
+// last lane we inspect after reopening.
+bool write_wide_recalc_fixture(const std::string& path) {
+  fm_workbook_t* wb = nullptr;
+  if (fm_workbook_create(&wb) != 0) {
+    return false;
+  }
+  constexpr std::uint32_t kRows = 48U;
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    const std::string formula = "=A" + std::to_string(row + 1U) + "*2+1";
+    if (fm_workbook_set_number(wb, 0U, row, 0U, static_cast<double>(row + 1U)) != 0 ||
+        fm_workbook_set_formula(wb, 0U, row, 1U, formula.c_str()) != 0) {
+      fm_workbook_destroy(wb);
+      return false;
+    }
+  }
+  std::uint8_t* bytes = nullptr;
+  std::size_t len = 0U;
+  if (fm_workbook_save(wb, &bytes, &len) != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  std::ofstream out(path, std::ios::binary | std::ios::trunc);
+  if (!out) {
+    fm_buffer_free(bytes);
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  out.write(reinterpret_cast<const char*>(bytes), static_cast<std::streamsize>(len));
+  out.close();
+  fm_buffer_free(bytes);
+  fm_workbook_destroy(wb);
+  return out.good();
+}
+
+bool write_out_of_range_defined_names_fixture(const std::string& path) {
+  formulon::Workbook wb = formulon::Workbook::create();
+  for (std::size_t i = 1; i < 7; ++i) {
+    wb.add_sheet("Sheet" + std::to_string(i + 1));
+  }
+
+  std::vector<formulon::DefinedName> names;
+  names.push_back(formulon::DefinedName{"Before", "=1", -1, false, ""});
+  names.push_back(formulon::DefinedName{"Bad", "=Sheet1!$A$1", 99, false, ""});
+  names.push_back(formulon::DefinedName{"After", "=2", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+
+  auto saved = wb.save();
+  if (!saved) {
+    return false;
+  }
+  std::ofstream out(path, std::ios::binary | std::ios::trunc);
+  if (!out) {
+    return false;
+  }
+  const std::vector<std::uint8_t>& bytes = saved.value();
+  out.write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+  out.close();
+  return out.good();
+}
+
+bool write_lossy_xlsx_fixture(const std::string& path) {
+  fm_workbook_t* wb = nullptr;
+  if (fm_workbook_create(&wb) != 0) {
+    return false;
+  }
+  if (fm_workbook_set_formula(wb, 0, 0, 0, "=T[C]") != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  fm_hyperlink hyperlink{};
+  hyperlink.target = "https://example.com";
+  if (fm_sheet_add_hyperlink(wb, 0, hyperlink) != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  fm_merge_range range{0, 0, 0, 0};
+  fm_data_validation validation{};
+  validation.ranges = &range;
+  validation.range_count = 1;
+  validation.type = 3;
+  validation.formula1 = "$A$1:$A$2";
+  if (fm_sheet_add_validation(wb, 0, validation) != 0 ||
+      fm_sheet_set_auto_filter_xml(wb, 0, "<autoFilter ref=\"A1:B2\"/>") != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  std::uint8_t* bytes = nullptr;
+  std::size_t len = 0;
+  if (fm_workbook_save(wb, &bytes, &len) != 0) {
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  std::ofstream out(path, std::ios::binary | std::ios::trunc);
+  if (!out) {
+    fm_buffer_free(bytes);
+    fm_workbook_destroy(wb);
+    return false;
+  }
+  out.write(reinterpret_cast<const char*>(bytes), static_cast<std::streamsize>(len));
+  out.close();
+  fm_buffer_free(bytes);
+  fm_workbook_destroy(wb);
+  return out.good();
+}
+
+std::vector<std::uint8_t> append_empty_zip_entry(const std::vector<std::uint8_t>& bytes, std::string_view name) {
+  const std::uint8_t sig[] = {0x50, 0x4b, 0x05, 0x06};
+  const auto it = std::find_end(bytes.begin(), bytes.end(), std::begin(sig), std::end(sig));
+  if (it == bytes.end())
+    return {};
+  const std::size_t eocd = static_cast<std::size_t>(it - bytes.begin());
+  const auto read16 = [&](std::size_t p) { return static_cast<std::uint16_t>(bytes[p] | (bytes[p + 1] << 8U)); };
+  const auto read32 = [&](std::size_t p) {
+    return static_cast<std::uint32_t>(bytes[p] | (bytes[p + 1] << 8U) | (bytes[p + 2] << 16U) | (bytes[p + 3] << 24U));
+  };
+  const std::uint16_t count = read16(eocd + 10U);
+  const std::uint32_t central_size = read32(eocd + 12U);
+  const std::uint32_t central_offset = read32(eocd + 16U);
+  const auto put16 = [](std::vector<std::uint8_t>& out, std::uint16_t x) {
+    out.push_back(static_cast<std::uint8_t>(x));
+    out.push_back(static_cast<std::uint8_t>(x >> 8U));
+  };
+  const auto put32 = [](std::vector<std::uint8_t>& out, std::uint32_t x) {
+    out.push_back(static_cast<std::uint8_t>(x));
+    out.push_back(static_cast<std::uint8_t>(x >> 8U));
+    out.push_back(static_cast<std::uint8_t>(x >> 16U));
+    out.push_back(static_cast<std::uint8_t>(x >> 24U));
+  };
+  const std::string n(name);
+  std::vector<std::uint8_t> local;
+  put32(local, 0x04034b50U);
+  put16(local, 20);
+  put16(local, 0);
+  put16(local, 0);
+  put16(local, 0);
+  put16(local, 0);
+  put32(local, 0);
+  put32(local, 0);
+  put32(local, 0);
+  put16(local, static_cast<std::uint16_t>(n.size()));
+  put16(local, 0);
+  local.insert(local.end(), n.begin(), n.end());
+  std::vector<std::uint8_t> central;
+  put32(central, 0x02014b50U);
+  put16(central, 20);
+  put16(central, 20);
+  put16(central, 0);
+  put16(central, 0);
+  put16(central, 0);
+  put16(central, 0);
+  put32(central, 0);
+  put32(central, 0);
+  put32(central, 0);
+  put16(central, static_cast<std::uint16_t>(n.size()));
+  put16(central, 0);
+  put16(central, 0);
+  put16(central, 0);
+  put16(central, 0);
+  put32(central, 0);
+  put32(central, central_offset);
+  central.insert(central.end(), n.begin(), n.end());
+  std::vector<std::uint8_t> out(bytes.begin(), bytes.begin() + central_offset);
+  out.insert(out.end(), local.begin(), local.end());
+  out.insert(out.end(), bytes.begin() + central_offset, bytes.begin() + central_offset + central_size);
+  out.insert(out.end(), central.begin(), central.end());
+  put32(out, 0x06054b50U);
+  put16(out, 0);
+  put16(out, 0);
+  put16(out, count + 1U);
+  put16(out, count + 1U);
+  put32(out, central_size + static_cast<std::uint32_t>(central.size()));
+  put32(out, central_offset + static_cast<std::uint32_t>(local.size()));
+  put16(out, 0);
+  return out;
+}
+
+// An `.xlsx` whose sheet carries one unusable reference per overlay kind and
+// whose workbook part declares a content type the reader does not recognise.
+// The engine's writer never produces either, so the package is assembled by
+// hand.
+bool write_lossy_ooxml_fixture(const std::string& path) {
+  const std::string content_types = formulon::test::OoxmlContentTypes("application/vnd.formulon-test.unknown+xml");
+  const std::vector<std::uint8_t> bytes = formulon::test::BuildOoxmlPackage(
+      content_types,
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"><sheetData/>"
+      "<mergeCells><mergeCell ref=\"nope\"/></mergeCells>"
+      "<conditionalFormatting><cfRule type=\"expression\" priority=\"1\"/></conditionalFormatting>"
+      "</worksheet>");
+  if (bytes.empty()) {
+    return false;
+  }
+  std::ofstream out(path, std::ios::binary | std::ios::trunc);
+  out.write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+  return out.good();
+}
+
+bool write_dropped_xlsb_fixture(const std::string& path) {
+  fm_workbook_t* wb = nullptr;
+  if (fm_workbook_create(&wb) != 0)
+    return false;
+  std::uint8_t* raw = nullptr;
+  std::size_t len = 0;
+  const bool saved = fm_workbook_save_as(wb, FM_WORKBOOK_FORMAT_XLSB, &raw, &len) == 0;
+  fm_workbook_destroy(wb);
+  if (!saved)
+    return false;
+  std::vector<std::uint8_t> fixture =
+      append_empty_zip_entry(std::vector<std::uint8_t>(raw, raw + len), "xl/dropped.unknown");
+  fm_buffer_free(raw);
+  if (fixture.empty())
+    return false;
+  std::ofstream out(path, std::ios::binary | std::ios::trunc);
+  out.write(reinterpret_cast<const char*>(fixture.data()), static_cast<std::streamsize>(fixture.size()));
+  return out.good();
+}
+
+}  // namespace formulon::cli_test
diff --git a/tests/cli/cli_test_support.h b/tests/cli/cli_test_support.h
new file mode 100644
index 000000000..6d6503285
--- /dev/null
+++ b/tests/cli/cli_test_support.h
@@ -0,0 +1,74 @@
+#pragma once
+
+#include <dirent.h>
+#include <fcntl.h>
+#include <gtest/gtest.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <fstream>
+#include <ios>
+#include <iterator>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#ifndef FORMULON_CLI_PATH
+#error "FORMULON_CLI_PATH must be defined by the build system"
+#endif
+
+#include "c_api/formulon_c.h"
+#include "cli/file_io.h"
+#include "defined_name.h"
+#include "io/format_detect.h"
+#include "support/ooxml_package_fixture.h"
+#include "workbook.h"
+
+namespace formulon::cli_test {
+
+struct CliRun {
+  int exit_code = -1;
+  std::string stdout_text;
+  std::string stderr_text;
+};
+
+// All subprocess and fixture helpers have external linkage in this one
+// implementation unit. In particular, temp_prefix() owns one process-wide
+// prefix and static initialization, so every split test file shares it.
+std::string sh_quote(const std::string& s);
+const std::string& temp_prefix();
+std::string temp_path(std::string_view name);
+std::vector<std::string> list_directory(const std::string& dir);
+CliRun run_cli(const std::vector<std::string>& args, bool merge_streams = false, bool close_stdout = false);
+
+struct PathGuard {
+  std::string path;
+  explicit PathGuard(std::string p);
+  PathGuard(const PathGuard&) = delete;
+  PathGuard& operator=(const PathGuard&) = delete;
+  ~PathGuard();
+};
+
+struct DirGuard {
+  std::string path;
+  explicit DirGuard(std::string p);
+  DirGuard(const DirGuard&) = delete;
+  DirGuard& operator=(const DirGuard&) = delete;
+  ~DirGuard();
+};
+
+std::vector<std::string> read_diagnostic_lines(const std::string& text);
+int open_descriptor_count();
+bool write_fixture_workbook(const std::string& path, std::string_view extra_text = {}, bool iterative = false,
+                            int32_t max_iterations = 100, double max_change = 0.001);
+bool write_wide_recalc_fixture(const std::string& path);
+bool write_out_of_range_defined_names_fixture(const std::string& path);
+bool write_lossy_xlsx_fixture(const std::string& path);
+bool write_lossy_ooxml_fixture(const std::string& path);
+bool write_dropped_xlsb_fixture(const std::string& path);
+
+}  // namespace formulon::cli_test
diff --git a/tests/concurrency/CMakeLists.txt b/tests/concurrency/CMakeLists.txt
index aba6eac39..22e319196 100644
--- a/tests/concurrency/CMakeLists.txt
+++ b/tests/concurrency/CMakeLists.txt
@@ -19,7 +19,11 @@
 
 # ---- Fast scheduler topology tests ---------------------------------------
 
-add_executable(formulon_concurrency_tests scheduler_test.cpp)
+add_executable(formulon_concurrency_tests
+  scheduler_test.cpp
+  scheduler_layers_test.cpp
+  scheduler_reliability_test.cpp
+)
 
 target_link_libraries(formulon_concurrency_tests
   PRIVATE
@@ -44,7 +48,9 @@ gtest_discover_tests(formulon_concurrency_tests
 
 # ---- SLOW-labelled stress test -------------------------------------------
 
-add_executable(formulon_concurrency_stress_tests scheduler_test.cpp)
+add_executable(formulon_concurrency_stress_tests
+  scheduler_stress_test.cpp
+)
 
 target_link_libraries(formulon_concurrency_stress_tests
   PRIVATE
diff --git a/tests/concurrency/scheduler_layers_test.cpp b/tests/concurrency/scheduler_layers_test.cpp
new file mode 100644
index 000000000..94b91f734
--- /dev/null
+++ b/tests/concurrency/scheduler_layers_test.cpp
@@ -0,0 +1,332 @@
+// Concurrency scheduler tests grouped by fixture size and execution mode.
+// Shared probes and workbook-pair helpers live in scheduler_test_helpers.h.
+
+#include "scheduler_test_helpers.h"
+
+namespace formulon::eval {
+namespace {
+
+using namespace scheduler_test;
+
+TEST(Scheduler, TwoCellChainSerialLayers) {
+  // A1 = 1, B1 = =A1+1. Two layers, each of size 1 -> serial dispatch on
+  // both. parallel_steps must remain 0.
+  WorkbookPair wp;
+  wp.set_value(0, 0, 0, Value::number(1.0));
+  wp.set_formula(0, 0, 1, "=A1+1");
+
+  SchedulerStats stats;
+  SchedulerConfig cfg;
+  cfg.num_threads = 8U;
+  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
+  EXPECT_EQ(stats.parallel_steps, 0U);
+  // The single dirty SCC (B1) is dispatched serially.
+  EXPECT_GE(stats.serial_fallback_steps, 1U);
+
+  Value b1 = StoredValue(wp.parallel, 0, 0, 1);
+  ASSERT_TRUE(b1.is_number());
+  EXPECT_DOUBLE_EQ(b1.as_number(), 2.0);
+}
+
+TEST(Scheduler, WideIndependentLayer) {
+  // 100 independent literals A1..A100. No dependencies among them, so a
+  // single layer of 100 super-nodes is dispatched in parallel. There are
+  // no formulas to evaluate (the cells are all literals), so this case
+  // primarily exercises the dirty-set / scheduler bookkeeping with a
+  // wide layer.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 100; ++r) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, r, 0U, Value::number(static_cast<double>(r)))));
+  }
+  // Now add 100 formulas in column B that each read one A cell — this
+  // gives a layer of 100 independent super-nodes.
+  for (std::uint32_t r = 0; r < 100; ++r) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, r, 1U, "=A" + std::to_string(r + 1) + "*2")));
+  }
+
+  SchedulerStats stats;
+  SchedulerConfig cfg;
+  cfg.num_threads = 8U;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
+  EXPECT_EQ(stats.cells_evaluated, 100U);
+  EXPECT_GE(stats.parallel_steps, 1U);
+  EXPECT_GE(stats.worker_threads_started, 2U);
+  EXPECT_GE(stats.worker_threads_used, 1U);
+
+  for (std::uint32_t r = 0; r < 100; ++r) {
+    Value v = StoredValue(wb, 0U, r, 1U);
+    ASSERT_TRUE(v.is_number()) << "row " << r;
+    EXPECT_DOUBLE_EQ(v.as_number(), static_cast<double>(r) * 2.0);
+  }
+}
+
+TEST(Scheduler, WideLayerExecutesOnDistinctWorkerThreads) {
+  Workbook wb = Workbook::create();
+  FunctionRegistry registry;
+  FunctionDef def{};
+  def.canonical_name = "RECORD_WORKER_THREAD";
+  def.min_arity = 1U;
+  def.max_arity = 1U;
+  def.impl = &RecordWorkerThreadImpl;
+  ASSERT_TRUE(registry.register_function(def));
+
+  ResetWorkerThreadProbe(/*synchronize=*/true);
+
+  constexpr std::uint32_t kRows = 16U;
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, row, 0U, Value::number(static_cast<double>(row + 1U)))));
+    ASSERT_TRUE(static_cast<bool>(
+        wb.set_cell_formula(0U, row, 1U, "=RECORD_WORKER_THREAD(A" + std::to_string(row + 1U) + ")")));
+  }
+
+  SchedulerConfig config;
+  config.num_threads = 4U;
+  SchedulerStats stats;
+  ASSERT_TRUE(static_cast<bool>(recalc_parallel(wb, registry, config, &stats)));
+  EXPECT_GE(stats.worker_threads_started, 2U);
+  EXPECT_GE(stats.worker_threads_used, 2U);
+  EXPECT_GE(stats.parallel_steps, 1U);
+
+  std::set<std::thread::id> observed_threads;
+  bool timed_out = false;
+  {
+    std::lock_guard<std::mutex> guard(g_worker_thread_probe.mutex);
+    observed_threads = g_worker_thread_probe.ids;
+    timed_out = g_worker_thread_probe.timed_out;
+  }
+  EXPECT_FALSE(timed_out);
+  EXPECT_GE(observed_threads.size(), 2U);
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    const Value value = StoredValue(wb, 0U, row, 1U);
+    ASSERT_TRUE(value.is_number()) << "row " << row;
+    EXPECT_DOUBLE_EQ(value.as_number(), static_cast<double>(row + 1U));
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Volatility classes and the layer split
+// ---------------------------------------------------------------------------
+
+TEST(Scheduler, ValueVolatileLayerStaysOnThePool) {
+  // `RAND` re-fires every pass but reads nothing, so the layering derived
+  // from the dependency edges is complete and every one of these cells is
+  // poolable. A pass must therefore dispatch the layer to the workers and
+  // leave no serial tail behind: if the scheduler ever went back to
+  // isolating value volatility, `pooled` would be empty here and the whole
+  // layer would fall to the caller, flipping both counters.
+  constexpr std::uint32_t kRows = 64U;
+  Workbook wb = Workbook::create();
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, row, 0U, "=RAND()*0+1")));
+  }
+
+  SchedulerConfig cfg;
+  cfg.num_threads = 4U;
+  SchedulerStats stats;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
+
+  EXPECT_EQ(stats.cells_evaluated, kRows);
+  EXPECT_EQ(stats.parallel_steps, 1U);
+  EXPECT_EQ(stats.serial_fallback_steps, 0U);
+  EXPECT_GE(stats.worker_threads_used, 1U);
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    const Value v = StoredValue(wb, 0U, row, 0U);
+    ASSERT_TRUE(v.is_number()) << "row " << row;
+    EXPECT_DOUBLE_EQ(v.as_number(), 1.0) << "row " << row;
+  }
+}
+
+TEST(Scheduler, DynamicReferenceLayerLeavesThePoolButValueVolatileDoesNot) {
+  // One layer holding both classes and nothing else: the `INDIRECT` half
+  // must be the serial tail, the `RAND` half must be the pooled body.
+  // Column A is settled before the measured pass so it contributes no
+  // super-node — re-merging the classes would leave the pool with nothing
+  // to do and drop `parallel_steps` to zero. The tracker assertions pin
+  // which cell landed in which class.
+  constexpr std::uint32_t kRows = 32U;
+  Workbook wb = Workbook::create();
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, row, 0U, Value::number(static_cast<double>(row)))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, row, 1U, "=RAND()*0+1")));
+    ASSERT_TRUE(
+        static_cast<bool>(wb.set_cell_formula(0U, row, 2U, "=INDIRECT(\"A" + std::to_string(row + 1U) + "\")")));
+  }
+
+  SchedulerConfig cfg;
+  cfg.num_threads = 4U;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, nullptr)));
+
+  SchedulerStats stats;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
+  EXPECT_EQ(stats.cells_evaluated, 2U * kRows);
+  EXPECT_EQ(stats.sccs_processed, 2U * kRows);
+  EXPECT_EQ(stats.parallel_steps, 1U);
+  EXPECT_EQ(stats.serial_fallback_steps, 1U);
+
+  const VolatileTracker& volatiles = wb.recalc_engine().volatiles();
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    const CellNodeId value_volatile{0U, row, 1U};
+    const CellNodeId dynamic_volatile{0U, row, 2U};
+    EXPECT_TRUE(volatiles.contains(value_volatile)) << "row " << row;
+    EXPECT_FALSE(volatiles.contains_dynamic_reference(value_volatile)) << "row " << row;
+    EXPECT_TRUE(volatiles.contains(dynamic_volatile)) << "row " << row;
+    EXPECT_TRUE(volatiles.contains_dynamic_reference(dynamic_volatile)) << "row " << row;
+
+    const Value value_result = StoredValue(wb, 0U, row, 1U);
+    ASSERT_TRUE(value_result.is_number()) << "row " << row;
+    EXPECT_DOUBLE_EQ(value_result.as_number(), 1.0) << "row " << row;
+    const Value dynamic_result = StoredValue(wb, 0U, row, 2U);
+    ASSERT_TRUE(dynamic_result.is_number()) << "row " << row;
+    EXPECT_DOUBLE_EQ(dynamic_result.as_number(), static_cast<double>(row)) << "row " << row;
+  }
+}
+
+TEST(Scheduler, MixedVolatilityClassesMatchSerialRecalc) {
+  // Both classes in one workbook, with every value-volatile result folded
+  // back to a fixed number so an ordering difference cannot hide behind a
+  // legitimately changing value. Column A is the target the dynamic
+  // references resolve to at evaluation time.
+  constexpr std::uint32_t kRows = 48U;
+  WorkbookPair wp;
+  wp.set_value(0, 0, 4, Value::number(0.0));  // E1: the OFFSET base.
+  for (std::uint32_t row = 0U; row < kRows; ++row) {
+    const std::string row_1based = std::to_string(row + 1U);
+    wp.set_formula(0, row, 0, "=RAND()*0+" + row_1based);
+    wp.set_formula(0, row, 1, "=INDIRECT(\"A" + row_1based + "\")");
+    wp.set_formula(0, row, 2, "=IF(NOW()>0,A" + row_1based + ",-1)");
+    wp.set_formula(0, row, 3, "=OFFSET($E$1," + std::to_string(row) + ",-4)");
+  }
+
+  SchedulerConfig cfg;
+  cfg.num_threads = 4U;
+  // Settling pass: no edge orders a dynamic reference against the cell it
+  // reads, so only the steady state is comparable across engines.
+  ASSERT_TRUE(static_cast<bool>(wp.serial.recalc(default_registry())));
+  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, nullptr)));
+
+  for (std::uint32_t pass = 0U; pass < 4U; ++pass) {
+    ASSERT_TRUE(static_cast<bool>(wp.serial.recalc(default_registry())));
+    ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, nullptr)));
+    for (std::uint32_t row = 0U; row < kRows; ++row) {
+      for (std::uint32_t col = 0U; col < 4U; ++col) {
+        const Value expected = StoredValue(wp.serial, 0U, row, col);
+        ASSERT_TRUE(expected.is_number()) << "pass " << pass << " at (" << row << ", " << col << ")";
+        EXPECT_DOUBLE_EQ(expected.as_number(), static_cast<double>(row + 1U))
+            << "pass " << pass << " at (" << row << ", " << col << ")";
+        EXPECT_EQ(expected, StoredValue(wp.parallel, 0U, row, col))
+            << "pass " << pass << " value mismatch at (" << row << ", " << col << ")";
+      }
+    }
+  }
+}
+
+TEST(Scheduler, SingleThreadConfigKeepsEvaluationOnCaller) {
+  Workbook wb = Workbook::create();
+  FunctionRegistry registry;
+  FunctionDef def{};
+  def.canonical_name = "RECORD_CALLER_THREAD";
+  def.min_arity = 1U;
+  def.max_arity = 1U;
+  def.impl = &RecordWorkerThreadImpl;
+  ASSERT_TRUE(registry.register_function(def));
+
+  ResetWorkerThreadProbe(/*synchronize=*/false);
+  const std::thread::id caller = std::this_thread::get_id();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(3.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=RECORD_CALLER_THREAD(A1)")));
+
+  SchedulerConfig config;
+  config.num_threads = 1U;
+  SchedulerStats stats;
+  ASSERT_TRUE(static_cast<bool>(recalc_parallel(wb, registry, config, &stats)));
+  EXPECT_EQ(stats.worker_threads_started, 0U);
+  EXPECT_EQ(stats.worker_threads_used, 0U);
+
+  std::set<std::thread::id> observed;
+  {
+    std::lock_guard<std::mutex> guard(g_worker_thread_probe.mutex);
+    observed = g_worker_thread_probe.ids;
+  }
+  ASSERT_EQ(observed.size(), 1U);
+  EXPECT_EQ(*observed.begin(), caller);
+}
+
+TEST(Scheduler, NestedRecalcFromWorkerReturnsReentrant) {
+  Workbook wb = Workbook::create();
+  FunctionRegistry registry;
+  FunctionDef def{};
+  def.canonical_name = "NESTED_WORKER_RECALC";
+  def.min_arity = 1U;
+  def.max_arity = 1U;
+  def.impl = &WorkerReentryImpl;
+  ASSERT_TRUE(registry.register_function(def));
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(20.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=NESTED_WORKER_RECALC(A1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 1U, 1U, "=NESTED_WORKER_RECALC(A2)")));
+
+  g_worker_reentry_workbook = &wb;
+  g_worker_reentry_code.store(0, std::memory_order_release);
+  SchedulerConfig config;
+  config.num_threads = 4U;
+  const auto outer = recalc_parallel(wb, registry, config, nullptr);
+  g_worker_reentry_workbook = nullptr;
+
+  ASSERT_TRUE(static_cast<bool>(outer));
+  EXPECT_EQ(g_worker_reentry_code.load(std::memory_order_acquire),
+            static_cast<int>(FormulonErrorCode::kGraphRecalcReentrant));
+  EXPECT_DOUBLE_EQ(StoredValue(wb, 0U, 0U, 1U).as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(StoredValue(wb, 0U, 1U, 1U).as_number(), 20.0);
+}
+
+TEST(Scheduler, DeepChainNoParallelism) {
+  // 100-cell deep chain: A1=1, A2=A1+1, ..., A100=A99+1. Every cell is
+  // its own layer (size 1) so parallel_steps must stay 0.
+  WorkbookPair wp;
+  wp.set_value(0, 0, 0, Value::number(1.0));
+  for (std::uint32_t r = 1; r < 100; ++r) {
+    wp.set_formula(0, r, 0, "=A" + std::to_string(r) + "+1");
+  }
+
+  SchedulerStats stats;
+  SchedulerConfig cfg;
+  cfg.num_threads = 8U;
+  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
+  EXPECT_EQ(stats.parallel_steps, 0U);
+  EXPECT_EQ(stats.cells_evaluated, 99U);
+
+  Value last = StoredValue(wp.parallel, 0, 99, 0);
+  ASSERT_TRUE(last.is_number());
+  EXPECT_DOUBLE_EQ(last.as_number(), 100.0);
+
+  RecalcBothAndExpectEqual(wp, 8U);
+}
+
+TEST(Scheduler, DiamondParallelLayer) {
+  // A1 -> B1, A1 -> C1, B1+C1 -> D1.
+  // Layer 0: A1 (literal — not a formula, so no dirty SCC for it).
+  // Layer 1: B1 and C1 (parallel).
+  // Layer 2: D1.
+  WorkbookPair wp;
+  wp.set_value(0, 0, 0, Value::number(10.0));
+  wp.set_formula(0, 0, 1, "=A1*2");
+  wp.set_formula(0, 0, 2, "=A1+5");
+  wp.set_formula(0, 0, 3, "=B1+C1");
+
+  SchedulerStats stats;
+  SchedulerConfig cfg;
+  cfg.num_threads = 8U;
+  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
+  EXPECT_EQ(stats.cells_evaluated, 3U);
+  EXPECT_GE(stats.parallel_steps, 1U);  // The B/C layer.
+
+  Value d1 = StoredValue(wp.parallel, 0, 0, 3);
+  ASSERT_TRUE(d1.is_number());
+  EXPECT_DOUBLE_EQ(d1.as_number(), 35.0);
+
+  RecalcBothAndExpectEqual(wp, 8U);
+}
+
+}  // namespace
+}  // namespace formulon::eval
diff --git a/tests/concurrency/scheduler_reliability_test.cpp b/tests/concurrency/scheduler_reliability_test.cpp
new file mode 100644
index 000000000..212ae6330
--- /dev/null
+++ b/tests/concurrency/scheduler_reliability_test.cpp
@@ -0,0 +1,305 @@
+// Concurrency scheduler tests grouped by fixture size and execution mode.
+// Shared probes and workbook-pair helpers live in scheduler_test_helpers.h.
+
+#include "scheduler_test_helpers.h"
+
+namespace formulon::eval {
+namespace {
+
+using namespace scheduler_test;
+
+// Repeats the wide-independent-layer scenario in a tight loop with the
+// maximum auto-detected pool to give ThreadSanitizer the maximum chance
+// of catching a racy `next_index` claim. Each iteration must produce
+// exactly the same per-cell results — a missed task (e.g. from a
+// premature `relaxed` fetch_add allowing a worker to skip a slot) would
+// surface as a non-numeric / wrong-numeric cached value.
+TEST(SchedulerParallelClaim, WideLayerNoMissedTasksUnderRepeatedRuns) {
+  constexpr std::uint32_t kRows = 64U;
+  constexpr int kIterations = 16;
+  for (int iter = 0; iter < kIterations; ++iter) {
+    Workbook wb = Workbook::create();
+    for (std::uint32_t r = 0; r < kRows; ++r) {
+      ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, r, 0U, Value::number(static_cast<double>(r) + 1.0))));
+    }
+    // Column B: every B<r> reads A<r>. One wide layer of `kRows` super-nodes
+    // all draining through the same `next_index` atomic.
+    for (std::uint32_t r = 0; r < kRows; ++r) {
+      ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, r, 1U, "=A" + std::to_string(r + 1) + "+1")));
+    }
+
+    SchedulerStats stats;
+    SchedulerConfig cfg;
+    cfg.num_threads = 8U;
+    ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
+    // Every formula must have been claimed exactly once.
+    EXPECT_EQ(stats.cells_evaluated, static_cast<std::uint64_t>(kRows)) << "iteration " << iter;
+    EXPECT_GE(stats.parallel_steps, 1U) << "iteration " << iter;
+    EXPECT_EQ(stats.serial_fallback_steps, 0U) << "iteration " << iter;
+
+    for (std::uint32_t r = 0; r < kRows; ++r) {
+      const Value v = StoredValue(wb, 0U, r, 1U);
+      ASSERT_TRUE(v.is_number()) << "iter " << iter << " row " << r;
+      EXPECT_DOUBLE_EQ(v.as_number(), static_cast<double>(r) + 2.0) << "iter " << iter << " row " << r;
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Degradation when the OS refuses worker threads
+// ---------------------------------------------------------------------------
+
+TEST(Scheduler, NoWorkerThreadsFallsBackToSerialEvaluation) {
+  // A host at its thread limit must still complete the recalc. Every
+  // launch is refused here, so the pool starts empty and each layer takes
+  // the calling-thread path; the numbers have to match what the fully
+  // parallel diamond produces.
+  ThreadLaunchInjection injection;
+  WorkbookPair wp;
+  wp.set_value(0, 0, 0, Value::number(10.0));
+  wp.set_formula(0, 0, 1, "=A1*2");
+  wp.set_formula(0, 0, 2, "=A1+5");
+  wp.set_formula(0, 0, 3, "=B1+C1");
+
+  set_thread_launch_failure_after(0U);
+  SchedulerStats stats;
+  SchedulerConfig cfg;
+  cfg.num_threads = 8U;
+  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
+  clear_thread_launch_failure_injection();
+
+  EXPECT_EQ(stats.parallel_steps, 0U) << "no worker was started, so no layer can have been dispatched to the pool";
+  EXPECT_GE(stats.serial_fallback_steps, 1U);
+  EXPECT_EQ(stats.cells_evaluated, 3U);
+  EXPECT_EQ(stats.worker_threads_started, 0U);
+  EXPECT_EQ(stats.worker_threads_used, 0U);
+
+  Value d1 = StoredValue(wp.parallel, 0, 0, 3);
+  ASSERT_TRUE(d1.is_number());
+  EXPECT_DOUBLE_EQ(d1.as_number(), 35.0);
+}
+
+TEST(Scheduler, PartialWorkerLaunchStillDispatchesWideLayers) {
+  // Two workers out of the eight requested: the pass keeps using the pool
+  // for layers wide enough to benefit, just with less of it.
+  ThreadLaunchInjection injection;
+  WorkbookPair wp;
+  wp.set_value(0, 0, 0, Value::number(10.0));
+  wp.set_formula(0, 0, 1, "=A1*2");
+  wp.set_formula(0, 0, 2, "=A1+5");
+  wp.set_formula(0, 0, 3, "=B1+C1");
+
+  set_thread_launch_failure_after(2U);
+  SchedulerStats stats;
+  SchedulerConfig cfg;
+  cfg.num_threads = 8U;
+  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
+  clear_thread_launch_failure_injection();
+
+  EXPECT_GE(stats.parallel_steps, 1U) << "the B/C layer should still reach the two workers that did start";
+  EXPECT_EQ(stats.cells_evaluated, 3U);
+  EXPECT_EQ(stats.worker_threads_started, 2U);
+  EXPECT_GE(stats.worker_threads_used, 1U);
+  EXPECT_LE(stats.worker_threads_used, stats.worker_threads_started);
+
+  Value d1 = StoredValue(wp.parallel, 0, 0, 3);
+  ASSERT_TRUE(d1.is_number());
+  EXPECT_DOUBLE_EQ(d1.as_number(), 35.0);
+
+  // And the degraded pass agrees with a plain serial recalc cell for cell.
+  RecalcBothAndExpectEqual(wp, 8U);
+}
+
+TEST(Scheduler, MixedValueKindsMatchSerialRecalc) {
+  WorkbookPair wp;
+  wp.set_value(0, 0, 0, Value::text("hello"));
+  wp.set_value(0, 0, 1, Value::boolean(true));
+  wp.set_value(0, 0, 2, Value::error(ErrorCode::Name));
+  wp.set_formula(0, 1, 0, "=A1&\" world\"");
+  wp.set_formula(0, 1, 1, "=NOT(B1)");
+  wp.set_formula(0, 1, 2, "=C1");
+
+  RecalcBothAndExpectEqual(wp, 4U);
+}
+
+TEST(Scheduler, CycleRecoveryViaIterativeSolver) {
+  // A1 = (B1 + 10) / 2, B1 = (A1 + 20) / 2. Averaging cycle that
+  // converges. Iterative-calc enabled.
+  Workbook wb = Workbook::create();
+  IterativeOptions opts;
+  opts.enabled = true;
+  opts.max_iterations = 100U;
+  opts.max_change = 1e-6;
+  wb.set_iterative_options(opts);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=(B1+10)/2")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=(A1+20)/2")));
+
+  SchedulerStats stats;
+  SchedulerConfig cfg;
+  cfg.num_threads = 4U;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
+  EXPECT_GE(stats.cycle_recoveries, 1U);
+  EXPECT_EQ(stats.cells_evaluated, 2U);
+}
+
+TEST(Scheduler, ParallelIterativeTextCycleSurvivesArenaResets) {
+  // The SCC is evaluated by one scheduler worker, but each member resets
+  // that worker's Arena before evaluating. Both formulas return the same
+  // Text value while depending on the other cell, so the second sweep must
+  // compare an owned convergence snapshot rather than an arena string_view.
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=IF(B1=1,\"stable\",\"stable\")")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=IF(A1=1,\"stable\",\"stable\")")));
+
+  IterativeOptions opts;
+  opts.enabled = true;
+  opts.max_iterations = 4U;
+  opts.max_change = 0.001;
+  wb.set_iterative_options(opts);
+
+  SchedulerStats stats;
+  SchedulerConfig cfg;
+  cfg.num_threads = 4U;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
+  EXPECT_EQ(stats.cycle_recoveries, 1U);
+  EXPECT_EQ(stats.cells_evaluated, 2U);
+
+  const Value a1 = StoredValue(wb, 0U, 0U, 0U);
+  const Value b1 = StoredValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(a1.is_text());
+  ASSERT_TRUE(b1.is_text());
+  EXPECT_EQ(a1.as_text(), "stable");
+  EXPECT_EQ(b1.as_text(), "stable");
+}
+
+TEST(Scheduler, ZeroThreadsAutoDetectsAndExecutes) {
+  // num_threads = 0 means "auto-detect, capped at 8". The scheduler must
+  // still resolve a sensible worker count and successfully complete.
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1*A1")));
+
+  SchedulerStats stats;
+  SchedulerConfig cfg;  // num_threads = 0 → auto.
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
+  EXPECT_EQ(stats.cells_evaluated, 1U);
+
+  Value b1 = StoredValue(wb, 0, 0, 1);
+  ASSERT_TRUE(b1.is_number());
+  EXPECT_DOUBLE_EQ(b1.as_number(), 4.0);
+}
+
+TEST(Scheduler, NullStatsDoesNotCrash) {
+  // Passing nullptr for `stats` is supported and must not crash.
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(5.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1+10")));
+
+  SchedulerConfig cfg;
+  cfg.num_threads = 4U;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, /*stats=*/nullptr)));
+
+  Value b1 = StoredValue(wb, 0, 0, 1);
+  ASSERT_TRUE(b1.is_number());
+  EXPECT_DOUBLE_EQ(b1.as_number(), 15.0);
+}
+
+TEST(Scheduler, RepeatedRecalcIsIdempotent) {
+  // Running `recalc_parallel` twice in a row with no intervening edits
+  // must produce the same values and zero counters on the second pass
+  // (dirty set was cleared by the first pass).
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(3.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1*7")));
+
+  SchedulerStats stats1;
+  SchedulerConfig cfg;
+  cfg.num_threads = 4U;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats1)));
+  EXPECT_EQ(stats1.cells_evaluated, 1U);
+
+  SchedulerStats stats2;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats2)));
+  // Second pass: nothing dirty, no work.
+  EXPECT_EQ(stats2.cells_evaluated, 0U);
+  EXPECT_EQ(stats2.sccs_processed, 0U);
+
+  Value b1 = StoredValue(wb, 0, 0, 1);
+  ASSERT_TRUE(b1.is_number());
+  EXPECT_DOUBLE_EQ(b1.as_number(), 21.0);
+}
+
+TEST(Scheduler, IncrementalEditPropagates) {
+  // Edit-then-recalc semantics with the parallel engine. Mutate A1 after
+  // the first recalc and confirm B1 reflects the new value.
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1+1")));
+
+  SchedulerConfig cfg;
+  cfg.num_threads = 4U;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, nullptr)));
+  Value b1 = StoredValue(wb, 0, 0, 1);
+  ASSERT_TRUE(b1.is_number());
+  EXPECT_DOUBLE_EQ(b1.as_number(), 3.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, nullptr)));
+  b1 = StoredValue(wb, 0, 0, 1);
+  ASSERT_TRUE(b1.is_number());
+  EXPECT_DOUBLE_EQ(b1.as_number(), 11.0);
+}
+
+TEST(Scheduler, ParallelMatchesSerialOnSimpleWorkbooks) {
+  // Five workbook shapes, each driven through both `recalc()` and
+  // `recalc_parallel()`. Per-cell value equality is asserted by
+  // `RecalcBothAndExpectEqual`.
+
+  {
+    SCOPED_TRACE("shape: linear chain");
+    WorkbookPair wp;
+    wp.set_value(0, 0, 0, Value::number(3.0));
+    wp.set_formula(0, 1, 0, "=A1*2");
+    wp.set_formula(0, 2, 0, "=A2-1");
+    RecalcBothAndExpectEqual(wp, 8U);
+  }
+  {
+    SCOPED_TRACE("shape: range sum");
+    WorkbookPair wp;
+    for (std::uint32_t r = 0; r < 5; ++r) {
+      wp.set_value(0, r, 0, Value::number(static_cast<double>(r + 1)));
+    }
+    wp.set_formula(0, 0, 1, "=SUM(A1:A5)");
+    RecalcBothAndExpectEqual(wp, 4U);
+  }
+  {
+    SCOPED_TRACE("shape: diamond");
+    WorkbookPair wp;
+    wp.set_value(0, 0, 0, Value::number(7.0));
+    wp.set_formula(0, 0, 1, "=A1+1");
+    wp.set_formula(0, 0, 2, "=A1*3");
+    wp.set_formula(0, 0, 3, "=B1+C1");
+    RecalcBothAndExpectEqual(wp, 4U);
+  }
+  {
+    SCOPED_TRACE("shape: text concat chain");
+    WorkbookPair wp;
+    wp.set_value(0, 0, 0, Value::number(5.0));
+    wp.set_formula(0, 1, 0, "=A1+10");
+    wp.set_formula(0, 2, 0, "=IF(A2>10, 1, 0)");
+    RecalcBothAndExpectEqual(wp, 8U);
+  }
+  {
+    SCOPED_TRACE("shape: wide layer");
+    WorkbookPair wp;
+    for (std::uint32_t r = 0; r < 20; ++r) {
+      wp.set_value(0, r, 0, Value::number(static_cast<double>(r)));
+      wp.set_formula(0, r, 1, "=A" + std::to_string(r + 1) + "+1");
+    }
+    RecalcBothAndExpectEqual(wp, 8U);
+  }
+}
+
+}  // namespace
+}  // namespace formulon::eval
diff --git a/tests/concurrency/scheduler_stress_test.cpp b/tests/concurrency/scheduler_stress_test.cpp
new file mode 100644
index 000000000..c0e790565
--- /dev/null
+++ b/tests/concurrency/scheduler_stress_test.cpp
@@ -0,0 +1,88 @@
+// Concurrency scheduler tests grouped by fixture size and execution mode.
+// Shared probes and workbook-pair helpers live in scheduler_test_helpers.h.
+
+#include <random>
+
+#include "scheduler_test_helpers.h"
+
+namespace formulon::eval {
+namespace {
+
+using namespace scheduler_test;
+
+TEST(SchedulerSlow, StressRandomDag) {
+  // 200-cell random DAG, run 50 times. Each run rebuilds the workbook from
+  // scratch and asserts every cell matches the single-threaded recalc.
+  // Kept comfortably under the SLOW timeout budget (120 s).
+  constexpr std::uint32_t kCellCount = 200U;
+  constexpr int kIterations = 50;
+
+  std::mt19937 rng(0xCAFEBABEU);
+
+  for (int iter = 0; iter < kIterations; ++iter) {
+    WorkbookPair wp;
+    // Seed cells: rows 0..9 are numeric literals 1..10.
+    for (std::uint32_t r = 0; r < 10; ++r) {
+      wp.set_value(0, r, 0, Value::number(static_cast<double>(r + 1)));
+    }
+    // Subsequent cells reference up to 3 earlier rows in column A.
+    for (std::uint32_t r = 10; r < kCellCount; ++r) {
+      std::uniform_int_distribution<std::uint32_t> pick(0U, r - 1U);
+      const std::uint32_t a = pick(rng);
+      const std::uint32_t b = pick(rng);
+      const std::string formula = "=A" + std::to_string(a + 1) + "+A" + std::to_string(b + 1);
+      wp.set_formula(0, r, 0, formula);
+    }
+
+    SchedulerConfig cfg;
+    cfg.num_threads = 8U;
+    ASSERT_TRUE(static_cast<bool>(wp.serial.recalc(default_registry())));
+    ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, nullptr)));
+
+    for (std::uint32_t r = 0; r < kCellCount; ++r) {
+      Value vs = StoredValue(wp.serial, 0, r, 0);
+      Value vp = StoredValue(wp.parallel, 0, r, 0);
+      ASSERT_EQ(vs.kind(), vp.kind()) << "iter=" << iter << " r=" << r;
+      if (vs.is_number()) {
+        ASSERT_DOUBLE_EQ(vs.as_number(), vp.as_number()) << "iter=" << iter << " r=" << r;
+      }
+    }
+  }
+}
+
+// Two independent dynamic-array formulas on the same sheet in the same
+// parallel layer, with disjoint spill footprints, evaluated repeatedly
+// under a 4-thread pool. Each formula spills through `Sheet::commit_spill`
+// / `Sheet::resolve_cell_value`, which mutate and read the sheet's spill
+// table and row store. Run under ThreadSanitizer this is the race-detection
+// fixture for concurrent spill commits on a shared sheet; the value
+// assertions also catch a lost / torn spill (a phantom reading back as
+// #SPILL! or blank).
+TEST(SchedulerSlow, ParallelSpillNoDataRace) {
+  constexpr int kIterations = 40;
+  for (int iter = 0; iter < kIterations; ++iter) {
+    Workbook wb = Workbook::create();
+    // A1 spills A1:A4 = {1, 2, 3, 4}.
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(4,1)"))) << "iter " << iter;
+    // C1 spills C1:C4 = {2, 4, 6, 8}. Disjoint footprint from column A.
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=SEQUENCE(4,1)*2"))) << "iter " << iter;
+
+    SchedulerConfig cfg;
+    cfg.num_threads = 4U;
+    ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, nullptr))) << "iter " << iter;
+
+    const Sheet& s = wb.sheet(0);
+    for (std::uint32_t r = 0; r < 4U; ++r) {
+      const Value a = s.resolve_cell_value(r, 0U);
+      ASSERT_TRUE(a.is_number()) << "iter " << iter << " A row " << r << " kind=" << static_cast<int>(a.kind());
+      EXPECT_DOUBLE_EQ(a.as_number(), static_cast<double>(r + 1U)) << "iter " << iter << " A row " << r;
+
+      const Value c = s.resolve_cell_value(r, 2U);
+      ASSERT_TRUE(c.is_number()) << "iter " << iter << " C row " << r << " kind=" << static_cast<int>(c.kind());
+      EXPECT_DOUBLE_EQ(c.as_number(), static_cast<double>((r + 1U) * 2U)) << "iter " << iter << " C row " << r;
+    }
+  }
+}
+
+}  // namespace
+}  // namespace formulon::eval
diff --git a/tests/concurrency/scheduler_test.cpp b/tests/concurrency/scheduler_test.cpp
index 104535a0e..4820d9647 100644
--- a/tests/concurrency/scheduler_test.cpp
+++ b/tests/concurrency/scheduler_test.cpp
@@ -1,197 +1,12 @@
-//
-// Concurrency tests for the parallel SCC-layered recalc scheduler.
-//
-// These tests build small workbook fixtures that exercise the layering
-// algorithm (linear chains, wide independent layers, diamonds, cycles)
-// and assert that:
-//
-//   * `recalc_parallel` produces the same per-cell results as the
-//     single-threaded `recalc()` engine;
-//   * the per-pass `SchedulerStats` counters are consistent with the
-//     dep-graph topology (parallel layers vs serial fallback);
-//   * cyclic SCCs route through the iterative solver and bump the
-//     `cycle_recoveries` counter on convergence.
-//
-// The slow stress test (`StressRandomDag`, label `SLOW`) drives a
-// larger random DAG many times and is the primary safety net for race
-// detection under ThreadSanitizer.
+// Concurrency scheduler tests grouped by fixture size and execution mode.
+// Shared probes and workbook-pair helpers live in scheduler_test_helpers.h.
 
-#include "eval/scheduler.h"
-
-#include <atomic>
-#include <chrono>
-#include <condition_variable>
-#include <cstdint>
-#include <mutex>
-#include <random>
-#include <set>
-#include <string>
-#include <thread>
-#include <vector>
-
-#include "cell.h"
-#include "eval/function_registry.h"
-#include "eval/iterative_solver.h"
-#include "eval/recalc_engine.h"
-#include "eval/volatile_tracker.h"
-#include "gtest/gtest.h"
-#include "sheet.h"
-#include "utils/thread_launch.h"
-#include "value.h"
-#include "workbook.h"
+#include "scheduler_test_helpers.h"
 
 namespace formulon::eval {
 namespace {
 
-/// Clears any injected thread-launch failure when the test leaves scope.
-/// Without this an assertion that aborts a degradation test mid-way would
-/// leave every later test unable to start a worker.
-struct ThreadLaunchInjection {
-  ~ThreadLaunchInjection() { clear_thread_launch_failure_injection(); }
-};
-
-Value StoredValue(const Workbook& wb, std::size_t sheet_index, std::uint32_t row, std::uint32_t col) {
-  const Sheet& s = wb.sheet(sheet_index);
-  if (const Cell* c = s.cell_at(row, col); c != nullptr) {
-    return c->cached_value;
-  }
-  return Value::blank();
-}
-
-struct ProgressAbortAfter {
-  std::atomic<std::uint32_t> calls{0U};
-  std::uint32_t abort_after = 0U;
-};
-
-struct ProgressThreadProbe {
-  std::thread::id caller;
-  std::mutex mutex;
-  std::vector<std::thread::id> callback_threads;
-};
-
-bool RecordIterativeProgressThread(std::uint32_t /*iteration*/, double /*max_residual*/,
-                                   std::uint32_t /*max_iterations*/, void* user_data) {
-  auto* probe = static_cast<ProgressThreadProbe*>(user_data);
-  std::lock_guard<std::mutex> guard(probe->mutex);
-  probe->callback_threads.push_back(std::this_thread::get_id());
-  return true;
-}
-
-struct WorkerThreadProbe {
-  std::condition_variable condition;
-  std::mutex mutex;
-  std::set<std::thread::id> ids;
-  bool synchronize = false;
-  bool released = true;
-  bool timed_out = false;
-};
-
-WorkerThreadProbe g_worker_thread_probe;
-
-void ResetWorkerThreadProbe(bool synchronize) {
-  std::lock_guard<std::mutex> guard(g_worker_thread_probe.mutex);
-  g_worker_thread_probe.ids.clear();
-  g_worker_thread_probe.synchronize = synchronize;
-  g_worker_thread_probe.released = !synchronize;
-  g_worker_thread_probe.timed_out = false;
-}
-
-Value RecordWorkerThreadImpl(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
-  if (arity != 1U) {
-    return Value::error(ErrorCode::Value);
-  }
-  std::unique_lock<std::mutex> lock(g_worker_thread_probe.mutex);
-  g_worker_thread_probe.ids.insert(std::this_thread::get_id());
-  if (g_worker_thread_probe.synchronize && !g_worker_thread_probe.released) {
-    // Keep the first worker occupied until a sibling SCC reaches this same
-    // rendezvous. The bounded deadline only prevents a deadlock if the host
-    // unexpectedly launches fewer workers than the fixture requests.
-    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(1);
-    while (!g_worker_thread_probe.released && g_worker_thread_probe.ids.size() < 2U) {
-      if (g_worker_thread_probe.condition.wait_until(lock, deadline) == std::cv_status::timeout) {
-        g_worker_thread_probe.timed_out = true;
-        g_worker_thread_probe.released = true;
-        g_worker_thread_probe.condition.notify_all();
-        break;
-      }
-    }
-    if (g_worker_thread_probe.ids.size() >= 2U && !g_worker_thread_probe.released) {
-      g_worker_thread_probe.released = true;
-      g_worker_thread_probe.condition.notify_all();
-    }
-  }
-  return args[0];
-}
-
-Workbook* g_worker_reentry_workbook = nullptr;
-std::atomic<int> g_worker_reentry_code{0};
-
-Value WorkerReentryImpl(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
-  if (arity != 1U || g_worker_reentry_workbook == nullptr) {
-    return Value::error(ErrorCode::Value);
-  }
-  SchedulerConfig config;
-  config.num_threads = 1U;
-  const auto nested = g_worker_reentry_workbook->recalc_parallel(default_registry(), config, nullptr);
-  g_worker_reentry_code.store(nested ? static_cast<int>(FormulonErrorCode::kOk) : static_cast<int>(nested.error().code),
-                              std::memory_order_release);
-  return args[0];
-}
-
-bool AbortIterativeSolve(std::uint32_t /*iteration*/, double /*max_residual*/, std::uint32_t /*max_iterations*/,
-                         void* user_data) {
-  auto* progress = static_cast<ProgressAbortAfter*>(user_data);
-  return progress->calls.fetch_add(1U, std::memory_order_relaxed) + 1U < progress->abort_after;
-}
-
-// Builds two sibling workbooks and applies the same edits to both. Used
-// by tests that run a recalc on one and `recalc_parallel` on the other,
-// then compare cell values to confirm bit-for-bit equality.
-struct WorkbookPair {
-  Workbook serial;
-  Workbook parallel;
-
-  WorkbookPair() : serial(Workbook::create()), parallel(Workbook::create()) {}
-
-  void set_value(std::size_t sheet, std::uint32_t row, std::uint32_t col, Value v) {
-    ASSERT_TRUE(static_cast<bool>(serial.set_cell_value(sheet, row, col, v)));
-    ASSERT_TRUE(static_cast<bool>(parallel.set_cell_value(sheet, row, col, v)));
-  }
-
-  void set_formula(std::size_t sheet, std::uint32_t row, std::uint32_t col, std::string formula) {
-    ASSERT_TRUE(static_cast<bool>(serial.set_cell_formula(sheet, row, col, formula)));
-    ASSERT_TRUE(static_cast<bool>(parallel.set_cell_formula(sheet, row, col, formula)));
-  }
-};
-
-// Recalcs both members and asserts every cell in the populated rows of
-// the serial sheet matches the parallel one. Cell-level equality uses
-// `Value::operator==` (defined for the Value variant); arrays / spills
-// are compared via `resolve_cell_value`.
-void RecalcBothAndExpectEqual(WorkbookPair& wp, std::uint32_t threads = 4U) {
-  ASSERT_TRUE(static_cast<bool>(wp.serial.recalc(default_registry())));
-  SchedulerConfig cfg;
-  cfg.num_threads = threads;
-  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, nullptr)));
-
-  ASSERT_EQ(wp.serial.sheet_count(), wp.parallel.sheet_count());
-  for (std::size_t s = 0; s < wp.serial.sheet_count(); ++s) {
-    const Sheet& a = wp.serial.sheet(s);
-    const Sheet& b = wp.parallel.sheet(s);
-    for (const auto& [row, cells] : a.rows()) {
-      for (std::uint32_t col = 0; col < cells.size(); ++col) {
-        Value va = cells[col].cached_value;
-        Value vb = StoredValue(wp.parallel, s, row, col);
-        EXPECT_EQ(va, vb) << "value mismatch at (" << row << ", " << col << ")";
-      }
-    }
-    (void)b;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Empty / trivial workbooks
-// ---------------------------------------------------------------------------
+using namespace scheduler_test;
 
 TEST(Scheduler, EmptyWorkbookProducesZeroStats) {
   Workbook wb = Workbook::create();
@@ -301,701 +116,5 @@ TEST(Scheduler, IterativeProgressCallbackRunsOnCallerThread) {
   EXPECT_NEAR(c1.as_number(), 2000.0, 1e-4);
 }
 
-// ---------------------------------------------------------------------------
-// Topology-specific tests
-// ---------------------------------------------------------------------------
-
-TEST(Scheduler, TwoCellChainSerialLayers) {
-  // A1 = 1, B1 = =A1+1. Two layers, each of size 1 -> serial dispatch on
-  // both. parallel_steps must remain 0.
-  WorkbookPair wp;
-  wp.set_value(0, 0, 0, Value::number(1.0));
-  wp.set_formula(0, 0, 1, "=A1+1");
-
-  SchedulerStats stats;
-  SchedulerConfig cfg;
-  cfg.num_threads = 8U;
-  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
-  EXPECT_EQ(stats.parallel_steps, 0U);
-  // The single dirty SCC (B1) is dispatched serially.
-  EXPECT_GE(stats.serial_fallback_steps, 1U);
-
-  Value b1 = StoredValue(wp.parallel, 0, 0, 1);
-  ASSERT_TRUE(b1.is_number());
-  EXPECT_DOUBLE_EQ(b1.as_number(), 2.0);
-}
-
-TEST(Scheduler, WideIndependentLayer) {
-  // 100 independent literals A1..A100. No dependencies among them, so a
-  // single layer of 100 super-nodes is dispatched in parallel. There are
-  // no formulas to evaluate (the cells are all literals), so this case
-  // primarily exercises the dirty-set / scheduler bookkeeping with a
-  // wide layer.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 100; ++r) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, r, 0U, Value::number(static_cast<double>(r)))));
-  }
-  // Now add 100 formulas in column B that each read one A cell — this
-  // gives a layer of 100 independent super-nodes.
-  for (std::uint32_t r = 0; r < 100; ++r) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, r, 1U, "=A" + std::to_string(r + 1) + "*2")));
-  }
-
-  SchedulerStats stats;
-  SchedulerConfig cfg;
-  cfg.num_threads = 8U;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
-  EXPECT_EQ(stats.cells_evaluated, 100U);
-  EXPECT_GE(stats.parallel_steps, 1U);
-  EXPECT_GE(stats.worker_threads_started, 2U);
-  EXPECT_GE(stats.worker_threads_used, 1U);
-
-  for (std::uint32_t r = 0; r < 100; ++r) {
-    Value v = StoredValue(wb, 0U, r, 1U);
-    ASSERT_TRUE(v.is_number()) << "row " << r;
-    EXPECT_DOUBLE_EQ(v.as_number(), static_cast<double>(r) * 2.0);
-  }
-}
-
-TEST(Scheduler, WideLayerExecutesOnDistinctWorkerThreads) {
-  Workbook wb = Workbook::create();
-  FunctionRegistry registry;
-  FunctionDef def{};
-  def.canonical_name = "RECORD_WORKER_THREAD";
-  def.min_arity = 1U;
-  def.max_arity = 1U;
-  def.impl = &RecordWorkerThreadImpl;
-  ASSERT_TRUE(registry.register_function(def));
-
-  ResetWorkerThreadProbe(/*synchronize=*/true);
-
-  constexpr std::uint32_t kRows = 16U;
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, row, 0U, Value::number(static_cast<double>(row + 1U)))));
-    ASSERT_TRUE(static_cast<bool>(
-        wb.set_cell_formula(0U, row, 1U, "=RECORD_WORKER_THREAD(A" + std::to_string(row + 1U) + ")")));
-  }
-
-  SchedulerConfig config;
-  config.num_threads = 4U;
-  SchedulerStats stats;
-  ASSERT_TRUE(static_cast<bool>(recalc_parallel(wb, registry, config, &stats)));
-  EXPECT_GE(stats.worker_threads_started, 2U);
-  EXPECT_GE(stats.worker_threads_used, 2U);
-  EXPECT_GE(stats.parallel_steps, 1U);
-
-  std::set<std::thread::id> observed_threads;
-  bool timed_out = false;
-  {
-    std::lock_guard<std::mutex> guard(g_worker_thread_probe.mutex);
-    observed_threads = g_worker_thread_probe.ids;
-    timed_out = g_worker_thread_probe.timed_out;
-  }
-  EXPECT_FALSE(timed_out);
-  EXPECT_GE(observed_threads.size(), 2U);
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    const Value value = StoredValue(wb, 0U, row, 1U);
-    ASSERT_TRUE(value.is_number()) << "row " << row;
-    EXPECT_DOUBLE_EQ(value.as_number(), static_cast<double>(row + 1U));
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Volatility classes and the layer split
-// ---------------------------------------------------------------------------
-
-TEST(Scheduler, ValueVolatileLayerStaysOnThePool) {
-  // `RAND` re-fires every pass but reads nothing, so the layering derived
-  // from the dependency edges is complete and every one of these cells is
-  // poolable. A pass must therefore dispatch the layer to the workers and
-  // leave no serial tail behind: if the scheduler ever went back to
-  // isolating value volatility, `pooled` would be empty here and the whole
-  // layer would fall to the caller, flipping both counters.
-  constexpr std::uint32_t kRows = 64U;
-  Workbook wb = Workbook::create();
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, row, 0U, "=RAND()*0+1")));
-  }
-
-  SchedulerConfig cfg;
-  cfg.num_threads = 4U;
-  SchedulerStats stats;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
-
-  EXPECT_EQ(stats.cells_evaluated, kRows);
-  EXPECT_EQ(stats.parallel_steps, 1U);
-  EXPECT_EQ(stats.serial_fallback_steps, 0U);
-  EXPECT_GE(stats.worker_threads_used, 1U);
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    const Value v = StoredValue(wb, 0U, row, 0U);
-    ASSERT_TRUE(v.is_number()) << "row " << row;
-    EXPECT_DOUBLE_EQ(v.as_number(), 1.0) << "row " << row;
-  }
-}
-
-TEST(Scheduler, DynamicReferenceLayerLeavesThePoolButValueVolatileDoesNot) {
-  // One layer holding both classes and nothing else: the `INDIRECT` half
-  // must be the serial tail, the `RAND` half must be the pooled body.
-  // Column A is settled before the measured pass so it contributes no
-  // super-node — re-merging the classes would leave the pool with nothing
-  // to do and drop `parallel_steps` to zero. The tracker assertions pin
-  // which cell landed in which class.
-  constexpr std::uint32_t kRows = 32U;
-  Workbook wb = Workbook::create();
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, row, 0U, Value::number(static_cast<double>(row)))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, row, 1U, "=RAND()*0+1")));
-    ASSERT_TRUE(
-        static_cast<bool>(wb.set_cell_formula(0U, row, 2U, "=INDIRECT(\"A" + std::to_string(row + 1U) + "\")")));
-  }
-
-  SchedulerConfig cfg;
-  cfg.num_threads = 4U;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, nullptr)));
-
-  SchedulerStats stats;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
-  EXPECT_EQ(stats.cells_evaluated, 2U * kRows);
-  EXPECT_EQ(stats.sccs_processed, 2U * kRows);
-  EXPECT_EQ(stats.parallel_steps, 1U);
-  EXPECT_EQ(stats.serial_fallback_steps, 1U);
-
-  const VolatileTracker& volatiles = wb.recalc_engine().volatiles();
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    const CellNodeId value_volatile{0U, row, 1U};
-    const CellNodeId dynamic_volatile{0U, row, 2U};
-    EXPECT_TRUE(volatiles.contains(value_volatile)) << "row " << row;
-    EXPECT_FALSE(volatiles.contains_dynamic_reference(value_volatile)) << "row " << row;
-    EXPECT_TRUE(volatiles.contains(dynamic_volatile)) << "row " << row;
-    EXPECT_TRUE(volatiles.contains_dynamic_reference(dynamic_volatile)) << "row " << row;
-
-    const Value value_result = StoredValue(wb, 0U, row, 1U);
-    ASSERT_TRUE(value_result.is_number()) << "row " << row;
-    EXPECT_DOUBLE_EQ(value_result.as_number(), 1.0) << "row " << row;
-    const Value dynamic_result = StoredValue(wb, 0U, row, 2U);
-    ASSERT_TRUE(dynamic_result.is_number()) << "row " << row;
-    EXPECT_DOUBLE_EQ(dynamic_result.as_number(), static_cast<double>(row)) << "row " << row;
-  }
-}
-
-TEST(Scheduler, MixedVolatilityClassesMatchSerialRecalc) {
-  // Both classes in one workbook, with every value-volatile result folded
-  // back to a fixed number so an ordering difference cannot hide behind a
-  // legitimately changing value. Column A is the target the dynamic
-  // references resolve to at evaluation time.
-  constexpr std::uint32_t kRows = 48U;
-  WorkbookPair wp;
-  wp.set_value(0, 0, 4, Value::number(0.0));  // E1: the OFFSET base.
-  for (std::uint32_t row = 0U; row < kRows; ++row) {
-    const std::string row_1based = std::to_string(row + 1U);
-    wp.set_formula(0, row, 0, "=RAND()*0+" + row_1based);
-    wp.set_formula(0, row, 1, "=INDIRECT(\"A" + row_1based + "\")");
-    wp.set_formula(0, row, 2, "=IF(NOW()>0,A" + row_1based + ",-1)");
-    wp.set_formula(0, row, 3, "=OFFSET($E$1," + std::to_string(row) + ",-4)");
-  }
-
-  SchedulerConfig cfg;
-  cfg.num_threads = 4U;
-  // Settling pass: no edge orders a dynamic reference against the cell it
-  // reads, so only the steady state is comparable across engines.
-  ASSERT_TRUE(static_cast<bool>(wp.serial.recalc(default_registry())));
-  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, nullptr)));
-
-  for (std::uint32_t pass = 0U; pass < 4U; ++pass) {
-    ASSERT_TRUE(static_cast<bool>(wp.serial.recalc(default_registry())));
-    ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, nullptr)));
-    for (std::uint32_t row = 0U; row < kRows; ++row) {
-      for (std::uint32_t col = 0U; col < 4U; ++col) {
-        const Value expected = StoredValue(wp.serial, 0U, row, col);
-        ASSERT_TRUE(expected.is_number()) << "pass " << pass << " at (" << row << ", " << col << ")";
-        EXPECT_DOUBLE_EQ(expected.as_number(), static_cast<double>(row + 1U))
-            << "pass " << pass << " at (" << row << ", " << col << ")";
-        EXPECT_EQ(expected, StoredValue(wp.parallel, 0U, row, col))
-            << "pass " << pass << " value mismatch at (" << row << ", " << col << ")";
-      }
-    }
-  }
-}
-
-TEST(Scheduler, SingleThreadConfigKeepsEvaluationOnCaller) {
-  Workbook wb = Workbook::create();
-  FunctionRegistry registry;
-  FunctionDef def{};
-  def.canonical_name = "RECORD_CALLER_THREAD";
-  def.min_arity = 1U;
-  def.max_arity = 1U;
-  def.impl = &RecordWorkerThreadImpl;
-  ASSERT_TRUE(registry.register_function(def));
-
-  ResetWorkerThreadProbe(/*synchronize=*/false);
-  const std::thread::id caller = std::this_thread::get_id();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(3.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=RECORD_CALLER_THREAD(A1)")));
-
-  SchedulerConfig config;
-  config.num_threads = 1U;
-  SchedulerStats stats;
-  ASSERT_TRUE(static_cast<bool>(recalc_parallel(wb, registry, config, &stats)));
-  EXPECT_EQ(stats.worker_threads_started, 0U);
-  EXPECT_EQ(stats.worker_threads_used, 0U);
-
-  std::set<std::thread::id> observed;
-  {
-    std::lock_guard<std::mutex> guard(g_worker_thread_probe.mutex);
-    observed = g_worker_thread_probe.ids;
-  }
-  ASSERT_EQ(observed.size(), 1U);
-  EXPECT_EQ(*observed.begin(), caller);
-}
-
-TEST(Scheduler, NestedRecalcFromWorkerReturnsReentrant) {
-  Workbook wb = Workbook::create();
-  FunctionRegistry registry;
-  FunctionDef def{};
-  def.canonical_name = "NESTED_WORKER_RECALC";
-  def.min_arity = 1U;
-  def.max_arity = 1U;
-  def.impl = &WorkerReentryImpl;
-  ASSERT_TRUE(registry.register_function(def));
-
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(20.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=NESTED_WORKER_RECALC(A1)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 1U, 1U, "=NESTED_WORKER_RECALC(A2)")));
-
-  g_worker_reentry_workbook = &wb;
-  g_worker_reentry_code.store(0, std::memory_order_release);
-  SchedulerConfig config;
-  config.num_threads = 4U;
-  const auto outer = recalc_parallel(wb, registry, config, nullptr);
-  g_worker_reentry_workbook = nullptr;
-
-  ASSERT_TRUE(static_cast<bool>(outer));
-  EXPECT_EQ(g_worker_reentry_code.load(std::memory_order_acquire),
-            static_cast<int>(FormulonErrorCode::kGraphRecalcReentrant));
-  EXPECT_DOUBLE_EQ(StoredValue(wb, 0U, 0U, 1U).as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(StoredValue(wb, 0U, 1U, 1U).as_number(), 20.0);
-}
-
-// Repeats the wide-independent-layer scenario in a tight loop with the
-// maximum auto-detected pool to give ThreadSanitizer the maximum chance
-// of catching a racy `next_index` claim. Each iteration must produce
-// exactly the same per-cell results — a missed task (e.g. from a
-// premature `relaxed` fetch_add allowing a worker to skip a slot) would
-// surface as a non-numeric / wrong-numeric cached value.
-TEST(SchedulerParallelClaim, WideLayerNoMissedTasksUnderRepeatedRuns) {
-  constexpr std::uint32_t kRows = 64U;
-  constexpr int kIterations = 16;
-  for (int iter = 0; iter < kIterations; ++iter) {
-    Workbook wb = Workbook::create();
-    for (std::uint32_t r = 0; r < kRows; ++r) {
-      ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, r, 0U, Value::number(static_cast<double>(r) + 1.0))));
-    }
-    // Column B: every B<r> reads A<r>. One wide layer of `kRows` super-nodes
-    // all draining through the same `next_index` atomic.
-    for (std::uint32_t r = 0; r < kRows; ++r) {
-      ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, r, 1U, "=A" + std::to_string(r + 1) + "+1")));
-    }
-
-    SchedulerStats stats;
-    SchedulerConfig cfg;
-    cfg.num_threads = 8U;
-    ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
-    // Every formula must have been claimed exactly once.
-    EXPECT_EQ(stats.cells_evaluated, static_cast<std::uint64_t>(kRows)) << "iteration " << iter;
-    EXPECT_GE(stats.parallel_steps, 1U) << "iteration " << iter;
-    EXPECT_EQ(stats.serial_fallback_steps, 0U) << "iteration " << iter;
-
-    for (std::uint32_t r = 0; r < kRows; ++r) {
-      const Value v = StoredValue(wb, 0U, r, 1U);
-      ASSERT_TRUE(v.is_number()) << "iter " << iter << " row " << r;
-      EXPECT_DOUBLE_EQ(v.as_number(), static_cast<double>(r) + 2.0) << "iter " << iter << " row " << r;
-    }
-  }
-}
-
-TEST(Scheduler, DeepChainNoParallelism) {
-  // 100-cell deep chain: A1=1, A2=A1+1, ..., A100=A99+1. Every cell is
-  // its own layer (size 1) so parallel_steps must stay 0.
-  WorkbookPair wp;
-  wp.set_value(0, 0, 0, Value::number(1.0));
-  for (std::uint32_t r = 1; r < 100; ++r) {
-    wp.set_formula(0, r, 0, "=A" + std::to_string(r) + "+1");
-  }
-
-  SchedulerStats stats;
-  SchedulerConfig cfg;
-  cfg.num_threads = 8U;
-  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
-  EXPECT_EQ(stats.parallel_steps, 0U);
-  EXPECT_EQ(stats.cells_evaluated, 99U);
-
-  Value last = StoredValue(wp.parallel, 0, 99, 0);
-  ASSERT_TRUE(last.is_number());
-  EXPECT_DOUBLE_EQ(last.as_number(), 100.0);
-
-  RecalcBothAndExpectEqual(wp, 8U);
-}
-
-TEST(Scheduler, DiamondParallelLayer) {
-  // A1 -> B1, A1 -> C1, B1+C1 -> D1.
-  // Layer 0: A1 (literal — not a formula, so no dirty SCC for it).
-  // Layer 1: B1 and C1 (parallel).
-  // Layer 2: D1.
-  WorkbookPair wp;
-  wp.set_value(0, 0, 0, Value::number(10.0));
-  wp.set_formula(0, 0, 1, "=A1*2");
-  wp.set_formula(0, 0, 2, "=A1+5");
-  wp.set_formula(0, 0, 3, "=B1+C1");
-
-  SchedulerStats stats;
-  SchedulerConfig cfg;
-  cfg.num_threads = 8U;
-  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
-  EXPECT_EQ(stats.cells_evaluated, 3U);
-  EXPECT_GE(stats.parallel_steps, 1U);  // The B/C layer.
-
-  Value d1 = StoredValue(wp.parallel, 0, 0, 3);
-  ASSERT_TRUE(d1.is_number());
-  EXPECT_DOUBLE_EQ(d1.as_number(), 35.0);
-
-  RecalcBothAndExpectEqual(wp, 8U);
-}
-
-// ---------------------------------------------------------------------------
-// Degradation when the OS refuses worker threads
-// ---------------------------------------------------------------------------
-
-TEST(Scheduler, NoWorkerThreadsFallsBackToSerialEvaluation) {
-  // A host at its thread limit must still complete the recalc. Every
-  // launch is refused here, so the pool starts empty and each layer takes
-  // the calling-thread path; the numbers have to match what the fully
-  // parallel diamond produces.
-  ThreadLaunchInjection injection;
-  WorkbookPair wp;
-  wp.set_value(0, 0, 0, Value::number(10.0));
-  wp.set_formula(0, 0, 1, "=A1*2");
-  wp.set_formula(0, 0, 2, "=A1+5");
-  wp.set_formula(0, 0, 3, "=B1+C1");
-
-  set_thread_launch_failure_after(0U);
-  SchedulerStats stats;
-  SchedulerConfig cfg;
-  cfg.num_threads = 8U;
-  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
-  clear_thread_launch_failure_injection();
-
-  EXPECT_EQ(stats.parallel_steps, 0U) << "no worker was started, so no layer can have been dispatched to the pool";
-  EXPECT_GE(stats.serial_fallback_steps, 1U);
-  EXPECT_EQ(stats.cells_evaluated, 3U);
-  EXPECT_EQ(stats.worker_threads_started, 0U);
-  EXPECT_EQ(stats.worker_threads_used, 0U);
-
-  Value d1 = StoredValue(wp.parallel, 0, 0, 3);
-  ASSERT_TRUE(d1.is_number());
-  EXPECT_DOUBLE_EQ(d1.as_number(), 35.0);
-}
-
-TEST(Scheduler, PartialWorkerLaunchStillDispatchesWideLayers) {
-  // Two workers out of the eight requested: the pass keeps using the pool
-  // for layers wide enough to benefit, just with less of it.
-  ThreadLaunchInjection injection;
-  WorkbookPair wp;
-  wp.set_value(0, 0, 0, Value::number(10.0));
-  wp.set_formula(0, 0, 1, "=A1*2");
-  wp.set_formula(0, 0, 2, "=A1+5");
-  wp.set_formula(0, 0, 3, "=B1+C1");
-
-  set_thread_launch_failure_after(2U);
-  SchedulerStats stats;
-  SchedulerConfig cfg;
-  cfg.num_threads = 8U;
-  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, &stats)));
-  clear_thread_launch_failure_injection();
-
-  EXPECT_GE(stats.parallel_steps, 1U) << "the B/C layer should still reach the two workers that did start";
-  EXPECT_EQ(stats.cells_evaluated, 3U);
-  EXPECT_EQ(stats.worker_threads_started, 2U);
-  EXPECT_GE(stats.worker_threads_used, 1U);
-  EXPECT_LE(stats.worker_threads_used, stats.worker_threads_started);
-
-  Value d1 = StoredValue(wp.parallel, 0, 0, 3);
-  ASSERT_TRUE(d1.is_number());
-  EXPECT_DOUBLE_EQ(d1.as_number(), 35.0);
-
-  // And the degraded pass agrees with a plain serial recalc cell for cell.
-  RecalcBothAndExpectEqual(wp, 8U);
-}
-
-TEST(Scheduler, MixedValueKindsMatchSerialRecalc) {
-  WorkbookPair wp;
-  wp.set_value(0, 0, 0, Value::text("hello"));
-  wp.set_value(0, 0, 1, Value::boolean(true));
-  wp.set_value(0, 0, 2, Value::error(ErrorCode::Name));
-  wp.set_formula(0, 1, 0, "=A1&\" world\"");
-  wp.set_formula(0, 1, 1, "=NOT(B1)");
-  wp.set_formula(0, 1, 2, "=C1");
-
-  RecalcBothAndExpectEqual(wp, 4U);
-}
-
-TEST(Scheduler, CycleRecoveryViaIterativeSolver) {
-  // A1 = (B1 + 10) / 2, B1 = (A1 + 20) / 2. Averaging cycle that
-  // converges. Iterative-calc enabled.
-  Workbook wb = Workbook::create();
-  IterativeOptions opts;
-  opts.enabled = true;
-  opts.max_iterations = 100U;
-  opts.max_change = 1e-6;
-  wb.set_iterative_options(opts);
-
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=(B1+10)/2")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=(A1+20)/2")));
-
-  SchedulerStats stats;
-  SchedulerConfig cfg;
-  cfg.num_threads = 4U;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
-  EXPECT_GE(stats.cycle_recoveries, 1U);
-  EXPECT_EQ(stats.cells_evaluated, 2U);
-}
-
-TEST(Scheduler, ParallelIterativeTextCycleSurvivesArenaResets) {
-  // The SCC is evaluated by one scheduler worker, but each member resets
-  // that worker's Arena before evaluating. Both formulas return the same
-  // Text value while depending on the other cell, so the second sweep must
-  // compare an owned convergence snapshot rather than an arena string_view.
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=IF(B1=1,\"stable\",\"stable\")")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=IF(A1=1,\"stable\",\"stable\")")));
-
-  IterativeOptions opts;
-  opts.enabled = true;
-  opts.max_iterations = 4U;
-  opts.max_change = 0.001;
-  wb.set_iterative_options(opts);
-
-  SchedulerStats stats;
-  SchedulerConfig cfg;
-  cfg.num_threads = 4U;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
-  EXPECT_EQ(stats.cycle_recoveries, 1U);
-  EXPECT_EQ(stats.cells_evaluated, 2U);
-
-  const Value a1 = StoredValue(wb, 0U, 0U, 0U);
-  const Value b1 = StoredValue(wb, 0U, 0U, 1U);
-  ASSERT_TRUE(a1.is_text());
-  ASSERT_TRUE(b1.is_text());
-  EXPECT_EQ(a1.as_text(), "stable");
-  EXPECT_EQ(b1.as_text(), "stable");
-}
-
-TEST(Scheduler, ZeroThreadsAutoDetectsAndExecutes) {
-  // num_threads = 0 means "auto-detect, capped at 8". The scheduler must
-  // still resolve a sensible worker count and successfully complete.
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(2.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1*A1")));
-
-  SchedulerStats stats;
-  SchedulerConfig cfg;  // num_threads = 0 → auto.
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats)));
-  EXPECT_EQ(stats.cells_evaluated, 1U);
-
-  Value b1 = StoredValue(wb, 0, 0, 1);
-  ASSERT_TRUE(b1.is_number());
-  EXPECT_DOUBLE_EQ(b1.as_number(), 4.0);
-}
-
-TEST(Scheduler, NullStatsDoesNotCrash) {
-  // Passing nullptr for `stats` is supported and must not crash.
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(5.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1+10")));
-
-  SchedulerConfig cfg;
-  cfg.num_threads = 4U;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, /*stats=*/nullptr)));
-
-  Value b1 = StoredValue(wb, 0, 0, 1);
-  ASSERT_TRUE(b1.is_number());
-  EXPECT_DOUBLE_EQ(b1.as_number(), 15.0);
-}
-
-TEST(Scheduler, RepeatedRecalcIsIdempotent) {
-  // Running `recalc_parallel` twice in a row with no intervening edits
-  // must produce the same values and zero counters on the second pass
-  // (dirty set was cleared by the first pass).
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(3.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1*7")));
-
-  SchedulerStats stats1;
-  SchedulerConfig cfg;
-  cfg.num_threads = 4U;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats1)));
-  EXPECT_EQ(stats1.cells_evaluated, 1U);
-
-  SchedulerStats stats2;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, &stats2)));
-  // Second pass: nothing dirty, no work.
-  EXPECT_EQ(stats2.cells_evaluated, 0U);
-  EXPECT_EQ(stats2.sccs_processed, 0U);
-
-  Value b1 = StoredValue(wb, 0, 0, 1);
-  ASSERT_TRUE(b1.is_number());
-  EXPECT_DOUBLE_EQ(b1.as_number(), 21.0);
-}
-
-TEST(Scheduler, IncrementalEditPropagates) {
-  // Edit-then-recalc semantics with the parallel engine. Mutate A1 after
-  // the first recalc and confirm B1 reflects the new value.
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(2.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1+1")));
-
-  SchedulerConfig cfg;
-  cfg.num_threads = 4U;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, nullptr)));
-  Value b1 = StoredValue(wb, 0, 0, 1);
-  ASSERT_TRUE(b1.is_number());
-  EXPECT_DOUBLE_EQ(b1.as_number(), 3.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, nullptr)));
-  b1 = StoredValue(wb, 0, 0, 1);
-  ASSERT_TRUE(b1.is_number());
-  EXPECT_DOUBLE_EQ(b1.as_number(), 11.0);
-}
-
-TEST(Scheduler, ParallelMatchesSerialOnSimpleWorkbooks) {
-  // Five workbook shapes, each driven through both `recalc()` and
-  // `recalc_parallel()`. Per-cell value equality is asserted by
-  // `RecalcBothAndExpectEqual`.
-
-  {
-    SCOPED_TRACE("shape: linear chain");
-    WorkbookPair wp;
-    wp.set_value(0, 0, 0, Value::number(3.0));
-    wp.set_formula(0, 1, 0, "=A1*2");
-    wp.set_formula(0, 2, 0, "=A2-1");
-    RecalcBothAndExpectEqual(wp, 8U);
-  }
-  {
-    SCOPED_TRACE("shape: range sum");
-    WorkbookPair wp;
-    for (std::uint32_t r = 0; r < 5; ++r) {
-      wp.set_value(0, r, 0, Value::number(static_cast<double>(r + 1)));
-    }
-    wp.set_formula(0, 0, 1, "=SUM(A1:A5)");
-    RecalcBothAndExpectEqual(wp, 4U);
-  }
-  {
-    SCOPED_TRACE("shape: diamond");
-    WorkbookPair wp;
-    wp.set_value(0, 0, 0, Value::number(7.0));
-    wp.set_formula(0, 0, 1, "=A1+1");
-    wp.set_formula(0, 0, 2, "=A1*3");
-    wp.set_formula(0, 0, 3, "=B1+C1");
-    RecalcBothAndExpectEqual(wp, 4U);
-  }
-  {
-    SCOPED_TRACE("shape: text concat chain");
-    WorkbookPair wp;
-    wp.set_value(0, 0, 0, Value::number(5.0));
-    wp.set_formula(0, 1, 0, "=A1+10");
-    wp.set_formula(0, 2, 0, "=IF(A2>10, 1, 0)");
-    RecalcBothAndExpectEqual(wp, 8U);
-  }
-  {
-    SCOPED_TRACE("shape: wide layer");
-    WorkbookPair wp;
-    for (std::uint32_t r = 0; r < 20; ++r) {
-      wp.set_value(0, r, 0, Value::number(static_cast<double>(r)));
-      wp.set_formula(0, r, 1, "=A" + std::to_string(r + 1) + "+1");
-    }
-    RecalcBothAndExpectEqual(wp, 8U);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// SLOW: stress test — a larger random DAG run repeatedly to surface races
-// under ThreadSanitizer.
-// ---------------------------------------------------------------------------
-
-TEST(SchedulerSlow, StressRandomDag) {
-  // 200-cell random DAG, run 50 times. Each run rebuilds the workbook from
-  // scratch and asserts every cell matches the single-threaded recalc.
-  // Kept comfortably under the SLOW timeout budget (120 s).
-  constexpr std::uint32_t kCellCount = 200U;
-  constexpr int kIterations = 50;
-
-  std::mt19937 rng(0xCAFEBABEU);
-
-  for (int iter = 0; iter < kIterations; ++iter) {
-    WorkbookPair wp;
-    // Seed cells: rows 0..9 are numeric literals 1..10.
-    for (std::uint32_t r = 0; r < 10; ++r) {
-      wp.set_value(0, r, 0, Value::number(static_cast<double>(r + 1)));
-    }
-    // Subsequent cells reference up to 3 earlier rows in column A.
-    for (std::uint32_t r = 10; r < kCellCount; ++r) {
-      std::uniform_int_distribution<std::uint32_t> pick(0U, r - 1U);
-      const std::uint32_t a = pick(rng);
-      const std::uint32_t b = pick(rng);
-      const std::string formula = "=A" + std::to_string(a + 1) + "+A" + std::to_string(b + 1);
-      wp.set_formula(0, r, 0, formula);
-    }
-
-    SchedulerConfig cfg;
-    cfg.num_threads = 8U;
-    ASSERT_TRUE(static_cast<bool>(wp.serial.recalc(default_registry())));
-    ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, nullptr)));
-
-    for (std::uint32_t r = 0; r < kCellCount; ++r) {
-      Value vs = StoredValue(wp.serial, 0, r, 0);
-      Value vp = StoredValue(wp.parallel, 0, r, 0);
-      ASSERT_EQ(vs.kind(), vp.kind()) << "iter=" << iter << " r=" << r;
-      if (vs.is_number()) {
-        ASSERT_DOUBLE_EQ(vs.as_number(), vp.as_number()) << "iter=" << iter << " r=" << r;
-      }
-    }
-  }
-}
-
-// Two independent dynamic-array formulas on the same sheet in the same
-// parallel layer, with disjoint spill footprints, evaluated repeatedly
-// under a 4-thread pool. Each formula spills through `Sheet::commit_spill`
-// / `Sheet::resolve_cell_value`, which mutate and read the sheet's spill
-// table and row store. Run under ThreadSanitizer this is the race-detection
-// fixture for concurrent spill commits on a shared sheet; the value
-// assertions also catch a lost / torn spill (a phantom reading back as
-// #SPILL! or blank).
-TEST(SchedulerSlow, ParallelSpillNoDataRace) {
-  constexpr int kIterations = 40;
-  for (int iter = 0; iter < kIterations; ++iter) {
-    Workbook wb = Workbook::create();
-    // A1 spills A1:A4 = {1, 2, 3, 4}.
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(4,1)"))) << "iter " << iter;
-    // C1 spills C1:C4 = {2, 4, 6, 8}. Disjoint footprint from column A.
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=SEQUENCE(4,1)*2"))) << "iter " << iter;
-
-    SchedulerConfig cfg;
-    cfg.num_threads = 4U;
-    ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(default_registry(), cfg, nullptr))) << "iter " << iter;
-
-    const Sheet& s = wb.sheet(0);
-    for (std::uint32_t r = 0; r < 4U; ++r) {
-      const Value a = s.resolve_cell_value(r, 0U);
-      ASSERT_TRUE(a.is_number()) << "iter " << iter << " A row " << r << " kind=" << static_cast<int>(a.kind());
-      EXPECT_DOUBLE_EQ(a.as_number(), static_cast<double>(r + 1U)) << "iter " << iter << " A row " << r;
-
-      const Value c = s.resolve_cell_value(r, 2U);
-      ASSERT_TRUE(c.is_number()) << "iter " << iter << " C row " << r << " kind=" << static_cast<int>(c.kind());
-      EXPECT_DOUBLE_EQ(c.as_number(), static_cast<double>((r + 1U) * 2U)) << "iter " << iter << " C row " << r;
-    }
-  }
-}
-
 }  // namespace
 }  // namespace formulon::eval
diff --git a/tests/concurrency/scheduler_test_helpers.h b/tests/concurrency/scheduler_test_helpers.h
new file mode 100644
index 000000000..18c0b271e
--- /dev/null
+++ b/tests/concurrency/scheduler_test_helpers.h
@@ -0,0 +1,176 @@
+#pragma once
+
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <set>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "cell.h"
+#include "eval/function_registry.h"
+#include "eval/iterative_solver.h"
+#include "eval/recalc_engine.h"
+#include "eval/scheduler.h"
+#include "eval/volatile_tracker.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "utils/thread_launch.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon::eval::scheduler_test {
+
+/// Clears any injected thread-launch failure when the test leaves scope.
+/// Without this an assertion that aborts a degradation test mid-way would
+/// leave every later test unable to start a worker.
+struct ThreadLaunchInjection {
+  ~ThreadLaunchInjection() { clear_thread_launch_failure_injection(); }
+};
+
+inline Value StoredValue(const Workbook& wb, std::size_t sheet_index, std::uint32_t row, std::uint32_t col) {
+  const Sheet& s = wb.sheet(sheet_index);
+  if (const Cell* c = s.cell_at(row, col); c != nullptr) {
+    return c->cached_value;
+  }
+  return Value::blank();
+}
+
+struct ProgressAbortAfter {
+  std::atomic<std::uint32_t> calls{0U};
+  std::uint32_t abort_after = 0U;
+};
+
+struct ProgressThreadProbe {
+  std::thread::id caller;
+  std::mutex mutex;
+  std::vector<std::thread::id> callback_threads;
+};
+
+inline bool RecordIterativeProgressThread(std::uint32_t /*iteration*/, double /*max_residual*/,
+                                          std::uint32_t /*max_iterations*/, void* user_data) {
+  auto* probe = static_cast<ProgressThreadProbe*>(user_data);
+  std::lock_guard<std::mutex> guard(probe->mutex);
+  probe->callback_threads.push_back(std::this_thread::get_id());
+  return true;
+}
+
+struct WorkerThreadProbe {
+  std::condition_variable condition;
+  std::mutex mutex;
+  std::set<std::thread::id> ids;
+  bool synchronize = false;
+  bool released = true;
+  bool timed_out = false;
+};
+
+inline WorkerThreadProbe g_worker_thread_probe;
+
+inline void ResetWorkerThreadProbe(bool synchronize) {
+  std::lock_guard<std::mutex> guard(g_worker_thread_probe.mutex);
+  g_worker_thread_probe.ids.clear();
+  g_worker_thread_probe.synchronize = synchronize;
+  g_worker_thread_probe.released = !synchronize;
+  g_worker_thread_probe.timed_out = false;
+}
+
+inline Value RecordWorkerThreadImpl(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
+  if (arity != 1U) {
+    return Value::error(ErrorCode::Value);
+  }
+  std::unique_lock<std::mutex> lock(g_worker_thread_probe.mutex);
+  g_worker_thread_probe.ids.insert(std::this_thread::get_id());
+  if (g_worker_thread_probe.synchronize && !g_worker_thread_probe.released) {
+    // Keep the first worker occupied until a sibling SCC reaches this same
+    // rendezvous. The bounded deadline only prevents a deadlock if the host
+    // unexpectedly launches fewer workers than the fixture requests.
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(1);
+    while (!g_worker_thread_probe.released && g_worker_thread_probe.ids.size() < 2U) {
+      if (g_worker_thread_probe.condition.wait_until(lock, deadline) == std::cv_status::timeout) {
+        g_worker_thread_probe.timed_out = true;
+        g_worker_thread_probe.released = true;
+        g_worker_thread_probe.condition.notify_all();
+        break;
+      }
+    }
+    if (g_worker_thread_probe.ids.size() >= 2U && !g_worker_thread_probe.released) {
+      g_worker_thread_probe.released = true;
+      g_worker_thread_probe.condition.notify_all();
+    }
+  }
+  return args[0];
+}
+
+inline Workbook* g_worker_reentry_workbook = nullptr;
+inline std::atomic<int> g_worker_reentry_code{0};
+
+inline Value WorkerReentryImpl(const Value* args, std::uint32_t arity, Arena& /*arena*/) {
+  if (arity != 1U || g_worker_reentry_workbook == nullptr) {
+    return Value::error(ErrorCode::Value);
+  }
+  SchedulerConfig config;
+  config.num_threads = 1U;
+  const auto nested = g_worker_reentry_workbook->recalc_parallel(default_registry(), config, nullptr);
+  g_worker_reentry_code.store(nested ? static_cast<int>(FormulonErrorCode::kOk) : static_cast<int>(nested.error().code),
+                              std::memory_order_release);
+  return args[0];
+}
+
+inline bool AbortIterativeSolve(std::uint32_t /*iteration*/, double /*max_residual*/, std::uint32_t /*max_iterations*/,
+                                void* user_data) {
+  auto* progress = static_cast<ProgressAbortAfter*>(user_data);
+  return progress->calls.fetch_add(1U, std::memory_order_relaxed) + 1U < progress->abort_after;
+}
+
+// Builds two sibling workbooks and applies the same edits to both. Used
+// by tests that run a recalc on one and `recalc_parallel` on the other,
+// then compare cell values to confirm bit-for-bit equality.
+struct WorkbookPair {
+  Workbook serial;
+  Workbook parallel;
+
+  WorkbookPair() : serial(Workbook::create()), parallel(Workbook::create()) {}
+
+  void set_value(std::size_t sheet, std::uint32_t row, std::uint32_t col, Value v) {
+    ASSERT_TRUE(static_cast<bool>(serial.set_cell_value(sheet, row, col, v)));
+    ASSERT_TRUE(static_cast<bool>(parallel.set_cell_value(sheet, row, col, v)));
+  }
+
+  void set_formula(std::size_t sheet, std::uint32_t row, std::uint32_t col, std::string formula) {
+    ASSERT_TRUE(static_cast<bool>(serial.set_cell_formula(sheet, row, col, formula)));
+    ASSERT_TRUE(static_cast<bool>(parallel.set_cell_formula(sheet, row, col, formula)));
+  }
+};
+
+// Recalcs both members and asserts every cell in the populated rows of
+// the serial sheet matches the parallel one. Cell-level equality uses
+// `Value::operator==` (defined for the Value variant); arrays / spills
+// are compared via `resolve_cell_value`.
+inline void RecalcBothAndExpectEqual(WorkbookPair& wp, std::uint32_t threads = 4U) {
+  ASSERT_TRUE(static_cast<bool>(wp.serial.recalc(default_registry())));
+  SchedulerConfig cfg;
+  cfg.num_threads = threads;
+  ASSERT_TRUE(static_cast<bool>(wp.parallel.recalc_parallel(default_registry(), cfg, nullptr)));
+
+  ASSERT_EQ(wp.serial.sheet_count(), wp.parallel.sheet_count());
+  for (std::size_t s = 0; s < wp.serial.sheet_count(); ++s) {
+    const Sheet& a = wp.serial.sheet(s);
+    const Sheet& b = wp.parallel.sheet(s);
+    for (const auto& [row, cells] : a.rows()) {
+      for (std::uint32_t col = 0; col < cells.size(); ++col) {
+        Value va = cells[col].cached_value;
+        Value vb = StoredValue(wp.parallel, s, row, col);
+        EXPECT_EQ(va, vb) << "value mismatch at (" << row << ", " << col << ")";
+      }
+    }
+    (void)b;
+  }
+}
+
+}  // namespace formulon::eval::scheduler_test
diff --git a/tests/fixtures/excel/auto_filter_kinds.xlsx b/tests/fixtures/excel/auto_filter_kinds.xlsx
new file mode 100644
index 000000000..f541deb2d
Binary files /dev/null and b/tests/fixtures/excel/auto_filter_kinds.xlsx differ
diff --git a/tests/fixtures/excel/builtin_cell_styles.xlsx b/tests/fixtures/excel/builtin_cell_styles.xlsx
new file mode 100644
index 000000000..3f29011d5
Binary files /dev/null and b/tests/fixtures/excel/builtin_cell_styles.xlsx differ
diff --git a/tests/fixtures/excel/data_validation_matrix.xlsx b/tests/fixtures/excel/data_validation_matrix.xlsx
new file mode 100644
index 000000000..adbaef423
Binary files /dev/null and b/tests/fixtures/excel/data_validation_matrix.xlsx differ
diff --git a/tests/integration/CMakeLists.txt b/tests/integration/CMakeLists.txt
index 665cc7043..18a70f0e9 100644
--- a/tests/integration/CMakeLists.txt
+++ b/tests/integration/CMakeLists.txt
@@ -11,6 +11,8 @@ set(FORMULON_INTEGRATION_TEST_SOURCES
   legacy_at_test.cpp
   ooxml_cf_test.cpp
   ooxml_corpus_test.cpp
+  ooxml_corpus_cases.cpp
+  ooxml_corpus_package_support.cpp
   ooxml_default_passthrough_test.cpp
   ooxml_metadata_test.cpp
   ooxml_minimal_writer_test.cpp
@@ -34,7 +36,10 @@ set(FORMULON_INTEGRATION_TEST_SOURCES
   sheet_features_roundtrip_test.cpp
   sheet_layout_roundtrip_test.cpp
   sheet_print_geometry_roundtrip_test.cpp
-  sheet_ops_test.cpp
+  sheet_ops_name_rename_test.cpp
+  sheet_ops_remove_move_defined_names_test.cpp
+  sheet_ops_row_col_edits_test.cpp
+  sheet_ops_3d_structural_recalc_test.cpp
   structural_edit_matrix_test.cpp
   spill_collision_test.cpp
   styles_roundtrip_test.cpp
diff --git a/tests/integration/ooxml_corpus_cases.cpp b/tests/integration/ooxml_corpus_cases.cpp
new file mode 100644
index 000000000..4b8c74f60
--- /dev/null
+++ b/tests/integration/ooxml_corpus_cases.cpp
@@ -0,0 +1,647 @@
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <deque>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "eval/iterative_solver.h"
+#include "eval/recalc_engine.h"
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "ooxml_corpus_support.h"
+#include "passthrough_part.h"
+#include "sheet.h"
+#include "table.h"
+#include "utils/status_macros.h"
+#include "value.h"
+
+namespace formulon::ooxml_corpus {
+
+Expected<std::vector<std::uint8_t>, Error> BuildEmpty() {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildSingleLiteral() {
+  Workbook wb = Workbook::create();
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(123.5)));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildLiteralsAllKinds() {
+  Workbook wb = Workbook::create();
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(42.0)));
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 1U, 0U, Value::boolean(true)));
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 2U, 0U, Value::boolean(false)));
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 3U, 0U, Value::text("hello")));
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 4U, 0U, Value::blank()));
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 5U, 0U, Value::error(ErrorCode::Div0)));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildArithmetic() {
+  // NOTE: the `&` (text-concat) operator is intentionally omitted here.
+  // Bundle 2.6 surfaced an existing engine limitation: the OOXML writer
+  // emits formula cells with text cached values as `<v>foobar</v>`
+  // (no `t="str"`), which the reader then parses as `t='n'` and
+  // rejects. That is a writer bug to fix in a follow-up bundle; the
+  // corpus avoids triggering it so the round-trip parity test stays
+  // green for the arithmetic surface itself.
+  Workbook wb = Workbook::create();
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0)));  // A1
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 1U, 0U, Value::number(3.0)));   // A2
+  // Formulas covering + - * / ^ % and unary minus (no `&`).
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=A1+A2"));  // B1 -> 13
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 1U, 1U, "=A1-A2"));  // B2 -> 7
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 2U, 1U, "=A1*A2"));  // B3 -> 30
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 3U, 1U, "=A1/A2"));  // B4 -> 3.333..
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 4U, 1U, "=A1^A2"));  // B5 -> 1000
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 5U, 1U, "=A1%"));    // B6 -> 0.1
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 6U, 1U, "=-A1"));    // B7 -> -10
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildCrossSheet() {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.add_sheet("Sheet2");
+  RETURN_IF_ERROR(wb.set_cell_value(1U, 0U, 0U, Value::number(99.0)));  // Sheet2!A1
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 0U, "=Sheet2!A1"));       // Sheet1!A1
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildMultiSheetIndependent() {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("North");
+  wb.add_sheet("South");
+  wb.add_sheet("East");
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0)));
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=A1+1"));
+  RETURN_IF_ERROR(wb.set_cell_value(1U, 0U, 0U, Value::number(2.0)));
+  RETURN_IF_ERROR(wb.set_cell_formula(1U, 0U, 1U, "=A1*2"));
+  RETURN_IF_ERROR(wb.set_cell_value(2U, 0U, 0U, Value::number(3.0)));
+  RETURN_IF_ERROR(wb.set_cell_formula(2U, 0U, 1U, "=A1-1"));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildUnicodeSheetNames() {
+  Workbook wb = Workbook::create_empty();
+  // "日本語" (Japanese) — exercises non-ASCII XML attribute encoding.
+  wb.add_sheet("\xE6\x97\xA5\xE6\x9C\xAC\xE8\xAA\x9E");
+  // emoji + ASCII — exercises 4-byte UTF-8 in attribute context.
+  wb.add_sheet("emoji\xF0\x9F\x98\x80");
+  // Spaces and digits — exercises plain attribute round-trip.
+  wb.add_sheet("Sheet 3 with spaces");
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildUnicodeCellText() {
+  Workbook wb = Workbook::create();
+  // Japanese.
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::text("\xE6\x97\xA5\xE6\x9C\xAC\xE8\xAA\x9E")));
+  // Emoji (4-byte UTF-8).
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 1U, 0U, Value::text("Hello \xF0\x9F\x98\x80")));
+  // NBSP (U+00A0).
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 2U, 0U, Value::text("a\xC2\xA0\x62")));
+  // Hebrew "shalom" — Right-to-left script. We are not asserting bidi
+  // rendering, just that the bytes survive a round-trip.
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 3U, 0U, Value::text("\xD7\xA9\xD7\x9C\xD7\x95\xD7\x9D")));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildRangeAggregates() {
+  Workbook wb = Workbook::create();
+  // Populate A1:A10 with 1..10.
+  for (std::uint32_t r = 0; r < 10U; ++r) {
+    RETURN_IF_ERROR(wb.set_cell_value(0U, r, 0U, Value::number(static_cast<double>(r + 1U))));
+  }
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=SUM(A1:A10)"));      // B1 -> 55
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 1U, 1U, "=AVERAGE(A1:A10)"));  // B2 -> 5.5
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 2U, 1U, "=MIN(A1:A10)"));      // B3 -> 1
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 3U, 1U, "=MAX(A1:A10)"));      // B4 -> 10
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 4U, 1U, "=COUNT(A1:A10)"));    // B5 -> 10
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildVolatileNowToday() {
+  Workbook wb = Workbook::create();
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 0U, "=NOW()"));
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 1U, 0U, "=TODAY()"));
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 2U, 0U, "=RAND()"));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildIterativeCircular() {
+  Workbook wb = Workbook::create();
+  // A1 = B1 + 1; B1 = A1.
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 0U, "=B1+1"));
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=A1"));
+  IterativeOptions opts;
+  opts.enabled = true;
+  opts.max_iterations = 20U;
+  opts.max_change = 0.01;
+  wb.set_iterative_options(opts);
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildDefinedNamesWorkbookScope() {
+  Workbook wb = Workbook::create();
+  std::vector<DefinedName> names;
+  DefinedName n;
+  n.name = "Sales";
+  n.formula = "Sheet1!$A$1:$A$10";
+  names.push_back(std::move(n));
+  wb.set_defined_names(std::move(names));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildDefinedNamesSheetScope() {
+  Workbook wb = Workbook::create();
+  std::vector<DefinedName> names;
+  DefinedName n;
+  n.name = "LocalRange";
+  n.formula = "Sheet1!$B$1:$B$5";
+  n.local_sheet_id = 0;
+  n.hidden = true;
+  n.comment = "Sheet1-only.";
+  names.push_back(std::move(n));
+  wb.set_defined_names(std::move(names));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildSingleTable() {
+  Workbook wb = Workbook::create();
+  TableMetadata table;
+  table.id = 1U;
+  table.name = "SalesTable";
+  table.display_name = "SalesTable";
+  table.ref = "A1:C5";
+  table.sheet_index = 0U;
+  table.header_row = true;
+  table.totals_row = true;
+  table.columns.push_back(TableColumn{1U, "Region", "Total", "", ""});
+  table.columns.push_back(TableColumn{2U, "Q1", "", "sum", ""});
+  table.columns.push_back(TableColumn{3U, "Q2", "", "sum", ""});
+  std::vector<TableMetadata> tables;
+  tables.push_back(std::move(table));
+  wb.set_tables(std::move(tables));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildMultipleTables() {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.add_sheet("Sheet2");
+
+  std::vector<TableMetadata> tables;
+  TableMetadata t1;
+  t1.id = 1U;
+  t1.name = "Tbl1";
+  t1.display_name = "Tbl1";
+  t1.ref = "A1:B3";
+  t1.sheet_index = 0U;
+  t1.columns.push_back(TableColumn{1U, "X", "", "", ""});
+  t1.columns.push_back(TableColumn{2U, "Y", "", "", ""});
+  tables.push_back(std::move(t1));
+
+  TableMetadata t2;
+  t2.id = 2U;
+  t2.name = "Tbl2";
+  t2.display_name = "Tbl2";
+  t2.ref = "A1:B2";
+  t2.sheet_index = 0U;
+  t2.columns.push_back(TableColumn{1U, "P", "", "", ""});
+  t2.columns.push_back(TableColumn{2U, "Q", "", "", ""});
+  tables.push_back(std::move(t2));
+
+  TableMetadata t3;
+  t3.id = 3U;
+  t3.name = "Tbl3";
+  t3.display_name = "Tbl3";
+  t3.ref = "A1:A2";
+  t3.sheet_index = 1U;
+  t3.columns.push_back(TableColumn{1U, "Z", "", "", ""});
+  tables.push_back(std::move(t3));
+
+  wb.set_tables(std::move(tables));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildNestedFunctionCalls() {
+  // Deeply nested IF/AND/OR with numeric branches only — text branch
+  // results would trigger the same `<v>` round-trip limitation called
+  // out in `BuildArithmetic`. Logic: (A1>0 OR A2<0) AND (A3=8) is true,
+  // and A1+A2 (=8) > A3 (=8) is false, so the formula falls into the
+  // inner else-branch and yields A2 (=3).
+  Workbook wb = Workbook::create();
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(5.0)));  // A1
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 1U, 0U, Value::number(3.0)));  // A2
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 2U, 0U, Value::number(8.0)));  // A3
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=IF(AND(OR(A1>0,A2<0),A3=8),IF(A1+A2>A3,A1,A2),0)"));
+  return SaveBytes(wb);
+}
+
+Expected<std::vector<std::uint8_t>, Error> BuildLargeGrid500Cells() {
+  // 500 cells across A1:T25 (20 columns x 25 rows). Mix of numeric
+  // literals, text, and formulas referencing earlier cells.
+  //
+  // `Value::text` is non-owning, so we materialise the per-row label
+  // strings into a function-static `std::deque<std::string>`: the
+  // deque keeps element addresses stable across appends and persists
+  // until program teardown, which is well past the round-trip pipeline
+  // (the workbook reads `cached_value.as_text()` during `save()` and
+  // discards the view afterward, but the value still has to be alive
+  // through that read).
+  static std::deque<std::string> kLabels;
+  static const bool kInitialised = [&]() {
+    for (std::uint32_t r = 0; r < 25U; ++r) {
+      kLabels.push_back("L" + std::to_string(r));
+    }
+    return true;
+  }();
+  (void)kInitialised;
+
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 25U; ++r) {
+    for (std::uint32_t c = 0; c < 20U; ++c) {
+      if ((r + c) % 7U == 0U) {
+        RETURN_IF_ERROR(wb.set_cell_value(0U, r, c, Value::text(kLabels[r])));
+      } else if ((r + c) % 3U == 0U && r > 0U) {
+        // Formula referencing the cell directly above (1-based row).
+        const std::string col_letter(1U, static_cast<char>('A' + c));
+        const std::string ref_above = col_letter + std::to_string(r);
+        RETURN_IF_ERROR(wb.set_cell_formula(0U, r, c, "=" + ref_above + "+1"));
+      } else {
+        RETURN_IF_ERROR(wb.set_cell_value(0U, r, c, Value::number(static_cast<double>(r * 20U + c))));
+      }
+    }
+  }
+  return SaveBytes(wb);
+}
+
+/// Combined kitchen-sink: 2 sheets, a defined name, a table, a
+/// passthrough theme part, mixed formulas, unicode text, and an
+/// iterative circular pair. We can't add a passthrough part via the
+/// public Workbook API alone (the writer copies it through, but the
+/// only way to get one in is to read an archive that already has it),
+/// so we build the synthetic theme archive, read it, then mutate the
+/// workbook to add the rest of the surfaces, then save.
+Expected<std::vector<std::uint8_t>, Error> BuildKitchenSink() {
+  ASSIGN_OR_RETURN(auto theme_bytes, BuildPassthroughThemeArchive());
+  ASSIGN_OR_RETURN(auto first_or, io::read_ooxml(SpanOf(theme_bytes)));
+  Workbook wb = std::move(first_or.workbook);
+
+  // Add a second sheet.
+  wb.add_sheet("\xE6\x97\xA5\xE6\x9C\xAC");  // "日本"
+
+  // Defined name (workbook-scope).
+  std::vector<DefinedName> names;
+  DefinedName n;
+  n.name = "ComboName";
+  n.formula = "Sheet1!$A$1";
+  names.push_back(std::move(n));
+  wb.set_defined_names(std::move(names));
+
+  // Table on Sheet1.
+  TableMetadata tab;
+  tab.id = 1U;
+  tab.name = "ComboTable";
+  tab.display_name = "ComboTable";
+  tab.ref = "A1:B2";
+  tab.sheet_index = 0U;
+  tab.columns.push_back(TableColumn{1U, "Alpha", "", "", ""});
+  tab.columns.push_back(TableColumn{2U, "Beta", "", "", ""});
+  std::vector<TableMetadata> tables;
+  tables.push_back(std::move(tab));
+  wb.set_tables(std::move(tables));
+
+  // Mixed formulas + unicode text.
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(3.14)));                    // A1
+  RETURN_IF_ERROR(wb.set_cell_formula(0U, 1U, 0U, "=A1*2"));                              // A2
+  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 1U, Value::text("\xE3\x81\x82")));            // B1: "あ"
+  RETURN_IF_ERROR(wb.set_cell_value(1U, 0U, 0U, Value::text("Hello \xF0\x9F\x91\x8B")));  // emoji wave
+
+  // Iterative circular pair on Sheet2 (rows 5-6).
+  RETURN_IF_ERROR(wb.set_cell_formula(1U, 5U, 0U, "=B6+0.5"));
+  RETURN_IF_ERROR(wb.set_cell_formula(1U, 5U, 1U, "=A6"));
+  IterativeOptions opts;
+  opts.enabled = true;
+  opts.max_iterations = 20U;
+  opts.max_change = 0.01;
+  wb.set_iterative_options(opts);
+
+  return SaveBytes(wb);
+}
+
+const Cell* CellAt(const Workbook& wb, std::size_t s, std::uint32_t r, std::uint32_t c) {
+  return wb.sheet(s).cell_at(r, c);
+}
+
+void AssertEmpty(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  EXPECT_EQ(wb.sheet(0).name(), "Sheet1");
+  EXPECT_EQ(wb.sheet(0).cell_count(), 0U);
+}
+
+void AssertSingleLiteral(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
+  ASSERT_NE(a1, nullptr);
+  ASSERT_TRUE(a1->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(a1->cached_value.as_number(), 123.5);
+}
+
+void AssertLiteralsAllKinds(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
+  ASSERT_NE(a1, nullptr);
+  ASSERT_TRUE(a1->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(a1->cached_value.as_number(), 42.0);
+
+  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
+  ASSERT_NE(a2, nullptr);
+  ASSERT_TRUE(a2->cached_value.is_boolean());
+  EXPECT_TRUE(a2->cached_value.as_boolean());
+
+  const Cell* a3 = CellAt(wb, 0U, 2U, 0U);
+  ASSERT_NE(a3, nullptr);
+  ASSERT_TRUE(a3->cached_value.is_boolean());
+  EXPECT_FALSE(a3->cached_value.as_boolean());
+
+  const Cell* a4 = CellAt(wb, 0U, 3U, 0U);
+  ASSERT_NE(a4, nullptr);
+  ASSERT_TRUE(a4->cached_value.is_text());
+  EXPECT_EQ(a4->cached_value.as_text(), "hello");
+
+  const Cell* a6 = CellAt(wb, 0U, 5U, 0U);
+  ASSERT_NE(a6, nullptr);
+  ASSERT_TRUE(a6->cached_value.is_error());
+  EXPECT_EQ(a6->cached_value.as_error(), ErrorCode::Div0);
+}
+
+void AssertArithmetic(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  const Cell* b1 = CellAt(wb, 0U, 0U, 1U);  // =A1+A2
+  const Cell* b2 = CellAt(wb, 0U, 1U, 1U);  // =A1-A2
+  const Cell* b3 = CellAt(wb, 0U, 2U, 1U);  // =A1*A2
+  const Cell* b5 = CellAt(wb, 0U, 4U, 1U);  // =A1^A2
+  const Cell* b7 = CellAt(wb, 0U, 6U, 1U);  // =-A1
+  ASSERT_NE(b1, nullptr);
+  ASSERT_NE(b2, nullptr);
+  ASSERT_NE(b3, nullptr);
+  ASSERT_NE(b5, nullptr);
+  ASSERT_NE(b7, nullptr);
+  ASSERT_TRUE(b1->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(b1->cached_value.as_number(), 13.0);
+  ASSERT_TRUE(b2->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(b2->cached_value.as_number(), 7.0);
+  ASSERT_TRUE(b3->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(b3->cached_value.as_number(), 30.0);
+  ASSERT_TRUE(b5->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(b5->cached_value.as_number(), 1000.0);
+  ASSERT_TRUE(b7->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(b7->cached_value.as_number(), -10.0);
+}
+
+void AssertCrossSheet(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 2U);
+  EXPECT_EQ(wb.sheet(0).name(), "Sheet1");
+  EXPECT_EQ(wb.sheet(1).name(), "Sheet2");
+  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
+  ASSERT_NE(a1, nullptr);
+  ASSERT_TRUE(a1->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(a1->cached_value.as_number(), 99.0);
+}
+
+void AssertMultiSheetIndependent(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 3U);
+  EXPECT_EQ(wb.sheet(0).name(), "North");
+  EXPECT_EQ(wb.sheet(1).name(), "South");
+  EXPECT_EQ(wb.sheet(2).name(), "East");
+  const Cell* north_b1 = CellAt(wb, 0U, 0U, 1U);
+  const Cell* south_b1 = CellAt(wb, 1U, 0U, 1U);
+  const Cell* east_b1 = CellAt(wb, 2U, 0U, 1U);
+  ASSERT_NE(north_b1, nullptr);
+  ASSERT_NE(south_b1, nullptr);
+  ASSERT_NE(east_b1, nullptr);
+  ASSERT_TRUE(north_b1->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(north_b1->cached_value.as_number(), 2.0);
+  ASSERT_TRUE(south_b1->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(south_b1->cached_value.as_number(), 4.0);
+  ASSERT_TRUE(east_b1->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(east_b1->cached_value.as_number(), 2.0);
+}
+
+void AssertUnicodeSheetNames(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 3U);
+  EXPECT_EQ(wb.sheet(0).name(), "\xE6\x97\xA5\xE6\x9C\xAC\xE8\xAA\x9E");
+  EXPECT_EQ(wb.sheet(1).name(), "emoji\xF0\x9F\x98\x80");
+  EXPECT_EQ(wb.sheet(2).name(), "Sheet 3 with spaces");
+}
+
+void AssertUnicodeCellText(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
+  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
+  const Cell* a3 = CellAt(wb, 0U, 2U, 0U);
+  const Cell* a4 = CellAt(wb, 0U, 3U, 0U);
+  ASSERT_NE(a1, nullptr);
+  ASSERT_NE(a2, nullptr);
+  ASSERT_NE(a3, nullptr);
+  ASSERT_NE(a4, nullptr);
+  ASSERT_TRUE(a1->cached_value.is_text());
+  EXPECT_EQ(a1->cached_value.as_text(), "\xE6\x97\xA5\xE6\x9C\xAC\xE8\xAA\x9E");
+  ASSERT_TRUE(a2->cached_value.is_text());
+  EXPECT_EQ(a2->cached_value.as_text(), "Hello \xF0\x9F\x98\x80");
+}
+
+void AssertRangeAggregates(const Workbook& wb) {
+  const Cell* sum = CellAt(wb, 0U, 0U, 1U);
+  const Cell* avg = CellAt(wb, 0U, 1U, 1U);
+  const Cell* mn = CellAt(wb, 0U, 2U, 1U);
+  const Cell* mx = CellAt(wb, 0U, 3U, 1U);
+  const Cell* cnt = CellAt(wb, 0U, 4U, 1U);
+  ASSERT_NE(sum, nullptr);
+  ASSERT_NE(avg, nullptr);
+  ASSERT_NE(mn, nullptr);
+  ASSERT_NE(mx, nullptr);
+  ASSERT_NE(cnt, nullptr);
+  ASSERT_TRUE(sum->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(sum->cached_value.as_number(), 55.0);
+  ASSERT_TRUE(avg->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(avg->cached_value.as_number(), 5.5);
+  ASSERT_TRUE(mn->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(mn->cached_value.as_number(), 1.0);
+  ASSERT_TRUE(mx->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(mx->cached_value.as_number(), 10.0);
+  ASSERT_TRUE(cnt->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(cnt->cached_value.as_number(), 10.0);
+}
+
+void AssertVolatileNowToday(const Workbook& wb) {
+  // Cached values WILL drift across recalcs; we only check that the
+  // formula text was preserved.
+  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
+  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
+  const Cell* a3 = CellAt(wb, 0U, 2U, 0U);
+  ASSERT_NE(a1, nullptr);
+  ASSERT_NE(a2, nullptr);
+  ASSERT_NE(a3, nullptr);
+  EXPECT_EQ(a1->formula_text, "=NOW()");
+  EXPECT_EQ(a2->formula_text, "=TODAY()");
+  EXPECT_EQ(a3->formula_text, "=RAND()");
+}
+
+void AssertIterativeCircular(const Workbook& wb) {
+  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
+  const Cell* b1 = CellAt(wb, 0U, 0U, 1U);
+  ASSERT_NE(a1, nullptr);
+  ASSERT_NE(b1, nullptr);
+  EXPECT_EQ(a1->formula_text, "=B1+1");
+  EXPECT_EQ(b1->formula_text, "=A1");
+  // The cached values are observable but not pinned: depending on
+  // whether iterative options were re-applied, the SCC will resolve
+  // either to a converged numeric pair (iterative on) or to #REF!
+  // (iterative off — the writer does not yet persist `<calcPr
+  // iterate=...>`). Either is acceptable here; the formula text is
+  // the load-bearing invariant.
+}
+
+void AssertDefinedNamesWorkbookScope(const Workbook& wb) {
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].name, "Sales");
+  EXPECT_EQ(wb.defined_names()[0].formula, "Sheet1!$A$1:$A$10");
+  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, -1);
+  EXPECT_FALSE(wb.defined_names()[0].hidden);
+}
+
+void AssertDefinedNamesSheetScope(const Workbook& wb) {
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].name, "LocalRange");
+  EXPECT_EQ(wb.defined_names()[0].formula, "Sheet1!$B$1:$B$5");
+  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, 0);
+  EXPECT_TRUE(wb.defined_names()[0].hidden);
+  EXPECT_EQ(wb.defined_names()[0].comment, "Sheet1-only.");
+}
+
+void AssertSingleTable(const Workbook& wb) {
+  ASSERT_EQ(wb.tables().size(), 1U);
+  const TableMetadata& t = wb.tables()[0];
+  EXPECT_EQ(t.name, "SalesTable");
+  EXPECT_EQ(t.ref, "A1:C5");
+  ASSERT_EQ(t.columns.size(), 3U);
+  EXPECT_EQ(t.columns[0].name, "Region");
+}
+
+void AssertMultipleTables(const Workbook& wb) {
+  ASSERT_EQ(wb.tables().size(), 3U);
+  EXPECT_EQ(wb.tables()[0].name, "Tbl1");
+  EXPECT_EQ(wb.tables()[1].name, "Tbl2");
+  EXPECT_EQ(wb.tables()[2].name, "Tbl3");
+  EXPECT_EQ(wb.tables()[0].sheet_index, 0U);
+  EXPECT_EQ(wb.tables()[1].sheet_index, 0U);
+  EXPECT_EQ(wb.tables()[2].sheet_index, 1U);
+}
+
+void AssertNestedFunctionCalls(const Workbook& wb) {
+  const Cell* b1 = CellAt(wb, 0U, 0U, 1U);
+  ASSERT_NE(b1, nullptr);
+  // Formula text round-trips verbatim; cached value resolves to A2=3.
+  EXPECT_EQ(b1->formula_text, "=IF(AND(OR(A1>0,A2<0),A3=8),IF(A1+A2>A3,A1,A2),0)");
+  ASSERT_TRUE(b1->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(b1->cached_value.as_number(), 3.0);
+}
+
+void AssertLargeGrid(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  // Spot-check the corners of the grid: A1 should be a numeric
+  // literal (r=0, c=0; (r+c) % 7 == 0 -> text "L0").
+  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
+  ASSERT_NE(a1, nullptr);
+  ASSERT_TRUE(a1->cached_value.is_text());
+  EXPECT_EQ(a1->cached_value.as_text(), "L0");
+  // Last cell T25 (r=24, c=19): (24+19)=43 -> 43%7=1 -> not text;
+  // 43 % 3 = 1 -> not formula; numeric 24*20+19 = 499.
+  const Cell* t25 = CellAt(wb, 0U, 24U, 19U);
+  ASSERT_NE(t25, nullptr);
+  ASSERT_TRUE(t25->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(t25->cached_value.as_number(), 499.0);
+}
+
+void AssertPassthroughTheme(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  // Passthrough must include the theme1 part with non-empty bytes.
+  const auto& parts = wb.passthrough_parts();
+  auto it = std::find_if(parts.begin(), parts.end(),
+                         [](const PassthroughPart& p) { return p.path == "xl/theme/theme1.xml"; });
+  ASSERT_NE(it, parts.end()) << "theme part missing from passthrough";
+  EXPECT_FALSE(it->bytes.empty());
+}
+
+void AssertSstCells(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
+  const Cell* b1 = CellAt(wb, 0U, 0U, 1U);
+  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
+  ASSERT_NE(a1, nullptr);
+  ASSERT_NE(b1, nullptr);
+  ASSERT_NE(a2, nullptr);
+  ASSERT_TRUE(a1->cached_value.is_text());
+  ASSERT_TRUE(b1->cached_value.is_text());
+  ASSERT_TRUE(a2->cached_value.is_text());
+  EXPECT_EQ(a1->cached_value.as_text(), "shared-alpha");
+  EXPECT_EQ(b1->cached_value.as_text(), "shared-beta");
+  EXPECT_EQ(a2->cached_value.as_text(), "shared-gamma");
+}
+
+void AssertKitchenSink(const Workbook& wb) {
+  ASSERT_EQ(wb.sheet_count(), 2U);
+  // Defined name preserved.
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].name, "ComboName");
+  // Table preserved.
+  ASSERT_EQ(wb.tables().size(), 1U);
+  EXPECT_EQ(wb.tables()[0].name, "ComboTable");
+  // Passthrough preserved.
+  const auto& parts = wb.passthrough_parts();
+  auto it = std::find_if(parts.begin(), parts.end(),
+                         [](const PassthroughPart& p) { return p.path == "xl/theme/theme1.xml"; });
+  EXPECT_NE(it, parts.end());
+  // Mixed formula present.
+  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
+  ASSERT_NE(a2, nullptr);
+  EXPECT_EQ(a2->formula_text, "=A1*2");
+}
+
+std::vector<CorpusBook> make_corpus() {
+  std::vector<CorpusBook> books;
+  books.push_back({"empty", BuildEmpty, AssertEmpty});
+  books.push_back({"single_literal", BuildSingleLiteral, AssertSingleLiteral});
+  books.push_back({"literals_all_kinds", BuildLiteralsAllKinds, AssertLiteralsAllKinds});
+  books.push_back({"arithmetic", BuildArithmetic, AssertArithmetic});
+  books.push_back({"cross_sheet", BuildCrossSheet, AssertCrossSheet});
+  books.push_back({"multi_sheet_independent", BuildMultiSheetIndependent, AssertMultiSheetIndependent});
+  books.push_back({"unicode_sheet_names", BuildUnicodeSheetNames, AssertUnicodeSheetNames});
+  books.push_back({"unicode_cell_text", BuildUnicodeCellText, AssertUnicodeCellText});
+  books.push_back({"range_aggregates", BuildRangeAggregates, AssertRangeAggregates});
+  books.push_back({"volatile_now_today", BuildVolatileNowToday, AssertVolatileNowToday});
+  books.push_back({"iterative_circular", BuildIterativeCircular, AssertIterativeCircular});
+  books.push_back({"defined_names_workbook_scope", BuildDefinedNamesWorkbookScope, AssertDefinedNamesWorkbookScope});
+  books.push_back({"defined_names_sheet_scope", BuildDefinedNamesSheetScope, AssertDefinedNamesSheetScope});
+  books.push_back({"single_table", BuildSingleTable, AssertSingleTable});
+  books.push_back({"multiple_tables", BuildMultipleTables, AssertMultipleTables});
+  books.push_back({"nested_function_calls", BuildNestedFunctionCalls, AssertNestedFunctionCalls});
+  books.push_back({"large_grid_500_cells", BuildLargeGrid500Cells, AssertLargeGrid});
+  books.push_back({"passthrough_theme_part", BuildPassthroughThemeArchive, AssertPassthroughTheme});
+  books.push_back({"sst_cells", BuildSstArchive, AssertSstCells});
+  books.push_back({"combined_kitchen_sink", BuildKitchenSink, AssertKitchenSink});
+  return books;
+}
+
+}  // namespace formulon::ooxml_corpus
diff --git a/tests/integration/ooxml_corpus_package_support.cpp b/tests/integration/ooxml_corpus_package_support.cpp
new file mode 100644
index 000000000..cced11cf7
--- /dev/null
+++ b/tests/integration/ooxml_corpus_package_support.cpp
@@ -0,0 +1,180 @@
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "miniz.h"
+#include "ooxml_corpus_support.h"
+
+namespace formulon::ooxml_corpus {
+namespace {
+struct PartFile {
+  const char* path;
+  std::string_view body;
+};
+
+Expected<std::vector<std::uint8_t>, Error> BuildZip(const std::vector<PartFile>& parts) {
+  mz_zip_archive writer{};
+  if (mz_zip_writer_init_heap(&writer, 0, 4096) == MZ_FALSE) {
+    return make_error(FormulonErrorCode::kIoZipCorrupt, "miniz writer init failed");
+  }
+  for (const PartFile& p : parts) {
+    if (mz_zip_writer_add_mem(&writer, p.path, p.body.data(), p.body.size(),
+                              static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)) == MZ_FALSE) {
+      mz_zip_writer_end(&writer);
+      return make_error(FormulonErrorCode::kIoZipCorrupt, std::string("miniz add failed for ") + p.path);
+    }
+  }
+  void* archive_ptr = nullptr;
+  std::size_t archive_size = 0;
+  if (mz_zip_writer_finalize_heap_archive(&writer, &archive_ptr, &archive_size) == MZ_FALSE) {
+    mz_zip_writer_end(&writer);
+    return make_error(FormulonErrorCode::kIoZipCorrupt, "miniz finalize failed");
+  }
+  std::vector<std::uint8_t> out(static_cast<const std::uint8_t*>(archive_ptr),
+                                static_cast<const std::uint8_t*>(archive_ptr) + archive_size);
+  mz_free(archive_ptr);
+  mz_zip_writer_end(&writer);
+  return out;
+}
+
+}  // namespace
+
+constexpr std::string_view kPackageRels =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+    "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
+    "  <Relationship Id=\"rId1\" "
+    "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" "
+    "Target=\"xl/workbook.xml\"/>\n"
+    "</Relationships>\n";
+
+constexpr std::string_view kEmptySheetXml =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+    "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n"
+    "  <sheetData/>\n"
+    "</worksheet>\n";
+
+/// Builds a synthetic `.xlsx` package containing a passthrough
+/// `xl/theme/theme1.xml` that the reader does not parse but Bundle 2.5
+/// promised to round-trip verbatim.
+Expected<std::vector<std::uint8_t>, Error> BuildPassthroughThemeArchive() {
+  constexpr std::string_view content_types =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">\n"
+      "  <Default Extension=\"rels\" "
+      "ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>\n"
+      "  <Default Extension=\"xml\" ContentType=\"application/xml\"/>\n"
+      "  <Override PartName=\"/xl/workbook.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/>\n"
+      "  <Override PartName=\"/xl/worksheets/sheet1.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/>\n"
+      "  <Override PartName=\"/xl/theme/theme1.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.theme+xml\"/>\n"
+      "</Types>\n";
+  constexpr std::string_view workbook_xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<workbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
+      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\">\n"
+      "  <sheets>\n"
+      "    <sheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/>\n"
+      "  </sheets>\n"
+      "</workbook>\n";
+  constexpr std::string_view workbook_rels =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
+      "  <Relationship Id=\"rId1\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
+      "Target=\"worksheets/sheet1.xml\"/>\n"
+      "</Relationships>\n";
+  // Distinctive payload so the round-trip assertion is meaningful.
+  constexpr std::string_view theme_xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<a:theme xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\" name=\"CorpusStub\">\n"
+      "  <a:themeElements/>\n"
+      "</a:theme>\n";
+
+  return BuildZip({
+      {"[Content_Types].xml", content_types},
+      {"_rels/.rels", kPackageRels},
+      {"xl/workbook.xml", workbook_xml},
+      {"xl/_rels/workbook.xml.rels", workbook_rels},
+      {"xl/worksheets/sheet1.xml", kEmptySheetXml},
+      {"xl/theme/theme1.xml", theme_xml},
+  });
+}
+
+/// Builds a synthetic `.xlsx` package whose Sheet1 references a real
+/// `xl/sharedStrings.xml`. Verifies Bundle 2.3 + 2.5 inline-string
+/// re-emission preserves the SST text payloads through the writer.
+Expected<std::vector<std::uint8_t>, Error> BuildSstArchive() {
+  constexpr std::string_view content_types =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">\n"
+      "  <Default Extension=\"rels\" "
+      "ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>\n"
+      "  <Default Extension=\"xml\" ContentType=\"application/xml\"/>\n"
+      "  <Override PartName=\"/xl/workbook.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/>\n"
+      "  <Override PartName=\"/xl/worksheets/sheet1.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/>\n"
+      "  <Override PartName=\"/xl/sharedStrings.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml\"/>\n"
+      "  <Override PartName=\"/xl/styles.xml\" "
+      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml\"/>\n"
+      "</Types>\n";
+  constexpr std::string_view workbook_xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<workbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
+      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\">\n"
+      "  <sheets>\n"
+      "    <sheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/>\n"
+      "  </sheets>\n"
+      "</workbook>\n";
+  constexpr std::string_view workbook_rels =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
+      "  <Relationship Id=\"rId1\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
+      "Target=\"worksheets/sheet1.xml\"/>\n"
+      "  <Relationship Id=\"rId2\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings\" "
+      "Target=\"sharedStrings.xml\"/>\n"
+      "  <Relationship Id=\"rId3\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles\" "
+      "Target=\"styles.xml\"/>\n"
+      "</Relationships>\n";
+  constexpr std::string_view sheet_xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n"
+      "  <sheetData>\n"
+      "    <row r=\"1\"><c r=\"A1\" t=\"s\"><v>0</v></c><c r=\"B1\" t=\"s\"><v>1</v></c></row>\n"
+      "    <row r=\"2\"><c r=\"A2\" t=\"s\"><v>2</v></c></row>\n"
+      "  </sheetData>\n"
+      "</worksheet>\n";
+  // Three SST entries; A2 reuses index 2 and B1 references index 1.
+  constexpr std::string_view sst_xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<sst xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" count=\"3\" uniqueCount=\"3\">\n"
+      "  <si><t>shared-alpha</t></si>\n"
+      "  <si><t>shared-beta</t></si>\n"
+      "  <si><t>shared-gamma</t></si>\n"
+      "</sst>\n";
+  constexpr std::string_view styles_xml =
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+      "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n"
+      "  <cellXfs count=\"1\"><xf numFmtId=\"0\" fontId=\"0\" fillId=\"0\" borderId=\"0\"/></cellXfs>\n"
+      "</styleSheet>\n";
+
+  return BuildZip({
+      {"[Content_Types].xml", content_types},
+      {"_rels/.rels", kPackageRels},
+      {"xl/workbook.xml", workbook_xml},
+      {"xl/_rels/workbook.xml.rels", workbook_rels},
+      {"xl/worksheets/sheet1.xml", sheet_xml},
+      {"xl/sharedStrings.xml", sst_xml},
+      {"xl/styles.xml", styles_xml},
+  });
+}
+
+}  // namespace formulon::ooxml_corpus
diff --git a/tests/integration/ooxml_corpus_support.h b/tests/integration/ooxml_corpus_support.h
new file mode 100644
index 000000000..428a96726
--- /dev/null
+++ b/tests/integration/ooxml_corpus_support.h
@@ -0,0 +1,205 @@
+#pragma once
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "io/zip_reader.h"
+#include "passthrough_part.h"
+#include "sheet.h"
+#include "table.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "workbook.h"
+
+namespace formulon::ooxml_corpus {
+
+inline io::ByteSpan SpanOf(const std::vector<std::uint8_t>& bytes) {
+  return io::ByteSpan{bytes.data(), bytes.size()};
+}
+
+/// `save()` wrapper that ASSERTs success and returns the bytes.
+inline Expected<std::vector<std::uint8_t>, Error> SaveBytes(const Workbook& wb) {
+  return wb.save();
+}
+
+/// Two workbooks have the same sheet shape iff they have the same
+/// number of sheets, the i-th sheet on each has the same display name,
+/// and the i-th sheet on each holds the same total `cell_count()`. We
+/// intentionally do NOT compare the geometric `(rows x cols)` extents
+/// because the row store grows lazily and the on-disk projection
+/// depends only on populated cells.
+inline bool sheets_have_same_shape(const Workbook& a, const Workbook& b) {
+  if (a.sheet_count() != b.sheet_count()) {
+    return false;
+  }
+  for (std::size_t i = 0; i < a.sheet_count(); ++i) {
+    if (a.sheet(i).name() != b.sheet(i).name()) {
+      return false;
+    }
+    if (a.sheet(i).cell_count() != b.sheet(i).cell_count()) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/// Order-preserving by name, plus the four scalar fields. The reader
+/// preserves declaration order, and the writer emits in that order, so
+/// equality must be index-aligned rather than set-equal.
+inline bool defined_names_equal(const Workbook& a, const Workbook& b) {
+  if (a.defined_names().size() != b.defined_names().size()) {
+    return false;
+  }
+  for (std::size_t i = 0; i < a.defined_names().size(); ++i) {
+    const DefinedName& x = a.defined_names()[i];
+    const DefinedName& y = b.defined_names()[i];
+    if (x.name != y.name || x.formula != y.formula || x.local_sheet_id != y.local_sheet_id || x.hidden != y.hidden ||
+        x.comment != y.comment) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/// Tables compared by id, ref, name, display_name, header/totals row
+/// flags, sheet index, and column-list shape (id + name). Other column
+/// fields (totals_label / totals_function) are not asserted here
+/// because the corpus does not stress them across all books; the
+/// per-book invariants check those where relevant.
+inline bool tables_equal(const Workbook& a, const Workbook& b) {
+  if (a.tables().size() != b.tables().size()) {
+    return false;
+  }
+  for (std::size_t i = 0; i < a.tables().size(); ++i) {
+    const TableMetadata& x = a.tables()[i];
+    const TableMetadata& y = b.tables()[i];
+    if (x.id != y.id || x.name != y.name || x.display_name != y.display_name || x.ref != y.ref ||
+        x.sheet_index != y.sheet_index || x.header_row != y.header_row || x.totals_row != y.totals_row) {
+      return false;
+    }
+    if (x.columns.size() != y.columns.size()) {
+      return false;
+    }
+    for (std::size_t c = 0; c < x.columns.size(); ++c) {
+      if (x.columns[c].id != y.columns[c].id || x.columns[c].name != y.columns[c].name) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+/// Passthrough parts are compared by path + raw bytes (content_type
+/// is also compared when both sides have one). Order is preserved in
+/// the round-trip but the assertion is set-style: we look up by path
+/// so re-emission ordering is not load-bearing.
+inline bool passthrough_parts_equal(const Workbook& a, const Workbook& b) {
+  if (a.passthrough_parts().size() != b.passthrough_parts().size()) {
+    return false;
+  }
+  for (const PassthroughPart& x : a.passthrough_parts()) {
+    auto it = std::find_if(b.passthrough_parts().begin(), b.passthrough_parts().end(),
+                           [&x](const PassthroughPart& y) { return y.path == x.path; });
+    if (it == b.passthrough_parts().end()) {
+      return false;
+    }
+    if (x.bytes.size() != it->bytes.size()) {
+      return false;
+    }
+    if (!std::equal(x.bytes.begin(), x.bytes.end(), it->bytes.begin())) {
+      return false;
+    }
+    if (!x.content_type.empty() && !it->content_type.empty() && x.content_type != it->content_type) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/// Iterates every cell with a non-empty formula on `a` and asserts the
+/// same coordinate on `b` carries the same formula text. Used by the
+/// volatile / iterative cases where cached values legitimately drift
+/// across recalcs but the formulas themselves must round-trip
+/// verbatim.
+inline bool formula_texts_equal_for_each_cell(const Workbook& a, const Workbook& b) {
+  if (a.sheet_count() != b.sheet_count()) {
+    return false;
+  }
+  for (std::size_t s = 0; s < a.sheet_count(); ++s) {
+    const Sheet& sa = a.sheet(s);
+    const Sheet& sb = b.sheet(s);
+    for (const auto& [row, cells] : sa.rows()) {
+      for (std::uint32_t col = 0; col < cells.size(); ++col) {
+        const Cell& ca = cells[col];
+        if (ca.formula_text.empty()) {
+          continue;
+        }
+        const Cell* cb = sb.cell_at(row, col);
+        if (cb == nullptr || cb->formula_text != ca.formula_text) {
+          return false;
+        }
+      }
+    }
+  }
+  return true;
+}
+
+struct CorpusBook {
+  std::string id;
+  std::function<Expected<std::vector<std::uint8_t>, Error>()> build;
+  std::function<void(const Workbook&)> assert_invariants;
+};
+
+Expected<std::vector<std::uint8_t>, Error> BuildPassthroughThemeArchive();
+Expected<std::vector<std::uint8_t>, Error> BuildSstArchive();
+
+Expected<std::vector<std::uint8_t>, Error> BuildEmpty();
+Expected<std::vector<std::uint8_t>, Error> BuildSingleLiteral();
+Expected<std::vector<std::uint8_t>, Error> BuildLiteralsAllKinds();
+Expected<std::vector<std::uint8_t>, Error> BuildArithmetic();
+Expected<std::vector<std::uint8_t>, Error> BuildCrossSheet();
+Expected<std::vector<std::uint8_t>, Error> BuildMultiSheetIndependent();
+Expected<std::vector<std::uint8_t>, Error> BuildUnicodeSheetNames();
+Expected<std::vector<std::uint8_t>, Error> BuildUnicodeCellText();
+Expected<std::vector<std::uint8_t>, Error> BuildRangeAggregates();
+Expected<std::vector<std::uint8_t>, Error> BuildVolatileNowToday();
+Expected<std::vector<std::uint8_t>, Error> BuildIterativeCircular();
+Expected<std::vector<std::uint8_t>, Error> BuildDefinedNamesWorkbookScope();
+Expected<std::vector<std::uint8_t>, Error> BuildDefinedNamesSheetScope();
+Expected<std::vector<std::uint8_t>, Error> BuildSingleTable();
+Expected<std::vector<std::uint8_t>, Error> BuildMultipleTables();
+Expected<std::vector<std::uint8_t>, Error> BuildNestedFunctionCalls();
+Expected<std::vector<std::uint8_t>, Error> BuildLargeGrid500Cells();
+Expected<std::vector<std::uint8_t>, Error> BuildKitchenSink();
+
+void AssertEmpty(const Workbook& wb);
+void AssertSingleLiteral(const Workbook& wb);
+void AssertLiteralsAllKinds(const Workbook& wb);
+void AssertArithmetic(const Workbook& wb);
+void AssertCrossSheet(const Workbook& wb);
+void AssertMultiSheetIndependent(const Workbook& wb);
+void AssertUnicodeSheetNames(const Workbook& wb);
+void AssertUnicodeCellText(const Workbook& wb);
+void AssertRangeAggregates(const Workbook& wb);
+void AssertVolatileNowToday(const Workbook& wb);
+void AssertIterativeCircular(const Workbook& wb);
+void AssertDefinedNamesWorkbookScope(const Workbook& wb);
+void AssertDefinedNamesSheetScope(const Workbook& wb);
+void AssertSingleTable(const Workbook& wb);
+void AssertMultipleTables(const Workbook& wb);
+void AssertNestedFunctionCalls(const Workbook& wb);
+void AssertLargeGrid(const Workbook& wb);
+void AssertPassthroughTheme(const Workbook& wb);
+void AssertSstCells(const Workbook& wb);
+void AssertKitchenSink(const Workbook& wb);
+
+std::vector<CorpusBook> make_corpus();
+
+}  // namespace formulon::ooxml_corpus
diff --git a/tests/integration/ooxml_corpus_test.cpp b/tests/integration/ooxml_corpus_test.cpp
index 6b4deddde..934612650 100644
--- a/tests/integration/ooxml_corpus_test.cpp
+++ b/tests/integration/ooxml_corpus_test.cpp
@@ -1,1056 +1,21 @@
-//
 // OOXML round-trip parity over a 20-book minimal corpus.
 //
-// This is the M6.core exit gate test. It builds 20 distinct
-// synthetic workbooks programmatically (no committed binary fixtures)
-// covering the union of features the M6.core slice supports, and runs
-// each through a two-cycle round-trip pipeline:
-//
-//   1. construct in-memory (via the public Workbook API or, for the
-//      explicit-SST / passthrough cases, via miniz);
-//   2. `read_ooxml` into workbook A;
-//   3. `recalc(default_registry())` so cached values are populated;
-//   4. `write_ooxml` -> bytes B;
-//   5. `read_ooxml(B)` into workbook C;
-//   6. `recalc(default_registry())` on C;
-//   7. compare salient invariants between A (post-recalc) and C
-//      (post-recalc): sheet shape, defined names, tables, passthrough
-//      parts, and per-cell formula text.
-//
-// Two cycles are deliberate: a single round-trip catches the gross
-// shape, but ordering / numbering / passthrough drift only surfaces on
-// the second pass when the writer's emitted ids and the reader's
-// re-derived ids must agree. Books that exercise volatile or iterative
-// features (NOW/TODAY/RAND, circular SCCs) compare formula text rather
-// than cached values, since the values legitimately drift across
-// recalcs.
+// The parameterized fixture and its formatter stay together so every corpus
+// id remains a stable gtest name. Builders, invariants, and package helpers
+// live in the adjacent topic files.
 
-#include <algorithm>
-#include <cstddef>
-#include <cstdint>
-#include <deque>
-#include <functional>
-#include <ostream>
 #include <string>
-#include <string_view>
-#include <utility>
-#include <vector>
 
-#include "cell.h"
-#include "defined_name.h"
 #include "eval/function_registry.h"
-#include "eval/iterative_solver.h"
 #include "eval/recalc_engine.h"
 #include "gtest/gtest.h"
 #include "io/ooxml_reader.h"
-#include "io/zip_reader.h"
-#include "miniz.h"
-#include "passthrough_part.h"
-#include "sheet.h"
-#include "table.h"
-#include "utils/error.h"
-#include "utils/expected.h"
-#include "utils/status_macros.h"
-#include "value.h"
-#include "workbook.h"
+#include "ooxml_corpus_support.h"
 
 namespace formulon {
 namespace {
 
-// ---------------------------------------------------------------------------
-// Small helpers shared across all corpus books.
-// ---------------------------------------------------------------------------
-
-io::ByteSpan SpanOf(const std::vector<std::uint8_t>& bytes) {
-  return io::ByteSpan{bytes.data(), bytes.size()};
-}
-
-/// `save()` wrapper that ASSERTs success and returns the bytes.
-Expected<std::vector<std::uint8_t>, Error> SaveBytes(const Workbook& wb) {
-  return wb.save();
-}
-
-/// Builds a synthetic `.xlsx` archive in memory by gluing a list of
-/// `(path, body)` pairs through miniz. Used for books 18 / 19 / 20
-/// where the source archive must contain shapes the writer does not
-/// emit on its own (explicit SST, passthrough theme part).
-struct PartFile {
-  const char* path;
-  std::string_view body;
-};
-
-Expected<std::vector<std::uint8_t>, Error> BuildZip(const std::vector<PartFile>& parts) {
-  mz_zip_archive writer{};
-  if (mz_zip_writer_init_heap(&writer, 0, 4096) == MZ_FALSE) {
-    return make_error(FormulonErrorCode::kIoZipCorrupt, "miniz writer init failed");
-  }
-  for (const PartFile& p : parts) {
-    if (mz_zip_writer_add_mem(&writer, p.path, p.body.data(), p.body.size(),
-                              static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)) == MZ_FALSE) {
-      mz_zip_writer_end(&writer);
-      return make_error(FormulonErrorCode::kIoZipCorrupt, std::string("miniz add failed for ") + p.path);
-    }
-  }
-  void* archive_ptr = nullptr;
-  std::size_t archive_size = 0;
-  if (mz_zip_writer_finalize_heap_archive(&writer, &archive_ptr, &archive_size) == MZ_FALSE) {
-    mz_zip_writer_end(&writer);
-    return make_error(FormulonErrorCode::kIoZipCorrupt, "miniz finalize failed");
-  }
-  std::vector<std::uint8_t> out(static_cast<const std::uint8_t*>(archive_ptr),
-                                static_cast<const std::uint8_t*>(archive_ptr) + archive_size);
-  mz_free(archive_ptr);
-  mz_zip_writer_end(&writer);
-  return out;
-}
-
-// ---------------------------------------------------------------------------
-// Cross-cycle equality helpers (the contract called out in the bundle).
-// All helpers take two workbooks (a "before" and "after" snapshot) and
-// return a bool that lets callers chain EXPECT_TRUE in the test body.
-// Doxygen on each documents what is — and is NOT — being compared so
-// future maintainers can extend rather than re-derive.
-// ---------------------------------------------------------------------------
-
-/// Two workbooks have the same sheet shape iff they have the same
-/// number of sheets, the i-th sheet on each has the same display name,
-/// and the i-th sheet on each holds the same total `cell_count()`. We
-/// intentionally do NOT compare the geometric `(rows x cols)` extents
-/// because the row store grows lazily and the on-disk projection
-/// depends only on populated cells.
-bool sheets_have_same_shape(const Workbook& a, const Workbook& b) {
-  if (a.sheet_count() != b.sheet_count()) {
-    return false;
-  }
-  for (std::size_t i = 0; i < a.sheet_count(); ++i) {
-    if (a.sheet(i).name() != b.sheet(i).name()) {
-      return false;
-    }
-    if (a.sheet(i).cell_count() != b.sheet(i).cell_count()) {
-      return false;
-    }
-  }
-  return true;
-}
-
-/// Order-preserving by name, plus the four scalar fields. The reader
-/// preserves declaration order, and the writer emits in that order, so
-/// equality must be index-aligned rather than set-equal.
-bool defined_names_equal(const Workbook& a, const Workbook& b) {
-  if (a.defined_names().size() != b.defined_names().size()) {
-    return false;
-  }
-  for (std::size_t i = 0; i < a.defined_names().size(); ++i) {
-    const DefinedName& x = a.defined_names()[i];
-    const DefinedName& y = b.defined_names()[i];
-    if (x.name != y.name || x.formula != y.formula || x.local_sheet_id != y.local_sheet_id || x.hidden != y.hidden ||
-        x.comment != y.comment) {
-      return false;
-    }
-  }
-  return true;
-}
-
-/// Tables compared by id, ref, name, display_name, header/totals row
-/// flags, sheet index, and column-list shape (id + name). Other column
-/// fields (totals_label / totals_function) are not asserted here
-/// because the corpus does not stress them across all books; the
-/// per-book invariants check those where relevant.
-bool tables_equal(const Workbook& a, const Workbook& b) {
-  if (a.tables().size() != b.tables().size()) {
-    return false;
-  }
-  for (std::size_t i = 0; i < a.tables().size(); ++i) {
-    const TableMetadata& x = a.tables()[i];
-    const TableMetadata& y = b.tables()[i];
-    if (x.id != y.id || x.name != y.name || x.display_name != y.display_name || x.ref != y.ref ||
-        x.sheet_index != y.sheet_index || x.header_row != y.header_row || x.totals_row != y.totals_row) {
-      return false;
-    }
-    if (x.columns.size() != y.columns.size()) {
-      return false;
-    }
-    for (std::size_t c = 0; c < x.columns.size(); ++c) {
-      if (x.columns[c].id != y.columns[c].id || x.columns[c].name != y.columns[c].name) {
-        return false;
-      }
-    }
-  }
-  return true;
-}
-
-/// Passthrough parts are compared by path + raw bytes (content_type
-/// is also compared when both sides have one). Order is preserved in
-/// the round-trip but the assertion is set-style: we look up by path
-/// so re-emission ordering is not load-bearing.
-bool passthrough_parts_equal(const Workbook& a, const Workbook& b) {
-  if (a.passthrough_parts().size() != b.passthrough_parts().size()) {
-    return false;
-  }
-  for (const PassthroughPart& x : a.passthrough_parts()) {
-    auto it = std::find_if(b.passthrough_parts().begin(), b.passthrough_parts().end(),
-                           [&x](const PassthroughPart& y) { return y.path == x.path; });
-    if (it == b.passthrough_parts().end()) {
-      return false;
-    }
-    if (x.bytes.size() != it->bytes.size()) {
-      return false;
-    }
-    if (!std::equal(x.bytes.begin(), x.bytes.end(), it->bytes.begin())) {
-      return false;
-    }
-    if (!x.content_type.empty() && !it->content_type.empty() && x.content_type != it->content_type) {
-      return false;
-    }
-  }
-  return true;
-}
-
-/// Iterates every cell with a non-empty formula on `a` and asserts the
-/// same coordinate on `b` carries the same formula text. Used by the
-/// volatile / iterative cases where cached values legitimately drift
-/// across recalcs but the formulas themselves must round-trip
-/// verbatim.
-bool formula_texts_equal_for_each_cell(const Workbook& a, const Workbook& b) {
-  if (a.sheet_count() != b.sheet_count()) {
-    return false;
-  }
-  for (std::size_t s = 0; s < a.sheet_count(); ++s) {
-    const Sheet& sa = a.sheet(s);
-    const Sheet& sb = b.sheet(s);
-    for (const auto& [row, cells] : sa.rows()) {
-      for (std::uint32_t col = 0; col < cells.size(); ++col) {
-        const Cell& ca = cells[col];
-        if (ca.formula_text.empty()) {
-          continue;
-        }
-        const Cell* cb = sb.cell_at(row, col);
-        if (cb == nullptr || cb->formula_text != ca.formula_text) {
-          return false;
-        }
-      }
-    }
-  }
-  return true;
-}
-
-// ---------------------------------------------------------------------------
-// Corpus contract.
-// ---------------------------------------------------------------------------
-
-/// One corpus book.
-///
-///   * `id`             — short, ctest-friendly identifier (no
-///                        whitespace, ASCII only).
-///   * `build`          — produces the source `.xlsx` bytes. Either
-///                        constructs a `Workbook` and saves it, or
-///                        builds an archive directly via miniz.
-///   * `assert_invariants` — invoked on the *post-recalc* workbook
-///                        after the first read; asserts the things
-///                        this book is supposed to verify (sheet
-///                        count, specific cell values, presence of a
-///                        passthrough part, ...). Failures land in the
-///                        parameterised test as the per-book GTest
-///                        failure.
-struct CorpusBook {
-  std::string id;
-  std::function<Expected<std::vector<std::uint8_t>, Error>()> build;
-  std::function<void(const Workbook&)> assert_invariants;
-};
-
-// ---------------------------------------------------------------------------
-// Synthetic-package builders for books 18 / 19 / 20.
-//
-// These archives contain shapes the writer does not currently emit on
-// its own (explicit SST, generic passthrough parts), so we build them
-// via miniz the same way the existing roundtrip + metadata suites do.
-// ---------------------------------------------------------------------------
-
-constexpr std::string_view kPackageRels =
-    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-    "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
-    "  <Relationship Id=\"rId1\" "
-    "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" "
-    "Target=\"xl/workbook.xml\"/>\n"
-    "</Relationships>\n";
-
-constexpr std::string_view kEmptySheetXml =
-    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-    "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n"
-    "  <sheetData/>\n"
-    "</worksheet>\n";
-
-/// Builds a synthetic `.xlsx` package containing a passthrough
-/// `xl/theme/theme1.xml` that the reader does not parse but Bundle 2.5
-/// promised to round-trip verbatim.
-Expected<std::vector<std::uint8_t>, Error> BuildPassthroughThemeArchive() {
-  constexpr std::string_view content_types =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">\n"
-      "  <Default Extension=\"rels\" "
-      "ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>\n"
-      "  <Default Extension=\"xml\" ContentType=\"application/xml\"/>\n"
-      "  <Override PartName=\"/xl/workbook.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/>\n"
-      "  <Override PartName=\"/xl/worksheets/sheet1.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/>\n"
-      "  <Override PartName=\"/xl/theme/theme1.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.theme+xml\"/>\n"
-      "</Types>\n";
-  constexpr std::string_view workbook_xml =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<workbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
-      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\">\n"
-      "  <sheets>\n"
-      "    <sheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/>\n"
-      "  </sheets>\n"
-      "</workbook>\n";
-  constexpr std::string_view workbook_rels =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
-      "  <Relationship Id=\"rId1\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
-      "Target=\"worksheets/sheet1.xml\"/>\n"
-      "</Relationships>\n";
-  // Distinctive payload so the round-trip assertion is meaningful.
-  constexpr std::string_view theme_xml =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<a:theme xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\" name=\"CorpusStub\">\n"
-      "  <a:themeElements/>\n"
-      "</a:theme>\n";
-
-  return BuildZip({
-      {"[Content_Types].xml", content_types},
-      {"_rels/.rels", kPackageRels},
-      {"xl/workbook.xml", workbook_xml},
-      {"xl/_rels/workbook.xml.rels", workbook_rels},
-      {"xl/worksheets/sheet1.xml", kEmptySheetXml},
-      {"xl/theme/theme1.xml", theme_xml},
-  });
-}
-
-/// Builds a synthetic `.xlsx` package whose Sheet1 references a real
-/// `xl/sharedStrings.xml`. Verifies Bundle 2.3 + 2.5 inline-string
-/// re-emission preserves the SST text payloads through the writer.
-Expected<std::vector<std::uint8_t>, Error> BuildSstArchive() {
-  constexpr std::string_view content_types =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">\n"
-      "  <Default Extension=\"rels\" "
-      "ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>\n"
-      "  <Default Extension=\"xml\" ContentType=\"application/xml\"/>\n"
-      "  <Override PartName=\"/xl/workbook.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/>\n"
-      "  <Override PartName=\"/xl/worksheets/sheet1.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/>\n"
-      "  <Override PartName=\"/xl/sharedStrings.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml\"/>\n"
-      "  <Override PartName=\"/xl/styles.xml\" "
-      "ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml\"/>\n"
-      "</Types>\n";
-  constexpr std::string_view workbook_xml =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<workbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" "
-      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\">\n"
-      "  <sheets>\n"
-      "    <sheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/>\n"
-      "  </sheets>\n"
-      "</workbook>\n";
-  constexpr std::string_view workbook_rels =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">\n"
-      "  <Relationship Id=\"rId1\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
-      "Target=\"worksheets/sheet1.xml\"/>\n"
-      "  <Relationship Id=\"rId2\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings\" "
-      "Target=\"sharedStrings.xml\"/>\n"
-      "  <Relationship Id=\"rId3\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles\" "
-      "Target=\"styles.xml\"/>\n"
-      "</Relationships>\n";
-  constexpr std::string_view sheet_xml =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n"
-      "  <sheetData>\n"
-      "    <row r=\"1\"><c r=\"A1\" t=\"s\"><v>0</v></c><c r=\"B1\" t=\"s\"><v>1</v></c></row>\n"
-      "    <row r=\"2\"><c r=\"A2\" t=\"s\"><v>2</v></c></row>\n"
-      "  </sheetData>\n"
-      "</worksheet>\n";
-  // Three SST entries; A2 reuses index 2 and B1 references index 1.
-  constexpr std::string_view sst_xml =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<sst xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" count=\"3\" uniqueCount=\"3\">\n"
-      "  <si><t>shared-alpha</t></si>\n"
-      "  <si><t>shared-beta</t></si>\n"
-      "  <si><t>shared-gamma</t></si>\n"
-      "</sst>\n";
-  constexpr std::string_view styles_xml =
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
-      "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">\n"
-      "  <cellXfs count=\"1\"><xf numFmtId=\"0\" fontId=\"0\" fillId=\"0\" borderId=\"0\"/></cellXfs>\n"
-      "</styleSheet>\n";
-
-  return BuildZip({
-      {"[Content_Types].xml", content_types},
-      {"_rels/.rels", kPackageRels},
-      {"xl/workbook.xml", workbook_xml},
-      {"xl/_rels/workbook.xml.rels", workbook_rels},
-      {"xl/worksheets/sheet1.xml", sheet_xml},
-      {"xl/sharedStrings.xml", sst_xml},
-      {"xl/styles.xml", styles_xml},
-  });
-}
-
-// ---------------------------------------------------------------------------
-// Pure-API builders for books 1-17 and the kitchen-sink combo (book 20).
-//
-// Each builder returns the source `.xlsx` bytes; the test driver
-// performs the `read -> recalc -> write -> read -> recalc` two-cycle
-// pipeline. For most books we go through `Workbook::set_cell_value /
-// set_cell_formula` and the high-level `add_sheet` API; tables and
-// defined names are attached via the dedicated setters.
-// ---------------------------------------------------------------------------
-
-Expected<std::vector<std::uint8_t>, Error> BuildEmpty() {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildSingleLiteral() {
-  Workbook wb = Workbook::create();
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(123.5)));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildLiteralsAllKinds() {
-  Workbook wb = Workbook::create();
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(42.0)));
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 1U, 0U, Value::boolean(true)));
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 2U, 0U, Value::boolean(false)));
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 3U, 0U, Value::text("hello")));
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 4U, 0U, Value::blank()));
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 5U, 0U, Value::error(ErrorCode::Div0)));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildArithmetic() {
-  // NOTE: the `&` (text-concat) operator is intentionally omitted here.
-  // Bundle 2.6 surfaced an existing engine limitation: the OOXML writer
-  // emits formula cells with text cached values as `<v>foobar</v>`
-  // (no `t="str"`), which the reader then parses as `t='n'` and
-  // rejects. That is a writer bug to fix in a follow-up bundle; the
-  // corpus avoids triggering it so the round-trip parity test stays
-  // green for the arithmetic surface itself.
-  Workbook wb = Workbook::create();
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0)));  // A1
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 1U, 0U, Value::number(3.0)));   // A2
-  // Formulas covering + - * / ^ % and unary minus (no `&`).
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=A1+A2"));  // B1 -> 13
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 1U, 1U, "=A1-A2"));  // B2 -> 7
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 2U, 1U, "=A1*A2"));  // B3 -> 30
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 3U, 1U, "=A1/A2"));  // B4 -> 3.333..
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 4U, 1U, "=A1^A2"));  // B5 -> 1000
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 5U, 1U, "=A1%"));    // B6 -> 0.1
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 6U, 1U, "=-A1"));    // B7 -> -10
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildCrossSheet() {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  wb.add_sheet("Sheet2");
-  RETURN_IF_ERROR(wb.set_cell_value(1U, 0U, 0U, Value::number(99.0)));  // Sheet2!A1
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 0U, "=Sheet2!A1"));       // Sheet1!A1
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildMultiSheetIndependent() {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("North");
-  wb.add_sheet("South");
-  wb.add_sheet("East");
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0)));
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=A1+1"));
-  RETURN_IF_ERROR(wb.set_cell_value(1U, 0U, 0U, Value::number(2.0)));
-  RETURN_IF_ERROR(wb.set_cell_formula(1U, 0U, 1U, "=A1*2"));
-  RETURN_IF_ERROR(wb.set_cell_value(2U, 0U, 0U, Value::number(3.0)));
-  RETURN_IF_ERROR(wb.set_cell_formula(2U, 0U, 1U, "=A1-1"));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildUnicodeSheetNames() {
-  Workbook wb = Workbook::create_empty();
-  // "日本語" (Japanese) — exercises non-ASCII XML attribute encoding.
-  wb.add_sheet("\xE6\x97\xA5\xE6\x9C\xAC\xE8\xAA\x9E");
-  // emoji + ASCII — exercises 4-byte UTF-8 in attribute context.
-  wb.add_sheet("emoji\xF0\x9F\x98\x80");
-  // Spaces and digits — exercises plain attribute round-trip.
-  wb.add_sheet("Sheet 3 with spaces");
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildUnicodeCellText() {
-  Workbook wb = Workbook::create();
-  // Japanese.
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::text("\xE6\x97\xA5\xE6\x9C\xAC\xE8\xAA\x9E")));
-  // Emoji (4-byte UTF-8).
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 1U, 0U, Value::text("Hello \xF0\x9F\x98\x80")));
-  // NBSP (U+00A0).
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 2U, 0U, Value::text("a\xC2\xA0\x62")));
-  // Hebrew "shalom" — Right-to-left script. We are not asserting bidi
-  // rendering, just that the bytes survive a round-trip.
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 3U, 0U, Value::text("\xD7\xA9\xD7\x9C\xD7\x95\xD7\x9D")));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildRangeAggregates() {
-  Workbook wb = Workbook::create();
-  // Populate A1:A10 with 1..10.
-  for (std::uint32_t r = 0; r < 10U; ++r) {
-    RETURN_IF_ERROR(wb.set_cell_value(0U, r, 0U, Value::number(static_cast<double>(r + 1U))));
-  }
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=SUM(A1:A10)"));      // B1 -> 55
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 1U, 1U, "=AVERAGE(A1:A10)"));  // B2 -> 5.5
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 2U, 1U, "=MIN(A1:A10)"));      // B3 -> 1
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 3U, 1U, "=MAX(A1:A10)"));      // B4 -> 10
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 4U, 1U, "=COUNT(A1:A10)"));    // B5 -> 10
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildVolatileNowToday() {
-  Workbook wb = Workbook::create();
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 0U, "=NOW()"));
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 1U, 0U, "=TODAY()"));
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 2U, 0U, "=RAND()"));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildIterativeCircular() {
-  Workbook wb = Workbook::create();
-  // A1 = B1 + 1; B1 = A1.
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 0U, "=B1+1"));
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=A1"));
-  IterativeOptions opts;
-  opts.enabled = true;
-  opts.max_iterations = 20U;
-  opts.max_change = 0.01;
-  wb.set_iterative_options(opts);
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildDefinedNamesWorkbookScope() {
-  Workbook wb = Workbook::create();
-  std::vector<DefinedName> names;
-  DefinedName n;
-  n.name = "Sales";
-  n.formula = "Sheet1!$A$1:$A$10";
-  names.push_back(std::move(n));
-  wb.set_defined_names(std::move(names));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildDefinedNamesSheetScope() {
-  Workbook wb = Workbook::create();
-  std::vector<DefinedName> names;
-  DefinedName n;
-  n.name = "LocalRange";
-  n.formula = "Sheet1!$B$1:$B$5";
-  n.local_sheet_id = 0;
-  n.hidden = true;
-  n.comment = "Sheet1-only.";
-  names.push_back(std::move(n));
-  wb.set_defined_names(std::move(names));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildSingleTable() {
-  Workbook wb = Workbook::create();
-  TableMetadata table;
-  table.id = 1U;
-  table.name = "SalesTable";
-  table.display_name = "SalesTable";
-  table.ref = "A1:C5";
-  table.sheet_index = 0U;
-  table.header_row = true;
-  table.totals_row = true;
-  table.columns.push_back(TableColumn{1U, "Region", "Total", "", ""});
-  table.columns.push_back(TableColumn{2U, "Q1", "", "sum", ""});
-  table.columns.push_back(TableColumn{3U, "Q2", "", "sum", ""});
-  std::vector<TableMetadata> tables;
-  tables.push_back(std::move(table));
-  wb.set_tables(std::move(tables));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildMultipleTables() {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  wb.add_sheet("Sheet2");
-
-  std::vector<TableMetadata> tables;
-  TableMetadata t1;
-  t1.id = 1U;
-  t1.name = "Tbl1";
-  t1.display_name = "Tbl1";
-  t1.ref = "A1:B3";
-  t1.sheet_index = 0U;
-  t1.columns.push_back(TableColumn{1U, "X", "", "", ""});
-  t1.columns.push_back(TableColumn{2U, "Y", "", "", ""});
-  tables.push_back(std::move(t1));
-
-  TableMetadata t2;
-  t2.id = 2U;
-  t2.name = "Tbl2";
-  t2.display_name = "Tbl2";
-  t2.ref = "A1:B2";
-  t2.sheet_index = 0U;
-  t2.columns.push_back(TableColumn{1U, "P", "", "", ""});
-  t2.columns.push_back(TableColumn{2U, "Q", "", "", ""});
-  tables.push_back(std::move(t2));
-
-  TableMetadata t3;
-  t3.id = 3U;
-  t3.name = "Tbl3";
-  t3.display_name = "Tbl3";
-  t3.ref = "A1:A2";
-  t3.sheet_index = 1U;
-  t3.columns.push_back(TableColumn{1U, "Z", "", "", ""});
-  tables.push_back(std::move(t3));
-
-  wb.set_tables(std::move(tables));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildNestedFunctionCalls() {
-  // Deeply nested IF/AND/OR with numeric branches only — text branch
-  // results would trigger the same `<v>` round-trip limitation called
-  // out in `BuildArithmetic`. Logic: (A1>0 OR A2<0) AND (A3=8) is true,
-  // and A1+A2 (=8) > A3 (=8) is false, so the formula falls into the
-  // inner else-branch and yields A2 (=3).
-  Workbook wb = Workbook::create();
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(5.0)));  // A1
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 1U, 0U, Value::number(3.0)));  // A2
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 2U, 0U, Value::number(8.0)));  // A3
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 0U, 1U, "=IF(AND(OR(A1>0,A2<0),A3=8),IF(A1+A2>A3,A1,A2),0)"));
-  return SaveBytes(wb);
-}
-
-Expected<std::vector<std::uint8_t>, Error> BuildLargeGrid500Cells() {
-  // 500 cells across A1:T25 (20 columns x 25 rows). Mix of numeric
-  // literals, text, and formulas referencing earlier cells.
-  //
-  // `Value::text` is non-owning, so we materialise the per-row label
-  // strings into a function-static `std::deque<std::string>`: the
-  // deque keeps element addresses stable across appends and persists
-  // until program teardown, which is well past the round-trip pipeline
-  // (the workbook reads `cached_value.as_text()` during `save()` and
-  // discards the view afterward, but the value still has to be alive
-  // through that read).
-  static std::deque<std::string> kLabels;
-  static const bool kInitialised = [&]() {
-    for (std::uint32_t r = 0; r < 25U; ++r) {
-      kLabels.push_back("L" + std::to_string(r));
-    }
-    return true;
-  }();
-  (void)kInitialised;
-
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 25U; ++r) {
-    for (std::uint32_t c = 0; c < 20U; ++c) {
-      if ((r + c) % 7U == 0U) {
-        RETURN_IF_ERROR(wb.set_cell_value(0U, r, c, Value::text(kLabels[r])));
-      } else if ((r + c) % 3U == 0U && r > 0U) {
-        // Formula referencing the cell directly above (1-based row).
-        const std::string col_letter(1U, static_cast<char>('A' + c));
-        const std::string ref_above = col_letter + std::to_string(r);
-        RETURN_IF_ERROR(wb.set_cell_formula(0U, r, c, "=" + ref_above + "+1"));
-      } else {
-        RETURN_IF_ERROR(wb.set_cell_value(0U, r, c, Value::number(static_cast<double>(r * 20U + c))));
-      }
-    }
-  }
-  return SaveBytes(wb);
-}
-
-/// Combined kitchen-sink: 2 sheets, a defined name, a table, a
-/// passthrough theme part, mixed formulas, unicode text, and an
-/// iterative circular pair. We can't add a passthrough part via the
-/// public Workbook API alone (the writer copies it through, but the
-/// only way to get one in is to read an archive that already has it),
-/// so we build the synthetic theme archive, read it, then mutate the
-/// workbook to add the rest of the surfaces, then save.
-Expected<std::vector<std::uint8_t>, Error> BuildKitchenSink() {
-  ASSIGN_OR_RETURN(auto theme_bytes, BuildPassthroughThemeArchive());
-  ASSIGN_OR_RETURN(auto first_or, io::read_ooxml(SpanOf(theme_bytes)));
-  Workbook wb = std::move(first_or.workbook);
-
-  // Add a second sheet.
-  wb.add_sheet("\xE6\x97\xA5\xE6\x9C\xAC");  // "日本"
-
-  // Defined name (workbook-scope).
-  std::vector<DefinedName> names;
-  DefinedName n;
-  n.name = "ComboName";
-  n.formula = "Sheet1!$A$1";
-  names.push_back(std::move(n));
-  wb.set_defined_names(std::move(names));
-
-  // Table on Sheet1.
-  TableMetadata tab;
-  tab.id = 1U;
-  tab.name = "ComboTable";
-  tab.display_name = "ComboTable";
-  tab.ref = "A1:B2";
-  tab.sheet_index = 0U;
-  tab.columns.push_back(TableColumn{1U, "Alpha", "", "", ""});
-  tab.columns.push_back(TableColumn{2U, "Beta", "", "", ""});
-  std::vector<TableMetadata> tables;
-  tables.push_back(std::move(tab));
-  wb.set_tables(std::move(tables));
-
-  // Mixed formulas + unicode text.
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 0U, Value::number(3.14)));                    // A1
-  RETURN_IF_ERROR(wb.set_cell_formula(0U, 1U, 0U, "=A1*2"));                              // A2
-  RETURN_IF_ERROR(wb.set_cell_value(0U, 0U, 1U, Value::text("\xE3\x81\x82")));            // B1: "あ"
-  RETURN_IF_ERROR(wb.set_cell_value(1U, 0U, 0U, Value::text("Hello \xF0\x9F\x91\x8B")));  // emoji wave
-
-  // Iterative circular pair on Sheet2 (rows 5-6).
-  RETURN_IF_ERROR(wb.set_cell_formula(1U, 5U, 0U, "=B6+0.5"));
-  RETURN_IF_ERROR(wb.set_cell_formula(1U, 5U, 1U, "=A6"));
-  IterativeOptions opts;
-  opts.enabled = true;
-  opts.max_iterations = 20U;
-  opts.max_change = 0.01;
-  wb.set_iterative_options(opts);
-
-  return SaveBytes(wb);
-}
-
-// ---------------------------------------------------------------------------
-// Per-book invariant assertions. Each `assert_invariants` runs against
-// the *post-recalc* first-cycle workbook and checks the things that
-// book is supposed to verify. The two-cycle equality contract handles
-// the "shape did not drift" claim separately, in the parameterised
-// driver.
-// ---------------------------------------------------------------------------
-
-const Cell* CellAt(const Workbook& wb, std::size_t s, std::uint32_t r, std::uint32_t c) {
-  return wb.sheet(s).cell_at(r, c);
-}
-
-void AssertEmpty(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  EXPECT_EQ(wb.sheet(0).name(), "Sheet1");
-  EXPECT_EQ(wb.sheet(0).cell_count(), 0U);
-}
-
-void AssertSingleLiteral(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
-  ASSERT_NE(a1, nullptr);
-  ASSERT_TRUE(a1->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(a1->cached_value.as_number(), 123.5);
-}
-
-void AssertLiteralsAllKinds(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
-  ASSERT_NE(a1, nullptr);
-  ASSERT_TRUE(a1->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(a1->cached_value.as_number(), 42.0);
-
-  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
-  ASSERT_NE(a2, nullptr);
-  ASSERT_TRUE(a2->cached_value.is_boolean());
-  EXPECT_TRUE(a2->cached_value.as_boolean());
-
-  const Cell* a3 = CellAt(wb, 0U, 2U, 0U);
-  ASSERT_NE(a3, nullptr);
-  ASSERT_TRUE(a3->cached_value.is_boolean());
-  EXPECT_FALSE(a3->cached_value.as_boolean());
-
-  const Cell* a4 = CellAt(wb, 0U, 3U, 0U);
-  ASSERT_NE(a4, nullptr);
-  ASSERT_TRUE(a4->cached_value.is_text());
-  EXPECT_EQ(a4->cached_value.as_text(), "hello");
-
-  const Cell* a6 = CellAt(wb, 0U, 5U, 0U);
-  ASSERT_NE(a6, nullptr);
-  ASSERT_TRUE(a6->cached_value.is_error());
-  EXPECT_EQ(a6->cached_value.as_error(), ErrorCode::Div0);
-}
-
-void AssertArithmetic(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  const Cell* b1 = CellAt(wb, 0U, 0U, 1U);  // =A1+A2
-  const Cell* b2 = CellAt(wb, 0U, 1U, 1U);  // =A1-A2
-  const Cell* b3 = CellAt(wb, 0U, 2U, 1U);  // =A1*A2
-  const Cell* b5 = CellAt(wb, 0U, 4U, 1U);  // =A1^A2
-  const Cell* b7 = CellAt(wb, 0U, 6U, 1U);  // =-A1
-  ASSERT_NE(b1, nullptr);
-  ASSERT_NE(b2, nullptr);
-  ASSERT_NE(b3, nullptr);
-  ASSERT_NE(b5, nullptr);
-  ASSERT_NE(b7, nullptr);
-  ASSERT_TRUE(b1->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(b1->cached_value.as_number(), 13.0);
-  ASSERT_TRUE(b2->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(b2->cached_value.as_number(), 7.0);
-  ASSERT_TRUE(b3->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(b3->cached_value.as_number(), 30.0);
-  ASSERT_TRUE(b5->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(b5->cached_value.as_number(), 1000.0);
-  ASSERT_TRUE(b7->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(b7->cached_value.as_number(), -10.0);
-}
-
-void AssertCrossSheet(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 2U);
-  EXPECT_EQ(wb.sheet(0).name(), "Sheet1");
-  EXPECT_EQ(wb.sheet(1).name(), "Sheet2");
-  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
-  ASSERT_NE(a1, nullptr);
-  ASSERT_TRUE(a1->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(a1->cached_value.as_number(), 99.0);
-}
-
-void AssertMultiSheetIndependent(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 3U);
-  EXPECT_EQ(wb.sheet(0).name(), "North");
-  EXPECT_EQ(wb.sheet(1).name(), "South");
-  EXPECT_EQ(wb.sheet(2).name(), "East");
-  const Cell* north_b1 = CellAt(wb, 0U, 0U, 1U);
-  const Cell* south_b1 = CellAt(wb, 1U, 0U, 1U);
-  const Cell* east_b1 = CellAt(wb, 2U, 0U, 1U);
-  ASSERT_NE(north_b1, nullptr);
-  ASSERT_NE(south_b1, nullptr);
-  ASSERT_NE(east_b1, nullptr);
-  ASSERT_TRUE(north_b1->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(north_b1->cached_value.as_number(), 2.0);
-  ASSERT_TRUE(south_b1->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(south_b1->cached_value.as_number(), 4.0);
-  ASSERT_TRUE(east_b1->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(east_b1->cached_value.as_number(), 2.0);
-}
-
-void AssertUnicodeSheetNames(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 3U);
-  EXPECT_EQ(wb.sheet(0).name(), "\xE6\x97\xA5\xE6\x9C\xAC\xE8\xAA\x9E");
-  EXPECT_EQ(wb.sheet(1).name(), "emoji\xF0\x9F\x98\x80");
-  EXPECT_EQ(wb.sheet(2).name(), "Sheet 3 with spaces");
-}
-
-void AssertUnicodeCellText(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
-  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
-  const Cell* a3 = CellAt(wb, 0U, 2U, 0U);
-  const Cell* a4 = CellAt(wb, 0U, 3U, 0U);
-  ASSERT_NE(a1, nullptr);
-  ASSERT_NE(a2, nullptr);
-  ASSERT_NE(a3, nullptr);
-  ASSERT_NE(a4, nullptr);
-  ASSERT_TRUE(a1->cached_value.is_text());
-  EXPECT_EQ(a1->cached_value.as_text(), "\xE6\x97\xA5\xE6\x9C\xAC\xE8\xAA\x9E");
-  ASSERT_TRUE(a2->cached_value.is_text());
-  EXPECT_EQ(a2->cached_value.as_text(), "Hello \xF0\x9F\x98\x80");
-}
-
-void AssertRangeAggregates(const Workbook& wb) {
-  const Cell* sum = CellAt(wb, 0U, 0U, 1U);
-  const Cell* avg = CellAt(wb, 0U, 1U, 1U);
-  const Cell* mn = CellAt(wb, 0U, 2U, 1U);
-  const Cell* mx = CellAt(wb, 0U, 3U, 1U);
-  const Cell* cnt = CellAt(wb, 0U, 4U, 1U);
-  ASSERT_NE(sum, nullptr);
-  ASSERT_NE(avg, nullptr);
-  ASSERT_NE(mn, nullptr);
-  ASSERT_NE(mx, nullptr);
-  ASSERT_NE(cnt, nullptr);
-  ASSERT_TRUE(sum->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(sum->cached_value.as_number(), 55.0);
-  ASSERT_TRUE(avg->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(avg->cached_value.as_number(), 5.5);
-  ASSERT_TRUE(mn->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(mn->cached_value.as_number(), 1.0);
-  ASSERT_TRUE(mx->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(mx->cached_value.as_number(), 10.0);
-  ASSERT_TRUE(cnt->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(cnt->cached_value.as_number(), 10.0);
-}
-
-void AssertVolatileNowToday(const Workbook& wb) {
-  // Cached values WILL drift across recalcs; we only check that the
-  // formula text was preserved.
-  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
-  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
-  const Cell* a3 = CellAt(wb, 0U, 2U, 0U);
-  ASSERT_NE(a1, nullptr);
-  ASSERT_NE(a2, nullptr);
-  ASSERT_NE(a3, nullptr);
-  EXPECT_EQ(a1->formula_text, "=NOW()");
-  EXPECT_EQ(a2->formula_text, "=TODAY()");
-  EXPECT_EQ(a3->formula_text, "=RAND()");
-}
-
-void AssertIterativeCircular(const Workbook& wb) {
-  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
-  const Cell* b1 = CellAt(wb, 0U, 0U, 1U);
-  ASSERT_NE(a1, nullptr);
-  ASSERT_NE(b1, nullptr);
-  EXPECT_EQ(a1->formula_text, "=B1+1");
-  EXPECT_EQ(b1->formula_text, "=A1");
-  // The cached values are observable but not pinned: depending on
-  // whether iterative options were re-applied, the SCC will resolve
-  // either to a converged numeric pair (iterative on) or to #REF!
-  // (iterative off — the writer does not yet persist `<calcPr
-  // iterate=...>`). Either is acceptable here; the formula text is
-  // the load-bearing invariant.
-}
-
-void AssertDefinedNamesWorkbookScope(const Workbook& wb) {
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  EXPECT_EQ(wb.defined_names()[0].name, "Sales");
-  EXPECT_EQ(wb.defined_names()[0].formula, "Sheet1!$A$1:$A$10");
-  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, -1);
-  EXPECT_FALSE(wb.defined_names()[0].hidden);
-}
-
-void AssertDefinedNamesSheetScope(const Workbook& wb) {
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  EXPECT_EQ(wb.defined_names()[0].name, "LocalRange");
-  EXPECT_EQ(wb.defined_names()[0].formula, "Sheet1!$B$1:$B$5");
-  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, 0);
-  EXPECT_TRUE(wb.defined_names()[0].hidden);
-  EXPECT_EQ(wb.defined_names()[0].comment, "Sheet1-only.");
-}
-
-void AssertSingleTable(const Workbook& wb) {
-  ASSERT_EQ(wb.tables().size(), 1U);
-  const TableMetadata& t = wb.tables()[0];
-  EXPECT_EQ(t.name, "SalesTable");
-  EXPECT_EQ(t.ref, "A1:C5");
-  ASSERT_EQ(t.columns.size(), 3U);
-  EXPECT_EQ(t.columns[0].name, "Region");
-}
-
-void AssertMultipleTables(const Workbook& wb) {
-  ASSERT_EQ(wb.tables().size(), 3U);
-  EXPECT_EQ(wb.tables()[0].name, "Tbl1");
-  EXPECT_EQ(wb.tables()[1].name, "Tbl2");
-  EXPECT_EQ(wb.tables()[2].name, "Tbl3");
-  EXPECT_EQ(wb.tables()[0].sheet_index, 0U);
-  EXPECT_EQ(wb.tables()[1].sheet_index, 0U);
-  EXPECT_EQ(wb.tables()[2].sheet_index, 1U);
-}
-
-void AssertNestedFunctionCalls(const Workbook& wb) {
-  const Cell* b1 = CellAt(wb, 0U, 0U, 1U);
-  ASSERT_NE(b1, nullptr);
-  // Formula text round-trips verbatim; cached value resolves to A2=3.
-  EXPECT_EQ(b1->formula_text, "=IF(AND(OR(A1>0,A2<0),A3=8),IF(A1+A2>A3,A1,A2),0)");
-  ASSERT_TRUE(b1->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(b1->cached_value.as_number(), 3.0);
-}
-
-void AssertLargeGrid(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  // Spot-check the corners of the grid: A1 should be a numeric
-  // literal (r=0, c=0; (r+c) % 7 == 0 -> text "L0").
-  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
-  ASSERT_NE(a1, nullptr);
-  ASSERT_TRUE(a1->cached_value.is_text());
-  EXPECT_EQ(a1->cached_value.as_text(), "L0");
-  // Last cell T25 (r=24, c=19): (24+19)=43 -> 43%7=1 -> not text;
-  // 43 % 3 = 1 -> not formula; numeric 24*20+19 = 499.
-  const Cell* t25 = CellAt(wb, 0U, 24U, 19U);
-  ASSERT_NE(t25, nullptr);
-  ASSERT_TRUE(t25->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(t25->cached_value.as_number(), 499.0);
-}
-
-void AssertPassthroughTheme(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  // Passthrough must include the theme1 part with non-empty bytes.
-  const auto& parts = wb.passthrough_parts();
-  auto it = std::find_if(parts.begin(), parts.end(),
-                         [](const PassthroughPart& p) { return p.path == "xl/theme/theme1.xml"; });
-  ASSERT_NE(it, parts.end()) << "theme part missing from passthrough";
-  EXPECT_FALSE(it->bytes.empty());
-}
-
-void AssertSstCells(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  const Cell* a1 = CellAt(wb, 0U, 0U, 0U);
-  const Cell* b1 = CellAt(wb, 0U, 0U, 1U);
-  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
-  ASSERT_NE(a1, nullptr);
-  ASSERT_NE(b1, nullptr);
-  ASSERT_NE(a2, nullptr);
-  ASSERT_TRUE(a1->cached_value.is_text());
-  ASSERT_TRUE(b1->cached_value.is_text());
-  ASSERT_TRUE(a2->cached_value.is_text());
-  EXPECT_EQ(a1->cached_value.as_text(), "shared-alpha");
-  EXPECT_EQ(b1->cached_value.as_text(), "shared-beta");
-  EXPECT_EQ(a2->cached_value.as_text(), "shared-gamma");
-}
-
-void AssertKitchenSink(const Workbook& wb) {
-  ASSERT_EQ(wb.sheet_count(), 2U);
-  // Defined name preserved.
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  EXPECT_EQ(wb.defined_names()[0].name, "ComboName");
-  // Table preserved.
-  ASSERT_EQ(wb.tables().size(), 1U);
-  EXPECT_EQ(wb.tables()[0].name, "ComboTable");
-  // Passthrough preserved.
-  const auto& parts = wb.passthrough_parts();
-  auto it = std::find_if(parts.begin(), parts.end(),
-                         [](const PassthroughPart& p) { return p.path == "xl/theme/theme1.xml"; });
-  EXPECT_NE(it, parts.end());
-  // Mixed formula present.
-  const Cell* a2 = CellAt(wb, 0U, 1U, 0U);
-  ASSERT_NE(a2, nullptr);
-  EXPECT_EQ(a2->formula_text, "=A1*2");
-}
-
-// ---------------------------------------------------------------------------
-// Corpus enumeration. The order here is the order CTest will iterate
-// the parameterised tests; keep it stable so failure output is
-// predictable.
-// ---------------------------------------------------------------------------
-
-std::vector<CorpusBook> make_corpus() {
-  std::vector<CorpusBook> books;
-  books.push_back({"empty", BuildEmpty, AssertEmpty});
-  books.push_back({"single_literal", BuildSingleLiteral, AssertSingleLiteral});
-  books.push_back({"literals_all_kinds", BuildLiteralsAllKinds, AssertLiteralsAllKinds});
-  books.push_back({"arithmetic", BuildArithmetic, AssertArithmetic});
-  books.push_back({"cross_sheet", BuildCrossSheet, AssertCrossSheet});
-  books.push_back({"multi_sheet_independent", BuildMultiSheetIndependent, AssertMultiSheetIndependent});
-  books.push_back({"unicode_sheet_names", BuildUnicodeSheetNames, AssertUnicodeSheetNames});
-  books.push_back({"unicode_cell_text", BuildUnicodeCellText, AssertUnicodeCellText});
-  books.push_back({"range_aggregates", BuildRangeAggregates, AssertRangeAggregates});
-  books.push_back({"volatile_now_today", BuildVolatileNowToday, AssertVolatileNowToday});
-  books.push_back({"iterative_circular", BuildIterativeCircular, AssertIterativeCircular});
-  books.push_back({"defined_names_workbook_scope", BuildDefinedNamesWorkbookScope, AssertDefinedNamesWorkbookScope});
-  books.push_back({"defined_names_sheet_scope", BuildDefinedNamesSheetScope, AssertDefinedNamesSheetScope});
-  books.push_back({"single_table", BuildSingleTable, AssertSingleTable});
-  books.push_back({"multiple_tables", BuildMultipleTables, AssertMultipleTables});
-  books.push_back({"nested_function_calls", BuildNestedFunctionCalls, AssertNestedFunctionCalls});
-  books.push_back({"large_grid_500_cells", BuildLargeGrid500Cells, AssertLargeGrid});
-  books.push_back({"passthrough_theme_part", BuildPassthroughThemeArchive, AssertPassthroughTheme});
-  books.push_back({"sst_cells", BuildSstArchive, AssertSstCells});
-  books.push_back({"combined_kitchen_sink", BuildKitchenSink, AssertKitchenSink});
-  return books;
-}
-
-// ---------------------------------------------------------------------------
-// Parameterised driver.
-// ---------------------------------------------------------------------------
+using namespace ooxml_corpus;
 
 class RoundTripParity : public ::testing::TestWithParam<CorpusBook> {};
 
diff --git a/tests/integration/ooxml_metadata_test.cpp b/tests/integration/ooxml_metadata_test.cpp
index 9fa1a0b73..2b9d49910 100644
--- a/tests/integration/ooxml_metadata_test.cpp
+++ b/tests/integration/ooxml_metadata_test.cpp
@@ -14,6 +14,7 @@
 
 #include "defined_name.h"
 #include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
 #include "io/ooxml_reader.h"
 #include "io/zip_reader.h"
 #include "miniz.h"
@@ -352,9 +353,9 @@ TEST(OoxmlMetadata, TableRoundTripThroughWriter) {
   table.columns.push_back(TableColumn{1, "Region", "Total", "", ""});
   table.columns.push_back(TableColumn{2, "Q1", "", "sum", ""});
   table.columns.push_back(TableColumn{3, "Q2", "", "sum", ""});
-  table.auto_filter_xml =
+  table.auto_filter_xml.set(io::auto_filter_from_xml(
       "<autoFilter ref=\"A1:C5\"><filterColumn colId=\"0\"><filters><filter val=\"West\"/></filters></filterColumn>"
-      "</autoFilter>";
+      "</autoFilter>"));
   table.sort_state_xml = "<sortState ref=\"A1:C5\"><sortCondition ref=\"C2:C5\" descending=\"1\"/></sortState>";
   table.table_style_info_xml =
       "<tableStyleInfo name=\"TableStyleMedium2\" showFirstColumn=\"0\" showLastColumn=\"1\" "
@@ -385,7 +386,7 @@ TEST(OoxmlMetadata, TableRoundTripThroughWriter) {
   EXPECT_EQ(got.columns[1].totals_function, "sum");
   EXPECT_EQ(got.columns[2].totals_function, "sum");
   EXPECT_EQ(
-      got.auto_filter_xml,
+      io::auto_filter_xml(got.auto_filter_xml.get()),
       "<autoFilter ref=\"A1:C5\"><filterColumn colId=\"0\"><filters><filter val=\"West\"/></filters></filterColumn>"
       "</autoFilter>");
   EXPECT_EQ(got.sort_state_xml, "<sortState ref=\"A1:C5\"><sortCondition ref=\"C2:C5\" descending=\"1\"/></sortState>");
diff --git a/tests/integration/ooxml_sax_metadata_test.cpp b/tests/integration/ooxml_sax_metadata_test.cpp
index a246f340d..a454d3485 100644
--- a/tests/integration/ooxml_sax_metadata_test.cpp
+++ b/tests/integration/ooxml_sax_metadata_test.cpp
@@ -18,6 +18,7 @@
 #include "eval/function_registry.h"
 #include "eval/recalc_engine.h"
 #include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
 #include "io/ooxml_reader.h"
 #include "io/sheet_reader.h"  // kSaxThresholdBytes
 #include "miniz.h"
@@ -183,7 +184,7 @@ TEST(OoxmlSaxMetadata, LargeSheetRecoversMetadataAndSharedFormulas) {
   EXPECT_TRUE(sheet.protection().sort) << "omitted lock-by-default flag reads as locked";
 
   // autoFilter + print settings recovered.
-  EXPECT_FALSE(sheet.auto_filter_xml().empty());
+  EXPECT_FALSE(io::auto_filter_xml(sheet.auto_filter()).empty());
   EXPECT_FALSE(sheet.print_settings().print_options_xml.empty());
   EXPECT_FALSE(sheet.print_settings().page_setup_xml.empty());
 
@@ -294,7 +295,7 @@ void ExpectSheetsEquivalent(const Sheet& dom, const Sheet& sax) {
   EXPECT_EQ(dom.print_settings().header_footer_xml, sax.print_settings().header_footer_xml);
   EXPECT_EQ(dom.print_settings().print_options_xml, sax.print_settings().print_options_xml);
   EXPECT_EQ(dom.print_settings().page_setup_xml, sax.print_settings().page_setup_xml);
-  EXPECT_EQ(dom.auto_filter_xml(), sax.auto_filter_xml());
+  EXPECT_EQ(io::auto_filter_xml(dom.auto_filter()), io::auto_filter_xml(sax.auto_filter()));
   ASSERT_EQ(dom.print_settings().manual_row_breaks.size(), sax.print_settings().manual_row_breaks.size());
   for (std::size_t i = 0; i < dom.print_settings().manual_row_breaks.size(); ++i) {
     EXPECT_EQ(dom.print_settings().manual_row_breaks[i].id, sax.print_settings().manual_row_breaks[i].id);
diff --git a/tests/integration/ooxml_sheet_features_batch_test.cpp b/tests/integration/ooxml_sheet_features_batch_test.cpp
index 5a43f0069..7353825c4 100644
--- a/tests/integration/ooxml_sheet_features_batch_test.cpp
+++ b/tests/integration/ooxml_sheet_features_batch_test.cpp
@@ -16,6 +16,7 @@
 #include <vector>
 
 #include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
 #include "io/ooxml_reader.h"
 #include "io/zip_reader.h"
 #include "miniz.h"
@@ -391,7 +392,8 @@ TEST(OoxmlSheetFeaturesBatch, TableStyleInfoRoundTrips) {
   ASSERT_TRUE(static_cast<bool>(load_or)) << load_or.error().message;
   ASSERT_EQ(load_or.value().workbook.tables().size(), 1U);
   EXPECT_NE(load_or.value().workbook.tables()[0].table_style_info_xml.find("TableStyleMedium2"), std::string::npos);
-  EXPECT_NE(load_or.value().workbook.tables()[0].auto_filter_xml.find("north"), std::string::npos);
+  EXPECT_NE(io::auto_filter_xml(load_or.value().workbook.tables()[0].auto_filter_xml.get()).find("north"),
+            std::string::npos);
   EXPECT_NE(load_or.value().workbook.tables()[0].sort_state_xml.find("descending=\"1\""), std::string::npos);
   EXPECT_NE(load_or.value().workbook.tables()[0].ext_lst_xml.find("urn:test:table-extension"), std::string::npos);
   EXPECT_NE(load_or.value().workbook.tables()[0].columns[0].extra_attrs.find("dataDxfId=\"4\""), std::string::npos);
diff --git a/tests/integration/sheet_ops_3d_structural_recalc_test.cpp b/tests/integration/sheet_ops_3d_structural_recalc_test.cpp
new file mode 100644
index 000000000..68ef70852
--- /dev/null
+++ b/tests/integration/sheet_ops_3d_structural_recalc_test.cpp
@@ -0,0 +1,625 @@
+// Structural workbook mutation tests grouped by public surface.
+#include "sheet_ops_test_support.h"
+
+namespace formulon {
+namespace {
+using namespace sheet_ops_test;
+
+TEST(WorkbookRowColEdits, RowDeletesPreserveThreeDReferenceCoordinates) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "First")));
+  wb.add_sheet("Second");
+  wb.add_sheet("Summary");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:A3)")));
+
+  // Excel 365 16.111.3 keeps the shared 3-D coordinate tail unchanged when
+  // a sheet inside the span is edited.
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+  ASSERT_NE(wb.sheet(2).cell_at(9, 0), nullptr);
+  EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->formula_text, "=SUM(First:Second!A1:A3)");
+
+  // Editing the formula owner moves the formula cell, but still does not
+  // rewrite the 3-D tail.
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(2, /*row=*/0, /*count=*/1)));
+  ASSERT_NE(wb.sheet(2).cell_at(8, 0), nullptr);
+  EXPECT_EQ(wb.sheet(2).cell_at(8, 0)->formula_text, "=SUM(First:Second!A1:A3)");
+}
+
+TEST(WorkbookRowColEdits, ThreeDRowEditsDirtySpanMembersOnly) {
+  auto make_workbook = [] {
+    Workbook wb = Workbook::create_empty();
+    wb.add_sheet("First");
+    wb.add_sheet("Second");
+    wb.add_sheet("Summary");
+    wb.add_sheet("Outside");
+    for (std::uint32_t row = 0; row < 4U; ++row) {
+      EXPECT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
+    }
+    for (std::uint32_t row = 0; row < 3U; ++row) {
+      EXPECT_TRUE(
+          static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
+    }
+    EXPECT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:A3)")));
+    EXPECT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
+    return wb;
+  };
+
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+    auto stats = wb.recalc(eval::default_registry());
+    ASSERT_TRUE(static_cast<bool>(stats));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->formula_text, "=SUM(First:Second!A1:A3)");
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
+    EXPECT_EQ(stats.value().cells_evaluated, 1U);
+  }
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(1, /*row=*/0, /*count=*/1)));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 56.0);
+  }
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/0, /*count=*/1)));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 63.0);
+  }
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.insert_rows(1, /*row=*/0, /*count=*/1)));
+    auto stats = wb.recalc(eval::default_registry());
+    ASSERT_TRUE(static_cast<bool>(stats));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 36.0);
+    EXPECT_EQ(stats.value().cells_evaluated, 1U);
+  }
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.insert_rows(3, /*row=*/0, /*count=*/1)));
+    auto stats = wb.recalc(eval::default_registry());
+    ASSERT_TRUE(static_cast<bool>(stats));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
+    EXPECT_EQ(stats.value().cells_evaluated, 0U);
+  }
+}
+
+TEST(WorkbookRowColEdits, ThreeDDefinedNamesAndNamedLambdasRecalculateAfterRowEdit) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("First");
+  wb.add_sheet("Second");
+  wb.add_sheet("Summary");
+  wb.set_defined_names({
+      DefinedName{"Inner", "SUM(First:Second!A1:A3)", -1, false, ""},
+      DefinedName{"Outer", "Inner+0", -1, false, ""},
+      DefinedName{"F", "LAMBDA(x,Outer+x)", -1, false, ""},
+  });
+  for (std::uint32_t row = 0; row < 4U; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
+  }
+  for (std::uint32_t row = 0; row < 3U; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
+  }
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=Outer")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 10, 0, "=F(2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 11, 0, "=A10+A11")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(2).cell_at(9, 0)->cached_value.is_number())
+      << wb.sheet(2).cell_at(9, 0)->cached_value.debug_to_string();
+  ASSERT_TRUE(wb.sheet(2).cell_at(10, 0)->cached_value.is_number())
+      << wb.sheet(2).cell_at(10, 0)->cached_value.debug_to_string();
+  ASSERT_TRUE(wb.sheet(2).cell_at(11, 0)->cached_value.is_number())
+      << wb.sheet(2).cell_at(11, 0)->cached_value.debug_to_string();
+  EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
+  EXPECT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 68.0);
+  EXPECT_EQ(wb.sheet(2).cell_at(11, 0)->cached_value.as_number(), 134.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+  auto stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
+  EXPECT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 71.0);
+  EXPECT_EQ(wb.sheet(2).cell_at(11, 0)->cached_value.as_number(), 140.0);
+  EXPECT_EQ(stats.value().cells_evaluated, 3U);
+}
+
+TEST(WorkbookRowColEdits, ThreeDReverseSpanWakesMiddleMemberOnly) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("First");
+  wb.add_sheet("Middle");
+  wb.add_sheet("Last");
+  wb.add_sheet("Summary");
+  wb.add_sheet("Outside");
+  for (std::uint32_t row = 0; row < 4U; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
+  }
+  for (std::uint32_t row = 0; row < 3U; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 100U)))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
+  }
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(3, 9, 0, "=SUM(Last:First!A1:A3)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_EQ(wb.sheet(3).cell_at(9, 0)->cached_value.as_number(), 666.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(1, /*row=*/0, /*count=*/1)));
+  auto stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_EQ(wb.sheet(3).cell_at(9, 0)->formula_text, "=SUM(Last:First!A1:A3)");
+  EXPECT_EQ(wb.sheet(3).cell_at(9, 0)->cached_value.as_number(), 566.0);
+  EXPECT_EQ(stats.value().cells_evaluated, 1U);
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(4, /*row=*/0, /*count=*/1)));
+  stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_EQ(wb.sheet(3).cell_at(9, 0)->cached_value.as_number(), 566.0);
+  EXPECT_EQ(stats.value().cells_evaluated, 0U);
+}
+
+TEST(WorkbookRowColEdits, ThreeDOwnerMoveReordersMovedSourceAndDownstream) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("First");
+  wb.add_sheet("Second");
+  wb.add_sheet("Summary");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, 0, Value::number(3.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 3, 0, "=1+3")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 5, 0, "=SUM(First:Second!A1:A3)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 0, 0, "=First!A6*2")));
+  for (std::uint32_t row = 0; row < 3U; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
+  }
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_EQ(wb.sheet(0).cell_at(5, 0)->cached_value.as_number(), 66.0);
+  ASSERT_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 132.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->formula_text, "=SUM(First:Second!A1:A3)");
+  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->cached_value.as_number(), 69.0);
+  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->formula_text, "=First!A5*2");
+  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 138.0);
+}
+
+TEST(WorkbookRowColEdits, ThreeDOwnerMoveWithDefinedNameReindexKeepsRegistryCoordinates) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("First");
+  wb.add_sheet("Second");
+  wb.set_defined_names({DefinedName{"Region", "First!A2:A3", -1, false, ""}});
+  for (std::uint32_t row = 0; row < 4U; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
+  }
+  for (std::uint32_t row = 0; row < 3U; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
+  }
+  // The ordinary formula moves immediately below the 3D owner. If a name
+  // rewrite rebuilds the registry before the physical move, both entries are
+  // left at their old coordinates and the later span edit can dirty this
+  // unrelated formula as though it were the owner.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 5, 0, "=SUM(First:Second!A1:A3)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 6, 0, "=1+3")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_EQ(wb.sheet(0).cell_at(5, 0)->cached_value.as_number(), 66.0);
+  ASSERT_EQ(wb.sheet(0).cell_at(6, 0)->cached_value.as_number(), 4.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+  ASSERT_EQ(wb.sheet(0).cell_at(4, 0)->formula_text, "=SUM(First:Second!A1:A3)");
+  ASSERT_EQ(wb.sheet(0).cell_at(5, 0)->formula_text, "=1+3");
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_EQ(wb.sheet(0).cell_at(4, 0)->cached_value.as_number(), 69.0);
+
+  // The owner is on First, while this edit is on the other span member.
+  // Exactly the owner should be woken; a stale pre-move registry entry would
+  // also wake the unrelated formula now occupying row 5.
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(1, /*row=*/0, /*count=*/1)));
+  auto stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->cached_value.as_number(), 59.0);
+  EXPECT_EQ(wb.sheet(0).cell_at(5, 0)->cached_value.as_number(), 4.0);
+  EXPECT_EQ(stats.value().cells_evaluated, 1U);
+}
+
+TEST(WorkbookRowColEdits, ThreeDOwnerDeletedByEditIsDroppedFromRegistry) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("First");
+  wb.add_sheet("Second");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, 0, Value::number(3.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 3, 0, "=SUM(First:Second!A1:A3)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 1, 0, Value::number(20.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 2, 0, Value::number(30.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_EQ(wb.sheet(0).cell_at(3, 0)->cached_value.as_number(), 66.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/3, /*count=*/1)));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Cell* deleted = wb.sheet(0).cell_at(3, 0);
+  EXPECT_TRUE(deleted == nullptr || deleted->formula_text.empty());
+}
+
+TEST(WorkbookRowColEdits, ThreeDColumnEditsDirtySpanMembersOnly) {
+  auto make_workbook = [] {
+    Workbook wb = Workbook::create_empty();
+    wb.add_sheet("First");
+    wb.add_sheet("Second");
+    wb.add_sheet("Summary");
+    wb.add_sheet("Outside");
+    for (std::uint32_t col = 0; col < 4U; ++col) {
+      EXPECT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, col, Value::number(static_cast<double>(col + 1U)))));
+    }
+    for (std::uint32_t col = 0; col < 3U; ++col) {
+      EXPECT_TRUE(
+          static_cast<bool>(wb.set_cell_value(1, 0, col, Value::number(static_cast<double>((col + 1U) * 10U)))));
+    }
+    EXPECT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:C1)")));
+    EXPECT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
+    return wb;
+  };
+
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
+    auto stats = wb.recalc(eval::default_registry());
+    ASSERT_TRUE(static_cast<bool>(stats));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->formula_text, "=SUM(First:Second!A1:C1)");
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
+    EXPECT_EQ(stats.value().cells_evaluated, 1U);
+  }
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(1, /*col=*/0, /*count=*/1)));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 56.0);
+  }
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, /*col=*/0, /*count=*/1)));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 63.0);
+  }
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.insert_cols(1, /*col=*/0, /*count=*/1)));
+    auto stats = wb.recalc(eval::default_registry());
+    ASSERT_TRUE(static_cast<bool>(stats));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 36.0);
+    EXPECT_EQ(stats.value().cells_evaluated, 1U);
+  }
+  {
+    Workbook wb = make_workbook();
+    ASSERT_TRUE(static_cast<bool>(wb.insert_cols(3, /*col=*/0, /*count=*/1)));
+    auto stats = wb.recalc(eval::default_registry());
+    ASSERT_TRUE(static_cast<bool>(stats));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
+    EXPECT_EQ(stats.value().cells_evaluated, 0U);
+  }
+}
+
+TEST(WorkbookRowColEdits, ThreeDWholeAxisEditsRecalculate) {
+  {
+    Workbook wb = Workbook::create_empty();
+    wb.add_sheet("First");
+    wb.add_sheet("Second");
+    wb.add_sheet("Summary");
+    for (std::uint32_t row = 0; row < 4U; ++row) {
+      ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
+    }
+    for (std::uint32_t row = 0; row < 3U; ++row) {
+      ASSERT_TRUE(
+          static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
+    }
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A:A)")));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    ASSERT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 70.0);
+
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
+  }
+  {
+    Workbook wb = Workbook::create_empty();
+    wb.add_sheet("First");
+    wb.add_sheet("Second");
+    wb.add_sheet("Summary");
+    for (std::uint32_t col = 0; col < 4U; ++col) {
+      ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, col, Value::number(static_cast<double>(col + 1U)))));
+    }
+    for (std::uint32_t col = 0; col < 3U; ++col) {
+      ASSERT_TRUE(
+          static_cast<bool>(wb.set_cell_value(1, 0, col, Value::number(static_cast<double>((col + 1U) * 10U)))));
+    }
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!1:1)")));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    ASSERT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 70.0);
+
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
+  }
+}
+
+TEST(WorkbookRowColEdits, ThreeDFormulaSourcesRecalculateBeforeFiniteAndWholeAxisOwners) {
+  {
+    Workbook wb = Workbook::create_empty();
+    wb.add_sheet("First");
+    wb.add_sheet("Second");
+    wb.add_sheet("Summary");
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(2.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 2, 0, "=ROW()")));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(10.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 1, 0, Value::number(20.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 2, 0, Value::number(30.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:A3)")));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 10, 0, "=SUM(First:Second!A:A)")));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    ASSERT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
+    ASSERT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 66.0);
+
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    ASSERT_EQ(wb.sheet(0).cell_at(1, 0)->formula_text, "=ROW()");
+    EXPECT_EQ(wb.sheet(0).cell_at(1, 0)->cached_value.as_number(), 2.0);
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 64.0);
+    EXPECT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 64.0);
+  }
+  {
+    Workbook wb = Workbook::create_empty();
+    wb.add_sheet("First");
+    wb.add_sheet("Second");
+    wb.add_sheet("Summary");
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 1, Value::number(2.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 2, "=COLUMN()")));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(10.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 1, Value::number(20.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 2, Value::number(30.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:C1)")));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 10, 0, "=SUM(First:Second!1:1)")));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    ASSERT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
+    ASSERT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 66.0);
+
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    ASSERT_EQ(wb.sheet(0).cell_at(0, 1)->formula_text, "=COLUMN()");
+    EXPECT_EQ(wb.sheet(0).cell_at(0, 1)->cached_value.as_number(), 2.0);
+    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 64.0);
+    EXPECT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 64.0);
+  }
+}
+
+TEST(WorkbookSheetOps, RenameUsesAstForThreeDFormulaAndPreservesStringLiteral) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Alpha");
+  wb.add_sheet("Beta");
+  wb.add_sheet("Summary");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(3.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 0, 0, "=SUM(Alpha:Beta!A1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 1, 0, "=\"Alpha!x\"")));
+  wb.set_defined_names({DefinedName{"Span", "SUM(Alpha:Beta!A1)", -1, false, ""}});
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_DOUBLE_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 5.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "Alpha New")));
+  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->formula_text, "=SUM('Alpha New:Beta'!A1)");
+  EXPECT_EQ(wb.sheet(2).cell_at(1, 0)->formula_text, "=\"Alpha!x\"");
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].formula, "SUM('Alpha New:Beta'!A1)");
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_DOUBLE_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 5.0);
+}
+
+TEST(WorkbookSheetOps, RenameQuotesApostropheInThreeDEndpoint) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("2026 Q1");
+  wb.add_sheet("Feb");
+  wb.add_sheet("Summary");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(3.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 0, 0, "=SUM('2026 Q1:Feb'!A1)")));
+  wb.set_defined_names({DefinedName{"Span", "SUM('2026 Q1:Feb'!A1)", -1, false, ""}});
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "2026 Q1's")));
+  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->formula_text, "=SUM('2026 Q1''s:Feb'!A1)");
+  EXPECT_EQ(wb.defined_names()[0].formula, "SUM('2026 Q1''s:Feb'!A1)");
+}
+
+TEST(WorkbookSheetOps, RemoveRewritesOnlyAffectedAstSubtreesAndDoesNotRebind) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Drop");
+  wb.add_sheet("Summary");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(42.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_text(1, 2, 0, "Drop!x")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 0, "=IFERROR(Drop!A1,99)+5")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 3, 0, "=IF(A3=\"Drop!x\",1,2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 4, 0, "=Drop!A1+1")));
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->formula_text, "=IFERROR(#REF!,99)+5");
+  EXPECT_EQ(wb.sheet(0).cell_at(3, 0)->formula_text, "=IF(A3=\"Drop!x\",1,2)");
+  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->formula_text, "=#REF!+1");
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 104.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(3, 0)->cached_value.as_number(), 1.0);
+
+  // A later sheet with the deleted display name must not rebind the frozen
+  // subtree or the direct reference after the final graph rebuild.
+  wb.add_sheet("Drop");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(99.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_TRUE(wb.sheet(0).cell_at(4, 0)->cached_value.is_error());
+  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->cached_value.as_error(), ErrorCode::Ref);
+}
+
+TEST(WorkbookSheetOps, RemoveAdjustsThreeDBeginMiddleEndAndReverseSpans) {
+  const auto run = [](std::uint32_t removed_index, std::string expected_formula, double expected_value,
+                      std::string source_formula) {
+    Workbook wb = Workbook::create_empty();
+    wb.add_sheet("Jan");
+    wb.add_sheet("Feb");
+    wb.add_sheet("Mar");
+    wb.add_sheet("Summary");
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(2.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, 0, 0, Value::number(3.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(3, 0, 0, std::move(source_formula))));
+    ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(removed_index)));
+    const std::size_t summary = wb.sheet_index_by_name("Summary");
+    ASSERT_NE(summary, static_cast<std::size_t>(-1));
+    EXPECT_EQ(wb.sheet(summary).cell_at(0, 0)->formula_text, expected_formula);
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    EXPECT_DOUBLE_EQ(wb.sheet(summary).cell_at(0, 0)->cached_value.as_number(), expected_value);
+  };
+
+  run(0, "=SUM(Feb:Mar!A1)", 5.0, "=SUM(Jan:Mar!A1)");
+  run(1, "=SUM(Jan:Mar!A1)", 4.0, "=SUM(Jan:Mar!A1)");
+  run(2, "=SUM(Jan:Feb!A1)", 3.0, "=SUM(Jan:Mar!A1)");
+  run(2, "=SUM(Feb:Jan!A1)", 3.0, "=SUM(Mar:Jan!A1)");
+}
+
+TEST(WorkbookSheetOps, RemoveTransformsAllFormulaMetadataAndDropsDanglingPivotState) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Drop");
+  wb.add_sheet("Survivor");
+
+  cf::ConditionalFormat conditional_format;
+  cf::CFRule rule;
+  rule.formula1 = "Drop!A1";
+  rule.formula2 = "Drop!B1";
+  rule.color_scale = cf::ColorScaleSpec{};
+  rule.color_scale->thresholds.push_back(cf::CfValueObject{cf::CfvoType::Formula, "Drop!C1", true});
+  rule.icon_set = cf::IconSetSpec{};
+  rule.icon_set->thresholds.push_back(cf::CfValueObject{cf::CfvoType::Formula, "Drop!D1", true});
+  rule.data_bar = cf::DataBarSpec{};
+  rule.data_bar->min = cf::CfValueObject{cf::CfvoType::Formula, "Drop!E1", true};
+  rule.data_bar->max = cf::CfValueObject{cf::CfvoType::Formula, "Drop!F1", true};
+  conditional_format.rules.push_back(std::move(rule));
+  wb.sheet(1).mutable_conditional_formats().push_back(std::move(conditional_format));
+
+  Hyperlink hyperlink;
+  hyperlink.location = "#Drop!A1";
+  wb.sheet(1).mutable_hyperlinks().push_back(hyperlink);
+  DataValidation validation;
+  validation.formula1 = "Drop!A1";
+  validation.formula2 = "Drop!B1";
+  wb.sheet(1).mutable_validations().push_back(validation);
+
+  TableMetadata dropped_table;
+  dropped_table.id = 1;
+  dropped_table.name = "DropTable";
+  dropped_table.display_name = "DropTable";
+  dropped_table.ref = "A1:B2";
+  dropped_table.sheet_index = 0;
+  TableMetadata survivor_table;
+  survivor_table.id = 2;
+  survivor_table.name = "SurvivorTable";
+  survivor_table.display_name = "SurvivorTable";
+  survivor_table.ref = "A1:B2";
+  survivor_table.sheet_index = 1;
+  survivor_table.columns.push_back(TableColumn{1, "Value", {}, {}, "Drop!A1"});
+  wb.set_tables({std::move(dropped_table), std::move(survivor_table)});
+
+  wb.set_defined_names({DefinedName{"DropName", "Drop!A1", -1, false, ""}});
+  auto dropped_cache = std::make_unique<pivot::PivotCache>();
+  dropped_cache->set_cache_id(11);
+  dropped_cache->mutable_worksheet_source() = {true, "$A$1:$B$2", "Drop", ""};
+  wb.add_pivot_cache(std::move(dropped_cache));
+  auto survivor_cache = std::make_unique<pivot::PivotCache>();
+  survivor_cache->set_cache_id(12);
+  survivor_cache->mutable_worksheet_source() = {true, "$A$1:$B$2", "Survivor", ""};
+  wb.add_pivot_cache(std::move(survivor_cache));
+  auto dropped_pivot = std::make_unique<pivot::PivotTable>();
+  dropped_pivot->set_pivot_cache_id(11);
+  wb.sheet(1).add_pivot_table(std::move(dropped_pivot));
+  auto survivor_pivot = std::make_unique<pivot::PivotTable>();
+  survivor_pivot->set_pivot_cache_id(12);
+  wb.sheet(1).add_pivot_table(std::move(survivor_pivot));
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));
+  ASSERT_EQ(wb.sheet_count(), 1U);
+  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].formula1.value(), "#REF!");
+  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].formula2.value(), "#REF!");
+  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].color_scale->thresholds[0].value, "#REF!");
+  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].icon_set->thresholds[0].value, "#REF!");
+  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].data_bar->min.value, "#REF!");
+  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].data_bar->max.value, "#REF!");
+  EXPECT_EQ(wb.sheet(0).hyperlinks()[0].location, "#REF!");
+  EXPECT_EQ(wb.sheet(0).validations()[0].formula1, "#REF!");
+  EXPECT_EQ(wb.sheet(0).validations()[0].formula2, "#REF!");
+  ASSERT_EQ(wb.tables().size(), 1U);
+  EXPECT_EQ(wb.tables()[0].sheet_index, 0U);
+  EXPECT_EQ(wb.tables()[0].columns[0].calculated_column_formula, "#REF!");
+  EXPECT_EQ(wb.defined_names()[0].formula, "#REF!");
+  ASSERT_EQ(wb.pivot_caches().size(), 1U);
+  EXPECT_EQ(wb.pivot_caches()[0]->cache_id(), 12U);
+  ASSERT_EQ(wb.sheet(0).pivot_tables().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).pivot_tables()[0]->pivot_cache_id(), 12U);
+
+  // Re-adding the removed display name must not rebind any surviving holder
+  // or resurrect the dropped cache/pivot relationship.
+  wb.add_sheet("Drop");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(99.0))));
+  EXPECT_EQ(wb.tables()[0].columns[0].calculated_column_formula, "#REF!");
+  EXPECT_EQ(wb.defined_names()[0].formula, "#REF!");
+  ASSERT_EQ(wb.pivot_caches().size(), 1U);
+  EXPECT_EQ(wb.pivot_caches()[0]->cache_id(), 12U);
+  ASSERT_EQ(wb.sheet(0).pivot_tables().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).pivot_tables()[0]->pivot_cache_id(), 12U);
+}
+
+TEST(WorkbookSheetOps, RenameDoesNotClearUnrelatedCommittedSpill) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Alpha");
+  wb.add_sheet("Beta");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 0, "=SEQUENCE(2,1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 1, "=Beta!A1")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_DOUBLE_EQ(wb.sheet(1).resolve_cell_value(1, 0).as_number(), 2.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "Alpha New")));
+  EXPECT_DOUBLE_EQ(wb.sheet(1).resolve_cell_value(1, 0).as_number(), 2.0);
+}
+
+TEST(WorkbookSheetOps, RemoveReindexesSurvivingScopedNameBeforeDependentRecalc) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Drop");
+  wb.add_sheet("Survivor");
+  wb.add_sheet("Summary");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::text("Label"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 1, Value::text("Value"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 1, 0, Value::text("row-1"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 1, 1, Value::number(2.0))));
+  TableMetadata table;
+  table.id = 7U;
+  table.name = "SurvivorTable";
+  table.display_name = "SurvivorTable";
+  table.ref = "A1:B2";
+  table.sheet_index = 1U;
+  table.header_row = true;
+  table.columns = {TableColumn{1U, "Label", {}, {}, {}}, TableColumn{2U, "Value", {}, {}, {}}};
+  wb.set_tables({table});
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Local", "$B$2", 1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 2, "=Local")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 0, 0, "=SUM(SurvivorTable[Value])")));
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, 0);
+  ASSERT_EQ(wb.tables().size(), 1U);
+  EXPECT_EQ(wb.tables()[0].sheet_index, 0U);
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0, 2)->cached_value.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(1).cell_at(0, 0)->cached_value.as_number(), 2.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 1, Value::number(7.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0, 2)->cached_value.as_number(), 7.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(1).cell_at(0, 0)->cached_value.as_number(), 7.0);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/integration/sheet_ops_name_rename_test.cpp b/tests/integration/sheet_ops_name_rename_test.cpp
new file mode 100644
index 000000000..a88a8bcc4
--- /dev/null
+++ b/tests/integration/sheet_ops_name_rename_test.cpp
@@ -0,0 +1,547 @@
+// Structural workbook mutation tests grouped by public surface.
+#include <functional>
+
+#include "sheet_ops_test_support.h"
+
+namespace formulon {
+namespace {
+using namespace sheet_ops_test;
+
+TEST(WorkbookSheetOps, RenameUpdatesSheetName) {
+  Workbook wb = ThreeSheetWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(1, "Charlie")));
+  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
+  EXPECT_EQ(wb.sheet(1).name(), "Charlie");
+  EXPECT_EQ(wb.sheet(2).name(), "Gamma");
+}
+
+TEST(WorkbookSheetOps, RenameRejectsEmptyName) {
+  Workbook wb = ThreeSheetWorkbook();
+  auto r = wb.rename_sheet(0, "");
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
+  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
+}
+
+TEST(WorkbookSheetOps, RenameRejectsTooLong) {
+  Workbook wb = ThreeSheetWorkbook();
+  // 32 chars: one over the limit.
+  std::string long_name(32U, 'a');
+  auto r = wb.rename_sheet(0, long_name);
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
+}
+
+TEST(WorkbookSheetOps, RenameRejectsForbiddenCharacters) {
+  Workbook wb = ThreeSheetWorkbook();
+  for (const char* bad : {"a:b", "a\\b", "a/b", "a?b", "a*b", "a[b", "a]b"}) {
+    auto r = wb.rename_sheet(0, bad);
+    ASSERT_FALSE(static_cast<bool>(r)) << "expected rejection of " << bad;
+    EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
+  }
+  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
+}
+
+TEST(WorkbookSheetOps, RenameRejectsCaseInsensitiveCollision) {
+  Workbook wb = ThreeSheetWorkbook();
+  // `BETA` collides with the existing `Beta`.
+  auto r = wb.rename_sheet(0, "BETA");
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
+}
+
+TEST(WorkbookSheetOps, RenameAcceptsCaseChangeOfOwnName) {
+  Workbook wb = ThreeSheetWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "ALPHA")));
+  EXPECT_EQ(wb.sheet(0).name(), "ALPHA");
+}
+
+TEST(WorkbookSheetOps, RenameRejectsOutOfRange) {
+  Workbook wb = ThreeSheetWorkbook();
+  auto r = wb.rename_sheet(kOutOfRangeIndex, "Anything");
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kSheetIndexOutOfRange);
+}
+
+TEST(WorkbookSheetOps, RenameAccepts31JapaneseCharacters) {
+  Workbook wb = ThreeSheetWorkbook();
+  // 31 copies of "あ" (U+3042, 3 bytes each = 93 bytes) is exactly at the
+  // 31-character limit; a byte-count check would wrongly reject it.
+  std::string name;
+  for (int i = 0; i < 31; ++i) {
+    name += "\xE3\x81\x82";  // "あ"
+  }
+  auto r = wb.rename_sheet(0, name);
+  ASSERT_TRUE(static_cast<bool>(r)) << "31 Japanese characters must be within the limit";
+  EXPECT_EQ(wb.sheet(0).name(), name);
+}
+
+TEST(WorkbookSheetOps, RenameRejects32JapaneseCharacters) {
+  Workbook wb = ThreeSheetWorkbook();
+  std::string name;
+  for (int i = 0; i < 32; ++i) {
+    name += "\xE3\x81\x82";  // "あ"
+  }
+  auto r = wb.rename_sheet(0, name);
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
+  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
+}
+
+TEST(WorkbookSheetOps, RenameCountsEmojiAsTwoUnits) {
+  Workbook wb = ThreeSheetWorkbook();
+  // "😀" (U+1F600) is a supplementary-plane codepoint: two UTF-16 units.
+  // 16 emoji = 32 units, one over the limit.
+  std::string name;
+  for (int i = 0; i < 16; ++i) {
+    name += "\xF0\x9F\x98\x80";  // "😀"
+  }
+  auto r = wb.rename_sheet(0, name);
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
+}
+
+TEST(WorkbookSheetOps, AddSheetValidatedAppendsAndReturnsPointer) {
+  Workbook wb = ThreeSheetWorkbook();
+  auto r = wb.add_sheet_validated("Delta");
+  ASSERT_TRUE(static_cast<bool>(r));
+  ASSERT_NE(r.value(), nullptr);
+  EXPECT_EQ(r.value()->name(), "Delta");
+  EXPECT_EQ(wb.sheet_count(), 4U);
+}
+
+TEST(WorkbookSheetOps, AddSheetValidatedRejectsDuplicateCaseInsensitively) {
+  Workbook wb = ThreeSheetWorkbook();
+  auto r = wb.add_sheet_validated("beta");  // collides with "Beta"
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
+  EXPECT_EQ(wb.sheet_count(), 3U);
+}
+
+TEST(WorkbookSheetOps, AddSheetValidatedRejectsEmptyForbiddenAndTooLong) {
+  Workbook wb = ThreeSheetWorkbook();
+  EXPECT_FALSE(static_cast<bool>(wb.add_sheet_validated("")));
+  EXPECT_FALSE(static_cast<bool>(wb.add_sheet_validated("a/b")));
+  EXPECT_FALSE(static_cast<bool>(wb.add_sheet_validated(std::string(32U, 'a'))));
+  EXPECT_EQ(wb.sheet_count(), 3U);
+}
+
+TEST(WorkbookSheetOps, AddSheetValidatedAccepts31JapaneseCharacters) {
+  Workbook wb = ThreeSheetWorkbook();
+  std::string name;
+  for (int i = 0; i < 31; ++i) {
+    name += "\xE3\x81\x82";  // "あ"
+  }
+  auto r = wb.add_sheet_validated(name);
+  ASSERT_TRUE(static_cast<bool>(r));
+  EXPECT_EQ(wb.sheet_count(), 4U);
+}
+
+TEST(WorkbookSheetOps, UnicodeSimpleFoldRejectsDuplicateAndResolvesLookup) {
+  Workbook wb = Workbook::create_empty();
+  auto added = wb.add_sheet_validated("\xC3\x84");  // Ä
+  ASSERT_TRUE(static_cast<bool>(added));
+  EXPECT_EQ(wb.sheet_index_by_name("\xC3\xA4"), 0U);  // ä
+  EXPECT_EQ(wb.sheet_by_name("\xC3\xA4"), added.value());
+
+  auto duplicate = wb.add_sheet_validated("\xC3\xA4");
+  ASSERT_FALSE(static_cast<bool>(duplicate));
+  EXPECT_EQ(duplicate.error().code, FormulonErrorCode::kInvalidSheetName);
+  EXPECT_EQ(wb.sheet_count(), 1U);
+
+  auto distinct = wb.add_sheet_validated("\xC3\x96");  // Ö
+  ASSERT_TRUE(static_cast<bool>(distinct));
+  auto rename_collision = wb.rename_sheet(1U, "\xC3\xA4");  // ä
+  ASSERT_FALSE(static_cast<bool>(rename_collision));
+  EXPECT_EQ(rename_collision.error().code, FormulonErrorCode::kInvalidSheetName);
+  EXPECT_EQ(wb.sheet(0).name(), "\xC3\x84");  // Ä
+  EXPECT_EQ(wb.sheet(1).name(), "\xC3\x96");  // Ö
+}
+
+TEST(WorkbookSheetOps, UnicodeSimpleFoldSupportsCasingRenameAndDependencies) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Source");
+  auto added = wb.add_sheet_validated("\xC3\x84");  // Ä
+  ASSERT_TRUE(static_cast<bool>(added));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "='\xC3\xA4'!A1")));  // alternate case: ä
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0).cell_at(0U, 0U)->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0U, 0U)->cached_value.as_number(), 10.0);
+
+  // A casing-only rename preserves the identity used by the dependency edge.
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(1U, "\xC3\xA4")));  // ä
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(25.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0).cell_at(0U, 0U)->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0U, 0U)->cached_value.as_number(), 25.0);
+}
+
+TEST(WorkbookSheetOps, UnicodeMalformedUtf8IsInvalidSheetName) {
+  Workbook wb = Workbook::create();
+  const std::string malformed("\xC3", 1U);
+  auto added = wb.add_sheet_validated(malformed);
+  ASSERT_FALSE(static_cast<bool>(added));
+  EXPECT_EQ(added.error().code, FormulonErrorCode::kInvalidSheetName);
+  auto renamed = wb.rename_sheet(0U, malformed);
+  ASSERT_FALSE(static_cast<bool>(renamed));
+  EXPECT_EQ(renamed.error().code, FormulonErrorCode::kInvalidSheetName);
+}
+
+TEST(WorkbookSheetOps, RenameUpdatesWorkbookScopedDefinedNames) {
+  Workbook wb = ThreeSheetWorkbook();
+  // Pre-populate two defined names that both mention `Beta`. A sheet-scoped
+  // name remains bound to its local sheet by ordinal, but its formula text
+  // may still explicitly target the renamed sheet and must follow the name.
+  std::vector<DefinedName> names;
+  DefinedName wb_scoped;
+  wb_scoped.name = "TotalArea";
+  wb_scoped.formula = "Beta!$A$1:$A$10";
+  wb_scoped.local_sheet_id = -1;
+  names.push_back(wb_scoped);
+
+  DefinedName sheet_scoped;
+  sheet_scoped.name = "RegionA";
+  sheet_scoped.formula = "Beta!$B$2";
+  sheet_scoped.local_sheet_id = 2;
+  names.push_back(sheet_scoped);
+  wb.set_defined_names(std::move(names));
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(1, "Banana")));
+
+  ASSERT_EQ(wb.defined_names().size(), 2U);
+  EXPECT_EQ(wb.defined_names()[0].formula, "Banana!$A$1:$A$10");
+  EXPECT_EQ(wb.defined_names()[1].formula, "Banana!$B$2");
+}
+
+TEST(WorkbookSheetOps, RenameUpdatesQuotedSheetReferences) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("With Space");
+  wb.add_sheet("Other");
+
+  std::vector<DefinedName> names;
+  DefinedName dn;
+  dn.name = "Q";
+  dn.formula = "'With Space'!$A$1";
+  dn.local_sheet_id = -1;
+  names.push_back(dn);
+  wb.set_defined_names(std::move(names));
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "Plain")));
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].formula, "Plain!$A$1");
+}
+
+TEST(WorkbookSheetOps, RenameToNameRequiringQuotesAddsQuotes) {
+  // Renaming a bare-identifier sheet to a name with whitespace forces
+  // the formatter to emit the canonical quoted form.
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Beta");
+
+  std::vector<DefinedName> names;
+  DefinedName dn;
+  dn.name = "X";
+  dn.formula = "Beta!$A$1";
+  dn.local_sheet_id = -1;
+  names.push_back(dn);
+  wb.set_defined_names(std::move(names));
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "New Beta")));
+  EXPECT_EQ(wb.defined_names()[0].formula, "'New Beta'!$A$1");
+}
+
+TEST(WorkbookSheetOps, RenameAcrossExpressionAndCallArgs) {
+  // The AST-based rewriter must catch references that sit inside
+  // function calls, range endpoints, and arithmetic — not just bare
+  // sheet-prefixed identifiers.
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Beta");
+  wb.add_sheet("Other");
+
+  std::vector<DefinedName> names;
+  DefinedName dn;
+  dn.name = "Total";
+  dn.formula = "SUM(Beta!$A$1:$A$10)+Beta!B2";
+  dn.local_sheet_id = -1;
+  names.push_back(dn);
+  wb.set_defined_names(std::move(names));
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "Banana")));
+  // Range endpoints with the same sheet collapse the sheet qualifier on
+  // the right-hand side — Excel's canonical form for `Sheet!A1:A10`.
+  EXPECT_EQ(wb.defined_names()[0].formula, "SUM(Banana!$A$1:$A$10)+Banana!B2");
+}
+
+TEST(WorkbookSheetOps, RenameDoesNotMatchIdentifierSubstrings) {
+  // `OtherSheet1` should not match a rename of `Sheet1`.
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.add_sheet("OtherSheet1");
+
+  std::vector<DefinedName> names;
+  DefinedName dn;
+  dn.name = "X";
+  dn.formula = "OtherSheet1!$A$1";
+  dn.local_sheet_id = -1;
+  names.push_back(dn);
+  wb.set_defined_names(std::move(names));
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "First")));
+  EXPECT_EQ(wb.defined_names()[0].formula, "OtherSheet1!$A$1");
+}
+
+TEST(WorkbookSheetOps, RenameRewritesReferencingCellFormulas) {
+  Workbook wb = ThreeSheetWorkbook();                                                // Alpha(0), Beta(1), Gamma(2)
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, 0, 0, Value::number(100.0))));  // Gamma!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=Gamma!A1")));         // Alpha!A1
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 100.0);
+
+  // Rename Gamma -> Delta. The Alpha!A1 formula text must follow.
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(2, "Delta")));
+  ASSERT_NE(wb.sheet(0).cell_at(0, 0), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->formula_text, "=Delta!A1");
+
+  // And it still resolves after recalc (not #REF!/#NAME?).
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value a1 = wb.sheet(0).cell_at(0, 0)->cached_value;
+  ASSERT_TRUE(a1.is_number()) << "renamed cross-sheet ref failed to resolve";
+  EXPECT_EQ(a1.as_number(), 100.0);
+}
+
+TEST(WorkbookSheetOps, RenameRewritesSheetNamedMetadata) {
+  Workbook wb = ThreeSheetWorkbook();  // Alpha(0), Beta(1), Gamma(2)
+  DefinedName local_name;
+  local_name.name = "LocalRef";
+  local_name.local_sheet_id = 0;
+  local_name.formula = "Gamma!$A$1";
+  wb.set_defined_names({local_name});
+
+  Hyperlink link;
+  link.row = 0;
+  link.col = 0;
+  link.location = "#Gamma!A1";
+  wb.sheet(0).mutable_hyperlinks().push_back(link);
+  DataValidation validation;
+  validation.ranges.push_back(MergeRange{0, 1, 0, 1});
+  validation.formula1 = "Gamma!$A$1";
+  validation.formula2 = "Gamma!$B$1";
+  wb.sheet(0).mutable_validations().push_back(validation);
+
+  cf::ConditionalFormat conditional_format;
+  cf::CFRule rule;
+  rule.formula1 = "Gamma!C1";
+  rule.formula2 = "Gamma!D1";
+  rule.color_scale = cf::ColorScaleSpec{};
+  rule.color_scale->thresholds.push_back({cf::CfvoType::Formula, "Gamma!E1", true});
+  rule.icon_set = cf::IconSetSpec{};
+  rule.icon_set->thresholds.push_back({cf::CfvoType::Formula, "Gamma!F1", true});
+  rule.data_bar = cf::DataBarSpec{};
+  rule.data_bar->min = {cf::CfvoType::Formula, "Gamma!G1", true};
+  rule.data_bar->max = {cf::CfvoType::Formula, "Gamma!H1", true};
+  conditional_format.rules.push_back(std::move(rule));
+  wb.sheet(0).mutable_conditional_formats().push_back(std::move(conditional_format));
+
+  TableMetadata table;
+  table.id = 1;
+  table.name = "Table1";
+  table.display_name = "Table1";
+  table.ref = "A1:B2";
+  table.sheet_index = 0;
+  table.columns.push_back(TableColumn{1, "Value", {}, {}, "Gamma!$A$1"});
+  wb.set_tables({std::move(table)});
+
+  auto cache = std::make_unique<pivot::PivotCache>();
+  cache->set_cache_id(7U);
+  cache->mutable_worksheet_source() = {true, "Gamma!$A$1:$B$2", "gAmMa", ""};
+  wb.add_pivot_cache(std::move(cache));
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(2, "Delta")));
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].formula, "Delta!$A$1");
+  ASSERT_EQ(wb.sheet(0).hyperlinks().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).hyperlinks()[0].location, "#Delta!A1");
+  ASSERT_EQ(wb.sheet(0).validations().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).validations()[0].formula1, "Delta!$A$1");
+  EXPECT_EQ(wb.sheet(0).validations()[0].formula2, "Delta!$B$1");
+  ASSERT_EQ(wb.sheet(0).conditional_formats().size(), 1U);
+  ASSERT_EQ(wb.sheet(0).conditional_formats()[0].rules.size(), 1U);
+  const cf::CFRule& rewritten_rule = wb.sheet(0).conditional_formats()[0].rules[0];
+  ASSERT_TRUE(rewritten_rule.formula1.has_value());
+  ASSERT_TRUE(rewritten_rule.formula2.has_value());
+  EXPECT_EQ(*rewritten_rule.formula1, "Delta!C1");
+  EXPECT_EQ(*rewritten_rule.formula2, "Delta!D1");
+  ASSERT_TRUE(rewritten_rule.color_scale.has_value());
+  EXPECT_EQ(rewritten_rule.color_scale->thresholds[0].value, "Delta!E1");
+  ASSERT_TRUE(rewritten_rule.icon_set.has_value());
+  EXPECT_EQ(rewritten_rule.icon_set->thresholds[0].value, "Delta!F1");
+  ASSERT_TRUE(rewritten_rule.data_bar.has_value());
+  EXPECT_EQ(rewritten_rule.data_bar->min.value, "Delta!G1");
+  EXPECT_EQ(rewritten_rule.data_bar->max.value, "Delta!H1");
+  ASSERT_EQ(wb.tables().size(), 1U);
+  EXPECT_EQ(wb.tables()[0].columns[0].calculated_column_formula, "Delta!$A$1");
+  ASSERT_EQ(wb.pivot_caches().size(), 1U);
+  EXPECT_EQ(wb.pivot_caches()[0]->worksheet_source().sheet, "Delta");
+  EXPECT_EQ(wb.pivot_caches()[0]->worksheet_source().ref, "Delta!$A$1:$B$2");
+}
+
+namespace {
+
+using AddMissingSheet = std::function<void(Workbook&)>;
+
+void ExerciseMissingSheetRecovery(const AddMissingSheet& add_missing) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Source");
+  wb.add_sheet("Summary");
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Leaf", "=Missing!A1")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Outer", "=Leaf")));
+
+  // These formulas are entered while Missing does not exist. The evaluator
+  // reports #REF!, and the dep extractor intentionally has no target edge to
+  // register yet. Adding the sheet must recover every static reference form.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 0U, "=Missing!A1")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 1U, "=SUM(Missing!A1:A2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 2U, "=SUM(Source:Missing!A1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 3U, "=Outer")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 4U, "=Missing!D1#")));
+  // This spill is unrelated to the missing sheet and must remain committed
+  // while the recovery pass reparses affected formulas.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 5U, "=SEQUENCE(2,1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+
+  for (std::uint32_t col = 0U; col < 5U; ++col) {
+    const Value value = wb.sheet(1U).resolve_cell_value(0U, col);
+    ASSERT_TRUE(value.is_error()) << "column=" << col;
+    EXPECT_EQ(value.as_error(), ErrorCode::Ref) << "column=" << col;
+  }
+  const Value unrelated_before = wb.sheet(1U).resolve_cell_value(1U, 5U);
+  ASSERT_TRUE(unrelated_before.is_number());
+  EXPECT_DOUBLE_EQ(unrelated_before.as_number(), 2.0);
+
+  add_missing(wb);
+  const std::size_t missing = wb.sheet_index_by_name("Missing");
+  ASSERT_NE(missing, static_cast<std::size_t>(-1));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(missing, 0U, 0U, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(missing, 1U, 0U, Value::number(20.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(missing, 0U, 3U, "=SEQUENCE(2,1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+
+  const Value direct = wb.sheet(1U).resolve_cell_value(0U, 0U);
+  const Value range = wb.sheet(1U).resolve_cell_value(0U, 1U);
+  const Value span = wb.sheet(1U).resolve_cell_value(0U, 2U);
+  const Value alias = wb.sheet(1U).resolve_cell_value(0U, 3U);
+  const Value spill_ref = wb.sheet(1U).resolve_cell_value(0U, 4U);
+  ASSERT_TRUE(direct.is_number());
+  ASSERT_TRUE(range.is_number());
+  ASSERT_TRUE(span.is_number());
+  ASSERT_TRUE(alias.is_number());
+  ASSERT_TRUE(spill_ref.is_number());
+  EXPECT_DOUBLE_EQ(direct.as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(range.as_number(), 30.0);
+  // Source!A1 + Summary!A1 + Missing!A1.
+  EXPECT_DOUBLE_EQ(span.as_number(), 21.0);
+  EXPECT_DOUBLE_EQ(alias.as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(spill_ref.as_number(), 1.0);
+  const Value spill_ref_tail = wb.sheet(1U).resolve_cell_value(1U, 4U);
+  ASSERT_TRUE(spill_ref_tail.is_number());
+  EXPECT_DOUBLE_EQ(spill_ref_tail.as_number(), 2.0);
+  const Value unrelated_after = wb.sheet(1U).resolve_cell_value(1U, 5U);
+  ASSERT_TRUE(unrelated_after.is_number());
+  EXPECT_DOUBLE_EQ(unrelated_after.as_number(), 2.0);
+
+  // The recovered formulas must retain live dependencies after the first
+  // successful recalc, including the range and the 3-D endpoint.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(missing, 0U, 0U, Value::number(15.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(1U).resolve_cell_value(0U, 0U).is_number());
+  ASSERT_TRUE(wb.sheet(1U).resolve_cell_value(0U, 1U).is_number());
+  ASSERT_TRUE(wb.sheet(1U).resolve_cell_value(0U, 2U).is_number());
+  ASSERT_TRUE(wb.sheet(1U).resolve_cell_value(0U, 3U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(1U).resolve_cell_value(0U, 0U).as_number(), 15.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(1U).resolve_cell_value(0U, 1U).as_number(), 35.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(1U).resolve_cell_value(0U, 2U).as_number(), 31.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(1U).resolve_cell_value(0U, 3U).as_number(), 15.0);
+}
+
+TEST(WorkbookSheetOps, AddSheetRecoversMissingSheetReferences) {
+  ExerciseMissingSheetRecovery([](Workbook& wb) { wb.add_sheet("Missing"); });
+}
+
+TEST(WorkbookSheetOps, AddSheetRecoversMissingReferenceWithNoGraphNodes) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Missing!A1")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value before = wb.sheet(0U).resolve_cell_value(0U, 0U);
+  ASSERT_TRUE(before.is_error());
+  EXPECT_EQ(before.as_error(), ErrorCode::Ref);
+  ASSERT_EQ(wb.recalc_engine().dep_graph().node_count(), 0U);
+
+  const std::size_t missing = wb.add_sheet("Missing");
+  ASSERT_EQ(missing, 1U);
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(missing, 0U, 0U, Value::number(12.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value after = wb.sheet(0U).resolve_cell_value(0U, 0U);
+  ASSERT_TRUE(after.is_number());
+  EXPECT_DOUBLE_EQ(after.as_number(), 12.0);
+}
+
+TEST(WorkbookSheetOps, AddSheetCheckedRecoversMissingSheetReferences) {
+  ExerciseMissingSheetRecovery([](Workbook& wb) { ASSERT_TRUE(static_cast<bool>(wb.add_sheet_checked("Missing"))); });
+}
+
+TEST(WorkbookSheetOps, AddSheetValidatedRecoversMissingSheetReferences) {
+  ExerciseMissingSheetRecovery([](Workbook& wb) { ASSERT_TRUE(static_cast<bool>(wb.add_sheet_validated("Missing"))); });
+}
+
+TEST(WorkbookSheetOps, RenameToMissingRecoversQualifiedLocalNameAliases) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Source");
+  wb.add_sheet("Other");
+  wb.add_sheet("Summary");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(7.0))));
+
+  // LocalLeaf is deliberately scoped to Summary. Alias and Alias2 exercise
+  // the reverse alias closure through a qualified local NameRef.
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("LocalLeaf", "=Missing!A1", 2)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Alias", "=Summary!LocalLeaf")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Alias2", "=Alias")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2U, 0U, 0U, "=Missing!A1")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2U, 0U, 1U, "=Summary!LocalLeaf")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2U, 0U, 2U, "=Alias")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2U, 0U, 3U, "=Alias2")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2U, 0U, 5U, "=SEQUENCE(2,1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  for (std::uint32_t col = 0U; col < 4U; ++col) {
+    const Value value = wb.sheet(2U).resolve_cell_value(0U, col);
+    ASSERT_TRUE(value.is_error()) << "column=" << col;
+    EXPECT_EQ(value.as_error(), ErrorCode::Ref) << "column=" << col;
+  }
+  ASSERT_TRUE(wb.sheet(2U).resolve_cell_value(1U, 5U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(2U).resolve_cell_value(1U, 5U).as_number(), 2.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(1U, "Missing")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  for (std::uint32_t col = 0U; col < 4U; ++col) {
+    const Value value = wb.sheet(2U).resolve_cell_value(0U, col);
+    ASSERT_TRUE(value.is_number()) << "column=" << col;
+    EXPECT_DOUBLE_EQ(value.as_number(), 7.0) << "column=" << col;
+  }
+  ASSERT_TRUE(wb.sheet(2U).resolve_cell_value(1U, 5U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(2U).resolve_cell_value(1U, 5U).as_number(), 2.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(11.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  for (std::uint32_t col = 0U; col < 4U; ++col) {
+    const Value value = wb.sheet(2U).resolve_cell_value(0U, col);
+    ASSERT_TRUE(value.is_number()) << "column=" << col;
+    EXPECT_DOUBLE_EQ(value.as_number(), 11.0) << "column=" << col;
+  }
+}
+
+}  // namespace
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/integration/sheet_ops_remove_move_defined_names_test.cpp b/tests/integration/sheet_ops_remove_move_defined_names_test.cpp
new file mode 100644
index 000000000..333a710c4
--- /dev/null
+++ b/tests/integration/sheet_ops_remove_move_defined_names_test.cpp
@@ -0,0 +1,614 @@
+// Structural workbook mutation tests grouped by public surface.
+#include "io/ooxml_reader.h"
+#include "pugixml.hpp"
+#include "sheet_ops_test_support.h"
+
+namespace formulon {
+namespace {
+using namespace sheet_ops_test;
+
+void ExpectBookViewIndices(const Workbook& wb, const std::vector<std::pair<unsigned, unsigned>>& expected) {
+  pugi::xml_document doc;
+  ASSERT_TRUE(doc.load_string(wb.book_views_xml().c_str()));
+  std::size_t index = 0U;
+  for (pugi::xml_node view : doc.child("bookViews").children("workbookView")) {
+    ASSERT_LT(index, expected.size());
+    EXPECT_EQ(view.attribute("activeTab").as_uint(), expected[index].first) << index;
+    EXPECT_EQ(view.attribute("firstSheet").as_uint(), expected[index].second) << index;
+    ++index;
+  }
+  EXPECT_EQ(index, expected.size());
+}
+
+TEST(WorkbookSheetOps, RemoveRemapsEveryBookViewAndPreservesOtherMetadata) {
+  Workbook wb = ThreeSheetWorkbook();
+  wb.set_book_views_xml(
+      "<bookViews xmlns:xr=\"urn:test\">"
+      "<workbookView activeTab=\"2\" firstSheet=\"1\" xr:uid=\"keep\">"
+      "<extLst><!--keep-comment--><?keep instruction?>"
+      "<ext uri=\"extension\"><xr:extra value=\"unchanged\"/></ext></extLst>"
+      "</workbookView><workbookView activeTab=\"1\" firstSheet=\"2\" windowWidth=\"640\"/>"
+      "</bookViews>");
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0U)));
+  ExpectBookViewIndices(wb, {{1U, 0U}, {0U, 1U}});
+  pugi::xml_document doc;
+  ASSERT_TRUE(doc.load_string(wb.book_views_xml().c_str()));
+  const auto root = doc.child("bookViews");
+  const auto first = root.child("workbookView");
+  EXPECT_STREQ(root.attribute("xmlns:xr").value(), "urn:test");
+  EXPECT_STREQ(first.attribute("xr:uid").value(), "keep");
+  EXPECT_STREQ(first.child("extLst").child("ext").child("xr:extra").attribute("value").value(), "unchanged");
+  EXPECT_EQ(first.next_sibling("workbookView").attribute("windowWidth").as_uint(), 640U);
+  EXPECT_NE(wb.book_views_xml().find("<!--keep-comment-->"), std::string::npos);
+  EXPECT_NE(wb.book_views_xml().find("<?keep instruction?>"), std::string::npos);
+}
+
+TEST(WorkbookSheetOps, RemoveSelectedLastSheetKeepsBookViewsInBoundsAfterRoundTrip) {
+  Workbook wb = ThreeSheetWorkbook();
+  wb.set_book_views_xml("<bookViews><workbookView activeTab=\"2\" firstSheet=\"2\"/></bookViews>");
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(2U)));
+  ExpectBookViewIndices(wb, {{1U, 1U}});
+  auto saved = wb.save();
+  ASSERT_TRUE(static_cast<bool>(saved));
+  auto loaded = io::read_ooxml(io::ByteSpan{saved.value().data(), saved.value().size()});
+  ASSERT_TRUE(static_cast<bool>(loaded));
+  ExpectBookViewIndices(loaded.value().workbook, {{1U, 1U}});
+}
+
+TEST(WorkbookSheetOps, MoveBookViewsFollowTheirSheetsInBothDirections) {
+  for (bool forward : {true, false}) {
+    SCOPED_TRACE(forward);
+    Workbook wb = ThreeSheetWorkbook();
+    wb.set_book_views_xml(
+        "<bookViews><workbookView activeTab=\"0\" firstSheet=\"0\"/>"
+        "<workbookView activeTab=\"1\" firstSheet=\"1\"/>"
+        "<workbookView activeTab=\"2\" firstSheet=\"2\"/></bookViews>");
+    ASSERT_TRUE(static_cast<bool>(wb.move_sheet(forward ? 0U : 2U, forward ? 2U : 0U)));
+    if (forward) {
+      ExpectBookViewIndices(wb, {{2U, 2U}, {0U, 0U}, {1U, 1U}});
+    } else {
+      ExpectBookViewIndices(wb, {{1U, 1U}, {2U, 2U}, {0U, 0U}});
+    }
+  }
+}
+
+TEST(WorkbookSheetOps, MoveMaterializesImplicitFirstSheetBookViewIndices) {
+  Workbook wb = ThreeSheetWorkbook();
+  wb.set_book_views_xml("<bookViews><workbookView windowWidth=\"640\"/></bookViews>");
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0U, 2U)));
+  ExpectBookViewIndices(wb, {{2U, 2U}});
+}
+
+TEST(WorkbookSheetOps, UnaffectedBookViewsRemainByteIdentical) {
+  Workbook wb = ThreeSheetWorkbook();
+  const std::string xml = "<bookViews>\n  <workbookView activeTab='0' firstSheet='0' />\n</bookViews>";
+  wb.set_book_views_xml(xml);
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(2U)));
+  EXPECT_EQ(wb.book_views_xml(), xml);
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0U, 0U)));
+  EXPECT_EQ(wb.book_views_xml(), xml);
+  ASSERT_FALSE(static_cast<bool>(wb.move_sheet(0U, 9U)));
+  EXPECT_EQ(wb.book_views_xml(), xml);
+}
+
+TEST(WorkbookSheetOps, UnparseableAndUnresolvedBookViewsRemainUnchanged) {
+  for (const std::string xml : {"<bookViews><workbookView activeTab=\"999\" firstSheet=\"bad\"/></bookViews>",
+                                "<bookViews><workbookView activeTab=\"-1\" firstSheet=\"4294967296\"/></bookViews>",
+                                "<bookViews><workbookView", "<extLst><workbookView activeTab=\"0\"/></extLst>", ""}) {
+    SCOPED_TRACE(xml);
+    Workbook wb = ThreeSheetWorkbook();
+    wb.set_book_views_xml(xml);
+    ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0U, 2U)));
+    EXPECT_EQ(wb.book_views_xml(), xml);
+  }
+}
+
+TEST(WorkbookSheetOps, SheetMovePreservesRawWorksheetMetadata) {
+  Workbook wb = ThreeSheetWorkbook();
+  SetMoveSensitiveMetadata(wb.sheet(0), "alpha");
+  SetMoveSensitiveMetadata(wb.sheet(1), "beta");
+  SetMoveSensitiveMetadata(wb.sheet(2), "gamma");
+
+  // Appending enough sheets guarantees a vector reallocation. Then erase and
+  // move exercise move assignment and move construction respectively.
+  for (std::uint32_t i = 0; i < 32U; ++i) {
+    wb.add_sheet("Extra" + std::to_string(i));
+  }
+  ExpectMoveSensitiveMetadata(wb.sheet(0), "alpha");
+  ExpectMoveSensitiveMetadata(wb.sheet(1), "beta");
+  ExpectMoveSensitiveMetadata(wb.sheet(2), "gamma");
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));
+  ExpectMoveSensitiveMetadata(wb.sheet(0), "alpha");
+  ExpectMoveSensitiveMetadata(wb.sheet(1), "gamma");
+
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(1, 0)));
+  ExpectMoveSensitiveMetadata(wb.sheet(0), "gamma");
+  ExpectMoveSensitiveMetadata(wb.sheet(1), "alpha");
+}
+
+TEST(WorkbookSheetOps, RemoveDropsSheet) {
+  Workbook wb = ThreeSheetWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));
+  ASSERT_EQ(wb.sheet_count(), 2U);
+  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
+  EXPECT_EQ(wb.sheet(1).name(), "Gamma");
+}
+
+TEST(WorkbookSheetOps, RemoveDropsPivotCacheWhoseWorksheetSourceWasRemoved) {
+  Workbook wb = ThreeSheetWorkbook();
+  auto removed_source_cache = std::make_unique<pivot::PivotCache>();
+  removed_source_cache->set_cache_id(1U);
+  removed_source_cache->mutable_worksheet_source() = {true, "$A$1:$B$10", "Beta", ""};
+  wb.add_pivot_cache(std::move(removed_source_cache));
+
+  auto surviving_source_cache = std::make_unique<pivot::PivotCache>();
+  surviving_source_cache->set_cache_id(2U);
+  surviving_source_cache->mutable_worksheet_source() = {true, "$A$1:$B$10", "Gamma", ""};
+  wb.add_pivot_cache(std::move(surviving_source_cache));
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1U)));  // Beta
+  ASSERT_EQ(wb.pivot_caches().size(), 1U);
+  ASSERT_NE(wb.pivot_caches()[0], nullptr);
+  EXPECT_EQ(wb.pivot_caches()[0]->cache_id(), 2U);
+  EXPECT_EQ(wb.pivot_caches()[0]->worksheet_source().sheet, "Gamma");
+}
+
+TEST(WorkbookSheetOps, SheetOperationsKeepTablesAttachedToTheirOwningSheet) {
+  Workbook wb = ThreeSheetWorkbook();
+  TableMetadata table;
+  table.id = 1;
+  table.name = "Table1";
+  table.display_name = "Table1";
+  table.sheet_index = 2;  // Gamma
+  table.ref = "A1:B2";
+  wb.set_tables({table});
+
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(2, 0)));
+  ASSERT_EQ(wb.tables().size(), 1U);
+  EXPECT_EQ(wb.sheet(wb.tables()[0].sheet_index).name(), "Gamma");
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));  // remove Alpha
+  ASSERT_EQ(wb.tables().size(), 1U);
+  EXPECT_EQ(wb.sheet(wb.tables()[0].sheet_index).name(), "Gamma");
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));  // remove Gamma
+  EXPECT_TRUE(wb.tables().empty());
+}
+
+TEST(WorkbookSheetOps, WriterRejectsTableDetachedFromAllSheets) {
+  Workbook wb = Workbook::create();
+  TableMetadata table;
+  table.id = 1;
+  table.name = "Detached";
+  table.display_name = "Detached";
+  table.sheet_index = 1;
+  table.ref = "A1:A2";
+  wb.set_tables({table});
+  auto written = io::write_ooxml(wb);
+  ASSERT_FALSE(static_cast<bool>(written));
+  EXPECT_EQ(written.error().code, FormulonErrorCode::kIoWriteFailed);
+}
+
+TEST(WorkbookSheetOps, RemoveFreezesReferencingFormulaBeforeSameNameIsReadded) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Source");
+  wb.add_sheet("Dependent");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(42))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 0, "=Source!A1")));
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));
+  ASSERT_EQ(wb.sheet(0).name(), "Dependent");
+  ASSERT_NE(wb.sheet(0).cell_at(0, 0), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->formula_text, "=#REF!");
+
+  wb.add_sheet("Source");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(99))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value value = wb.sheet(0).cell_at(0, 0)->cached_value;
+  ASSERT_TRUE(value.is_error());
+  EXPECT_EQ(value.as_error(), ErrorCode::Ref);
+}
+
+TEST(WorkbookSheetOps, AppendReportsTheIndexOfTheSheetItAppended) {
+  Workbook wb = Workbook::create_empty();
+  EXPECT_EQ(wb.add_sheet("First"), 0U);
+  EXPECT_EQ(wb.add_sheet("Second"), 1U);
+
+  auto checked = wb.add_sheet_checked("Third");
+  ASSERT_TRUE(static_cast<bool>(checked));
+  EXPECT_EQ(checked.value(), 2U);
+
+  ASSERT_EQ(wb.sheet_count(), 3U);
+  EXPECT_EQ(wb.sheet(0).name(), "First");
+  EXPECT_EQ(wb.sheet(1).name(), "Second");
+  EXPECT_EQ(wb.sheet(2).name(), "Third");
+}
+
+TEST(WorkbookSheetOps, AppendedSheetStaysReachableAcrossLaterAppends) {
+  Workbook wb = Workbook::create_empty();
+  const std::size_t first = wb.add_sheet("First");
+  // Enough appends to force the underlying vector to reallocate at least
+  // once past whatever capacity the first append reserved.
+  for (int i = 0; i < 64; ++i) {
+    wb.add_sheet("Filler" + std::to_string(i));
+  }
+  wb.sheet(first).set_cell_value(0U, 0U, Value::number(7.0));
+
+  EXPECT_EQ(wb.sheet(first).name(), "First");
+  const Cell* cell = wb.sheet(first).cell_at(0U, 0U);
+  ASSERT_NE(cell, nullptr);
+  EXPECT_EQ(cell->cached_value.as_number(), 7.0);
+}
+
+TEST(WorkbookSheetOps, AppendStopsAtTheSheetIdCeiling) {
+  Workbook wb = Workbook::create_empty();
+  std::string name;
+  for (std::size_t i = 0; i < Workbook::kMaxSheets; ++i) {
+    name.assign("S");
+    name.append(std::to_string(i));
+    ASSERT_TRUE(static_cast<bool>(wb.add_sheet_checked(name))) << "rejected at sheet " << i;
+  }
+  ASSERT_EQ(wb.sheet_count(), Workbook::kMaxSheets);
+
+  auto checked = wb.add_sheet_checked("Overflow");
+  ASSERT_FALSE(static_cast<bool>(checked));
+  EXPECT_EQ(checked.error().code, FormulonErrorCode::kSheetCountLimitExceeded);
+
+  auto validated = wb.add_sheet_validated("Overflow");
+  ASSERT_FALSE(static_cast<bool>(validated));
+  EXPECT_EQ(validated.error().code, FormulonErrorCode::kSheetCountLimitExceeded);
+
+  // The name-unchecked overload has no error channel, but it must not grow
+  // the workbook past the ceiling either, and the index it reports back must
+  // not name a sheet the caller could then mutate by mistake.
+  EXPECT_EQ(wb.add_sheet("Overflow"), Workbook::kMaxSheets);
+  EXPECT_EQ(wb.sheet_count(), Workbook::kMaxSheets);
+  EXPECT_EQ(wb.sheet(Workbook::kMaxSheets - 1U).name(), "S" + std::to_string(Workbook::kMaxSheets - 1U));
+}
+
+TEST(WorkbookSheetOps, RemoveRejectsLastSheet) {
+  Workbook wb = Workbook::create();  // single Sheet1
+  auto r = wb.remove_sheet(0);
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kCannotRemoveLastSheet);
+  EXPECT_EQ(wb.sheet_count(), 1U);
+}
+
+TEST(WorkbookSheetOps, RemoveRejectsOutOfRange) {
+  Workbook wb = ThreeSheetWorkbook();
+  auto r = wb.remove_sheet(kOutOfRangeIndex);
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kSheetIndexOutOfRange);
+}
+
+TEST(WorkbookSheetOps, RemoveFreezesWorkbookScopedNamesTargetingRemovedSheet) {
+  Workbook wb = ThreeSheetWorkbook();
+  std::vector<DefinedName> names;
+  DefinedName keep;
+  keep.name = "Keeper";
+  keep.formula = "Alpha!$A$1";
+  keep.local_sheet_id = -1;
+  names.push_back(keep);
+
+  DefinedName frozen;
+  frozen.name = "Goner";
+  frozen.formula = "Beta!$A$1";
+  frozen.local_sheet_id = -1;
+  names.push_back(frozen);
+  wb.set_defined_names(std::move(names));
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));
+
+  ASSERT_EQ(wb.defined_names().size(), 2U);
+  EXPECT_EQ(wb.defined_names()[0].name, "Keeper");
+  EXPECT_EQ(wb.defined_names()[1].name, "Goner");
+  EXPECT_EQ(wb.defined_names()[1].formula, "#REF!");
+}
+
+TEST(WorkbookSheetOps, RemoveAdjustsSheetScopedLocalIds) {
+  Workbook wb = ThreeSheetWorkbook();
+  std::vector<DefinedName> names;
+  DefinedName scoped_alpha;
+  scoped_alpha.name = "A";
+  scoped_alpha.formula = "$A$1";
+  scoped_alpha.local_sheet_id = 0;
+  names.push_back(scoped_alpha);
+
+  DefinedName scoped_gamma;
+  scoped_gamma.name = "G";
+  scoped_gamma.formula = "$A$1";
+  scoped_gamma.local_sheet_id = 2;
+  names.push_back(scoped_gamma);
+  wb.set_defined_names(std::move(names));
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));  // remove Beta
+
+  ASSERT_EQ(wb.defined_names().size(), 2U);
+  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, 0);  // Alpha still at 0
+  EXPECT_EQ(wb.defined_names()[1].local_sheet_id, 1);  // Gamma shifted down
+}
+
+TEST(WorkbookSheetOps, MoveForwardRearrangesSheets) {
+  Workbook wb = ThreeSheetWorkbook();
+  // Move Alpha (0) to position 2 (the end). Excel UI semantics:
+  // `to_index == 2`, not `3`.
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0, 2)));
+  EXPECT_EQ(wb.sheet(0).name(), "Beta");
+  EXPECT_EQ(wb.sheet(1).name(), "Gamma");
+  EXPECT_EQ(wb.sheet(2).name(), "Alpha");
+}
+
+TEST(WorkbookSheetOps, MoveBackwardRearrangesSheets) {
+  Workbook wb = ThreeSheetWorkbook();
+  // Move Gamma (2) to position 0.
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(2, 0)));
+  EXPECT_EQ(wb.sheet(0).name(), "Gamma");
+  EXPECT_EQ(wb.sheet(1).name(), "Alpha");
+  EXPECT_EQ(wb.sheet(2).name(), "Beta");
+}
+
+TEST(WorkbookSheetOps, MoveNoOpAcceptsSamePosition) {
+  Workbook wb = ThreeSheetWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(1, 1)));
+  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
+  EXPECT_EQ(wb.sheet(1).name(), "Beta");
+  EXPECT_EQ(wb.sheet(2).name(), "Gamma");
+}
+
+TEST(WorkbookSheetOps, MoveRejectsOutOfRange) {
+  Workbook wb = ThreeSheetWorkbook();
+  auto r1 = wb.move_sheet(kOutOfRangeIndex, 0);
+  ASSERT_FALSE(static_cast<bool>(r1));
+  EXPECT_EQ(r1.error().code, FormulonErrorCode::kSheetIndexOutOfRange);
+
+  auto r2 = wb.move_sheet(0, kOutOfRangeIndex);
+  ASSERT_FALSE(static_cast<bool>(r2));
+  EXPECT_EQ(r2.error().code, FormulonErrorCode::kSheetIndexOutOfRange);
+}
+
+TEST(WorkbookSheetOps, MoveAdjustsSheetScopedLocalIds) {
+  Workbook wb = ThreeSheetWorkbook();
+  std::vector<DefinedName> names;
+  DefinedName name_alpha;
+  name_alpha.name = "A";
+  name_alpha.formula = "$A$1";
+  name_alpha.local_sheet_id = 0;
+  DefinedName name_beta;
+  name_beta.name = "B";
+  name_beta.formula = "$A$1";
+  name_beta.local_sheet_id = 1;
+  DefinedName name_gamma;
+  name_gamma.name = "C";
+  name_gamma.formula = "$A$1";
+  name_gamma.local_sheet_id = 2;
+  names.push_back(name_alpha);
+  names.push_back(name_beta);
+  names.push_back(name_gamma);
+  wb.set_defined_names(std::move(names));
+
+  // Move sheet 0 (Alpha) to position 2: post-removal layout is
+  // [Beta, Gamma, Alpha]. Alpha was scope 0 -> now 2; Beta was 1 -> 0;
+  // Gamma was 2 -> 1.
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0, 2)));
+  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, 2);  // A (Alpha)
+  EXPECT_EQ(wb.defined_names()[1].local_sheet_id, 0);  // B (Beta)
+  EXPECT_EQ(wb.defined_names()[2].local_sheet_id, 1);  // C (Gamma)
+}
+
+TEST(WorkbookSheetOps, RemoveMiddleSheetRepointsCrossSheetDependencies) {
+  Workbook wb = ThreeSheetWorkbook();                                                // Alpha(0), Beta(1), Gamma(2)
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, 0, 0, Value::number(100.0))));  // Gamma!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=Gamma!A1")));         // Alpha!A1
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 100.0);
+
+  // Remove Beta (index 1); Gamma slides to index 1.
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));
+  EXPECT_EQ(wb.sheet(1).name(), "Gamma");
+  // Recalc after the structural change re-reads Gamma at its new index.
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 100.0);
+
+  // Edit Gamma (now index 1); the dependent Alpha!A1 must re-evaluate.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(300.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 300.0)
+      << "cross-sheet dependent stale after removing a preceding sheet";
+}
+
+TEST(WorkbookSheetOps, MoveSheetRepointsCrossSheetDependencies) {
+  Workbook wb = ThreeSheetWorkbook();                                               // Alpha(0), Beta(1), Gamma(2)
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, 0, 0, Value::number(10.0))));  // Gamma!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=Gamma!A1")));        // Alpha!A1
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 10.0);
+
+  // Move Alpha (0) to the end: layout becomes [Beta, Gamma, Alpha].
+  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0, 2)));
+  EXPECT_EQ(wb.sheet(1).name(), "Gamma");
+  EXPECT_EQ(wb.sheet(2).name(), "Alpha");
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 10.0);
+
+  // Edit Gamma (now index 1); Alpha (now index 2) must re-evaluate.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(42.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 42.0)
+      << "cross-sheet dependent stale after moving a sheet";
+}
+
+TEST(WorkbookSheetOps, SetDefinedNameAddsEntry) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Pi", "=3.14159")));
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].name, "Pi");
+  EXPECT_EQ(wb.defined_names()[0].formula, "=3.14159");
+  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, -1);
+}
+
+TEST(WorkbookSheetOps, SetDefinedNameUpdatesExisting) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Pi", "=3.14")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("PI", "=3.14159")));
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  // Authored casing of the original entry is preserved.
+  EXPECT_EQ(wb.defined_names()[0].name, "Pi");
+  EXPECT_EQ(wb.defined_names()[0].formula, "=3.14159");
+}
+
+TEST(WorkbookSheetOps, SetDefinedNameEmptyFormulaRemovesEntry) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Pi", "=3.14")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Pi", "")));
+  EXPECT_TRUE(wb.defined_names().empty());
+}
+
+TEST(WorkbookSheetOps, SetDefinedNameEmptyFormulaOnMissingNameIsNoOp) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Missing", "")));
+  EXPECT_TRUE(wb.defined_names().empty());
+}
+
+TEST(WorkbookSheetOps, SetDefinedNameRejectsEmptyName) {
+  Workbook wb = Workbook::create();
+  auto r = wb.set_defined_name("", "=1");
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidArgument);
+}
+
+TEST(WorkbookSheetOps, BulkDefinedNameReplacementReindexesAliasesAndPreservesUnrelatedSpill) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(2.0))));
+
+  wb.set_defined_names({DefinedName{"Base", "=A1", -1, false, ""}, DefinedName{"Alias", "=Base", -1, false, ""},
+                        DefinedName{"UnrelatedSpill", "=SEQUENCE(2,1)", -1, false, ""}});
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=Alias")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 3U, "=UnrelatedSpill")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(0U, 1U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(0U, 1U).as_number(), 1.0);
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(1U, 3U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(1U, 3U).as_number(), 2.0);
+
+  // Retarget Base while keeping Alias unchanged. The unrelated named spill
+  // changes only its comment/hidden metadata and must stay committed while
+  // the affected alias formula is re-registered.
+  wb.set_defined_names({DefinedName{"Base", "=A2", -1, false, ""}, DefinedName{"Alias", "=Base", -1, false, ""},
+                        DefinedName{"UnrelatedSpill", "=SEQUENCE(2,1)", -1, true, "preserve"}});
+  const Value spill_before_recalc = wb.sheet(0U).resolve_cell_value(1U, 3U);
+  ASSERT_TRUE(spill_before_recalc.is_number());
+  EXPECT_DOUBLE_EQ(spill_before_recalc.as_number(), 2.0);
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(0U, 1U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(0U, 1U).as_number(), 2.0);
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(1U, 3U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(1U, 3U).as_number(), 2.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(8.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(0U, 1U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(0U, 1U).as_number(), 8.0);
+
+  // Removing Base also removes the value behind Alias. The unrelated spill
+  // remains available and is not swept by the name-list replacement.
+  wb.set_defined_names({DefinedName{"Alias", "=Base", -1, false, ""},
+                        DefinedName{"UnrelatedSpill", "=SEQUENCE(2,1)", -1, true, "preserve"}});
+  const Value spill_before_remove_recalc = wb.sheet(0U).resolve_cell_value(1U, 3U);
+  ASSERT_TRUE(spill_before_remove_recalc.is_number());
+  EXPECT_DOUBLE_EQ(spill_before_remove_recalc.as_number(), 2.0);
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value removed_alias = wb.sheet(0U).resolve_cell_value(0U, 1U);
+  ASSERT_TRUE(removed_alias.is_error());
+  EXPECT_EQ(removed_alias.as_error(), ErrorCode::Name);
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(1U, 3U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(1U, 3U).as_number(), 2.0);
+}
+
+TEST(WorkbookSheetOps, BulkDefinedNamesRespectGlobalAndLocalScopes) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Alpha");
+  wb.add_sheet("Beta");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 1U, 0U, Value::number(20.0))));
+  wb.set_defined_names(
+      {DefinedName{"Rate", "=Alpha!A1", -1, false, ""}, DefinedName{"Rate", "=Beta!A1", 1, false, ""}});
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=Rate")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 1U, "=Rate")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(0U, 1U).is_number());
+  ASSERT_TRUE(wb.sheet(1U).resolve_cell_value(0U, 1U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(0U, 1U).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(1U).resolve_cell_value(0U, 1U).as_number(), 2.0);
+
+  wb.set_defined_names(
+      {DefinedName{"Rate", "=Alpha!A1", -1, false, ""}, DefinedName{"Rate", "=Beta!A2", 1, false, ""}});
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(0U, 1U).is_number());
+  ASSERT_TRUE(wb.sheet(1U).resolve_cell_value(0U, 1U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(0U, 1U).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(1U).resolve_cell_value(0U, 1U).as_number(), 20.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 1U, 0U, Value::number(30.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(1U).resolve_cell_value(0U, 1U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(1U).resolve_cell_value(0U, 1U).as_number(), 30.0);
+  ASSERT_TRUE(wb.sheet(0U).resolve_cell_value(0U, 1U).is_number());
+  EXPECT_DOUBLE_EQ(wb.sheet(0U).resolve_cell_value(0U, 1U).as_number(), 1.0);
+}
+
+TEST(WorkbookSheetOps, BulkDefinedNameAdditionRecoversCachedNameError) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Later")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value before = wb.sheet(0U).resolve_cell_value(0U, 0U);
+  ASSERT_TRUE(before.is_error());
+  EXPECT_EQ(before.as_error(), ErrorCode::Name);
+  wb.set_defined_names({DefinedName{"Later", "=42", -1, false, ""}});
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value after = wb.sheet(0U).resolve_cell_value(0U, 0U);
+  ASSERT_TRUE(after.is_number());
+  EXPECT_DOUBLE_EQ(after.as_number(), 42.0);
+}
+
+TEST(WorkbookSheetOps, BulkDefinedNameMetadataChangePreservesCommittedSpill) {
+  Workbook wb = Workbook::create();
+  wb.set_defined_names({DefinedName{"Array", "=SEQUENCE(2,1)", -1, false, ""}});
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Array")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  wb.set_defined_names({DefinedName{"ARRAY", "=SEQUENCE(2,1)", -1, true, "comment"}});
+  const Value tail = wb.sheet(0U).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(tail.is_number());
+  EXPECT_DOUBLE_EQ(tail.as_number(), 2.0);
+  auto recalc = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(recalc));
+  EXPECT_EQ(recalc.value().cells_evaluated, 0U);
+}
+
+TEST(WorkbookSheetOps, LoadedDefinedNameAliasesStayLiveAfterSourceEdit) {
+  Workbook src = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(src.set_cell_value(0U, 0U, 0U, Value::number(5.0))));
+  src.set_defined_names({DefinedName{"Base", "=A1", -1, false, ""}, DefinedName{"Alias", "=Base", -1, false, ""}});
+  ASSERT_TRUE(static_cast<bool>(src.set_cell_formula(0U, 0U, 1U, "=Alias")));
+  ASSERT_TRUE(static_cast<bool>(src.recalc(eval::default_registry())));
+  auto saved = src.save();
+  ASSERT_TRUE(static_cast<bool>(saved)) << saved.error().message;
+
+  auto loaded = io::read_ooxml(io::ByteSpan{saved.value().data(), saved.value().size()});
+  ASSERT_TRUE(static_cast<bool>(loaded)) << loaded.error().message;
+  Workbook& dst = loaded.value().workbook;
+  ASSERT_TRUE(static_cast<bool>(dst.recalc(eval::default_registry())));
+  const Value first = dst.sheet(0U).resolve_cell_value(0U, 1U);
+  ASSERT_TRUE(first.is_number());
+  EXPECT_DOUBLE_EQ(first.as_number(), 5.0);
+
+  ASSERT_TRUE(static_cast<bool>(dst.set_cell_value(0U, 0U, 0U, Value::number(9.0))));
+  ASSERT_TRUE(static_cast<bool>(dst.recalc(eval::default_registry())));
+  const Value after_edit = dst.sheet(0U).resolve_cell_value(0U, 1U);
+  ASSERT_TRUE(after_edit.is_number());
+  EXPECT_DOUBLE_EQ(after_edit.as_number(), 9.0);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/integration/sheet_ops_row_col_edits_test.cpp b/tests/integration/sheet_ops_row_col_edits_test.cpp
new file mode 100644
index 000000000..2cd49a88e
--- /dev/null
+++ b/tests/integration/sheet_ops_row_col_edits_test.cpp
@@ -0,0 +1,781 @@
+// Structural workbook mutation tests grouped by public surface.
+#include <limits>
+
+#include "sheet_ops_test_support.h"
+
+namespace formulon {
+namespace {
+using namespace sheet_ops_test;
+
+TEST(WorkbookRowColEdits, QualifiedBuiltinsStayOpaqueAndEdgeFreeAfterEdits) {
+  for (const bool rows : {false, true}) {
+    for (const bool deletion : {false, true}) {
+      SCOPED_TRACE(std::string(rows ? "rows" : "cols") + (deletion ? " delete" : " insert"));
+      Workbook wb = Workbook::create();
+      ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1, 1, "=Sheet1!SUM(C3)")));
+      ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 2, 2, "=B2")));
+      EXPECT_TRUE(wb.recalc_engine().dep_graph().dependencies_of({0, 1, 1}).empty());
+      ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+      ASSERT_TRUE(static_cast<bool>(rows ? (deletion ? wb.delete_rows(0, 0, 1) : wb.insert_rows(0, 0, 1))
+                                         : (deletion ? wb.delete_cols(0, 0, 1) : wb.insert_cols(0, 0, 1))));
+      const std::uint32_t moved = deletion ? 0U : 2U;
+      const std::uint32_t dependent = deletion ? 1U : 3U;
+      const eval::CellNodeId invalid{0, rows ? moved : 1U, rows ? 1U : moved};
+      EXPECT_TRUE(wb.recalc_engine().dep_graph().dependencies_of(invalid).empty());
+      ASSERT_NE(wb.sheet(0).cell_at(invalid.row, invalid.col), nullptr);
+      EXPECT_EQ(wb.sheet(0).cell_at(invalid.row, invalid.col)->formula_text, "=Sheet1!SUM(C3)");
+      ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+      for (const auto coordinate :
+           {CellAddress{invalid.row, invalid.col}, CellAddress{rows ? dependent : 2U, rows ? 2U : dependent}}) {
+        const Cell* cell = wb.sheet(0).cell_at(coordinate.row, coordinate.col);
+        ASSERT_NE(cell, nullptr);
+        ASSERT_TRUE(cell->cached_value.is_error());
+        EXPECT_EQ(cell->cached_value.as_error(), ErrorCode::Name);
+      }
+    }
+  }
+}
+
+TEST(WorkbookRowColEdits, QualifiedBuiltinsStayEdgeFreeWhenNamesForceFullReindex) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Region", "=Sheet1!$A$2")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1, 1, "=Sheet1!SUM(C3)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 2, 2, "=B2")));
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 0, 1)));
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_EQ(wb.defined_names()[0].formula, "=Sheet1!$A$3");
+  EXPECT_TRUE(wb.recalc_engine().dep_graph().dependencies_of({0, 2, 1}).empty());
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0).cell_at(3, 2)->cached_value.is_error());
+  EXPECT_EQ(wb.sheet(0).cell_at(3, 2)->cached_value.as_error(), ErrorCode::Name);
+}
+
+TEST(WorkbookRowColEdits, QualifiedBuiltinsStayEdgeFreeWhenNamesAreRetargeted) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Region", "=C1")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 1, "=Sheet1!SUM(Region)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=B1")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Region", "=A1")));
+  EXPECT_TRUE(wb.recalc_engine().dep_graph().dependencies_of({0, 0, 1}).empty());
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_TRUE(wb.sheet(0).cell_at(0, 0)->cached_value.is_error());
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_error(), ErrorCode::Name);
+}
+
+TEST(WorkbookRowColEdits, MovedInvalidFormulasAreRecalculatedAtTheirNewCoordinates) {
+  for (const bool rows : {false, true}) {
+    for (const bool deletion : {false, true}) {
+      SCOPED_TRACE(std::string(rows ? "rows" : "cols") + (deletion ? " delete" : " insert"));
+      Workbook wb = Workbook::create();
+      ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1, 1, "=A1 3")));
+      const auto edited = rows ? (deletion ? wb.delete_rows(0, 0, 1) : wb.insert_rows(0, 0, 1))
+                               : (deletion ? wb.delete_cols(0, 0, 1) : wb.insert_cols(0, 0, 1));
+      ASSERT_TRUE(static_cast<bool>(edited));
+      const std::uint32_t moved = deletion ? 0U : 2U;
+      const Cell* cell = wb.sheet(0).cell_at(rows ? moved : 1U, rows ? 1U : moved);
+      ASSERT_NE(cell, nullptr);
+      EXPECT_EQ(cell->formula_text, "=A1 3");
+      ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+      cell = wb.sheet(0).cell_at(rows ? moved : 1U, rows ? 1U : moved);
+      ASSERT_NE(cell, nullptr);
+      ASSERT_TRUE(cell->cached_value.is_error());
+      EXPECT_EQ(cell->cached_value.as_error(), ErrorCode::Name);
+    }
+  }
+}
+
+TEST(WorkbookRowColEdits, DeletingInvalidFormulasDoesNotOverwriteReplacementValues) {
+  for (const bool rows : {false, true}) {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=A1 3")));
+    ASSERT_TRUE(static_cast<bool>(rows ? wb.delete_rows(0, 0, 1) : wb.delete_cols(0, 0, 1)));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(42.0))));
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    const Cell* cell = wb.sheet(0).cell_at(0, 0);
+    ASSERT_NE(cell, nullptr);
+    EXPECT_TRUE(cell->formula_text.empty());
+    ASSERT_TRUE(cell->cached_value.is_number());
+    EXPECT_DOUBLE_EQ(cell->cached_value.as_number(), 42.0);
+  }
+}
+
+TEST(WorkbookSheetOps, InsertRowsRekeysAllDependenciesBeforeRegisteringNewCoordinates) {
+  Workbook wb = Workbook::create();
+  constexpr std::uint32_t kRows = 60U;
+  for (std::uint32_t row = 0; row < kRows; ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, row, 0U, Value::number(static_cast<double>(row)))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, row, 1U, "=A" + std::to_string(row + 1U))));
+  }
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0U, 0U, 1U)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(999.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+
+  for (std::uint32_t row = 0; row < kRows; ++row) {
+    const Cell* dependent = wb.sheet(0).cell_at(row + 1U, 1U);
+    ASSERT_NE(dependent, nullptr) << "missing formula at row " << row + 2U;
+    ASSERT_TRUE(dependent->cached_value.is_number());
+    const double expected = (row == 0U) ? 999.0 : static_cast<double>(row);
+    EXPECT_DOUBLE_EQ(dependent->cached_value.as_number(), expected) << "stale dependent at row " << row + 2U;
+  }
+}
+
+TEST(WorkbookSheetOps, ConsecutiveRowInsertsKeepShiftedDependenciesLive) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 2, 1, "=SUM(A1:A2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(2, 1)->cached_value.as_number(), 3.0);
+
+  // Inserting inside the range expands it; the original second input moves
+  // to A3 and the dependent moves to B4.
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 1, 1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(5.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_NE(wb.sheet(0).cell_at(3, 1), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(3, 1)->formula_text, "=SUM(A1:A3)");
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(3, 1)->cached_value.as_number(), 8.0);
+
+  // A second insert must re-key the already-shifted dependency. Updating
+  // the moved original A1 (now A2) must still invalidate the formula B5.
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 0, 1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_NE(wb.sheet(0).cell_at(4, 1), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(4, 1)->formula_text, "=SUM(A2:A4)");
+  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(4, 1)->cached_value.as_number(), 17.0);
+}
+
+TEST(WorkbookRowColEdits, InsertRowsShiftsCellsAndFormulas) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 5, 0, Value::number(20.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 6, 0, "=A1+A6")));
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/3, /*count=*/2)));
+
+  // Cells at row 0 stayed put; cell at row 5 moved to row 7; the formula
+  // cell at row 6 moved to row 8 and its A6 ref shifted to A8.
+  const Sheet& s = wb.sheet(0);
+  ASSERT_NE(s.cell_at(0, 0), nullptr);
+  EXPECT_EQ(s.cell_at(0, 0)->cached_value.as_number(), 10.0);
+  EXPECT_EQ(s.cell_at(5, 0), nullptr);
+  ASSERT_NE(s.cell_at(7, 0), nullptr);
+  EXPECT_EQ(s.cell_at(7, 0)->cached_value.as_number(), 20.0);
+  ASSERT_NE(s.cell_at(8, 0), nullptr);
+  EXPECT_EQ(s.cell_at(8, 0)->formula_text, "=A1+A8");
+}
+
+TEST(WorkbookRowColEdits, InsertRowsShiftsConditionalFormatsLayoutAndBreaks) {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  cf::ConditionalFormat format;
+  format.sqref.push_back(cf::CFCellRange{CellAddress{1, 0}, CellAddress{2, 1}});
+  cf::CFRule rule;
+  rule.formula1 = "A2";
+  format.rules.push_back(std::move(rule));
+  sheet.mutable_conditional_formats().push_back(std::move(format));
+  sheet.mutable_layout().row_overrides.push_back(RowLayout{2, 24.0, true, 1, true});
+  sheet.mutable_layout().columns.push_back(ColumnLayout{1, 2, 18.0, true, 2});
+  sheet.mutable_print_settings().manual_row_breaks.push_back(ManualBreak{3, 0, 10, true});
+  sheet.mutable_print_settings().manual_col_breaks.push_back(ManualBreak{2, 0, 10, true});
+  TableMetadata table;
+  table.id = 1;
+  table.name = "Table1";
+  table.display_name = "Table1";
+  table.sheet_index = 0;
+  table.ref = "A2:B3";
+  table.columns.push_back(TableColumn{1, "Value", {}, {}, "A2"});
+  wb.set_tables({table});
+  auto pivot = std::make_unique<pivot::PivotTable>();
+  pivot->set_anchor(2, 1, 3, 2);
+  sheet.add_pivot_table(std::move(pivot));
+  ASSERT_TRUE(sheet.commit_spill(4, 4, 2, 1, std::vector<Value>{Value::number(1), Value::number(2)}));
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 1, 1)));
+  const cf::CFCellRange row_shifted = sheet.conditional_formats()[0].sqref[0];
+  EXPECT_EQ(row_shifted.first.row, 2U);
+  EXPECT_EQ(row_shifted.last.row, 3U);
+  ASSERT_TRUE(sheet.conditional_formats()[0].rules[0].formula1.has_value());
+  EXPECT_EQ(*sheet.conditional_formats()[0].rules[0].formula1, "A3");
+  EXPECT_EQ(sheet.layout().row_overrides[0].row, 3U);
+  EXPECT_EQ(sheet.print_settings().manual_row_breaks[0].id, 4U);
+  ASSERT_EQ(sheet.pivot_tables().size(), 1U);
+  EXPECT_EQ(sheet.pivot_tables()[0]->anchor_row(), 3U);
+  EXPECT_EQ(sheet.spill_region_at_anchor(5, 4), nullptr);
+  ASSERT_EQ(wb.tables().size(), 1U);
+  EXPECT_EQ(wb.tables()[0].ref, "A3:B4");
+  EXPECT_EQ(wb.tables()[0].columns[0].calculated_column_formula, "A3");
+  // Column-bound metadata is not touched by a row edit.
+  EXPECT_EQ(sheet.layout().columns[0].first, 1U);
+  EXPECT_EQ(sheet.print_settings().manual_col_breaks[0].id, 2U);
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, 0, 1)));
+  const cf::CFCellRange col_shifted = sheet.conditional_formats()[0].sqref[0];
+  EXPECT_EQ(col_shifted.first.col, 1U);
+  EXPECT_EQ(col_shifted.last.col, 2U);
+  EXPECT_EQ(sheet.layout().columns[0].first, 2U);
+  EXPECT_EQ(sheet.layout().columns[0].last, 3U);
+  EXPECT_EQ(sheet.print_settings().manual_col_breaks[0].id, 3U);
+  EXPECT_EQ(sheet.pivot_tables()[0]->anchor_col(), 2U);
+  EXPECT_EQ(wb.tables()[0].ref, "B3:C4");
+}
+
+TEST(WorkbookRowColEdits, DeleteRowsRemovesConditionalFormatWhoseRangeIsDeleted) {
+  Workbook wb = Workbook::create();
+  cf::ConditionalFormat format;
+  format.sqref.push_back(cf::CFCellRange{CellAddress{1, 0}, CellAddress{2, 1}});
+  cf::CFRule rule;
+  rule.formula1 = "A2";
+  format.rules.push_back(std::move(rule));
+  wb.sheet(0).mutable_conditional_formats().push_back(std::move(format));
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, 1, 2)));
+  EXPECT_TRUE(wb.sheet(0).conditional_formats().empty());
+}
+
+TEST(WorkbookRowColEdits, DeleteRowsCollapsesReferencesInsideInterval) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=A5")));     // A5 lives inside the deletion.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 1, "=A8+A2")));  // A8 trails the deletion; A2 is below.
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/3, /*count=*/3)));
+
+  const Sheet& s = wb.sheet(0);
+  // A5 falls inside [3, 6); collapses to #REF!.
+  EXPECT_EQ(s.cell_at(0, 0)->formula_text, "=#REF!");
+  // A8 -> A5 (shifted up by 3); A2 unchanged.
+  EXPECT_EQ(s.cell_at(0, 1)->formula_text, "=A5+A2");
+}
+
+TEST(WorkbookRowColEdits, DeleteRowsShrinksRangeAtFirstLastAndMiddle) {
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A1:A3)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(A1:A2)");
+  }
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A1:A3)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/2, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(A1:A2)");
+  }
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A1:A5)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/2, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(A1:A4)");
+  }
+}
+
+TEST(WorkbookRowColEdits, DeleteRowsCollapsesSingletonAndShrinksWholeRowRange) {
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A2:A2)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/1, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(#REF!)");
+  }
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(1:4)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/1, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(1:3)");
+  }
+}
+
+TEST(WorkbookRowColEdits, DeleteRowsCollapsesFullyDeletedMultiCellRange) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A2:A4)")));
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/1, /*count=*/3)));
+  ASSERT_NE(wb.sheet(0).cell_at(7, 0), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(7, 0)->formula_text, "=SUM(#REF!)");
+}
+
+TEST(WorkbookRowColEdits, DeleteRowsShrunkRangeRecalculatesAfterSurvivorChange) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(20.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, 0, Value::number(30.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 3, 0, Value::number(40.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 6, 3, "=SUM(A1:A4)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_EQ(wb.sheet(0).cell_at(6, 3)->cached_value.as_number(), 100.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_NE(wb.sheet(0).cell_at(5, 3), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(5, 3)->formula_text, "=SUM(A1:A3)");
+  EXPECT_EQ(wb.sheet(0).cell_at(5, 3)->cached_value.as_number(), 90.0);
+
+  // The surviving dependency at A2 must still point at the moved formula;
+  // changing it and recalculating proves the structural edit rebuilt the
+  // dependency graph rather than merely changing formula text.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(50.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).cell_at(5, 3)->cached_value.as_number(), 110.0);
+}
+
+TEST(WorkbookRowColEdits, InsertColsShiftsCellsAcrossRow) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 3, Value::number(4.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1, 0, "=A1+D1")));
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, /*col=*/1, /*count=*/2)));
+
+  const Sheet& s = wb.sheet(0);
+  EXPECT_EQ(s.cell_at(0, 0)->cached_value.as_number(), 1.0);
+  // Slot at (0, 3) exists in the row vector but is a default Cell — the
+  // value that used to live there migrated forward.
+  ASSERT_NE(s.cell_at(0, 3), nullptr);
+  EXPECT_TRUE(s.cell_at(0, 3)->cached_value.is_blank());
+  ASSERT_NE(s.cell_at(0, 5), nullptr);
+  EXPECT_EQ(s.cell_at(0, 5)->cached_value.as_number(), 4.0);
+  // The formula cell sat at (1, 0), which is below the insert origin
+  // (col 1) and so does not move. Its references shift: D1 -> F1.
+  ASSERT_NE(s.cell_at(1, 0), nullptr);
+  EXPECT_EQ(s.cell_at(1, 0)->formula_text, "=A1+F1");
+}
+
+TEST(WorkbookRowColEdits, DeleteColsRewritesFormulaAndDropsCell) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 5, "=B1+C1+E1")));
+
+  // Delete cols B..C (col indices 1..2).
+  ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/1, /*count=*/2)));
+
+  const Sheet& s = wb.sheet(0);
+  // Source cell moved from F1 (col 5) to D1 (col 3).
+  ASSERT_NE(s.cell_at(0, 3), nullptr);
+  // B1 and C1 are inside the deleted span: collapse the entire formula
+  // to #REF! because every range / sum endpoint that lands inside the
+  // deletion poisons its enclosing expression.
+  EXPECT_EQ(s.cell_at(0, 3)->formula_text, "=#REF!+#REF!+C1");
+}
+
+TEST(WorkbookRowColEdits, DeleteColsShrinksRangeAtFirstLastAndMiddle) {
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(A1:D1)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(0, 9), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(0, 9)->formula_text, "=SUM(A1:C1)");
+  }
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(A1:D1)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/3, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(0, 9), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(0, 9)->formula_text, "=SUM(A1:C1)");
+  }
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(A1:F1)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/2, /*count=*/2)));
+    ASSERT_NE(wb.sheet(0).cell_at(0, 8), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(0, 8)->formula_text, "=SUM(A1:D1)");
+  }
+}
+
+TEST(WorkbookRowColEdits, DeleteColsCollapsesSingletonAndShrinksWholeColumnRange) {
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(B1:B1)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/1, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(0, 9), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(0, 9)->formula_text, "=SUM(#REF!)");
+  }
+  {
+    Workbook wb = Workbook::create();
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(A:D)")));
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/1, /*count=*/1)));
+    ASSERT_NE(wb.sheet(0).cell_at(0, 9), nullptr);
+    EXPECT_EQ(wb.sheet(0).cell_at(0, 9)->formula_text, "=SUM(A:C)");
+  }
+}
+
+TEST(WorkbookRowColEdits, DeleteColsCollapsesFullyDeletedMultiCellRange) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(B1:D1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/1, /*count=*/3)));
+  ASSERT_NE(wb.sheet(0).cell_at(0, 7), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 7)->formula_text, "=SUM(#REF!)");
+}
+
+TEST(WorkbookRowColEdits, DeleteColsShrunkRangeRecalculatesAfterSurvivorChange) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 1, Value::number(20.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 2, Value::number(30.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 3, Value::number(40.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 5, 6, "=SUM(A1:D1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_EQ(wb.sheet(0).cell_at(5, 6)->cached_value.as_number(), 100.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_NE(wb.sheet(0).cell_at(5, 5), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(5, 5)->formula_text, "=SUM(A1:C1)");
+  EXPECT_EQ(wb.sheet(0).cell_at(5, 5)->cached_value.as_number(), 90.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 1, Value::number(50.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).cell_at(5, 5)->cached_value.as_number(), 110.0);
+}
+
+TEST(WorkbookRowColEdits, InsertRowsShiftsMergeRanges) {
+  Workbook wb = Workbook::create();
+  Sheet& s = wb.sheet(0);
+  s.mutable_merges() = {MergeRange{0, 0, 0, 1}, MergeRange{5, 0, 7, 1}};
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/3, /*count=*/2)));
+
+  ASSERT_EQ(s.merges().size(), 2U);
+  // First merge sits entirely below the insert; unchanged.
+  EXPECT_EQ(s.merges()[0].first_row, 0U);
+  EXPECT_EQ(s.merges()[0].last_row, 0U);
+  // Second merge shifted forward by 2.
+  EXPECT_EQ(s.merges()[1].first_row, 7U);
+  EXPECT_EQ(s.merges()[1].last_row, 9U);
+}
+
+TEST(WorkbookRowColEdits, DeleteRowsClampsStraddlingMerge) {
+  Workbook wb = Workbook::create();
+  Sheet& s = wb.sheet(0);
+  s.mutable_merges() = {MergeRange{2, 0, 8, 1}};
+
+  // Delete rows 4..6.
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/4, /*count=*/3)));
+
+  ASSERT_EQ(s.merges().size(), 1U);
+  EXPECT_EQ(s.merges()[0].first_row, 2U);
+  // Last row was 8 (past the deletion); shifts up by 3 to 5.
+  EXPECT_EQ(s.merges()[0].last_row, 5U);
+}
+
+TEST(WorkbookRowColEdits, InsertDropsOffGridRangesAndKeepsPartialOverhangConsistent) {
+  for (const bool rows : {false, true}) {
+    SCOPED_TRACE(rows ? "rows" : "columns");
+    Workbook wb = Workbook::create();
+    Sheet& s = wb.sheet(0);
+    const std::uint32_t bound = rows ? Sheet::kMaxRows : Sheet::kMaxCols;
+    const std::uint32_t insert_at = bound - 4U;
+    const std::uint32_t count = 2U;
+
+    const auto make_range = [rows](std::uint32_t first, std::uint32_t last) {
+      return rows ? MergeRange{first, 0U, last, 1U} : MergeRange{0U, first, 1U, last};
+    };
+    const auto make_cf_range = [rows](std::uint32_t first, std::uint32_t last) {
+      return rows ? cf::CFCellRange{CellAddress{first, 0U}, CellAddress{last, 1U}}
+                  : cf::CFCellRange{CellAddress{0U, first}, CellAddress{1U, last}};
+    };
+    const auto make_hyperlink = [](const MergeRange& range, const char* target) {
+      Hyperlink hyperlink;
+      hyperlink.row = range.first_row;
+      hyperlink.col = range.first_col;
+      hyperlink.last_row = range.last_row;
+      hyperlink.last_col = range.last_col;
+      hyperlink.target = target;
+      return hyperlink;
+    };
+
+    // The first range is wholly pushed off-grid. The second starts at the
+    // insertion point and overhangs by one coordinate; it must remain as a
+    // valid clipped range. The third is below the edit and is unchanged.
+    const MergeRange off_grid = make_range(bound - 2U, bound - 1U);
+    const MergeRange partial = make_range(insert_at, bound - 2U);
+    const MergeRange untouched = make_range(0U, 1U);
+    s.mutable_merges() = {off_grid, partial, untouched};
+    s.mutable_hyperlinks() = {make_hyperlink(off_grid, "https://off-grid"), make_hyperlink(partial, "https://partial"),
+                              make_hyperlink(untouched, "https://untouched")};
+    DataValidation validation;
+    validation.ranges = {off_grid, partial, untouched};
+    s.mutable_validations().push_back(std::move(validation));
+    cf::ConditionalFormat conditional;
+    conditional.sqref = {make_cf_range(bound - 2U, bound - 1U), make_cf_range(insert_at, bound - 2U),
+                         make_cf_range(0U, 1U)};
+    s.mutable_conditional_formats().push_back(std::move(conditional));
+
+    const auto edited = rows ? wb.insert_rows(0U, insert_at, count) : wb.insert_cols(0U, insert_at, count);
+    ASSERT_TRUE(static_cast<bool>(edited));
+
+    const MergeRange expected_partial = make_range(bound - 2U, bound - 1U);
+    const MergeRange expected_untouched = untouched;
+    ASSERT_EQ(s.merges().size(), 2U);
+    EXPECT_EQ(s.merges()[0].first_row, expected_partial.first_row);
+    EXPECT_EQ(s.merges()[0].first_col, expected_partial.first_col);
+    EXPECT_EQ(s.merges()[0].last_row, expected_partial.last_row);
+    EXPECT_EQ(s.merges()[0].last_col, expected_partial.last_col);
+    EXPECT_EQ(s.merges()[1].first_row, expected_untouched.first_row);
+    EXPECT_EQ(s.merges()[1].first_col, expected_untouched.first_col);
+    EXPECT_EQ(s.merges()[1].last_row, expected_untouched.last_row);
+    EXPECT_EQ(s.merges()[1].last_col, expected_untouched.last_col);
+
+    ASSERT_EQ(s.hyperlinks().size(), 2U);
+    EXPECT_EQ(s.hyperlinks()[0].row, expected_partial.first_row);
+    EXPECT_EQ(s.hyperlinks()[0].col, expected_partial.first_col);
+    EXPECT_EQ(s.hyperlinks()[0].last_row, expected_partial.last_row);
+    EXPECT_EQ(s.hyperlinks()[0].last_col, expected_partial.last_col);
+    EXPECT_EQ(s.hyperlinks()[0].target, "https://partial");
+    EXPECT_EQ(s.hyperlinks()[1].row, expected_untouched.first_row);
+    EXPECT_EQ(s.hyperlinks()[1].col, expected_untouched.first_col);
+    EXPECT_EQ(s.hyperlinks()[1].last_row, expected_untouched.last_row);
+    EXPECT_EQ(s.hyperlinks()[1].last_col, expected_untouched.last_col);
+    EXPECT_EQ(s.hyperlinks()[1].target, "https://untouched");
+
+    ASSERT_EQ(s.validations().size(), 1U);
+    ASSERT_EQ(s.validations()[0].ranges.size(), 2U);
+    EXPECT_EQ(s.validations()[0].ranges[0].first_row, expected_partial.first_row);
+    EXPECT_EQ(s.validations()[0].ranges[0].first_col, expected_partial.first_col);
+    EXPECT_EQ(s.validations()[0].ranges[0].last_row, expected_partial.last_row);
+    EXPECT_EQ(s.validations()[0].ranges[0].last_col, expected_partial.last_col);
+    EXPECT_EQ(s.validations()[0].ranges[1].first_row, expected_untouched.first_row);
+    EXPECT_EQ(s.validations()[0].ranges[1].first_col, expected_untouched.first_col);
+    EXPECT_EQ(s.validations()[0].ranges[1].last_row, expected_untouched.last_row);
+    EXPECT_EQ(s.validations()[0].ranges[1].last_col, expected_untouched.last_col);
+
+    ASSERT_EQ(s.conditional_formats().size(), 1U);
+    ASSERT_EQ(s.conditional_formats()[0].sqref.size(), 2U);
+    EXPECT_EQ(s.conditional_formats()[0].sqref[0].first.row, expected_partial.first_row);
+    EXPECT_EQ(s.conditional_formats()[0].sqref[0].first.col, expected_partial.first_col);
+    EXPECT_EQ(s.conditional_formats()[0].sqref[0].last.row, expected_partial.last_row);
+    EXPECT_EQ(s.conditional_formats()[0].sqref[0].last.col, expected_partial.last_col);
+    EXPECT_EQ(s.conditional_formats()[0].sqref[1].first.row, expected_untouched.first_row);
+    EXPECT_EQ(s.conditional_formats()[0].sqref[1].first.col, expected_untouched.first_col);
+    EXPECT_EQ(s.conditional_formats()[0].sqref[1].last.row, expected_untouched.last_row);
+    EXPECT_EQ(s.conditional_formats()[0].sqref[1].last.col, expected_untouched.last_col);
+  }
+}
+
+TEST(WorkbookRowColEdits, InsertMaxCountDropsWhollyOffGridRangesWithoutWraparound) {
+  for (const bool rows : {false, true}) {
+    SCOPED_TRACE(rows ? "rows" : "columns");
+    Workbook wb = Workbook::create();
+    Sheet& s = wb.sheet(0);
+    const MergeRange range = rows ? MergeRange{0U, 0U, 0U, 1U} : MergeRange{0U, 0U, 1U, 0U};
+    s.mutable_merges().push_back(range);
+    Hyperlink hyperlink;
+    hyperlink.row = range.first_row;
+    hyperlink.col = range.first_col;
+    hyperlink.last_row = range.last_row;
+    hyperlink.last_col = range.last_col;
+    hyperlink.target = "https://off-grid";
+    s.mutable_hyperlinks().push_back(std::move(hyperlink));
+    DataValidation validation;
+    validation.ranges.push_back(range);
+    s.mutable_validations().push_back(std::move(validation));
+
+    const auto edited = rows ? wb.insert_rows(0U, 0U, std::numeric_limits<std::uint32_t>::max())
+                             : wb.insert_cols(0U, 0U, std::numeric_limits<std::uint32_t>::max());
+    ASSERT_TRUE(static_cast<bool>(edited));
+    EXPECT_TRUE(s.merges().empty());
+    EXPECT_TRUE(s.hyperlinks().empty());
+    EXPECT_TRUE(s.validations().empty());
+  }
+}
+
+TEST(WorkbookRowColEdits, InsertRowsRewritesDefinedName) {
+  Workbook wb = Workbook::create();
+  std::vector<DefinedName> names;
+  DefinedName dn;
+  dn.name = "Region";
+  dn.formula = "Sheet1!$A$5:$A$10";
+  dn.local_sheet_id = -1;
+  names.push_back(dn);
+  wb.set_defined_names(std::move(names));
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/3, /*count=*/2)));
+
+  EXPECT_EQ(wb.defined_names()[0].formula, "Sheet1!$A$7:$A$12");
+}
+
+TEST(WorkbookRowColEdits, InsertRowsReindexesFormulasThatReachRangesViaDefinedName) {
+  Workbook wb = Workbook::create();
+  std::vector<DefinedName> names;
+  DefinedName dn;
+  dn.name = "Region";
+  dn.formula = "Sheet1!$A$2:$A$3";
+  dn.local_sheet_id = -1;
+  names.push_back(dn);
+  wb.set_defined_names(std::move(names));
+
+  // A2 = 10, A3 = 20 (0-based rows 1 and 2).
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(10.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, 0, Value::number(20.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 2, "=SUM(Region)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_NE(wb.sheet(0).cell_at(0, 2), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 2)->cached_value.as_number(), 30.0);
+
+  // Insert a row above the named range: the definition moves to $A$3:$A$4 and
+  // the two values move with it. `=SUM(Region)` is unchanged as text.
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/1, /*count=*/1)));
+  EXPECT_EQ(wb.defined_names()[0].formula, "Sheet1!$A$3:$A$4");
+
+  // Write to A4 (0-based row 3). That row is inside the *new* definition and
+  // outside the old one, so the edit only marks `=SUM(Region)` dirty if the
+  // dep graph was re-indexed against the rewritten definition.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 3, 0, Value::number(25.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_NE(wb.sheet(0).cell_at(0, 2), nullptr);
+  EXPECT_EQ(wb.sheet(0).cell_at(0, 2)->cached_value.as_number(), 35.0)
+      << "SUM over the defined name did not follow the shifted definition";
+}
+
+TEST(WorkbookRowColEdits, InsertRowsRecomputesShiftedFormulasAndAggregates) {
+  Workbook wb = Workbook::create();
+  // Items: qty (col 1), unit (col 2), subtotal=qty*unit (col 3), tax=sub*0.08 (col 4).
+  // Row 0 reserved for headers (left empty).
+  // Item rows 1..5.
+  const double qty[] = {24, 30, 4, 12, 5};
+  const double unit[] = {0.42, 2.5, 4.45, 2.0, 0.75};
+  for (std::uint32_t i = 0; i < 5; ++i) {
+    const std::uint32_t r = i + 1;
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, r, 1, Value::number(qty[i]))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, r, 2, Value::number(unit[i]))));
+    // Excel-text uses 1-based addressing; the formula at cell row=i+1 references row=i+1 (1-based).
+    const std::string subtotal_formula = "=B" + std::to_string(r + 1) + "*C" + std::to_string(r + 1);
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, r, 3, subtotal_formula)));
+    const std::string tax_formula = "=D" + std::to_string(r + 1) + "*0.08";
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, r, 4, tax_formula)));
+  }
+  // Totals at row 7 (1-based row 8). =SUM(D2:D6) covers the entire item range.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 7, 3, "=SUM(D2:D6)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 7, 4, "=SUM(E2:E6)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 8, 3, "=D8+E8")));
+
+  // Initial recalc establishes the baseline.
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  {
+    const Sheet& s = wb.sheet(0);
+    EXPECT_EQ(s.cell_at(5, 3)->cached_value.as_number(), 5.0 * 0.75);  // eraser subtotal pre-shift
+    EXPECT_EQ(s.cell_at(7, 3)->cached_value.as_number(), 24 * 0.42 + 30 * 2.5 + 4 * 4.45 + 12 * 2.0 + 5 * 0.75);
+  }
+
+  // Insert one blank row at row index 1, push every item down by 1.
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/1, /*count=*/1)));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+
+  const Sheet& s = wb.sheet(0);
+  // Items now at rows 2..6, totals at row 8, with-tax at row 9.
+  for (std::uint32_t i = 0; i < 5; ++i) {
+    const std::uint32_t r = i + 2;
+    ASSERT_NE(s.cell_at(r, 3), nullptr) << "subtotal cell missing at row " << r;
+    ASSERT_NE(s.cell_at(r, 4), nullptr) << "tax cell missing at row " << r;
+    EXPECT_EQ(s.cell_at(r, 3)->cached_value.as_number(), qty[i] * unit[i])
+        << "subtotal mismatch at post-shift row " << r;
+    EXPECT_EQ(s.cell_at(r, 4)->cached_value.as_number(), qty[i] * unit[i] * 0.08)
+        << "tax mismatch at post-shift row " << r;
+  }
+  ASSERT_NE(s.cell_at(8, 3), nullptr);
+  EXPECT_EQ(s.cell_at(8, 3)->cached_value.as_number(), 24 * 0.42 + 30 * 2.5 + 4 * 4.45 + 12 * 2.0 + 5 * 0.75)
+      << "post-shift SUM mismatch (should NOT be #REF!)";
+  ASSERT_NE(s.cell_at(8, 4), nullptr);
+  EXPECT_NEAR(s.cell_at(8, 4)->cached_value.as_number(), (24 * 0.42 + 30 * 2.5 + 4 * 4.45 + 12 * 2.0 + 5 * 0.75) * 0.08,
+              1e-9);
+  ASSERT_NE(s.cell_at(9, 3), nullptr);
+  EXPECT_NEAR(s.cell_at(9, 3)->cached_value.as_number(), (24 * 0.42 + 30 * 2.5 + 4 * 4.45 + 12 * 2.0 + 5 * 0.75) * 1.08,
+              1e-9);
+}
+
+TEST(WorkbookRowColEdits, InsertColsRecomputesShiftedFormulasAndAggregates) {
+  Workbook wb = Workbook::create();
+  // Layout (1-based): row 3 has qty/unit per item; row 4 has the
+  // subtotal formulas; H4 = SUM(B4:F4).
+  const double qty[] = {2, 3, 4, 5, 6};
+  const double unit[] = {1.5, 2.5, 3.5, 4.5, 5.5};
+  for (std::uint32_t i = 0; i < 5; ++i) {
+    const std::uint32_t c = i + 1;  // cols 1..5 (B..F in 1-based)
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, c, Value::number(qty[i]))));
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 3, c, Value::number(unit[i]))));
+    const std::string col_letter(1, static_cast<char>('A' + c));
+    const std::string sub_formula = "=" + col_letter + "3*" + col_letter + "4";
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 4, c, sub_formula)));
+  }
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 4, 7, "=SUM(B5:F5)")));
+
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  double expected_sum = 0.0;
+  for (std::uint32_t i = 0; i < 5; ++i) {
+    expected_sum += qty[i] * unit[i];
+  }
+  EXPECT_EQ(wb.sheet(0).cell_at(4, 7)->cached_value.as_number(), expected_sum);
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, /*col=*/1, /*count=*/1)));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+
+  const Sheet& s = wb.sheet(0);
+  for (std::uint32_t i = 0; i < 5; ++i) {
+    const std::uint32_t c = i + 2;  // cols 2..6 post-shift
+    ASSERT_NE(s.cell_at(4, c), nullptr);
+    EXPECT_EQ(s.cell_at(4, c)->cached_value.as_number(), qty[i] * unit[i])
+        << "post-shift subtotal mismatch at col " << c;
+  }
+  ASSERT_NE(s.cell_at(4, 8), nullptr);
+  EXPECT_EQ(s.cell_at(4, 8)->cached_value.as_number(), expected_sum) << "post-shift SUM stale or #REF!";
+}
+
+TEST(WorkbookRowColEdits, DeleteRowsRecomputesShiftedFormulasAndAggregates) {
+  Workbook wb = Workbook::create();
+  const double qty[] = {2, 3, 4, 5, 6};
+  for (std::uint32_t i = 0; i < 5; ++i) {
+    const std::uint32_t r = i + 1;
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, r, 1, Value::number(qty[i]))));
+    const std::string subtotal_formula = "=B" + std::to_string(r + 1) + "*2";
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, r, 3, subtotal_formula)));
+  }
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 7, 3, "=SUM(D2:D6)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  double expected_pre = 0.0;
+  for (std::uint32_t i = 0; i < 5; ++i) {
+    expected_pre += qty[i] * 2;
+  }
+  EXPECT_EQ(wb.sheet(0).cell_at(7, 3)->cached_value.as_number(), expected_pre);
+
+  // Delete rows 2..3 (0-based), removing the second and third items.
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/2, /*count=*/2)));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+
+  const Sheet& s = wb.sheet(0);
+  ASSERT_NE(s.cell_at(5, 3), nullptr);  // SUM moved from row 7 → 5
+  // SUM range was D2:D6 covering rows 1..5; after deleting rows 2..3
+  // the range refs collapse: D2 (row 1, untouched) + D5..D6 (rows 4..5
+  // pre-delete, now rows 2..3) survive; rows 2..3 (qty[1], qty[2]) drop.
+  const double expected_post = qty[0] * 2 + qty[3] * 2 + qty[4] * 2;
+  EXPECT_EQ(s.cell_at(5, 3)->cached_value.as_number(), expected_post)
+      << "post-delete SUM mismatch (range refs should collapse, not stale)";
+}
+
+TEST(WorkbookRowColEdits, RejectsZeroCount) {
+  Workbook wb = Workbook::create();
+  auto r = wb.insert_rows(0, /*row=*/0, /*count=*/0);
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidArgument);
+}
+
+TEST(WorkbookRowColEdits, RejectsOutOfRangeSheetIndex) {
+  Workbook wb = Workbook::create();
+  auto r = wb.delete_cols(99, /*col=*/0, /*count=*/1);
+  ASSERT_FALSE(static_cast<bool>(r));
+  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidArgument);
+}
+
+TEST(WorkbookSheetOps, RowInsertKeepsWrittenParentheses) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 4U, 1U, "=(A1)+1")));
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0U, 0U, 1U)));
+  const Cell* cell = wb.sheet(0).cell_at(5U, 1U);
+  ASSERT_NE(cell, nullptr);
+  EXPECT_EQ(cell->formula_text, "=(A2)+1");
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/integration/sheet_ops_test.cpp b/tests/integration/sheet_ops_test.cpp
deleted file mode 100644
index cbf57263f..000000000
--- a/tests/integration/sheet_ops_test.cpp
+++ /dev/null
@@ -1,2020 +0,0 @@
-//
-// End-to-end tests for the workbook-level structural mutation surface:
-// `Workbook::rename_sheet`, `remove_sheet`, `move_sheet`, and
-// `set_defined_name`. These exercise the public C++ API directly so the
-// validation rules and defined-name rewriter can be observed without
-// going through the C ABI.
-
-#include <cstdint>
-#include <memory>
-#include <string>
-
-#include "cf/cf_types.h"
-#include "defined_name.h"
-#include "eval/function_registry.h"
-#include "eval/recalc_engine.h"
-#include "gtest/gtest.h"
-#include "io/ooxml_writer.h"
-#include "pivot/pivot_cache.h"
-#include "pivot/pivot_table.h"
-#include "sheet.h"
-#include "table.h"
-#include "utils/error.h"
-#include "value.h"
-#include "workbook.h"
-
-namespace formulon {
-namespace {
-
-// Sentinel sheet index well past `sheet_count()` for any test workbook
-// in this file. Used to force the "out-of-range" rejection paths.
-constexpr std::uint32_t kOutOfRangeIndex = 99U;
-
-// Convenience factory: workbook with three sheets, named `Alpha`,
-// `Beta`, `Gamma` (created via `add_sheet` so the default `Sheet1`
-// stays out of the way).
-Workbook ThreeSheetWorkbook() {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Alpha");
-  wb.add_sheet("Beta");
-  wb.add_sheet("Gamma");
-  return wb;
-}
-
-void SetMoveSensitiveMetadata(Sheet& sheet, std::string_view suffix) {
-  sheet.set_drawing_rel_target("xl/drawings/drawing-" + std::string(suffix) + ".xml");
-  sheet.set_auto_filter_xml("<autoFilter ref=\"A1:" + std::string(suffix) + "9\"/>");
-  sheet.set_ext_lst_xml("<extLst><ext uri=\"" + std::string(suffix) + "\"/></extLst>");
-  sheet.set_root_extra_ns_attrs(" xmlns:x" + std::string(suffix) + "=\"urn:" + std::string(suffix) + "\"");
-}
-
-void ExpectMoveSensitiveMetadata(const Sheet& sheet, std::string_view suffix) {
-  EXPECT_EQ(sheet.drawing_rel_target(), "xl/drawings/drawing-" + std::string(suffix) + ".xml");
-  EXPECT_EQ(sheet.auto_filter_xml(), "<autoFilter ref=\"A1:" + std::string(suffix) + "9\"/>");
-  EXPECT_EQ(sheet.ext_lst_xml(), "<extLst><ext uri=\"" + std::string(suffix) + "\"/></extLst>");
-  EXPECT_EQ(sheet.root_extra_ns_attrs(), " xmlns:x" + std::string(suffix) + "=\"urn:" + std::string(suffix) + "\"");
-}
-
-TEST(WorkbookSheetOps, RenameUpdatesSheetName) {
-  Workbook wb = ThreeSheetWorkbook();
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(1, "Charlie")));
-  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
-  EXPECT_EQ(wb.sheet(1).name(), "Charlie");
-  EXPECT_EQ(wb.sheet(2).name(), "Gamma");
-}
-
-TEST(WorkbookSheetOps, RenameRejectsEmptyName) {
-  Workbook wb = ThreeSheetWorkbook();
-  auto r = wb.rename_sheet(0, "");
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
-  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
-}
-
-TEST(WorkbookSheetOps, RenameRejectsTooLong) {
-  Workbook wb = ThreeSheetWorkbook();
-  // 32 chars: one over the limit.
-  std::string long_name(32U, 'a');
-  auto r = wb.rename_sheet(0, long_name);
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
-}
-
-TEST(WorkbookSheetOps, RenameRejectsForbiddenCharacters) {
-  Workbook wb = ThreeSheetWorkbook();
-  for (const char* bad : {"a:b", "a\\b", "a/b", "a?b", "a*b", "a[b", "a]b"}) {
-    auto r = wb.rename_sheet(0, bad);
-    ASSERT_FALSE(static_cast<bool>(r)) << "expected rejection of " << bad;
-    EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
-  }
-  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
-}
-
-TEST(WorkbookSheetOps, RenameRejectsCaseInsensitiveCollision) {
-  Workbook wb = ThreeSheetWorkbook();
-  // `BETA` collides with the existing `Beta`.
-  auto r = wb.rename_sheet(0, "BETA");
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
-}
-
-TEST(WorkbookSheetOps, RenameAcceptsCaseChangeOfOwnName) {
-  Workbook wb = ThreeSheetWorkbook();
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "ALPHA")));
-  EXPECT_EQ(wb.sheet(0).name(), "ALPHA");
-}
-
-TEST(WorkbookSheetOps, RenameRejectsOutOfRange) {
-  Workbook wb = ThreeSheetWorkbook();
-  auto r = wb.rename_sheet(kOutOfRangeIndex, "Anything");
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kSheetIndexOutOfRange);
-}
-
-TEST(WorkbookSheetOps, RenameAccepts31JapaneseCharacters) {
-  Workbook wb = ThreeSheetWorkbook();
-  // 31 copies of "あ" (U+3042, 3 bytes each = 93 bytes) is exactly at the
-  // 31-character limit; a byte-count check would wrongly reject it.
-  std::string name;
-  for (int i = 0; i < 31; ++i) {
-    name += "\xE3\x81\x82";  // "あ"
-  }
-  auto r = wb.rename_sheet(0, name);
-  ASSERT_TRUE(static_cast<bool>(r)) << "31 Japanese characters must be within the limit";
-  EXPECT_EQ(wb.sheet(0).name(), name);
-}
-
-TEST(WorkbookSheetOps, RenameRejects32JapaneseCharacters) {
-  Workbook wb = ThreeSheetWorkbook();
-  std::string name;
-  for (int i = 0; i < 32; ++i) {
-    name += "\xE3\x81\x82";  // "あ"
-  }
-  auto r = wb.rename_sheet(0, name);
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
-  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
-}
-
-TEST(WorkbookSheetOps, RenameCountsEmojiAsTwoUnits) {
-  Workbook wb = ThreeSheetWorkbook();
-  // "😀" (U+1F600) is a supplementary-plane codepoint: two UTF-16 units.
-  // 16 emoji = 32 units, one over the limit.
-  std::string name;
-  for (int i = 0; i < 16; ++i) {
-    name += "\xF0\x9F\x98\x80";  // "😀"
-  }
-  auto r = wb.rename_sheet(0, name);
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
-}
-
-TEST(WorkbookSheetOps, AddSheetValidatedAppendsAndReturnsPointer) {
-  Workbook wb = ThreeSheetWorkbook();
-  auto r = wb.add_sheet_validated("Delta");
-  ASSERT_TRUE(static_cast<bool>(r));
-  ASSERT_NE(r.value(), nullptr);
-  EXPECT_EQ(r.value()->name(), "Delta");
-  EXPECT_EQ(wb.sheet_count(), 4U);
-}
-
-TEST(WorkbookSheetOps, AddSheetValidatedRejectsDuplicateCaseInsensitively) {
-  Workbook wb = ThreeSheetWorkbook();
-  auto r = wb.add_sheet_validated("beta");  // collides with "Beta"
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidSheetName);
-  EXPECT_EQ(wb.sheet_count(), 3U);
-}
-
-TEST(WorkbookSheetOps, AddSheetValidatedRejectsEmptyForbiddenAndTooLong) {
-  Workbook wb = ThreeSheetWorkbook();
-  EXPECT_FALSE(static_cast<bool>(wb.add_sheet_validated("")));
-  EXPECT_FALSE(static_cast<bool>(wb.add_sheet_validated("a/b")));
-  EXPECT_FALSE(static_cast<bool>(wb.add_sheet_validated(std::string(32U, 'a'))));
-  EXPECT_EQ(wb.sheet_count(), 3U);
-}
-
-TEST(WorkbookSheetOps, AddSheetValidatedAccepts31JapaneseCharacters) {
-  Workbook wb = ThreeSheetWorkbook();
-  std::string name;
-  for (int i = 0; i < 31; ++i) {
-    name += "\xE3\x81\x82";  // "あ"
-  }
-  auto r = wb.add_sheet_validated(name);
-  ASSERT_TRUE(static_cast<bool>(r));
-  EXPECT_EQ(wb.sheet_count(), 4U);
-}
-
-TEST(WorkbookSheetOps, UnicodeSimpleFoldRejectsDuplicateAndResolvesLookup) {
-  Workbook wb = Workbook::create_empty();
-  auto added = wb.add_sheet_validated("\xC3\x84");  // Ä
-  ASSERT_TRUE(static_cast<bool>(added));
-  EXPECT_EQ(wb.sheet_index_by_name("\xC3\xA4"), 0U);  // ä
-  EXPECT_EQ(wb.sheet_by_name("\xC3\xA4"), added.value());
-
-  auto duplicate = wb.add_sheet_validated("\xC3\xA4");
-  ASSERT_FALSE(static_cast<bool>(duplicate));
-  EXPECT_EQ(duplicate.error().code, FormulonErrorCode::kInvalidSheetName);
-  EXPECT_EQ(wb.sheet_count(), 1U);
-
-  auto distinct = wb.add_sheet_validated("\xC3\x96");  // Ö
-  ASSERT_TRUE(static_cast<bool>(distinct));
-  auto rename_collision = wb.rename_sheet(1U, "\xC3\xA4");  // ä
-  ASSERT_FALSE(static_cast<bool>(rename_collision));
-  EXPECT_EQ(rename_collision.error().code, FormulonErrorCode::kInvalidSheetName);
-  EXPECT_EQ(wb.sheet(0).name(), "\xC3\x84");  // Ä
-  EXPECT_EQ(wb.sheet(1).name(), "\xC3\x96");  // Ö
-}
-
-TEST(WorkbookSheetOps, UnicodeSimpleFoldSupportsCasingRenameAndDependencies) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Source");
-  auto added = wb.add_sheet_validated("\xC3\x84");  // Ä
-  ASSERT_TRUE(static_cast<bool>(added));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "='\xC3\xA4'!A1")));  // alternate case: ä
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_TRUE(wb.sheet(0).cell_at(0U, 0U)->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0U, 0U)->cached_value.as_number(), 10.0);
-
-  // A casing-only rename preserves the identity used by the dependency edge.
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(1U, "\xC3\xA4")));  // ä
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(25.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_TRUE(wb.sheet(0).cell_at(0U, 0U)->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0U, 0U)->cached_value.as_number(), 25.0);
-}
-
-TEST(WorkbookSheetOps, UnicodeMalformedUtf8IsInvalidSheetName) {
-  Workbook wb = Workbook::create();
-  const std::string malformed("\xC3", 1U);
-  auto added = wb.add_sheet_validated(malformed);
-  ASSERT_FALSE(static_cast<bool>(added));
-  EXPECT_EQ(added.error().code, FormulonErrorCode::kInvalidSheetName);
-  auto renamed = wb.rename_sheet(0U, malformed);
-  ASSERT_FALSE(static_cast<bool>(renamed));
-  EXPECT_EQ(renamed.error().code, FormulonErrorCode::kInvalidSheetName);
-}
-
-TEST(WorkbookSheetOps, SheetMovePreservesRawWorksheetMetadata) {
-  Workbook wb = ThreeSheetWorkbook();
-  SetMoveSensitiveMetadata(wb.sheet(0), "alpha");
-  SetMoveSensitiveMetadata(wb.sheet(1), "beta");
-  SetMoveSensitiveMetadata(wb.sheet(2), "gamma");
-
-  // Appending enough sheets guarantees a vector reallocation. Then erase and
-  // move exercise move assignment and move construction respectively.
-  for (std::uint32_t i = 0; i < 32U; ++i) {
-    wb.add_sheet("Extra" + std::to_string(i));
-  }
-  ExpectMoveSensitiveMetadata(wb.sheet(0), "alpha");
-  ExpectMoveSensitiveMetadata(wb.sheet(1), "beta");
-  ExpectMoveSensitiveMetadata(wb.sheet(2), "gamma");
-
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));
-  ExpectMoveSensitiveMetadata(wb.sheet(0), "alpha");
-  ExpectMoveSensitiveMetadata(wb.sheet(1), "gamma");
-
-  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(1, 0)));
-  ExpectMoveSensitiveMetadata(wb.sheet(0), "gamma");
-  ExpectMoveSensitiveMetadata(wb.sheet(1), "alpha");
-}
-
-TEST(WorkbookSheetOps, RenameUpdatesWorkbookScopedDefinedNames) {
-  Workbook wb = ThreeSheetWorkbook();
-  // Pre-populate two defined names that both mention `Beta`. A sheet-scoped
-  // name remains bound to its local sheet by ordinal, but its formula text
-  // may still explicitly target the renamed sheet and must follow the name.
-  std::vector<DefinedName> names;
-  DefinedName wb_scoped;
-  wb_scoped.name = "TotalArea";
-  wb_scoped.formula = "Beta!$A$1:$A$10";
-  wb_scoped.local_sheet_id = -1;
-  names.push_back(wb_scoped);
-
-  DefinedName sheet_scoped;
-  sheet_scoped.name = "RegionA";
-  sheet_scoped.formula = "Beta!$B$2";
-  sheet_scoped.local_sheet_id = 2;
-  names.push_back(sheet_scoped);
-  wb.set_defined_names(std::move(names));
-
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(1, "Banana")));
-
-  ASSERT_EQ(wb.defined_names().size(), 2U);
-  EXPECT_EQ(wb.defined_names()[0].formula, "Banana!$A$1:$A$10");
-  EXPECT_EQ(wb.defined_names()[1].formula, "Banana!$B$2");
-}
-
-TEST(WorkbookSheetOps, RenameUpdatesQuotedSheetReferences) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("With Space");
-  wb.add_sheet("Other");
-
-  std::vector<DefinedName> names;
-  DefinedName dn;
-  dn.name = "Q";
-  dn.formula = "'With Space'!$A$1";
-  dn.local_sheet_id = -1;
-  names.push_back(dn);
-  wb.set_defined_names(std::move(names));
-
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "Plain")));
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  EXPECT_EQ(wb.defined_names()[0].formula, "Plain!$A$1");
-}
-
-TEST(WorkbookSheetOps, RenameToNameRequiringQuotesAddsQuotes) {
-  // Renaming a bare-identifier sheet to a name with whitespace forces
-  // the formatter to emit the canonical quoted form.
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Beta");
-
-  std::vector<DefinedName> names;
-  DefinedName dn;
-  dn.name = "X";
-  dn.formula = "Beta!$A$1";
-  dn.local_sheet_id = -1;
-  names.push_back(dn);
-  wb.set_defined_names(std::move(names));
-
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "New Beta")));
-  EXPECT_EQ(wb.defined_names()[0].formula, "'New Beta'!$A$1");
-}
-
-TEST(WorkbookSheetOps, RenameAcrossExpressionAndCallArgs) {
-  // The AST-based rewriter must catch references that sit inside
-  // function calls, range endpoints, and arithmetic — not just bare
-  // sheet-prefixed identifiers.
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Beta");
-  wb.add_sheet("Other");
-
-  std::vector<DefinedName> names;
-  DefinedName dn;
-  dn.name = "Total";
-  dn.formula = "SUM(Beta!$A$1:$A$10)+Beta!B2";
-  dn.local_sheet_id = -1;
-  names.push_back(dn);
-  wb.set_defined_names(std::move(names));
-
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "Banana")));
-  // Range endpoints with the same sheet collapse the sheet qualifier on
-  // the right-hand side — Excel's canonical form for `Sheet!A1:A10`.
-  EXPECT_EQ(wb.defined_names()[0].formula, "SUM(Banana!$A$1:$A$10)+Banana!B2");
-}
-
-TEST(WorkbookSheetOps, RenameDoesNotMatchIdentifierSubstrings) {
-  // `OtherSheet1` should not match a rename of `Sheet1`.
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  wb.add_sheet("OtherSheet1");
-
-  std::vector<DefinedName> names;
-  DefinedName dn;
-  dn.name = "X";
-  dn.formula = "OtherSheet1!$A$1";
-  dn.local_sheet_id = -1;
-  names.push_back(dn);
-  wb.set_defined_names(std::move(names));
-
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "First")));
-  EXPECT_EQ(wb.defined_names()[0].formula, "OtherSheet1!$A$1");
-}
-
-// Renaming a sheet must rewrite cell formulas that reference it by name,
-// not just defined names. A dependent that keeps the stale name resolves
-// to #REF!/#NAME? on the next recalc.
-TEST(WorkbookSheetOps, RenameRewritesReferencingCellFormulas) {
-  Workbook wb = ThreeSheetWorkbook();                                                // Alpha(0), Beta(1), Gamma(2)
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, 0, 0, Value::number(100.0))));  // Gamma!A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=Gamma!A1")));         // Alpha!A1
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 100.0);
-
-  // Rename Gamma -> Delta. The Alpha!A1 formula text must follow.
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(2, "Delta")));
-  ASSERT_NE(wb.sheet(0).cell_at(0, 0), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->formula_text, "=Delta!A1");
-
-  // And it still resolves after recalc (not #REF!/#NAME?).
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  const Value a1 = wb.sheet(0).cell_at(0, 0)->cached_value;
-  ASSERT_TRUE(a1.is_number()) << "renamed cross-sheet ref failed to resolve";
-  EXPECT_EQ(a1.as_number(), 100.0);
-}
-
-TEST(WorkbookSheetOps, RenameRewritesSheetNamedMetadata) {
-  Workbook wb = ThreeSheetWorkbook();  // Alpha(0), Beta(1), Gamma(2)
-  DefinedName local_name;
-  local_name.name = "LocalRef";
-  local_name.local_sheet_id = 0;
-  local_name.formula = "Gamma!$A$1";
-  wb.set_defined_names({local_name});
-
-  Hyperlink link;
-  link.row = 0;
-  link.col = 0;
-  link.location = "#Gamma!A1";
-  wb.sheet(0).mutable_hyperlinks().push_back(link);
-  DataValidation validation;
-  validation.ranges.push_back(MergeRange{0, 1, 0, 1});
-  validation.formula1 = "Gamma!$A$1";
-  validation.formula2 = "Gamma!$B$1";
-  wb.sheet(0).mutable_validations().push_back(validation);
-
-  cf::ConditionalFormat conditional_format;
-  cf::CFRule rule;
-  rule.formula1 = "Gamma!C1";
-  rule.formula2 = "Gamma!D1";
-  rule.color_scale = cf::ColorScaleSpec{};
-  rule.color_scale->thresholds.push_back({cf::CfvoType::Formula, "Gamma!E1", true});
-  rule.icon_set = cf::IconSetSpec{};
-  rule.icon_set->thresholds.push_back({cf::CfvoType::Formula, "Gamma!F1", true});
-  rule.data_bar = cf::DataBarSpec{};
-  rule.data_bar->min = {cf::CfvoType::Formula, "Gamma!G1", true};
-  rule.data_bar->max = {cf::CfvoType::Formula, "Gamma!H1", true};
-  conditional_format.rules.push_back(std::move(rule));
-  wb.sheet(0).mutable_conditional_formats().push_back(std::move(conditional_format));
-
-  TableMetadata table;
-  table.id = 1;
-  table.name = "Table1";
-  table.display_name = "Table1";
-  table.ref = "A1:B2";
-  table.sheet_index = 0;
-  table.columns.push_back(TableColumn{1, "Value", {}, {}, "Gamma!$A$1"});
-  wb.set_tables({std::move(table)});
-
-  auto cache = std::make_unique<pivot::PivotCache>();
-  cache->set_cache_id(7U);
-  cache->mutable_worksheet_source() = {true, "Gamma!$A$1:$B$2", "gAmMa", ""};
-  wb.add_pivot_cache(std::move(cache));
-
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(2, "Delta")));
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  EXPECT_EQ(wb.defined_names()[0].formula, "Delta!$A$1");
-  ASSERT_EQ(wb.sheet(0).hyperlinks().size(), 1U);
-  EXPECT_EQ(wb.sheet(0).hyperlinks()[0].location, "#Delta!A1");
-  ASSERT_EQ(wb.sheet(0).validations().size(), 1U);
-  EXPECT_EQ(wb.sheet(0).validations()[0].formula1, "Delta!$A$1");
-  EXPECT_EQ(wb.sheet(0).validations()[0].formula2, "Delta!$B$1");
-  ASSERT_EQ(wb.sheet(0).conditional_formats().size(), 1U);
-  ASSERT_EQ(wb.sheet(0).conditional_formats()[0].rules.size(), 1U);
-  const cf::CFRule& rewritten_rule = wb.sheet(0).conditional_formats()[0].rules[0];
-  ASSERT_TRUE(rewritten_rule.formula1.has_value());
-  ASSERT_TRUE(rewritten_rule.formula2.has_value());
-  EXPECT_EQ(*rewritten_rule.formula1, "Delta!C1");
-  EXPECT_EQ(*rewritten_rule.formula2, "Delta!D1");
-  ASSERT_TRUE(rewritten_rule.color_scale.has_value());
-  EXPECT_EQ(rewritten_rule.color_scale->thresholds[0].value, "Delta!E1");
-  ASSERT_TRUE(rewritten_rule.icon_set.has_value());
-  EXPECT_EQ(rewritten_rule.icon_set->thresholds[0].value, "Delta!F1");
-  ASSERT_TRUE(rewritten_rule.data_bar.has_value());
-  EXPECT_EQ(rewritten_rule.data_bar->min.value, "Delta!G1");
-  EXPECT_EQ(rewritten_rule.data_bar->max.value, "Delta!H1");
-  ASSERT_EQ(wb.tables().size(), 1U);
-  EXPECT_EQ(wb.tables()[0].columns[0].calculated_column_formula, "Delta!$A$1");
-  ASSERT_EQ(wb.pivot_caches().size(), 1U);
-  EXPECT_EQ(wb.pivot_caches()[0]->worksheet_source().sheet, "Delta");
-  EXPECT_EQ(wb.pivot_caches()[0]->worksheet_source().ref, "Delta!$A$1:$B$2");
-}
-
-TEST(WorkbookSheetOps, RemoveDropsSheet) {
-  Workbook wb = ThreeSheetWorkbook();
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));
-  ASSERT_EQ(wb.sheet_count(), 2U);
-  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
-  EXPECT_EQ(wb.sheet(1).name(), "Gamma");
-}
-
-TEST(WorkbookSheetOps, RemoveDropsPivotCacheWhoseWorksheetSourceWasRemoved) {
-  Workbook wb = ThreeSheetWorkbook();
-  auto removed_source_cache = std::make_unique<pivot::PivotCache>();
-  removed_source_cache->set_cache_id(1U);
-  removed_source_cache->mutable_worksheet_source() = {true, "$A$1:$B$10", "Beta", ""};
-  wb.add_pivot_cache(std::move(removed_source_cache));
-
-  auto surviving_source_cache = std::make_unique<pivot::PivotCache>();
-  surviving_source_cache->set_cache_id(2U);
-  surviving_source_cache->mutable_worksheet_source() = {true, "$A$1:$B$10", "Gamma", ""};
-  wb.add_pivot_cache(std::move(surviving_source_cache));
-
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1U)));  // Beta
-  ASSERT_EQ(wb.pivot_caches().size(), 1U);
-  ASSERT_NE(wb.pivot_caches()[0], nullptr);
-  EXPECT_EQ(wb.pivot_caches()[0]->cache_id(), 2U);
-  EXPECT_EQ(wb.pivot_caches()[0]->worksheet_source().sheet, "Gamma");
-}
-
-TEST(WorkbookSheetOps, SheetOperationsKeepTablesAttachedToTheirOwningSheet) {
-  Workbook wb = ThreeSheetWorkbook();
-  TableMetadata table;
-  table.id = 1;
-  table.name = "Table1";
-  table.display_name = "Table1";
-  table.sheet_index = 2;  // Gamma
-  table.ref = "A1:B2";
-  wb.set_tables({table});
-
-  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(2, 0)));
-  ASSERT_EQ(wb.tables().size(), 1U);
-  EXPECT_EQ(wb.sheet(wb.tables()[0].sheet_index).name(), "Gamma");
-
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));  // remove Alpha
-  ASSERT_EQ(wb.tables().size(), 1U);
-  EXPECT_EQ(wb.sheet(wb.tables()[0].sheet_index).name(), "Gamma");
-
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));  // remove Gamma
-  EXPECT_TRUE(wb.tables().empty());
-}
-
-TEST(WorkbookSheetOps, WriterRejectsTableDetachedFromAllSheets) {
-  Workbook wb = Workbook::create();
-  TableMetadata table;
-  table.id = 1;
-  table.name = "Detached";
-  table.display_name = "Detached";
-  table.sheet_index = 1;
-  table.ref = "A1:A2";
-  wb.set_tables({table});
-  auto written = io::write_ooxml(wb);
-  ASSERT_FALSE(static_cast<bool>(written));
-  EXPECT_EQ(written.error().code, FormulonErrorCode::kIoWriteFailed);
-}
-
-TEST(WorkbookSheetOps, RemoveFreezesReferencingFormulaBeforeSameNameIsReadded) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Source");
-  wb.add_sheet("Dependent");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(42))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 0, "=Source!A1")));
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));
-  ASSERT_EQ(wb.sheet(0).name(), "Dependent");
-  ASSERT_NE(wb.sheet(0).cell_at(0, 0), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->formula_text, "=#REF!");
-
-  wb.add_sheet("Source");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(99))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  const Value value = wb.sheet(0).cell_at(0, 0)->cached_value;
-  ASSERT_TRUE(value.is_error());
-  EXPECT_EQ(value.as_error(), ErrorCode::Ref);
-}
-
-TEST(WorkbookSheetOps, AppendReportsTheIndexOfTheSheetItAppended) {
-  Workbook wb = Workbook::create_empty();
-  EXPECT_EQ(wb.add_sheet("First"), 0U);
-  EXPECT_EQ(wb.add_sheet("Second"), 1U);
-
-  auto checked = wb.add_sheet_checked("Third");
-  ASSERT_TRUE(static_cast<bool>(checked));
-  EXPECT_EQ(checked.value(), 2U);
-
-  ASSERT_EQ(wb.sheet_count(), 3U);
-  EXPECT_EQ(wb.sheet(0).name(), "First");
-  EXPECT_EQ(wb.sheet(1).name(), "Second");
-  EXPECT_EQ(wb.sheet(2).name(), "Third");
-}
-
-// The append path reports a position, not a reference into `sheets_`. A
-// reference taken before a later append would dangle once the vector
-// reallocated, and re-reading through the index after every append is what
-// makes the ordering below safe rather than accidentally correct.
-TEST(WorkbookSheetOps, AppendedSheetStaysReachableAcrossLaterAppends) {
-  Workbook wb = Workbook::create_empty();
-  const std::size_t first = wb.add_sheet("First");
-  // Enough appends to force the underlying vector to reallocate at least
-  // once past whatever capacity the first append reserved.
-  for (int i = 0; i < 64; ++i) {
-    wb.add_sheet("Filler" + std::to_string(i));
-  }
-  wb.sheet(first).set_cell_value(0U, 0U, Value::number(7.0));
-
-  EXPECT_EQ(wb.sheet(first).name(), "First");
-  const Cell* cell = wb.sheet(first).cell_at(0U, 0U);
-  ASSERT_NE(cell, nullptr);
-  EXPECT_EQ(cell->cached_value.as_number(), 7.0);
-}
-
-// A `CellNodeId` names its sheet with a 16-bit id, so the workbook stops
-// accepting sheets at `kMaxSheets`. The ceiling is only observable with the
-// sheets actually present — every append path shares one headroom check,
-// and there is no seam that reports the rejection without the vector being
-// full — so the workbook is filled to the boundary here.
-TEST(WorkbookSheetOps, AppendStopsAtTheSheetIdCeiling) {
-  Workbook wb = Workbook::create_empty();
-  std::string name;
-  for (std::size_t i = 0; i < Workbook::kMaxSheets; ++i) {
-    name.assign("S");
-    name.append(std::to_string(i));
-    ASSERT_TRUE(static_cast<bool>(wb.add_sheet_checked(name))) << "rejected at sheet " << i;
-  }
-  ASSERT_EQ(wb.sheet_count(), Workbook::kMaxSheets);
-
-  auto checked = wb.add_sheet_checked("Overflow");
-  ASSERT_FALSE(static_cast<bool>(checked));
-  EXPECT_EQ(checked.error().code, FormulonErrorCode::kSheetCountLimitExceeded);
-
-  auto validated = wb.add_sheet_validated("Overflow");
-  ASSERT_FALSE(static_cast<bool>(validated));
-  EXPECT_EQ(validated.error().code, FormulonErrorCode::kSheetCountLimitExceeded);
-
-  // The name-unchecked overload has no error channel, but it must not grow
-  // the workbook past the ceiling either, and the index it reports back must
-  // not name a sheet the caller could then mutate by mistake.
-  EXPECT_EQ(wb.add_sheet("Overflow"), Workbook::kMaxSheets);
-  EXPECT_EQ(wb.sheet_count(), Workbook::kMaxSheets);
-  EXPECT_EQ(wb.sheet(Workbook::kMaxSheets - 1U).name(), "S" + std::to_string(Workbook::kMaxSheets - 1U));
-}
-
-TEST(WorkbookSheetOps, RemoveRejectsLastSheet) {
-  Workbook wb = Workbook::create();  // single Sheet1
-  auto r = wb.remove_sheet(0);
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kCannotRemoveLastSheet);
-  EXPECT_EQ(wb.sheet_count(), 1U);
-}
-
-TEST(WorkbookSheetOps, RemoveRejectsOutOfRange) {
-  Workbook wb = ThreeSheetWorkbook();
-  auto r = wb.remove_sheet(kOutOfRangeIndex);
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kSheetIndexOutOfRange);
-}
-
-TEST(WorkbookSheetOps, RemoveFreezesWorkbookScopedNamesTargetingRemovedSheet) {
-  Workbook wb = ThreeSheetWorkbook();
-  std::vector<DefinedName> names;
-  DefinedName keep;
-  keep.name = "Keeper";
-  keep.formula = "Alpha!$A$1";
-  keep.local_sheet_id = -1;
-  names.push_back(keep);
-
-  DefinedName frozen;
-  frozen.name = "Goner";
-  frozen.formula = "Beta!$A$1";
-  frozen.local_sheet_id = -1;
-  names.push_back(frozen);
-  wb.set_defined_names(std::move(names));
-
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));
-
-  ASSERT_EQ(wb.defined_names().size(), 2U);
-  EXPECT_EQ(wb.defined_names()[0].name, "Keeper");
-  EXPECT_EQ(wb.defined_names()[1].name, "Goner");
-  EXPECT_EQ(wb.defined_names()[1].formula, "#REF!");
-}
-
-TEST(WorkbookSheetOps, RemoveAdjustsSheetScopedLocalIds) {
-  Workbook wb = ThreeSheetWorkbook();
-  std::vector<DefinedName> names;
-  DefinedName scoped_alpha;
-  scoped_alpha.name = "A";
-  scoped_alpha.formula = "$A$1";
-  scoped_alpha.local_sheet_id = 0;
-  names.push_back(scoped_alpha);
-
-  DefinedName scoped_gamma;
-  scoped_gamma.name = "G";
-  scoped_gamma.formula = "$A$1";
-  scoped_gamma.local_sheet_id = 2;
-  names.push_back(scoped_gamma);
-  wb.set_defined_names(std::move(names));
-
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));  // remove Beta
-
-  ASSERT_EQ(wb.defined_names().size(), 2U);
-  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, 0);  // Alpha still at 0
-  EXPECT_EQ(wb.defined_names()[1].local_sheet_id, 1);  // Gamma shifted down
-}
-
-TEST(WorkbookSheetOps, MoveForwardRearrangesSheets) {
-  Workbook wb = ThreeSheetWorkbook();
-  // Move Alpha (0) to position 2 (the end). Excel UI semantics:
-  // `to_index == 2`, not `3`.
-  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0, 2)));
-  EXPECT_EQ(wb.sheet(0).name(), "Beta");
-  EXPECT_EQ(wb.sheet(1).name(), "Gamma");
-  EXPECT_EQ(wb.sheet(2).name(), "Alpha");
-}
-
-TEST(WorkbookSheetOps, MoveBackwardRearrangesSheets) {
-  Workbook wb = ThreeSheetWorkbook();
-  // Move Gamma (2) to position 0.
-  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(2, 0)));
-  EXPECT_EQ(wb.sheet(0).name(), "Gamma");
-  EXPECT_EQ(wb.sheet(1).name(), "Alpha");
-  EXPECT_EQ(wb.sheet(2).name(), "Beta");
-}
-
-TEST(WorkbookSheetOps, MoveNoOpAcceptsSamePosition) {
-  Workbook wb = ThreeSheetWorkbook();
-  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(1, 1)));
-  EXPECT_EQ(wb.sheet(0).name(), "Alpha");
-  EXPECT_EQ(wb.sheet(1).name(), "Beta");
-  EXPECT_EQ(wb.sheet(2).name(), "Gamma");
-}
-
-TEST(WorkbookSheetOps, MoveRejectsOutOfRange) {
-  Workbook wb = ThreeSheetWorkbook();
-  auto r1 = wb.move_sheet(kOutOfRangeIndex, 0);
-  ASSERT_FALSE(static_cast<bool>(r1));
-  EXPECT_EQ(r1.error().code, FormulonErrorCode::kSheetIndexOutOfRange);
-
-  auto r2 = wb.move_sheet(0, kOutOfRangeIndex);
-  ASSERT_FALSE(static_cast<bool>(r2));
-  EXPECT_EQ(r2.error().code, FormulonErrorCode::kSheetIndexOutOfRange);
-}
-
-TEST(WorkbookSheetOps, MoveAdjustsSheetScopedLocalIds) {
-  Workbook wb = ThreeSheetWorkbook();
-  std::vector<DefinedName> names;
-  DefinedName name_alpha;
-  name_alpha.name = "A";
-  name_alpha.formula = "$A$1";
-  name_alpha.local_sheet_id = 0;
-  DefinedName name_beta;
-  name_beta.name = "B";
-  name_beta.formula = "$A$1";
-  name_beta.local_sheet_id = 1;
-  DefinedName name_gamma;
-  name_gamma.name = "C";
-  name_gamma.formula = "$A$1";
-  name_gamma.local_sheet_id = 2;
-  names.push_back(name_alpha);
-  names.push_back(name_beta);
-  names.push_back(name_gamma);
-  wb.set_defined_names(std::move(names));
-
-  // Move sheet 0 (Alpha) to position 2: post-removal layout is
-  // [Beta, Gamma, Alpha]. Alpha was scope 0 -> now 2; Beta was 1 -> 0;
-  // Gamma was 2 -> 1.
-  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0, 2)));
-  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, 2);  // A (Alpha)
-  EXPECT_EQ(wb.defined_names()[1].local_sheet_id, 0);  // B (Beta)
-  EXPECT_EQ(wb.defined_names()[2].local_sheet_id, 1);  // C (Gamma)
-}
-
-// Removing a middle sheet renumbers every later sheet's workbook-relative
-// index. The dependency graph is keyed by that index, so a cross-sheet
-// formula's edge must be re-pointed at the survivor's new position;
-// otherwise a later edit to the survivor never dirties the dependent and
-// the stale cached value persists.
-TEST(WorkbookSheetOps, RemoveMiddleSheetRepointsCrossSheetDependencies) {
-  Workbook wb = ThreeSheetWorkbook();                                                // Alpha(0), Beta(1), Gamma(2)
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, 0, 0, Value::number(100.0))));  // Gamma!A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=Gamma!A1")));         // Alpha!A1
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 100.0);
-
-  // Remove Beta (index 1); Gamma slides to index 1.
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(1)));
-  EXPECT_EQ(wb.sheet(1).name(), "Gamma");
-  // Recalc after the structural change re-reads Gamma at its new index.
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 100.0);
-
-  // Edit Gamma (now index 1); the dependent Alpha!A1 must re-evaluate.
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(300.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 300.0)
-      << "cross-sheet dependent stale after removing a preceding sheet";
-}
-
-// Moving a sheet renumbers the whole [min..max] window. A cross-sheet
-// dependency edge that spans the window must survive the renumbering so
-// downstream edits still propagate.
-TEST(WorkbookSheetOps, MoveSheetRepointsCrossSheetDependencies) {
-  Workbook wb = ThreeSheetWorkbook();                                               // Alpha(0), Beta(1), Gamma(2)
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, 0, 0, Value::number(10.0))));  // Gamma!A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=Gamma!A1")));        // Alpha!A1
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 10.0);
-
-  // Move Alpha (0) to the end: layout becomes [Beta, Gamma, Alpha].
-  ASSERT_TRUE(static_cast<bool>(wb.move_sheet(0, 2)));
-  EXPECT_EQ(wb.sheet(1).name(), "Gamma");
-  EXPECT_EQ(wb.sheet(2).name(), "Alpha");
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 10.0);
-
-  // Edit Gamma (now index 1); Alpha (now index 2) must re-evaluate.
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(42.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 42.0)
-      << "cross-sheet dependent stale after moving a sheet";
-}
-
-TEST(WorkbookSheetOps, InsertRowsRekeysAllDependenciesBeforeRegisteringNewCoordinates) {
-  Workbook wb = Workbook::create();
-  constexpr std::uint32_t kRows = 60U;
-  for (std::uint32_t row = 0; row < kRows; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, row, 0U, Value::number(static_cast<double>(row)))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, row, 1U, "=A" + std::to_string(row + 1U))));
-  }
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0U, 0U, 1U)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(999.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-
-  for (std::uint32_t row = 0; row < kRows; ++row) {
-    const Cell* dependent = wb.sheet(0).cell_at(row + 1U, 1U);
-    ASSERT_NE(dependent, nullptr) << "missing formula at row " << row + 2U;
-    ASSERT_TRUE(dependent->cached_value.is_number());
-    const double expected = (row == 0U) ? 999.0 : static_cast<double>(row);
-    EXPECT_DOUBLE_EQ(dependent->cached_value.as_number(), expected) << "stale dependent at row " << row + 2U;
-  }
-}
-
-TEST(WorkbookSheetOps, ConsecutiveRowInsertsKeepShiftedDependenciesLive) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(2.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 2, 1, "=SUM(A1:A2)")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(2, 1)->cached_value.as_number(), 3.0);
-
-  // Inserting inside the range expands it; the original second input moves
-  // to A3 and the dependent moves to B4.
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 1, 1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(5.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_NE(wb.sheet(0).cell_at(3, 1), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(3, 1)->formula_text, "=SUM(A1:A3)");
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(3, 1)->cached_value.as_number(), 8.0);
-
-  // A second insert must re-key the already-shifted dependency. Updating
-  // the moved original A1 (now A2) must still invalidate the formula B5.
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 0, 1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_NE(wb.sheet(0).cell_at(4, 1), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(4, 1)->formula_text, "=SUM(A2:A4)");
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(4, 1)->cached_value.as_number(), 17.0);
-}
-
-TEST(WorkbookSheetOps, SetDefinedNameAddsEntry) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Pi", "=3.14159")));
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  EXPECT_EQ(wb.defined_names()[0].name, "Pi");
-  EXPECT_EQ(wb.defined_names()[0].formula, "=3.14159");
-  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, -1);
-}
-
-TEST(WorkbookSheetOps, SetDefinedNameUpdatesExisting) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Pi", "=3.14")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("PI", "=3.14159")));
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  // Authored casing of the original entry is preserved.
-  EXPECT_EQ(wb.defined_names()[0].name, "Pi");
-  EXPECT_EQ(wb.defined_names()[0].formula, "=3.14159");
-}
-
-TEST(WorkbookSheetOps, SetDefinedNameEmptyFormulaRemovesEntry) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Pi", "=3.14")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Pi", "")));
-  EXPECT_TRUE(wb.defined_names().empty());
-}
-
-TEST(WorkbookSheetOps, SetDefinedNameEmptyFormulaOnMissingNameIsNoOp) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Missing", "")));
-  EXPECT_TRUE(wb.defined_names().empty());
-}
-
-TEST(WorkbookSheetOps, SetDefinedNameRejectsEmptyName) {
-  Workbook wb = Workbook::create();
-  auto r = wb.set_defined_name("", "=1");
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidArgument);
-}
-
-// ---------------------------------------------------------------------------
-// Row / column insert and delete
-// ---------------------------------------------------------------------------
-
-TEST(WorkbookRowColEdits, InsertRowsShiftsCellsAndFormulas) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 5, 0, Value::number(20.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 6, 0, "=A1+A6")));
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/3, /*count=*/2)));
-
-  // Cells at row 0 stayed put; cell at row 5 moved to row 7; the formula
-  // cell at row 6 moved to row 8 and its A6 ref shifted to A8.
-  const Sheet& s = wb.sheet(0);
-  ASSERT_NE(s.cell_at(0, 0), nullptr);
-  EXPECT_EQ(s.cell_at(0, 0)->cached_value.as_number(), 10.0);
-  EXPECT_EQ(s.cell_at(5, 0), nullptr);
-  ASSERT_NE(s.cell_at(7, 0), nullptr);
-  EXPECT_EQ(s.cell_at(7, 0)->cached_value.as_number(), 20.0);
-  ASSERT_NE(s.cell_at(8, 0), nullptr);
-  EXPECT_EQ(s.cell_at(8, 0)->formula_text, "=A1+A8");
-}
-
-TEST(WorkbookRowColEdits, InsertRowsShiftsConditionalFormatsLayoutAndBreaks) {
-  Workbook wb = Workbook::create();
-  Sheet& sheet = wb.sheet(0);
-  cf::ConditionalFormat format;
-  format.sqref.push_back(cf::CFCellRange{CellAddress{1, 0}, CellAddress{2, 1}});
-  cf::CFRule rule;
-  rule.formula1 = "A2";
-  format.rules.push_back(std::move(rule));
-  sheet.mutable_conditional_formats().push_back(std::move(format));
-  sheet.mutable_layout().row_overrides.push_back(RowLayout{2, 24.0, true, 1, true});
-  sheet.mutable_layout().columns.push_back(ColumnLayout{1, 2, 18.0, true, 2});
-  sheet.mutable_print_settings().manual_row_breaks.push_back(ManualBreak{3, 0, 10, true});
-  sheet.mutable_print_settings().manual_col_breaks.push_back(ManualBreak{2, 0, 10, true});
-  TableMetadata table;
-  table.id = 1;
-  table.name = "Table1";
-  table.display_name = "Table1";
-  table.sheet_index = 0;
-  table.ref = "A2:B3";
-  table.columns.push_back(TableColumn{1, "Value", {}, {}, "A2"});
-  wb.set_tables({table});
-  auto pivot = std::make_unique<pivot::PivotTable>();
-  pivot->set_anchor(2, 1, 3, 2);
-  sheet.add_pivot_table(std::move(pivot));
-  ASSERT_TRUE(sheet.commit_spill(4, 4, 2, 1, std::vector<Value>{Value::number(1), Value::number(2)}));
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 1, 1)));
-  const cf::CFCellRange row_shifted = sheet.conditional_formats()[0].sqref[0];
-  EXPECT_EQ(row_shifted.first.row, 2U);
-  EXPECT_EQ(row_shifted.last.row, 3U);
-  ASSERT_TRUE(sheet.conditional_formats()[0].rules[0].formula1.has_value());
-  EXPECT_EQ(*sheet.conditional_formats()[0].rules[0].formula1, "A3");
-  EXPECT_EQ(sheet.layout().row_overrides[0].row, 3U);
-  EXPECT_EQ(sheet.print_settings().manual_row_breaks[0].id, 4U);
-  ASSERT_EQ(sheet.pivot_tables().size(), 1U);
-  EXPECT_EQ(sheet.pivot_tables()[0]->anchor_row(), 3U);
-  EXPECT_EQ(sheet.spill_region_at_anchor(5, 4), nullptr);
-  ASSERT_EQ(wb.tables().size(), 1U);
-  EXPECT_EQ(wb.tables()[0].ref, "A3:B4");
-  EXPECT_EQ(wb.tables()[0].columns[0].calculated_column_formula, "A3");
-  // Column-bound metadata is not touched by a row edit.
-  EXPECT_EQ(sheet.layout().columns[0].first, 1U);
-  EXPECT_EQ(sheet.print_settings().manual_col_breaks[0].id, 2U);
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, 0, 1)));
-  const cf::CFCellRange col_shifted = sheet.conditional_formats()[0].sqref[0];
-  EXPECT_EQ(col_shifted.first.col, 1U);
-  EXPECT_EQ(col_shifted.last.col, 2U);
-  EXPECT_EQ(sheet.layout().columns[0].first, 2U);
-  EXPECT_EQ(sheet.layout().columns[0].last, 3U);
-  EXPECT_EQ(sheet.print_settings().manual_col_breaks[0].id, 3U);
-  EXPECT_EQ(sheet.pivot_tables()[0]->anchor_col(), 2U);
-  EXPECT_EQ(wb.tables()[0].ref, "B3:C4");
-}
-
-TEST(WorkbookRowColEdits, DeleteRowsRemovesConditionalFormatWhoseRangeIsDeleted) {
-  Workbook wb = Workbook::create();
-  cf::ConditionalFormat format;
-  format.sqref.push_back(cf::CFCellRange{CellAddress{1, 0}, CellAddress{2, 1}});
-  cf::CFRule rule;
-  rule.formula1 = "A2";
-  format.rules.push_back(std::move(rule));
-  wb.sheet(0).mutable_conditional_formats().push_back(std::move(format));
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, 1, 2)));
-  EXPECT_TRUE(wb.sheet(0).conditional_formats().empty());
-}
-
-TEST(WorkbookRowColEdits, DeleteRowsCollapsesReferencesInsideInterval) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 0, "=A5")));     // A5 lives inside the deletion.
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 1, "=A8+A2")));  // A8 trails the deletion; A2 is below.
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/3, /*count=*/3)));
-
-  const Sheet& s = wb.sheet(0);
-  // A5 falls inside [3, 6); collapses to #REF!.
-  EXPECT_EQ(s.cell_at(0, 0)->formula_text, "=#REF!");
-  // A8 -> A5 (shifted up by 3); A2 unchanged.
-  EXPECT_EQ(s.cell_at(0, 1)->formula_text, "=A5+A2");
-}
-
-TEST(WorkbookRowColEdits, DeleteRowsShrinksRangeAtFirstLastAndMiddle) {
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A1:A3)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(A1:A2)");
-  }
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A1:A3)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/2, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(A1:A2)");
-  }
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A1:A5)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/2, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(A1:A4)");
-  }
-}
-
-TEST(WorkbookRowColEdits, DeleteRowsCollapsesSingletonAndShrinksWholeRowRange) {
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A2:A2)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/1, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(#REF!)");
-  }
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(1:4)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/1, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(9, 0), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(9, 0)->formula_text, "=SUM(1:3)");
-  }
-}
-
-TEST(WorkbookRowColEdits, DeleteRowsCollapsesFullyDeletedMultiCellRange) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 10, 0, "=SUM(A2:A4)")));
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/1, /*count=*/3)));
-  ASSERT_NE(wb.sheet(0).cell_at(7, 0), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(7, 0)->formula_text, "=SUM(#REF!)");
-}
-
-TEST(WorkbookRowColEdits, DeleteRowsShrunkRangeRecalculatesAfterSurvivorChange) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(20.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, 0, Value::number(30.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 3, 0, Value::number(40.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 6, 3, "=SUM(A1:A4)")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_EQ(wb.sheet(0).cell_at(6, 3)->cached_value.as_number(), 100.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_NE(wb.sheet(0).cell_at(5, 3), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(5, 3)->formula_text, "=SUM(A1:A3)");
-  EXPECT_EQ(wb.sheet(0).cell_at(5, 3)->cached_value.as_number(), 90.0);
-
-  // The surviving dependency at A2 must still point at the moved formula;
-  // changing it and recalculating proves the structural edit rebuilt the
-  // dependency graph rather than merely changing formula text.
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(50.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).cell_at(5, 3)->cached_value.as_number(), 110.0);
-}
-
-TEST(WorkbookRowColEdits, RowDeletesPreserveThreeDReferenceCoordinates) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "First")));
-  wb.add_sheet("Second");
-  wb.add_sheet("Summary");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:A3)")));
-
-  // Excel 365 16.111.3 keeps the shared 3-D coordinate tail unchanged when
-  // a sheet inside the span is edited.
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-  ASSERT_NE(wb.sheet(2).cell_at(9, 0), nullptr);
-  EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->formula_text, "=SUM(First:Second!A1:A3)");
-
-  // Editing the formula owner moves the formula cell, but still does not
-  // rewrite the 3-D tail.
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(2, /*row=*/0, /*count=*/1)));
-  ASSERT_NE(wb.sheet(2).cell_at(8, 0), nullptr);
-  EXPECT_EQ(wb.sheet(2).cell_at(8, 0)->formula_text, "=SUM(First:Second!A1:A3)");
-}
-
-TEST(WorkbookRowColEdits, ThreeDRowEditsDirtySpanMembersOnly) {
-  auto make_workbook = [] {
-    Workbook wb = Workbook::create_empty();
-    wb.add_sheet("First");
-    wb.add_sheet("Second");
-    wb.add_sheet("Summary");
-    wb.add_sheet("Outside");
-    for (std::uint32_t row = 0; row < 4U; ++row) {
-      EXPECT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
-    }
-    for (std::uint32_t row = 0; row < 3U; ++row) {
-      EXPECT_TRUE(
-          static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
-    }
-    EXPECT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:A3)")));
-    EXPECT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
-    return wb;
-  };
-
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-    auto stats = wb.recalc(eval::default_registry());
-    ASSERT_TRUE(static_cast<bool>(stats));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->formula_text, "=SUM(First:Second!A1:A3)");
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
-    EXPECT_EQ(stats.value().cells_evaluated, 1U);
-  }
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(1, /*row=*/0, /*count=*/1)));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 56.0);
-  }
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/0, /*count=*/1)));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 63.0);
-  }
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.insert_rows(1, /*row=*/0, /*count=*/1)));
-    auto stats = wb.recalc(eval::default_registry());
-    ASSERT_TRUE(static_cast<bool>(stats));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 36.0);
-    EXPECT_EQ(stats.value().cells_evaluated, 1U);
-  }
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.insert_rows(3, /*row=*/0, /*count=*/1)));
-    auto stats = wb.recalc(eval::default_registry());
-    ASSERT_TRUE(static_cast<bool>(stats));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
-    EXPECT_EQ(stats.value().cells_evaluated, 0U);
-  }
-}
-
-TEST(WorkbookRowColEdits, ThreeDDefinedNamesAndNamedLambdasRecalculateAfterRowEdit) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("First");
-  wb.add_sheet("Second");
-  wb.add_sheet("Summary");
-  wb.set_defined_names({
-      DefinedName{"Inner", "SUM(First:Second!A1:A3)", -1, false, ""},
-      DefinedName{"Outer", "Inner+0", -1, false, ""},
-      DefinedName{"F", "LAMBDA(x,Outer+x)", -1, false, ""},
-  });
-  for (std::uint32_t row = 0; row < 4U; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
-  }
-  for (std::uint32_t row = 0; row < 3U; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
-  }
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=Outer")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 10, 0, "=F(2)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 11, 0, "=A10+A11")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_TRUE(wb.sheet(2).cell_at(9, 0)->cached_value.is_number())
-      << wb.sheet(2).cell_at(9, 0)->cached_value.debug_to_string();
-  ASSERT_TRUE(wb.sheet(2).cell_at(10, 0)->cached_value.is_number())
-      << wb.sheet(2).cell_at(10, 0)->cached_value.debug_to_string();
-  ASSERT_TRUE(wb.sheet(2).cell_at(11, 0)->cached_value.is_number())
-      << wb.sheet(2).cell_at(11, 0)->cached_value.debug_to_string();
-  EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
-  EXPECT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 68.0);
-  EXPECT_EQ(wb.sheet(2).cell_at(11, 0)->cached_value.as_number(), 134.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-  auto stats = wb.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(stats));
-  EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
-  EXPECT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 71.0);
-  EXPECT_EQ(wb.sheet(2).cell_at(11, 0)->cached_value.as_number(), 140.0);
-  EXPECT_EQ(stats.value().cells_evaluated, 3U);
-}
-
-TEST(WorkbookRowColEdits, ThreeDReverseSpanWakesMiddleMemberOnly) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("First");
-  wb.add_sheet("Middle");
-  wb.add_sheet("Last");
-  wb.add_sheet("Summary");
-  wb.add_sheet("Outside");
-  for (std::uint32_t row = 0; row < 4U; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
-  }
-  for (std::uint32_t row = 0; row < 3U; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 100U)))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
-  }
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(3, 9, 0, "=SUM(Last:First!A1:A3)")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_EQ(wb.sheet(3).cell_at(9, 0)->cached_value.as_number(), 666.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(1, /*row=*/0, /*count=*/1)));
-  auto stats = wb.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(stats));
-  EXPECT_EQ(wb.sheet(3).cell_at(9, 0)->formula_text, "=SUM(Last:First!A1:A3)");
-  EXPECT_EQ(wb.sheet(3).cell_at(9, 0)->cached_value.as_number(), 566.0);
-  EXPECT_EQ(stats.value().cells_evaluated, 1U);
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(4, /*row=*/0, /*count=*/1)));
-  stats = wb.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(stats));
-  EXPECT_EQ(wb.sheet(3).cell_at(9, 0)->cached_value.as_number(), 566.0);
-  EXPECT_EQ(stats.value().cells_evaluated, 0U);
-}
-
-TEST(WorkbookRowColEdits, ThreeDOwnerMoveReordersMovedSourceAndDownstream) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("First");
-  wb.add_sheet("Second");
-  wb.add_sheet("Summary");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(2.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, 0, Value::number(3.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 3, 0, "=1+3")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 5, 0, "=SUM(First:Second!A1:A3)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 0, 0, "=First!A6*2")));
-  for (std::uint32_t row = 0; row < 3U; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
-  }
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_EQ(wb.sheet(0).cell_at(5, 0)->cached_value.as_number(), 66.0);
-  ASSERT_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 132.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->formula_text, "=SUM(First:Second!A1:A3)");
-  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->cached_value.as_number(), 69.0);
-  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->formula_text, "=First!A5*2");
-  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 138.0);
-}
-
-TEST(WorkbookRowColEdits, ThreeDOwnerMoveWithDefinedNameReindexKeepsRegistryCoordinates) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("First");
-  wb.add_sheet("Second");
-  wb.set_defined_names({DefinedName{"Region", "First!A2:A3", -1, false, ""}});
-  for (std::uint32_t row = 0; row < 4U; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
-  }
-  for (std::uint32_t row = 0; row < 3U; ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
-  }
-  // The ordinary formula moves immediately below the 3D owner. If a name
-  // rewrite rebuilds the registry before the physical move, both entries are
-  // left at their old coordinates and the later span edit can dirty this
-  // unrelated formula as though it were the owner.
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 5, 0, "=SUM(First:Second!A1:A3)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 6, 0, "=1+3")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_EQ(wb.sheet(0).cell_at(5, 0)->cached_value.as_number(), 66.0);
-  ASSERT_EQ(wb.sheet(0).cell_at(6, 0)->cached_value.as_number(), 4.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-  ASSERT_EQ(wb.sheet(0).cell_at(4, 0)->formula_text, "=SUM(First:Second!A1:A3)");
-  ASSERT_EQ(wb.sheet(0).cell_at(5, 0)->formula_text, "=1+3");
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_EQ(wb.sheet(0).cell_at(4, 0)->cached_value.as_number(), 69.0);
-
-  // The owner is on First, while this edit is on the other span member.
-  // Exactly the owner should be woken; a stale pre-move registry entry would
-  // also wake the unrelated formula now occupying row 5.
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(1, /*row=*/0, /*count=*/1)));
-  auto stats = wb.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(stats));
-  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->cached_value.as_number(), 59.0);
-  EXPECT_EQ(wb.sheet(0).cell_at(5, 0)->cached_value.as_number(), 4.0);
-  EXPECT_EQ(stats.value().cells_evaluated, 1U);
-}
-
-TEST(WorkbookRowColEdits, ThreeDOwnerDeletedByEditIsDroppedFromRegistry) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("First");
-  wb.add_sheet("Second");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(2.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, 0, Value::number(3.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 3, 0, "=SUM(First:Second!A1:A3)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 1, 0, Value::number(20.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 2, 0, Value::number(30.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_EQ(wb.sheet(0).cell_at(3, 0)->cached_value.as_number(), 66.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/3, /*count=*/1)));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  const Cell* deleted = wb.sheet(0).cell_at(3, 0);
-  EXPECT_TRUE(deleted == nullptr || deleted->formula_text.empty());
-}
-
-TEST(WorkbookRowColEdits, InsertColsShiftsCellsAcrossRow) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 3, Value::number(4.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1, 0, "=A1+D1")));
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, /*col=*/1, /*count=*/2)));
-
-  const Sheet& s = wb.sheet(0);
-  EXPECT_EQ(s.cell_at(0, 0)->cached_value.as_number(), 1.0);
-  // Slot at (0, 3) exists in the row vector but is a default Cell — the
-  // value that used to live there migrated forward.
-  ASSERT_NE(s.cell_at(0, 3), nullptr);
-  EXPECT_TRUE(s.cell_at(0, 3)->cached_value.is_blank());
-  ASSERT_NE(s.cell_at(0, 5), nullptr);
-  EXPECT_EQ(s.cell_at(0, 5)->cached_value.as_number(), 4.0);
-  // The formula cell sat at (1, 0), which is below the insert origin
-  // (col 1) and so does not move. Its references shift: D1 -> F1.
-  ASSERT_NE(s.cell_at(1, 0), nullptr);
-  EXPECT_EQ(s.cell_at(1, 0)->formula_text, "=A1+F1");
-}
-
-TEST(WorkbookRowColEdits, DeleteColsRewritesFormulaAndDropsCell) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 5, "=B1+C1+E1")));
-
-  // Delete cols B..C (col indices 1..2).
-  ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/1, /*count=*/2)));
-
-  const Sheet& s = wb.sheet(0);
-  // Source cell moved from F1 (col 5) to D1 (col 3).
-  ASSERT_NE(s.cell_at(0, 3), nullptr);
-  // B1 and C1 are inside the deleted span: collapse the entire formula
-  // to #REF! because every range / sum endpoint that lands inside the
-  // deletion poisons its enclosing expression.
-  EXPECT_EQ(s.cell_at(0, 3)->formula_text, "=#REF!+#REF!+C1");
-}
-
-TEST(WorkbookRowColEdits, DeleteColsShrinksRangeAtFirstLastAndMiddle) {
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(A1:D1)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(0, 9), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(0, 9)->formula_text, "=SUM(A1:C1)");
-  }
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(A1:D1)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/3, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(0, 9), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(0, 9)->formula_text, "=SUM(A1:C1)");
-  }
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(A1:F1)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/2, /*count=*/2)));
-    ASSERT_NE(wb.sheet(0).cell_at(0, 8), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(0, 8)->formula_text, "=SUM(A1:D1)");
-  }
-}
-
-TEST(WorkbookRowColEdits, DeleteColsCollapsesSingletonAndShrinksWholeColumnRange) {
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(B1:B1)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/1, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(0, 9), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(0, 9)->formula_text, "=SUM(#REF!)");
-  }
-  {
-    Workbook wb = Workbook::create();
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(A:D)")));
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/1, /*count=*/1)));
-    ASSERT_NE(wb.sheet(0).cell_at(0, 9), nullptr);
-    EXPECT_EQ(wb.sheet(0).cell_at(0, 9)->formula_text, "=SUM(A:C)");
-  }
-}
-
-TEST(WorkbookRowColEdits, DeleteColsCollapsesFullyDeletedMultiCellRange) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 10, "=SUM(B1:D1)")));
-  ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/1, /*count=*/3)));
-  ASSERT_NE(wb.sheet(0).cell_at(0, 7), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 7)->formula_text, "=SUM(#REF!)");
-}
-
-TEST(WorkbookRowColEdits, ThreeDColumnEditsDirtySpanMembersOnly) {
-  auto make_workbook = [] {
-    Workbook wb = Workbook::create_empty();
-    wb.add_sheet("First");
-    wb.add_sheet("Second");
-    wb.add_sheet("Summary");
-    wb.add_sheet("Outside");
-    for (std::uint32_t col = 0; col < 4U; ++col) {
-      EXPECT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, col, Value::number(static_cast<double>(col + 1U)))));
-    }
-    for (std::uint32_t col = 0; col < 3U; ++col) {
-      EXPECT_TRUE(
-          static_cast<bool>(wb.set_cell_value(1, 0, col, Value::number(static_cast<double>((col + 1U) * 10U)))));
-    }
-    EXPECT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:C1)")));
-    EXPECT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
-    return wb;
-  };
-
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
-    auto stats = wb.recalc(eval::default_registry());
-    ASSERT_TRUE(static_cast<bool>(stats));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->formula_text, "=SUM(First:Second!A1:C1)");
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
-    EXPECT_EQ(stats.value().cells_evaluated, 1U);
-  }
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(1, /*col=*/0, /*count=*/1)));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 56.0);
-  }
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, /*col=*/0, /*count=*/1)));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 63.0);
-  }
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.insert_cols(1, /*col=*/0, /*count=*/1)));
-    auto stats = wb.recalc(eval::default_registry());
-    ASSERT_TRUE(static_cast<bool>(stats));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 36.0);
-    EXPECT_EQ(stats.value().cells_evaluated, 1U);
-  }
-  {
-    Workbook wb = make_workbook();
-    ASSERT_TRUE(static_cast<bool>(wb.insert_cols(3, /*col=*/0, /*count=*/1)));
-    auto stats = wb.recalc(eval::default_registry());
-    ASSERT_TRUE(static_cast<bool>(stats));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
-    EXPECT_EQ(stats.value().cells_evaluated, 0U);
-  }
-}
-
-TEST(WorkbookRowColEdits, ThreeDWholeAxisEditsRecalculate) {
-  {
-    Workbook wb = Workbook::create_empty();
-    wb.add_sheet("First");
-    wb.add_sheet("Second");
-    wb.add_sheet("Summary");
-    for (std::uint32_t row = 0; row < 4U; ++row) {
-      ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, row, 0, Value::number(static_cast<double>(row + 1U)))));
-    }
-    for (std::uint32_t row = 0; row < 3U; ++row) {
-      ASSERT_TRUE(
-          static_cast<bool>(wb.set_cell_value(1, row, 0, Value::number(static_cast<double>((row + 1U) * 10U)))));
-    }
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A:A)")));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    ASSERT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 70.0);
-
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
-  }
-  {
-    Workbook wb = Workbook::create_empty();
-    wb.add_sheet("First");
-    wb.add_sheet("Second");
-    wb.add_sheet("Summary");
-    for (std::uint32_t col = 0; col < 4U; ++col) {
-      ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, col, Value::number(static_cast<double>(col + 1U)))));
-    }
-    for (std::uint32_t col = 0; col < 3U; ++col) {
-      ASSERT_TRUE(
-          static_cast<bool>(wb.set_cell_value(1, 0, col, Value::number(static_cast<double>((col + 1U) * 10U)))));
-    }
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!1:1)")));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    ASSERT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 70.0);
-
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 69.0);
-  }
-}
-
-TEST(WorkbookRowColEdits, ThreeDFormulaSourcesRecalculateBeforeFiniteAndWholeAxisOwners) {
-  {
-    Workbook wb = Workbook::create_empty();
-    wb.add_sheet("First");
-    wb.add_sheet("Second");
-    wb.add_sheet("Summary");
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(2.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 2, 0, "=ROW()")));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(10.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 1, 0, Value::number(20.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 2, 0, Value::number(30.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:A3)")));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 10, 0, "=SUM(First:Second!A:A)")));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    ASSERT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
-    ASSERT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 66.0);
-
-    ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/0, /*count=*/1)));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    ASSERT_EQ(wb.sheet(0).cell_at(1, 0)->formula_text, "=ROW()");
-    EXPECT_EQ(wb.sheet(0).cell_at(1, 0)->cached_value.as_number(), 2.0);
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 64.0);
-    EXPECT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 64.0);
-  }
-  {
-    Workbook wb = Workbook::create_empty();
-    wb.add_sheet("First");
-    wb.add_sheet("Second");
-    wb.add_sheet("Summary");
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 1, Value::number(2.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 2, "=COLUMN()")));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(10.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 1, Value::number(20.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 2, Value::number(30.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 9, 0, "=SUM(First:Second!A1:C1)")));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 10, 0, "=SUM(First:Second!1:1)")));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    ASSERT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 66.0);
-    ASSERT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 66.0);
-
-    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    ASSERT_EQ(wb.sheet(0).cell_at(0, 1)->formula_text, "=COLUMN()");
-    EXPECT_EQ(wb.sheet(0).cell_at(0, 1)->cached_value.as_number(), 2.0);
-    EXPECT_EQ(wb.sheet(2).cell_at(9, 0)->cached_value.as_number(), 64.0);
-    EXPECT_EQ(wb.sheet(2).cell_at(10, 0)->cached_value.as_number(), 64.0);
-  }
-}
-
-TEST(WorkbookRowColEdits, DeleteColsShrunkRangeRecalculatesAfterSurvivorChange) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 1, Value::number(20.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 2, Value::number(30.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 3, Value::number(40.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 5, 6, "=SUM(A1:D1)")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_EQ(wb.sheet(0).cell_at(5, 6)->cached_value.as_number(), 100.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, /*col=*/0, /*count=*/1)));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_NE(wb.sheet(0).cell_at(5, 5), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(5, 5)->formula_text, "=SUM(A1:C1)");
-  EXPECT_EQ(wb.sheet(0).cell_at(5, 5)->cached_value.as_number(), 90.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 1, Value::number(50.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).cell_at(5, 5)->cached_value.as_number(), 110.0);
-}
-
-TEST(WorkbookRowColEdits, InsertRowsShiftsMergeRanges) {
-  Workbook wb = Workbook::create();
-  Sheet& s = wb.sheet(0);
-  s.mutable_merges() = {MergeRange{0, 0, 0, 1}, MergeRange{5, 0, 7, 1}};
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/3, /*count=*/2)));
-
-  ASSERT_EQ(s.merges().size(), 2U);
-  // First merge sits entirely below the insert; unchanged.
-  EXPECT_EQ(s.merges()[0].first_row, 0U);
-  EXPECT_EQ(s.merges()[0].last_row, 0U);
-  // Second merge shifted forward by 2.
-  EXPECT_EQ(s.merges()[1].first_row, 7U);
-  EXPECT_EQ(s.merges()[1].last_row, 9U);
-}
-
-TEST(WorkbookRowColEdits, DeleteRowsClampsStraddlingMerge) {
-  Workbook wb = Workbook::create();
-  Sheet& s = wb.sheet(0);
-  s.mutable_merges() = {MergeRange{2, 0, 8, 1}};
-
-  // Delete rows 4..6.
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/4, /*count=*/3)));
-
-  ASSERT_EQ(s.merges().size(), 1U);
-  EXPECT_EQ(s.merges()[0].first_row, 2U);
-  // Last row was 8 (past the deletion); shifts up by 3 to 5.
-  EXPECT_EQ(s.merges()[0].last_row, 5U);
-}
-
-TEST(WorkbookRowColEdits, InsertRowsRewritesDefinedName) {
-  Workbook wb = Workbook::create();
-  std::vector<DefinedName> names;
-  DefinedName dn;
-  dn.name = "Region";
-  dn.formula = "Sheet1!$A$5:$A$10";
-  dn.local_sheet_id = -1;
-  names.push_back(dn);
-  wb.set_defined_names(std::move(names));
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/3, /*count=*/2)));
-
-  EXPECT_EQ(wb.defined_names()[0].formula, "Sheet1!$A$7:$A$12");
-}
-
-// A formula that reaches a shifted range only through a defined name is
-// textually unchanged by the shift — a `NameRef` node is the identity case
-// for the transform — so the per-formula rewriter never re-registers it. Its
-// dep-graph edges were extracted by expanding the *old* definition, which now
-// points somewhere else, so without a full re-index the next recalc misses
-// the cells the name actually covers.
-TEST(WorkbookRowColEdits, InsertRowsReindexesFormulasThatReachRangesViaDefinedName) {
-  Workbook wb = Workbook::create();
-  std::vector<DefinedName> names;
-  DefinedName dn;
-  dn.name = "Region";
-  dn.formula = "Sheet1!$A$2:$A$3";
-  dn.local_sheet_id = -1;
-  names.push_back(dn);
-  wb.set_defined_names(std::move(names));
-
-  // A2 = 10, A3 = 20 (0-based rows 1 and 2).
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 0, Value::number(10.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, 0, Value::number(20.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 2, "=SUM(Region)")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_NE(wb.sheet(0).cell_at(0, 2), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 2)->cached_value.as_number(), 30.0);
-
-  // Insert a row above the named range: the definition moves to $A$3:$A$4 and
-  // the two values move with it. `=SUM(Region)` is unchanged as text.
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/1, /*count=*/1)));
-  EXPECT_EQ(wb.defined_names()[0].formula, "Sheet1!$A$3:$A$4");
-
-  // Write to A4 (0-based row 3). That row is inside the *new* definition and
-  // outside the old one, so the edit only marks `=SUM(Region)` dirty if the
-  // dep graph was re-indexed against the rewritten definition.
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 3, 0, Value::number(25.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  ASSERT_NE(wb.sheet(0).cell_at(0, 2), nullptr);
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 2)->cached_value.as_number(), 35.0)
-      << "SUM over the defined name did not follow the shifted definition";
-}
-
-TEST(WorkbookRowColEdits, InsertRowsRecomputesShiftedFormulasAndAggregates) {
-  Workbook wb = Workbook::create();
-  // Items: qty (col 1), unit (col 2), subtotal=qty*unit (col 3), tax=sub*0.08 (col 4).
-  // Row 0 reserved for headers (left empty).
-  // Item rows 1..5.
-  const double qty[] = {24, 30, 4, 12, 5};
-  const double unit[] = {0.42, 2.5, 4.45, 2.0, 0.75};
-  for (std::uint32_t i = 0; i < 5; ++i) {
-    const std::uint32_t r = i + 1;
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, r, 1, Value::number(qty[i]))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, r, 2, Value::number(unit[i]))));
-    // Excel-text uses 1-based addressing; the formula at cell row=i+1 references row=i+1 (1-based).
-    const std::string subtotal_formula = "=B" + std::to_string(r + 1) + "*C" + std::to_string(r + 1);
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, r, 3, subtotal_formula)));
-    const std::string tax_formula = "=D" + std::to_string(r + 1) + "*0.08";
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, r, 4, tax_formula)));
-  }
-  // Totals at row 7 (1-based row 8). =SUM(D2:D6) covers the entire item range.
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 7, 3, "=SUM(D2:D6)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 7, 4, "=SUM(E2:E6)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 8, 3, "=D8+E8")));
-
-  // Initial recalc establishes the baseline.
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  {
-    const Sheet& s = wb.sheet(0);
-    EXPECT_EQ(s.cell_at(5, 3)->cached_value.as_number(), 5.0 * 0.75);  // eraser subtotal pre-shift
-    EXPECT_EQ(s.cell_at(7, 3)->cached_value.as_number(), 24 * 0.42 + 30 * 2.5 + 4 * 4.45 + 12 * 2.0 + 5 * 0.75);
-  }
-
-  // Insert one blank row at row index 1, push every item down by 1.
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, /*row=*/1, /*count=*/1)));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-
-  const Sheet& s = wb.sheet(0);
-  // Items now at rows 2..6, totals at row 8, with-tax at row 9.
-  for (std::uint32_t i = 0; i < 5; ++i) {
-    const std::uint32_t r = i + 2;
-    ASSERT_NE(s.cell_at(r, 3), nullptr) << "subtotal cell missing at row " << r;
-    ASSERT_NE(s.cell_at(r, 4), nullptr) << "tax cell missing at row " << r;
-    EXPECT_EQ(s.cell_at(r, 3)->cached_value.as_number(), qty[i] * unit[i])
-        << "subtotal mismatch at post-shift row " << r;
-    EXPECT_EQ(s.cell_at(r, 4)->cached_value.as_number(), qty[i] * unit[i] * 0.08)
-        << "tax mismatch at post-shift row " << r;
-  }
-  ASSERT_NE(s.cell_at(8, 3), nullptr);
-  EXPECT_EQ(s.cell_at(8, 3)->cached_value.as_number(), 24 * 0.42 + 30 * 2.5 + 4 * 4.45 + 12 * 2.0 + 5 * 0.75)
-      << "post-shift SUM mismatch (should NOT be #REF!)";
-  ASSERT_NE(s.cell_at(8, 4), nullptr);
-  EXPECT_NEAR(s.cell_at(8, 4)->cached_value.as_number(), (24 * 0.42 + 30 * 2.5 + 4 * 4.45 + 12 * 2.0 + 5 * 0.75) * 0.08,
-              1e-9);
-  ASSERT_NE(s.cell_at(9, 3), nullptr);
-  EXPECT_NEAR(s.cell_at(9, 3)->cached_value.as_number(), (24 * 0.42 + 30 * 2.5 + 4 * 4.45 + 12 * 2.0 + 5 * 0.75) * 1.08,
-              1e-9);
-}
-
-// Mirror of the row regression on the column axis. Items live in cols B..F,
-// SUM is in col H. After insertCols(1, 1) the SUM range shifts to C3..G3
-// and every item must keep a fresh value, especially the last shifted col.
-TEST(WorkbookRowColEdits, InsertColsRecomputesShiftedFormulasAndAggregates) {
-  Workbook wb = Workbook::create();
-  // Layout (1-based): row 3 has qty/unit per item; row 4 has the
-  // subtotal formulas; H4 = SUM(B4:F4).
-  const double qty[] = {2, 3, 4, 5, 6};
-  const double unit[] = {1.5, 2.5, 3.5, 4.5, 5.5};
-  for (std::uint32_t i = 0; i < 5; ++i) {
-    const std::uint32_t c = i + 1;  // cols 1..5 (B..F in 1-based)
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 2, c, Value::number(qty[i]))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 3, c, Value::number(unit[i]))));
-    const std::string col_letter(1, static_cast<char>('A' + c));
-    const std::string sub_formula = "=" + col_letter + "3*" + col_letter + "4";
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 4, c, sub_formula)));
-  }
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 4, 7, "=SUM(B5:F5)")));
-
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  double expected_sum = 0.0;
-  for (std::uint32_t i = 0; i < 5; ++i) {
-    expected_sum += qty[i] * unit[i];
-  }
-  EXPECT_EQ(wb.sheet(0).cell_at(4, 7)->cached_value.as_number(), expected_sum);
-
-  ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, /*col=*/1, /*count=*/1)));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-
-  const Sheet& s = wb.sheet(0);
-  for (std::uint32_t i = 0; i < 5; ++i) {
-    const std::uint32_t c = i + 2;  // cols 2..6 post-shift
-    ASSERT_NE(s.cell_at(4, c), nullptr);
-    EXPECT_EQ(s.cell_at(4, c)->cached_value.as_number(), qty[i] * unit[i])
-        << "post-shift subtotal mismatch at col " << c;
-  }
-  ASSERT_NE(s.cell_at(4, 8), nullptr);
-  EXPECT_EQ(s.cell_at(4, 8)->cached_value.as_number(), expected_sum) << "post-shift SUM stale or #REF!";
-}
-
-// Delete rows must drop dep-graph entries for cells inside the deletion
-// band AND re-key entries for cells trailing the band so dependents recalc
-// correctly. Without the fix the SUM that spans the deletion would read
-// stale (pre-delete) cached values from the now-empty rows.
-TEST(WorkbookRowColEdits, DeleteRowsRecomputesShiftedFormulasAndAggregates) {
-  Workbook wb = Workbook::create();
-  const double qty[] = {2, 3, 4, 5, 6};
-  for (std::uint32_t i = 0; i < 5; ++i) {
-    const std::uint32_t r = i + 1;
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, r, 1, Value::number(qty[i]))));
-    const std::string subtotal_formula = "=B" + std::to_string(r + 1) + "*2";
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, r, 3, subtotal_formula)));
-  }
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 7, 3, "=SUM(D2:D6)")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  double expected_pre = 0.0;
-  for (std::uint32_t i = 0; i < 5; ++i) {
-    expected_pre += qty[i] * 2;
-  }
-  EXPECT_EQ(wb.sheet(0).cell_at(7, 3)->cached_value.as_number(), expected_pre);
-
-  // Delete rows 2..3 (0-based), removing the second and third items.
-  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, /*row=*/2, /*count=*/2)));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-
-  const Sheet& s = wb.sheet(0);
-  ASSERT_NE(s.cell_at(5, 3), nullptr);  // SUM moved from row 7 → 5
-  // SUM range was D2:D6 covering rows 1..5; after deleting rows 2..3
-  // the range refs collapse: D2 (row 1, untouched) + D5..D6 (rows 4..5
-  // pre-delete, now rows 2..3) survive; rows 2..3 (qty[1], qty[2]) drop.
-  const double expected_post = qty[0] * 2 + qty[3] * 2 + qty[4] * 2;
-  EXPECT_EQ(s.cell_at(5, 3)->cached_value.as_number(), expected_post)
-      << "post-delete SUM mismatch (range refs should collapse, not stale)";
-}
-
-TEST(WorkbookRowColEdits, RejectsZeroCount) {
-  Workbook wb = Workbook::create();
-  auto r = wb.insert_rows(0, /*row=*/0, /*count=*/0);
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidArgument);
-}
-
-TEST(WorkbookRowColEdits, RejectsOutOfRangeSheetIndex) {
-  Workbook wb = Workbook::create();
-  auto r = wb.delete_cols(99, /*col=*/0, /*count=*/1);
-  ASSERT_FALSE(static_cast<bool>(r));
-  EXPECT_EQ(r.error().code, FormulonErrorCode::kInvalidArgument);
-}
-
-TEST(WorkbookSheetOps, RenameUsesAstForThreeDFormulaAndPreservesStringLiteral) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Alpha");
-  wb.add_sheet("Beta");
-  wb.add_sheet("Summary");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(2.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(3.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 0, 0, "=SUM(Alpha:Beta!A1)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 1, 0, "=\"Alpha!x\"")));
-  wb.set_defined_names({DefinedName{"Span", "SUM(Alpha:Beta!A1)", -1, false, ""}});
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_DOUBLE_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 5.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "Alpha New")));
-  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->formula_text, "=SUM('Alpha New:Beta'!A1)");
-  EXPECT_EQ(wb.sheet(2).cell_at(1, 0)->formula_text, "=\"Alpha!x\"");
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  EXPECT_EQ(wb.defined_names()[0].formula, "SUM('Alpha New:Beta'!A1)");
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_DOUBLE_EQ(wb.sheet(2).cell_at(0, 0)->cached_value.as_number(), 5.0);
-}
-
-TEST(WorkbookSheetOps, RenameQuotesApostropheInThreeDEndpoint) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("2026 Q1");
-  wb.add_sheet("Feb");
-  wb.add_sheet("Summary");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(2.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(3.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 0, 0, "=SUM('2026 Q1:Feb'!A1)")));
-  wb.set_defined_names({DefinedName{"Span", "SUM('2026 Q1:Feb'!A1)", -1, false, ""}});
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "2026 Q1's")));
-  EXPECT_EQ(wb.sheet(2).cell_at(0, 0)->formula_text, "=SUM('2026 Q1''s:Feb'!A1)");
-  EXPECT_EQ(wb.defined_names()[0].formula, "SUM('2026 Q1''s:Feb'!A1)");
-}
-
-TEST(WorkbookSheetOps, RemoveRewritesOnlyAffectedAstSubtreesAndDoesNotRebind) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Drop");
-  wb.add_sheet("Summary");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(42.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_text(1, 2, 0, "Drop!x")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 0, "=IFERROR(Drop!A1,99)+5")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 3, 0, "=IF(A3=\"Drop!x\",1,2)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 4, 0, "=Drop!A1+1")));
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  EXPECT_EQ(wb.sheet(0).cell_at(0, 0)->formula_text, "=IFERROR(#REF!,99)+5");
-  EXPECT_EQ(wb.sheet(0).cell_at(3, 0)->formula_text, "=IF(A3=\"Drop!x\",1,2)");
-  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->formula_text, "=#REF!+1");
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0, 0)->cached_value.as_number(), 104.0);
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(3, 0)->cached_value.as_number(), 1.0);
-
-  // A later sheet with the deleted display name must not rebind the frozen
-  // subtree or the direct reference after the final graph rebuild.
-  wb.add_sheet("Drop");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(99.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_TRUE(wb.sheet(0).cell_at(4, 0)->cached_value.is_error());
-  EXPECT_EQ(wb.sheet(0).cell_at(4, 0)->cached_value.as_error(), ErrorCode::Ref);
-}
-
-TEST(WorkbookSheetOps, RemoveAdjustsThreeDBeginMiddleEndAndReverseSpans) {
-  const auto run = [](std::uint32_t removed_index, std::string expected_formula, double expected_value,
-                      std::string source_formula) {
-    Workbook wb = Workbook::create_empty();
-    wb.add_sheet("Jan");
-    wb.add_sheet("Feb");
-    wb.add_sheet("Mar");
-    wb.add_sheet("Summary");
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(1.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(2.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(2, 0, 0, Value::number(3.0))));
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(3, 0, 0, std::move(source_formula))));
-    ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(removed_index)));
-    const std::size_t summary = wb.sheet_index_by_name("Summary");
-    ASSERT_NE(summary, static_cast<std::size_t>(-1));
-    EXPECT_EQ(wb.sheet(summary).cell_at(0, 0)->formula_text, expected_formula);
-    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-    EXPECT_DOUBLE_EQ(wb.sheet(summary).cell_at(0, 0)->cached_value.as_number(), expected_value);
-  };
-
-  run(0, "=SUM(Feb:Mar!A1)", 5.0, "=SUM(Jan:Mar!A1)");
-  run(1, "=SUM(Jan:Mar!A1)", 4.0, "=SUM(Jan:Mar!A1)");
-  run(2, "=SUM(Jan:Feb!A1)", 3.0, "=SUM(Jan:Mar!A1)");
-  run(2, "=SUM(Feb:Jan!A1)", 3.0, "=SUM(Mar:Jan!A1)");
-}
-
-TEST(WorkbookSheetOps, RemoveTransformsAllFormulaMetadataAndDropsDanglingPivotState) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Drop");
-  wb.add_sheet("Survivor");
-
-  cf::ConditionalFormat conditional_format;
-  cf::CFRule rule;
-  rule.formula1 = "Drop!A1";
-  rule.formula2 = "Drop!B1";
-  rule.color_scale = cf::ColorScaleSpec{};
-  rule.color_scale->thresholds.push_back(cf::CfValueObject{cf::CfvoType::Formula, "Drop!C1", true});
-  rule.icon_set = cf::IconSetSpec{};
-  rule.icon_set->thresholds.push_back(cf::CfValueObject{cf::CfvoType::Formula, "Drop!D1", true});
-  rule.data_bar = cf::DataBarSpec{};
-  rule.data_bar->min = cf::CfValueObject{cf::CfvoType::Formula, "Drop!E1", true};
-  rule.data_bar->max = cf::CfValueObject{cf::CfvoType::Formula, "Drop!F1", true};
-  conditional_format.rules.push_back(std::move(rule));
-  wb.sheet(1).mutable_conditional_formats().push_back(std::move(conditional_format));
-
-  Hyperlink hyperlink;
-  hyperlink.location = "#Drop!A1";
-  wb.sheet(1).mutable_hyperlinks().push_back(hyperlink);
-  DataValidation validation;
-  validation.formula1 = "Drop!A1";
-  validation.formula2 = "Drop!B1";
-  wb.sheet(1).mutable_validations().push_back(validation);
-
-  TableMetadata dropped_table;
-  dropped_table.id = 1;
-  dropped_table.name = "DropTable";
-  dropped_table.display_name = "DropTable";
-  dropped_table.ref = "A1:B2";
-  dropped_table.sheet_index = 0;
-  TableMetadata survivor_table;
-  survivor_table.id = 2;
-  survivor_table.name = "SurvivorTable";
-  survivor_table.display_name = "SurvivorTable";
-  survivor_table.ref = "A1:B2";
-  survivor_table.sheet_index = 1;
-  survivor_table.columns.push_back(TableColumn{1, "Value", {}, {}, "Drop!A1"});
-  wb.set_tables({std::move(dropped_table), std::move(survivor_table)});
-
-  wb.set_defined_names({DefinedName{"DropName", "Drop!A1", -1, false, ""}});
-  auto dropped_cache = std::make_unique<pivot::PivotCache>();
-  dropped_cache->set_cache_id(11);
-  dropped_cache->mutable_worksheet_source() = {true, "$A$1:$B$2", "Drop", ""};
-  wb.add_pivot_cache(std::move(dropped_cache));
-  auto survivor_cache = std::make_unique<pivot::PivotCache>();
-  survivor_cache->set_cache_id(12);
-  survivor_cache->mutable_worksheet_source() = {true, "$A$1:$B$2", "Survivor", ""};
-  wb.add_pivot_cache(std::move(survivor_cache));
-  auto dropped_pivot = std::make_unique<pivot::PivotTable>();
-  dropped_pivot->set_pivot_cache_id(11);
-  wb.sheet(1).add_pivot_table(std::move(dropped_pivot));
-  auto survivor_pivot = std::make_unique<pivot::PivotTable>();
-  survivor_pivot->set_pivot_cache_id(12);
-  wb.sheet(1).add_pivot_table(std::move(survivor_pivot));
-
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));
-  ASSERT_EQ(wb.sheet_count(), 1U);
-  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].formula1.value(), "#REF!");
-  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].formula2.value(), "#REF!");
-  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].color_scale->thresholds[0].value, "#REF!");
-  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].icon_set->thresholds[0].value, "#REF!");
-  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].data_bar->min.value, "#REF!");
-  EXPECT_EQ(wb.sheet(0).conditional_formats()[0].rules[0].data_bar->max.value, "#REF!");
-  EXPECT_EQ(wb.sheet(0).hyperlinks()[0].location, "#REF!");
-  EXPECT_EQ(wb.sheet(0).validations()[0].formula1, "#REF!");
-  EXPECT_EQ(wb.sheet(0).validations()[0].formula2, "#REF!");
-  ASSERT_EQ(wb.tables().size(), 1U);
-  EXPECT_EQ(wb.tables()[0].sheet_index, 0U);
-  EXPECT_EQ(wb.tables()[0].columns[0].calculated_column_formula, "#REF!");
-  EXPECT_EQ(wb.defined_names()[0].formula, "#REF!");
-  ASSERT_EQ(wb.pivot_caches().size(), 1U);
-  EXPECT_EQ(wb.pivot_caches()[0]->cache_id(), 12U);
-  ASSERT_EQ(wb.sheet(0).pivot_tables().size(), 1U);
-  EXPECT_EQ(wb.sheet(0).pivot_tables()[0]->pivot_cache_id(), 12U);
-
-  // Re-adding the removed display name must not rebind any surviving holder
-  // or resurrect the dropped cache/pivot relationship.
-  wb.add_sheet("Drop");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(99.0))));
-  EXPECT_EQ(wb.tables()[0].columns[0].calculated_column_formula, "#REF!");
-  EXPECT_EQ(wb.defined_names()[0].formula, "#REF!");
-  ASSERT_EQ(wb.pivot_caches().size(), 1U);
-  EXPECT_EQ(wb.pivot_caches()[0]->cache_id(), 12U);
-  ASSERT_EQ(wb.sheet(0).pivot_tables().size(), 1U);
-  EXPECT_EQ(wb.sheet(0).pivot_tables()[0]->pivot_cache_id(), 12U);
-}
-
-TEST(WorkbookSheetOps, RenameDoesNotClearUnrelatedCommittedSpill) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Alpha");
-  wb.add_sheet("Beta");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 0, "=SEQUENCE(2,1)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 1, "=Beta!A1")));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_DOUBLE_EQ(wb.sheet(1).resolve_cell_value(1, 0).as_number(), 2.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "Alpha New")));
-  EXPECT_DOUBLE_EQ(wb.sheet(1).resolve_cell_value(1, 0).as_number(), 2.0);
-}
-
-TEST(WorkbookSheetOps, RemoveReindexesSurvivingScopedNameBeforeDependentRecalc) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Drop");
-  wb.add_sheet("Survivor");
-  wb.add_sheet("Summary");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::text("Label"))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 1, Value::text("Value"))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 1, 0, Value::text("row-1"))));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1, 1, 1, Value::number(2.0))));
-  TableMetadata table;
-  table.id = 7U;
-  table.name = "SurvivorTable";
-  table.display_name = "SurvivorTable";
-  table.ref = "A1:B2";
-  table.sheet_index = 1U;
-  table.header_row = true;
-  table.columns = {TableColumn{1U, "Label", {}, {}, {}}, TableColumn{2U, "Value", {}, {}, {}}};
-  wb.set_tables({table});
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Local", "$B$2", 1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 2, "=Local")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(2, 0, 0, "=SUM(SurvivorTable[Value])")));
-
-  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet(0)));
-  ASSERT_EQ(wb.defined_names().size(), 1U);
-  EXPECT_EQ(wb.defined_names()[0].local_sheet_id, 0);
-  ASSERT_EQ(wb.tables().size(), 1U);
-  EXPECT_EQ(wb.tables()[0].sheet_index, 0U);
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0, 2)->cached_value.as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(wb.sheet(1).cell_at(0, 0)->cached_value.as_number(), 2.0);
-
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 1, 1, Value::number(7.0))));
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_DOUBLE_EQ(wb.sheet(0).cell_at(0, 2)->cached_value.as_number(), 7.0);
-  EXPECT_DOUBLE_EQ(wb.sheet(1).cell_at(0, 0)->cached_value.as_number(), 7.0);
-}
-
-TEST(WorkbookSheetOps, RowInsertKeepsWrittenParentheses) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 4U, 1U, "=(A1)+1")));
-  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0U, 0U, 1U)));
-  const Cell* cell = wb.sheet(0).cell_at(5U, 1U);
-  ASSERT_NE(cell, nullptr);
-  EXPECT_EQ(cell->formula_text, "=(A2)+1");
-}
-
-}  // namespace
-}  // namespace formulon
diff --git a/tests/integration/sheet_ops_test_support.h b/tests/integration/sheet_ops_test_support.h
new file mode 100644
index 000000000..fea905692
--- /dev/null
+++ b/tests/integration/sheet_ops_test_support.h
@@ -0,0 +1,56 @@
+#pragma once
+
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "cf/cf_types.h"
+#include "defined_name.h"
+#include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
+#include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
+#include "io/ooxml_writer.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_table.h"
+#include "sheet.h"
+#include "table.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon::sheet_ops_test {
+
+// Sentinel sheet index well past `sheet_count()` for every workbook in this
+// family. Used to force the out-of-range rejection paths.
+inline constexpr std::uint32_t kOutOfRangeIndex = 99U;
+
+// Convenience factory: workbook with three sheets, named `Alpha`, `Beta`,
+// and `Gamma` (created via `add_sheet` so the default `Sheet1` stays out of
+// the way).
+inline Workbook ThreeSheetWorkbook() {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Alpha");
+  wb.add_sheet("Beta");
+  wb.add_sheet("Gamma");
+  return wb;
+}
+
+inline void SetMoveSensitiveMetadata(Sheet& sheet, std::string_view suffix) {
+  sheet.set_drawing_rel_target("xl/drawings/drawing-" + std::string(suffix) + ".xml");
+  sheet.set_auto_filter(io::auto_filter_from_xml("<autoFilter ref=\"A1:" + std::string(suffix) + "9\"/>"));
+  sheet.set_ext_lst_xml("<extLst><ext uri=\"" + std::string(suffix) + "\"/></extLst>");
+  sheet.set_root_extra_ns_attrs(" xmlns:x" + std::string(suffix) + "=\"urn:" + std::string(suffix) + "\"");
+}
+
+inline void ExpectMoveSensitiveMetadata(const Sheet& sheet, std::string_view suffix) {
+  EXPECT_EQ(sheet.drawing_rel_target(), "xl/drawings/drawing-" + std::string(suffix) + ".xml");
+  EXPECT_EQ(io::auto_filter_xml(sheet.auto_filter()), "<autoFilter ref=\"A1:" + std::string(suffix) + "9\"/>");
+  EXPECT_EQ(sheet.ext_lst_xml(), "<extLst><ext uri=\"" + std::string(suffix) + "\"/></extLst>");
+  EXPECT_EQ(sheet.root_extra_ns_attrs(), " xmlns:x" + std::string(suffix) + "=\"urn:" + std::string(suffix) + "\"");
+}
+
+}  // namespace formulon::sheet_ops_test
diff --git a/tests/integration/spill_collision_test.cpp b/tests/integration/spill_collision_test.cpp
index 86dd7ea29..ec40a8c04 100644
--- a/tests/integration/spill_collision_test.cpp
+++ b/tests/integration/spill_collision_test.cpp
@@ -881,5 +881,119 @@ TEST(SpillCollision, SpillAtTableEdgeJustFitsNoCollision) {
   EXPECT_NE(wb.sheet(0).spill_region_at_anchor(0U, 3U), nullptr);
 }
 
+TEST(SpillCollision, AddMergeNormalizesReversedRangeAndWakesCommittedSpill) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2,2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_NE(wb.sheet(0).spill_region_at_anchor(0U, 0U), nullptr);
+
+  // The reversed rectangle normalises to B1:C2 and intersects the committed
+  // A1:B2 spill in column B.
+  ASSERT_TRUE(static_cast<bool>(wb.add_merge(0U, MergeRange{1U, 2U, 0U, 1U})));
+  ASSERT_EQ(wb.sheet(0).merges().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).merges()[0].first_row, 0U);
+  EXPECT_EQ(wb.sheet(0).merges()[0].first_col, 1U);
+  EXPECT_EQ(wb.sheet(0).merges()[0].last_row, 1U);
+  EXPECT_EQ(wb.sheet(0).merges()[0].last_col, 2U);
+
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).spill_region_at_anchor(0U, 0U), nullptr);
+  const Value a1 = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(a1.is_error());
+  EXPECT_EQ(a1.as_error(), ErrorCode::Spill);
+}
+
+TEST(SpillCollision, AddMergeRejectsOutOfGridRangeWithoutMutation) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2,2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const std::vector<SpillFootprint> before = wb.sheet(0).committed_spill_footprints();
+  ASSERT_EQ(before.size(), 1U);
+
+  for (const MergeRange invalid : {MergeRange{0U, 0U, Sheet::kMaxRows, 0U}, MergeRange{0U, 0U, 0U, Sheet::kMaxCols}}) {
+    const auto result = wb.add_merge(0U, invalid);
+    ASSERT_FALSE(static_cast<bool>(result));
+    EXPECT_EQ(result.error().code, FormulonErrorCode::kInvalidArgument);
+  }
+  EXPECT_TRUE(wb.sheet(0).merges().empty());
+
+  const std::vector<SpillFootprint> after = wb.sheet(0).committed_spill_footprints();
+  ASSERT_EQ(after.size(), before.size());
+  EXPECT_EQ(after[0].anchor_row, before[0].anchor_row);
+  EXPECT_EQ(after[0].anchor_col, before[0].anchor_col);
+  EXPECT_EQ(after[0].rows, before[0].rows);
+  EXPECT_EQ(after[0].cols, before[0].cols);
+  EXPECT_DOUBLE_EQ(wb.sheet(0).resolve_cell_value(0U, 0U).as_number(), 1.0);
+}
+
+TEST(SpillCollision, RemoveMergeNormalizesReversedQueryAndWakesBlockedSpill) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.add_merge(0U, MergeRange{1U, 0U, 2U, 1U})));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(3,2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  ASSERT_EQ(StoredValue(wb, 0U, 0U, 0U).as_error(), ErrorCode::Spill);
+  ASSERT_EQ(wb.sheet(0).blocked_spill_anchors().size(), 1U);
+
+  // The raw reversed endpoints do not intersect the stored merge until both
+  // axes are normalised: row 3 is above the merge's last row 2, while the
+  // normalised query spans rows 0..3 and columns 0..2.
+  ASSERT_TRUE(static_cast<bool>(wb.remove_merges_intersecting(0U, MergeRange{3U, 2U, 0U, 0U})));
+  EXPECT_TRUE(wb.sheet(0).merges().empty());
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value b3 = wb.sheet(0).resolve_cell_value(2U, 1U);
+  ASSERT_TRUE(b3.is_number());
+  EXPECT_DOUBLE_EQ(b3.as_number(), 6.0);
+  EXPECT_TRUE(wb.sheet(0).blocked_spill_anchors().empty());
+}
+
+TEST(SpillCollision, RemoveMergeAcceptsOutsideGridQuery) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.add_merge(0U, MergeRange{0U, 0U, 1U, 1U})));
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_merges_intersecting(
+      0U, MergeRange{Sheet::kMaxRows, Sheet::kMaxCols, Sheet::kMaxRows, Sheet::kMaxCols})));
+  ASSERT_EQ(wb.sheet(0).merges().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).merges()[0].first_row, 0U);
+  EXPECT_EQ(wb.sheet(0).merges()[0].first_col, 0U);
+  EXPECT_EQ(wb.sheet(0).merges()[0].last_row, 1U);
+  EXPECT_EQ(wb.sheet(0).merges()[0].last_col, 1U);
+}
+
+TEST(SpillCollision, DistantRowAndColumnEditsRestoreCommittedSpills) {
+  for (const bool rows : {false, true}) {
+    for (const bool deletion : {false, true}) {
+      SCOPED_TRACE(std::string(rows ? "rows" : "cols") + (deletion ? " delete" : " insert"));
+      Workbook wb = Workbook::create();
+      wb.set_excel_profile(mac_365_ja_jp_profile());
+      ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2,2)")));
+      ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+      ASSERT_NE(wb.sheet(0).spill_region_at_anchor(0U, 0U), nullptr);
+
+      const auto edited = rows ? (deletion ? wb.delete_rows(0U, 10U, 1U) : wb.insert_rows(0U, 10U, 1U))
+                               : (deletion ? wb.delete_cols(0U, 10U, 1U) : wb.insert_cols(0U, 10U, 1U));
+      ASSERT_TRUE(static_cast<bool>(edited));
+      EXPECT_EQ(wb.sheet(0).spill_region_at_anchor(0U, 0U), nullptr);
+
+      ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+      EXPECT_NE(wb.sheet(0).spill_region_at_anchor(0U, 0U), nullptr);
+      const Value a1 = wb.sheet(0).resolve_cell_value(0U, 0U);
+      const Value b1 = wb.sheet(0).resolve_cell_value(0U, 1U);
+      const Value a2 = wb.sheet(0).resolve_cell_value(1U, 0U);
+      const Value b2 = wb.sheet(0).resolve_cell_value(1U, 1U);
+      ASSERT_TRUE(a1.is_number());
+      ASSERT_TRUE(b1.is_number());
+      ASSERT_TRUE(a2.is_number());
+      ASSERT_TRUE(b2.is_number());
+      EXPECT_DOUBLE_EQ(a1.as_number(), 1.0);
+      EXPECT_DOUBLE_EQ(b1.as_number(), 2.0);
+      EXPECT_DOUBLE_EQ(a2.as_number(), 3.0);
+      EXPECT_DOUBLE_EQ(b2.as_number(), 4.0);
+    }
+  }
+}
+
 }  // namespace
 }  // namespace formulon
diff --git a/tests/integration/structural_edit_matrix_test.cpp b/tests/integration/structural_edit_matrix_test.cpp
index a0c5dbdbf..a4bffe13a 100644
--- a/tests/integration/structural_edit_matrix_test.cpp
+++ b/tests/integration/structural_edit_matrix_test.cpp
@@ -36,6 +36,9 @@
 #include "eval/function_registry.h"
 #include "eval/recalc_engine.h"
 #include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
 #include "pivot/pivot_cache.h"
 #include "pivot/pivot_table.h"
 #include "sheet.h"
@@ -55,6 +58,37 @@ constexpr std::uint32_t kAnchorCol = 3;
 constexpr std::uint32_t kEditOrigin = 1;
 constexpr std::uint32_t kEditCount = 1;
 
+TEST(StructuralEditMatrix, DeletionRemovesConsumedValidationsAndPreservesSurvivingRanges) {
+  for (const bool rows : {false, true}) {
+    SCOPED_TRACE(rows ? "rows" : "cols");
+    Workbook wb = Workbook::create();
+    DataValidation consumed;
+    consumed.type = 3;
+    consumed.formula1 = "\"one,two\"";
+    consumed.ranges.push_back(MergeRange{1, 1, 1, 1});
+    DataValidation surviving = consumed;
+    surviving.ranges.push_back(MergeRange{3, 3, 3, 3});
+    wb.sheet(0).mutable_validations().push_back(std::move(consumed));
+    wb.sheet(0).mutable_validations().push_back(std::move(surviving));
+
+    ASSERT_TRUE(static_cast<bool>(rows ? wb.delete_rows(0, 1, 1) : wb.delete_cols(0, 1, 1)));
+    ASSERT_EQ(wb.sheet(0).validations().size(), 1U);
+    const auto& ranges = wb.sheet(0).validations()[0].ranges;
+    ASSERT_EQ(ranges.size(), 1U);
+    EXPECT_EQ(ranges[0].first_row, rows ? 2U : 3U);
+    EXPECT_EQ(ranges[0].last_row, rows ? 2U : 3U);
+    EXPECT_EQ(ranges[0].first_col, rows ? 3U : 2U);
+    EXPECT_EQ(ranges[0].last_col, rows ? 3U : 2U);
+
+    auto written = io::write_ooxml(wb);
+    ASSERT_TRUE(static_cast<bool>(written));
+    auto loaded = io::read_ooxml(io::ByteSpan{written.value().data(), written.value().size()});
+    ASSERT_TRUE(static_cast<bool>(loaded));
+    ASSERT_EQ(loaded.value().workbook.sheet(0).validations().size(), 1U);
+    EXPECT_EQ(loaded.value().workbook.sheet(0).validations()[0].formula1, "\"one,two\"");
+  }
+}
+
 /// Builds a workbook whose single sheet carries one instance of every
 /// structure a row/column edit has to move.
 Workbook MakeWorkbook() {
@@ -151,7 +185,7 @@ Workbook MakeWorkbook() {
   // The auto-filter element is retained as raw XML, but its `ref` rectangle
   // decides which cells the filter is attached to and so has to move with
   // them. Same rectangle as the merge above.
-  sheet.set_auto_filter_xml("<autoFilter ref=\"D6:E7\"><filterColumn colId=\"0\"/></autoFilter>");
+  sheet.set_auto_filter(io::auto_filter_from_xml("<autoFilter ref=\"D6:E7\"><filterColumn colId=\"0\"/></autoFilter>"));
 
   auto pivot = std::make_unique<pivot::PivotTable>();
   pivot->set_anchor(kAnchorRow, kAnchorCol, /*rows=*/2, /*cols=*/2);
@@ -176,7 +210,7 @@ const cf::CFCellRange& OnlyCfRange(const Workbook& wb) {
 /// The auto-filter element, with its `ref` rectangle rewritten to
 /// `expected_ref` and everything else left verbatim.
 void ExpectAutoFilterRef(const Sheet& sheet, const std::string& expected_ref) {
-  EXPECT_EQ(sheet.auto_filter_xml(),
+  EXPECT_EQ(io::auto_filter_xml(sheet.auto_filter()),
             "<autoFilter ref=\"" + expected_ref + "\"><filterColumn colId=\"0\"/></autoFilter>");
 }
 
@@ -298,6 +332,67 @@ Workbook MakeCrossSheetWorkbook() {
   return wb;
 }
 
+/// Extends the ordinary cross-sheet fixture with metadata whose owner cannot
+/// be inferred from the workbook. These holders must use the caller's
+/// unowned policy instead of accidentally borrowing Sheet1's local transform.
+Workbook MakeCrossSheetWorkbookWithUnownedSources() {
+  Workbook wb = MakeCrossSheetWorkbook();
+
+  auto missing_sheet_cache = std::make_unique<pivot::PivotCache>();
+  missing_sheet_cache->set_cache_id(2U);
+  missing_sheet_cache->mutable_worksheet_source() = {true, "$D$6:$D$7", "Missing", ""};
+  wb.add_pivot_cache(std::move(missing_sheet_cache));
+
+  auto qualified_cache = std::make_unique<pivot::PivotCache>();
+  qualified_cache->set_cache_id(3U);
+  qualified_cache->mutable_worksheet_source() = {true, "Sheet1!$D$6:$D$7", "", ""};
+  wb.add_pivot_cache(std::move(qualified_cache));
+
+  auto remote_cache = std::make_unique<pivot::PivotCache>();
+  remote_cache->set_cache_id(4U);
+  remote_cache->mutable_worksheet_source() = {true, "$D$6:$D$7", "Sheet2", ""};
+  wb.add_pivot_cache(std::move(remote_cache));
+
+  TableMetadata unowned_table;
+  unowned_table.id = 3;
+  unowned_table.name = "UnownedTable";
+  unowned_table.display_name = "UnownedTable";
+  unowned_table.ref = "D6:D7";
+  unowned_table.sheet_index = wb.sheet_count() + 10U;
+  unowned_table.columns.push_back(TableColumn{1, "Value", {}, {}, "Sheet1!D6*2"});
+  wb.mutable_tables().push_back(std::move(unowned_table));
+
+  return wb;
+}
+
+/// Builds two sheets whose defined names exercise every owner policy used by
+/// a row/column edit. The local name is deliberately anchored at A1 and has
+/// two dependents: the first is the exact A1 reproduction, while the second
+/// survives a delete of row/column zero so the four-operation matrix can also
+/// observe the resulting #REF! mapping.
+Workbook MakeDefinedNameOwnerWorkbook() {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  EXPECT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(7.0))));
+  EXPECT_TRUE(static_cast<bool>(wb.set_cell_value(1, 0, 0, Value::number(11.0))));
+
+  wb.set_defined_names({
+      DefinedName{"Local", "$A$1", 0, false, ""},
+      DefinedName{"OtherLocal", "$A$1", 1, false, ""},
+      DefinedName{"OtherQualified", "Sheet1!$A$1", 1, false, ""},
+      DefinedName{"GlobalQualified", "Sheet1!$A$1", -1, false, ""},
+      DefinedName{"InvalidQualified", "Sheet1!$A$1", 99, false, ""},
+      DefinedName{"GlobalUnqualified", "$A$1", -1, false, ""},
+      DefinedName{"InvalidUnqualified", "$A$1", 99, false, ""},
+  });
+
+  EXPECT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 2, "=Local")));
+  EXPECT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1, 2, "=Local")));
+  EXPECT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 2, "=OtherLocal")));
+  EXPECT_TRUE(static_cast<bool>(wb.set_cell_formula(1, 0, 3, "=OtherQualified")));
+  return wb;
+}
+
 /// The cross-sheet rule on Sheet2 — the one qualified with the edited sheet.
 const std::string& CrossSheetCfFormula(const Workbook& wb) {
   return *wb.sheet(1).conditional_formats().at(0).rules.at(0).formula1;
@@ -521,30 +616,31 @@ TEST(StructuralEditMatrix, DeleteColsMovesEveryColumnAnchoredStructure) {
 
 TEST(StructuralEditMatrix, DeleteRowsShrinksTheAutoFilterRef) {
   Workbook wb = Workbook::create();
-  wb.sheet(0).set_auto_filter_xml("<autoFilter ref=\"D6:E8\"/>");
+  wb.sheet(0).set_auto_filter(io::auto_filter_from_xml("<autoFilter ref=\"D6:E8\"/>"));
 
   ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, 7, 1)));
-  EXPECT_EQ(wb.sheet(0).auto_filter_xml(), "<autoFilter ref=\"D6:E7\"/>");
+  EXPECT_EQ(io::auto_filter_xml(wb.sheet(0).auto_filter()), "<autoFilter ref=\"D6:E7\"/>");
 }
 
 TEST(StructuralEditMatrix, DeleteRowsDropsAnAutoFilterWhoseRangeIsFullyConsumed) {
   Workbook wb = Workbook::create();
-  wb.sheet(0).set_auto_filter_xml("<autoFilter ref=\"D6:E7\"><filterColumn colId=\"0\"/></autoFilter>");
+  wb.sheet(0).set_auto_filter(
+      io::auto_filter_from_xml("<autoFilter ref=\"D6:E7\"><filterColumn colId=\"0\"/></autoFilter>"));
 
   // Deleting every filtered row leaves no rectangle to attach the filter to,
   // which Excel resolves by dropping the element rather than keeping an
   // empty one.
   ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, 5, 2)));
-  EXPECT_TRUE(wb.sheet(0).auto_filter_xml().empty());
+  EXPECT_TRUE(io::auto_filter_xml(wb.sheet(0).auto_filter()).empty());
 }
 
 TEST(StructuralEditMatrix, InsertColsKeepsASingleCellAutoFilterRefSingleCell) {
   Workbook wb = Workbook::create();
-  wb.sheet(0).set_auto_filter_xml("<autoFilter ref=\"D6\"/>");
+  wb.sheet(0).set_auto_filter(io::auto_filter_from_xml("<autoFilter ref=\"D6\"/>"));
 
   // A one-cell `ref` is written without the `:` form, and stays that way.
   ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, 1, 2)));
-  EXPECT_EQ(wb.sheet(0).auto_filter_xml(), "<autoFilter ref=\"F6\"/>");
+  EXPECT_EQ(io::auto_filter_xml(wb.sheet(0).auto_filter()), "<autoFilter ref=\"F6\"/>");
 }
 
 TEST(StructuralEditMatrix, EditsLeaveAnUnparsableAutoFilterRefAlone) {
@@ -552,10 +648,10 @@ TEST(StructuralEditMatrix, EditsLeaveAnUnparsableAutoFilterRefAlone) {
   // A `ref` this layer cannot decode is retained verbatim rather than
   // rewritten from a guess.
   const std::string original = "<autoFilter ref=\"Sheet1!D6:E7\"/>";
-  wb.sheet(0).set_auto_filter_xml(original);
+  wb.sheet(0).set_auto_filter(io::auto_filter_from_xml(original));
 
   ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 1, 1)));
-  EXPECT_EQ(wb.sheet(0).auto_filter_xml(), original);
+  EXPECT_EQ(io::auto_filter_xml(wb.sheet(0).auto_filter()), original);
 }
 
 // The worksheet `<extLst>` is retained verbatim, but its x14 ranges and
@@ -845,6 +941,122 @@ TEST(StructuralEditMatrix, PivotWorksheetSourceRefShiftsOnRowInsert) {
   EXPECT_EQ(wb.pivot_caches()[0]->worksheet_source().sheet, "Sheet1");
 }
 
+TEST(StructuralEditMatrix, UnownedMetadataDoesNotBorrowFirstSheetTransform) {
+  for (const bool rows : {false, true}) {
+    for (const bool insert : {false, true}) {
+      SCOPED_TRACE(std::string(rows ? "rows" : "cols") + (insert ? " insert" : " delete"));
+      Workbook wb = MakeCrossSheetWorkbookWithUnownedSources();
+      if (rows) {
+        ASSERT_TRUE(static_cast<bool>(insert ? wb.insert_rows(0, kEditOrigin, kEditCount)
+                                             : wb.delete_rows(0, kEditOrigin, kEditCount)));
+      } else {
+        ASSERT_TRUE(static_cast<bool>(insert ? wb.insert_cols(0, kEditOrigin, kEditCount)
+                                             : wb.delete_cols(0, kEditOrigin, kEditCount)));
+      }
+
+      const std::string local_ref = rows ? (insert ? "$D$7:$D$8" : "$D$5:$D$6") : (insert ? "$E$6:$E$7" : "$C$6:$C$7");
+      const std::string qualified_ref = rows ? (insert ? "Sheet1!$D$7:$D$8" : "Sheet1!$D$5:$D$6")
+                                             : (insert ? "Sheet1!$E$6:$E$7" : "Sheet1!$C$6:$C$7");
+
+      ASSERT_EQ(wb.pivot_caches().size(), 4U);
+      ASSERT_NE(wb.pivot_caches()[0], nullptr);
+      ASSERT_NE(wb.pivot_caches()[1], nullptr);
+      ASSERT_NE(wb.pivot_caches()[2], nullptr);
+      ASSERT_NE(wb.pivot_caches()[3], nullptr);
+      EXPECT_EQ(wb.pivot_caches()[0]->worksheet_source().ref, local_ref);
+      EXPECT_EQ(wb.pivot_caches()[1]->worksheet_source().ref, "$D$6:$D$7")
+          << "a source on a missing sheet has no safe local owner";
+      EXPECT_EQ(wb.pivot_caches()[2]->worksheet_source().ref, qualified_ref)
+          << "a qualified source still follows Sheet1 even without worksheetSource/@sheet";
+      EXPECT_EQ(wb.pivot_caches()[3]->worksheet_source().ref, "$D$6:$D$7")
+          << "a valid source on Sheet2 is outside the edited sheet";
+
+      ASSERT_EQ(wb.tables().size(), 3U);
+      EXPECT_EQ(wb.tables()[0].ref, rows ? (insert ? "D7:D8" : "D5:D6") : (insert ? "E6:E7" : "C6:C7"));
+      EXPECT_EQ(wb.tables()[1].ref, "A1:B2");
+      EXPECT_EQ(wb.tables()[2].ref, "D6:D7") << "a table whose sheet index is outside the workbook has no local owner";
+      EXPECT_EQ(wb.tables()[2].columns[0].calculated_column_formula,
+                rows ? (insert ? "Sheet1!D7*2" : "Sheet1!D5*2") : (insert ? "Sheet1!E6*2" : "Sheet1!C6*2"));
+    }
+  }
+}
+
+TEST(StructuralEditMatrix, DefinedNamesUseTheirOwningSheetTransform) {
+  const auto run_case = [](const bool rows, const bool deletion) {
+    SCOPED_TRACE(std::string(rows ? "rows" : "cols") + (deletion ? " delete" : " insert"));
+    Workbook wb = MakeDefinedNameOwnerWorkbook();
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    const Cell* initial_local = wb.sheet(0).cell_at(0, 2);
+    const Cell* initial_other_local = wb.sheet(1).cell_at(0, 2);
+    const Cell* initial_other_qualified = wb.sheet(1).cell_at(0, 3);
+    ASSERT_NE(initial_local, nullptr);
+    ASSERT_NE(initial_other_local, nullptr);
+    ASSERT_NE(initial_other_qualified, nullptr);
+    ASSERT_TRUE(initial_local->cached_value.is_number());
+    ASSERT_TRUE(initial_other_local->cached_value.is_number());
+    ASSERT_TRUE(initial_other_qualified->cached_value.is_number());
+    EXPECT_DOUBLE_EQ(initial_local->cached_value.as_number(), 7.0);
+    EXPECT_DOUBLE_EQ(initial_other_local->cached_value.as_number(), 11.0);
+    EXPECT_DOUBLE_EQ(initial_other_qualified->cached_value.as_number(), 7.0);
+
+    if (rows) {
+      ASSERT_TRUE(static_cast<bool>(deletion ? wb.delete_rows(0, 0, 1) : wb.insert_rows(0, 0, 1)));
+    } else {
+      ASSERT_TRUE(static_cast<bool>(deletion ? wb.delete_cols(0, 0, 1) : wb.insert_cols(0, 0, 1)));
+    }
+
+    const std::string local_formula = deletion ? "#REF!" : (rows ? "$A$2" : "$B$1");
+    const std::string qualified_formula = deletion ? "#REF!" : (rows ? "Sheet1!$A$2" : "Sheet1!$B$1");
+    const std::string unchanged_formula = "$A$1";
+    ASSERT_EQ(wb.defined_names().size(), 7U);
+    EXPECT_EQ(wb.defined_names()[0].formula, local_formula);
+    EXPECT_EQ(wb.defined_names()[1].formula, unchanged_formula)
+        << "an unqualified name owned by Sheet2 is outside a Sheet1 edit";
+    EXPECT_EQ(wb.defined_names()[2].formula, qualified_formula)
+        << "a qualified reference follows Sheet1 even when owned by Sheet2";
+    EXPECT_EQ(wb.defined_names()[3].formula, qualified_formula)
+        << "a global name uses the explicit qualified-only fallback";
+    EXPECT_EQ(wb.defined_names()[4].formula, qualified_formula)
+        << "an invalid owner uses the explicit qualified-only fallback";
+    EXPECT_EQ(wb.defined_names()[5].formula, unchanged_formula)
+        << "a global unqualified name has no sheet owner to edit";
+    EXPECT_EQ(wb.defined_names()[6].formula, unchanged_formula)
+        << "an invalid owner cannot make an unqualified name local";
+
+    const std::uint32_t surviving_local_row = rows ? (deletion ? 0U : 1U) : 0U;
+    const std::uint32_t surviving_local_col = rows ? 2U : (deletion ? 1U : 3U);
+    const Cell* local_result = wb.sheet(0).cell_at(surviving_local_row, surviving_local_col);
+    ASSERT_NE(local_result, nullptr);
+    ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+    if (deletion) {
+      ASSERT_TRUE(local_result->cached_value.is_error());
+      EXPECT_EQ(local_result->cached_value.as_error(), ErrorCode::Ref);
+    } else {
+      ASSERT_TRUE(local_result->cached_value.is_number());
+      EXPECT_DOUBLE_EQ(local_result->cached_value.as_number(), 7.0);
+    }
+    const Cell* other_local_result = wb.sheet(1).cell_at(0, 2);
+    ASSERT_NE(other_local_result, nullptr);
+    ASSERT_TRUE(other_local_result->cached_value.is_number());
+    EXPECT_DOUBLE_EQ(other_local_result->cached_value.as_number(), 11.0);
+    const Cell* qualified_result = wb.sheet(1).cell_at(0, 3);
+    ASSERT_NE(qualified_result, nullptr);
+    if (deletion) {
+      ASSERT_TRUE(qualified_result->cached_value.is_error());
+      EXPECT_EQ(qualified_result->cached_value.as_error(), ErrorCode::Ref);
+    } else {
+      ASSERT_TRUE(qualified_result->cached_value.is_number());
+      EXPECT_DOUBLE_EQ(qualified_result->cached_value.as_number(), 7.0);
+    }
+  };
+
+  for (const bool rows : {false, true}) {
+    for (const bool deletion : {false, true}) {
+      run_case(rows, deletion);
+    }
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Spill regions
 // ---------------------------------------------------------------------------
diff --git a/tests/integration/workbook_iterative_test.cpp b/tests/integration/workbook_iterative_test.cpp
index 86b623461..ef8676e4c 100644
--- a/tests/integration/workbook_iterative_test.cpp
+++ b/tests/integration/workbook_iterative_test.cpp
@@ -23,6 +23,7 @@
 #include "eval/function_registry.h"
 #include "eval/iterative_solver.h"
 #include "eval/recalc_engine.h"
+#include "eval/scheduler.h"
 #include "gtest/gtest.h"
 #include "sheet.h"
 #include "value.h"
@@ -62,6 +63,167 @@ TEST(WorkbookIterative, DefaultDisabledStillSurfacesRefForCycle) {
   EXPECT_EQ(b1.as_error(), ErrorCode::Ref);
 }
 
+TEST(WorkbookIterative, ChangingOptionsInvalidatesCachedCycleResults) {
+  // A self-referential averaging formula converges to 2 only when iterative
+  // calculation is enabled. Changing the workbook option must therefore
+  // re-run the already-cached cycle in both directions.
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=(A1+2)/2")));
+
+  auto disabled_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(disabled_stats));
+  EXPECT_EQ(disabled_stats.value().cycle_cells, 1U);
+  Value a1 = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(a1.is_error());
+  EXPECT_EQ(a1.as_error(), ErrorCode::Ref);
+
+  IterativeOptions enabled;
+  enabled.enabled = true;
+  enabled.max_iterations = 100U;
+  enabled.max_change = 1e-9;
+  wb.set_iterative_options(enabled);
+
+  auto enabled_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(enabled_stats));
+  EXPECT_EQ(enabled_stats.value().iterative_cells, 1U);
+  EXPECT_EQ(enabled_stats.value().cycle_cells, 0U);
+  a1 = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(a1.is_number());
+  EXPECT_NEAR(a1.as_number(), 2.0, 1e-9);
+
+  // Re-applying the effective options is a no-op and must not cause a
+  // needless formula evaluation on the next pass.
+  wb.set_iterative_options(enabled);
+  auto no_op_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(no_op_stats));
+  EXPECT_EQ(no_op_stats.value().cells_evaluated, 0U);
+  EXPECT_EQ(no_op_stats.value().iterative_cells, 0U);
+  EXPECT_EQ(no_op_stats.value().cycle_cells, 0U);
+
+  // A numeric option change is also a recalculation boundary. One allowed
+  // sweep cannot meet the tolerance from the cached 2.0 seed, so the
+  // cycle remains unresolved while retaining its numeric approximation.
+  enabled.max_iterations = 1U;
+  wb.set_iterative_options(enabled);
+  auto budget_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(budget_stats));
+  EXPECT_EQ(budget_stats.value().cycle_cells, 1U);
+  EXPECT_EQ(budget_stats.value().iterative_cells, 0U);
+  a1 = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(a1.is_number());
+  EXPECT_NEAR(a1.as_number(), 2.0, 1e-9);
+
+  enabled.enabled = false;
+  wb.set_iterative_options(enabled);
+  auto disabled_again_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(disabled_again_stats));
+  EXPECT_EQ(disabled_again_stats.value().cycle_cells, 1U);
+  EXPECT_EQ(disabled_again_stats.value().iterative_cells, 0U);
+  a1 = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(a1.is_error());
+  EXPECT_EQ(a1.as_error(), ErrorCode::Ref);
+}
+
+TEST(WorkbookIterative, EnablingIterationPreservesIndependentRefUntilRecalc) {
+  // A1 is an ordinary formula whose #REF! is genuine. B1 is an independent
+  // circular formula that should be re-seeded only when its SCC is actually
+  // evaluated. Enabling the option dirties both formulas, but must not erase
+  // either cached result before the caller chooses a recalc scope.
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=#REF!")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=(B1+2)/2")));
+
+  auto disabled_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(disabled_stats));
+  EXPECT_EQ(disabled_stats.value().cycle_cells, 1U);
+  const Value disabled_a1 = StoredValue(wb, 0U, 0U, 0U);
+  const Value disabled_b1 = StoredValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(disabled_a1.is_error()) << "A1 kind=" << static_cast<int>(disabled_a1.kind());
+  ASSERT_TRUE(disabled_b1.is_error()) << "B1 kind=" << static_cast<int>(disabled_b1.kind());
+  EXPECT_EQ(disabled_a1.as_error(), ErrorCode::Ref);
+  EXPECT_EQ(disabled_b1.as_error(), ErrorCode::Ref);
+
+  IterativeOptions enabled;
+  enabled.enabled = true;
+  enabled.max_iterations = 100U;
+  enabled.max_change = 1e-9;
+  wb.set_iterative_options(enabled);
+
+  // This is the regression witness: changing an option must not globally
+  // rewrite cached #REF! values before the subsequent recalc.
+  const Value cached_a1 = StoredValue(wb, 0U, 0U, 0U);
+  const Value cached_b1 = StoredValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(cached_a1.is_error()) << "A1 kind=" << static_cast<int>(cached_a1.kind());
+  ASSERT_TRUE(cached_b1.is_error()) << "B1 kind=" << static_cast<int>(cached_b1.kind());
+  EXPECT_EQ(cached_a1.as_error(), ErrorCode::Ref);
+  EXPECT_EQ(cached_b1.as_error(), ErrorCode::Ref);
+
+  eval::SheetCellRange b1;
+  b1.sheet_id = 0U;
+  b1.first_row = 0U;
+  b1.last_row = 0U;
+  b1.first_col = 1U;
+  b1.last_col = 1U;
+  auto partial_stats = wb.partial_recalc(eval::default_registry(), b1);
+  ASSERT_TRUE(static_cast<bool>(partial_stats));
+  EXPECT_EQ(partial_stats.value().iterative_cells, 1U);
+  ASSERT_TRUE(StoredValue(wb, 0U, 0U, 1U).is_number());
+  EXPECT_NEAR(StoredValue(wb, 0U, 0U, 1U).as_number(), 2.0, 1e-9);
+  // A1 was outside the partial viewport and remains both the genuine error
+  // value and dirty for the next full pass.
+  const Value partial_a1 = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(partial_a1.is_error()) << "A1 kind=" << static_cast<int>(partial_a1.kind());
+  EXPECT_EQ(partial_a1.as_error(), ErrorCode::Ref);
+
+  auto full_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(full_stats));
+  EXPECT_EQ(full_stats.value().cells_evaluated, 1U);
+  const Value full_a1 = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(full_a1.is_error()) << "A1 kind=" << static_cast<int>(full_a1.kind());
+  EXPECT_EQ(full_a1.as_error(), ErrorCode::Ref);
+  ASSERT_TRUE(StoredValue(wb, 0U, 0U, 1U).is_number());
+  EXPECT_NEAR(StoredValue(wb, 0U, 0U, 1U).as_number(), 2.0, 1e-9);
+}
+
+TEST(WorkbookIterative, EnablingIterationPreservesIndependentRefOnParallelRecalc) {
+  // Keep the same two independent formula shapes on the parallel entry point
+  // so option toggling cannot diverge between the serial and worker paths.
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=#REF!")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=(B1+2)/2")));
+
+  eval::SchedulerConfig cfg;
+  cfg.num_threads = 2U;
+  auto disabled_stats = wb.recalc_parallel(eval::default_registry(), cfg, nullptr);
+  ASSERT_TRUE(static_cast<bool>(disabled_stats));
+  const Value disabled_a1 = StoredValue(wb, 0U, 0U, 0U);
+  const Value disabled_b1 = StoredValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(disabled_a1.is_error()) << "A1 kind=" << static_cast<int>(disabled_a1.kind());
+  ASSERT_TRUE(disabled_b1.is_error()) << "B1 kind=" << static_cast<int>(disabled_b1.kind());
+  EXPECT_EQ(disabled_a1.as_error(), ErrorCode::Ref);
+  EXPECT_EQ(disabled_b1.as_error(), ErrorCode::Ref);
+
+  IterativeOptions enabled;
+  enabled.enabled = true;
+  enabled.max_iterations = 100U;
+  enabled.max_change = 1e-9;
+  wb.set_iterative_options(enabled);
+  const Value cached_a1 = StoredValue(wb, 0U, 0U, 0U);
+  const Value cached_b1 = StoredValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(cached_a1.is_error()) << "A1 kind=" << static_cast<int>(cached_a1.kind());
+  ASSERT_TRUE(cached_b1.is_error()) << "B1 kind=" << static_cast<int>(cached_b1.kind());
+  EXPECT_EQ(cached_a1.as_error(), ErrorCode::Ref);
+  EXPECT_EQ(cached_b1.as_error(), ErrorCode::Ref);
+
+  auto enabled_stats = wb.recalc_parallel(eval::default_registry(), cfg, nullptr);
+  ASSERT_TRUE(static_cast<bool>(enabled_stats));
+  const Value full_a1 = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(full_a1.is_error()) << "A1 kind=" << static_cast<int>(full_a1.kind());
+  EXPECT_EQ(full_a1.as_error(), ErrorCode::Ref);
+  ASSERT_TRUE(StoredValue(wb, 0U, 0U, 1U).is_number());
+  EXPECT_NEAR(StoredValue(wb, 0U, 0U, 1U).as_number(), 2.0, 1e-9);
+}
+
 TEST(WorkbookIterative, EnabledIdentityCycleObservedBehaviour) {
   // `=A1+1` and `=B1-1`-style "non-fixed-point" identity cycle:
   // A1 = B1 + 1, B1 = A1 - 1. Substituting into either equation yields
@@ -260,5 +422,55 @@ TEST(WorkbookIterative, OptionsClampTheIterationBudgetOnTheWayIn) {
   EXPECT_EQ(wb.iterative_options().max_iterations, 0U);
 }
 
+TEST(WorkbookIterative, GenuineRefFromEnabledSolveSeedsTheNextSolve) {
+  // A #REF! produced by an enabled solve is a real value, so the next solve
+  // seeds from it (IFERROR -> 0, ending at 99), not from the blank seed
+  // reserved for a #REF! left behind by a disabled-iteration cycle.
+  Workbook wb = Workbook::create();
+  IterativeOptions enabled;
+  enabled.enabled = true;
+  enabled.max_iterations = 100U;
+  enabled.max_change = 1e-9;
+  wb.set_iterative_options(enabled);
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::boolean(true))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=IF(B1,#REF!,IFERROR(A1+1,0))")));
+
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value first = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(first.is_error());
+  EXPECT_EQ(first.as_error(), ErrorCode::Ref);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::boolean(false))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Value second = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(second.is_number()) << second.debug_to_string();
+  EXPECT_DOUBLE_EQ(second.as_number(), 99.0);
+}
+
+TEST(WorkbookIterative, GenuineRefFromEnabledSolveSeedsTheNextParallelSolve) {
+  // Parallel-scheduler counterpart of the serial test above.
+  eval::SchedulerConfig cfg;
+  cfg.num_threads = 2U;
+  Workbook wb = Workbook::create();
+  IterativeOptions enabled;
+  enabled.enabled = true;
+  enabled.max_iterations = 100U;
+  enabled.max_change = 1e-9;
+  wb.set_iterative_options(enabled);
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::boolean(true))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=IF(B1,#REF!,IFERROR(A1+1,0))")));
+
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(eval::default_registry(), cfg, nullptr)));
+  const Value first = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(first.is_error());
+  EXPECT_EQ(first.as_error(), ErrorCode::Ref);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::boolean(false))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc_parallel(eval::default_registry(), cfg, nullptr)));
+  const Value second = StoredValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(second.is_number()) << second.debug_to_string();
+  EXPECT_DOUBLE_EQ(second.as_number(), 99.0);
+}
+
 }  // namespace
 }  // namespace formulon
diff --git a/tests/oracle/CMakeLists.txt b/tests/oracle/CMakeLists.txt
index 880a4aa7d..aa7938c50 100644
--- a/tests/oracle/CMakeLists.txt
+++ b/tests/oracle/CMakeLists.txt
@@ -12,6 +12,7 @@ set(FORMULON_ORACLE_TEST_SOURCES
   oracle_anchor.cpp
   oracle_runner.cpp
   oracle_test.cpp
+  oracle_skip_registry_test.cpp
 )
 
 add_executable(formulon_oracle_tests ${FORMULON_ORACLE_TEST_SOURCES})
@@ -391,6 +392,8 @@ if(FORMULON_ORACLE_VARIANTS)
     oracle_runner.cpp
     roundtrip_authoring.cpp
     workbook_builder.cpp
+    workbook_builder_pivot.cpp
+    workbook_builder_print.cpp
     workbook_oracle_runner.cpp
     workbook_oracle_test.cpp
   )
@@ -522,6 +525,8 @@ add_executable(formulon_workbook_oracle_tests
   oracle_runner.cpp
   roundtrip_authoring.cpp
   workbook_builder.cpp
+  workbook_builder_pivot.cpp
+  workbook_builder_print.cpp
   workbook_oracle_runner.cpp
   workbook_oracle_test.cpp
 )
@@ -610,6 +615,8 @@ add_executable(formulon_workbook_builder_test
   json_reader.cpp
   oracle_runner.cpp
   workbook_builder.cpp
+  workbook_builder_pivot.cpp
+  workbook_builder_print.cpp
   workbook_builder_test.cpp
 )
 
@@ -702,6 +709,15 @@ if(Python3_Interpreter_FOUND)
     WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
   )
   set_tests_properties(formulon_divergence_projection_unit PROPERTIES LABELS "oracle;oracle-metadata")
+  # The DataBar / IconSet match payloads are computed from documented
+  # semantics rather than captured, so this is the only check on them that
+  # does not need Excel.
+  add_test(
+    NAME formulon_cf_visual_semantics_unit
+    COMMAND ${_formulon_oracle_python} -m unittest tools.oracle.cf_visual_semantics_test
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+  )
+  set_tests_properties(formulon_cf_visual_semantics_unit PROPERTIES LABELS "oracle;oracle-metadata")
   # This entry covers the spec and address handling only. The suite's
   # authoring half needs the Formulon Python binding, which the oracle
   # venv does not install -- it carries the capture dependencies (PyYAML,
diff --git a/tests/oracle/cases/aggregate.yaml b/tests/oracle/cases/aggregate.yaml
index 7cac3c76e..bc8ae84f1 100644
--- a/tests/oracle/cases/aggregate.yaml
+++ b/tests/oracle/cases/aggregate.yaml
@@ -165,3 +165,244 @@ cases:
     description: "options=8 — outside [0,7] -> #VALUE!"
     setup: { A1: 10, A2: 20, A3: 30 }
     formula: "=AGGREGATE(9, 8, A1:A3)"
+
+  # -- Nested SUBTOTAL / AGGREGATE bit (options 0..3 exclude, 4..7 keep) --------
+  - id: aggregate_nested_fn9_opt0
+    description: "AGGREGATE(9,0) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(9,0,A1:A11)"
+
+  - id: aggregate_nested_fn9_opt1
+    description: "AGGREGATE(9,1) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(9,1,A1:A11)"
+
+  - id: aggregate_nested_fn9_opt2
+    description: "AGGREGATE(9,2) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(9,2,A1:A11)"
+
+  - id: aggregate_nested_fn9_opt3
+    description: "AGGREGATE(9,3) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(9,3,A1:A11)"
+
+  - id: aggregate_nested_fn9_opt4
+    description: "AGGREGATE(9,4) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(9,4,A1:A11)"
+
+  - id: aggregate_nested_fn9_opt5
+    description: "AGGREGATE(9,5) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(9,5,A1:A11)"
+
+  - id: aggregate_nested_fn9_opt6
+    description: "AGGREGATE(9,6) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(9,6,A1:A11)"
+
+  - id: aggregate_nested_fn9_opt7
+    description: "AGGREGATE(9,7) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(9,7,A1:A11)"
+
+  - id: aggregate_nested_fn1_opt0
+    description: "AGGREGATE(1,0) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(1,0,A1:A11)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_fn1_opt1
+    description: "AGGREGATE(1,1) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(1,1,A1:A11)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_fn1_opt2
+    description: "AGGREGATE(1,2) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(1,2,A1:A11)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_fn1_opt3
+    description: "AGGREGATE(1,3) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(1,3,A1:A11)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_fn1_opt4
+    description: "AGGREGATE(1,4) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(1,4,A1:A11)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_fn1_opt5
+    description: "AGGREGATE(1,5) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(1,5,A1:A11)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_fn1_opt6
+    description: "AGGREGATE(1,6) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(1,6,A1:A11)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_fn1_opt7
+    description: "AGGREGATE(1,7) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(1,7,A1:A11)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_fn4_opt0
+    description: "AGGREGATE(4,0) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(4,0,A1:A11)"
+
+  - id: aggregate_nested_fn4_opt1
+    description: "AGGREGATE(4,1) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(4,1,A1:A11)"
+
+  - id: aggregate_nested_fn4_opt2
+    description: "AGGREGATE(4,2) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(4,2,A1:A11)"
+
+  - id: aggregate_nested_fn4_opt3
+    description: "AGGREGATE(4,3) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(4,3,A1:A11)"
+
+  - id: aggregate_nested_fn4_opt4
+    description: "AGGREGATE(4,4) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(4,4,A1:A11)"
+
+  - id: aggregate_nested_fn4_opt5
+    description: "AGGREGATE(4,5) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(4,5,A1:A11)"
+
+  - id: aggregate_nested_fn4_opt6
+    description: "AGGREGATE(4,6) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(4,6,A1:A11)"
+
+  - id: aggregate_nested_fn4_opt7
+    description: "AGGREGATE(4,7) over the nested marker mask"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(4,7,A1:A11)"
+
+  - id: aggregate_nested_small_opt0_k1
+    description: "array form SMALL (15), options 0, k=1"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,0,A1:A11,1)"
+
+  - id: aggregate_nested_small_opt0_k2
+    description: "array form SMALL (15), options 0, k=2"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,0,A1:A11,2)"
+
+  - id: aggregate_nested_small_opt1_k1
+    description: "array form SMALL (15), options 1, k=1"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,1,A1:A11,1)"
+
+  - id: aggregate_nested_small_opt1_k2
+    description: "array form SMALL (15), options 1, k=2"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,1,A1:A11,2)"
+
+  - id: aggregate_nested_small_opt2_k1
+    description: "array form SMALL (15), options 2, k=1"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,2,A1:A11,1)"
+
+  - id: aggregate_nested_small_opt2_k2
+    description: "array form SMALL (15), options 2, k=2"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,2,A1:A11,2)"
+
+  - id: aggregate_nested_small_opt3_k1
+    description: "array form SMALL (15), options 3, k=1"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,3,A1:A11,1)"
+
+  - id: aggregate_nested_small_opt3_k2
+    description: "array form SMALL (15), options 3, k=2"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,3,A1:A11,2)"
+
+  - id: aggregate_nested_small_opt4_k1
+    description: "array form SMALL (15), options 4, k=1"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,4,A1:A11,1)"
+
+  - id: aggregate_nested_small_opt4_k2
+    description: "array form SMALL (15), options 4, k=2"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,4,A1:A11,2)"
+
+  - id: aggregate_nested_small_opt5_k1
+    description: "array form SMALL (15), options 5, k=1"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,5,A1:A11,1)"
+
+  - id: aggregate_nested_small_opt5_k2
+    description: "array form SMALL (15), options 5, k=2"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,5,A1:A11,2)"
+
+  - id: aggregate_nested_small_opt6_k1
+    description: "array form SMALL (15), options 6, k=1"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,6,A1:A11,1)"
+
+  - id: aggregate_nested_small_opt6_k2
+    description: "array form SMALL (15), options 6, k=2"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,6,A1:A11,2)"
+
+  - id: aggregate_nested_small_opt7_k1
+    description: "array form SMALL (15), options 7, k=1"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,7,A1:A11,1)"
+
+  - id: aggregate_nested_small_opt7_k2
+    description: "array form SMALL (15), options 7, k=2"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=AGGREGATE(15,7,A1:A11,2)"
+
+  - id: aggregate_nested_report_block_fn1_opt0
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=AGGREGATE(1,0,A20:A26)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_report_block_fn9_opt0
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=AGGREGATE(9,0,A20:A26)"
+
+  - id: aggregate_nested_report_block_fn1_opt4
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=AGGREGATE(1,4,A20:A26)"
+    tolerance: { abs: 1.0e-4, rel: 1.0e-6 }
+
+  - id: aggregate_nested_report_block_fn9_opt4
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=AGGREGATE(9,4,A20:A26)"
+
+  - id: aggregate_nested_spill_anchor_opt0
+    description: "spill whose anchor holds SUBTOTAL"
+    setup: { X10: 512, C1: "=SUBTOTAL(9,X10)+SEQUENCE(3)*0" }
+    formula: "=AGGREGATE(9,0,C1:C3)"
+
+  - id: aggregate_nested_spill_anchor_opt4
+    description: "spill whose anchor holds SUBTOTAL"
+    setup: { X10: 512, C1: "=SUBTOTAL(9,X10)+SEQUENCE(3)*0" }
+    formula: "=AGGREGATE(9,4,C1:C3)"
diff --git a/tests/oracle/cases/subtotal.yaml b/tests/oracle/cases/subtotal.yaml
index 3ad962824..37dfbe1b1 100644
--- a/tests/oracle/cases/subtotal.yaml
+++ b/tests/oracle/cases/subtotal.yaml
@@ -32,3 +32,139 @@ cases:
     description: "code outside 1..11 / 101..111 -> #VALUE!"
     setup: { A1: 10, A2: 20, A3: 30 }
     formula: "=SUBTOTAL(99,A1:A3)"
+
+  # -- Nested SUBTOTAL / AGGREGATE exclusion --------------------------------
+  - id: subtotal_nested_candidate_plain_subtotal
+    description: "outer SUBTOTAL(9) over one cell that is itself SUBTOTAL(9,..): excluded"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)" }
+    formula: "=SUBTOTAL(9,A1)"
+
+  - id: subtotal_nested_candidate_let_wrapped
+    description: "candidate cell =LET(x,SUBTOTAL(9,X1),x) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=LET(x,SUBTOTAL(9,X1),x)" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_lambda_call
+    description: "candidate cell =LAMBDA(r,SUBTOTAL(9,r))(X1) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=LAMBDA(r,SUBTOTAL(9,r))(X1)" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_lowercase
+    description: "candidate cell =subtotal(9,X1) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=subtotal(9,X1)" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_code_109
+    description: "candidate cell =SUBTOTAL(109,X1) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=SUBTOTAL(109,X1)" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_sumproduct_offset
+    description: "candidate cell =SUMPRODUCT(SUBTOTAL(9,OFFSET(X1,0,0,1,1))) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=SUMPRODUCT(SUBTOTAL(9,OFFSET(X1,0,0,1,1)))" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_aggregate_0
+    description: "candidate cell =AGGREGATE(9,0,X1) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=AGGREGATE(9,0,X1)" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_aggregate_4
+    description: "candidate cell =AGGREGATE(9,4,X1) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=AGGREGATE(9,4,X1)" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_dead_if_branch
+    description: "candidate cell =IF(1,256,AGGREGATE(9,0,X1)) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=IF(1,256,AGGREGATE(9,0,X1))" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_string_literal_only
+    description: "candidate cell =IF(1,64,SUBTOTAL(9)) as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=IF(1,64,\"SUBTOTAL(9)\")" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_pointer_cell
+    description: "candidate cell =A1*32 as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=A1*32" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_candidate_indirect_pointer
+    description: "candidate cell =INDIRECT(A1)*1024 as the only cell of SUBTOTAL(9,A2)"
+    setup: { X1: 1, A1: "=SUBTOTAL(9,X1)", A2: "=INDIRECT(\"A1\")*1024" }
+    formula: "=SUBTOTAL(9,A2)"
+
+  - id: subtotal_nested_marker_mask_1
+    description: "nine nested-shaped cells among two plain ones; SUBTOTAL(1) over A1:A11"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=SUBTOTAL(1,A1:A11)"
+
+  - id: subtotal_nested_marker_mask_9
+    description: "nine nested-shaped cells among two plain ones; SUBTOTAL(9) over A1:A11"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=SUBTOTAL(9,A1:A11)"
+
+  - id: subtotal_nested_marker_mask_101
+    description: "nine nested-shaped cells among two plain ones; SUBTOTAL(101) over A1:A11"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=SUBTOTAL(101,A1:A11)"
+
+  - id: subtotal_nested_marker_mask_109
+    description: "nine nested-shaped cells among two plain ones; SUBTOTAL(109) over A1:A11"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=SUBTOTAL(109,A1:A11)"
+
+  - id: subtotal_nested_marker_mask_2
+    description: "nine nested-shaped cells among two plain ones; SUBTOTAL(2) over A1:A11"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=SUBTOTAL(2,A1:A11)"
+
+  - id: subtotal_nested_marker_mask_3
+    description: "nine nested-shaped cells among two plain ones; SUBTOTAL(3) over A1:A11"
+    setup: { A1: 1000, A2: 2000, X1: 1, X2: 2, X3: 4, X4: 8, X5: 16, X8: 128, X9: 256, A3: "=SUBTOTAL(9,X1)", A4: "=0+SUBTOTAL(9,X2)", A5: "=X3", A6: "=LET(x,SUBTOTAL(9,X4),x)", A7: "=AGGREGATE(9,0,X5)", A8: "=A3*32", A9: "=IF(1,64,\"SUBTOTAL(9)\")", A10: "=IF(TRUE,SUBTOTAL(9,X8),0)", A11: "=IF(1,256,AGGREGATE(9,0,X9))" }
+    formula: "=SUBTOTAL(3,A1:A11)"
+
+  - id: subtotal_nested_report_block_9
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=SUBTOTAL(9,A20:A26)"
+
+  - id: subtotal_nested_report_block_1
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=SUBTOTAL(1,A20:A26)"
+
+  - id: subtotal_nested_report_block_2
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=SUBTOTAL(2,A20:A26)"
+
+  - id: subtotal_nested_report_block_3
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=SUBTOTAL(3,A20:A26)"
+
+  - id: subtotal_nested_report_block_109
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=SUBTOTAL(109,A20:A26)"
+
+  - id: subtotal_nested_report_block_101
+    description: "report block with two subtotal rows"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=SUBTOTAL(101,A20:A26)"
+
+  - id: subtotal_nested_spill_anchor_9
+    description: "every cell of a spill whose anchor holds SUBTOTAL is excluded"
+    setup: { X10: 512, C1: "=SUBTOTAL(9,X10)+SEQUENCE(3)*0" }
+    formula: "=SUBTOTAL(9,C1:C3)"
+
+  - id: subtotal_nested_spill_anchor_109
+    description: "every cell of a spill whose anchor holds SUBTOTAL is excluded"
+    setup: { X10: 512, C1: "=SUBTOTAL(9,X10)+SEQUENCE(3)*0" }
+    formula: "=SUBTOTAL(109,C1:C3)"
+
+  - id: subtotal_nested_whole_column
+    description: "whole-column reference over the report block"
+    setup: { A20: 100, A21: 200, A22: 300, A23: "=SUBTOTAL(9,A20:A22)", A24: 400, A25: 500, A26: "=SUBTOTAL(9,A24:A25)" }
+    formula: "=SUBTOTAL(9,A:A)"
diff --git a/tests/oracle/cases/text_format_display.yaml b/tests/oracle/cases/text_format_display.yaml
new file mode 100644
index 000000000..6d1ff7143
--- /dev/null
+++ b/tests/oracle/cases/text_format_display.yaml
@@ -0,0 +1,31 @@
+suite: text_format_display
+description: TEXT() renderings that match cell display text (fraction padding, DBNum General, serial 0 dates, era format)
+tolerance: { abs: 0.0, rel: 0.0 }
+locale: ja-JP
+cases:
+  - id: text_fraction_pad_0
+    formula: "=TEXT(0, \"# ?/?\")"
+  - id: text_fraction_pad_2
+    formula: "=TEXT(2, \"# ?/?\")"
+  - id: text_fraction_pad_59
+    formula: "=TEXT(59, \"# ?/?\")"
+  - id: text_fraction_pad_123456789
+    formula: "=TEXT(123456789, \"# ?/?\")"
+  - id: text_dbnum1_general_1234
+    formula: "=TEXT(1234, \"[DBNum1]G/標準\")"
+  - id: text_dbnum1_general_1234_5678
+    formula: "=TEXT(1234.5678, \"[DBNum1]G/標準\")"
+  - id: text_dbnum1_general_1e15
+    formula: "=TEXT(1E+15, \"[DBNum1]G/標準\")"
+  - id: text_date_ymd_serial_0
+    formula: "=TEXT(0, \"yyyy/m/d\")"
+  - id: text_date_era_serial_0
+    formula: "=TEXT(0, \"ggge\"\"年\"\"m\"\"月\"\"d\"\"日\"\"\")"
+  - id: text_date_ymd_serial_half
+    formula: "=TEXT(0.5, \"yyyy/m/d\")"
+  - id: text_date_era_serial_half
+    formula: "=TEXT(0.5, \"ggge\"\"年\"\"m\"\"月\"\"d\"\"日\"\"\")"
+  - id: text_date_ymd_serial_tiny
+    formula: "=TEXT(0.00001, \"yyyy/m/d\")"
+  - id: text_date_era_serial_tiny
+    formula: "=TEXT(0.00001, \"ggge\"\"年\"\"m\"\"月\"\"d\"\"日\"\"\")"
diff --git a/tests/oracle/cases/text_format_display_1904.yaml b/tests/oracle/cases/text_format_display_1904.yaml
new file mode 100644
index 000000000..eb27d593f
--- /dev/null
+++ b/tests/oracle/cases/text_format_display_1904.yaml
@@ -0,0 +1,40 @@
+suite: text_format_display_1904
+description: TEXT() of negative serials under the 1904 date system
+tolerance: { abs: 0.0, rel: 0.0 }
+locale: ja-JP
+options:
+  date1904: true
+  iterative: false
+cases:
+  - id: text1904_ymd_m1
+    formula: "=TEXT(-1, \"yyyy/m/d\")"
+  - id: text1904_hms_m1
+    formula: "=TEXT(-1, \"h:mm:ss\")"
+  - id: text1904_elapsed_m1
+    formula: "=TEXT(-1, \"[h]:mm\")"
+  - id: text1904_weekday_m1
+    formula: "=TEXT(-1, \"aaaa\")"
+  - id: text1904_ymd_m1_5
+    formula: "=TEXT(-1.5, \"yyyy/m/d\")"
+  - id: text1904_hms_m1_5
+    formula: "=TEXT(-1.5, \"h:mm:ss\")"
+  - id: text1904_elapsed_m1_5
+    formula: "=TEXT(-1.5, \"[h]:mm\")"
+  - id: text1904_weekday_m1_5
+    formula: "=TEXT(-1.5, \"aaaa\")"
+  - id: text1904_ymd_m1462
+    formula: "=TEXT(-1462, \"yyyy/m/d\")"
+  - id: text1904_hms_m1462
+    formula: "=TEXT(-1462, \"h:mm:ss\")"
+  - id: text1904_elapsed_m1462
+    formula: "=TEXT(-1462, \"[h]:mm\")"
+  - id: text1904_weekday_m1462
+    formula: "=TEXT(-1462, \"aaaa\")"
+  - id: text1904_ymd_m2957003
+    formula: "=TEXT(-2957003, \"yyyy/m/d\")"
+  - id: text1904_hms_m2957003
+    formula: "=TEXT(-2957003, \"h:mm:ss\")"
+  - id: text1904_elapsed_m2957003
+    formula: "=TEXT(-2957003, \"[h]:mm\")"
+  - id: text1904_weekday_m2957003
+    formula: "=TEXT(-2957003, \"aaaa\")"
diff --git a/tests/oracle/golden/aggregate.golden.json b/tests/oracle/golden/aggregate.golden.json
index 9b4d968f8..048358ee5 100644
--- a/tests/oracle/golden/aggregate.golden.json
+++ b/tests/oracle/golden/aggregate.golden.json
@@ -2,11 +2,11 @@
   "suite": "aggregate",
   "description": "SUM / AVERAGE / MIN / MAX / PRODUCT with direct args, ranges, and coercion edge cases",
   "environment": {
-    "excel_version": "16.112",
+    "excel_version": "16.113.3",
     "excel_locale": "ja-JP",
     "date1904": false,
     "iterative": false,
-    "generated_at": "2026-08-13T00:16:13Z"
+    "generated_at": "2026-10-05T10:02:44Z"
   },
   "tolerance": {
     "abs": 1e-12,
@@ -654,6 +654,3514 @@
         "kind": "error",
         "code": "#VALUE!"
       }
+    },
+    {
+      "id": "aggregate_nested_fn9_opt0",
+      "formula": "=AGGREGATE(9,0,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3100.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn9_opt1",
+      "formula": "=AGGREGATE(9,1,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3100.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn9_opt2",
+      "formula": "=AGGREGATE(9,2,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3100.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn9_opt3",
+      "formula": "=AGGREGATE(9,3,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3100.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn9_opt4",
+      "formula": "=AGGREGATE(9,4,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3511.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn9_opt5",
+      "formula": "=AGGREGATE(9,5,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3511.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn9_opt6",
+      "formula": "=AGGREGATE(9,6,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3511.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn9_opt7",
+      "formula": "=AGGREGATE(9,7,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3511.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn1_opt0",
+      "formula": "=AGGREGATE(1,0,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 620.0
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_fn1_opt1",
+      "formula": "=AGGREGATE(1,1,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 620.0
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_fn1_opt2",
+      "formula": "=AGGREGATE(1,2,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 620.0
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_fn1_opt3",
+      "formula": "=AGGREGATE(1,3,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 620.0
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_fn1_opt4",
+      "formula": "=AGGREGATE(1,4,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 319.1818181818182
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_fn1_opt5",
+      "formula": "=AGGREGATE(1,5,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 319.1818181818182
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_fn1_opt6",
+      "formula": "=AGGREGATE(1,6,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 319.1818181818182
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_fn1_opt7",
+      "formula": "=AGGREGATE(1,7,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 319.1818181818182
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_fn4_opt0",
+      "formula": "=AGGREGATE(4,0,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn4_opt1",
+      "formula": "=AGGREGATE(4,1,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn4_opt2",
+      "formula": "=AGGREGATE(4,2,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn4_opt3",
+      "formula": "=AGGREGATE(4,3,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn4_opt4",
+      "formula": "=AGGREGATE(4,4,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn4_opt5",
+      "formula": "=AGGREGATE(4,5,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn4_opt6",
+      "formula": "=AGGREGATE(4,6,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_fn4_opt7",
+      "formula": "=AGGREGATE(4,7,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt0_k1",
+      "formula": "=AGGREGATE(15,0,A1:A11,1)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 4.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt0_k2",
+      "formula": "=AGGREGATE(15,0,A1:A11,2)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 32.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt1_k1",
+      "formula": "=AGGREGATE(15,1,A1:A11,1)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 4.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt1_k2",
+      "formula": "=AGGREGATE(15,1,A1:A11,2)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 32.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt2_k1",
+      "formula": "=AGGREGATE(15,2,A1:A11,1)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 4.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt2_k2",
+      "formula": "=AGGREGATE(15,2,A1:A11,2)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 32.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt3_k1",
+      "formula": "=AGGREGATE(15,3,A1:A11,1)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 4.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt3_k2",
+      "formula": "=AGGREGATE(15,3,A1:A11,2)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 32.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt4_k1",
+      "formula": "=AGGREGATE(15,4,A1:A11,1)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt4_k2",
+      "formula": "=AGGREGATE(15,4,A1:A11,2)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt5_k1",
+      "formula": "=AGGREGATE(15,5,A1:A11,1)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt5_k2",
+      "formula": "=AGGREGATE(15,5,A1:A11,2)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt6_k1",
+      "formula": "=AGGREGATE(15,6,A1:A11,1)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt6_k2",
+      "formula": "=AGGREGATE(15,6,A1:A11,2)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt7_k1",
+      "formula": "=AGGREGATE(15,7,A1:A11,1)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1.0
+      }
+    },
+    {
+      "id": "aggregate_nested_small_opt7_k2",
+      "formula": "=AGGREGATE(15,7,A1:A11,2)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 2.0
+      }
+    },
+    {
+      "id": "aggregate_nested_report_block_fn1_opt0",
+      "formula": "=AGGREGATE(1,0,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 300.0
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_report_block_fn9_opt0",
+      "formula": "=AGGREGATE(9,0,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1500.0
+      }
+    },
+    {
+      "id": "aggregate_nested_report_block_fn1_opt4",
+      "formula": "=AGGREGATE(1,4,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 428.57142857142856
+      },
+      "tolerance": {
+        "abs": 0.0001,
+        "rel": 1e-06
+      }
+    },
+    {
+      "id": "aggregate_nested_report_block_fn9_opt4",
+      "formula": "=AGGREGATE(9,4,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3000.0
+      }
+    },
+    {
+      "id": "aggregate_nested_spill_anchor_opt0",
+      "formula": "=AGGREGATE(9,0,C1:C3)",
+      "setup": {
+        "X10": {
+          "kind": "number",
+          "value": 512.0
+        },
+        "C1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X10)+SEQUENCE(3)*0"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "aggregate_nested_spill_anchor_opt4",
+      "formula": "=AGGREGATE(9,4,C1:C3)",
+      "setup": {
+        "X10": {
+          "kind": "number",
+          "value": 512.0
+        },
+        "C1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X10)+SEQUENCE(3)*0"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1536.0
+      }
     }
   ]
 }
diff --git a/tests/oracle/golden/subtotal.golden.json b/tests/oracle/golden/subtotal.golden.json
index 28fe97085..af761a3fd 100644
--- a/tests/oracle/golden/subtotal.golden.json
+++ b/tests/oracle/golden/subtotal.golden.json
@@ -2,11 +2,11 @@
   "suite": "subtotal",
   "description": "SUBTOTAL is a function-code-driven aggregator. Codes 1-11 dispatch to AVERAGE / COUNT / COUNTA / MAX / MIN / PRODUCT / STDEV / STDEVP / SUM / VAR / VARP, including hidden rows. Codes 101-111 dispatch to the same aggregators but exclude rows hidden via row-level hiding (column-hide and filter-hide are handled separately). Invalid codes -> #VALUE!.\n",
   "environment": {
-    "excel_version": "16.112",
+    "excel_version": "16.113.3",
     "excel_locale": "ja-JP",
     "date1904": false,
     "iterative": false,
-    "generated_at": "2026-08-13T01:07:04Z"
+    "generated_at": "2026-10-05T10:02:08Z"
   },
   "tolerance": {
     "abs": 0.0,
@@ -138,6 +138,1060 @@
         "kind": "error",
         "code": "#VALUE!"
       }
+    },
+    {
+      "id": "subtotal_nested_candidate_plain_subtotal",
+      "formula": "=SUBTOTAL(9,A1)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_let_wrapped",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X1),x)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_lambda_call",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=LAMBDA(r,SUBTOTAL(9,r))(X1)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_lowercase",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=subtotal(9,X1)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_code_109",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(109,X1)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_sumproduct_offset",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=SUMPRODUCT(SUBTOTAL(9,OFFSET(X1,0,0,1,1)))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_aggregate_0",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X1)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_aggregate_4",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,4,X1)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_dead_if_branch",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X1))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_string_literal_only",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 64.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_pointer_cell",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=A1*32"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 32.0
+      }
+    },
+    {
+      "id": "subtotal_nested_candidate_indirect_pointer",
+      "formula": "=SUBTOTAL(9,A2)",
+      "setup": {
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "A1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A2": {
+          "kind": "formula",
+          "formula": "=INDIRECT(\"A1\")*1024"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1024.0
+      }
+    },
+    {
+      "id": "subtotal_nested_marker_mask_1",
+      "formula": "=SUBTOTAL(1,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 620.0
+      }
+    },
+    {
+      "id": "subtotal_nested_marker_mask_9",
+      "formula": "=SUBTOTAL(9,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3100.0
+      }
+    },
+    {
+      "id": "subtotal_nested_marker_mask_101",
+      "formula": "=SUBTOTAL(101,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 620.0
+      }
+    },
+    {
+      "id": "subtotal_nested_marker_mask_109",
+      "formula": "=SUBTOTAL(109,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 3100.0
+      }
+    },
+    {
+      "id": "subtotal_nested_marker_mask_2",
+      "formula": "=SUBTOTAL(2,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 5.0
+      }
+    },
+    {
+      "id": "subtotal_nested_marker_mask_3",
+      "formula": "=SUBTOTAL(3,A1:A11)",
+      "setup": {
+        "A1": {
+          "kind": "number",
+          "value": 1000.0
+        },
+        "A2": {
+          "kind": "number",
+          "value": 2000.0
+        },
+        "X1": {
+          "kind": "number",
+          "value": 1.0
+        },
+        "X2": {
+          "kind": "number",
+          "value": 2.0
+        },
+        "X3": {
+          "kind": "number",
+          "value": 4.0
+        },
+        "X4": {
+          "kind": "number",
+          "value": 8.0
+        },
+        "X5": {
+          "kind": "number",
+          "value": 16.0
+        },
+        "X8": {
+          "kind": "number",
+          "value": 128.0
+        },
+        "X9": {
+          "kind": "number",
+          "value": 256.0
+        },
+        "A3": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X1)"
+        },
+        "A4": {
+          "kind": "formula",
+          "formula": "=0+SUBTOTAL(9,X2)"
+        },
+        "A5": {
+          "kind": "formula",
+          "formula": "=X3"
+        },
+        "A6": {
+          "kind": "formula",
+          "formula": "=LET(x,SUBTOTAL(9,X4),x)"
+        },
+        "A7": {
+          "kind": "formula",
+          "formula": "=AGGREGATE(9,0,X5)"
+        },
+        "A8": {
+          "kind": "formula",
+          "formula": "=A3*32"
+        },
+        "A9": {
+          "kind": "formula",
+          "formula": "=IF(1,64,\"SUBTOTAL(9)\")"
+        },
+        "A10": {
+          "kind": "formula",
+          "formula": "=IF(TRUE,SUBTOTAL(9,X8),0)"
+        },
+        "A11": {
+          "kind": "formula",
+          "formula": "=IF(1,256,AGGREGATE(9,0,X9))"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 5.0
+      }
+    },
+    {
+      "id": "subtotal_nested_report_block_9",
+      "formula": "=SUBTOTAL(9,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1500.0
+      }
+    },
+    {
+      "id": "subtotal_nested_report_block_1",
+      "formula": "=SUBTOTAL(1,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 300.0
+      }
+    },
+    {
+      "id": "subtotal_nested_report_block_2",
+      "formula": "=SUBTOTAL(2,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 5.0
+      }
+    },
+    {
+      "id": "subtotal_nested_report_block_3",
+      "formula": "=SUBTOTAL(3,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 5.0
+      }
+    },
+    {
+      "id": "subtotal_nested_report_block_109",
+      "formula": "=SUBTOTAL(109,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1500.0
+      }
+    },
+    {
+      "id": "subtotal_nested_report_block_101",
+      "formula": "=SUBTOTAL(101,A20:A26)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 300.0
+      }
+    },
+    {
+      "id": "subtotal_nested_spill_anchor_9",
+      "formula": "=SUBTOTAL(9,C1:C3)",
+      "setup": {
+        "X10": {
+          "kind": "number",
+          "value": 512.0
+        },
+        "C1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X10)+SEQUENCE(3)*0"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_spill_anchor_109",
+      "formula": "=SUBTOTAL(109,C1:C3)",
+      "setup": {
+        "X10": {
+          "kind": "number",
+          "value": 512.0
+        },
+        "C1": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,X10)+SEQUENCE(3)*0"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 0.0
+      }
+    },
+    {
+      "id": "subtotal_nested_whole_column",
+      "formula": "=SUBTOTAL(9,A:A)",
+      "setup": {
+        "A20": {
+          "kind": "number",
+          "value": 100.0
+        },
+        "A21": {
+          "kind": "number",
+          "value": 200.0
+        },
+        "A22": {
+          "kind": "number",
+          "value": 300.0
+        },
+        "A23": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A20:A22)"
+        },
+        "A24": {
+          "kind": "number",
+          "value": 400.0
+        },
+        "A25": {
+          "kind": "number",
+          "value": 500.0
+        },
+        "A26": {
+          "kind": "formula",
+          "formula": "=SUBTOTAL(9,A24:A25)"
+        }
+      },
+      "expect": {
+        "kind": "number",
+        "value": 1500.0
+      }
     }
   ]
 }
diff --git a/tests/oracle/golden/text_format_display.golden.json b/tests/oracle/golden/text_format_display.golden.json
new file mode 100644
index 000000000..a331688a8
--- /dev/null
+++ b/tests/oracle/golden/text_format_display.golden.json
@@ -0,0 +1,134 @@
+{
+  "suite": "text_format_display",
+  "description": "TEXT() renderings that match cell display text (fraction padding, DBNum General, serial 0 dates, era format)",
+  "environment": {
+    "excel_version": "16.113.3",
+    "excel_locale": "ja-JP",
+    "date1904": false,
+    "iterative": false,
+    "generated_at": "2026-10-05T10:48:20Z"
+  },
+  "tolerance": {
+    "abs": 0.0,
+    "rel": 0.0
+  },
+  "cases": [
+    {
+      "id": "text_fraction_pad_0",
+      "formula": "=TEXT(0, \"# ?/?\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "0    "
+      }
+    },
+    {
+      "id": "text_fraction_pad_2",
+      "formula": "=TEXT(2, \"# ?/?\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "2    "
+      }
+    },
+    {
+      "id": "text_fraction_pad_59",
+      "formula": "=TEXT(59, \"# ?/?\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "59    "
+      }
+    },
+    {
+      "id": "text_fraction_pad_123456789",
+      "formula": "=TEXT(123456789, \"# ?/?\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "123456789    "
+      }
+    },
+    {
+      "id": "text_dbnum1_general_1234",
+      "formula": "=TEXT(1234, \"[DBNum1]G/標準\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "千二百三十四"
+      }
+    },
+    {
+      "id": "text_dbnum1_general_1234_5678",
+      "formula": "=TEXT(1234.5678, \"[DBNum1]G/標準\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "千二百三十四.五六七八"
+      }
+    },
+    {
+      "id": "text_dbnum1_general_1e15",
+      "formula": "=TEXT(1E+15, \"[DBNum1]G/標準\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "千兆"
+      }
+    },
+    {
+      "id": "text_date_ymd_serial_0",
+      "formula": "=TEXT(0, \"yyyy/m/d\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "1900/1/0"
+      }
+    },
+    {
+      "id": "text_date_era_serial_0",
+      "formula": "=TEXT(0, \"ggge\"\"年\"\"m\"\"月\"\"d\"\"日\"\"\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "明治33年1月0日"
+      }
+    },
+    {
+      "id": "text_date_ymd_serial_half",
+      "formula": "=TEXT(0.5, \"yyyy/m/d\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "1900/1/0"
+      }
+    },
+    {
+      "id": "text_date_era_serial_half",
+      "formula": "=TEXT(0.5, \"ggge\"\"年\"\"m\"\"月\"\"d\"\"日\"\"\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "明治33年1月0日"
+      }
+    },
+    {
+      "id": "text_date_ymd_serial_tiny",
+      "formula": "=TEXT(0.00001, \"yyyy/m/d\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "1900/1/0"
+      }
+    },
+    {
+      "id": "text_date_era_serial_tiny",
+      "formula": "=TEXT(0.00001, \"ggge\"\"年\"\"m\"\"月\"\"d\"\"日\"\"\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "明治33年1月0日"
+      }
+    }
+  ]
+}
diff --git a/tests/oracle/golden/text_format_display_1904.golden.json b/tests/oracle/golden/text_format_display_1904.golden.json
new file mode 100644
index 000000000..47caa2c51
--- /dev/null
+++ b/tests/oracle/golden/text_format_display_1904.golden.json
@@ -0,0 +1,161 @@
+{
+  "suite": "text_format_display_1904",
+  "description": "TEXT() of negative serials under the 1904 date system",
+  "environment": {
+    "excel_version": "16.113.3",
+    "excel_locale": "ja-JP",
+    "date1904": true,
+    "iterative": false,
+    "generated_at": "2026-10-05T10:48:30Z"
+  },
+  "tolerance": {
+    "abs": 0.0,
+    "rel": 0.0
+  },
+  "cases": [
+    {
+      "id": "text1904_ymd_m1",
+      "formula": "=TEXT(-1, \"yyyy/m/d\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-1904/1/2"
+      }
+    },
+    {
+      "id": "text1904_hms_m1",
+      "formula": "=TEXT(-1, \"h:mm:ss\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-0:00:00"
+      }
+    },
+    {
+      "id": "text1904_elapsed_m1",
+      "formula": "=TEXT(-1, \"[h]:mm\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-24:00"
+      }
+    },
+    {
+      "id": "text1904_weekday_m1",
+      "formula": "=TEXT(-1, \"aaaa\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-土曜日"
+      }
+    },
+    {
+      "id": "text1904_ymd_m1_5",
+      "formula": "=TEXT(-1.5, \"yyyy/m/d\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-1904/1/2"
+      }
+    },
+    {
+      "id": "text1904_hms_m1_5",
+      "formula": "=TEXT(-1.5, \"h:mm:ss\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-12:00:00"
+      }
+    },
+    {
+      "id": "text1904_elapsed_m1_5",
+      "formula": "=TEXT(-1.5, \"[h]:mm\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-36:00"
+      }
+    },
+    {
+      "id": "text1904_weekday_m1_5",
+      "formula": "=TEXT(-1.5, \"aaaa\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-土曜日"
+      }
+    },
+    {
+      "id": "text1904_ymd_m1462",
+      "formula": "=TEXT(-1462, \"yyyy/m/d\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-1908/1/2"
+      }
+    },
+    {
+      "id": "text1904_hms_m1462",
+      "formula": "=TEXT(-1462, \"h:mm:ss\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-0:00:00"
+      }
+    },
+    {
+      "id": "text1904_elapsed_m1462",
+      "formula": "=TEXT(-1462, \"[h]:mm\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-35088:00"
+      }
+    },
+    {
+      "id": "text1904_weekday_m1462",
+      "formula": "=TEXT(-1462, \"aaaa\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-木曜日"
+      }
+    },
+    {
+      "id": "text1904_ymd_m2957003",
+      "formula": "=TEXT(-2957003, \"yyyy/m/d\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-9999/12/31"
+      }
+    },
+    {
+      "id": "text1904_hms_m2957003",
+      "formula": "=TEXT(-2957003, \"h:mm:ss\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-0:00:00"
+      }
+    },
+    {
+      "id": "text1904_elapsed_m2957003",
+      "formula": "=TEXT(-2957003, \"[h]:mm\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-70968072:00"
+      }
+    },
+    {
+      "id": "text1904_weekday_m2957003",
+      "formula": "=TEXT(-2957003, \"aaaa\")",
+      "setup": {},
+      "expect": {
+        "kind": "text",
+        "value": "-金曜日"
+      }
+    }
+  ]
+}
diff --git a/tests/oracle/oracle_skip_registry_test.cpp b/tests/oracle/oracle_skip_registry_test.cpp
new file mode 100644
index 000000000..0084df576
--- /dev/null
+++ b/tests/oracle/oracle_skip_registry_test.cpp
@@ -0,0 +1,95 @@
+#include <filesystem>
+#include <fstream>
+#include <map>
+#include <random>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "tests/oracle/oracle_runner.h"
+
+namespace formulon {
+namespace tests {
+namespace oracle {
+namespace {
+
+// ---------------------------------------------------------------------------
+// Divergence registry
+// ---------------------------------------------------------------------------
+
+// Creates an empty scratch directory for one test's throwaway golden.
+//
+// The name carries a random token because these tests are linked into more
+// than one oracle binary (the primary and the IronCalc one) and CTest may
+// run those concurrently: a fixed path would let one run delete the other's
+// fixture mid-read.
+std::filesystem::path make_scratch_dir(const std::string& label) {
+  std::error_code ec;
+  std::random_device entropy;
+  const std::filesystem::path dir =
+      std::filesystem::temp_directory_path(ec) / ("formulon_oracle_" + label + "_" + std::to_string(entropy()));
+  std::filesystem::remove_all(dir, ec);
+  std::filesystem::create_directories(dir, ec);
+  return dir;
+}
+
+// A case the registry names is skipped even though its golden says nothing
+// about the skip -- which is the state of every golden captured before the
+// divergence was adjudicated. Without this the entry would only take effect
+// once someone with an Excel host re-ran the capture, so the case would stay
+// red on every other machine in the meantime.
+TEST(OracleSkipRegistry, SkipsAGoldenCapturedBeforeTheEntryWasAdjudicated) {
+  const std::map<std::string, std::string>& registry = oracle_skip_registry();
+  if (registry.empty()) {
+    GTEST_SKIP() << "no divergence projection is wired into this build (FORMULON_ORACLE_SKIP_FILE)";
+  }
+  const std::string& case_id = registry.begin()->first;
+  const std::string& reason = registry.begin()->second;
+
+  const std::filesystem::path dir = make_scratch_dir("skip_registry");
+  std::error_code ec;
+  ASSERT_TRUE(std::filesystem::is_directory(dir, ec)) << dir.string();
+
+  {
+    // Deliberately no `"skipped"` field, and an `expect` the engine cannot
+    // satisfy: if the registry were not consulted the case would be
+    // verified, and fail.
+    std::ofstream out(dir / "skip_registry_probe.golden.json");
+    ASSERT_TRUE(out.good());
+    out << "{\"suite\": \"skip_registry_probe\", \"cases\": [{\"id\": \"" << case_id
+        << "\", \"formula\": \"=1\", \"expect\": {\"kind\": \"number\", \"value\": 2}}]}\n";
+  }
+
+  const std::vector<OracleCase> cases = load_oracle_cases(dir.string());
+  ASSERT_EQ(cases.size(), 1U);
+  EXPECT_EQ(cases[0].case_id, case_id);
+  EXPECT_EQ(cases[0].skipped_reason, reason);
+
+  std::filesystem::remove_all(dir, ec);
+}
+
+// The baked field still wins for goldens that carry one, and it is what a
+// case with no registry entry relies on.
+TEST(OracleSkipRegistry, BakedSkippedFieldIsHonouredOnItsOwn) {
+  const std::filesystem::path dir = make_scratch_dir("baked_skip");
+  std::error_code ec;
+  ASSERT_TRUE(std::filesystem::is_directory(dir, ec)) << dir.string();
+
+  {
+    std::ofstream out(dir / "baked_probe.golden.json");
+    ASSERT_TRUE(out.good());
+    out << "{\"suite\": \"baked_probe\", \"cases\": [{\"id\": \"baked_probe_case\", "
+           "\"skipped\": \"captured with the skip already baked in\"}]}\n";
+  }
+
+  const std::vector<OracleCase> cases = load_oracle_cases(dir.string());
+  ASSERT_EQ(cases.size(), 1U);
+  EXPECT_EQ(cases[0].skipped_reason, "captured with the skip already baked in");
+
+  std::filesystem::remove_all(dir, ec);
+}
+
+}  // namespace
+}  // namespace oracle
+}  // namespace tests
+}  // namespace formulon
diff --git a/tests/oracle/oracle_test.cpp b/tests/oracle/oracle_test.cpp
index adf390f13..a064ae17d 100644
--- a/tests/oracle/oracle_test.cpp
+++ b/tests/oracle/oracle_test.cpp
@@ -1,669 +1,29 @@
-//
 // Parameterized gtest that verifies Formulon's tree-walk evaluator against
 // golden JSON files produced by the xlwings-driven oracle-gen pipeline.
 //
-// Each parameter is an (suite, case_id) pair loaded via
-// `oracle_runner::load_oracle_cases` from `tests/oracle/golden/*.golden.json`.
-// The build wires the directory through the compile-time define
-// `FORMULON_ORACLE_GOLDEN_DIR`. When the directory is empty (the expected
-// state before oracle-gen has been run on a Mac) the parameter vector is
-// empty and gtest registers the suite with zero instantiations, so the
-// build stays green.
-//
-// Divergences are intentionally reported as test failures here: the
-// accepted-divergence policy lives in `tests/divergence.yaml` and is
-// consulted by the Python generator (it can skip or widen tolerance) — the
-// C++ side verifies what the goldens actually commit to.
+// Fixture, parameter-name formatter, instantiation, and the configured
+// directory guard stay in this translation unit so every oracle target keeps
+// the same registration topology. Comparison/setup/provider helpers live in
+// oracle_test_support.h.
 
-#include <cctype>
-#include <cmath>
-#include <cstdint>
-#include <cstdlib>
 #include <filesystem>
 #include <fstream>
-#include <iterator>
 #include <map>
 #include <random>
 #include <string>
-#include <string_view>
-#include <utility>
-#include <vector>
 
-#include "eval/eval_context.h"
-#include "eval/eval_state.h"
-#include "eval/function_registry.h"
-#include "eval/iterative_solver.h"
-#include "eval/tree_walker.h"
-#include "excel_profile.h"
 #include "gtest/gtest.h"
-#include "parser/ast.h"
-#include "parser/parser.h"
-#include "sheet.h"
-#include "tests/oracle/json_reader.h"
-#include "tests/oracle/oracle_anchor.h"
-#include "tests/oracle/oracle_runner.h"
-#include "utils/arena.h"
-#include "utils/error.h"
-#include "value.h"
-#include "workbook.h"
+#include "tests/oracle/oracle_test_support.h"
 
 namespace formulon {
 namespace tests {
 namespace oracle {
 namespace {
 
+using namespace support;
 using formulon::parser::AstNode;
 using formulon::parser::Parser;
 
-struct SetupFormulaCell {
-  std::size_t sheet_index = 0;
-  std::uint32_t row = 0;
-  std::uint32_t col = 0;
-  std::string formula;
-};
-
-// Maps the golden JSON's `"#DIV/0!"` style display name to the matching
-// ErrorCode enum. Returns `false` on an unknown code.
-bool display_name_to_code(std::string_view name, ErrorCode* out) {
-  struct Entry {
-    std::string_view display;
-    ErrorCode code;
-  };
-  static constexpr Entry kTable[] = {
-      {"#NULL!", ErrorCode::Null},
-      {"#DIV/0!", ErrorCode::Div0},
-      {"#VALUE!", ErrorCode::Value},
-      {"#REF!", ErrorCode::Ref},
-      {"#NAME?", ErrorCode::Name},
-      {"#NUM!", ErrorCode::Num},
-      {"#N/A", ErrorCode::NA},
-      {"#SPILL!", ErrorCode::Spill},
-      {"#CALC!", ErrorCode::Calc},
-      {"#FIELD!", ErrorCode::Field},
-      {"#BLOCKED!", ErrorCode::Blocked},
-      {"#CONNECT!", ErrorCode::Connect},
-      {"#EXTERNAL!", ErrorCode::External},
-      {"#BUSY!", ErrorCode::Busy},
-      {"#PYTHON!", ErrorCode::Python},
-      {"#UNKNOWN!", ErrorCode::Unknown},
-  };
-  for (const auto& e : kTable) {
-    if (e.display == name) {
-      *out = e.code;
-      return true;
-    }
-  }
-  return false;
-}
-
-// Applies a single {kind, value} JSON record to a cell. Returns nullptr on
-// success or a short error string on failure (unknown kind, missing value,
-// etc.) that the caller folds into the test failure message.
-const char* apply_cell_value(const JsonValue& spec, Sheet& sheet, std::uint32_t row, std::uint32_t col,
-                             Arena& text_arena) {
-  if (!spec.is_object())
-    return "setup cell is not an object";
-  const JsonValue* kind_v = spec.find("kind");
-  if (kind_v == nullptr || !kind_v->is_string())
-    return "missing 'kind'";
-  const std::string& kind = kind_v->as_string();
-
-  if (kind == "formula") {
-    const JsonValue* f = spec.find("formula");
-    if (f == nullptr || !f->is_string())
-      return "formula cell missing 'formula'";
-    sheet.set_cell_formula(row, col, f->as_string());
-    return nullptr;
-  }
-
-  const JsonValue* val_v = spec.find("value");
-  if (kind == "blank") {
-    // Nothing to do: absence from storage already means blank.
-    return nullptr;
-  }
-  if (kind == "number") {
-    if (val_v == nullptr || !val_v->is_number())
-      return "number missing 'value'";
-    sheet.set_cell_value(row, col, Value::number(val_v->as_number()));
-    return nullptr;
-  }
-  if (kind == "bool") {
-    if (val_v == nullptr || !val_v->is_bool())
-      return "bool missing 'value'";
-    sheet.set_cell_value(row, col, Value::boolean(val_v->as_bool()));
-    return nullptr;
-  }
-  if (kind == "text") {
-    if (val_v == nullptr || !val_v->is_string())
-      return "text missing 'value'";
-    // Intern the string into the arena so the Value's string_view remains
-    // valid for the lifetime of the test.
-    const std::string& payload = val_v->as_string();
-    std::string_view view = text_arena.intern(payload);
-    sheet.set_cell_value(row, col, Value::text(view));
-    return nullptr;
-  }
-  if (kind == "error") {
-    const JsonValue* code_v = spec.find("code");
-    if (code_v == nullptr || !code_v->is_string())
-      return "error missing 'code'";
-    ErrorCode code;
-    if (!display_name_to_code(code_v->as_string(), &code)) {
-      return "error has unknown 'code'";
-    }
-    sheet.set_cell_value(row, col, Value::error(code));
-    return nullptr;
-  }
-  return "setup cell has unknown 'kind'";
-}
-
-// Applies the optional case-level `merges` list emitted by oracle_gen. The
-// formula drivers use Excel's inclusive A1 range syntax; keep the native
-// verifier on the same representation and normalise transposed corners just
-// as the C API merge surface does.
-const char* apply_merge_ranges(const JsonValue& spec, Sheet& sheet) {
-  if (!spec.is_array()) {
-    return "case 'merges' is not an array";
-  }
-  for (const JsonValue& item : spec.as_array()) {
-    if (!item.is_string() || item.as_string().empty()) {
-      return "merge range is not a non-empty A1 string";
-    }
-    const std::string& ref = item.as_string();
-    const std::size_t separator = ref.find(':');
-    if (separator != std::string::npos && ref.find(':', separator + 1U) != std::string::npos) {
-      return "merge range contains more than one ':'";
-    }
-    const std::string first_ref = ref.substr(0, separator);
-    const std::string last_ref = separator == std::string::npos ? first_ref : ref.substr(separator + 1U);
-    std::uint32_t first_row = 0;
-    std::uint32_t first_col = 0;
-    std::uint32_t last_row = 0;
-    std::uint32_t last_col = 0;
-    if (!a1_to_row_col(first_ref, &first_row, &first_col) || !a1_to_row_col(last_ref, &last_row, &last_col)) {
-      return "merge range contains an invalid A1 address";
-    }
-    if (first_row > last_row) {
-      const std::uint32_t tmp = first_row;
-      first_row = last_row;
-      last_row = tmp;
-    }
-    if (first_col > last_col) {
-      const std::uint32_t tmp = first_col;
-      first_col = last_col;
-      last_col = tmp;
-    }
-    sheet.mutable_merges().push_back(MergeRange{first_row, first_col, last_row, last_col});
-  }
-  return nullptr;
-}
-
-// Renders a Formulon Value as a short display string for assertion failure
-// messages. Mirrors the debug_to_string helper but keeps error / text
-// formatting consistent with the JSON schema.
-std::string format_value(const Value& v) {
-  switch (v.kind()) {
-    case ValueKind::Blank:
-      return "blank";
-    case ValueKind::Number:
-      return "number(" + std::to_string(v.as_number()) + ")";
-    case ValueKind::Bool:
-      return v.as_boolean() ? "bool(TRUE)" : "bool(FALSE)";
-    case ValueKind::Text:
-      return std::string("text(\"") + std::string(v.as_text()) + "\")";
-    case ValueKind::Error:
-      return std::string("error(") + display_name(v.as_error()) + ")";
-    case ValueKind::Array:
-      return "array(" + std::to_string(v.as_array_rows()) + "x" + std::to_string(v.as_array_cols()) + ")";
-    default:
-      return "<unsupported>";
-  }
-}
-
-/// Result of parsing an Excel complex-number text representation.
-///
-/// Excel complex numbers are formatted as `<real><sign><imag><suffix>` (or
-/// `<real>` alone, or `<sign><imag><suffix>` alone), where `<suffix>` is
-/// `i` or `j`. See `parse_excel_complex` for the precise grammar.
-struct ParsedComplex {
-  double real = 0.0;
-  double imag = 0.0;
-  bool ok = false;
-};
-
-/// Parses an Excel complex-number text into its real and imaginary parts.
-///
-/// Recognised shapes:
-///   `"3"`                                 -> {3, 0}
-///   `"4i"`                                -> {0, 4}
-///   `"i"`                                 -> {0, 1}
-///   `"-i"`                                -> {0, -1}
-///   `"-2.5+i"`                            -> {-2.5, 1}
-///   `"0.62-0.30i"`                        -> {0.62, -0.30}
-///   `"1.0e-3+2.5e+10i"`                   -> {1.0e-3, 2.5e10}
-///
-/// The split between real and imaginary parts is the LAST `+` or `-` in the
-/// trimmed string that is neither at position 0 (a leading sign on the real
-/// part) nor immediately after `e` / `E` (a scientific-notation exponent
-/// sign).
-ParsedComplex parse_excel_complex(std::string_view s) {
-  ParsedComplex out;
-  if (s.empty())
-    return out;
-
-  // Strip the imaginary suffix, if any. Excel uses `i`; Formulon currently
-  // only emits `i`, but accept `j` for symmetry with the SUFFIX argument
-  // family of IM* functions.
-  bool has_imag = false;
-  std::string_view body = s;
-  const char last = body.back();
-  if (last == 'i' || last == 'j') {
-    has_imag = true;
-    body.remove_suffix(1);
-  }
-
-  // Locate the split between real and imaginary parts.
-  std::size_t split = std::string_view::npos;
-  for (std::size_t i = body.size(); i-- > 0;) {
-    const char c = body[i];
-    if (c != '+' && c != '-')
-      continue;
-    if (i == 0)
-      break;  // leading sign on the real part
-    const char prev = body[i - 1];
-    if (prev == 'e' || prev == 'E')
-      continue;  // exponent sign
-    split = i;
-    break;
-  }
-
-  const auto parse_double = [](std::string_view sv, double* out_d) {
-    if (sv.empty())
-      return false;
-    // strtod requires a NUL-terminated buffer; copy into a small std::string.
-    const std::string buf(sv);
-    const char* begin = buf.c_str();
-    char* end = nullptr;
-    const double v = std::strtod(begin, &end);
-    if (end != begin + buf.size())
-      return false;
-    *out_d = v;
-    return true;
-  };
-
-  if (split == std::string_view::npos) {
-    if (has_imag) {
-      // Whole trimmed body is the imaginary coefficient.
-      if (body.empty() || body == "+") {
-        out.imag = 1.0;
-      } else if (body == "-") {
-        out.imag = -1.0;
-      } else if (!parse_double(body, &out.imag)) {
-        return out;
-      }
-      out.real = 0.0;
-    } else {
-      if (!parse_double(body, &out.real))
-        return out;
-      out.imag = 0.0;
-    }
-    out.ok = true;
-    return out;
-  }
-
-  // Split present: there must be an imaginary suffix (otherwise we have a
-  // trailing sign with no `i`, which is malformed).
-  if (!has_imag)
-    return out;
-
-  const std::string_view real_part = body.substr(0, split);
-  const std::string_view imag_part = body.substr(split);  // includes sign
-  if (!parse_double(real_part, &out.real))
-    return out;
-  if (imag_part == "+") {
-    out.imag = 1.0;
-  } else if (imag_part == "-") {
-    out.imag = -1.0;
-  } else if (!parse_double(imag_part, &out.imag)) {
-    return out;
-  }
-  out.ok = true;
-  return out;
-}
-
-// Component-wise comparator for Excel complex-number text. Returns an empty
-// string on match (real and imag both within tolerance); otherwise a short
-// diagnostic that quotes both sides verbatim.
-std::string compare_complex_text(const std::string& want, const std::string& got, double tol_abs, double tol_rel) {
-  const auto wc = parse_excel_complex(want);
-  const auto gc = parse_excel_complex(got);
-  if (!wc.ok || !gc.ok) {
-    return "text mismatch (complex parse failed): expected \"" + want + "\", got \"" + got + "\"";
-  }
-  const auto component_ok = [&](double a, double b) {
-    const double diff = std::abs(a - b);
-    if (diff == 0.0)
-      return true;
-    if (tol_abs > 0.0 && diff <= tol_abs)
-      return true;
-    const double scale = std::max(std::abs(a), std::abs(b));
-    if (tol_rel > 0.0 && scale > 0.0 && diff / scale <= tol_rel)
-      return true;
-    return false;
-  };
-  if (component_ok(wc.real, gc.real) && component_ok(wc.imag, gc.imag)) {
-    return {};
-  }
-  return "complex mismatch (within text but components diverge): expected \"" + want + "\", got \"" + got + "\"";
-}
-
-bool parse_numeric_text(std::string_view text, double* out) {
-  std::string owned(text);
-  char* end = nullptr;
-  double value = std::strtod(owned.c_str(), &end);
-  if (end == owned.c_str()) {
-    return false;
-  }
-  while (*end != '\0') {
-    if (!std::isspace(static_cast<unsigned char>(*end))) {
-      return false;
-    }
-    ++end;
-  }
-  *out = value;
-  return true;
-}
-
-bool numbers_match(double want, double got, double tol_abs, double tol_rel) {
-  if (std::isnan(want) && std::isnan(got)) {
-    return true;
-  }
-  const double diff = std::abs(want - got);
-  if (diff == 0.0) {
-    return true;
-  }
-  if (tol_abs > 0.0 && diff <= tol_abs) {
-    return true;
-  }
-  const double scale = std::max(std::abs(want), std::abs(got));
-  return tol_rel > 0.0 && scale > 0.0 && diff / scale <= tol_rel;
-}
-
-std::string compare_value(const JsonValue& expect, const Value& raw_actual, double tol_abs, double tol_rel,
-                          std::string_view compare_mode);
-
-std::string compare_json_scalar(const JsonValue& expect, const Value& actual, double tol_abs, double tol_rel,
-                                std::string_view compare_mode) {
-  if (expect.is_null()) {
-    return actual.is_blank() ? std::string{} : "expected blank, got " + format_value(actual);
-  }
-  if (expect.is_number()) {
-    if (!actual.is_number())
-      return "expected number, got " + format_value(actual);
-    return numbers_match(expect.as_number(), actual.as_number(), tol_abs, tol_rel)
-               ? std::string{}
-               : "number mismatch: expected " + std::to_string(expect.as_number()) + ", got " +
-                     std::to_string(actual.as_number());
-  }
-  if (expect.is_bool()) {
-    if (!actual.is_boolean())
-      return "expected bool, got " + format_value(actual);
-    return actual.as_boolean() == expect.as_bool()
-               ? std::string{}
-               : std::string("bool mismatch: expected ") + (expect.as_bool() ? "TRUE" : "FALSE") + ", got " +
-                     (actual.as_boolean() ? "TRUE" : "FALSE");
-  }
-  if (expect.is_string()) {
-    if (!actual.is_text())
-      return "expected text, got " + format_value(actual);
-    if (expect.as_string() == actual.as_text())
-      return {};
-    if (compare_mode == "complex_text") {
-      return compare_complex_text(expect.as_string(), std::string(actual.as_text()), tol_abs, tol_rel);
-    }
-    return "text mismatch: expected \"" + expect.as_string() + "\", got \"" + std::string(actual.as_text()) + "\"";
-  }
-  if (expect.is_object()) {
-    return compare_value(expect, actual, tol_abs, tol_rel, compare_mode);
-  }
-  return "array golden cell is not scalar";
-}
-
-// Compares `actual` to the golden `expect` JSON record under the given
-// tolerance. Returns an empty string on match; otherwise a human-readable
-// diff message.
-//
-// `compare_mode` is "" or "exact" for the historical strict path, or a
-// structured comparator key (e.g. "complex_text") that selects an
-// alternative routine when the strict byte-equality check fails.
-std::string compare_value(const JsonValue& expect, const Value& raw_actual, double tol_abs, double tol_rel,
-                          std::string_view compare_mode) {
-  if (!expect.is_object())
-    return "golden 'expect' is not an object";
-  const JsonValue* kind_v = expect.find("kind");
-  if (kind_v == nullptr || !kind_v->is_string()) {
-    return "golden 'expect' missing 'kind'";
-  }
-  const std::string& kind = kind_v->as_string();
-
-  if (kind == "array") {
-    if (!raw_actual.is_array())
-      return "expected array, got " + format_value(raw_actual);
-    const JsonValue* shape_v = expect.find("shape");
-    if (shape_v == nullptr || !shape_v->is_array())
-      return "array golden missing 'shape'";
-    const auto& shape = shape_v->as_array();
-    if (shape.size() != 2 || !shape[0].is_number() || !shape[1].is_number())
-      return "array golden has invalid 'shape'";
-    const auto want_rows = static_cast<std::uint32_t>(shape[0].as_number());
-    const auto want_cols = static_cast<std::uint32_t>(shape[1].as_number());
-    if (raw_actual.as_array_rows() != want_rows || raw_actual.as_array_cols() != want_cols) {
-      return "array shape mismatch: expected " + std::to_string(want_rows) + "x" + std::to_string(want_cols) +
-             ", got " + std::to_string(raw_actual.as_array_rows()) + "x" + std::to_string(raw_actual.as_array_cols());
-    }
-    const JsonValue* value_v = expect.find("value");
-    if (value_v == nullptr) {
-      return {};
-    }
-    if (!value_v->is_array())
-      return "array golden 'value' is not an array";
-    const auto& expected_cells = value_v->as_array();
-    const std::size_t n = static_cast<std::size_t>(want_rows) * static_cast<std::size_t>(want_cols);
-    if (expected_cells.size() != n)
-      return "array golden value length mismatch: expected " + std::to_string(n) + ", got " +
-             std::to_string(expected_cells.size());
-    const Value* actual_cells = raw_actual.as_array_cells();
-    for (std::size_t i = 0; i < n; ++i) {
-      std::string diff = compare_json_scalar(expected_cells[i], actual_cells[i], tol_abs, tol_rel, compare_mode);
-      if (!diff.empty()) {
-        return "array cell " + std::to_string(i) + ": " + diff;
-      }
-    }
-    return {};
-  }
-
-  if (kind == "array_shape") {
-    return "golden 'expect' kind 'array_shape' must be compared with compare_array_shape";
-  }
-
-  // Anchor projection: Excel reports the top-left scalar of any spill
-  // region while xlwings reads back only that cell. Formulon's eval
-  // surfaces the full Array; project it down so scalar expectations see
-  // the same value Excel reports. Full array expectations above bypass
-  // this projection and compare shape + cells.
-  const Value& actual = anchor_or_self(raw_actual);
-
-  if (kind == "blank") {
-    if (actual.is_blank())
-      return {};
-    return "expected blank, got " + format_value(actual);
-  }
-  if (kind == "number") {
-    if (!actual.is_number())
-      return "expected number, got " + format_value(actual);
-    const JsonValue* val_v = expect.find("value");
-    if (val_v == nullptr || !val_v->is_number())
-      return "golden missing 'value'";
-    double want = val_v->as_number();
-    double got = actual.as_number();
-    if (compare_mode == "datevalue_roundtrip_readback" && want == -1.0 && got == 0.0)
-      return {};
-    // Exact equality is the strict path. When tolerances are non-zero, we
-    // accept a match if either absolute or relative diff fits. NaN matches
-    // NaN (Excel treats NaN as #NUM!, so this usually doesn't arise).
-    if (numbers_match(want, got, tol_abs, tol_rel))
-      return {};
-    return "number mismatch: expected " + std::to_string(want) + ", got " + std::to_string(got);
-  }
-  if (kind == "bool") {
-    if (!actual.is_boolean())
-      return "expected bool, got " + format_value(actual);
-    const JsonValue* val_v = expect.find("value");
-    if (val_v == nullptr || !val_v->is_bool())
-      return "golden missing 'value'";
-    if (actual.as_boolean() == val_v->as_bool())
-      return {};
-    return std::string("bool mismatch: expected ") + (val_v->as_bool() ? "TRUE" : "FALSE") + ", got " +
-           (actual.as_boolean() ? "TRUE" : "FALSE");
-  }
-  if (kind == "text") {
-    const JsonValue* val_v = expect.find("value");
-    if (val_v == nullptr || !val_v->is_string())
-      return "golden missing 'value'";
-    const std::string& want_text = val_v->as_string();
-
-    if (compare_mode == "numeric_text" && actual.is_number()) {
-      double want_number = 0.0;
-      if (!parse_numeric_text(want_text, &want_number)) {
-        return "expected numeric text but golden value is not numeric: \"" + want_text + "\"";
-      }
-      const double got = actual.as_number();
-      if (numbers_match(want_number, got, tol_abs, tol_rel)) {
-        return {};
-      }
-      return "numeric text mismatch: expected \"" + want_text + "\", got " + std::to_string(got);
-    }
-
-    if (!actual.is_text())
-      return "expected text, got " + format_value(actual);
-    const std::string actual_text(actual.as_text());
-
-    // Strict byte compare wins fast on the common path; structured
-    // comparators only run when the bytes already disagree.
-    if (want_text == actual_text)
-      return {};
-
-    if (compare_mode == "complex_text") {
-      return compare_complex_text(want_text, actual_text, tol_abs, tol_rel);
-    }
-
-    return "text mismatch: expected \"" + want_text + "\", got \"" + actual_text + "\"";
-  }
-  if (kind == "error") {
-    if (!actual.is_error())
-      return "expected error, got " + format_value(actual);
-    const JsonValue* code_v = expect.find("code");
-    if (code_v == nullptr || !code_v->is_string())
-      return "golden missing 'code'";
-    ErrorCode want_code;
-    if (!display_name_to_code(code_v->as_string(), &want_code)) {
-      return "golden has unknown error 'code': " + code_v->as_string();
-    }
-    if (actual.as_error() == want_code)
-      return {};
-    return std::string("error mismatch: expected ") + code_v->as_string() + ", got " + display_name(actual.as_error());
-  }
-  return "unknown expect kind: " + kind;
-}
-
-// Verifies a spill the oracle could not record cell by cell. The golden
-// carries the dynamic-array shape plus the cells the case asked to sample,
-// keyed by their absolute A1 address on the sheet Excel spilled into. Both
-// sides anchor the spill at the formula cell, so a sample resolves to the
-// array element at its offset from that cell.
-//
-// The shape is the load-bearing half: an implementation that trims a spill
-// to its populated extent, or collapses it to a scalar, fails here before
-// any sample is read.
-std::string compare_array_shape(const JsonValue& expect, const Value& actual, std::uint32_t case_row,
-                                std::uint32_t case_col, double tol_abs, double tol_rel, std::string_view compare_mode) {
-  if (!actual.is_array())
-    return "expected array, got " + format_value(actual);
-  const JsonValue* shape_v = expect.find("shape");
-  if (shape_v == nullptr || !shape_v->is_array())
-    return "array_shape golden missing 'shape'";
-  const auto& shape = shape_v->as_array();
-  if (shape.size() != 2 || !shape[0].is_number() || !shape[1].is_number())
-    return "array_shape golden has invalid 'shape'";
-  const auto want_rows = static_cast<std::uint32_t>(shape[0].as_number());
-  const auto want_cols = static_cast<std::uint32_t>(shape[1].as_number());
-  if (actual.as_array_rows() != want_rows || actual.as_array_cols() != want_cols) {
-    return "array shape mismatch: expected " + std::to_string(want_rows) + "x" + std::to_string(want_cols) + ", got " +
-           std::to_string(actual.as_array_rows()) + "x" + std::to_string(actual.as_array_cols());
-  }
-
-  const JsonValue* samples_v = expect.find("samples");
-  if (samples_v == nullptr || !samples_v->is_object())
-    return "array_shape golden missing 'samples'";
-  const auto& samples = samples_v->as_object();
-  if (samples.empty())
-    return "array_shape golden has an empty 'samples'";
-
-  const Value* cells = actual.as_array_cells();
-  for (const auto& entry : samples) {
-    std::uint32_t row = 0;
-    std::uint32_t col = 0;
-    if (!a1_to_row_col(entry.first, &row, &col))
-      return "array_shape sample '" + entry.first + "' is not an A1 address";
-    if (row < case_row || col < case_col) {
-      return "array_shape sample '" + entry.first + "' is above or left of the formula cell";
-    }
-    const std::uint32_t offset_row = row - case_row;
-    const std::uint32_t offset_col = col - case_col;
-    if (offset_row >= want_rows || offset_col >= want_cols) {
-      return "array_shape sample '" + entry.first + "' is outside the " + std::to_string(want_rows) + "x" +
-             std::to_string(want_cols) + " spill";
-    }
-    const std::size_t index = static_cast<std::size_t>(offset_row) * static_cast<std::size_t>(want_cols) +
-                              static_cast<std::size_t>(offset_col);
-    std::string diff = compare_json_scalar(entry.second, cells[index], tol_abs, tol_rel, compare_mode);
-    if (!diff.empty()) {
-      return "array_shape sample " + entry.first + ": " + diff;
-    }
-  }
-  return {};
-}
-
-// ---------------------------------------------------------------------------
-// Parameter provider
-// ---------------------------------------------------------------------------
-
-const std::vector<OracleCase>& oracle_cases() {
-  // Loaded once at first call; `load_oracle_cases` is safe to call multiple
-  // times but we cache to keep test discovery deterministic even if the
-  // directory is mutated mid-run (it isn't, but it's cheap insurance).
-  //
-  // Variant goldens are appended after the primary set. Cases inherit the
-  // variant tag from the load call; the parameter-name printer uses it to
-  // suffix `__<tag>` so primary and variant entries never collide. When
-  // no variants are configured (the default build) the appended sequence
-  // is empty and the parameter list is bit-for-bit identical to the
-  // primary-only flow.
-  static const std::vector<OracleCase> cached = []() {
-    std::vector<OracleCase> all = load_oracle_cases(configured_golden_dir(), "");
-    for (const auto& [tag, dir] : configured_variant_dirs()) {
-      auto vc = load_oracle_cases(dir, tag);
-      all.insert(all.end(), std::make_move_iterator(vc.begin()), std::make_move_iterator(vc.end()));
-    }
-    return all;
-  }();
-  return cached;
-}
-
-// ---------------------------------------------------------------------------
-// Fixture
-// ---------------------------------------------------------------------------
-
 class OracleTest : public ::testing::TestWithParam<OracleCase> {};
 
 TEST_P(OracleTest, Matches) {
@@ -932,82 +292,6 @@ TEST(OracleGoldenDirectory, NonEmptyConfiguredDirYieldsCases) {
       << "configured golden directory " << dir << " loaded zero oracle cases";
 }
 
-// ---------------------------------------------------------------------------
-// Divergence registry
-// ---------------------------------------------------------------------------
-
-// Creates an empty scratch directory for one test's throwaway golden.
-//
-// The name carries a random token because these tests are linked into more
-// than one oracle binary (the primary and the IronCalc one) and CTest may
-// run those concurrently: a fixed path would let one run delete the other's
-// fixture mid-read.
-std::filesystem::path make_scratch_dir(const std::string& label) {
-  std::error_code ec;
-  std::random_device entropy;
-  const std::filesystem::path dir =
-      std::filesystem::temp_directory_path(ec) / ("formulon_oracle_" + label + "_" + std::to_string(entropy()));
-  std::filesystem::remove_all(dir, ec);
-  std::filesystem::create_directories(dir, ec);
-  return dir;
-}
-
-// A case the registry names is skipped even though its golden says nothing
-// about the skip -- which is the state of every golden captured before the
-// divergence was adjudicated. Without this the entry would only take effect
-// once someone with an Excel host re-ran the capture, so the case would stay
-// red on every other machine in the meantime.
-TEST(OracleSkipRegistry, SkipsAGoldenCapturedBeforeTheEntryWasAdjudicated) {
-  const std::map<std::string, std::string>& registry = oracle_skip_registry();
-  if (registry.empty()) {
-    GTEST_SKIP() << "no divergence projection is wired into this build (FORMULON_ORACLE_SKIP_FILE)";
-  }
-  const std::string& case_id = registry.begin()->first;
-  const std::string& reason = registry.begin()->second;
-
-  const std::filesystem::path dir = make_scratch_dir("skip_registry");
-  std::error_code ec;
-  ASSERT_TRUE(std::filesystem::is_directory(dir, ec)) << dir.string();
-
-  {
-    // Deliberately no `"skipped"` field, and an `expect` the engine cannot
-    // satisfy: if the registry were not consulted the case would be
-    // verified, and fail.
-    std::ofstream out(dir / "skip_registry_probe.golden.json");
-    ASSERT_TRUE(out.good());
-    out << "{\"suite\": \"skip_registry_probe\", \"cases\": [{\"id\": \"" << case_id
-        << "\", \"formula\": \"=1\", \"expect\": {\"kind\": \"number\", \"value\": 2}}]}\n";
-  }
-
-  const std::vector<OracleCase> cases = load_oracle_cases(dir.string());
-  ASSERT_EQ(cases.size(), 1U);
-  EXPECT_EQ(cases[0].case_id, case_id);
-  EXPECT_EQ(cases[0].skipped_reason, reason);
-
-  std::filesystem::remove_all(dir, ec);
-}
-
-// The baked field still wins for goldens that carry one, and it is what a
-// case with no registry entry relies on.
-TEST(OracleSkipRegistry, BakedSkippedFieldIsHonouredOnItsOwn) {
-  const std::filesystem::path dir = make_scratch_dir("baked_skip");
-  std::error_code ec;
-  ASSERT_TRUE(std::filesystem::is_directory(dir, ec)) << dir.string();
-
-  {
-    std::ofstream out(dir / "baked_probe.golden.json");
-    ASSERT_TRUE(out.good());
-    out << "{\"suite\": \"baked_probe\", \"cases\": [{\"id\": \"baked_probe_case\", "
-           "\"skipped\": \"captured with the skip already baked in\"}]}\n";
-  }
-
-  const std::vector<OracleCase> cases = load_oracle_cases(dir.string());
-  ASSERT_EQ(cases.size(), 1U);
-  EXPECT_EQ(cases[0].skipped_reason, "captured with the skip already baked in");
-
-  std::filesystem::remove_all(dir, ec);
-}
-
 }  // namespace
 }  // namespace oracle
 }  // namespace tests
diff --git a/tests/oracle/oracle_test_support.h b/tests/oracle/oracle_test_support.h
new file mode 100644
index 000000000..a04a63353
--- /dev/null
+++ b/tests/oracle/oracle_test_support.h
@@ -0,0 +1,640 @@
+#pragma once
+
+#include <algorithm>
+#include <cctype>
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <iterator>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "eval/iterative_solver.h"
+#include "eval/tree_walker.h"
+#include "excel_profile.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "sheet.h"
+#include "tests/oracle/json_reader.h"
+#include "tests/oracle/oracle_anchor.h"
+#include "tests/oracle/oracle_runner.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon::tests::oracle::support {
+
+struct SetupFormulaCell {
+  std::size_t sheet_index = 0;
+  std::uint32_t row = 0;
+  std::uint32_t col = 0;
+  std::string formula;
+};
+
+// Maps the golden JSON's `"#DIV/0!"` style display name to the matching
+// ErrorCode enum. Returns `false` on an unknown code.
+inline bool display_name_to_code(std::string_view name, ErrorCode* out) {
+  struct Entry {
+    std::string_view display;
+    ErrorCode code;
+  };
+  static constexpr Entry kTable[] = {
+      {"#NULL!", ErrorCode::Null},
+      {"#DIV/0!", ErrorCode::Div0},
+      {"#VALUE!", ErrorCode::Value},
+      {"#REF!", ErrorCode::Ref},
+      {"#NAME?", ErrorCode::Name},
+      {"#NUM!", ErrorCode::Num},
+      {"#N/A", ErrorCode::NA},
+      {"#SPILL!", ErrorCode::Spill},
+      {"#CALC!", ErrorCode::Calc},
+      {"#FIELD!", ErrorCode::Field},
+      {"#BLOCKED!", ErrorCode::Blocked},
+      {"#CONNECT!", ErrorCode::Connect},
+      {"#EXTERNAL!", ErrorCode::External},
+      {"#BUSY!", ErrorCode::Busy},
+      {"#PYTHON!", ErrorCode::Python},
+      {"#UNKNOWN!", ErrorCode::Unknown},
+  };
+  for (const auto& e : kTable) {
+    if (e.display == name) {
+      *out = e.code;
+      return true;
+    }
+  }
+  return false;
+}
+
+// Applies a single {kind, value} JSON record to a cell. Returns nullptr on
+// success or a short error string on failure (unknown kind, missing value,
+// etc.) that the caller folds into the test failure message.
+inline const char* apply_cell_value(const JsonValue& spec, Sheet& sheet, std::uint32_t row, std::uint32_t col,
+                                    Arena& text_arena) {
+  if (!spec.is_object())
+    return "setup cell is not an object";
+  const JsonValue* kind_v = spec.find("kind");
+  if (kind_v == nullptr || !kind_v->is_string())
+    return "missing 'kind'";
+  const std::string& kind = kind_v->as_string();
+
+  if (kind == "formula") {
+    const JsonValue* f = spec.find("formula");
+    if (f == nullptr || !f->is_string())
+      return "formula cell missing 'formula'";
+    sheet.set_cell_formula(row, col, f->as_string());
+    return nullptr;
+  }
+
+  const JsonValue* val_v = spec.find("value");
+  if (kind == "blank") {
+    // Nothing to do: absence from storage already means blank.
+    return nullptr;
+  }
+  if (kind == "number") {
+    if (val_v == nullptr || !val_v->is_number())
+      return "number missing 'value'";
+    sheet.set_cell_value(row, col, Value::number(val_v->as_number()));
+    return nullptr;
+  }
+  if (kind == "bool") {
+    if (val_v == nullptr || !val_v->is_bool())
+      return "bool missing 'value'";
+    sheet.set_cell_value(row, col, Value::boolean(val_v->as_bool()));
+    return nullptr;
+  }
+  if (kind == "text") {
+    if (val_v == nullptr || !val_v->is_string())
+      return "text missing 'value'";
+    // Intern the string into the arena so the Value's string_view remains
+    // valid for the lifetime of the test.
+    const std::string& payload = val_v->as_string();
+    std::string_view view = text_arena.intern(payload);
+    sheet.set_cell_value(row, col, Value::text(view));
+    return nullptr;
+  }
+  if (kind == "error") {
+    const JsonValue* code_v = spec.find("code");
+    if (code_v == nullptr || !code_v->is_string())
+      return "error missing 'code'";
+    ErrorCode code;
+    if (!display_name_to_code(code_v->as_string(), &code)) {
+      return "error has unknown 'code'";
+    }
+    sheet.set_cell_value(row, col, Value::error(code));
+    return nullptr;
+  }
+  return "setup cell has unknown 'kind'";
+}
+
+// Applies the optional case-level `merges` list emitted by oracle_gen. The
+// formula drivers use Excel's inclusive A1 range syntax; keep the native
+// verifier on the same representation and normalise transposed corners just
+// as the C API merge surface does.
+inline const char* apply_merge_ranges(const JsonValue& spec, Sheet& sheet) {
+  if (!spec.is_array()) {
+    return "case 'merges' is not an array";
+  }
+  for (const JsonValue& item : spec.as_array()) {
+    if (!item.is_string() || item.as_string().empty()) {
+      return "merge range is not a non-empty A1 string";
+    }
+    const std::string& ref = item.as_string();
+    const std::size_t separator = ref.find(':');
+    if (separator != std::string::npos && ref.find(':', separator + 1U) != std::string::npos) {
+      return "merge range contains more than one ':'";
+    }
+    const std::string first_ref = ref.substr(0, separator);
+    const std::string last_ref = separator == std::string::npos ? first_ref : ref.substr(separator + 1U);
+    std::uint32_t first_row = 0;
+    std::uint32_t first_col = 0;
+    std::uint32_t last_row = 0;
+    std::uint32_t last_col = 0;
+    if (!a1_to_row_col(first_ref, &first_row, &first_col) || !a1_to_row_col(last_ref, &last_row, &last_col)) {
+      return "merge range contains an invalid A1 address";
+    }
+    if (first_row > last_row) {
+      const std::uint32_t tmp = first_row;
+      first_row = last_row;
+      last_row = tmp;
+    }
+    if (first_col > last_col) {
+      const std::uint32_t tmp = first_col;
+      first_col = last_col;
+      last_col = tmp;
+    }
+    sheet.mutable_merges().push_back(MergeRange{first_row, first_col, last_row, last_col});
+  }
+  return nullptr;
+}
+
+// Renders a Formulon Value as a short display string for assertion failure
+// messages. Mirrors the debug_to_string helper but keeps error / text
+// formatting consistent with the JSON schema.
+inline std::string format_value(const Value& v) {
+  switch (v.kind()) {
+    case ValueKind::Blank:
+      return "blank";
+    case ValueKind::Number:
+      return "number(" + std::to_string(v.as_number()) + ")";
+    case ValueKind::Bool:
+      return v.as_boolean() ? "bool(TRUE)" : "bool(FALSE)";
+    case ValueKind::Text:
+      return std::string("text(\"") + std::string(v.as_text()) + "\")";
+    case ValueKind::Error:
+      return std::string("error(") + display_name(v.as_error()) + ")";
+    case ValueKind::Array:
+      return "array(" + std::to_string(v.as_array_rows()) + "x" + std::to_string(v.as_array_cols()) + ")";
+    default:
+      return "<unsupported>";
+  }
+}
+
+/// Result of parsing an Excel complex-number text representation.
+///
+/// Excel complex numbers are formatted as `<real><sign><imag><suffix>` (or
+/// `<real>` alone, or `<sign><imag><suffix>` alone), where `<suffix>` is
+/// `i` or `j`. See `parse_excel_complex` for the precise grammar.
+struct ParsedComplex {
+  double real = 0.0;
+  double imag = 0.0;
+  bool ok = false;
+};
+
+/// Parses an Excel complex-number text into its real and imaginary parts.
+///
+/// Recognised shapes:
+///   `"3"`                                 -> {3, 0}
+///   `"4i"`                                -> {0, 4}
+///   `"i"`                                 -> {0, 1}
+///   `"-i"`                                -> {0, -1}
+///   `"-2.5+i"`                            -> {-2.5, 1}
+///   `"0.62-0.30i"`                        -> {0.62, -0.30}
+///   `"1.0e-3+2.5e+10i"`                   -> {1.0e-3, 2.5e10}
+///
+/// The split between real and imaginary parts is the LAST `+` or `-` in the
+/// trimmed string that is neither at position 0 (a leading sign on the real
+/// part) nor immediately after `e` / `E` (a scientific-notation exponent
+/// sign).
+inline ParsedComplex parse_excel_complex(std::string_view s) {
+  ParsedComplex out;
+  if (s.empty())
+    return out;
+
+  // Strip the imaginary suffix, if any. Excel uses `i`; Formulon currently
+  // only emits `i`, but accept `j` for symmetry with the SUFFIX argument
+  // family of IM* functions.
+  bool has_imag = false;
+  std::string_view body = s;
+  const char last = body.back();
+  if (last == 'i' || last == 'j') {
+    has_imag = true;
+    body.remove_suffix(1);
+  }
+
+  // Locate the split between real and imaginary parts.
+  std::size_t split = std::string_view::npos;
+  for (std::size_t i = body.size(); i-- > 0;) {
+    const char c = body[i];
+    if (c != '+' && c != '-')
+      continue;
+    if (i == 0)
+      break;  // leading sign on the real part
+    const char prev = body[i - 1];
+    if (prev == 'e' || prev == 'E')
+      continue;  // exponent sign
+    split = i;
+    break;
+  }
+
+  const auto parse_double = [](std::string_view sv, double* out_d) {
+    if (sv.empty())
+      return false;
+    // strtod requires a NUL-terminated buffer; copy into a small std::string.
+    const std::string buf(sv);
+    const char* begin = buf.c_str();
+    char* end = nullptr;
+    const double v = std::strtod(begin, &end);
+    if (end != begin + buf.size())
+      return false;
+    *out_d = v;
+    return true;
+  };
+
+  if (split == std::string_view::npos) {
+    if (has_imag) {
+      // Whole trimmed body is the imaginary coefficient.
+      if (body.empty() || body == "+") {
+        out.imag = 1.0;
+      } else if (body == "-") {
+        out.imag = -1.0;
+      } else if (!parse_double(body, &out.imag)) {
+        return out;
+      }
+      out.real = 0.0;
+    } else {
+      if (!parse_double(body, &out.real))
+        return out;
+      out.imag = 0.0;
+    }
+    out.ok = true;
+    return out;
+  }
+
+  // Split present: there must be an imaginary suffix (otherwise we have a
+  // trailing sign with no `i`, which is malformed).
+  if (!has_imag)
+    return out;
+
+  const std::string_view real_part = body.substr(0, split);
+  const std::string_view imag_part = body.substr(split);  // includes sign
+  if (!parse_double(real_part, &out.real))
+    return out;
+  if (imag_part == "+") {
+    out.imag = 1.0;
+  } else if (imag_part == "-") {
+    out.imag = -1.0;
+  } else if (!parse_double(imag_part, &out.imag)) {
+    return out;
+  }
+  out.ok = true;
+  return out;
+}
+
+// Component-wise comparator for Excel complex-number text. Returns an empty
+// string on match (real and imag both within tolerance); otherwise a short
+// diagnostic that quotes both sides verbatim.
+inline std::string compare_complex_text(const std::string& want, const std::string& got, double tol_abs,
+                                        double tol_rel) {
+  const auto wc = parse_excel_complex(want);
+  const auto gc = parse_excel_complex(got);
+  if (!wc.ok || !gc.ok) {
+    return "text mismatch (complex parse failed): expected \"" + want + "\", got \"" + got + "\"";
+  }
+  const auto component_ok = [&](double a, double b) {
+    const double diff = std::abs(a - b);
+    if (diff == 0.0)
+      return true;
+    if (tol_abs > 0.0 && diff <= tol_abs)
+      return true;
+    const double scale = std::max(std::abs(a), std::abs(b));
+    if (tol_rel > 0.0 && scale > 0.0 && diff / scale <= tol_rel)
+      return true;
+    return false;
+  };
+  if (component_ok(wc.real, gc.real) && component_ok(wc.imag, gc.imag)) {
+    return {};
+  }
+  return "complex mismatch (within text but components diverge): expected \"" + want + "\", got \"" + got + "\"";
+}
+
+inline bool parse_numeric_text(std::string_view text, double* out) {
+  std::string owned(text);
+  char* end = nullptr;
+  double value = std::strtod(owned.c_str(), &end);
+  if (end == owned.c_str()) {
+    return false;
+  }
+  while (*end != '\0') {
+    if (!std::isspace(static_cast<unsigned char>(*end))) {
+      return false;
+    }
+    ++end;
+  }
+  *out = value;
+  return true;
+}
+
+inline bool numbers_match(double want, double got, double tol_abs, double tol_rel) {
+  if (std::isnan(want) && std::isnan(got)) {
+    return true;
+  }
+  const double diff = std::abs(want - got);
+  if (diff == 0.0) {
+    return true;
+  }
+  if (tol_abs > 0.0 && diff <= tol_abs) {
+    return true;
+  }
+  const double scale = std::max(std::abs(want), std::abs(got));
+  return tol_rel > 0.0 && scale > 0.0 && diff / scale <= tol_rel;
+}
+
+inline std::string compare_value(const JsonValue& expect, const Value& raw_actual, double tol_abs, double tol_rel,
+                                 std::string_view compare_mode);
+
+inline std::string compare_json_scalar(const JsonValue& expect, const Value& actual, double tol_abs, double tol_rel,
+                                       std::string_view compare_mode) {
+  if (expect.is_null()) {
+    return actual.is_blank() ? std::string{} : "expected blank, got " + format_value(actual);
+  }
+  if (expect.is_number()) {
+    if (!actual.is_number())
+      return "expected number, got " + format_value(actual);
+    return numbers_match(expect.as_number(), actual.as_number(), tol_abs, tol_rel)
+               ? std::string{}
+               : "number mismatch: expected " + std::to_string(expect.as_number()) + ", got " +
+                     std::to_string(actual.as_number());
+  }
+  if (expect.is_bool()) {
+    if (!actual.is_boolean())
+      return "expected bool, got " + format_value(actual);
+    return actual.as_boolean() == expect.as_bool()
+               ? std::string{}
+               : std::string("bool mismatch: expected ") + (expect.as_bool() ? "TRUE" : "FALSE") + ", got " +
+                     (actual.as_boolean() ? "TRUE" : "FALSE");
+  }
+  if (expect.is_string()) {
+    if (!actual.is_text())
+      return "expected text, got " + format_value(actual);
+    if (expect.as_string() == actual.as_text())
+      return {};
+    if (compare_mode == "complex_text") {
+      return compare_complex_text(expect.as_string(), std::string(actual.as_text()), tol_abs, tol_rel);
+    }
+    return "text mismatch: expected \"" + expect.as_string() + "\", got \"" + std::string(actual.as_text()) + "\"";
+  }
+  if (expect.is_object()) {
+    return compare_value(expect, actual, tol_abs, tol_rel, compare_mode);
+  }
+  return "array golden cell is not scalar";
+}
+
+// Compares `actual` to the golden `expect` JSON record under the given
+// tolerance. Returns an empty string on match; otherwise a human-readable
+// diff message.
+//
+// `compare_mode` is "" or "exact" for the historical strict path, or a
+// structured comparator key (e.g. "complex_text") that selects an
+// alternative routine when the strict byte-equality check fails.
+inline std::string compare_value(const JsonValue& expect, const Value& raw_actual, double tol_abs, double tol_rel,
+                                 std::string_view compare_mode) {
+  if (!expect.is_object())
+    return "golden 'expect' is not an object";
+  const JsonValue* kind_v = expect.find("kind");
+  if (kind_v == nullptr || !kind_v->is_string()) {
+    return "golden 'expect' missing 'kind'";
+  }
+  const std::string& kind = kind_v->as_string();
+
+  if (kind == "array") {
+    if (!raw_actual.is_array())
+      return "expected array, got " + format_value(raw_actual);
+    const JsonValue* shape_v = expect.find("shape");
+    if (shape_v == nullptr || !shape_v->is_array())
+      return "array golden missing 'shape'";
+    const auto& shape = shape_v->as_array();
+    if (shape.size() != 2 || !shape[0].is_number() || !shape[1].is_number())
+      return "array golden has invalid 'shape'";
+    const auto want_rows = static_cast<std::uint32_t>(shape[0].as_number());
+    const auto want_cols = static_cast<std::uint32_t>(shape[1].as_number());
+    if (raw_actual.as_array_rows() != want_rows || raw_actual.as_array_cols() != want_cols) {
+      return "array shape mismatch: expected " + std::to_string(want_rows) + "x" + std::to_string(want_cols) +
+             ", got " + std::to_string(raw_actual.as_array_rows()) + "x" + std::to_string(raw_actual.as_array_cols());
+    }
+    const JsonValue* value_v = expect.find("value");
+    if (value_v == nullptr) {
+      return {};
+    }
+    if (!value_v->is_array())
+      return "array golden 'value' is not an array";
+    const auto& expected_cells = value_v->as_array();
+    const std::size_t n = static_cast<std::size_t>(want_rows) * static_cast<std::size_t>(want_cols);
+    if (expected_cells.size() != n)
+      return "array golden value length mismatch: expected " + std::to_string(n) + ", got " +
+             std::to_string(expected_cells.size());
+    const Value* actual_cells = raw_actual.as_array_cells();
+    for (std::size_t i = 0; i < n; ++i) {
+      std::string diff = compare_json_scalar(expected_cells[i], actual_cells[i], tol_abs, tol_rel, compare_mode);
+      if (!diff.empty()) {
+        return "array cell " + std::to_string(i) + ": " + diff;
+      }
+    }
+    return {};
+  }
+
+  if (kind == "array_shape") {
+    return "golden 'expect' kind 'array_shape' must be compared with compare_array_shape";
+  }
+
+  // Anchor projection: Excel reports the top-left scalar of any spill
+  // region while xlwings reads back only that cell. Formulon's eval
+  // surfaces the full Array; project it down so scalar expectations see
+  // the same value Excel reports. Full array expectations above bypass
+  // this projection and compare shape + cells.
+  const Value& actual = anchor_or_self(raw_actual);
+
+  if (kind == "blank") {
+    if (actual.is_blank())
+      return {};
+    return "expected blank, got " + format_value(actual);
+  }
+  if (kind == "number") {
+    if (!actual.is_number())
+      return "expected number, got " + format_value(actual);
+    const JsonValue* val_v = expect.find("value");
+    if (val_v == nullptr || !val_v->is_number())
+      return "golden missing 'value'";
+    double want = val_v->as_number();
+    double got = actual.as_number();
+    if (compare_mode == "datevalue_roundtrip_readback" && want == -1.0 && got == 0.0)
+      return {};
+    // Exact equality is the strict path. When tolerances are non-zero, we
+    // accept a match if either absolute or relative diff fits. NaN matches
+    // NaN (Excel treats NaN as #NUM!, so this usually doesn't arise).
+    if (numbers_match(want, got, tol_abs, tol_rel))
+      return {};
+    return "number mismatch: expected " + std::to_string(want) + ", got " + std::to_string(got);
+  }
+  if (kind == "bool") {
+    if (!actual.is_boolean())
+      return "expected bool, got " + format_value(actual);
+    const JsonValue* val_v = expect.find("value");
+    if (val_v == nullptr || !val_v->is_bool())
+      return "golden missing 'value'";
+    if (actual.as_boolean() == val_v->as_bool())
+      return {};
+    return std::string("bool mismatch: expected ") + (val_v->as_bool() ? "TRUE" : "FALSE") + ", got " +
+           (actual.as_boolean() ? "TRUE" : "FALSE");
+  }
+  if (kind == "text") {
+    const JsonValue* val_v = expect.find("value");
+    if (val_v == nullptr || !val_v->is_string())
+      return "golden missing 'value'";
+    const std::string& want_text = val_v->as_string();
+
+    if (compare_mode == "numeric_text" && actual.is_number()) {
+      double want_number = 0.0;
+      if (!parse_numeric_text(want_text, &want_number)) {
+        return "expected numeric text but golden value is not numeric: \"" + want_text + "\"";
+      }
+      const double got = actual.as_number();
+      if (numbers_match(want_number, got, tol_abs, tol_rel)) {
+        return {};
+      }
+      return "numeric text mismatch: expected \"" + want_text + "\", got " + std::to_string(got);
+    }
+
+    if (!actual.is_text())
+      return "expected text, got " + format_value(actual);
+    const std::string actual_text(actual.as_text());
+
+    // Strict byte compare wins fast on the common path; structured
+    // comparators only run when the bytes already disagree.
+    if (want_text == actual_text)
+      return {};
+
+    if (compare_mode == "complex_text") {
+      return compare_complex_text(want_text, actual_text, tol_abs, tol_rel);
+    }
+
+    return "text mismatch: expected \"" + want_text + "\", got \"" + actual_text + "\"";
+  }
+  if (kind == "error") {
+    if (!actual.is_error())
+      return "expected error, got " + format_value(actual);
+    const JsonValue* code_v = expect.find("code");
+    if (code_v == nullptr || !code_v->is_string())
+      return "golden missing 'code'";
+    ErrorCode want_code;
+    if (!display_name_to_code(code_v->as_string(), &want_code)) {
+      return "golden has unknown error 'code': " + code_v->as_string();
+    }
+    if (actual.as_error() == want_code)
+      return {};
+    return std::string("error mismatch: expected ") + code_v->as_string() + ", got " + display_name(actual.as_error());
+  }
+  return "unknown expect kind: " + kind;
+}
+
+// Verifies a spill the oracle could not record cell by cell. The golden
+// carries the dynamic-array shape plus the cells the case asked to sample,
+// keyed by their absolute A1 address on the sheet Excel spilled into. Both
+// sides anchor the spill at the formula cell, so a sample resolves to the
+// array element at its offset from that cell.
+//
+// The shape is the load-bearing half: an implementation that trims a spill
+// to its populated extent, or collapses it to a scalar, fails here before
+// any sample is read.
+inline std::string compare_array_shape(const JsonValue& expect, const Value& actual, std::uint32_t case_row,
+                                       std::uint32_t case_col, double tol_abs, double tol_rel,
+                                       std::string_view compare_mode) {
+  if (!actual.is_array())
+    return "expected array, got " + format_value(actual);
+  const JsonValue* shape_v = expect.find("shape");
+  if (shape_v == nullptr || !shape_v->is_array())
+    return "array_shape golden missing 'shape'";
+  const auto& shape = shape_v->as_array();
+  if (shape.size() != 2 || !shape[0].is_number() || !shape[1].is_number())
+    return "array_shape golden has invalid 'shape'";
+  const auto want_rows = static_cast<std::uint32_t>(shape[0].as_number());
+  const auto want_cols = static_cast<std::uint32_t>(shape[1].as_number());
+  if (actual.as_array_rows() != want_rows || actual.as_array_cols() != want_cols) {
+    return "array shape mismatch: expected " + std::to_string(want_rows) + "x" + std::to_string(want_cols) + ", got " +
+           std::to_string(actual.as_array_rows()) + "x" + std::to_string(actual.as_array_cols());
+  }
+
+  const JsonValue* samples_v = expect.find("samples");
+  if (samples_v == nullptr || !samples_v->is_object())
+    return "array_shape golden missing 'samples'";
+  const auto& samples = samples_v->as_object();
+  if (samples.empty())
+    return "array_shape golden has an empty 'samples'";
+
+  const Value* cells = actual.as_array_cells();
+  for (const auto& entry : samples) {
+    std::uint32_t row = 0;
+    std::uint32_t col = 0;
+    if (!a1_to_row_col(entry.first, &row, &col))
+      return "array_shape sample '" + entry.first + "' is not an A1 address";
+    if (row < case_row || col < case_col) {
+      return "array_shape sample '" + entry.first + "' is above or left of the formula cell";
+    }
+    const std::uint32_t offset_row = row - case_row;
+    const std::uint32_t offset_col = col - case_col;
+    if (offset_row >= want_rows || offset_col >= want_cols) {
+      return "array_shape sample '" + entry.first + "' is outside the " + std::to_string(want_rows) + "x" +
+             std::to_string(want_cols) + " spill";
+    }
+    const std::size_t index = static_cast<std::size_t>(offset_row) * static_cast<std::size_t>(want_cols) +
+                              static_cast<std::size_t>(offset_col);
+    std::string diff = compare_json_scalar(entry.second, cells[index], tol_abs, tol_rel, compare_mode);
+    if (!diff.empty()) {
+      return "array_shape sample " + entry.first + ": " + diff;
+    }
+  }
+  return {};
+}
+
+// ---------------------------------------------------------------------------
+// Parameter provider
+// ---------------------------------------------------------------------------
+
+inline const std::vector<OracleCase>& oracle_cases() {
+  // Loaded once at first call; `load_oracle_cases` is safe to call multiple
+  // times but we cache to keep test discovery deterministic even if the
+  // directory is mutated mid-run (it isn't, but it's cheap insurance).
+  //
+  // Variant goldens are appended after the primary set. Cases inherit the
+  // variant tag from the load call; the parameter-name printer uses it to
+  // suffix `__<tag>` so primary and variant entries never collide. When
+  // no variants are configured (the default build) the appended sequence
+  // is empty and the parameter list is bit-for-bit identical to the
+  // primary-only flow.
+  static const std::vector<OracleCase> cached = []() {
+    std::vector<OracleCase> all = load_oracle_cases(configured_golden_dir(), "");
+    for (const auto& [tag, dir] : configured_variant_dirs()) {
+      auto vc = load_oracle_cases(dir, tag);
+      all.insert(all.end(), std::make_move_iterator(vc.begin()), std::make_move_iterator(vc.end()));
+    }
+    return all;
+  }();
+  return cached;
+}
+
+}  // namespace formulon::tests::oracle::support
diff --git a/tests/oracle/workbook_builder.cpp b/tests/oracle/workbook_builder.cpp
index 0eb5bb67b..c5c8b24f1 100644
--- a/tests/oracle/workbook_builder.cpp
+++ b/tests/oracle/workbook_builder.cpp
@@ -15,6 +15,7 @@
 #include "excel_profile.h"
 #include "pivot/pivot_locale.h"
 #include "tests/oracle/oracle_runner.h"
+#include "tests/oracle/workbook_builder_internal.h"
 #include "utils/a1_ref.h"
 #include "utils/status_macros.h"
 #include "value.h"
@@ -23,28 +24,14 @@ namespace formulon {
 namespace tests {
 namespace oracle {
 
-namespace {
-
-using ::formulon::pivot::Aggregation;
-using ::formulon::pivot::PivotAxis;
-using ::formulon::pivot::PivotCache;
-using ::formulon::pivot::PivotCacheField;
-using ::formulon::pivot::PivotCacheRecord;
-using ::formulon::pivot::PivotDataField;
-using ::formulon::pivot::PivotField;
-using ::formulon::pivot::PivotItem;
-using ::formulon::pivot::PivotLayout;
-using ::formulon::pivot::PivotTable;
-
-/// Cache id stamped on the single cache the builder constructs. The
-/// workbook-oracle harness never assembles more than one pivot per case,
-/// so a fixed id is sufficient and keeps the table/cache binding obvious.
-constexpr std::uint32_t kBuilderCacheId = 1;
+namespace workbook_builder_detail {
 
 Error invalid(std::string message) {
   return make_error(FormulonErrorCode::kInvalidArgument, std::move(message));
 }
 
+namespace {
+
 /// Converts one declarative cell record into a `Value`. Accepts both the
 /// normalised `{kind, value}` shape the workbook case schema emits and the
 /// bare JSON shorthands (number / string / bool) for hand-written specs.
@@ -98,6 +85,7 @@ Expected<Value, Error> value_from_record(const JsonValue& rec, Workbook* workboo
   }
   return invalid(where + ": unsupported cell kind '" + kind + "' for a pivot source");
 }
+}  // namespace
 
 /// Builds the case's workbook from the `sheets` block. Each sheet's cell
 /// map is written via `Sheet::set_cell_value`.
@@ -162,407 +150,11 @@ Expected<std::unique_ptr<Workbook>, Error> build_workbook(const JsonValue& spec)
   }
   return workbook;
 }
+}  // namespace workbook_builder_detail
 
-/// Parses a sheet-qualified A1 range ("Data!A1:C13") into the sheet name
-/// plus 0-based inclusive row/col bounds.
-struct SourceRange {
-  std::string sheet;
-  std::uint32_t r0 = 0;
-  std::uint32_t c0 = 0;
-  std::uint32_t r1 = 0;
-  std::uint32_t c1 = 0;
-};
-
-Expected<SourceRange, Error> parse_source_range(const std::string& spec_text) {
-  auto [sheet, bare] = split_sheet_qualified_addr(spec_text);
-  if (sheet.empty()) {
-    return invalid("pivot 'source' must be sheet-qualified: '" + spec_text + "'");
-  }
-  const std::size_t colon = bare.find(':');
-  if (colon == std::string::npos) {
-    return invalid("pivot 'source' must be an A1 range: '" + spec_text + "'");
-  }
-  SourceRange out;
-  out.sheet = sheet;
-  if (!a1_to_row_col(bare.substr(0, colon), &out.r0, &out.c0) ||
-      !a1_to_row_col(bare.substr(colon + 1), &out.r1, &out.c1)) {
-    return invalid("pivot 'source' has a malformed endpoint: '" + spec_text + "'");
-  }
-  if (out.r1 < out.r0 || out.c1 < out.c0) {
-    return invalid("pivot 'source' range is inverted: '" + spec_text + "'");
-  }
-  return out;
-}
-
-/// Maps an `agg` string from the declarative spec onto the `Aggregation`
-/// enum. The accepted names mirror the enumerators one-to-one.
-Expected<Aggregation, Error> aggregation_from_string(const std::string& name) {
-  if (name == "Sum") {
-    return Aggregation::Sum;
-  }
-  if (name == "Count") {
-    return Aggregation::Count;
-  }
-  if (name == "Average") {
-    return Aggregation::Average;
-  }
-  if (name == "Max") {
-    return Aggregation::Max;
-  }
-  if (name == "Min") {
-    return Aggregation::Min;
-  }
-  if (name == "Product") {
-    return Aggregation::Product;
-  }
-  if (name == "CountNumbers") {
-    return Aggregation::CountNumbers;
-  }
-  if (name == "StdDev") {
-    return Aggregation::StdDev;
-  }
-  if (name == "StdDevP") {
-    return Aggregation::StdDevP;
-  }
-  if (name == "Var") {
-    return Aggregation::Var;
-  }
-  if (name == "VarP") {
-    return Aggregation::VarP;
-  }
-  return invalid("unknown aggregation '" + name + "'");
-}
-
-/// Maps a `layout` string onto the `PivotLayout` enum. Defaults to Compact
-/// when the spec omits the field; an unrecognised value is an error.
-Expected<PivotLayout, Error> layout_from_string(const std::string& name) {
-  if (name == "Compact") {
-    return PivotLayout::Compact;
-  }
-  if (name == "Tabular") {
-    return PivotLayout::Tabular;
-  }
-  if (name == "Outline") {
-    return PivotLayout::Outline;
-  }
-  return invalid("unknown pivot layout '" + name + "'");
-}
-
-/// Returns the 0-based column offset of `header` within the source-range
-/// header row, or `npos`-equivalent (`field_count`) when not found.
-std::uint32_t header_index(const std::vector<std::string>& headers, const std::string& name) {
-  for (std::uint32_t i = 0; i < headers.size(); ++i) {
-    if (headers[i] == name) {
-      return i;
-    }
-  }
-  return static_cast<std::uint32_t>(headers.size());
-}
-
-/// Collects the string list at `obj[key]`, defaulting to empty when the
-/// key is absent. Each element must be a string.
-Expected<std::vector<std::string>, Error> string_list(const JsonValue& obj, const char* key) {
-  std::vector<std::string> out;
-  const JsonValue* v = obj.find(key);
-  if (v == nullptr || v->is_null()) {
-    return out;
-  }
-  if (!v->is_array()) {
-    return invalid(std::string("pivot '") + key + "' must be an array");
-  }
-  for (const JsonValue& item : v->as_array()) {
-    if (!item.is_string()) {
-      return invalid(std::string("pivot '") + key + "' entries must be strings");
-    }
-    out.push_back(item.as_string());
-  }
-  return out;
-}
-
-}  // namespace
-
-Expected<BuiltPivot, Error> build_pivot_from_spec(const JsonValue& spec) {
-  if (!spec.is_object()) {
-    return invalid("workbook spec must be an object");
-  }
-  const JsonValue* pivot_v = spec.find("pivot");
-  if (pivot_v == nullptr || !pivot_v->is_object()) {
-    return invalid("workbook spec has no 'pivot' block");
-  }
-  const JsonValue& pivot = *pivot_v;
-
-  ASSIGN_OR_RETURN(std::unique_ptr<Workbook> workbook, build_workbook(spec));
-
-  // --- source range --------------------------------------------------------
-  const JsonValue* source_v = pivot.find("source");
-  if (source_v == nullptr || !source_v->is_string()) {
-    return invalid("pivot block missing string 'source'");
-  }
-  ASSIGN_OR_RETURN(SourceRange src, parse_source_range(source_v->as_string()));
-  const Sheet* src_sheet = workbook->sheet_by_name(src.sheet);
-  if (src_sheet == nullptr) {
-    return invalid("pivot 'source' names an unknown sheet '" + src.sheet + "'");
-  }
-
-  // --- anchor --------------------------------------------------------------
-  const JsonValue* anchor_v = pivot.find("anchor");
-  if (anchor_v == nullptr || !anchor_v->is_string()) {
-    return invalid("pivot block missing string 'anchor'");
-  }
-  auto [anchor_sheet, anchor_bare] = split_sheet_qualified_addr(anchor_v->as_string());
-  std::uint32_t anchor_row = 0;
-  std::uint32_t anchor_col = 0;
-  if (!a1_to_row_col(anchor_bare, &anchor_row, &anchor_col)) {
-    return invalid("pivot 'anchor' has a malformed A1 address");
-  }
-
-  // --- cache: header row + records ----------------------------------------
-  std::vector<std::string> headers;
-  headers.reserve(src.c1 - src.c0 + 1);
-  for (std::uint32_t c = src.c0; c <= src.c1; ++c) {
-    const Value header = src_sheet->resolve_cell_value(src.r0, c);
-    if (header.kind() != ValueKind::Text) {
-      return invalid("pivot 'source' header row must be text in every column");
-    }
-    headers.emplace_back(header.as_text());
-  }
-
-  PivotCache cache;
-  cache.set_cache_id(kBuilderCacheId);
-  for (const std::string& name : headers) {
-    cache.mutable_fields().push_back(PivotCacheField{name, {}});
-  }
-  for (std::uint32_t r = src.r0 + 1; r <= src.r1; ++r) {
-    PivotCacheRecord rec;
-    rec.cells.reserve(headers.size());
-    // Every cell below is stored inline (verbatim), never as an index into
-    // `shared_items` -- explicit so `cell_value()` (record_access.h) does
-    // not fall back to inferring the encoding from `shared_items` being
-    // non-empty. That fallback assumes a field with shared items indexes
-    // *every* cell through them; this harness only populates shared_items
-    // from a field's text values (informational, for filter-item lookup),
-    // so a field mixing numbers and text -- e.g. Count(Amount) with one
-    // error/text cell among the numbers -- would otherwise have its
-    // numeric cells misread as out-of-range shared-item indices and
-    // collapse to Blank.
-    rec.cell_is_index.assign(headers.size(), false);
-    for (std::uint32_t c = src.c0; c <= src.c1; ++c) {
-      Value cell = src_sheet->resolve_cell_value(r, c);
-      // The cache must outlive the workbook's text views once the
-      // workbook is moved into `BuiltPivot`, so any text payload is
-      // re-interned into the cache's own pointer-stable storage.
-      if (cell.kind() == ValueKind::Text) {
-        cache.mutable_text_storage().emplace_back(cell.as_text());
-        cell = Value::text(cache.text_storage().back());
-      }
-      rec.cells.push_back(cell);
-    }
-    cache.mutable_records().push_back(std::move(rec));
-  }
-
-  // Distinct shared items per column, in first-seen order. Numeric /
-  // boolean columns also get shared items here; the evaluator keys on the
-  // record cells directly, so this is purely informational metadata.
-  for (std::uint32_t f = 0; f < headers.size(); ++f) {
-    std::vector<std::string> seen_text;
-    for (const PivotCacheRecord& rec : cache.records()) {
-      const Value& cell = rec.cells[f];
-      if (cell.kind() != ValueKind::Text) {
-        continue;
-      }
-      const std::string text(cell.as_text());
-      if (std::find(seen_text.begin(), seen_text.end(), text) == seen_text.end()) {
-        seen_text.push_back(text);
-        cache.mutable_text_storage().emplace_back(text);
-        cache.mutable_fields()[f].shared_items.push_back(Value::text(cache.text_storage().back()));
-      }
-    }
-  }
-
-  // --- table: fields + axes ------------------------------------------------
-  ASSIGN_OR_RETURN(std::vector<std::string> row_fields, string_list(pivot, "row_fields"));
-  ASSIGN_OR_RETURN(std::vector<std::string> col_fields, string_list(pivot, "col_fields"));
-  ASSIGN_OR_RETURN(std::vector<std::string> page_fields, string_list(pivot, "page_fields"));
-
-  PivotTable table;
-  table.set_pivot_cache_id(kBuilderCacheId);
-
-  // Manual item filters: collect a hidden-item set per field name so the
-  // matching `PivotField::items` can carry `visible = false`.
-  std::map<std::string, std::vector<std::string>> hidden_items;
-  if (const JsonValue* filters_v = pivot.find("filters"); filters_v != nullptr && !filters_v->is_null()) {
-    if (!filters_v->is_array()) {
-      return invalid("pivot 'filters' must be an array");
-    }
-    for (const JsonValue& filter : filters_v->as_array()) {
-      if (!filter.is_object()) {
-        return invalid("pivot 'filters' entries must be objects");
-      }
-      const JsonValue* field_v = filter.find("field");
-      const JsonValue* hide_v = filter.find("hide");
-      if (field_v == nullptr || !field_v->is_string() || hide_v == nullptr || !hide_v->is_array()) {
-        return invalid("pivot filter needs string 'field' and array 'hide'");
-      }
-      std::vector<std::string>& hidden = hidden_items[field_v->as_string()];
-      for (const JsonValue& item : hide_v->as_array()) {
-        if (!item.is_string()) {
-          return invalid("pivot filter 'hide' entries must be strings");
-        }
-        hidden.push_back(item.as_string());
-      }
-    }
-  }
-
-  // Build one `PivotField` per source header, in source-column order, so a
-  // data field's `field_index` lines up with the cache field index. The
-  // axis starts at `None` — an available field the report does not place —
-  // and is promoted when the field name appears in `row_fields` /
-  // `col_fields` / `page_fields`. `Page` is a placement of its own and
-  // draws a header above the report, so a source column nobody positioned
-  // must not borrow it.
-  for (std::uint32_t f = 0; f < headers.size(); ++f) {
-    PivotField field;
-    field.source_name = headers[f];
-    field.axis = PivotAxis::None;
-    auto hidden_it = hidden_items.find(headers[f]);
-    if (hidden_it != hidden_items.end()) {
-      for (const Value& shared : cache.fields()[f].shared_items) {
-        if (shared.kind() != ValueKind::Text) {
-          continue;
-        }
-        const std::string item_name(shared.as_text());
-        const bool hidden =
-            std::find(hidden_it->second.begin(), hidden_it->second.end(), item_name) != hidden_it->second.end();
-        field.items.push_back(PivotItem{item_name, !hidden});
-      }
-    }
-    table.mutable_fields().push_back(std::move(field));
-  }
-
-  for (const std::string& name : row_fields) {
-    const std::uint32_t idx = header_index(headers, name);
-    if (idx >= headers.size()) {
-      return invalid("pivot 'row_fields' names a non-source field '" + name + "'");
-    }
-    table.mutable_fields()[idx].axis = PivotAxis::Row;
-    table.mutable_row_field_order().push_back(idx);
-  }
-  for (const std::string& name : col_fields) {
-    const std::uint32_t idx = header_index(headers, name);
-    if (idx >= headers.size()) {
-      return invalid("pivot 'col_fields' names a non-source field '" + name + "'");
-    }
-    table.mutable_fields()[idx].axis = PivotAxis::Col;
-    table.mutable_col_field_order().push_back(idx);
-  }
-  for (const std::string& name : page_fields) {
-    const std::uint32_t idx = header_index(headers, name);
-    if (idx >= headers.size()) {
-      return invalid("pivot 'page_fields' names a non-source field '" + name + "'");
-    }
-    if (table.mutable_fields()[idx].axis == PivotAxis::Row || table.mutable_fields()[idx].axis == PivotAxis::Col) {
-      return invalid("pivot 'page_fields' overlaps a row/column field '" + name + "'");
-    }
-    table.mutable_fields()[idx].axis = PivotAxis::Page;
-  }
-
-  // Excel's compact layout (the default) implicitly shows a subtotal
-  // row for every non-leaf row field. The declarative spec does not
-  // model that directly, so flip `subtotal_top` on every row / col
-  // field that has at least one descendant on the same axis. The
-  // leaf-most field on each axis is left alone — its values already
-  // occupy the data rows / columns.
-  if (table.mutable_row_field_order().size() > 1) {
-    for (std::size_t i = 0; i + 1 < table.mutable_row_field_order().size(); ++i) {
-      const std::uint32_t idx = table.mutable_row_field_order()[i];
-      table.mutable_fields()[idx].subtotal_top = true;
-    }
-  }
-  if (table.mutable_col_field_order().size() > 1) {
-    for (std::size_t i = 0; i + 1 < table.mutable_col_field_order().size(); ++i) {
-      const std::uint32_t idx = table.mutable_col_field_order()[i];
-      table.mutable_fields()[idx].subtotal_top = true;
-    }
-  }
-
-  // --- table: data fields --------------------------------------------------
-  // Excel auto-disambiguates the displayed source-field name when the
-  // same source column is aggregated more than once on the value axis
-  // (e.g. Sum(Amount) + Count(Amount) renders as "合計 / Amount" and
-  // "個数 / Amount2"). Track the running per-source-name occurrence
-  // count so the synthesised display names match the Excel pivot UI.
-  const JsonValue* data_v = pivot.find("data_fields");
-  if (data_v == nullptr || !data_v->is_array() || data_v->as_array().empty()) {
-    return invalid("pivot block needs a non-empty 'data_fields' array");
-  }
-  const ExcelProfile profile = workbook->excel_profile();
-  std::map<std::string, std::uint32_t> source_name_occurrences;
-  for (const JsonValue& df : data_v->as_array()) {
-    if (!df.is_object()) {
-      return invalid("pivot 'data_fields' entries must be objects");
-    }
-    const JsonValue* field_v = df.find("field");
-    const JsonValue* agg_v = df.find("agg");
-    if (field_v == nullptr || !field_v->is_string()) {
-      return invalid("pivot data field missing string 'field'");
-    }
-    if (agg_v == nullptr || !agg_v->is_string()) {
-      return invalid("pivot data field missing string 'agg'");
-    }
-    const std::uint32_t idx = header_index(headers, field_v->as_string());
-    if (idx >= headers.size()) {
-      return invalid("pivot data field names a non-source field '" + field_v->as_string() + "'");
-    }
-    ASSIGN_OR_RETURN(Aggregation agg, aggregation_from_string(agg_v->as_string()));
-    table.mutable_fields()[idx].axis = PivotAxis::Value;
-
-    const std::string& source = field_v->as_string();
-    const std::uint32_t occurrence = ++source_name_occurrences[source];
-    std::string display_source = source;
-    if (occurrence > 1) {
-      display_source += std::to_string(occurrence);
-    }
-
-    PivotDataField data_field;
-    data_field.name = pivot::data_field_display_name(agg, display_source, profile);
-    data_field.field_index = idx;
-    data_field.aggregation = agg;
-    table.mutable_data_fields().push_back(std::move(data_field));
-  }
-
-  // --- table: layout / anchor / grand totals -------------------------------
-  if (const JsonValue* layout_v = pivot.find("layout"); layout_v != nullptr && !layout_v->is_null()) {
-    if (!layout_v->is_string()) {
-      return invalid("pivot 'layout' must be a string");
-    }
-    ASSIGN_OR_RETURN(PivotLayout layout, layout_from_string(layout_v->as_string()));
-    table.set_layout(layout);
-  }
-
-  bool grand_rows = true;
-  bool grand_cols = true;
-  if (const JsonValue* gt_v = pivot.find("grand_totals"); gt_v != nullptr && !gt_v->is_null()) {
-    if (!gt_v->is_object()) {
-      return invalid("pivot 'grand_totals' must be an object");
-    }
-    if (const JsonValue* rv = gt_v->find("rows"); rv != nullptr && rv->is_bool()) {
-      grand_rows = rv->as_bool();
-    }
-    if (const JsonValue* cv = gt_v->find("cols"); cv != nullptr && cv->is_bool()) {
-      grand_cols = cv->as_bool();
-    }
-  }
-  table.set_grand_totals(grand_rows, grand_cols);
-  // Span is left at zero: the layout pass derives the rendered extent from
-  // the evaluated result, not from the anchor's span fields.
-  table.set_anchor(anchor_row, anchor_col, /*rows=*/0, /*cols=*/0);
-
-  BuiltPivot out;
-  out.workbook = std::move(workbook);
-  out.cache = std::move(cache);
-  out.table = std::move(table);
-  return out;
-}
+using ::formulon::pivot::PivotCache;
+using ::formulon::pivot::PivotTable;
+using workbook_builder_detail::invalid;
 
 Expected<std::vector<FormulaProbeResult>, Error> evaluate_pivot_formula_probes(BuiltPivot* built,
                                                                                const JsonValue& spec) {
@@ -678,353 +270,6 @@ Expected<std::vector<FormulaProbeResult>, Error> evaluate_pivot_formula_probes(B
   return out;
 }
 
-// ---------------------------------------------------------------------------
-// Print-spec builder
-// ---------------------------------------------------------------------------
-
-namespace {
-
-/// OOXML built-in defined-name identifiers for the print area and titles.
-constexpr const char* kPrintAreaName = "_xlnm.Print_Area";
-constexpr const char* kPrintTitlesName = "_xlnm.Print_Titles";
-
-/// Applies the case-level `column_widths` / `row_heights` maps onto the
-/// first sheet's layout overrides.
-///
-/// A `column_widths` key is a column letter or `first:last` span
-/// ("A" / "A:D"); each entry becomes one `ColumnLayout{first,last,width}`.
-/// A `row_heights` key is a 1-based Excel row number ("3"); each entry
-/// becomes one `RowLayout{row,height}`. Both maps are optional.
-Expected<void, Error> apply_layout_dimensions(const JsonValue& spec, Sheet* sheet) {
-  // Hidden lines are emitted before the size maps on purpose: both the
-  // pagination fast path and `ColumnWidthChars` resolve a track against the
-  // *first* matching span, so a `column_widths` span covering a hidden
-  // column would otherwise mask it and silently paginate the case as if
-  // nothing were hidden.
-  if (const JsonValue* hidden_v = spec.find("hidden_columns"); hidden_v != nullptr && !hidden_v->is_null()) {
-    if (!hidden_v->is_array()) {
-      return invalid("'hidden_columns' must be an array");
-    }
-    for (const JsonValue& item : hidden_v->as_array()) {
-      if (!item.is_string()) {
-        return invalid("hidden_columns: entries must be column letters");
-      }
-      const std::string& key = item.as_string();
-      std::size_t pos = 0;
-      std::uint32_t col1 = 0;
-      if (!a1::parse_column_letters(key, &pos, &col1) || pos != key.size()) {
-        return invalid("hidden_columns/" + key + ": malformed column key");
-      }
-      ColumnLayout col;
-      col.first = col1 - 1U;
-      col.last = col1 - 1U;
-      col.hidden = true;
-      sheet->mutable_layout().columns.push_back(col);
-    }
-  }
-
-  if (const JsonValue* hidden_v = spec.find("hidden_rows"); hidden_v != nullptr && !hidden_v->is_null()) {
-    if (!hidden_v->is_array()) {
-      return invalid("'hidden_rows' must be an array");
-    }
-    for (const JsonValue& item : hidden_v->as_array()) {
-      if (!item.is_string()) {
-        return invalid("hidden_rows: entries must be 1-based row numbers");
-      }
-      const std::string& key = item.as_string();
-      std::size_t pos = 0;
-      std::uint32_t row1 = 0;
-      if (!a1::parse_uint(key, &pos, &row1) || pos != key.size() || row1 == 0U) {
-        return invalid("hidden_rows/" + key + ": malformed 1-based row key");
-      }
-      RowLayout row;
-      row.row = row1 - 1U;
-      row.hidden = true;
-      sheet->mutable_layout().row_overrides.push_back(row);
-    }
-  }
-
-  if (const JsonValue* widths_v = spec.find("column_widths"); widths_v != nullptr && !widths_v->is_null()) {
-    if (!widths_v->is_object()) {
-      return invalid("'column_widths' must be an object");
-    }
-    for (const auto& [key, value] : widths_v->as_object()) {
-      if (!value.is_number()) {
-        return invalid("column_widths/" + key + ": width must be a number");
-      }
-      const std::size_t colon = key.find(':');
-      std::string_view lhs = key;
-      std::string_view rhs = key;
-      if (colon != std::string::npos) {
-        lhs = std::string_view(key).substr(0, colon);
-        rhs = std::string_view(key).substr(colon + 1);
-      }
-      std::size_t p_lhs = 0;
-      std::size_t p_rhs = 0;
-      std::uint32_t first = 0;
-      std::uint32_t last = 0;
-      if (!a1::parse_column_letters(lhs, &p_lhs, &first) || p_lhs != lhs.size() ||
-          !a1::parse_column_letters(rhs, &p_rhs, &last) || p_rhs != rhs.size()) {
-        return invalid("column_widths/" + key + ": malformed column key");
-      }
-      // `parse_column_letters` yields a 1-based column ordinal.
-      ColumnLayout col;
-      col.first = std::min(first, last) - 1U;
-      col.last = std::max(first, last) - 1U;
-      col.width = value.as_number();
-      sheet->mutable_layout().columns.push_back(col);
-    }
-  }
-
-  if (const JsonValue* heights_v = spec.find("row_heights"); heights_v != nullptr && !heights_v->is_null()) {
-    if (!heights_v->is_object()) {
-      return invalid("'row_heights' must be an object");
-    }
-    for (const auto& [key, value] : heights_v->as_object()) {
-      if (!value.is_number()) {
-        return invalid("row_heights/" + key + ": height must be a number");
-      }
-      std::size_t pos = 0;
-      std::uint32_t row1 = 0;
-      if (!a1::parse_uint(key, &pos, &row1) || pos != key.size() || row1 == 0U) {
-        return invalid("row_heights/" + key + ": malformed 1-based row key");
-      }
-      RowLayout row;
-      row.row = row1 - 1U;
-      row.height = value.as_number();
-      sheet->mutable_layout().row_overrides.push_back(row);
-    }
-  }
-
-  return {};
-}
-
-/// Maps an `orientation` string onto the `Orientation` enum.
-Expected<Orientation, Error> orientation_from_string(const std::string& name) {
-  if (name == "portrait") {
-    return Orientation::kPortrait;
-  }
-  if (name == "landscape") {
-    return Orientation::kLandscape;
-  }
-  if (name == "default") {
-    return Orientation::kDefault;
-  }
-  return invalid("unknown page orientation '" + name + "'");
-}
-
-/// Translates the declarative `page_setup` block into a `PageSetup`.
-///
-/// Absent fields keep the struct/OOXML defaults. A non-zero
-/// `fit_to_width` / `fit_to_height` flips `fit_to_page` on so the
-/// pagination engine derives a shrink factor instead of using `scale`.
-Expected<PageSetup, Error> page_setup_from_spec(const JsonValue& block) {
-  PageSetup setup;
-  if (!block.is_object()) {
-    return invalid("'page_setup' must be an object");
-  }
-  if (const JsonValue* v = block.find("orientation"); v != nullptr && !v->is_null()) {
-    if (!v->is_string()) {
-      return invalid("page_setup 'orientation' must be a string");
-    }
-    ASSIGN_OR_RETURN(setup.orientation, orientation_from_string(v->as_string()));
-  }
-  if (const JsonValue* v = block.find("paper"); v != nullptr && !v->is_null()) {
-    if (!v->is_number()) {
-      return invalid("page_setup 'paper' must be a number");
-    }
-    setup.paper_size = static_cast<std::uint32_t>(v->as_number());
-  }
-  if (const JsonValue* v = block.find("scale"); v != nullptr && !v->is_null()) {
-    if (!v->is_number()) {
-      return invalid("page_setup 'scale' must be a number");
-    }
-    setup.scale = static_cast<std::uint32_t>(v->as_number());
-  }
-  // `PageSetup`'s struct default leaves `fit_to_width` / `fit_to_height`
-  // at 1, which would imply fit-to-page even when the case never asked
-  // for it. The declarative spec instead treats an absent fit field as
-  // 0 (axis unconstrained); only an explicit non-zero entry turns the
-  // fit-to-page toggle on. This mirrors Excel's mutually-exclusive
-  // scale-vs-fit radio: a `scale` case keeps both fit counts at 0.
-  bool fit_specified = false;
-  std::uint32_t fit_width = 0;
-  std::uint32_t fit_height = 0;
-  if (const JsonValue* v = block.find("fit_to_width"); v != nullptr && !v->is_null()) {
-    if (!v->is_number()) {
-      return invalid("page_setup 'fit_to_width' must be a number");
-    }
-    fit_width = static_cast<std::uint32_t>(v->as_number());
-    fit_specified = true;
-  }
-  if (const JsonValue* v = block.find("fit_to_height"); v != nullptr && !v->is_null()) {
-    if (!v->is_number()) {
-      return invalid("page_setup 'fit_to_height' must be a number");
-    }
-    fit_height = static_cast<std::uint32_t>(v->as_number());
-    fit_specified = true;
-  }
-  setup.fit_to_width = fit_width;
-  setup.fit_to_height = fit_height;
-  setup.fit_to_page = fit_specified && (fit_width != 0U || fit_height != 0U);
-  return setup;
-}
-
-/// Collects the integer list at `block[key]`, defaulting to empty. Each
-/// element must be a number; `out` receives every value cast to
-/// `std::uint32_t`.
-Expected<std::vector<std::uint32_t>, Error> uint_list(const JsonValue& block, const char* key) {
-  std::vector<std::uint32_t> out;
-  const JsonValue* v = block.find(key);
-  if (v == nullptr || v->is_null()) {
-    return out;
-  }
-  if (!v->is_array()) {
-    return invalid(std::string("manual_breaks '") + key + "' must be an array");
-  }
-  for (const JsonValue& item : v->as_array()) {
-    if (!item.is_number()) {
-      return invalid(std::string("manual_breaks '") + key + "' entries must be numbers");
-    }
-    out.push_back(static_cast<std::uint32_t>(item.as_number()));
-  }
-  return out;
-}
-
-}  // namespace
-
-Expected<BuiltPrint, Error> build_print_from_spec(const JsonValue& spec) {
-  if (!spec.is_object()) {
-    return invalid("workbook spec must be an object");
-  }
-  const JsonValue* print_v = spec.find("print");
-  if (print_v == nullptr || !print_v->is_object()) {
-    return invalid("workbook spec has no 'print' block");
-  }
-  const JsonValue& print = *print_v;
-
-  ASSIGN_OR_RETURN(std::unique_ptr<Workbook> workbook, build_workbook(spec));
-
-  // --- target sheet --------------------------------------------------------
-  const JsonValue* sheet_v = print.find("sheet");
-  if (sheet_v == nullptr || !sheet_v->is_string()) {
-    return invalid("print block missing string 'sheet'");
-  }
-  const std::string& sheet_name = sheet_v->as_string();
-  std::uint32_t sheet_index = 0;
-  bool found = false;
-  for (std::size_t i = 0; i < workbook->sheet_count(); ++i) {
-    if (workbook->sheet(i).name() == sheet_name) {
-      sheet_index = static_cast<std::uint32_t>(i);
-      found = true;
-      break;
-    }
-  }
-  if (!found) {
-    return invalid("print 'sheet' names an unknown sheet '" + sheet_name + "'");
-  }
-  Sheet& sheet = workbook->sheet(sheet_index);
-
-  // --- case-level layout dimensions ---------------------------------------
-  RETURN_IF_ERROR(apply_layout_dimensions(spec, &sheet));
-
-  // --- page setup ----------------------------------------------------------
-  if (const JsonValue* setup_v = print.find("page_setup"); setup_v != nullptr && !setup_v->is_null()) {
-    ASSIGN_OR_RETURN(PageSetup setup, page_setup_from_spec(*setup_v));
-    sheet.mutable_print_settings().page_setup = setup;
-  }
-
-  // --- manual breaks -------------------------------------------------------
-  if (const JsonValue* breaks_v = print.find("manual_breaks"); breaks_v != nullptr && !breaks_v->is_null()) {
-    if (!breaks_v->is_object()) {
-      return invalid("'manual_breaks' must be an object");
-    }
-    // `rows` carries 1-based Excel row numbers; convert to the 0-based
-    // index the break sits before. `cols` carries column letters.
-    ASSIGN_OR_RETURN(std::vector<std::uint32_t> break_rows, uint_list(*breaks_v, "rows"));
-    for (std::uint32_t row1 : break_rows) {
-      if (row1 == 0U) {
-        return invalid("manual_breaks 'rows' entries must be 1-based row numbers");
-      }
-      ManualBreak brk;
-      brk.id = row1 - 1U;
-      brk.manual = true;
-      sheet.mutable_print_settings().manual_row_breaks.push_back(brk);
-    }
-    if (const JsonValue* cols_v = breaks_v->find("cols"); cols_v != nullptr && !cols_v->is_null()) {
-      if (!cols_v->is_array()) {
-        return invalid("manual_breaks 'cols' must be an array");
-      }
-      for (const JsonValue& item : cols_v->as_array()) {
-        if (!item.is_string()) {
-          return invalid("manual_breaks 'cols' entries must be column letters");
-        }
-        const std::string& letters = item.as_string();
-        std::size_t pos = 0;
-        std::uint32_t col1 = 0;
-        if (!a1::parse_column_letters(letters, &pos, &col1) || pos != letters.size() || col1 == 0U) {
-          return invalid("manual_breaks 'cols' has a malformed column letter '" + letters + "'");
-        }
-        ManualBreak brk;
-        brk.id = col1 - 1U;
-        brk.manual = true;
-        sheet.mutable_print_settings().manual_col_breaks.push_back(brk);
-      }
-    }
-  }
-
-  // --- print-area / print-titles defined names -----------------------------
-  // Excel stores the print area / titles as sheet-scoped built-in defined
-  // names whose formula is a fully-qualified A1 range. The print-area
-  // resolver strips the sheet qualifier and `$` anchors, so a plain
-  // `Sheet1!A1:H80` form is sufficient here.
-  std::vector<DefinedName> defined_names = workbook->defined_names();
-  if (const JsonValue* area_v = print.find("print_area"); area_v != nullptr && !area_v->is_null()) {
-    if (!area_v->is_string()) {
-      return invalid("print 'print_area' must be a string");
-    }
-    DefinedName dn;
-    dn.name = kPrintAreaName;
-    dn.formula = sheet_name + "!" + area_v->as_string();
-    dn.local_sheet_id = static_cast<std::int32_t>(sheet_index);
-    defined_names.push_back(std::move(dn));
-  }
-  if (const JsonValue* titles_v = print.find("print_titles"); titles_v != nullptr && !titles_v->is_null()) {
-    if (!titles_v->is_object()) {
-      return invalid("print 'print_titles' must be an object");
-    }
-    std::string formula;
-    if (const JsonValue* rows_v = titles_v->find("rows"); rows_v != nullptr && !rows_v->is_null()) {
-      if (!rows_v->is_string()) {
-        return invalid("print_titles 'rows' must be a string");
-      }
-      formula = sheet_name + "!" + rows_v->as_string();
-    }
-    if (const JsonValue* cols_v = titles_v->find("cols"); cols_v != nullptr && !cols_v->is_null()) {
-      if (!cols_v->is_string()) {
-        return invalid("print_titles 'cols' must be a string");
-      }
-      if (!formula.empty()) {
-        formula += ",";
-      }
-      formula += sheet_name + "!" + cols_v->as_string();
-    }
-    if (!formula.empty()) {
-      DefinedName dn;
-      dn.name = kPrintTitlesName;
-      dn.formula = std::move(formula);
-      dn.local_sheet_id = static_cast<std::int32_t>(sheet_index);
-      defined_names.push_back(std::move(dn));
-    }
-  }
-  workbook->set_defined_names(std::move(defined_names));
-
-  BuiltPrint out;
-  out.workbook = std::move(workbook);
-  out.sheet_index = sheet_index;
-  return out;
-}
-
 }  // namespace oracle
 }  // namespace tests
 }  // namespace formulon
diff --git a/tests/oracle/workbook_builder_internal.h b/tests/oracle/workbook_builder_internal.h
new file mode 100644
index 000000000..b328a7fd0
--- /dev/null
+++ b/tests/oracle/workbook_builder_internal.h
@@ -0,0 +1,25 @@
+#ifndef FORMULON_TESTS_ORACLE_WORKBOOK_BUILDER_INTERNAL_H_
+#define FORMULON_TESTS_ORACLE_WORKBOOK_BUILDER_INTERNAL_H_
+
+#include <memory>
+#include <string>
+
+#include "tests/oracle/json_reader.h"
+#include "utils/error.h"
+#include "utils/expected.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace tests {
+namespace oracle {
+namespace workbook_builder_detail {
+
+Error invalid(std::string message);
+Expected<std::unique_ptr<Workbook>, Error> build_workbook(const JsonValue& spec);
+
+}  // namespace workbook_builder_detail
+}  // namespace oracle
+}  // namespace tests
+}  // namespace formulon
+
+#endif  // FORMULON_TESTS_ORACLE_WORKBOOK_BUILDER_INTERNAL_H_
diff --git a/tests/oracle/workbook_builder_pivot.cpp b/tests/oracle/workbook_builder_pivot.cpp
new file mode 100644
index 000000000..0a21a2287
--- /dev/null
+++ b/tests/oracle/workbook_builder_pivot.cpp
@@ -0,0 +1,450 @@
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <map>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "defined_name.h"
+#include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
+#include "excel_profile.h"
+#include "pivot/pivot_locale.h"
+#include "tests/oracle/oracle_runner.h"
+#include "tests/oracle/workbook_builder.h"
+#include "tests/oracle/workbook_builder_internal.h"
+#include "utils/a1_ref.h"
+#include "utils/status_macros.h"
+#include "value.h"
+
+namespace formulon {
+namespace tests {
+namespace oracle {
+
+using workbook_builder_detail::build_workbook;
+using workbook_builder_detail::invalid;
+
+namespace {
+
+using ::formulon::pivot::Aggregation;
+using ::formulon::pivot::PivotAxis;
+using ::formulon::pivot::PivotCache;
+using ::formulon::pivot::PivotCacheField;
+using ::formulon::pivot::PivotCacheRecord;
+using ::formulon::pivot::PivotDataField;
+using ::formulon::pivot::PivotField;
+using ::formulon::pivot::PivotItem;
+using ::formulon::pivot::PivotLayout;
+using ::formulon::pivot::PivotTable;
+
+/// Cache id stamped on the single cache the builder constructs. The
+/// workbook-oracle harness never assembles more than one pivot per case,
+/// so a fixed id is sufficient and keeps the table/cache binding obvious.
+constexpr std::uint32_t kBuilderCacheId = 1;
+
+/// Parses a sheet-qualified A1 range ("Data!A1:C13") into the sheet name
+/// plus 0-based inclusive row/col bounds.
+struct SourceRange {
+  std::string sheet;
+  std::uint32_t r0 = 0;
+  std::uint32_t c0 = 0;
+  std::uint32_t r1 = 0;
+  std::uint32_t c1 = 0;
+};
+
+Expected<SourceRange, Error> parse_source_range(const std::string& spec_text) {
+  auto [sheet, bare] = split_sheet_qualified_addr(spec_text);
+  if (sheet.empty()) {
+    return invalid("pivot 'source' must be sheet-qualified: '" + spec_text + "'");
+  }
+  const std::size_t colon = bare.find(':');
+  if (colon == std::string::npos) {
+    return invalid("pivot 'source' must be an A1 range: '" + spec_text + "'");
+  }
+  SourceRange out;
+  out.sheet = sheet;
+  if (!a1_to_row_col(bare.substr(0, colon), &out.r0, &out.c0) ||
+      !a1_to_row_col(bare.substr(colon + 1), &out.r1, &out.c1)) {
+    return invalid("pivot 'source' has a malformed endpoint: '" + spec_text + "'");
+  }
+  if (out.r1 < out.r0 || out.c1 < out.c0) {
+    return invalid("pivot 'source' range is inverted: '" + spec_text + "'");
+  }
+  return out;
+}
+
+/// Maps an `agg` string from the declarative spec onto the `Aggregation`
+/// enum. The accepted names mirror the enumerators one-to-one.
+Expected<Aggregation, Error> aggregation_from_string(const std::string& name) {
+  if (name == "Sum") {
+    return Aggregation::Sum;
+  }
+  if (name == "Count") {
+    return Aggregation::Count;
+  }
+  if (name == "Average") {
+    return Aggregation::Average;
+  }
+  if (name == "Max") {
+    return Aggregation::Max;
+  }
+  if (name == "Min") {
+    return Aggregation::Min;
+  }
+  if (name == "Product") {
+    return Aggregation::Product;
+  }
+  if (name == "CountNumbers") {
+    return Aggregation::CountNumbers;
+  }
+  if (name == "StdDev") {
+    return Aggregation::StdDev;
+  }
+  if (name == "StdDevP") {
+    return Aggregation::StdDevP;
+  }
+  if (name == "Var") {
+    return Aggregation::Var;
+  }
+  if (name == "VarP") {
+    return Aggregation::VarP;
+  }
+  return invalid("unknown aggregation '" + name + "'");
+}
+
+/// Maps a `layout` string onto the `PivotLayout` enum. Defaults to Compact
+/// when the spec omits the field; an unrecognised value is an error.
+Expected<PivotLayout, Error> layout_from_string(const std::string& name) {
+  if (name == "Compact") {
+    return PivotLayout::Compact;
+  }
+  if (name == "Tabular") {
+    return PivotLayout::Tabular;
+  }
+  if (name == "Outline") {
+    return PivotLayout::Outline;
+  }
+  return invalid("unknown pivot layout '" + name + "'");
+}
+
+/// Returns the 0-based column offset of `header` within the source-range
+/// header row, or `npos`-equivalent (`field_count`) when not found.
+std::uint32_t header_index(const std::vector<std::string>& headers, const std::string& name) {
+  for (std::uint32_t i = 0; i < headers.size(); ++i) {
+    if (headers[i] == name) {
+      return i;
+    }
+  }
+  return static_cast<std::uint32_t>(headers.size());
+}
+
+/// Collects the string list at `obj[key]`, defaulting to empty when the
+/// key is absent. Each element must be a string.
+Expected<std::vector<std::string>, Error> string_list(const JsonValue& obj, const char* key) {
+  std::vector<std::string> out;
+  const JsonValue* v = obj.find(key);
+  if (v == nullptr || v->is_null()) {
+    return out;
+  }
+  if (!v->is_array()) {
+    return invalid(std::string("pivot '") + key + "' must be an array");
+  }
+  for (const JsonValue& item : v->as_array()) {
+    if (!item.is_string()) {
+      return invalid(std::string("pivot '") + key + "' entries must be strings");
+    }
+    out.push_back(item.as_string());
+  }
+  return out;
+}
+
+}  // namespace
+
+Expected<BuiltPivot, Error> build_pivot_from_spec(const JsonValue& spec) {
+  if (!spec.is_object()) {
+    return invalid("workbook spec must be an object");
+  }
+  const JsonValue* pivot_v = spec.find("pivot");
+  if (pivot_v == nullptr || !pivot_v->is_object()) {
+    return invalid("workbook spec has no 'pivot' block");
+  }
+  const JsonValue& pivot = *pivot_v;
+
+  ASSIGN_OR_RETURN(std::unique_ptr<Workbook> workbook, build_workbook(spec));
+
+  // --- source range --------------------------------------------------------
+  const JsonValue* source_v = pivot.find("source");
+  if (source_v == nullptr || !source_v->is_string()) {
+    return invalid("pivot block missing string 'source'");
+  }
+  ASSIGN_OR_RETURN(SourceRange src, parse_source_range(source_v->as_string()));
+  const Sheet* src_sheet = workbook->sheet_by_name(src.sheet);
+  if (src_sheet == nullptr) {
+    return invalid("pivot 'source' names an unknown sheet '" + src.sheet + "'");
+  }
+
+  // --- anchor --------------------------------------------------------------
+  const JsonValue* anchor_v = pivot.find("anchor");
+  if (anchor_v == nullptr || !anchor_v->is_string()) {
+    return invalid("pivot block missing string 'anchor'");
+  }
+  auto [anchor_sheet, anchor_bare] = split_sheet_qualified_addr(anchor_v->as_string());
+  std::uint32_t anchor_row = 0;
+  std::uint32_t anchor_col = 0;
+  if (!a1_to_row_col(anchor_bare, &anchor_row, &anchor_col)) {
+    return invalid("pivot 'anchor' has a malformed A1 address");
+  }
+
+  // --- cache: header row + records ----------------------------------------
+  std::vector<std::string> headers;
+  headers.reserve(src.c1 - src.c0 + 1);
+  for (std::uint32_t c = src.c0; c <= src.c1; ++c) {
+    const Value header = src_sheet->resolve_cell_value(src.r0, c);
+    if (header.kind() != ValueKind::Text) {
+      return invalid("pivot 'source' header row must be text in every column");
+    }
+    headers.emplace_back(header.as_text());
+  }
+
+  PivotCache cache;
+  cache.set_cache_id(kBuilderCacheId);
+  for (const std::string& name : headers) {
+    cache.mutable_fields().push_back(PivotCacheField{name, {}});
+  }
+  for (std::uint32_t r = src.r0 + 1; r <= src.r1; ++r) {
+    PivotCacheRecord rec;
+    rec.cells.reserve(headers.size());
+    // Every cell below is stored inline (verbatim), never as an index into
+    // `shared_items` -- explicit so `cell_value()` (record_access.h) does
+    // not fall back to inferring the encoding from `shared_items` being
+    // non-empty. That fallback assumes a field with shared items indexes
+    // *every* cell through them; this harness only populates shared_items
+    // from a field's text values (informational, for filter-item lookup),
+    // so a field mixing numbers and text -- e.g. Count(Amount) with one
+    // error/text cell among the numbers -- would otherwise have its
+    // numeric cells misread as out-of-range shared-item indices and
+    // collapse to Blank.
+    rec.cell_is_index.assign(headers.size(), false);
+    for (std::uint32_t c = src.c0; c <= src.c1; ++c) {
+      Value cell = src_sheet->resolve_cell_value(r, c);
+      // The cache must outlive the workbook's text views once the
+      // workbook is moved into `BuiltPivot`, so any text payload is
+      // re-interned into the cache's own pointer-stable storage.
+      if (cell.kind() == ValueKind::Text) {
+        cache.mutable_text_storage().emplace_back(cell.as_text());
+        cell = Value::text(cache.text_storage().back());
+      }
+      rec.cells.push_back(cell);
+    }
+    cache.mutable_records().push_back(std::move(rec));
+  }
+
+  // Distinct shared items per column, in first-seen order. Numeric /
+  // boolean columns also get shared items here; the evaluator keys on the
+  // record cells directly, so this is purely informational metadata.
+  for (std::uint32_t f = 0; f < headers.size(); ++f) {
+    std::vector<std::string> seen_text;
+    for (const PivotCacheRecord& rec : cache.records()) {
+      const Value& cell = rec.cells[f];
+      if (cell.kind() != ValueKind::Text) {
+        continue;
+      }
+      const std::string text(cell.as_text());
+      if (std::find(seen_text.begin(), seen_text.end(), text) == seen_text.end()) {
+        seen_text.push_back(text);
+        cache.mutable_text_storage().emplace_back(text);
+        cache.mutable_fields()[f].shared_items.push_back(Value::text(cache.text_storage().back()));
+      }
+    }
+  }
+
+  // --- table: fields + axes ------------------------------------------------
+  ASSIGN_OR_RETURN(std::vector<std::string> row_fields, string_list(pivot, "row_fields"));
+  ASSIGN_OR_RETURN(std::vector<std::string> col_fields, string_list(pivot, "col_fields"));
+  ASSIGN_OR_RETURN(std::vector<std::string> page_fields, string_list(pivot, "page_fields"));
+
+  PivotTable table;
+  table.set_pivot_cache_id(kBuilderCacheId);
+
+  // Manual item filters: collect a hidden-item set per field name so the
+  // matching `PivotField::items` can carry `visible = false`.
+  std::map<std::string, std::vector<std::string>> hidden_items;
+  if (const JsonValue* filters_v = pivot.find("filters"); filters_v != nullptr && !filters_v->is_null()) {
+    if (!filters_v->is_array()) {
+      return invalid("pivot 'filters' must be an array");
+    }
+    for (const JsonValue& filter : filters_v->as_array()) {
+      if (!filter.is_object()) {
+        return invalid("pivot 'filters' entries must be objects");
+      }
+      const JsonValue* field_v = filter.find("field");
+      const JsonValue* hide_v = filter.find("hide");
+      if (field_v == nullptr || !field_v->is_string() || hide_v == nullptr || !hide_v->is_array()) {
+        return invalid("pivot filter needs string 'field' and array 'hide'");
+      }
+      std::vector<std::string>& hidden = hidden_items[field_v->as_string()];
+      for (const JsonValue& item : hide_v->as_array()) {
+        if (!item.is_string()) {
+          return invalid("pivot filter 'hide' entries must be strings");
+        }
+        hidden.push_back(item.as_string());
+      }
+    }
+  }
+
+  // Build one `PivotField` per source header, in source-column order, so a
+  // data field's `field_index` lines up with the cache field index. The
+  // axis starts at `None` — an available field the report does not place —
+  // and is promoted when the field name appears in `row_fields` /
+  // `col_fields` / `page_fields`. `Page` is a placement of its own and
+  // draws a header above the report, so a source column nobody positioned
+  // must not borrow it.
+  for (std::uint32_t f = 0; f < headers.size(); ++f) {
+    PivotField field;
+    field.source_name = headers[f];
+    field.axis = PivotAxis::None;
+    auto hidden_it = hidden_items.find(headers[f]);
+    if (hidden_it != hidden_items.end()) {
+      for (const Value& shared : cache.fields()[f].shared_items) {
+        if (shared.kind() != ValueKind::Text) {
+          continue;
+        }
+        const std::string item_name(shared.as_text());
+        const bool hidden =
+            std::find(hidden_it->second.begin(), hidden_it->second.end(), item_name) != hidden_it->second.end();
+        field.items.push_back(PivotItem{item_name, !hidden});
+      }
+    }
+    table.mutable_fields().push_back(std::move(field));
+  }
+
+  for (const std::string& name : row_fields) {
+    const std::uint32_t idx = header_index(headers, name);
+    if (idx >= headers.size()) {
+      return invalid("pivot 'row_fields' names a non-source field '" + name + "'");
+    }
+    table.mutable_fields()[idx].axis = PivotAxis::Row;
+    table.mutable_row_field_order().push_back(idx);
+  }
+  for (const std::string& name : col_fields) {
+    const std::uint32_t idx = header_index(headers, name);
+    if (idx >= headers.size()) {
+      return invalid("pivot 'col_fields' names a non-source field '" + name + "'");
+    }
+    table.mutable_fields()[idx].axis = PivotAxis::Col;
+    table.mutable_col_field_order().push_back(idx);
+  }
+  for (const std::string& name : page_fields) {
+    const std::uint32_t idx = header_index(headers, name);
+    if (idx >= headers.size()) {
+      return invalid("pivot 'page_fields' names a non-source field '" + name + "'");
+    }
+    if (table.mutable_fields()[idx].axis == PivotAxis::Row || table.mutable_fields()[idx].axis == PivotAxis::Col) {
+      return invalid("pivot 'page_fields' overlaps a row/column field '" + name + "'");
+    }
+    table.mutable_fields()[idx].axis = PivotAxis::Page;
+  }
+
+  // Excel's compact layout (the default) implicitly shows a subtotal
+  // row for every non-leaf row field. The declarative spec does not
+  // model that directly, so flip `subtotal_top` on every row / col
+  // field that has at least one descendant on the same axis. The
+  // leaf-most field on each axis is left alone — its values already
+  // occupy the data rows / columns.
+  if (table.mutable_row_field_order().size() > 1) {
+    for (std::size_t i = 0; i + 1 < table.mutable_row_field_order().size(); ++i) {
+      const std::uint32_t idx = table.mutable_row_field_order()[i];
+      table.mutable_fields()[idx].subtotal_top = true;
+    }
+  }
+  if (table.mutable_col_field_order().size() > 1) {
+    for (std::size_t i = 0; i + 1 < table.mutable_col_field_order().size(); ++i) {
+      const std::uint32_t idx = table.mutable_col_field_order()[i];
+      table.mutable_fields()[idx].subtotal_top = true;
+    }
+  }
+
+  // --- table: data fields --------------------------------------------------
+  // Excel auto-disambiguates the displayed source-field name when the
+  // same source column is aggregated more than once on the value axis
+  // (e.g. Sum(Amount) + Count(Amount) renders as "合計 / Amount" and
+  // "個数 / Amount2"). Track the running per-source-name occurrence
+  // count so the synthesised display names match the Excel pivot UI.
+  const JsonValue* data_v = pivot.find("data_fields");
+  if (data_v == nullptr || !data_v->is_array() || data_v->as_array().empty()) {
+    return invalid("pivot block needs a non-empty 'data_fields' array");
+  }
+  const ExcelProfile profile = workbook->excel_profile();
+  std::map<std::string, std::uint32_t> source_name_occurrences;
+  for (const JsonValue& df : data_v->as_array()) {
+    if (!df.is_object()) {
+      return invalid("pivot 'data_fields' entries must be objects");
+    }
+    const JsonValue* field_v = df.find("field");
+    const JsonValue* agg_v = df.find("agg");
+    if (field_v == nullptr || !field_v->is_string()) {
+      return invalid("pivot data field missing string 'field'");
+    }
+    if (agg_v == nullptr || !agg_v->is_string()) {
+      return invalid("pivot data field missing string 'agg'");
+    }
+    const std::uint32_t idx = header_index(headers, field_v->as_string());
+    if (idx >= headers.size()) {
+      return invalid("pivot data field names a non-source field '" + field_v->as_string() + "'");
+    }
+    ASSIGN_OR_RETURN(Aggregation agg, aggregation_from_string(agg_v->as_string()));
+    table.mutable_fields()[idx].axis = PivotAxis::Value;
+
+    const std::string& source = field_v->as_string();
+    const std::uint32_t occurrence = ++source_name_occurrences[source];
+    std::string display_source = source;
+    if (occurrence > 1) {
+      display_source += std::to_string(occurrence);
+    }
+
+    PivotDataField data_field;
+    data_field.name = pivot::data_field_display_name(agg, display_source, profile);
+    data_field.field_index = idx;
+    data_field.aggregation = agg;
+    table.mutable_data_fields().push_back(std::move(data_field));
+  }
+
+  // --- table: layout / anchor / grand totals -------------------------------
+  if (const JsonValue* layout_v = pivot.find("layout"); layout_v != nullptr && !layout_v->is_null()) {
+    if (!layout_v->is_string()) {
+      return invalid("pivot 'layout' must be a string");
+    }
+    ASSIGN_OR_RETURN(PivotLayout layout, layout_from_string(layout_v->as_string()));
+    table.set_layout(layout);
+  }
+
+  bool grand_rows = true;
+  bool grand_cols = true;
+  if (const JsonValue* gt_v = pivot.find("grand_totals"); gt_v != nullptr && !gt_v->is_null()) {
+    if (!gt_v->is_object()) {
+      return invalid("pivot 'grand_totals' must be an object");
+    }
+    if (const JsonValue* rv = gt_v->find("rows"); rv != nullptr && rv->is_bool()) {
+      grand_rows = rv->as_bool();
+    }
+    if (const JsonValue* cv = gt_v->find("cols"); cv != nullptr && cv->is_bool()) {
+      grand_cols = cv->as_bool();
+    }
+  }
+  table.set_grand_totals(grand_rows, grand_cols);
+  // Span is left at zero: the layout pass derives the rendered extent from
+  // the evaluated result, not from the anchor's span fields.
+  table.set_anchor(anchor_row, anchor_col, /*rows=*/0, /*cols=*/0);
+
+  BuiltPivot out;
+  out.workbook = std::move(workbook);
+  out.cache = std::move(cache);
+  out.table = std::move(table);
+  return out;
+}
+
+}  // namespace oracle
+}  // namespace tests
+}  // namespace formulon
diff --git a/tests/oracle/workbook_builder_print.cpp b/tests/oracle/workbook_builder_print.cpp
new file mode 100644
index 000000000..11f127122
--- /dev/null
+++ b/tests/oracle/workbook_builder_print.cpp
@@ -0,0 +1,380 @@
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <map>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "defined_name.h"
+#include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
+#include "excel_profile.h"
+#include "pivot/pivot_locale.h"
+#include "tests/oracle/oracle_runner.h"
+#include "tests/oracle/workbook_builder.h"
+#include "tests/oracle/workbook_builder_internal.h"
+#include "utils/a1_ref.h"
+#include "utils/status_macros.h"
+#include "value.h"
+
+namespace formulon {
+namespace tests {
+namespace oracle {
+
+using workbook_builder_detail::build_workbook;
+using workbook_builder_detail::invalid;
+
+// ---------------------------------------------------------------------------
+// Print-spec builder
+// ---------------------------------------------------------------------------
+
+namespace {
+
+/// OOXML built-in defined-name identifiers for the print area and titles.
+constexpr const char* kPrintAreaName = "_xlnm.Print_Area";
+constexpr const char* kPrintTitlesName = "_xlnm.Print_Titles";
+
+/// Applies the case-level `column_widths` / `row_heights` maps onto the
+/// first sheet's layout overrides.
+///
+/// A `column_widths` key is a column letter or `first:last` span
+/// ("A" / "A:D"); each entry becomes one `ColumnLayout{first,last,width}`.
+/// A `row_heights` key is a 1-based Excel row number ("3"); each entry
+/// becomes one `RowLayout{row,height}`. Both maps are optional.
+Expected<void, Error> apply_layout_dimensions(const JsonValue& spec, Sheet* sheet) {
+  // Hidden lines are emitted before the size maps on purpose: both the
+  // pagination fast path and `ColumnWidthChars` resolve a track against the
+  // *first* matching span, so a `column_widths` span covering a hidden
+  // column would otherwise mask it and silently paginate the case as if
+  // nothing were hidden.
+  if (const JsonValue* hidden_v = spec.find("hidden_columns"); hidden_v != nullptr && !hidden_v->is_null()) {
+    if (!hidden_v->is_array()) {
+      return invalid("'hidden_columns' must be an array");
+    }
+    for (const JsonValue& item : hidden_v->as_array()) {
+      if (!item.is_string()) {
+        return invalid("hidden_columns: entries must be column letters");
+      }
+      const std::string& key = item.as_string();
+      std::size_t pos = 0;
+      std::uint32_t col1 = 0;
+      if (!a1::parse_column_letters(key, &pos, &col1) || pos != key.size()) {
+        return invalid("hidden_columns/" + key + ": malformed column key");
+      }
+      ColumnLayout col;
+      col.first = col1 - 1U;
+      col.last = col1 - 1U;
+      col.hidden = true;
+      sheet->mutable_layout().columns.push_back(col);
+    }
+  }
+
+  if (const JsonValue* hidden_v = spec.find("hidden_rows"); hidden_v != nullptr && !hidden_v->is_null()) {
+    if (!hidden_v->is_array()) {
+      return invalid("'hidden_rows' must be an array");
+    }
+    for (const JsonValue& item : hidden_v->as_array()) {
+      if (!item.is_string()) {
+        return invalid("hidden_rows: entries must be 1-based row numbers");
+      }
+      const std::string& key = item.as_string();
+      std::size_t pos = 0;
+      std::uint32_t row1 = 0;
+      if (!a1::parse_uint(key, &pos, &row1) || pos != key.size() || row1 == 0U) {
+        return invalid("hidden_rows/" + key + ": malformed 1-based row key");
+      }
+      RowLayout row;
+      row.row = row1 - 1U;
+      row.hidden = true;
+      sheet->mutable_layout().row_overrides.push_back(row);
+    }
+  }
+
+  if (const JsonValue* widths_v = spec.find("column_widths"); widths_v != nullptr && !widths_v->is_null()) {
+    if (!widths_v->is_object()) {
+      return invalid("'column_widths' must be an object");
+    }
+    for (const auto& [key, value] : widths_v->as_object()) {
+      if (!value.is_number()) {
+        return invalid("column_widths/" + key + ": width must be a number");
+      }
+      const std::size_t colon = key.find(':');
+      std::string_view lhs = key;
+      std::string_view rhs = key;
+      if (colon != std::string::npos) {
+        lhs = std::string_view(key).substr(0, colon);
+        rhs = std::string_view(key).substr(colon + 1);
+      }
+      std::size_t p_lhs = 0;
+      std::size_t p_rhs = 0;
+      std::uint32_t first = 0;
+      std::uint32_t last = 0;
+      if (!a1::parse_column_letters(lhs, &p_lhs, &first) || p_lhs != lhs.size() ||
+          !a1::parse_column_letters(rhs, &p_rhs, &last) || p_rhs != rhs.size()) {
+        return invalid("column_widths/" + key + ": malformed column key");
+      }
+      // `parse_column_letters` yields a 1-based column ordinal.
+      ColumnLayout col;
+      col.first = std::min(first, last) - 1U;
+      col.last = std::max(first, last) - 1U;
+      col.width = value.as_number();
+      sheet->mutable_layout().columns.push_back(col);
+    }
+  }
+
+  if (const JsonValue* heights_v = spec.find("row_heights"); heights_v != nullptr && !heights_v->is_null()) {
+    if (!heights_v->is_object()) {
+      return invalid("'row_heights' must be an object");
+    }
+    for (const auto& [key, value] : heights_v->as_object()) {
+      if (!value.is_number()) {
+        return invalid("row_heights/" + key + ": height must be a number");
+      }
+      std::size_t pos = 0;
+      std::uint32_t row1 = 0;
+      if (!a1::parse_uint(key, &pos, &row1) || pos != key.size() || row1 == 0U) {
+        return invalid("row_heights/" + key + ": malformed 1-based row key");
+      }
+      RowLayout row;
+      row.row = row1 - 1U;
+      row.height = value.as_number();
+      row.has_height = true;
+      row.custom_height = true;
+      sheet->mutable_layout().row_overrides.push_back(row);
+    }
+  }
+
+  return {};
+}
+
+/// Maps an `orientation` string onto the `Orientation` enum.
+Expected<Orientation, Error> orientation_from_string(const std::string& name) {
+  if (name == "portrait") {
+    return Orientation::kPortrait;
+  }
+  if (name == "landscape") {
+    return Orientation::kLandscape;
+  }
+  if (name == "default") {
+    return Orientation::kDefault;
+  }
+  return invalid("unknown page orientation '" + name + "'");
+}
+
+/// Translates the declarative `page_setup` block into a `PageSetup`.
+///
+/// Absent fields keep the struct/OOXML defaults. A non-zero
+/// `fit_to_width` / `fit_to_height` flips `fit_to_page` on so the
+/// pagination engine derives a shrink factor instead of using `scale`.
+Expected<PageSetup, Error> page_setup_from_spec(const JsonValue& block) {
+  PageSetup setup;
+  if (!block.is_object()) {
+    return invalid("'page_setup' must be an object");
+  }
+  if (const JsonValue* v = block.find("orientation"); v != nullptr && !v->is_null()) {
+    if (!v->is_string()) {
+      return invalid("page_setup 'orientation' must be a string");
+    }
+    ASSIGN_OR_RETURN(setup.orientation, orientation_from_string(v->as_string()));
+  }
+  if (const JsonValue* v = block.find("paper"); v != nullptr && !v->is_null()) {
+    if (!v->is_number()) {
+      return invalid("page_setup 'paper' must be a number");
+    }
+    setup.paper_size = static_cast<std::uint32_t>(v->as_number());
+  }
+  if (const JsonValue* v = block.find("scale"); v != nullptr && !v->is_null()) {
+    if (!v->is_number()) {
+      return invalid("page_setup 'scale' must be a number");
+    }
+    setup.scale = static_cast<std::uint32_t>(v->as_number());
+  }
+  // `PageSetup`'s struct default leaves `fit_to_width` / `fit_to_height`
+  // at 1, which would imply fit-to-page even when the case never asked
+  // for it. The declarative spec instead treats an absent fit field as
+  // 0 (axis unconstrained); only an explicit non-zero entry turns the
+  // fit-to-page toggle on. This mirrors Excel's mutually-exclusive
+  // scale-vs-fit radio: a `scale` case keeps both fit counts at 0.
+  bool fit_specified = false;
+  std::uint32_t fit_width = 0;
+  std::uint32_t fit_height = 0;
+  if (const JsonValue* v = block.find("fit_to_width"); v != nullptr && !v->is_null()) {
+    if (!v->is_number()) {
+      return invalid("page_setup 'fit_to_width' must be a number");
+    }
+    fit_width = static_cast<std::uint32_t>(v->as_number());
+    fit_specified = true;
+  }
+  if (const JsonValue* v = block.find("fit_to_height"); v != nullptr && !v->is_null()) {
+    if (!v->is_number()) {
+      return invalid("page_setup 'fit_to_height' must be a number");
+    }
+    fit_height = static_cast<std::uint32_t>(v->as_number());
+    fit_specified = true;
+  }
+  setup.fit_to_width = fit_width;
+  setup.fit_to_height = fit_height;
+  setup.fit_to_page = fit_specified && (fit_width != 0U || fit_height != 0U);
+  return setup;
+}
+
+/// Collects the integer list at `block[key]`, defaulting to empty. Each
+/// element must be a number; `out` receives every value cast to
+/// `std::uint32_t`.
+Expected<std::vector<std::uint32_t>, Error> uint_list(const JsonValue& block, const char* key) {
+  std::vector<std::uint32_t> out;
+  const JsonValue* v = block.find(key);
+  if (v == nullptr || v->is_null()) {
+    return out;
+  }
+  if (!v->is_array()) {
+    return invalid(std::string("manual_breaks '") + key + "' must be an array");
+  }
+  for (const JsonValue& item : v->as_array()) {
+    if (!item.is_number()) {
+      return invalid(std::string("manual_breaks '") + key + "' entries must be numbers");
+    }
+    out.push_back(static_cast<std::uint32_t>(item.as_number()));
+  }
+  return out;
+}
+
+}  // namespace
+
+Expected<BuiltPrint, Error> build_print_from_spec(const JsonValue& spec) {
+  if (!spec.is_object()) {
+    return invalid("workbook spec must be an object");
+  }
+  const JsonValue* print_v = spec.find("print");
+  if (print_v == nullptr || !print_v->is_object()) {
+    return invalid("workbook spec has no 'print' block");
+  }
+  const JsonValue& print = *print_v;
+
+  ASSIGN_OR_RETURN(std::unique_ptr<Workbook> workbook, build_workbook(spec));
+
+  // --- target sheet --------------------------------------------------------
+  const JsonValue* sheet_v = print.find("sheet");
+  if (sheet_v == nullptr || !sheet_v->is_string()) {
+    return invalid("print block missing string 'sheet'");
+  }
+  const std::string& sheet_name = sheet_v->as_string();
+  std::uint32_t sheet_index = 0;
+  bool found = false;
+  for (std::size_t i = 0; i < workbook->sheet_count(); ++i) {
+    if (workbook->sheet(i).name() == sheet_name) {
+      sheet_index = static_cast<std::uint32_t>(i);
+      found = true;
+      break;
+    }
+  }
+  if (!found) {
+    return invalid("print 'sheet' names an unknown sheet '" + sheet_name + "'");
+  }
+  Sheet& sheet = workbook->sheet(sheet_index);
+
+  // --- case-level layout dimensions ---------------------------------------
+  RETURN_IF_ERROR(apply_layout_dimensions(spec, &sheet));
+
+  // --- page setup ----------------------------------------------------------
+  if (const JsonValue* setup_v = print.find("page_setup"); setup_v != nullptr && !setup_v->is_null()) {
+    ASSIGN_OR_RETURN(PageSetup setup, page_setup_from_spec(*setup_v));
+    sheet.mutable_print_settings().page_setup = setup;
+  }
+
+  // --- manual breaks -------------------------------------------------------
+  if (const JsonValue* breaks_v = print.find("manual_breaks"); breaks_v != nullptr && !breaks_v->is_null()) {
+    if (!breaks_v->is_object()) {
+      return invalid("'manual_breaks' must be an object");
+    }
+    // `rows` carries 1-based Excel row numbers; convert to the 0-based
+    // index the break sits before. `cols` carries column letters.
+    ASSIGN_OR_RETURN(std::vector<std::uint32_t> break_rows, uint_list(*breaks_v, "rows"));
+    for (std::uint32_t row1 : break_rows) {
+      if (row1 == 0U) {
+        return invalid("manual_breaks 'rows' entries must be 1-based row numbers");
+      }
+      ManualBreak brk;
+      brk.id = row1 - 1U;
+      brk.manual = true;
+      sheet.mutable_print_settings().manual_row_breaks.push_back(brk);
+    }
+    if (const JsonValue* cols_v = breaks_v->find("cols"); cols_v != nullptr && !cols_v->is_null()) {
+      if (!cols_v->is_array()) {
+        return invalid("manual_breaks 'cols' must be an array");
+      }
+      for (const JsonValue& item : cols_v->as_array()) {
+        if (!item.is_string()) {
+          return invalid("manual_breaks 'cols' entries must be column letters");
+        }
+        const std::string& letters = item.as_string();
+        std::size_t pos = 0;
+        std::uint32_t col1 = 0;
+        if (!a1::parse_column_letters(letters, &pos, &col1) || pos != letters.size() || col1 == 0U) {
+          return invalid("manual_breaks 'cols' has a malformed column letter '" + letters + "'");
+        }
+        ManualBreak brk;
+        brk.id = col1 - 1U;
+        brk.manual = true;
+        sheet.mutable_print_settings().manual_col_breaks.push_back(brk);
+      }
+    }
+  }
+
+  // --- print-area / print-titles defined names -----------------------------
+  // Excel stores the print area / titles as sheet-scoped built-in defined
+  // names whose formula is a fully-qualified A1 range. The print-area
+  // resolver strips the sheet qualifier and `$` anchors, so a plain
+  // `Sheet1!A1:H80` form is sufficient here.
+  std::vector<DefinedName> defined_names = workbook->defined_names();
+  if (const JsonValue* area_v = print.find("print_area"); area_v != nullptr && !area_v->is_null()) {
+    if (!area_v->is_string()) {
+      return invalid("print 'print_area' must be a string");
+    }
+    DefinedName dn;
+    dn.name = kPrintAreaName;
+    dn.formula = sheet_name + "!" + area_v->as_string();
+    dn.local_sheet_id = static_cast<std::int32_t>(sheet_index);
+    defined_names.push_back(std::move(dn));
+  }
+  if (const JsonValue* titles_v = print.find("print_titles"); titles_v != nullptr && !titles_v->is_null()) {
+    if (!titles_v->is_object()) {
+      return invalid("print 'print_titles' must be an object");
+    }
+    std::string formula;
+    if (const JsonValue* rows_v = titles_v->find("rows"); rows_v != nullptr && !rows_v->is_null()) {
+      if (!rows_v->is_string()) {
+        return invalid("print_titles 'rows' must be a string");
+      }
+      formula = sheet_name + "!" + rows_v->as_string();
+    }
+    if (const JsonValue* cols_v = titles_v->find("cols"); cols_v != nullptr && !cols_v->is_null()) {
+      if (!cols_v->is_string()) {
+        return invalid("print_titles 'cols' must be a string");
+      }
+      if (!formula.empty()) {
+        formula += ",";
+      }
+      formula += sheet_name + "!" + cols_v->as_string();
+    }
+    if (!formula.empty()) {
+      DefinedName dn;
+      dn.name = kPrintTitlesName;
+      dn.formula = std::move(formula);
+      dn.local_sheet_id = static_cast<std::int32_t>(sheet_index);
+      defined_names.push_back(std::move(dn));
+    }
+  }
+  workbook->set_defined_names(std::move(defined_names));
+
+  BuiltPrint out;
+  out.workbook = std::move(workbook);
+  out.sheet_index = sheet_index;
+  return out;
+}
+
+}  // namespace oracle
+}  // namespace tests
+}  // namespace formulon
diff --git a/tests/unit/auto_filter_eval_test.cpp b/tests/unit/auto_filter_eval_test.cpp
new file mode 100644
index 000000000..dd022cd2f
--- /dev/null
+++ b/tests/unit/auto_filter_eval_test.cpp
@@ -0,0 +1,242 @@
+#include "cf/auto_filter_eval.h"
+
+#include <cstdint>
+#include <cstdio>
+#include <memory>
+#include <set>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "sheet.h"
+#include "util/test_eval_helpers.h"
+#include "utils/date_time.h"
+#include "value.h"
+#include "workbook.h"
+
+#ifndef FORMULON_FIXTURES_DIR
+#error "FORMULON_FIXTURES_DIR must be defined by the build"
+#endif
+
+namespace formulon {
+namespace {
+
+std::vector<std::uint8_t> ReadFile(const char* file) {
+  std::vector<std::uint8_t> out;
+  const std::string path = std::string(FORMULON_FIXTURES_DIR) + "/excel/" + file;
+  FILE* fp = std::fopen(path.c_str(), "rb");
+  if (fp == nullptr) {
+    ADD_FAILURE() << "could not open fixture: " << path;
+    return out;
+  }
+  std::fseek(fp, 0, SEEK_END);
+  const long size = std::ftell(fp);
+  std::fseek(fp, 0, SEEK_SET);
+  out.resize(size > 0 ? static_cast<std::size_t>(size) : 0U);
+  if (std::fread(out.data(), 1, out.size(), fp) != out.size()) {
+    ADD_FAILURE() << "short read on fixture: " << path;
+    out.clear();
+  }
+  std::fclose(fp);
+  return out;
+}
+
+bool RowHidden(const Sheet& sheet, std::uint32_t row) {
+  for (const RowLayout& r : sheet.layout().row_overrides) {
+    if (r.row == row) {
+      return r.hidden;
+    }
+  }
+  return false;
+}
+
+void SetRowHidden(Sheet& sheet, std::uint32_t row, bool hidden) {
+  for (RowLayout& r : sheet.mutable_layout().row_overrides) {
+    if (r.row == row) {
+      r.hidden = hidden;
+      return;
+    }
+  }
+  RowLayout fresh;
+  fresh.row = row;
+  fresh.hidden = hidden;
+  sheet.mutable_layout().row_overrides.push_back(fresh);
+}
+
+// Every sheet of this workbook was filtered and then saved by Excel, so its
+// saved row-hidden state is the visible set Excel computed. Relative-date
+// cases were filtered on Monday 2026-10-05.
+std::unique_ptr<Workbook> LoadKinds() {
+  const std::vector<std::uint8_t> bytes = ReadFile("auto_filter_kinds.xlsx");
+  auto read = io::read_ooxml(io::ByteSpan{bytes.data(), bytes.size()});
+  if (!read) {
+    ADD_FAILURE() << "fixture did not load";
+    return nullptr;
+  }
+  auto wb = std::make_unique<Workbook>(std::move(read.value().workbook));
+  wb->set_pinned_now(date_time::CivilTime{{2026, 10, 5U}, {12U, 0U, 0U}});
+  return wb;
+}
+
+TEST(AutoFilterEval, ProbeTable) {
+  std::unique_ptr<Workbook> wb = LoadKinds();
+  ASSERT_NE(wb, nullptr);
+  ASSERT_EQ(wb->sheet_count(), 60U);
+  std::size_t evaluated = 0;
+  for (std::size_t i = 0; i < wb->sheet_count(); ++i) {
+    const Sheet& sheet = wb->sheet(i);
+    const AutoFilter* filter = sheet.auto_filter();
+    ASSERT_NE(filter, nullptr) << sheet.name();
+    auto visible = evaluate_auto_filter(*wb, sheet, *filter);
+    ASSERT_TRUE(static_cast<bool>(visible)) << sheet.name();
+    ASSERT_EQ(visible.value().size(), filter->range.last_row - filter->range.first_row) << sheet.name();
+    std::string mismatched;
+    for (std::uint32_t k = 0; k < visible.value().size(); ++k) {
+      const std::uint32_t row = filter->range.first_row + 1U + k;
+      if (visible.value()[k] == RowHidden(sheet, row)) {
+        mismatched += " " + std::to_string(row + 1U);
+      }
+    }
+    EXPECT_TRUE(mismatched.empty()) << sheet.name() << " differs on rows" << mismatched;
+    ++evaluated;
+  }
+  EXPECT_EQ(evaluated, 60U);
+}
+
+// Reapplying re-derives every body row: a matching row hidden by hand is shown
+// again, non-matching rows are hidden, and rows outside the range keep their state.
+TEST(AutoFilterEval, ApplyUnhidesMatchingRows) {
+  std::unique_ptr<Workbook> wb = LoadKinds();
+  ASSERT_NE(wb, nullptr);
+  const std::size_t index = wb->sheet_index_by_name("val_case_apple");
+  ASSERT_LT(index, wb->sheet_count());
+  Sheet& sheet = wb->sheet(index);
+  const AutoFilter filter = *sheet.auto_filter();
+
+  std::set<std::uint32_t> excel_hidden;
+  for (std::uint32_t row = 1; row <= filter.range.last_row; ++row) {
+    if (RowHidden(sheet, row)) {
+      excel_hidden.insert(row);
+    }
+    SetRowHidden(sheet, row, false);
+  }
+  SetRowHidden(sheet, 6, true);   // "apple" (row 7) hidden by hand.
+  SetRowHidden(sheet, 19, true);  // Row 20, outside the range.
+
+  ASSERT_TRUE(static_cast<bool>(apply_auto_filter(*wb, index, filter)));
+  for (std::uint32_t row = 1; row <= filter.range.last_row; ++row) {
+    EXPECT_EQ(RowHidden(sheet, row), excel_hidden.count(row) == 1U) << "row " << row + 1U;
+  }
+  EXPECT_FALSE(RowHidden(sheet, 6));
+  EXPECT_TRUE(RowHidden(sheet, 19));
+
+  // The sheet now carries a criterion, so SUBTOTAL(3) skips the filtered rows
+  // and the outside row alike: rows 6..8 are the only visible values.
+  const Value count = test::EvalSourceIn("=SUBTOTAL(3,A2:A20)", *wb, sheet);
+  ASSERT_TRUE(count.is_number());
+  EXPECT_DOUBLE_EQ(count.as_number(), 3.0);
+}
+
+// Custom-filter conditions x cell types x and/or.
+//
+// Pairwise model (all-pairs by Latin-square construction, join = (cond + cell) % 3):
+//   cond (7): a* | ?b | *b* | <>x | <>a* | >b | <>" " (non-blank)
+//   cell (10): "a" "ab" "*b" "APPLE" "x" ="" blank '5 "ba" "~"   (fixture rows 2,4,5,8,9,10,11,12,13,14)
+//   join (3): single | and *b* | or *b*
+// Every cond x cell pair occurs once and each join meets every cond and every
+// cell. Expected values combine single-condition results Excel produced on
+// the same rows of the fixture's custom-filter sheets.
+struct Cond {
+  const char* name;
+  FilterOperator op;
+  const char* val;
+  std::set<std::uint32_t> excel_visible;  // 1-based rows of the fixture's text cases.
+};
+
+const std::vector<Cond>& Conds() {
+  static const std::vector<Cond> conds = {
+      {"a*", FilterOperator::kEqual, "a*", {2, 4, 6, 7, 8, 15}},
+      {"?b", FilterOperator::kEqual, "?b", {4, 5}},
+      {"*b*", FilterOperator::kEqual, "*b*", {3, 4, 5, 13, 15, 16}},
+      {"<>x", FilterOperator::kNotEqual, "x", {2, 3, 4, 5, 6, 7, 8, 10, 11, 12, 13, 14, 15, 16}},
+      {"<>a*", FilterOperator::kNotEqual, "a*", {3, 5, 9, 10, 11, 12, 13, 14, 16}},
+      {">b", FilterOperator::kGreaterThan, "b", {9, 13, 16}},
+      {"nonblank", FilterOperator::kNotEqual, " ", {2, 3, 4, 5, 6, 7, 8, 9, 12, 13, 14, 15, 16}},
+  };
+  return conds;
+}
+
+TEST(AutoFilterEval, CustomConditionPairwise) {
+  std::unique_ptr<Workbook> wb = LoadKinds();
+  ASSERT_NE(wb, nullptr);
+  const std::size_t index = wb->sheet_index_by_name("cus_ne_x");
+  ASSERT_LT(index, wb->sheet_count());
+  const Sheet& sheet = wb->sheet(index);
+  const std::vector<std::uint32_t> cells = {2, 4, 5, 8, 9, 10, 11, 12, 13, 14};
+  const Cond& second = Conds()[2];
+
+  std::size_t cases = 0;
+  for (std::size_t c = 0; c < Conds().size(); ++c) {
+    for (std::size_t k = 0; k < cells.size(); ++k) {
+      const Cond& cond = Conds()[c];
+      const std::uint32_t row = cells[k];
+      const int join = static_cast<int>((c + k) % 3U);
+
+      AutoFilter filter;
+      filter.range = MergeRange{0, 0, 15, 0};
+      FilterColumn column;
+      column.kind = FilterKind::kCustom;
+      column.custom.filters.push_back(CustomFilter{cond.op, cond.val});
+      bool expected = cond.excel_visible.count(row) == 1U;
+      if (join != 0) {
+        column.custom.and_join = join == 1;
+        column.custom.filters.push_back(CustomFilter{second.op, second.val});
+        const bool other = second.excel_visible.count(row) == 1U;
+        expected = join == 1 ? (expected && other) : (expected || other);
+      }
+      filter.columns.push_back(column);
+
+      auto visible = evaluate_auto_filter(*wb, sheet, filter);
+      ASSERT_TRUE(static_cast<bool>(visible));
+      EXPECT_EQ(visible.value()[row - 2U], expected)
+          << cond.name << " row " << row << " join " << (join == 0 ? "single" : (join == 1 ? "and" : "or"));
+      ++cases;
+    }
+  }
+  EXPECT_EQ(cases, 70U);
+}
+
+TEST(AutoFilterEval, OpaqueFilterIsRejected) {
+  Workbook wb = Workbook::create();
+  AutoFilter filter;
+  filter.opaque_xml = "<autoFilter ref=\"A1:$B$2\"/>";
+  auto visible = evaluate_auto_filter(wb, wb.sheet(0), filter);
+  ASSERT_FALSE(static_cast<bool>(visible));
+  EXPECT_EQ(visible.error().code, FormulonErrorCode::kAutoFilterInvalid);
+}
+
+TEST(AutoFilterEval, TableCriterionMakesSheetFiltered) {
+  Workbook wb = Workbook::create();
+  EXPECT_FALSE(sheet_has_filter_criteria(&wb, wb.sheet(0)));
+  TableMetadata table;
+  table.id = 1;
+  table.name = "T1";
+  table.display_name = "T1";
+  table.ref = "A1:B3";
+  wb.mutable_tables().push_back(table);
+  AutoFilter filter;
+  filter.range = MergeRange{0, 0, 2, 1};
+  ASSERT_TRUE(static_cast<bool>(wb.set_table_auto_filter(0, filter)));
+  EXPECT_FALSE(sheet_has_filter_criteria(&wb, wb.sheet(0)));
+  FilterColumn column;
+  column.kind = FilterKind::kValues;
+  column.values.values.push_back("x");
+  filter.columns.push_back(column);
+  ASSERT_TRUE(static_cast<bool>(wb.set_table_auto_filter(0, filter)));
+  EXPECT_TRUE(sheet_has_filter_criteria(&wb, wb.sheet(0)));
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/auto_filter_model_test.cpp b/tests/unit/auto_filter_model_test.cpp
new file mode 100644
index 000000000..011d25737
--- /dev/null
+++ b/tests/unit/auto_filter_model_test.cpp
@@ -0,0 +1,541 @@
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "auto_filter.h"
+#include "defined_name.h"
+#include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
+#include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "sheet.h"
+#include "table.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+#ifndef FORMULON_FIXTURES_DIR
+#error "FORMULON_FIXTURES_DIR must be defined by the build"
+#endif
+
+namespace formulon {
+namespace {
+
+constexpr std::string_view kFilterDatabase = "_xlnm._FilterDatabase";
+
+// The structure-edit setup measured in Excel: header row 2 of B2:F12, filters on c2
+// (colId 1, value `1`) and c4 (colId 3, value `2`).
+constexpr const char* kProbeFilter =
+    "<autoFilter ref=\"B2:F12\"><filterColumn colId=\"1\"><filters><filter val=\"1\"/></filters></filterColumn>"
+    "<filterColumn colId=\"3\"><filters><filter val=\"2\"/></filters></filterColumn></autoFilter>";
+
+std::vector<std::uint8_t> ReadFileBytes(const std::string& path) {
+  std::vector<std::uint8_t> out;
+  FILE* file = std::fopen(path.c_str(), "rb");
+  if (file == nullptr) {
+    ADD_FAILURE() << "could not open fixture: " << path;
+    return out;
+  }
+  std::fseek(file, 0, SEEK_END);
+  const long size = std::ftell(file);
+  std::fseek(file, 0, SEEK_SET);
+  out.resize(size > 0 ? static_cast<std::size_t>(size) : 0U);
+  if (std::fread(out.data(), 1, out.size(), file) != out.size()) {
+    ADD_FAILURE() << "short read on fixture: " << path;
+  }
+  std::fclose(file);
+  return out;
+}
+
+std::vector<std::uint8_t> FixtureBytes() {
+  return ReadFileBytes(std::string(FORMULON_FIXTURES_DIR) + "/excel/auto_filter_kinds.xlsx");
+}
+
+Workbook Load(const std::vector<std::uint8_t>& bytes) {
+  auto result = io::read_ooxml(io::ByteSpan{bytes.data(), bytes.size()});
+  EXPECT_TRUE(static_cast<bool>(result)) << (result ? "" : result.error().message);
+  return result ? std::move(result.value().workbook) : Workbook::create_empty();
+}
+
+std::vector<std::uint8_t> Save(const Workbook& wb) {
+  auto saved = io::write_ooxml(wb);
+  EXPECT_TRUE(static_cast<bool>(saved)) << (saved ? "" : saved.error().message);
+  return saved ? std::move(saved.value()) : std::vector<std::uint8_t>();
+}
+
+/// Every `<autoFilter>` element in the package's worksheet parts, as written.
+std::vector<std::string> WorksheetAutoFilters(const std::vector<std::uint8_t>& package) {
+  io::ZipReader zip;
+  EXPECT_TRUE(static_cast<bool>(zip.open(io::ByteSpan{package.data(), package.size()})));
+  std::vector<std::string> out;
+  for (const std::string& name : zip.list_entries()) {
+    if (name.rfind("xl/worksheets/sheet", 0) != 0) {
+      continue;
+    }
+    auto bytes = zip.read_entry(name);
+    EXPECT_TRUE(static_cast<bool>(bytes));
+    const std::string xml(bytes.value().begin(), bytes.value().end());
+    const std::size_t begin = xml.find("<autoFilter");
+    if (begin == std::string::npos) {
+      continue;
+    }
+    const std::size_t tag_end = xml.find('>', begin);
+    const std::size_t end = xml[tag_end - 1U] == '/'
+                                ? tag_end + 1U
+                                : xml.find("</autoFilter>", begin) + std::string("</autoFilter>").size();
+    out.push_back(xml.substr(begin, end - begin));
+  }
+  std::sort(out.begin(), out.end());
+  return out;
+}
+
+std::vector<std::string> ModelAutoFilters(const Workbook& wb) {
+  std::vector<std::string> out;
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    if (wb.sheet(i).has_auto_filter()) {
+      out.push_back(io::auto_filter_xml(wb.sheet(i).auto_filter()));
+    }
+  }
+  std::sort(out.begin(), out.end());
+  return out;
+}
+
+const AutoFilter& SheetFilter(const Workbook& wb, std::string_view sheet_name) {
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    if (wb.sheet(i).name() == sheet_name && wb.sheet(i).auto_filter() != nullptr) {
+      return *wb.sheet(i).auto_filter();
+    }
+  }
+  ADD_FAILURE() << "no AutoFilter on sheet " << sheet_name;
+  static const AutoFilter kEmpty;
+  return kEmpty;
+}
+
+/// `B2:E12; colId 2: 2` — the shape of the measured expectation table.
+std::string Describe(const AutoFilter* filter) {
+  if (filter == nullptr) {
+    return "none";
+  }
+  std::string out;
+  append_a1_rectangle(out, filter->range);
+  for (const FilterColumn& col : filter->columns) {
+    out += "; colId " + std::to_string(col.col_id) + ":";
+    for (const std::string& value : col.values.values) {
+      out += " " + value;
+    }
+  }
+  return out;
+}
+
+Workbook NewWorkbook() {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  return wb;
+}
+
+Workbook ProbeWorkbook() {
+  Workbook wb = NewWorkbook();
+  wb.sheet(0).set_auto_filter(io::auto_filter_from_xml(kProbeFilter));
+  return wb;
+}
+
+Workbook ProbeTableWorkbook() {
+  Workbook wb = NewWorkbook();
+  TableMetadata table;
+  table.id = 1;
+  table.name = "Table1";
+  table.display_name = "Table1";
+  table.ref = "B2:F12";
+  table.sheet_index = 0;
+  for (std::uint32_t i = 1; i <= 5; ++i) {
+    table.columns.emplace_back(i, "c" + std::to_string(i), "", "", "");
+  }
+  table.auto_filter_xml.set(io::auto_filter_from_xml(kProbeFilter));
+  wb.mutable_tables().push_back(std::move(table));
+  return wb;
+}
+
+const DefinedName* FilterDatabaseName(const Workbook& wb, std::int32_t sheet) {
+  for (const DefinedName& name : wb.defined_names()) {
+    if (name.name == kFilterDatabase && name.local_sheet_id == sheet) {
+      return &name;
+    }
+  }
+  return nullptr;
+}
+
+TEST(AutoFilterModel, EveryFixtureKindRoundTrips) {
+  const std::vector<std::uint8_t> fixture = FixtureBytes();
+  const std::vector<std::string> written = WorksheetAutoFilters(fixture);
+  ASSERT_EQ(written.size(), 60U);
+  const Workbook wb = Load(fixture);
+  for (std::size_t i = 0; i < wb.sheet_count(); ++i) {
+    if (const AutoFilter* filter = wb.sheet(i).auto_filter()) {
+      EXPECT_FALSE(filter->is_opaque()) << wb.sheet(i).name();
+    }
+  }
+  EXPECT_EQ(ModelAutoFilters(wb), written);
+
+  const std::vector<std::uint8_t> saved = Save(wb);
+  EXPECT_EQ(WorksheetAutoFilters(saved), written);
+  EXPECT_EQ(ModelAutoFilters(Load(saved)), written);
+}
+
+TEST(AutoFilterModel, FixtureKindsParseIntoTypedCriteria) {
+  const Workbook wb = Load(FixtureBytes());
+
+  const FilterColumn& values = SheetFilter(wb, "val_multi_a_c").columns.at(0);
+  EXPECT_EQ(values.kind, FilterKind::kValues);
+  EXPECT_EQ(values.values.values, (std::vector<std::string>{"a", "ab"}));
+  EXPECT_TRUE(SheetFilter(wb, "val_blank_eq").columns.at(0).values.blank);
+
+  const FilterColumn& custom = SheetFilter(wb, "cus_and_gt2_lt5").columns.at(0);
+  ASSERT_EQ(custom.kind, FilterKind::kCustom);
+  EXPECT_TRUE(custom.custom.and_join);
+  ASSERT_EQ(custom.custom.filters.size(), 2U);
+  EXPECT_EQ(custom.custom.filters[0].op, FilterOperator::kGreaterThan);
+  EXPECT_EQ(custom.custom.filters[0].val, "2");
+  EXPECT_EQ(custom.custom.filters[1].op, FilterOperator::kLessThan);
+  EXPECT_EQ(SheetFilter(wb, "cus_ne_x").columns.at(0).custom.filters.at(0).op, FilterOperator::kNotEqual);
+
+  const FilterColumn& bottom = SheetFilter(wb, "bottom_pct_10_n15").columns.at(0);
+  ASSERT_EQ(bottom.kind, FilterKind::kTop10);
+  EXPECT_FALSE(bottom.top10.top);
+  EXPECT_TRUE(bottom.top10.percent);
+  EXPECT_EQ(bottom.top10.val, 10.0);
+  EXPECT_EQ(bottom.top10.filter_val, -1.0);
+
+  const FilterColumn& week = SheetFilter(wb, "dyn_thisWeek").columns.at(0);
+  ASSERT_EQ(week.kind, FilterKind::kDynamic);
+  EXPECT_EQ(week.dynamic.type, DynamicFilterType::kThisWeek);
+  EXPECT_EQ(week.dynamic.val, 46299.0);
+  EXPECT_EQ(week.dynamic.max_val, 46306.0);
+  EXPECT_EQ(SheetFilter(wb, "dyn_Oct").columns.at(0).dynamic.type, DynamicFilterType::kM10);
+  EXPECT_FALSE(SheetFilter(wb, "dyn_Q4").columns.at(0).dynamic.val.has_value());
+
+  const FilterColumn& hour = SheetFilter(wb, "dgi_hour_2025_03_03_12").columns.at(0);
+  ASSERT_EQ(hour.kind, FilterKind::kValues);
+  ASSERT_EQ(hour.values.date_groups.size(), 1U);
+  EXPECT_EQ(hour.values.date_groups[0].year, 2025U);
+  EXPECT_EQ(hour.values.date_groups[0].month, 3U);
+  EXPECT_EQ(hour.values.date_groups[0].day, 3U);
+  EXPECT_EQ(hour.values.date_groups[0].hour, 12U);
+  EXPECT_EQ(hour.values.date_groups[0].grouping, DateTimeGrouping::kHour);
+  EXPECT_TRUE(hour.ext_xml.empty());
+
+  const FilterColumn& font = SheetFilter(wb, "col_font_red").columns.at(0);
+  ASSERT_EQ(font.kind, FilterKind::kColor);
+  EXPECT_EQ(font.color.dxf_id, 1U);
+  EXPECT_FALSE(font.color.cell_color);
+  EXPECT_TRUE(SheetFilter(wb, "col_cell_yellow").columns.at(0).color.cell_color);
+
+  // Excel-saved filters carry `xr:uid`, retained as an unmodelled attribute.
+  ASSERT_EQ(SheetFilter(wb, "top_items_1").extra_attrs.size(), 1U);
+  EXPECT_EQ(SheetFilter(wb, "top_items_1").extra_attrs[0].first, "xr:uid");
+}
+
+TEST(AutoFilterModel, ColIdShiftsOnColumnInsert) {
+  struct Case {
+    std::uint32_t col;
+    const char* expected;
+  };
+  // O5a sheet_insert_col_* rows.
+  const Case cases[] = {
+      {0U, "C2:G12; colId 1: 1; colId 3: 2"},  // A, outside left
+      {1U, "C2:G12; colId 1: 1; colId 3: 2"},  // B, left edge
+      {2U, "B2:G12; colId 2: 1; colId 4: 2"},  // C, inside
+      {4U, "B2:G12; colId 1: 1; colId 4: 2"},  // E, between filters
+      {6U, "B2:F12; colId 1: 1; colId 3: 2"},  // G, outside right
+  };
+  for (const Case& c : cases) {
+    Workbook wb = ProbeWorkbook();
+    ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, c.col, 1U)));
+    EXPECT_EQ(Describe(wb.sheet(0).auto_filter()), c.expected) << "insert at column " << c.col;
+  }
+}
+
+TEST(AutoFilterModel, ColumnDeleteRemovesCriterionAndRenumbers) {
+  struct Case {
+    std::uint32_t col;
+    std::uint32_t count;
+    const char* expected;
+  };
+  // O5a sheet_delete_col_* rows.
+  const Case cases[] = {
+      {1U, 1U, "B2:E12; colId 0: 1; colId 2: 2"},  // B, first
+      {2U, 1U, "B2:E12; colId 2: 2"},              // C, filtered c2
+      {3U, 1U, "B2:E12; colId 1: 1; colId 2: 2"},  // D, unfiltered
+      {4U, 1U, "B2:E12; colId 1: 1"},              // E, filtered c4
+      {5U, 1U, "B2:E12; colId 1: 1; colId 3: 2"},  // F, last
+      {2U, 2U, "B2:D12; colId 1: 2"},              // C:D
+  };
+  for (const Case& c : cases) {
+    Workbook wb = ProbeWorkbook();
+    ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, c.col, c.count)));
+    EXPECT_EQ(Describe(wb.sheet(0).auto_filter()), c.expected) << "delete at column " << c.col;
+  }
+}
+
+TEST(AutoFilterModel, RowEditsMoveTheSheetFilter) {
+  struct Case {
+    bool is_delete;
+    std::uint32_t row;
+    const char* expected;
+  };
+  // O5a sheet_*_row_* rows (0-based row indices).
+  const Case cases[] = {
+      {true, 1U, "none"},                             // header row
+      {true, 11U, "B2:F11; colId 1: 1; colId 3: 2"},  // last body row
+      {true, 0U, "B1:F11; colId 1: 1; colId 3: 2"},   // above the range
+      {true, 4U, "B2:F11; colId 1: 1; colId 3: 2"},   // in the body
+      {false, 1U, "B3:F13; colId 1: 1; colId 3: 2"},  // above the header
+      {false, 4U, "B2:F13; colId 1: 1; colId 3: 2"},  // in the body
+  };
+  for (const Case& c : cases) {
+    Workbook wb = ProbeWorkbook();
+    ASSERT_TRUE(static_cast<bool>(c.is_delete ? wb.delete_rows(0, c.row, 1U) : wb.insert_rows(0, c.row, 1U)));
+    EXPECT_EQ(Describe(wb.sheet(0).auto_filter()), c.expected) << (c.is_delete ? "delete" : "insert") << c.row;
+  }
+}
+
+TEST(AutoFilterModel, HeaderRowDeleteRemovesFilterDatabaseName) {
+  Workbook wb = NewWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter_xml(0, kProbeFilter)));
+  ASSERT_NE(FilterDatabaseName(wb, 0), nullptr);
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, 1U, 1U)));
+  EXPECT_FALSE(wb.sheet(0).has_auto_filter());
+  EXPECT_EQ(FilterDatabaseName(wb, 0), nullptr);
+}
+
+TEST(AutoFilterModel, TableFilterFollowsRowDelete) {
+  // O5a tbl_delete_row_in_body: table and filter shrink, colIds stay.
+  Workbook wb = ProbeTableWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, 4U, 1U)));
+  EXPECT_EQ(wb.tables()[0].ref, "B2:F11");
+  EXPECT_EQ(Describe(wb.tables()[0].auto_filter_xml.get()), "B2:F11; colId 1: 1; colId 3: 2");
+
+  // O5a tbl_delete_col_C_filtered(c2).
+  Workbook cols = ProbeTableWorkbook();
+  ASSERT_TRUE(static_cast<bool>(cols.delete_cols(0, 2U, 1U)));
+  EXPECT_EQ(Describe(cols.tables()[0].auto_filter_xml.get()), "B2:E12; colId 2: 2");
+
+  // O5a tbl_insert_col_at_C_inside.
+  Workbook inserted = ProbeTableWorkbook();
+  ASSERT_TRUE(static_cast<bool>(inserted.insert_cols(0, 2U, 1U)));
+  EXPECT_EQ(Describe(inserted.tables()[0].auto_filter_xml.get()), "B2:G12; colId 2: 1; colId 4: 2");
+
+  // A table filter is never dropped for its header row.
+  Workbook header = ProbeTableWorkbook();
+  ASSERT_TRUE(static_cast<bool>(header.delete_rows(0, 1U, 1U)));
+  EXPECT_NE(header.tables()[0].auto_filter_xml.get(), nullptr);
+  EXPECT_TRUE(header.defined_names().empty());
+}
+
+TEST(AutoFilterModel, OpaqueFragmentSurvives) {
+  const std::string unknown_type =
+      "<autoFilter ref=\"A1:B5\"><filterColumn colId=\"0\"><dynamicFilter type=\"fortnight\"/></filterColumn>"
+      "</autoFilter>";
+  const std::string qualified_ref = "<autoFilter ref=\"Sheet1!D6:E7\"/>";
+  for (const std::string& xml : {unknown_type, qualified_ref}) {
+    EXPECT_EQ(io::parse_auto_filter_xml(xml).error().code, FormulonErrorCode::kAutoFilterInvalid) << xml;
+    Workbook wb = NewWorkbook();
+    ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter_xml(0, xml)));
+    ASSERT_NE(wb.sheet(0).auto_filter(), nullptr);
+    EXPECT_TRUE(wb.sheet(0).auto_filter()->is_opaque());
+    EXPECT_EQ(io::auto_filter_xml(wb.sheet(0).auto_filter()), xml);
+    EXPECT_EQ(FilterDatabaseName(wb, 0), nullptr);
+
+    ASSERT_TRUE(static_cast<bool>(wb.insert_cols(0, 0U, 1U)));
+    EXPECT_EQ(io::auto_filter_xml(wb.sheet(0).auto_filter()), xml);
+    EXPECT_EQ(io::auto_filter_xml(Load(Save(wb)).sheet(0).auto_filter()), xml);
+
+    const auto typed = wb.set_sheet_auto_filter(0, *wb.sheet(0).auto_filter());
+    ASSERT_FALSE(static_cast<bool>(typed));
+    EXPECT_EQ(typed.error().code, FormulonErrorCode::kAutoFilterInvalid);
+  }
+}
+
+TEST(AutoFilterModel, UnknownColumnContentIsRetainedTyped) {
+  const std::string xml =
+      "<autoFilter ref=\"A1:C9\" xr:uid=\"{00000000-0000-0000-0000-000000000001}\">"
+      "<filterColumn colId=\"2\" hiddenButton=\"1\" x:future=\"7\"><filters><filter val=\"x\"/></filters>"
+      "<futureChild a=\"1\"/></filterColumn></autoFilter>";
+  auto parsed = io::parse_auto_filter_xml(xml);
+  ASSERT_TRUE(static_cast<bool>(parsed)) << parsed.error().message;
+  const FilterColumn& col = parsed.value().columns.at(0);
+  EXPECT_TRUE(col.hidden_button);
+  ASSERT_EQ(col.extra_attrs.size(), 1U);
+  EXPECT_EQ(col.extra_attrs[0].first, "x:future");
+  EXPECT_EQ(col.extra_xml, "<futureChild a=\"1\"/>");
+  EXPECT_EQ(io::serialize_auto_filter(parsed.value()), xml);
+}
+
+TEST(AutoFilterModel, ExtLstRoundTrips) {
+  // Date groups lift out of the richdata2 extension; another extension in
+  // the same column and the AutoFilter's own extLst stay verbatim.
+  const std::string xml =
+      "<autoFilter ref=\"A1:A10\"><filterColumn colId=\"0\"><extLst>"
+      "<ext uri=\"{1AD28BCE-077C-4C59-8B6E-1921CE8616D4}\" "
+      "xmlns:xlrd2=\"http://schemas.microsoft.com/office/spreadsheetml/2017/richdata2\"><xlrd2:filterColumn>"
+      "<xlrd2:filters><xlrd2:dateGroupItem year=\"2025\" month=\"3\" dateTimeGrouping=\"month\"/></xlrd2:filters>"
+      "</xlrd2:filterColumn></ext><ext uri=\"{00000000-0000-0000-0000-00000000FFFF}\"><y:other/></ext></extLst>"
+      "</filterColumn><extLst><ext uri=\"{00000000-0000-0000-0000-00000000EEEE}\"/></extLst></autoFilter>";
+  auto parsed = io::parse_auto_filter_xml(xml);
+  ASSERT_TRUE(static_cast<bool>(parsed)) << parsed.error().message;
+  const FilterColumn& col = parsed.value().columns.at(0);
+  ASSERT_EQ(col.kind, FilterKind::kValues);
+  ASSERT_EQ(col.values.date_groups.size(), 1U);
+  EXPECT_EQ(col.values.date_groups[0].year, 2025U);
+  EXPECT_EQ(col.values.date_groups[0].month, 3U);
+  EXPECT_EQ(col.values.date_groups[0].grouping, DateTimeGrouping::kMonth);
+  EXPECT_EQ(col.ext_xml, "<ext uri=\"{00000000-0000-0000-0000-00000000FFFF}\"><y:other/></ext>");
+  EXPECT_EQ(parsed.value().ext_lst_xml, "<extLst><ext uri=\"{00000000-0000-0000-0000-00000000EEEE}\"/></extLst>");
+  EXPECT_EQ(io::serialize_auto_filter(parsed.value()), xml);
+
+  // A legacy `<filters><dateGroupItem>` is written in the extension form
+  // Excel uses (O5b dgi_year_2024).
+  auto legacy = io::parse_auto_filter_xml(
+      "<autoFilter ref=\"A1:A10\"><filterColumn colId=\"0\"><filters>"
+      "<dateGroupItem year=\"2024\" dateTimeGrouping=\"year\"/></filters></filterColumn></autoFilter>");
+  ASSERT_TRUE(static_cast<bool>(legacy));
+  EXPECT_EQ(io::serialize_auto_filter(legacy.value()),
+            "<autoFilter ref=\"A1:A10\"><filterColumn colId=\"0\"><extLst>"
+            "<ext uri=\"{1AD28BCE-077C-4C59-8B6E-1921CE8616D4}\" "
+            "xmlns:xlrd2=\"http://schemas.microsoft.com/office/spreadsheetml/2017/richdata2\"><xlrd2:filterColumn>"
+            "<xlrd2:filters><xlrd2:dateGroupItem year=\"2024\" dateTimeGrouping=\"year\"/></xlrd2:filters>"
+            "</xlrd2:filterColumn></ext></extLst></filterColumn></autoFilter>");
+}
+
+TEST(AutoFilterModel, SortStateRoundTripsAndMoves) {
+  const std::string xml =
+      "<autoFilter ref=\"A1:C9\"><sortState caseSensitive=\"1\" ref=\"A2:C9\">"
+      "<sortCondition descending=\"1\" ref=\"B2:B9\"/><sortCondition sortBy=\"icon\" ref=\"C2:C9\" "
+      "iconSet=\"3Flags\" iconId=\"2\"/></sortState></autoFilter>";
+  auto parsed = io::parse_auto_filter_xml(xml);
+  ASSERT_TRUE(static_cast<bool>(parsed)) << parsed.error().message;
+  ASSERT_TRUE(parsed.value().sort.has_value());
+  EXPECT_EQ(parsed.value().sort->conditions.at(1).icon_set, cf::IconSetName::Three_Flags);
+  EXPECT_EQ(io::serialize_auto_filter(parsed.value()), xml);
+
+  AutoFilter shifted = parsed.value();
+  ASSERT_TRUE(shift_auto_filter(shifted, 1U, 1U, /*is_delete=*/true, /*row_axis=*/false,
+                                /*header_delete_removes=*/true));
+  EXPECT_EQ(io::serialize_auto_filter(shifted),
+            "<autoFilter ref=\"A1:B9\"><sortState caseSensitive=\"1\" ref=\"A2:B9\">"
+            "<sortCondition sortBy=\"icon\" ref=\"B2:B9\" iconSet=\"3Flags\" iconId=\"2\"/></sortState></autoFilter>");
+}
+
+TEST(AutoFilterModel, FilterDatabaseNameCreatedAndRemoved) {
+  Workbook wb = NewWorkbook();
+  const std::size_t quoted = wb.add_sheet("My Data");
+  ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter_xml(0, kProbeFilter)));
+  const DefinedName* name = FilterDatabaseName(wb, 0);
+  ASSERT_NE(name, nullptr);
+  EXPECT_TRUE(name->hidden);
+  EXPECT_EQ(name->formula, "Sheet1!$B$2:$F$12");
+
+  auto narrowed = io::parse_auto_filter_xml("<autoFilter ref=\"A1:A16\"/>");
+  ASSERT_TRUE(static_cast<bool>(narrowed));
+  ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter(quoted, narrowed.value())));
+  ASSERT_NE(FilterDatabaseName(wb, static_cast<std::int32_t>(quoted)), nullptr);
+  EXPECT_EQ(FilterDatabaseName(wb, static_cast<std::int32_t>(quoted))->formula, "'My Data'!$A$1:$A$16");
+  ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter(0, narrowed.value())));
+  EXPECT_EQ(FilterDatabaseName(wb, 0)->formula, "Sheet1!$A$1:$A$16");
+  EXPECT_EQ(wb.defined_names().size(), 2U);
+
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet_auto_filter(0)));
+  EXPECT_FALSE(wb.sheet(0).has_auto_filter());
+  EXPECT_EQ(FilterDatabaseName(wb, 0), nullptr);
+  ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter_xml(quoted, "")));
+  EXPECT_TRUE(wb.defined_names().empty());
+
+  // Tables carry no `_FilterDatabase` name.
+  Workbook tables = ProbeTableWorkbook();
+  auto probe = io::parse_auto_filter_xml(kProbeFilter);
+  ASSERT_TRUE(static_cast<bool>(tables.set_table_auto_filter(0, probe.value())));
+  EXPECT_TRUE(tables.defined_names().empty());
+}
+
+TEST(AutoFilterModel, SetDefinedNameHiddenTogglesTheFlag) {
+  Workbook wb = NewWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Data", "Sheet1!$A$1", 0)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_hidden("data", 0, true)));
+  EXPECT_TRUE(wb.defined_names()[0].hidden);
+  const auto missing = wb.set_defined_name_hidden("Data", -1, true);
+  ASSERT_FALSE(static_cast<bool>(missing));
+  EXPECT_EQ(missing.error().code, FormulonErrorCode::kInvalidArgument);
+}
+
+TEST(AutoFilterModel, ValidationRejectsMalformedModels) {
+  auto base = io::parse_auto_filter_xml(kProbeFilter);
+  ASSERT_TRUE(static_cast<bool>(base));
+  EXPECT_TRUE(static_cast<bool>(validate_auto_filter(base.value())));
+
+  AutoFilter outside = base.value();
+  outside.columns[1].col_id = 5U;  // B..F is five columns wide.
+  AutoFilter unordered = base.value();
+  std::swap(unordered.columns[0], unordered.columns[1]);
+  AutoFilter empty_custom = base.value();
+  empty_custom.columns[0].kind = FilterKind::kCustom;
+  for (const AutoFilter& bad : {outside, unordered, empty_custom}) {
+    Workbook wb = NewWorkbook();
+    const auto result = wb.set_sheet_auto_filter(0, bad);
+    ASSERT_FALSE(static_cast<bool>(result));
+    EXPECT_EQ(result.error().code, FormulonErrorCode::kAutoFilterInvalid);
+    EXPECT_FALSE(wb.sheet(0).has_auto_filter());
+  }
+}
+
+TEST(AutoFilterModel, ChangesDirtySubtotalDependents) {
+  Workbook wb = NewWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0U, 0U, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0U, 2U, "=SUBTOTAL(9,A1:A3)")));
+  const auto evaluated = [&wb]() {
+    auto stats = wb.recalc(eval::default_registry());
+    EXPECT_TRUE(static_cast<bool>(stats));
+    return stats ? stats.value().cells_evaluated : 0U;
+  };
+  evaluated();
+  ASSERT_EQ(evaluated(), 0U);
+
+  auto probe = io::parse_auto_filter_xml(kProbeFilter);
+  ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter(0, probe.value())));
+  EXPECT_EQ(evaluated(), 1U) << "set";
+  ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter_xml(0, kProbeFilter)));
+  EXPECT_EQ(evaluated(), 1U) << "xml view";
+  ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, 3U, 1U)));
+  EXPECT_GE(evaluated(), 1U) << "structural edit";
+  ASSERT_TRUE(static_cast<bool>(wb.remove_sheet_auto_filter(0)));
+  EXPECT_EQ(evaluated(), 1U) << "remove";
+
+  TableMetadata table;
+  table.name = "T";
+  table.display_name = "T";
+  table.ref = "E1:F4";
+  wb.mutable_tables().push_back(std::move(table));
+  ASSERT_TRUE(static_cast<bool>(wb.set_table_auto_filter(0, probe.value())));
+  EXPECT_EQ(evaluated(), 1U) << "table set";
+  ASSERT_TRUE(static_cast<bool>(wb.remove_table_auto_filter(0)));
+  EXPECT_EQ(evaluated(), 1U) << "table remove";
+}
+
+TEST(AutoFilterModel, XlsbSaveReportsTheDeferredFilter) {
+  Workbook wb = NewWorkbook();
+  auto probe = io::parse_auto_filter_xml(kProbeFilter);
+  ASSERT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter(0, probe.value())));
+  auto written = io::xlsb::write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(written)) << written.error().message;
+  EXPECT_EQ(written.value().diagnostics.deferred_feature_count, 1U);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/cf/cf_evaluator_context_test.cpp b/tests/unit/cf/cf_evaluator_context_test.cpp
new file mode 100644
index 000000000..979c77be7
--- /dev/null
+++ b/tests/unit/cf/cf_evaluator_context_test.cpp
@@ -0,0 +1,480 @@
+// Conditional-format evaluator tests: expression, context-aware operands, and time periods.
+
+#include <cstdint>
+
+#include "cell.h"
+#include "cf/cf_evaluator.h"
+#include "cf/cf_types.h"
+#include "cf_evaluator_fixtures.h"
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "utils/date_time.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+namespace formulon::cf {
+namespace {
+
+using test::At;
+using test::CFEvalHarness;
+using test::MakeRange;
+using test::MakeRule;
+using test::PopulateLinearPopulation;
+using test::RGB;
+using test::SqrefContext;
+using test::TwoStopMinMax;
+
+// The context-aware overload routes Expression rules through
+// `helpers::parse_shift_evaluate`, which must canonicalise Excel's
+// `_xlfn.` / `_xlpm.` storage prefixes before parsing (see cf_helpers.cpp)
+// -- the CF-rule ingestion path does not go through the defined-names
+// reader's own stripping, so it needs its own.
+TEST(CFEvaluator, ExpressionRuleAcceptsXlfnPrefixedFunction) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("Sheet1"));
+  eval::EvalState state;
+  eval::EvalContext eval_ctx(wb, s, state);
+  Arena arena;
+  const eval::FunctionRegistry& registry = eval::default_registry();
+
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "_xlfn.LET(_xlpm.x,TRUE,_xlpm.x)";
+
+  CFEvalContext ctx;
+  ctx.anchor = CellAddress{0U, 0U};
+  ctx.target = CellAddress{0U, 0U};
+  ctx.arena = &arena;
+  ctx.registry = &registry;
+  ctx.eval_ctx = &eval_ctx;
+
+  EXPECT_TRUE(match_rule(r, Value::blank(), ctx));
+}
+
+TEST(CFEvaluator, StoredExpressionQualifiedBuiltinDoesNotMatch) {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("SUM", "LAMBDA(x,x+100)", 0)));
+
+  ConditionalFormat block;
+  block.sqref.push_back(MakeRange(0U, 0U, 0U, 0U));
+  CFRule rule = MakeRule(RuleType::Expression);
+  rule.formula1 = "Sheet1!SUM(7)";
+  block.rules.push_back(std::move(rule));
+  sheet.mutable_conditional_formats().push_back(std::move(block));
+
+  Arena arena;
+  eval::EvalState state;
+  eval::EvalContext eval_ctx(wb, sheet, state);
+  CFHost host;
+  host.arena = &arena;
+  host.registry = &eval::default_registry();
+  host.eval_ctx = &eval_ctx;
+  EXPECT_TRUE(evaluate_cf_at(sheet, At(0U, 0U), host).empty());
+}
+
+// ---------------------------------------------------------------------------
+// Context-aware overload: Expression rules and CellIs with non-literal
+// formula1 / formula2.
+// ---------------------------------------------------------------------------
+
+TEST(CFEvaluator, ExpressionRuleLiteralTrueMatches) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "TRUE";
+  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleLiteralFalseDoesNotMatch) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "FALSE";
+  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleNonZeroNumberMatches) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "1";
+  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleZeroNumberDoesNotMatch) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "0";
+  EXPECT_FALSE(match_rule(r, Value::number(1.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleArithmeticComparison) {
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(15.0));  // A1 = 15
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "A1>10";
+  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleRelativeReferenceShiftsToTargetRow) {
+  // Anchor at A1, target at A4. Formula `=A1>10` shifts to `=A4>10`.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(5.0));   // A1
+  harness.sheet.set_cell_value(3, 0, Value::number(15.0));  // A4
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "A1>10";
+  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(3, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleRelativeReferenceShiftsToTargetColumn) {
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(5.0));   // A1
+  harness.sheet.set_cell_value(0, 2, Value::number(20.0));  // C1
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "A1>10";
+  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 2))));
+}
+
+TEST(CFEvaluator, ExpressionRuleAbsoluteReferenceLocksAtAnchor) {
+  // `$A$1>10` always reads A1, regardless of target.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(15.0));  // A1
+  harness.sheet.set_cell_value(0, 5, Value::number(0.0));   // F1
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "$A$1>10";
+  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 5))));
+}
+
+TEST(CFEvaluator, ExpressionRuleErrorResultDoesNotMatch) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "1/0";  // produces #DIV/0!
+  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleTextResultDoesNotMatch) {
+  // Excel's expression-rule truthiness rejects text — only bool / number trigger.
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "\"yes\"";
+  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleParseFailureDoesNotMatch) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "(((";
+  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleMissingFormulaDoesNotMatch) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  // formula1 unset
+  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, ExpressionRuleOutOfBoundsShiftDoesNotMatch) {
+  // Anchor at A1, target at A1 with delta = (-1, 0) is impossible
+  // (target above anchor by one row would land on row 0 = okay).
+  // Pick a formula referencing A1 with anchor at B5 and target at A1
+  // → delta = (-4, -1). Shift A1 by (-4, -1) goes out of bounds.
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::Expression);
+  r.formula1 = "A1>10";
+  // The shifted ref becomes #REF!; comparison `(#REF!)>10` propagates
+  // an error, which is not truthy.
+  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(4, 1), At(0, 0))));
+}
+
+// ---------------------------------------------------------------------------
+// CellIs with non-literal operand
+// ---------------------------------------------------------------------------
+
+TEST(CFEvaluator, CellIsEvaluatesReferenceOperand) {
+  // CellIs Equal `=A1`, with A1 = 10. Cell value = 10 → matches.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(10.0));  // A1
+  CFRule r = MakeRule(RuleType::CellIs);
+  r.op = CellIsOperator::Equal;
+  r.formula1 = "A1";
+  EXPECT_TRUE(match_rule(r, Value::number(10.0), harness.context(At(0, 0), At(0, 0))));
+  EXPECT_FALSE(match_rule(r, Value::number(11.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, CellIsEvaluatesArithmeticOperand) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::CellIs);
+  r.op = CellIsOperator::LessThan;
+  r.formula1 = "10*2";  // = 20
+  EXPECT_TRUE(match_rule(r, Value::number(15.0), harness.context(At(0, 0), At(0, 0))));
+  EXPECT_FALSE(match_rule(r, Value::number(25.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, CellIsBetweenWithReferenceOperands) {
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(5.0));   // A1
+  harness.sheet.set_cell_value(0, 1, Value::number(10.0));  // B1
+  CFRule r = MakeRule(RuleType::CellIs);
+  r.op = CellIsOperator::Between;
+  r.formula1 = "A1";
+  r.formula2 = "B1";
+  EXPECT_TRUE(match_rule(r, Value::number(7.5), harness.context(At(0, 0), At(0, 0))));
+  EXPECT_FALSE(match_rule(r, Value::number(11.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, CellIsLiteralPathStillWorksThroughEvaluatorOverload) {
+  // Verify the context-aware overload doesn't regress the literal path.
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::CellIs);
+  r.op = CellIsOperator::Equal;
+  r.formula1 = "42";
+  EXPECT_TRUE(match_rule(r, Value::number(42.0), harness.context(At(0, 0), At(0, 0))));
+  EXPECT_FALSE(match_rule(r, Value::number(43.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, CellIsReferenceShiftsWithTarget) {
+  // CellIs with `A1` operand, anchor at A1, target at A2 → operand is A2.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(1, 0, Value::number(50.0));  // A2
+  CFRule r = MakeRule(RuleType::CellIs);
+  r.op = CellIsOperator::Equal;
+  r.formula1 = "A1";
+  EXPECT_TRUE(match_rule(r, Value::number(50.0), harness.context(At(0, 0), At(1, 0))));
+}
+
+TEST(CFEvaluator, ContextAwareOverloadDelegatesValueOnlyKinds) {
+  // Verify the context-aware overload routes value-only rules to the
+  // simple overload. This is a regression guard: if the dispatcher
+  // ever forgets to delegate, the rule would silently return false.
+  CFEvalHarness harness;
+  CFRule blanks = MakeRule(RuleType::ContainsBlanks);
+  EXPECT_TRUE(match_rule(blanks, Value::blank(), harness.context(At(0, 0), At(0, 0))));
+  EXPECT_FALSE(match_rule(blanks, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
+
+  CFRule errors = MakeRule(RuleType::ContainsErrors);
+  EXPECT_TRUE(match_rule(errors, Value::error(ErrorCode::Div0), harness.context(At(0, 0), At(0, 0))));
+
+  CFRule contains = MakeRule(RuleType::ContainsText);
+  contains.text = "foo";
+  EXPECT_TRUE(match_rule(contains, Value::text("foobar"), harness.context(At(0, 0), At(0, 0))));
+  EXPECT_FALSE(match_rule(contains, Value::text("bar"), harness.context(At(0, 0), At(0, 0))));
+}
+
+// ---------------------------------------------------------------------------
+// TimePeriod
+//
+// Anchored at Wednesday 2024-03-13 throughout. Excel weekday semantics
+// place that day at WEEKDAY=4 (Sun=1). The week therefore spans
+// 2024-03-10 (Sun) through 2024-03-16 (Sat).
+// ---------------------------------------------------------------------------
+
+CFEvalContext PinnedContext(CFEvalHarness& harness, double today_serial) {
+  CFEvalContext ctx = harness.context(At(0, 0), At(0, 0));
+  ctx.today_serial = today_serial;
+  return ctx;
+}
+
+double Serial(int year, unsigned month, unsigned day) {
+  return date_time::serial_from_ymd(year, month, day);
+}
+
+TEST(CFEvaluator, TimePeriodWithoutTodaySerialDoesNotMatch) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::Today;
+  // ctx.today_serial intentionally left as nullopt.
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13)), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, TimePeriodMissingBucketDoesNotMatch) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  // r.time_period not set
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13)), PinnedContext(harness, Serial(2024, 3, 13))));
+}
+
+TEST(CFEvaluator, TimePeriodNonNumericCellDoesNotMatch) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::Today;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_FALSE(match_rule(r, Value::text("2024-03-13"), ctx));
+  EXPECT_FALSE(match_rule(r, Value::boolean(true), ctx));
+  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
+  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
+}
+
+TEST(CFEvaluator, TimePeriodTodayMatchesSameDay) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::Today;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 12)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 14)), ctx));
+}
+
+TEST(CFEvaluator, TimePeriodTodayDropsTimeOfDayFraction) {
+  // Cell carrying date + 0.75 (= 18:00) still matches Today.
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::Today;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 13) + 0.75), ctx));
+}
+
+TEST(CFEvaluator, TimePeriodYesterdayMatchesPreviousDay) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::Yesterday;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 12)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 11)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));
+}
+
+TEST(CFEvaluator, TimePeriodTomorrowMatchesNextDay) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::Tomorrow;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 14)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 15)), ctx));
+}
+
+TEST(CFEvaluator, TimePeriodLast7DaysSpansSixDaysBackThroughToday) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::Last7Days;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 7)), ctx));   // today - 6
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 6)), ctx));  // today - 7
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 14)), ctx));
+}
+
+TEST(CFEvaluator, TimePeriodThisWeekIsSundayThroughSaturday) {
+  // 2024-03-13 is Wed. Week = 2024-03-10 (Sun) .. 2024-03-16 (Sat).
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::ThisWeek;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 10)), ctx));   // Sun
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));   // Wed
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 16)), ctx));   // Sat
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 9)), ctx));   // prior Sat
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 17)), ctx));  // next Sun
+}
+
+TEST(CFEvaluator, TimePeriodLastWeekIsPriorSundayThroughSaturday) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::LastWeek;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 3)), ctx));    // Sun
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 9)), ctx));    // Sat
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 2)), ctx));   // 2 weeks back
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 10)), ctx));  // this Sun
+}
+
+TEST(CFEvaluator, TimePeriodNextWeekIsFollowingSundayThroughSaturday) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::NextWeek;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 17)), ctx));   // Sun
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 23)), ctx));   // Sat
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 16)), ctx));  // this Sat
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 24)), ctx));  // 2 weeks ahead
+}
+
+TEST(CFEvaluator, TimePeriodThisMonthMatchesSameYearAndMonth) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::ThisMonth;
+  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 1)), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 31)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 2, 29)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 4, 1)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2023, 3, 13)), ctx));  // same month, prior year
+}
+
+TEST(CFEvaluator, TimePeriodLastMonthHandlesYearBoundary) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::LastMonth;
+  // today = 2024-01-15 → last month = 2023-12.
+  const auto ctx = PinnedContext(harness, Serial(2024, 1, 15));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2023, 12, 1)), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2023, 12, 31)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 1, 1)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2023, 11, 30)), ctx));
+}
+
+TEST(CFEvaluator, TimePeriodNextMonthHandlesYearBoundary) {
+  CFEvalHarness harness;
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::NextMonth;
+  // today = 2024-12-15 → next month = 2025-01.
+  const auto ctx = PinnedContext(harness, Serial(2024, 12, 15));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2025, 1, 1)), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(Serial(2025, 1, 31)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 12, 31)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2025, 2, 1)), ctx));
+}
+
+double Date1904Serial(int year, unsigned month, unsigned day) {
+  return date_time::serial_from_ymd(year, month, day, /*date1904=*/true);
+}
+
+// Same anchor and boundary assertions as `TimePeriodThisWeekIsSundayThroughSaturday`,
+// but with every serial encoded under the 1904 system and the context's
+// `EvalContext` carrying that epoch. A decode that silently assumed 1900
+// would land on the wrong civil date and miss these boundaries.
+TEST(CFEvaluator, TimePeriodThisWeekHonorsDate1904Epoch) {
+  CFEvalHarness harness;
+  eval::EvalContext date1904_ctx = harness.eval_ctx.with_date1904(true);
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::ThisWeek;
+  CFEvalContext ctx = PinnedContext(harness, Date1904Serial(2024, 3, 13));
+  ctx.eval_ctx = &date1904_ctx;
+  EXPECT_TRUE(match_rule(r, Value::number(Date1904Serial(2024, 3, 10)), ctx));   // Sun
+  EXPECT_TRUE(match_rule(r, Value::number(Date1904Serial(2024, 3, 16)), ctx));   // Sat
+  EXPECT_FALSE(match_rule(r, Value::number(Date1904Serial(2024, 3, 9)), ctx));   // prior Sat
+  EXPECT_FALSE(match_rule(r, Value::number(Date1904Serial(2024, 3, 17)), ctx));  // next Sun
+}
+
+// Same as `TimePeriodThisMonthMatchesSameYearAndMonth`, under the 1904
+// epoch: the month boundary at 2024-02-29/2024-03-01 only lands correctly
+// if the decode reads the epoch the caller encoded with.
+TEST(CFEvaluator, TimePeriodThisMonthHonorsDate1904Epoch) {
+  CFEvalHarness harness;
+  eval::EvalContext date1904_ctx = harness.eval_ctx.with_date1904(true);
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::ThisMonth;
+  CFEvalContext ctx = PinnedContext(harness, Date1904Serial(2024, 3, 13));
+  ctx.eval_ctx = &date1904_ctx;
+  EXPECT_TRUE(match_rule(r, Value::number(Date1904Serial(2024, 3, 1)), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(Date1904Serial(2024, 3, 31)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Date1904Serial(2024, 2, 29)), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(Date1904Serial(2024, 4, 1)), ctx));
+}
+
+TEST(CFEvaluator, TimePeriodValueOnlyOverloadStillReturnsFalse) {
+  // The value-only overload has no today reference, so TimePeriod
+  // continues to return false there. Pin the contract.
+  CFRule r = MakeRule(RuleType::TimePeriod);
+  r.time_period = TimePeriod::Today;
+  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13))));
+}
+
+// ---------------------------------------------------------------------------
+// DuplicateValues / UniqueValues
+// ---------------------------------------------------------------------------
+
+}  // namespace
+}  // namespace formulon::cf
diff --git a/tests/unit/cf/cf_evaluator_population_test.cpp b/tests/unit/cf/cf_evaluator_population_test.cpp
new file mode 100644
index 000000000..604a66867
--- /dev/null
+++ b/tests/unit/cf/cf_evaluator_population_test.cpp
@@ -0,0 +1,450 @@
+// Conditional-format evaluator tests: population predicates.
+
+#include <cstdint>
+#include <vector>
+
+#include "cf/cf_evaluator.h"
+#include "cf/cf_types.h"
+#include "cf_evaluator_fixtures.h"
+#include "gtest/gtest.h"
+#include "utils/error.h"
+#include "value.h"
+namespace formulon::cf {
+namespace {
+
+using test::At;
+using test::CFEvalHarness;
+using test::MakeRange;
+using test::MakeRule;
+using test::PopulateLinearPopulation;
+using test::RGB;
+using test::SqrefContext;
+using test::TwoStopMinMax;
+
+// ---------------------------------------------------------------------------
+// DuplicateValues / UniqueValues
+// ---------------------------------------------------------------------------
+
+TEST(CFEvaluator, DuplicateValuesWithoutSqrefDoesNotMatch) {
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(7.0));
+  harness.sheet.set_cell_value(0, 1, Value::number(7.0));
+  CFRule r = MakeRule(RuleType::DuplicateValues);
+  // ctx.sqref intentionally nullptr.
+  EXPECT_FALSE(match_rule(r, Value::number(7.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, DuplicateValuesMatchesNumberAppearingTwice) {
+  CFEvalHarness harness;
+  // A1:A3 = [7, 7, 9]. Value 7 appears twice → duplicate; 9 appears once.
+  harness.sheet.set_cell_value(0, 0, Value::number(7.0));
+  harness.sheet.set_cell_value(1, 0, Value::number(7.0));
+  harness.sheet.set_cell_value(2, 0, Value::number(9.0));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
+  CFRule r = MakeRule(RuleType::DuplicateValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(7.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(9.0), ctx));
+}
+
+TEST(CFEvaluator, DuplicateValuesNumbersUseExactEquality) {
+  // 1.0 and 1.0000000001 are distinct under IEEE-754 equality, even
+  // though they round to the same display string.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(1.0));
+  harness.sheet.set_cell_value(1, 0, Value::number(1.0000000001));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 1, 0)};
+  CFRule r = MakeRule(RuleType::DuplicateValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::number(1.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(1.0000000001), ctx));
+}
+
+TEST(CFEvaluator, DuplicateValuesTextIsAsciiCaseInsensitive) {
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::text("apple"));
+  harness.sheet.set_cell_value(1, 0, Value::text("APPLE"));
+  harness.sheet.set_cell_value(2, 0, Value::text("orange"));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
+  CFRule r = MakeRule(RuleType::DuplicateValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::text("apple"), ctx));
+  EXPECT_TRUE(match_rule(r, Value::text("Apple"), ctx));
+  EXPECT_FALSE(match_rule(r, Value::text("orange"), ctx));
+}
+
+TEST(CFEvaluator, DuplicateValuesBooleansMatchByIdentity) {
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::boolean(true));
+  harness.sheet.set_cell_value(1, 0, Value::boolean(true));
+  harness.sheet.set_cell_value(2, 0, Value::boolean(false));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
+  CFRule r = MakeRule(RuleType::DuplicateValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::boolean(true), ctx));
+  EXPECT_FALSE(match_rule(r, Value::boolean(false), ctx));
+}
+
+TEST(CFEvaluator, DuplicateValuesIsCrossKindFalse) {
+  // Number 1 and text "1" are distinct, even though Excel coerces in
+  // some contexts. Mirroring the cellIs cross-kind=false stance.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(1.0));
+  harness.sheet.set_cell_value(1, 0, Value::text("1"));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 1, 0)};
+  CFRule r = MakeRule(RuleType::DuplicateValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::number(1.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::text("1"), ctx));
+}
+
+TEST(CFEvaluator, DuplicateValuesErrorsAndBlanksDoNotMatch) {
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::error(ErrorCode::NA));
+  harness.sheet.set_cell_value(1, 0, Value::error(ErrorCode::NA));
+  // A3 left blank.
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
+  CFRule r = MakeRule(RuleType::DuplicateValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
+  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
+}
+
+TEST(CFEvaluator, DuplicateValuesAcrossMultipleSqrefRanges) {
+  // sqref unions A1:A2 and C1:C2. Value 5 appears in A1 and C2 → dup.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(5.0));
+  harness.sheet.set_cell_value(1, 0, Value::number(99.0));
+  harness.sheet.set_cell_value(0, 2, Value::number(11.0));
+  harness.sheet.set_cell_value(1, 2, Value::number(5.0));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 1, 0), MakeRange(0, 2, 1, 2)};
+  CFRule r = MakeRule(RuleType::DuplicateValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(5.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(99.0), ctx));
+}
+
+TEST(CFEvaluator, UniqueValuesMatchesValueAppearingExactlyOnce) {
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(7.0));
+  harness.sheet.set_cell_value(1, 0, Value::number(7.0));
+  harness.sheet.set_cell_value(2, 0, Value::number(9.0));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
+  CFRule r = MakeRule(RuleType::UniqueValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(9.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(7.0), ctx));
+}
+
+TEST(CFEvaluator, UniqueValuesNonStorableValueKindDoesNotMatch) {
+  // Errors and blanks never match either rule.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(1.0));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 0, 0)};
+  CFRule r = MakeRule(RuleType::UniqueValues);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
+  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
+}
+
+TEST(CFEvaluator, DuplicateUniqueValueOnlyOverloadStillReturnsFalse) {
+  // Pin the staging contract: value-only overload has no sqref access,
+  // so DuplicateValues / UniqueValues continue to return false there.
+  CFRule dup = MakeRule(RuleType::DuplicateValues);
+  EXPECT_FALSE(match_rule(dup, Value::number(1.0)));
+  CFRule uniq = MakeRule(RuleType::UniqueValues);
+  EXPECT_FALSE(match_rule(uniq, Value::number(1.0)));
+}
+
+// ---------------------------------------------------------------------------
+// AboveAverage
+// ---------------------------------------------------------------------------
+//
+// All AboveAverage tests use the population [10, 20, 30, 40, 50] in
+// A1:A5 — mean = 30, sample std-dev = sqrt(250) ≈ 15.811.
+
+TEST(CFEvaluator, AboveAverageWithoutSqrefDoesNotMatch) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  // ctx.sqref intentionally nullptr.
+  EXPECT_FALSE(match_rule(r, Value::number(40.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, AboveAverageMatchesValuesStrictlyAboveMean) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  r.above_average = true;
+  r.equal_average = false;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(40.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));  // mean
+  EXPECT_FALSE(match_rule(r, Value::number(20.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(10.0), ctx));
+}
+
+TEST(CFEvaluator, AboveAverageEqualAverageIncludesMean) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  r.above_average = true;
+  r.equal_average = true;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(40.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(30.0), ctx));  // mean inclusive
+  EXPECT_FALSE(match_rule(r, Value::number(29.999), ctx));
+}
+
+TEST(CFEvaluator, AboveAverageBelowSideMatchesValuesStrictlyBelowMean) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  r.above_average = false;
+  r.equal_average = false;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(20.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(40.0), ctx));
+}
+
+TEST(CFEvaluator, AboveAverageStdDevShiftsThresholdAboveMean) {
+  // mean = 30, sample stddev ≈ 15.811. With std_dev = 1, threshold ≈
+  // 45.811 → only 50 (above) matches; 40 falls below.
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  r.above_average = true;
+  r.equal_average = false;
+  r.std_dev = 1.0;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(40.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
+}
+
+TEST(CFEvaluator, AboveAverageStdDevShiftsThresholdBelowMeanForBelowSide) {
+  // mean = 30, sample stddev ≈ 15.811. With std_dev = 1 on the below
+  // side, threshold ≈ 14.189 → only 10 matches.
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  r.above_average = false;
+  r.equal_average = false;
+  r.std_dev = 1.0;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(20.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
+}
+
+TEST(CFEvaluator, AboveAverageNonNumericCellDoesNotMatch) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::text("40"), ctx));
+  EXPECT_FALSE(match_rule(r, Value::boolean(true), ctx));
+  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
+  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
+}
+
+TEST(CFEvaluator, AboveAverageEmptyPopulationDoesNotMatch) {
+  CFEvalHarness harness;  // sqref points at cells that are all blank.
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::number(0.0), ctx));
+}
+
+TEST(CFEvaluator, AboveAverageBooleansAndTextExcludedFromPopulation) {
+  // Population is [10, 50] (numbers only) → mean = 30. Boolean TRUE
+  // and text "100" do not contribute.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(10.0));
+  harness.sheet.set_cell_value(1, 0, Value::boolean(true));
+  harness.sheet.set_cell_value(2, 0, Value::text("100"));
+  harness.sheet.set_cell_value(3, 0, Value::number(50.0));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 3, 0)};
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(20.0), ctx));
+}
+
+TEST(CFEvaluator, AboveAverageValueOnlyOverloadStillReturnsFalse) {
+  // Pin the staging contract: AboveAverage continues to return false on
+  // the value-only overload (no sqref access).
+  CFRule r = MakeRule(RuleType::AboveAverage);
+  EXPECT_FALSE(match_rule(r, Value::number(50.0)));
+}
+
+// ---------------------------------------------------------------------------
+// Top10
+// ---------------------------------------------------------------------------
+
+TEST(CFEvaluator, Top10WithoutSqrefDoesNotMatch) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 2;
+  EXPECT_FALSE(match_rule(r, Value::number(50.0), harness.context(At(0, 0), At(0, 0))));
+}
+
+TEST(CFEvaluator, Top10MatchesTopNValuesByRank) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);  // [10, 20, 30, 40, 50]
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 2;
+  r.bottom = false;
+  r.percent = false;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(40.0), ctx));  // 2nd-largest
+  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(10.0), ctx));
+}
+
+TEST(CFEvaluator, Top10BottomMatchesBottomNValuesByRank) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 2;
+  r.bottom = true;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(20.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(50.0), ctx));
+}
+
+TEST(CFEvaluator, Top10TiesAtThresholdAreIncluded) {
+  // Population is [40, 40, 40, 30, 10]. Top 2 by rank → threshold = 40,
+  // and all three 40s match because the comparison is `>= threshold`.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(40.0));
+  harness.sheet.set_cell_value(1, 0, Value::number(40.0));
+  harness.sheet.set_cell_value(2, 0, Value::number(40.0));
+  harness.sheet.set_cell_value(3, 0, Value::number(30.0));
+  harness.sheet.set_cell_value(4, 0, Value::number(10.0));
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 2;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(40.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(10.0), ctx));
+}
+
+TEST(CFEvaluator, Top10PercentInterpretsRankAsPercentOfPopulation) {
+  // Population size 10 → top 30% = floor(10 * 30 / 100) = 3.
+  CFEvalHarness harness;
+  for (std::uint32_t row = 0; row < 10; ++row) {
+    harness.sheet.set_cell_value(row, 0, Value::number(static_cast<double>(row + 1)));
+  }
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 9, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 30;
+  r.percent = true;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(9.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(8.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(7.0), ctx));
+}
+
+TEST(CFEvaluator, Top10PercentClampsToAtLeastOne) {
+  // Population size 5, percent = 1 → floor(5 * 1 / 100) = 0; clamps to 1.
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 1;
+  r.percent = true;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
+  EXPECT_FALSE(match_rule(r, Value::number(40.0), ctx));
+}
+
+TEST(CFEvaluator, Top10RankExceedingPopulationClampsToAll) {
+  // Rank 100 with a 5-cell population → threshold = min/max so every
+  // cell matches.
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 100;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
+}
+
+TEST(CFEvaluator, Top10ZeroOrNegativeRankDoesNotMatch) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 0;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::number(50.0), ctx));
+  r.rank = -3;
+  const auto ctx2 = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::number(50.0), ctx2));
+}
+
+TEST(CFEvaluator, Top10NonNumericCellDoesNotMatch) {
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 5;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::text("50"), ctx));
+  EXPECT_FALSE(match_rule(r, Value::boolean(true), ctx));
+  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
+  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
+}
+
+TEST(CFEvaluator, Top10EmptyPopulationDoesNotMatch) {
+  CFEvalHarness harness;
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 2;
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_FALSE(match_rule(r, Value::number(0.0), ctx));
+}
+
+TEST(CFEvaluator, Top10DefaultRankIsTen) {
+  // No `rank` set → defaults to 10. With only 5 numbers, that clamps to
+  // 5 (the entire population), so every value matches.
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
+  CFRule r = MakeRule(RuleType::Top10);
+  // r.rank intentionally unset.
+  const auto ctx = SqrefContext(harness, sqref);
+  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
+  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
+}
+
+TEST(CFEvaluator, Top10ValueOnlyOverloadStillReturnsFalse) {
+  // Pin the staging contract: Top10 continues to return false on the
+  // value-only overload (no sqref access).
+  CFRule r = MakeRule(RuleType::Top10);
+  r.rank = 5;
+  EXPECT_FALSE(match_rule(r, Value::number(50.0)));
+}
+
+}  // namespace
+}  // namespace formulon::cf
diff --git a/tests/unit/cf/cf_evaluator_range_test.cpp b/tests/unit/cf/cf_evaluator_range_test.cpp
new file mode 100644
index 000000000..c7c7f8f67
--- /dev/null
+++ b/tests/unit/cf/cf_evaluator_range_test.cpp
@@ -0,0 +1,557 @@
+// Conditional-format evaluator tests: range dispatch and population caching.
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "cf/cf_evaluator.h"
+#include "cf/cf_helpers.h"
+#include "cf/cf_match.h"
+#include "cf/cf_types.h"
+#include "cf_evaluator_fixtures.h"
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "utils/date_time.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+namespace formulon::cf {
+namespace {
+
+using test::At;
+using test::CFEvalHarness;
+using test::MakeRange;
+using test::MakeRule;
+using test::PopulateLinearPopulation;
+using test::RGB;
+using test::SqrefContext;
+using test::TwoStopMinMax;
+
+// ---------------------------------------------------------------------------
+// evaluate_cf_at — cross-block priority chain + stopIfTrue
+// ---------------------------------------------------------------------------
+
+CFHost MakeHost(CFEvalHarness& harness) {
+  CFHost host;
+  host.arena = &harness.arena;
+  host.registry = &eval::default_registry();
+  host.eval_ctx = &harness.eval_ctx;
+  return host;
+}
+
+ConditionalFormat MakeBlock(std::vector<CFCellRange> sqref, std::vector<CFRule> rules) {
+  ConditionalFormat block;
+  block.sqref = std::move(sqref);
+  block.rules = std::move(rules);
+  return block;
+}
+
+CFRule MakeBlanksRule(std::int32_t priority, std::uint32_t dxf_id, std::string id, bool stop_if_true = false) {
+  CFRule rule;
+  rule.type = RuleType::ContainsBlanks;
+  rule.priority = priority;
+  rule.dxf_id = dxf_id;
+  rule.id = std::move(id);
+  rule.stop_if_true = stop_if_true;
+  return rule;
+}
+
+TEST(CFEvaluator, EvaluateCfAtWithoutBlocksReturnsEmpty) {
+  CFEvalHarness harness;
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  EXPECT_TRUE(matches.empty());
+}
+
+TEST(CFEvaluator, EvaluateCfAtIgnoresBlocksWhoseSqrefExcludesTarget) {
+  CFEvalHarness harness;
+  // A1 is blank; block sqref is C1:D2 → does not contain A1.
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 2, 1, 3)}, {MakeBlanksRule(1, 7, "rule-1")}));
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  EXPECT_TRUE(matches.empty());
+}
+
+TEST(CFEvaluator, EvaluateCfAtReturnsMatchingDifferentialFormat) {
+  CFEvalHarness harness;
+  // A1 is blank by default; ContainsBlanks rule should fire.
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 1, 1)}, {MakeBlanksRule(1, 7, "rule-1")}));
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  ASSERT_EQ(matches.size(), 1u);
+  EXPECT_EQ(matches[0].rule_id, "rule-1");
+  EXPECT_EQ(matches[0].priority, 1);
+  EXPECT_EQ(matches[0].kind, CFMatchKind::DifferentialFormat);
+  ASSERT_TRUE(matches[0].dxf_id.has_value());
+  EXPECT_EQ(*matches[0].dxf_id, 7u);
+}
+
+TEST(CFEvaluator, EvaluateCfAtSortsByPriorityAscending) {
+  CFEvalHarness harness;
+  // Two rules in the same block, declared in reverse priority order.
+  // Both fire (cell A1 is blank); evaluator must sort priority=1 first.
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 1, 1)},
+                {MakeBlanksRule(5, 50, "rule-low-priority"), MakeBlanksRule(1, 10, "rule-high-priority")}));
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  ASSERT_EQ(matches.size(), 2u);
+  EXPECT_EQ(matches[0].rule_id, "rule-high-priority");
+  EXPECT_EQ(matches[0].priority, 1);
+  EXPECT_EQ(matches[1].rule_id, "rule-low-priority");
+  EXPECT_EQ(matches[1].priority, 5);
+}
+
+TEST(CFEvaluator, EvaluateCfAtSortsAcrossBlocks) {
+  CFEvalHarness harness;
+  // Two separate blocks — priority is workbook-global so the
+  // priority-2 rule from the second block evaluates between the
+  // priority-1 and priority-3 rules of the first block.
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 1, 1)}, {MakeBlanksRule(1, 11, "p1"), MakeBlanksRule(3, 13, "p3")}));
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(2, 12, "p2")}));
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  ASSERT_EQ(matches.size(), 3u);
+  EXPECT_EQ(matches[0].rule_id, "p1");
+  EXPECT_EQ(matches[1].rule_id, "p2");
+  EXPECT_EQ(matches[2].rule_id, "p3");
+}
+
+TEST(CFEvaluator, EvaluateCfAtFirstWinsFoldSelectsTheHighestPriorityDxf) {
+  // Two overlapping rules, neither carrying stopIfTrue, both matching the
+  // same cell. The published consumption rule is first-wins over the
+  // returned order, so the smaller priority owns the format. Walking the
+  // list is what a host does, so the test walks it the documented way.
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 4, 0)}, {MakeBlanksRule(7, 70, "lower-priority")}));
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(2, 20, "higher-priority")}));
+
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  ASSERT_EQ(matches.size(), 2u);
+  EXPECT_EQ(matches[0].rule_id, "higher-priority");
+
+  std::optional<std::uint32_t> painted;
+  for (const CFMatch& match : matches) {
+    if (!painted.has_value() && match.dxf_id.has_value()) {
+      painted = match.dxf_id;
+    }
+  }
+  ASSERT_TRUE(painted.has_value());
+  EXPECT_EQ(*painted, 20u);
+}
+
+TEST(CFEvaluator, EvaluateCfAtStopIfTrueHaltsEvaluation) {
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 1, 1)},
+                {MakeBlanksRule(1, 10, "first", /*stop_if_true=*/true), MakeBlanksRule(2, 20, "second")}));
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  ASSERT_EQ(matches.size(), 1u);
+  EXPECT_EQ(matches[0].rule_id, "first");
+}
+
+TEST(CFEvaluator, EvaluateCfAtStopIfTrueDoesNotHaltOnNonMatch) {
+  // First rule does not match (cell is non-blank), so stop_if_true is
+  // never triggered; the second rule still evaluates.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(7.0));
+
+  CFRule cell_is_rule;
+  cell_is_rule.type = RuleType::CellIs;
+  cell_is_rule.priority = 1;
+  cell_is_rule.dxf_id = 100;
+  cell_is_rule.id = "cell-is-zero";
+  cell_is_rule.op = CellIsOperator::Equal;
+  cell_is_rule.formula1 = "0";
+  cell_is_rule.stop_if_true = true;
+
+  CFRule errors_rule;
+  errors_rule.type = RuleType::NotContainsErrors;
+  errors_rule.priority = 2;
+  errors_rule.dxf_id = 200;
+  errors_rule.id = "not-error";
+
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 0)}, {cell_is_rule, errors_rule}));
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  ASSERT_EQ(matches.size(), 1u);
+  EXPECT_EQ(matches[0].rule_id, "not-error");
+}
+
+TEST(CFEvaluator, EvaluateCfAtVisualRulePopulatesRenderPayload) {
+  // ColorScale rule on A1:A5; cell A3 is the population midpoint.
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  CFRule color_rule = MakeRule(RuleType::ColorScale);
+  color_rule.priority = 1;
+  color_rule.id = "color-1";
+  color_rule.color_scale = TwoStopMinMax(RGB(255, 0, 0), RGB(0, 255, 0));
+  harness.sheet.mutable_conditional_formats().push_back(MakeBlock({MakeRange(0, 0, 4, 0)}, {color_rule}));
+
+  const auto host = MakeHost(harness);
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(2, 0), host);
+  ASSERT_EQ(matches.size(), 1u);
+  EXPECT_EQ(matches[0].kind, CFMatchKind::ColorScale);
+  ASSERT_TRUE(matches[0].resolved_fill_color.has_value());
+  EXPECT_EQ(matches[0].resolved_fill_color->r, 128);
+  EXPECT_EQ(matches[0].resolved_fill_color->g, 128);
+  EXPECT_EQ(matches[0].resolved_fill_color->b, 0);
+}
+
+TEST(CFEvaluator, EvaluateCfAtMissingHostFieldsReturnsEmpty) {
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "rule-1")}));
+  CFHost host;  // arena/registry/eval_ctx all null.
+  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
+  EXPECT_TRUE(matches.empty());
+}
+
+// ---------------------------------------------------------------------------
+// evaluate_cf_for_range — viewport-range API
+// ---------------------------------------------------------------------------
+
+TEST(CFEvaluator, EvaluateCfForRangeReturnsOneEntryPerMatchedCell) {
+  CFEvalHarness harness;
+  // A1 and A2 are blank → both match ContainsBlanks. A3 has a value.
+  harness.sheet.set_cell_value(2, 0, Value::number(42.0));
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 2, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
+
+  const auto host = MakeHost(harness);
+  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 2, 0), host).value();
+  ASSERT_EQ(matches.size(), 2u);
+  EXPECT_EQ(matches[0].cell.row, 0u);
+  EXPECT_EQ(matches[0].cell.col, 0u);
+  EXPECT_EQ(matches[1].cell.row, 1u);
+  EXPECT_EQ(matches[1].cell.col, 0u);
+  ASSERT_EQ(matches[0].matches.size(), 1u);
+  EXPECT_EQ(matches[0].matches[0].rule_id, "blanks");
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeEmitsRowMajorOrder) {
+  CFEvalHarness harness;
+  // 2x2 viewport, all blank → all 4 cells match.
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 1, 1)}, {MakeBlanksRule(1, 7, "blanks")}));
+
+  const auto host = MakeHost(harness);
+  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 1, 1), host).value();
+  ASSERT_EQ(matches.size(), 4u);
+  // Row-major: (0,0), (0,1), (1,0), (1,1).
+  EXPECT_EQ(matches[0].cell.row, 0u);
+  EXPECT_EQ(matches[0].cell.col, 0u);
+  EXPECT_EQ(matches[1].cell.row, 0u);
+  EXPECT_EQ(matches[1].cell.col, 1u);
+  EXPECT_EQ(matches[2].cell.row, 1u);
+  EXPECT_EQ(matches[2].cell.col, 0u);
+  EXPECT_EQ(matches[3].cell.row, 1u);
+  EXPECT_EQ(matches[3].cell.col, 1u);
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeSkipsCellsWithNoMatches) {
+  CFEvalHarness harness;
+  // Block applies only to A1; B1 has no rules.
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
+  const auto host = MakeHost(harness);
+  // Viewport spans A1:B1 → only A1 should appear in the result.
+  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 0, 1), host).value();
+  ASSERT_EQ(matches.size(), 1u);
+  EXPECT_EQ(matches[0].cell.row, 0u);
+  EXPECT_EQ(matches[0].cell.col, 0u);
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeSingleCellRangeStillVisited) {
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
+  const auto host = MakeHost(harness);
+  // first == last (A1:A1).
+  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 0, 0), host).value();
+  ASSERT_EQ(matches.size(), 1u);
+  EXPECT_EQ(matches[0].cell.row, 0u);
+  EXPECT_EQ(matches[0].cell.col, 0u);
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeReturnsEmptyForEmptyHost) {
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
+  CFHost host;  // null fields.
+  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 0, 0), host).value();
+  EXPECT_TRUE(matches.empty());
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeAggregatesPriorityOrderPerCell) {
+  // Two rules at different priorities; both match every cell. Pin that
+  // each cell's match list comes back in priority order.
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 1)}, {MakeBlanksRule(2, 20, "later"), MakeBlanksRule(1, 10, "earlier")}));
+  const auto host = MakeHost(harness);
+  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 0, 1), host).value();
+  ASSERT_EQ(matches.size(), 2u);
+  for (const auto& cell : matches) {
+    ASSERT_EQ(cell.matches.size(), 2u);
+    EXPECT_EQ(cell.matches[0].rule_id, "earlier");
+    EXPECT_EQ(cell.matches[1].rule_id, "later");
+  }
+}
+
+CFRule MakeGreaterThanRule(std::int32_t priority, std::uint32_t dxf_id, std::string id, std::string threshold) {
+  CFRule rule;
+  rule.type = RuleType::CellIs;
+  rule.op = CellIsOperator::GreaterThan;
+  rule.priority = priority;
+  rule.dxf_id = dxf_id;
+  rule.id = std::move(id);
+  rule.formula1 = std::move(threshold);
+  return rule;
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeWholeColumnWalksOnlyTheBlock) {
+  // One 3x3 block on a sheet; the request is the whole of column A. The
+  // walk must cost the block's overlap with the column (three cells),
+  // not the column's million rows — this test finishing inside the fast
+  // tier is that bound's evidence.
+  CFEvalHarness harness;
+  harness.sheet.set_cell_value(0, 0, Value::number(10.0));
+  harness.sheet.set_cell_value(1, 0, Value::number(60.0));
+  harness.sheet.set_cell_value(2, 0, Value::number(90.0));
+  harness.sheet.set_cell_value(1, 1, Value::number(70.0));
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 2, 2)}, {MakeGreaterThanRule(1, 7, "gt50", "50")}));
+
+  const auto host = MakeHost(harness);
+  const auto result = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, kCfMaxRows - 1U, 0), host);
+  ASSERT_TRUE(static_cast<bool>(result));
+  const std::vector<CFRangeCellMatches>& matches = result.value();
+  ASSERT_EQ(matches.size(), 2u);
+  EXPECT_EQ(matches[0].cell.row, 1u);
+  EXPECT_EQ(matches[0].cell.col, 0u);
+  ASSERT_EQ(matches[0].matches.size(), 1u);
+  EXPECT_EQ(matches[0].matches[0].rule_id, "gt50");
+  EXPECT_EQ(matches[0].matches[0].dxf_id, 7u);
+  EXPECT_EQ(matches[1].cell.row, 2u);
+  EXPECT_EQ(matches[1].cell.col, 0u);
+  ASSERT_EQ(matches[1].matches.size(), 1u);
+  EXPECT_EQ(matches[1].matches[0].rule_id, "gt50");
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeRejectsRequestPastViewportCeiling) {
+  // Two full columns are past the viewport ceiling: the request is
+  // refused before any cell is visited.
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
+
+  const auto host = MakeHost(harness);
+  const auto result = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, kCfMaxRows - 1U, 1), host);
+  ASSERT_FALSE(static_cast<bool>(result));
+  EXPECT_EQ(result.error().code, FormulonErrorCode::kSecResourceLimit);
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeOverlappingBlocksVisitEachCellOnce) {
+  // Two blocks share column B. Every cell of the viewport must appear
+  // exactly once and in row-major order, with the shared cells carrying
+  // both blocks' matches in priority order.
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 1, 1)}, {MakeBlanksRule(2, 20, "left")}));
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 1, 1, 2)}, {MakeBlanksRule(1, 10, "right")}));
+
+  const auto host = MakeHost(harness);
+  const auto result = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 1, 2), host);
+  ASSERT_TRUE(static_cast<bool>(result));
+  const std::vector<CFRangeCellMatches>& matches = result.value();
+  ASSERT_EQ(matches.size(), 6u);
+  const std::vector<std::pair<std::uint32_t, std::uint32_t>> expected_cells{{0, 0}, {0, 1}, {0, 2},
+                                                                            {1, 0}, {1, 1}, {1, 2}};
+  for (std::size_t i = 0; i < expected_cells.size(); ++i) {
+    EXPECT_EQ(matches[i].cell.row, expected_cells[i].first) << "i=" << i;
+    EXPECT_EQ(matches[i].cell.col, expected_cells[i].second) << "i=" << i;
+  }
+  // Column A sees only the left block, column C only the right one, and
+  // column B both — priority-ascending.
+  ASSERT_EQ(matches[0].matches.size(), 1u);
+  EXPECT_EQ(matches[0].matches[0].rule_id, "left");
+  ASSERT_EQ(matches[1].matches.size(), 2u);
+  EXPECT_EQ(matches[1].matches[0].rule_id, "right");
+  EXPECT_EQ(matches[1].matches[1].rule_id, "left");
+  ASSERT_EQ(matches[2].matches.size(), 1u);
+  EXPECT_EQ(matches[2].matches[0].rule_id, "right");
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeClipsBlocksOutsideTheRequest) {
+  // A block sitting entirely outside the viewport contributes nothing,
+  // and a block straddling the viewport edge contributes only the cells
+  // inside it.
+  CFEvalHarness harness;
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 3, 3)}, {MakeBlanksRule(1, 7, "straddling")}));
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(10, 10, 12, 12)}, {MakeBlanksRule(1, 8, "far-away")}));
+
+  const auto host = MakeHost(harness);
+  const auto result = evaluate_cf_for_range(harness.sheet, MakeRange(1, 1, 2, 2), host);
+  ASSERT_TRUE(static_cast<bool>(result));
+  const std::vector<CFRangeCellMatches>& matches = result.value();
+  ASSERT_EQ(matches.size(), 4u);
+  EXPECT_EQ(matches[0].cell.row, 1u);
+  EXPECT_EQ(matches[0].cell.col, 1u);
+  EXPECT_EQ(matches[3].cell.row, 2u);
+  EXPECT_EQ(matches[3].cell.col, 2u);
+  for (const auto& cell : matches) {
+    ASSERT_EQ(cell.matches.size(), 1u);
+    EXPECT_EQ(cell.matches[0].rule_id, "straddling");
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Population caching — viewport API must produce results identical to
+// per-cell `evaluate_cf_at` calls. This pins the optimisation: caching
+// the population across cells in a range may not change rendered output.
+// ---------------------------------------------------------------------------
+
+CFRule MakeColorScaleBlock(std::int32_t priority, std::string id) {
+  CFRule rule;
+  rule.type = RuleType::ColorScale;
+  rule.priority = priority;
+  rule.id = std::move(id);
+  rule.color_scale = TwoStopMinMax(RGB(255, 0, 0), RGB(0, 255, 0));
+  return rule;
+}
+
+CFRule MakeTop10Rule(std::int32_t priority, std::string id, std::int32_t rank) {
+  CFRule rule;
+  rule.type = RuleType::Top10;
+  rule.priority = priority;
+  rule.dxf_id = 5;
+  rule.id = std::move(id);
+  rule.rank = rank;
+  rule.bottom = false;
+  rule.percent = false;
+  return rule;
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeCachedPathMatchesUncached) {
+  // ColorScale over A1:A5 = [10, 20, 30, 40, 50]. Every cell is in
+  // the sqref so `evaluate_cf_at` and `evaluate_cf_for_range` must
+  // resolve identical fill colours.
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 4, 0)}, {MakeColorScaleBlock(1, "color-scale")}));
+
+  const auto host = MakeHost(harness);
+  std::vector<CFRangeCellMatches> ranged = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 4, 0), host).value();
+  ASSERT_EQ(ranged.size(), 5u);
+
+  for (std::uint32_t row = 0; row < 5; ++row) {
+    std::vector<CFMatch> per_cell = evaluate_cf_at(harness.sheet, At(row, 0), host);
+    ASSERT_EQ(per_cell.size(), 1u) << "row=" << row;
+    ASSERT_EQ(ranged[row].matches.size(), 1u) << "row=" << row;
+    const auto& cached = ranged[row].matches[0];
+    const auto& fresh = per_cell[0];
+    ASSERT_TRUE(cached.resolved_fill_color.has_value()) << "row=" << row;
+    ASSERT_TRUE(fresh.resolved_fill_color.has_value()) << "row=" << row;
+    EXPECT_EQ(cached.resolved_fill_color->r, fresh.resolved_fill_color->r) << "row=" << row;
+    EXPECT_EQ(cached.resolved_fill_color->g, fresh.resolved_fill_color->g) << "row=" << row;
+    EXPECT_EQ(cached.resolved_fill_color->b, fresh.resolved_fill_color->b) << "row=" << row;
+    EXPECT_EQ(cached.resolved_fill_color->a, fresh.resolved_fill_color->a) << "row=" << row;
+  }
+}
+
+TEST(CFEvaluator, EvaluateCfForRangeCachedPathPreservesTop10Behavior) {
+  // Top-2 over [10, 20, 30, 40, 50] should match rows 3 (40) and 4
+  // (50). Cached and uncached paths must agree on which cells fire.
+  CFEvalHarness harness;
+  PopulateLinearPopulation(harness);
+  harness.sheet.mutable_conditional_formats().push_back(
+      MakeBlock({MakeRange(0, 0, 4, 0)}, {MakeTop10Rule(1, "top2", 2)}));
+
+  const auto host = MakeHost(harness);
+  std::vector<CFRangeCellMatches> ranged = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 4, 0), host).value();
+
+  // Row-major: only rows 3 and 4 should appear.
+  ASSERT_EQ(ranged.size(), 2u);
+  EXPECT_EQ(ranged[0].cell.row, 3u);
+  EXPECT_EQ(ranged[1].cell.row, 4u);
+
+  // Cross-check by walking cell-by-cell with the uncached entry point.
+  for (std::uint32_t row = 0; row < 5; ++row) {
+    std::vector<CFMatch> per_cell = evaluate_cf_at(harness.sheet, At(row, 0), host);
+    const bool expected = row >= 3;
+    EXPECT_EQ(per_cell.size(), expected ? 1u : 0u) << "row=" << row;
+  }
+}
+
+// A rule whose sqref is an explicit multi-million-cell rectangle (not
+// whole-column / whole-row notation) must be clamped to the populated
+// extent before scanning, so the scan stays bounded and still returns the
+// same match/numeric results as the tight rectangle would.
+TEST(CFHelpers, ExplicitGiantSqrefIsClampedToPopulatedExtent) {
+  Sheet sheet("S");
+  sheet.set_cell_cached_value(0, 0, Value::number(5.0));
+  sheet.set_cell_cached_value(50, 5, Value::number(5.0));
+  sheet.set_cell_cached_value(100, 3, Value::number(5.0));
+  sheet.set_cell_cached_value(100, 10, Value::number(9.0));  // populated, non-matching
+
+  // Explicit rectangle far larger than the ~65k clamp threshold, yet not
+  // full-column (last.row != kCfMaxRows-1) nor full-row (last.col !=
+  // kCfMaxCols-1) — the case the old code walked cell-by-cell.
+  CFCellRange giant;
+  giant.first = CellAddress{0, 0};
+  giant.last = CellAddress{400000, 4000};
+  ASSERT_FALSE(giant.is_full_col());
+  ASSERT_FALSE(giant.is_full_row());
+  const std::vector<CFCellRange> sqref{giant};
+
+  EXPECT_EQ(helpers::count_matches_in_sqref(Value::number(5.0), sqref, sheet), 3u);
+
+  const std::vector<double> numbers = helpers::collect_numeric_values(sqref, sheet);
+  EXPECT_EQ(numbers.size(), 4u);  // three 5s + one 9
+  double sum = 0.0;
+  for (double n : numbers) {
+    sum += n;
+  }
+  EXPECT_DOUBLE_EQ(sum, 24.0);
+}
+
+TEST(CFHelpers, WholeAxisExtentIncludesPhantomOnlyColumn) {
+  Sheet sheet("S");
+  ASSERT_TRUE(sheet.commit_spill(0U, 0U, 3U, 2U,
+                                 {Value::number(1.0), Value::number(2.0), Value::number(3.0), Value::number(4.0),
+                                  Value::number(5.0), Value::number(6.0)}));
+
+  const std::vector<CFCellRange> sqref{MakeRange(0U, 1U, kCfMaxRows - 1U, 1U)};
+  EXPECT_EQ(helpers::count_matches_in_sqref(Value::number(2.0), sqref, sheet), 1U);
+  EXPECT_EQ(helpers::count_matches_in_sqref(Value::number(4.0), sqref, sheet), 1U);
+  const std::vector<double> values = helpers::collect_numeric_values(sqref, sheet);
+  ASSERT_EQ(values.size(), 3U);
+  EXPECT_DOUBLE_EQ(values[0], 2.0);
+  EXPECT_DOUBLE_EQ(values[1], 4.0);
+  EXPECT_DOUBLE_EQ(values[2], 6.0);
+}
+
+}  // namespace
+}  // namespace formulon::cf
diff --git a/tests/unit/cf/cf_evaluator_test.cpp b/tests/unit/cf/cf_evaluator_test.cpp
index 50a4010af..306059461 100644
--- a/tests/unit/cf/cf_evaluator_test.cpp
+++ b/tests/unit/cf/cf_evaluator_test.cpp
@@ -1,37 +1,14 @@
-//
-// Unit tests for the conditional-format evaluator. Coverage so far:
-// the value-only rule types (ContainsBlanks / NotContainsBlanks /
-// ContainsErrors / NotContainsErrors) and `cellIs` against literal
-// formula1/formula2. Later PRs add expression, containsText, top10/
-// aboveAverage/timePeriod, and the visual rule kinds. The "other rule
-// types fall through to false" guarantee is pinned here so the staging
-// strategy stays observable.
+// Conditional-format evaluator tests: literal and text predicates.
 
 #include "cf/cf_evaluator.h"
 
-#include <cstddef>
-#include <cstdint>
-#include <optional>
-#include <string>
-#include <utility>
-#include <vector>
-
 #include "cell.h"
-#include "cf/cf_helpers.h"
 #include "cf/cf_match.h"
 #include "cf/cf_types.h"
 #include "cf_evaluator_fixtures.h"
-#include "eval/eval_context.h"
-#include "eval/eval_state.h"
-#include "eval/function_registry.h"
 #include "gtest/gtest.h"
-#include "sheet.h"
-#include "utils/arena.h"
-#include "utils/date_time.h"
 #include "utils/error.h"
 #include "value.h"
-#include "workbook.h"
-
 namespace formulon::cf {
 namespace {
 
@@ -104,33 +81,6 @@ TEST(CFEvaluator, RuleTypesNotYetImplementedReturnFalse) {
     EXPECT_FALSE(match_rule(r, Value::text("x"))) << "type=" << static_cast<int>(t);
   }
 }
-
-// The context-aware overload routes Expression rules through
-// `helpers::parse_shift_evaluate`, which must canonicalise Excel's
-// `_xlfn.` / `_xlpm.` storage prefixes before parsing (see cf_helpers.cpp)
-// -- the CF-rule ingestion path does not go through the defined-names
-// reader's own stripping, so it needs its own.
-TEST(CFEvaluator, ExpressionRuleAcceptsXlfnPrefixedFunction) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("Sheet1"));
-  eval::EvalState state;
-  eval::EvalContext eval_ctx(wb, s, state);
-  Arena arena;
-  const eval::FunctionRegistry& registry = eval::default_registry();
-
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "_xlfn.LET(_xlpm.x,TRUE,_xlpm.x)";
-
-  CFEvalContext ctx;
-  ctx.anchor = CellAddress{0U, 0U};
-  ctx.target = CellAddress{0U, 0U};
-  ctx.arena = &arena;
-  ctx.registry = &registry;
-  ctx.eval_ctx = &eval_ctx;
-
-  EXPECT_TRUE(match_rule(r, Value::blank(), ctx));
-}
-
 TEST(CFEvaluator, CellIsLessThanNumeric) {
   CFRule r = MakeRule(RuleType::CellIs);
   r.op = CellIsOperator::LessThan;
@@ -522,1344 +472,5 @@ TEST(CFEvaluator, MakeMatchPropagatesEmptyDxf) {
   EXPECT_FALSE(m.dxf_id.has_value());
 }
 
-// ---------------------------------------------------------------------------
-// Context-aware overload: Expression rules and CellIs with non-literal
-// formula1 / formula2.
-// ---------------------------------------------------------------------------
-
-TEST(CFEvaluator, ExpressionRuleLiteralTrueMatches) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "TRUE";
-  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleLiteralFalseDoesNotMatch) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "FALSE";
-  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleNonZeroNumberMatches) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "1";
-  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleZeroNumberDoesNotMatch) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "0";
-  EXPECT_FALSE(match_rule(r, Value::number(1.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleArithmeticComparison) {
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(15.0));  // A1 = 15
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "A1>10";
-  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleRelativeReferenceShiftsToTargetRow) {
-  // Anchor at A1, target at A4. Formula `=A1>10` shifts to `=A4>10`.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(5.0));   // A1
-  harness.sheet.set_cell_value(3, 0, Value::number(15.0));  // A4
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "A1>10";
-  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(3, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleRelativeReferenceShiftsToTargetColumn) {
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(5.0));   // A1
-  harness.sheet.set_cell_value(0, 2, Value::number(20.0));  // C1
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "A1>10";
-  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 2))));
-}
-
-TEST(CFEvaluator, ExpressionRuleAbsoluteReferenceLocksAtAnchor) {
-  // `$A$1>10` always reads A1, regardless of target.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(15.0));  // A1
-  harness.sheet.set_cell_value(0, 5, Value::number(0.0));   // F1
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "$A$1>10";
-  EXPECT_TRUE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 5))));
-}
-
-TEST(CFEvaluator, ExpressionRuleErrorResultDoesNotMatch) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "1/0";  // produces #DIV/0!
-  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleTextResultDoesNotMatch) {
-  // Excel's expression-rule truthiness rejects text — only bool / number trigger.
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "\"yes\"";
-  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleParseFailureDoesNotMatch) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "(((";
-  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleMissingFormulaDoesNotMatch) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  // formula1 unset
-  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, ExpressionRuleOutOfBoundsShiftDoesNotMatch) {
-  // Anchor at A1, target at A1 with delta = (-1, 0) is impossible
-  // (target above anchor by one row would land on row 0 = okay).
-  // Pick a formula referencing A1 with anchor at B5 and target at A1
-  // → delta = (-4, -1). Shift A1 by (-4, -1) goes out of bounds.
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::Expression);
-  r.formula1 = "A1>10";
-  // The shifted ref becomes #REF!; comparison `(#REF!)>10` propagates
-  // an error, which is not truthy.
-  EXPECT_FALSE(match_rule(r, Value::number(0.0), harness.context(At(4, 1), At(0, 0))));
-}
-
-// ---------------------------------------------------------------------------
-// CellIs with non-literal operand
-// ---------------------------------------------------------------------------
-
-TEST(CFEvaluator, CellIsEvaluatesReferenceOperand) {
-  // CellIs Equal `=A1`, with A1 = 10. Cell value = 10 → matches.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(10.0));  // A1
-  CFRule r = MakeRule(RuleType::CellIs);
-  r.op = CellIsOperator::Equal;
-  r.formula1 = "A1";
-  EXPECT_TRUE(match_rule(r, Value::number(10.0), harness.context(At(0, 0), At(0, 0))));
-  EXPECT_FALSE(match_rule(r, Value::number(11.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, CellIsEvaluatesArithmeticOperand) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::CellIs);
-  r.op = CellIsOperator::LessThan;
-  r.formula1 = "10*2";  // = 20
-  EXPECT_TRUE(match_rule(r, Value::number(15.0), harness.context(At(0, 0), At(0, 0))));
-  EXPECT_FALSE(match_rule(r, Value::number(25.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, CellIsBetweenWithReferenceOperands) {
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(5.0));   // A1
-  harness.sheet.set_cell_value(0, 1, Value::number(10.0));  // B1
-  CFRule r = MakeRule(RuleType::CellIs);
-  r.op = CellIsOperator::Between;
-  r.formula1 = "A1";
-  r.formula2 = "B1";
-  EXPECT_TRUE(match_rule(r, Value::number(7.5), harness.context(At(0, 0), At(0, 0))));
-  EXPECT_FALSE(match_rule(r, Value::number(11.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, CellIsLiteralPathStillWorksThroughEvaluatorOverload) {
-  // Verify the context-aware overload doesn't regress the literal path.
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::CellIs);
-  r.op = CellIsOperator::Equal;
-  r.formula1 = "42";
-  EXPECT_TRUE(match_rule(r, Value::number(42.0), harness.context(At(0, 0), At(0, 0))));
-  EXPECT_FALSE(match_rule(r, Value::number(43.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, CellIsReferenceShiftsWithTarget) {
-  // CellIs with `A1` operand, anchor at A1, target at A2 → operand is A2.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(1, 0, Value::number(50.0));  // A2
-  CFRule r = MakeRule(RuleType::CellIs);
-  r.op = CellIsOperator::Equal;
-  r.formula1 = "A1";
-  EXPECT_TRUE(match_rule(r, Value::number(50.0), harness.context(At(0, 0), At(1, 0))));
-}
-
-TEST(CFEvaluator, ContextAwareOverloadDelegatesValueOnlyKinds) {
-  // Verify the context-aware overload routes value-only rules to the
-  // simple overload. This is a regression guard: if the dispatcher
-  // ever forgets to delegate, the rule would silently return false.
-  CFEvalHarness harness;
-  CFRule blanks = MakeRule(RuleType::ContainsBlanks);
-  EXPECT_TRUE(match_rule(blanks, Value::blank(), harness.context(At(0, 0), At(0, 0))));
-  EXPECT_FALSE(match_rule(blanks, Value::number(0.0), harness.context(At(0, 0), At(0, 0))));
-
-  CFRule errors = MakeRule(RuleType::ContainsErrors);
-  EXPECT_TRUE(match_rule(errors, Value::error(ErrorCode::Div0), harness.context(At(0, 0), At(0, 0))));
-
-  CFRule contains = MakeRule(RuleType::ContainsText);
-  contains.text = "foo";
-  EXPECT_TRUE(match_rule(contains, Value::text("foobar"), harness.context(At(0, 0), At(0, 0))));
-  EXPECT_FALSE(match_rule(contains, Value::text("bar"), harness.context(At(0, 0), At(0, 0))));
-}
-
-// ---------------------------------------------------------------------------
-// TimePeriod
-//
-// Anchored at Wednesday 2024-03-13 throughout. Excel weekday semantics
-// place that day at WEEKDAY=4 (Sun=1). The week therefore spans
-// 2024-03-10 (Sun) through 2024-03-16 (Sat).
-// ---------------------------------------------------------------------------
-
-CFEvalContext PinnedContext(CFEvalHarness& harness, double today_serial) {
-  CFEvalContext ctx = harness.context(At(0, 0), At(0, 0));
-  ctx.today_serial = today_serial;
-  return ctx;
-}
-
-double Serial(int year, unsigned month, unsigned day) {
-  return date_time::serial_from_ymd(year, month, day);
-}
-
-TEST(CFEvaluator, TimePeriodWithoutTodaySerialDoesNotMatch) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::Today;
-  // ctx.today_serial intentionally left as nullopt.
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13)), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, TimePeriodMissingBucketDoesNotMatch) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  // r.time_period not set
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13)), PinnedContext(harness, Serial(2024, 3, 13))));
-}
-
-TEST(CFEvaluator, TimePeriodNonNumericCellDoesNotMatch) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::Today;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_FALSE(match_rule(r, Value::text("2024-03-13"), ctx));
-  EXPECT_FALSE(match_rule(r, Value::boolean(true), ctx));
-  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
-  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
-}
-
-TEST(CFEvaluator, TimePeriodTodayMatchesSameDay) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::Today;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 12)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 14)), ctx));
-}
-
-TEST(CFEvaluator, TimePeriodTodayDropsTimeOfDayFraction) {
-  // Cell carrying date + 0.75 (= 18:00) still matches Today.
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::Today;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 13) + 0.75), ctx));
-}
-
-TEST(CFEvaluator, TimePeriodYesterdayMatchesPreviousDay) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::Yesterday;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 12)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 11)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));
-}
-
-TEST(CFEvaluator, TimePeriodTomorrowMatchesNextDay) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::Tomorrow;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 14)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 15)), ctx));
-}
-
-TEST(CFEvaluator, TimePeriodLast7DaysSpansSixDaysBackThroughToday) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::Last7Days;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 7)), ctx));   // today - 6
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 6)), ctx));  // today - 7
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 14)), ctx));
-}
-
-TEST(CFEvaluator, TimePeriodThisWeekIsSundayThroughSaturday) {
-  // 2024-03-13 is Wed. Week = 2024-03-10 (Sun) .. 2024-03-16 (Sat).
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::ThisWeek;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 10)), ctx));   // Sun
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 13)), ctx));   // Wed
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 16)), ctx));   // Sat
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 9)), ctx));   // prior Sat
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 17)), ctx));  // next Sun
-}
-
-TEST(CFEvaluator, TimePeriodLastWeekIsPriorSundayThroughSaturday) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::LastWeek;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 3)), ctx));    // Sun
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 9)), ctx));    // Sat
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 2)), ctx));   // 2 weeks back
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 10)), ctx));  // this Sun
-}
-
-TEST(CFEvaluator, TimePeriodNextWeekIsFollowingSundayThroughSaturday) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::NextWeek;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 17)), ctx));   // Sun
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 23)), ctx));   // Sat
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 16)), ctx));  // this Sat
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 24)), ctx));  // 2 weeks ahead
-}
-
-TEST(CFEvaluator, TimePeriodThisMonthMatchesSameYearAndMonth) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::ThisMonth;
-  const auto ctx = PinnedContext(harness, Serial(2024, 3, 13));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 1)), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2024, 3, 31)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 2, 29)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 4, 1)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2023, 3, 13)), ctx));  // same month, prior year
-}
-
-TEST(CFEvaluator, TimePeriodLastMonthHandlesYearBoundary) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::LastMonth;
-  // today = 2024-01-15 → last month = 2023-12.
-  const auto ctx = PinnedContext(harness, Serial(2024, 1, 15));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2023, 12, 1)), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2023, 12, 31)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 1, 1)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2023, 11, 30)), ctx));
-}
-
-TEST(CFEvaluator, TimePeriodNextMonthHandlesYearBoundary) {
-  CFEvalHarness harness;
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::NextMonth;
-  // today = 2024-12-15 → next month = 2025-01.
-  const auto ctx = PinnedContext(harness, Serial(2024, 12, 15));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2025, 1, 1)), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(Serial(2025, 1, 31)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 12, 31)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2025, 2, 1)), ctx));
-}
-
-double Date1904Serial(int year, unsigned month, unsigned day) {
-  return date_time::serial_from_ymd(year, month, day, /*date1904=*/true);
-}
-
-// Same anchor and boundary assertions as `TimePeriodThisWeekIsSundayThroughSaturday`,
-// but with every serial encoded under the 1904 system and the context's
-// `EvalContext` carrying that epoch. A decode that silently assumed 1900
-// would land on the wrong civil date and miss these boundaries.
-TEST(CFEvaluator, TimePeriodThisWeekHonorsDate1904Epoch) {
-  CFEvalHarness harness;
-  eval::EvalContext date1904_ctx = harness.eval_ctx.with_date1904(true);
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::ThisWeek;
-  CFEvalContext ctx = PinnedContext(harness, Date1904Serial(2024, 3, 13));
-  ctx.eval_ctx = &date1904_ctx;
-  EXPECT_TRUE(match_rule(r, Value::number(Date1904Serial(2024, 3, 10)), ctx));   // Sun
-  EXPECT_TRUE(match_rule(r, Value::number(Date1904Serial(2024, 3, 16)), ctx));   // Sat
-  EXPECT_FALSE(match_rule(r, Value::number(Date1904Serial(2024, 3, 9)), ctx));   // prior Sat
-  EXPECT_FALSE(match_rule(r, Value::number(Date1904Serial(2024, 3, 17)), ctx));  // next Sun
-}
-
-// Same as `TimePeriodThisMonthMatchesSameYearAndMonth`, under the 1904
-// epoch: the month boundary at 2024-02-29/2024-03-01 only lands correctly
-// if the decode reads the epoch the caller encoded with.
-TEST(CFEvaluator, TimePeriodThisMonthHonorsDate1904Epoch) {
-  CFEvalHarness harness;
-  eval::EvalContext date1904_ctx = harness.eval_ctx.with_date1904(true);
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::ThisMonth;
-  CFEvalContext ctx = PinnedContext(harness, Date1904Serial(2024, 3, 13));
-  ctx.eval_ctx = &date1904_ctx;
-  EXPECT_TRUE(match_rule(r, Value::number(Date1904Serial(2024, 3, 1)), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(Date1904Serial(2024, 3, 31)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Date1904Serial(2024, 2, 29)), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(Date1904Serial(2024, 4, 1)), ctx));
-}
-
-TEST(CFEvaluator, TimePeriodValueOnlyOverloadStillReturnsFalse) {
-  // The value-only overload has no today reference, so TimePeriod
-  // continues to return false there. Pin the contract.
-  CFRule r = MakeRule(RuleType::TimePeriod);
-  r.time_period = TimePeriod::Today;
-  EXPECT_FALSE(match_rule(r, Value::number(Serial(2024, 3, 13))));
-}
-
-// ---------------------------------------------------------------------------
-// DuplicateValues / UniqueValues
-// ---------------------------------------------------------------------------
-
-TEST(CFEvaluator, DuplicateValuesWithoutSqrefDoesNotMatch) {
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(7.0));
-  harness.sheet.set_cell_value(0, 1, Value::number(7.0));
-  CFRule r = MakeRule(RuleType::DuplicateValues);
-  // ctx.sqref intentionally nullptr.
-  EXPECT_FALSE(match_rule(r, Value::number(7.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, DuplicateValuesMatchesNumberAppearingTwice) {
-  CFEvalHarness harness;
-  // A1:A3 = [7, 7, 9]. Value 7 appears twice → duplicate; 9 appears once.
-  harness.sheet.set_cell_value(0, 0, Value::number(7.0));
-  harness.sheet.set_cell_value(1, 0, Value::number(7.0));
-  harness.sheet.set_cell_value(2, 0, Value::number(9.0));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
-  CFRule r = MakeRule(RuleType::DuplicateValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(7.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(9.0), ctx));
-}
-
-TEST(CFEvaluator, DuplicateValuesNumbersUseExactEquality) {
-  // 1.0 and 1.0000000001 are distinct under IEEE-754 equality, even
-  // though they round to the same display string.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(1.0));
-  harness.sheet.set_cell_value(1, 0, Value::number(1.0000000001));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 1, 0)};
-  CFRule r = MakeRule(RuleType::DuplicateValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::number(1.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(1.0000000001), ctx));
-}
-
-TEST(CFEvaluator, DuplicateValuesTextIsAsciiCaseInsensitive) {
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::text("apple"));
-  harness.sheet.set_cell_value(1, 0, Value::text("APPLE"));
-  harness.sheet.set_cell_value(2, 0, Value::text("orange"));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
-  CFRule r = MakeRule(RuleType::DuplicateValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::text("apple"), ctx));
-  EXPECT_TRUE(match_rule(r, Value::text("Apple"), ctx));
-  EXPECT_FALSE(match_rule(r, Value::text("orange"), ctx));
-}
-
-TEST(CFEvaluator, DuplicateValuesBooleansMatchByIdentity) {
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::boolean(true));
-  harness.sheet.set_cell_value(1, 0, Value::boolean(true));
-  harness.sheet.set_cell_value(2, 0, Value::boolean(false));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
-  CFRule r = MakeRule(RuleType::DuplicateValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::boolean(true), ctx));
-  EXPECT_FALSE(match_rule(r, Value::boolean(false), ctx));
-}
-
-TEST(CFEvaluator, DuplicateValuesIsCrossKindFalse) {
-  // Number 1 and text "1" are distinct, even though Excel coerces in
-  // some contexts. Mirroring the cellIs cross-kind=false stance.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(1.0));
-  harness.sheet.set_cell_value(1, 0, Value::text("1"));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 1, 0)};
-  CFRule r = MakeRule(RuleType::DuplicateValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::number(1.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::text("1"), ctx));
-}
-
-TEST(CFEvaluator, DuplicateValuesErrorsAndBlanksDoNotMatch) {
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::error(ErrorCode::NA));
-  harness.sheet.set_cell_value(1, 0, Value::error(ErrorCode::NA));
-  // A3 left blank.
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
-  CFRule r = MakeRule(RuleType::DuplicateValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
-  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
-}
-
-TEST(CFEvaluator, DuplicateValuesAcrossMultipleSqrefRanges) {
-  // sqref unions A1:A2 and C1:C2. Value 5 appears in A1 and C2 → dup.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(5.0));
-  harness.sheet.set_cell_value(1, 0, Value::number(99.0));
-  harness.sheet.set_cell_value(0, 2, Value::number(11.0));
-  harness.sheet.set_cell_value(1, 2, Value::number(5.0));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 1, 0), MakeRange(0, 2, 1, 2)};
-  CFRule r = MakeRule(RuleType::DuplicateValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(5.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(99.0), ctx));
-}
-
-TEST(CFEvaluator, UniqueValuesMatchesValueAppearingExactlyOnce) {
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(7.0));
-  harness.sheet.set_cell_value(1, 0, Value::number(7.0));
-  harness.sheet.set_cell_value(2, 0, Value::number(9.0));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 2, 0)};
-  CFRule r = MakeRule(RuleType::UniqueValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(9.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(7.0), ctx));
-}
-
-TEST(CFEvaluator, UniqueValuesNonStorableValueKindDoesNotMatch) {
-  // Errors and blanks never match either rule.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(1.0));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 0, 0)};
-  CFRule r = MakeRule(RuleType::UniqueValues);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
-  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
-}
-
-TEST(CFEvaluator, DuplicateUniqueValueOnlyOverloadStillReturnsFalse) {
-  // Pin the staging contract: value-only overload has no sqref access,
-  // so DuplicateValues / UniqueValues continue to return false there.
-  CFRule dup = MakeRule(RuleType::DuplicateValues);
-  EXPECT_FALSE(match_rule(dup, Value::number(1.0)));
-  CFRule uniq = MakeRule(RuleType::UniqueValues);
-  EXPECT_FALSE(match_rule(uniq, Value::number(1.0)));
-}
-
-// ---------------------------------------------------------------------------
-// AboveAverage
-// ---------------------------------------------------------------------------
-//
-// All AboveAverage tests use the population [10, 20, 30, 40, 50] in
-// A1:A5 — mean = 30, sample std-dev = sqrt(250) ≈ 15.811.
-
-TEST(CFEvaluator, AboveAverageWithoutSqrefDoesNotMatch) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  // ctx.sqref intentionally nullptr.
-  EXPECT_FALSE(match_rule(r, Value::number(40.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, AboveAverageMatchesValuesStrictlyAboveMean) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  r.above_average = true;
-  r.equal_average = false;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(40.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));  // mean
-  EXPECT_FALSE(match_rule(r, Value::number(20.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(10.0), ctx));
-}
-
-TEST(CFEvaluator, AboveAverageEqualAverageIncludesMean) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  r.above_average = true;
-  r.equal_average = true;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(40.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(30.0), ctx));  // mean inclusive
-  EXPECT_FALSE(match_rule(r, Value::number(29.999), ctx));
-}
-
-TEST(CFEvaluator, AboveAverageBelowSideMatchesValuesStrictlyBelowMean) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  r.above_average = false;
-  r.equal_average = false;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(20.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(40.0), ctx));
-}
-
-TEST(CFEvaluator, AboveAverageStdDevShiftsThresholdAboveMean) {
-  // mean = 30, sample stddev ≈ 15.811. With std_dev = 1, threshold ≈
-  // 45.811 → only 50 (above) matches; 40 falls below.
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  r.above_average = true;
-  r.equal_average = false;
-  r.std_dev = 1.0;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(40.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
-}
-
-TEST(CFEvaluator, AboveAverageStdDevShiftsThresholdBelowMeanForBelowSide) {
-  // mean = 30, sample stddev ≈ 15.811. With std_dev = 1 on the below
-  // side, threshold ≈ 14.189 → only 10 matches.
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  r.above_average = false;
-  r.equal_average = false;
-  r.std_dev = 1.0;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(20.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
-}
-
-TEST(CFEvaluator, AboveAverageNonNumericCellDoesNotMatch) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::text("40"), ctx));
-  EXPECT_FALSE(match_rule(r, Value::boolean(true), ctx));
-  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
-  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
-}
-
-TEST(CFEvaluator, AboveAverageEmptyPopulationDoesNotMatch) {
-  CFEvalHarness harness;  // sqref points at cells that are all blank.
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::number(0.0), ctx));
-}
-
-TEST(CFEvaluator, AboveAverageBooleansAndTextExcludedFromPopulation) {
-  // Population is [10, 50] (numbers only) → mean = 30. Boolean TRUE
-  // and text "100" do not contribute.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(10.0));
-  harness.sheet.set_cell_value(1, 0, Value::boolean(true));
-  harness.sheet.set_cell_value(2, 0, Value::text("100"));
-  harness.sheet.set_cell_value(3, 0, Value::number(50.0));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 3, 0)};
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(20.0), ctx));
-}
-
-TEST(CFEvaluator, AboveAverageValueOnlyOverloadStillReturnsFalse) {
-  // Pin the staging contract: AboveAverage continues to return false on
-  // the value-only overload (no sqref access).
-  CFRule r = MakeRule(RuleType::AboveAverage);
-  EXPECT_FALSE(match_rule(r, Value::number(50.0)));
-}
-
-// ---------------------------------------------------------------------------
-// Top10
-// ---------------------------------------------------------------------------
-
-TEST(CFEvaluator, Top10WithoutSqrefDoesNotMatch) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 2;
-  EXPECT_FALSE(match_rule(r, Value::number(50.0), harness.context(At(0, 0), At(0, 0))));
-}
-
-TEST(CFEvaluator, Top10MatchesTopNValuesByRank) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);  // [10, 20, 30, 40, 50]
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 2;
-  r.bottom = false;
-  r.percent = false;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(40.0), ctx));  // 2nd-largest
-  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(10.0), ctx));
-}
-
-TEST(CFEvaluator, Top10BottomMatchesBottomNValuesByRank) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 2;
-  r.bottom = true;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(20.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(50.0), ctx));
-}
-
-TEST(CFEvaluator, Top10TiesAtThresholdAreIncluded) {
-  // Population is [40, 40, 40, 30, 10]. Top 2 by rank → threshold = 40,
-  // and all three 40s match because the comparison is `>= threshold`.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(40.0));
-  harness.sheet.set_cell_value(1, 0, Value::number(40.0));
-  harness.sheet.set_cell_value(2, 0, Value::number(40.0));
-  harness.sheet.set_cell_value(3, 0, Value::number(30.0));
-  harness.sheet.set_cell_value(4, 0, Value::number(10.0));
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 2;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(40.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(30.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(10.0), ctx));
-}
-
-TEST(CFEvaluator, Top10PercentInterpretsRankAsPercentOfPopulation) {
-  // Population size 10 → top 30% = floor(10 * 30 / 100) = 3.
-  CFEvalHarness harness;
-  for (std::uint32_t row = 0; row < 10; ++row) {
-    harness.sheet.set_cell_value(row, 0, Value::number(static_cast<double>(row + 1)));
-  }
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 9, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 30;
-  r.percent = true;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(9.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(8.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(7.0), ctx));
-}
-
-TEST(CFEvaluator, Top10PercentClampsToAtLeastOne) {
-  // Population size 5, percent = 1 → floor(5 * 1 / 100) = 0; clamps to 1.
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 1;
-  r.percent = true;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
-  EXPECT_FALSE(match_rule(r, Value::number(40.0), ctx));
-}
-
-TEST(CFEvaluator, Top10RankExceedingPopulationClampsToAll) {
-  // Rank 100 with a 5-cell population → threshold = min/max so every
-  // cell matches.
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 100;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
-}
-
-TEST(CFEvaluator, Top10ZeroOrNegativeRankDoesNotMatch) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 0;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::number(50.0), ctx));
-  r.rank = -3;
-  const auto ctx2 = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::number(50.0), ctx2));
-}
-
-TEST(CFEvaluator, Top10NonNumericCellDoesNotMatch) {
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 5;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::text("50"), ctx));
-  EXPECT_FALSE(match_rule(r, Value::boolean(true), ctx));
-  EXPECT_FALSE(match_rule(r, Value::error(ErrorCode::NA), ctx));
-  EXPECT_FALSE(match_rule(r, Value::blank(), ctx));
-}
-
-TEST(CFEvaluator, Top10EmptyPopulationDoesNotMatch) {
-  CFEvalHarness harness;
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 2;
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_FALSE(match_rule(r, Value::number(0.0), ctx));
-}
-
-TEST(CFEvaluator, Top10DefaultRankIsTen) {
-  // No `rank` set → defaults to 10. With only 5 numbers, that clamps to
-  // 5 (the entire population), so every value matches.
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  const std::vector<CFCellRange> sqref{MakeRange(0, 0, 4, 0)};
-  CFRule r = MakeRule(RuleType::Top10);
-  // r.rank intentionally unset.
-  const auto ctx = SqrefContext(harness, sqref);
-  EXPECT_TRUE(match_rule(r, Value::number(50.0), ctx));
-  EXPECT_TRUE(match_rule(r, Value::number(10.0), ctx));
-}
-
-TEST(CFEvaluator, Top10ValueOnlyOverloadStillReturnsFalse) {
-  // Pin the staging contract: Top10 continues to return false on the
-  // value-only overload (no sqref access).
-  CFRule r = MakeRule(RuleType::Top10);
-  r.rank = 5;
-  EXPECT_FALSE(match_rule(r, Value::number(50.0)));
-}
-
-// ---------------------------------------------------------------------------
-// evaluate_cf_at — cross-block priority chain + stopIfTrue
-// ---------------------------------------------------------------------------
-
-CFHost MakeHost(CFEvalHarness& harness) {
-  CFHost host;
-  host.arena = &harness.arena;
-  host.registry = &eval::default_registry();
-  host.eval_ctx = &harness.eval_ctx;
-  return host;
-}
-
-ConditionalFormat MakeBlock(std::vector<CFCellRange> sqref, std::vector<CFRule> rules) {
-  ConditionalFormat block;
-  block.sqref = std::move(sqref);
-  block.rules = std::move(rules);
-  return block;
-}
-
-CFRule MakeBlanksRule(std::int32_t priority, std::uint32_t dxf_id, std::string id, bool stop_if_true = false) {
-  CFRule rule;
-  rule.type = RuleType::ContainsBlanks;
-  rule.priority = priority;
-  rule.dxf_id = dxf_id;
-  rule.id = std::move(id);
-  rule.stop_if_true = stop_if_true;
-  return rule;
-}
-
-TEST(CFEvaluator, EvaluateCfAtWithoutBlocksReturnsEmpty) {
-  CFEvalHarness harness;
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  EXPECT_TRUE(matches.empty());
-}
-
-TEST(CFEvaluator, EvaluateCfAtIgnoresBlocksWhoseSqrefExcludesTarget) {
-  CFEvalHarness harness;
-  // A1 is blank; block sqref is C1:D2 → does not contain A1.
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 2, 1, 3)}, {MakeBlanksRule(1, 7, "rule-1")}));
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  EXPECT_TRUE(matches.empty());
-}
-
-TEST(CFEvaluator, EvaluateCfAtReturnsMatchingDifferentialFormat) {
-  CFEvalHarness harness;
-  // A1 is blank by default; ContainsBlanks rule should fire.
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 1, 1)}, {MakeBlanksRule(1, 7, "rule-1")}));
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  ASSERT_EQ(matches.size(), 1u);
-  EXPECT_EQ(matches[0].rule_id, "rule-1");
-  EXPECT_EQ(matches[0].priority, 1);
-  EXPECT_EQ(matches[0].kind, CFMatchKind::DifferentialFormat);
-  ASSERT_TRUE(matches[0].dxf_id.has_value());
-  EXPECT_EQ(*matches[0].dxf_id, 7u);
-}
-
-TEST(CFEvaluator, EvaluateCfAtSortsByPriorityAscending) {
-  CFEvalHarness harness;
-  // Two rules in the same block, declared in reverse priority order.
-  // Both fire (cell A1 is blank); evaluator must sort priority=1 first.
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 1, 1)},
-                {MakeBlanksRule(5, 50, "rule-low-priority"), MakeBlanksRule(1, 10, "rule-high-priority")}));
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  ASSERT_EQ(matches.size(), 2u);
-  EXPECT_EQ(matches[0].rule_id, "rule-high-priority");
-  EXPECT_EQ(matches[0].priority, 1);
-  EXPECT_EQ(matches[1].rule_id, "rule-low-priority");
-  EXPECT_EQ(matches[1].priority, 5);
-}
-
-TEST(CFEvaluator, EvaluateCfAtSortsAcrossBlocks) {
-  CFEvalHarness harness;
-  // Two separate blocks — priority is workbook-global so the
-  // priority-2 rule from the second block evaluates between the
-  // priority-1 and priority-3 rules of the first block.
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 1, 1)}, {MakeBlanksRule(1, 11, "p1"), MakeBlanksRule(3, 13, "p3")}));
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(2, 12, "p2")}));
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  ASSERT_EQ(matches.size(), 3u);
-  EXPECT_EQ(matches[0].rule_id, "p1");
-  EXPECT_EQ(matches[1].rule_id, "p2");
-  EXPECT_EQ(matches[2].rule_id, "p3");
-}
-
-TEST(CFEvaluator, EvaluateCfAtFirstWinsFoldSelectsTheHighestPriorityDxf) {
-  // Two overlapping rules, neither carrying stopIfTrue, both matching the
-  // same cell. The published consumption rule is first-wins over the
-  // returned order, so the smaller priority owns the format. Walking the
-  // list is what a host does, so the test walks it the documented way.
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 4, 0)}, {MakeBlanksRule(7, 70, "lower-priority")}));
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(2, 20, "higher-priority")}));
-
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  ASSERT_EQ(matches.size(), 2u);
-  EXPECT_EQ(matches[0].rule_id, "higher-priority");
-
-  std::optional<std::uint32_t> painted;
-  for (const CFMatch& match : matches) {
-    if (!painted.has_value() && match.dxf_id.has_value()) {
-      painted = match.dxf_id;
-    }
-  }
-  ASSERT_TRUE(painted.has_value());
-  EXPECT_EQ(*painted, 20u);
-}
-
-TEST(CFEvaluator, EvaluateCfAtStopIfTrueHaltsEvaluation) {
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 1, 1)},
-                {MakeBlanksRule(1, 10, "first", /*stop_if_true=*/true), MakeBlanksRule(2, 20, "second")}));
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  ASSERT_EQ(matches.size(), 1u);
-  EXPECT_EQ(matches[0].rule_id, "first");
-}
-
-TEST(CFEvaluator, EvaluateCfAtStopIfTrueDoesNotHaltOnNonMatch) {
-  // First rule does not match (cell is non-blank), so stop_if_true is
-  // never triggered; the second rule still evaluates.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(7.0));
-
-  CFRule cell_is_rule;
-  cell_is_rule.type = RuleType::CellIs;
-  cell_is_rule.priority = 1;
-  cell_is_rule.dxf_id = 100;
-  cell_is_rule.id = "cell-is-zero";
-  cell_is_rule.op = CellIsOperator::Equal;
-  cell_is_rule.formula1 = "0";
-  cell_is_rule.stop_if_true = true;
-
-  CFRule errors_rule;
-  errors_rule.type = RuleType::NotContainsErrors;
-  errors_rule.priority = 2;
-  errors_rule.dxf_id = 200;
-  errors_rule.id = "not-error";
-
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 0)}, {cell_is_rule, errors_rule}));
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  ASSERT_EQ(matches.size(), 1u);
-  EXPECT_EQ(matches[0].rule_id, "not-error");
-}
-
-TEST(CFEvaluator, EvaluateCfAtVisualRulePopulatesRenderPayload) {
-  // ColorScale rule on A1:A5; cell A3 is the population midpoint.
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  CFRule color_rule = MakeRule(RuleType::ColorScale);
-  color_rule.priority = 1;
-  color_rule.id = "color-1";
-  color_rule.color_scale = TwoStopMinMax(RGB(255, 0, 0), RGB(0, 255, 0));
-  harness.sheet.mutable_conditional_formats().push_back(MakeBlock({MakeRange(0, 0, 4, 0)}, {color_rule}));
-
-  const auto host = MakeHost(harness);
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(2, 0), host);
-  ASSERT_EQ(matches.size(), 1u);
-  EXPECT_EQ(matches[0].kind, CFMatchKind::ColorScale);
-  ASSERT_TRUE(matches[0].resolved_fill_color.has_value());
-  EXPECT_EQ(matches[0].resolved_fill_color->r, 128);
-  EXPECT_EQ(matches[0].resolved_fill_color->g, 128);
-  EXPECT_EQ(matches[0].resolved_fill_color->b, 0);
-}
-
-TEST(CFEvaluator, EvaluateCfAtMissingHostFieldsReturnsEmpty) {
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "rule-1")}));
-  CFHost host;  // arena/registry/eval_ctx all null.
-  std::vector<CFMatch> matches = evaluate_cf_at(harness.sheet, At(0, 0), host);
-  EXPECT_TRUE(matches.empty());
-}
-
-// ---------------------------------------------------------------------------
-// evaluate_cf_for_range — viewport-range API
-// ---------------------------------------------------------------------------
-
-TEST(CFEvaluator, EvaluateCfForRangeReturnsOneEntryPerMatchedCell) {
-  CFEvalHarness harness;
-  // A1 and A2 are blank → both match ContainsBlanks. A3 has a value.
-  harness.sheet.set_cell_value(2, 0, Value::number(42.0));
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 2, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
-
-  const auto host = MakeHost(harness);
-  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 2, 0), host).value();
-  ASSERT_EQ(matches.size(), 2u);
-  EXPECT_EQ(matches[0].cell.row, 0u);
-  EXPECT_EQ(matches[0].cell.col, 0u);
-  EXPECT_EQ(matches[1].cell.row, 1u);
-  EXPECT_EQ(matches[1].cell.col, 0u);
-  ASSERT_EQ(matches[0].matches.size(), 1u);
-  EXPECT_EQ(matches[0].matches[0].rule_id, "blanks");
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeEmitsRowMajorOrder) {
-  CFEvalHarness harness;
-  // 2x2 viewport, all blank → all 4 cells match.
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 1, 1)}, {MakeBlanksRule(1, 7, "blanks")}));
-
-  const auto host = MakeHost(harness);
-  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 1, 1), host).value();
-  ASSERT_EQ(matches.size(), 4u);
-  // Row-major: (0,0), (0,1), (1,0), (1,1).
-  EXPECT_EQ(matches[0].cell.row, 0u);
-  EXPECT_EQ(matches[0].cell.col, 0u);
-  EXPECT_EQ(matches[1].cell.row, 0u);
-  EXPECT_EQ(matches[1].cell.col, 1u);
-  EXPECT_EQ(matches[2].cell.row, 1u);
-  EXPECT_EQ(matches[2].cell.col, 0u);
-  EXPECT_EQ(matches[3].cell.row, 1u);
-  EXPECT_EQ(matches[3].cell.col, 1u);
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeSkipsCellsWithNoMatches) {
-  CFEvalHarness harness;
-  // Block applies only to A1; B1 has no rules.
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
-  const auto host = MakeHost(harness);
-  // Viewport spans A1:B1 → only A1 should appear in the result.
-  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 0, 1), host).value();
-  ASSERT_EQ(matches.size(), 1u);
-  EXPECT_EQ(matches[0].cell.row, 0u);
-  EXPECT_EQ(matches[0].cell.col, 0u);
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeSingleCellRangeStillVisited) {
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
-  const auto host = MakeHost(harness);
-  // first == last (A1:A1).
-  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 0, 0), host).value();
-  ASSERT_EQ(matches.size(), 1u);
-  EXPECT_EQ(matches[0].cell.row, 0u);
-  EXPECT_EQ(matches[0].cell.col, 0u);
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeReturnsEmptyForEmptyHost) {
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
-  CFHost host;  // null fields.
-  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 0, 0), host).value();
-  EXPECT_TRUE(matches.empty());
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeAggregatesPriorityOrderPerCell) {
-  // Two rules at different priorities; both match every cell. Pin that
-  // each cell's match list comes back in priority order.
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 1)}, {MakeBlanksRule(2, 20, "later"), MakeBlanksRule(1, 10, "earlier")}));
-  const auto host = MakeHost(harness);
-  std::vector<CFRangeCellMatches> matches = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 0, 1), host).value();
-  ASSERT_EQ(matches.size(), 2u);
-  for (const auto& cell : matches) {
-    ASSERT_EQ(cell.matches.size(), 2u);
-    EXPECT_EQ(cell.matches[0].rule_id, "earlier");
-    EXPECT_EQ(cell.matches[1].rule_id, "later");
-  }
-}
-
-CFRule MakeGreaterThanRule(std::int32_t priority, std::uint32_t dxf_id, std::string id, std::string threshold) {
-  CFRule rule;
-  rule.type = RuleType::CellIs;
-  rule.op = CellIsOperator::GreaterThan;
-  rule.priority = priority;
-  rule.dxf_id = dxf_id;
-  rule.id = std::move(id);
-  rule.formula1 = std::move(threshold);
-  return rule;
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeWholeColumnWalksOnlyTheBlock) {
-  // One 3x3 block on a sheet; the request is the whole of column A. The
-  // walk must cost the block's overlap with the column (three cells),
-  // not the column's million rows — this test finishing inside the fast
-  // tier is that bound's evidence.
-  CFEvalHarness harness;
-  harness.sheet.set_cell_value(0, 0, Value::number(10.0));
-  harness.sheet.set_cell_value(1, 0, Value::number(60.0));
-  harness.sheet.set_cell_value(2, 0, Value::number(90.0));
-  harness.sheet.set_cell_value(1, 1, Value::number(70.0));
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 2, 2)}, {MakeGreaterThanRule(1, 7, "gt50", "50")}));
-
-  const auto host = MakeHost(harness);
-  const auto result = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, kCfMaxRows - 1U, 0), host);
-  ASSERT_TRUE(static_cast<bool>(result));
-  const std::vector<CFRangeCellMatches>& matches = result.value();
-  ASSERT_EQ(matches.size(), 2u);
-  EXPECT_EQ(matches[0].cell.row, 1u);
-  EXPECT_EQ(matches[0].cell.col, 0u);
-  ASSERT_EQ(matches[0].matches.size(), 1u);
-  EXPECT_EQ(matches[0].matches[0].rule_id, "gt50");
-  EXPECT_EQ(matches[0].matches[0].dxf_id, 7u);
-  EXPECT_EQ(matches[1].cell.row, 2u);
-  EXPECT_EQ(matches[1].cell.col, 0u);
-  ASSERT_EQ(matches[1].matches.size(), 1u);
-  EXPECT_EQ(matches[1].matches[0].rule_id, "gt50");
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeRejectsRequestPastViewportCeiling) {
-  // Two full columns are past the viewport ceiling: the request is
-  // refused before any cell is visited.
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 0, 0)}, {MakeBlanksRule(1, 7, "blanks")}));
-
-  const auto host = MakeHost(harness);
-  const auto result = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, kCfMaxRows - 1U, 1), host);
-  ASSERT_FALSE(static_cast<bool>(result));
-  EXPECT_EQ(result.error().code, FormulonErrorCode::kSecResourceLimit);
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeOverlappingBlocksVisitEachCellOnce) {
-  // Two blocks share column B. Every cell of the viewport must appear
-  // exactly once and in row-major order, with the shared cells carrying
-  // both blocks' matches in priority order.
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 1, 1)}, {MakeBlanksRule(2, 20, "left")}));
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 1, 1, 2)}, {MakeBlanksRule(1, 10, "right")}));
-
-  const auto host = MakeHost(harness);
-  const auto result = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 1, 2), host);
-  ASSERT_TRUE(static_cast<bool>(result));
-  const std::vector<CFRangeCellMatches>& matches = result.value();
-  ASSERT_EQ(matches.size(), 6u);
-  const std::vector<std::pair<std::uint32_t, std::uint32_t>> expected_cells{{0, 0}, {0, 1}, {0, 2},
-                                                                            {1, 0}, {1, 1}, {1, 2}};
-  for (std::size_t i = 0; i < expected_cells.size(); ++i) {
-    EXPECT_EQ(matches[i].cell.row, expected_cells[i].first) << "i=" << i;
-    EXPECT_EQ(matches[i].cell.col, expected_cells[i].second) << "i=" << i;
-  }
-  // Column A sees only the left block, column C only the right one, and
-  // column B both — priority-ascending.
-  ASSERT_EQ(matches[0].matches.size(), 1u);
-  EXPECT_EQ(matches[0].matches[0].rule_id, "left");
-  ASSERT_EQ(matches[1].matches.size(), 2u);
-  EXPECT_EQ(matches[1].matches[0].rule_id, "right");
-  EXPECT_EQ(matches[1].matches[1].rule_id, "left");
-  ASSERT_EQ(matches[2].matches.size(), 1u);
-  EXPECT_EQ(matches[2].matches[0].rule_id, "right");
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeClipsBlocksOutsideTheRequest) {
-  // A block sitting entirely outside the viewport contributes nothing,
-  // and a block straddling the viewport edge contributes only the cells
-  // inside it.
-  CFEvalHarness harness;
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 3, 3)}, {MakeBlanksRule(1, 7, "straddling")}));
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(10, 10, 12, 12)}, {MakeBlanksRule(1, 8, "far-away")}));
-
-  const auto host = MakeHost(harness);
-  const auto result = evaluate_cf_for_range(harness.sheet, MakeRange(1, 1, 2, 2), host);
-  ASSERT_TRUE(static_cast<bool>(result));
-  const std::vector<CFRangeCellMatches>& matches = result.value();
-  ASSERT_EQ(matches.size(), 4u);
-  EXPECT_EQ(matches[0].cell.row, 1u);
-  EXPECT_EQ(matches[0].cell.col, 1u);
-  EXPECT_EQ(matches[3].cell.row, 2u);
-  EXPECT_EQ(matches[3].cell.col, 2u);
-  for (const auto& cell : matches) {
-    ASSERT_EQ(cell.matches.size(), 1u);
-    EXPECT_EQ(cell.matches[0].rule_id, "straddling");
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Population caching — viewport API must produce results identical to
-// per-cell `evaluate_cf_at` calls. This pins the optimisation: caching
-// the population across cells in a range may not change rendered output.
-// ---------------------------------------------------------------------------
-
-CFRule MakeColorScaleBlock(std::int32_t priority, std::string id) {
-  CFRule rule;
-  rule.type = RuleType::ColorScale;
-  rule.priority = priority;
-  rule.id = std::move(id);
-  rule.color_scale = TwoStopMinMax(RGB(255, 0, 0), RGB(0, 255, 0));
-  return rule;
-}
-
-CFRule MakeTop10Rule(std::int32_t priority, std::string id, std::int32_t rank) {
-  CFRule rule;
-  rule.type = RuleType::Top10;
-  rule.priority = priority;
-  rule.dxf_id = 5;
-  rule.id = std::move(id);
-  rule.rank = rank;
-  rule.bottom = false;
-  rule.percent = false;
-  return rule;
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeCachedPathMatchesUncached) {
-  // ColorScale over A1:A5 = [10, 20, 30, 40, 50]. Every cell is in
-  // the sqref so `evaluate_cf_at` and `evaluate_cf_for_range` must
-  // resolve identical fill colours.
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 4, 0)}, {MakeColorScaleBlock(1, "color-scale")}));
-
-  const auto host = MakeHost(harness);
-  std::vector<CFRangeCellMatches> ranged = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 4, 0), host).value();
-  ASSERT_EQ(ranged.size(), 5u);
-
-  for (std::uint32_t row = 0; row < 5; ++row) {
-    std::vector<CFMatch> per_cell = evaluate_cf_at(harness.sheet, At(row, 0), host);
-    ASSERT_EQ(per_cell.size(), 1u) << "row=" << row;
-    ASSERT_EQ(ranged[row].matches.size(), 1u) << "row=" << row;
-    const auto& cached = ranged[row].matches[0];
-    const auto& fresh = per_cell[0];
-    ASSERT_TRUE(cached.resolved_fill_color.has_value()) << "row=" << row;
-    ASSERT_TRUE(fresh.resolved_fill_color.has_value()) << "row=" << row;
-    EXPECT_EQ(cached.resolved_fill_color->r, fresh.resolved_fill_color->r) << "row=" << row;
-    EXPECT_EQ(cached.resolved_fill_color->g, fresh.resolved_fill_color->g) << "row=" << row;
-    EXPECT_EQ(cached.resolved_fill_color->b, fresh.resolved_fill_color->b) << "row=" << row;
-    EXPECT_EQ(cached.resolved_fill_color->a, fresh.resolved_fill_color->a) << "row=" << row;
-  }
-}
-
-TEST(CFEvaluator, EvaluateCfForRangeCachedPathPreservesTop10Behavior) {
-  // Top-2 over [10, 20, 30, 40, 50] should match rows 3 (40) and 4
-  // (50). Cached and uncached paths must agree on which cells fire.
-  CFEvalHarness harness;
-  PopulateLinearPopulation(harness);
-  harness.sheet.mutable_conditional_formats().push_back(
-      MakeBlock({MakeRange(0, 0, 4, 0)}, {MakeTop10Rule(1, "top2", 2)}));
-
-  const auto host = MakeHost(harness);
-  std::vector<CFRangeCellMatches> ranged = evaluate_cf_for_range(harness.sheet, MakeRange(0, 0, 4, 0), host).value();
-
-  // Row-major: only rows 3 and 4 should appear.
-  ASSERT_EQ(ranged.size(), 2u);
-  EXPECT_EQ(ranged[0].cell.row, 3u);
-  EXPECT_EQ(ranged[1].cell.row, 4u);
-
-  // Cross-check by walking cell-by-cell with the uncached entry point.
-  for (std::uint32_t row = 0; row < 5; ++row) {
-    std::vector<CFMatch> per_cell = evaluate_cf_at(harness.sheet, At(row, 0), host);
-    const bool expected = row >= 3;
-    EXPECT_EQ(per_cell.size(), expected ? 1u : 0u) << "row=" << row;
-  }
-}
-
-// A rule whose sqref is an explicit multi-million-cell rectangle (not
-// whole-column / whole-row notation) must be clamped to the populated
-// extent before scanning, so the scan stays bounded and still returns the
-// same match/numeric results as the tight rectangle would.
-TEST(CFHelpers, ExplicitGiantSqrefIsClampedToPopulatedExtent) {
-  Sheet sheet("S");
-  sheet.set_cell_cached_value(0, 0, Value::number(5.0));
-  sheet.set_cell_cached_value(50, 5, Value::number(5.0));
-  sheet.set_cell_cached_value(100, 3, Value::number(5.0));
-  sheet.set_cell_cached_value(100, 10, Value::number(9.0));  // populated, non-matching
-
-  // Explicit rectangle far larger than the ~65k clamp threshold, yet not
-  // full-column (last.row != kCfMaxRows-1) nor full-row (last.col !=
-  // kCfMaxCols-1) — the case the old code walked cell-by-cell.
-  CFCellRange giant;
-  giant.first = CellAddress{0, 0};
-  giant.last = CellAddress{400000, 4000};
-  ASSERT_FALSE(giant.is_full_col());
-  ASSERT_FALSE(giant.is_full_row());
-  const std::vector<CFCellRange> sqref{giant};
-
-  EXPECT_EQ(helpers::count_matches_in_sqref(Value::number(5.0), sqref, sheet), 3u);
-
-  const std::vector<double> numbers = helpers::collect_numeric_values(sqref, sheet);
-  EXPECT_EQ(numbers.size(), 4u);  // three 5s + one 9
-  double sum = 0.0;
-  for (double n : numbers) {
-    sum += n;
-  }
-  EXPECT_DOUBLE_EQ(sum, 24.0);
-}
-
-TEST(CFHelpers, WholeAxisExtentIncludesPhantomOnlyColumn) {
-  Sheet sheet("S");
-  ASSERT_TRUE(sheet.commit_spill(0U, 0U, 3U, 2U,
-                                 {Value::number(1.0), Value::number(2.0), Value::number(3.0), Value::number(4.0),
-                                  Value::number(5.0), Value::number(6.0)}));
-
-  const std::vector<CFCellRange> sqref{MakeRange(0U, 1U, kCfMaxRows - 1U, 1U)};
-  EXPECT_EQ(helpers::count_matches_in_sqref(Value::number(2.0), sqref, sheet), 1U);
-  EXPECT_EQ(helpers::count_matches_in_sqref(Value::number(4.0), sqref, sheet), 1U);
-  const std::vector<double> values = helpers::collect_numeric_values(sqref, sheet);
-  ASSERT_EQ(values.size(), 3U);
-  EXPECT_DOUBLE_EQ(values[0], 2.0);
-  EXPECT_DOUBLE_EQ(values[1], 4.0);
-  EXPECT_DOUBLE_EQ(values[2], 6.0);
-}
-
 }  // namespace
 }  // namespace formulon::cf
diff --git a/tests/unit/cf/cf_theme_color_test.cpp b/tests/unit/cf/cf_theme_color_test.cpp
new file mode 100644
index 000000000..b10c6e438
--- /dev/null
+++ b/tests/unit/cf/cf_theme_color_test.cpp
@@ -0,0 +1,214 @@
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cf/cf_evaluator.h"
+#include "cf/cf_types.h"
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "gtest/gtest.h"
+#include "io/cf_reader.h"
+#include "io/cf_writer.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "pugixml.hpp"
+#include "sheet.h"
+#include "theme.h"
+#include "utils/arena.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon::cf {
+namespace {
+
+// Resolved RGB values come from the measured theme/tint table (Office 2013-2022
+// scheme): theme index 4 = accent1 etc.
+constexpr Color Rgb(std::uint8_t r, std::uint8_t g, std::uint8_t b) {
+  return Color{r, g, b, 255, ColorSpec{}};
+}
+
+std::vector<ConditionalFormat> ReadBlocks(const std::string& body) {
+  pugi::xml_document doc;
+  const std::string xml = "<worksheet>" + body + "</worksheet>";
+  EXPECT_TRUE(doc.load_string(xml.c_str()));
+  auto formats = io::read_conditional_formats(doc.child("worksheet"));
+  EXPECT_TRUE(static_cast<bool>(formats));
+  return formats.take();
+}
+
+const char* kColorScaleXml =
+    "<conditionalFormatting sqref=\"A1:A3\"><cfRule type=\"colorScale\" priority=\"1\"><colorScale>"
+    "<cfvo type=\"min\"/><cfvo type=\"max\"/>"
+    "<color theme=\"4\" tint=\"0.39997558519241921\"/><color theme=\"5\" tint=\"-0.249977111117893\"/>"
+    "</colorScale></cfRule></conditionalFormatting>";
+
+const char* kDataBarXml =
+    "<conditionalFormatting sqref=\"B1:B3\"><cfRule type=\"dataBar\" priority=\"2\"><dataBar>"
+    "<cfvo type=\"min\"/><cfvo type=\"max\"/><color theme=\"8\" tint=\"0.59999389629810485\"/>"
+    "</dataBar></cfRule></conditionalFormatting>";
+
+struct Fixture {
+  Workbook wb = Workbook::create();
+  Arena arena;
+  eval::EvalState state;
+
+  explicit Fixture(const std::string& body) {
+    Sheet& sheet = wb.sheet(0);
+    sheet.set_cell_value(0, 0, Value::number(0.0));
+    sheet.set_cell_value(1, 0, Value::number(50.0));
+    sheet.set_cell_value(2, 0, Value::number(100.0));
+    sheet.set_cell_value(0, 1, Value::number(0.0));
+    sheet.set_cell_value(1, 1, Value::number(50.0));
+    sheet.set_cell_value(2, 1, Value::number(100.0));
+    for (ConditionalFormat& block : ReadBlocks(body)) {
+      sheet.mutable_conditional_formats().push_back(std::move(block));
+    }
+  }
+
+  std::vector<CFRangeCellMatches> Evaluate() {
+    eval::EvalContext ctx(wb, wb.sheet(0), state);
+    CFHost host;
+    host.arena = &arena;
+    host.registry = &eval::default_registry();
+    host.eval_ctx = &ctx;
+    CFCellRange range{};
+    range.first = CellAddress{0, 0};
+    range.last = CellAddress{2, 1};
+    auto out = evaluate_cf_for_range(wb.sheet(0), range, host);
+    EXPECT_TRUE(static_cast<bool>(out));
+    return out.take();
+  }
+};
+
+const CFMatch* MatchAt(const std::vector<CFRangeCellMatches>& all, std::uint32_t row, std::uint32_t col) {
+  for (const CFRangeCellMatches& entry : all) {
+    if (entry.cell.row == row && entry.cell.col == col && !entry.matches.empty()) {
+      return &entry.matches[0];
+    }
+  }
+  return nullptr;
+}
+
+TEST(CfThemeColor, ColorScaleThemeNotBlack) {
+  Fixture f(kColorScaleXml);
+  const auto results = f.Evaluate();
+  const CFMatch* low = MatchAt(results, 0, 0);
+  const CFMatch* high = MatchAt(results, 2, 0);
+  ASSERT_NE(low, nullptr);
+  ASSERT_NE(high, nullptr);
+  ASSERT_TRUE(low->resolved_fill_color.has_value());
+  ASSERT_TRUE(high->resolved_fill_color.has_value());
+  EXPECT_EQ(*low->resolved_fill_color, Rgb(0x8E, 0xA9, 0xDB));   // accent1, tint 0.4
+  EXPECT_EQ(*high->resolved_fill_color, Rgb(0xC6, 0x59, 0x11));  // accent2, tint -0.25
+}
+
+TEST(CfThemeColor, DataBarThemeTintFill) {
+  Fixture f(kDataBarXml);
+  const auto results = f.Evaluate();
+  const CFMatch* match = MatchAt(results, 1, 1);
+  ASSERT_NE(match, nullptr);
+  ASSERT_TRUE(match->data_bar_render.has_value());
+  EXPECT_EQ(match->data_bar_render->fill, Rgb(0xBD, 0xD7, 0xEE));  // accent5, tint 0.6
+}
+
+TEST(CfThemeColor, IndexedAndAutoColors) {
+  Fixture f(
+      "<conditionalFormatting sqref=\"A1:A3\"><cfRule type=\"colorScale\" priority=\"1\"><colorScale>"
+      "<cfvo type=\"min\"/><cfvo type=\"max\"/><color indexed=\"2\"/><color auto=\"1\"/>"
+      "</colorScale></cfRule></conditionalFormatting>"
+      "<conditionalFormatting sqref=\"B1:B3\"><cfRule type=\"dataBar\" priority=\"2\"><dataBar>"
+      "<cfvo type=\"min\"/><cfvo type=\"max\"/><color indexed=\"4\"/></dataBar></cfRule></conditionalFormatting>");
+  const auto results = f.Evaluate();
+  const CFMatch* low = MatchAt(results, 0, 0);
+  const CFMatch* high = MatchAt(results, 2, 0);
+  ASSERT_NE(low, nullptr);
+  ASSERT_NE(high, nullptr);
+  EXPECT_EQ(*low->resolved_fill_color, Rgb(0xFF, 0x00, 0x00));
+  EXPECT_EQ(*high->resolved_fill_color, Rgb(0xFF, 0xFF, 0xFF));  // automatic fill colour is the window colour
+  const CFMatch* bar = MatchAt(results, 1, 1);
+  ASSERT_NE(bar, nullptr);
+  EXPECT_EQ(bar->data_bar_render->fill, Rgb(0x00, 0x00, 0xFF));
+}
+
+TEST(CfThemeColor, LiteralRgbIsUntouched) {
+  Fixture f(
+      "<conditionalFormatting sqref=\"A1:A3\"><cfRule type=\"colorScale\" priority=\"1\"><colorScale>"
+      "<cfvo type=\"min\"/><cfvo type=\"max\"/><color rgb=\"FF102030\"/><color rgb=\"FF405060\"/>"
+      "</colorScale></cfRule></conditionalFormatting>");
+  const auto results = f.Evaluate();
+  EXPECT_EQ(*MatchAt(results, 0, 0)->resolved_fill_color, Rgb(0x10, 0x20, 0x30));
+  EXPECT_EQ(*MatchAt(results, 2, 0)->resolved_fill_color, Rgb(0x40, 0x50, 0x60));
+}
+
+TEST(CfThemeColor, ThemeEditIsReflected) {
+  Fixture f(kColorScaleXml);
+  ThemeColors colors = f.wb.load_theme().theme.colors;
+  colors[4] = 0xFF204060U;  // accent1 (clrScheme order)
+  ASSERT_TRUE(static_cast<bool>(f.wb.set_theme_colors(colors)));
+  const auto results = f.Evaluate();
+  const Color got = *MatchAt(results, 0, 0)->resolved_fill_color;
+  EXPECT_NE(got, Rgb(0x8E, 0xA9, 0xDB));
+  EXPECT_NE(got, Rgb(0, 0, 0));
+  // A lighter tint of a dark accent is lighter than the accent itself.
+  EXPECT_GT(got.b, 0x60);
+}
+
+TEST(CfThemeColor, WriterKeepsThemeAttributesOnRoundTrip) {
+  const auto first = ReadBlocks(std::string(kColorScaleXml) + kDataBarXml);
+  ASSERT_EQ(first.size(), 2u);
+  const std::string written = io::write_conditional_formattings(first, 0);
+  EXPECT_NE(written.find("theme=\"4\""), std::string::npos);
+  EXPECT_NE(written.find("theme=\"8\""), std::string::npos);
+  EXPECT_NE(written.find("tint=\""), std::string::npos);
+
+  const auto second = ReadBlocks(written);
+  ASSERT_EQ(second.size(), 2u);
+  const ColorScaleSpec& a = *first[0].rules[0].color_scale;
+  const ColorScaleSpec& b = *second[0].rules[0].color_scale;
+  ASSERT_EQ(b.colors.size(), 2u);
+  EXPECT_EQ(b.colors[0].spec.kind, ColorSpec::Kind::kTheme);
+  EXPECT_EQ(b.colors[0].spec.theme, 4u);
+  EXPECT_DOUBLE_EQ(b.colors[0].spec.tint, a.colors[0].spec.tint);
+  EXPECT_EQ(b.colors[1].spec.theme, 5u);
+  EXPECT_LT(b.colors[1].spec.tint, 0.0);
+  const DataBarSpec& bar = *second[1].rules[0].data_bar;
+  EXPECT_EQ(bar.fill.spec.kind, ColorSpec::Kind::kTheme);
+  EXPECT_EQ(bar.fill.spec.theme, 8u);
+  EXPECT_DOUBLE_EQ(bar.fill.spec.tint, first[1].rules[0].data_bar->fill.spec.tint);
+}
+
+TEST(CfThemeColor, IndexedAndAutoSurviveWriterRoundTrip) {
+  const auto first = ReadBlocks(
+      "<conditionalFormatting sqref=\"A1:A3\"><cfRule type=\"colorScale\" priority=\"1\"><colorScale>"
+      "<cfvo type=\"min\"/><cfvo type=\"max\"/><color indexed=\"2\"/><color auto=\"1\"/>"
+      "</colorScale></cfRule></conditionalFormatting>");
+  const auto second = ReadBlocks(io::write_conditional_formattings(first, 0));
+  ASSERT_EQ(second.size(), 1u);
+  const auto& colors = second[0].rules[0].color_scale->colors;
+  ASSERT_EQ(colors.size(), 2u);
+  EXPECT_EQ(colors[0].spec.kind, ColorSpec::Kind::kIndexed);
+  EXPECT_EQ(colors[0].spec.indexed, 2u);
+  EXPECT_EQ(colors[1].spec.kind, ColorSpec::Kind::kAuto);
+}
+
+TEST(CfThemeColor, PackageSaveLoadKeepsThemeAttributes) {
+  Fixture f(kColorScaleXml);
+  auto bytes = io::write_ooxml(f.wb);
+  ASSERT_TRUE(static_cast<bool>(bytes));
+  auto read = io::read_ooxml(io::ByteSpan{bytes.value().data(), bytes.value().size()});
+  ASSERT_TRUE(static_cast<bool>(read));
+  const auto& blocks = read.value().workbook.sheet(0).conditional_formats();
+  ASSERT_EQ(blocks.size(), 1u);
+  const auto& colors = blocks[0].rules[0].color_scale->colors;
+  ASSERT_EQ(colors.size(), 2u);
+  EXPECT_EQ(colors[0].spec.kind, ColorSpec::Kind::kTheme);
+  EXPECT_EQ(colors[0].spec.theme, 4u);
+  EXPECT_GT(colors[0].spec.tint, 0.39);
+  EXPECT_EQ(colors[1].spec.theme, 5u);
+  EXPECT_LT(colors[1].spec.tint, -0.24);
+}
+
+}  // namespace
+}  // namespace formulon::cf
diff --git a/tests/unit/color_resolve_test.cpp b/tests/unit/color_resolve_test.cpp
new file mode 100644
index 000000000..f1ecc327d
--- /dev/null
+++ b/tests/unit/color_resolve_test.cpp
@@ -0,0 +1,182 @@
+#include "color_resolve.h"
+
+#include <cstdint>
+#include <cstdio>
+#include <string>
+
+#include "gtest/gtest.h"
+#include "theme.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+// Theme colour scheme the table was measured against (clrScheme order).
+constexpr std::uint32_t kMeasuredScheme[12] = {0xFF000000U, 0xFFFFFFFFU, 0xFF44546AU, 0xFFE7E6E6U,
+                                               0xFF4472C4U, 0xFFED7D31U, 0xFFA5A5A5U, 0xFFFFC000U,
+                                               0xFF5B9BD5U, 0xFF70AD47U, 0xFF0563C1U, 0xFF954F72U};
+
+// Columns of kTintTable.
+constexpr double kTints[9] = {-0.5, -0.25, -0.1, 0.0, 0.1, 0.25, 0.4, 0.6, 0.8};
+
+// Resolved RGB by `theme` attribute index (0=lt1, 1=dk1, 2=lt2, 3=dk2, 4..11) and tint.
+constexpr const char* kTintTable[12][9] = {
+    {"808080", "BFBFBF", "E6E6E6", "FFFFFF", "FFFFFF", "FFFFFF", "FFFFFF", "FFFFFF", "FFFFFF"},
+    {"000000", "000000", "000000", "000000", "1A1A1A", "404040", "666666", "999999", "CCCCCC"},
+    {"757171", "AEAAAA", "D0CECE", "E7E6E6", "E9E9E9", "ECECEC", "F0F0F0", "F4F4F4", "FAFAFA"},
+    {"222B35", "333F4F", "3D4B5F", "44546A", "51647D", "657C9C", "8497B0", "ACB9CA", "D6DCE4"},
+    {"203764", "305496", "3864B4", "4472C4", "557ECA", "7395D2", "8EA9DB", "B4C6E7", "D9E1F2"},
+    {"833C0C", "C65911", "EB6B16", "ED7D31", "EF8945", "F19D65", "F4B084", "F8CBAD", "FCE4D6"},
+    {"525252", "7B7B7B", "949494", "A5A5A5", "ADADAD", "BBBBBB", "C9C9C9", "DBDBDB", "EDEDED"},
+    {"806000", "BF8F00", "E6AC00", "FFC000", "FFC61A", "FFCF40", "FFD966", "FFE699", "FFF2CC"},
+    {"1F4E78", "2F75B5", "428BCE", "5B9BD5", "6AA5D9", "84B4DF", "9BC2E6", "BDD7EE", "DDEBF7"},
+    {"375623", "548235", "649B40", "70AD47", "7DB955", "93C572", "A9D08E", "C6E0B4", "E2EFDA"},
+    {"023160", "03498F", "0458AC", "0563C1", "0572DE", "1A89F9", "46A0FB", "85C0FC", "C1DFFD"},
+    {"492738", "703A55", "864666", "954F72", "A75880", "B67495", "C58FAA", "D8B4C6", "EBDAE2"},
+};
+
+// Indexed colour by palette index: fill foreground and font colour.
+constexpr const char* kIndexedFill[66] = {
+    "000000", "FFFFFF", "FF0000", "00FF00", "0000FF", "FFFF00", "FF00FF", "00FFFF", "000000", "FFFFFF", "FF0000",
+    "00FF00", "0000FF", "FFFF00", "FF00FF", "00FFFF", "800000", "008000", "000080", "808000", "800080", "008080",
+    "C0C0C0", "808080", "9999FF", "993366", "FFFFCC", "CCFFFF", "660066", "FF8080", "0066CC", "CCCCFF", "000080",
+    "FF00FF", "FFFF00", "00FFFF", "800080", "800000", "008080", "0000FF", "00CCFF", "CCFFFF", "CCFFCC", "FFFF99",
+    "99CCFF", "FF99CC", "CC99FF", "FFCC99", "3366FF", "33CCCC", "99CC00", "FFCC00", "FF9900", "FF6600", "666699",
+    "969696", "003366", "339966", "003300", "333300", "993300", "993366", "333399", "333333", "FFFFFF", "FFFFFF",
+};
+constexpr const char* kIndexedFont[66] = {
+    "000000", "FFFFFF", "FF0000", "00FF00", "0000FF", "FFFF00", "FF00FF", "00FFFF", "000000", "FFFFFF", "FF0000",
+    "00FF00", "0000FF", "FFFF00", "FF00FF", "00FFFF", "800000", "008000", "000080", "808000", "800080", "008080",
+    "C0C0C0", "808080", "9999FF", "993366", "FFFFCC", "CCFFFF", "660066", "FF8080", "0066CC", "CCCCFF", "000080",
+    "FF00FF", "FFFF00", "00FFFF", "800080", "800000", "008080", "0000FF", "00CCFF", "CCFFFF", "CCFFCC", "FFFF99",
+    "99CCFF", "FF99CC", "CC99FF", "FFCC99", "3366FF", "33CCCC", "99CC00", "FFCC00", "FF9900", "FF6600", "666699",
+    "969696", "003366", "339966", "003300", "333300", "993300", "993366", "333399", "333333", "000000", "FFFFFF",
+};
+
+std::string Hex(std::uint32_t argb) {
+  char buf[12];
+  std::snprintf(buf, sizeof(buf), "%06X", argb & 0xFFFFFFU);
+  return buf;
+}
+
+Theme MeasuredTheme() {
+  Theme theme = default_theme();
+  for (std::size_t i = 0; i < kThemeColorCount; ++i) {
+    theme.colors[i] = kMeasuredScheme[i];
+  }
+  return theme;
+}
+
+ColorSpec ThemeSpec(std::uint32_t index, double tint) {
+  ColorSpec spec;
+  spec.kind = ColorSpec::Kind::kTheme;
+  spec.theme = index;
+  spec.tint = tint;
+  return spec;
+}
+
+ColorSpec IndexedSpec(std::uint32_t index) {
+  ColorSpec spec;
+  spec.kind = ColorSpec::Kind::kIndexed;
+  spec.indexed = index;
+  return spec;
+}
+
+TEST(ColorResolve, ProbeTable) {
+  const Theme theme = MeasuredTheme();
+  const IndexedPalette palette;
+  int theme_checked = 0;
+  for (std::uint32_t index = 0; index < 12U; ++index) {
+    for (int t = 0; t < 9; ++t) {
+      const ResolvedColor got =
+          resolve_color(ThemeSpec(index, kTints[t]), theme, ThemeSource::kPart, palette, ColorContext::kFillForeground);
+      EXPECT_EQ(Hex(got.argb), kTintTable[index][t]) << "theme=" << index << " tint=" << kTints[t];
+      EXPECT_EQ(got.argb >> 24U, 0xFFU);
+      EXPECT_EQ(got.resolution, ColorResolution::kExact);
+      ++theme_checked;
+    }
+  }
+  EXPECT_EQ(theme_checked, 108);
+  for (std::uint32_t index = 0; index < 66U; ++index) {
+    const ResolvedColor fill =
+        resolve_color(IndexedSpec(index), theme, ThemeSource::kPart, palette, ColorContext::kFillForeground);
+    const ResolvedColor font =
+        resolve_color(IndexedSpec(index), theme, ThemeSource::kPart, palette, ColorContext::kFont);
+    EXPECT_EQ(Hex(fill.argb), kIndexedFill[index]) << "indexed fill " << index;
+    EXPECT_EQ(Hex(font.argb), kIndexedFont[index]) << "indexed font " << index;
+  }
+}
+
+TEST(ColorResolve, ThemeFontColourWithoutTint) {
+  const Theme theme = MeasuredTheme();
+  const char* expected[4] = {"FFFFFF", "000000", "E7E6E6", "44546A"};
+  for (std::uint32_t index = 0; index < 4U; ++index) {
+    EXPECT_EQ(Hex(resolve_color(ThemeSpec(index, 0.0), theme, ThemeSource::kPart, {}, ColorContext::kFont).argb),
+              expected[index]);
+  }
+}
+
+TEST(ColorResolve, ResolutionReflectsThemeSource) {
+  const Theme theme = default_theme();
+  EXPECT_EQ(resolve_color(ThemeSpec(4, 0.0), theme, ThemeSource::kPart, {}, ColorContext::kFont).resolution,
+            ColorResolution::kExact);
+  EXPECT_EQ(resolve_color(ThemeSpec(4, 0.0), theme, ThemeSource::kDefault, {}, ColorContext::kFont).resolution,
+            ColorResolution::kDefaultTheme);
+  EXPECT_EQ(resolve_color(ThemeSpec(4, 0.0), theme, ThemeSource::kUnparseable, {}, ColorContext::kFont).resolution,
+            ColorResolution::kThemeUnparseable);
+  EXPECT_EQ(resolve_color(ThemeSpec(12, 0.0), theme, ThemeSource::kPart, {}, ColorContext::kFont).resolution,
+            ColorResolution::kIndexOutOfRange);
+}
+
+TEST(ColorResolve, IndexedBeyondPaletteIsOutOfRange) {
+  const ResolvedColor got =
+      resolve_color(IndexedSpec(66), default_theme(), ThemeSource::kPart, {}, ColorContext::kFont);
+  EXPECT_EQ(got.resolution, ColorResolution::kIndexOutOfRange);
+  EXPECT_EQ(got.argb, 0xFF000000U);
+}
+
+TEST(ColorResolve, SystemIndexesAndAutoFollowContext) {
+  const Theme theme = default_theme();
+  ColorSpec auto_spec;
+  auto_spec.kind = ColorSpec::Kind::kAuto;
+  for (const ColorSpec& spec : {IndexedSpec(64), auto_spec, ColorSpec{}}) {
+    const ResolvedColor font = resolve_color(spec, theme, ThemeSource::kPart, {}, ColorContext::kFont);
+    const ResolvedColor border = resolve_color(spec, theme, ThemeSource::kPart, {}, ColorContext::kBorder);
+    const ResolvedColor fill = resolve_color(spec, theme, ThemeSource::kPart, {}, ColorContext::kFillBackground);
+    EXPECT_EQ(font.argb, 0xFF000000U);
+    EXPECT_EQ(border.argb, 0xFF000000U);
+    EXPECT_EQ(fill.argb, 0xFFFFFFFFU);
+    EXPECT_EQ(font.resolution, ColorResolution::kAutoContext);
+  }
+}
+
+TEST(ColorResolve, PaletteOverrideReplacesLeadingEntries) {
+  const IndexedPalette palette = {0xFF112233U, 0x00445566U};
+  const Theme theme = default_theme();
+  EXPECT_EQ(resolve_color(IndexedSpec(0), theme, ThemeSource::kPart, palette, ColorContext::kFont).argb, 0xFF112233U);
+  EXPECT_EQ(resolve_color(IndexedSpec(1), theme, ThemeSource::kPart, palette, ColorContext::kFont).argb, 0xFF445566U);
+  EXPECT_EQ(resolve_color(IndexedSpec(2), theme, ThemeSource::kPart, palette, ColorContext::kFont).argb, 0xFFFF0000U);
+}
+
+TEST(ColorResolve, LiteralRgbIsExact) {
+  ColorSpec spec;
+  spec.kind = ColorSpec::Kind::kRgb;
+  spec.rgb = 0xFF123456U;
+  const ResolvedColor got = resolve_color(spec, default_theme(), ThemeSource::kDefault, {}, ColorContext::kFont);
+  EXPECT_EQ(got.argb, 0xFF123456U);
+  EXPECT_EQ(got.resolution, ColorResolution::kExact);
+}
+
+TEST(ColorResolve, WorkbookOverloadUsesWorkbookTheme) {
+  Workbook wb = Workbook::create();
+  EXPECT_EQ(resolve_color(wb, ThemeSpec(4, 0.0), ColorContext::kFont).resolution, ColorResolution::kDefaultTheme);
+  ThemeColors colors = default_theme().colors;
+  colors[4] = 0xFF010203U;
+  ASSERT_TRUE(static_cast<bool>(wb.set_theme_colors(colors)));
+  const ResolvedColor got = resolve_color(wb, ThemeSpec(4, 0.0), ColorContext::kFont);
+  EXPECT_EQ(got.argb, 0xFF010203U);
+  EXPECT_EQ(got.resolution, ColorResolution::kExact);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/drawing/drawing_edit_test.cpp b/tests/unit/drawing/drawing_edit_test.cpp
new file mode 100644
index 000000000..538a3d35b
--- /dev/null
+++ b/tests/unit/drawing/drawing_edit_test.cpp
@@ -0,0 +1,634 @@
+#include "drawing/drawing_edit.h"
+
+#include <cstdint>
+#include <limits>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "passthrough_part.h"
+#include "sheet.h"
+#include "unknown_relationship.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+using Bytes = std::vector<std::uint8_t>;
+
+constexpr const char* kCtDrawing = "application/vnd.openxmlformats-officedocument.drawing+xml";
+constexpr const char* kRelDrawing = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing";
+constexpr const char* kDrawingPath = "xl/drawings/drawing1.xml";
+constexpr const char* kRelsPath = "xl/drawings/_rels/drawing1.xml.rels";
+constexpr const char* kWsDrOpen =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\r\n"
+    "<xdr:wsDr xmlns:xdr=\"http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing\" "
+    "xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\">";
+constexpr const char* kRelsOpen =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\r\n"
+    "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">";
+constexpr const char* kImageRel = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image";
+
+Bytes ToBytes(const std::string& s) {
+  return Bytes(s.begin(), s.end());
+}
+
+Bytes Png(std::uint32_t w, std::uint32_t h) {
+  Bytes b = {0x89, 'P', 'N', 'G', 0x0D, 0x0A, 0x1A, 0x0A, 0, 0, 0, 13, 'I', 'H', 'D', 'R'};
+  for (std::uint32_t v : {w, h}) {
+    for (int shift = 24; shift >= 0; shift -= 8) {
+      b.push_back(static_cast<std::uint8_t>(v >> shift));
+    }
+  }
+  b.insert(b.end(), {8, 6, 0, 0, 0, 0x1F, 0x15, 0xC4, 0x89});
+  return b;
+}
+
+Bytes Jpeg(std::uint16_t w, std::uint16_t h) {
+  return {0xFF,
+          0xD8,
+          0xFF,
+          0xC0,
+          0x00,
+          0x11,
+          0x08,
+          static_cast<std::uint8_t>(h >> 8),
+          static_cast<std::uint8_t>(h),
+          static_cast<std::uint8_t>(w >> 8),
+          static_cast<std::uint8_t>(w),
+          0x03,
+          0xFF,
+          0xD9};
+}
+
+std::string Marker(const char* tag, std::uint32_t col, std::int64_t col_off, std::uint32_t row, std::int64_t row_off) {
+  return std::string("<xdr:") + tag + "><xdr:col>" + std::to_string(col) + "</xdr:col><xdr:colOff>" +
+         std::to_string(col_off) + "</xdr:colOff><xdr:row>" + std::to_string(row) + "</xdr:row><xdr:rowOff>" +
+         std::to_string(row_off) + "</xdr:rowOff></xdr:" + tag + ">";
+}
+
+std::string Pic(std::uint32_t id, const char* rid) {
+  return "<xdr:pic><xdr:nvPicPr><xdr:cNvPr id=\"" + std::to_string(id) + "\" name=\"Picture " + std::to_string(id - 1) +
+         "\"/><xdr:cNvPicPr><a:picLocks noChangeAspect=\"1\"/></xdr:cNvPicPr></xdr:nvPicPr><xdr:blipFill>"
+         "<a:blip xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" r:embed=\"" +
+         rid +
+         "\"/><a:stretch><a:fillRect/></a:stretch></xdr:blipFill><xdr:spPr><a:xfrm><a:off x=\"0\" y=\"0\"/>"
+         "<a:ext cx=\"381000\" cy=\"762000\"/></a:xfrm><a:prstGeom prst=\"rect\"><a:avLst/></a:prstGeom></xdr:spPr>"
+         "</xdr:pic><xdr:clientData/>";
+}
+
+std::string Rel(const char* id, const char* type, const char* target) {
+  return std::string("<Relationship Id=\"") + id + "\" Type=\"" + type + "\" Target=\"" + target + "\"/>";
+}
+
+const PassthroughPart* Part(const Workbook& wb, const std::string& path) {
+  for (const PassthroughPart& part : wb.passthrough_parts()) {
+    if (part.path == path) {
+      return &part;
+    }
+  }
+  return nullptr;
+}
+
+Workbook RoundTrip(const Workbook& wb) {
+  auto bytes = io::write_ooxml(wb);
+  EXPECT_TRUE(static_cast<bool>(bytes));
+  auto read = io::read_ooxml(io::ByteSpan{bytes.value().data(), bytes.value().size()});
+  EXPECT_TRUE(static_cast<bool>(read));
+  return std::move(read.value().workbook);
+}
+
+std::vector<DrawingObject> List(const Workbook& wb) {
+  auto objects = list_drawing_objects(wb, 0);
+  EXPECT_TRUE(static_cast<bool>(objects));
+  return objects ? objects.value() : std::vector<DrawingObject>{};
+}
+
+// A workbook whose first sheet uses 18 pt rows and carries `drawing` with
+// `rels`, plus the given media parts.
+Workbook WithDrawing(const std::string& drawing, const std::string& rels, const std::vector<std::string>& media) {
+  Workbook wb = Workbook::create();
+  SheetFormatDefaults& defaults = wb.sheet(0).mutable_format_defaults();
+  defaults.default_row_height = 18.0;
+  defaults.has_default_row_height = true;
+  EXPECT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart(kDrawingPath, kCtDrawing, ToBytes(drawing)))));
+  EXPECT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart(kRelsPath, "", ToBytes(rels)))));
+  for (const std::string& path : media) {
+    EXPECT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart(path, "", Png(40, 80)))));
+  }
+  wb.set_default_content_types({{"png", "image/png"}});
+  wb.sheet(0).set_drawing_rel_target(kDrawingPath);
+  return wb;
+}
+
+// Three 30 x 60 pt pictures at B5, D5 and F5 on 18 pt rows: move and size
+// with cells, move only, and free floating.
+Workbook ThreePlacements() {
+  const std::string drawing = std::string(kWsDrOpen) + "<xdr:twoCellAnchor>" + Marker("from", 1, 38100, 4, 50800) +
+                              Marker("to", 1, 419100, 7, 127000) + Pic(2, "rId1") +
+                              "</xdr:twoCellAnchor><xdr:twoCellAnchor editAs=\"oneCell\">" +
+                              Marker("from", 3, 38100, 4, 50800) + Marker("to", 3, 419100, 7, 127000) + Pic(3, "rId2") +
+                              "</xdr:twoCellAnchor><xdr:twoCellAnchor editAs=\"absolute\">" +
+                              Marker("from", 5, 38100, 4, 50800) + Marker("to", 5, 419100, 7, 127000) + Pic(4, "rId3") +
+                              "</xdr:twoCellAnchor></xdr:wsDr>";
+  const std::string rels = std::string(kRelsOpen) + Rel("rId1", kImageRel, "../media/image1.png") +
+                           Rel("rId2", kImageRel, "../media/image2.png") +
+                           Rel("rId3", kImageRel, "../media/image3.png") + "</Relationships>";
+  return WithDrawing(drawing, rels, {"xl/media/image1.png", "xl/media/image2.png", "xl/media/image3.png"});
+}
+
+void ExpectAnchor(const DrawingObject& obj, const AnchorPoint& from, const AnchorPoint& to) {
+  EXPECT_EQ(obj.from.row, from.row);
+  EXPECT_EQ(obj.from.row_off, from.row_off);
+  EXPECT_EQ(obj.from.col, from.col);
+  EXPECT_EQ(obj.from.col_off, from.col_off);
+  EXPECT_EQ(obj.to.row, to.row);
+  EXPECT_EQ(obj.to.row_off, to.row_off);
+  EXPECT_EQ(obj.to.col, to.col);
+  EXPECT_EQ(obj.to.col_off, to.col_off);
+}
+
+TEST(DrawingEdit, InsertTwoRemoveOneKeepsOthers) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0, 0, Value::number(21))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0, 1, "=A1*2")));
+  ASSERT_TRUE(static_cast<bool>(wb.add_merge(0, MergeRange{2, 0, 3, 1})));
+
+  const Bytes png = Png(40, 80);
+  ImageInsertOptions first;
+  first.name = "First";
+  first.descr = "first image";
+  first.row = 1;
+  first.col = 1;
+  auto id1 = insert_image(wb, 0, png.data(), png.size(), first);
+  ASSERT_TRUE(static_cast<bool>(id1));
+
+  const Bytes jpeg = Jpeg(100, 50);
+  ImageInsertOptions second;
+  second.descr = "second <image>";
+  second.anchor_kind = AnchorKind::kTwoCell;
+  second.edit_as = EditAs::kOneCell;
+  second.row = 10;
+  second.col = 2;
+  second.width_emu = 952500;
+  second.height_emu = 476250;
+  auto id2 = insert_image(wb, 0, jpeg.data(), jpeg.size(), second);
+  ASSERT_TRUE(static_cast<bool>(id2));
+  EXPECT_EQ(id1.value(), 2U);
+  EXPECT_EQ(id2.value(), 3U);
+
+  Workbook saved = RoundTrip(wb);
+  std::vector<DrawingObject> objects = List(saved);
+  ASSERT_EQ(objects.size(), 2U);
+  EXPECT_EQ(objects[0].anchor_kind, AnchorKind::kOneCell);
+  EXPECT_EQ(objects[0].name, "First");
+  EXPECT_EQ(objects[0].descr, "first image");
+  EXPECT_EQ(objects[0].cx, 40 * 9525);
+  EXPECT_EQ(objects[0].cy, 80 * 9525);
+  EXPECT_EQ(objects[0].image_format, ImageFormat::kPng);
+  EXPECT_EQ(objects[1].anchor_kind, AnchorKind::kTwoCell);
+  EXPECT_EQ(objects[1].edit_as, EditAs::kOneCell);
+  EXPECT_EQ(objects[1].image_format, ImageFormat::kJpeg);
+  EXPECT_EQ(objects[1].descr, "second <image>");
+  ASSERT_NE(Part(saved, objects[0].media_path), nullptr);
+  EXPECT_EQ(Part(saved, objects[0].media_path)->bytes, png);
+  const std::string jpeg_path = objects[1].media_path;
+  EXPECT_EQ(Part(saved, jpeg_path)->bytes, jpeg);
+
+  const std::string png_path = objects[0].media_path;
+  ASSERT_TRUE(static_cast<bool>(remove_image(saved, 0, id1.value())));
+  objects = List(saved);
+  ASSERT_EQ(objects.size(), 1U);
+  EXPECT_EQ(objects[0].object_id, id2.value());
+  EXPECT_EQ(Part(saved, png_path), nullptr);
+
+  Workbook again = RoundTrip(saved);
+  objects = List(again);
+  ASSERT_EQ(objects.size(), 1U);
+  EXPECT_EQ(objects[0].descr, "second <image>");
+  EXPECT_EQ(Part(again, jpeg_path)->bytes, jpeg);
+  EXPECT_EQ(Part(again, png_path), nullptr);
+  EXPECT_EQ(again.sheet(0).cell_at(0, 1)->formula_text, "=A1*2");
+  ASSERT_EQ(again.sheet(0).merges().size(), 1U);
+  EXPECT_EQ(again.sheet(0).merges()[0].last_row, 3U);
+}
+
+TEST(DrawingEdit, CoexistsWithChart) {
+  const std::string drawing =
+      std::string(kWsDrOpen) + "<xdr:twoCellAnchor>" + Marker("from", 0, 0, 0, 0) + Marker("to", 6, 0, 14, 0) +
+      "<xdr:graphicFrame macro=\"\"><xdr:nvGraphicFramePr><xdr:cNvPr id=\"2\" name=\"Chart 1\"/>"
+      "<xdr:cNvGraphicFramePr/></xdr:nvGraphicFramePr><xdr:xfrm><a:off x=\"0\" y=\"0\"/><a:ext cx=\"0\" cy=\"0\"/>"
+      "</xdr:xfrm><a:graphic><a:graphicData uri=\"http://schemas.openxmlformats.org/drawingml/2006/chart\">"
+      "<c:chart xmlns:c=\"http://schemas.openxmlformats.org/drawingml/2006/chart\" "
+      "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" r:id=\"rId1\"/>"
+      "</a:graphicData></a:graphic></xdr:graphicFrame><xdr:clientData/></xdr:twoCellAnchor>"
+      "<xdr:oneCellAnchor>" +
+      Marker("from", 8, 0, 1, 0) +
+      "<xdr:ext cx=\"914400\" cy=\"457200\"/><xdr:sp macro=\"\" textlink=\"\"><xdr:nvSpPr>"
+      "<xdr:cNvPr id=\"3\" name=\"Oval 2\"/><xdr:cNvSpPr/></xdr:nvSpPr><xdr:spPr><a:prstGeom prst=\"ellipse\">"
+      "<a:avLst/></a:prstGeom></xdr:spPr></xdr:sp><xdr:clientData/></xdr:oneCellAnchor></xdr:wsDr>";
+  const std::string rels =
+      std::string(kRelsOpen) +
+      Rel("rId1", "http://schemas.openxmlformats.org/officeDocument/2006/relationships/chart", "../charts/chart1.xml") +
+      "</Relationships>";
+  Workbook wb = WithDrawing(drawing, rels, {});
+  const Bytes chart = ToBytes("<c:chartSpace xmlns:c=\"http://schemas.openxmlformats.org/drawingml/2006/chart\"/>");
+  ASSERT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart(
+      "xl/charts/chart1.xml", "application/vnd.openxmlformats-officedocument.drawingml.chart+xml", chart))));
+
+  const Bytes png = Png(10, 10);
+  auto id = insert_image(wb, 0, png.data(), png.size(), ImageInsertOptions{});
+  ASSERT_TRUE(static_cast<bool>(id));
+  EXPECT_EQ(id.value(), 4U);
+
+  Workbook saved = RoundTrip(wb);
+  std::vector<DrawingObject> objects = List(saved);
+  ASSERT_EQ(objects.size(), 3U);
+  EXPECT_EQ(objects[0].kind, DrawingObjectKind::kChart);
+  EXPECT_EQ(objects[0].to.col, 6U);
+  EXPECT_EQ(objects[0].to.row, 14U);
+  EXPECT_EQ(objects[1].kind, DrawingObjectKind::kShape);
+  EXPECT_EQ(objects[1].name, "Oval 2");
+  EXPECT_EQ(objects[2].kind, DrawingObjectKind::kPicture);
+  EXPECT_EQ(objects[2].image_rel_id, "rId2");
+  ASSERT_NE(Part(saved, "xl/charts/chart1.xml"), nullptr);
+  EXPECT_EQ(Part(saved, "xl/charts/chart1.xml")->bytes, chart);
+  const std::string saved_rels(Part(saved, kRelsPath)->bytes.begin(), Part(saved, kRelsPath)->bytes.end());
+  EXPECT_NE(saved_rels.find("Target=\"../charts/chart1.xml\""), std::string::npos);
+
+  // Removing the picture leaves the chart, its relationship and its part.
+  ASSERT_TRUE(static_cast<bool>(remove_image(saved, 0, id.value())));
+  objects = List(saved);
+  ASSERT_EQ(objects.size(), 2U);
+  EXPECT_EQ(objects[0].kind, DrawingObjectKind::kChart);
+  EXPECT_NE(Part(saved, "xl/charts/chart1.xml"), nullptr);
+  const std::string after_rels(Part(saved, kRelsPath)->bytes.begin(), Part(saved, kRelsPath)->bytes.end());
+  EXPECT_NE(after_rels.find("rId1"), std::string::npos);
+  EXPECT_EQ(after_rels.find("rId2"), std::string::npos);
+  // The chart is not a picture, so it cannot be removed as one.
+  auto refused = remove_image(saved, 0, 2);
+  ASSERT_FALSE(static_cast<bool>(refused));
+  EXPECT_EQ(refused.error().code, FormulonErrorCode::kInvalidArgument);
+}
+
+TEST(DrawingEdit, TwoCellDeletedWithRows) {
+  // Rows 5..8 hold all three pictures and are deleted.
+  Workbook wb = ThreePlacements();
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, 4, 4)));
+  const std::vector<DrawingObject> objects = List(wb);
+  ASSERT_EQ(objects.size(), 2U);
+  EXPECT_EQ(objects[0].object_id, 3U);
+  ExpectAnchor(objects[0], {4, 3, 0, 38100}, {7, 3, 76200, 419100});
+  EXPECT_EQ(objects[1].object_id, 4U);
+  ExpectAnchor(objects[1], {4, 5, 50800, 38100}, {7, 5, 127000, 419100});
+  // The removed picture's relationship and media go with it.
+  EXPECT_EQ(Part(wb, "xl/media/image1.png"), nullptr);
+  EXPECT_NE(Part(wb, "xl/media/image2.png"), nullptr);
+  const std::string rels(Part(wb, kRelsPath)->bytes.begin(), Part(wb, kRelsPath)->bytes.end());
+  EXPECT_EQ(rels.find("image1.png"), std::string::npos);
+  EXPECT_NE(rels.find("image3.png"), std::string::npos);
+}
+
+struct AnchorCase {
+  const char* name;
+  std::uint32_t index;
+  std::uint32_t count;
+  bool is_delete;
+  bool row_axis;
+  bool move_and_size_removed;
+  AnchorPoint move_and_size_from, move_and_size_to;
+  AnchorPoint move_from, move_to;
+};
+
+TEST(DrawingEdit, AnchorsFollowMeasuredRowColumnRules) {
+  // {row, col, row_off, col_off}; Excel's anchors after each edit.
+  const AnchorCase cases[] = {
+      {"delete rows 3-4 above",
+       2,
+       2,
+       true,
+       true,
+       false,
+       {2, 1, 50800, 38100},
+       {5, 1, 127000, 419100},
+       {2, 3, 50800, 38100},
+       {5, 3, 127000, 419100}},
+      {"delete rows 6-7 inside",
+       5,
+       2,
+       true,
+       true,
+       false,
+       {4, 1, 50800, 38100},
+       {5, 1, 127000, 419100},
+       {4, 3, 50800, 38100},
+       {7, 3, 127000, 419100}},
+      {"delete rows 7-10 bottom overlap",
+       6,
+       4,
+       true,
+       true,
+       false,
+       {4, 1, 50800, 38100},
+       {6, 1, 0, 419100},
+       {4, 3, 50800, 38100},
+       {7, 3, 127000, 419100}},
+      {"delete rows 3-6 top overlap",
+       2,
+       4,
+       true,
+       true,
+       false,
+       {2, 1, 0, 38100},
+       {3, 1, 127000, 419100},
+       {2, 3, 0, 38100},
+       {5, 3, 76200, 419100}},
+      {"delete row 5 first row",
+       4,
+       1,
+       true,
+       true,
+       false,
+       {4, 1, 0, 38100},
+       {6, 1, 127000, 419100},
+       {4, 3, 0, 38100},
+       {7, 3, 76200, 419100}},
+      {"delete row 8 last row",
+       7,
+       1,
+       true,
+       true,
+       false,
+       {4, 1, 50800, 38100},
+       {7, 1, 0, 419100},
+       {4, 3, 50800, 38100},
+       {7, 3, 127000, 419100}},
+      {"insert rows 6-7 inside",
+       5,
+       2,
+       false,
+       true,
+       false,
+       {4, 1, 50800, 38100},
+       {9, 1, 127000, 419100},
+       {4, 3, 50800, 38100},
+       {7, 3, 127000, 419100}},
+      {"delete column C",
+       2,
+       1,
+       true,
+       false,
+       false,
+       {4, 1, 50800, 38100},
+       {7, 1, 127000, 419100},
+       {4, 2, 50800, 38100},
+       {7, 2, 127000, 419100}},
+      {"delete column D",
+       3,
+       1,
+       true,
+       false,
+       false,
+       {4, 1, 50800, 38100},
+       {7, 1, 127000, 419100},
+       {4, 3, 50800, 0},
+       {7, 3, 127000, 381000}},
+      {"delete columns B-D", 1, 3, true, false, true, {}, {}, {4, 1, 50800, 0}, {7, 1, 127000, 381000}},
+  };
+  for (const AnchorCase& c : cases) {
+    SCOPED_TRACE(c.name);
+    Workbook wb = ThreePlacements();
+    shift_drawing_anchors(wb, 0, c.index, c.count, c.is_delete, c.row_axis);
+    const std::vector<DrawingObject> objects = List(wb);
+    ASSERT_EQ(objects.size(), c.move_and_size_removed ? 2U : 3U);
+    std::size_t i = 0;
+    if (!c.move_and_size_removed) {
+      ExpectAnchor(objects[i++], c.move_and_size_from, c.move_and_size_to);
+    }
+    ExpectAnchor(objects[i++], c.move_from, c.move_to);
+    ExpectAnchor(objects[i], {4, 5, 50800, 38100}, {7, 5, 127000, 419100});
+  }
+}
+
+TEST(DrawingEdit, LargeInsertClampsAnchorsWithoutWrapping) {
+  const std::uint32_t huge_count = std::numeric_limits<std::uint32_t>::max();
+
+  Workbook rows = ThreePlacements();
+  shift_drawing_anchors(rows, 0, 0, huge_count, false, true);
+  std::vector<DrawingObject> objects = List(rows);
+  ASSERT_EQ(objects.size(), 3U);
+  EXPECT_EQ(objects[0].from.row, Sheet::kMaxRows - 1U);
+  EXPECT_EQ(objects[0].to.row, Sheet::kMaxRows - 1U);
+  EXPECT_EQ(objects[1].from.row, Sheet::kMaxRows - 1U);
+  EXPECT_EQ(objects[1].to.row, Sheet::kMaxRows - 1U);
+  EXPECT_EQ(objects[2].from.row, 4U);
+  EXPECT_EQ(objects[2].to.row, 7U);
+
+  Workbook columns = ThreePlacements();
+  shift_drawing_anchors(columns, 0, 0, huge_count, false, false);
+  objects = List(columns);
+  ASSERT_EQ(objects.size(), 3U);
+  EXPECT_EQ(objects[0].from.col, Sheet::kMaxCols - 1U);
+  EXPECT_EQ(objects[0].to.col, Sheet::kMaxCols - 1U);
+  EXPECT_EQ(objects[1].from.col, Sheet::kMaxCols - 1U);
+  EXPECT_EQ(objects[1].to.col, Sheet::kMaxCols - 1U);
+  EXPECT_EQ(objects[2].from.col, 5U);
+  EXPECT_EQ(objects[2].to.col, 5U);
+
+  // A regular insertion still shifts anchors by its exact count.
+  Workbook ordinary = ThreePlacements();
+  shift_drawing_anchors(ordinary, 0, 5, 2, false, true);
+  objects = List(ordinary);
+  ASSERT_EQ(objects.size(), 3U);
+  EXPECT_EQ(objects[0].from.row, 4U);
+  EXPECT_EQ(objects[0].to.row, 9U);
+  EXPECT_EQ(objects[1].from.row, 4U);
+  EXPECT_EQ(objects[1].to.row, 7U);
+}
+
+TEST(DrawingEdit, OneCellAndAbsoluteAnchorsOnRowDelete) {
+  const std::string drawing = std::string(kWsDrOpen) + "<xdr:oneCellAnchor>" + Marker("from", 1, 38100, 4, 50800) +
+                              "<xdr:ext cx=\"381000\" cy=\"762000\"/>" + Pic(2, "rId1") +
+                              "</xdr:oneCellAnchor><xdr:absoluteAnchor><xdr:pos x=\"5000\" y=\"6000\"/>"
+                              "<xdr:ext cx=\"381000\" cy=\"762000\"/>" +
+                              Pic(3, "rId1") + "</xdr:absoluteAnchor></xdr:wsDr>";
+  const std::string rels = std::string(kRelsOpen) + Rel("rId1", kImageRel, "../media/image1.png") + "</Relationships>";
+
+  Workbook covering = WithDrawing(drawing, rels, {"xl/media/image1.png"});
+  shift_drawing_anchors(covering, 0, 4, 4, true, true);
+  std::vector<DrawingObject> objects = List(covering);
+  ASSERT_EQ(objects.size(), 2U);
+  EXPECT_EQ(objects[0].from.row, 4U);
+  EXPECT_EQ(objects[0].from.row_off, 0);
+  EXPECT_EQ(objects[0].from.col_off, 38100);
+  EXPECT_EQ(objects[0].cy, 762000);
+  EXPECT_EQ(objects[1].from.col_off, 5000);
+  EXPECT_EQ(objects[1].from.row_off, 6000);
+
+  Workbook above = WithDrawing(drawing, rels, {"xl/media/image1.png"});
+  shift_drawing_anchors(above, 0, 0, 2, true, true);
+  objects = List(above);
+  ASSERT_EQ(objects.size(), 2U);
+  EXPECT_EQ(objects[0].from.row, 2U);
+  EXPECT_EQ(objects[0].from.row_off, 50800);
+}
+
+TEST(DrawingEdit, EditAfterEveryObjectKeepsBytes) {
+  Workbook wb = ThreePlacements();
+  const Bytes before = Part(wb, kDrawingPath)->bytes;
+  shift_drawing_anchors(wb, 0, 20, 3, true, true);
+  shift_drawing_anchors(wb, 0, 10, 2, false, false);
+  EXPECT_EQ(Part(wb, kDrawingPath)->bytes, before);
+}
+
+TEST(DrawingEdit, RefusesXlsbRetainedDrawing) {
+  Workbook wb = Workbook::create();
+  const Bytes drawing = ToBytes(std::string(kWsDrOpen) + "</xdr:wsDr>");
+  ASSERT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart(kDrawingPath, kCtDrawing, drawing))));
+  wb.sheet(0).set_unknown_relationships({UnknownRelationship{"rId1", kRelDrawing, kDrawingPath, false}});
+  const Bytes png = Png(4, 4);
+  auto inserted = insert_image(wb, 0, png.data(), png.size(), ImageInsertOptions{});
+  ASSERT_FALSE(static_cast<bool>(inserted));
+  EXPECT_EQ(inserted.error().code, FormulonErrorCode::kIoDrawingUnparseable);
+  auto removed = remove_image(wb, 0, 2);
+  ASSERT_FALSE(static_cast<bool>(removed));
+  EXPECT_EQ(removed.error().code, FormulonErrorCode::kIoDrawingUnparseable);
+  EXPECT_EQ(wb.passthrough_parts().size(), 1U);
+  EXPECT_EQ(Part(wb, kDrawingPath)->bytes, drawing);
+  EXPECT_TRUE(wb.sheet(0).drawing_rel_target().empty());
+}
+
+TEST(DrawingEdit, UnparseableDrawingRefusesEdits) {
+  Workbook wb =
+      WithDrawing(std::string(kWsDrOpen) + "<xdr:twoCellAnchor>", std::string(kRelsOpen) + "</Relationships>", {});
+  const Bytes before = Part(wb, kDrawingPath)->bytes;
+  const Bytes png = Png(4, 4);
+  auto inserted = insert_image(wb, 0, png.data(), png.size(), ImageInsertOptions{});
+  ASSERT_FALSE(static_cast<bool>(inserted));
+  EXPECT_EQ(inserted.error().code, FormulonErrorCode::kIoDrawingUnparseable);
+  auto listed = list_drawing_objects(wb, 0);
+  ASSERT_FALSE(static_cast<bool>(listed));
+  EXPECT_EQ(listed.error().code, FormulonErrorCode::kIoDrawingUnparseable);
+  shift_drawing_anchors(wb, 0, 0, 1, true, true);
+  EXPECT_EQ(Part(wb, kDrawingPath)->bytes, before);
+  EXPECT_EQ(wb.passthrough_parts().size(), 2U);
+}
+
+TEST(DrawingEdit, InsertSaveReloadKeepsBytes) {
+  Workbook wb = Workbook::create();
+  const Bytes png = Png(16, 8);
+  ImageInsertOptions options;
+  options.descr = "alt";
+  options.row = 3;
+  options.col = 2;
+  options.row_off = 1000;
+  options.col_off = 2000;
+  ASSERT_TRUE(static_cast<bool>(insert_image(wb, 0, png.data(), png.size(), options)));
+  EXPECT_EQ(wb.sheet(0).drawing_rel_target(), kDrawingPath);
+  const Bytes drawing = Part(wb, kDrawingPath)->bytes;
+  const Bytes rels = Part(wb, kRelsPath)->bytes;
+
+  Workbook reloaded = RoundTrip(wb);
+  ASSERT_NE(Part(reloaded, kDrawingPath), nullptr);
+  EXPECT_EQ(Part(reloaded, kDrawingPath)->bytes, drawing);
+  EXPECT_EQ(Part(reloaded, kDrawingPath)->content_type, kCtDrawing);
+  EXPECT_EQ(Part(reloaded, kRelsPath)->bytes, rels);
+  EXPECT_EQ(Part(reloaded, "xl/media/image1.png")->bytes, png);
+  bool png_default = false;
+  for (const DefaultContentType& def : reloaded.default_content_types()) {
+    png_default = png_default || (def.extension == "png" && def.content_type == "image/png");
+  }
+  EXPECT_TRUE(png_default);
+  const std::vector<DrawingObject> objects = List(reloaded);
+  ASSERT_EQ(objects.size(), 1U);
+  EXPECT_EQ(objects[0].from.row, 3U);
+  EXPECT_EQ(objects[0].from.row_off, 1000);
+  EXPECT_EQ(objects[0].from.col, 2U);
+  EXPECT_EQ(objects[0].from.col_off, 2000);
+  EXPECT_EQ(objects[0].cx, 16 * 9525);
+  EXPECT_EQ(objects[0].cy, 8 * 9525);
+  EXPECT_EQ(objects[0].descr, "alt");
+}
+
+TEST(DrawingEdit, TwoCellInsertDerivesToFromSize) {
+  // A 30 x 60 pt picture at B5 + (3 pt, 4 pt) on 18 pt rows ends 10 pt into
+  // row 8, as Excel anchors it.
+  Workbook wb = WithDrawing(std::string(kWsDrOpen) + "</xdr:wsDr>", std::string(kRelsOpen) + "</Relationships>", {});
+  const Bytes png = Png(4, 4);
+  ImageInsertOptions options;
+  options.anchor_kind = AnchorKind::kTwoCell;
+  options.row = 4;
+  options.col = 1;
+  options.row_off = 50800;
+  options.col_off = 38100;
+  options.width_emu = 381000;
+  options.height_emu = 762000;
+  ASSERT_TRUE(static_cast<bool>(insert_image(wb, 0, png.data(), png.size(), options)));
+  const std::vector<DrawingObject> objects = List(wb);
+  ASSERT_EQ(objects.size(), 1U);
+  EXPECT_EQ(objects[0].anchor_kind, AnchorKind::kTwoCell);
+  EXPECT_EQ(objects[0].edit_as, EditAs::kTwoCell);
+  ExpectAnchor(objects[0], {4, 1, 50800, 38100}, {7, 1, 127000, 419100});
+  const std::string xml(Part(wb, kDrawingPath)->bytes.begin(), Part(wb, kDrawingPath)->bytes.end());
+  EXPECT_EQ(xml.find("editAs"), std::string::npos);
+}
+
+TEST(DrawingEdit, IdsStayUniqueAcrossNestedObjects) {
+  const std::string drawing =
+      std::string(kWsDrOpen) + "<xdr:twoCellAnchor>" + Marker("from", 0, 0, 0, 0) + Marker("to", 2, 0, 2, 0) +
+      "<xdr:grpSp><xdr:nvGrpSpPr><xdr:cNvPr id=\"2\" name=\"Group 1\"/><xdr:cNvGrpSpPr/></xdr:nvGrpSpPr>"
+      "<xdr:grpSpPr/><xdr:sp macro=\"\" textlink=\"\"><xdr:nvSpPr><xdr:cNvPr id=\"5\" name=\"Shape 4\"/>"
+      "<xdr:cNvSpPr/></xdr:nvSpPr><xdr:spPr/></xdr:sp></xdr:grpSp><xdr:clientData/></xdr:twoCellAnchor></xdr:wsDr>";
+  Workbook wb = WithDrawing(drawing, std::string(kRelsOpen) + "</Relationships>", {});
+  const Bytes jpeg = Jpeg(8, 8);
+  auto id = insert_image(wb, 0, jpeg.data(), jpeg.size(), ImageInsertOptions{});
+  ASSERT_TRUE(static_cast<bool>(id));
+  EXPECT_EQ(id.value(), 6U);
+  EXPECT_NE(Part(wb, "xl/media/image1.jpeg"), nullptr);
+  bool jpeg_default = false;
+  for (const DefaultContentType& def : wb.default_content_types()) {
+    jpeg_default = jpeg_default || (def.extension == "jpeg" && def.content_type == "image/jpeg");
+  }
+  EXPECT_TRUE(jpeg_default);
+}
+
+TEST(DrawingEdit, RejectsInvalidInsertions) {
+  Workbook wb = Workbook::create();
+  const Bytes png = Png(4, 4);
+  const auto code = [&](const ImageInsertOptions& options, const Bytes& bytes) {
+    auto result = insert_image(wb, 0, bytes.data(), bytes.size(), options);
+    return result ? FormulonErrorCode::kOk : result.error().code;
+  };
+  ImageInsertOptions absolute;
+  absolute.anchor_kind = AnchorKind::kAbsolute;
+  EXPECT_EQ(code(absolute, png), FormulonErrorCode::kInvalidArgument);
+  ImageInsertOptions negative;
+  negative.row_off = -1;
+  EXPECT_EQ(code(negative, png), FormulonErrorCode::kInvalidArgument);
+  ImageInsertOptions huge;
+  huge.width_emu = std::int64_t{1} << 31;
+  EXPECT_EQ(code(huge, png), FormulonErrorCode::kInvalidArgument);
+  ImageInsertOptions off_sheet;
+  off_sheet.row = Sheet::kMaxRows;
+  EXPECT_EQ(code(off_sheet, png), FormulonErrorCode::kInvalidArgument);
+  ImageInsertOptions past_end;
+  past_end.row = Sheet::kMaxRows - 1;
+  past_end.height_emu = 762000;
+  EXPECT_EQ(code(past_end, png), FormulonErrorCode::kInvalidArgument);
+  EXPECT_EQ(code(ImageInsertOptions{}, ToBytes("not an image")), FormulonErrorCode::kIoImageUnsupported);
+  Bytes oversized = Png(4, 4);
+  oversized.resize(kMaxImageBytes + 1);
+  EXPECT_EQ(code(ImageInsertOptions{}, oversized), FormulonErrorCode::kInvalidArgument);
+  auto bad_sheet = insert_image(wb, 3, png.data(), png.size(), ImageInsertOptions{});
+  ASSERT_FALSE(static_cast<bool>(bad_sheet));
+  EXPECT_EQ(bad_sheet.error().code, FormulonErrorCode::kInvalidArgument);
+  // Nothing was added by the refused insertions.
+  EXPECT_TRUE(wb.passthrough_parts().empty());
+  EXPECT_TRUE(wb.sheet(0).drawing_rel_target().empty());
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/drawing/drawing_xml_test.cpp b/tests/unit/drawing/drawing_xml_test.cpp
new file mode 100644
index 000000000..776853048
--- /dev/null
+++ b/tests/unit/drawing/drawing_xml_test.cpp
@@ -0,0 +1,261 @@
+#include "drawing/drawing_xml.h"
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "drawing/drawing_edit.h"
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "passthrough_part.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+using Bytes = std::vector<std::uint8_t>;
+
+Bytes ToBytes(const std::string& s) {
+  return Bytes(s.begin(), s.end());
+}
+
+// A picture (move but don't size), a one-cell shape, an absolute chart, a
+// group, a connector and a chartex frame wrapped in mc:AlternateContent.
+constexpr const char* kDrawing =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\r\n"
+    "<xdr:wsDr xmlns:xdr=\"http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing\" "
+    "xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\">"
+    "<xdr:twoCellAnchor editAs=\"oneCell\">"
+    "<xdr:from><xdr:col>1</xdr:col><xdr:colOff>38100</xdr:colOff><xdr:row>4</xdr:row><xdr:rowOff>50800</xdr:rowOff>"
+    "</xdr:from>"
+    "<xdr:to><xdr:col>1</xdr:col><xdr:colOff>419100</xdr:colOff><xdr:row>7</xdr:row><xdr:rowOff>127000</xdr:rowOff>"
+    "</xdr:to>"
+    "<xdr:pic><xdr:nvPicPr><xdr:cNvPr id=\"2\" name=\"Picture 1\" descr=\"Logo &amp; mark\"/>"
+    "<xdr:cNvPicPr><a:picLocks noChangeAspect=\"1\"/></xdr:cNvPicPr></xdr:nvPicPr>"
+    "<xdr:blipFill><a:blip xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" "
+    "r:embed=\"rId2\"/><a:stretch><a:fillRect/></a:stretch></xdr:blipFill>"
+    "<xdr:spPr><a:xfrm><a:off x=\"647700\" y=\"965200\"/><a:ext cx=\"381000\" cy=\"762000\"/></a:xfrm>"
+    "<a:prstGeom prst=\"rect\"><a:avLst/></a:prstGeom></xdr:spPr></xdr:pic><xdr:clientData/></xdr:twoCellAnchor>"
+    "<xdr:oneCellAnchor><xdr:from><xdr:col>3</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>0</xdr:row>"
+    "<xdr:rowOff>0</xdr:rowOff></xdr:from><xdr:ext cx=\"914400\" cy=\"457200\"/>"
+    "<xdr:sp macro=\"\" textlink=\"\"><xdr:nvSpPr><xdr:cNvPr id=\"3\" name=\"Rectangle 2\"/><xdr:cNvSpPr/></xdr:nvSpPr>"
+    "<xdr:spPr><a:prstGeom prst=\"rect\"><a:avLst/></a:prstGeom></xdr:spPr></xdr:sp><xdr:clientData/>"
+    "</xdr:oneCellAnchor>"
+    "<xdr:absoluteAnchor><xdr:pos x=\"100\" y=\"200\"/><xdr:ext cx=\"4572000\" cy=\"2743200\"/>"
+    "<xdr:graphicFrame macro=\"\"><xdr:nvGraphicFramePr><xdr:cNvPr id=\"4\" name=\"Chart 3\"/>"
+    "<xdr:cNvGraphicFramePr/></xdr:nvGraphicFramePr><xdr:xfrm><a:off x=\"0\" y=\"0\"/><a:ext cx=\"0\" cy=\"0\"/>"
+    "</xdr:xfrm><a:graphic><a:graphicData uri=\"http://schemas.openxmlformats.org/drawingml/2006/chart\">"
+    "<c:chart xmlns:c=\"http://schemas.openxmlformats.org/drawingml/2006/chart\" "
+    "xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\" r:id=\"rId1\"/>"
+    "</a:graphicData></a:graphic></xdr:graphicFrame><xdr:clientData/></xdr:absoluteAnchor>"
+    "<xdr:twoCellAnchor><xdr:from><xdr:col>5</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>1</xdr:row>"
+    "<xdr:rowOff>0</xdr:rowOff></xdr:from><xdr:to><xdr:col>6</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>3</xdr:row>"
+    "<xdr:rowOff>0</xdr:rowOff></xdr:to><xdr:grpSp><xdr:nvGrpSpPr><xdr:cNvPr id=\"7\" name=\"Group 6\"/>"
+    "<xdr:cNvGrpSpPr/></xdr:nvGrpSpPr><xdr:grpSpPr><a:xfrm><a:off x=\"1\" y=\"2\"/><a:ext cx=\"600\" cy=\"700\"/>"
+    "<a:chOff x=\"0\" y=\"0\"/><a:chExt cx=\"600\" cy=\"700\"/></a:xfrm></xdr:grpSpPr></xdr:grpSp><xdr:clientData/>"
+    "</xdr:twoCellAnchor>"
+    "<xdr:twoCellAnchor editAs=\"absolute\"><xdr:from><xdr:col>0</xdr:col><xdr:colOff>0</xdr:colOff>"
+    "<xdr:row>9</xdr:row><xdr:rowOff>0</xdr:rowOff></xdr:from><xdr:to><xdr:col>2</xdr:col><xdr:colOff>0</xdr:colOff>"
+    "<xdr:row>9</xdr:row><xdr:rowOff>0</xdr:rowOff></xdr:to><xdr:cxnSp macro=\"\"><xdr:nvCxnSpPr>"
+    "<xdr:cNvPr id=\"8\" name=\"Straight Connector 7\"/><xdr:cNvCxnSpPr/></xdr:nvCxnSpPr><xdr:spPr/></xdr:cxnSp>"
+    "<xdr:clientData/></xdr:twoCellAnchor>"
+    "<mc:AlternateContent xmlns:mc=\"http://schemas.openxmlformats.org/markup-compatibility/2006\">"
+    "<mc:Choice xmlns:cx1=\"http://schemas.microsoft.com/office/drawing/2015/9/8/chartex\" Requires=\"cx1\">"
+    "<xdr:twoCellAnchor><xdr:from><xdr:col>8</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>2</xdr:row>"
+    "<xdr:rowOff>0</xdr:rowOff></xdr:from><xdr:to><xdr:col>12</xdr:col><xdr:colOff>0</xdr:colOff>"
+    "<xdr:row>12</xdr:row><xdr:rowOff>0</xdr:rowOff></xdr:to><xdr:graphicFrame macro=\"\"><xdr:nvGraphicFramePr>"
+    "<xdr:cNvPr id=\"9\" name=\"Chart 8\"/><xdr:cNvGraphicFramePr/></xdr:nvGraphicFramePr><xdr:xfrm/>"
+    "<a:graphic><a:graphicData uri=\"http://schemas.microsoft.com/office/drawing/2014/chartex\"/></a:graphic>"
+    "</xdr:graphicFrame><xdr:clientData/></xdr:twoCellAnchor></mc:Choice>"
+    "<mc:Fallback><xdr:twoCellAnchor><xdr:from><xdr:col>8</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>2</xdr:row>"
+    "<xdr:rowOff>0</xdr:rowOff></xdr:from><xdr:to><xdr:col>12</xdr:col><xdr:colOff>0</xdr:colOff>"
+    "<xdr:row>12</xdr:row><xdr:rowOff>0</xdr:rowOff></xdr:to><xdr:sp macro=\"\" textlink=\"\"><xdr:nvSpPr>"
+    "<xdr:cNvPr id=\"0\" name=\"\"/><xdr:cNvSpPr/></xdr:nvSpPr><xdr:spPr/></xdr:sp><xdr:clientData/>"
+    "</xdr:twoCellAnchor></mc:Fallback></mc:AlternateContent>"
+    "</xdr:wsDr>";
+
+constexpr const char* kRels =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\r\n"
+    "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
+    "<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/chart\" "
+    "Target=\"../charts/chart1.xml\"/>"
+    "<Relationship Id=\"rId2\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\" "
+    "Target=\"../media/image1.png\"/>"
+    "<Relationship Id=\"rId3\" "
+    "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink\" "
+    "Target=\"https://example.com/a\" TargetMode=\"External\"/>"
+    "</Relationships>";
+
+std::vector<DrawingObject> ReadObjects(const std::string& xml, const std::vector<DrawingRel>& rels) {
+  pugi::xml_document doc;
+  EXPECT_TRUE(static_cast<bool>(parse_drawing_part(ToBytes(xml), doc)));
+  return read_drawing_objects(doc, rels);
+}
+
+TEST(DrawingXml, ReadsEveryObjectKindAndAnchor) {
+  auto rels = parse_part_rels(ToBytes(kRels), "xl/drawings");
+  ASSERT_TRUE(static_cast<bool>(rels));
+  const std::vector<DrawingObject> objects = ReadObjects(kDrawing, rels.value());
+  ASSERT_EQ(objects.size(), 6U);
+
+  const DrawingObject& pic = objects[0];
+  EXPECT_EQ(pic.kind, DrawingObjectKind::kPicture);
+  EXPECT_EQ(pic.anchor_kind, AnchorKind::kTwoCell);
+  EXPECT_EQ(pic.edit_as, EditAs::kOneCell);
+  EXPECT_EQ(pic.object_id, 2U);
+  EXPECT_EQ(pic.name, "Picture 1");
+  EXPECT_EQ(pic.descr, "Logo & mark");
+  EXPECT_EQ(pic.from.col, 1U);
+  EXPECT_EQ(pic.from.col_off, 38100);
+  EXPECT_EQ(pic.from.row, 4U);
+  EXPECT_EQ(pic.from.row_off, 50800);
+  EXPECT_EQ(pic.to.col_off, 419100);
+  EXPECT_EQ(pic.to.row, 7U);
+  EXPECT_EQ(pic.to.row_off, 127000);
+  EXPECT_EQ(pic.cx, 381000);
+  EXPECT_EQ(pic.cy, 762000);
+  EXPECT_EQ(pic.image_rel_id, "rId2");
+  EXPECT_EQ(pic.media_path, "xl/media/image1.png");
+
+  const DrawingObject& shape = objects[1];
+  EXPECT_EQ(shape.kind, DrawingObjectKind::kShape);
+  EXPECT_EQ(shape.anchor_kind, AnchorKind::kOneCell);
+  EXPECT_EQ(shape.edit_as, EditAs::kOneCell);
+  EXPECT_EQ(shape.from.col, 3U);
+  EXPECT_EQ(shape.cx, 914400);
+  EXPECT_EQ(shape.cy, 457200);
+  EXPECT_TRUE(shape.media_path.empty());
+
+  const DrawingObject& chart = objects[2];
+  EXPECT_EQ(chart.kind, DrawingObjectKind::kChart);
+  EXPECT_EQ(chart.anchor_kind, AnchorKind::kAbsolute);
+  EXPECT_EQ(chart.edit_as, EditAs::kAbsolute);
+  EXPECT_EQ(chart.from.col_off, 100);
+  EXPECT_EQ(chart.from.row_off, 200);
+  EXPECT_EQ(chart.cx, 4572000);
+  EXPECT_EQ(chart.name, "Chart 3");
+
+  EXPECT_EQ(objects[3].kind, DrawingObjectKind::kGroup);
+  EXPECT_EQ(objects[3].edit_as, EditAs::kTwoCell);
+  EXPECT_EQ(objects[3].object_id, 7U);
+  EXPECT_EQ(objects[3].cx, 600);
+  EXPECT_EQ(objects[3].cy, 700);
+
+  EXPECT_EQ(objects[4].kind, DrawingObjectKind::kConnector);
+  EXPECT_EQ(objects[4].edit_as, EditAs::kAbsolute);
+
+  // The chartex frame is reported once, from its mc:Choice branch.
+  EXPECT_EQ(objects[5].kind, DrawingObjectKind::kChart);
+  EXPECT_EQ(objects[5].object_id, 9U);
+  EXPECT_EQ(objects[5].to.row, 12U);
+}
+
+TEST(DrawingXml, FallbackAnchorsAreIncludedOnlyOnRequest) {
+  pugi::xml_document doc;
+  ASSERT_TRUE(static_cast<bool>(parse_drawing_part(ToBytes(kDrawing), doc)));
+  EXPECT_EQ(drawing_anchors(doc.document_element(), false).size(), 6U);
+  EXPECT_EQ(drawing_anchors(doc.document_element(), true).size(), 7U);
+}
+
+TEST(DrawingXml, MatchesElementsByLocalName) {
+  const std::string xml =
+      "<wsDr xmlns=\"http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing\" "
+      "xmlns:d=\"http://schemas.openxmlformats.org/drawingml/2006/main\"><oneCellAnchor><from><col>2</col>"
+      "<colOff>5</colOff><row>3</row><rowOff>6</rowOff></from><ext cx=\"10\" cy=\"20\"/><pic><nvPicPr>"
+      "<cNvPr id=\"11\" name=\"P\"/></nvPicPr><blipFill><d:blip xmlns:rel=\"http://schemas.openxmlformats.org/"
+      "officeDocument/2006/relationships\" rel:embed=\"rId9\"/></blipFill></pic><clientData/></oneCellAnchor></wsDr>";
+  const std::vector<DrawingObject> objects = ReadObjects(xml, {{"rId9", "image", "xl/media/x.gif", false}});
+  ASSERT_EQ(objects.size(), 1U);
+  EXPECT_EQ(objects[0].kind, DrawingObjectKind::kPicture);
+  EXPECT_EQ(objects[0].object_id, 11U);
+  EXPECT_EQ(objects[0].from.row, 3U);
+  EXPECT_EQ(objects[0].from.col_off, 5);
+  EXPECT_EQ(objects[0].image_rel_id, "rId9");
+  EXPECT_EQ(objects[0].media_path, "xl/media/x.gif");
+}
+
+TEST(DrawingXml, UnparseablePartIsRefused) {
+  pugi::xml_document doc;
+  auto broken = parse_drawing_part(ToBytes("<xdr:wsDr><xdr:twoCellAnchor>"), doc);
+  ASSERT_FALSE(static_cast<bool>(broken));
+  EXPECT_EQ(broken.error().code, FormulonErrorCode::kIoDrawingUnparseable);
+  auto wrong_root = parse_drawing_part(ToBytes("<c:chartSpace xmlns:c=\"urn:x\"/>"), doc);
+  ASSERT_FALSE(static_cast<bool>(wrong_root));
+  EXPECT_EQ(wrong_root.error().code, FormulonErrorCode::kIoDrawingUnparseable);
+  auto bad_rels = parse_part_rels(ToBytes("<Relationships><Relationship"), "xl/drawings");
+  ASSERT_FALSE(static_cast<bool>(bad_rels));
+  EXPECT_EQ(bad_rels.error().code, FormulonErrorCode::kIoDrawingUnparseable);
+}
+
+TEST(DrawingXml, RelsResolveAgainstOwnerDirectory) {
+  auto rels = parse_part_rels(ToBytes(kRels), "xl/drawings");
+  ASSERT_TRUE(static_cast<bool>(rels));
+  ASSERT_EQ(rels.value().size(), 3U);
+  EXPECT_EQ(rels.value()[0].target, "xl/charts/chart1.xml");
+  EXPECT_FALSE(rels.value()[0].external);
+  EXPECT_EQ(rels.value()[2].target, "https://example.com/a");
+  EXPECT_TRUE(rels.value()[2].external);
+}
+
+TEST(DrawingXml, RelativeTargets) {
+  EXPECT_EQ(relative_target("xl/drawings", "xl/media/image1.png"), "../media/image1.png");
+  EXPECT_EQ(relative_target("xl/drawings", "xl/drawings/drawing2.xml"), "drawing2.xml");
+  EXPECT_EQ(relative_target("xl/worksheets", "xl/drawings/drawing1.xml"), "../drawings/drawing1.xml");
+}
+
+TEST(DrawingXml, AnchorPointWriteReadRoundTrip) {
+  pugi::xml_document doc;
+  ASSERT_TRUE(static_cast<bool>(parse_drawing_part(ToBytes(kDrawing), doc)));
+  const pugi::xml_node anchor = drawing_anchors(doc.document_element(), false)[0];
+  const AnchorPoint written{12U, 3U, 9000000000LL, 4};
+  write_anchor_point(child_local(anchor, "to"), written);
+  const AnchorPoint read = read_anchor_point(child_local(anchor, "to"));
+  EXPECT_EQ(read.row, 12U);
+  EXPECT_EQ(read.col, 3U);
+  EXPECT_EQ(read.row_off, 9000000000LL);
+  EXPECT_EQ(read.col_off, 4);
+}
+
+TEST(DrawingXml, WorkbookRoundTripKeepsDrawingBytes) {
+  Workbook wb = Workbook::create();
+  const Bytes png = {0x89, 'P', 'N', 'G', 0x0D, 0x0A, 0x1A, 0x0A, 0, 0, 0, 13,
+                     'I',  'H', 'D', 'R', 0,    0,    0,    40,   0, 0, 0, 80};
+  ASSERT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart(
+      "xl/drawings/drawing1.xml", "application/vnd.openxmlformats-officedocument.drawing+xml", ToBytes(kDrawing)))));
+  ASSERT_TRUE(static_cast<bool>(
+      wb.add_passthrough_part(PassthroughPart("xl/drawings/_rels/drawing1.xml.rels", "", ToBytes(kRels)))));
+  ASSERT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart("xl/media/image1.png", "", png))));
+  ASSERT_TRUE(static_cast<bool>(wb.add_passthrough_part(
+      PassthroughPart("xl/charts/chart1.xml", "application/vnd.openxmlformats-officedocument.drawingml.chart+xml",
+                      ToBytes("<c:chartSpace xmlns:c=\"http://schemas.openxmlformats.org/drawingml/2006/chart\"/>")))));
+  wb.set_default_content_types({{"png", "image/png"}});
+  wb.sheet(0).set_drawing_rel_target("xl/drawings/drawing1.xml");
+
+  auto bytes = io::write_ooxml(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes));
+  auto read = io::read_ooxml(io::ByteSpan{bytes.value().data(), bytes.value().size()});
+  ASSERT_TRUE(static_cast<bool>(read));
+  const Workbook& reloaded = read.value().workbook;
+  EXPECT_EQ(reloaded.sheet(0).drawing_rel_target(), "xl/drawings/drawing1.xml");
+  for (const char* path : {"xl/drawings/drawing1.xml", "xl/media/image1.png", "xl/charts/chart1.xml"}) {
+    const PassthroughPart* before = nullptr;
+    const PassthroughPart* after = nullptr;
+    for (const PassthroughPart& p : wb.passthrough_parts()) {
+      before = p.path == path ? &p : before;
+    }
+    for (const PassthroughPart& p : reloaded.passthrough_parts()) {
+      after = p.path == path ? &p : after;
+    }
+    ASSERT_NE(after, nullptr) << path;
+    EXPECT_EQ(after->bytes, before->bytes) << path;
+  }
+  auto listed = list_drawing_objects(reloaded, 0);
+  ASSERT_TRUE(static_cast<bool>(listed));
+  ASSERT_EQ(listed.value().size(), 6U);
+  EXPECT_EQ(listed.value()[0].media_path, "xl/media/image1.png");
+  EXPECT_EQ(listed.value()[0].image_format, ImageFormat::kPng);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/drawing/image_header_test.cpp b/tests/unit/drawing/image_header_test.cpp
new file mode 100644
index 000000000..3bd3f663d
--- /dev/null
+++ b/tests/unit/drawing/image_header_test.cpp
@@ -0,0 +1,137 @@
+#include "drawing/image_header.h"
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+
+namespace formulon {
+namespace {
+
+using Bytes = std::vector<std::uint8_t>;
+
+Bytes Png(std::uint32_t w, std::uint32_t h) {
+  Bytes b = {0x89, 'P', 'N', 'G', 0x0D, 0x0A, 0x1A, 0x0A, 0, 0, 0, 13, 'I', 'H', 'D', 'R'};
+  for (std::uint32_t v : {w, h}) {
+    b.push_back(static_cast<std::uint8_t>(v >> 24));
+    b.push_back(static_cast<std::uint8_t>(v >> 16));
+    b.push_back(static_cast<std::uint8_t>(v >> 8));
+    b.push_back(static_cast<std::uint8_t>(v));
+  }
+  b.insert(b.end(), {8, 6, 0, 0, 0, 0, 0, 0, 0});
+  return b;
+}
+
+ImageInfo Probe(const Bytes& b) {
+  auto info = probe_image(b.data(), b.size());
+  EXPECT_TRUE(static_cast<bool>(info));
+  return info ? info.value() : ImageInfo{};
+}
+
+FormulonErrorCode ProbeError(const Bytes& b) {
+  auto info = probe_image(b.data(), b.size());
+  EXPECT_FALSE(static_cast<bool>(info));
+  return info ? FormulonErrorCode::kOk : info.error().code;
+}
+
+TEST(ImageHeader, PngReadsIhdr) {
+  const ImageInfo info = Probe(Png(640, 480));
+  EXPECT_EQ(info.format, ImageFormat::kPng);
+  EXPECT_EQ(info.px_width, 640U);
+  EXPECT_EQ(info.px_height, 480U);
+}
+
+TEST(ImageHeader, JpegReadsBaselineFrameAfterApp0) {
+  // SOI, APP0 (JFIF, length 16), SOF0: precision 8, height 0x01E0, width 0x0280.
+  Bytes b = {0xFF, 0xD8, 0xFF, 0xE0, 0x00, 0x10, 'J',  'F',  'I',  'F',  0,    1,    1,    0,    0,
+             1,    0,    1,    0,    0,    0xFF, 0xC0, 0x00, 0x11, 0x08, 0x01, 0xE0, 0x02, 0x80, 0x03};
+  const ImageInfo info = Probe(b);
+  EXPECT_EQ(info.format, ImageFormat::kJpeg);
+  EXPECT_EQ(info.px_width, 640U);
+  EXPECT_EQ(info.px_height, 480U);
+}
+
+TEST(ImageHeader, JpegSkipsHuffmanTableAndFillBytes) {
+  // A DHT segment (0xC4 is not a frame header) and a fill byte precede SOF2.
+  Bytes b = {0xFF, 0xD8, 0xFF, 0xC4, 0x00, 0x04, 0x00, 0x00, 0xFF,
+             0xFF, 0xC2, 0x00, 0x11, 0x08, 0x00, 0x20, 0x00, 0x10};
+  const ImageInfo info = Probe(b);
+  EXPECT_EQ(info.format, ImageFormat::kJpeg);
+  EXPECT_EQ(info.px_width, 16U);
+  EXPECT_EQ(info.px_height, 32U);
+}
+
+TEST(ImageHeader, GifReadsScreenDescriptor) {
+  Bytes b = {'G', 'I', 'F', '8', '9', 'a', 0x2C, 0x01, 0x64, 0x00, 0x00, 0x00, 0x00};
+  const ImageInfo info = Probe(b);
+  EXPECT_EQ(info.format, ImageFormat::kGif);
+  EXPECT_EQ(info.px_width, 300U);
+  EXPECT_EQ(info.px_height, 100U);
+}
+
+TEST(ImageHeader, BmpInfoHeaderTopDown) {
+  Bytes b(54, 0);
+  b[0] = 'B';
+  b[1] = 'M';
+  b[14] = 40;    // BITMAPINFOHEADER
+  b[18] = 0x20;  // width 32
+  // height -16 (top-down), little endian
+  b[22] = 0xF0;
+  b[23] = 0xFF;
+  b[24] = 0xFF;
+  b[25] = 0xFF;
+  const ImageInfo info = Probe(b);
+  EXPECT_EQ(info.format, ImageFormat::kBmp);
+  EXPECT_EQ(info.px_width, 32U);
+  EXPECT_EQ(info.px_height, 16U);
+}
+
+TEST(ImageHeader, BmpCoreHeader) {
+  Bytes b(26, 0);
+  b[0] = 'B';
+  b[1] = 'M';
+  b[14] = 12;  // BITMAPCOREHEADER
+  b[18] = 0x05;
+  b[20] = 0x07;
+  const ImageInfo info = Probe(b);
+  EXPECT_EQ(info.format, ImageFormat::kBmp);
+  EXPECT_EQ(info.px_width, 5U);
+  EXPECT_EQ(info.px_height, 7U);
+}
+
+TEST(ImageHeader, TruncatedHeadersAreUnsupported) {
+  Bytes png = Png(1, 1);
+  png.resize(20);
+  EXPECT_EQ(ProbeError(png), FormulonErrorCode::kIoImageUnsupported);
+  EXPECT_EQ(ProbeError({0xFF, 0xD8, 0xFF, 0xC0, 0x00, 0x11, 0x08}), FormulonErrorCode::kIoImageUnsupported);
+  EXPECT_EQ(ProbeError({'G', 'I', 'F', '8', '9', 'a', 1}), FormulonErrorCode::kIoImageUnsupported);
+  EXPECT_EQ(ProbeError({'B', 'M', 0, 0}), FormulonErrorCode::kIoImageUnsupported);
+}
+
+TEST(ImageHeader, JpegWithoutFrameHeaderIsUnsupported) {
+  // End of image, then start of scan, before any frame header.
+  EXPECT_EQ(ProbeError({0xFF, 0xD8, 0xFF, 0xD9}), FormulonErrorCode::kIoImageUnsupported);
+  EXPECT_EQ(ProbeError({0xFF, 0xD8, 0xFF, 0xDA, 0x00, 0x08, 0, 0, 0, 0, 0, 0}), FormulonErrorCode::kIoImageUnsupported);
+}
+
+TEST(ImageHeader, UnknownBytesAreUnsupported) {
+  EXPECT_EQ(ProbeError({'h', 'e', 'l', 'l', 'o'}), FormulonErrorCode::kIoImageUnsupported);
+  EXPECT_EQ(ProbeError({}), FormulonErrorCode::kIoImageUnsupported);
+  EXPECT_FALSE(static_cast<bool>(probe_image(nullptr, 0)));
+}
+
+TEST(ImageHeader, ZeroDimensionIsUnsupported) {
+  EXPECT_EQ(ProbeError(Png(0, 10)), FormulonErrorCode::kIoImageUnsupported);
+}
+
+TEST(ImageHeader, ExtensionsAndContentTypes) {
+  EXPECT_STREQ(image_extension(ImageFormat::kPng), "png");
+  EXPECT_STREQ(image_extension(ImageFormat::kJpeg), "jpeg");
+  EXPECT_STREQ(image_content_type(ImageFormat::kJpeg), "image/jpeg");
+  EXPECT_STREQ(image_content_type(ImageFormat::kGif), "image/gif");
+  EXPECT_STREQ(image_extension(ImageFormat::kUnknown), "");
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/eval/builtin_names_test.cpp b/tests/unit/eval/builtin_names_test.cpp
index fbc3d6def..08f6a1173 100644
--- a/tests/unit/eval/builtin_names_test.cpp
+++ b/tests/unit/eval/builtin_names_test.cpp
@@ -67,6 +67,23 @@ TEST(BuiltinNames, AcceptedQualifiedFormsAreNotFlagged) {
   }
 }
 
+TEST(BuiltinNames, FormulaEntryGateRejectsQualifiedBuiltinsOnly) {
+  for (const char* src : {"Sheet1!SUM(1)", "[0]!LET(a,1,a)", "SUM(Sheet1!SUM(1))"}) {
+    Arena arena;
+    std::string storage = parser::strip_storage_prefixes(src);
+    EXPECT_EQ(parse_formula_entry(storage, arena), nullptr) << src;
+  }
+
+  for (const char* src : {"Sheet1!MyFn(1)", "Sheet1!NOSUCH(1)", "SUM(1)", "A1+1"}) {
+    Arena arena;
+    std::string storage = parser::strip_storage_prefixes(src);
+    EXPECT_NE(parse_formula_entry(storage, arena), nullptr) << src;
+  }
+
+  Arena malformed_arena;
+  EXPECT_EQ(parse_formula_entry("SUM(", malformed_arena), nullptr);
+}
+
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins/dynamic_array_test.cpp b/tests/unit/eval/builtins/dynamic_array_test.cpp
index 6cf4b7b9a..4f9ca82ed 100644
--- a/tests/unit/eval/builtins/dynamic_array_test.cpp
+++ b/tests/unit/eval/builtins/dynamic_array_test.cpp
@@ -11,10 +11,12 @@
 //      dispatch, spill-aware reads, OOXML anchor / phantom suppression);
 //      SEQUENCE is the first acceptance test for that machinery.
 
+#include <array>
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
 #include <string_view>
+#include <utility>
 
 #include "cell.h"
 #include "eval/eval_context.h"
@@ -699,6 +701,88 @@ TEST(BuiltinsRandarray, MinEqualsMaxIsDeterministic) {
   }
 }
 
+TEST(BuiltinsRandarray, HugeIntegralSingletonsArePreserved) {
+  // Bounds outside int64_t still represent exact integral doubles. A
+  // singleton must be returned unchanged instead of being cast through the
+  // signed integer distribution's implementation-defined domain.
+  for (const auto& sample : {std::pair<double, double>(1e20, 1e20), std::pair<double, double>(-1e20, -1e20)}) {
+    Arena arena;
+    const Value v = CallRandArray(arena, {Value::number(1), Value::number(1), Value::number(sample.first),
+                                          Value::number(sample.second), Value::boolean(true)});
+    ASSERT_TRUE(v.is_array());
+    ASSERT_TRUE(v.as_array_cells()[0].is_number());
+    EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), sample.first);
+  }
+}
+
+TEST(BuiltinsRandarray, Int64BoundaryInputsStayFiniteAndIntegral) {
+  // -2^63 is representable in int64_t; the nearest representable double below
+  // +2^63 is also safe. The exact +2^63 endpoint and a value below -2^63 are
+  // intentionally unsafe integer-distribution inputs and must still remain
+  // valid double-valued results.
+  const double safe_lower = -9223372036854775808.0;
+  const double safe_upper = 9223372036854774784.0;
+  const double unsafe_lower = -9223372036854777856.0;
+  const double unsafe_upper = 9223372036854777856.0;
+  const std::array<std::pair<double, double>, 4> bounds = {{
+      {safe_lower, safe_lower},
+      {safe_upper, safe_upper},
+      {unsafe_lower, unsafe_lower},
+      {unsafe_upper, unsafe_upper},
+  }};
+  for (const auto& sample : bounds) {
+    Arena arena;
+    const Value v = CallRandArray(arena, {Value::number(1), Value::number(1), Value::number(sample.first),
+                                          Value::number(sample.second), Value::boolean(true)});
+    ASSERT_TRUE(v.is_array());
+    ASSERT_TRUE(v.as_array_cells()[0].is_number());
+    const double x = v.as_array_cells()[0].as_number();
+    EXPECT_TRUE(std::isfinite(x));
+    EXPECT_DOUBLE_EQ(x, sample.first);
+    EXPECT_EQ(std::trunc(x), x);
+  }
+}
+
+TEST(BuiltinsRandarray, HugeIntegralRangesStayInRange) {
+  const std::array<std::pair<double, double>, 3> ranges = {{
+      {1e20, 1e21},
+      {-1e21, -1e20},
+      {-1e20, 1e20},
+  }};
+  for (const auto& sample : ranges) {
+    Arena arena;
+    const Value v = CallRandArray(arena, {Value::number(200), Value::number(1), Value::number(sample.first),
+                                          Value::number(sample.second), Value::boolean(true)});
+    ASSERT_TRUE(v.is_array());
+    const Value* cells = v.as_array_cells();
+    for (std::size_t i = 0; i < 200U; ++i) {
+      ASSERT_TRUE(cells[i].is_number()) << "iter=" << i;
+      const double x = cells[i].as_number();
+      EXPECT_TRUE(std::isfinite(x)) << "iter=" << i;
+      EXPECT_GE(x, sample.first) << "iter=" << i;
+      EXPECT_LE(x, sample.second) << "iter=" << i;
+      EXPECT_EQ(std::trunc(x), x) << "iter=" << i;
+    }
+  }
+}
+
+TEST(BuiltinsRandarray, HugeRealRangeStaysFiniteAndHalfOpen) {
+  constexpr double kMin = -1e308;
+  constexpr double kMax = 1e308;
+  Arena arena;
+  const Value v =
+      CallRandArray(arena, {Value::number(200), Value::number(1), Value::number(kMin), Value::number(kMax)});
+  ASSERT_TRUE(v.is_array());
+  const Value* cells = v.as_array_cells();
+  for (std::size_t i = 0; i < 200U; ++i) {
+    ASSERT_TRUE(cells[i].is_number()) << "iter=" << i;
+    const double x = cells[i].as_number();
+    EXPECT_TRUE(std::isfinite(x)) << "iter=" << i;
+    EXPECT_GE(x, kMin) << "iter=" << i;
+    EXPECT_LT(x, kMax) << "iter=" << i;
+  }
+}
+
 TEST(BuiltinsRandarray, MinGreaterThanMaxReturnsValue) {
   Arena arena;
   const Value v = CallRandArray(arena, {Value::number(1), Value::number(1), Value::number(5), Value::number(2)});
diff --git a/tests/unit/eval/builtins_aggregate_fn_test.cpp b/tests/unit/eval/builtins_aggregate_fn_test.cpp
index 6ef1dd237..f756478f0 100644
--- a/tests/unit/eval/builtins_aggregate_fn_test.cpp
+++ b/tests/unit/eval/builtins_aggregate_fn_test.cpp
@@ -27,6 +27,7 @@
 #include "eval/eval_context.h"
 #include "eval/eval_state.h"
 #include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
 #include "eval/tree_walker.h"
 #include "gtest/gtest.h"
 #include "parser/ast.h"
@@ -161,6 +162,21 @@ TEST(BuiltinsAggregateFn, Code11IsVarPopulation) {
   EXPECT_DOUBLE_EQ(v.as_number(), 2.0);
 }
 
+TEST(BuiltinsAggregateFn, ExtremeMomentOverflowIsNumError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0e308));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(1.0e308));
+
+  for (const char* formula :
+       {"=AGGREGATE(1,0,A1:A2)", "=AGGREGATE(7,0,A1:A2)", "=AGGREGATE(8,0,A1:A2)", "=AGGREGATE(10,0,A1:A2)",
+        "=AGGREGATE(11,0,A1:A2)", "=SUBTOTAL(1,A1:A2)", "=SUBTOTAL(7,A1:A2)", "=SUBTOTAL(8,A1:A2)",
+        "=SUBTOTAL(10,A1:A2)", "=SUBTOTAL(11,A1:A2)"}) {
+    const Value result = EvalSourceIn(formula, wb, wb.sheet(0));
+    ASSERT_TRUE(result.is_error()) << formula << ": " << result.debug_to_string();
+    EXPECT_EQ(result.as_error(), ErrorCode::Num) << formula;
+  }
+}
+
 TEST(BuiltinsAggregateFn, Code12IsMedian) {
   Workbook wb = MakeOneToFive();
   const Value v = EvalSourceIn("=AGGREGATE(12,0,A1:A5)", wb, wb.sheet(0));
@@ -603,6 +619,82 @@ TEST(BuiltinsAggregateFn, MissingDataRangeRejected) {
   ASSERT_TRUE(v.is_error());
 }
 
+// ---------------------------------------------------------------------------
+// Nested SUBTOTAL / AGGREGATE bit (options 0..3 exclude, 4..7 keep)
+// ---------------------------------------------------------------------------
+
+TEST(AggregateNested, Options4To7KeepNested) {
+  // A1 = 1000 and A2 = 2000 are plain; A3:A11 hold 1, 2, 4, ..., 256. A3, A4,
+  // A6, A7, A10 and A11 contain a SUBTOTAL / AGGREGATE call; A5 goes through
+  // a defined name, A8 only points at a subtotal cell and A9 has the text in
+  // a string literal, so those three stay in even for options 0..3.
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  const auto set_formula = [&wb](std::uint32_t row, std::uint32_t col, const char* text) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, row, col, text))) << text;
+  };
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("NmSub", "SUBTOTAL(9,$Z$3)")));
+  sheet.set_cell_value(0, 0, Value::number(1000.0));
+  sheet.set_cell_value(1, 0, Value::number(2000.0));
+  sheet.set_cell_value(0, 25, Value::number(1.0));    // Z1
+  sheet.set_cell_value(1, 25, Value::number(2.0));    // Z2
+  sheet.set_cell_value(2, 25, Value::number(4.0));    // Z3
+  sheet.set_cell_value(3, 25, Value::number(8.0));    // Z4
+  sheet.set_cell_value(4, 25, Value::number(16.0));   // Z5
+  sheet.set_cell_value(7, 25, Value::number(128.0));  // Z8
+  sheet.set_cell_value(8, 25, Value::number(256.0));  // Z9
+  set_formula(2U, 0U, "=SUBTOTAL(9,Z1)");
+  set_formula(3U, 0U, "=0+SUBTOTAL(9,Z2)");
+  set_formula(4U, 0U, "=NmSub");
+  set_formula(5U, 0U, "=LET(x,SUBTOTAL(9,Z4),x)");
+  set_formula(6U, 0U, "=AGGREGATE(9,0,Z5)");
+  set_formula(7U, 0U, "=A3*32");
+  set_formula(8U, 0U, "=IF(1,64,\"SUBTOTAL(9)\")");
+  set_formula(9U, 0U, "=IF(TRUE,SUBTOTAL(9,Z8),0)");
+  set_formula(10U, 0U, "=IF(1,256,AGGREGATE(9,0,Z9))");
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+
+  struct Case {
+    const char* source;
+    double expected;
+  };
+  static constexpr Case kCases[] = {
+      {"=SUBTOTAL(9,A1:A11)", 3100.0},    {"=SUBTOTAL(109,A1:A11)", 3100.0},   {"=SUBTOTAL(1,A1:A11)", 620.0},
+      {"=SUBTOTAL(101,A1:A11)", 620.0},   {"=SUBTOTAL(2,A1:A11)", 5.0},        {"=SUBTOTAL(3,A1:A11)", 5.0},
+      {"=AGGREGATE(9,0,A1:A11)", 3100.0}, {"=AGGREGATE(9,1,A1:A11)", 3100.0},  {"=AGGREGATE(9,2,A1:A11)", 3100.0},
+      {"=AGGREGATE(9,3,A1:A11)", 3100.0}, {"=AGGREGATE(9,4,A1:A11)", 3511.0},  {"=AGGREGATE(9,5,A1:A11)", 3511.0},
+      {"=AGGREGATE(9,6,A1:A11)", 3511.0}, {"=AGGREGATE(9,7,A1:A11)", 3511.0},  {"=AGGREGATE(1,0,A1:A11)", 620.0},
+      {"=AGGREGATE(1,3,A1:A11)", 620.0},  {"=AGGREGATE(4,0,A1:A11)", 2000.0},  {"=AGGREGATE(4,7,A1:A11)", 2000.0},
+      {"=AGGREGATE(15,0,A1:A11,1)", 4.0}, {"=AGGREGATE(15,3,A1:A11,2)", 32.0}, {"=AGGREGATE(15,4,A1:A11,1)", 1.0},
+      {"=AGGREGATE(15,7,A1:A11,2)", 2.0},
+  };
+  for (const Case& c : kCases) {
+    const Value v = EvalSourceIn(c.source, wb, wb.sheet(0));
+    ASSERT_TRUE(v.is_number()) << c.source;
+    EXPECT_DOUBLE_EQ(v.as_number(), c.expected) << c.source;
+  }
+  for (const char* source :
+       {"=AGGREGATE(1,4,A1:A11)", "=AGGREGATE(1,5,A1:A11)", "=AGGREGATE(1,6,A1:A11)", "=AGGREGATE(1,7,A1:A11)"}) {
+    const Value v = EvalSourceIn(source, wb, wb.sheet(0));
+    ASSERT_TRUE(v.is_number()) << source;
+    EXPECT_NEAR(v.as_number(), 319.181818, 1e-6) << source;
+  }
+}
+
+TEST(AggregateNested, SubtotalCellsExcludedFromAggregateAndBack) {
+  // A subtotal row inside an AGGREGATE range, and an AGGREGATE row inside a
+  // SUBTOTAL range, are both excluded; the "ignore none" options keep them.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(100.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(200.0));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 2U, 0U, "=SUBTOTAL(9,A1:A2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 3U, 0U, "=AGGREGATE(9,0,A1:A2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  EXPECT_DOUBLE_EQ(EvalSourceIn("=AGGREGATE(9,0,A1:A4)", wb, wb.sheet(0)).as_number(), 300.0);
+  EXPECT_DOUBLE_EQ(EvalSourceIn("=AGGREGATE(9,4,A1:A4)", wb, wb.sheet(0)).as_number(), 900.0);
+  EXPECT_DOUBLE_EQ(EvalSourceIn("=SUBTOTAL(9,A1:A4)", wb, wb.sheet(0)).as_number(), 300.0);
+}
+
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins_datetime_1904_test.cpp b/tests/unit/eval/builtins_datetime_1904_test.cpp
new file mode 100644
index 000000000..7547b3d69
--- /dev/null
+++ b/tests/unit/eval/builtins_datetime_1904_test.cpp
@@ -0,0 +1,582 @@
+// End-to-end date/time built-in tests: 1904 epoch and raw text behavior.
+
+#include <cmath>
+#include <string>
+
+#include "builtins_datetime_test_helpers.h"
+namespace formulon {
+namespace eval {
+namespace {
+
+// ---------------------------------------------------------------------------
+// 1904 date system. The 1904 epoch is 1462 days after the 1900 epoch, so a
+// given calendar date has a serial 1462 smaller. The calendar family reads
+// the epoch from `EvalContext::date1904()`.
+// ---------------------------------------------------------------------------
+
+TEST(DateTime1904, DateSerialIs1462Less) {
+  // DATE(2020,1,1) is serial 43831 under the 1900 system, 42369 under 1904.
+  const Value v1900 = EvalSource("=DATE(2020,1,1)");
+  ASSERT_TRUE(v1900.is_number());
+  EXPECT_DOUBLE_EQ(v1900.as_number(), 43831.0);
+  const Value v1904 = EvalSource1904("=DATE(2020,1,1)");
+  ASSERT_TRUE(v1904.is_number());
+  EXPECT_DOUBLE_EQ(v1904.as_number(), 42369.0);
+}
+
+TEST(DateTime1904, TextRendersDateTextInTheWorkbookEpoch) {
+  // TEXT coerces its first argument through the shared numeric ladder, whose
+  // date fallback always produces a 1900-system serial. Rendering it with
+  // 1904 format codes must therefore round-trip to the same calendar day
+  // under both epochs, not shift by the 1462-day gap.
+  const Value v1900 = EvalSource("=TEXT(\"2024-03-15\", \"yyyy/m/d\")");
+  ASSERT_TRUE(v1900.is_text());
+  EXPECT_EQ(v1900.as_text(), "2024/3/15");
+
+  const Value v1904 = EvalSource1904("=TEXT(\"2024-03-15\", \"yyyy/m/d\")");
+  ASSERT_TRUE(v1904.is_text());
+  EXPECT_EQ(v1904.as_text(), "2024/3/15");
+}
+
+TEST(DateTime1904, TextShiftsOnlyDateDerivedSerials) {
+  // The epoch shift is keyed on the coercion ladder's date rung, not on the
+  // format codes. A value that already is a serial — whether it arrives as a
+  // number or as numeric text — is read in the workbook's own epoch and must
+  // not be moved again.
+  const std::string number_1900 = std::string(EvalSource("=TEXT(45366,\"yyyy/m/d\")").as_text());
+  EXPECT_EQ(number_1900, "2024/3/15");
+
+  const std::string number_1904 = std::string(EvalSource1904("=TEXT(45366,\"yyyy/m/d\")").as_text());
+  EXPECT_EQ(number_1904, "2028/3/16") << "a bare serial follows the workbook epoch";
+
+  const std::string numeric_text_1904 = std::string(EvalSource1904("=TEXT(\"45366\",\"yyyy/m/d\")").as_text());
+  EXPECT_EQ(numeric_text_1904, number_1904) << "numeric text must not pick up the date rung's epoch shift";
+
+  // A non-date rung of the ladder renders identically under both epochs.
+  const std::string percent_1900 = std::string(EvalSource("=TEXT(\"50%\",\"0.00\")").as_text());
+  const std::string percent_1904 = std::string(EvalSource1904("=TEXT(\"50%\",\"0.00\")").as_text());
+  EXPECT_EQ(percent_1900, "0.50");
+  EXPECT_EQ(percent_1904, percent_1900);
+
+  // Time-only text is a day fraction: the same number, and the same
+  // rendering, under either epoch.
+  const std::string time_1900 = std::string(EvalSource("=TEXT(\"13:30\",\"h:mm\")").as_text());
+  const std::string time_1904 = std::string(EvalSource1904("=TEXT(\"13:30\",\"h:mm\")").as_text());
+  EXPECT_EQ(time_1900, "13:30");
+  EXPECT_EQ(time_1904, time_1900);
+}
+
+TEST(DateTime1904, SerialZeroExtractorsFollowTheWorkbookEpoch) {
+  // Serial 0 is the fictitious "1900-01-00" origin under the 1900 system and
+  // a real 1904-01-01 under the 1904 one, so the day component differs while
+  // the month does not. Two branches of `coerce_serial_ymd` meet here: the
+  // explicit day-0 alias, which only applies under the 1900 epoch, and the
+  // epoch shift that rebases a 1904 serial before decoding. Expected values
+  // come from the `datetime` / `datetime_1904_text` oracle suites, not from
+  // this implementation.
+  const Value year_1900 = EvalSource("=YEAR(0)");
+  const Value month_1900 = EvalSource("=MONTH(0)");
+  const Value day_1900 = EvalSource("=DAY(0)");
+  ASSERT_TRUE(year_1900.is_number());
+  ASSERT_TRUE(month_1900.is_number());
+  ASSERT_TRUE(day_1900.is_number());
+  EXPECT_DOUBLE_EQ(year_1900.as_number(), 1900.0);
+  EXPECT_DOUBLE_EQ(month_1900.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(day_1900.as_number(), 0.0);
+
+  const Value year_1904 = EvalSource1904("=YEAR(0)");
+  const Value month_1904 = EvalSource1904("=MONTH(0)");
+  const Value day_1904 = EvalSource1904("=DAY(0)");
+  ASSERT_TRUE(year_1904.is_number());
+  ASSERT_TRUE(month_1904.is_number());
+  ASSERT_TRUE(day_1904.is_number());
+  EXPECT_DOUBLE_EQ(year_1904.as_number(), 1904.0);
+  EXPECT_DOUBLE_EQ(month_1904.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(day_1904.as_number(), 1.0);
+}
+
+TEST(DateTime1904, UpperEndpointIsEpochSpecific) {
+  const Value endpoint = EvalSource1904("=DATE(9999, 12, 31)");
+  ASSERT_TRUE(endpoint.is_number());
+  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
+
+  const Value normalised = EvalSource1904("=DATE(9999, 11, 61)");
+  ASSERT_TRUE(normalised.is_number());
+  EXPECT_DOUBLE_EQ(normalised.as_number(), 2957003.0);
+}
+
+TEST(DateTime1904, DateOverflowPastUpperEndpointIsNum) {
+  const Value v = EvalSource1904("=DATE(9999, 12, 32)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, EdateUpperEndpointAndOverflow) {
+  const Value endpoint = EvalSource1904("=EDATE(DATE(9999, 12, 31), 0)");
+  ASSERT_TRUE(endpoint.is_number());
+  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
+
+  const Value overflow = EvalSource1904("=EDATE(DATE(9999, 12, 1), 1)");
+  ASSERT_TRUE(overflow.is_error());
+  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, EdateInputOnePastUpperEndpointIsNum) {
+  const Value v = EvalSource1904("=EDATE(DATE(9999, 12, 31) + 1, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, ExtractorRejectsOnePastEpochSpecificUpperEndpoint) {
+  const Value v = EvalSource1904("=YEAR(DATE(9999, 12, 31) + 1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, AcceptsFinalDayTimeFraction) {
+  const Value year = EvalSource1904("=YEAR(2957003.999988426)");
+  const Value month = EvalSource1904("=MONTH(2957003.999988426)");
+  const Value day = EvalSource1904("=DAY(2957003.999988426)");
+  ASSERT_TRUE(year.is_number());
+  ASSERT_TRUE(month.is_number());
+  ASSERT_TRUE(day.is_number());
+  EXPECT_DOUBLE_EQ(year.as_number(), 9999.0);
+  EXPECT_DOUBLE_EQ(month.as_number(), 12.0);
+  EXPECT_DOUBLE_EQ(day.as_number(), 31.0);
+}
+
+TEST(DateTime1904, RejectsExactNextDay) {
+  const Value year = EvalSource1904("=YEAR(2957004)");
+  const Value month = EvalSource1904("=MONTH(2957004)");
+  const Value day = EvalSource1904("=DAY(2957004)");
+  ASSERT_TRUE(year.is_error());
+  ASSERT_TRUE(month.is_error());
+  ASSERT_TRUE(day.is_error());
+  EXPECT_EQ(year.as_error(), ErrorCode::Num);
+  EXPECT_EQ(month.as_error(), ErrorCode::Num);
+  EXPECT_EQ(day.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, EdateGiganticMonthOffsetIsNum) {
+  const Value v = EvalSource1904("=EDATE(DATE(2024, 1, 1), 1E20)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, EdateLeftmostErrorPrecedesGiganticMonthOffset) {
+  const Value v = EvalSource1904("=EDATE(1/0, 1E20)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
+}
+
+TEST(DateTime1904, EdateLowerBoundaryWithZeroMonths) {
+  const Value v = EvalSource1904("=EDATE(DATE(1904, 1, 1), 0)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(DateTime1904, EomonthUpperEndpointAndOverflow) {
+  const Value endpoint = EvalSource1904("=EOMONTH(DATE(9999, 12, 1), 0)");
+  ASSERT_TRUE(endpoint.is_number());
+  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
+
+  const Value overflow = EvalSource1904("=EOMONTH(DATE(9999, 12, 1), 1)");
+  ASSERT_TRUE(overflow.is_error());
+  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, EdateAcceptsFinalDayTimeFraction) {
+  const Value endpoint = EvalSource1904("=EDATE(2957003.999988426, 0)");
+  ASSERT_TRUE(endpoint.is_number());
+  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
+}
+
+TEST(DateTime1904, EdateFinalDayTimeFractionCannotCrossUpperEndpoint) {
+  const Value overflow = EvalSource1904("=EDATE(2957003.999988426, 1)");
+  ASSERT_TRUE(overflow.is_error());
+  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, EomonthAcceptsFinalDayTimeFraction) {
+  const Value endpoint = EvalSource1904("=EOMONTH(2957003.999988426, 0)");
+  ASSERT_TRUE(endpoint.is_number());
+  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
+}
+
+TEST(DateTime1904, EomonthFinalDayTimeFractionCannotCrossUpperEndpoint) {
+  const Value overflow = EvalSource1904("=EOMONTH(2957003.999988426, 1)");
+  ASSERT_TRUE(overflow.is_error());
+  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, EomonthGiganticMonthOffsetIsNum) {
+  const Value v = EvalSource1904("=EOMONTH(DATE(2024, 1, 1), 1E20)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, EomonthBooleanPrecedenceBeatsGiganticMonthOffset) {
+  const Value v = EvalSource1904("=EOMONTH(TRUE, 1E20)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(DateTime1904, EomonthLowerBoundaryControl) {
+  const Value v = EvalSource1904("=EOMONTH(DATE(1904, 1, 1), 0)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
+}
+
+TEST(DateTime1904, YearMonthDayInvertUnder1904) {
+  // Serial 42369 is 2020-01-01 in the 1904 system.
+  const Value y = EvalSource1904("=YEAR(42369)");
+  ASSERT_TRUE(y.is_number());
+  EXPECT_DOUBLE_EQ(y.as_number(), 2020.0);
+  const Value m = EvalSource1904("=MONTH(42369)");
+  ASSERT_TRUE(m.is_number());
+  EXPECT_DOUBLE_EQ(m.as_number(), 1.0);
+  const Value d = EvalSource1904("=DAY(42369)");
+  ASSERT_TRUE(d.is_number());
+  EXPECT_DOUBLE_EQ(d.as_number(), 1.0);
+}
+
+TEST(DateTime1904, EdateShiftsWithin1904Epoch) {
+  // EDATE(2020-01-01, 1) -> 2020-02-01; serial 42400 in the 1904 system
+  // (43862 - 1462).
+  const Value v = EvalSource1904("=EDATE(42369,1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 42400.0);
+}
+
+TEST(DateTime1904, DateValueUsesWorkbookEpoch) {
+  const Value v = EvalSource1904("=DATEVALUE(\"2020-01-01\")");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 42369.0);
+}
+
+TEST(DateTime1904, WeekdayMatchesCalendarDateUnder1904) {
+  // 2020-01-01 is a Wednesday -> WEEKDAY type 1 (Sun=1) returns 4.
+  const Value v = EvalSource1904("=WEEKDAY(42369)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 4.0);
+}
+
+TEST(DateTime1904, NetworkdaysCountsTheSameCalendarSpanUnderBothEpochs) {
+  // 2024-01-01 (Mon) .. 2024-01-12 (Fri) is 10 business days regardless of
+  // the workbook epoch. The 1900/1904 offset of 1462 days is not a multiple
+  // of 7, so reading a 1904 serial as a 1900 one moves every weekend by two
+  // days and the span answers 9 instead.
+  const Value v1900 = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,12))");
+  ASSERT_TRUE(v1900.is_number());
+  EXPECT_DOUBLE_EQ(v1900.as_number(), 10.0);
+
+  const Value v1904 = EvalSource1904("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,12))");
+  ASSERT_TRUE(v1904.is_number());
+  EXPECT_DOUBLE_EQ(v1904.as_number(), 10.0);
+}
+
+TEST(DateTime1904, NetworkdaysIntlWeekendMaskFollowsTheWorkbookEpoch) {
+  // Weekend selector 11 is "Sunday only", so 2024-01-01 .. 2024-01-13
+  // (Mon .. Sat) drops just 2024-01-07 and leaves 12 working days. Under an
+  // epoch-blind weekday test the mask lands on the Saturdays instead and the
+  // span answers 11.
+  const Value v1900 = EvalSource("=NETWORKDAYS.INTL(DATE(2024,1,1),DATE(2024,1,13),11)");
+  ASSERT_TRUE(v1900.is_number());
+  EXPECT_DOUBLE_EQ(v1900.as_number(), 12.0);
+
+  const Value v1904 = EvalSource1904("=NETWORKDAYS.INTL(DATE(2024,1,1),DATE(2024,1,13),11)");
+  ASSERT_TRUE(v1904.is_number());
+  EXPECT_DOUBLE_EQ(v1904.as_number(), 12.0);
+}
+
+TEST(DateTime1904, WorkdayLandsOnTheSameCalendarDateUnderBothEpochs) {
+  // One working day after 2024-01-05 (Fri) is 2024-01-08 (Mon): the weekend
+  // in between must be recognised in the workbook's own epoch.
+  const Value v1900 = EvalSource("=WORKDAY(DATE(2024,1,5),1)");
+  ASSERT_TRUE(v1900.is_number());
+  const Value expected_1900 = EvalSource("=DATE(2024,1,8)");
+  ASSERT_TRUE(expected_1900.is_number());
+  EXPECT_DOUBLE_EQ(v1900.as_number(), expected_1900.as_number());
+
+  const Value v1904 = EvalSource1904("=WORKDAY(DATE(2024,1,5),1)");
+  ASSERT_TRUE(v1904.is_number());
+  EXPECT_DOUBLE_EQ(v1904.as_number(), v1900.as_number() - 1462.0);
+}
+
+TEST(DateTime1904, WorkdayIntlWeekendMaskFollowsTheWorkbookEpoch) {
+  // Weekend selector 11 is "Sunday only", so the day after 2024-01-05 (Fri)
+  // is the working Saturday 2024-01-06.
+  const Value v1900 = EvalSource("=WORKDAY.INTL(DATE(2024,1,5),1,11)");
+  ASSERT_TRUE(v1900.is_number());
+  const Value expected_1900 = EvalSource("=DATE(2024,1,6)");
+  ASSERT_TRUE(expected_1900.is_number());
+  EXPECT_DOUBLE_EQ(v1900.as_number(), expected_1900.as_number());
+
+  const Value v1904 = EvalSource1904("=WORKDAY.INTL(DATE(2024,1,5),1,11)");
+  ASSERT_TRUE(v1904.is_number());
+  EXPECT_DOUBLE_EQ(v1904.as_number(), v1900.as_number() - 1462.0);
+}
+
+TEST(DateTime1904, WorkdayHolidaysAreReadInTheWorkbookEpoch) {
+  // 2024-01-08 (Mon) as a holiday pushes the result to 2024-01-09, and the
+  // holiday serial itself is expressed in the workbook's epoch.
+  const Value v1900 = EvalSource("=WORKDAY(DATE(2024,1,5),1,DATE(2024,1,8))");
+  ASSERT_TRUE(v1900.is_number());
+  const Value expected_1900 = EvalSource("=DATE(2024,1,9)");
+  ASSERT_TRUE(expected_1900.is_number());
+  EXPECT_DOUBLE_EQ(v1900.as_number(), expected_1900.as_number());
+
+  const Value v1904 = EvalSource1904("=WORKDAY(DATE(2024,1,5),1,DATE(2024,1,8))");
+  ASSERT_TRUE(v1904.is_number());
+  EXPECT_DOUBLE_EQ(v1904.as_number(), v1900.as_number() - 1462.0);
+}
+
+TEST(DateTime1904, WorkdayUpperEndpointIsEpochSpecific) {
+  // 9999-12-31 is serial 2957003 under the 1904 system, so walking forward
+  // from 2957000 runs off the calendar. The same serial is an ordinary day
+  // under the 1900 system and the walk succeeds there.
+  const Value over = EvalSource1904("=WORKDAY(2957000,10)");
+  ASSERT_TRUE(over.is_error());
+  EXPECT_EQ(over.as_error(), ErrorCode::Num);
+
+  const Value within = EvalSource("=WORKDAY(2957000,10)");
+  ASSERT_TRUE(within.is_number());
+}
+
+TEST(DateTime1904, NetworkdaysRejectsSerialsPastTheEpochUpperEndpoint) {
+  const Value v = EvalSource1904("=NETWORKDAYS(1,2957004)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTime1904, DefaultSystemUnaffected) {
+  // Sanity: the 1900 default path is unchanged (YEAR of the 1900 serial).
+  const Value v = EvalSource("=YEAR(43831)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 2020.0);
+}
+
+TEST(DateTime1904, TodayIsPositiveIntegerUnder1904) {
+  // TODAY() reads the wall clock; assert only that the 1904 epoch yields a
+  // positive integer serial (deterministic value would depend on the date).
+  const Value v = EvalSource1904("=TODAY()");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_GT(v.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(v.as_number(), std::floor(v.as_number()));
+}
+TEST(DateTime1904, TextDateRenderingUsesWorkbookEpoch) {
+  // Serial 42369 is 2015-12-31 in the 1900 system and 2020-01-01 in the 1904
+  // system. TEXT's date format must render against the workbook epoch.
+  const Value v1900 = EvalSource("=TEXT(42369,\"yyyy-mm-dd\")");
+  ASSERT_TRUE(v1900.is_text());
+  EXPECT_EQ(v1900.as_text(), "2015-12-31");
+  const Value v1904 = EvalSource1904("=TEXT(42369,\"yyyy-mm-dd\")");
+  ASSERT_TRUE(v1904.is_text());
+  EXPECT_EQ(v1904.as_text(), "2020-01-01");
+}
+
+TEST(DateTime1904, TextRoundTripsDateBuiltinUnder1904) {
+  // DATE and TEXT share the workbook epoch, so DATE(2020,3,15) formatted back
+  // reads "2020-03-15" under both systems.
+  const Value v = EvalSource1904("=TEXT(DATE(2020,3,15),\"yyyy-mm-dd\")");
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "2020-03-15");
+}
+
+TEST(DateTime1904, TextNumericFormatUnaffectedByEpoch) {
+  // A pure-numeric format has no date tokens, so the epoch is irrelevant.
+  const Value v = EvalSource1904("=TEXT(1234.5,\"0.00\")");
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "1234.50");
+}
+
+TEST(DateTimeSerialZero, 1900SystemKeepsFictitiousDayAlias) {
+  const Value year = EvalSource("=YEAR(0)");
+  const Value month = EvalSource("=MONTH(0)");
+  const Value day = EvalSource("=DAY(0)");
+  ASSERT_TRUE(year.is_number());
+  ASSERT_TRUE(month.is_number());
+  ASSERT_TRUE(day.is_number());
+  EXPECT_DOUBLE_EQ(year.as_number(), 1900.0);
+  EXPECT_DOUBLE_EQ(month.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(day.as_number(), 0.0);
+}
+
+TEST(DateTimeSerialZero, 1904SystemUsesRealEpochDay) {
+  const Value year = EvalSource1904("=YEAR(0)");
+  const Value month = EvalSource1904("=MONTH(0)");
+  const Value day = EvalSource1904("=DAY(0)");
+  ASSERT_TRUE(year.is_number());
+  ASSERT_TRUE(month.is_number());
+  ASSERT_TRUE(day.is_number());
+  EXPECT_DOUBLE_EQ(year.as_number(), 1904.0);
+  EXPECT_DOUBLE_EQ(month.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(day.as_number(), 1.0);
+}
+
+TEST(DateTime1904, RawTextUsesCalendarDateAcrossExtractors) {
+  const Value year = EvalSource1904("=YEAR(\"2024-03-15\")");
+  const Value month = EvalSource1904("=MONTH(\"2024-03-15\")");
+  const Value day = EvalSource1904("=DAY(\"2024-03-15\")");
+  const Value weekday = EvalSource1904("=WEEKDAY(\"2024-03-15\")");
+  const Value weeknum = EvalSource1904("=WEEKNUM(\"2024-03-15\")");
+  const Value isoweeknum = EvalSource1904("=ISOWEEKNUM(\"2024-03-15\")");
+  ASSERT_TRUE(year.is_number());
+  ASSERT_TRUE(month.is_number());
+  ASSERT_TRUE(day.is_number());
+  ASSERT_TRUE(weekday.is_number());
+  ASSERT_TRUE(weeknum.is_number());
+  ASSERT_TRUE(isoweeknum.is_number());
+  EXPECT_DOUBLE_EQ(year.as_number(), 2024.0);
+  EXPECT_DOUBLE_EQ(month.as_number(), 3.0);
+  EXPECT_DOUBLE_EQ(day.as_number(), 15.0);
+  EXPECT_DOUBLE_EQ(weekday.as_number(), 6.0);  // Friday, Sunday-first.
+  EXPECT_DOUBLE_EQ(weeknum.as_number(), 11.0);
+  EXPECT_DOUBLE_EQ(isoweeknum.as_number(), 11.0);
+}
+
+TEST(DateTime1904, RawTextDayCountsMatchDatevalueNumbers) {
+  const Value datedif_raw = EvalSource1904("=DATEDIF(\"2024-01-01\",DATE(2024,12,31),\"D\")");
+  const Value datedif_datevalue = EvalSource1904("=DATEDIF(DATEVALUE(\"2024-01-01\"),DATE(2024,12,31),\"D\")");
+  const Value days360_raw = EvalSource1904("=DAYS360(\"2024-01-01\",DATE(2024,12,31))");
+  const Value days360_datevalue = EvalSource1904("=DAYS360(DATEVALUE(\"2024-01-01\"),DATE(2024,12,31))");
+  const Value days_raw = EvalSource1904("=DAYS(\"2024-03-15\",DATE(2024,3,14))");
+  const Value days_datevalue = EvalSource1904("=DAYS(DATEVALUE(\"2024-03-15\"),DATE(2024,3,14))");
+  ASSERT_TRUE(datedif_raw.is_number());
+  ASSERT_TRUE(datedif_datevalue.is_number());
+  ASSERT_TRUE(days360_raw.is_number());
+  ASSERT_TRUE(days360_datevalue.is_number());
+  ASSERT_TRUE(days_raw.is_number());
+  ASSERT_TRUE(days_datevalue.is_number());
+  EXPECT_DOUBLE_EQ(datedif_raw.as_number(), 365.0);
+  EXPECT_DOUBLE_EQ(datedif_datevalue.as_number(), 365.0);
+  EXPECT_DOUBLE_EQ(days360_raw.as_number(), 360.0);
+  EXPECT_DOUBLE_EQ(days360_datevalue.as_number(), 360.0);
+  EXPECT_DOUBLE_EQ(days_raw.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(days_datevalue.as_number(), 1.0);
+}
+
+TEST(DateTime1904, DaysBroadcastsArrayArguments) {
+  const Value result = EvalSource1904("=DAYS({\"2024-03-15\",\"2024-03-16\"},DATE(2024,3,14))");
+  ASSERT_TRUE(result.is_array());
+  ASSERT_EQ(result.as_array_rows(), 1U);
+  ASSERT_EQ(result.as_array_cols(), 2U);
+  ASSERT_TRUE(result.as_array()->cells[0].is_number());
+  ASSERT_TRUE(result.as_array()->cells[1].is_number());
+  EXPECT_DOUBLE_EQ(result.as_array()->cells[0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(result.as_array()->cells[1].as_number(), 2.0);
+}
+
+TEST(DateTime1904, LegacyMonthFunctionsUseRawTextInputCoordinateAfterValidation) {
+  const Value edate_raw = EvalSource1904("=EDATE(\"2024-03-15\",1)");
+  const Value edate_datevalue = EvalSource1904("=EDATE(DATEVALUE(\"2024-03-15\"),1)");
+  const Value eomonth_raw = EvalSource1904("=EOMONTH(\"2024-03-15\",0)");
+  const Value eomonth_datevalue = EvalSource1904("=EOMONTH(DATEVALUE(\"2024-03-15\"),0)");
+  ASSERT_TRUE(edate_raw.is_number());
+  ASSERT_TRUE(edate_datevalue.is_number());
+  ASSERT_TRUE(eomonth_raw.is_number());
+  ASSERT_TRUE(eomonth_datevalue.is_number());
+  EXPECT_DOUBLE_EQ(edate_raw.as_number(), 42473.0);
+  EXPECT_DOUBLE_EQ(edate_datevalue.as_number(), 43935.0);
+  EXPECT_DOUBLE_EQ(eomonth_raw.as_number(), 42459.0);
+  EXPECT_DOUBLE_EQ(eomonth_datevalue.as_number(), 43920.0);
+}
+
+TEST(DateTime1904, YearfracRawTextUsesLegacyEndpoints) {
+  const Value raw_start = EvalSource1904("=YEARFRAC(\"2024-01-01\",DATE(2024,12,31),3)");
+  const Value raw_end = EvalSource1904("=YEARFRAC(DATE(2024,1,1),\"2024-12-31\",3)");
+  const Value datevalue_start = EvalSource1904("=YEARFRAC(DATEVALUE(\"2024-01-01\"),DATE(2024,12,31),3)");
+  const Value datevalue_end = EvalSource1904("=YEARFRAC(DATE(2024,1,1),DATEVALUE(\"2024-12-31\"),3)");
+  const Value both_raw_basis3 = EvalSource1904("=YEARFRAC(\"2024-01-01\",\"2024-12-31\",3)");
+  const Value both_raw_basis1 = EvalSource1904("=YEARFRAC(\"2024-01-01\",\"2024-12-31\",1)");
+  ASSERT_TRUE(raw_start.is_number());
+  ASSERT_TRUE(raw_end.is_number());
+  ASSERT_TRUE(datevalue_start.is_number());
+  ASSERT_TRUE(datevalue_end.is_number());
+  ASSERT_TRUE(both_raw_basis3.is_number());
+  ASSERT_TRUE(both_raw_basis1.is_number());
+  EXPECT_DOUBLE_EQ(raw_start.as_number(), 1827.0 / 365.0);
+  EXPECT_DOUBLE_EQ(raw_end.as_number(), 1097.0 / 365.0);
+  EXPECT_DOUBLE_EQ(datevalue_start.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(datevalue_end.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(both_raw_basis3.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(both_raw_basis1.as_number(), 365.0 / 366.0);
+}
+
+TEST(DateTime1904, LegacyEdateTextBoundaryProjections) {
+  struct Case {
+    const char* date;
+    int months;
+    double expected;
+  };
+  constexpr Case cases[] = {
+      {"1904-01-01", 0, -1462.0}, {"1907-12-31", 0, -2.0},   {"1908-01-01", 0, -1.0},
+      {"1908-01-02", 0, 0.0},     {"1908-01-01", -1, -32.0}, {"2024-02-29", 0, 42427.0},
+  };
+  for (const Case& tc : cases) {
+    const std::string formula = "=EDATE(\"" + std::string(tc.date) + "\"," + std::to_string(tc.months) + ")";
+    const Value v = EvalSource1904(formula);
+    ASSERT_TRUE(v.is_number()) << formula;
+    EXPECT_DOUBLE_EQ(v.as_number(), tc.expected) << formula;
+  }
+}
+
+TEST(DateTime1904, LegacyEomonthTextBoundaryProjections) {
+  struct Case {
+    const char* date;
+    double expected;
+  };
+  constexpr Case cases[] = {
+      {"1904-01-01", -1431.0}, {"1907-12-31", -1.0},    {"1908-01-01", -1.0},
+      {"1908-01-02", 30.0},    {"2024-02-29", 42428.0},
+  };
+  for (const Case& tc : cases) {
+    const std::string formula = "=EOMONTH(\"" + std::string(tc.date) + "\",0)";
+    const Value v = EvalSource1904(formula);
+    ASSERT_TRUE(v.is_number()) << formula;
+    EXPECT_DOUBLE_EQ(v.as_number(), tc.expected) << formula;
+  }
+}
+
+TEST(DateTime1904, PreEpochRawDateTextIsValueError) {
+  const Value year = EvalSource1904("=YEAR(\"1903-12-31\")");
+  const Value edate = EvalSource1904("=EDATE(\"1903-12-31\",0)");
+  const Value eomonth = EvalSource1904("=EOMONTH(\"1903-12-31\",0)");
+  ASSERT_TRUE(year.is_error());
+  ASSERT_TRUE(edate.is_error());
+  ASSERT_TRUE(eomonth.is_error());
+  EXPECT_EQ(year.as_error(), ErrorCode::Value);
+  EXPECT_EQ(edate.as_error(), ErrorCode::Value);
+  EXPECT_EQ(eomonth.as_error(), ErrorCode::Value);
+}
+
+TEST(DateTime1904, NumericTextWhitespaceAndTimeOnlyStayNonDirect) {
+  const Value numeric_text = EvalSource1904("=YEAR(\"42369\")");
+  const Value whitespace = EvalSource1904("=YEAR(\" 2024-03-15 \")");
+  const Value time_value = EvalSource1904("=YEAR(\"12:00\")");
+  ASSERT_TRUE(numeric_text.is_number());
+  ASSERT_TRUE(whitespace.is_error());
+  ASSERT_TRUE(time_value.is_number());
+  EXPECT_DOUBLE_EQ(numeric_text.as_number(), 2020.0);
+  EXPECT_EQ(whitespace.as_error(), ErrorCode::Value);
+  EXPECT_DOUBLE_EQ(time_value.as_number(), 1904.0);
+}
+
+TEST(DateTime1904, NumericAndDatevalueMonthBoundsStayCanonical) {
+  const Value numeric_lower = EvalSource1904("=EDATE(0,0)");
+  const Value datevalue_lower = EvalSource1904("=EDATE(DATEVALUE(\"1904-01-01\"),0)");
+  const Value numeric_upper = EvalSource1904("=EDATE(DATE(9999,12,31),0)");
+  const Value datevalue_upper = EvalSource1904("=EDATE(DATEVALUE(\"9999-12-31\"),0)");
+  ASSERT_TRUE(numeric_lower.is_number());
+  ASSERT_TRUE(datevalue_lower.is_number());
+  ASSERT_TRUE(numeric_upper.is_number());
+  ASSERT_TRUE(datevalue_upper.is_number());
+  EXPECT_DOUBLE_EQ(numeric_lower.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(datevalue_lower.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(numeric_upper.as_number(), 2957003.0);
+  EXPECT_DOUBLE_EQ(datevalue_upper.as_number(), 2957003.0);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_datetime_calendar_test.cpp b/tests/unit/eval/builtins_datetime_calendar_test.cpp
new file mode 100644
index 000000000..bded13d39
--- /dev/null
+++ b/tests/unit/eval/builtins_datetime_calendar_test.cpp
@@ -0,0 +1,401 @@
+// End-to-end date/time built-in tests: week numbering, year fractions, date differences, and workdays.
+
+#include <string>
+
+#include "builtins_datetime_test_helpers.h"
+namespace formulon {
+namespace eval {
+namespace {
+
+// ---------------------------------------------------------------------------
+// WEEKNUM / ISOWEEKNUM
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeWeeknum, DefaultSundayType) {
+  // 2024-01-01 is a Monday. Default return_type=1 (Sunday start); week 1
+  // contains Jan 1, Jan 1 itself is the second day of that week.
+  const Value v = EvalSource("=WEEKNUM(DATE(2024,1,1))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 1.0);
+}
+
+TEST(DateTimeWeeknum, MidYearDefault) {
+  // 2024-07-04 is a Thursday of ISO week 27; return_type=1 (Sun start)
+  // yields 27 as well.
+  const Value v = EvalSource("=WEEKNUM(DATE(2024,7,4))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 27.0);
+}
+
+TEST(DateTimeWeeknum, MondayTypeTwo) {
+  // 2024-01-01 is a Monday; with return_type=2 (Mon start) it is the
+  // first day of week 1.
+  const Value v = EvalSource("=WEEKNUM(DATE(2024,1,1),2)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 1.0);
+}
+
+TEST(DateTimeWeeknum, Iso21Matches2024Jan1) {
+  // ISO 8601: 2024-01-01 is a Monday -> week 1 of 2024.
+  const Value v = EvalSource("=WEEKNUM(DATE(2024,1,1),21)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 1.0);
+}
+
+TEST(DateTimeWeeknum, Iso21_2023Jan1_RollsToPrevYear) {
+  // 2023-01-01 is a Sunday -> ISO week 52 of 2022.
+  const Value v = EvalSource("=WEEKNUM(DATE(2023,1,1),21)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 52.0);
+}
+
+// Windows Excel 365 (the primary reference) rejects an unsupported
+// return_type with #NUM!; only 1, 2, 11..17 and 21 are accepted.
+TEST(DateTimeWeeknum, InvalidReturnTypeIsNum) {
+  for (const char* src :
+       {"=WEEKNUM(DATE(2024,1,1),99)", "=WEEKNUM(DATE(2024,1,1),0)", "=WEEKNUM(DATE(2024,1,1),3)",
+        "=WEEKNUM(DATE(2024,1,1),10)", "=WEEKNUM(DATE(2024,1,1),18)", "=WEEKNUM(DATE(2024,1,1),22)"}) {
+    const Value v = EvalSource(src);
+    ASSERT_TRUE(v.is_error()) << src;
+    EXPECT_EQ(v.as_error(), ErrorCode::Num) << src;
+  }
+}
+
+TEST(DateTimeWeeknum, EveryAcceptedReturnTypeComputes) {
+  for (const char* src :
+       {"=WEEKNUM(DATE(2024,1,1),1)", "=WEEKNUM(DATE(2024,1,1),2)", "=WEEKNUM(DATE(2024,1,1),11)",
+        "=WEEKNUM(DATE(2024,1,1),17)", "=WEEKNUM(DATE(2024,1,1),21)", "=WEEKNUM(DATE(2024,1,1),11.9)"}) {
+    EXPECT_TRUE(EvalSource(src).is_number()) << src;
+  }
+}
+
+TEST(DateTimeWeeknum, NegativeSerialIsNum) {
+  const Value v = EvalSource("=WEEKNUM(-1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeIsoWeeknum, MidYear) {
+  // 2024-07-04 -> ISO week 27.
+  const Value v = EvalSource("=ISOWEEKNUM(DATE(2024,7,4))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 27.0);
+}
+
+TEST(DateTimeIsoWeeknum, Jan1_2023_IsWeek52OfPrevYear) {
+  const Value v = EvalSource("=ISOWEEKNUM(DATE(2023,1,1))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 52.0);
+}
+
+TEST(DateTimeIsoWeeknum, Dec31_2024_IsWeek1OfNextYear) {
+  // 2024-12-31 is a Tuesday -> ISO week 1 of 2025.
+  const Value v = EvalSource("=ISOWEEKNUM(DATE(2024,12,31))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 1.0);
+}
+
+// ---------------------------------------------------------------------------
+// YEARFRAC
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeYearfrac, Basis0_US30_360_HalfYear) {
+  // 2024-01-01 -> 2024-07-01 under 30/360 = 180/360 = 0.5 exactly.
+  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),0)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.5, 1e-12);
+}
+
+TEST(DateTimeYearfrac, Basis1_ActualActual_OneFullLeapYear) {
+  // 2023-01-01 -> 2024-01-01 exact anniversary spanning 365 days across
+  // two calendar years -> 1.0 under the avg-year rule.
+  const Value v = EvalSource("=YEARFRAC(DATE(2023,1,1),DATE(2024,1,1),1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
+}
+
+TEST(DateTimeYearfrac, Basis1_ActualActual_OneYearSpanEnclosingFeb29) {
+  // 2020-01-01 -> 2021-01-01 is exactly one year and encloses 2020-02-29, so
+  // the denominator is the single leap year length 366 (not the multi-year
+  // average 365.5): 366/366 = 1.0 exactly. Regression for the actual/actual
+  // leap-year bug (previously 1.0013679890560876).
+  const Value v = EvalSource("=YEARFRAC(DATE(2020,1,1),DATE(2021,1,1),1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
+}
+
+TEST(DateTimeYearfrac, Basis1_ActualActual_OneYearSpanAnniversaryEnclosingFeb29) {
+  // 2019-03-01 -> 2020-03-01 is a one-year span whose interval includes
+  // 2020-02-29, so the denominator is 366 and the fraction is exactly 1.0.
+  const Value v = EvalSource("=YEARFRAC(DATE(2019,3,1),DATE(2020,3,1),1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
+}
+
+TEST(DateTimeYearfrac, Basis1_ActualActual_NonLeapOneYearSpan) {
+  // 2021-01-01 -> 2022-01-01: neither year is leap, span is one year -> 1.0.
+  const Value v = EvalSource("=YEARFRAC(DATE(2021,1,1),DATE(2022,1,1),1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
+}
+
+TEST(DateTimeYearfrac, Basis1_ActualActual_MultiYearAveragesFullYearLengths) {
+  // Spans longer than one year divide by the average full length of the
+  // years y1..y2, even when the leap year's Feb 29 lies outside the span.
+  // Values captured from Excel 365.
+  const Value leap_start = EvalSource("=YEARFRAC(DATE(2024,3,1),DATE(2026,6,1),1)");
+  ASSERT_TRUE(leap_start.is_number());
+  EXPECT_EQ(leap_start.as_number(), 2.25);
+  const Value leap_end = EvalSource("=YEARFRAC(DATE(2022,6,1),DATE(2024,2,1),1)");
+  ASSERT_TRUE(leap_end.is_number());
+  EXPECT_EQ(leap_end.as_number(), 1.6697080291970803);
+  const Value contains = EvalSource("=YEARFRAC(DATE(2023,6,1),DATE(2025,6,1),1)");
+  ASSERT_TRUE(contains.is_number());
+  EXPECT_EQ(contains.as_number(), 2.0009124087591244);
+}
+
+TEST(DateTimeYearfrac, Basis2_Actual360_HalfLeapYear) {
+  // 2024-01-01 -> 2024-07-01 is 182 days in 2024; 182/360.
+  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),2)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 182.0 / 360.0, 1e-12);
+}
+
+TEST(DateTimeYearfrac, Basis3_Actual365_HalfLeapYear) {
+  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),3)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 182.0 / 365.0, 1e-12);
+}
+
+TEST(DateTimeYearfrac, Basis4_EU30_360_HalfYear) {
+  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),4)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.5, 1e-12);
+}
+
+TEST(DateTimeYearfrac, NegativeIntervalSwaps) {
+  // Oracle-documented behaviour: YEARFRAC is symmetric in its first two
+  // args (positive regardless of order).
+  const Value a = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),0)");
+  const Value b = EvalSource("=YEARFRAC(DATE(2024,7,1),DATE(2024,1,1),0)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeYearfrac, InvalidBasisIsNum) {
+  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),5)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+// ---------------------------------------------------------------------------
+// DATEDIF
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeDatedif, YearsBetween) {
+  const Value v = EvalSource("=DATEDIF(DATE(2020,3,15),DATE(2024,7,1),\"Y\")");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 4.0);
+}
+
+TEST(DateTimeDatedif, MonthsBetween) {
+  // 2024-01-15 -> 2024-07-01: 5 complete months (d2 < d1 shaves one off).
+  const Value v = EvalSource("=DATEDIF(DATE(2024,1,15),DATE(2024,7,1),\"M\")");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 5.0);
+}
+
+TEST(DateTimeDatedif, DaysBetween) {
+  const Value v = EvalSource("=DATEDIF(DATE(2024,1,1),DATE(2024,1,15),\"D\")");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 14.0);
+}
+
+TEST(DateTimeDatedif, YmIgnoresYears) {
+  // 4 years 3 months 16 days -> YM = 3.
+  const Value v = EvalSource("=DATEDIF(DATE(2020,3,15),DATE(2024,7,1),\"YM\")");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 3.0);
+}
+
+TEST(DateTimeDatedif, YdIgnoresYearsSameCalendarPosition) {
+  // Same month/day pair: YD = 0 when the calendar positions align.
+  const Value v = EvalSource("=DATEDIF(DATE(2020,3,15),DATE(2024,3,15),\"YD\")");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 0.0);
+}
+
+TEST(DateTimeDatedif, MdDayOnlyDiff) {
+  // Same day-of-month -> MD = 0.
+  const Value v = EvalSource("=DATEDIF(DATE(2024,1,15),DATE(2024,7,15),\"MD\")");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 0.0);
+}
+
+TEST(DateTimeDatedif, EndBeforeStartIsNum) {
+  const Value v = EvalSource("=DATEDIF(DATE(2024,7,1),DATE(2020,3,15),\"Y\")");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeDatedif, UnknownUnitIsNum) {
+  const Value v = EvalSource("=DATEDIF(DATE(2024,1,1),DATE(2024,12,31),\"X\")");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeDatedif, UnitTokensAreCaseInsensitive) {
+  struct Case {
+    std::string_view unit;
+    std::string_view start;
+    std::string_view end;
+    double expected;
+  };
+  const Case cases[] = {
+      {"y", "DATE(2020,3,15)", "DATE(2024,7,1)", 4.0},   {"m", "DATE(2024,1,15)", "DATE(2024,7,1)", 5.0},
+      {"d", "DATE(2024,1,1)", "DATE(2024,1,15)", 14.0},  {"yM", "DATE(2020,3,15)", "DATE(2024,7,1)", 3.0},
+      {"Yd", "DATE(2020,3,15)", "DATE(2024,3,15)", 0.0}, {"mD", "DATE(2024,1,15)", "DATE(2024,7,15)", 0.0},
+  };
+  for (const Case& test : cases) {
+    const std::string formula =
+        "=DATEDIF(" + std::string(test.start) + "," + std::string(test.end) + ",\"" + std::string(test.unit) + "\")";
+    const Value v = EvalSource(formula);
+    ASSERT_TRUE(v.is_number()) << formula << ": " << v.debug_to_string();
+    EXPECT_DOUBLE_EQ(v.as_number(), test.expected) << formula;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// NETWORKDAYS / WORKDAY
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeNetworkdays, OneCompleteWeek) {
+  // 2024-01-01 (Mon) .. 2024-01-05 (Fri) inclusive -> 5 business days.
+  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,5))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 5.0);
+}
+
+TEST(DateTimeNetworkdays, TwoCompleteWeeks) {
+  // 2024-01-01 .. 2024-01-12 (Fri) inclusive -> 10 business days.
+  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,12))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 10.0);
+}
+
+TEST(DateTimeNetworkdays, SingleWeekdayIsOne) {
+  // Mon .. Mon same day -> 1.
+  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,1))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 1.0);
+}
+
+TEST(DateTimeNetworkdays, SingleSaturdayIsZero) {
+  // 2024-01-06 is a Saturday. A weekend-only interval counts as zero.
+  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,6),DATE(2024,1,6))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 0.0);
+}
+
+TEST(DateTimeNetworkdays, ArrayLiteralHolidays) {
+  // Drop Jan 1 and Jan 2 via an inline array literal; 2024-01-01..01-05
+  // has 5 business days, minus 2 holidays -> 3.
+  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,5),{45292,45293})");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 3.0);
+}
+
+TEST(DateTimeNetworkdays, RangeHolidays) {
+  // Same setup as above but sourced from A1:A2 on a bound sheet.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(45292.0));  // 2024-01-01
+  wb.sheet(0).set_cell_value(1, 0, Value::number(45293.0));  // 2024-01-02
+  const Value v = EvalSourceIn("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,5),A1:A2)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 3.0);
+}
+
+TEST(DateTimeNetworkdays, ReversedRangeNegates) {
+  // Excel 365 returns the negated business-day count when start > end.
+  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,5),DATE(2024,1,1))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), -5.0);
+}
+
+TEST(DateTimeNetworkdays, ErrorPropagates) {
+  const Value v = EvalSource("=NETWORKDAYS(\"abc\",DATE(2024,1,5))");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(DateTimeNetworkdays, RejectsOutOfRangeSerialBeforeIteration) {
+  const Value v = EvalSource("=NETWORKDAYS(1,1000000000)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeWorkday, RejectsOutOfRangeDayCountBeforeIteration) {
+  const Value v = EvalSource("=WORKDAY(1,1000000000)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeWorkday, ForwardFiveDays) {
+  // 2024-01-01 (Mon). +5 business days -> 2024-01-08 (the next Monday,
+  // because Jan 6/7 are Sat/Sun and skip without counting).
+  const Value v = EvalSource("=WORKDAY(DATE(2024,1,1),5)");
+  const Value exp = EvalSource("=DATE(2024,1,8)");
+  ASSERT_TRUE(v.is_number());
+  ASSERT_TRUE(exp.is_number());
+  EXPECT_EQ(v.as_number(), exp.as_number());
+}
+
+TEST(DateTimeWorkday, BackwardFiveDays) {
+  // 2024-01-15 (Mon) - 5 business days -> 2024-01-08 (Mon).
+  const Value v = EvalSource("=WORKDAY(DATE(2024,1,15),-5)");
+  const Value exp = EvalSource("=DATE(2024,1,8)");
+  ASSERT_TRUE(v.is_number());
+  ASSERT_TRUE(exp.is_number());
+  EXPECT_EQ(v.as_number(), exp.as_number());
+}
+
+TEST(DateTimeWorkday, ZeroDaysReturnsStart) {
+  // Excel: WORKDAY(start, 0) returns start regardless of weekday status.
+  const Value v = EvalSource("=WORKDAY(DATE(2024,1,3),0)");
+  const Value exp = EvalSource("=DATE(2024,1,3)");
+  ASSERT_TRUE(v.is_number());
+  ASSERT_TRUE(exp.is_number());
+  EXPECT_EQ(v.as_number(), exp.as_number());
+}
+
+TEST(DateTimeWorkday, HolidaysExtendForward) {
+  // +5 business days from Mon with Tue / Wed as holidays -> Fri of next
+  // week (the 5 working days skipped the two holidays AND the weekend).
+  const Value v = EvalSource("=WORKDAY(DATE(2024,1,1),5,{45293,45294})");
+  const Value exp = EvalSource("=DATE(2024,1,10)");
+  ASSERT_TRUE(v.is_number());
+  ASSERT_TRUE(exp.is_number());
+  EXPECT_EQ(v.as_number(), exp.as_number());
+}
+
+TEST(DateTimeWorkday, RangeHolidays) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(45293.0));  // 2024-01-02
+  wb.sheet(0).set_cell_value(1, 0, Value::number(45294.0));  // 2024-01-03
+  const Value v = EvalSourceIn("=WORKDAY(DATE(2024,1,1),5,A1:A2)", wb, wb.sheet(0));
+  const Value exp = EvalSource("=DATE(2024,1,10)");
+  ASSERT_TRUE(v.is_number());
+  ASSERT_TRUE(exp.is_number());
+  EXPECT_EQ(v.as_number(), exp.as_number());
+}
+
+TEST(DateTimeWorkday, ErrorPropagates) {
+  const Value v = EvalSource("=WORKDAY(\"abc\",5)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_datetime_clock_test.cpp b/tests/unit/eval/builtins_datetime_clock_test.cpp
new file mode 100644
index 000000000..30e1e19a5
--- /dev/null
+++ b/tests/unit/eval/builtins_datetime_clock_test.cpp
@@ -0,0 +1,525 @@
+// End-to-end date/time built-in tests: clock seams and serial weekday grids.
+
+#include <cmath>
+
+#include "builtins_datetime_test_helpers.h"
+#include "utils/date_time.h"
+namespace formulon {
+namespace eval {
+namespace {
+
+// ---------------------------------------------------------------------------
+// Clock seam
+//
+// `EvalContext::wall_clock()` falls through to the host clock unless a
+// reading is pinned. Pinning is what makes NOW / TODAY assertable at all:
+// without it every expectation here would have to be a shape check against
+// whatever day the suite happens to run on, as the test above has to be.
+// ---------------------------------------------------------------------------
+
+// 2026-04-23 15:30:45. The date half matches `DateTimeDate.CurrentDateSerial`
+// above, so the expected serial 46135 is already independently pinned.
+constexpr date_time::CivilTime kPinnedNow{{2026, 4U, 23U}, {15U, 30U, 45U}};
+constexpr double kPinnedSerial = 46135.0;
+// 15:30:45 == 55,845 seconds into the day.
+constexpr double kPinnedTimeOfDay = 55845.0 / 86400.0;
+
+Value EvalSourcePinned(std::string_view src, date_time::CivilTime pinned = kPinnedNow, bool date1904 = false) {
+  static thread_local Arena parse_arena;
+  static thread_local Arena eval_arena;
+  parse_arena.reset();
+  eval_arena.reset();
+  parser::Parser p(src, parse_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  return evaluate(*root, eval_arena, default_registry(),
+                  test::mac_context().with_date1904(date1904).with_pinned_now(pinned));
+}
+
+TEST(ClockSeam, TodayReturnsThePinnedDate) {
+  const Value v = EvalSourcePinned("=TODAY()");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), kPinnedSerial);
+}
+
+TEST(ClockSeam, NowCarriesThePinnedTimeOfDay) {
+  const Value v = EvalSourcePinned("=NOW()");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), kPinnedSerial + kPinnedTimeOfDay);
+}
+
+TEST(ClockSeam, TodayDiscardsTheTimeOfDayNowKeeps) {
+  const Value today = EvalSourcePinned("=TODAY()");
+  const Value now = EvalSourcePinned("=NOW()");
+  ASSERT_TRUE(today.is_number());
+  ASSERT_TRUE(now.is_number());
+  EXPECT_DOUBLE_EQ(today.as_number(), std::floor(now.as_number()));
+  EXPECT_GT(now.as_number(), today.as_number());
+}
+
+TEST(ClockSeam, MovingThePinMovesTheAnswer) {
+  // Guards against the pin being accepted but ignored: a second reading a
+  // day later must shift the serial by exactly one.
+  constexpr date_time::CivilTime kNextDay{{2026, 4U, 24U}, {15U, 30U, 45U}};
+  const Value v = EvalSourcePinned("=TODAY()", kNextDay);
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), kPinnedSerial + 1.0);
+}
+
+TEST(ClockSeam, ThePinnedReadingStillHonoursTheWorkbookEpoch) {
+  // The pin carries calendar fields, not a serial, so the 1904 epoch is
+  // applied downstream exactly as it is for an argument-supplied date.
+  const Value v = EvalSourcePinned("=TODAY()", kPinnedNow, /*date1904=*/true);
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), kPinnedSerial - date_time::kDate1904EpochGap);
+}
+
+TEST(ClockSeam, AnUnpinnedContextStillFollowsTheHostClock) {
+  // The seam must not disturb the shipping default: with nothing pinned both
+  // functions keep reading the host clock, so only the shape is assertable.
+  const Value v = EvalSource("=TODAY()");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_GT(v.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(v.as_number(), std::floor(v.as_number()));
+}
+// ---------------------------------------------------------------------------
+// Weekdays of 1900 serials
+// ---------------------------------------------------------------------------
+
+// Excel 365 ja-JP readings for serials 0..8, around the ghost day 60, and
+// across 1900 for the week-number family.
+TEST(DateTimeSerialWeekday, MatchesExcelGrid) {
+  struct Case {
+    const char* formula;
+    double number;
+    const char* text;
+    bool num_error;
+  };
+  static constexpr Case kCases[] = {
+      {"=WEEKDAY(0)", 7.0, nullptr, false},
+      {"=WEEKDAY(0,2)", 6.0, nullptr, false},
+      {"=WEEKDAY(0,3)", 5.0, nullptr, false},
+      {"=WEEKDAY(1)", 1.0, nullptr, false},
+      {"=WEEKDAY(1,2)", 7.0, nullptr, false},
+      {"=WEEKDAY(1,3)", 6.0, nullptr, false},
+      {"=WEEKDAY(2)", 2.0, nullptr, false},
+      {"=WEEKDAY(2,2)", 1.0, nullptr, false},
+      {"=WEEKDAY(2,3)", 0.0, nullptr, false},
+      {"=WEEKDAY(3)", 3.0, nullptr, false},
+      {"=WEEKDAY(3,2)", 2.0, nullptr, false},
+      {"=WEEKDAY(3,3)", 1.0, nullptr, false},
+      {"=WEEKDAY(4)", 4.0, nullptr, false},
+      {"=WEEKDAY(4,2)", 3.0, nullptr, false},
+      {"=WEEKDAY(4,3)", 2.0, nullptr, false},
+      {"=WEEKDAY(5)", 5.0, nullptr, false},
+      {"=WEEKDAY(5,2)", 4.0, nullptr, false},
+      {"=WEEKDAY(5,3)", 3.0, nullptr, false},
+      {"=WEEKDAY(6)", 6.0, nullptr, false},
+      {"=WEEKDAY(6,2)", 5.0, nullptr, false},
+      {"=WEEKDAY(6,3)", 4.0, nullptr, false},
+      {"=WEEKDAY(7)", 7.0, nullptr, false},
+      {"=WEEKDAY(7,2)", 6.0, nullptr, false},
+      {"=WEEKDAY(7,3)", 5.0, nullptr, false},
+      {"=WEEKDAY(8)", 1.0, nullptr, false},
+      {"=WEEKDAY(8,2)", 7.0, nullptr, false},
+      {"=WEEKDAY(8,3)", 6.0, nullptr, false},
+      {"=WEEKDAY(58)", 2.0, nullptr, false},
+      {"=WEEKDAY(58,2)", 1.0, nullptr, false},
+      {"=WEEKDAY(58,3)", 0.0, nullptr, false},
+      {"=WEEKDAY(59)", 3.0, nullptr, false},
+      {"=WEEKDAY(59,2)", 2.0, nullptr, false},
+      {"=WEEKDAY(59,3)", 1.0, nullptr, false},
+      {"=WEEKDAY(60)", 4.0, nullptr, false},
+      {"=WEEKDAY(60,2)", 3.0, nullptr, false},
+      {"=WEEKDAY(60,3)", 2.0, nullptr, false},
+      {"=WEEKDAY(61)", 5.0, nullptr, false},
+      {"=WEEKDAY(61,2)", 4.0, nullptr, false},
+      {"=WEEKDAY(61,3)", 3.0, nullptr, false},
+      {"=WEEKDAY(62)", 6.0, nullptr, false},
+      {"=WEEKDAY(62,2)", 5.0, nullptr, false},
+      {"=WEEKDAY(62,3)", 4.0, nullptr, false},
+      {"=NETWORKDAYS(0,0)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,0)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,0,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,0,\"0000011\")", 0.0, nullptr, false},
+      {"=NETWORKDAYS(0,1)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,1)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,1,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,1,\"0000011\")", 0.0, nullptr, false},
+      {"=NETWORKDAYS(0,2)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,2)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,2,11)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,2,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(0,3)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,3)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,3,11)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,3,\"0000011\")", 2.0, nullptr, false},
+      {"=NETWORKDAYS(0,4)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,4)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,4,11)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,4,\"0000011\")", 3.0, nullptr, false},
+      {"=NETWORKDAYS(0,5)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,5)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,5,11)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,5,\"0000011\")", 4.0, nullptr, false},
+      {"=NETWORKDAYS(0,6)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,6)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,6,11)", 6.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,6,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(0,7)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,7)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,7,11)", 7.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,7,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(0,8)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,8)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,8,11)", 7.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(0,8,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(1,1)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,1)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,1,11)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,1,\"0000011\")", 0.0, nullptr, false},
+      {"=NETWORKDAYS(1,2)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,2)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,2,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,2,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(1,3)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,3)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,3,11)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,3,\"0000011\")", 2.0, nullptr, false},
+      {"=NETWORKDAYS(1,4)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,4)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,4,11)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,4,\"0000011\")", 3.0, nullptr, false},
+      {"=NETWORKDAYS(1,5)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,5)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,5,11)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,5,\"0000011\")", 4.0, nullptr, false},
+      {"=NETWORKDAYS(1,6)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,6)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,6,11)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,6,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(1,7)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,7)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,7,11)", 6.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,7,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(1,8)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,8)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,8,11)", 6.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,8,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(2,2)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,2)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,2,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,2,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(2,3)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,3)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,3,11)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,3,\"0000011\")", 2.0, nullptr, false},
+      {"=NETWORKDAYS(2,4)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,4)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,4,11)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,4,\"0000011\")", 3.0, nullptr, false},
+      {"=NETWORKDAYS(2,5)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,5)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,5,11)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,5,\"0000011\")", 4.0, nullptr, false},
+      {"=NETWORKDAYS(2,6)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,6)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,6,11)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,6,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(2,7)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,7)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,7,11)", 6.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,7,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(2,8)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,8)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,8,11)", 6.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,8,\"0000011\")", 5.0, nullptr, false},
+      {"=NETWORKDAYS(3,3)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,3)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,3,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,3,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(3,4)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,4)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,4,11)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,4,\"0000011\")", 2.0, nullptr, false},
+      {"=NETWORKDAYS(3,5)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,5)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,5,11)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,5,\"0000011\")", 3.0, nullptr, false},
+      {"=NETWORKDAYS(3,6)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,6)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,6,11)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,6,\"0000011\")", 4.0, nullptr, false},
+      {"=NETWORKDAYS(3,7)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,7)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,7,11)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,7,\"0000011\")", 4.0, nullptr, false},
+      {"=NETWORKDAYS(3,8)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,8)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,8,11)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(3,8,\"0000011\")", 4.0, nullptr, false},
+      {"=NETWORKDAYS(4,4)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,4)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,4,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,4,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(4,5)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,5)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,5,11)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,5,\"0000011\")", 2.0, nullptr, false},
+      {"=NETWORKDAYS(4,6)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,6)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,6,11)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,6,\"0000011\")", 3.0, nullptr, false},
+      {"=NETWORKDAYS(4,7)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,7)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,7,11)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,7,\"0000011\")", 3.0, nullptr, false},
+      {"=NETWORKDAYS(4,8)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,8)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,8,11)", 4.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(4,8,\"0000011\")", 3.0, nullptr, false},
+      {"=NETWORKDAYS(5,5)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,5)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,5,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,5,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(5,6)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,6)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,6,11)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,6,\"0000011\")", 2.0, nullptr, false},
+      {"=NETWORKDAYS(5,7)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,7)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,7,11)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,7,\"0000011\")", 2.0, nullptr, false},
+      {"=NETWORKDAYS(5,8)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,8)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,8,11)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(5,8,\"0000011\")", 2.0, nullptr, false},
+      {"=NETWORKDAYS(6,6)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,6)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,6,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,6,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(6,7)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,7)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,7,11)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,7,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(6,8)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,8)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,8,11)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(6,8,\"0000011\")", 1.0, nullptr, false},
+      {"=NETWORKDAYS(7,7)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(7,7)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(7,7,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(7,7,\"0000011\")", 0.0, nullptr, false},
+      {"=NETWORKDAYS(7,8)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(7,8)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(7,8,11)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(7,8,\"0000011\")", 0.0, nullptr, false},
+      {"=NETWORKDAYS(8,8)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(8,8)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(8,8,11)", 0.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(8,8,\"0000011\")", 0.0, nullptr, false},
+      {"=NETWORKDAYS(55,65)", 7.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(55,65)", 7.0, nullptr, false},
+      {"=NETWORKDAYS(58,62)", 5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(58,62)", 5.0, nullptr, false},
+      {"=NETWORKDAYS(59,61)", 3.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(59,61)", 3.0, nullptr, false},
+      {"=NETWORKDAYS(60,60)", 1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(60,60)", 1.0, nullptr, false},
+      {"=NETWORKDAYS(59,60)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(59,60)", 2.0, nullptr, false},
+      {"=NETWORKDAYS(60,61)", 2.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(60,61)", 2.0, nullptr, false},
+      {"=NETWORKDAYS(1,70)", 50.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(1,70)", 50.0, nullptr, false},
+      {"=NETWORKDAYS(2,1)", -1.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(2,1)", -1.0, nullptr, false},
+      {"=NETWORKDAYS(8,0)", -5.0, nullptr, false},
+      {"=NETWORKDAYS.INTL(8,0)", -5.0, nullptr, false},
+      {"=WORKDAY(0,1)", 2.0, nullptr, false},
+      {"=WORKDAY.INTL(0,1)", 2.0, nullptr, false},
+      {"=WORKDAY.INTL(0,1,11)", 2.0, nullptr, false},
+      {"=WORKDAY(1,1)", 2.0, nullptr, false},
+      {"=WORKDAY.INTL(1,1)", 2.0, nullptr, false},
+      {"=WORKDAY.INTL(1,1,11)", 2.0, nullptr, false},
+      {"=WORKDAY(0,0)", 0.0, nullptr, false},
+      {"=WORKDAY.INTL(0,0)", 0.0, nullptr, false},
+      {"=WORKDAY.INTL(0,0,11)", 0.0, nullptr, false},
+      {"=WORKDAY(1,0)", 1.0, nullptr, false},
+      {"=WORKDAY.INTL(1,0)", 1.0, nullptr, false},
+      {"=WORKDAY.INTL(1,0,11)", 1.0, nullptr, false},
+      {"=WORKDAY(0,5)", 6.0, nullptr, false},
+      {"=WORKDAY.INTL(0,5)", 6.0, nullptr, false},
+      {"=WORKDAY.INTL(0,5,11)", 6.0, nullptr, false},
+      {"=WORKDAY(1,5)", 6.0, nullptr, false},
+      {"=WORKDAY.INTL(1,5)", 6.0, nullptr, false},
+      {"=WORKDAY.INTL(1,5,11)", 6.0, nullptr, false},
+      {"=WORKDAY(2,-1)", 0.0, nullptr, true},
+      {"=WORKDAY.INTL(2,-1)", 0.0, nullptr, true},
+      {"=WORKDAY.INTL(2,-1,11)", 0.0, nullptr, false},
+      {"=WORKDAY(1,-1)", 0.0, nullptr, true},
+      {"=WORKDAY.INTL(1,-1)", 0.0, nullptr, true},
+      {"=WORKDAY.INTL(1,-1,11)", 0.0, nullptr, false},
+      {"=WORKDAY(57,3)", 60.0, nullptr, false},
+      {"=WORKDAY.INTL(57,3)", 60.0, nullptr, false},
+      {"=WORKDAY.INTL(57,3,11)", 60.0, nullptr, false},
+      {"=WORKDAY(58,1)", 59.0, nullptr, false},
+      {"=WORKDAY.INTL(58,1)", 59.0, nullptr, false},
+      {"=WORKDAY.INTL(58,1,11)", 59.0, nullptr, false},
+      {"=WORKDAY(59,1)", 60.0, nullptr, false},
+      {"=WORKDAY.INTL(59,1)", 60.0, nullptr, false},
+      {"=WORKDAY.INTL(59,1,11)", 60.0, nullptr, false},
+      {"=WORKDAY(61,-1)", 60.0, nullptr, false},
+      {"=WORKDAY.INTL(61,-1)", 60.0, nullptr, false},
+      {"=WORKDAY.INTL(61,-1,11)", 60.0, nullptr, false},
+      {"=WORKDAY(62,-3)", 59.0, nullptr, false},
+      {"=WORKDAY.INTL(62,-3)", 59.0, nullptr, false},
+      {"=WORKDAY.INTL(62,-3,11)", 59.0, nullptr, false},
+      {"=TEXT(0,\"ddd\")", 0.0, "Sat", false},
+      {"=TEXT(0,\"dddd\")", 0.0, "Saturday", false},
+      {"=TEXT(0,\"aaa\")", 0.0, "土", false},
+      {"=WEEKNUM(0)", 0.0, nullptr, false},
+      {"=WEEKNUM(0,2)", 1.0, nullptr, false},
+      {"=WEEKNUM(0,21)", 52.0, nullptr, false},
+      {"=ISOWEEKNUM(0)", 52.0, nullptr, false},
+      {"=WEEKNUM(0,11)", 1.0, nullptr, false},
+      {"=WEEKNUM(0,17)", 0.0, nullptr, false},
+      {"=TEXT(1,\"ddd\")", 0.0, "Sun", false},
+      {"=TEXT(1,\"dddd\")", 0.0, "Sunday", false},
+      {"=TEXT(1,\"aaa\")", 0.0, "日", false},
+      {"=WEEKNUM(1)", 1.0, nullptr, false},
+      {"=WEEKNUM(1,2)", 1.0, nullptr, false},
+      {"=WEEKNUM(1,21)", 52.0, nullptr, false},
+      {"=ISOWEEKNUM(1)", 52.0, nullptr, false},
+      {"=WEEKNUM(1,11)", 1.0, nullptr, false},
+      {"=WEEKNUM(1,17)", 1.0, nullptr, false},
+      {"=TEXT(2,\"ddd\")", 0.0, "Mon", false},
+      {"=TEXT(2,\"dddd\")", 0.0, "Monday", false},
+      {"=TEXT(2,\"aaa\")", 0.0, "月", false},
+      {"=WEEKNUM(2)", 1.0, nullptr, false},
+      {"=WEEKNUM(2,2)", 2.0, nullptr, false},
+      {"=WEEKNUM(2,21)", 1.0, nullptr, false},
+      {"=ISOWEEKNUM(2)", 1.0, nullptr, false},
+      {"=WEEKNUM(2,11)", 2.0, nullptr, false},
+      {"=WEEKNUM(2,17)", 1.0, nullptr, false},
+      {"=TEXT(6,\"ddd\")", 0.0, "Fri", false},
+      {"=TEXT(6,\"dddd\")", 0.0, "Friday", false},
+      {"=TEXT(6,\"aaa\")", 0.0, "金", false},
+      {"=WEEKNUM(6)", 1.0, nullptr, false},
+      {"=WEEKNUM(6,2)", 2.0, nullptr, false},
+      {"=WEEKNUM(6,21)", 1.0, nullptr, false},
+      {"=ISOWEEKNUM(6)", 1.0, nullptr, false},
+      {"=WEEKNUM(6,11)", 2.0, nullptr, false},
+      {"=WEEKNUM(6,17)", 1.0, nullptr, false},
+      {"=TEXT(7,\"ddd\")", 0.0, "Sat", false},
+      {"=TEXT(7,\"dddd\")", 0.0, "Saturday", false},
+      {"=TEXT(7,\"aaa\")", 0.0, "土", false},
+      {"=WEEKNUM(7)", 1.0, nullptr, false},
+      {"=WEEKNUM(7,2)", 2.0, nullptr, false},
+      {"=WEEKNUM(7,21)", 1.0, nullptr, false},
+      {"=ISOWEEKNUM(7)", 1.0, nullptr, false},
+      {"=WEEKNUM(7,11)", 2.0, nullptr, false},
+      {"=WEEKNUM(7,17)", 1.0, nullptr, false},
+      {"=TEXT(8,\"ddd\")", 0.0, "Sun", false},
+      {"=TEXT(8,\"dddd\")", 0.0, "Sunday", false},
+      {"=TEXT(8,\"aaa\")", 0.0, "日", false},
+      {"=WEEKNUM(8)", 2.0, nullptr, false},
+      {"=WEEKNUM(8,2)", 2.0, nullptr, false},
+      {"=WEEKNUM(8,21)", 1.0, nullptr, false},
+      {"=ISOWEEKNUM(8)", 1.0, nullptr, false},
+      {"=WEEKNUM(8,11)", 2.0, nullptr, false},
+      {"=WEEKNUM(8,17)", 2.0, nullptr, false},
+      {"=TEXT(14,\"ddd\")", 0.0, "Sat", false},
+      {"=TEXT(14,\"dddd\")", 0.0, "Saturday", false},
+      {"=TEXT(14,\"aaa\")", 0.0, "土", false},
+      {"=WEEKNUM(14)", 2.0, nullptr, false},
+      {"=WEEKNUM(14,2)", 3.0, nullptr, false},
+      {"=WEEKNUM(14,21)", 2.0, nullptr, false},
+      {"=ISOWEEKNUM(14)", 2.0, nullptr, false},
+      {"=WEEKNUM(14,11)", 3.0, nullptr, false},
+      {"=WEEKNUM(14,17)", 2.0, nullptr, false},
+      {"=TEXT(15,\"ddd\")", 0.0, "Sun", false},
+      {"=TEXT(15,\"dddd\")", 0.0, "Sunday", false},
+      {"=TEXT(15,\"aaa\")", 0.0, "日", false},
+      {"=WEEKNUM(15)", 3.0, nullptr, false},
+      {"=WEEKNUM(15,2)", 3.0, nullptr, false},
+      {"=WEEKNUM(15,21)", 2.0, nullptr, false},
+      {"=ISOWEEKNUM(15)", 2.0, nullptr, false},
+      {"=WEEKNUM(15,11)", 3.0, nullptr, false},
+      {"=WEEKNUM(15,17)", 3.0, nullptr, false},
+      {"=TEXT(59,\"ddd\")", 0.0, "Tue", false},
+      {"=TEXT(59,\"dddd\")", 0.0, "Tuesday", false},
+      {"=TEXT(59,\"aaa\")", 0.0, "火", false},
+      {"=WEEKNUM(59)", 9.0, nullptr, false},
+      {"=WEEKNUM(59,2)", 10.0, nullptr, false},
+      {"=WEEKNUM(59,21)", 9.0, nullptr, false},
+      {"=ISOWEEKNUM(59)", 9.0, nullptr, false},
+      {"=WEEKNUM(59,11)", 10.0, nullptr, false},
+      {"=WEEKNUM(59,17)", 9.0, nullptr, false},
+      {"=TEXT(60,\"ddd\")", 0.0, "Wed", false},
+      {"=TEXT(60,\"dddd\")", 0.0, "Wednesday", false},
+      {"=TEXT(60,\"aaa\")", 0.0, "水", false},
+      {"=WEEKNUM(60)", 9.0, nullptr, false},
+      {"=WEEKNUM(60,2)", 10.0, nullptr, false},
+      {"=WEEKNUM(60,21)", 9.0, nullptr, false},
+      {"=ISOWEEKNUM(60)", 9.0, nullptr, false},
+      {"=WEEKNUM(60,11)", 10.0, nullptr, false},
+      {"=WEEKNUM(60,17)", 9.0, nullptr, false},
+      {"=TEXT(61,\"ddd\")", 0.0, "Thu", false},
+      {"=TEXT(61,\"dddd\")", 0.0, "Thursday", false},
+      {"=TEXT(61,\"aaa\")", 0.0, "木", false},
+      {"=WEEKNUM(61)", 9.0, nullptr, false},
+      {"=WEEKNUM(61,2)", 10.0, nullptr, false},
+      {"=WEEKNUM(61,21)", 9.0, nullptr, false},
+      {"=ISOWEEKNUM(61)", 9.0, nullptr, false},
+      {"=WEEKNUM(61,11)", 10.0, nullptr, false},
+      {"=WEEKNUM(61,17)", 9.0, nullptr, false},
+      {"=TEXT(62,\"ddd\")", 0.0, "Fri", false},
+      {"=TEXT(62,\"dddd\")", 0.0, "Friday", false},
+      {"=TEXT(62,\"aaa\")", 0.0, "金", false},
+      {"=WEEKNUM(62)", 9.0, nullptr, false},
+      {"=WEEKNUM(62,2)", 10.0, nullptr, false},
+      {"=WEEKNUM(62,21)", 9.0, nullptr, false},
+      {"=ISOWEEKNUM(62)", 9.0, nullptr, false},
+      {"=WEEKNUM(62,11)", 10.0, nullptr, false},
+      {"=WEEKNUM(62,17)", 9.0, nullptr, false},
+      {"=TEXT(365,\"ddd\")", 0.0, "Sun", false},
+      {"=TEXT(365,\"dddd\")", 0.0, "Sunday", false},
+      {"=TEXT(365,\"aaa\")", 0.0, "日", false},
+      {"=WEEKNUM(365)", 53.0, nullptr, false},
+      {"=WEEKNUM(365,2)", 53.0, nullptr, false},
+      {"=WEEKNUM(365,21)", 52.0, nullptr, false},
+      {"=ISOWEEKNUM(365)", 52.0, nullptr, false},
+      {"=WEEKNUM(365,11)", 53.0, nullptr, false},
+      {"=WEEKNUM(365,17)", 53.0, nullptr, false},
+      {"=TEXT(366,\"ddd\")", 0.0, "Mon", false},
+      {"=TEXT(366,\"dddd\")", 0.0, "Monday", false},
+      {"=TEXT(366,\"aaa\")", 0.0, "月", false},
+      {"=WEEKNUM(366)", 53.0, nullptr, false},
+      {"=WEEKNUM(366,2)", 54.0, nullptr, false},
+      {"=WEEKNUM(366,21)", 1.0, nullptr, false},
+      {"=ISOWEEKNUM(366)", 1.0, nullptr, false},
+      {"=WEEKNUM(366,11)", 54.0, nullptr, false},
+      {"=WEEKNUM(366,17)", 53.0, nullptr, false},
+  };
+  for (const Case& c : kCases) {
+    const Value v = EvalSource(c.formula);
+    if (c.num_error) {
+      ASSERT_TRUE(v.is_error()) << c.formula;
+      EXPECT_EQ(v.as_error(), ErrorCode::Num) << c.formula;
+    } else if (c.text != nullptr) {
+      ASSERT_TRUE(v.is_text()) << c.formula;
+      EXPECT_EQ(v.as_text(), c.text) << c.formula;
+    } else {
+      ASSERT_TRUE(v.is_number()) << c.formula;
+      EXPECT_EQ(v.as_number(), c.number) << c.formula;
+    }
+  }
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_datetime_months_test.cpp b/tests/unit/eval/builtins_datetime_months_test.cpp
new file mode 100644
index 000000000..79c5370ac
--- /dev/null
+++ b/tests/unit/eval/builtins_datetime_months_test.cpp
@@ -0,0 +1,315 @@
+// End-to-end date/time built-in tests: month shifts and day differences.
+
+#include "builtins_datetime_test_helpers.h"
+namespace formulon {
+namespace eval {
+namespace {
+
+// ---------------------------------------------------------------------------
+// EDATE
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeEdate, ForwardMonths) {
+  // 2026-04-23 + 2 months -> 2026-06-23.
+  const Value a = EvalSource("=EDATE(DATE(2026, 4, 23), 2)");
+  const Value b = EvalSource("=DATE(2026, 6, 23)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEdate, BackwardMonths) {
+  // 2026-04-23 - 5 months -> 2025-11-23.
+  const Value a = EvalSource("=EDATE(DATE(2026, 4, 23), -5)");
+  const Value b = EvalSource("=DATE(2025, 11, 23)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEdate, Jan31PlusOneMonthInLeapYear) {
+  // 2024 is a leap year: Jan 31 + 1 month -> Feb 29.
+  const Value a = EvalSource("=EDATE(DATE(2024, 1, 31), 1)");
+  const Value b = EvalSource("=DATE(2024, 2, 29)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEdate, Jan31PlusOneMonthInNonLeapYear) {
+  // 2023 is not a leap year: Jan 31 + 1 month -> Feb 28.
+  const Value a = EvalSource("=EDATE(DATE(2023, 1, 31), 1)");
+  const Value b = EvalSource("=DATE(2023, 2, 28)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEdate, CrossYearBackwards) {
+  // 2026-01-15 - 13 months -> 2024-12-15.
+  const Value a = EvalSource("=EDATE(DATE(2026, 1, 15), -13)");
+  const Value b = EvalSource("=DATE(2024, 12, 15)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEdate, TruncatesMonthArgument) {
+  // `months = 2.9` truncates to 2.
+  const Value a = EvalSource("=EDATE(DATE(2026, 4, 23), 2.9)");
+  const Value b = EvalSource("=DATE(2026, 6, 23)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEdate, UpperEndpointWithZeroMonths) {
+  const Value v = EvalSource("=EDATE(DATE(9999, 12, 31), 0)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 2958465.0);
+}
+
+TEST(DateTimeEdate, CrossingUpperEndpointIsNum) {
+  const Value v = EvalSource("=EDATE(DATE(9999, 12, 1), 1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeEdate, InputOnePastUpperEndpointIsNum) {
+  const Value v = EvalSource("=EDATE(DATE(9999, 12, 31) + 1, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeEdate, AcceptsFinalDayTimeFraction) {
+  const Value endpoint = EvalSource("=EDATE(2958465.999988426, 0)");
+  ASSERT_TRUE(endpoint.is_number());
+  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2958465.0);
+}
+
+TEST(DateTimeEdate, FinalDayTimeFractionCannotCrossUpperEndpoint) {
+  const Value overflow = EvalSource("=EDATE(2958465.999988426, 1)");
+  ASSERT_TRUE(overflow.is_error());
+  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeEdate, GiganticMonthOffsetIsNum) {
+  const Value v = EvalSource("=EDATE(DATE(2024, 1, 1), 1E20)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeEdate, LeftmostErrorPrecedesGiganticMonthOffset) {
+  const Value v = EvalSource("=EDATE(1/0, 1E20)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
+}
+
+TEST(DateTimeEdate, LowerBoundaryWithZeroMonths) {
+  const Value v = EvalSource("=EDATE(DATE(1900, 1, 1), 0)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
+// ---------------------------------------------------------------------------
+// EOMONTH
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeEomonth, SameMonth) {
+  // EOMONTH(2026-04-10, 0) -> 2026-04-30.
+  const Value a = EvalSource("=EOMONTH(DATE(2026, 4, 10), 0)");
+  const Value b = EvalSource("=DATE(2026, 4, 30)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEomonth, LeapYearFebruary) {
+  // EOMONTH(2024-02-15, 0) -> 2024-02-29 (leap year).
+  const Value a = EvalSource("=EOMONTH(DATE(2024, 2, 15), 0)");
+  const Value b = EvalSource("=DATE(2024, 2, 29)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEomonth, NonLeapYearFebruary) {
+  const Value a = EvalSource("=EOMONTH(DATE(2023, 2, 15), 0)");
+  const Value b = EvalSource("=DATE(2023, 2, 28)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEomonth, ShiftsForward) {
+  // EOMONTH(2026-04-10, 2) -> 2026-06-30.
+  const Value a = EvalSource("=EOMONTH(DATE(2026, 4, 10), 2)");
+  const Value b = EvalSource("=DATE(2026, 6, 30)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEomonth, ShiftsBackward) {
+  // EOMONTH(2026-04-10, -1) -> 2026-03-31.
+  const Value a = EvalSource("=EOMONTH(DATE(2026, 4, 10), -1)");
+  const Value b = EvalSource("=DATE(2026, 3, 31)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEomonth, Century2100NotLeap) {
+  // 2100 is divisible by 100 but not 400 -> NOT a leap year.
+  const Value a = EvalSource("=EOMONTH(DATE(2100, 2, 15), 0)");
+  const Value b = EvalSource("=DATE(2100, 2, 28)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+TEST(DateTimeEomonth, RejectsBooleanArgument) {
+  // Excel 365 rejects Booleans in EOMONTH with #VALUE! (unlike EDATE, which
+  // coerces them to 0/1). Guard both positional arguments.
+  const Value v_start = EvalSource("=EOMONTH(TRUE, 0)");
+  ASSERT_TRUE(v_start.is_error());
+  EXPECT_EQ(v_start.as_error(), ErrorCode::Value);
+
+  const Value v_months = EvalSource("=EOMONTH(44987, TRUE)");
+  ASSERT_TRUE(v_months.is_error());
+  EXPECT_EQ(v_months.as_error(), ErrorCode::Value);
+}
+
+TEST(DateTimeEomonth, UpperEndpointWithZeroMonths) {
+  const Value v = EvalSource("=EOMONTH(DATE(9999, 12, 1), 0)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 2958465.0);
+}
+
+TEST(DateTimeEomonth, CrossingUpperEndpointIsNum) {
+  const Value v = EvalSource("=EOMONTH(DATE(9999, 12, 1), 1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeEomonth, AcceptsFinalDayTimeFraction) {
+  const Value endpoint = EvalSource("=EOMONTH(2958465.999988426, 0)");
+  ASSERT_TRUE(endpoint.is_number());
+  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2958465.0);
+}
+
+TEST(DateTimeEomonth, FinalDayTimeFractionCannotCrossUpperEndpoint) {
+  const Value overflow = EvalSource("=EOMONTH(2958465.999988426, 1)");
+  ASSERT_TRUE(overflow.is_error());
+  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeEomonth, LowerBoundaryPreviousMonthIsZero) {
+  const Value v = EvalSource("=EOMONTH(1, -1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(DateTimeEomonth, GiganticMonthOffsetIsNum) {
+  const Value v = EvalSource("=EOMONTH(DATE(2024, 1, 1), 1E20)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(DateTimeEomonth, BooleanPrecedenceBeatsGiganticMonthOffset) {
+  const Value v = EvalSource("=EOMONTH(TRUE, 1E20)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(DateTimeEomonth, Century2000IsLeap) {
+  // 2000 is divisible by 400 -> IS a leap year.
+  const Value a = EvalSource("=EOMONTH(DATE(2000, 2, 15), 0)");
+  const Value b = EvalSource("=DATE(2000, 2, 29)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_EQ(a.as_number(), b.as_number());
+}
+
+// ---------------------------------------------------------------------------
+// DAYS
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeDays, PositiveDiff) {
+  const Value v = EvalSource("=DAYS(DATE(2026, 4, 23), DATE(2026, 4, 20))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 3.0);
+}
+
+TEST(DateTimeDays, ZeroDiff) {
+  const Value v = EvalSource("=DAYS(DATE(2026, 4, 23), DATE(2026, 4, 23))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 0.0);
+}
+
+TEST(DateTimeDays, NegativeDiff) {
+  const Value v = EvalSource("=DAYS(DATE(2026, 4, 20), DATE(2026, 4, 23))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), -3.0);
+}
+
+TEST(DateTimeDays, CrossYear) {
+  // 2026-01-01 minus 2025-12-31 = 1 day.
+  const Value v = EvalSource("=DAYS(DATE(2026, 1, 1), DATE(2025, 12, 31))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 1.0);
+}
+
+TEST(DateTimeDays, IgnoresFractionalPart) {
+  // DAYS floors both operands, so a fractional serial should not leak in.
+  const Value v = EvalSource("=DAYS(DATE(2026, 4, 23) + 0.9, DATE(2026, 4, 20) + 0.1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 3.0);
+}
+
+TEST(DateTimeDays, ErrorPropagates) {
+  const Value v = EvalSource("=DAYS(\"abc\", DATE(2026, 4, 23))");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(DateTimeDays, OutOfRangeSerialIsNum) {
+  // A serial far beyond Excel's max date (9999-12-31 = 2958465) must be
+  // rejected with #NUM! rather than reaching the int64 cast in
+  // ymd_from_serial with undefined behavior.
+  const Value v = EvalSource("=DAYS(1E300, DATE(2026, 4, 23))");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+// ---------------------------------------------------------------------------
+// Round-trip sanity checks combining DATE with extractors.
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeRoundTrip, DateExtractsItself) {
+  const Value y = EvalSource("=YEAR(DATE(1995, 7, 4))");
+  const Value m = EvalSource("=MONTH(DATE(1995, 7, 4))");
+  const Value d = EvalSource("=DAY(DATE(1995, 7, 4))");
+  ASSERT_TRUE(y.is_number());
+  ASSERT_TRUE(m.is_number());
+  ASSERT_TRUE(d.is_number());
+  EXPECT_EQ(y.as_number(), 1995.0);
+  EXPECT_EQ(m.as_number(), 7.0);
+  EXPECT_EQ(d.as_number(), 4.0);
+}
+
+TEST(DateTimeRoundTrip, TimeExtractsItself) {
+  const Value h = EvalSource("=HOUR(TIME(7, 15, 30))");
+  const Value m = EvalSource("=MINUTE(TIME(7, 15, 30))");
+  const Value s = EvalSource("=SECOND(TIME(7, 15, 30))");
+  ASSERT_TRUE(h.is_number());
+  ASSERT_TRUE(m.is_number());
+  ASSERT_TRUE(s.is_number());
+  EXPECT_EQ(h.as_number(), 7.0);
+  EXPECT_EQ(m.as_number(), 15.0);
+  EXPECT_EQ(s.as_number(), 30.0);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_datetime_test.cpp b/tests/unit/eval/builtins_datetime_test.cpp
index 33c67b6bd..e6a4fa32f 100644
--- a/tests/unit/eval/builtins_datetime_test.cpp
+++ b/tests/unit/eval/builtins_datetime_test.cpp
@@ -1,101 +1,69 @@
-//
-// End-to-end tests for the date/time built-ins: DATE, TIME, YEAR, MONTH,
-// DAY, HOUR, MINUTE, SECOND, WEEKDAY, EDATE, EOMONTH, DAYS, WEEKNUM,
-// ISOWEEKNUM, YEARFRAC, DATEDIF, NETWORKDAYS, WORKDAY. Each test parses a
-// formula source, evaluates the AST through the default registry, and
-// asserts the resulting Value. NETWORKDAYS and WORKDAY tests use a bound
-// workbook so they can exercise range-sourced holiday lists.
-//
-// Serial values used in the assertions below were cross-checked by
-// independently running Howard Hinnant's `days_from_civil` algorithm and
-// adding the +25569 post-ghost / +25568 pre-ghost offsets (see
-// `src/eval/date_time.cpp`). Example landmarks:
-//
-//   DATE(1900, 1, 1)  =     1   (first Excel serial, pre-ghost)
-//   DATE(1900, 2, 28) =    59   (last pre-ghost real day)
-//   DATE(1900, 3, 1)  =    61   (first post-ghost day -- serial 60 is the
-//                                fictional 1900-02-29 preserved from
-//                                Lotus 1-2-3's leap-year bug)
-//   DATE(2024, 2, 29) = 45351   (actual leap day, 2024 leap year)
-//   DATE(2026, 4, 23) = 46135   (today's date per CLAUDE.md currentDate)
-
-#include <cmath>
-#include <string>
-#include <string_view>
-
-#include "eval/eval_context.h"
-#include "eval/eval_state.h"
-#include "eval/function_registry.h"
-#include "eval/tree_walker.h"
-#include "gtest/gtest.h"
-#include "parser/ast.h"
-#include "parser/parser.h"
-#include "sheet.h"
-#include "test_eval_helpers.h"
-#include "utils/arena.h"
-#include "value.h"
-#include "workbook.h"
+// End-to-end date/time built-in tests: constructors and extractors.
 
+#include <limits>
+#include <utility>
+
+#include "builtins_datetime_test_helpers.h"
 namespace formulon {
 namespace eval {
 namespace {
 
-// Parses `src` and evaluates it via the default function registry. The
-// thread-local arenas keep text payloads readable for the immediately
-// following EXPECT_*. Each call resets the arenas to avoid cross-test
-// contamination.
-Value EvalSource(std::string_view src) {
-  static thread_local Arena parse_arena;
-  static thread_local Arena eval_arena;
-  parse_arena.reset();
-  eval_arena.reset();
-  parser::Parser p(src, parse_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
+// ---------------------------------------------------------------------------
+// DATE
+// ---------------------------------------------------------------------------
+
+TEST(DateTimeTime, OverflowingComponentsReturnNumError) {
+  for (const char* formula : {"=TIME(1E308,0,0)", "=TIME(0,1E308,0)", "=TIME(1E308,-1E308,0)"}) {
+    SCOPED_TRACE(formula);
+    const Value value = EvalSource(formula);
+    ASSERT_TRUE(value.is_error());
+    EXPECT_EQ(value.as_error(), ErrorCode::Num);
   }
-  return evaluate(*root, eval_arena, default_registry(), test::mac_context());
+  const Value carry = EvalSource("=TIME(25,0,0)");
+  ASSERT_TRUE(carry.is_number());
+  EXPECT_DOUBLE_EQ(carry.as_number(), 1.0 / 24.0);
 }
 
-// Bound-workbook variant used by NETWORKDAYS / WORKDAY tests: lets A1-style
-// refs in the formula resolve against the sheet's live cells so range-
-// sourced holiday lists exercise the same path as real workbooks.
-Value EvalSourceIn(std::string_view src, const Workbook& wb, const Sheet& current) {
-  static thread_local Arena parse_arena;
-  static thread_local Arena eval_arena;
-  parse_arena.reset();
-  eval_arena.reset();
-  parser::Parser p(src, parse_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
+TEST(DateTimeTime, ComponentUpperBoundsApplyBeforeDayWrapping) {
+  for (const char* formula : {"=TIME(32768,0,0)", "=TIME(0,32768,0)", "=TIME(0,0,32768)", "=TIME(0,0,1E308)"}) {
+    SCOPED_TRACE(formula);
+    const Value value = EvalSource(formula);
+    ASSERT_TRUE(value.is_error());
+    EXPECT_EQ(value.as_error(), ErrorCode::Num);
+  }
+  for (const auto& row :
+       {std::pair{"=TIME(32767,0,0)", 7.0 / 24.0},
+        std::pair{"=TIME(0,32767,0)", (32767.0 * 60.0 - 22.0 * 86400.0) / 86400.0},
+        std::pair{"=TIME(0,0,32767)", 32767.0 / 86400.0}, std::pair{"=TIME(32767.9,0,0)", 7.0 / 24.0}}) {
+    SCOPED_TRACE(row.first);
+    const Value value = EvalSource(row.first);
+    ASSERT_TRUE(value.is_number());
+    EXPECT_DOUBLE_EQ(value.as_number(), row.second);
   }
-  EvalState state;
-  const EvalContext ctx(wb, current, state);
-  return evaluate(*root, eval_arena, default_registry(), ctx);
 }
 
-// Evaluates `src` under the 1904 date system (the calendar family reads the
-// epoch from `EvalContext::date1904()`).
-Value EvalSource1904(std::string_view src) {
-  static thread_local Arena parse_arena;
-  static thread_local Arena eval_arena;
-  parse_arena.reset();
-  eval_arena.reset();
-  parser::Parser p(src, parse_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
+TEST(DateTimeNumericSafety, NonFiniteCellTimesReturnNumError) {
+  Workbook workbook = Workbook::create();
+  for (double input : {std::numeric_limits<double>::quiet_NaN(), std::numeric_limits<double>::infinity(),
+                       -std::numeric_limits<double>::infinity()}) {
+    workbook.sheet(0).set_cell_value(0, 0, Value::number(input));
+    for (const char* formula : {"=HOUR(A1)", "=MINUTE(A1)", "=SECOND(A1)"}) {
+      const Value value = EvalSourceIn(formula, workbook, workbook.sheet(0));
+      ASSERT_TRUE(value.is_error()) << formula;
+      EXPECT_EQ(value.as_error(), ErrorCode::Num);
+    }
   }
-  return evaluate(*root, eval_arena, default_registry(), test::mac_context().with_date1904(true));
 }
 
-// ---------------------------------------------------------------------------
-// DATE
-// ---------------------------------------------------------------------------
+TEST(DateTimeNumericSafety, HugeSelectorsReturnNumError) {
+  for (const char* formula : {"=WEEKDAY(1,1E300)", "=WEEKDAY(1,-1E300)", "=WEEKNUM(1,1E300)", "=WEEKNUM(1,-1E300)",
+                              "=YEARFRAC(1,2,1E300)", "=YEARFRAC(1,2,-1E300)"}) {
+    SCOPED_TRACE(formula);
+    const Value value = EvalSource(formula);
+    ASSERT_TRUE(value.is_error());
+    EXPECT_EQ(value.as_error(), ErrorCode::Num);
+  }
+}
 
 TEST(DateTimeDate, CurrentDateSerial) {
   const Value v = EvalSource("=DATE(2026, 4, 23)");
@@ -493,1783 +461,6 @@ TEST(DateTimeWeekday, UnsupportedTypeIsNum) {
   EXPECT_EQ(v.as_error(), ErrorCode::Num);
 }
 
-// ---------------------------------------------------------------------------
-// EDATE
-// ---------------------------------------------------------------------------
-
-TEST(DateTimeEdate, ForwardMonths) {
-  // 2026-04-23 + 2 months -> 2026-06-23.
-  const Value a = EvalSource("=EDATE(DATE(2026, 4, 23), 2)");
-  const Value b = EvalSource("=DATE(2026, 6, 23)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEdate, BackwardMonths) {
-  // 2026-04-23 - 5 months -> 2025-11-23.
-  const Value a = EvalSource("=EDATE(DATE(2026, 4, 23), -5)");
-  const Value b = EvalSource("=DATE(2025, 11, 23)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEdate, Jan31PlusOneMonthInLeapYear) {
-  // 2024 is a leap year: Jan 31 + 1 month -> Feb 29.
-  const Value a = EvalSource("=EDATE(DATE(2024, 1, 31), 1)");
-  const Value b = EvalSource("=DATE(2024, 2, 29)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEdate, Jan31PlusOneMonthInNonLeapYear) {
-  // 2023 is not a leap year: Jan 31 + 1 month -> Feb 28.
-  const Value a = EvalSource("=EDATE(DATE(2023, 1, 31), 1)");
-  const Value b = EvalSource("=DATE(2023, 2, 28)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEdate, CrossYearBackwards) {
-  // 2026-01-15 - 13 months -> 2024-12-15.
-  const Value a = EvalSource("=EDATE(DATE(2026, 1, 15), -13)");
-  const Value b = EvalSource("=DATE(2024, 12, 15)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEdate, TruncatesMonthArgument) {
-  // `months = 2.9` truncates to 2.
-  const Value a = EvalSource("=EDATE(DATE(2026, 4, 23), 2.9)");
-  const Value b = EvalSource("=DATE(2026, 6, 23)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEdate, UpperEndpointWithZeroMonths) {
-  const Value v = EvalSource("=EDATE(DATE(9999, 12, 31), 0)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 2958465.0);
-}
-
-TEST(DateTimeEdate, CrossingUpperEndpointIsNum) {
-  const Value v = EvalSource("=EDATE(DATE(9999, 12, 1), 1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeEdate, InputOnePastUpperEndpointIsNum) {
-  const Value v = EvalSource("=EDATE(DATE(9999, 12, 31) + 1, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeEdate, AcceptsFinalDayTimeFraction) {
-  const Value endpoint = EvalSource("=EDATE(2958465.999988426, 0)");
-  ASSERT_TRUE(endpoint.is_number());
-  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2958465.0);
-}
-
-TEST(DateTimeEdate, FinalDayTimeFractionCannotCrossUpperEndpoint) {
-  const Value overflow = EvalSource("=EDATE(2958465.999988426, 1)");
-  ASSERT_TRUE(overflow.is_error());
-  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeEdate, GiganticMonthOffsetIsNum) {
-  const Value v = EvalSource("=EDATE(DATE(2024, 1, 1), 1E20)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeEdate, LeftmostErrorPrecedesGiganticMonthOffset) {
-  const Value v = EvalSource("=EDATE(1/0, 1E20)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
-}
-
-TEST(DateTimeEdate, LowerBoundaryWithZeroMonths) {
-  const Value v = EvalSource("=EDATE(DATE(1900, 1, 1), 0)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
-}
-
-// ---------------------------------------------------------------------------
-// EOMONTH
-// ---------------------------------------------------------------------------
-
-TEST(DateTimeEomonth, SameMonth) {
-  // EOMONTH(2026-04-10, 0) -> 2026-04-30.
-  const Value a = EvalSource("=EOMONTH(DATE(2026, 4, 10), 0)");
-  const Value b = EvalSource("=DATE(2026, 4, 30)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEomonth, LeapYearFebruary) {
-  // EOMONTH(2024-02-15, 0) -> 2024-02-29 (leap year).
-  const Value a = EvalSource("=EOMONTH(DATE(2024, 2, 15), 0)");
-  const Value b = EvalSource("=DATE(2024, 2, 29)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEomonth, NonLeapYearFebruary) {
-  const Value a = EvalSource("=EOMONTH(DATE(2023, 2, 15), 0)");
-  const Value b = EvalSource("=DATE(2023, 2, 28)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEomonth, ShiftsForward) {
-  // EOMONTH(2026-04-10, 2) -> 2026-06-30.
-  const Value a = EvalSource("=EOMONTH(DATE(2026, 4, 10), 2)");
-  const Value b = EvalSource("=DATE(2026, 6, 30)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEomonth, ShiftsBackward) {
-  // EOMONTH(2026-04-10, -1) -> 2026-03-31.
-  const Value a = EvalSource("=EOMONTH(DATE(2026, 4, 10), -1)");
-  const Value b = EvalSource("=DATE(2026, 3, 31)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEomonth, Century2100NotLeap) {
-  // 2100 is divisible by 100 but not 400 -> NOT a leap year.
-  const Value a = EvalSource("=EOMONTH(DATE(2100, 2, 15), 0)");
-  const Value b = EvalSource("=DATE(2100, 2, 28)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeEomonth, RejectsBooleanArgument) {
-  // Excel 365 rejects Booleans in EOMONTH with #VALUE! (unlike EDATE, which
-  // coerces them to 0/1). Guard both positional arguments.
-  const Value v_start = EvalSource("=EOMONTH(TRUE, 0)");
-  ASSERT_TRUE(v_start.is_error());
-  EXPECT_EQ(v_start.as_error(), ErrorCode::Value);
-
-  const Value v_months = EvalSource("=EOMONTH(44987, TRUE)");
-  ASSERT_TRUE(v_months.is_error());
-  EXPECT_EQ(v_months.as_error(), ErrorCode::Value);
-}
-
-TEST(DateTimeEomonth, UpperEndpointWithZeroMonths) {
-  const Value v = EvalSource("=EOMONTH(DATE(9999, 12, 1), 0)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 2958465.0);
-}
-
-TEST(DateTimeEomonth, CrossingUpperEndpointIsNum) {
-  const Value v = EvalSource("=EOMONTH(DATE(9999, 12, 1), 1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeEomonth, AcceptsFinalDayTimeFraction) {
-  const Value endpoint = EvalSource("=EOMONTH(2958465.999988426, 0)");
-  ASSERT_TRUE(endpoint.is_number());
-  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2958465.0);
-}
-
-TEST(DateTimeEomonth, FinalDayTimeFractionCannotCrossUpperEndpoint) {
-  const Value overflow = EvalSource("=EOMONTH(2958465.999988426, 1)");
-  ASSERT_TRUE(overflow.is_error());
-  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeEomonth, LowerBoundaryPreviousMonthIsZero) {
-  const Value v = EvalSource("=EOMONTH(1, -1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(DateTimeEomonth, GiganticMonthOffsetIsNum) {
-  const Value v = EvalSource("=EOMONTH(DATE(2024, 1, 1), 1E20)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeEomonth, BooleanPrecedenceBeatsGiganticMonthOffset) {
-  const Value v = EvalSource("=EOMONTH(TRUE, 1E20)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(DateTimeEomonth, Century2000IsLeap) {
-  // 2000 is divisible by 400 -> IS a leap year.
-  const Value a = EvalSource("=EOMONTH(DATE(2000, 2, 15), 0)");
-  const Value b = EvalSource("=DATE(2000, 2, 29)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-// ---------------------------------------------------------------------------
-// DAYS
-// ---------------------------------------------------------------------------
-
-TEST(DateTimeDays, PositiveDiff) {
-  const Value v = EvalSource("=DAYS(DATE(2026, 4, 23), DATE(2026, 4, 20))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 3.0);
-}
-
-TEST(DateTimeDays, ZeroDiff) {
-  const Value v = EvalSource("=DAYS(DATE(2026, 4, 23), DATE(2026, 4, 23))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 0.0);
-}
-
-TEST(DateTimeDays, NegativeDiff) {
-  const Value v = EvalSource("=DAYS(DATE(2026, 4, 20), DATE(2026, 4, 23))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), -3.0);
-}
-
-TEST(DateTimeDays, CrossYear) {
-  // 2026-01-01 minus 2025-12-31 = 1 day.
-  const Value v = EvalSource("=DAYS(DATE(2026, 1, 1), DATE(2025, 12, 31))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 1.0);
-}
-
-TEST(DateTimeDays, IgnoresFractionalPart) {
-  // DAYS floors both operands, so a fractional serial should not leak in.
-  const Value v = EvalSource("=DAYS(DATE(2026, 4, 23) + 0.9, DATE(2026, 4, 20) + 0.1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 3.0);
-}
-
-TEST(DateTimeDays, ErrorPropagates) {
-  const Value v = EvalSource("=DAYS(\"abc\", DATE(2026, 4, 23))");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(DateTimeDays, OutOfRangeSerialIsNum) {
-  // A serial far beyond Excel's max date (9999-12-31 = 2958465) must be
-  // rejected with #NUM! rather than reaching the int64 cast in
-  // ymd_from_serial with undefined behavior.
-  const Value v = EvalSource("=DAYS(1E300, DATE(2026, 4, 23))");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// Round-trip sanity checks combining DATE with extractors.
-// ---------------------------------------------------------------------------
-
-TEST(DateTimeRoundTrip, DateExtractsItself) {
-  const Value y = EvalSource("=YEAR(DATE(1995, 7, 4))");
-  const Value m = EvalSource("=MONTH(DATE(1995, 7, 4))");
-  const Value d = EvalSource("=DAY(DATE(1995, 7, 4))");
-  ASSERT_TRUE(y.is_number());
-  ASSERT_TRUE(m.is_number());
-  ASSERT_TRUE(d.is_number());
-  EXPECT_EQ(y.as_number(), 1995.0);
-  EXPECT_EQ(m.as_number(), 7.0);
-  EXPECT_EQ(d.as_number(), 4.0);
-}
-
-TEST(DateTimeRoundTrip, TimeExtractsItself) {
-  const Value h = EvalSource("=HOUR(TIME(7, 15, 30))");
-  const Value m = EvalSource("=MINUTE(TIME(7, 15, 30))");
-  const Value s = EvalSource("=SECOND(TIME(7, 15, 30))");
-  ASSERT_TRUE(h.is_number());
-  ASSERT_TRUE(m.is_number());
-  ASSERT_TRUE(s.is_number());
-  EXPECT_EQ(h.as_number(), 7.0);
-  EXPECT_EQ(m.as_number(), 15.0);
-  EXPECT_EQ(s.as_number(), 30.0);
-}
-
-// ---------------------------------------------------------------------------
-// WEEKNUM / ISOWEEKNUM
-// ---------------------------------------------------------------------------
-
-TEST(DateTimeWeeknum, DefaultSundayType) {
-  // 2024-01-01 is a Monday. Default return_type=1 (Sunday start); week 1
-  // contains Jan 1, Jan 1 itself is the second day of that week.
-  const Value v = EvalSource("=WEEKNUM(DATE(2024,1,1))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 1.0);
-}
-
-TEST(DateTimeWeeknum, MidYearDefault) {
-  // 2024-07-04 is a Thursday of ISO week 27; return_type=1 (Sun start)
-  // yields 27 as well.
-  const Value v = EvalSource("=WEEKNUM(DATE(2024,7,4))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 27.0);
-}
-
-TEST(DateTimeWeeknum, MondayTypeTwo) {
-  // 2024-01-01 is a Monday; with return_type=2 (Mon start) it is the
-  // first day of week 1.
-  const Value v = EvalSource("=WEEKNUM(DATE(2024,1,1),2)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 1.0);
-}
-
-TEST(DateTimeWeeknum, Iso21Matches2024Jan1) {
-  // ISO 8601: 2024-01-01 is a Monday -> week 1 of 2024.
-  const Value v = EvalSource("=WEEKNUM(DATE(2024,1,1),21)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 1.0);
-}
-
-TEST(DateTimeWeeknum, Iso21_2023Jan1_RollsToPrevYear) {
-  // 2023-01-01 is a Sunday -> ISO week 52 of 2022.
-  const Value v = EvalSource("=WEEKNUM(DATE(2023,1,1),21)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 52.0);
-}
-
-// Windows Excel 365 (the primary reference) rejects an unsupported
-// return_type with #NUM!; only 1, 2, 11..17 and 21 are accepted.
-TEST(DateTimeWeeknum, InvalidReturnTypeIsNum) {
-  for (const char* src :
-       {"=WEEKNUM(DATE(2024,1,1),99)", "=WEEKNUM(DATE(2024,1,1),0)", "=WEEKNUM(DATE(2024,1,1),3)",
-        "=WEEKNUM(DATE(2024,1,1),10)", "=WEEKNUM(DATE(2024,1,1),18)", "=WEEKNUM(DATE(2024,1,1),22)"}) {
-    const Value v = EvalSource(src);
-    ASSERT_TRUE(v.is_error()) << src;
-    EXPECT_EQ(v.as_error(), ErrorCode::Num) << src;
-  }
-}
-
-TEST(DateTimeWeeknum, EveryAcceptedReturnTypeComputes) {
-  for (const char* src :
-       {"=WEEKNUM(DATE(2024,1,1),1)", "=WEEKNUM(DATE(2024,1,1),2)", "=WEEKNUM(DATE(2024,1,1),11)",
-        "=WEEKNUM(DATE(2024,1,1),17)", "=WEEKNUM(DATE(2024,1,1),21)", "=WEEKNUM(DATE(2024,1,1),11.9)"}) {
-    EXPECT_TRUE(EvalSource(src).is_number()) << src;
-  }
-}
-
-TEST(DateTimeWeeknum, NegativeSerialIsNum) {
-  const Value v = EvalSource("=WEEKNUM(-1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeIsoWeeknum, MidYear) {
-  // 2024-07-04 -> ISO week 27.
-  const Value v = EvalSource("=ISOWEEKNUM(DATE(2024,7,4))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 27.0);
-}
-
-TEST(DateTimeIsoWeeknum, Jan1_2023_IsWeek52OfPrevYear) {
-  const Value v = EvalSource("=ISOWEEKNUM(DATE(2023,1,1))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 52.0);
-}
-
-TEST(DateTimeIsoWeeknum, Dec31_2024_IsWeek1OfNextYear) {
-  // 2024-12-31 is a Tuesday -> ISO week 1 of 2025.
-  const Value v = EvalSource("=ISOWEEKNUM(DATE(2024,12,31))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 1.0);
-}
-
-// ---------------------------------------------------------------------------
-// YEARFRAC
-// ---------------------------------------------------------------------------
-
-TEST(DateTimeYearfrac, Basis0_US30_360_HalfYear) {
-  // 2024-01-01 -> 2024-07-01 under 30/360 = 180/360 = 0.5 exactly.
-  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),0)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.5, 1e-12);
-}
-
-TEST(DateTimeYearfrac, Basis1_ActualActual_OneFullLeapYear) {
-  // 2023-01-01 -> 2024-01-01 exact anniversary spanning 365 days across
-  // two calendar years -> 1.0 under the avg-year rule.
-  const Value v = EvalSource("=YEARFRAC(DATE(2023,1,1),DATE(2024,1,1),1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
-}
-
-TEST(DateTimeYearfrac, Basis1_ActualActual_OneYearSpanEnclosingFeb29) {
-  // 2020-01-01 -> 2021-01-01 is exactly one year and encloses 2020-02-29, so
-  // the denominator is the single leap year length 366 (not the multi-year
-  // average 365.5): 366/366 = 1.0 exactly. Regression for the actual/actual
-  // leap-year bug (previously 1.0013679890560876).
-  const Value v = EvalSource("=YEARFRAC(DATE(2020,1,1),DATE(2021,1,1),1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
-}
-
-TEST(DateTimeYearfrac, Basis1_ActualActual_OneYearSpanAnniversaryEnclosingFeb29) {
-  // 2019-03-01 -> 2020-03-01 is a one-year span whose interval includes
-  // 2020-02-29, so the denominator is 366 and the fraction is exactly 1.0.
-  const Value v = EvalSource("=YEARFRAC(DATE(2019,3,1),DATE(2020,3,1),1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
-}
-
-TEST(DateTimeYearfrac, Basis1_ActualActual_NonLeapOneYearSpan) {
-  // 2021-01-01 -> 2022-01-01: neither year is leap, span is one year -> 1.0.
-  const Value v = EvalSource("=YEARFRAC(DATE(2021,1,1),DATE(2022,1,1),1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
-}
-
-TEST(DateTimeYearfrac, Basis1_ActualActual_MultiYearAveragesFullYearLengths) {
-  // Spans longer than one year divide by the average full length of the
-  // years y1..y2, even when the leap year's Feb 29 lies outside the span.
-  // Values captured from Excel 365.
-  const Value leap_start = EvalSource("=YEARFRAC(DATE(2024,3,1),DATE(2026,6,1),1)");
-  ASSERT_TRUE(leap_start.is_number());
-  EXPECT_EQ(leap_start.as_number(), 2.25);
-  const Value leap_end = EvalSource("=YEARFRAC(DATE(2022,6,1),DATE(2024,2,1),1)");
-  ASSERT_TRUE(leap_end.is_number());
-  EXPECT_EQ(leap_end.as_number(), 1.6697080291970803);
-  const Value contains = EvalSource("=YEARFRAC(DATE(2023,6,1),DATE(2025,6,1),1)");
-  ASSERT_TRUE(contains.is_number());
-  EXPECT_EQ(contains.as_number(), 2.0009124087591244);
-}
-
-TEST(DateTimeYearfrac, Basis2_Actual360_HalfLeapYear) {
-  // 2024-01-01 -> 2024-07-01 is 182 days in 2024; 182/360.
-  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),2)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 182.0 / 360.0, 1e-12);
-}
-
-TEST(DateTimeYearfrac, Basis3_Actual365_HalfLeapYear) {
-  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),3)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 182.0 / 365.0, 1e-12);
-}
-
-TEST(DateTimeYearfrac, Basis4_EU30_360_HalfYear) {
-  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),4)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.5, 1e-12);
-}
-
-TEST(DateTimeYearfrac, NegativeIntervalSwaps) {
-  // Oracle-documented behaviour: YEARFRAC is symmetric in its first two
-  // args (positive regardless of order).
-  const Value a = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),0)");
-  const Value b = EvalSource("=YEARFRAC(DATE(2024,7,1),DATE(2024,1,1),0)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_EQ(a.as_number(), b.as_number());
-}
-
-TEST(DateTimeYearfrac, InvalidBasisIsNum) {
-  const Value v = EvalSource("=YEARFRAC(DATE(2024,1,1),DATE(2024,7,1),5)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// DATEDIF
-// ---------------------------------------------------------------------------
-
-TEST(DateTimeDatedif, YearsBetween) {
-  const Value v = EvalSource("=DATEDIF(DATE(2020,3,15),DATE(2024,7,1),\"Y\")");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 4.0);
-}
-
-TEST(DateTimeDatedif, MonthsBetween) {
-  // 2024-01-15 -> 2024-07-01: 5 complete months (d2 < d1 shaves one off).
-  const Value v = EvalSource("=DATEDIF(DATE(2024,1,15),DATE(2024,7,1),\"M\")");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 5.0);
-}
-
-TEST(DateTimeDatedif, DaysBetween) {
-  const Value v = EvalSource("=DATEDIF(DATE(2024,1,1),DATE(2024,1,15),\"D\")");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 14.0);
-}
-
-TEST(DateTimeDatedif, YmIgnoresYears) {
-  // 4 years 3 months 16 days -> YM = 3.
-  const Value v = EvalSource("=DATEDIF(DATE(2020,3,15),DATE(2024,7,1),\"YM\")");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 3.0);
-}
-
-TEST(DateTimeDatedif, YdIgnoresYearsSameCalendarPosition) {
-  // Same month/day pair: YD = 0 when the calendar positions align.
-  const Value v = EvalSource("=DATEDIF(DATE(2020,3,15),DATE(2024,3,15),\"YD\")");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 0.0);
-}
-
-TEST(DateTimeDatedif, MdDayOnlyDiff) {
-  // Same day-of-month -> MD = 0.
-  const Value v = EvalSource("=DATEDIF(DATE(2024,1,15),DATE(2024,7,15),\"MD\")");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 0.0);
-}
-
-TEST(DateTimeDatedif, EndBeforeStartIsNum) {
-  const Value v = EvalSource("=DATEDIF(DATE(2024,7,1),DATE(2020,3,15),\"Y\")");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeDatedif, UnknownUnitIsNum) {
-  const Value v = EvalSource("=DATEDIF(DATE(2024,1,1),DATE(2024,12,31),\"X\")");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeDatedif, UnitTokensAreCaseInsensitive) {
-  struct Case {
-    std::string_view unit;
-    std::string_view start;
-    std::string_view end;
-    double expected;
-  };
-  const Case cases[] = {
-      {"y", "DATE(2020,3,15)", "DATE(2024,7,1)", 4.0},   {"m", "DATE(2024,1,15)", "DATE(2024,7,1)", 5.0},
-      {"d", "DATE(2024,1,1)", "DATE(2024,1,15)", 14.0},  {"yM", "DATE(2020,3,15)", "DATE(2024,7,1)", 3.0},
-      {"Yd", "DATE(2020,3,15)", "DATE(2024,3,15)", 0.0}, {"mD", "DATE(2024,1,15)", "DATE(2024,7,15)", 0.0},
-  };
-  for (const Case& test : cases) {
-    const std::string formula =
-        "=DATEDIF(" + std::string(test.start) + "," + std::string(test.end) + ",\"" + std::string(test.unit) + "\")";
-    const Value v = EvalSource(formula);
-    ASSERT_TRUE(v.is_number()) << formula << ": " << v.debug_to_string();
-    EXPECT_DOUBLE_EQ(v.as_number(), test.expected) << formula;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// NETWORKDAYS / WORKDAY
-// ---------------------------------------------------------------------------
-
-TEST(DateTimeNetworkdays, OneCompleteWeek) {
-  // 2024-01-01 (Mon) .. 2024-01-05 (Fri) inclusive -> 5 business days.
-  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,5))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 5.0);
-}
-
-TEST(DateTimeNetworkdays, TwoCompleteWeeks) {
-  // 2024-01-01 .. 2024-01-12 (Fri) inclusive -> 10 business days.
-  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,12))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 10.0);
-}
-
-TEST(DateTimeNetworkdays, SingleWeekdayIsOne) {
-  // Mon .. Mon same day -> 1.
-  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,1))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 1.0);
-}
-
-TEST(DateTimeNetworkdays, SingleSaturdayIsZero) {
-  // 2024-01-06 is a Saturday. A weekend-only interval counts as zero.
-  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,6),DATE(2024,1,6))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 0.0);
-}
-
-TEST(DateTimeNetworkdays, ArrayLiteralHolidays) {
-  // Drop Jan 1 and Jan 2 via an inline array literal; 2024-01-01..01-05
-  // has 5 business days, minus 2 holidays -> 3.
-  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,5),{45292,45293})");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 3.0);
-}
-
-TEST(DateTimeNetworkdays, RangeHolidays) {
-  // Same setup as above but sourced from A1:A2 on a bound sheet.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(45292.0));  // 2024-01-01
-  wb.sheet(0).set_cell_value(1, 0, Value::number(45293.0));  // 2024-01-02
-  const Value v = EvalSourceIn("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,5),A1:A2)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 3.0);
-}
-
-TEST(DateTimeNetworkdays, ReversedRangeNegates) {
-  // Excel 365 returns the negated business-day count when start > end.
-  const Value v = EvalSource("=NETWORKDAYS(DATE(2024,1,5),DATE(2024,1,1))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), -5.0);
-}
-
-TEST(DateTimeNetworkdays, ErrorPropagates) {
-  const Value v = EvalSource("=NETWORKDAYS(\"abc\",DATE(2024,1,5))");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(DateTimeNetworkdays, RejectsOutOfRangeSerialBeforeIteration) {
-  const Value v = EvalSource("=NETWORKDAYS(1,1000000000)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeWorkday, RejectsOutOfRangeDayCountBeforeIteration) {
-  const Value v = EvalSource("=WORKDAY(1,1000000000)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTimeWorkday, ForwardFiveDays) {
-  // 2024-01-01 (Mon). +5 business days -> 2024-01-08 (the next Monday,
-  // because Jan 6/7 are Sat/Sun and skip without counting).
-  const Value v = EvalSource("=WORKDAY(DATE(2024,1,1),5)");
-  const Value exp = EvalSource("=DATE(2024,1,8)");
-  ASSERT_TRUE(v.is_number());
-  ASSERT_TRUE(exp.is_number());
-  EXPECT_EQ(v.as_number(), exp.as_number());
-}
-
-TEST(DateTimeWorkday, BackwardFiveDays) {
-  // 2024-01-15 (Mon) - 5 business days -> 2024-01-08 (Mon).
-  const Value v = EvalSource("=WORKDAY(DATE(2024,1,15),-5)");
-  const Value exp = EvalSource("=DATE(2024,1,8)");
-  ASSERT_TRUE(v.is_number());
-  ASSERT_TRUE(exp.is_number());
-  EXPECT_EQ(v.as_number(), exp.as_number());
-}
-
-TEST(DateTimeWorkday, ZeroDaysReturnsStart) {
-  // Excel: WORKDAY(start, 0) returns start regardless of weekday status.
-  const Value v = EvalSource("=WORKDAY(DATE(2024,1,3),0)");
-  const Value exp = EvalSource("=DATE(2024,1,3)");
-  ASSERT_TRUE(v.is_number());
-  ASSERT_TRUE(exp.is_number());
-  EXPECT_EQ(v.as_number(), exp.as_number());
-}
-
-TEST(DateTimeWorkday, HolidaysExtendForward) {
-  // +5 business days from Mon with Tue / Wed as holidays -> Fri of next
-  // week (the 5 working days skipped the two holidays AND the weekend).
-  const Value v = EvalSource("=WORKDAY(DATE(2024,1,1),5,{45293,45294})");
-  const Value exp = EvalSource("=DATE(2024,1,10)");
-  ASSERT_TRUE(v.is_number());
-  ASSERT_TRUE(exp.is_number());
-  EXPECT_EQ(v.as_number(), exp.as_number());
-}
-
-TEST(DateTimeWorkday, RangeHolidays) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(45293.0));  // 2024-01-02
-  wb.sheet(0).set_cell_value(1, 0, Value::number(45294.0));  // 2024-01-03
-  const Value v = EvalSourceIn("=WORKDAY(DATE(2024,1,1),5,A1:A2)", wb, wb.sheet(0));
-  const Value exp = EvalSource("=DATE(2024,1,10)");
-  ASSERT_TRUE(v.is_number());
-  ASSERT_TRUE(exp.is_number());
-  EXPECT_EQ(v.as_number(), exp.as_number());
-}
-
-TEST(DateTimeWorkday, ErrorPropagates) {
-  const Value v = EvalSource("=WORKDAY(\"abc\",5)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-// ---------------------------------------------------------------------------
-// 1904 date system. The 1904 epoch is 1462 days after the 1900 epoch, so a
-// given calendar date has a serial 1462 smaller. The calendar family reads
-// the epoch from `EvalContext::date1904()`.
-// ---------------------------------------------------------------------------
-
-TEST(DateTime1904, DateSerialIs1462Less) {
-  // DATE(2020,1,1) is serial 43831 under the 1900 system, 42369 under 1904.
-  const Value v1900 = EvalSource("=DATE(2020,1,1)");
-  ASSERT_TRUE(v1900.is_number());
-  EXPECT_DOUBLE_EQ(v1900.as_number(), 43831.0);
-  const Value v1904 = EvalSource1904("=DATE(2020,1,1)");
-  ASSERT_TRUE(v1904.is_number());
-  EXPECT_DOUBLE_EQ(v1904.as_number(), 42369.0);
-}
-
-TEST(DateTime1904, TextRendersDateTextInTheWorkbookEpoch) {
-  // TEXT coerces its first argument through the shared numeric ladder, whose
-  // date fallback always produces a 1900-system serial. Rendering it with
-  // 1904 format codes must therefore round-trip to the same calendar day
-  // under both epochs, not shift by the 1462-day gap.
-  const Value v1900 = EvalSource("=TEXT(\"2024-03-15\", \"yyyy/m/d\")");
-  ASSERT_TRUE(v1900.is_text());
-  EXPECT_EQ(v1900.as_text(), "2024/3/15");
-
-  const Value v1904 = EvalSource1904("=TEXT(\"2024-03-15\", \"yyyy/m/d\")");
-  ASSERT_TRUE(v1904.is_text());
-  EXPECT_EQ(v1904.as_text(), "2024/3/15");
-}
-
-TEST(DateTime1904, TextShiftsOnlyDateDerivedSerials) {
-  // The epoch shift is keyed on the coercion ladder's date rung, not on the
-  // format codes. A value that already is a serial — whether it arrives as a
-  // number or as numeric text — is read in the workbook's own epoch and must
-  // not be moved again.
-  const std::string number_1900 = std::string(EvalSource("=TEXT(45366,\"yyyy/m/d\")").as_text());
-  EXPECT_EQ(number_1900, "2024/3/15");
-
-  const std::string number_1904 = std::string(EvalSource1904("=TEXT(45366,\"yyyy/m/d\")").as_text());
-  EXPECT_EQ(number_1904, "2028/3/16") << "a bare serial follows the workbook epoch";
-
-  const std::string numeric_text_1904 = std::string(EvalSource1904("=TEXT(\"45366\",\"yyyy/m/d\")").as_text());
-  EXPECT_EQ(numeric_text_1904, number_1904) << "numeric text must not pick up the date rung's epoch shift";
-
-  // A non-date rung of the ladder renders identically under both epochs.
-  const std::string percent_1900 = std::string(EvalSource("=TEXT(\"50%\",\"0.00\")").as_text());
-  const std::string percent_1904 = std::string(EvalSource1904("=TEXT(\"50%\",\"0.00\")").as_text());
-  EXPECT_EQ(percent_1900, "0.50");
-  EXPECT_EQ(percent_1904, percent_1900);
-
-  // Time-only text is a day fraction: the same number, and the same
-  // rendering, under either epoch.
-  const std::string time_1900 = std::string(EvalSource("=TEXT(\"13:30\",\"h:mm\")").as_text());
-  const std::string time_1904 = std::string(EvalSource1904("=TEXT(\"13:30\",\"h:mm\")").as_text());
-  EXPECT_EQ(time_1900, "13:30");
-  EXPECT_EQ(time_1904, time_1900);
-}
-
-TEST(DateTime1904, SerialZeroExtractorsFollowTheWorkbookEpoch) {
-  // Serial 0 is the fictitious "1900-01-00" origin under the 1900 system and
-  // a real 1904-01-01 under the 1904 one, so the day component differs while
-  // the month does not. Two branches of `coerce_serial_ymd` meet here: the
-  // explicit day-0 alias, which only applies under the 1900 epoch, and the
-  // epoch shift that rebases a 1904 serial before decoding. Expected values
-  // come from the `datetime` / `datetime_1904_text` oracle suites, not from
-  // this implementation.
-  const Value year_1900 = EvalSource("=YEAR(0)");
-  const Value month_1900 = EvalSource("=MONTH(0)");
-  const Value day_1900 = EvalSource("=DAY(0)");
-  ASSERT_TRUE(year_1900.is_number());
-  ASSERT_TRUE(month_1900.is_number());
-  ASSERT_TRUE(day_1900.is_number());
-  EXPECT_DOUBLE_EQ(year_1900.as_number(), 1900.0);
-  EXPECT_DOUBLE_EQ(month_1900.as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(day_1900.as_number(), 0.0);
-
-  const Value year_1904 = EvalSource1904("=YEAR(0)");
-  const Value month_1904 = EvalSource1904("=MONTH(0)");
-  const Value day_1904 = EvalSource1904("=DAY(0)");
-  ASSERT_TRUE(year_1904.is_number());
-  ASSERT_TRUE(month_1904.is_number());
-  ASSERT_TRUE(day_1904.is_number());
-  EXPECT_DOUBLE_EQ(year_1904.as_number(), 1904.0);
-  EXPECT_DOUBLE_EQ(month_1904.as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(day_1904.as_number(), 1.0);
-}
-
-TEST(DateTime1904, UpperEndpointIsEpochSpecific) {
-  const Value endpoint = EvalSource1904("=DATE(9999, 12, 31)");
-  ASSERT_TRUE(endpoint.is_number());
-  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
-
-  const Value normalised = EvalSource1904("=DATE(9999, 11, 61)");
-  ASSERT_TRUE(normalised.is_number());
-  EXPECT_DOUBLE_EQ(normalised.as_number(), 2957003.0);
-}
-
-TEST(DateTime1904, DateOverflowPastUpperEndpointIsNum) {
-  const Value v = EvalSource1904("=DATE(9999, 12, 32)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, EdateUpperEndpointAndOverflow) {
-  const Value endpoint = EvalSource1904("=EDATE(DATE(9999, 12, 31), 0)");
-  ASSERT_TRUE(endpoint.is_number());
-  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
-
-  const Value overflow = EvalSource1904("=EDATE(DATE(9999, 12, 1), 1)");
-  ASSERT_TRUE(overflow.is_error());
-  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, EdateInputOnePastUpperEndpointIsNum) {
-  const Value v = EvalSource1904("=EDATE(DATE(9999, 12, 31) + 1, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, ExtractorRejectsOnePastEpochSpecificUpperEndpoint) {
-  const Value v = EvalSource1904("=YEAR(DATE(9999, 12, 31) + 1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, AcceptsFinalDayTimeFraction) {
-  const Value year = EvalSource1904("=YEAR(2957003.999988426)");
-  const Value month = EvalSource1904("=MONTH(2957003.999988426)");
-  const Value day = EvalSource1904("=DAY(2957003.999988426)");
-  ASSERT_TRUE(year.is_number());
-  ASSERT_TRUE(month.is_number());
-  ASSERT_TRUE(day.is_number());
-  EXPECT_DOUBLE_EQ(year.as_number(), 9999.0);
-  EXPECT_DOUBLE_EQ(month.as_number(), 12.0);
-  EXPECT_DOUBLE_EQ(day.as_number(), 31.0);
-}
-
-TEST(DateTime1904, RejectsExactNextDay) {
-  const Value year = EvalSource1904("=YEAR(2957004)");
-  const Value month = EvalSource1904("=MONTH(2957004)");
-  const Value day = EvalSource1904("=DAY(2957004)");
-  ASSERT_TRUE(year.is_error());
-  ASSERT_TRUE(month.is_error());
-  ASSERT_TRUE(day.is_error());
-  EXPECT_EQ(year.as_error(), ErrorCode::Num);
-  EXPECT_EQ(month.as_error(), ErrorCode::Num);
-  EXPECT_EQ(day.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, EdateGiganticMonthOffsetIsNum) {
-  const Value v = EvalSource1904("=EDATE(DATE(2024, 1, 1), 1E20)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, EdateLeftmostErrorPrecedesGiganticMonthOffset) {
-  const Value v = EvalSource1904("=EDATE(1/0, 1E20)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
-}
-
-TEST(DateTime1904, EdateLowerBoundaryWithZeroMonths) {
-  const Value v = EvalSource1904("=EDATE(DATE(1904, 1, 1), 0)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(DateTime1904, EomonthUpperEndpointAndOverflow) {
-  const Value endpoint = EvalSource1904("=EOMONTH(DATE(9999, 12, 1), 0)");
-  ASSERT_TRUE(endpoint.is_number());
-  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
-
-  const Value overflow = EvalSource1904("=EOMONTH(DATE(9999, 12, 1), 1)");
-  ASSERT_TRUE(overflow.is_error());
-  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, EdateAcceptsFinalDayTimeFraction) {
-  const Value endpoint = EvalSource1904("=EDATE(2957003.999988426, 0)");
-  ASSERT_TRUE(endpoint.is_number());
-  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
-}
-
-TEST(DateTime1904, EdateFinalDayTimeFractionCannotCrossUpperEndpoint) {
-  const Value overflow = EvalSource1904("=EDATE(2957003.999988426, 1)");
-  ASSERT_TRUE(overflow.is_error());
-  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, EomonthAcceptsFinalDayTimeFraction) {
-  const Value endpoint = EvalSource1904("=EOMONTH(2957003.999988426, 0)");
-  ASSERT_TRUE(endpoint.is_number());
-  EXPECT_DOUBLE_EQ(endpoint.as_number(), 2957003.0);
-}
-
-TEST(DateTime1904, EomonthFinalDayTimeFractionCannotCrossUpperEndpoint) {
-  const Value overflow = EvalSource1904("=EOMONTH(2957003.999988426, 1)");
-  ASSERT_TRUE(overflow.is_error());
-  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, EomonthGiganticMonthOffsetIsNum) {
-  const Value v = EvalSource1904("=EOMONTH(DATE(2024, 1, 1), 1E20)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, EomonthBooleanPrecedenceBeatsGiganticMonthOffset) {
-  const Value v = EvalSource1904("=EOMONTH(TRUE, 1E20)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(DateTime1904, EomonthLowerBoundaryControl) {
-  const Value v = EvalSource1904("=EOMONTH(DATE(1904, 1, 1), 0)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
-}
-
-TEST(DateTime1904, YearMonthDayInvertUnder1904) {
-  // Serial 42369 is 2020-01-01 in the 1904 system.
-  const Value y = EvalSource1904("=YEAR(42369)");
-  ASSERT_TRUE(y.is_number());
-  EXPECT_DOUBLE_EQ(y.as_number(), 2020.0);
-  const Value m = EvalSource1904("=MONTH(42369)");
-  ASSERT_TRUE(m.is_number());
-  EXPECT_DOUBLE_EQ(m.as_number(), 1.0);
-  const Value d = EvalSource1904("=DAY(42369)");
-  ASSERT_TRUE(d.is_number());
-  EXPECT_DOUBLE_EQ(d.as_number(), 1.0);
-}
-
-TEST(DateTime1904, EdateShiftsWithin1904Epoch) {
-  // EDATE(2020-01-01, 1) -> 2020-02-01; serial 42400 in the 1904 system
-  // (43862 - 1462).
-  const Value v = EvalSource1904("=EDATE(42369,1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 42400.0);
-}
-
-TEST(DateTime1904, DateValueUsesWorkbookEpoch) {
-  const Value v = EvalSource1904("=DATEVALUE(\"2020-01-01\")");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 42369.0);
-}
-
-TEST(DateTime1904, WeekdayMatchesCalendarDateUnder1904) {
-  // 2020-01-01 is a Wednesday -> WEEKDAY type 1 (Sun=1) returns 4.
-  const Value v = EvalSource1904("=WEEKDAY(42369)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 4.0);
-}
-
-TEST(DateTime1904, NetworkdaysCountsTheSameCalendarSpanUnderBothEpochs) {
-  // 2024-01-01 (Mon) .. 2024-01-12 (Fri) is 10 business days regardless of
-  // the workbook epoch. The 1900/1904 offset of 1462 days is not a multiple
-  // of 7, so reading a 1904 serial as a 1900 one moves every weekend by two
-  // days and the span answers 9 instead.
-  const Value v1900 = EvalSource("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,12))");
-  ASSERT_TRUE(v1900.is_number());
-  EXPECT_DOUBLE_EQ(v1900.as_number(), 10.0);
-
-  const Value v1904 = EvalSource1904("=NETWORKDAYS(DATE(2024,1,1),DATE(2024,1,12))");
-  ASSERT_TRUE(v1904.is_number());
-  EXPECT_DOUBLE_EQ(v1904.as_number(), 10.0);
-}
-
-TEST(DateTime1904, NetworkdaysIntlWeekendMaskFollowsTheWorkbookEpoch) {
-  // Weekend selector 11 is "Sunday only", so 2024-01-01 .. 2024-01-13
-  // (Mon .. Sat) drops just 2024-01-07 and leaves 12 working days. Under an
-  // epoch-blind weekday test the mask lands on the Saturdays instead and the
-  // span answers 11.
-  const Value v1900 = EvalSource("=NETWORKDAYS.INTL(DATE(2024,1,1),DATE(2024,1,13),11)");
-  ASSERT_TRUE(v1900.is_number());
-  EXPECT_DOUBLE_EQ(v1900.as_number(), 12.0);
-
-  const Value v1904 = EvalSource1904("=NETWORKDAYS.INTL(DATE(2024,1,1),DATE(2024,1,13),11)");
-  ASSERT_TRUE(v1904.is_number());
-  EXPECT_DOUBLE_EQ(v1904.as_number(), 12.0);
-}
-
-TEST(DateTime1904, WorkdayLandsOnTheSameCalendarDateUnderBothEpochs) {
-  // One working day after 2024-01-05 (Fri) is 2024-01-08 (Mon): the weekend
-  // in between must be recognised in the workbook's own epoch.
-  const Value v1900 = EvalSource("=WORKDAY(DATE(2024,1,5),1)");
-  ASSERT_TRUE(v1900.is_number());
-  const Value expected_1900 = EvalSource("=DATE(2024,1,8)");
-  ASSERT_TRUE(expected_1900.is_number());
-  EXPECT_DOUBLE_EQ(v1900.as_number(), expected_1900.as_number());
-
-  const Value v1904 = EvalSource1904("=WORKDAY(DATE(2024,1,5),1)");
-  ASSERT_TRUE(v1904.is_number());
-  EXPECT_DOUBLE_EQ(v1904.as_number(), v1900.as_number() - 1462.0);
-}
-
-TEST(DateTime1904, WorkdayIntlWeekendMaskFollowsTheWorkbookEpoch) {
-  // Weekend selector 11 is "Sunday only", so the day after 2024-01-05 (Fri)
-  // is the working Saturday 2024-01-06.
-  const Value v1900 = EvalSource("=WORKDAY.INTL(DATE(2024,1,5),1,11)");
-  ASSERT_TRUE(v1900.is_number());
-  const Value expected_1900 = EvalSource("=DATE(2024,1,6)");
-  ASSERT_TRUE(expected_1900.is_number());
-  EXPECT_DOUBLE_EQ(v1900.as_number(), expected_1900.as_number());
-
-  const Value v1904 = EvalSource1904("=WORKDAY.INTL(DATE(2024,1,5),1,11)");
-  ASSERT_TRUE(v1904.is_number());
-  EXPECT_DOUBLE_EQ(v1904.as_number(), v1900.as_number() - 1462.0);
-}
-
-TEST(DateTime1904, WorkdayHolidaysAreReadInTheWorkbookEpoch) {
-  // 2024-01-08 (Mon) as a holiday pushes the result to 2024-01-09, and the
-  // holiday serial itself is expressed in the workbook's epoch.
-  const Value v1900 = EvalSource("=WORKDAY(DATE(2024,1,5),1,DATE(2024,1,8))");
-  ASSERT_TRUE(v1900.is_number());
-  const Value expected_1900 = EvalSource("=DATE(2024,1,9)");
-  ASSERT_TRUE(expected_1900.is_number());
-  EXPECT_DOUBLE_EQ(v1900.as_number(), expected_1900.as_number());
-
-  const Value v1904 = EvalSource1904("=WORKDAY(DATE(2024,1,5),1,DATE(2024,1,8))");
-  ASSERT_TRUE(v1904.is_number());
-  EXPECT_DOUBLE_EQ(v1904.as_number(), v1900.as_number() - 1462.0);
-}
-
-TEST(DateTime1904, WorkdayUpperEndpointIsEpochSpecific) {
-  // 9999-12-31 is serial 2957003 under the 1904 system, so walking forward
-  // from 2957000 runs off the calendar. The same serial is an ordinary day
-  // under the 1900 system and the walk succeeds there.
-  const Value over = EvalSource1904("=WORKDAY(2957000,10)");
-  ASSERT_TRUE(over.is_error());
-  EXPECT_EQ(over.as_error(), ErrorCode::Num);
-
-  const Value within = EvalSource("=WORKDAY(2957000,10)");
-  ASSERT_TRUE(within.is_number());
-}
-
-TEST(DateTime1904, NetworkdaysRejectsSerialsPastTheEpochUpperEndpoint) {
-  const Value v = EvalSource1904("=NETWORKDAYS(1,2957004)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(DateTime1904, DefaultSystemUnaffected) {
-  // Sanity: the 1900 default path is unchanged (YEAR of the 1900 serial).
-  const Value v = EvalSource("=YEAR(43831)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 2020.0);
-}
-
-TEST(DateTime1904, TodayIsPositiveIntegerUnder1904) {
-  // TODAY() reads the wall clock; assert only that the 1904 epoch yields a
-  // positive integer serial (deterministic value would depend on the date).
-  const Value v = EvalSource1904("=TODAY()");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_GT(v.as_number(), 0.0);
-  EXPECT_DOUBLE_EQ(v.as_number(), std::floor(v.as_number()));
-}
-
-// ---------------------------------------------------------------------------
-// Clock seam
-//
-// `EvalContext::wall_clock()` falls through to the host clock unless a
-// reading is pinned. Pinning is what makes NOW / TODAY assertable at all:
-// without it every expectation here would have to be a shape check against
-// whatever day the suite happens to run on, as the test above has to be.
-// ---------------------------------------------------------------------------
-
-// 2026-04-23 15:30:45. The date half matches `DateTimeDate.CurrentDateSerial`
-// above, so the expected serial 46135 is already independently pinned.
-constexpr date_time::CivilTime kPinnedNow{{2026, 4U, 23U}, {15U, 30U, 45U}};
-constexpr double kPinnedSerial = 46135.0;
-// 15:30:45 == 55,845 seconds into the day.
-constexpr double kPinnedTimeOfDay = 55845.0 / 86400.0;
-
-Value EvalSourcePinned(std::string_view src, date_time::CivilTime pinned = kPinnedNow, bool date1904 = false) {
-  static thread_local Arena parse_arena;
-  static thread_local Arena eval_arena;
-  parse_arena.reset();
-  eval_arena.reset();
-  parser::Parser p(src, parse_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
-  }
-  return evaluate(*root, eval_arena, default_registry(),
-                  test::mac_context().with_date1904(date1904).with_pinned_now(pinned));
-}
-
-TEST(ClockSeam, TodayReturnsThePinnedDate) {
-  const Value v = EvalSourcePinned("=TODAY()");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), kPinnedSerial);
-}
-
-TEST(ClockSeam, NowCarriesThePinnedTimeOfDay) {
-  const Value v = EvalSourcePinned("=NOW()");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), kPinnedSerial + kPinnedTimeOfDay);
-}
-
-TEST(ClockSeam, TodayDiscardsTheTimeOfDayNowKeeps) {
-  const Value today = EvalSourcePinned("=TODAY()");
-  const Value now = EvalSourcePinned("=NOW()");
-  ASSERT_TRUE(today.is_number());
-  ASSERT_TRUE(now.is_number());
-  EXPECT_DOUBLE_EQ(today.as_number(), std::floor(now.as_number()));
-  EXPECT_GT(now.as_number(), today.as_number());
-}
-
-TEST(ClockSeam, MovingThePinMovesTheAnswer) {
-  // Guards against the pin being accepted but ignored: a second reading a
-  // day later must shift the serial by exactly one.
-  constexpr date_time::CivilTime kNextDay{{2026, 4U, 24U}, {15U, 30U, 45U}};
-  const Value v = EvalSourcePinned("=TODAY()", kNextDay);
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), kPinnedSerial + 1.0);
-}
-
-TEST(ClockSeam, ThePinnedReadingStillHonoursTheWorkbookEpoch) {
-  // The pin carries calendar fields, not a serial, so the 1904 epoch is
-  // applied downstream exactly as it is for an argument-supplied date.
-  const Value v = EvalSourcePinned("=TODAY()", kPinnedNow, /*date1904=*/true);
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), kPinnedSerial - date_time::kDate1904EpochGap);
-}
-
-TEST(ClockSeam, AnUnpinnedContextStillFollowsTheHostClock) {
-  // The seam must not disturb the shipping default: with nothing pinned both
-  // functions keep reading the host clock, so only the shape is assertable.
-  const Value v = EvalSource("=TODAY()");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_GT(v.as_number(), 0.0);
-  EXPECT_DOUBLE_EQ(v.as_number(), std::floor(v.as_number()));
-}
-
-TEST(DateTime1904, TextDateRenderingUsesWorkbookEpoch) {
-  // Serial 42369 is 2015-12-31 in the 1900 system and 2020-01-01 in the 1904
-  // system. TEXT's date format must render against the workbook epoch.
-  const Value v1900 = EvalSource("=TEXT(42369,\"yyyy-mm-dd\")");
-  ASSERT_TRUE(v1900.is_text());
-  EXPECT_EQ(v1900.as_text(), "2015-12-31");
-  const Value v1904 = EvalSource1904("=TEXT(42369,\"yyyy-mm-dd\")");
-  ASSERT_TRUE(v1904.is_text());
-  EXPECT_EQ(v1904.as_text(), "2020-01-01");
-}
-
-TEST(DateTime1904, TextRoundTripsDateBuiltinUnder1904) {
-  // DATE and TEXT share the workbook epoch, so DATE(2020,3,15) formatted back
-  // reads "2020-03-15" under both systems.
-  const Value v = EvalSource1904("=TEXT(DATE(2020,3,15),\"yyyy-mm-dd\")");
-  ASSERT_TRUE(v.is_text());
-  EXPECT_EQ(v.as_text(), "2020-03-15");
-}
-
-TEST(DateTime1904, TextNumericFormatUnaffectedByEpoch) {
-  // A pure-numeric format has no date tokens, so the epoch is irrelevant.
-  const Value v = EvalSource1904("=TEXT(1234.5,\"0.00\")");
-  ASSERT_TRUE(v.is_text());
-  EXPECT_EQ(v.as_text(), "1234.50");
-}
-
-TEST(DateTimeSerialZero, 1900SystemKeepsFictitiousDayAlias) {
-  const Value year = EvalSource("=YEAR(0)");
-  const Value month = EvalSource("=MONTH(0)");
-  const Value day = EvalSource("=DAY(0)");
-  ASSERT_TRUE(year.is_number());
-  ASSERT_TRUE(month.is_number());
-  ASSERT_TRUE(day.is_number());
-  EXPECT_DOUBLE_EQ(year.as_number(), 1900.0);
-  EXPECT_DOUBLE_EQ(month.as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(day.as_number(), 0.0);
-}
-
-TEST(DateTimeSerialZero, 1904SystemUsesRealEpochDay) {
-  const Value year = EvalSource1904("=YEAR(0)");
-  const Value month = EvalSource1904("=MONTH(0)");
-  const Value day = EvalSource1904("=DAY(0)");
-  ASSERT_TRUE(year.is_number());
-  ASSERT_TRUE(month.is_number());
-  ASSERT_TRUE(day.is_number());
-  EXPECT_DOUBLE_EQ(year.as_number(), 1904.0);
-  EXPECT_DOUBLE_EQ(month.as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(day.as_number(), 1.0);
-}
-
-TEST(DateTime1904, RawTextUsesCalendarDateAcrossExtractors) {
-  const Value year = EvalSource1904("=YEAR(\"2024-03-15\")");
-  const Value month = EvalSource1904("=MONTH(\"2024-03-15\")");
-  const Value day = EvalSource1904("=DAY(\"2024-03-15\")");
-  const Value weekday = EvalSource1904("=WEEKDAY(\"2024-03-15\")");
-  const Value weeknum = EvalSource1904("=WEEKNUM(\"2024-03-15\")");
-  const Value isoweeknum = EvalSource1904("=ISOWEEKNUM(\"2024-03-15\")");
-  ASSERT_TRUE(year.is_number());
-  ASSERT_TRUE(month.is_number());
-  ASSERT_TRUE(day.is_number());
-  ASSERT_TRUE(weekday.is_number());
-  ASSERT_TRUE(weeknum.is_number());
-  ASSERT_TRUE(isoweeknum.is_number());
-  EXPECT_DOUBLE_EQ(year.as_number(), 2024.0);
-  EXPECT_DOUBLE_EQ(month.as_number(), 3.0);
-  EXPECT_DOUBLE_EQ(day.as_number(), 15.0);
-  EXPECT_DOUBLE_EQ(weekday.as_number(), 6.0);  // Friday, Sunday-first.
-  EXPECT_DOUBLE_EQ(weeknum.as_number(), 11.0);
-  EXPECT_DOUBLE_EQ(isoweeknum.as_number(), 11.0);
-}
-
-TEST(DateTime1904, RawTextDayCountsMatchDatevalueNumbers) {
-  const Value datedif_raw = EvalSource1904("=DATEDIF(\"2024-01-01\",DATE(2024,12,31),\"D\")");
-  const Value datedif_datevalue = EvalSource1904("=DATEDIF(DATEVALUE(\"2024-01-01\"),DATE(2024,12,31),\"D\")");
-  const Value days360_raw = EvalSource1904("=DAYS360(\"2024-01-01\",DATE(2024,12,31))");
-  const Value days360_datevalue = EvalSource1904("=DAYS360(DATEVALUE(\"2024-01-01\"),DATE(2024,12,31))");
-  const Value days_raw = EvalSource1904("=DAYS(\"2024-03-15\",DATE(2024,3,14))");
-  const Value days_datevalue = EvalSource1904("=DAYS(DATEVALUE(\"2024-03-15\"),DATE(2024,3,14))");
-  ASSERT_TRUE(datedif_raw.is_number());
-  ASSERT_TRUE(datedif_datevalue.is_number());
-  ASSERT_TRUE(days360_raw.is_number());
-  ASSERT_TRUE(days360_datevalue.is_number());
-  ASSERT_TRUE(days_raw.is_number());
-  ASSERT_TRUE(days_datevalue.is_number());
-  EXPECT_DOUBLE_EQ(datedif_raw.as_number(), 365.0);
-  EXPECT_DOUBLE_EQ(datedif_datevalue.as_number(), 365.0);
-  EXPECT_DOUBLE_EQ(days360_raw.as_number(), 360.0);
-  EXPECT_DOUBLE_EQ(days360_datevalue.as_number(), 360.0);
-  EXPECT_DOUBLE_EQ(days_raw.as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(days_datevalue.as_number(), 1.0);
-}
-
-TEST(DateTime1904, DaysBroadcastsArrayArguments) {
-  const Value result = EvalSource1904("=DAYS({\"2024-03-15\",\"2024-03-16\"},DATE(2024,3,14))");
-  ASSERT_TRUE(result.is_array());
-  ASSERT_EQ(result.as_array_rows(), 1U);
-  ASSERT_EQ(result.as_array_cols(), 2U);
-  ASSERT_TRUE(result.as_array()->cells[0].is_number());
-  ASSERT_TRUE(result.as_array()->cells[1].is_number());
-  EXPECT_DOUBLE_EQ(result.as_array()->cells[0].as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(result.as_array()->cells[1].as_number(), 2.0);
-}
-
-TEST(DateTime1904, LegacyMonthFunctionsUseRawTextInputCoordinateAfterValidation) {
-  const Value edate_raw = EvalSource1904("=EDATE(\"2024-03-15\",1)");
-  const Value edate_datevalue = EvalSource1904("=EDATE(DATEVALUE(\"2024-03-15\"),1)");
-  const Value eomonth_raw = EvalSource1904("=EOMONTH(\"2024-03-15\",0)");
-  const Value eomonth_datevalue = EvalSource1904("=EOMONTH(DATEVALUE(\"2024-03-15\"),0)");
-  ASSERT_TRUE(edate_raw.is_number());
-  ASSERT_TRUE(edate_datevalue.is_number());
-  ASSERT_TRUE(eomonth_raw.is_number());
-  ASSERT_TRUE(eomonth_datevalue.is_number());
-  EXPECT_DOUBLE_EQ(edate_raw.as_number(), 42473.0);
-  EXPECT_DOUBLE_EQ(edate_datevalue.as_number(), 43935.0);
-  EXPECT_DOUBLE_EQ(eomonth_raw.as_number(), 42459.0);
-  EXPECT_DOUBLE_EQ(eomonth_datevalue.as_number(), 43920.0);
-}
-
-TEST(DateTime1904, YearfracRawTextUsesLegacyEndpoints) {
-  const Value raw_start = EvalSource1904("=YEARFRAC(\"2024-01-01\",DATE(2024,12,31),3)");
-  const Value raw_end = EvalSource1904("=YEARFRAC(DATE(2024,1,1),\"2024-12-31\",3)");
-  const Value datevalue_start = EvalSource1904("=YEARFRAC(DATEVALUE(\"2024-01-01\"),DATE(2024,12,31),3)");
-  const Value datevalue_end = EvalSource1904("=YEARFRAC(DATE(2024,1,1),DATEVALUE(\"2024-12-31\"),3)");
-  const Value both_raw_basis3 = EvalSource1904("=YEARFRAC(\"2024-01-01\",\"2024-12-31\",3)");
-  const Value both_raw_basis1 = EvalSource1904("=YEARFRAC(\"2024-01-01\",\"2024-12-31\",1)");
-  ASSERT_TRUE(raw_start.is_number());
-  ASSERT_TRUE(raw_end.is_number());
-  ASSERT_TRUE(datevalue_start.is_number());
-  ASSERT_TRUE(datevalue_end.is_number());
-  ASSERT_TRUE(both_raw_basis3.is_number());
-  ASSERT_TRUE(both_raw_basis1.is_number());
-  EXPECT_DOUBLE_EQ(raw_start.as_number(), 1827.0 / 365.0);
-  EXPECT_DOUBLE_EQ(raw_end.as_number(), 1097.0 / 365.0);
-  EXPECT_DOUBLE_EQ(datevalue_start.as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(datevalue_end.as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(both_raw_basis3.as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(both_raw_basis1.as_number(), 365.0 / 366.0);
-}
-
-TEST(DateTime1904, LegacyEdateTextBoundaryProjections) {
-  struct Case {
-    const char* date;
-    int months;
-    double expected;
-  };
-  constexpr Case cases[] = {
-      {"1904-01-01", 0, -1462.0}, {"1907-12-31", 0, -2.0},   {"1908-01-01", 0, -1.0},
-      {"1908-01-02", 0, 0.0},     {"1908-01-01", -1, -32.0}, {"2024-02-29", 0, 42427.0},
-  };
-  for (const Case& tc : cases) {
-    const std::string formula = "=EDATE(\"" + std::string(tc.date) + "\"," + std::to_string(tc.months) + ")";
-    const Value v = EvalSource1904(formula);
-    ASSERT_TRUE(v.is_number()) << formula;
-    EXPECT_DOUBLE_EQ(v.as_number(), tc.expected) << formula;
-  }
-}
-
-TEST(DateTime1904, LegacyEomonthTextBoundaryProjections) {
-  struct Case {
-    const char* date;
-    double expected;
-  };
-  constexpr Case cases[] = {
-      {"1904-01-01", -1431.0}, {"1907-12-31", -1.0},    {"1908-01-01", -1.0},
-      {"1908-01-02", 30.0},    {"2024-02-29", 42428.0},
-  };
-  for (const Case& tc : cases) {
-    const std::string formula = "=EOMONTH(\"" + std::string(tc.date) + "\",0)";
-    const Value v = EvalSource1904(formula);
-    ASSERT_TRUE(v.is_number()) << formula;
-    EXPECT_DOUBLE_EQ(v.as_number(), tc.expected) << formula;
-  }
-}
-
-TEST(DateTime1904, PreEpochRawDateTextIsValueError) {
-  const Value year = EvalSource1904("=YEAR(\"1903-12-31\")");
-  const Value edate = EvalSource1904("=EDATE(\"1903-12-31\",0)");
-  const Value eomonth = EvalSource1904("=EOMONTH(\"1903-12-31\",0)");
-  ASSERT_TRUE(year.is_error());
-  ASSERT_TRUE(edate.is_error());
-  ASSERT_TRUE(eomonth.is_error());
-  EXPECT_EQ(year.as_error(), ErrorCode::Value);
-  EXPECT_EQ(edate.as_error(), ErrorCode::Value);
-  EXPECT_EQ(eomonth.as_error(), ErrorCode::Value);
-}
-
-TEST(DateTime1904, NumericTextWhitespaceAndTimeOnlyStayNonDirect) {
-  const Value numeric_text = EvalSource1904("=YEAR(\"42369\")");
-  const Value whitespace = EvalSource1904("=YEAR(\" 2024-03-15 \")");
-  const Value time_value = EvalSource1904("=YEAR(\"12:00\")");
-  ASSERT_TRUE(numeric_text.is_number());
-  ASSERT_TRUE(whitespace.is_error());
-  ASSERT_TRUE(time_value.is_number());
-  EXPECT_DOUBLE_EQ(numeric_text.as_number(), 2020.0);
-  EXPECT_EQ(whitespace.as_error(), ErrorCode::Value);
-  EXPECT_DOUBLE_EQ(time_value.as_number(), 1904.0);
-}
-
-TEST(DateTime1904, NumericAndDatevalueMonthBoundsStayCanonical) {
-  const Value numeric_lower = EvalSource1904("=EDATE(0,0)");
-  const Value datevalue_lower = EvalSource1904("=EDATE(DATEVALUE(\"1904-01-01\"),0)");
-  const Value numeric_upper = EvalSource1904("=EDATE(DATE(9999,12,31),0)");
-  const Value datevalue_upper = EvalSource1904("=EDATE(DATEVALUE(\"9999-12-31\"),0)");
-  ASSERT_TRUE(numeric_lower.is_number());
-  ASSERT_TRUE(datevalue_lower.is_number());
-  ASSERT_TRUE(numeric_upper.is_number());
-  ASSERT_TRUE(datevalue_upper.is_number());
-  EXPECT_DOUBLE_EQ(numeric_lower.as_number(), 0.0);
-  EXPECT_DOUBLE_EQ(datevalue_lower.as_number(), 0.0);
-  EXPECT_DOUBLE_EQ(numeric_upper.as_number(), 2957003.0);
-  EXPECT_DOUBLE_EQ(datevalue_upper.as_number(), 2957003.0);
-}
-
-// ---------------------------------------------------------------------------
-// Weekdays of 1900 serials
-// ---------------------------------------------------------------------------
-
-// Excel 365 ja-JP readings for serials 0..8, around the ghost day 60, and
-// across 1900 for the week-number family.
-TEST(DateTimeSerialWeekday, MatchesExcelGrid) {
-  struct Case {
-    const char* formula;
-    double number;
-    const char* text;
-    bool num_error;
-  };
-  static constexpr Case kCases[] = {
-      {"=WEEKDAY(0)", 7.0, nullptr, false},
-      {"=WEEKDAY(0,2)", 6.0, nullptr, false},
-      {"=WEEKDAY(0,3)", 5.0, nullptr, false},
-      {"=WEEKDAY(1)", 1.0, nullptr, false},
-      {"=WEEKDAY(1,2)", 7.0, nullptr, false},
-      {"=WEEKDAY(1,3)", 6.0, nullptr, false},
-      {"=WEEKDAY(2)", 2.0, nullptr, false},
-      {"=WEEKDAY(2,2)", 1.0, nullptr, false},
-      {"=WEEKDAY(2,3)", 0.0, nullptr, false},
-      {"=WEEKDAY(3)", 3.0, nullptr, false},
-      {"=WEEKDAY(3,2)", 2.0, nullptr, false},
-      {"=WEEKDAY(3,3)", 1.0, nullptr, false},
-      {"=WEEKDAY(4)", 4.0, nullptr, false},
-      {"=WEEKDAY(4,2)", 3.0, nullptr, false},
-      {"=WEEKDAY(4,3)", 2.0, nullptr, false},
-      {"=WEEKDAY(5)", 5.0, nullptr, false},
-      {"=WEEKDAY(5,2)", 4.0, nullptr, false},
-      {"=WEEKDAY(5,3)", 3.0, nullptr, false},
-      {"=WEEKDAY(6)", 6.0, nullptr, false},
-      {"=WEEKDAY(6,2)", 5.0, nullptr, false},
-      {"=WEEKDAY(6,3)", 4.0, nullptr, false},
-      {"=WEEKDAY(7)", 7.0, nullptr, false},
-      {"=WEEKDAY(7,2)", 6.0, nullptr, false},
-      {"=WEEKDAY(7,3)", 5.0, nullptr, false},
-      {"=WEEKDAY(8)", 1.0, nullptr, false},
-      {"=WEEKDAY(8,2)", 7.0, nullptr, false},
-      {"=WEEKDAY(8,3)", 6.0, nullptr, false},
-      {"=WEEKDAY(58)", 2.0, nullptr, false},
-      {"=WEEKDAY(58,2)", 1.0, nullptr, false},
-      {"=WEEKDAY(58,3)", 0.0, nullptr, false},
-      {"=WEEKDAY(59)", 3.0, nullptr, false},
-      {"=WEEKDAY(59,2)", 2.0, nullptr, false},
-      {"=WEEKDAY(59,3)", 1.0, nullptr, false},
-      {"=WEEKDAY(60)", 4.0, nullptr, false},
-      {"=WEEKDAY(60,2)", 3.0, nullptr, false},
-      {"=WEEKDAY(60,3)", 2.0, nullptr, false},
-      {"=WEEKDAY(61)", 5.0, nullptr, false},
-      {"=WEEKDAY(61,2)", 4.0, nullptr, false},
-      {"=WEEKDAY(61,3)", 3.0, nullptr, false},
-      {"=WEEKDAY(62)", 6.0, nullptr, false},
-      {"=WEEKDAY(62,2)", 5.0, nullptr, false},
-      {"=WEEKDAY(62,3)", 4.0, nullptr, false},
-      {"=NETWORKDAYS(0,0)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,0)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,0,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,0,\"0000011\")", 0.0, nullptr, false},
-      {"=NETWORKDAYS(0,1)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,1)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,1,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,1,\"0000011\")", 0.0, nullptr, false},
-      {"=NETWORKDAYS(0,2)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,2)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,2,11)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,2,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(0,3)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,3)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,3,11)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,3,\"0000011\")", 2.0, nullptr, false},
-      {"=NETWORKDAYS(0,4)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,4)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,4,11)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,4,\"0000011\")", 3.0, nullptr, false},
-      {"=NETWORKDAYS(0,5)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,5)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,5,11)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,5,\"0000011\")", 4.0, nullptr, false},
-      {"=NETWORKDAYS(0,6)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,6)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,6,11)", 6.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,6,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(0,7)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,7)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,7,11)", 7.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,7,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(0,8)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,8)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,8,11)", 7.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(0,8,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(1,1)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,1)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,1,11)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,1,\"0000011\")", 0.0, nullptr, false},
-      {"=NETWORKDAYS(1,2)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,2)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,2,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,2,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(1,3)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,3)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,3,11)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,3,\"0000011\")", 2.0, nullptr, false},
-      {"=NETWORKDAYS(1,4)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,4)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,4,11)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,4,\"0000011\")", 3.0, nullptr, false},
-      {"=NETWORKDAYS(1,5)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,5)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,5,11)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,5,\"0000011\")", 4.0, nullptr, false},
-      {"=NETWORKDAYS(1,6)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,6)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,6,11)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,6,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(1,7)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,7)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,7,11)", 6.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,7,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(1,8)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,8)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,8,11)", 6.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,8,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(2,2)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,2)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,2,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,2,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(2,3)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,3)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,3,11)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,3,\"0000011\")", 2.0, nullptr, false},
-      {"=NETWORKDAYS(2,4)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,4)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,4,11)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,4,\"0000011\")", 3.0, nullptr, false},
-      {"=NETWORKDAYS(2,5)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,5)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,5,11)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,5,\"0000011\")", 4.0, nullptr, false},
-      {"=NETWORKDAYS(2,6)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,6)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,6,11)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,6,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(2,7)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,7)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,7,11)", 6.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,7,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(2,8)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,8)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,8,11)", 6.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,8,\"0000011\")", 5.0, nullptr, false},
-      {"=NETWORKDAYS(3,3)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,3)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,3,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,3,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(3,4)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,4)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,4,11)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,4,\"0000011\")", 2.0, nullptr, false},
-      {"=NETWORKDAYS(3,5)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,5)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,5,11)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,5,\"0000011\")", 3.0, nullptr, false},
-      {"=NETWORKDAYS(3,6)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,6)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,6,11)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,6,\"0000011\")", 4.0, nullptr, false},
-      {"=NETWORKDAYS(3,7)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,7)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,7,11)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,7,\"0000011\")", 4.0, nullptr, false},
-      {"=NETWORKDAYS(3,8)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,8)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,8,11)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(3,8,\"0000011\")", 4.0, nullptr, false},
-      {"=NETWORKDAYS(4,4)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,4)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,4,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,4,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(4,5)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,5)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,5,11)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,5,\"0000011\")", 2.0, nullptr, false},
-      {"=NETWORKDAYS(4,6)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,6)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,6,11)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,6,\"0000011\")", 3.0, nullptr, false},
-      {"=NETWORKDAYS(4,7)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,7)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,7,11)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,7,\"0000011\")", 3.0, nullptr, false},
-      {"=NETWORKDAYS(4,8)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,8)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,8,11)", 4.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(4,8,\"0000011\")", 3.0, nullptr, false},
-      {"=NETWORKDAYS(5,5)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,5)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,5,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,5,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(5,6)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,6)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,6,11)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,6,\"0000011\")", 2.0, nullptr, false},
-      {"=NETWORKDAYS(5,7)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,7)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,7,11)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,7,\"0000011\")", 2.0, nullptr, false},
-      {"=NETWORKDAYS(5,8)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,8)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,8,11)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(5,8,\"0000011\")", 2.0, nullptr, false},
-      {"=NETWORKDAYS(6,6)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,6)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,6,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,6,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(6,7)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,7)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,7,11)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,7,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(6,8)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,8)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,8,11)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(6,8,\"0000011\")", 1.0, nullptr, false},
-      {"=NETWORKDAYS(7,7)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(7,7)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(7,7,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(7,7,\"0000011\")", 0.0, nullptr, false},
-      {"=NETWORKDAYS(7,8)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(7,8)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(7,8,11)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(7,8,\"0000011\")", 0.0, nullptr, false},
-      {"=NETWORKDAYS(8,8)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(8,8)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(8,8,11)", 0.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(8,8,\"0000011\")", 0.0, nullptr, false},
-      {"=NETWORKDAYS(55,65)", 7.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(55,65)", 7.0, nullptr, false},
-      {"=NETWORKDAYS(58,62)", 5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(58,62)", 5.0, nullptr, false},
-      {"=NETWORKDAYS(59,61)", 3.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(59,61)", 3.0, nullptr, false},
-      {"=NETWORKDAYS(60,60)", 1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(60,60)", 1.0, nullptr, false},
-      {"=NETWORKDAYS(59,60)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(59,60)", 2.0, nullptr, false},
-      {"=NETWORKDAYS(60,61)", 2.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(60,61)", 2.0, nullptr, false},
-      {"=NETWORKDAYS(1,70)", 50.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(1,70)", 50.0, nullptr, false},
-      {"=NETWORKDAYS(2,1)", -1.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(2,1)", -1.0, nullptr, false},
-      {"=NETWORKDAYS(8,0)", -5.0, nullptr, false},
-      {"=NETWORKDAYS.INTL(8,0)", -5.0, nullptr, false},
-      {"=WORKDAY(0,1)", 2.0, nullptr, false},
-      {"=WORKDAY.INTL(0,1)", 2.0, nullptr, false},
-      {"=WORKDAY.INTL(0,1,11)", 2.0, nullptr, false},
-      {"=WORKDAY(1,1)", 2.0, nullptr, false},
-      {"=WORKDAY.INTL(1,1)", 2.0, nullptr, false},
-      {"=WORKDAY.INTL(1,1,11)", 2.0, nullptr, false},
-      {"=WORKDAY(0,0)", 0.0, nullptr, false},
-      {"=WORKDAY.INTL(0,0)", 0.0, nullptr, false},
-      {"=WORKDAY.INTL(0,0,11)", 0.0, nullptr, false},
-      {"=WORKDAY(1,0)", 1.0, nullptr, false},
-      {"=WORKDAY.INTL(1,0)", 1.0, nullptr, false},
-      {"=WORKDAY.INTL(1,0,11)", 1.0, nullptr, false},
-      {"=WORKDAY(0,5)", 6.0, nullptr, false},
-      {"=WORKDAY.INTL(0,5)", 6.0, nullptr, false},
-      {"=WORKDAY.INTL(0,5,11)", 6.0, nullptr, false},
-      {"=WORKDAY(1,5)", 6.0, nullptr, false},
-      {"=WORKDAY.INTL(1,5)", 6.0, nullptr, false},
-      {"=WORKDAY.INTL(1,5,11)", 6.0, nullptr, false},
-      {"=WORKDAY(2,-1)", 0.0, nullptr, true},
-      {"=WORKDAY.INTL(2,-1)", 0.0, nullptr, true},
-      {"=WORKDAY.INTL(2,-1,11)", 0.0, nullptr, false},
-      {"=WORKDAY(1,-1)", 0.0, nullptr, true},
-      {"=WORKDAY.INTL(1,-1)", 0.0, nullptr, true},
-      {"=WORKDAY.INTL(1,-1,11)", 0.0, nullptr, false},
-      {"=WORKDAY(57,3)", 60.0, nullptr, false},
-      {"=WORKDAY.INTL(57,3)", 60.0, nullptr, false},
-      {"=WORKDAY.INTL(57,3,11)", 60.0, nullptr, false},
-      {"=WORKDAY(58,1)", 59.0, nullptr, false},
-      {"=WORKDAY.INTL(58,1)", 59.0, nullptr, false},
-      {"=WORKDAY.INTL(58,1,11)", 59.0, nullptr, false},
-      {"=WORKDAY(59,1)", 60.0, nullptr, false},
-      {"=WORKDAY.INTL(59,1)", 60.0, nullptr, false},
-      {"=WORKDAY.INTL(59,1,11)", 60.0, nullptr, false},
-      {"=WORKDAY(61,-1)", 60.0, nullptr, false},
-      {"=WORKDAY.INTL(61,-1)", 60.0, nullptr, false},
-      {"=WORKDAY.INTL(61,-1,11)", 60.0, nullptr, false},
-      {"=WORKDAY(62,-3)", 59.0, nullptr, false},
-      {"=WORKDAY.INTL(62,-3)", 59.0, nullptr, false},
-      {"=WORKDAY.INTL(62,-3,11)", 59.0, nullptr, false},
-      {"=TEXT(0,\"ddd\")", 0.0, "Sat", false},
-      {"=TEXT(0,\"dddd\")", 0.0, "Saturday", false},
-      {"=TEXT(0,\"aaa\")", 0.0, "土", false},
-      {"=WEEKNUM(0)", 0.0, nullptr, false},
-      {"=WEEKNUM(0,2)", 1.0, nullptr, false},
-      {"=WEEKNUM(0,21)", 52.0, nullptr, false},
-      {"=ISOWEEKNUM(0)", 52.0, nullptr, false},
-      {"=WEEKNUM(0,11)", 1.0, nullptr, false},
-      {"=WEEKNUM(0,17)", 0.0, nullptr, false},
-      {"=TEXT(1,\"ddd\")", 0.0, "Sun", false},
-      {"=TEXT(1,\"dddd\")", 0.0, "Sunday", false},
-      {"=TEXT(1,\"aaa\")", 0.0, "日", false},
-      {"=WEEKNUM(1)", 1.0, nullptr, false},
-      {"=WEEKNUM(1,2)", 1.0, nullptr, false},
-      {"=WEEKNUM(1,21)", 52.0, nullptr, false},
-      {"=ISOWEEKNUM(1)", 52.0, nullptr, false},
-      {"=WEEKNUM(1,11)", 1.0, nullptr, false},
-      {"=WEEKNUM(1,17)", 1.0, nullptr, false},
-      {"=TEXT(2,\"ddd\")", 0.0, "Mon", false},
-      {"=TEXT(2,\"dddd\")", 0.0, "Monday", false},
-      {"=TEXT(2,\"aaa\")", 0.0, "月", false},
-      {"=WEEKNUM(2)", 1.0, nullptr, false},
-      {"=WEEKNUM(2,2)", 2.0, nullptr, false},
-      {"=WEEKNUM(2,21)", 1.0, nullptr, false},
-      {"=ISOWEEKNUM(2)", 1.0, nullptr, false},
-      {"=WEEKNUM(2,11)", 2.0, nullptr, false},
-      {"=WEEKNUM(2,17)", 1.0, nullptr, false},
-      {"=TEXT(6,\"ddd\")", 0.0, "Fri", false},
-      {"=TEXT(6,\"dddd\")", 0.0, "Friday", false},
-      {"=TEXT(6,\"aaa\")", 0.0, "金", false},
-      {"=WEEKNUM(6)", 1.0, nullptr, false},
-      {"=WEEKNUM(6,2)", 2.0, nullptr, false},
-      {"=WEEKNUM(6,21)", 1.0, nullptr, false},
-      {"=ISOWEEKNUM(6)", 1.0, nullptr, false},
-      {"=WEEKNUM(6,11)", 2.0, nullptr, false},
-      {"=WEEKNUM(6,17)", 1.0, nullptr, false},
-      {"=TEXT(7,\"ddd\")", 0.0, "Sat", false},
-      {"=TEXT(7,\"dddd\")", 0.0, "Saturday", false},
-      {"=TEXT(7,\"aaa\")", 0.0, "土", false},
-      {"=WEEKNUM(7)", 1.0, nullptr, false},
-      {"=WEEKNUM(7,2)", 2.0, nullptr, false},
-      {"=WEEKNUM(7,21)", 1.0, nullptr, false},
-      {"=ISOWEEKNUM(7)", 1.0, nullptr, false},
-      {"=WEEKNUM(7,11)", 2.0, nullptr, false},
-      {"=WEEKNUM(7,17)", 1.0, nullptr, false},
-      {"=TEXT(8,\"ddd\")", 0.0, "Sun", false},
-      {"=TEXT(8,\"dddd\")", 0.0, "Sunday", false},
-      {"=TEXT(8,\"aaa\")", 0.0, "日", false},
-      {"=WEEKNUM(8)", 2.0, nullptr, false},
-      {"=WEEKNUM(8,2)", 2.0, nullptr, false},
-      {"=WEEKNUM(8,21)", 1.0, nullptr, false},
-      {"=ISOWEEKNUM(8)", 1.0, nullptr, false},
-      {"=WEEKNUM(8,11)", 2.0, nullptr, false},
-      {"=WEEKNUM(8,17)", 2.0, nullptr, false},
-      {"=TEXT(14,\"ddd\")", 0.0, "Sat", false},
-      {"=TEXT(14,\"dddd\")", 0.0, "Saturday", false},
-      {"=TEXT(14,\"aaa\")", 0.0, "土", false},
-      {"=WEEKNUM(14)", 2.0, nullptr, false},
-      {"=WEEKNUM(14,2)", 3.0, nullptr, false},
-      {"=WEEKNUM(14,21)", 2.0, nullptr, false},
-      {"=ISOWEEKNUM(14)", 2.0, nullptr, false},
-      {"=WEEKNUM(14,11)", 3.0, nullptr, false},
-      {"=WEEKNUM(14,17)", 2.0, nullptr, false},
-      {"=TEXT(15,\"ddd\")", 0.0, "Sun", false},
-      {"=TEXT(15,\"dddd\")", 0.0, "Sunday", false},
-      {"=TEXT(15,\"aaa\")", 0.0, "日", false},
-      {"=WEEKNUM(15)", 3.0, nullptr, false},
-      {"=WEEKNUM(15,2)", 3.0, nullptr, false},
-      {"=WEEKNUM(15,21)", 2.0, nullptr, false},
-      {"=ISOWEEKNUM(15)", 2.0, nullptr, false},
-      {"=WEEKNUM(15,11)", 3.0, nullptr, false},
-      {"=WEEKNUM(15,17)", 3.0, nullptr, false},
-      {"=TEXT(59,\"ddd\")", 0.0, "Tue", false},
-      {"=TEXT(59,\"dddd\")", 0.0, "Tuesday", false},
-      {"=TEXT(59,\"aaa\")", 0.0, "火", false},
-      {"=WEEKNUM(59)", 9.0, nullptr, false},
-      {"=WEEKNUM(59,2)", 10.0, nullptr, false},
-      {"=WEEKNUM(59,21)", 9.0, nullptr, false},
-      {"=ISOWEEKNUM(59)", 9.0, nullptr, false},
-      {"=WEEKNUM(59,11)", 10.0, nullptr, false},
-      {"=WEEKNUM(59,17)", 9.0, nullptr, false},
-      {"=TEXT(60,\"ddd\")", 0.0, "Wed", false},
-      {"=TEXT(60,\"dddd\")", 0.0, "Wednesday", false},
-      {"=TEXT(60,\"aaa\")", 0.0, "水", false},
-      {"=WEEKNUM(60)", 9.0, nullptr, false},
-      {"=WEEKNUM(60,2)", 10.0, nullptr, false},
-      {"=WEEKNUM(60,21)", 9.0, nullptr, false},
-      {"=ISOWEEKNUM(60)", 9.0, nullptr, false},
-      {"=WEEKNUM(60,11)", 10.0, nullptr, false},
-      {"=WEEKNUM(60,17)", 9.0, nullptr, false},
-      {"=TEXT(61,\"ddd\")", 0.0, "Thu", false},
-      {"=TEXT(61,\"dddd\")", 0.0, "Thursday", false},
-      {"=TEXT(61,\"aaa\")", 0.0, "木", false},
-      {"=WEEKNUM(61)", 9.0, nullptr, false},
-      {"=WEEKNUM(61,2)", 10.0, nullptr, false},
-      {"=WEEKNUM(61,21)", 9.0, nullptr, false},
-      {"=ISOWEEKNUM(61)", 9.0, nullptr, false},
-      {"=WEEKNUM(61,11)", 10.0, nullptr, false},
-      {"=WEEKNUM(61,17)", 9.0, nullptr, false},
-      {"=TEXT(62,\"ddd\")", 0.0, "Fri", false},
-      {"=TEXT(62,\"dddd\")", 0.0, "Friday", false},
-      {"=TEXT(62,\"aaa\")", 0.0, "金", false},
-      {"=WEEKNUM(62)", 9.0, nullptr, false},
-      {"=WEEKNUM(62,2)", 10.0, nullptr, false},
-      {"=WEEKNUM(62,21)", 9.0, nullptr, false},
-      {"=ISOWEEKNUM(62)", 9.0, nullptr, false},
-      {"=WEEKNUM(62,11)", 10.0, nullptr, false},
-      {"=WEEKNUM(62,17)", 9.0, nullptr, false},
-      {"=TEXT(365,\"ddd\")", 0.0, "Sun", false},
-      {"=TEXT(365,\"dddd\")", 0.0, "Sunday", false},
-      {"=TEXT(365,\"aaa\")", 0.0, "日", false},
-      {"=WEEKNUM(365)", 53.0, nullptr, false},
-      {"=WEEKNUM(365,2)", 53.0, nullptr, false},
-      {"=WEEKNUM(365,21)", 52.0, nullptr, false},
-      {"=ISOWEEKNUM(365)", 52.0, nullptr, false},
-      {"=WEEKNUM(365,11)", 53.0, nullptr, false},
-      {"=WEEKNUM(365,17)", 53.0, nullptr, false},
-      {"=TEXT(366,\"ddd\")", 0.0, "Mon", false},
-      {"=TEXT(366,\"dddd\")", 0.0, "Monday", false},
-      {"=TEXT(366,\"aaa\")", 0.0, "月", false},
-      {"=WEEKNUM(366)", 53.0, nullptr, false},
-      {"=WEEKNUM(366,2)", 54.0, nullptr, false},
-      {"=WEEKNUM(366,21)", 1.0, nullptr, false},
-      {"=ISOWEEKNUM(366)", 1.0, nullptr, false},
-      {"=WEEKNUM(366,11)", 54.0, nullptr, false},
-      {"=WEEKNUM(366,17)", 53.0, nullptr, false},
-  };
-  for (const Case& c : kCases) {
-    const Value v = EvalSource(c.formula);
-    if (c.num_error) {
-      ASSERT_TRUE(v.is_error()) << c.formula;
-      EXPECT_EQ(v.as_error(), ErrorCode::Num) << c.formula;
-    } else if (c.text != nullptr) {
-      ASSERT_TRUE(v.is_text()) << c.formula;
-      EXPECT_EQ(v.as_text(), c.text) << c.formula;
-    } else {
-      ASSERT_TRUE(v.is_number()) << c.formula;
-      EXPECT_EQ(v.as_number(), c.number) << c.formula;
-    }
-  }
-}
-
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins_datetime_test_helpers.h b/tests/unit/eval/builtins_datetime_test_helpers.h
new file mode 100644
index 000000000..8657d296d
--- /dev/null
+++ b/tests/unit/eval/builtins_datetime_test_helpers.h
@@ -0,0 +1,73 @@
+#pragma once
+
+#include <string_view>
+
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "sheet.h"
+#include "test_eval_helpers.h"
+#include "utils/arena.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon::eval {
+
+// Parses `src` and evaluates it via the default function registry. The
+// thread-local arenas keep text payloads readable for the immediately
+// following EXPECT_*. Each call resets the arenas to avoid cross-test
+// contamination.
+inline Value EvalSource(std::string_view src) {
+  static thread_local Arena parse_arena;
+  static thread_local Arena eval_arena;
+  parse_arena.reset();
+  eval_arena.reset();
+  parser::Parser p(src, parse_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  return evaluate(*root, eval_arena, default_registry(), test::mac_context());
+}
+
+// Bound-workbook variant used by NETWORKDAYS / WORKDAY tests: lets A1-style
+// refs in the formula resolve against the sheet's live cells so range-
+// sourced holiday lists exercise the same path as real workbooks.
+inline Value EvalSourceIn(std::string_view src, const Workbook& wb, const Sheet& current) {
+  static thread_local Arena parse_arena;
+  static thread_local Arena eval_arena;
+  parse_arena.reset();
+  eval_arena.reset();
+  parser::Parser p(src, parse_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  EvalState state;
+  const EvalContext ctx(wb, current, state);
+  return evaluate(*root, eval_arena, default_registry(), ctx);
+}
+
+// Evaluates `src` under the 1904 date system (the calendar family reads the
+// epoch from `EvalContext::date1904()`).
+inline Value EvalSource1904(std::string_view src) {
+  static thread_local Arena parse_arena;
+  static thread_local Arena eval_arena;
+  parse_arena.reset();
+  eval_arena.reset();
+  parser::Parser p(src, parse_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  return evaluate(*root, eval_arena, default_registry(), test::mac_context().with_date1904(true));
+}
+
+}  // namespace formulon::eval
diff --git a/tests/unit/eval/builtins_distributions_beta_gamma_test.cpp b/tests/unit/eval/builtins_distributions_beta_gamma_test.cpp
new file mode 100644
index 000000000..52af8d59a
--- /dev/null
+++ b/tests/unit/eval/builtins_distributions_beta_gamma_test.cpp
@@ -0,0 +1,336 @@
+// Probability distribution tests grouped by distribution family.
+
+#include <cmath>
+#include <iomanip>
+#include <sstream>
+#include <string>
+#include <string_view>
+
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "util/test_eval_helpers.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using formulon::test::EvalSource;
+
+TEST(BuiltinsBetaInv, Symmetric) {
+  // BETA(2, 2) is symmetric around 0.5, so the median is 0.5.
+  const Value v = EvalSource("=BETA.INV(0.5, 2, 2)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.5, 1e-9);
+}
+
+TEST(BuiltinsBetaInv, ScaledSupport) {
+  // Median of BETA(2, 2) rescaled to [0, 10] is 5.
+  const Value v = EvalSource("=BETA.INV(0.5, 2, 2, 0, 10)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 5.0, 1e-9);
+}
+
+TEST(BuiltinsBetaInv, PZeroIsNum) {
+  const Value v = EvalSource("=BETA.INV(0, 2, 3)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsBetaInv, POneIsNum) {
+  const Value v = EvalSource("=BETA.INV(1, 2, 3)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsBetaInv, TailTinyProbabilityRecoversNearZeroAnswer) {
+  // For p far below the absolute Newton tolerance, the inverter must
+  // converge in x-space rather than terminating on |cdf(x)-p| < kTol.
+  // The true root for BETA.INV(3.038194444441917e-24, 2, 2.5, 0, 1.2)
+  // is ~1e-12 (i.e. y = 8.33e-13 in standard support, then rescaled
+  // by B - A = 1.2).
+  const Value v = EvalSource("=BETA.INV(3.038194444441917e-24, 2, 2.5, 0, 1.2)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.0e-12, 5e-8);
+}
+
+TEST(BuiltinsBetaInv, RoundTripTinyAtSupportBoundary) {
+  // BETA.INV must round-trip BETA.DIST near the support boundary even
+  // when the resulting CDF probability is extreme.
+  const Value cdf = EvalSource("=BETA.DIST(1e-12, 2, 2.5, TRUE, 0, 1.2)");
+  ASSERT_TRUE(cdf.is_number());
+  std::ostringstream oss;
+  oss << std::setprecision(17) << cdf.as_number();
+  const std::string formula = "=BETA.INV(" + oss.str() + ", 2, 2.5, 0, 1.2)";
+  const Value back = EvalSource(formula);
+  ASSERT_TRUE(back.is_number());
+  EXPECT_NEAR(back.as_number(), 1.0e-12, 5e-8);
+}
+
+TEST(BuiltinsBetaInv, ExtremeTailDoesNotClampToFixedLowerBound) {
+  // BETA(1, 1) has CDF(x) = x, making this an exact probe of the inverter's
+  // lower search bound rather than of the incomplete-beta approximation.
+  const Value v = EvalSource("=BETA.INV(5.77e-151, 1, 1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 5.77e-151, 1e-160);
+}
+
+TEST(BuiltinsGamma, IntegerFactorial) {
+  // Γ(5) = 4! = 24.
+  const Value v = EvalSource("=GAMMA(5)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 24.0, 1e-10);
+}
+
+TEST(BuiltinsGamma, HalfIsSqrtPi) {
+  // Γ(0.5) = sqrt(pi) ~ 1.7724538509055159.
+  const Value v = EvalSource("=GAMMA(0.5)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.7724538509055159, 1e-12);
+}
+
+TEST(BuiltinsGamma, NegativeNonIntegerIsFinite) {
+  // Γ(-0.5) = -2 * sqrt(pi) ~ -3.544907701811032.
+  const Value v = EvalSource("=GAMMA(-0.5)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), -3.544907701811032, 1e-12);
+}
+
+TEST(BuiltinsGamma, ZeroIsNum) {
+  const Value v = EvalSource("=GAMMA(0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsGamma, NegativeIntegerIsNum) {
+  const Value v = EvalSource("=GAMMA(-3)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsGammaln, LnFactorialOfTen) {
+  // ln Γ(10) = ln(9!) = ln(362880) ~ 12.801827480081469.
+  const Value v = EvalSource("=GAMMALN(10)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 12.801827480081469, 1e-10);
+}
+
+TEST(BuiltinsGammalnPrecise, AgreesWithGammaln) {
+  const Value a = EvalSource("=GAMMALN(7.5)");
+  const Value b = EvalSource("=GAMMALN.PRECISE(7.5)");
+  ASSERT_TRUE(a.is_number());
+  ASSERT_TRUE(b.is_number());
+  EXPECT_DOUBLE_EQ(a.as_number(), b.as_number());
+}
+
+TEST(BuiltinsGammaln, ZeroIsNum) {
+  const Value v = EvalSource("=GAMMALN(0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsGammaln, NegativeIsNum) {
+  const Value v = EvalSource("=GAMMALN(-1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsGammaDist, CdfBasic) {
+  // GAMMA(alpha=3, beta=2) CDF at x=2 ~ 0.080301 (scipy:
+  // gammainc(3, 1) where x/beta = 2/2 = 1).
+  const Value v = EvalSource("=GAMMA.DIST(2, 3, 2, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.080301, 1e-5);
+}
+
+TEST(BuiltinsGammaDist, PdfBasic) {
+  // PDF of GAMMA(3, 2) at x=2: (1 / (2^3 * Γ(3))) * 2^2 * exp(-1)
+  //   = (1 / 16) * 4 * e^-1 ~ 0.09196986029286058.
+  const Value v = EvalSource("=GAMMA.DIST(2, 3, 2, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.09196986029286058, 1e-10);
+}
+
+TEST(BuiltinsGammaDist, CdfZero) {
+  const Value v = EvalSource("=GAMMA.DIST(0, 3, 2, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsGammaDist, NegativeXIsNum) {
+  const Value v = EvalSource("=GAMMA.DIST(-1, 3, 2, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsGammaDist, NegativeAlphaIsNum) {
+  const Value v = EvalSource("=GAMMA.DIST(1, -1, 2, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsGammaDist, NegativeBetaIsNum) {
+  const Value v = EvalSource("=GAMMA.DIST(1, 3, -2, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsGammaInv, RoundTrip) {
+  // GAMMA.INV(GAMMA.DIST(x, a, b, TRUE), a, b) == x.
+  const Value cdf = EvalSource("=GAMMA.DIST(4, 3, 2, TRUE)");
+  ASSERT_TRUE(cdf.is_number());
+  std::ostringstream oss;
+  oss << std::setprecision(17) << cdf.as_number();
+  const std::string formula = "=GAMMA.INV(" + oss.str() + ", 3, 2)";
+  const Value back = EvalSource(formula);
+  ASSERT_TRUE(back.is_number());
+  EXPECT_NEAR(back.as_number(), 4.0, 1e-6);
+}
+
+TEST(BuiltinsGammaInv, PZeroIsZero) {
+  const Value v = EvalSource("=GAMMA.INV(0, 3, 2)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsGammaInv, POneIsNum) {
+  const Value v = EvalSource("=GAMMA.INV(1, 3, 2)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsGammaInv, NegativeAlphaIsNum) {
+  const Value v = EvalSource("=GAMMA.INV(0.5, -1, 2)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsWeibullDist, CdfBasic) {
+  // WEIBULL(alpha=20, beta=100) CDF at x=105 ~ 0.929581.
+  const Value v = EvalSource("=WEIBULL.DIST(105, 20, 100, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.929581, 1e-5);
+}
+
+TEST(BuiltinsWeibullDist, PdfAtBoundaryIsZero) {
+  // Mac Excel 365 returns exactly 0 for the Weibull PDF at x == 0
+  // regardless of alpha (including the alpha == 1 exponential case where
+  // the mathematical limit would be 1/beta = 1). Verified against the
+  // oracle.
+  const Value v = EvalSource("=WEIBULL.DIST(0, 1, 1, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsWeibullDist, PdfAtBoundarySubLinearIsZero) {
+  // alpha < 1 would mathematically diverge at x == 0, but Excel's
+  // "boundary is zero" rule still applies: no #NUM!, just 0.
+  const Value v = EvalSource("=WEIBULL.DIST(0, 0.5, 1, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsWeibullDist, PdfAwayFromBoundary) {
+  // Weibull PDF with alpha=2, beta=1, x=1: (2/1) * 1^1 * exp(-1) = 2/e.
+  const Value v = EvalSource("=WEIBULL.DIST(1, 2, 1, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 2.0 / std::exp(1.0), 1e-12);
+}
+
+TEST(BuiltinsWeibullDist, CdfAtZero) {
+  const Value v = EvalSource("=WEIBULL.DIST(0, 2, 1, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsWeibullDist, NegativeXIsNum) {
+  const Value v = EvalSource("=WEIBULL.DIST(-1, 2, 3, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsWeibullDist, ZeroAlphaIsNum) {
+  const Value v = EvalSource("=WEIBULL.DIST(1, 0, 2, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsBetaDist, CdfStandardSupport) {
+  // BETA(alpha=8, beta=10) CDF at 0.4 ~ 0.35949234 (numerical integration
+  // of the Beta(8, 10) PDF from 0 to 0.4; also matches scipy's betainc).
+  const Value v = EvalSource("=BETA.DIST(0.4, 8, 10, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.35949234293309229, 1e-10);
+}
+
+TEST(BuiltinsBetaDist, PdfStandardSupport) {
+  // BETA(alpha=2, beta=2) PDF at 0.5 = 6 * 0.5 * 0.5 = 1.5.
+  const Value v = EvalSource("=BETA.DIST(0.5, 2, 2, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.5, 1e-12);
+}
+
+TEST(BuiltinsBetaDist, ScaledSupportCdf) {
+  // Rescaled BETA(8, 10) on [1, 3] at x=1.8: y = (1.8 - 1)/(3 - 1) = 0.4,
+  // so the CDF matches the standard-support case at y = 0.4.
+  const Value v = EvalSource("=BETA.DIST(1.8, 8, 10, TRUE, 1, 3)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.35949234293309229, 1e-10);
+}
+
+TEST(BuiltinsBetaDist, ScaledSupportPdfJacobian) {
+  // Rescaled BETA(2, 2) on [0, 2] at x=1 is PDF(0.5) / span = 1.5 / 2 = 0.75.
+  const Value v = EvalSource("=BETA.DIST(1, 2, 2, FALSE, 0, 2)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.75, 1e-12);
+}
+
+TEST(BuiltinsBetaDist, CdfLowerBound) {
+  const Value v = EvalSource("=BETA.DIST(0, 2, 3, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsBetaDist, CdfUpperBound) {
+  const Value v = EvalSource("=BETA.DIST(1, 2, 3, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
+TEST(BuiltinsBetaDist, NegativeAlphaIsNum) {
+  const Value v = EvalSource("=BETA.DIST(0.5, -1, 2, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsBetaDist, XOutOfSupportIsNum) {
+  const Value v = EvalSource("=BETA.DIST(1.5, 2, 3, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsBetaDist, AGtBIsNum) {
+  const Value v = EvalSource("=BETA.DIST(0.5, 2, 3, TRUE, 2, 1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsBetaInv, RoundTrip) {
+  // BETA.INV(BETA.DIST(0.4, 8, 10, TRUE), 8, 10) should recover 0.4.
+  const Value cdf = EvalSource("=BETA.DIST(0.4, 8, 10, TRUE)");
+  ASSERT_TRUE(cdf.is_number());
+  std::ostringstream oss;
+  oss << std::setprecision(17) << cdf.as_number();
+  const std::string formula = "=BETA.INV(" + oss.str() + ", 8, 10)";
+  const Value back = EvalSource(formula);
+  ASSERT_TRUE(back.is_number());
+  EXPECT_NEAR(back.as_number(), 0.4, 1e-9);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_distributions_tail_test.cpp b/tests/unit/eval/builtins_distributions_tail_test.cpp
new file mode 100644
index 000000000..136908c6a
--- /dev/null
+++ b/tests/unit/eval/builtins_distributions_tail_test.cpp
@@ -0,0 +1,176 @@
+// Probability distribution tests grouped by distribution family.
+
+#include <cmath>
+#include <iomanip>
+#include <sstream>
+#include <string>
+#include <string_view>
+
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "util/test_eval_helpers.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using formulon::test::EvalSource;
+
+TEST(BuiltinsLognormDist, CdfBasic) {
+  // LOGNORM(mean=3.5, sd=1.2) CDF at x=4 ~ 0.039083.
+  const Value v = EvalSource("=LOGNORM.DIST(4, 3.5, 1.2, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.039083, 1e-5);
+}
+
+TEST(BuiltinsLognormDist, PdfBasic) {
+  // LOGNORM(mean=0, sd=1) PDF at x=1 = 1/(1 * sqrt(2*pi)) ~ 0.398942.
+  const Value v = EvalSource("=LOGNORM.DIST(1, 0, 1, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 0.39894228040143267, 1e-12);
+}
+
+TEST(BuiltinsLognormDist, ZeroXIsNum) {
+  const Value v = EvalSource("=LOGNORM.DIST(0, 0, 1, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsLognormDist, NegativeXIsNum) {
+  const Value v = EvalSource("=LOGNORM.DIST(-1, 0, 1, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsLognormDist, ZeroSdIsNum) {
+  const Value v = EvalSource("=LOGNORM.DIST(1, 0, 0, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsLognormInv, Median) {
+  // Median of LOGNORM(mean=0, sd=1) is exp(0) = 1.
+  const Value v = EvalSource("=LOGNORM.INV(0.5, 0, 1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.0, 1e-9);
+}
+
+TEST(BuiltinsLognormInv, RoundTrip) {
+  const Value cdf = EvalSource("=LOGNORM.DIST(2, 0, 1, TRUE)");
+  ASSERT_TRUE(cdf.is_number());
+  std::ostringstream oss;
+  oss << std::setprecision(17) << cdf.as_number();
+  const std::string formula = "=LOGNORM.INV(" + oss.str() + ", 0, 1)";
+  const Value back = EvalSource(formula);
+  ASSERT_TRUE(back.is_number());
+  EXPECT_NEAR(back.as_number(), 2.0, 1e-9);
+}
+
+TEST(BuiltinsLognormInv, PZeroIsNum) {
+  const Value v = EvalSource("=LOGNORM.INV(0, 0, 1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsLognormInv, POneIsNum) {
+  const Value v = EvalSource("=LOGNORM.INV(1, 0, 1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsHypgeomDist, PmfBasic) {
+  // HYPGEOM(k=1, n=4, K=8, N=20) PMF = C(8,1)*C(12,3)/C(20,4)
+  //   = 8 * 220 / 4845 = 1760/4845 ~ 0.36326109391124871.
+  const Value v = EvalSource("=HYPGEOM.DIST(1, 4, 8, 20, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1760.0 / 4845.0, 1e-12);
+}
+
+TEST(BuiltinsHypgeomDist, CdfBasic) {
+  // CDF at k=2 for (n=4, K=8, N=20) should equal sum of PMFs 0..2.
+  const Value cdf = EvalSource("=HYPGEOM.DIST(2, 4, 8, 20, TRUE)");
+  const Value sum = EvalSource(
+      "=HYPGEOM.DIST(0, 4, 8, 20, FALSE) + HYPGEOM.DIST(1, 4, 8, 20, FALSE) + HYPGEOM.DIST(2, 4, 8, 20, FALSE)");
+  ASSERT_TRUE(cdf.is_number());
+  ASSERT_TRUE(sum.is_number());
+  EXPECT_NEAR(cdf.as_number(), sum.as_number(), 1e-12);
+}
+
+TEST(BuiltinsHypgeomDist, FullSupportCdfIsOne) {
+  // Summing PMFs over the full support must equal 1. For (n=4, K=8, N=20)
+  // the support is k in [max(0, 4+8-20), min(4, 8)] = [0, 4].
+  const Value v = EvalSource("=HYPGEOM.DIST(4, 4, 8, 20, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
+}
+
+TEST(BuiltinsHypgeomDist, PmfZeroSuccesses) {
+  // PMF(0; n=4, K=8, N=20) = C(8, 0) * C(12, 4) / C(20, 4).
+  // = 1 * 495 / 4845 ~ 0.10216718266.
+  const Value v = EvalSource("=HYPGEOM.DIST(0, 4, 8, 20, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 495.0 / 4845.0, 1e-12);
+}
+
+TEST(BuiltinsHypgeomDist, NegativeKIsNum) {
+  // Mac Excel 365 rejects k < 0 with #NUM! (not 0): a negative sample
+  // count is treated as malformed input, not merely infeasible. Verified
+  // against the oracle golden.
+  const Value v = EvalSource("=HYPGEOM.DIST(-1, 4, 8, 20, FALSE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsHypgeomDist, SampleBiggerThanPopIsNum) {
+  // Genuinely malformed: sample size > population. Excel surfaces #NUM!.
+  const Value v = EvalSource("=HYPGEOM.DIST(0, 25, 8, 20, FALSE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsHypgeomDist, KBiggerThanSampleIsZero) {
+  // k = 5 exceeds n = 4 (no way to draw 5 successes in a sample of 4).
+  // Excel treats this as an infeasible-k case and returns 0, not #NUM!.
+  const Value v = EvalSource("=HYPGEOM.DIST(5, 4, 8, 20, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsHypgeomDist, KBiggerThanKIsZero) {
+  // k = 9 exceeds K = 8 (can't have more successes than the total number
+  // of successes in the population). Out of support -> 0.
+  const Value v = EvalSource("=HYPGEOM.DIST(9, 10, 8, 20, FALSE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsHypgeomDist, CdfBeyondSupportIsOne) {
+  // CDF at k = 10 (beyond k_max = 4 for this configuration) is 1.0.
+  const Value v = EvalSource("=HYPGEOM.DIST(10, 4, 8, 20, TRUE)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
+TEST(BuiltinsHypgeomDist, CdfNegativeKIsNum) {
+  // Symmetric with the PMF case: k < 0 is malformed, not infeasible.
+  const Value v = EvalSource("=HYPGEOM.DIST(-1, 4, 8, 20, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsHypgeomDist, BigKBiggerThanPopIsNum) {
+  // K > N is a genuinely malformed arrangement (more successes in the
+  // population than the population itself). Excel surfaces #NUM!.
+  const Value v = EvalSource("=HYPGEOM.DIST(0, 4, 25, 20, FALSE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_distributions_test.cpp b/tests/unit/eval/builtins_distributions_test.cpp
index 1cfb2fe11..f3be72f34 100644
--- a/tests/unit/eval/builtins_distributions_test.cpp
+++ b/tests/unit/eval/builtins_distributions_test.cpp
@@ -1,14 +1,4 @@
-//
-// End-to-end tests for the probability-distribution family registered by
-// `register_stats_builtins`: NORM.DIST, NORM.S.DIST, NORM.INV, NORM.S.INV,
-// BINOM.DIST, POISSON.DIST, and EXPON.DIST.
-//
-// These functions are scalar-only (no range expansion), so every case
-// here exercises the tree walker's eager path: each argument is
-// pre-evaluated, coerced via `coerce_to_number` / `coerce_to_bool`, and
-// handed to the impl. Tests cover PDF/CDF symmetry identities,
-// PDF/INV round-trips, tail summation, and every documented
-// `#NUM!` domain case.
+// Probability distribution tests grouped by distribution family.
 
 #include <cmath>
 #include <iomanip>
@@ -29,13 +19,8 @@
 namespace formulon {
 namespace eval {
 namespace {
-
 using formulon::test::EvalSource;
 
-// ---------------------------------------------------------------------------
-// Registry pins
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsDistributionsRegistry, AllNamesRegistered) {
   for (const char* name : {"NORM.DIST", "NORM.S.DIST", "NORM.INV", "NORM.S.INV", "BINOM.DIST", "POISSON.DIST",
                            "EXPON.DIST", "BETA.DIST", "BETA.INV", "GAMMA", "GAMMALN", "GAMMALN.PRECISE", "GAMMA.DIST",
@@ -44,10 +29,6 @@ TEST(BuiltinsDistributionsRegistry, AllNamesRegistered) {
   }
 }
 
-// ---------------------------------------------------------------------------
-// NORM.DIST
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsNormDist, StandardPdfAtZero) {
   // PDF of N(0, 1) at 0 is 1 / sqrt(2*pi) ~ 0.3989422804...
   const Value v = EvalSource("=NORM.DIST(0, 0, 1, FALSE)");
@@ -102,10 +83,6 @@ TEST(BuiltinsNormDist, ZeroSdIsNum) {
   EXPECT_EQ(v.as_error(), ErrorCode::Num);
 }
 
-// ---------------------------------------------------------------------------
-// NORM.S.DIST
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsNormSDist, CdfAtZero) {
   const Value v = EvalSource("=NORM.S.DIST(0, TRUE)");
   ASSERT_TRUE(v.is_number());
@@ -125,10 +102,6 @@ TEST(BuiltinsNormSDist, PdfAtZero) {
   EXPECT_NEAR(v.as_number(), 0.39894228040143267, 1e-12);
 }
 
-// ---------------------------------------------------------------------------
-// NORM.INV / NORM.S.INV
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsNormInv, HalfIsZero) {
   const Value v = EvalSource("=NORM.INV(0.5, 0, 1)");
   ASSERT_TRUE(v.is_number());
@@ -201,10 +174,6 @@ TEST(BuiltinsNormInv, RoundTripFromDist) {
   EXPECT_NEAR(back.as_number(), 1.25, 1e-9);
 }
 
-// ---------------------------------------------------------------------------
-// BINOM.DIST
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsBinomDist, PmfFairCoinFiveHeads) {
   // BINOM(10, 0.5) PMF at 5 = C(10, 5) / 2^10 = 252 / 1024 = 0.24609375.
   const Value v = EvalSource("=BINOM.DIST(5, 10, 0.5, FALSE)");
@@ -280,10 +249,6 @@ TEST(BuiltinsBinomDist, ProbOutOfRangeIsNum) {
   EXPECT_EQ(lo.as_error(), ErrorCode::Num);
 }
 
-// ---------------------------------------------------------------------------
-// POISSON.DIST
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsPoissonDist, PmfMean3AtTwo) {
   // Poisson(3) PMF at 2 = 3^2 * e^-3 / 2! ~ 0.224042.
   const Value v = EvalSource("=POISSON.DIST(2, 3, FALSE)");
@@ -345,19 +310,6 @@ TEST(BuiltinsPoissonDist, NegativeMeanIsNum) {
   EXPECT_EQ(v.as_error(), ErrorCode::Num);
 }
 
-// ---------------------------------------------------------------------------
-// Run time bounded by the size of the input, not its value
-//
-// The cumulative branches used to step once per unit of their argument, so
-// the cost of an answer tracked the magnitude a caller happened to type:
-// these cases ran for seconds at 1E8 and past the life of the process at
-// 1E12. Past a fixed ceiling on summed terms they now take a closed form
-// instead, and refuse only where that closed form cannot hold the
-// family's tolerance -- which depends on how balanced the beta shapes
-// are, not on how large the argument is. Either way the call returns
-// promptly.
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsDistributionBounds, PoissonCdfAnswersFarPastTheTermCeiling) {
   // Every term beyond a handful is negligible against mean = 1, so the
   // CDF is 1 to within double precision. The point is that it comes back
@@ -427,10 +379,6 @@ TEST(BuiltinsDistributionBounds, BinomCdfJustBelowTheCeilingStillSums) {
   EXPECT_NEAR(v.as_number(), 1.0, 1e-8);
 }
 
-// ---------------------------------------------------------------------------
-// EXPON.DIST
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsExponDist, PdfAtZero) {
   // Exponential(lambda=1) PDF at 0 = lambda = 1.
   const Value v = EvalSource("=EXPON.DIST(0, 1, FALSE)");
@@ -469,10 +417,6 @@ TEST(BuiltinsExponDist, NegativeLambdaIsNum) {
   EXPECT_EQ(v.as_error(), ErrorCode::Num);
 }
 
-// ---------------------------------------------------------------------------
-// Cross-function consistency
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsDistributions, NormDistAndSDistAgree) {
   // NORM.DIST with mean=0, sd=1 must match NORM.S.DIST for the same inputs.
   const Value a = EvalSource("=NORM.DIST(1.5, 0, 1, TRUE)");
@@ -504,506 +448,6 @@ TEST(BuiltinsDistributions, ArityRejectsExtraArgs) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// BETA.DIST
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsBetaDist, CdfStandardSupport) {
-  // BETA(alpha=8, beta=10) CDF at 0.4 ~ 0.35949234 (numerical integration
-  // of the Beta(8, 10) PDF from 0 to 0.4; also matches scipy's betainc).
-  const Value v = EvalSource("=BETA.DIST(0.4, 8, 10, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.35949234293309229, 1e-10);
-}
-
-TEST(BuiltinsBetaDist, PdfStandardSupport) {
-  // BETA(alpha=2, beta=2) PDF at 0.5 = 6 * 0.5 * 0.5 = 1.5.
-  const Value v = EvalSource("=BETA.DIST(0.5, 2, 2, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.5, 1e-12);
-}
-
-TEST(BuiltinsBetaDist, ScaledSupportCdf) {
-  // Rescaled BETA(8, 10) on [1, 3] at x=1.8: y = (1.8 - 1)/(3 - 1) = 0.4,
-  // so the CDF matches the standard-support case at y = 0.4.
-  const Value v = EvalSource("=BETA.DIST(1.8, 8, 10, TRUE, 1, 3)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.35949234293309229, 1e-10);
-}
-
-TEST(BuiltinsBetaDist, ScaledSupportPdfJacobian) {
-  // Rescaled BETA(2, 2) on [0, 2] at x=1 is PDF(0.5) / span = 1.5 / 2 = 0.75.
-  const Value v = EvalSource("=BETA.DIST(1, 2, 2, FALSE, 0, 2)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.75, 1e-12);
-}
-
-TEST(BuiltinsBetaDist, CdfLowerBound) {
-  const Value v = EvalSource("=BETA.DIST(0, 2, 3, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsBetaDist, CdfUpperBound) {
-  const Value v = EvalSource("=BETA.DIST(1, 2, 3, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
-}
-
-TEST(BuiltinsBetaDist, NegativeAlphaIsNum) {
-  const Value v = EvalSource("=BETA.DIST(0.5, -1, 2, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsBetaDist, XOutOfSupportIsNum) {
-  const Value v = EvalSource("=BETA.DIST(1.5, 2, 3, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsBetaDist, AGtBIsNum) {
-  const Value v = EvalSource("=BETA.DIST(0.5, 2, 3, TRUE, 2, 1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// BETA.INV
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsBetaInv, RoundTrip) {
-  // BETA.INV(BETA.DIST(0.4, 8, 10, TRUE), 8, 10) should recover 0.4.
-  const Value cdf = EvalSource("=BETA.DIST(0.4, 8, 10, TRUE)");
-  ASSERT_TRUE(cdf.is_number());
-  std::ostringstream oss;
-  oss << std::setprecision(17) << cdf.as_number();
-  const std::string formula = "=BETA.INV(" + oss.str() + ", 8, 10)";
-  const Value back = EvalSource(formula);
-  ASSERT_TRUE(back.is_number());
-  EXPECT_NEAR(back.as_number(), 0.4, 1e-9);
-}
-
-TEST(BuiltinsBetaInv, Symmetric) {
-  // BETA(2, 2) is symmetric around 0.5, so the median is 0.5.
-  const Value v = EvalSource("=BETA.INV(0.5, 2, 2)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.5, 1e-9);
-}
-
-TEST(BuiltinsBetaInv, ScaledSupport) {
-  // Median of BETA(2, 2) rescaled to [0, 10] is 5.
-  const Value v = EvalSource("=BETA.INV(0.5, 2, 2, 0, 10)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 5.0, 1e-9);
-}
-
-TEST(BuiltinsBetaInv, PZeroIsNum) {
-  const Value v = EvalSource("=BETA.INV(0, 2, 3)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsBetaInv, POneIsNum) {
-  const Value v = EvalSource("=BETA.INV(1, 2, 3)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsBetaInv, TailTinyProbabilityRecoversNearZeroAnswer) {
-  // For p far below the absolute Newton tolerance, the inverter must
-  // converge in x-space rather than terminating on |cdf(x)-p| < kTol.
-  // The true root for BETA.INV(3.038194444441917e-24, 2, 2.5, 0, 1.2)
-  // is ~1e-12 (i.e. y = 8.33e-13 in standard support, then rescaled
-  // by B - A = 1.2).
-  const Value v = EvalSource("=BETA.INV(3.038194444441917e-24, 2, 2.5, 0, 1.2)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.0e-12, 5e-8);
-}
-
-TEST(BuiltinsBetaInv, RoundTripTinyAtSupportBoundary) {
-  // BETA.INV must round-trip BETA.DIST near the support boundary even
-  // when the resulting CDF probability is extreme.
-  const Value cdf = EvalSource("=BETA.DIST(1e-12, 2, 2.5, TRUE, 0, 1.2)");
-  ASSERT_TRUE(cdf.is_number());
-  std::ostringstream oss;
-  oss << std::setprecision(17) << cdf.as_number();
-  const std::string formula = "=BETA.INV(" + oss.str() + ", 2, 2.5, 0, 1.2)";
-  const Value back = EvalSource(formula);
-  ASSERT_TRUE(back.is_number());
-  EXPECT_NEAR(back.as_number(), 1.0e-12, 5e-8);
-}
-
-TEST(BuiltinsBetaInv, ExtremeTailDoesNotClampToFixedLowerBound) {
-  // BETA(1, 1) has CDF(x) = x, making this an exact probe of the inverter's
-  // lower search bound rather than of the incomplete-beta approximation.
-  const Value v = EvalSource("=BETA.INV(5.77e-151, 1, 1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 5.77e-151, 1e-160);
-}
-
-// ---------------------------------------------------------------------------
-// GAMMA
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsGamma, IntegerFactorial) {
-  // Γ(5) = 4! = 24.
-  const Value v = EvalSource("=GAMMA(5)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 24.0, 1e-10);
-}
-
-TEST(BuiltinsGamma, HalfIsSqrtPi) {
-  // Γ(0.5) = sqrt(pi) ~ 1.7724538509055159.
-  const Value v = EvalSource("=GAMMA(0.5)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.7724538509055159, 1e-12);
-}
-
-TEST(BuiltinsGamma, NegativeNonIntegerIsFinite) {
-  // Γ(-0.5) = -2 * sqrt(pi) ~ -3.544907701811032.
-  const Value v = EvalSource("=GAMMA(-0.5)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), -3.544907701811032, 1e-12);
-}
-
-TEST(BuiltinsGamma, ZeroIsNum) {
-  const Value v = EvalSource("=GAMMA(0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsGamma, NegativeIntegerIsNum) {
-  const Value v = EvalSource("=GAMMA(-3)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// GAMMALN / GAMMALN.PRECISE
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsGammaln, LnFactorialOfTen) {
-  // ln Γ(10) = ln(9!) = ln(362880) ~ 12.801827480081469.
-  const Value v = EvalSource("=GAMMALN(10)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 12.801827480081469, 1e-10);
-}
-
-TEST(BuiltinsGammalnPrecise, AgreesWithGammaln) {
-  const Value a = EvalSource("=GAMMALN(7.5)");
-  const Value b = EvalSource("=GAMMALN.PRECISE(7.5)");
-  ASSERT_TRUE(a.is_number());
-  ASSERT_TRUE(b.is_number());
-  EXPECT_DOUBLE_EQ(a.as_number(), b.as_number());
-}
-
-TEST(BuiltinsGammaln, ZeroIsNum) {
-  const Value v = EvalSource("=GAMMALN(0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsGammaln, NegativeIsNum) {
-  const Value v = EvalSource("=GAMMALN(-1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// GAMMA.DIST
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsGammaDist, CdfBasic) {
-  // GAMMA(alpha=3, beta=2) CDF at x=2 ~ 0.080301 (scipy:
-  // gammainc(3, 1) where x/beta = 2/2 = 1).
-  const Value v = EvalSource("=GAMMA.DIST(2, 3, 2, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.080301, 1e-5);
-}
-
-TEST(BuiltinsGammaDist, PdfBasic) {
-  // PDF of GAMMA(3, 2) at x=2: (1 / (2^3 * Γ(3))) * 2^2 * exp(-1)
-  //   = (1 / 16) * 4 * e^-1 ~ 0.09196986029286058.
-  const Value v = EvalSource("=GAMMA.DIST(2, 3, 2, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.09196986029286058, 1e-10);
-}
-
-TEST(BuiltinsGammaDist, CdfZero) {
-  const Value v = EvalSource("=GAMMA.DIST(0, 3, 2, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsGammaDist, NegativeXIsNum) {
-  const Value v = EvalSource("=GAMMA.DIST(-1, 3, 2, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsGammaDist, NegativeAlphaIsNum) {
-  const Value v = EvalSource("=GAMMA.DIST(1, -1, 2, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsGammaDist, NegativeBetaIsNum) {
-  const Value v = EvalSource("=GAMMA.DIST(1, 3, -2, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// GAMMA.INV
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsGammaInv, RoundTrip) {
-  // GAMMA.INV(GAMMA.DIST(x, a, b, TRUE), a, b) == x.
-  const Value cdf = EvalSource("=GAMMA.DIST(4, 3, 2, TRUE)");
-  ASSERT_TRUE(cdf.is_number());
-  std::ostringstream oss;
-  oss << std::setprecision(17) << cdf.as_number();
-  const std::string formula = "=GAMMA.INV(" + oss.str() + ", 3, 2)";
-  const Value back = EvalSource(formula);
-  ASSERT_TRUE(back.is_number());
-  EXPECT_NEAR(back.as_number(), 4.0, 1e-6);
-}
-
-TEST(BuiltinsGammaInv, PZeroIsZero) {
-  const Value v = EvalSource("=GAMMA.INV(0, 3, 2)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsGammaInv, POneIsNum) {
-  const Value v = EvalSource("=GAMMA.INV(1, 3, 2)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsGammaInv, NegativeAlphaIsNum) {
-  const Value v = EvalSource("=GAMMA.INV(0.5, -1, 2)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// WEIBULL.DIST
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsWeibullDist, CdfBasic) {
-  // WEIBULL(alpha=20, beta=100) CDF at x=105 ~ 0.929581.
-  const Value v = EvalSource("=WEIBULL.DIST(105, 20, 100, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.929581, 1e-5);
-}
-
-TEST(BuiltinsWeibullDist, PdfAtBoundaryIsZero) {
-  // Mac Excel 365 returns exactly 0 for the Weibull PDF at x == 0
-  // regardless of alpha (including the alpha == 1 exponential case where
-  // the mathematical limit would be 1/beta = 1). Verified against the
-  // oracle.
-  const Value v = EvalSource("=WEIBULL.DIST(0, 1, 1, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsWeibullDist, PdfAtBoundarySubLinearIsZero) {
-  // alpha < 1 would mathematically diverge at x == 0, but Excel's
-  // "boundary is zero" rule still applies: no #NUM!, just 0.
-  const Value v = EvalSource("=WEIBULL.DIST(0, 0.5, 1, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsWeibullDist, PdfAwayFromBoundary) {
-  // Weibull PDF with alpha=2, beta=1, x=1: (2/1) * 1^1 * exp(-1) = 2/e.
-  const Value v = EvalSource("=WEIBULL.DIST(1, 2, 1, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 2.0 / std::exp(1.0), 1e-12);
-}
-
-TEST(BuiltinsWeibullDist, CdfAtZero) {
-  const Value v = EvalSource("=WEIBULL.DIST(0, 2, 1, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsWeibullDist, NegativeXIsNum) {
-  const Value v = EvalSource("=WEIBULL.DIST(-1, 2, 3, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsWeibullDist, ZeroAlphaIsNum) {
-  const Value v = EvalSource("=WEIBULL.DIST(1, 0, 2, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// LOGNORM.DIST
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsLognormDist, CdfBasic) {
-  // LOGNORM(mean=3.5, sd=1.2) CDF at x=4 ~ 0.039083.
-  const Value v = EvalSource("=LOGNORM.DIST(4, 3.5, 1.2, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.039083, 1e-5);
-}
-
-TEST(BuiltinsLognormDist, PdfBasic) {
-  // LOGNORM(mean=0, sd=1) PDF at x=1 = 1/(1 * sqrt(2*pi)) ~ 0.398942.
-  const Value v = EvalSource("=LOGNORM.DIST(1, 0, 1, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 0.39894228040143267, 1e-12);
-}
-
-TEST(BuiltinsLognormDist, ZeroXIsNum) {
-  const Value v = EvalSource("=LOGNORM.DIST(0, 0, 1, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsLognormDist, NegativeXIsNum) {
-  const Value v = EvalSource("=LOGNORM.DIST(-1, 0, 1, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsLognormDist, ZeroSdIsNum) {
-  const Value v = EvalSource("=LOGNORM.DIST(1, 0, 0, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// LOGNORM.INV
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsLognormInv, Median) {
-  // Median of LOGNORM(mean=0, sd=1) is exp(0) = 1.
-  const Value v = EvalSource("=LOGNORM.INV(0.5, 0, 1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.0, 1e-9);
-}
-
-TEST(BuiltinsLognormInv, RoundTrip) {
-  const Value cdf = EvalSource("=LOGNORM.DIST(2, 0, 1, TRUE)");
-  ASSERT_TRUE(cdf.is_number());
-  std::ostringstream oss;
-  oss << std::setprecision(17) << cdf.as_number();
-  const std::string formula = "=LOGNORM.INV(" + oss.str() + ", 0, 1)";
-  const Value back = EvalSource(formula);
-  ASSERT_TRUE(back.is_number());
-  EXPECT_NEAR(back.as_number(), 2.0, 1e-9);
-}
-
-TEST(BuiltinsLognormInv, PZeroIsNum) {
-  const Value v = EvalSource("=LOGNORM.INV(0, 0, 1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsLognormInv, POneIsNum) {
-  const Value v = EvalSource("=LOGNORM.INV(1, 0, 1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// HYPGEOM.DIST
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsHypgeomDist, PmfBasic) {
-  // HYPGEOM(k=1, n=4, K=8, N=20) PMF = C(8,1)*C(12,3)/C(20,4)
-  //   = 8 * 220 / 4845 = 1760/4845 ~ 0.36326109391124871.
-  const Value v = EvalSource("=HYPGEOM.DIST(1, 4, 8, 20, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1760.0 / 4845.0, 1e-12);
-}
-
-TEST(BuiltinsHypgeomDist, CdfBasic) {
-  // CDF at k=2 for (n=4, K=8, N=20) should equal sum of PMFs 0..2.
-  const Value cdf = EvalSource("=HYPGEOM.DIST(2, 4, 8, 20, TRUE)");
-  const Value sum = EvalSource(
-      "=HYPGEOM.DIST(0, 4, 8, 20, FALSE) + HYPGEOM.DIST(1, 4, 8, 20, FALSE) + HYPGEOM.DIST(2, 4, 8, 20, FALSE)");
-  ASSERT_TRUE(cdf.is_number());
-  ASSERT_TRUE(sum.is_number());
-  EXPECT_NEAR(cdf.as_number(), sum.as_number(), 1e-12);
-}
-
-TEST(BuiltinsHypgeomDist, FullSupportCdfIsOne) {
-  // Summing PMFs over the full support must equal 1. For (n=4, K=8, N=20)
-  // the support is k in [max(0, 4+8-20), min(4, 8)] = [0, 4].
-  const Value v = EvalSource("=HYPGEOM.DIST(4, 4, 8, 20, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1.0, 1e-12);
-}
-
-TEST(BuiltinsHypgeomDist, PmfZeroSuccesses) {
-  // PMF(0; n=4, K=8, N=20) = C(8, 0) * C(12, 4) / C(20, 4).
-  // = 1 * 495 / 4845 ~ 0.10216718266.
-  const Value v = EvalSource("=HYPGEOM.DIST(0, 4, 8, 20, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 495.0 / 4845.0, 1e-12);
-}
-
-TEST(BuiltinsHypgeomDist, NegativeKIsNum) {
-  // Mac Excel 365 rejects k < 0 with #NUM! (not 0): a negative sample
-  // count is treated as malformed input, not merely infeasible. Verified
-  // against the oracle golden.
-  const Value v = EvalSource("=HYPGEOM.DIST(-1, 4, 8, 20, FALSE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsHypgeomDist, SampleBiggerThanPopIsNum) {
-  // Genuinely malformed: sample size > population. Excel surfaces #NUM!.
-  const Value v = EvalSource("=HYPGEOM.DIST(0, 25, 8, 20, FALSE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsHypgeomDist, KBiggerThanSampleIsZero) {
-  // k = 5 exceeds n = 4 (no way to draw 5 successes in a sample of 4).
-  // Excel treats this as an infeasible-k case and returns 0, not #NUM!.
-  const Value v = EvalSource("=HYPGEOM.DIST(5, 4, 8, 20, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsHypgeomDist, KBiggerThanKIsZero) {
-  // k = 9 exceeds K = 8 (can't have more successes than the total number
-  // of successes in the population). Out of support -> 0.
-  const Value v = EvalSource("=HYPGEOM.DIST(9, 10, 8, 20, FALSE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsHypgeomDist, CdfBeyondSupportIsOne) {
-  // CDF at k = 10 (beyond k_max = 4 for this configuration) is 1.0.
-  const Value v = EvalSource("=HYPGEOM.DIST(10, 4, 8, 20, TRUE)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
-}
-
-TEST(BuiltinsHypgeomDist, CdfNegativeKIsNum) {
-  // Symmetric with the PMF case: k < 0 is malformed, not infeasible.
-  const Value v = EvalSource("=HYPGEOM.DIST(-1, 4, 8, 20, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(BuiltinsHypgeomDist, BigKBiggerThanPopIsNum) {
-  // K > N is a genuinely malformed arrangement (more successes in the
-  // population than the population itself). Excel surfaces #NUM!.
-  const Value v = EvalSource("=HYPGEOM.DIST(0, 4, 25, 20, FALSE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins_financial_depreciation_test.cpp b/tests/unit/eval/builtins_financial_depreciation_test.cpp
new file mode 100644
index 000000000..3f3349b40
--- /dev/null
+++ b/tests/unit/eval/builtins_financial_depreciation_test.cpp
@@ -0,0 +1,299 @@
+// Financial builtin tests grouped by schedule family.
+
+#include <cmath>
+#include <string>
+#include <string_view>
+
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "sheet.h"
+#include "util/test_eval_helpers.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using formulon::test::EvalSource;
+using formulon::test::EvalSourceIn;
+
+TEST(FinancialSLN, Basic) {
+  const Value v = EvalSource("=SLN(10000, 1000, 5)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1800.0);
+}
+
+TEST(FinancialSLN, ZeroSalvage) {
+  const Value v = EvalSource("=SLN(10000, 0, 10)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1000.0);
+}
+
+TEST(FinancialSLN, IdentitySlnTimesLifeEqualsDepreciableBase) {
+  // SLN * life == cost - salvage for any legal inputs.
+  const Value v = EvalSource("=SLN(10000, 1000, 5)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number() * 5.0, 10000.0 - 1000.0);
+}
+
+TEST(FinancialSLN, LifeZeroIsDiv0) {
+  const Value v = EvalSource("=SLN(10000, 1000, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
+}
+
+TEST(FinancialSLN, NegativeLifeProducesNegativeDepreciation) {
+  // Oracle-verified: Excel 365 Mac returns the raw algebraic answer
+  // (-1800 for these inputs) rather than #NUM!.
+  const Value v = EvalSource("=SLN(10000, 1000, -5)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), -1800.0);
+}
+
+TEST(FinancialSLN, ArityMismatchIsValue) {
+  const Value v = EvalSource("=SLN(10000, 1000)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(FinancialSYD, FirstPeriod) {
+  // (10000-1000)*5*2/(5*6) = 3000
+  const Value v = EvalSource("=SYD(10000, 1000, 5, 1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 3000.0);
+}
+
+TEST(FinancialSYD, LastPeriod) {
+  // (10000-1000)*1*2/(5*6) = 600
+  const Value v = EvalSource("=SYD(10000, 1000, 5, 5)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 600.0);
+}
+
+TEST(FinancialSYD, SumAcrossAllPeriodsEqualsDepreciableBase) {
+  // sum_{p=1..life} SYD(cost, salvage, life, p) == cost - salvage.
+  double total = 0.0;
+  for (int p = 1; p <= 5; ++p) {
+    const std::string src = "=SYD(10000, 1000, 5, " + std::to_string(p) + ")";
+    const Value v = EvalSource(src);
+    ASSERT_TRUE(v.is_number()) << "p=" << p;
+    total += v.as_number();
+  }
+  EXPECT_NEAR(total, 9000.0, 1e-9);
+}
+
+TEST(FinancialSYD, PeriodOutOfRangeIsNum) {
+  const Value v = EvalSource("=SYD(10000, 1000, 5, 6)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialSYD, PeriodZeroIsNum) {
+  const Value v = EvalSource("=SYD(10000, 1000, 5, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialSYD, FractionalPeriodAccepted) {
+  // Excel 365 accepts fractional periods: the SYD formula is a linear
+  // schedule so period=0.1 evaluates naturally. Regression guard for the
+  // relaxation of the `period < 1` rejection.
+  //   (290-2)*(5-0.1+1)*2 / (5*6) = 288 * 5.9 * 2 / 30 = 113.28
+  const Value v = EvalSource("=SYD(290, 2, 5, 0.1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 113.28);
+}
+
+TEST(FinancialSYD, LifeZeroIsNum) {
+  const Value v = EvalSource("=SYD(10000, 1000, 0, 1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialDDB, FirstPeriod) {
+  // rate = 2/5 = 0.4; dep_1 = 10000 * 0.4 = 4000
+  const Value v = EvalSource("=DDB(10000, 1000, 5, 1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 4000.0);
+}
+
+TEST(FinancialDDB, SecondPeriod) {
+  // book = 6000 after period 1; dep_2 = 6000 * 0.4 = 2400
+  const Value v = EvalSource("=DDB(10000, 1000, 5, 2)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 2400.0);
+}
+
+TEST(FinancialDDB, CustomFactorTriples) {
+  // factor=3 -> rate = 3/5 = 0.6; dep_1 = 10000 * 0.6 = 6000
+  const Value v = EvalSource("=DDB(10000, 1000, 5, 1, 3)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 6000.0);
+}
+
+TEST(FinancialDDB, SalvageFloorCaps) {
+  // Running the full schedule: dep must never take book value below
+  // salvage. Verify total == cost - salvage (9000) exactly — DDB
+  // depreciates the full base over the asset's life, with the salvage
+  // floor absorbing whatever remains in the last period. For this
+  // schedule the final period is the capped one: 1296 * 0.4 = 518.4
+  // would overshoot, so dep_5 = book - salvage = 296.
+  double total = 0.0;
+  for (int p = 1; p <= 5; ++p) {
+    const std::string src = "=DDB(10000, 1000, 5, " + std::to_string(p) + ")";
+    const Value v = EvalSource(src);
+    ASSERT_TRUE(v.is_number()) << "p=" << p;
+    total += v.as_number();
+  }
+  EXPECT_NEAR(total, 9000.0, 1e-9);
+  const Value last = EvalSource("=DDB(10000, 1000, 5, 5)");
+  ASSERT_TRUE(last.is_number());
+  EXPECT_NEAR(last.as_number(), 296.0, 1e-9);
+}
+
+TEST(FinancialDDB, PeriodOutOfRangeIsNum) {
+  const Value v = EvalSource("=DDB(10000, 1000, 5, 6)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialDDB, NegativeCostIsNum) {
+  const Value v = EvalSource("=DDB(-100, 0, 5, 1)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialDDB, FactorZeroIsNum) {
+  const Value v = EvalSource("=DDB(10000, 1000, 5, 1, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialDB, FullYearFirstPeriod) {
+  // rate = round(1 - (0.1)^0.2, 3) = 0.369; dep_1 = 10000 * 0.369 = 3690.
+  const Value v = EvalSource("=DB(10000, 1000, 5, 1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 3690.0, 1e-6);
+}
+
+TEST(FinancialDB, PartialFirstYearProrated) {
+  // month=6: dep_1 = 10000 * 0.369 * 6/12 = 1845.
+  const Value v = EvalSource("=DB(10000, 1000, 5, 1, 6)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1845.0, 1e-6);
+}
+
+TEST(FinancialDB, PartialYearSumApproxEqualsDepreciableBase) {
+  // With month=6 the depreciation runs life+1 = 6 periods; the sum
+  // should approximately equal cost - salvage within the 3-decimal
+  // rate-rounding error.
+  double total = 0.0;
+  for (int p = 1; p <= 6; ++p) {
+    const std::string src = "=DB(10000, 1000, 5, " + std::to_string(p) + ", 6)";
+    const Value v = EvalSource(src);
+    ASSERT_TRUE(v.is_number()) << "p=" << p;
+    total += v.as_number();
+  }
+  // Excel's 3-decimal rate rounding produces a small residual between
+  // the sum of depreciations and the true depreciable base. Observed
+  // residual for this fixture (cost=10000, salvage=1000, life=5,
+  // month=6) is ~54 — tolerance of 100 leaves margin for rounding
+  // accumulation without masking a real regression.
+  EXPECT_NEAR(total, 9000.0, 100.0);
+}
+
+TEST(FinancialDB, PeriodLifePlusOneNeedsPartialFirstYear) {
+  // month=12 (full year) with period == life+1 is invalid.
+  const Value v = EvalSource("=DB(10000, 1000, 5, 6)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialDB, PeriodLifePlusOneWithPartialYearIsValid) {
+  // month=6, period=6 is the partial last year; must produce a
+  // positive, finite charge.
+  const Value v = EvalSource("=DB(10000, 1000, 5, 6, 6)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_GT(v.as_number(), 0.0);
+}
+
+TEST(FinancialDB, InvalidMonthIsNum) {
+  const Value v = EvalSource("=DB(10000, 1000, 5, 1, 13)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialDB, ZeroMonthIsNum) {
+  const Value v = EvalSource("=DB(10000, 1000, 5, 1, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialDb, MonthIsFlooredToInteger) {
+  // Mac Excel 365 evaluates DB using INT(month), not the raw fractional
+  // month argument. With month=9.2222 the formula reduces to rate=0.438,
+  // dep_1=32.85, dep_2=29.4117, dep_3=(100-32.85-29.4117)*0.438 =
+  // 16.5293754 — the same value Mac Excel and the IronCalc G10 oracle
+  // produce. Prior to the INT(month) fix this evaluated to ~16.329735
+  // because the fractional month fed directly into the rate-prorated
+  // first period.
+  const Value v = EvalSource("=DB(100, 10, 4, 3, 9.2222)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 16.5293754, 1e-6);
+}
+
+TEST(FinancialDb, ZeroCostReturnsZero) {
+  // Excel short-circuits zero-cost assets to zero depreciation to avoid
+  // the `(salvage/0)^(1/life)` blow-up. Verified against IronCalc G30.
+  const Value v = EvalSource("=DB(0, 10, 4, 1, 2)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 0.0);
+}
+
+TEST(FinancialDDB, HugeScheduleFallsBackToClosedForm) {
+  // Without the cap this would step 1e18 iterations. The closed form
+  // `cost * ((1-rate)^(p-1) - (1-rate)^p)` is exact for integer periods,
+  // so the answer is still well-defined.
+  const Value v = EvalSource("=DDB(1, 0, 2000000, 2000000)");
+  ASSERT_TRUE(v.is_number());
+  const double rate = 2.0 / 2000000.0;
+  const double expected = std::pow(1.0 - rate, 1999999.0) - std::pow(1.0 - rate, 2000000.0);
+  EXPECT_NEAR(v.as_number(), expected, expected * 1e-9);
+}
+
+TEST(FinancialDDB, ClosedFormAgreesWithTheIterativeSchedule) {
+  // The fallback is only sound because both branches compute the same
+  // number. Pin that at the largest period the iterative branch still
+  // takes, so a change to either branch is caught here.
+  const Value v = EvalSource("=DDB(1, 0, 2000000, 1048576)");
+  ASSERT_TRUE(v.is_number());
+  const double rate = 2.0 / 2000000.0;
+  const double expected = std::pow(1.0 - rate, 1048575.0) - std::pow(1.0 - rate, 1048576.0);
+  EXPECT_NEAR(v.as_number(), expected, expected * 1e-8);
+}
+
+TEST(FinancialDb, HugeScheduleIsNum) {
+  // DB's schedule carries a rounded rate and a partial-first-year term
+  // with no closed form to fall back on, so an over-long schedule is
+  // refused rather than approximated.
+  const Value v = EvalSource("=DB(10000, 1000, 1E18, 1E18, 6)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialDb, ScheduleWithinTheCapStillComputes) {
+  const Value v = EvalSource("=DB(10000, 1000, 5, 1, 6)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), 1845.0, 1e-9);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_financial_payments_test.cpp b/tests/unit/eval/builtins_financial_payments_test.cpp
new file mode 100644
index 000000000..7d521f9fc
--- /dev/null
+++ b/tests/unit/eval/builtins_financial_payments_test.cpp
@@ -0,0 +1,293 @@
+// Financial builtin tests grouped by schedule family.
+
+#include <cmath>
+#include <string>
+#include <string_view>
+
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "sheet.h"
+#include "util/test_eval_helpers.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using formulon::test::EvalSource;
+using formulon::test::EvalSourceIn;
+
+TEST(FinancialIPMT, FirstPeriodInterestDominates) {
+  // =IPMT(0.05/12, 1, 60, 25000): balance at start of period 1 is the
+  // full pv (25000), so interest = -25000 * (0.05/12) ~= -104.1667.
+  const Value v = EvalSource("=IPMT(0.05/12, 1, 60, 25000)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), -25000.0 * (0.05 / 12.0), 1e-8);
+}
+
+TEST(FinancialIPMT, LastPeriodInterestNearZero) {
+  // Interest in the final period is small in magnitude (most of the
+  // final payment is principal).
+  const Value v = EvalSource("=IPMT(0.05/12, 60, 60, 25000)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_LT(std::fabs(v.as_number()), 5.0);
+  EXPECT_LT(v.as_number(), 0.0);  // still negative (interest payment)
+}
+
+TEST(FinancialIPMT, IntegerPerBeyondNperIsNum) {
+  // Integer per > nper is an out-of-schedule period: Mac Excel 365 (and
+  // the IronCalc oracle) return #NUM! in this case.
+  const Value v = EvalSource("=IPMT(0.05/12, 61, 60, 25000)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialIPMT, FractionalPerBeyondNperMatchesOracle) {
+  // IronCalc / Mac Excel 365 oracle value for a fractional per > nper case
+  // at type == 0.
+  const Value v = EvalSource("=IPMT(0.1, 3.9, 3, 8000)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), -30.51485756246893, 1e-9);
+}
+
+TEST(FinancialIPMT, FractionalPerBeyondNperType1) {
+  // Same fractional per > nper case with fv=10 and annuity-due (type=1).
+  const Value v = EvalSource("=IPMT(0.1, 3.9, 3, 8000, 10, 1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), -26.866364667656, 1e-9);
+}
+
+TEST(FinancialIPMT, PerZeroIsNum) {
+  const Value v = EvalSource("=IPMT(0.05/12, 0, 60, 25000)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialIPMT, TypeOneFirstPeriodIsZero) {
+  // Annuity-due, first period: payment is at start so no interest has
+  // accrued. IPMT must be exactly 0.
+  const Value v = EvalSource("=IPMT(0.05/12, 1, 60, 25000, 0, 1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(FinancialIPMT, ZeroRateIsZero) {
+  // No interest ever accrues at rate=0.
+  const Value v = EvalSource("=IPMT(0, 5, 60, 25000)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(FinancialIPMT, ArityUnder) {
+  const Value v = EvalSource("=IPMT(0.05/12, 1, 60)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(FinancialPPMT, FirstPeriodPrincipal) {
+  // PPMT = PMT - IPMT for the same period.
+  const Value pmt = EvalSource("=PMT(0.05/12, 60, 25000)");
+  const Value ipmt = EvalSource("=IPMT(0.05/12, 1, 60, 25000)");
+  const Value ppmt = EvalSource("=PPMT(0.05/12, 1, 60, 25000)");
+  ASSERT_TRUE(pmt.is_number());
+  ASSERT_TRUE(ipmt.is_number());
+  ASSERT_TRUE(ppmt.is_number());
+  EXPECT_NEAR(ppmt.as_number(), pmt.as_number() - ipmt.as_number(), 1e-9);
+}
+
+TEST(FinancialPPMT, IdentityAcrossAllPeriods) {
+  // For every period i in [1, nper], IPMT(i) + PPMT(i) == PMT.
+  const Value pmt = EvalSource("=PMT(0.05/12, 60, 25000)");
+  ASSERT_TRUE(pmt.is_number());
+  // Probe a handful of representative periods (full sweep is expensive
+  // via EvalSource and adds no signal over ~5 strategic probes).
+  for (int per : {1, 2, 15, 30, 59, 60}) {
+    const std::string formula = "=IPMT(0.05/12, " + std::to_string(per) + ", 60, 25000) + PPMT(0.05/12, " +
+                                std::to_string(per) + ", 60, 25000)";
+    const Value sum = EvalSource(formula);
+    ASSERT_TRUE(sum.is_number()) << "per=" << per;
+    EXPECT_NEAR(sum.as_number(), pmt.as_number(), 1e-8) << "per=" << per;
+  }
+}
+
+TEST(FinancialPPMT, IntegerPerBeyondNperIsNum) {
+  // Mirrors FinancialIPMT.IntegerPerBeyondNperIsNum — integer per > nper
+  // is still rejected as #NUM! to match the Mac Excel 365 oracle.
+  const Value v = EvalSource("=PPMT(0.05/12, 61, 60, 25000)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialPPMT, FractionalPerBeyondNperMatchesOracle) {
+  // IronCalc / Mac Excel 365 oracle value for a fractional per > nper case.
+  const Value v = EvalSource("=PPMT(0.1, 3.9, 3, 8000)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), -3186.4035714405495, 1e-9);
+}
+
+TEST(FinancialPPMT, ZeroRatePrincipalEqualsPmt) {
+  // rate=0 -> IPMT=0, so PPMT == PMT for every period.
+  const Value pmt = EvalSource("=PMT(0, 60, 25000)");
+  const Value ppmt = EvalSource("=PPMT(0, 5, 60, 25000)");
+  ASSERT_TRUE(pmt.is_number());
+  ASSERT_TRUE(ppmt.is_number());
+  EXPECT_DOUBLE_EQ(ppmt.as_number(), pmt.as_number());
+}
+
+TEST(FinancialCUMIPMT, FullRangeMatchesSumOfIPMT) {
+  // Sum of IPMT over [1, nper] must equal CUMIPMT over the same range.
+  const Value cum = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 1, 60, 0)");
+  ASSERT_TRUE(cum.is_number());
+  double expected_sum = 0.0;
+  for (int per = 1; per <= 60; ++per) {
+    const std::string f = "=IPMT(0.05/12, " + std::to_string(per) + ", 60, 25000)";
+    const Value v = EvalSource(f);
+    ASSERT_TRUE(v.is_number());
+    expected_sum += v.as_number();
+  }
+  EXPECT_NEAR(cum.as_number(), expected_sum, 1e-6);
+}
+
+TEST(FinancialCUMIPMT, FirstYearSubset) {
+  // Sum of IPMT over periods 1..12 equals CUMIPMT for the first year.
+  const Value cum = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 1, 12, 0)");
+  ASSERT_TRUE(cum.is_number());
+  double expected_sum = 0.0;
+  for (int per = 1; per <= 12; ++per) {
+    const std::string f = "=IPMT(0.05/12, " + std::to_string(per) + ", 60, 25000)";
+    const Value v = EvalSource(f);
+    ASSERT_TRUE(v.is_number());
+    expected_sum += v.as_number();
+  }
+  EXPECT_NEAR(cum.as_number(), expected_sum, 1e-6);
+}
+
+TEST(FinancialCUMIPMT, StartZeroIsNum) {
+  const Value v = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 0, 12, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialCUMIPMT, ReversedRangeIsNum) {
+  // start > end is rejected.
+  const Value v = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 24, 12, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialCUMIPMT, ZeroRateIsNum) {
+  // Excel's documented rule: rate must be strictly positive.
+  const Value v = EvalSource("=CUMIPMT(0, 60, 25000, 1, 12, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialCUMIPMT, NegativePvIsNum) {
+  const Value v = EvalSource("=CUMIPMT(0.05/12, 60, -25000, 1, 12, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialCUMIPMT, ArityTooFew) {
+  // `type` is required; CUMIPMT without the 6th arg is an arity error.
+  const Value v = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 1, 12)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(FinancialCUMPRINC, FullRangeEqualsNegativePv) {
+  // Sum of all principal payments on a standard loan should equal -pv
+  // (the loan gets fully paid off). Small tolerance for compounding
+  // round-off over 60 periods.
+  const Value v = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 1, 60, 0)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_NEAR(v.as_number(), -25000.0, 1e-6);
+}
+
+TEST(FinancialCUMPRINC, CumPrincPlusCumIpmtEqualsTotalPayments) {
+  // CUMPRINC + CUMIPMT over [1, nper] = PMT * nper (sum of payments).
+  const Value cp = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 1, 60, 0)");
+  const Value ci = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 1, 60, 0)");
+  const Value pmt = EvalSource("=PMT(0.05/12, 60, 25000)");
+  ASSERT_TRUE(cp.is_number());
+  ASSERT_TRUE(ci.is_number());
+  ASSERT_TRUE(pmt.is_number());
+  EXPECT_NEAR(cp.as_number() + ci.as_number(), pmt.as_number() * 60.0, 1e-6);
+}
+
+TEST(FinancialCUMPRINC, StartOutOfRangeIsNum) {
+  const Value v = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 0, 12, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialCUMPRINC, EndBeyondNperIsNum) {
+  const Value v = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 1, 61, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialCUMPRINC, ArityTooFew) {
+  // `type` is required.
+  const Value v = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 1, 12)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(FinancialCUMPRINC, FractionalStartRoundsUp) {
+  // Mac Excel 365 ceils `start_period` and floors `end_period` before
+  // iterating; start=1.2 therefore skips period 1 and begins at period 2.
+  const Value ref = EvalSource("=CUMPRINC(0.01, 36, 8000, 2, 8, 1)");
+  const Value frac = EvalSource("=CUMPRINC(0.01, 36, 8000, 1.2, 8.53, 1)");
+  ASSERT_TRUE(ref.is_number());
+  ASSERT_TRUE(frac.is_number());
+  EXPECT_DOUBLE_EQ(frac.as_number(), ref.as_number());
+}
+
+TEST(FinancialCUMPRINC, FractionalTypeIsNum) {
+  // `type` must be strictly 0 or 1; fractional values yield #NUM!.
+  const Value v = EvalSource("=CUMPRINC(0.01, 36, 8000, 1, 10, 0.7)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialCUMIPMT, FractionalStartRoundsUp) {
+  const Value ref = EvalSource("=CUMIPMT(0.01, 36, 8000, 2, 8, 1)");
+  const Value frac = EvalSource("=CUMIPMT(0.01, 36, 8000, 1.2, 8.53, 1)");
+  ASSERT_TRUE(ref.is_number());
+  ASSERT_TRUE(frac.is_number());
+  EXPECT_DOUBLE_EQ(frac.as_number(), ref.as_number());
+}
+
+TEST(FinancialCUMIPMT, FractionalTypeIsNum) {
+  const Value v = EvalSource("=CUMIPMT(0.01, 36, 8000, 1, 10, 1.2)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(FinancialCumipmt, RejectsBoolStart) {
+  // Excel 365 rejects Bool in any position with #VALUE! (no silent
+  // coercion to 1.0). Mirrors the oracle's CUMPRINC_CUMIPMT G27/H27.
+  const Value v = EvalSource("=CUMIPMT(0.05, 10, 8000, TRUE, 10, 0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(FinancialCumprinc, RejectsBoolType) {
+  // Oracle CUMPRINC_CUMIPMT G28/H28: Bool in the `type` position is
+  // rejected with #VALUE! rather than being folded to 1.
+  const Value v = EvalSource("=CUMPRINC(0.05, 10, 8000, 3, 10, TRUE)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_financial_test.cpp b/tests/unit/eval/builtins_financial_test.cpp
index df3e86466..674447012 100644
--- a/tests/unit/eval/builtins_financial_test.cpp
+++ b/tests/unit/eval/builtins_financial_test.cpp
@@ -1,14 +1,4 @@
-//
-// End-to-end tests for the financial built-ins: PV, FV, PMT, NPER, NPV,
-// IRR, RATE, IPMT, PPMT, CUMIPMT, and CUMPRINC. All but IRR run through
-// the eager registry dispatcher; IRR rides the lazy dispatch table
-// because its first argument must reach the impl as un-flattened AST so
-// range / Ref / ArrayLiteral shapes can all be walked cell-by-cell for
-// Newton-Raphson.
-//
-// Each test parses a formula source, evaluates the AST through the
-// default registry, and asserts the resulting Value. Tests that need a
-// bound workbook populate the current sheet and use `EvalSourceIn`.
+// Financial builtin tests grouped by schedule family.
 
 #include <cmath>
 #include <string>
@@ -31,14 +21,9 @@
 namespace formulon {
 namespace eval {
 namespace {
-
 using formulon::test::EvalSource;
 using formulon::test::EvalSourceIn;
 
-// ---------------------------------------------------------------------------
-// PV
-// ---------------------------------------------------------------------------
-
 TEST(FinancialPV, BasicEndOfPeriod) {
   // =PV(0.05/12, 60, -500) - 5-year car loan at 5% APR; negative pmt
   // (cash out) yields positive PV (loan amount in hand today).
@@ -78,10 +63,6 @@ TEST(FinancialPV, NonNumericArgIsValue) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// FV
-// ---------------------------------------------------------------------------
-
 TEST(FinancialFV, BasicMonthlySavings) {
   // =FV(0.08/12, 120, -200) - 10-year deposit at 8% APR, $200/mo cash
   // out, zero PV. Should be ~36589.21 positive (cash back to investor).
@@ -107,10 +88,6 @@ TEST(FinancialFV, WithPvAndType) {
   EXPECT_GT(begin.as_number(), end.as_number());
 }
 
-// ---------------------------------------------------------------------------
-// PMT
-// ---------------------------------------------------------------------------
-
 TEST(FinancialPMT, CarLoanPayment) {
   // =PMT(0.05/12, 60, 25000) - pv positive (borrow), pmt negative (pay).
   const Value v = EvalSource("=PMT(0.05/12, 60, 25000)");
@@ -194,10 +171,6 @@ TEST(FinancialFv, RateBelowMinusOneIntegerNperIsFinite) {
   EXPECT_DOUBLE_EQ(v.as_number(), -1100.0);
 }
 
-// ---------------------------------------------------------------------------
-// NPER
-// ---------------------------------------------------------------------------
-
 TEST(FinancialNPER, BasicLoan) {
   // =NPER(0.05/12, -500, 25000) -> ~56.18 periods.
   const Value v = EvalSource("=NPER(0.05/12, -500, 25000)");
@@ -232,10 +205,6 @@ TEST(FinancialNPER, RateBelowMinusOneIsNum) {
   EXPECT_EQ(v.as_error(), ErrorCode::Num);
 }
 
-// ---------------------------------------------------------------------------
-// NPV
-// ---------------------------------------------------------------------------
-
 TEST(FinancialNPV, BasicScalars) {
   // 100/1.1 + 200/1.1^2 + 300/1.1^3 ~= 481.59.
   const Value v = EvalSource("=NPV(0.1, 100, 200, 300)");
@@ -297,16 +266,12 @@ TEST(FinancialNPV, ErrorInScalarPropagates) {
   EXPECT_EQ(v.as_error(), ErrorCode::Div0);
 }
 
-// A direct logical argument contributes at its period: TRUE coerces to 1.0
-// discounted by (1+rate)^1. Previously the value was silently dropped.
 TEST(FinancialNPV, DirectBoolContributesAtPeriod) {
   const Value v = EvalSource("=NPV(0.1, TRUE)");
   ASSERT_TRUE(v.is_number());
   EXPECT_NEAR(v.as_number(), 1.0 / 1.1, 1e-12);
 }
 
-// A direct logical between two numbers advances the period counter so the
-// following number lands one period later.
 TEST(FinancialNPV, DirectBoolAdvancesSubsequentPeriods) {
   const Value v = EvalSource("=NPV(0.1, 100, TRUE, 300)");
   const double expected = 100.0 / 1.1 + 1.0 / std::pow(1.1, 2) + 300.0 / std::pow(1.1, 3);
@@ -314,24 +279,18 @@ TEST(FinancialNPV, DirectBoolAdvancesSubsequentPeriods) {
   EXPECT_NEAR(v.as_number(), expected, 1e-10);
 }
 
-// A direct numeric-text argument is coerced and counted, matching Excel's
-// treatment of directly-passed text numbers.
 TEST(FinancialNPV, DirectNumericTextContributes) {
   const Value v = EvalSource("=NPV(0.1, \"5\")");
   ASSERT_TRUE(v.is_number());
   EXPECT_NEAR(v.as_number(), 5.0 / 1.1, 1e-12);
 }
 
-// A direct non-numeric text argument is ignored and does not advance the
-// period, so a following number stays at its original period.
 TEST(FinancialNPV, DirectNonNumericTextIsIgnored) {
   const Value v = EvalSource("=NPV(0.1, \"x\", 100)");
   ASSERT_TRUE(v.is_number());
   EXPECT_NEAR(v.as_number(), 100.0 / 1.1, 1e-12);
 }
 
-// A range-sourced bool/text cell is still dropped (range filtering rules
-// are preserved): only the numeric cell participates.
 TEST(FinancialNPV, RangeBoolStillDropped) {
   Workbook wb = Workbook::create();
   wb.sheet(0).set_cell_value(0, 0, Value::boolean(true));
@@ -342,10 +301,6 @@ TEST(FinancialNPV, RangeBoolStillDropped) {
   EXPECT_NEAR(v.as_number(), 100.0 / 1.1, 1e-12);
 }
 
-// ---------------------------------------------------------------------------
-// IRR
-// ---------------------------------------------------------------------------
-
 TEST(FinancialIRR, BasicRangeInvestment) {
   // Classic textbook IRR: -1000 followed by +300, +400, +500 over three
   // periods. Excel gives ~0.0890 (8.9% IRR).
@@ -446,10 +401,6 @@ TEST(FinancialIRR, RangeSkipsNonNumeric) {
   EXPECT_NEAR(v.as_number(), 0.0889633947, 1e-8);
 }
 
-// ---------------------------------------------------------------------------
-// RATE
-// ---------------------------------------------------------------------------
-
 TEST(FinancialRATE, CarLoanConverges) {
   // =RATE(60, -500, 25000): 60 monthly payments of $500 amortise a
   // $25,000 principal. Total outflow 30000 implies 5000 interest over
@@ -508,583 +459,6 @@ TEST(FinancialRATE, ArityOver) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// IPMT
-// ---------------------------------------------------------------------------
-
-TEST(FinancialIPMT, FirstPeriodInterestDominates) {
-  // =IPMT(0.05/12, 1, 60, 25000): balance at start of period 1 is the
-  // full pv (25000), so interest = -25000 * (0.05/12) ~= -104.1667.
-  const Value v = EvalSource("=IPMT(0.05/12, 1, 60, 25000)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), -25000.0 * (0.05 / 12.0), 1e-8);
-}
-
-TEST(FinancialIPMT, LastPeriodInterestNearZero) {
-  // Interest in the final period is small in magnitude (most of the
-  // final payment is principal).
-  const Value v = EvalSource("=IPMT(0.05/12, 60, 60, 25000)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_LT(std::fabs(v.as_number()), 5.0);
-  EXPECT_LT(v.as_number(), 0.0);  // still negative (interest payment)
-}
-
-TEST(FinancialIPMT, IntegerPerBeyondNperIsNum) {
-  // Integer per > nper is an out-of-schedule period: Mac Excel 365 (and
-  // the IronCalc oracle) return #NUM! in this case.
-  const Value v = EvalSource("=IPMT(0.05/12, 61, 60, 25000)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialIPMT, FractionalPerBeyondNperMatchesOracle) {
-  // IronCalc / Mac Excel 365 oracle value for a fractional per > nper case
-  // at type == 0.
-  const Value v = EvalSource("=IPMT(0.1, 3.9, 3, 8000)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), -30.51485756246893, 1e-9);
-}
-
-TEST(FinancialIPMT, FractionalPerBeyondNperType1) {
-  // Same fractional per > nper case with fv=10 and annuity-due (type=1).
-  const Value v = EvalSource("=IPMT(0.1, 3.9, 3, 8000, 10, 1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), -26.866364667656, 1e-9);
-}
-
-TEST(FinancialIPMT, PerZeroIsNum) {
-  const Value v = EvalSource("=IPMT(0.05/12, 0, 60, 25000)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialIPMT, TypeOneFirstPeriodIsZero) {
-  // Annuity-due, first period: payment is at start so no interest has
-  // accrued. IPMT must be exactly 0.
-  const Value v = EvalSource("=IPMT(0.05/12, 1, 60, 25000, 0, 1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(FinancialIPMT, ZeroRateIsZero) {
-  // No interest ever accrues at rate=0.
-  const Value v = EvalSource("=IPMT(0, 5, 60, 25000)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(FinancialIPMT, ArityUnder) {
-  const Value v = EvalSource("=IPMT(0.05/12, 1, 60)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-// ---------------------------------------------------------------------------
-// PPMT
-// ---------------------------------------------------------------------------
-
-TEST(FinancialPPMT, FirstPeriodPrincipal) {
-  // PPMT = PMT - IPMT for the same period.
-  const Value pmt = EvalSource("=PMT(0.05/12, 60, 25000)");
-  const Value ipmt = EvalSource("=IPMT(0.05/12, 1, 60, 25000)");
-  const Value ppmt = EvalSource("=PPMT(0.05/12, 1, 60, 25000)");
-  ASSERT_TRUE(pmt.is_number());
-  ASSERT_TRUE(ipmt.is_number());
-  ASSERT_TRUE(ppmt.is_number());
-  EXPECT_NEAR(ppmt.as_number(), pmt.as_number() - ipmt.as_number(), 1e-9);
-}
-
-TEST(FinancialPPMT, IdentityAcrossAllPeriods) {
-  // For every period i in [1, nper], IPMT(i) + PPMT(i) == PMT.
-  const Value pmt = EvalSource("=PMT(0.05/12, 60, 25000)");
-  ASSERT_TRUE(pmt.is_number());
-  // Probe a handful of representative periods (full sweep is expensive
-  // via EvalSource and adds no signal over ~5 strategic probes).
-  for (int per : {1, 2, 15, 30, 59, 60}) {
-    const std::string formula = "=IPMT(0.05/12, " + std::to_string(per) + ", 60, 25000) + PPMT(0.05/12, " +
-                                std::to_string(per) + ", 60, 25000)";
-    const Value sum = EvalSource(formula);
-    ASSERT_TRUE(sum.is_number()) << "per=" << per;
-    EXPECT_NEAR(sum.as_number(), pmt.as_number(), 1e-8) << "per=" << per;
-  }
-}
-
-TEST(FinancialPPMT, IntegerPerBeyondNperIsNum) {
-  // Mirrors FinancialIPMT.IntegerPerBeyondNperIsNum — integer per > nper
-  // is still rejected as #NUM! to match the Mac Excel 365 oracle.
-  const Value v = EvalSource("=PPMT(0.05/12, 61, 60, 25000)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialPPMT, FractionalPerBeyondNperMatchesOracle) {
-  // IronCalc / Mac Excel 365 oracle value for a fractional per > nper case.
-  const Value v = EvalSource("=PPMT(0.1, 3.9, 3, 8000)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), -3186.4035714405495, 1e-9);
-}
-
-TEST(FinancialPPMT, ZeroRatePrincipalEqualsPmt) {
-  // rate=0 -> IPMT=0, so PPMT == PMT for every period.
-  const Value pmt = EvalSource("=PMT(0, 60, 25000)");
-  const Value ppmt = EvalSource("=PPMT(0, 5, 60, 25000)");
-  ASSERT_TRUE(pmt.is_number());
-  ASSERT_TRUE(ppmt.is_number());
-  EXPECT_DOUBLE_EQ(ppmt.as_number(), pmt.as_number());
-}
-
-// ---------------------------------------------------------------------------
-// CUMIPMT
-// ---------------------------------------------------------------------------
-
-TEST(FinancialCUMIPMT, FullRangeMatchesSumOfIPMT) {
-  // Sum of IPMT over [1, nper] must equal CUMIPMT over the same range.
-  const Value cum = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 1, 60, 0)");
-  ASSERT_TRUE(cum.is_number());
-  double expected_sum = 0.0;
-  for (int per = 1; per <= 60; ++per) {
-    const std::string f = "=IPMT(0.05/12, " + std::to_string(per) + ", 60, 25000)";
-    const Value v = EvalSource(f);
-    ASSERT_TRUE(v.is_number());
-    expected_sum += v.as_number();
-  }
-  EXPECT_NEAR(cum.as_number(), expected_sum, 1e-6);
-}
-
-TEST(FinancialCUMIPMT, FirstYearSubset) {
-  // Sum of IPMT over periods 1..12 equals CUMIPMT for the first year.
-  const Value cum = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 1, 12, 0)");
-  ASSERT_TRUE(cum.is_number());
-  double expected_sum = 0.0;
-  for (int per = 1; per <= 12; ++per) {
-    const std::string f = "=IPMT(0.05/12, " + std::to_string(per) + ", 60, 25000)";
-    const Value v = EvalSource(f);
-    ASSERT_TRUE(v.is_number());
-    expected_sum += v.as_number();
-  }
-  EXPECT_NEAR(cum.as_number(), expected_sum, 1e-6);
-}
-
-TEST(FinancialCUMIPMT, StartZeroIsNum) {
-  const Value v = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 0, 12, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialCUMIPMT, ReversedRangeIsNum) {
-  // start > end is rejected.
-  const Value v = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 24, 12, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialCUMIPMT, ZeroRateIsNum) {
-  // Excel's documented rule: rate must be strictly positive.
-  const Value v = EvalSource("=CUMIPMT(0, 60, 25000, 1, 12, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialCUMIPMT, NegativePvIsNum) {
-  const Value v = EvalSource("=CUMIPMT(0.05/12, 60, -25000, 1, 12, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialCUMIPMT, ArityTooFew) {
-  // `type` is required; CUMIPMT without the 6th arg is an arity error.
-  const Value v = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 1, 12)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-// ---------------------------------------------------------------------------
-// CUMPRINC
-// ---------------------------------------------------------------------------
-
-TEST(FinancialCUMPRINC, FullRangeEqualsNegativePv) {
-  // Sum of all principal payments on a standard loan should equal -pv
-  // (the loan gets fully paid off). Small tolerance for compounding
-  // round-off over 60 periods.
-  const Value v = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 1, 60, 0)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), -25000.0, 1e-6);
-}
-
-TEST(FinancialCUMPRINC, CumPrincPlusCumIpmtEqualsTotalPayments) {
-  // CUMPRINC + CUMIPMT over [1, nper] = PMT * nper (sum of payments).
-  const Value cp = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 1, 60, 0)");
-  const Value ci = EvalSource("=CUMIPMT(0.05/12, 60, 25000, 1, 60, 0)");
-  const Value pmt = EvalSource("=PMT(0.05/12, 60, 25000)");
-  ASSERT_TRUE(cp.is_number());
-  ASSERT_TRUE(ci.is_number());
-  ASSERT_TRUE(pmt.is_number());
-  EXPECT_NEAR(cp.as_number() + ci.as_number(), pmt.as_number() * 60.0, 1e-6);
-}
-
-TEST(FinancialCUMPRINC, StartOutOfRangeIsNum) {
-  const Value v = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 0, 12, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialCUMPRINC, EndBeyondNperIsNum) {
-  const Value v = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 1, 61, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialCUMPRINC, ArityTooFew) {
-  // `type` is required.
-  const Value v = EvalSource("=CUMPRINC(0.05/12, 60, 25000, 1, 12)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(FinancialCUMPRINC, FractionalStartRoundsUp) {
-  // Mac Excel 365 ceils `start_period` and floors `end_period` before
-  // iterating; start=1.2 therefore skips period 1 and begins at period 2.
-  const Value ref = EvalSource("=CUMPRINC(0.01, 36, 8000, 2, 8, 1)");
-  const Value frac = EvalSource("=CUMPRINC(0.01, 36, 8000, 1.2, 8.53, 1)");
-  ASSERT_TRUE(ref.is_number());
-  ASSERT_TRUE(frac.is_number());
-  EXPECT_DOUBLE_EQ(frac.as_number(), ref.as_number());
-}
-
-TEST(FinancialCUMPRINC, FractionalTypeIsNum) {
-  // `type` must be strictly 0 or 1; fractional values yield #NUM!.
-  const Value v = EvalSource("=CUMPRINC(0.01, 36, 8000, 1, 10, 0.7)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialCUMIPMT, FractionalStartRoundsUp) {
-  const Value ref = EvalSource("=CUMIPMT(0.01, 36, 8000, 2, 8, 1)");
-  const Value frac = EvalSource("=CUMIPMT(0.01, 36, 8000, 1.2, 8.53, 1)");
-  ASSERT_TRUE(ref.is_number());
-  ASSERT_TRUE(frac.is_number());
-  EXPECT_DOUBLE_EQ(frac.as_number(), ref.as_number());
-}
-
-TEST(FinancialCUMIPMT, FractionalTypeIsNum) {
-  const Value v = EvalSource("=CUMIPMT(0.01, 36, 8000, 1, 10, 1.2)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialCumipmt, RejectsBoolStart) {
-  // Excel 365 rejects Bool in any position with #VALUE! (no silent
-  // coercion to 1.0). Mirrors the oracle's CUMPRINC_CUMIPMT G27/H27.
-  const Value v = EvalSource("=CUMIPMT(0.05, 10, 8000, TRUE, 10, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(FinancialCumprinc, RejectsBoolType) {
-  // Oracle CUMPRINC_CUMIPMT G28/H28: Bool in the `type` position is
-  // rejected with #VALUE! rather than being folded to 1.
-  const Value v = EvalSource("=CUMPRINC(0.05, 10, 8000, 3, 10, TRUE)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-// ---------------------------------------------------------------------------
-// SLN — straight-line depreciation
-// ---------------------------------------------------------------------------
-
-TEST(FinancialSLN, Basic) {
-  const Value v = EvalSource("=SLN(10000, 1000, 5)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1800.0);
-}
-
-TEST(FinancialSLN, ZeroSalvage) {
-  const Value v = EvalSource("=SLN(10000, 0, 10)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1000.0);
-}
-
-TEST(FinancialSLN, IdentitySlnTimesLifeEqualsDepreciableBase) {
-  // SLN * life == cost - salvage for any legal inputs.
-  const Value v = EvalSource("=SLN(10000, 1000, 5)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number() * 5.0, 10000.0 - 1000.0);
-}
-
-TEST(FinancialSLN, LifeZeroIsDiv0) {
-  const Value v = EvalSource("=SLN(10000, 1000, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
-}
-
-TEST(FinancialSLN, NegativeLifeProducesNegativeDepreciation) {
-  // Oracle-verified: Excel 365 Mac returns the raw algebraic answer
-  // (-1800 for these inputs) rather than #NUM!.
-  const Value v = EvalSource("=SLN(10000, 1000, -5)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), -1800.0);
-}
-
-TEST(FinancialSLN, ArityMismatchIsValue) {
-  const Value v = EvalSource("=SLN(10000, 1000)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-// ---------------------------------------------------------------------------
-// SYD — sum-of-years'-digits depreciation
-// ---------------------------------------------------------------------------
-
-TEST(FinancialSYD, FirstPeriod) {
-  // (10000-1000)*5*2/(5*6) = 3000
-  const Value v = EvalSource("=SYD(10000, 1000, 5, 1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 3000.0);
-}
-
-TEST(FinancialSYD, LastPeriod) {
-  // (10000-1000)*1*2/(5*6) = 600
-  const Value v = EvalSource("=SYD(10000, 1000, 5, 5)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 600.0);
-}
-
-TEST(FinancialSYD, SumAcrossAllPeriodsEqualsDepreciableBase) {
-  // sum_{p=1..life} SYD(cost, salvage, life, p) == cost - salvage.
-  double total = 0.0;
-  for (int p = 1; p <= 5; ++p) {
-    const std::string src = "=SYD(10000, 1000, 5, " + std::to_string(p) + ")";
-    const Value v = EvalSource(src);
-    ASSERT_TRUE(v.is_number()) << "p=" << p;
-    total += v.as_number();
-  }
-  EXPECT_NEAR(total, 9000.0, 1e-9);
-}
-
-TEST(FinancialSYD, PeriodOutOfRangeIsNum) {
-  const Value v = EvalSource("=SYD(10000, 1000, 5, 6)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialSYD, PeriodZeroIsNum) {
-  const Value v = EvalSource("=SYD(10000, 1000, 5, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialSYD, FractionalPeriodAccepted) {
-  // Excel 365 accepts fractional periods: the SYD formula is a linear
-  // schedule so period=0.1 evaluates naturally. Regression guard for the
-  // relaxation of the `period < 1` rejection.
-  //   (290-2)*(5-0.1+1)*2 / (5*6) = 288 * 5.9 * 2 / 30 = 113.28
-  const Value v = EvalSource("=SYD(290, 2, 5, 0.1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 113.28);
-}
-
-TEST(FinancialSYD, LifeZeroIsNum) {
-  const Value v = EvalSource("=SYD(10000, 1000, 0, 1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// DDB — double-declining-balance depreciation
-// ---------------------------------------------------------------------------
-
-TEST(FinancialDDB, FirstPeriod) {
-  // rate = 2/5 = 0.4; dep_1 = 10000 * 0.4 = 4000
-  const Value v = EvalSource("=DDB(10000, 1000, 5, 1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 4000.0);
-}
-
-TEST(FinancialDDB, SecondPeriod) {
-  // book = 6000 after period 1; dep_2 = 6000 * 0.4 = 2400
-  const Value v = EvalSource("=DDB(10000, 1000, 5, 2)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 2400.0);
-}
-
-TEST(FinancialDDB, CustomFactorTriples) {
-  // factor=3 -> rate = 3/5 = 0.6; dep_1 = 10000 * 0.6 = 6000
-  const Value v = EvalSource("=DDB(10000, 1000, 5, 1, 3)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 6000.0);
-}
-
-TEST(FinancialDDB, SalvageFloorCaps) {
-  // Running the full schedule: dep must never take book value below
-  // salvage. Verify total == cost - salvage (9000) exactly — DDB
-  // depreciates the full base over the asset's life, with the salvage
-  // floor absorbing whatever remains in the last period. For this
-  // schedule the final period is the capped one: 1296 * 0.4 = 518.4
-  // would overshoot, so dep_5 = book - salvage = 296.
-  double total = 0.0;
-  for (int p = 1; p <= 5; ++p) {
-    const std::string src = "=DDB(10000, 1000, 5, " + std::to_string(p) + ")";
-    const Value v = EvalSource(src);
-    ASSERT_TRUE(v.is_number()) << "p=" << p;
-    total += v.as_number();
-  }
-  EXPECT_NEAR(total, 9000.0, 1e-9);
-  const Value last = EvalSource("=DDB(10000, 1000, 5, 5)");
-  ASSERT_TRUE(last.is_number());
-  EXPECT_NEAR(last.as_number(), 296.0, 1e-9);
-}
-
-TEST(FinancialDDB, PeriodOutOfRangeIsNum) {
-  const Value v = EvalSource("=DDB(10000, 1000, 5, 6)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialDDB, NegativeCostIsNum) {
-  const Value v = EvalSource("=DDB(-100, 0, 5, 1)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialDDB, FactorZeroIsNum) {
-  const Value v = EvalSource("=DDB(10000, 1000, 5, 1, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-// ---------------------------------------------------------------------------
-// DB — fixed-rate declining-balance depreciation
-// ---------------------------------------------------------------------------
-
-TEST(FinancialDB, FullYearFirstPeriod) {
-  // rate = round(1 - (0.1)^0.2, 3) = 0.369; dep_1 = 10000 * 0.369 = 3690.
-  const Value v = EvalSource("=DB(10000, 1000, 5, 1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 3690.0, 1e-6);
-}
-
-TEST(FinancialDB, PartialFirstYearProrated) {
-  // month=6: dep_1 = 10000 * 0.369 * 6/12 = 1845.
-  const Value v = EvalSource("=DB(10000, 1000, 5, 1, 6)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1845.0, 1e-6);
-}
-
-TEST(FinancialDB, PartialYearSumApproxEqualsDepreciableBase) {
-  // With month=6 the depreciation runs life+1 = 6 periods; the sum
-  // should approximately equal cost - salvage within the 3-decimal
-  // rate-rounding error.
-  double total = 0.0;
-  for (int p = 1; p <= 6; ++p) {
-    const std::string src = "=DB(10000, 1000, 5, " + std::to_string(p) + ", 6)";
-    const Value v = EvalSource(src);
-    ASSERT_TRUE(v.is_number()) << "p=" << p;
-    total += v.as_number();
-  }
-  // Excel's 3-decimal rate rounding produces a small residual between
-  // the sum of depreciations and the true depreciable base. Observed
-  // residual for this fixture (cost=10000, salvage=1000, life=5,
-  // month=6) is ~54 — tolerance of 100 leaves margin for rounding
-  // accumulation without masking a real regression.
-  EXPECT_NEAR(total, 9000.0, 100.0);
-}
-
-TEST(FinancialDB, PeriodLifePlusOneNeedsPartialFirstYear) {
-  // month=12 (full year) with period == life+1 is invalid.
-  const Value v = EvalSource("=DB(10000, 1000, 5, 6)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialDB, PeriodLifePlusOneWithPartialYearIsValid) {
-  // month=6, period=6 is the partial last year; must produce a
-  // positive, finite charge.
-  const Value v = EvalSource("=DB(10000, 1000, 5, 6, 6)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_GT(v.as_number(), 0.0);
-}
-
-TEST(FinancialDB, InvalidMonthIsNum) {
-  const Value v = EvalSource("=DB(10000, 1000, 5, 1, 13)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialDB, ZeroMonthIsNum) {
-  const Value v = EvalSource("=DB(10000, 1000, 5, 1, 0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialDb, MonthIsFlooredToInteger) {
-  // Mac Excel 365 evaluates DB using INT(month), not the raw fractional
-  // month argument. With month=9.2222 the formula reduces to rate=0.438,
-  // dep_1=32.85, dep_2=29.4117, dep_3=(100-32.85-29.4117)*0.438 =
-  // 16.5293754 — the same value Mac Excel and the IronCalc G10 oracle
-  // produce. Prior to the INT(month) fix this evaluated to ~16.329735
-  // because the fractional month fed directly into the rate-prorated
-  // first period.
-  const Value v = EvalSource("=DB(100, 10, 4, 3, 9.2222)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 16.5293754, 1e-6);
-}
-
-TEST(FinancialDb, ZeroCostReturnsZero) {
-  // Excel short-circuits zero-cost assets to zero depreciation to avoid
-  // the `(salvage/0)^(1/life)` blow-up. Verified against IronCalc G30.
-  const Value v = EvalSource("=DB(0, 10, 4, 1, 2)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_EQ(v.as_number(), 0.0);
-}
-
-// ---------------------------------------------------------------------------
-// Depreciation schedule length
-// ---------------------------------------------------------------------------
-//
-// DDB and DB both step one iteration per integer period, and `period` is
-// bounded only by `life`, which is an ordinary user-supplied double. A
-// schedule longer than the Excel grid's row count cannot describe a real
-// asset, so each function stops before the loop becomes unbounded — DDB by
-// falling back to the closed form it already uses for fractional periods,
-// DB by refusing the request.
-
-TEST(FinancialDDB, HugeScheduleFallsBackToClosedForm) {
-  // Without the cap this would step 1e18 iterations. The closed form
-  // `cost * ((1-rate)^(p-1) - (1-rate)^p)` is exact for integer periods,
-  // so the answer is still well-defined.
-  const Value v = EvalSource("=DDB(1, 0, 2000000, 2000000)");
-  ASSERT_TRUE(v.is_number());
-  const double rate = 2.0 / 2000000.0;
-  const double expected = std::pow(1.0 - rate, 1999999.0) - std::pow(1.0 - rate, 2000000.0);
-  EXPECT_NEAR(v.as_number(), expected, expected * 1e-9);
-}
-
-TEST(FinancialDDB, ClosedFormAgreesWithTheIterativeSchedule) {
-  // The fallback is only sound because both branches compute the same
-  // number. Pin that at the largest period the iterative branch still
-  // takes, so a change to either branch is caught here.
-  const Value v = EvalSource("=DDB(1, 0, 2000000, 1048576)");
-  ASSERT_TRUE(v.is_number());
-  const double rate = 2.0 / 2000000.0;
-  const double expected = std::pow(1.0 - rate, 1048575.0) - std::pow(1.0 - rate, 1048576.0);
-  EXPECT_NEAR(v.as_number(), expected, expected * 1e-8);
-}
-
-TEST(FinancialDb, HugeScheduleIsNum) {
-  // DB's schedule carries a rounded rate and a partial-first-year term
-  // with no closed form to fall back on, so an over-long schedule is
-  // refused rather than approximated.
-  const Value v = EvalSource("=DB(10000, 1000, 1E18, 1E18, 6)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Num);
-}
-
-TEST(FinancialDb, ScheduleWithinTheCapStillComputes) {
-  const Value v = EvalSource("=DB(10000, 1000, 5, 1, 6)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_NEAR(v.as_number(), 1845.0, 1e-9);
-}
-
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins_lookup_choose_test.cpp b/tests/unit/eval/builtins_lookup_choose_test.cpp
new file mode 100644
index 000000000..758e6e9fc
--- /dev/null
+++ b/tests/unit/eval/builtins_lookup_choose_test.cpp
@@ -0,0 +1,304 @@
+// Lookup builtin tests grouped by function.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+#include "builtins_lookup_test_helpers.h"
+#include "eval/builtins.h"
+#include "util/test_eval_helpers.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using formulon::test::EvalSource;
+using formulon::test::EvalSourceIn;
+using namespace lookup_test_helpers;
+
+TEST(BuiltinsChoose, BasicSelect) {
+  const Value v = EvalSource("=CHOOSE(2, \"a\", \"b\", \"c\")");
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "b");
+}
+
+TEST(BuiltinsChoose, FractionalIndexTruncates) {
+  // 2.9 -> floor to 2, selects "b" (not rounding to 3).
+  const Value v = EvalSource("=CHOOSE(2.9, \"a\", \"b\", \"c\")");
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "b");
+}
+
+TEST(BuiltinsChoose, OutOfRangeZeroIsValueError) {
+  const Value v = EvalSource("=CHOOSE(0, \"a\", \"b\")");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsChoose, OutOfRangeTooLargeIsValueError) {
+  const Value v = EvalSource("=CHOOSE(4, \"a\", \"b\", \"c\")");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsChoose, IndexErrorPropagates) {
+  const Value v = EvalSource("=CHOOSE(#DIV/0!, \"a\", \"b\")");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
+}
+
+TEST(BuiltinsChoose, ChosenArgErrorPropagates) {
+  const Value v = EvalSource("=CHOOSE(2, 1, #N/A)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::NA);
+}
+
+TEST(BuiltinsChoose, ChosenArgIsCellRef) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(11.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(22.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(33.0));
+  const Value v = EvalSourceIn("=CHOOSE(3, A1, A2, A3)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 33.0);
+}
+
+TEST(BuiltinsChoose, LargeArity) {
+  // Ten values; pick the 7th.
+  const Value v = EvalSource("=CHOOSE(7, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 7.0);
+}
+
+TEST(BuiltinsChoose, UnselectedArgNotEvaluated) {
+  // Non-chosen arg contains a #DIV/0! literal that would propagate if
+  // evaluated. CHOOSE must short-circuit so the result is "a".
+  const Value v = EvalSource("=CHOOSE(1, \"a\", #DIV/0!)");
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "a");
+}
+
+TEST(BuiltinsChoose, ZeroArityIsValueError) {
+  EXPECT_EQ(EvalSource("=CHOOSE()").as_error(), ErrorCode::Value);
+  // Just an index without any values is also invalid.
+  EXPECT_EQ(EvalSource("=CHOOSE(1)").as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsChoose, ArrayIndexSelectsScalarBranches) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(1, 1, Value::number(1.0));
+  const Value v = EvalSourceIn("=CHOOSE(A1:B2,10,20)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 2U, 2U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(cells[1].as_number(), 20.0);
+  EXPECT_DOUBLE_EQ(cells[2].as_number(), 20.0);
+  EXPECT_DOUBLE_EQ(cells[3].as_number(), 10.0);
+}
+
+TEST(BuiltinsChoose, HorizontalIndexTilesVerticalBranches) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(12.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(21.0));
+  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
+  const Value v = EvalSourceIn("=CHOOSE(A1:B1,D1:D2,E1:E2)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 2U, 2U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 11.0);
+  EXPECT_DOUBLE_EQ(cells[1].as_number(), 21.0);
+  EXPECT_DOUBLE_EQ(cells[2].as_number(), 12.0);
+  EXPECT_DOUBLE_EQ(cells[3].as_number(), 22.0);
+}
+
+TEST(BuiltinsChoose, VerticalIndexTilesHorizontalBranches) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
+  wb.sheet(0).set_cell_value(0, 5, Value::number(21.0));
+  wb.sheet(0).set_cell_value(0, 6, Value::number(22.0));
+  const Value v = EvalSourceIn("=CHOOSE(A1:A2,D1:E1,F1:G1)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 2U, 2U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 11.0);
+  EXPECT_DOUBLE_EQ(cells[1].as_number(), 12.0);
+  EXPECT_DOUBLE_EQ(cells[2].as_number(), 21.0);
+  EXPECT_DOUBLE_EQ(cells[3].as_number(), 22.0);
+}
+
+TEST(BuiltinsChoose, ArrayIndexUsesSelectedBranchShape) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(21.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(22.0));
+  const Value v = EvalSourceIn("=CHOOSE(A1:B1,9,D1:D2)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 2U, 2U);
+  for (std::uint32_t i = 0; i < 4U; ++i) {
+    EXPECT_DOUBLE_EQ(v.as_array_cells()[i].as_number(), 9.0);
+  }
+}
+
+TEST(BuiltinsChoose, UnequalBranchShapesBroadcastShortAxes) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(12.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(21.0));
+  wb.sheet(0).set_cell_value(0, 5, Value::number(22.0));
+  const Value v = EvalSourceIn("=CHOOSE(A1:B1,D1:D2,E1:F1)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 2U, 2U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 11.0);
+  EXPECT_DOUBLE_EQ(cells[1].as_number(), 22.0);
+  EXPECT_DOUBLE_EQ(cells[2].as_number(), 12.0);
+  EXPECT_DOUBLE_EQ(cells[3].as_number(), 22.0);
+}
+
+TEST(BuiltinsChoose, ArrayIndexSelectedBranchErrorIsLaneLocal) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+  const Value v = EvalSourceIn("=CHOOSE(A1:B1,10,1/0)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 1U, 2U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 10.0);
+  ASSERT_TRUE(v.as_array_cells()[1].is_error());
+  EXPECT_EQ(v.as_array_cells()[1].as_error(), ErrorCode::Div0);
+}
+
+TEST(BuiltinsChoose, ArraySelectorReferenceBlankCountsInCountA) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=COUNTA(CHOOSE(SEQUENCE(1),A1:A3))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
+
+  const Value scalar = EvalSourceIn("=COUNTA(CHOOSE(1,A1:A3))", wb, wb.sheet(0));
+  ASSERT_TRUE(scalar.is_number());
+  EXPECT_DOUBLE_EQ(scalar.as_number(), 2.0);
+}
+
+TEST(BuiltinsChoose, ArraySelectorReferenceBlankCountsAndNestedIsBlank) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(1.0));
+
+  const Value count = EvalSourceIn("=COUNT(CHOOSE(SEQUENCE(1),A1:A3))", wb, wb.sheet(0));
+  ASSERT_TRUE(count.is_number());
+  EXPECT_DOUBLE_EQ(count.as_number(), 2.0);
+
+  const Value blank = EvalSourceIn("=ISBLANK(INDEX(CHOOSE(SEQUENCE(1),A1:A3),2,1))", wb, wb.sheet(0));
+  ASSERT_TRUE(blank.is_boolean());
+  EXPECT_TRUE(blank.as_boolean());
+}
+
+TEST(BuiltinsChoose, ArraySelectorRangeExpanderEvaluatesIndexOnce) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(1.0));
+
+  FunctionRegistry registry;
+  register_builtins(registry);
+  ASSERT_TRUE(registry.register_function(FunctionDef{"TICKARRAY", 0U, 0U, &TickArrayImpl}));
+
+  std::uint32_t calls = 0U;
+  g_tick_array_calls = &calls;
+  const Value value = EvalSourceInWithRegistry("=COUNTA(CHOOSE(TICKARRAY(),A1:A3))", wb, wb.sheet(0), registry);
+  g_tick_array_calls = nullptr;
+
+  ASSERT_TRUE(value.is_number());
+  EXPECT_DOUBLE_EQ(value.as_number(), 3.0);
+  EXPECT_EQ(calls, 1U);
+}
+
+TEST(BuiltinsChoose, ChooseAsRangeProducerInSumPicksMiddleRange) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
+  wb.sheet(0).set_cell_value(3, 0, Value::number(40.0));
+  // Picks A1:A3 -> 10 + 20 + 30 = 60.
+  const Value v = EvalSourceIn("=SUM(CHOOSE(2, A1:A2, A1:A3, A1:A4))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 60.0);
+}
+
+TEST(BuiltinsChoose, ChooseAsRangeProducerInAverage) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
+  // CHOOSE(1, A1:A2, ...) -> AVERAGE(10, 20) = 15.
+  const Value v = EvalSourceIn("=AVERAGE(CHOOSE(1, A1:A2, A1:A3))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 15.0);
+}
+
+TEST(BuiltinsChoose, ChooseAsRangeProducerSkipsTextInSum) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::text("Ranges"));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(23.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(45.0));
+  // CHOOSE(2, A1:A2, A1:A3, A1:A4) -> SUM over A1:A3, text in A1 is
+  // skipped per range-provenance filter.
+  const Value v = EvalSourceIn("=SUM(CHOOSE(2, A1:A2, A1:A3, A1:A4))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 68.0);
+}
+
+TEST(BuiltinsChoose, ChooseScalarChildIsTreatedAsOneCellRange) {
+  // CHOOSE's scalar child is treated as a 1-cell range by the aggregator
+  // (faf447f). Verified against Mac Excel 365 via xlwings: scalar
+  // SUM(CHOOSE(1, 7, A1:A2)) = 7, range SUM(CHOOSE(2, 7, A1:A2)) = 3.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  const Value scalar = EvalSourceIn("=SUM(CHOOSE(1, 7, A1:A2))", wb, wb.sheet(0));
+  ASSERT_TRUE(scalar.is_number());
+  EXPECT_DOUBLE_EQ(scalar.as_number(), 7.0);
+  const Value range = EvalSourceIn("=SUM(CHOOSE(2, 7, A1:A2))", wb, wb.sheet(0));
+  ASSERT_TRUE(range.is_number());
+  EXPECT_DOUBLE_EQ(range.as_number(), 3.0);
+}
+
+TEST(BuiltinsChoose, ChooseOutOfRangeIndexIsValueError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  const Value v = EvalSourceIn("=SUM(CHOOSE(5, A1:A2, A1:A3))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsChoose, ChooseErrorIndexPropagates) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  const Value v = EvalSourceIn("=SUM(CHOOSE(NA(), A1:A2))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::NA);
+}
+
+TEST(BuiltinsChoose, ChooseNestedRecurses) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
+  wb.sheet(0).set_cell_value(3, 0, Value::number(40.0));
+  // Outer CHOOSE picks slot 2 -> inner CHOOSE(1, A1:A3, A1:A4) -> A1:A3.
+  // SUM(A1:A3) = 60.
+  const Value v = EvalSourceIn("=SUM(CHOOSE(2, A1:A2, CHOOSE(1, A1:A3, A1:A4)))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 60.0);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_lookup_index_test.cpp b/tests/unit/eval/builtins_lookup_index_test.cpp
new file mode 100644
index 000000000..9d548e1e9
--- /dev/null
+++ b/tests/unit/eval/builtins_lookup_index_test.cpp
@@ -0,0 +1,396 @@
+// Lookup builtin tests grouped by function.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+#include "builtins_lookup_test_helpers.h"
+#include "eval/builtins.h"
+#include "util/test_eval_helpers.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using formulon::test::EvalSource;
+using formulon::test::EvalSourceIn;
+using namespace lookup_test_helpers;
+
+TEST(BuiltinsIndex, ColumnRangeRowSelects) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
+  wb.sheet(0).set_cell_value(3, 0, Value::number(40.0));
+  wb.sheet(0).set_cell_value(4, 0, Value::number(50.0));
+  const Value v = EvalSourceIn("=INDEX(A1:A5, 3)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
+}
+
+TEST(BuiltinsIndex, RowRangeSoleIndexPicksColumn) {
+  // 1-D row vector A1:E1 with two args (sole index = column).
+  Workbook wb = Workbook::create();
+  for (std::uint32_t c = 0; c < 5; ++c) {
+    wb.sheet(0).set_cell_value(0, c, Value::number(10.0 * static_cast<double>(c + 1)));
+  }
+  const Value v = EvalSourceIn("=INDEX(A1:E1, 4)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 40.0);
+}
+
+TEST(BuiltinsIndex, TwoDimensionalRowAndColumn) {
+  Workbook wb = Workbook::create();
+  // Populate A1:C3 with distinct values 1..9 row-major.
+  for (std::uint32_t r = 0; r < 3; ++r) {
+    for (std::uint32_t c = 0; c < 3; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
+    }
+  }
+  const Value v = EvalSourceIn("=INDEX(A1:C3, 2, 3)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 6.0);  // row 2, col 3 -> cell (1,2) -> 1*3+2+1 = 6
+}
+
+TEST(BuiltinsIndex, ArrayLiteralUsesSharedRangeMaterialization) {
+  const Value v = EvalSource("=INDEX({1,2;3,4},2,1)");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
+}
+
+TEST(BuiltinsIndex, OutOfBoundsRowIsRefError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  const Value v = EvalSourceIn("=INDEX(A1:A2, 5)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndex, OutOfBoundsColumnIsRefError) {
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 2; ++r) {
+    for (std::uint32_t c = 0; c < 2; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(1.0));
+    }
+  }
+  const Value v = EvalSourceIn("=INDEX(A1:B2, 1, 5)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndex, NegativeIndexIsValueError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=INDEX(A1:A1, -1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsIndex, ZeroRowOn2DRangeSpillsColumn) {
+  // INDEX(A1:C3, 0, 2) spills the whole column 2 as a vertical array.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 3; ++r) {
+    for (std::uint32_t c = 0; c < 3; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
+    }
+  }
+  const Value v = EvalSourceIn("=INDEX(A1:C3, 0, 2)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array());
+  EXPECT_EQ(v.as_array_rows(), 3U);
+  EXPECT_EQ(v.as_array_cols(), 1U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 2.0);  // (0,1)
+  EXPECT_DOUBLE_EQ(cells[1].as_number(), 5.0);  // (1,1)
+  EXPECT_DOUBLE_EQ(cells[2].as_number(), 8.0);  // (2,1)
+}
+
+TEST(BuiltinsIndex, ZeroColOn2DRangeSpillsRow) {
+  // INDEX(A1:C3, 2, 0) spills the whole row 2 as a horizontal array. The
+  // silent-divergence form INDEX(A1:C3, 2, 0) used to return only the
+  // row's first cell.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 3; ++r) {
+    for (std::uint32_t c = 0; c < 3; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
+    }
+  }
+  const Value v = EvalSourceIn("=INDEX(A1:C3, 2, 0)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array());
+  EXPECT_EQ(v.as_array_rows(), 1U);
+  EXPECT_EQ(v.as_array_cols(), 3U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 4.0);  // (1,0)
+  EXPECT_DOUBLE_EQ(cells[1].as_number(), 5.0);  // (1,1)
+  EXPECT_DOUBLE_EQ(cells[2].as_number(), 6.0);  // (1,2)
+}
+
+TEST(BuiltinsIndex, TwoArg2DReferenceRowOnlyIsRefError) {
+  // The reference form needs both indices on a 2-D area: Excel 365 gives
+  // `INDEX(A1:B2,1)` #REF! (measured).
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 3; ++r) {
+    for (std::uint32_t c = 0; c < 3; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
+    }
+  }
+  const Value v = EvalSourceIn("=INDEX(A1:C3, 3)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndex, ZeroBothOn2DRangeSpillsWholeArray) {
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 2; ++r) {
+    for (std::uint32_t c = 0; c < 2; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 2 + c + 1)));
+    }
+  }
+  const Value v = EvalSourceIn("=INDEX(A1:B2, 0, 0)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array());
+  EXPECT_EQ(v.as_array_rows(), 2U);
+  EXPECT_EQ(v.as_array_cols(), 2U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(cells[3].as_number(), 4.0);
+}
+
+TEST(BuiltinsIndex, ZeroRowWithColumnOmittedSpillsAnArrayButNotAReference) {
+  // Excel 365: `INDEX(Sheet2!A1:C2,0)` is #REF! like any row-only 2-D
+  // reference, while the array form spills the whole array.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 2; ++r) {
+    for (std::uint32_t c = 0; c < 2; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 2 + c + 1)));
+    }
+  }
+  const Value two_arg = EvalSourceIn("=INDEX(A1:B2, 0)", wb, wb.sheet(0));
+  ASSERT_TRUE(two_arg.is_error());
+  EXPECT_EQ(two_arg.as_error(), ErrorCode::Ref);
+
+  const Value array_literal = EvalSource("=INDEX({1,2;3,4},0)");
+  ASSERT_TRUE(array_literal.is_array());
+  EXPECT_EQ(array_literal.as_array_rows(), 2U);
+  EXPECT_EQ(array_literal.as_array_cols(), 2U);
+  EXPECT_DOUBLE_EQ(array_literal.as_array_cells()[3].as_number(), 4.0);
+}
+
+TEST(BuiltinsIndex, ZeroColOutOfRangeColumnIsRefError) {
+  // INDEX(A1:C3, 0, 5): whole column requested but col index out of range.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 3; ++r) {
+    for (std::uint32_t c = 0; c < 3; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(1.0));
+    }
+  }
+  const Value v = EvalSourceIn("=INDEX(A1:C3, 0, 5)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndex, ColumnVectorZeroSpillsVector) {
+  // 2-arg INDEX(A1:A3, 0) on a column vector spills the whole column.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
+  const Value v = EvalSourceIn("=INDEX(A1:A3, 0)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array());
+  EXPECT_EQ(v.as_array_rows(), 3U);
+  EXPECT_EQ(v.as_array_cols(), 1U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(cells[2].as_number(), 30.0);
+}
+
+TEST(BuiltinsIndex, SingleCellRefAsArray) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::text("hello"));
+  const Value hit = EvalSourceIn("=INDEX(A1, 1, 1)", wb, wb.sheet(0));
+  ASSERT_TRUE(hit.is_text());
+  EXPECT_EQ(hit.as_text(), "hello");
+  // Out of bounds on a single-cell Ref.
+  const Value miss = EvalSourceIn("=INDEX(A1, 2, 1)", wb, wb.sheet(0));
+  ASSERT_TRUE(miss.is_error());
+  EXPECT_EQ(miss.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndex, CrossSheetTwoDimensionalRange) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Data");
+  for (std::uint32_t r = 0; r < 3; ++r) {
+    for (std::uint32_t c = 0; c < 3; ++c) {
+      wb.sheet(1).set_cell_value(r, c, Value::number(static_cast<double>((r + 1) * 10 + (c + 1))));
+    }
+  }
+  const Value v = EvalSourceIn("=INDEX(Data!A1:C3, 3, 2)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 32.0);
+}
+
+TEST(BuiltinsIndex, NonCoercibleIndexIsValueError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=INDEX(A1:A1, \"not a number\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsIndex, WrongArityIsValueError) {
+  EXPECT_EQ(EvalSource("=INDEX()").as_error(), ErrorCode::Value);
+  EXPECT_EQ(EvalSource("=INDEX(1)").as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsIndex, ArrayRowSelectorWithScalarColumn) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(3.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(21.0));
+  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
+  wb.sheet(0).set_cell_value(2, 3, Value::number(31.0));
+  wb.sheet(0).set_cell_value(2, 4, Value::number(32.0));
+  const Value v = EvalSourceIn("=INDEX(D1:E3,A1:A2,2)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 2U, 1U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 12.0);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 32.0);
+}
+
+TEST(BuiltinsIndex, ScalarRowWithArrayColumnSelector) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(21.0));
+  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
+  wb.sheet(0).set_cell_value(2, 3, Value::number(31.0));
+  wb.sheet(0).set_cell_value(2, 4, Value::number(32.0));
+  const Value v = EvalSourceIn("=INDEX(D1:E3,2,A1:B1)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 1U, 2U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 21.0);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 22.0);
+}
+
+TEST(BuiltinsIndex, ArrayRowAndColumnSelectorsBroadcastOuter) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(3.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 2, Value::number(2.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(11.0));
+  wb.sheet(0).set_cell_value(0, 5, Value::number(12.0));
+  wb.sheet(0).set_cell_value(1, 4, Value::number(21.0));
+  wb.sheet(0).set_cell_value(1, 5, Value::number(22.0));
+  wb.sheet(0).set_cell_value(2, 4, Value::number(31.0));
+  wb.sheet(0).set_cell_value(2, 5, Value::number(32.0));
+  const Value v = EvalSourceIn("=INDEX(E1:F3,A1:A3,B1:C1)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 3U, 2U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 11.0);
+  EXPECT_DOUBLE_EQ(cells[1].as_number(), 12.0);
+  EXPECT_DOUBLE_EQ(cells[2].as_number(), 21.0);
+  EXPECT_DOUBLE_EQ(cells[3].as_number(), 22.0);
+  EXPECT_DOUBLE_EQ(cells[4].as_number(), 31.0);
+  EXPECT_DOUBLE_EQ(cells[5].as_number(), 32.0);
+}
+
+TEST(BuiltinsIndex, UnequalVerticalSelectorsFillNA) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(3.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(11.0));
+  wb.sheet(0).set_cell_value(0, 5, Value::number(12.0));
+  wb.sheet(0).set_cell_value(1, 4, Value::number(21.0));
+  wb.sheet(0).set_cell_value(1, 5, Value::number(22.0));
+  wb.sheet(0).set_cell_value(2, 4, Value::number(31.0));
+  wb.sheet(0).set_cell_value(2, 5, Value::number(32.0));
+  const Value v = EvalSourceIn("=INDEX(E1:F3,A1:A3,B1:B2)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 3U, 1U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 11.0);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 22.0);
+  ASSERT_TRUE(v.as_array_cells()[2].is_error());
+  EXPECT_EQ(v.as_array_cells()[2].as_error(), ErrorCode::NA);
+}
+
+TEST(BuiltinsIndex, ArraySelectorBoundsAndErrorAreLaneLocal) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(9.0));
+  wb.sheet(0).set_cell_formula(2, 0, "=NA()");
+  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(21.0));
+  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
+  wb.sheet(0).set_cell_value(2, 3, Value::number(31.0));
+  wb.sheet(0).set_cell_value(2, 4, Value::number(32.0));
+  const Value v = EvalSourceIn("=INDEX(D1:E3,A1:A3,1)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 3U, 1U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 11.0);
+  ASSERT_TRUE(v.as_array_cells()[1].is_error());
+  EXPECT_EQ(v.as_array_cells()[1].as_error(), ErrorCode::Ref);
+  ASSERT_TRUE(v.as_array_cells()[2].is_error());
+  EXPECT_EQ(v.as_array_cells()[2].as_error(), ErrorCode::NA);
+}
+
+TEST(BuiltinsIndex, ArrayRowZeroComposesColumnTile) {
+  const Value v = EvalSource("=INDEX({11,12;21,22},{0;2},1)");
+  ExpectArrayShape(v, 2U, 1U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 11.0);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 21.0);
+}
+
+TEST(BuiltinsIndex, ArrayColumnZeroComposesRowTile) {
+  const Value v = EvalSource("=INDEX({11,12;21,22},1,{0,2})");
+  ExpectArrayShape(v, 1U, 2U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 11.0);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 12.0);
+}
+
+TEST(BuiltinsIndex, ArraySelectorErrorPrecedesColumnErrorPerLane) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_formula(0, 0, "=NA()");
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(21.0));
+  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
+  const Value v = EvalSourceIn("=INDEX(D1:E2,A1:A2,#REF!)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 2U, 1U);
+  ASSERT_TRUE(v.as_array_cells()[0].is_error());
+  EXPECT_EQ(v.as_array_cells()[0].as_error(), ErrorCode::NA);
+  ASSERT_TRUE(v.as_array_cells()[1].is_error());
+  EXPECT_EQ(v.as_array_cells()[1].as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndex, ArraySelectorPreservesSourceErrorShape) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  const Value v = EvalSourceIn("=INDEX(#REF!,A1:A2,1)", wb, wb.sheet(0));
+  ExpectArrayShape(v, 2U, 1U);
+  ASSERT_TRUE(v.as_array_cells()[0].is_error());
+  EXPECT_EQ(v.as_array_cells()[0].as_error(), ErrorCode::Ref);
+  ASSERT_TRUE(v.as_array_cells()[1].is_error());
+  EXPECT_EQ(v.as_array_cells()[1].as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndex, ArraySelectorReferenceBlankCountsInCountA) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(2.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(2.0));
+  wb.sheet(0).set_cell_value(2, 3, Value::number(3.0));
+  const Value v = EvalSourceIn("=COUNTA(INDEX(A1:A3,D1:D3))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_lookup_test.cpp b/tests/unit/eval/builtins_lookup_test.cpp
index 766ef55dd..2acf51391 100644
--- a/tests/unit/eval/builtins_lookup_test.cpp
+++ b/tests/unit/eval/builtins_lookup_test.cpp
@@ -1,76 +1,19 @@
-//
-// End-to-end tests for the lazy-dispatched lookup / reference functions
-// CHOOSE, INDEX, and MATCH. All three are routed through the lazy table in
-// `tree_walker.cpp` because they need AST-level inspection of their
-// arguments (range shape for INDEX / MATCH; per-branch short-circuit for
-// CHOOSE).
+// Lookup builtin tests grouped by function.
 
 #include <cstdint>
 #include <string>
 #include <string_view>
 
-#include "eval/array_alloc.h"
+#include "builtins_lookup_test_helpers.h"
 #include "eval/builtins.h"
-#include "eval/eval_context.h"
-#include "eval/eval_state.h"
-#include "eval/function_registry.h"
-#include "eval/tree_walker.h"
-#include "gtest/gtest.h"
-#include "parser/ast.h"
-#include "parser/parser.h"
-#include "sheet.h"
 #include "util/test_eval_helpers.h"
-#include "utils/arena.h"
-#include "utils/error.h"
-#include "value.h"
-#include "workbook.h"
 
 namespace formulon {
 namespace eval {
 namespace {
-
 using formulon::test::EvalSource;
 using formulon::test::EvalSourceIn;
-
-thread_local std::uint32_t* g_tick_array_calls = nullptr;
-
-Value TickArrayImpl(const Value* /*args*/, std::uint32_t /*arity*/, Arena& arena) {
-  if (g_tick_array_calls != nullptr) {
-    ++*g_tick_array_calls;
-  }
-  Value* cells = nullptr;
-  ArrayValue* array = allocate_array_value(1U, 1U, arena, cells);
-  if (array == nullptr) {
-    return Value::error(ErrorCode::Num);
-  }
-  cells[0] = Value::number(1.0);
-  return Value::array(array);
-}
-
-Value EvalSourceInWithRegistry(std::string_view formula, const Workbook& wb, const Sheet& current,
-                               const FunctionRegistry& registry) {
-  Arena parse_arena;
-  Arena eval_arena;
-  parser::Parser p(formula, parse_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr) << "parse failed for: " << formula;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
-  }
-  EvalState state;
-  const EvalContext ctx(wb, current, state);
-  return evaluate(*root, eval_arena, registry, ctx);
-}
-
-void ExpectArrayShape(const Value& value, std::uint32_t rows, std::uint32_t cols) {
-  ASSERT_TRUE(value.is_array()) << value.debug_to_string();
-  EXPECT_EQ(value.as_array_rows(), rows);
-  EXPECT_EQ(value.as_array_cols(), cols);
-}
-
-// ---------------------------------------------------------------------------
-// MATCH
-// ---------------------------------------------------------------------------
+using namespace lookup_test_helpers;
 
 TEST(BuiltinsMatch, ExactNumericFirstHit) {
   Workbook wb = Workbook::create();
@@ -329,688 +272,6 @@ TEST(BuiltinsMatch, WrongArityIsValueError) {
   EXPECT_EQ(EvalSource("=MATCH(1)").as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// INDEX
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsIndex, ColumnRangeRowSelects) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
-  wb.sheet(0).set_cell_value(3, 0, Value::number(40.0));
-  wb.sheet(0).set_cell_value(4, 0, Value::number(50.0));
-  const Value v = EvalSourceIn("=INDEX(A1:A5, 3)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
-}
-
-TEST(BuiltinsIndex, RowRangeSoleIndexPicksColumn) {
-  // 1-D row vector A1:E1 with two args (sole index = column).
-  Workbook wb = Workbook::create();
-  for (std::uint32_t c = 0; c < 5; ++c) {
-    wb.sheet(0).set_cell_value(0, c, Value::number(10.0 * static_cast<double>(c + 1)));
-  }
-  const Value v = EvalSourceIn("=INDEX(A1:E1, 4)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 40.0);
-}
-
-TEST(BuiltinsIndex, TwoDimensionalRowAndColumn) {
-  Workbook wb = Workbook::create();
-  // Populate A1:C3 with distinct values 1..9 row-major.
-  for (std::uint32_t r = 0; r < 3; ++r) {
-    for (std::uint32_t c = 0; c < 3; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
-    }
-  }
-  const Value v = EvalSourceIn("=INDEX(A1:C3, 2, 3)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 6.0);  // row 2, col 3 -> cell (1,2) -> 1*3+2+1 = 6
-}
-
-TEST(BuiltinsIndex, ArrayLiteralUsesSharedRangeMaterialization) {
-  const Value v = EvalSource("=INDEX({1,2;3,4},2,1)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
-}
-
-TEST(BuiltinsIndex, OutOfBoundsRowIsRefError) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  const Value v = EvalSourceIn("=INDEX(A1:A2, 5)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndex, OutOfBoundsColumnIsRefError) {
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 2; ++r) {
-    for (std::uint32_t c = 0; c < 2; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(1.0));
-    }
-  }
-  const Value v = EvalSourceIn("=INDEX(A1:B2, 1, 5)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndex, NegativeIndexIsValueError) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=INDEX(A1:A1, -1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsIndex, ZeroRowOn2DRangeSpillsColumn) {
-  // INDEX(A1:C3, 0, 2) spills the whole column 2 as a vertical array.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 3; ++r) {
-    for (std::uint32_t c = 0; c < 3; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
-    }
-  }
-  const Value v = EvalSourceIn("=INDEX(A1:C3, 0, 2)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array());
-  EXPECT_EQ(v.as_array_rows(), 3U);
-  EXPECT_EQ(v.as_array_cols(), 1U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 2.0);  // (0,1)
-  EXPECT_DOUBLE_EQ(cells[1].as_number(), 5.0);  // (1,1)
-  EXPECT_DOUBLE_EQ(cells[2].as_number(), 8.0);  // (2,1)
-}
-
-TEST(BuiltinsIndex, ZeroColOn2DRangeSpillsRow) {
-  // INDEX(A1:C3, 2, 0) spills the whole row 2 as a horizontal array. The
-  // silent-divergence form INDEX(A1:C3, 2, 0) used to return only the
-  // row's first cell.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 3; ++r) {
-    for (std::uint32_t c = 0; c < 3; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
-    }
-  }
-  const Value v = EvalSourceIn("=INDEX(A1:C3, 2, 0)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array());
-  EXPECT_EQ(v.as_array_rows(), 1U);
-  EXPECT_EQ(v.as_array_cols(), 3U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 4.0);  // (1,0)
-  EXPECT_DOUBLE_EQ(cells[1].as_number(), 5.0);  // (1,1)
-  EXPECT_DOUBLE_EQ(cells[2].as_number(), 6.0);  // (1,2)
-}
-
-TEST(BuiltinsIndex, TwoArg2DReferenceRowOnlyIsRefError) {
-  // The reference form needs both indices on a 2-D area: Excel 365 gives
-  // `INDEX(A1:B2,1)` #REF! (measured).
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 3; ++r) {
-    for (std::uint32_t c = 0; c < 3; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
-    }
-  }
-  const Value v = EvalSourceIn("=INDEX(A1:C3, 3)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndex, ZeroBothOn2DRangeSpillsWholeArray) {
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 2; ++r) {
-    for (std::uint32_t c = 0; c < 2; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 2 + c + 1)));
-    }
-  }
-  const Value v = EvalSourceIn("=INDEX(A1:B2, 0, 0)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array());
-  EXPECT_EQ(v.as_array_rows(), 2U);
-  EXPECT_EQ(v.as_array_cols(), 2U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(cells[3].as_number(), 4.0);
-}
-
-TEST(BuiltinsIndex, ZeroRowWithColumnOmittedSpillsAnArrayButNotAReference) {
-  // Excel 365: `INDEX(Sheet2!A1:C2,0)` is #REF! like any row-only 2-D
-  // reference, while the array form spills the whole array.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 2; ++r) {
-    for (std::uint32_t c = 0; c < 2; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 2 + c + 1)));
-    }
-  }
-  const Value two_arg = EvalSourceIn("=INDEX(A1:B2, 0)", wb, wb.sheet(0));
-  ASSERT_TRUE(two_arg.is_error());
-  EXPECT_EQ(two_arg.as_error(), ErrorCode::Ref);
-
-  const Value array_literal = EvalSource("=INDEX({1,2;3,4},0)");
-  ASSERT_TRUE(array_literal.is_array());
-  EXPECT_EQ(array_literal.as_array_rows(), 2U);
-  EXPECT_EQ(array_literal.as_array_cols(), 2U);
-  EXPECT_DOUBLE_EQ(array_literal.as_array_cells()[3].as_number(), 4.0);
-}
-
-TEST(BuiltinsIndex, ZeroColOutOfRangeColumnIsRefError) {
-  // INDEX(A1:C3, 0, 5): whole column requested but col index out of range.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 3; ++r) {
-    for (std::uint32_t c = 0; c < 3; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(1.0));
-    }
-  }
-  const Value v = EvalSourceIn("=INDEX(A1:C3, 0, 5)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndex, ColumnVectorZeroSpillsVector) {
-  // 2-arg INDEX(A1:A3, 0) on a column vector spills the whole column.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
-  const Value v = EvalSourceIn("=INDEX(A1:A3, 0)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array());
-  EXPECT_EQ(v.as_array_rows(), 3U);
-  EXPECT_EQ(v.as_array_cols(), 1U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(cells[2].as_number(), 30.0);
-}
-
-TEST(BuiltinsIndex, SingleCellRefAsArray) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::text("hello"));
-  const Value hit = EvalSourceIn("=INDEX(A1, 1, 1)", wb, wb.sheet(0));
-  ASSERT_TRUE(hit.is_text());
-  EXPECT_EQ(hit.as_text(), "hello");
-  // Out of bounds on a single-cell Ref.
-  const Value miss = EvalSourceIn("=INDEX(A1, 2, 1)", wb, wb.sheet(0));
-  ASSERT_TRUE(miss.is_error());
-  EXPECT_EQ(miss.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndex, CrossSheetTwoDimensionalRange) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Data");
-  for (std::uint32_t r = 0; r < 3; ++r) {
-    for (std::uint32_t c = 0; c < 3; ++c) {
-      wb.sheet(1).set_cell_value(r, c, Value::number(static_cast<double>((r + 1) * 10 + (c + 1))));
-    }
-  }
-  const Value v = EvalSourceIn("=INDEX(Data!A1:C3, 3, 2)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 32.0);
-}
-
-TEST(BuiltinsIndex, NonCoercibleIndexIsValueError) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=INDEX(A1:A1, \"not a number\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsIndex, WrongArityIsValueError) {
-  EXPECT_EQ(EvalSource("=INDEX()").as_error(), ErrorCode::Value);
-  EXPECT_EQ(EvalSource("=INDEX(1)").as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsIndex, ArrayRowSelectorWithScalarColumn) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(3.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(21.0));
-  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
-  wb.sheet(0).set_cell_value(2, 3, Value::number(31.0));
-  wb.sheet(0).set_cell_value(2, 4, Value::number(32.0));
-  const Value v = EvalSourceIn("=INDEX(D1:E3,A1:A2,2)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 2U, 1U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 12.0);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 32.0);
-}
-
-TEST(BuiltinsIndex, ScalarRowWithArrayColumnSelector) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(21.0));
-  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
-  wb.sheet(0).set_cell_value(2, 3, Value::number(31.0));
-  wb.sheet(0).set_cell_value(2, 4, Value::number(32.0));
-  const Value v = EvalSourceIn("=INDEX(D1:E3,2,A1:B1)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 1U, 2U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 21.0);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 22.0);
-}
-
-TEST(BuiltinsIndex, ArrayRowAndColumnSelectorsBroadcastOuter) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(3.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 2, Value::number(2.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(11.0));
-  wb.sheet(0).set_cell_value(0, 5, Value::number(12.0));
-  wb.sheet(0).set_cell_value(1, 4, Value::number(21.0));
-  wb.sheet(0).set_cell_value(1, 5, Value::number(22.0));
-  wb.sheet(0).set_cell_value(2, 4, Value::number(31.0));
-  wb.sheet(0).set_cell_value(2, 5, Value::number(32.0));
-  const Value v = EvalSourceIn("=INDEX(E1:F3,A1:A3,B1:C1)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 3U, 2U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 11.0);
-  EXPECT_DOUBLE_EQ(cells[1].as_number(), 12.0);
-  EXPECT_DOUBLE_EQ(cells[2].as_number(), 21.0);
-  EXPECT_DOUBLE_EQ(cells[3].as_number(), 22.0);
-  EXPECT_DOUBLE_EQ(cells[4].as_number(), 31.0);
-  EXPECT_DOUBLE_EQ(cells[5].as_number(), 32.0);
-}
-
-TEST(BuiltinsIndex, UnequalVerticalSelectorsFillNA) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(3.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(11.0));
-  wb.sheet(0).set_cell_value(0, 5, Value::number(12.0));
-  wb.sheet(0).set_cell_value(1, 4, Value::number(21.0));
-  wb.sheet(0).set_cell_value(1, 5, Value::number(22.0));
-  wb.sheet(0).set_cell_value(2, 4, Value::number(31.0));
-  wb.sheet(0).set_cell_value(2, 5, Value::number(32.0));
-  const Value v = EvalSourceIn("=INDEX(E1:F3,A1:A3,B1:B2)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 3U, 1U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 11.0);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 22.0);
-  ASSERT_TRUE(v.as_array_cells()[2].is_error());
-  EXPECT_EQ(v.as_array_cells()[2].as_error(), ErrorCode::NA);
-}
-
-TEST(BuiltinsIndex, ArraySelectorBoundsAndErrorAreLaneLocal) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(9.0));
-  wb.sheet(0).set_cell_formula(2, 0, "=NA()");
-  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(21.0));
-  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
-  wb.sheet(0).set_cell_value(2, 3, Value::number(31.0));
-  wb.sheet(0).set_cell_value(2, 4, Value::number(32.0));
-  const Value v = EvalSourceIn("=INDEX(D1:E3,A1:A3,1)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 3U, 1U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 11.0);
-  ASSERT_TRUE(v.as_array_cells()[1].is_error());
-  EXPECT_EQ(v.as_array_cells()[1].as_error(), ErrorCode::Ref);
-  ASSERT_TRUE(v.as_array_cells()[2].is_error());
-  EXPECT_EQ(v.as_array_cells()[2].as_error(), ErrorCode::NA);
-}
-
-TEST(BuiltinsIndex, ArrayRowZeroComposesColumnTile) {
-  const Value v = EvalSource("=INDEX({11,12;21,22},{0;2},1)");
-  ExpectArrayShape(v, 2U, 1U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 11.0);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 21.0);
-}
-
-TEST(BuiltinsIndex, ArrayColumnZeroComposesRowTile) {
-  const Value v = EvalSource("=INDEX({11,12;21,22},1,{0,2})");
-  ExpectArrayShape(v, 1U, 2U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 11.0);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[1].as_number(), 12.0);
-}
-
-TEST(BuiltinsIndex, ArraySelectorErrorPrecedesColumnErrorPerLane) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_formula(0, 0, "=NA()");
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(21.0));
-  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
-  const Value v = EvalSourceIn("=INDEX(D1:E2,A1:A2,#REF!)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 2U, 1U);
-  ASSERT_TRUE(v.as_array_cells()[0].is_error());
-  EXPECT_EQ(v.as_array_cells()[0].as_error(), ErrorCode::NA);
-  ASSERT_TRUE(v.as_array_cells()[1].is_error());
-  EXPECT_EQ(v.as_array_cells()[1].as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndex, ArraySelectorPreservesSourceErrorShape) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  const Value v = EvalSourceIn("=INDEX(#REF!,A1:A2,1)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 2U, 1U);
-  ASSERT_TRUE(v.as_array_cells()[0].is_error());
-  EXPECT_EQ(v.as_array_cells()[0].as_error(), ErrorCode::Ref);
-  ASSERT_TRUE(v.as_array_cells()[1].is_error());
-  EXPECT_EQ(v.as_array_cells()[1].as_error(), ErrorCode::Ref);
-}
-
-// ---------------------------------------------------------------------------
-// CHOOSE
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsChoose, BasicSelect) {
-  const Value v = EvalSource("=CHOOSE(2, \"a\", \"b\", \"c\")");
-  ASSERT_TRUE(v.is_text());
-  EXPECT_EQ(v.as_text(), "b");
-}
-
-TEST(BuiltinsChoose, FractionalIndexTruncates) {
-  // 2.9 -> floor to 2, selects "b" (not rounding to 3).
-  const Value v = EvalSource("=CHOOSE(2.9, \"a\", \"b\", \"c\")");
-  ASSERT_TRUE(v.is_text());
-  EXPECT_EQ(v.as_text(), "b");
-}
-
-TEST(BuiltinsChoose, OutOfRangeZeroIsValueError) {
-  const Value v = EvalSource("=CHOOSE(0, \"a\", \"b\")");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsChoose, OutOfRangeTooLargeIsValueError) {
-  const Value v = EvalSource("=CHOOSE(4, \"a\", \"b\", \"c\")");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsChoose, IndexErrorPropagates) {
-  const Value v = EvalSource("=CHOOSE(#DIV/0!, \"a\", \"b\")");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
-}
-
-TEST(BuiltinsChoose, ChosenArgErrorPropagates) {
-  const Value v = EvalSource("=CHOOSE(2, 1, #N/A)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::NA);
-}
-
-TEST(BuiltinsChoose, ChosenArgIsCellRef) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(11.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(22.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(33.0));
-  const Value v = EvalSourceIn("=CHOOSE(3, A1, A2, A3)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 33.0);
-}
-
-TEST(BuiltinsChoose, LargeArity) {
-  // Ten values; pick the 7th.
-  const Value v = EvalSource("=CHOOSE(7, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10)");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 7.0);
-}
-
-TEST(BuiltinsChoose, UnselectedArgNotEvaluated) {
-  // Non-chosen arg contains a #DIV/0! literal that would propagate if
-  // evaluated. CHOOSE must short-circuit so the result is "a".
-  const Value v = EvalSource("=CHOOSE(1, \"a\", #DIV/0!)");
-  ASSERT_TRUE(v.is_text());
-  EXPECT_EQ(v.as_text(), "a");
-}
-
-TEST(BuiltinsChoose, ZeroArityIsValueError) {
-  EXPECT_EQ(EvalSource("=CHOOSE()").as_error(), ErrorCode::Value);
-  // Just an index without any values is also invalid.
-  EXPECT_EQ(EvalSource("=CHOOSE(1)").as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsChoose, ArrayIndexSelectsScalarBranches) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(1, 1, Value::number(1.0));
-  const Value v = EvalSourceIn("=CHOOSE(A1:B2,10,20)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 2U, 2U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(cells[1].as_number(), 20.0);
-  EXPECT_DOUBLE_EQ(cells[2].as_number(), 20.0);
-  EXPECT_DOUBLE_EQ(cells[3].as_number(), 10.0);
-}
-
-TEST(BuiltinsChoose, HorizontalIndexTilesVerticalBranches) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(12.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(21.0));
-  wb.sheet(0).set_cell_value(1, 4, Value::number(22.0));
-  const Value v = EvalSourceIn("=CHOOSE(A1:B1,D1:D2,E1:E2)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 2U, 2U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 11.0);
-  EXPECT_DOUBLE_EQ(cells[1].as_number(), 21.0);
-  EXPECT_DOUBLE_EQ(cells[2].as_number(), 12.0);
-  EXPECT_DOUBLE_EQ(cells[3].as_number(), 22.0);
-}
-
-TEST(BuiltinsChoose, VerticalIndexTilesHorizontalBranches) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(12.0));
-  wb.sheet(0).set_cell_value(0, 5, Value::number(21.0));
-  wb.sheet(0).set_cell_value(0, 6, Value::number(22.0));
-  const Value v = EvalSourceIn("=CHOOSE(A1:A2,D1:E1,F1:G1)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 2U, 2U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 11.0);
-  EXPECT_DOUBLE_EQ(cells[1].as_number(), 12.0);
-  EXPECT_DOUBLE_EQ(cells[2].as_number(), 21.0);
-  EXPECT_DOUBLE_EQ(cells[3].as_number(), 22.0);
-}
-
-TEST(BuiltinsChoose, ArrayIndexUsesSelectedBranchShape) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(21.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(22.0));
-  const Value v = EvalSourceIn("=CHOOSE(A1:B1,9,D1:D2)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 2U, 2U);
-  for (std::uint32_t i = 0; i < 4U; ++i) {
-    EXPECT_DOUBLE_EQ(v.as_array_cells()[i].as_number(), 9.0);
-  }
-}
-
-TEST(BuiltinsChoose, UnequalBranchShapesBroadcastShortAxes) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(11.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(12.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(21.0));
-  wb.sheet(0).set_cell_value(0, 5, Value::number(22.0));
-  const Value v = EvalSourceIn("=CHOOSE(A1:B1,D1:D2,E1:F1)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 2U, 2U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 11.0);
-  EXPECT_DOUBLE_EQ(cells[1].as_number(), 22.0);
-  EXPECT_DOUBLE_EQ(cells[2].as_number(), 12.0);
-  EXPECT_DOUBLE_EQ(cells[3].as_number(), 22.0);
-}
-
-TEST(BuiltinsChoose, ArrayIndexSelectedBranchErrorIsLaneLocal) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-  const Value v = EvalSourceIn("=CHOOSE(A1:B1,10,1/0)", wb, wb.sheet(0));
-  ExpectArrayShape(v, 1U, 2U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 10.0);
-  ASSERT_TRUE(v.as_array_cells()[1].is_error());
-  EXPECT_EQ(v.as_array_cells()[1].as_error(), ErrorCode::Div0);
-}
-
-TEST(BuiltinsIndex, ArraySelectorReferenceBlankCountsInCountA) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(2.0));
-  wb.sheet(0).set_cell_value(2, 3, Value::number(3.0));
-  const Value v = EvalSourceIn("=COUNTA(INDEX(A1:A3,D1:D3))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
-}
-
-TEST(BuiltinsChoose, ArraySelectorReferenceBlankCountsInCountA) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=COUNTA(CHOOSE(SEQUENCE(1),A1:A3))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
-
-  const Value scalar = EvalSourceIn("=COUNTA(CHOOSE(1,A1:A3))", wb, wb.sheet(0));
-  ASSERT_TRUE(scalar.is_number());
-  EXPECT_DOUBLE_EQ(scalar.as_number(), 2.0);
-}
-
-TEST(BuiltinsChoose, ArraySelectorReferenceBlankCountsAndNestedIsBlank) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(1.0));
-
-  const Value count = EvalSourceIn("=COUNT(CHOOSE(SEQUENCE(1),A1:A3))", wb, wb.sheet(0));
-  ASSERT_TRUE(count.is_number());
-  EXPECT_DOUBLE_EQ(count.as_number(), 2.0);
-
-  const Value blank = EvalSourceIn("=ISBLANK(INDEX(CHOOSE(SEQUENCE(1),A1:A3),2,1))", wb, wb.sheet(0));
-  ASSERT_TRUE(blank.is_boolean());
-  EXPECT_TRUE(blank.as_boolean());
-}
-
-TEST(BuiltinsChoose, ArraySelectorRangeExpanderEvaluatesIndexOnce) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(2.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(1.0));
-
-  FunctionRegistry registry;
-  register_builtins(registry);
-  ASSERT_TRUE(registry.register_function(FunctionDef{"TICKARRAY", 0U, 0U, &TickArrayImpl}));
-
-  std::uint32_t calls = 0U;
-  g_tick_array_calls = &calls;
-  const Value value = EvalSourceInWithRegistry("=COUNTA(CHOOSE(TICKARRAY(),A1:A3))", wb, wb.sheet(0), registry);
-  g_tick_array_calls = nullptr;
-
-  ASSERT_TRUE(value.is_number());
-  EXPECT_DOUBLE_EQ(value.as_number(), 3.0);
-  EXPECT_EQ(calls, 1U);
-}
-
-// ---------------------------------------------------------------------------
-// CHOOSE as range producer inside aggregators
-//
-// Pre-365 Excel allows `SUM(CHOOSE(idx, range1, range2, ...))` to aggregate
-// the chosen range, not just its top-left cell. Mac Excel 365 (ja-JP) keeps
-// that behaviour, and the IronCalc oracle exercises it directly. The
-// expansion is wired through `expand_choose_call`, which mirrors the
-// OFFSET-as-range-producer path.
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsChoose, ChooseAsRangeProducerInSumPicksMiddleRange) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
-  wb.sheet(0).set_cell_value(3, 0, Value::number(40.0));
-  // Picks A1:A3 -> 10 + 20 + 30 = 60.
-  const Value v = EvalSourceIn("=SUM(CHOOSE(2, A1:A2, A1:A3, A1:A4))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 60.0);
-}
-
-TEST(BuiltinsChoose, ChooseAsRangeProducerInAverage) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
-  // CHOOSE(1, A1:A2, ...) -> AVERAGE(10, 20) = 15.
-  const Value v = EvalSourceIn("=AVERAGE(CHOOSE(1, A1:A2, A1:A3))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 15.0);
-}
-
-TEST(BuiltinsChoose, ChooseAsRangeProducerSkipsTextInSum) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::text("Ranges"));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(23.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(45.0));
-  // CHOOSE(2, A1:A2, A1:A3, A1:A4) -> SUM over A1:A3, text in A1 is
-  // skipped per range-provenance filter.
-  const Value v = EvalSourceIn("=SUM(CHOOSE(2, A1:A2, A1:A3, A1:A4))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 68.0);
-}
-
-TEST(BuiltinsChoose, ChooseScalarChildIsTreatedAsOneCellRange) {
-  // CHOOSE's scalar child is treated as a 1-cell range by the aggregator
-  // (faf447f). Verified against Mac Excel 365 via xlwings: scalar
-  // SUM(CHOOSE(1, 7, A1:A2)) = 7, range SUM(CHOOSE(2, 7, A1:A2)) = 3.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  const Value scalar = EvalSourceIn("=SUM(CHOOSE(1, 7, A1:A2))", wb, wb.sheet(0));
-  ASSERT_TRUE(scalar.is_number());
-  EXPECT_DOUBLE_EQ(scalar.as_number(), 7.0);
-  const Value range = EvalSourceIn("=SUM(CHOOSE(2, 7, A1:A2))", wb, wb.sheet(0));
-  ASSERT_TRUE(range.is_number());
-  EXPECT_DOUBLE_EQ(range.as_number(), 3.0);
-}
-
-TEST(BuiltinsChoose, ChooseOutOfRangeIndexIsValueError) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  const Value v = EvalSourceIn("=SUM(CHOOSE(5, A1:A2, A1:A3))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsChoose, ChooseErrorIndexPropagates) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  const Value v = EvalSourceIn("=SUM(CHOOSE(NA(), A1:A2))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::NA);
-}
-
-TEST(BuiltinsChoose, ChooseNestedRecurses) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
-  wb.sheet(0).set_cell_value(3, 0, Value::number(40.0));
-  // Outer CHOOSE picks slot 2 -> inner CHOOSE(1, A1:A3, A1:A4) -> A1:A3.
-  // SUM(A1:A3) = 60.
-  const Value v = EvalSourceIn("=SUM(CHOOSE(2, A1:A2, CHOOSE(1, A1:A3, A1:A4)))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 60.0);
-}
-
-// ---------------------------------------------------------------------------
-// LOOKUP (vector form)
-// ---------------------------------------------------------------------------
-
 TEST(BuiltinsLookup, VectorFormExactMatch) {
   Workbook wb = Workbook::create();
   wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
diff --git a/tests/unit/eval/builtins_lookup_test_helpers.h b/tests/unit/eval/builtins_lookup_test_helpers.h
new file mode 100644
index 000000000..e3ff731a9
--- /dev/null
+++ b/tests/unit/eval/builtins_lookup_test_helpers.h
@@ -0,0 +1,58 @@
+#pragma once
+
+#include <cstdint>
+#include <string_view>
+
+#include "eval/array_alloc.h"
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon::eval::lookup_test_helpers {
+
+inline thread_local std::uint32_t* g_tick_array_calls = nullptr;
+
+inline Value TickArrayImpl(const Value* /*args*/, std::uint32_t /*arity*/, Arena& arena) {
+  if (g_tick_array_calls != nullptr) {
+    ++*g_tick_array_calls;
+  }
+  Value* cells = nullptr;
+  ArrayValue* array = allocate_array_value(1U, 1U, arena, cells);
+  if (array == nullptr) {
+    return Value::error(ErrorCode::Num);
+  }
+  cells[0] = Value::number(1.0);
+  return Value::array(array);
+}
+
+inline Value EvalSourceInWithRegistry(std::string_view formula, const Workbook& wb, const Sheet& current,
+                                      const FunctionRegistry& registry) {
+  Arena parse_arena;
+  Arena eval_arena;
+  parser::Parser p(formula, parse_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr) << "parse failed for: " << formula;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  EvalState state;
+  const EvalContext ctx(wb, current, state);
+  return evaluate(*root, eval_arena, registry, ctx);
+}
+
+inline void ExpectArrayShape(const Value& value, std::uint32_t rows, std::uint32_t cols) {
+  ASSERT_TRUE(value.is_array()) << value.debug_to_string();
+  EXPECT_EQ(value.as_array_rows(), rows);
+  EXPECT_EQ(value.as_array_cols(), cols);
+}
+
+}  // namespace formulon::eval::lookup_test_helpers
diff --git a/tests/unit/eval/builtins_math_test.cpp b/tests/unit/eval/builtins_math_test.cpp
index 8ffb588f1..a29665a4e 100644
--- a/tests/unit/eval/builtins_math_test.cpp
+++ b/tests/unit/eval/builtins_math_test.cpp
@@ -10,15 +10,18 @@
 #include "gtest/gtest.h"
 #include "parser/ast.h"
 #include "parser/parser.h"
+#include "sheet.h"
 #include "util/test_eval_helpers.h"
 #include "utils/arena.h"
 #include "value.h"
+#include "workbook.h"
 
 namespace formulon {
 namespace eval {
 namespace {
 
 using formulon::test::EvalSource;
+using formulon::test::EvalSourceIn;
 
 // ---------------------------------------------------------------------------
 // ABS
@@ -631,6 +634,29 @@ TEST(MathAverage, EmptyArgListIsArityViolation) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
+TEST(MathAverage, SumOverflowIsNumError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0e308));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(1.0e308));
+  const Value average = EvalSourceIn("=AVERAGE(A1:A2)", wb, wb.sheet(0));
+  ASSERT_TRUE(average.is_error()) << average.debug_to_string();
+  EXPECT_EQ(average.as_error(), ErrorCode::Num);
+
+  const Value direct = EvalSource("=AVERAGE(9E307,9E307)");
+  ASSERT_TRUE(direct.is_error()) << direct.debug_to_string();
+  EXPECT_EQ(direct.as_error(), ErrorCode::Num);
+}
+
+TEST(MathAverage, PlainSumKeepsLastBitAndAbsorption) {
+  const Value last_bit = EvalSource("=(AVERAGE(0.1,0.2,0.3)-0.2)*1");
+  ASSERT_TRUE(last_bit.is_number()) << last_bit.debug_to_string();
+  EXPECT_DOUBLE_EQ(last_bit.as_number(), 2.7755575615628914e-17);
+
+  const Value absorbed = EvalSource("=AVERAGE(1E16,1,-1E16)");
+  ASSERT_TRUE(absorbed.is_number()) << absorbed.debug_to_string();
+  EXPECT_DOUBLE_EQ(absorbed.as_number(), 0.0);
+}
+
 // ---------------------------------------------------------------------------
 // PRODUCT
 // ---------------------------------------------------------------------------
diff --git a/tests/unit/eval/builtins_pivotby_aggregators_test.cpp b/tests/unit/eval/builtins_pivotby_aggregators_test.cpp
new file mode 100644
index 000000000..afe14d031
--- /dev/null
+++ b/tests/unit/eval/builtins_pivotby_aggregators_test.cpp
@@ -0,0 +1,193 @@
+// PIVOTBY tests grouped by output layout and argument surface.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+#include "builtins_pivotby_test_helpers.h"
+#include "util/test_log_recorder.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using namespace pivotby_test_helpers;
+
+TEST(PivotBy, BareSumName) {
+  // No headers (field_headers=0), no totals (row_total_depth=0,
+  // col_total_depth=0). The col-axis label row (X/Y) is still emitted --
+  // it identifies the pivot's columns independent of field_headers --
+  // followed by the A/B body rows.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"Y\";\"X\";\"Y\"},"
+      "         {1;2;3;4}, SUM, 0, 0,, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 3U);
+  EXPECT_EQ(v.as_array_cols(), 3U);
+  // Col-axis row: [blank corner, "X", "Y"].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 2.0);
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "B");
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 3.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+}
+
+TEST(PivotBy, BareSumFiltersRangeSourcedNonNumbers) {
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"X\";\"X\";\"X\"},"
+      "         {1;TRUE;\"text\";2}, SUM, 0, 0,, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 2.0);
+}
+
+TEST(PivotBy, BareSumInvokedWhenRangeFilterKeepsNothing) {
+  const Value v = EvalSrc("=PIVOTBY({\"A\";\"A\"}, {\"X\";\"X\"}, {TRUE;\"text\"}, SUM, 0, 0,, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 0.0);
+}
+
+TEST(PivotBy, BareAverageName) {
+  // (A, X) = avg(10, 30) = 20; (A, Y) = 40; (B, X) = 20; (B, Y) = avg(60, 80) = 70.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"A\";\"A\";\"B\";\"B\";\"B\"}, {\"X\";\"X\";\"Y\";\"X\";\"Y\";\"Y\"},"
+      "         {10;30;40;20;60;80}, AVERAGE, 0, 0,, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 20.0);  // (A, X)
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 40.0);  // (A, Y)
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 20.0);  // (B, X)
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 70.0);  // (B, Y)
+}
+
+TEST(PivotBy, BareCountAName) {
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"Y\";\"X\";\"Y\"},"
+      "         {1;2;3;4}, COUNTA, 0, 0,, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 1.0);
+}
+
+TEST(PivotBy, UnknownBareNameYieldsNameError) {
+  // `NOPE_NAME` resolves neither in NameEnv nor in the registry; the raw
+  // NameRef evaluation surfaces #NAME?.
+  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\"}, {1;2}, NOPE_NAME, 0, 0,, 0)");
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Name);
+}
+
+TEST(PivotBy, NameBoundLambdaViaLet) {
+  const Value v = EvalSrc(
+      "=LET(agg, LAMBDA(v, SUM(v)),"
+      "     PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"Y\";\"X\";\"Y\"},"
+      "             {1;2;3;4}, agg, 0, 0,, 0))");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+}
+
+TEST(PivotBy, NonLambdaNonNameAggregatorYieldsValueError) {
+  const Value v = EvalSrc("=PIVOTBY({\"A\"}, {\"X\"}, {1}, 42, 0,, 0,, 0)");
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(PivotBy, LambdaWrongArityYieldsValueError) {
+  const Value v = EvalSrc("=PIVOTBY({\"A\"}, {\"X\"}, {1}, LAMBDA(a, b, a+b), 0, 0,, 0)");
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(PivotBy, LambdaWithTrailingOptionalIsAccepted) {
+  // Same fixture as `BasicTwoByTwoLambdaAggregatorSum`, with an optional
+  // param added to the aggregator.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
+      "         {\"V\";1;2;3;4}, LAMBDA(v, [u], SUM(v)))");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 4U);
+  EXPECT_EQ(v.as_array_cols(), 4U);
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 3.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+}
+
+TEST(PivotBy, OptionalParamLambdaMatchesPlainLambda) {
+  // `EvalSrc` resets the shared arenas per call, so the first result is
+  // copied out as plain doubles before the second formula runs.
+  double plain[4] = {0.0, 0.0, 0.0, 0.0};
+  {
+    const Value v = EvalSrc(
+        "=PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
+        "         {\"V\";1;2;3;4}, LAMBDA(v, SUM(v)))");
+    ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+    ASSERT_EQ(v.as_array_rows(), 4U);
+    plain[0] = Cell(v, 1, 1).as_number();
+    plain[1] = Cell(v, 1, 2).as_number();
+    plain[2] = Cell(v, 2, 1).as_number();
+    plain[3] = Cell(v, 2, 2).as_number();
+  }
+  const Value with_opt = EvalSrc(
+      "=PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
+      "         {\"V\";1;2;3;4}, LAMBDA(v, [u], SUM(v)))");
+  ASSERT_TRUE(with_opt.is_array()) << with_opt.debug_to_string();
+  ASSERT_EQ(with_opt.as_array_rows(), 4U);
+  EXPECT_DOUBLE_EQ(plain[0], Cell(with_opt, 1, 1).as_number());
+  EXPECT_DOUBLE_EQ(plain[1], Cell(with_opt, 1, 2).as_number());
+  EXPECT_DOUBLE_EQ(plain[2], Cell(with_opt, 2, 1).as_number());
+  EXPECT_DOUBLE_EQ(plain[3], Cell(with_opt, 2, 2).as_number());
+}
+
+TEST(PivotBy, OmittedParamIsBoundForIsomitted) {
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
+      "         {\"V\";1;2;3;4}, LAMBDA(v, [u], IF(ISOMITTED(u), SUM(v), -1)))");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+}
+
+TEST(PivotBy, LetBoundLambdaWithOptionalIsAccepted) {
+  // Form B resolves the aggregator through the name environment, a
+  // separate branch from the inline literal.
+  const Value v = EvalSrc(
+      "=LET(f, LAMBDA(v, [u], SUM(v)),"
+      "     PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
+      "             {\"V\";1;2;3;4}, f))");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+}
+
+TEST(PivotBy, ZeroParamLambdaStillRejected) {
+  // The other edge: PIVOTBY supplies one argument, so a lambda declaring
+  // no params at all cannot take it.
+  const Value v = EvalSrc("=PIVOTBY({\"A\"}, {\"X\"}, {1}, LAMBDA(42), 0, 0,, 0)");
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(PivotBy, AggregatorReturningArrayYieldsCalcInThatCell) {
+  // SEQUENCE returns multi-cell; each body cell becomes #CALC!.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"A\";\"B\"}, {\"X\";\"Y\";\"X\"},"
+      "         {1;2;3}, LAMBDA(v, SEQUENCE(1, 3)), 0, 0,, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_TRUE(Cell(v, 1, 1).is_error());
+  EXPECT_EQ(Cell(v, 1, 1).as_error(), ErrorCode::Calc);
+  ASSERT_TRUE(Cell(v, 1, 2).is_error());
+  EXPECT_EQ(Cell(v, 1, 2).as_error(), ErrorCode::Calc);
+  // (B, X) is non-empty so the aggregator runs and surfaces #CALC! too.
+  ASSERT_TRUE(Cell(v, 2, 1).is_error());
+  EXPECT_EQ(Cell(v, 2, 1).as_error(), ErrorCode::Calc);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_pivotby_multicol_test.cpp b/tests/unit/eval/builtins_pivotby_multicol_test.cpp
new file mode 100644
index 000000000..f22f16a61
--- /dev/null
+++ b/tests/unit/eval/builtins_pivotby_multicol_test.cpp
@@ -0,0 +1,370 @@
+// PIVOTBY tests grouped by output layout and argument surface.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+#include "builtins_pivotby_test_helpers.h"
+#include "util/test_log_recorder.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using namespace pivotby_test_helpers;
+
+TEST(PivotBy, MismatchedRowCountsRowVsValuesYieldsValueError) {
+  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\";\"C\"}, {\"X\";\"Y\";\"Z\"}, {1;2}, SUM, 0, 0,, 0)");
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(PivotBy, MismatchedRowCountsColVsValuesYieldsValueError) {
+  // row_fields has 2 rows, values has 2 rows, col_fields has 3 -> #VALUE!.
+  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\";\"Z\"}, {1;2}, SUM, 0, 0,, 0)");
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(PivotBy, MultiColumnRowFieldsBasic) {
+  // K=2, L=1, V=1, fh=0. Formulon defaults for the rest:
+  //   row_total_depth=1 (totals at BOTTOM), col_total_depth=1 (totals at RIGHT).
+  // rows = L + 0 + nR + 1 = 1 + 0 + 2 + 1 = 4
+  // cols = K + nC*V + V = 2 + 2 + 1 = 5
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\",\"P\";\"B\",\"Q\";\"A\",\"P\"}, {\"X\";\"Y\";\"X\"},"
+      "         {1;2;3}, SUM, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 4U);
+  EXPECT_EQ(v.as_array_cols(), 5U);
+  // Row 0 (col-axis label row): [null, null, "X", "Y", "合計"].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 1).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "合計");
+  // Row 1 ((A,P) group): X=1+3=4, Y=blank, total=4.
+  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
+  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "P");
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 4.0);
+  EXPECT_TRUE(Cell(v, 1, 3).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 4).as_number(), 4.0);
+  // Row 2 ((B,Q) group): X=blank, Y=2, total=2.
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "B");
+  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "Q");
+  EXPECT_TRUE(Cell(v, 2, 2).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 2.0);
+  // Row 3 (bottom grand-total row): ["合計", null, 4, 2, 6].
+  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "合計");
+  EXPECT_TRUE(Cell(v, 3, 1).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 6.0);
+}
+
+TEST(PivotBy, MultiColumnColFieldsBasic) {
+  // K=1, L=2, V=1, fh=0.
+  // rows = 2 + 0 + 2 + 1 = 5, cols = 1 + 2 + 1 = 4.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
+      "         {1;2;3}, SUM, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 5U);
+  EXPECT_EQ(v.as_array_cols(), 4U);
+  // Row 0 (outermost col-axis level): [null, "X", "Y", "合計"].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "合計");
+  // Row 1 (innermost col-axis level): [null, "M", "N", null].
+  EXPECT_TRUE(Cell(v, 1, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "M");
+  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "N");
+  EXPECT_TRUE(Cell(v, 1, 3).is_blank());
+  // Row 2 (A): [A, 4, blank, 4].
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "A");
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 4.0);
+  EXPECT_TRUE(Cell(v, 2, 2).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 4.0);
+  // Row 3 (B): [B, blank, 2, 2].
+  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "B");
+  EXPECT_TRUE(Cell(v, 3, 1).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 2.0);
+  // Row 4 (bottom grand total): ["合計", 4, 2, 6].
+  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "合計");
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 1).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 2).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 6.0);
+}
+
+TEST(PivotBy, MultiColumnValuesBasic) {
+  // K=1, L=1, V=2, fh=0.
+  // rows = 1 + 0 + 2 + 1 = 4, cols = 1 + 2*2 + 2 = 7.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\";\"Y\";\"X\"},"
+      "         {1,10;2,20;3,30}, SUM, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 4U);
+  EXPECT_EQ(v.as_array_cols(), 7U);
+  // Row 0 (col-axis labels tiled V=2 per col group, "合計" tiled V=2):
+  //   [null, "X", "X", "Y", "Y", "合計", "合計"].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "合計");
+  EXPECT_EQ(std::string(Cell(v, 0, 6).as_text()), "合計");
+  // Row 1 (A): [A, 4, 40, blank, blank, blank, blank].
+  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 40.0);
+  EXPECT_TRUE(Cell(v, 1, 3).is_blank());
+  EXPECT_TRUE(Cell(v, 1, 4).is_blank());
+  EXPECT_TRUE(Cell(v, 1, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 1, 6).is_blank());
+  // Row 2 (B): [B, blank, blank, 2, 20, blank, blank].
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "B");
+  EXPECT_TRUE(Cell(v, 2, 1).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 2).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 20.0);
+  EXPECT_TRUE(Cell(v, 2, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 6).is_blank());
+  // Row 3 (bottom grand totals).
+  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "合計");
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 1).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 40.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 20.0);
+  EXPECT_TRUE(Cell(v, 3, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 3, 6).is_blank());
+}
+
+TEST(PivotBy, MultiColumnAllAxes) {
+  // K=2, L=2, V=2, fh=0.
+  // rows = 2 + 0 + 2 + 1 = 5, cols = 2 + 2*2 + 2 = 8.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\",\"P\";\"B\",\"Q\";\"A\",\"P\"},"
+      "         {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
+      "         {1,10;2,20;3,30}, SUM, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 5U);
+  EXPECT_EQ(v.as_array_cols(), 8U);
+  // Row 0 (outer col-axis): [null, null, "X", "X", "Y", "Y",
+  //                          "合計", "合計"].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 1).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 6).as_text()), "合計");
+  EXPECT_EQ(std::string(Cell(v, 0, 7).as_text()), "合計");
+  // Row 1 (inner col-axis): [null, null, "M", "M", "N", "N", null, null].
+  EXPECT_TRUE(Cell(v, 1, 0).is_blank());
+  EXPECT_TRUE(Cell(v, 1, 1).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "M");
+  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "M");
+  EXPECT_EQ(std::string(Cell(v, 1, 4).as_text()), "N");
+  EXPECT_EQ(std::string(Cell(v, 1, 5).as_text()), "N");
+  EXPECT_TRUE(Cell(v, 1, 6).is_blank());
+  EXPECT_TRUE(Cell(v, 1, 7).is_blank());
+  // Row 2 ((A,P)): [A, P, 4, 40, null, null, null, null].
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "A");
+  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "P");
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 40.0);
+  EXPECT_TRUE(Cell(v, 2, 4).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 6).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 7).is_blank());
+  // Row 3 ((B,Q)): [B, Q, null, null, 2, 20, null, null].
+  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "B");
+  EXPECT_EQ(std::string(Cell(v, 3, 1).as_text()), "Q");
+  EXPECT_TRUE(Cell(v, 3, 2).is_blank());
+  EXPECT_TRUE(Cell(v, 3, 3).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 5).as_number(), 20.0);
+  EXPECT_TRUE(Cell(v, 3, 6).is_blank());
+  EXPECT_TRUE(Cell(v, 3, 7).is_blank());
+  // Row 4 (bottom grand total): ["合計", null, 4, 40, 2, 20, null, null].
+  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "合計");
+  EXPECT_TRUE(Cell(v, 4, 1).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 2).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 40.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 5).as_number(), 20.0);
+  EXPECT_TRUE(Cell(v, 4, 6).is_blank());
+  EXPECT_TRUE(Cell(v, 4, 7).is_blank());
+}
+
+TEST(PivotBy, MultiColumnRowsWithFieldHeadersThree) {
+  // K=2, L=1, V=1, fh=3 (inputs have header, output emits header).
+  // rows = 1 col-field header + 1 col-axis + 1 output header + 1 total + 2 body = 6.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"R1\",\"R2\";\"A\",\"P\";\"B\",\"Q\";\"A\",\"P\"},"
+      "         {\"C\";\"X\";\"Y\";\"X\"},"
+      "         {\"V\";1;2;3}, SUM, 3)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 6U);
+  EXPECT_EQ(v.as_array_cols(), 5U);
+  // Row 0 (col-field header): [null, null, "C", null, null].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 1).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "C");
+  EXPECT_TRUE(Cell(v, 0, 3).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 4).is_blank());
+  // Row 1 (col-axis labels from col_fields data row 0 reps):
+  //   [null, null, "X", "Y", "合計"].
+  EXPECT_TRUE(Cell(v, 1, 0).is_blank());
+  EXPECT_TRUE(Cell(v, 1, 1).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 1, 4).as_text()), "合計");
+  // Row 2 (header row): ["R1", "R2", "V", "V", "V"].
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "R1");
+  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "R2");
+  EXPECT_EQ(std::string(Cell(v, 2, 2).as_text()), "V");
+  EXPECT_EQ(std::string(Cell(v, 2, 3).as_text()), "V");
+  EXPECT_EQ(std::string(Cell(v, 2, 4).as_text()), "V");
+  // Row 3 ((A,P)): [A, P, 4, blank, 4].
+  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "A");
+  EXPECT_EQ(std::string(Cell(v, 3, 1).as_text()), "P");
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 4.0);
+  EXPECT_TRUE(Cell(v, 3, 3).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 4.0);
+  // Row 4 ((B,Q)): [B, Q, blank, 2, 2].
+  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "B");
+  EXPECT_EQ(std::string(Cell(v, 4, 1).as_text()), "Q");
+  EXPECT_TRUE(Cell(v, 4, 2).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 2.0);
+  // Row 5 (bottom grand total).
+  EXPECT_EQ(std::string(Cell(v, 5, 0).as_text()), "合計");
+  EXPECT_TRUE(Cell(v, 5, 1).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 2).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 4).as_number(), 6.0);
+}
+
+TEST(PivotBy, MultiColumnValuesWithFieldHeadersThree) {
+  // K=1, L=1, V=2, fh=3.
+  // rows = 1 col-field header + 1 col-axis + 1 output header + 1 total + 2 body = 6.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"Region\";\"A\";\"B\";\"A\"}, {\"Cat\";\"X\";\"Y\";\"X\"},"
+      "         {\"S\",\"C\";1,10;2,20;3,30}, SUM, 3)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 6U);
+  EXPECT_EQ(v.as_array_cols(), 7U);
+  // Row 0: [null, "Cat", null, null, null, null, null].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "Cat");
+  EXPECT_TRUE(Cell(v, 0, 2).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 3).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 4).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 6).is_blank());
+  // Row 1: [null, "X", "X", "Y", "Y", "合計", "合計"].
+  EXPECT_TRUE(Cell(v, 1, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 1, 4).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 1, 5).as_text()), "合計");
+  EXPECT_EQ(std::string(Cell(v, 1, 6).as_text()), "合計");
+  // Row 2: ["Region", "S", "C", "S", "C", "S", "C"].
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "Region");
+  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "S");
+  EXPECT_EQ(std::string(Cell(v, 2, 2).as_text()), "C");
+  EXPECT_EQ(std::string(Cell(v, 2, 3).as_text()), "S");
+  EXPECT_EQ(std::string(Cell(v, 2, 4).as_text()), "C");
+  EXPECT_EQ(std::string(Cell(v, 2, 5).as_text()), "S");
+  EXPECT_EQ(std::string(Cell(v, 2, 6).as_text()), "C");
+  // Row 3 (A): [A, 4, 40, blank, blank, blank, blank].
+  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "A");
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 1).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 40.0);
+  EXPECT_TRUE(Cell(v, 3, 3).is_blank());
+  EXPECT_TRUE(Cell(v, 3, 4).is_blank());
+  EXPECT_TRUE(Cell(v, 3, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 3, 6).is_blank());
+  // Row 4 (B): [B, blank, blank, 2, 20, blank, blank].
+  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "B");
+  EXPECT_TRUE(Cell(v, 4, 1).is_blank());
+  EXPECT_TRUE(Cell(v, 4, 2).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 20.0);
+  EXPECT_TRUE(Cell(v, 4, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 4, 6).is_blank());
+  // Row 5 (bottom grand total).
+  EXPECT_EQ(std::string(Cell(v, 5, 0).as_text()), "合計");
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 1).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 2).as_number(), 40.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 4).as_number(), 20.0);
+  EXPECT_TRUE(Cell(v, 5, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 5, 6).is_blank());
+}
+
+TEST(PivotBy, MultiColumnValuesWithFieldHeadersTwoSynth) {
+  // K=1, L=1, V=2, fh=2 (no input header, output emits synth labels).
+  // rows = 1 + 1 + 2 + 1 = 5, cols = 7.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\";\"Y\";\"X\"},"
+      "         {1,10;2,20;3,30}, SUM, 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 5U);
+  EXPECT_EQ(v.as_array_cols(), 7U);
+  // Row 0 (col-axis labels from col_fields data row 0 reps):
+  //   [null, "X", "X", "Y", "Y", "合計", "合計"].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "合計");
+  // Row 1 (synth header row):
+  //   ["Field 1", "Value 1", "Value 2", "Value 1", "Value 2", "Value 1", "Value 2"].
+  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "Field 1");
+  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "Value 1");
+  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "Value 2");
+  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "Value 1");
+  EXPECT_EQ(std::string(Cell(v, 1, 4).as_text()), "Value 2");
+  EXPECT_EQ(std::string(Cell(v, 1, 5).as_text()), "Value 1");
+  EXPECT_EQ(std::string(Cell(v, 1, 6).as_text()), "Value 2");
+  // Body sanity check (full coverage in MultiColumnValuesBasic).
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 4.0);
+  EXPECT_TRUE(Cell(v, 2, 6).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 1).as_number(), 4.0);
+  EXPECT_TRUE(Cell(v, 4, 6).is_blank());
+}
+
+TEST(PivotBy, MultiColumnRowsWithFilterArray) {
+  // K=2, L=1, V=1, fh=0, with a filter that drops the (B,Q) data row.
+  // After filter: only (A,P) row group, only X col group. nR=1, nC=1.
+  // rows = 1 + 0 + 1 + 1 = 3, cols = 2 + 1 + 1 = 4.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\",\"P\";\"B\",\"Q\";\"A\",\"P\"}, {\"X\";\"Y\";\"X\"},"
+      "         {1;2;3}, SUM, 0, -1,, 1,, {TRUE;FALSE;TRUE})");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_EQ(v.as_array_rows(), 3U);
+  EXPECT_EQ(v.as_array_cols(), 4U);
+  // Row 0: [null, null, "X", "合計"].
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_TRUE(Cell(v, 0, 1).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "合計");
+  // Row 1 (top grand total): ["合計", null, 4, 4].
+  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "合計");
+  EXPECT_TRUE(Cell(v, 1, 1).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 3).as_number(), 4.0);
+  // Row 2 ((A,P)): [A, P, 4, 4].
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "A");
+  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "P");
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 4.0);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_pivotby_nested_totals_test.cpp b/tests/unit/eval/builtins_pivotby_nested_totals_test.cpp
new file mode 100644
index 000000000..4ca434681
--- /dev/null
+++ b/tests/unit/eval/builtins_pivotby_nested_totals_test.cpp
@@ -0,0 +1,268 @@
+// PIVOTBY tests grouped by output layout and argument surface.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+#include "builtins_pivotby_test_helpers.h"
+#include "util/test_log_recorder.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using namespace pivotby_test_helpers;
+
+TEST(PivotBy, RowTotalDepthTwoAddsASubtotalRowPerOuterRowGroup) {
+  // Row keys are (outer, inner); the outer level is "A" (two rows) and "B"
+  // (one row). Each outer group gets a subtotal row carrying its per-column
+  // aggregates and its row total.
+  const Value v =
+      EvalSrc("=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0, 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  // Col-axis label row + 3 body rows + 2 subtotals + grand total = 7.
+  ASSERT_EQ(v.as_array_rows(), 7U);
+  // 2 row-key cols + 2 col groups + grand-total col = 5.
+  ASSERT_EQ(v.as_array_cols(), 5U);
+  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
+  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "x");
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 20.0);
+  // Subtotal for outer group A: 10 under X, 20 under Y, 30 in total.
+  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "A");
+  EXPECT_TRUE(Cell(v, 3, 1).is_blank()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 20.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 30.0);
+  // Outer group B has no Y data, so that cell stays blank.
+  EXPECT_EQ(std::string(Cell(v, 5, 0).as_text()), "B");
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 2).as_number(), 30.0);
+  EXPECT_TRUE(Cell(v, 5, 3).is_blank()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(Cell(v, 5, 4).as_number(), 30.0);
+  // Grand total closes the block, promoted to 総計 now that subtotal rows
+  // share the same column.
+  EXPECT_EQ(std::string(Cell(v, 6, 0).as_text()), "総計");
+  EXPECT_DOUBLE_EQ(Cell(v, 6, 4).as_number(), 60.0);
+}
+
+TEST(PivotBy, RowTotalDepthNegativeTwoPutsEverySubtotalAboveItsGroup) {
+  const Value v =
+      EvalSrc("=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0, -2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_rows(), 7U);
+  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "総計");
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "A");
+  EXPECT_EQ(std::string(Cell(v, 3, 1).as_text()), "x");
+  EXPECT_EQ(std::string(Cell(v, 4, 1).as_text()), "y");
+  EXPECT_EQ(std::string(Cell(v, 5, 0).as_text()), "B");
+}
+
+TEST(PivotBy, RowTotalDepthTwoWithOneRowKeyColumnKeepsTheGrandTotalOnlyLayout) {
+  const Value v = EvalSrc("=PIVOTBY({\"A\";\"A\";\"B\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0, 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  // Col-axis row + 2 body rows + grand total; a single row-key column
+  // has no outer level to roll up, so ±2 degrades to the ordinary ±1
+  // grand-total-only layout.
+  ASSERT_EQ(v.as_array_rows(), 4U);
+  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "合計");
+}
+
+TEST(PivotBy, RowTotalDepthTwoEmitsNoDiagnostic) {
+  // Row subtotals are implemented, so the degraded-layout warning must not
+  // fire on this path. Asserted against a log sink rather than captured
+  // stderr: logging ships off, so a stderr assertion would hold even if the
+  // code did warn.
+  ::formulon::test::LogRecorder log;
+  ASSERT_TRUE(log.probe_and_clear()) << "log sink is not carrying records; the assertion below would be vacuous";
+  const Value v =
+      EvalSrc("=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0, 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_TRUE(log.empty()) << "unexpected diagnostic: " << log.joined();
+}
+
+TEST(PivotBy, ColTotalDepthTwoEmitsNoDiagnostic) {
+  // Column subtotals are implemented, so the ±2 column request must not
+  // announce a degraded grand-total-only layout.
+  ::formulon::test::LogRecorder log;
+  ASSERT_TRUE(log.probe_and_clear()) << "log sink is not carrying records; the assertion below would be vacuous";
+  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\",\"p\";\"X\",\"q\"}, {10;20}, SUM, 0, 1, , 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_TRUE(log.empty()) << "unexpected diagnostic: " << log.joined();
+}
+
+TEST(PivotBy, ColTotalDepthPositiveTwoMatchesMacExcelObservedMatrix) {
+  // Mac Excel 16.111.3 ja-JP observation (V=1):
+  //   [blank, X, X, Y, Y, 総計]
+  //   [blank, M, blank, N, blank, blank]
+  //   [合計, 4, 4, 2, 2, 6]
+  //   [A, 4, 4, blank, blank, 4]
+  //   [B, blank, blank, 2, 2, 2]
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
+      "         {1;2;3}, SUM, 0, -1,, 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_rows(), 5U);
+  ASSERT_EQ(v.as_array_cols(), 6U);
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "総計");
+  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "M");
+  EXPECT_TRUE(Cell(v, 1, 2).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "N");
+  EXPECT_TRUE(Cell(v, 1, 4).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "合計");
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 5).as_number(), 6.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 1).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 4.0);
+  EXPECT_TRUE(Cell(v, 3, 3).is_blank());
+  EXPECT_TRUE(Cell(v, 3, 4).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 5).as_number(), 4.0);
+  EXPECT_TRUE(Cell(v, 4, 1).is_blank());
+  EXPECT_TRUE(Cell(v, 4, 2).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 5).as_number(), 2.0);
+}
+
+TEST(PivotBy, ColTotalDepthNegativeTwoMatchesMacExcelObservedMatrix) {
+  // The negative depth puts the hierarchy grand total first and each outer
+  // subtotal immediately before its leaf blocks.
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
+      "         {1;2;3}, SUM, 0, -1,, -2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_rows(), 5U);
+  ASSERT_EQ(v.as_array_cols(), 6U);
+  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "総計");
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "Y");
+  EXPECT_TRUE(Cell(v, 1, 1).is_blank());
+  EXPECT_TRUE(Cell(v, 1, 2).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "M");
+  EXPECT_TRUE(Cell(v, 1, 4).is_blank());
+  EXPECT_EQ(std::string(Cell(v, 1, 5).as_text()), "N");
+  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "合計");
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 6.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 5).as_number(), 2.0);
+}
+
+TEST(PivotBy, ColTotalDepthTwoTilesEveryValueColumn) {
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
+      "         {1,10;2,20;3,30}, SUM, 0, 0,, 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_rows(), 4U);
+  ASSERT_EQ(v.as_array_cols(), 11U);  // key + (leaf, subtotal) * 2 outers * V=2 + grand V=2
+  // A: X leaf/subtotal = (4,40), Y is empty; B has only Y.
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 40.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 40.0);
+  EXPECT_TRUE(Cell(v, 2, 5).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 6).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 7).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 8).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 5).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 6).as_number(), 20.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 7).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 8).as_number(), 20.0);
+}
+
+TEST(PivotBy, RowAndColumnNestedSubtotalsIntersectAtBothOuterKeys) {
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"},"
+      "         {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
+      "         {10;20;30}, SUM, 0, 2,, 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_rows(), 8U);
+  ASSERT_EQ(v.as_array_cols(), 7U);
+  // A subtotal row: X leaf/subtotal=10, Y leaf/subtotal=20.
+  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "A");
+  EXPECT_TRUE(Cell(v, 4, 1).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 2).as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 20.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 4, 5).as_number(), 20.0);
+  // B subtotal has no Y intersection, so both Y blocks remain blank.
+  EXPECT_EQ(std::string(Cell(v, 6, 0).as_text()), "B");
+  EXPECT_DOUBLE_EQ(Cell(v, 6, 2).as_number(), 30.0);
+  EXPECT_DOUBLE_EQ(Cell(v, 6, 3).as_number(), 30.0);
+  EXPECT_TRUE(Cell(v, 6, 4).is_blank());
+  EXPECT_TRUE(Cell(v, 6, 5).is_blank());
+}
+
+TEST(PivotBy, ColSubtotalSortKeepsOuterGroupsContiguous) {
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"A\";\"A\";\"A\"},"
+      "         {\"Y\",\"N\";\"X\",\"M\";\"Y\",\"O\";\"X\",\"P\"},"
+      "         {1;2;3;4}, SUM, 0, 0, , 2, 1)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_cols(), 8U);
+  // col_sort_order=1 orders leaves by totals Y(1), X(2), Y(3), X(4), but
+  // the subtotal block plan re-bundles those leaves by outer key: Y,Y,Y,
+  // then X,X,X.
+  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "Y");
+  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "X");
+  EXPECT_EQ(std::string(Cell(v, 0, 6).as_text()), "X");
+}
+
+TEST(PivotBy, ColSubtotalFilterAndErrorRemainLocal) {
+  const Value v = EvalSrc(
+      "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"},"
+      "         {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\";\"Y\",\"N\"},"
+      "         {0;5;4;8}, LAMBDA(v, 1/SUM(v)), 0, 0,, 2,,"
+      "         {TRUE;FALSE;TRUE;TRUE})");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_rows(), 4U);
+  ASSERT_EQ(v.as_array_cols(), 6U);
+  // A/X is a local #DIV/0! in both its leaf and subtotal; A/Y was filtered
+  // out and stays blank. B remains fully calculable.
+  EXPECT_EQ(Cell(v, 2, 1).as_error(), ErrorCode::Div0);
+  EXPECT_EQ(Cell(v, 2, 2).as_error(), ErrorCode::Div0);
+  EXPECT_TRUE(Cell(v, 2, 3).is_blank());
+  EXPECT_TRUE(Cell(v, 2, 4).is_blank());
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 1).as_number(), 0.25);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 0.25);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 0.125);
+  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 0.125);
+}
+
+TEST(PivotBy, ColTotalDepthTwoWithOneColumnLevelKeepsOrdinaryLayout) {
+  ::formulon::test::LogRecorder log;
+  ASSERT_TRUE(log.probe_and_clear()) << "log sink is not carrying records; the assertion below would be vacuous";
+  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\"}, {1;2}, SUM, 0, 0,, 2)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_cols(), 4U);  // key + two leaves + ordinary grand total
+  // Row 0 is the col-axis label row; row 1 is the first body row (A).
+  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
+  EXPECT_TRUE(Cell(v, 1, 2).is_blank());
+  EXPECT_TRUE(log.empty()) << "unexpected diagnostic: " << log.joined();
+}
+
+TEST(PivotBy, DefaultDepthEmitsNoDiagnostic) {
+  // The ordinary ±1 grand-total path must NOT emit the fallback warning.
+  ::formulon::test::LogRecorder log;
+  ASSERT_TRUE(log.probe_and_clear()) << "log sink is not carrying records; the assertion below would be vacuous";
+  const Value v = EvalSrc("=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0)");
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  EXPECT_TRUE(log.empty()) << "unexpected diagnostic on the ±1 path: " << log.joined();
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_pivotby_test.cpp b/tests/unit/eval/builtins_pivotby_test.cpp
index ae523aa37..59488f094 100644
--- a/tests/unit/eval/builtins_pivotby_test.cpp
+++ b/tests/unit/eval/builtins_pivotby_test.cpp
@@ -1,79 +1,16 @@
-//
-// Tests for Excel 365's PIVOTBY dynamic-array function. PIVOTBY shares the
-// lazy-dispatch entry point and aggregator-resolution machinery with
-// GROUPBY (see `tests/unit/eval/builtins_groupby_test.cpp`). The goal of
-// this suite is to cover PIVOTBY's incremental surface:
-//
-//   * Form A / B / C aggregator resolution (parity with GROUPBY).
-//   * 2D output layout: row-axis groups + col-axis groups + per-cell body.
-//   * `field_headers` ∈ {0, 1, 2, 3} drives both row and col header edges.
-//   * `row_total_depth` / `col_total_depth` ∈ {-2, -1, 0, 1, 2} control row /
-//     column total placement (top/bottom for row totals, left/right for
-//     column totals, with nested subtotals on two-level axes).
-//   * `row_sort_order` / `col_sort_order` ∈ {-1, 0, 1} sort by row / col
-//     totals (the "first/only value column" reduces to the total in the
-//     single-column-values scope of this commit).
-//   * `filter_array` masks data rows.
-//   * Per-(row, col) error isolation: one cell errors, the rest succeed.
-//   * ja-JP `fold_jp_text` applies symmetrically to row keys and col keys.
-//   * Mismatched row counts -> `#VALUE!`.
-//   * Multi-column row_fields / col_fields / values produce the K x L x V
-//     cross-product layout (see `eval_pivotby_lazy` source comment for
-//     the row / column ordering and the documented Mac Excel divergences).
-//   * Empty / fully-excluded input -> `#CALC!`.
-//   * Bad arg domains -> `#VALUE!`.
-//   * Aggregator returning array -> `#CALC!` for that cell.
+// PIVOTBY tests grouped by output layout and argument surface.
 
 #include <cstdint>
 #include <string>
 #include <string_view>
 
-#include "eval/eval_context.h"
-#include "eval/function_registry.h"
-#include "eval/tree_walker.h"
-#include "gtest/gtest.h"
-#include "parser/ast.h"
-#include "parser/parser.h"
-#include "test_eval_helpers.h"
+#include "builtins_pivotby_test_helpers.h"
 #include "util/test_log_recorder.h"
-#include "utils/arena.h"
-#include "utils/error.h"
-#include "value.h"
 
 namespace formulon {
 namespace eval {
 namespace {
-
-// Parses `src` and evaluates it through the default function registry.
-// Parse / eval arenas have process lifetime via `static thread_local` so the
-// returned `Value`'s arena-backed payload (text, array cells, lambda body)
-// survives until the next `EvalSrc` call. Each call resets the shared arenas
-// to avoid cross-test contamination, matching the helper pattern in
-// `builtins_countif_test.cpp`. A stack-local `ParseAndEval` would free both
-// arenas at function return, leaving the returned `Value` dangling — caught
-// by AddressSanitizer as heap-use-after-free in `Value::as_array_cells()`.
-Value EvalSrc(std::string_view src) {
-  static thread_local Arena parse_arena;
-  static thread_local Arena eval_arena;
-  parse_arena.reset();
-  eval_arena.reset();
-  parser::Parser p(src, parse_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_TRUE(p.errors().empty()) << "unexpected parse errors for: " << src;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
-  }
-  return evaluate(*root, eval_arena, default_registry(), test::mac_context());
-}
-
-// Reads cell `(r, c)` from a 2D ArrayValue using row-major indexing.
-const Value& Cell(const Value& v, std::uint32_t r, std::uint32_t c) {
-  return v.as_array_cells()[static_cast<std::size_t>(r) * v.as_array_cols() + c];
-}
-
-// ---------------------------------------------------------------------------
-// Form A: inline LAMBDA literal aggregator
-// ---------------------------------------------------------------------------
+using namespace pivotby_test_helpers;
 
 TEST(PivotBy, BasicTwoByTwoLambdaAggregatorSum) {
   // Row groups: A, B. Col groups: X, Y.
@@ -110,97 +47,6 @@ TEST(PivotBy, BasicTwoByTwoLambdaAggregatorSum) {
   EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 10.0);
 }
 
-// ---------------------------------------------------------------------------
-// Form C: bare function name aggregator
-// ---------------------------------------------------------------------------
-
-TEST(PivotBy, BareSumName) {
-  // No headers (field_headers=0), no totals (row_total_depth=0,
-  // col_total_depth=0). The col-axis label row (X/Y) is still emitted --
-  // it identifies the pivot's columns independent of field_headers --
-  // followed by the A/B body rows.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"Y\";\"X\";\"Y\"},"
-      "         {1;2;3;4}, SUM, 0, 0,, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 3U);
-  EXPECT_EQ(v.as_array_cols(), 3U);
-  // Col-axis row: [blank corner, "X", "Y"].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 2.0);
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "B");
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 3.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-}
-
-TEST(PivotBy, BareSumFiltersRangeSourcedNonNumbers) {
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"X\";\"X\";\"X\"},"
-      "         {1;TRUE;\"text\";2}, SUM, 0, 0,, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 2.0);
-}
-
-TEST(PivotBy, BareSumInvokedWhenRangeFilterKeepsNothing) {
-  const Value v = EvalSrc("=PIVOTBY({\"A\";\"A\"}, {\"X\";\"X\"}, {TRUE;\"text\"}, SUM, 0, 0,, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 0.0);
-}
-
-TEST(PivotBy, BareAverageName) {
-  // (A, X) = avg(10, 30) = 20; (A, Y) = 40; (B, X) = 20; (B, Y) = avg(60, 80) = 70.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"A\";\"A\";\"B\";\"B\";\"B\"}, {\"X\";\"X\";\"Y\";\"X\";\"Y\";\"Y\"},"
-      "         {10;30;40;20;60;80}, AVERAGE, 0, 0,, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 20.0);  // (A, X)
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 40.0);  // (A, Y)
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 20.0);  // (B, X)
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 70.0);  // (B, Y)
-}
-
-TEST(PivotBy, BareCountAName) {
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"Y\";\"X\";\"Y\"},"
-      "         {1;2;3;4}, COUNTA, 0, 0,, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 1.0);
-}
-
-TEST(PivotBy, UnknownBareNameYieldsNameError) {
-  // `NOPE_NAME` resolves neither in NameEnv nor in the registry; the raw
-  // NameRef evaluation surfaces #NAME?.
-  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\"}, {1;2}, NOPE_NAME, 0, 0,, 0)");
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Name);
-}
-
-// ---------------------------------------------------------------------------
-// Form B: name-bound LAMBDA via LET
-// ---------------------------------------------------------------------------
-
-TEST(PivotBy, NameBoundLambdaViaLet) {
-  const Value v = EvalSrc(
-      "=LET(agg, LAMBDA(v, SUM(v)),"
-      "     PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"Y\";\"X\";\"Y\"},"
-      "             {1;2;3;4}, agg, 0, 0,, 0))");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-}
-
-// ---------------------------------------------------------------------------
-// field_headers ∈ {0, 1, 2, 3}
-// ---------------------------------------------------------------------------
-
 TEST(PivotBy, FieldHeadersZeroNoHeaders) {
   // No header row in the inputs and no row_fields header label emitted,
   // but the col-axis label row (which carries the pivot's column keys)
@@ -216,11 +62,6 @@ TEST(PivotBy, FieldHeadersZeroNoHeaders) {
   EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
 }
 
-// Regression coverage for the oracle cases `pivotby_bare_sum` /
-// `pivotby_lambda_sum`: field_headers=0 and col_total_depth=0 together
-// still spill a 3x3 result -- blank corner cell, X/Y col-axis row, then
-// the A/B body rows with values on the diagonal (each row group
-// intersects exactly one col group here).
 TEST(PivotBy, ZeroFieldHeadersAndZeroColTotalDepthStillEmitsColAxisRow) {
   const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\"}, {1;2}, SUM, 0, 0, , 0)");
   ASSERT_TRUE(v.is_array()) << v.debug_to_string();
@@ -291,10 +132,6 @@ TEST(PivotBy, FieldHeadersOutOfRangeYieldsValueError) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// row_total_depth
-// ---------------------------------------------------------------------------
-
 TEST(PivotBy, RowTotalDepthZeroNoColumnTotals) {
   // No "column totals" row anywhere.
   const Value v = EvalSrc(
@@ -334,10 +171,6 @@ TEST(PivotBy, RowTotalDepthOutOfRangeYieldsValueError) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// col_total_depth
-// ---------------------------------------------------------------------------
-
 TEST(PivotBy, ColTotalDepthZeroNoRowTotals) {
   const Value v = EvalSrc(
       "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"}, {\"X\";\"Y\";\"X\";\"Y\"},"
@@ -381,10 +214,6 @@ TEST(PivotBy, ColTotalDepthOutOfRangeYieldsValueError) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// row_sort_order
-// ---------------------------------------------------------------------------
-
 TEST(PivotBy, OmittedRowSortOrderPreservesFirstOccurrence) {
   // Row groups in input order: B, A, C. With the slot left out they stay
   // that way. Row 0 is the col-axis label row.
@@ -420,14 +249,6 @@ TEST(PivotBy, RowSortOrderNegativeDescendingByRowTotal) {
   EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "B");
 }
 
-// ---------------------------------------------------------------------------
-// col_sort_order
-// ---------------------------------------------------------------------------
-
-// Both slots take the same signed-column-index domain, which has no zero
-// member. Excel pins the row half (pivotby_row_sort_order_zero_rejected);
-// the column half is held to the same rule so a symmetric argument pair
-// does not accept on one side what it rejects on the other.
 TEST(PivotBy, SuppliedRowSortOrderZeroYieldsValueError) {
   const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\"}, {1;2}, SUM, 0, 0, 0)");
   ASSERT_TRUE(v.is_error()) << v.debug_to_string();
@@ -479,10 +300,6 @@ TEST(PivotBy, ColSortOrderNegativeDescendingByColTotal) {
   EXPECT_DOUBLE_EQ(Cell(v, 1, 3).as_number(), 1.0);  // Y
 }
 
-// ---------------------------------------------------------------------------
-// filter_array
-// ---------------------------------------------------------------------------
-
 TEST(PivotBy, FilterArrayBasicIncludeExclude) {
   // Mask drops the second row (B, X, 3); only A rows and (B, Y, 4) survive.
   const Value v = EvalSrc(
@@ -520,10 +337,6 @@ TEST(PivotBy, FilterArrayAllExcludedYieldsValueError) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// Per-(row, col) error isolation
-// ---------------------------------------------------------------------------
-
 TEST(PivotBy, PerCellErrorIsolation) {
   // The aggregator divides 1 by the cell sum. (A, X) sums to 0 -> #DIV/0!
   // for that cell only; (A, Y) and (B, Y) sums are non-zero and produce
@@ -545,10 +358,6 @@ TEST(PivotBy, PerCellErrorIsolation) {
   EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 0.25);
 }
 
-// ---------------------------------------------------------------------------
-// ja-JP key folding (row + col)
-// ---------------------------------------------------------------------------
-
 TEST(PivotBy, JapaneseFoldingAppliesToRowAndColKeys) {
   // Half-width "ｱ" (U+FF71) and full-width "ア" (U+30A2) fold to the same
   // key. The pivot collapses both rows into a single (row_group, col_group)
@@ -564,470 +373,6 @@ TEST(PivotBy, JapaneseFoldingAppliesToRowAndColKeys) {
   EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 30.0);
 }
 
-// ---------------------------------------------------------------------------
-// Row-count consistency
-// ---------------------------------------------------------------------------
-
-TEST(PivotBy, MismatchedRowCountsRowVsValuesYieldsValueError) {
-  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\";\"C\"}, {\"X\";\"Y\";\"Z\"}, {1;2}, SUM, 0, 0,, 0)");
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(PivotBy, MismatchedRowCountsColVsValuesYieldsValueError) {
-  // row_fields has 2 rows, values has 2 rows, col_fields has 3 -> #VALUE!.
-  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\";\"Z\"}, {1;2}, SUM, 0, 0,, 0)");
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-// ---------------------------------------------------------------------------
-// Multi-column row_fields / col_fields / values
-// ---------------------------------------------------------------------------
-//
-// The general K x L x V layout (K = row_fields->cols, L = col_fields->cols,
-// V = values->cols, all >= 1) is documented in
-// `src/eval/groupby_pivotby/pivotby.cpp` near the top of `eval_pivotby_lazy`.
-// The fixtures here use Formulon's defaults (field_headers=3,
-// row_total_depth=-1, col_total_depth=1) which differ from Mac Excel's
-// defaults; that is a documented, intentional divergence preserving the
-// pre-multi-col test contracts. When fixtures override the defaults
-// (e.g. to fh=0), the expected output is computed from the spec layout.
-
-TEST(PivotBy, MultiColumnRowFieldsBasic) {
-  // K=2, L=1, V=1, fh=0. Formulon defaults for the rest:
-  //   row_total_depth=1 (totals at BOTTOM), col_total_depth=1 (totals at RIGHT).
-  // rows = L + 0 + nR + 1 = 1 + 0 + 2 + 1 = 4
-  // cols = K + nC*V + V = 2 + 2 + 1 = 5
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\",\"P\";\"B\",\"Q\";\"A\",\"P\"}, {\"X\";\"Y\";\"X\"},"
-      "         {1;2;3}, SUM, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 4U);
-  EXPECT_EQ(v.as_array_cols(), 5U);
-  // Row 0 (col-axis label row): [null, null, "X", "Y", "合計"].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 1).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "合計");
-  // Row 1 ((A,P) group): X=1+3=4, Y=blank, total=4.
-  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
-  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "P");
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 4.0);
-  EXPECT_TRUE(Cell(v, 1, 3).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 4).as_number(), 4.0);
-  // Row 2 ((B,Q) group): X=blank, Y=2, total=2.
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "B");
-  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "Q");
-  EXPECT_TRUE(Cell(v, 2, 2).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 2.0);
-  // Row 3 (bottom grand-total row): ["合計", null, 4, 2, 6].
-  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "合計");
-  EXPECT_TRUE(Cell(v, 3, 1).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 6.0);
-}
-
-TEST(PivotBy, MultiColumnColFieldsBasic) {
-  // K=1, L=2, V=1, fh=0.
-  // rows = 2 + 0 + 2 + 1 = 5, cols = 1 + 2 + 1 = 4.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
-      "         {1;2;3}, SUM, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 5U);
-  EXPECT_EQ(v.as_array_cols(), 4U);
-  // Row 0 (outermost col-axis level): [null, "X", "Y", "合計"].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "合計");
-  // Row 1 (innermost col-axis level): [null, "M", "N", null].
-  EXPECT_TRUE(Cell(v, 1, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "M");
-  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "N");
-  EXPECT_TRUE(Cell(v, 1, 3).is_blank());
-  // Row 2 (A): [A, 4, blank, 4].
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "A");
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 4.0);
-  EXPECT_TRUE(Cell(v, 2, 2).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 4.0);
-  // Row 3 (B): [B, blank, 2, 2].
-  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "B");
-  EXPECT_TRUE(Cell(v, 3, 1).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 2.0);
-  // Row 4 (bottom grand total): ["合計", 4, 2, 6].
-  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "合計");
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 1).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 2).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 6.0);
-}
-
-TEST(PivotBy, MultiColumnValuesBasic) {
-  // K=1, L=1, V=2, fh=0.
-  // rows = 1 + 0 + 2 + 1 = 4, cols = 1 + 2*2 + 2 = 7.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\";\"Y\";\"X\"},"
-      "         {1,10;2,20;3,30}, SUM, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 4U);
-  EXPECT_EQ(v.as_array_cols(), 7U);
-  // Row 0 (col-axis labels tiled V=2 per col group, "合計" tiled V=2):
-  //   [null, "X", "X", "Y", "Y", "合計", "合計"].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "合計");
-  EXPECT_EQ(std::string(Cell(v, 0, 6).as_text()), "合計");
-  // Row 1 (A): [A, 4, 40, blank, blank, blank, blank].
-  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 40.0);
-  EXPECT_TRUE(Cell(v, 1, 3).is_blank());
-  EXPECT_TRUE(Cell(v, 1, 4).is_blank());
-  EXPECT_TRUE(Cell(v, 1, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 1, 6).is_blank());
-  // Row 2 (B): [B, blank, blank, 2, 20, blank, blank].
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "B");
-  EXPECT_TRUE(Cell(v, 2, 1).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 2).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 20.0);
-  EXPECT_TRUE(Cell(v, 2, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 6).is_blank());
-  // Row 3 (bottom grand totals).
-  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "合計");
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 1).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 40.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 20.0);
-  EXPECT_TRUE(Cell(v, 3, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 3, 6).is_blank());
-}
-
-TEST(PivotBy, MultiColumnAllAxes) {
-  // K=2, L=2, V=2, fh=0.
-  // rows = 2 + 0 + 2 + 1 = 5, cols = 2 + 2*2 + 2 = 8.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\",\"P\";\"B\",\"Q\";\"A\",\"P\"},"
-      "         {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
-      "         {1,10;2,20;3,30}, SUM, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 5U);
-  EXPECT_EQ(v.as_array_cols(), 8U);
-  // Row 0 (outer col-axis): [null, null, "X", "X", "Y", "Y",
-  //                          "合計", "合計"].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 1).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 6).as_text()), "合計");
-  EXPECT_EQ(std::string(Cell(v, 0, 7).as_text()), "合計");
-  // Row 1 (inner col-axis): [null, null, "M", "M", "N", "N", null, null].
-  EXPECT_TRUE(Cell(v, 1, 0).is_blank());
-  EXPECT_TRUE(Cell(v, 1, 1).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "M");
-  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "M");
-  EXPECT_EQ(std::string(Cell(v, 1, 4).as_text()), "N");
-  EXPECT_EQ(std::string(Cell(v, 1, 5).as_text()), "N");
-  EXPECT_TRUE(Cell(v, 1, 6).is_blank());
-  EXPECT_TRUE(Cell(v, 1, 7).is_blank());
-  // Row 2 ((A,P)): [A, P, 4, 40, null, null, null, null].
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "A");
-  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "P");
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 40.0);
-  EXPECT_TRUE(Cell(v, 2, 4).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 6).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 7).is_blank());
-  // Row 3 ((B,Q)): [B, Q, null, null, 2, 20, null, null].
-  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "B");
-  EXPECT_EQ(std::string(Cell(v, 3, 1).as_text()), "Q");
-  EXPECT_TRUE(Cell(v, 3, 2).is_blank());
-  EXPECT_TRUE(Cell(v, 3, 3).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 5).as_number(), 20.0);
-  EXPECT_TRUE(Cell(v, 3, 6).is_blank());
-  EXPECT_TRUE(Cell(v, 3, 7).is_blank());
-  // Row 4 (bottom grand total): ["合計", null, 4, 40, 2, 20, null, null].
-  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "合計");
-  EXPECT_TRUE(Cell(v, 4, 1).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 2).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 40.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 5).as_number(), 20.0);
-  EXPECT_TRUE(Cell(v, 4, 6).is_blank());
-  EXPECT_TRUE(Cell(v, 4, 7).is_blank());
-}
-
-TEST(PivotBy, MultiColumnRowsWithFieldHeadersThree) {
-  // K=2, L=1, V=1, fh=3 (inputs have header, output emits header).
-  // rows = 1 col-field header + 1 col-axis + 1 output header + 1 total + 2 body = 6.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"R1\",\"R2\";\"A\",\"P\";\"B\",\"Q\";\"A\",\"P\"},"
-      "         {\"C\";\"X\";\"Y\";\"X\"},"
-      "         {\"V\";1;2;3}, SUM, 3)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 6U);
-  EXPECT_EQ(v.as_array_cols(), 5U);
-  // Row 0 (col-field header): [null, null, "C", null, null].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 1).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "C");
-  EXPECT_TRUE(Cell(v, 0, 3).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 4).is_blank());
-  // Row 1 (col-axis labels from col_fields data row 0 reps):
-  //   [null, null, "X", "Y", "合計"].
-  EXPECT_TRUE(Cell(v, 1, 0).is_blank());
-  EXPECT_TRUE(Cell(v, 1, 1).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 1, 4).as_text()), "合計");
-  // Row 2 (header row): ["R1", "R2", "V", "V", "V"].
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "R1");
-  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "R2");
-  EXPECT_EQ(std::string(Cell(v, 2, 2).as_text()), "V");
-  EXPECT_EQ(std::string(Cell(v, 2, 3).as_text()), "V");
-  EXPECT_EQ(std::string(Cell(v, 2, 4).as_text()), "V");
-  // Row 3 ((A,P)): [A, P, 4, blank, 4].
-  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "A");
-  EXPECT_EQ(std::string(Cell(v, 3, 1).as_text()), "P");
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 4.0);
-  EXPECT_TRUE(Cell(v, 3, 3).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 4.0);
-  // Row 4 ((B,Q)): [B, Q, blank, 2, 2].
-  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "B");
-  EXPECT_EQ(std::string(Cell(v, 4, 1).as_text()), "Q");
-  EXPECT_TRUE(Cell(v, 4, 2).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 2.0);
-  // Row 5 (bottom grand total).
-  EXPECT_EQ(std::string(Cell(v, 5, 0).as_text()), "合計");
-  EXPECT_TRUE(Cell(v, 5, 1).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 2).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 4).as_number(), 6.0);
-}
-
-TEST(PivotBy, MultiColumnValuesWithFieldHeadersThree) {
-  // K=1, L=1, V=2, fh=3.
-  // rows = 1 col-field header + 1 col-axis + 1 output header + 1 total + 2 body = 6.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"Region\";\"A\";\"B\";\"A\"}, {\"Cat\";\"X\";\"Y\";\"X\"},"
-      "         {\"S\",\"C\";1,10;2,20;3,30}, SUM, 3)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 6U);
-  EXPECT_EQ(v.as_array_cols(), 7U);
-  // Row 0: [null, "Cat", null, null, null, null, null].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "Cat");
-  EXPECT_TRUE(Cell(v, 0, 2).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 3).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 4).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 6).is_blank());
-  // Row 1: [null, "X", "X", "Y", "Y", "合計", "合計"].
-  EXPECT_TRUE(Cell(v, 1, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 1, 4).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 1, 5).as_text()), "合計");
-  EXPECT_EQ(std::string(Cell(v, 1, 6).as_text()), "合計");
-  // Row 2: ["Region", "S", "C", "S", "C", "S", "C"].
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "Region");
-  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "S");
-  EXPECT_EQ(std::string(Cell(v, 2, 2).as_text()), "C");
-  EXPECT_EQ(std::string(Cell(v, 2, 3).as_text()), "S");
-  EXPECT_EQ(std::string(Cell(v, 2, 4).as_text()), "C");
-  EXPECT_EQ(std::string(Cell(v, 2, 5).as_text()), "S");
-  EXPECT_EQ(std::string(Cell(v, 2, 6).as_text()), "C");
-  // Row 3 (A): [A, 4, 40, blank, blank, blank, blank].
-  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "A");
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 1).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 40.0);
-  EXPECT_TRUE(Cell(v, 3, 3).is_blank());
-  EXPECT_TRUE(Cell(v, 3, 4).is_blank());
-  EXPECT_TRUE(Cell(v, 3, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 3, 6).is_blank());
-  // Row 4 (B): [B, blank, blank, 2, 20, blank, blank].
-  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "B");
-  EXPECT_TRUE(Cell(v, 4, 1).is_blank());
-  EXPECT_TRUE(Cell(v, 4, 2).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 20.0);
-  EXPECT_TRUE(Cell(v, 4, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 4, 6).is_blank());
-  // Row 5 (bottom grand total).
-  EXPECT_EQ(std::string(Cell(v, 5, 0).as_text()), "合計");
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 1).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 2).as_number(), 40.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 4).as_number(), 20.0);
-  EXPECT_TRUE(Cell(v, 5, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 5, 6).is_blank());
-}
-
-TEST(PivotBy, MultiColumnValuesWithFieldHeadersTwoSynth) {
-  // K=1, L=1, V=2, fh=2 (no input header, output emits synth labels).
-  // rows = 1 + 1 + 2 + 1 = 5, cols = 7.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\";\"Y\";\"X\"},"
-      "         {1,10;2,20;3,30}, SUM, 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 5U);
-  EXPECT_EQ(v.as_array_cols(), 7U);
-  // Row 0 (col-axis labels from col_fields data row 0 reps):
-  //   [null, "X", "X", "Y", "Y", "合計", "合計"].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "合計");
-  // Row 1 (synth header row):
-  //   ["Field 1", "Value 1", "Value 2", "Value 1", "Value 2", "Value 1", "Value 2"].
-  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "Field 1");
-  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "Value 1");
-  EXPECT_EQ(std::string(Cell(v, 1, 2).as_text()), "Value 2");
-  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "Value 1");
-  EXPECT_EQ(std::string(Cell(v, 1, 4).as_text()), "Value 2");
-  EXPECT_EQ(std::string(Cell(v, 1, 5).as_text()), "Value 1");
-  EXPECT_EQ(std::string(Cell(v, 1, 6).as_text()), "Value 2");
-  // Body sanity check (full coverage in MultiColumnValuesBasic).
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 4.0);
-  EXPECT_TRUE(Cell(v, 2, 6).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 1).as_number(), 4.0);
-  EXPECT_TRUE(Cell(v, 4, 6).is_blank());
-}
-
-TEST(PivotBy, MultiColumnRowsWithFilterArray) {
-  // K=2, L=1, V=1, fh=0, with a filter that drops the (B,Q) data row.
-  // After filter: only (A,P) row group, only X col group. nR=1, nC=1.
-  // rows = 1 + 0 + 1 + 1 = 3, cols = 2 + 1 + 1 = 4.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\",\"P\";\"B\",\"Q\";\"A\",\"P\"}, {\"X\";\"Y\";\"X\"},"
-      "         {1;2;3}, SUM, 0, -1,, 1,, {TRUE;FALSE;TRUE})");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 3U);
-  EXPECT_EQ(v.as_array_cols(), 4U);
-  // Row 0: [null, null, "X", "合計"].
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_TRUE(Cell(v, 0, 1).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "合計");
-  // Row 1 (top grand total): ["合計", null, 4, 4].
-  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "合計");
-  EXPECT_TRUE(Cell(v, 1, 1).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 3).as_number(), 4.0);
-  // Row 2 ((A,P)): [A, P, 4, 4].
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "A");
-  EXPECT_EQ(std::string(Cell(v, 2, 1).as_text()), "P");
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 4.0);
-}
-
-// ---------------------------------------------------------------------------
-// Bad arg domain checks
-// ---------------------------------------------------------------------------
-
-TEST(PivotBy, NonLambdaNonNameAggregatorYieldsValueError) {
-  const Value v = EvalSrc("=PIVOTBY({\"A\"}, {\"X\"}, {1}, 42, 0,, 0,, 0)");
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(PivotBy, LambdaWrongArityYieldsValueError) {
-  const Value v = EvalSrc("=PIVOTBY({\"A\"}, {\"X\"}, {1}, LAMBDA(a, b, a+b), 0, 0,, 0)");
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-// ---------------------------------------------------------------------------
-// Optional (`[name]`) params on the aggregator lambda
-//
-// PIVOTBY shares GROUPBY's aggregator resolution and per-group invocation,
-// so the same callability window applies: one supplied argument, trailing
-// `[optional]` params bound to the sentinel `ISOMITTED` detects.
-// ---------------------------------------------------------------------------
-
-TEST(PivotBy, LambdaWithTrailingOptionalIsAccepted) {
-  // Same fixture as `BasicTwoByTwoLambdaAggregatorSum`, with an optional
-  // param added to the aggregator.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
-      "         {\"V\";1;2;3;4}, LAMBDA(v, [u], SUM(v)))");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_EQ(v.as_array_rows(), 4U);
-  EXPECT_EQ(v.as_array_cols(), 4U);
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 3.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-}
-
-TEST(PivotBy, OptionalParamLambdaMatchesPlainLambda) {
-  // `EvalSrc` resets the shared arenas per call, so the first result is
-  // copied out as plain doubles before the second formula runs.
-  double plain[4] = {0.0, 0.0, 0.0, 0.0};
-  {
-    const Value v = EvalSrc(
-        "=PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
-        "         {\"V\";1;2;3;4}, LAMBDA(v, SUM(v)))");
-    ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-    ASSERT_EQ(v.as_array_rows(), 4U);
-    plain[0] = Cell(v, 1, 1).as_number();
-    plain[1] = Cell(v, 1, 2).as_number();
-    plain[2] = Cell(v, 2, 1).as_number();
-    plain[3] = Cell(v, 2, 2).as_number();
-  }
-  const Value with_opt = EvalSrc(
-      "=PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
-      "         {\"V\";1;2;3;4}, LAMBDA(v, [u], SUM(v)))");
-  ASSERT_TRUE(with_opt.is_array()) << with_opt.debug_to_string();
-  ASSERT_EQ(with_opt.as_array_rows(), 4U);
-  EXPECT_DOUBLE_EQ(plain[0], Cell(with_opt, 1, 1).as_number());
-  EXPECT_DOUBLE_EQ(plain[1], Cell(with_opt, 1, 2).as_number());
-  EXPECT_DOUBLE_EQ(plain[2], Cell(with_opt, 2, 1).as_number());
-  EXPECT_DOUBLE_EQ(plain[3], Cell(with_opt, 2, 2).as_number());
-}
-
-TEST(PivotBy, OmittedParamIsBoundForIsomitted) {
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
-      "         {\"V\";1;2;3;4}, LAMBDA(v, [u], IF(ISOMITTED(u), SUM(v), -1)))");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-}
-
-TEST(PivotBy, LetBoundLambdaWithOptionalIsAccepted) {
-  // Form B resolves the aggregator through the name environment, a
-  // separate branch from the inline literal.
-  const Value v = EvalSrc(
-      "=LET(f, LAMBDA(v, [u], SUM(v)),"
-      "     PIVOTBY({\"R\";\"A\";\"A\";\"B\";\"B\"}, {\"C\";\"X\";\"Y\";\"X\";\"Y\"},"
-      "             {\"V\";1;2;3;4}, f))");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-}
-
-TEST(PivotBy, ZeroParamLambdaStillRejected) {
-  // The other edge: PIVOTBY supplies one argument, so a lambda declaring
-  // no params at all cannot take it.
-  const Value v = EvalSrc("=PIVOTBY({\"A\"}, {\"X\"}, {1}, LAMBDA(42), 0, 0,, 0)");
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
 TEST(PivotBy, RowSortOrderAbsTwoYieldsValueError) {
   // First-commit scope: only ±1 / 0 are supported on the sort orders.
   const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\"}, {1;2}, SUM, 0, 0, 2, 0)");
@@ -1049,280 +394,6 @@ TEST(PivotBy, TooFewArgsYieldsValueError) {
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
-// ---------------------------------------------------------------------------
-// Aggregator returning multi-cell array -> #CALC! per cell
-// ---------------------------------------------------------------------------
-
-TEST(PivotBy, AggregatorReturningArrayYieldsCalcInThatCell) {
-  // SEQUENCE returns multi-cell; each body cell becomes #CALC!.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"A\";\"B\"}, {\"X\";\"Y\";\"X\"},"
-      "         {1;2;3}, LAMBDA(v, SEQUENCE(1, 3)), 0, 0,, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_TRUE(Cell(v, 1, 1).is_error());
-  EXPECT_EQ(Cell(v, 1, 1).as_error(), ErrorCode::Calc);
-  ASSERT_TRUE(Cell(v, 1, 2).is_error());
-  EXPECT_EQ(Cell(v, 1, 2).as_error(), ErrorCode::Calc);
-  // (B, X) is non-empty so the aggregator runs and surfaces #CALC! too.
-  ASSERT_TRUE(Cell(v, 2, 1).is_error());
-  EXPECT_EQ(Cell(v, 2, 1).as_error(), ErrorCode::Calc);
-}
-
-// ---------------------------------------------------------------------------
-// Nested subtotals (|row_total_depth| == 2 and |col_total_depth| == 2)
-// ---------------------------------------------------------------------------
-
-TEST(PivotBy, RowTotalDepthTwoAddsASubtotalRowPerOuterRowGroup) {
-  // Row keys are (outer, inner); the outer level is "A" (two rows) and "B"
-  // (one row). Each outer group gets a subtotal row carrying its per-column
-  // aggregates and its row total.
-  const Value v =
-      EvalSrc("=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0, 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  // Col-axis label row + 3 body rows + 2 subtotals + grand total = 7.
-  ASSERT_EQ(v.as_array_rows(), 7U);
-  // 2 row-key cols + 2 col groups + grand-total col = 5.
-  ASSERT_EQ(v.as_array_cols(), 5U);
-  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "A");
-  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "x");
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 2).as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 20.0);
-  // Subtotal for outer group A: 10 under X, 20 under Y, 30 in total.
-  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "A");
-  EXPECT_TRUE(Cell(v, 3, 1).is_blank()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 20.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 30.0);
-  // Outer group B has no Y data, so that cell stays blank.
-  EXPECT_EQ(std::string(Cell(v, 5, 0).as_text()), "B");
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 2).as_number(), 30.0);
-  EXPECT_TRUE(Cell(v, 5, 3).is_blank()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(Cell(v, 5, 4).as_number(), 30.0);
-  // Grand total closes the block, promoted to 総計 now that subtotal rows
-  // share the same column.
-  EXPECT_EQ(std::string(Cell(v, 6, 0).as_text()), "総計");
-  EXPECT_DOUBLE_EQ(Cell(v, 6, 4).as_number(), 60.0);
-}
-
-TEST(PivotBy, RowTotalDepthNegativeTwoPutsEverySubtotalAboveItsGroup) {
-  const Value v =
-      EvalSrc("=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0, -2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_rows(), 7U);
-  EXPECT_EQ(std::string(Cell(v, 1, 0).as_text()), "総計");
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "A");
-  EXPECT_EQ(std::string(Cell(v, 3, 1).as_text()), "x");
-  EXPECT_EQ(std::string(Cell(v, 4, 1).as_text()), "y");
-  EXPECT_EQ(std::string(Cell(v, 5, 0).as_text()), "B");
-}
-
-TEST(PivotBy, RowTotalDepthTwoWithOneRowKeyColumnKeepsTheGrandTotalOnlyLayout) {
-  const Value v = EvalSrc("=PIVOTBY({\"A\";\"A\";\"B\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0, 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  // Col-axis row + 2 body rows + grand total; a single row-key column
-  // has no outer level to roll up, so ±2 degrades to the ordinary ±1
-  // grand-total-only layout.
-  ASSERT_EQ(v.as_array_rows(), 4U);
-  EXPECT_EQ(std::string(Cell(v, 3, 0).as_text()), "合計");
-}
-
-TEST(PivotBy, RowTotalDepthTwoEmitsNoDiagnostic) {
-  // Row subtotals are implemented, so the degraded-layout warning must not
-  // fire on this path. Asserted against a log sink rather than captured
-  // stderr: logging ships off, so a stderr assertion would hold even if the
-  // code did warn.
-  ::formulon::test::LogRecorder log;
-  ASSERT_TRUE(log.probe_and_clear()) << "log sink is not carrying records; the assertion below would be vacuous";
-  const Value v =
-      EvalSrc("=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0, 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_TRUE(log.empty()) << "unexpected diagnostic: " << log.joined();
-}
-
-TEST(PivotBy, ColTotalDepthTwoEmitsNoDiagnostic) {
-  // Column subtotals are implemented, so the ±2 column request must not
-  // announce a degraded grand-total-only layout.
-  ::formulon::test::LogRecorder log;
-  ASSERT_TRUE(log.probe_and_clear()) << "log sink is not carrying records; the assertion below would be vacuous";
-  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\",\"p\";\"X\",\"q\"}, {10;20}, SUM, 0, 1, , 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_TRUE(log.empty()) << "unexpected diagnostic: " << log.joined();
-}
-
-TEST(PivotBy, ColTotalDepthPositiveTwoMatchesMacExcelObservedMatrix) {
-  // Mac Excel 16.111.3 ja-JP observation (V=1):
-  //   [blank, X, X, Y, Y, 総計]
-  //   [blank, M, blank, N, blank, blank]
-  //   [合計, 4, 4, 2, 2, 6]
-  //   [A, 4, 4, blank, blank, 4]
-  //   [B, blank, blank, 2, 2, 2]
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
-      "         {1;2;3}, SUM, 0, -1,, 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_rows(), 5U);
-  ASSERT_EQ(v.as_array_cols(), 6U);
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "総計");
-  EXPECT_EQ(std::string(Cell(v, 1, 1).as_text()), "M");
-  EXPECT_TRUE(Cell(v, 1, 2).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "N");
-  EXPECT_TRUE(Cell(v, 1, 4).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "合計");
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 5).as_number(), 6.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 1).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 4.0);
-  EXPECT_TRUE(Cell(v, 3, 3).is_blank());
-  EXPECT_TRUE(Cell(v, 3, 4).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 5).as_number(), 4.0);
-  EXPECT_TRUE(Cell(v, 4, 1).is_blank());
-  EXPECT_TRUE(Cell(v, 4, 2).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 5).as_number(), 2.0);
-}
-
-TEST(PivotBy, ColTotalDepthNegativeTwoMatchesMacExcelObservedMatrix) {
-  // The negative depth puts the hierarchy grand total first and each outer
-  // subtotal immediately before its leaf blocks.
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
-      "         {1;2;3}, SUM, 0, -1,, -2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_rows(), 5U);
-  ASSERT_EQ(v.as_array_cols(), 6U);
-  EXPECT_TRUE(Cell(v, 0, 0).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "総計");
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "Y");
-  EXPECT_TRUE(Cell(v, 1, 1).is_blank());
-  EXPECT_TRUE(Cell(v, 1, 2).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 1, 3).as_text()), "M");
-  EXPECT_TRUE(Cell(v, 1, 4).is_blank());
-  EXPECT_EQ(std::string(Cell(v, 1, 5).as_text()), "N");
-  EXPECT_EQ(std::string(Cell(v, 2, 0).as_text()), "合計");
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 6.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 5).as_number(), 2.0);
-}
-
-TEST(PivotBy, ColTotalDepthTwoTilesEveryValueColumn) {
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"B\";\"A\"}, {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
-      "         {1,10;2,20;3,30}, SUM, 0, 0,, 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_rows(), 4U);
-  ASSERT_EQ(v.as_array_cols(), 11U);  // key + (leaf, subtotal) * 2 outers * V=2 + grand V=2
-  // A: X leaf/subtotal = (4,40), Y is empty; B has only Y.
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 1).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 2).as_number(), 40.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 3).as_number(), 4.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 2, 4).as_number(), 40.0);
-  EXPECT_TRUE(Cell(v, 2, 5).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 6).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 7).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 8).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 5).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 6).as_number(), 20.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 7).as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 8).as_number(), 20.0);
-}
-
-TEST(PivotBy, RowAndColumnNestedSubtotalsIntersectAtBothOuterKeys) {
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"},"
-      "         {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\"},"
-      "         {10;20;30}, SUM, 0, 2,, 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_rows(), 8U);
-  ASSERT_EQ(v.as_array_cols(), 7U);
-  // A subtotal row: X leaf/subtotal=10, Y leaf/subtotal=20.
-  EXPECT_EQ(std::string(Cell(v, 4, 0).as_text()), "A");
-  EXPECT_TRUE(Cell(v, 4, 1).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 2).as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 3).as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 4).as_number(), 20.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 4, 5).as_number(), 20.0);
-  // B subtotal has no Y intersection, so both Y blocks remain blank.
-  EXPECT_EQ(std::string(Cell(v, 6, 0).as_text()), "B");
-  EXPECT_DOUBLE_EQ(Cell(v, 6, 2).as_number(), 30.0);
-  EXPECT_DOUBLE_EQ(Cell(v, 6, 3).as_number(), 30.0);
-  EXPECT_TRUE(Cell(v, 6, 4).is_blank());
-  EXPECT_TRUE(Cell(v, 6, 5).is_blank());
-}
-
-TEST(PivotBy, ColSubtotalSortKeepsOuterGroupsContiguous) {
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"A\";\"A\";\"A\"},"
-      "         {\"Y\",\"N\";\"X\",\"M\";\"Y\",\"O\";\"X\",\"P\"},"
-      "         {1;2;3;4}, SUM, 0, 0, , 2, 1)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_cols(), 8U);
-  // col_sort_order=1 orders leaves by totals Y(1), X(2), Y(3), X(4), but
-  // the subtotal block plan re-bundles those leaves by outer key: Y,Y,Y,
-  // then X,X,X.
-  EXPECT_EQ(std::string(Cell(v, 0, 1).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 2).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 3).as_text()), "Y");
-  EXPECT_EQ(std::string(Cell(v, 0, 4).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 5).as_text()), "X");
-  EXPECT_EQ(std::string(Cell(v, 0, 6).as_text()), "X");
-}
-
-TEST(PivotBy, ColSubtotalFilterAndErrorRemainLocal) {
-  const Value v = EvalSrc(
-      "=PIVOTBY({\"A\";\"A\";\"B\";\"B\"},"
-      "         {\"X\",\"M\";\"Y\",\"N\";\"X\",\"M\";\"Y\",\"N\"},"
-      "         {0;5;4;8}, LAMBDA(v, 1/SUM(v)), 0, 0,, 2,,"
-      "         {TRUE;FALSE;TRUE;TRUE})");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_rows(), 4U);
-  ASSERT_EQ(v.as_array_cols(), 6U);
-  // A/X is a local #DIV/0! in both its leaf and subtotal; A/Y was filtered
-  // out and stays blank. B remains fully calculable.
-  EXPECT_EQ(Cell(v, 2, 1).as_error(), ErrorCode::Div0);
-  EXPECT_EQ(Cell(v, 2, 2).as_error(), ErrorCode::Div0);
-  EXPECT_TRUE(Cell(v, 2, 3).is_blank());
-  EXPECT_TRUE(Cell(v, 2, 4).is_blank());
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 1).as_number(), 0.25);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 2).as_number(), 0.25);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 3).as_number(), 0.125);
-  EXPECT_DOUBLE_EQ(Cell(v, 3, 4).as_number(), 0.125);
-}
-
-TEST(PivotBy, ColTotalDepthTwoWithOneColumnLevelKeepsOrdinaryLayout) {
-  ::formulon::test::LogRecorder log;
-  ASSERT_TRUE(log.probe_and_clear()) << "log sink is not carrying records; the assertion below would be vacuous";
-  const Value v = EvalSrc("=PIVOTBY({\"A\";\"B\"}, {\"X\";\"Y\"}, {1;2}, SUM, 0, 0,, 2)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_cols(), 4U);  // key + two leaves + ordinary grand total
-  // Row 0 is the col-axis label row; row 1 is the first body row (A).
-  EXPECT_DOUBLE_EQ(Cell(v, 1, 1).as_number(), 1.0);
-  EXPECT_TRUE(Cell(v, 1, 2).is_blank());
-  EXPECT_TRUE(log.empty()) << "unexpected diagnostic: " << log.joined();
-}
-
-TEST(PivotBy, DefaultDepthEmitsNoDiagnostic) {
-  // The ordinary ±1 grand-total path must NOT emit the fallback warning.
-  ::formulon::test::LogRecorder log;
-  ASSERT_TRUE(log.probe_and_clear()) << "log sink is not carrying records; the assertion below would be vacuous";
-  const Value v = EvalSrc("=PIVOTBY({\"A\",\"x\";\"A\",\"y\";\"B\",\"x\"}, {\"X\";\"Y\";\"X\"}, {10;20;30}, SUM, 0)");
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  EXPECT_TRUE(log.empty()) << "unexpected diagnostic on the ±1 path: " << log.joined();
-}
-
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins_pivotby_test_helpers.h b/tests/unit/eval/builtins_pivotby_test_helpers.h
new file mode 100644
index 000000000..f06d87a6c
--- /dev/null
+++ b/tests/unit/eval/builtins_pivotby_test_helpers.h
@@ -0,0 +1,38 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string_view>
+
+#include "eval/eval_context.h"
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "test_eval_helpers.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace formulon::eval::pivotby_test_helpers {
+
+inline Value EvalSrc(std::string_view src) {
+  static thread_local Arena parse_arena;
+  static thread_local Arena eval_arena;
+  parse_arena.reset();
+  eval_arena.reset();
+  parser::Parser p(src, parse_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_TRUE(p.errors().empty()) << "unexpected parse errors for: " << src;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  return evaluate(*root, eval_arena, default_registry(), test::mac_context());
+}
+
+inline const Value& Cell(const Value& v, std::uint32_t r, std::uint32_t c) {
+  return v.as_array_cells()[static_cast<std::size_t>(r) * v.as_array_cols() + c];
+}
+
+}  // namespace formulon::eval::pivotby_test_helpers
diff --git a/tests/unit/eval/builtins_rand_test.cpp b/tests/unit/eval/builtins_rand_test.cpp
index 736228d07..e95582f98 100644
--- a/tests/unit/eval/builtins_rand_test.cpp
+++ b/tests/unit/eval/builtins_rand_test.cpp
@@ -12,8 +12,11 @@
 //
 // No oracle fixtures: the generator cannot reproduce nondeterministic values
 // from Excel, so volatility is asserted structurally here instead.
+#include <array>
+#include <cmath>
 #include <set>
 #include <string_view>
+#include <utility>
 
 #include "eval/function_registry.h"
 #include "eval/tree_walker.h"
@@ -30,6 +33,21 @@ namespace {
 
 using formulon::test::EvalSource;
 
+const FunctionDef* RandBetweenDef() {
+  const FunctionDef* def = default_registry().lookup("RANDBETWEEN");
+  EXPECT_NE(def, nullptr) << "RANDBETWEEN must be registered in the default registry";
+  return def;
+}
+
+Value CallRandBetween(Arena& arena, double bottom, double top) {
+  const FunctionDef* def = RandBetweenDef();
+  if (def == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  Value args[2] = {Value::number(bottom), Value::number(top)};
+  return def->impl(args, 2U, arena);
+}
+
 // ---------------------------------------------------------------------------
 // Registry pin -- catches accidental drops / renames during refactors.
 // ---------------------------------------------------------------------------
@@ -137,6 +155,64 @@ TEST(BuiltinsRandBetween, BoolBottomCoercesToOne) {
   }
 }
 
+TEST(BuiltinsRandBetween, HugeIntegralSingletonsArePreserved) {
+  // Bounds outside int64_t still represent exact integral doubles. A
+  // singleton must be returned unchanged instead of being cast through the
+  // signed integer distribution's implementation-defined domain.
+  for (const auto& sample : {std::pair<std::string_view, double>("=RANDBETWEEN(1e20,1e20)", 1e20),
+                             std::pair<std::string_view, double>("=RANDBETWEEN(-1e20,-1e20)", -1e20)}) {
+    const Value v = EvalSource(sample.first);
+    ASSERT_TRUE(v.is_number()) << sample.first;
+    EXPECT_DOUBLE_EQ(v.as_number(), sample.second) << sample.first;
+  }
+}
+
+TEST(BuiltinsRandBetween, Int64BoundaryInputsStayFiniteAndIntegral) {
+  // -2^63 is representable in int64_t; the nearest representable double below
+  // +2^63 is also safe. The exact +2^63 endpoint and a value below -2^63 are
+  // intentionally unsafe integer-distribution inputs and must still remain
+  // valid double-valued results.
+  const double safe_lower = -9223372036854775808.0;
+  const double safe_upper = 9223372036854774784.0;
+  const double unsafe_lower = -9223372036854777856.0;
+  const double unsafe_upper = 9223372036854777856.0;
+  const std::array<std::pair<double, double>, 5> bounds = {{
+      {safe_lower, safe_lower},
+      {safe_upper, safe_upper},
+      {0x1p63, 0x1p63},
+      {unsafe_lower, unsafe_lower},
+      {unsafe_upper, unsafe_upper},
+  }};
+  for (const auto& sample : bounds) {
+    Arena arena;
+    const Value v = CallRandBetween(arena, sample.first, sample.second);
+    ASSERT_TRUE(v.is_number());
+    const double x = v.as_number();
+    EXPECT_TRUE(std::isfinite(x));
+    EXPECT_DOUBLE_EQ(x, sample.first);
+    EXPECT_EQ(std::trunc(x), x);
+  }
+}
+
+TEST(BuiltinsRandBetween, HugeIntegralRangesStayInRange) {
+  const std::array<std::pair<std::string_view, std::pair<double, double>>, 3> ranges = {{
+      {"=RANDBETWEEN(1e20,1e21)", {1e20, 1e21}},
+      {"=RANDBETWEEN(-1e21,-1e20)", {-1e21, -1e20}},
+      {"=RANDBETWEEN(-1e20,1e20)", {-1e20, 1e20}},
+  }};
+  for (const auto& sample : ranges) {
+    for (int i = 0; i < 100; ++i) {
+      const Value v = EvalSource(sample.first);
+      ASSERT_TRUE(v.is_number()) << sample.first << " iter=" << i;
+      const double x = v.as_number();
+      EXPECT_TRUE(std::isfinite(x)) << sample.first << " iter=" << i;
+      EXPECT_GE(x, sample.second.first) << sample.first << " iter=" << i;
+      EXPECT_LE(x, sample.second.second) << sample.first << " iter=" << i;
+      EXPECT_EQ(std::trunc(x), x) << sample.first << " iter=" << i;
+    }
+  }
+}
+
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins_references_endpoints_test.cpp b/tests/unit/eval/builtins_references_endpoints_test.cpp
new file mode 100644
index 000000000..8f55d86a1
--- /dev/null
+++ b/tests/unit/eval/builtins_references_endpoints_test.cpp
@@ -0,0 +1,304 @@
+// Reference builtin tests grouped by reference constructor.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#include "builtins_references_test_helpers.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using namespace references_test_helpers;
+
+Workbook NamedEndpointBook() {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  for (std::uint32_t r = 0; r < 4U; ++r) {
+    for (std::uint32_t c = 0; c < 4U; ++c) {
+      const double v = static_cast<double>((r + 1U) * 10U + (c + 1U));
+      wb.sheet(0).set_cell_value(r, c, Value::number(v));
+      wb.sheet(1).set_cell_value(r, c, Value::number(100.0 + v));
+    }
+  }
+  const std::pair<const char*, const char*> names[] = {
+      {"CellNm", "=Sheet1!$C$3"},
+      {"RectNm", "=Sheet1!$C$3:$D$4"},
+      {"Konst", "=5"},
+      {"IdxNm", "=INDEX(Sheet1!$A$1:$D$4,3,3)"},
+      {"OtherNm", "=Sheet2!$C$3"},
+      {"ExprNm", "=Sheet1!$C$3+0"},
+      {"TextNm", "=\"abc\""},
+      {"OffNm", "=OFFSET(Sheet1!$A$1,2,2)"},
+      {"ErrNm", "=#N/A"},
+      {"NaNm", "=NA()"},
+  };
+  for (const auto& [name, formula] : names) {
+    EXPECT_TRUE(static_cast<bool>(wb.set_defined_name(name, formula)));
+  }
+  return wb;
+}
+
+void ExpectError(const Value& v, ErrorCode expected, std::string_view formula) {
+  ASSERT_TRUE(v.is_error()) << formula << " -> " << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), expected) << formula;
+}
+
+TEST(ReferenceCall, CallEndpointRangeSpillsAsAValue) {
+  Workbook wb = ColumnOfTen();
+  const Value v = EvalSourceIn("=A1:INDEX(A1:A10,3)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
+  ASSERT_EQ(v.as_array_rows(), 3U);
+  ASSERT_EQ(v.as_array_cols(), 1U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[2].as_number(), 3.0);
+  ExpectNumber(EvalSourceIn("=A2:OFFSET(A1,1,0)", wb, wb.sheet(0)), 2.0, "1x1 call-endpoint range");
+}
+
+TEST(ReferenceCall, IndexAsReferenceArgument) {
+  Workbook wb = ColumnOfTen();
+  const Value isref = EvalSourceIn("=ISREF(INDEX(A1:B2,1,1))", wb, wb.sheet(0));
+  ASSERT_TRUE(isref.is_boolean());
+  EXPECT_TRUE(isref.as_boolean());
+  const Value literal = EvalSourceIn("=ISREF(INDEX({1,2},1))", wb, wb.sheet(0));
+  ASSERT_TRUE(literal.is_boolean());
+  EXPECT_FALSE(literal.as_boolean());
+  ExpectNumber(EvalSourceIn("=ROW(INDEX(A1:A10,3))", wb, wb.sheet(0)), 3.0, "ROW(INDEX(A1:A10,3))");
+  ExpectNumber(EvalSourceIn("=COLUMN(INDEX(A1:C3,2,3))", wb, wb.sheet(0)), 3.0, "COLUMN(INDEX(A1:C3,2,3))");
+  ExpectText(EvalSourceIn("=CELL(\"address\",INDEX(A1:C3,2,3))", wb, wb.sheet(0)), "$C$2", "CELL of INDEX");
+  // A zero index selects a whole column / row of the source.
+  ExpectNumber(EvalSourceIn("=ROWS(INDEX(A1:C3,0,2))", wb, wb.sheet(0)), 3.0, "ROWS(INDEX(A1:C3,0,2))");
+  ExpectNumber(EvalSourceIn("=COLUMNS(INDEX(A1:C3,2,0))", wb, wb.sheet(0)), 3.0, "COLUMNS(INDEX(A1:C3,2,0))");
+  ExpectNumber(EvalSourceIn("=SUM(OFFSET(INDEX(A1:A10,2),1,0,2,1))", wb, wb.sheet(0)), 7.0, "OFFSET over INDEX");
+}
+
+TEST(ReferenceCall, IndexAreaNumSelectsFromUnion) {
+  // A1:B2 = {1,2;3,4}, D1:E2 = {10,20;30,40}.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(3.0));
+  wb.sheet(0).set_cell_value(1, 1, Value::number(4.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(10.0));
+  wb.sheet(0).set_cell_value(0, 4, Value::number(20.0));
+  wb.sheet(0).set_cell_value(1, 3, Value::number(30.0));
+  wb.sheet(0).set_cell_value(1, 4, Value::number(40.0));
+  ExpectNumber(EvalSourceIn("=INDEX((A1:B2,D1:E2),2,1,2)", wb, wb.sheet(0)), 30.0, "area 2");
+  ExpectNumber(EvalSourceIn("=INDEX((A1:B2,D1:E2),2,1,1)", wb, wb.sheet(0)), 3.0, "area 1");
+  ExpectNumber(EvalSourceIn("=INDEX((A1:B2,D1:E2),2,1)", wb, wb.sheet(0)), 3.0, "default area");
+  ExpectNumber(EvalSourceIn("=INDEX(A1:B2,1,2,1)", wb, wb.sheet(0)), 2.0, "single area");
+  ExpectText(EvalSourceIn("=CELL(\"address\",INDEX((A1:B2,D1:E2),1,2,2))", wb, wb.sheet(0)), "$E$1", "CELL of area 2");
+  ExpectNumber(EvalSourceIn("=SUM(INDEX((A1:B2,D1:E2),0,2,2))", wb, wb.sheet(0)), 60.0, "whole column of area 2");
+  ExpectNumber(EvalSourceIn("=AREAS(INDEX((A1:B2,D1:E2),1,1,2))", wb, wb.sheet(0)), 1.0, "AREAS of INDEX");
+  for (const char* formula : {"=INDEX((A1:B2,D1:E2),1,1,3)", "=INDEX(A1:B2,1,1,2)"}) {
+    const Value v = EvalSourceIn(formula, wb, wb.sheet(0));
+    ASSERT_TRUE(v.is_error()) << formula;
+    EXPECT_EQ(v.as_error(), ErrorCode::Ref) << formula;
+  }
+  for (const char* formula :
+       {"=INDEX((A1:B2,D1:E2),1,1,0)", "=INDEX(A1:B2,1,1,0)", "=INDEX((A1:B2,D1:E2),1,1,-1)", "=INDEX(A1:B2,1,1,-1)"}) {
+    const Value v = EvalSourceIn(formula, wb, wb.sheet(0));
+    ASSERT_TRUE(v.is_error()) << formula;
+    EXPECT_EQ(v.as_error(), ErrorCode::Value) << formula;
+  }
+  // A fractional area_num truncates toward zero, like row_num / column_num.
+  ExpectNumber(EvalSourceIn("=INDEX((A1:B2,D1:E2),2,1,1.9)", wb, wb.sheet(0)), 3.0, "area_num truncates");
+  // area_num on a whole-area selection (row=0, col=0) picks that area's
+  // own shape and top-left address, not the union's.
+  ExpectNumber(EvalSourceIn("=ROWS(INDEX((A1:B2,D1:E2),0,0,2))", wb, wb.sheet(0)), 2.0, "ROWS of whole area 2");
+  ExpectNumber(EvalSourceIn("=SUM(INDEX((A1:B2,D1:E2),0,0,2))", wb, wb.sheet(0)), 100.0, "SUM of whole area 2");
+  ExpectText(EvalSourceIn("=CELL(\"address\",INDEX((A1:B2,D1:E2),0,0,2))", wb, wb.sheet(0)), "$D$1",
+             "CELL of whole area 2");
+}
+
+TEST(ReferenceCall, XlookupAsReference) {
+  // A1:A3 = a/b/c, B1:C3 = {1,10;2,20;3,30}.
+  Workbook wb = Workbook::create();
+  const char* keys[] = {"a", "b", "c"};
+  for (std::uint32_t r = 0; r < 3; ++r) {
+    wb.sheet(0).set_cell_value(r, 0, Value::text(keys[r]));
+    wb.sheet(0).set_cell_value(r, 1, Value::number(static_cast<double>(r + 1)));
+    wb.sheet(0).set_cell_value(r, 2, Value::number(static_cast<double>((r + 1) * 10)));
+  }
+  ExpectNumber(EvalSourceIn("=SUM(XLOOKUP(\"b\",A1:A3,B1:B3):B3)", wb, wb.sheet(0)), 5.0, "XLOOKUP endpoint");
+  const Value isref = EvalSourceIn("=ISREF(XLOOKUP(\"b\",A1:A3,B1:B3))", wb, wb.sheet(0));
+  ASSERT_TRUE(isref.is_boolean());
+  EXPECT_TRUE(isref.as_boolean());
+  ExpectText(EvalSourceIn("=CELL(\"address\",XLOOKUP(\"c\",A1:A3,B1:B3))", wb, wb.sheet(0)), "$B$3", "CELL of XLOOKUP");
+  // A multi-column return_array yields the matched row.
+  ExpectNumber(EvalSourceIn("=COLUMNS(XLOOKUP(\"a\",A1:A3,B1:C3))", wb, wb.sheet(0)), 2.0, "matched row");
+  ExpectNumber(EvalSourceIn("=ROW(XLOOKUP(\"b\",A1:A3,B1:C3))", wb, wb.sheet(0)), 2.0, "ROW of matched row");
+  // A miss returns if_not_found, which may itself be a reference.
+  ExpectText(EvalSourceIn("=CELL(\"address\",XLOOKUP(\"z\",A1:A3,B1:B3,C1))", wb, wb.sheet(0)), "$C$1",
+             "miss falls back to reference");
+  const Value miss = EvalSourceIn("=SUM(A1:XLOOKUP(\"z\",A1:A3,B1:B3))", wb, wb.sheet(0));
+  ASSERT_TRUE(miss.is_error());
+  EXPECT_EQ(miss.as_error(), ErrorCode::NA);
+}
+
+TEST(ReferenceCall, IfsAndSwitchPassReferencesThrough) {
+  Workbook wb = ColumnOfTen();
+  ExpectNumber(EvalSourceIn("=ROWS(A1:SWITCH(2,1,A2,2,A4))", wb, wb.sheet(0)), 4.0, "SWITCH endpoint");
+  ExpectNumber(EvalSourceIn("=SUM(A1:IFS(FALSE,A2,TRUE,A3))", wb, wb.sheet(0)), 6.0, "IFS endpoint");
+  const Value isref = EvalSourceIn("=ISREF(IFS(FALSE,A1,TRUE,B2))", wb, wb.sheet(0));
+  ASSERT_TRUE(isref.is_boolean());
+  EXPECT_TRUE(isref.as_boolean());
+  const Value scalar = EvalSourceIn("=ISREF(SWITCH(1,1,5))", wb, wb.sheet(0));
+  ASSERT_TRUE(scalar.is_boolean());
+  EXPECT_FALSE(scalar.as_boolean());
+  ExpectNumber(EvalSourceIn("=AREAS(SWITCH(9,1,A1,B1:C2))", wb, wb.sheet(0)), 1.0, "AREAS of SWITCH default");
+  // The value path is unchanged.
+  ExpectNumber(EvalSourceIn("=SWITCH(2,1,A2,2,A4)", wb, wb.sheet(0)), 4.0, "SWITCH value");
+  ExpectNumber(EvalSourceIn("=IFS(FALSE,A2,TRUE,A3)", wb, wb.sheet(0)), 3.0, "IFS value");
+}
+
+TEST(ReferenceCall, DefinedNameAsRangeEndpoint) {
+  Workbook wb = NamedEndpointBook();
+  const Sheet& s1 = wb.sheet(0);
+  ExpectNumber(EvalSourceIn("=SUM(A1:CellNm)", wb, s1), 198.0, "SUM(A1:CellNm)");
+  ExpectNumber(EvalSourceIn("=SUM(CellNm:A1)", wb, s1), 198.0, "SUM(CellNm:A1)");
+  ExpectNumber(EvalSourceIn("=SUM(A1:RectNm)", wb, s1), 440.0, "SUM(A1:RectNm)");
+  ExpectNumber(EvalSourceIn("=SUM(A1:IdxNm)", wb, s1), 198.0, "SUM(A1:IdxNm)");
+  ExpectNumber(EvalSourceIn("=SUM(A1:OffNm)", wb, s1), 198.0, "SUM(A1:OffNm)");
+  ExpectNumber(EvalSourceIn("=ROWS(A1:RectNm)", wb, s1), 4.0, "ROWS(A1:RectNm)");
+  ExpectNumber(EvalSourceIn("=SUM(CellNm:RectNm)", wb, s1), 154.0, "SUM(CellNm:RectNm)");
+  ExpectNumber(EvalSourceIn("=SUM(A1:CellNm:B1)", wb, s1), 198.0, "SUM(A1:CellNm:B1)");
+  ExpectNumber(EvalSourceIn("=SUM(Sheet1!A1:CellNm)", wb, s1), 198.0, "SUM(Sheet1!A1:CellNm)");
+  ExpectNumber(EvalSourceIn("=SUM(Sheet2!A1:OtherNm)", wb, s1), 1098.0, "SUM(Sheet2!A1:OtherNm)");
+  ExpectNumber(EvalSourceIn("=SUM(A1:Sheet1!CellNm)", wb, s1), 198.0, "SUM(A1:Sheet1!CellNm)");
+  ExpectNumber(EvalSourceIn("=SUM(A1:[0]!CellNm)", wb, s1), 198.0, "SUM(A1:[0]!CellNm)");
+}
+
+TEST(ReferenceCall, NonReferenceNameAsRangeEndpoint) {
+  Workbook wb = NamedEndpointBook();
+  const Sheet& s1 = wb.sheet(0);
+  ExpectError(EvalSourceIn("=SUM(A1:Konst)", wb, s1), ErrorCode::Value, "SUM(A1:Konst)");
+  ExpectError(EvalSourceIn("=SUM(Konst:A1)", wb, s1), ErrorCode::Value, "SUM(Konst:A1)");
+  ExpectError(EvalSourceIn("=ROWS(A1:Konst)", wb, s1), ErrorCode::Value, "ROWS(A1:Konst)");
+  ExpectError(EvalSourceIn("=SUM(A1:ExprNm)", wb, s1), ErrorCode::Value, "SUM(A1:ExprNm)");
+  ExpectError(EvalSourceIn("=SUM(A1:TextNm)", wb, s1), ErrorCode::Value, "SUM(A1:TextNm)");
+  ExpectError(EvalSourceIn("=SUM(A1:Nope)", wb, s1), ErrorCode::Name, "SUM(A1:Nope)");
+  ExpectError(EvalSourceIn("=SUM(A1:ErrNm)", wb, s1), ErrorCode::NA, "SUM(A1:ErrNm)");
+  ExpectError(EvalSourceIn("=SUM(A1:NaNm)", wb, s1), ErrorCode::NA, "SUM(A1:NaNm)");
+  ExpectError(EvalSourceIn("=LET(r,5,SUM(A1:r))", wb, s1), ErrorCode::Value, "LET(r,5,SUM(A1:r))");
+}
+
+TEST(ReferenceCall, RangeEndpointsOnDifferentSheets) {
+  Workbook wb = NamedEndpointBook();
+  const Sheet& s1 = wb.sheet(0);
+  const Sheet& s2 = wb.sheet(1);
+  ExpectError(EvalSourceIn("=SUM(A1:OtherNm)", wb, s1), ErrorCode::Value, "Sheet1: SUM(A1:OtherNm)");
+  ExpectError(EvalSourceIn("=SUM(Sheet1!A1:OtherNm)", wb, s1), ErrorCode::Value, "SUM(Sheet1!A1:OtherNm)");
+  ExpectError(EvalSourceIn("=SUM(A1:INDEX(Sheet2!A1:D4,3,3))", wb, s1), ErrorCode::Value,
+              "Sheet1: SUM(A1:INDEX(Sheet2!A1:D4,3,3))");
+  ExpectError(EvalSourceIn("=SUM(Sheet1!A1:INDEX(Sheet2!A1:D4,3,3))", wb, s1), ErrorCode::Value,
+              "SUM(Sheet1!A1:INDEX(Sheet2!A1:D4,3,3))");
+  ExpectNumber(EvalSourceIn("=SUM(A1:OtherNm)", wb, s2), 1098.0, "Sheet2: SUM(A1:OtherNm)");
+  ExpectNumber(EvalSourceIn("=SUM(A1:INDEX(Sheet2!A1:D4,3,3))", wb, s2), 1098.0,
+               "Sheet2: SUM(A1:INDEX(Sheet2!A1:D4,3,3))");
+  ExpectError(EvalSourceIn("=SUM(A1:CellNm)", wb, s2), ErrorCode::Value, "Sheet2: SUM(A1:CellNm)");
+  ExpectError(EvalSourceIn("=SUM(A1:INDEX(Sheet1!A1:D4,3,3))", wb, s2), ErrorCode::Value,
+              "Sheet2: SUM(A1:INDEX(Sheet1!A1:D4,3,3))");
+}
+
+TEST(RangeEndpoint, RefToOffsetSingleCol) {
+  // SUM(A1:OFFSET(A1,4,0)) — lhs literal Ref, rhs OFFSET single-cell.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 5; ++r) {
+    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
+  }
+  const Value v = EvalSourceIn("=SUM(A1:OFFSET(A1,4,0))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 15.0);
+}
+
+TEST(RangeEndpoint, OffsetToOffsetSingleCol) {
+  // SUM(OFFSET(A1,0,0):OFFSET(A1,4,0)) — both endpoints are OFFSET calls.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 5; ++r) {
+    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
+  }
+  const Value v = EvalSourceIn("=SUM(OFFSET(A1,0,0):OFFSET(A1,4,0))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 15.0);
+}
+
+TEST(RangeEndpoint, IndirectToIndirect) {
+  // SUM(INDIRECT("B2"):INDIRECT("B6")) — both endpoints INDIRECT.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(1, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(2, 1, Value::number(4.0));
+  wb.sheet(0).set_cell_value(3, 1, Value::number(6.0));
+  wb.sheet(0).set_cell_value(4, 1, Value::number(8.0));
+  wb.sheet(0).set_cell_value(5, 1, Value::number(10.0));
+  const Value v = EvalSourceIn("=SUM(INDIRECT(\"B2\"):INDIRECT(\"B6\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
+}
+
+TEST(RangeEndpoint, OffsetAboveRefNormalises) {
+  // SUM(OFFSET(A5,-4,0):A5) — lhs OFFSET resolves to A1, rhs A5;
+  // endpoint ordering is normalised so the union is A1:A5.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 5; ++r) {
+    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
+  }
+  const Value v = EvalSourceIn("=SUM(OFFSET(A5,-4,0):A5)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 15.0);
+}
+
+TEST(RangeEndpoint, RefToMultiCellOffset) {
+  // SUM(A1:OFFSET(A1,2,1,2,1)) — rhs OFFSET resolves to a 2x1
+  // rectangle B3:B4. The rectangle's bottom-right corner participates
+  // in the union so the unioned range is A1:B4 =
+  //   1 + 2 + 3 + 4 + 10 + 20 + 30 + 40 = 110.
+  // Verified against Mac Excel 365 in
+  // tests/oracle/golden/range_endpoint_calls.golden.json.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 5; ++r) {
+    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
+    wb.sheet(0).set_cell_value(r, 1, Value::number(static_cast<double>((r + 1) * 10)));
+  }
+  const Value v = EvalSourceIn("=SUM(A1:OFFSET(A1,2,1,2,1))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 110.0);
+}
+
+TEST(RangeEndpoint, RefToOffsetTwoCol) {
+  // SUM(A1:OFFSET(A1,4,1)) — rhs OFFSET steps to column B; spans A1:B5.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 5; ++r) {
+    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
+    wb.sheet(0).set_cell_value(r, 1, Value::number(static_cast<double>((r + 1) * 10)));
+  }
+  const Value v = EvalSourceIn("=SUM(A1:OFFSET(A1,4,1))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 165.0);
+}
+
+TEST(RangeEndpoint, RefToIndirect) {
+  // SUM(A1:INDIRECT("A3")) — lhs Ref, rhs INDIRECT.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(100.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(200.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(300.0));
+  const Value v = EvalSourceIn("=SUM(A1:INDIRECT(\"A3\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 600.0);
+}
+
+TEST(ReferenceCall, IndexAsRangeEndpoint) {
+  Workbook wb = ColumnOfTen();
+  ExpectNumber(EvalSourceIn("=SUM(A1:INDEX(A1:A10,3))", wb, wb.sheet(0)), 6.0, "SUM(A1:INDEX(A1:A10,3))");
+  ExpectNumber(EvalSourceIn("=SUM(A1:INDEX(A:A,COUNTA(A:A)))", wb, wb.sheet(0)), 55.0, "dynamic A1:INDEX(A:A,n)");
+  ExpectNumber(EvalSourceIn("=ROWS(INDEX(A:A,2):INDEX(A:A,5))", wb, wb.sheet(0)), 4.0, "ROWS(INDEX:INDEX)");
+  ExpectNumber(EvalSourceIn("=SUM(INDEX(A1:A10,4):INDEX(A1:A10,6))", wb, wb.sheet(0)), 15.0, "SUM(INDEX:INDEX)");
+  const Value out_of_range = EvalSourceIn("=SUM(A1:INDEX(A1:A10,11))", wb, wb.sheet(0));
+  ASSERT_TRUE(out_of_range.is_error());
+  EXPECT_EQ(out_of_range.as_error(), ErrorCode::Ref);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_references_indirect_test.cpp b/tests/unit/eval/builtins_references_indirect_test.cpp
new file mode 100644
index 000000000..d7b7bae78
--- /dev/null
+++ b/tests/unit/eval/builtins_references_indirect_test.cpp
@@ -0,0 +1,364 @@
+// Reference builtin tests grouped by reference constructor.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#include "builtins_references_test_helpers.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using namespace references_test_helpers;
+
+Value EvalAnchoredAt(std::string_view src, const Workbook& wb, std::uint32_t row, std::uint32_t col) {
+  static thread_local Arena parse_arena;
+  static thread_local Arena eval_arena;
+  parse_arena.reset();
+  eval_arena.reset();
+  parser::Parser parser_instance(src, parse_arena);
+  parser::AstNode* root = parser_instance.parse();
+  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  EvalState state;
+  const EvalContext ctx = test::workbook_context(wb, wb.sheet(0), state).with_formula_cell(row, col);
+  return evaluate(*root, eval_arena, default_registry(), ctx);
+}
+
+TEST(BuiltinsIndirect, SingleCellLocal) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(42.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"A1\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 42.0);
+}
+
+TEST(BuiltinsIndirect, SingleCellAbsolute) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(2, 1, Value::number(7.5));  // B3 = 7.5
+  const Value v = EvalSourceIn("=INDIRECT(\"$B$3\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 7.5);
+}
+
+TEST(BuiltinsIndirect, QualifiedSheetBare) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Data");
+  wb.sheet(1).set_cell_value(4, 2, Value::text("hit"));  // Data!C5
+  const Value v = EvalSourceIn("=INDIRECT(\"Data!C5\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(std::string(v.as_text()), "hit");
+}
+
+TEST(BuiltinsIndirect, QualifiedSheetQuotedWithSpace) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("My Data");
+  wb.sheet(1).set_cell_value(0, 0, Value::number(99.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"'My Data'!A1\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 99.0);
+}
+
+TEST(BuiltinsIndirect, EmptyTextIsRefError) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=INDIRECT(\"\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndirect, GarbageTextIsRefError) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=INDIRECT(\"not-a-ref\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndirect, UnknownSheetIsRefError) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=INDIRECT(\"NoSuch!A1\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndirect, RangeTextSpillsArray) {
+  // Multi-cell range text resolves to the full rectangle as a Value::Array
+  // so the result spills (and is consumable by range-aware callers).
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"A1:A2\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array());
+  EXPECT_EQ(v.as_array_rows(), 2U);
+  EXPECT_EQ(v.as_array_cols(), 1U);
+  const Value* cells = v.as_array_cells();
+  EXPECT_DOUBLE_EQ(cells[0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(cells[1].as_number(), 2.0);
+}
+
+TEST(BuiltinsIndirect, RangeTextAdmitsRectanglesPastTheConjuredArrayCeiling) {
+  // Same rule as the spilled OFFSET rectangle: the array is a copy of an
+  // already-admitted read, so the narrower ceiling for argument-synthesised
+  // arrays (2^20 cells) must not apply to it.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(549999U, 1U, Value::number(2.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"A1:B550000\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array()) << "a rectangle the read admits must not fail to materialise";
+  EXPECT_EQ(v.as_array_rows(), 550000U);
+  EXPECT_EQ(v.as_array_cols(), 2U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[1099999U].as_number(), 2.0);
+}
+
+TEST(BuiltinsIndirect, RangeTextInSumAggregates) {
+  // SUM(INDIRECT("A1:A3")) aggregates the multi-cell range.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
+  const Value v = EvalSourceIn("=SUM(INDIRECT(\"A1:A3\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 60.0);
+}
+
+TEST(BuiltinsIndirect, MultiColTableInVlookup) {
+  // VLOOKUP with an INDIRECT multi-column table argument resolves the
+  // table rectangle and returns the column-2 cell of the matched row.
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Data");
+  wb.sheet(1).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(1).set_cell_value(0, 1, Value::text("one"));
+  wb.sheet(1).set_cell_value(1, 0, Value::number(2.0));
+  wb.sheet(1).set_cell_value(1, 1, Value::text("two"));
+  wb.sheet(1).set_cell_value(2, 0, Value::number(3.0));
+  wb.sheet(1).set_cell_value(2, 1, Value::text("three"));
+  const Value v = EvalSourceIn("=VLOOKUP(2, INDIRECT(\"Data!A1:B3\"), 2, 0)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "two");
+}
+
+TEST(BuiltinsIndirect, RangeTextCollapsingToSingleCellIsScalar) {
+  // Range syntax whose rectangle collapses to one cell (A1:A1) returns
+  // the scalar cell, not a 1x1 array.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(42.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"A1:A1\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 42.0);
+}
+
+TEST(BuiltinsIndirect, R1C1AbsoluteResolvesTheCell) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"R1C1\",FALSE)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
+TEST(BuiltinsIndirect, R1C1RelativeResolvesAgainstTheFormulaCell) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(2, 2, Value::number(7.0));
+  const Value v = EvalAnchoredAt("=INDIRECT(\"R[1]C[1]\",FALSE)", wb, 1, 1);
+  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(v.as_number(), 7.0);
+}
+
+TEST(BuiltinsIndirect, R1C1BareAxesAreTheFormulaCellItself) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(1, 1, Value::number(5.0));
+  const Value v = EvalAnchoredAt("=SUM(INDIRECT(\"RC\",FALSE))", wb, 1, 1);
+  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(v.as_number(), 5.0);
+}
+
+TEST(BuiltinsIndirect, R1C1RelativeWithoutAFormulaCellIsRef) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"RC\",FALSE)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndirect, R1C1AbsoluteWithoutAFormulaCellStillResolves) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(1, 2, Value::number(42.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"R2C3\",FALSE)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(v.as_number(), 42.0);
+}
+
+TEST(BuiltinsIndirect, R1C1RangeSumsTheRectangle) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(3.0));
+  wb.sheet(0).set_cell_value(1, 1, Value::number(4.0));
+  const Value v = EvalSourceIn("=SUM(INDIRECT(\"R1C1:R2C2\",FALSE))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(v.as_number(), 10.0);
+}
+
+TEST(BuiltinsIndirect, R1C1SingleAxisIsAWholeRow) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(1, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(1, 5, Value::number(20.0));
+  wb.sheet(0).set_cell_value(0, 0, Value::number(99.0));
+  const Value v = EvalSourceIn("=SUM(INDIRECT(\"R2\",FALSE))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
+  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
+}
+
+TEST(BuiltinsIndirect, A1TextUnderR1C1FlagIsRef) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"A1\",FALSE)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndirect, R1C1OffsetOutsideTheGridIsRef) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalAnchoredAt("=INDIRECT(\"R[-1]C\",FALSE)", wb, 0, 0);
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndirect, R1C1MismatchedRangeEndpointsAreRef) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"R2:R3C4\",FALSE)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsIndirect, BuildFromConcat) {
+  // INDIRECT("A" & "1") evaluates the concat first, then resolves.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(111.0));
+  const Value v = EvalSourceIn("=INDIRECT(\"A\" & \"1\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 111.0);
+}
+
+TEST(BuiltinsIndirect, ArityMustBeOneOrTwo) {
+  const Value v0 = EvalSource("=INDIRECT()");
+  ASSERT_TRUE(v0.is_error());
+  const Value v3 = EvalSource("=INDIRECT(\"A1\",TRUE,3)");
+  ASSERT_TRUE(v3.is_error());
+}
+
+TEST(BuiltinsIndirect, ErrorTextPropagates) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=INDIRECT(1/0)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
+}
+
+TEST(BuiltinsIndirect, FullColumnTextExpandsInSum) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 3, Value::number(4.0));  // D1
+  wb.sheet(0).set_cell_value(1, 3, Value::number(5.0));  // D2
+  const Value v = EvalSourceIn("=SUM(INDIRECT(\"D:D\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 9.0);
+}
+
+TEST(BuiltinsIndirect, FullColumnTextEmptyResolvesToZero) {
+  // An empty column has no cells to spill; the expansion collapses to a
+  // blank scalar, which the top-level resolves to 0 exactly like a bare
+  // reference to an empty cell (`=Z1`).
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=INDIRECT(\"D:D\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
+}
+
+TEST(BuiltinsIndirect, FullRowTextExpandsInSum) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(4, 0, Value::number(1.0));  // A5
+  wb.sheet(0).set_cell_value(4, 2, Value::number(2.0));  // C5
+  const Value v = EvalSourceIn("=SUM(INDIRECT(\"5:5\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, RowOfFullColumn) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=ROW(INDIRECT(\"D:D\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, ColumnOfFullColumn) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"D:D\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 4.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, RowOfFullRow) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=ROW(INDIRECT(\"5:5\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 5.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, ColumnOfFullRow) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"5:5\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, AbsoluteMixedFullColumn) {
+  // `$FF:FG` -> leftmost column is FF = 162.
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"$FF:FG\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 162.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, ReversedFullColumnNormalisedByMin) {
+  // `C:A` should report column 1 (A) as leftmost.
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"C:A\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, AbsoluteFullRow) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=ROW(INDIRECT(\"$12:$23\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 12.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, LastColumnXfd) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"XFD:XFD\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 16384.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, LowercaseColumn) {
+  // `s:s` -> column 19 (S).
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"s:s\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 19.0);
+}
+
+TEST(BuiltinsIndirectFullColRow, LeadingZeroRow) {
+  // `05:05` -> row 5 (leading zeros tolerated in the row part).
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=ROW(INDIRECT(\"05:05\"))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 5.0);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_references_offset_test.cpp b/tests/unit/eval/builtins_references_offset_test.cpp
new file mode 100644
index 000000000..4f91fa3df
--- /dev/null
+++ b/tests/unit/eval/builtins_references_offset_test.cpp
@@ -0,0 +1,364 @@
+// Reference builtin tests grouped by reference constructor.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#include "builtins_references_test_helpers.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+using namespace references_test_helpers;
+
+TEST(BuiltinsOffset, NegativeOffsetIntoGrid) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(2, 2, Value::text("from"));  // C3
+  const Value v = EvalSourceIn("=OFFSET(C3,-2,-2)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 10.0);
+}
+
+TEST(BuiltinsOffset, OffsetOutOfGridIsRef) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=OFFSET(A1,-1,0)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsOffset, NegativeHeightEndsAtAnchor) {
+  // Excel allows negative height: the rectangle extends upward and the
+  // base cell is the bottom edge. `OFFSET(A1, 0, 0, -1, 1)` yields a
+  // 1x1 rectangle at A1 (base is both top and bottom when |h|=1).
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=OFFSET(A1,0,0,-1,1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
+TEST(BuiltinsOffset, NegativeHeightWalksUpTwoRows) {
+  // `OFFSET(C3, 0, 0, -2, 1)` anchors at C3 and walks up one row, so the
+  // rectangle spans C2:C3 and spills both cells.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(1, 2, Value::number(42.0));  // C2
+  wb.sheet(0).set_cell_value(2, 2, Value::number(99.0));  // C3
+  const Value v = EvalSourceIn("=OFFSET(C3,0,0,-2,1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array());
+  ASSERT_EQ(v.as_array_rows(), 2U);
+  EXPECT_DOUBLE_EQ(v.as_array()->cells[0].as_number(), 42.0);
+  EXPECT_DOUBLE_EQ(v.as_array()->cells[1].as_number(), 99.0);
+}
+
+TEST(BuiltinsOffset, NegativeHeightOffGridIsRef) {
+  // Negative height that would walk off the top is still #REF!.
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=OFFSET(A1,0,0,-2,1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsOffset, ZeroHeightIsRef) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  const Value v = EvalSourceIn("=OFFSET(A1,0,0,0,1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsOffset, MultiCellSpillsRectangle) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(3.0));
+  wb.sheet(0).set_cell_value(1, 1, Value::number(4.0));
+  const Value v = EvalSourceIn("=OFFSET(A1,0,0,3,3)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array());
+  ASSERT_EQ(v.as_array_rows(), 3U);
+  ASSERT_EQ(v.as_array_cols(), 3U);
+  EXPECT_DOUBLE_EQ(v.as_array()->cells[0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(v.as_array()->cells[4].as_number(), 4.0);
+}
+
+TEST(BuiltinsOffset, MultiCellSpillAdmitsRectanglesPastTheConjuredArrayCeiling) {
+  // The spilled array is a copy of the rectangle the range reader already
+  // admitted, so it is bounded like a read, not like an array a formula
+  // conjures from its arguments. 2 x 550,000 sits past that narrower
+  // ceiling (2^20 cells) and well inside the range-expansion bound.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(549999U, 1U, Value::number(2.0));
+  const Value v = EvalSourceIn("=OFFSET(A1,0,0,550000,2)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array()) << "a rectangle the read admits must not fail to materialise";
+  EXPECT_EQ(v.as_array_rows(), 550000U);
+  EXPECT_EQ(v.as_array_cols(), 2U);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(v.as_array_cells()[1099999U].as_number(), 2.0);
+}
+
+TEST(BuiltinsOffset, MultiCellSpillMaterialisesBlankCellsAsZero) {
+  Workbook wb = Workbook::create();
+  const Value v = EvalSourceIn("=OFFSET(A1,2,2,2,-2)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_array());
+  ASSERT_EQ(v.as_array_rows(), 2U);
+  ASSERT_EQ(v.as_array_cols(), 2U);
+  for (std::uint32_t i = 0; i < 4U; ++i) {
+    ASSERT_TRUE(v.as_array()->cells[i].is_number());
+    EXPECT_DOUBLE_EQ(v.as_array()->cells[i].as_number(), 0.0);
+  }
+}
+
+TEST(BuiltinsOffset, RangeConsumersRetainBlankProvenance) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
+
+  // Direct OFFSET projects the two interior source blanks to numeric zero,
+  // but its range-aware consumers still receive genuine Blank cells.
+  const Value count = EvalSourceIn("=COUNT(OFFSET(A1,0,0,2,2))", wb, wb.sheet(0));
+  ASSERT_TRUE(count.is_number());
+  EXPECT_DOUBLE_EQ(count.as_number(), 2.0);
+  const Value counta = EvalSourceIn("=COUNTA(OFFSET(A1,0,0,2,2))", wb, wb.sheet(0));
+  ASSERT_TRUE(counta.is_number());
+  EXPECT_DOUBLE_EQ(counta.as_number(), 2.0);
+
+  // An all-blank range has no logical values; it must not become FALSE just
+  // because the direct spill surface renders its cells as zero.
+  const Value all_blank_and = EvalSourceIn("=AND(OFFSET(D1,0,0,2,2))", wb, wb.sheet(0));
+  ASSERT_TRUE(all_blank_and.is_error());
+  EXPECT_EQ(all_blank_and.as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsReferences, RawRangeIngressProjectsBlankAcrossReferenceForms) {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  sheet.set_cell_value(0, 0, Value::number(2.0));
+  // A2 is intentionally untouched, and A3 closes the interior-blank range.
+  sheet.set_cell_value(2, 0, Value::number(1.0));
+
+  const std::string expressions[] = {
+      "A1:A3",          "OFFSET(A1,0,0,3,1)",    "INDIRECT(\"A1:A3\")",
+      "INDEX(A1:A3,0)", "CHOOSE(1,A1:A3,B1:B3)", "IF(TRUE,A1:A3,B1:B3)",
+  };
+  for (const std::string& expression : expressions) {
+    const std::string direct_formula = "=" + expression;
+    const Value direct = EvalSourceIn(direct_formula, wb, sheet);
+    ASSERT_TRUE(direct.is_array()) << expression << ": " << direct.debug_to_string();
+    ASSERT_EQ(direct.as_array_rows(), 3U) << expression;
+    ASSERT_EQ(direct.as_array_cols(), 1U) << expression;
+    ASSERT_TRUE(direct.as_array_cells()[0].is_number()) << expression;
+    EXPECT_DOUBLE_EQ(direct.as_array_cells()[0].as_number(), 2.0) << expression;
+    ASSERT_TRUE(direct.as_array_cells()[1].is_number()) << expression;
+    EXPECT_DOUBLE_EQ(direct.as_array_cells()[1].as_number(), 0.0) << expression;
+    ASSERT_TRUE(direct.as_array_cells()[2].is_number()) << expression;
+    EXPECT_DOUBLE_EQ(direct.as_array_cells()[2].as_number(), 1.0) << expression;
+
+    const Value count = EvalSourceIn("=COUNT(" + expression + ")", wb, sheet);
+    ASSERT_TRUE(count.is_number()) << expression << ": " << count.debug_to_string();
+    EXPECT_DOUBLE_EQ(count.as_number(), 2.0) << expression;
+    const Value counta = EvalSourceIn("=COUNTA(" + expression + ")", wb, sheet);
+    ASSERT_TRUE(counta.is_number()) << expression << ": " << counta.debug_to_string();
+    EXPECT_DOUBLE_EQ(counta.as_number(), 2.0) << expression;
+    const Value and_value = EvalSourceIn("=AND(" + expression + ")", wb, sheet);
+    ASSERT_TRUE(and_value.is_boolean()) << expression << ": " << and_value.debug_to_string();
+    EXPECT_TRUE(and_value.as_boolean()) << expression;
+  }
+}
+
+TEST(BuiltinsOffset, BaseRangeSpillsRectangle) {
+  // `OFFSET(A1:B2, 0, 0)` defaults height/width from the base -> a 2x2
+  // rectangle starting at A1. Passing explicit `(1,1)` dimensions
+  // confirms the scalar path.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(100.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(200.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(300.0));
+  wb.sheet(0).set_cell_value(1, 1, Value::number(400.0));
+  const Value v_multi = EvalSourceIn("=OFFSET(A1:B2,0,0)", wb, wb.sheet(0));
+  ASSERT_TRUE(v_multi.is_array());
+  ASSERT_EQ(v_multi.as_array_rows(), 2U);
+  ASSERT_EQ(v_multi.as_array_cols(), 2U);
+  EXPECT_DOUBLE_EQ(v_multi.as_array()->cells[0].as_number(), 100.0);
+  EXPECT_DOUBLE_EQ(v_multi.as_array()->cells[3].as_number(), 400.0);
+  const Value v_scalar = EvalSourceIn("=OFFSET(A1:B2,0,0,1,1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v_scalar.is_number());
+  EXPECT_DOUBLE_EQ(v_scalar.as_number(), 100.0);
+}
+
+TEST(BuiltinsOffset, ArityBelowMinIsError) {
+  EXPECT_TRUE(EvalSource("=OFFSET(A1)").is_error());
+  EXPECT_TRUE(EvalSource("=OFFSET(A1,0)").is_error());
+}
+
+TEST(BuiltinsOffset, ArityAboveMaxIsError) {
+  EXPECT_TRUE(EvalSource("=OFFSET(A1,0,0,1,1,1)").is_error());
+}
+
+TEST(BuiltinsOffset, NonRefBaseIsValueError) {
+  // OFFSET(42, 0, 0) — base is a literal scalar, not a reference.
+  const Value v = EvalSource("=OFFSET(42,0,0)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+}
+
+TEST(BuiltinsOffset, WholeColumnBaseResolvesInsteadOfValueError) {
+  // OFFSET(A:A, 1, 0, 1, 1) anchors one row below A1: A2.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(1, 0, Value::number(7.0));
+  const Value v = EvalSourceIn("=OFFSET(A:A,1,0,1,1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 7.0);
+}
+
+TEST(BuiltinsOffset, WholeColumnBaseDefaultHeightIsFullAxis) {
+  // Without an explicit height/width, OFFSET reuses the base's own shape
+  // -- a whole column's declared shape spans the full row axis, so
+  // ROWS(OFFSET(A:A,0,1)) (column-only shift, to B:B) reports the grid
+  // height rather than #VALUE!. A *row* offset on a whole column is
+  // rejected with #REF! regardless of this fix: the column already spans
+  // every row, so shifting it down by even one pushes the bottom edge
+  // past the grid, matching Excel.
+  const Value v = EvalSource("=ROWS(OFFSET(A:A,0,1))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), static_cast<double>(Sheet::kMaxRows));
+
+  const Value shifted_down = EvalSource("=OFFSET(A:A,1,0)");
+  ASSERT_TRUE(shifted_down.is_error());
+  EXPECT_EQ(shifted_down.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsOffset, EmptyHeightOrWidthKeepsTheBaseSize) {
+  // An empty height or width is the base's, not zero (Excel 365:
+  // `@OFFSET(A1,0,0,,2)` is the 1x2 A1:B1, so #VALUE! off its row).
+  const Value rows = EvalSource("=ROWS(OFFSET(A1:A3,0,0,,2))");
+  ASSERT_TRUE(rows.is_number());
+  EXPECT_DOUBLE_EQ(rows.as_number(), 3.0);
+  const Value cols = EvalSource("=COLUMNS(OFFSET(A1:A3,0,0,2,))");
+  ASSERT_TRUE(cols.is_number());
+  EXPECT_DOUBLE_EQ(cols.as_number(), 1.0);
+}
+
+TEST(BuiltinsOffset, WholeRowBaseResolvesInsteadOfValueError) {
+  // OFFSET(1:1, 0, 1, 1, 1) anchors one column right of row 1: B1.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 1, Value::number(9.0));
+  const Value v = EvalSourceIn("=OFFSET(1:1,0,1,1,1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 9.0);
+}
+
+TEST(BuiltinsOffset, MultiColumnWholeRangeBaseUnionsTheColumnSpan) {
+  // OFFSET(A:C, 0, 0, 1, 1) keeps the full row axis and the A..C column
+  // span, anchored at A1.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 2, Value::number(3.0));
+  const Value v = EvalSourceIn("=OFFSET(A:C,0,2,1,1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
+}
+
+TEST(BuiltinsOffset, LetBoundRangeBaseIsLookedThrough) {
+  // LET(r, A1:A3, ROWS(OFFSET(r, 1, 0))) -- the LET binding's underlying
+  // RangeOp shape (3 rows) must reach resolve_offset_base rather than
+  // collapsing to its scalar spill anchor.
+  const Value v = EvalSource("=LET(r,A1:A3,ROWS(OFFSET(r,1,0)))");
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
+}
+
+TEST(BuiltinsOffset, LetBoundNameBaseWithExplicitHeightIsLookedThrough) {
+  // The dynamic-named-range idiom (OFFSET(name,0,0,COUNTA(...))), scoped
+  // to what `resolve_offset_base` actually looks through: a LET/LAMBDA
+  // binding via `ctx.name_env()`, the same mechanism ROW / COLUMN / AREAS
+  // / the conditional aggregators use. A workbook Name Manager entry is a
+  // separate resolution path (`resolve_defined_name`) this finding's
+  // invariant does not cover.
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
+  const Value v = EvalSourceIn("=LET(data,A1:A2,SUM(OFFSET(data,0,0,2,1)))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
+}
+
+TEST(BuiltinsOffset, SumOfOffsetRectangle) {
+  // Set up a 3x3 block with known sum.
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 3; ++r) {
+    for (std::uint32_t c = 0; c < 3; ++c) {
+      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
+    }
+  }
+  // A1:C3 = {1,2,3; 4,5,6; 7,8,9} -> sum = 45.
+  const Value v = EvalSourceIn("=SUM(OFFSET(A1,0,0,3,3))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 45.0);
+}
+
+TEST(BuiltinsOffset, AverageOfOffsetRectangle) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(20.0));
+  wb.sheet(0).set_cell_value(0, 2, Value::number(30.0));
+  // AVERAGE(B1:C1) == 25, reached via OFFSET(A1, 0, 1, 1, 2).
+  const Value v = EvalSourceIn("=AVERAGE(OFFSET(A1,0,1,1,2))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 25.0);
+}
+
+TEST(BuiltinsOffset, CountifOfOffsetRectangle) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(5.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(5.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(7.0));
+  wb.sheet(0).set_cell_value(3, 0, Value::number(5.0));
+  const Value v = EvalSourceIn("=COUNTIF(OFFSET(A1,0,0,4,1),5)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
+}
+
+TEST(BuiltinsOffset, OffsetAppliedAfterShift) {
+  // The whole point of OFFSET + SUM: compute a moving sum. Shift the 3x1
+  // window one column to the right (starts at B1).
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(0, 1, Value::number(10.0));
+  wb.sheet(0).set_cell_value(0, 2, Value::number(100.0));
+  wb.sheet(0).set_cell_value(0, 3, Value::number(1000.0));
+  const Value v = EvalSourceIn("=SUM(OFFSET(A1,0,1,1,3))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1110.0);
+}
+
+TEST(BuiltinsOffset, SumOfOffsetOutOfGridPropagatesRef) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  // Trying to spill above row 1 — OFFSET produces #REF!, which SUM
+  // propagates as its leftmost error.
+  const Value v = EvalSourceIn("=SUM(OFFSET(A1,-1,0,2,1))", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(BuiltinsOffset, ScalarRowsCols) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+  wb.sheet(0).set_cell_value(1, 2, Value::number(99.0));  // C2
+  const Value v = EvalSourceIn("=OFFSET(A1,1,2)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 99.0);
+}
+
+TEST(BuiltinsOffset, ZeroOffsetReturnsBase) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(4, 4, Value::number(42.0));  // E5
+  const Value v = EvalSourceIn("=OFFSET(E5,0,0)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 42.0);
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_references_test.cpp b/tests/unit/eval/builtins_references_test.cpp
index 64404b511..1a302628a 100644
--- a/tests/unit/eval/builtins_references_test.cpp
+++ b/tests/unit/eval/builtins_references_test.cpp
@@ -1,70 +1,16 @@
-//
-// End-to-end tests for the reference-manipulation builtins `ADDRESS`,
-// `INDIRECT`, and `OFFSET`. ADDRESS is eager; INDIRECT and OFFSET are
-// lazy (see `eval/reference_lazy.*`). OFFSET's multi-cell range path is
-// integrated with the range-aware aggregators through
-// `resolve_range_arg`, so tests covering `=SUM(OFFSET(...))` and
-// `=AVERAGE(OFFSET(...))` live here alongside the scalar OFFSET cases.
+// Reference builtin tests grouped by reference constructor.
 
 #include <cstdint>
 #include <string>
 #include <string_view>
 #include <utility>
 
-#include "eval/eval_context.h"
-#include "eval/eval_state.h"
-#include "eval/function_registry.h"
-#include "eval/tree_walker.h"
-#include "gtest/gtest.h"
-#include "parser/ast.h"
-#include "parser/parser.h"
-#include "sheet.h"
-#include "test_eval_helpers.h"
-#include "utils/arena.h"
-#include "utils/error.h"
-#include "value.h"
-#include "workbook.h"
+#include "builtins_references_test_helpers.h"
 
 namespace formulon {
 namespace eval {
 namespace {
-
-// Parses `src` and evaluates it through the default function registry with
-// no bound workbook.
-Value EvalSource(std::string_view src) {
-  static thread_local Arena parse_arena;
-  static thread_local Arena eval_arena;
-  parse_arena.reset();
-  eval_arena.reset();
-  parser::Parser p(src, parse_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
-  }
-  return evaluate(*root, eval_arena);
-}
-
-// Parses `src` and evaluates it against a bound workbook + current sheet.
-Value EvalSourceIn(std::string_view src, const Workbook& wb, const Sheet& current) {
-  static thread_local Arena parse_arena;
-  static thread_local Arena eval_arena;
-  parse_arena.reset();
-  eval_arena.reset();
-  parser::Parser p(src, parse_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
-  }
-  EvalState state;
-  const EvalContext ctx = test::workbook_context(wb, current, state);
-  return evaluate(*root, eval_arena, default_registry(), ctx);
-}
-
-// ---------------------------------------------------------------------------
-// ADDRESS
-// ---------------------------------------------------------------------------
+using namespace references_test_helpers;
 
 TEST(BuiltinsAddress, DefaultAbsoluteA1) {
   const Value v = EvalSource("=ADDRESS(1,1)");
@@ -216,1054 +162,6 @@ TEST(BuiltinsAddress, NumericCoercionOnRowCol) {
   EXPECT_EQ(std::string(v.as_text()), "$B$3");
 }
 
-// ---------------------------------------------------------------------------
-// INDIRECT
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsIndirect, SingleCellLocal) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(42.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"A1\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 42.0);
-}
-
-TEST(BuiltinsIndirect, SingleCellAbsolute) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(2, 1, Value::number(7.5));  // B3 = 7.5
-  const Value v = EvalSourceIn("=INDIRECT(\"$B$3\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 7.5);
-}
-
-TEST(BuiltinsIndirect, QualifiedSheetBare) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Data");
-  wb.sheet(1).set_cell_value(4, 2, Value::text("hit"));  // Data!C5
-  const Value v = EvalSourceIn("=INDIRECT(\"Data!C5\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_text());
-  EXPECT_EQ(std::string(v.as_text()), "hit");
-}
-
-TEST(BuiltinsIndirect, QualifiedSheetQuotedWithSpace) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("My Data");
-  wb.sheet(1).set_cell_value(0, 0, Value::number(99.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"'My Data'!A1\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 99.0);
-}
-
-TEST(BuiltinsIndirect, EmptyTextIsRefError) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=INDIRECT(\"\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndirect, GarbageTextIsRefError) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=INDIRECT(\"not-a-ref\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndirect, UnknownSheetIsRefError) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=INDIRECT(\"NoSuch!A1\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndirect, RangeTextSpillsArray) {
-  // Multi-cell range text resolves to the full rectangle as a Value::Array
-  // so the result spills (and is consumable by range-aware callers).
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(2.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"A1:A2\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array());
-  EXPECT_EQ(v.as_array_rows(), 2U);
-  EXPECT_EQ(v.as_array_cols(), 1U);
-  const Value* cells = v.as_array_cells();
-  EXPECT_DOUBLE_EQ(cells[0].as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(cells[1].as_number(), 2.0);
-}
-
-TEST(BuiltinsIndirect, RangeTextAdmitsRectanglesPastTheConjuredArrayCeiling) {
-  // Same rule as the spilled OFFSET rectangle: the array is a copy of an
-  // already-admitted read, so the narrower ceiling for argument-synthesised
-  // arrays (2^20 cells) must not apply to it.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(549999U, 1U, Value::number(2.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"A1:B550000\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array()) << "a rectangle the read admits must not fail to materialise";
-  EXPECT_EQ(v.as_array_rows(), 550000U);
-  EXPECT_EQ(v.as_array_cols(), 2U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[1099999U].as_number(), 2.0);
-}
-
-TEST(BuiltinsIndirect, RangeTextInSumAggregates) {
-  // SUM(INDIRECT("A1:A3")) aggregates the multi-cell range.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(30.0));
-  const Value v = EvalSourceIn("=SUM(INDIRECT(\"A1:A3\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 60.0);
-}
-
-TEST(BuiltinsIndirect, MultiColTableInVlookup) {
-  // VLOOKUP with an INDIRECT multi-column table argument resolves the
-  // table rectangle and returns the column-2 cell of the matched row.
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Data");
-  wb.sheet(1).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(1).set_cell_value(0, 1, Value::text("one"));
-  wb.sheet(1).set_cell_value(1, 0, Value::number(2.0));
-  wb.sheet(1).set_cell_value(1, 1, Value::text("two"));
-  wb.sheet(1).set_cell_value(2, 0, Value::number(3.0));
-  wb.sheet(1).set_cell_value(2, 1, Value::text("three"));
-  const Value v = EvalSourceIn("=VLOOKUP(2, INDIRECT(\"Data!A1:B3\"), 2, 0)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_text());
-  EXPECT_EQ(v.as_text(), "two");
-}
-
-TEST(BuiltinsIndirect, RangeTextCollapsingToSingleCellIsScalar) {
-  // Range syntax whose rectangle collapses to one cell (A1:A1) returns
-  // the scalar cell, not a 1x1 array.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(42.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"A1:A1\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 42.0);
-}
-
-TEST(BuiltinsIndirect, R1C1AbsoluteResolvesTheCell) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"R1C1\",FALSE)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
-}
-
-// Evaluates `src` as though the formula sat at (row, col), which is what a
-// relative R1C1 axis measures from.
-Value EvalAnchoredAt(std::string_view src, const Workbook& wb, std::uint32_t row, std::uint32_t col) {
-  static thread_local Arena parse_arena;
-  static thread_local Arena eval_arena;
-  parse_arena.reset();
-  eval_arena.reset();
-  parser::Parser parser_instance(src, parse_arena);
-  parser::AstNode* root = parser_instance.parse();
-  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
-  if (root == nullptr) {
-    return Value::error(ErrorCode::Name);
-  }
-  EvalState state;
-  const EvalContext ctx = test::workbook_context(wb, wb.sheet(0), state).with_formula_cell(row, col);
-  return evaluate(*root, eval_arena, default_registry(), ctx);
-}
-
-// Relative axes measure from the cell holding the formula. Anchored at B2,
-// `R[1]C[1]` is C3.
-TEST(BuiltinsIndirect, R1C1RelativeResolvesAgainstTheFormulaCell) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(2, 2, Value::number(7.0));
-  const Value v = EvalAnchoredAt("=INDIRECT(\"R[1]C[1]\",FALSE)", wb, 1, 1);
-  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(v.as_number(), 7.0);
-}
-
-// A bare axis letter is a zero offset, not a missing one.
-TEST(BuiltinsIndirect, R1C1BareAxesAreTheFormulaCellItself) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(1, 1, Value::number(5.0));
-  const Value v = EvalAnchoredAt("=SUM(INDIRECT(\"RC\",FALSE))", wb, 1, 1);
-  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(v.as_number(), 5.0);
-}
-
-// The ad-hoc "evaluate this text" entry points bind no formula cell, so a
-// relative axis has nothing to measure from and must not quietly assume the
-// origin -- that would resolve to a real but arbitrary cell.
-TEST(BuiltinsIndirect, R1C1RelativeWithoutAFormulaCellIsRef) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"RC\",FALSE)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-// An absolute reference needs no base and keeps working on that same path.
-TEST(BuiltinsIndirect, R1C1AbsoluteWithoutAFormulaCellStillResolves) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(1, 2, Value::number(42.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"R2C3\",FALSE)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(v.as_number(), 42.0);
-}
-
-TEST(BuiltinsIndirect, R1C1RangeSumsTheRectangle) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(3.0));
-  wb.sheet(0).set_cell_value(1, 1, Value::number(4.0));
-  const Value v = EvalSourceIn("=SUM(INDIRECT(\"R1C1:R2C2\",FALSE))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(v.as_number(), 10.0);
-}
-
-// An endpoint naming one axis is unbounded along the other, so `R2` is the
-// whole of row 2 the way `2:2` is.
-TEST(BuiltinsIndirect, R1C1SingleAxisIsAWholeRow) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(1, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(1, 5, Value::number(20.0));
-  wb.sheet(0).set_cell_value(0, 0, Value::number(99.0));
-  const Value v = EvalSourceIn("=SUM(INDIRECT(\"R2\",FALSE))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number()) << v.debug_to_string();
-  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
-}
-
-// The flag selects the grammar rather than adding a fallback: each style
-// rejects the other's spelling.
-TEST(BuiltinsIndirect, A1TextUnderR1C1FlagIsRef) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"A1\",FALSE)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-// Anchored at A1, so a -1 row offset falls off the top edge. Anchoring
-// matters here: without a formula cell the call would fail for the unrelated
-// reason above and stop testing the bound.
-TEST(BuiltinsIndirect, R1C1OffsetOutsideTheGridIsRef) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalAnchoredAt("=INDIRECT(\"R[-1]C\",FALSE)", wb, 0, 0);
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-// A range whose endpoints name different axes describes no rectangle.
-TEST(BuiltinsIndirect, R1C1MismatchedRangeEndpointsAreRef) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"R2:R3C4\",FALSE)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsIndirect, BuildFromConcat) {
-  // INDIRECT("A" & "1") evaluates the concat first, then resolves.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(111.0));
-  const Value v = EvalSourceIn("=INDIRECT(\"A\" & \"1\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 111.0);
-}
-
-TEST(BuiltinsIndirect, ArityMustBeOneOrTwo) {
-  const Value v0 = EvalSource("=INDIRECT()");
-  ASSERT_TRUE(v0.is_error());
-  const Value v3 = EvalSource("=INDIRECT(\"A1\",TRUE,3)");
-  ASSERT_TRUE(v3.is_error());
-}
-
-TEST(BuiltinsIndirect, ErrorTextPropagates) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=INDIRECT(1/0)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Div0);
-}
-
-// Full-column / full-row INDIRECT shapes expand against the sheet's used
-// range: aggregating one via SUM sees the populated cells, and an empty
-// column collapses to a blank scalar (no cells to spill). The ROW / COLUMN
-// family below exercises the rectangle-aware metadata path.
-TEST(BuiltinsIndirect, FullColumnTextExpandsInSum) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 3, Value::number(4.0));  // D1
-  wb.sheet(0).set_cell_value(1, 3, Value::number(5.0));  // D2
-  const Value v = EvalSourceIn("=SUM(INDIRECT(\"D:D\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 9.0);
-}
-
-TEST(BuiltinsIndirect, FullColumnTextEmptyResolvesToZero) {
-  // An empty column has no cells to spill; the expansion collapses to a
-  // blank scalar, which the top-level resolves to 0 exactly like a bare
-  // reference to an empty cell (`=Z1`).
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=INDIRECT(\"D:D\")", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 0.0);
-}
-
-TEST(BuiltinsIndirect, FullRowTextExpandsInSum) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(4, 0, Value::number(1.0));  // A5
-  wb.sheet(0).set_cell_value(4, 2, Value::number(2.0));  // C5
-  const Value v = EvalSourceIn("=SUM(INDIRECT(\"5:5\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, RowOfFullColumn) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=ROW(INDIRECT(\"D:D\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, ColumnOfFullColumn) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"D:D\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 4.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, RowOfFullRow) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=ROW(INDIRECT(\"5:5\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 5.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, ColumnOfFullRow) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"5:5\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, AbsoluteMixedFullColumn) {
-  // `$FF:FG` -> leftmost column is FF = 162.
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"$FF:FG\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 162.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, ReversedFullColumnNormalisedByMin) {
-  // `C:A` should report column 1 (A) as leftmost.
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"C:A\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, AbsoluteFullRow) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=ROW(INDIRECT(\"$12:$23\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 12.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, LastColumnXfd) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"XFD:XFD\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 16384.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, LowercaseColumn) {
-  // `s:s` -> column 19 (S).
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=COLUMN(INDIRECT(\"s:s\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 19.0);
-}
-
-TEST(BuiltinsIndirectFullColRow, LeadingZeroRow) {
-  // `05:05` -> row 5 (leading zeros tolerated in the row part).
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=ROW(INDIRECT(\"05:05\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 5.0);
-}
-
-// ---------------------------------------------------------------------------
-// OFFSET (scalar form)
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsOffset, ScalarRowsCols) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(1, 2, Value::number(99.0));  // C2
-  const Value v = EvalSourceIn("=OFFSET(A1,1,2)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 99.0);
-}
-
-TEST(BuiltinsOffset, ZeroOffsetReturnsBase) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(4, 4, Value::number(42.0));  // E5
-  const Value v = EvalSourceIn("=OFFSET(E5,0,0)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 42.0);
-}
-
-TEST(BuiltinsOffset, NegativeOffsetIntoGrid) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(2, 2, Value::text("from"));  // C3
-  const Value v = EvalSourceIn("=OFFSET(C3,-2,-2)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 10.0);
-}
-
-TEST(BuiltinsOffset, OffsetOutOfGridIsRef) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=OFFSET(A1,-1,0)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsOffset, NegativeHeightEndsAtAnchor) {
-  // Excel allows negative height: the rectangle extends upward and the
-  // base cell is the bottom edge. `OFFSET(A1, 0, 0, -1, 1)` yields a
-  // 1x1 rectangle at A1 (base is both top and bottom when |h|=1).
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=OFFSET(A1,0,0,-1,1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
-}
-
-TEST(BuiltinsOffset, NegativeHeightWalksUpTwoRows) {
-  // `OFFSET(C3, 0, 0, -2, 1)` anchors at C3 and walks up one row, so the
-  // rectangle spans C2:C3 and spills both cells.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(1, 2, Value::number(42.0));  // C2
-  wb.sheet(0).set_cell_value(2, 2, Value::number(99.0));  // C3
-  const Value v = EvalSourceIn("=OFFSET(C3,0,0,-2,1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array());
-  ASSERT_EQ(v.as_array_rows(), 2U);
-  EXPECT_DOUBLE_EQ(v.as_array()->cells[0].as_number(), 42.0);
-  EXPECT_DOUBLE_EQ(v.as_array()->cells[1].as_number(), 99.0);
-}
-
-TEST(BuiltinsOffset, NegativeHeightOffGridIsRef) {
-  // Negative height that would walk off the top is still #REF!.
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=OFFSET(A1,0,0,-2,1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsOffset, ZeroHeightIsRef) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  const Value v = EvalSourceIn("=OFFSET(A1,0,0,0,1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsOffset, MultiCellSpillsRectangle) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(3.0));
-  wb.sheet(0).set_cell_value(1, 1, Value::number(4.0));
-  const Value v = EvalSourceIn("=OFFSET(A1,0,0,3,3)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array());
-  ASSERT_EQ(v.as_array_rows(), 3U);
-  ASSERT_EQ(v.as_array_cols(), 3U);
-  EXPECT_DOUBLE_EQ(v.as_array()->cells[0].as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(v.as_array()->cells[4].as_number(), 4.0);
-}
-
-TEST(BuiltinsOffset, MultiCellSpillAdmitsRectanglesPastTheConjuredArrayCeiling) {
-  // The spilled array is a copy of the rectangle the range reader already
-  // admitted, so it is bounded like a read, not like an array a formula
-  // conjures from its arguments. 2 x 550,000 sits past that narrower
-  // ceiling (2^20 cells) and well inside the range-expansion bound.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(549999U, 1U, Value::number(2.0));
-  const Value v = EvalSourceIn("=OFFSET(A1,0,0,550000,2)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array()) << "a rectangle the read admits must not fail to materialise";
-  EXPECT_EQ(v.as_array_rows(), 550000U);
-  EXPECT_EQ(v.as_array_cols(), 2U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[0].as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[1099999U].as_number(), 2.0);
-}
-
-TEST(BuiltinsOffset, MultiCellSpillMaterialisesBlankCellsAsZero) {
-  Workbook wb = Workbook::create();
-  const Value v = EvalSourceIn("=OFFSET(A1,2,2,2,-2)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array());
-  ASSERT_EQ(v.as_array_rows(), 2U);
-  ASSERT_EQ(v.as_array_cols(), 2U);
-  for (std::uint32_t i = 0; i < 4U; ++i) {
-    ASSERT_TRUE(v.as_array()->cells[i].is_number());
-    EXPECT_DOUBLE_EQ(v.as_array()->cells[i].as_number(), 0.0);
-  }
-}
-
-TEST(BuiltinsOffset, RangeConsumersRetainBlankProvenance) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-
-  // Direct OFFSET projects the two interior source blanks to numeric zero,
-  // but its range-aware consumers still receive genuine Blank cells.
-  const Value count = EvalSourceIn("=COUNT(OFFSET(A1,0,0,2,2))", wb, wb.sheet(0));
-  ASSERT_TRUE(count.is_number());
-  EXPECT_DOUBLE_EQ(count.as_number(), 2.0);
-  const Value counta = EvalSourceIn("=COUNTA(OFFSET(A1,0,0,2,2))", wb, wb.sheet(0));
-  ASSERT_TRUE(counta.is_number());
-  EXPECT_DOUBLE_EQ(counta.as_number(), 2.0);
-
-  // An all-blank range has no logical values; it must not become FALSE just
-  // because the direct spill surface renders its cells as zero.
-  const Value all_blank_and = EvalSourceIn("=AND(OFFSET(D1,0,0,2,2))", wb, wb.sheet(0));
-  ASSERT_TRUE(all_blank_and.is_error());
-  EXPECT_EQ(all_blank_and.as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsReferences, RawRangeIngressProjectsBlankAcrossReferenceForms) {
-  Workbook wb = Workbook::create();
-  Sheet& sheet = wb.sheet(0);
-  sheet.set_cell_value(0, 0, Value::number(2.0));
-  // A2 is intentionally untouched, and A3 closes the interior-blank range.
-  sheet.set_cell_value(2, 0, Value::number(1.0));
-
-  const std::string expressions[] = {
-      "A1:A3",          "OFFSET(A1,0,0,3,1)",    "INDIRECT(\"A1:A3\")",
-      "INDEX(A1:A3,0)", "CHOOSE(1,A1:A3,B1:B3)", "IF(TRUE,A1:A3,B1:B3)",
-  };
-  for (const std::string& expression : expressions) {
-    const std::string direct_formula = "=" + expression;
-    const Value direct = EvalSourceIn(direct_formula, wb, sheet);
-    ASSERT_TRUE(direct.is_array()) << expression << ": " << direct.debug_to_string();
-    ASSERT_EQ(direct.as_array_rows(), 3U) << expression;
-    ASSERT_EQ(direct.as_array_cols(), 1U) << expression;
-    ASSERT_TRUE(direct.as_array_cells()[0].is_number()) << expression;
-    EXPECT_DOUBLE_EQ(direct.as_array_cells()[0].as_number(), 2.0) << expression;
-    ASSERT_TRUE(direct.as_array_cells()[1].is_number()) << expression;
-    EXPECT_DOUBLE_EQ(direct.as_array_cells()[1].as_number(), 0.0) << expression;
-    ASSERT_TRUE(direct.as_array_cells()[2].is_number()) << expression;
-    EXPECT_DOUBLE_EQ(direct.as_array_cells()[2].as_number(), 1.0) << expression;
-
-    const Value count = EvalSourceIn("=COUNT(" + expression + ")", wb, sheet);
-    ASSERT_TRUE(count.is_number()) << expression << ": " << count.debug_to_string();
-    EXPECT_DOUBLE_EQ(count.as_number(), 2.0) << expression;
-    const Value counta = EvalSourceIn("=COUNTA(" + expression + ")", wb, sheet);
-    ASSERT_TRUE(counta.is_number()) << expression << ": " << counta.debug_to_string();
-    EXPECT_DOUBLE_EQ(counta.as_number(), 2.0) << expression;
-    const Value and_value = EvalSourceIn("=AND(" + expression + ")", wb, sheet);
-    ASSERT_TRUE(and_value.is_boolean()) << expression << ": " << and_value.debug_to_string();
-    EXPECT_TRUE(and_value.as_boolean()) << expression;
-  }
-}
-
-TEST(BuiltinsOffset, BaseRangeSpillsRectangle) {
-  // `OFFSET(A1:B2, 0, 0)` defaults height/width from the base -> a 2x2
-  // rectangle starting at A1. Passing explicit `(1,1)` dimensions
-  // confirms the scalar path.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(100.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(200.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(300.0));
-  wb.sheet(0).set_cell_value(1, 1, Value::number(400.0));
-  const Value v_multi = EvalSourceIn("=OFFSET(A1:B2,0,0)", wb, wb.sheet(0));
-  ASSERT_TRUE(v_multi.is_array());
-  ASSERT_EQ(v_multi.as_array_rows(), 2U);
-  ASSERT_EQ(v_multi.as_array_cols(), 2U);
-  EXPECT_DOUBLE_EQ(v_multi.as_array()->cells[0].as_number(), 100.0);
-  EXPECT_DOUBLE_EQ(v_multi.as_array()->cells[3].as_number(), 400.0);
-  const Value v_scalar = EvalSourceIn("=OFFSET(A1:B2,0,0,1,1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v_scalar.is_number());
-  EXPECT_DOUBLE_EQ(v_scalar.as_number(), 100.0);
-}
-
-TEST(BuiltinsOffset, ArityBelowMinIsError) {
-  EXPECT_TRUE(EvalSource("=OFFSET(A1)").is_error());
-  EXPECT_TRUE(EvalSource("=OFFSET(A1,0)").is_error());
-}
-
-TEST(BuiltinsOffset, ArityAboveMaxIsError) {
-  EXPECT_TRUE(EvalSource("=OFFSET(A1,0,0,1,1,1)").is_error());
-}
-
-TEST(BuiltinsOffset, NonRefBaseIsValueError) {
-  // OFFSET(42, 0, 0) — base is a literal scalar, not a reference.
-  const Value v = EvalSource("=OFFSET(42,0,0)");
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
-}
-
-TEST(BuiltinsOffset, WholeColumnBaseResolvesInsteadOfValueError) {
-  // OFFSET(A:A, 1, 0, 1, 1) anchors one row below A1: A2.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(1, 0, Value::number(7.0));
-  const Value v = EvalSourceIn("=OFFSET(A:A,1,0,1,1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 7.0);
-}
-
-TEST(BuiltinsOffset, WholeColumnBaseDefaultHeightIsFullAxis) {
-  // Without an explicit height/width, OFFSET reuses the base's own shape
-  // -- a whole column's declared shape spans the full row axis, so
-  // ROWS(OFFSET(A:A,0,1)) (column-only shift, to B:B) reports the grid
-  // height rather than #VALUE!. A *row* offset on a whole column is
-  // rejected with #REF! regardless of this fix: the column already spans
-  // every row, so shifting it down by even one pushes the bottom edge
-  // past the grid, matching Excel.
-  const Value v = EvalSource("=ROWS(OFFSET(A:A,0,1))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), static_cast<double>(Sheet::kMaxRows));
-
-  const Value shifted_down = EvalSource("=OFFSET(A:A,1,0)");
-  ASSERT_TRUE(shifted_down.is_error());
-  EXPECT_EQ(shifted_down.as_error(), ErrorCode::Ref);
-}
-
-TEST(BuiltinsOffset, EmptyHeightOrWidthKeepsTheBaseSize) {
-  // An empty height or width is the base's, not zero (Excel 365:
-  // `@OFFSET(A1,0,0,,2)` is the 1x2 A1:B1, so #VALUE! off its row).
-  const Value rows = EvalSource("=ROWS(OFFSET(A1:A3,0,0,,2))");
-  ASSERT_TRUE(rows.is_number());
-  EXPECT_DOUBLE_EQ(rows.as_number(), 3.0);
-  const Value cols = EvalSource("=COLUMNS(OFFSET(A1:A3,0,0,2,))");
-  ASSERT_TRUE(cols.is_number());
-  EXPECT_DOUBLE_EQ(cols.as_number(), 1.0);
-}
-
-TEST(BuiltinsOffset, WholeRowBaseResolvesInsteadOfValueError) {
-  // OFFSET(1:1, 0, 1, 1, 1) anchors one column right of row 1: B1.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 1, Value::number(9.0));
-  const Value v = EvalSourceIn("=OFFSET(1:1,0,1,1,1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 9.0);
-}
-
-TEST(BuiltinsOffset, MultiColumnWholeRangeBaseUnionsTheColumnSpan) {
-  // OFFSET(A:C, 0, 0, 1, 1) keeps the full row axis and the A..C column
-  // span, anchored at A1.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 2, Value::number(3.0));
-  const Value v = EvalSourceIn("=OFFSET(A:C,0,2,1,1)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
-}
-
-TEST(BuiltinsOffset, LetBoundRangeBaseIsLookedThrough) {
-  // LET(r, A1:A3, ROWS(OFFSET(r, 1, 0))) -- the LET binding's underlying
-  // RangeOp shape (3 rows) must reach resolve_offset_base rather than
-  // collapsing to its scalar spill anchor.
-  const Value v = EvalSource("=LET(r,A1:A3,ROWS(OFFSET(r,1,0)))");
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
-}
-
-TEST(BuiltinsOffset, LetBoundNameBaseWithExplicitHeightIsLookedThrough) {
-  // The dynamic-named-range idiom (OFFSET(name,0,0,COUNTA(...))), scoped
-  // to what `resolve_offset_base` actually looks through: a LET/LAMBDA
-  // binding via `ctx.name_env()`, the same mechanism ROW / COLUMN / AREAS
-  // / the conditional aggregators use. A workbook Name Manager entry is a
-  // separate resolution path (`resolve_defined_name`) this finding's
-  // invariant does not cover.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(20.0));
-  const Value v = EvalSourceIn("=LET(data,A1:A2,SUM(OFFSET(data,0,0,2,1)))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
-}
-
-// ---------------------------------------------------------------------------
-// OFFSET inside lazy aggregators (range-producing path)
-// ---------------------------------------------------------------------------
-
-TEST(BuiltinsOffset, SumOfOffsetRectangle) {
-  // Set up a 3x3 block with known sum.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 3; ++r) {
-    for (std::uint32_t c = 0; c < 3; ++c) {
-      wb.sheet(0).set_cell_value(r, c, Value::number(static_cast<double>(r * 3 + c + 1)));
-    }
-  }
-  // A1:C3 = {1,2,3; 4,5,6; 7,8,9} -> sum = 45.
-  const Value v = EvalSourceIn("=SUM(OFFSET(A1,0,0,3,3))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 45.0);
-}
-
-TEST(BuiltinsOffset, AverageOfOffsetRectangle) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(10.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(20.0));
-  wb.sheet(0).set_cell_value(0, 2, Value::number(30.0));
-  // AVERAGE(B1:C1) == 25, reached via OFFSET(A1, 0, 1, 1, 2).
-  const Value v = EvalSourceIn("=AVERAGE(OFFSET(A1,0,1,1,2))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 25.0);
-}
-
-TEST(BuiltinsOffset, CountifOfOffsetRectangle) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(5.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(5.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(7.0));
-  wb.sheet(0).set_cell_value(3, 0, Value::number(5.0));
-  const Value v = EvalSourceIn("=COUNTIF(OFFSET(A1,0,0,4,1),5)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 3.0);
-}
-
-TEST(BuiltinsOffset, OffsetAppliedAfterShift) {
-  // The whole point of OFFSET + SUM: compute a moving sum. Shift the 3x1
-  // window one column to the right (starts at B1).
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(10.0));
-  wb.sheet(0).set_cell_value(0, 2, Value::number(100.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(1000.0));
-  const Value v = EvalSourceIn("=SUM(OFFSET(A1,0,1,1,3))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 1110.0);
-}
-
-TEST(BuiltinsOffset, SumOfOffsetOutOfGridPropagatesRef) {
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  // Trying to spill above row 1 — OFFSET produces #REF!, which SUM
-  // propagates as its leftmost error.
-  const Value v = EvalSourceIn("=SUM(OFFSET(A1,-1,0,2,1))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
-}
-
-// ---------------------------------------------------------------------------
-// `:` operator with OFFSET / INDIRECT call endpoints.
-// Mac Excel 365 (ja-JP) accepts these and unions the resolved rectangles;
-// see tests/oracle/cases/range_endpoint_calls.yaml for the goldens.
-// ---------------------------------------------------------------------------
-
-TEST(RangeEndpoint, RefToOffsetSingleCol) {
-  // SUM(A1:OFFSET(A1,4,0)) — lhs literal Ref, rhs OFFSET single-cell.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 5; ++r) {
-    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
-  }
-  const Value v = EvalSourceIn("=SUM(A1:OFFSET(A1,4,0))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 15.0);
-}
-
-TEST(RangeEndpoint, OffsetToOffsetSingleCol) {
-  // SUM(OFFSET(A1,0,0):OFFSET(A1,4,0)) — both endpoints are OFFSET calls.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 5; ++r) {
-    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
-  }
-  const Value v = EvalSourceIn("=SUM(OFFSET(A1,0,0):OFFSET(A1,4,0))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 15.0);
-}
-
-TEST(RangeEndpoint, IndirectToIndirect) {
-  // SUM(INDIRECT("B2"):INDIRECT("B6")) — both endpoints INDIRECT.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(1, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(2, 1, Value::number(4.0));
-  wb.sheet(0).set_cell_value(3, 1, Value::number(6.0));
-  wb.sheet(0).set_cell_value(4, 1, Value::number(8.0));
-  wb.sheet(0).set_cell_value(5, 1, Value::number(10.0));
-  const Value v = EvalSourceIn("=SUM(INDIRECT(\"B2\"):INDIRECT(\"B6\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 30.0);
-}
-
-TEST(RangeEndpoint, OffsetAboveRefNormalises) {
-  // SUM(OFFSET(A5,-4,0):A5) — lhs OFFSET resolves to A1, rhs A5;
-  // endpoint ordering is normalised so the union is A1:A5.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 5; ++r) {
-    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
-  }
-  const Value v = EvalSourceIn("=SUM(OFFSET(A5,-4,0):A5)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 15.0);
-}
-
-TEST(RangeEndpoint, RefToMultiCellOffset) {
-  // SUM(A1:OFFSET(A1,2,1,2,1)) — rhs OFFSET resolves to a 2x1
-  // rectangle B3:B4. The rectangle's bottom-right corner participates
-  // in the union so the unioned range is A1:B4 =
-  //   1 + 2 + 3 + 4 + 10 + 20 + 30 + 40 = 110.
-  // Verified against Mac Excel 365 in
-  // tests/oracle/golden/range_endpoint_calls.golden.json.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 5; ++r) {
-    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
-    wb.sheet(0).set_cell_value(r, 1, Value::number(static_cast<double>((r + 1) * 10)));
-  }
-  const Value v = EvalSourceIn("=SUM(A1:OFFSET(A1,2,1,2,1))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 110.0);
-}
-
-TEST(RangeEndpoint, RefToOffsetTwoCol) {
-  // SUM(A1:OFFSET(A1,4,1)) — rhs OFFSET steps to column B; spans A1:B5.
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 5; ++r) {
-    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
-    wb.sheet(0).set_cell_value(r, 1, Value::number(static_cast<double>((r + 1) * 10)));
-  }
-  const Value v = EvalSourceIn("=SUM(A1:OFFSET(A1,4,1))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 165.0);
-}
-
-TEST(RangeEndpoint, RefToIndirect) {
-  // SUM(A1:INDIRECT("A3")) — lhs Ref, rhs INDIRECT.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(100.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(200.0));
-  wb.sheet(0).set_cell_value(2, 0, Value::number(300.0));
-  const Value v = EvalSourceIn("=SUM(A1:INDIRECT(\"A3\"))", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_number());
-  EXPECT_DOUBLE_EQ(v.as_number(), 600.0);
-}
-
-// ---------------------------------------------------------------------------
-// Reference-returning INDEX / XLOOKUP / IFS / SWITCH
-// ---------------------------------------------------------------------------
-
-// A1:A10 = 1..10.
-Workbook ColumnOfTen() {
-  Workbook wb = Workbook::create();
-  for (std::uint32_t r = 0; r < 10; ++r) {
-    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
-  }
-  return wb;
-}
-
-void ExpectNumber(const Value& v, double expected, std::string_view formula) {
-  ASSERT_TRUE(v.is_number()) << formula;
-  EXPECT_DOUBLE_EQ(v.as_number(), expected) << formula;
-}
-
-void ExpectText(const Value& v, std::string_view expected, std::string_view formula) {
-  ASSERT_TRUE(v.is_text()) << formula;
-  EXPECT_EQ(std::string(v.as_text()), std::string(expected)) << formula;
-}
-
-TEST(ReferenceCall, IndexAsRangeEndpoint) {
-  Workbook wb = ColumnOfTen();
-  ExpectNumber(EvalSourceIn("=SUM(A1:INDEX(A1:A10,3))", wb, wb.sheet(0)), 6.0, "SUM(A1:INDEX(A1:A10,3))");
-  ExpectNumber(EvalSourceIn("=SUM(A1:INDEX(A:A,COUNTA(A:A)))", wb, wb.sheet(0)), 55.0, "dynamic A1:INDEX(A:A,n)");
-  ExpectNumber(EvalSourceIn("=ROWS(INDEX(A:A,2):INDEX(A:A,5))", wb, wb.sheet(0)), 4.0, "ROWS(INDEX:INDEX)");
-  ExpectNumber(EvalSourceIn("=SUM(INDEX(A1:A10,4):INDEX(A1:A10,6))", wb, wb.sheet(0)), 15.0, "SUM(INDEX:INDEX)");
-  const Value out_of_range = EvalSourceIn("=SUM(A1:INDEX(A1:A10,11))", wb, wb.sheet(0));
-  ASSERT_TRUE(out_of_range.is_error());
-  EXPECT_EQ(out_of_range.as_error(), ErrorCode::Ref);
-}
-
-TEST(ReferenceCall, CallEndpointRangeSpillsAsAValue) {
-  Workbook wb = ColumnOfTen();
-  const Value v = EvalSourceIn("=A1:INDEX(A1:A10,3)", wb, wb.sheet(0));
-  ASSERT_TRUE(v.is_array()) << v.debug_to_string();
-  ASSERT_EQ(v.as_array_rows(), 3U);
-  ASSERT_EQ(v.as_array_cols(), 1U);
-  EXPECT_DOUBLE_EQ(v.as_array_cells()[2].as_number(), 3.0);
-  ExpectNumber(EvalSourceIn("=A2:OFFSET(A1,1,0)", wb, wb.sheet(0)), 2.0, "1x1 call-endpoint range");
-}
-
-TEST(ReferenceCall, IndexAsReferenceArgument) {
-  Workbook wb = ColumnOfTen();
-  const Value isref = EvalSourceIn("=ISREF(INDEX(A1:B2,1,1))", wb, wb.sheet(0));
-  ASSERT_TRUE(isref.is_boolean());
-  EXPECT_TRUE(isref.as_boolean());
-  const Value literal = EvalSourceIn("=ISREF(INDEX({1,2},1))", wb, wb.sheet(0));
-  ASSERT_TRUE(literal.is_boolean());
-  EXPECT_FALSE(literal.as_boolean());
-  ExpectNumber(EvalSourceIn("=ROW(INDEX(A1:A10,3))", wb, wb.sheet(0)), 3.0, "ROW(INDEX(A1:A10,3))");
-  ExpectNumber(EvalSourceIn("=COLUMN(INDEX(A1:C3,2,3))", wb, wb.sheet(0)), 3.0, "COLUMN(INDEX(A1:C3,2,3))");
-  ExpectText(EvalSourceIn("=CELL(\"address\",INDEX(A1:C3,2,3))", wb, wb.sheet(0)), "$C$2", "CELL of INDEX");
-  // A zero index selects a whole column / row of the source.
-  ExpectNumber(EvalSourceIn("=ROWS(INDEX(A1:C3,0,2))", wb, wb.sheet(0)), 3.0, "ROWS(INDEX(A1:C3,0,2))");
-  ExpectNumber(EvalSourceIn("=COLUMNS(INDEX(A1:C3,2,0))", wb, wb.sheet(0)), 3.0, "COLUMNS(INDEX(A1:C3,2,0))");
-  ExpectNumber(EvalSourceIn("=SUM(OFFSET(INDEX(A1:A10,2),1,0,2,1))", wb, wb.sheet(0)), 7.0, "OFFSET over INDEX");
-}
-
-TEST(ReferenceCall, IndexAreaNumSelectsFromUnion) {
-  // A1:B2 = {1,2;3,4}, D1:E2 = {10,20;30,40}.
-  Workbook wb = Workbook::create();
-  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
-  wb.sheet(0).set_cell_value(0, 1, Value::number(2.0));
-  wb.sheet(0).set_cell_value(1, 0, Value::number(3.0));
-  wb.sheet(0).set_cell_value(1, 1, Value::number(4.0));
-  wb.sheet(0).set_cell_value(0, 3, Value::number(10.0));
-  wb.sheet(0).set_cell_value(0, 4, Value::number(20.0));
-  wb.sheet(0).set_cell_value(1, 3, Value::number(30.0));
-  wb.sheet(0).set_cell_value(1, 4, Value::number(40.0));
-  ExpectNumber(EvalSourceIn("=INDEX((A1:B2,D1:E2),2,1,2)", wb, wb.sheet(0)), 30.0, "area 2");
-  ExpectNumber(EvalSourceIn("=INDEX((A1:B2,D1:E2),2,1,1)", wb, wb.sheet(0)), 3.0, "area 1");
-  ExpectNumber(EvalSourceIn("=INDEX((A1:B2,D1:E2),2,1)", wb, wb.sheet(0)), 3.0, "default area");
-  ExpectNumber(EvalSourceIn("=INDEX(A1:B2,1,2,1)", wb, wb.sheet(0)), 2.0, "single area");
-  ExpectText(EvalSourceIn("=CELL(\"address\",INDEX((A1:B2,D1:E2),1,2,2))", wb, wb.sheet(0)), "$E$1", "CELL of area 2");
-  ExpectNumber(EvalSourceIn("=SUM(INDEX((A1:B2,D1:E2),0,2,2))", wb, wb.sheet(0)), 60.0, "whole column of area 2");
-  ExpectNumber(EvalSourceIn("=AREAS(INDEX((A1:B2,D1:E2),1,1,2))", wb, wb.sheet(0)), 1.0, "AREAS of INDEX");
-  for (const char* formula : {"=INDEX((A1:B2,D1:E2),1,1,3)", "=INDEX(A1:B2,1,1,2)"}) {
-    const Value v = EvalSourceIn(formula, wb, wb.sheet(0));
-    ASSERT_TRUE(v.is_error()) << formula;
-    EXPECT_EQ(v.as_error(), ErrorCode::Ref) << formula;
-  }
-  for (const char* formula :
-       {"=INDEX((A1:B2,D1:E2),1,1,0)", "=INDEX(A1:B2,1,1,0)", "=INDEX((A1:B2,D1:E2),1,1,-1)", "=INDEX(A1:B2,1,1,-1)"}) {
-    const Value v = EvalSourceIn(formula, wb, wb.sheet(0));
-    ASSERT_TRUE(v.is_error()) << formula;
-    EXPECT_EQ(v.as_error(), ErrorCode::Value) << formula;
-  }
-  // A fractional area_num truncates toward zero, like row_num / column_num.
-  ExpectNumber(EvalSourceIn("=INDEX((A1:B2,D1:E2),2,1,1.9)", wb, wb.sheet(0)), 3.0, "area_num truncates");
-  // area_num on a whole-area selection (row=0, col=0) picks that area's
-  // own shape and top-left address, not the union's.
-  ExpectNumber(EvalSourceIn("=ROWS(INDEX((A1:B2,D1:E2),0,0,2))", wb, wb.sheet(0)), 2.0, "ROWS of whole area 2");
-  ExpectNumber(EvalSourceIn("=SUM(INDEX((A1:B2,D1:E2),0,0,2))", wb, wb.sheet(0)), 100.0, "SUM of whole area 2");
-  ExpectText(EvalSourceIn("=CELL(\"address\",INDEX((A1:B2,D1:E2),0,0,2))", wb, wb.sheet(0)), "$D$1",
-             "CELL of whole area 2");
-}
-
-TEST(ReferenceCall, XlookupAsReference) {
-  // A1:A3 = a/b/c, B1:C3 = {1,10;2,20;3,30}.
-  Workbook wb = Workbook::create();
-  const char* keys[] = {"a", "b", "c"};
-  for (std::uint32_t r = 0; r < 3; ++r) {
-    wb.sheet(0).set_cell_value(r, 0, Value::text(keys[r]));
-    wb.sheet(0).set_cell_value(r, 1, Value::number(static_cast<double>(r + 1)));
-    wb.sheet(0).set_cell_value(r, 2, Value::number(static_cast<double>((r + 1) * 10)));
-  }
-  ExpectNumber(EvalSourceIn("=SUM(XLOOKUP(\"b\",A1:A3,B1:B3):B3)", wb, wb.sheet(0)), 5.0, "XLOOKUP endpoint");
-  const Value isref = EvalSourceIn("=ISREF(XLOOKUP(\"b\",A1:A3,B1:B3))", wb, wb.sheet(0));
-  ASSERT_TRUE(isref.is_boolean());
-  EXPECT_TRUE(isref.as_boolean());
-  ExpectText(EvalSourceIn("=CELL(\"address\",XLOOKUP(\"c\",A1:A3,B1:B3))", wb, wb.sheet(0)), "$B$3", "CELL of XLOOKUP");
-  // A multi-column return_array yields the matched row.
-  ExpectNumber(EvalSourceIn("=COLUMNS(XLOOKUP(\"a\",A1:A3,B1:C3))", wb, wb.sheet(0)), 2.0, "matched row");
-  ExpectNumber(EvalSourceIn("=ROW(XLOOKUP(\"b\",A1:A3,B1:C3))", wb, wb.sheet(0)), 2.0, "ROW of matched row");
-  // A miss returns if_not_found, which may itself be a reference.
-  ExpectText(EvalSourceIn("=CELL(\"address\",XLOOKUP(\"z\",A1:A3,B1:B3,C1))", wb, wb.sheet(0)), "$C$1",
-             "miss falls back to reference");
-  const Value miss = EvalSourceIn("=SUM(A1:XLOOKUP(\"z\",A1:A3,B1:B3))", wb, wb.sheet(0));
-  ASSERT_TRUE(miss.is_error());
-  EXPECT_EQ(miss.as_error(), ErrorCode::NA);
-}
-
-TEST(ReferenceCall, IfsAndSwitchPassReferencesThrough) {
-  Workbook wb = ColumnOfTen();
-  ExpectNumber(EvalSourceIn("=ROWS(A1:SWITCH(2,1,A2,2,A4))", wb, wb.sheet(0)), 4.0, "SWITCH endpoint");
-  ExpectNumber(EvalSourceIn("=SUM(A1:IFS(FALSE,A2,TRUE,A3))", wb, wb.sheet(0)), 6.0, "IFS endpoint");
-  const Value isref = EvalSourceIn("=ISREF(IFS(FALSE,A1,TRUE,B2))", wb, wb.sheet(0));
-  ASSERT_TRUE(isref.is_boolean());
-  EXPECT_TRUE(isref.as_boolean());
-  const Value scalar = EvalSourceIn("=ISREF(SWITCH(1,1,5))", wb, wb.sheet(0));
-  ASSERT_TRUE(scalar.is_boolean());
-  EXPECT_FALSE(scalar.as_boolean());
-  ExpectNumber(EvalSourceIn("=AREAS(SWITCH(9,1,A1,B1:C2))", wb, wb.sheet(0)), 1.0, "AREAS of SWITCH default");
-  // The value path is unchanged.
-  ExpectNumber(EvalSourceIn("=SWITCH(2,1,A2,2,A4)", wb, wb.sheet(0)), 4.0, "SWITCH value");
-  ExpectNumber(EvalSourceIn("=IFS(FALSE,A2,TRUE,A3)", wb, wb.sheet(0)), 3.0, "IFS value");
-}
-
-// Sheet1 and Sheet2 hold r*10+c (Sheet2: 100+r*10+c) over A1:D4, with the
-// names the Excel 365 measurement used.
-Workbook NamedEndpointBook() {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");
-  for (std::uint32_t r = 0; r < 4U; ++r) {
-    for (std::uint32_t c = 0; c < 4U; ++c) {
-      const double v = static_cast<double>((r + 1U) * 10U + (c + 1U));
-      wb.sheet(0).set_cell_value(r, c, Value::number(v));
-      wb.sheet(1).set_cell_value(r, c, Value::number(100.0 + v));
-    }
-  }
-  const std::pair<const char*, const char*> names[] = {
-      {"CellNm", "=Sheet1!$C$3"},
-      {"RectNm", "=Sheet1!$C$3:$D$4"},
-      {"Konst", "=5"},
-      {"IdxNm", "=INDEX(Sheet1!$A$1:$D$4,3,3)"},
-      {"OtherNm", "=Sheet2!$C$3"},
-      {"ExprNm", "=Sheet1!$C$3+0"},
-      {"TextNm", "=\"abc\""},
-      {"OffNm", "=OFFSET(Sheet1!$A$1,2,2)"},
-      {"ErrNm", "=#N/A"},
-      {"NaNm", "=NA()"},
-  };
-  for (const auto& [name, formula] : names) {
-    EXPECT_TRUE(static_cast<bool>(wb.set_defined_name(name, formula)));
-  }
-  return wb;
-}
-
-void ExpectError(const Value& v, ErrorCode expected, std::string_view formula) {
-  ASSERT_TRUE(v.is_error()) << formula << " -> " << v.debug_to_string();
-  EXPECT_EQ(v.as_error(), expected) << formula;
-}
-
-// Values measured on Excel 365 (Mac, ja-JP).
-TEST(ReferenceCall, DefinedNameAsRangeEndpoint) {
-  Workbook wb = NamedEndpointBook();
-  const Sheet& s1 = wb.sheet(0);
-  ExpectNumber(EvalSourceIn("=SUM(A1:CellNm)", wb, s1), 198.0, "SUM(A1:CellNm)");
-  ExpectNumber(EvalSourceIn("=SUM(CellNm:A1)", wb, s1), 198.0, "SUM(CellNm:A1)");
-  ExpectNumber(EvalSourceIn("=SUM(A1:RectNm)", wb, s1), 440.0, "SUM(A1:RectNm)");
-  ExpectNumber(EvalSourceIn("=SUM(A1:IdxNm)", wb, s1), 198.0, "SUM(A1:IdxNm)");
-  ExpectNumber(EvalSourceIn("=SUM(A1:OffNm)", wb, s1), 198.0, "SUM(A1:OffNm)");
-  ExpectNumber(EvalSourceIn("=ROWS(A1:RectNm)", wb, s1), 4.0, "ROWS(A1:RectNm)");
-  ExpectNumber(EvalSourceIn("=SUM(CellNm:RectNm)", wb, s1), 154.0, "SUM(CellNm:RectNm)");
-  ExpectNumber(EvalSourceIn("=SUM(A1:CellNm:B1)", wb, s1), 198.0, "SUM(A1:CellNm:B1)");
-  ExpectNumber(EvalSourceIn("=SUM(Sheet1!A1:CellNm)", wb, s1), 198.0, "SUM(Sheet1!A1:CellNm)");
-  ExpectNumber(EvalSourceIn("=SUM(Sheet2!A1:OtherNm)", wb, s1), 1098.0, "SUM(Sheet2!A1:OtherNm)");
-  ExpectNumber(EvalSourceIn("=SUM(A1:Sheet1!CellNm)", wb, s1), 198.0, "SUM(A1:Sheet1!CellNm)");
-  ExpectNumber(EvalSourceIn("=SUM(A1:[0]!CellNm)", wb, s1), 198.0, "SUM(A1:[0]!CellNm)");
-}
-
-TEST(ReferenceCall, NonReferenceNameAsRangeEndpoint) {
-  Workbook wb = NamedEndpointBook();
-  const Sheet& s1 = wb.sheet(0);
-  ExpectError(EvalSourceIn("=SUM(A1:Konst)", wb, s1), ErrorCode::Value, "SUM(A1:Konst)");
-  ExpectError(EvalSourceIn("=SUM(Konst:A1)", wb, s1), ErrorCode::Value, "SUM(Konst:A1)");
-  ExpectError(EvalSourceIn("=ROWS(A1:Konst)", wb, s1), ErrorCode::Value, "ROWS(A1:Konst)");
-  ExpectError(EvalSourceIn("=SUM(A1:ExprNm)", wb, s1), ErrorCode::Value, "SUM(A1:ExprNm)");
-  ExpectError(EvalSourceIn("=SUM(A1:TextNm)", wb, s1), ErrorCode::Value, "SUM(A1:TextNm)");
-  ExpectError(EvalSourceIn("=SUM(A1:Nope)", wb, s1), ErrorCode::Name, "SUM(A1:Nope)");
-  ExpectError(EvalSourceIn("=SUM(A1:ErrNm)", wb, s1), ErrorCode::NA, "SUM(A1:ErrNm)");
-  ExpectError(EvalSourceIn("=SUM(A1:NaNm)", wb, s1), ErrorCode::NA, "SUM(A1:NaNm)");
-  ExpectError(EvalSourceIn("=LET(r,5,SUM(A1:r))", wb, s1), ErrorCode::Value, "LET(r,5,SUM(A1:r))");
-}
-
-// A bare endpoint is the formula's own sheet when the other side's sheet
-// comes from a name or a call, and endpoints on two sheets are #VALUE!.
-TEST(ReferenceCall, RangeEndpointsOnDifferentSheets) {
-  Workbook wb = NamedEndpointBook();
-  const Sheet& s1 = wb.sheet(0);
-  const Sheet& s2 = wb.sheet(1);
-  ExpectError(EvalSourceIn("=SUM(A1:OtherNm)", wb, s1), ErrorCode::Value, "Sheet1: SUM(A1:OtherNm)");
-  ExpectError(EvalSourceIn("=SUM(Sheet1!A1:OtherNm)", wb, s1), ErrorCode::Value, "SUM(Sheet1!A1:OtherNm)");
-  ExpectError(EvalSourceIn("=SUM(A1:INDEX(Sheet2!A1:D4,3,3))", wb, s1), ErrorCode::Value,
-              "Sheet1: SUM(A1:INDEX(Sheet2!A1:D4,3,3))");
-  ExpectError(EvalSourceIn("=SUM(Sheet1!A1:INDEX(Sheet2!A1:D4,3,3))", wb, s1), ErrorCode::Value,
-              "SUM(Sheet1!A1:INDEX(Sheet2!A1:D4,3,3))");
-  ExpectNumber(EvalSourceIn("=SUM(A1:OtherNm)", wb, s2), 1098.0, "Sheet2: SUM(A1:OtherNm)");
-  ExpectNumber(EvalSourceIn("=SUM(A1:INDEX(Sheet2!A1:D4,3,3))", wb, s2), 1098.0,
-               "Sheet2: SUM(A1:INDEX(Sheet2!A1:D4,3,3))");
-  ExpectError(EvalSourceIn("=SUM(A1:CellNm)", wb, s2), ErrorCode::Value, "Sheet2: SUM(A1:CellNm)");
-  ExpectError(EvalSourceIn("=SUM(A1:INDEX(Sheet1!A1:D4,3,3))", wb, s2), ErrorCode::Value,
-              "Sheet2: SUM(A1:INDEX(Sheet1!A1:D4,3,3))");
-}
-
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins_references_test_helpers.h b/tests/unit/eval/builtins_references_test_helpers.h
new file mode 100644
index 000000000..2249c8b52
--- /dev/null
+++ b/tests/unit/eval/builtins_references_test_helpers.h
@@ -0,0 +1,71 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+#include "eval/eval_context.h"
+#include "eval/eval_state.h"
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "sheet.h"
+#include "test_eval_helpers.h"
+#include "utils/arena.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon::eval::references_test_helpers {
+
+inline Workbook ColumnOfTen() {
+  Workbook wb = Workbook::create();
+  for (std::uint32_t r = 0; r < 10; ++r) {
+    wb.sheet(0).set_cell_value(r, 0, Value::number(static_cast<double>(r + 1)));
+  }
+  return wb;
+}
+
+inline void ExpectNumber(const Value& v, double expected, std::string_view formula) {
+  ASSERT_TRUE(v.is_number()) << formula;
+  EXPECT_DOUBLE_EQ(v.as_number(), expected) << formula;
+}
+
+inline void ExpectText(const Value& v, std::string_view expected, std::string_view formula) {
+  ASSERT_TRUE(v.is_text()) << formula;
+  EXPECT_EQ(std::string(v.as_text()), std::string(expected)) << formula;
+}
+
+inline Value EvalSource(std::string_view src) {
+  static thread_local Arena parse_arena;
+  static thread_local Arena eval_arena;
+  parse_arena.reset();
+  eval_arena.reset();
+  parser::Parser p(src, parse_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  return evaluate(*root, eval_arena);
+}
+
+inline Value EvalSourceIn(std::string_view src, const Workbook& wb, const Sheet& current) {
+  static thread_local Arena parse_arena;
+  static thread_local Arena eval_arena;
+  parse_arena.reset();
+  eval_arena.reset();
+  parser::Parser p(src, parse_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr) << "parse failed for: " << src;
+  if (root == nullptr) {
+    return Value::error(ErrorCode::Name);
+  }
+  EvalState state;
+  const EvalContext ctx = test::workbook_context(wb, current, state);
+  return evaluate(*root, eval_arena, default_registry(), ctx);
+}
+
+}  // namespace formulon::eval::references_test_helpers
diff --git a/tests/unit/eval/builtins_stats_a_test.cpp b/tests/unit/eval/builtins_stats_a_test.cpp
index 2eb62bb7b..de5e70218 100644
--- a/tests/unit/eval/builtins_stats_a_test.cpp
+++ b/tests/unit/eval/builtins_stats_a_test.cpp
@@ -225,6 +225,19 @@ TEST(BuiltinsStdevPA, SqrtOfVarpa) {
   EXPECT_DOUBLE_EQ(v.as_number(), std::sqrt(2.25));
 }
 
+TEST(BuiltinsStatsAExtreme, EqualLargeRangeOverflowIsNumError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0e308));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(1.0e308));
+
+  for (const char* formula :
+       {"=AVERAGEA(A1:A2)", "=VARA(A1:A2)", "=VARPA(A1:A2)", "=STDEVA(A1:A2)", "=STDEVPA(A1:A2)"}) {
+    const Value result = EvalSourceIn(formula, wb, wb.sheet(0));
+    ASSERT_TRUE(result.is_error()) << formula << ": " << result.debug_to_string();
+    EXPECT_EQ(result.as_error(), ErrorCode::Num) << formula;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Legacy VARP / STDEVP (aliases of VAR.P / STDEV.P, NOT A-variants).
 // ---------------------------------------------------------------------------
diff --git a/tests/unit/eval/builtins_stats_test.cpp b/tests/unit/eval/builtins_stats_test.cpp
index bd5a18580..483989a31 100644
--- a/tests/unit/eval/builtins_stats_test.cpp
+++ b/tests/unit/eval/builtins_stats_test.cpp
@@ -11,6 +11,7 @@
 
 #include <cmath>
 #include <cstdint>
+#include <limits>
 #include <string>
 #include <string_view>
 
@@ -806,6 +807,52 @@ TEST(BuiltinsVarP, Range) {
   EXPECT_NEAR(v.as_number(), 4.0, 1e-12);
 }
 
+TEST(BuiltinsStatsExtreme, EqualLargeRangeOverflowIsNumError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0e308));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(1.0e308));
+
+  for (const char* formula : {"=VAR.S(A1:A2)", "=VAR.P(A1:A2)", "=STDEV.S(A1:A2)", "=STDEV.P(A1:A2)"}) {
+    const Value result = EvalSourceIn(formula, wb, wb.sheet(0));
+    ASSERT_TRUE(result.is_error()) << formula << ": " << result.debug_to_string();
+    EXPECT_EQ(result.as_error(), ErrorCode::Num) << formula;
+  }
+}
+
+TEST(BuiltinsStatsExtreme, OpposingMaximumPopulationStdDevIsNumError) {
+  Workbook wb = Workbook::create();
+  const double max = std::numeric_limits<double>::max();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(max));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(-max));
+
+  const Value stdev = EvalSourceIn("=STDEV.P(A1:A2)", wb, wb.sheet(0));
+  ASSERT_TRUE(stdev.is_error()) << stdev.debug_to_string();
+  EXPECT_EQ(stdev.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsStatsExtreme, SquaredDeviationOverflowIsNumError) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0e155));
+  for (std::uint32_t row = 1U; row < 1000U; ++row) {
+    wb.sheet(0).set_cell_value(row, 0, Value::number(0.0));
+  }
+
+  const Value variance = EvalSourceIn("=VAR.P(A1:A1000)", wb, wb.sheet(0));
+  ASSERT_TRUE(variance.is_error()) << variance.debug_to_string();
+  EXPECT_EQ(variance.as_error(), ErrorCode::Num);
+}
+
+TEST(BuiltinsStatsExtreme, AdjacentLargeValuesMatchExcelPopulationVariance) {
+  constexpr double first = 1.0e150;
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 0, Value::number(first));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(std::nextafter(first, 0.0)));
+
+  const Value variance = EvalSourceIn("=VAR.P(A1:A2)", wb, wb.sheet(0));
+  ASSERT_TRUE(variance.is_number()) << variance.debug_to_string();
+  EXPECT_DOUBLE_EQ(variance.as_number(), 1.650920409798954e+268);
+}
+
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/builtins_subtotal_filter_hidden_test.cpp b/tests/unit/eval/builtins_subtotal_filter_hidden_test.cpp
new file mode 100644
index 000000000..8cb4eda03
--- /dev/null
+++ b/tests/unit/eval/builtins_subtotal_filter_hidden_test.cpp
@@ -0,0 +1,164 @@
+// SUBTOTAL(1..11) excludes filter-hidden rows and 101..111 every hidden row.
+// A hidden row counts as filtered exactly when an AutoFilter on its sheet (the
+// sheet's own or a table's) carries a criterion, inside the filter range or
+// not. Expected values were measured in Excel after save, close and reopen.
+
+#include <cstdint>
+#include <set>
+#include <string>
+#include <vector>
+
+#include "auto_filter.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "table.h"
+#include "util/test_eval_helpers.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+enum class Filter : std::uint8_t {
+  kNone,            // No AutoFilter.
+  kNoCriterion,     // Sheet AutoFilter without a criterion.
+  kCriterion,       // Sheet AutoFilter with a column-A criterion.
+  kTwoCriteria,     // Sheet AutoFilter with criteria on columns A and B.
+  kTableCriterion,  // Table over the range whose AutoFilter has a criterion.
+};
+
+struct Case {
+  const char* name;
+  Filter filter;
+  std::uint32_t last_ref_row;  // 1-based last row of the filter range.
+  std::uint32_t last_row;      // 1-based last data row probed.
+  std::vector<std::uint32_t> hidden;
+  std::vector<std::uint32_t> excluded_by_9;
+  std::vector<std::uint32_t> excluded_by_109;
+};
+
+const std::vector<std::uint32_t> kOddPlus6And25 = {3, 5, 6, 7, 9, 11, 13, 15, 17, 19, 21, 25};
+const std::vector<std::uint32_t> kOddPlus6And25And40 = {3, 5, 6, 7, 9, 11, 13, 15, 17, 19, 21, 25, 40};
+
+const std::vector<Case>& Cases() {
+  static const std::vector<Case> cases = {
+      {"Cond", Filter::kCriterion, 21, 30, kOddPlus6And25, kOddPlus6And25, kOddPlus6And25},
+      {"NoCrit", Filter::kNoCriterion, 21, 30, {4, 9, 25}, {}, {4, 9, 25}},
+      {"Tbl", Filter::kTableCriterion, 21, 30, kOddPlus6And25, kOddPlus6And25, kOddPlus6And25},
+      {"C1", Filter::kCriterion, 21, 40, kOddPlus6And25And40, kOddPlus6And25And40, kOddPlus6And25And40},
+      {"C2", Filter::kCriterion, 10, 40, {3, 5, 7, 9, 15, 25}, {3, 5, 7, 9, 15, 25}, {3, 5, 7, 9, 15, 25}},
+      {"N1", Filter::kNoCriterion, 21, 40, {4, 9, 25}, {}, {4, 9, 25}},
+      {"X", Filter::kNone, 21, 40, {4, 25}, {}, {4, 25}},
+      {"C3", Filter::kCriterion, 21, 40, {}, {}, {}},
+      {"C4", Filter::kTwoCriteria, 21, 40, kOddPlus6And25, kOddPlus6And25, kOddPlus6And25},
+  };
+  return cases;
+}
+
+FilterColumn ValuesColumn(std::uint32_t col_id, std::vector<std::string> values) {
+  FilterColumn column;
+  column.col_id = col_id;
+  column.kind = FilterKind::kValues;
+  column.values.values = std::move(values);
+  return column;
+}
+
+// Column A holds "x" on even and "y" on odd rows 2..21 and "o" from row 23;
+// column B holds the row number. Row 22 is empty.
+Workbook Build(const Case& c) {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  sheet.set_cell_value(0, 0, Value::text("key"));
+  sheet.set_cell_value(0, 1, Value::text("val"));
+  for (std::uint32_t r = 2; r <= c.last_row; ++r) {
+    if (r == 22) {
+      continue;
+    }
+    const char* key = r > 22 ? "o" : (r % 2U == 0U ? "x" : "y");
+    sheet.set_cell_value(r - 1U, 0, Value::text(key));
+    sheet.set_cell_value(r - 1U, 1, Value::number(static_cast<double>(r)));
+  }
+  for (std::uint32_t r : c.hidden) {
+    RowLayout layout;
+    layout.row = r - 1U;
+    layout.hidden = true;
+    sheet.mutable_layout().row_overrides.push_back(layout);
+  }
+
+  AutoFilter filter;
+  filter.range = MergeRange{0, 0, c.last_ref_row - 1U, 1};
+  if (c.filter == Filter::kCriterion || c.filter == Filter::kTwoCriteria || c.filter == Filter::kTableCriterion) {
+    filter.columns.push_back(ValuesColumn(0, {"x"}));
+  }
+  if (c.filter == Filter::kTwoCriteria) {
+    filter.columns.push_back(ValuesColumn(1, {"2", "4"}));
+  }
+  if (c.filter == Filter::kTableCriterion) {
+    TableMetadata table;
+    table.id = 1;
+    table.name = "T1";
+    table.display_name = "T1";
+    table.ref = "A1:B21";
+    table.columns.emplace_back(1U, "key", "", "", "");
+    table.columns.emplace_back(2U, "val", "", "", "");
+    wb.mutable_tables().push_back(table);
+    EXPECT_TRUE(static_cast<bool>(wb.set_table_auto_filter(0, filter)));
+  } else if (c.filter != Filter::kNone) {
+    EXPECT_TRUE(static_cast<bool>(wb.set_sheet_auto_filter(0, filter)));
+  }
+  return wb;
+}
+
+double Eval(const Workbook& wb, const std::string& formula) {
+  const Value v = test::EvalSourceIn(formula, wb, wb.sheet(0));
+  EXPECT_TRUE(v.is_number()) << formula;
+  return v.is_number() ? v.as_number() : -1.0;
+}
+
+TEST(SubtotalFilterHidden, ProbeTable) {
+  for (const Case& c : Cases()) {
+    const Workbook wb = Build(c);
+    const std::set<std::uint32_t> by9(c.excluded_by_9.begin(), c.excluded_by_9.end());
+    const std::set<std::uint32_t> by109(c.excluded_by_109.begin(), c.excluded_by_109.end());
+    for (std::uint32_t r = 2; r <= c.last_row; ++r) {
+      if (r == 22) {
+        continue;
+      }
+      const std::string ref = "B" + std::to_string(r);
+      EXPECT_EQ(Eval(wb, "=SUBTOTAL(9," + ref + ")") == 0.0, by9.count(r) == 1U) << c.name << " row " << r;
+      EXPECT_EQ(Eval(wb, "=SUBTOTAL(109," + ref + ")") == 0.0, by109.count(r) == 1U) << c.name << " row " << r;
+    }
+  }
+}
+
+// Region totals measured on the Excel-built sheets.
+TEST(SubtotalFilterHidden, RegionSums) {
+  struct Sums {
+    const char* name;
+    double in9, in109, out9, out109, all9, all109;
+  };
+  const Sums sums[] = {
+      {"Cond", 104, 104, 187, 187, 291, 291},
+      {"NoCrit", 230, 217, 212, 187, 442, 404},
+      {"Tbl", 104, 104, 187, 187, 291, 291},
+  };
+  for (const Sums& s : sums) {
+    const Case* found = nullptr;
+    for (const Case& c : Cases()) {
+      if (std::string(c.name) == s.name) {
+        found = &c;
+      }
+    }
+    ASSERT_NE(found, nullptr);
+    const Workbook wb = Build(*found);
+    EXPECT_DOUBLE_EQ(Eval(wb, "=SUBTOTAL(9,B2:B21)"), s.in9) << s.name;
+    EXPECT_DOUBLE_EQ(Eval(wb, "=SUBTOTAL(109,B2:B21)"), s.in109) << s.name;
+    EXPECT_DOUBLE_EQ(Eval(wb, "=SUBTOTAL(9,B23:B30)"), s.out9) << s.name;
+    EXPECT_DOUBLE_EQ(Eval(wb, "=SUBTOTAL(109,B23:B30)"), s.out109) << s.name;
+    EXPECT_DOUBLE_EQ(Eval(wb, "=SUBTOTAL(9,B1:B30)"), s.all9) << s.name;
+    EXPECT_DOUBLE_EQ(Eval(wb, "=SUBTOTAL(109,B1:B30)"), s.all109) << s.name;
+  }
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/eval/builtins_subtotal_test.cpp b/tests/unit/eval/builtins_subtotal_test.cpp
index 5ee0eef2c..8e6cba8c9 100644
--- a/tests/unit/eval/builtins_subtotal_test.cpp
+++ b/tests/unit/eval/builtins_subtotal_test.cpp
@@ -17,6 +17,7 @@
 #include "eval/eval_context.h"
 #include "eval/eval_state.h"
 #include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
 #include "eval/tree_walker.h"
 #include "gtest/gtest.h"
 #include "parser/ast.h"
@@ -485,6 +486,165 @@ TEST(BuiltinsSubtotal, MissingRangeRejected) {
   ASSERT_TRUE(v.is_error());
 }
 
+// ---------------------------------------------------------------------------
+// Nested SUBTOTAL / AGGREGATE exclusion
+// ---------------------------------------------------------------------------
+
+namespace {
+
+void SetFormula(Workbook& wb, std::uint32_t row, std::uint32_t col, const char* text) {
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, row, col, text))) << text;
+}
+
+void Recalc(Workbook& wb) {
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+}
+
+double NumberAt(const Workbook& wb, std::uint32_t row, std::uint32_t col) {
+  const Cell* cell = wb.sheet(0).cell_at(row, col);
+  EXPECT_TRUE(cell != nullptr);
+  if (cell == nullptr || !cell->cached_value.is_number()) {
+    ADD_FAILURE() << "row " << row << " col " << col << " "
+                  << (cell != nullptr ? cell->cached_value.debug_to_string() : "");
+    return -1.0;
+  }
+  return cell->cached_value.as_number();
+}
+
+// Report block in A1:A7: 100, 200, 300, subtotal of the first three, 400, 500,
+// subtotal of the last two.
+void FillReportBlock(Workbook& wb) {
+  wb.sheet(0).set_cell_value(0, 0, Value::number(100.0));
+  wb.sheet(0).set_cell_value(1, 0, Value::number(200.0));
+  wb.sheet(0).set_cell_value(2, 0, Value::number(300.0));
+  SetFormula(wb, 3U, 0U, "=SUBTOTAL(9,A1:A3)");
+  wb.sheet(0).set_cell_value(4, 0, Value::number(400.0));
+  wb.sheet(0).set_cell_value(5, 0, Value::number(500.0));
+  SetFormula(wb, 6U, 0U, "=SUBTOTAL(9,A5:A6)");
+}
+
+}  // namespace
+
+TEST(SubtotalNested, FeedbackWorkbookAverage) {
+  Workbook wb = Workbook::create();
+  FillReportBlock(wb);
+  SetFormula(wb, 0U, 2U, "=SUBTOTAL(9,A1:A7)");
+  SetFormula(wb, 1U, 2U, "=SUBTOTAL(1,A1:A7)");
+  SetFormula(wb, 2U, 2U, "=SUBTOTAL(2,A1:A7)");
+  SetFormula(wb, 3U, 2U, "=SUBTOTAL(3,A1:A7)");
+  SetFormula(wb, 4U, 2U, "=SUBTOTAL(109,A1:A7)");
+  SetFormula(wb, 5U, 2U, "=SUBTOTAL(101,A1:A7)");
+  SetFormula(wb, 6U, 2U, "=SUBTOTAL(1,A:A)");
+  Recalc(wb);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 0U, 2U), 1500.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 1U, 2U), 300.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 2U, 2U), 5.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 3U, 2U), 5.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 4U, 2U), 1500.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 5U, 2U), 300.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 6U, 2U), 300.0);
+}
+
+TEST(SubtotalNested, SurvivesRowInsertDelete) {
+  Workbook wb = Workbook::create();
+  FillReportBlock(wb);
+  SetFormula(wb, 20U, 2U, "=SUBTOTAL(9,A1:A7)");
+  SetFormula(wb, 21U, 2U, "=SUBTOTAL(1,A1:A7)");
+  SetFormula(wb, 22U, 2U, "=SUBTOTAL(2,A1:A7)");
+  Recalc(wb);
+  ASSERT_DOUBLE_EQ(NumberAt(wb, 20U, 2U), 1500.0);
+
+  // A blank row inside the range shifts the outer formulas down one row and
+  // widens their ranges; the results do not change.
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0U, 2U, 1U)));
+  Recalc(wb);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 21U, 2U), 1500.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 22U, 2U), 300.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 23U, 2U), 5.0);
+
+  // Deleting the same row restores the original layout and results.
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0U, 2U, 1U)));
+  Recalc(wb);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 20U, 2U), 1500.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 21U, 2U), 300.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 22U, 2U), 5.0);
+}
+
+TEST(SubtotalNested, CandidateCellShapes) {
+  // One candidate cell per outer call; 0 means the cell is excluded. A defined
+  // name, a pointer cell and INDIRECT are not subtotal calls and stay in.
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("NmSub", "SUBTOTAL(9,$Z$3)")));
+  wb.sheet(0).set_cell_value(0, 25, Value::number(1.0));  // Z1
+  wb.sheet(0).set_cell_value(2, 25, Value::number(8.0));  // Z3
+  struct Candidate {
+    const char* formula;
+    double expected;
+  };
+  static constexpr Candidate kCandidates[] = {
+      {"=SUBTOTAL(9,Z1)", 0.0},
+      {"=LET(x,SUBTOTAL(9,Z1),x)", 0.0},
+      {"=LET(x,NmSub,x)+0", 8.0},
+      {"=NmSub*2", 16.0},
+      {"=LAMBDA(r,SUBTOTAL(9,r))(Z1)", 0.0},
+      {"=subtotal(9,Z1)", 0.0},
+      {"=SUBTOTAL(109,Z1)", 0.0},
+      {"=SUMPRODUCT(SUBTOTAL(9,OFFSET(Z1,0,0,1,1)))", 0.0},
+      {"=AGGREGATE(9,0,Z1)", 0.0},
+      {"=AGGREGATE(9,4,Z1)", 0.0},
+      {"=IF(TRUE,64,\"SUBTOTAL(9)\")", 64.0},
+      {"=IF(1,256,AGGREGATE(9,0,Z1))", 0.0},
+      {"=A1*1024", 1024.0},  // only points at the SUBTOTAL(9,Z1) cell in A1
+      {"=INDIRECT(\"A1\")*1024", 1024.0},
+  };
+  SetFormula(wb, 0U, 0U, "=SUBTOTAL(9,Z1)");
+  std::uint32_t row = 1;
+  for (const Candidate& c : kCandidates) {
+    SetFormula(wb, row, 0U, c.formula);
+    SetFormula(wb, row, 2U, (std::string("=SUBTOTAL(9,A") + std::to_string(row + 1U) + ")").c_str());
+    ++row;
+  }
+  Recalc(wb);
+  row = 1;
+  for (const Candidate& c : kCandidates) {
+    EXPECT_DOUBLE_EQ(NumberAt(wb, row, 2U), c.expected) << c.formula;
+    ++row;
+  }
+}
+
+TEST(SubtotalNested, InvalidQualifiedBuiltinCellPropagatesToOuterSubtotal) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(1U, 0U, Value::number(4.0));  // A2
+  SetFormula(wb, 0U, 1U, "=Sheet1!SUM(SUBTOTAL(9,A2))");   // B1 is entry-invalid.
+  SetFormula(wb, 0U, 2U, "=SUBTOTAL(9,B1)");
+  Recalc(wb);
+
+  const Cell* invalid = wb.sheet(0).cell_at(0U, 1U);
+  ASSERT_NE(invalid, nullptr);
+  ASSERT_TRUE(invalid->cached_value.is_error()) << invalid->cached_value.debug_to_string();
+  EXPECT_EQ(invalid->cached_value.as_error(), ErrorCode::Name);
+
+  const Cell* outer = wb.sheet(0).cell_at(0U, 2U);
+  ASSERT_NE(outer, nullptr);
+  ASSERT_TRUE(outer->cached_value.is_error()) << outer->cached_value.debug_to_string();
+  EXPECT_EQ(outer->cached_value.as_error(), ErrorCode::Name);
+}
+
+TEST(SubtotalNested, SpillCellsFollowTheAnchorFormula) {
+  Workbook wb = Workbook::create();
+  wb.sheet(0).set_cell_value(0, 25, Value::number(512.0));  // Z1
+  SetFormula(wb, 0U, 2U, "=SUBTOTAL(9,Z1)+SEQUENCE(3)*0");
+  SetFormula(wb, 0U, 4U, "=SUBTOTAL(9,C1:C3)");
+  SetFormula(wb, 1U, 4U, "=SUBTOTAL(109,C1:C3)");
+  SetFormula(wb, 2U, 4U, "=AGGREGATE(9,0,C1:C3)");
+  SetFormula(wb, 3U, 4U, "=AGGREGATE(9,4,C1:C3)");
+  Recalc(wb);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 0U, 4U), 0.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 1U, 4U), 0.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 2U, 4U), 0.0);
+  EXPECT_DOUBLE_EQ(NumberAt(wb, 3U, 4U), 1536.0);
+}
+
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/cell_eval_test.cpp b/tests/unit/eval/cell_eval_test.cpp
index a2e3b1f1e..5db39c320 100644
--- a/tests/unit/eval/cell_eval_test.cpp
+++ b/tests/unit/eval/cell_eval_test.cpp
@@ -22,6 +22,7 @@
 #include "eval/eval_context.h"
 #include "eval/eval_state.h"
 #include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
 #include "eval/tree_walker.h"
 #include "gtest/gtest.h"
 #include "parser/ast.h"
@@ -225,6 +226,47 @@ TEST(BuiltinsCellFormat, BuiltinNumberFormatCodes) {
   EXPECT_EQ(EvalSourceIn("=CELL(\"format\", A2)", wb, wb.sheet(0)).as_text(), "D1");
 }
 
+TEST(BuiltinsCellStyle, InheritedColumnStyleCoversSpillPhantomAndBlank) {
+  Workbook wb = Workbook::create();
+  StylesTable styles;
+  styles.cell_xfs.push_back(CellXf{});  // xf 0: explicit cell override/default.
+  CellXf column_style{};
+  column_style.num_fmt_id = 10U;  // 0.00%
+  column_style.has_protection = true;
+  column_style.locked = false;
+  styles.cell_xfs.push_back(column_style);  // xf 1: column B style.
+  wb.set_styles(std::move(styles));
+
+  ColumnLayout column_b{};
+  column_b.first = 1U;
+  column_b.last = 1U;
+  column_b.has_style = true;
+  column_b.style_xf = 1U;
+  wb.sheet(0).mutable_layout().columns.push_back(column_b);
+
+  // B1 is a materialised spill phantom, while B2 remains a genuinely blank
+  // cell. Both coordinates still inherit the column's effective style.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(1,2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=B1")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  ASSERT_NE(wb.sheet(0).spill_region_at_anchor(0U, 0U), nullptr);
+
+  const Value spill_ref = wb.sheet(0).cell_at(0U, 2U)->cached_value;
+  ASSERT_TRUE(spill_ref.is_number());
+  EXPECT_DOUBLE_EQ(spill_ref.as_number(), 2.0);
+
+  EXPECT_EQ(EvalSourceIn("=CELL(\"format\", B1)", wb, wb.sheet(0)).as_text(), "P2");
+  EXPECT_DOUBLE_EQ(EvalSourceIn("=CELL(\"protect\", B1)", wb, wb.sheet(0)).as_number(), 0.0);
+  EXPECT_EQ(EvalSourceIn("=CELL(\"format\", B2)", wb, wb.sheet(0)).as_text(), "P2");
+  EXPECT_DOUBLE_EQ(EvalSourceIn("=CELL(\"protect\", B2)", wb, wb.sheet(0)).as_number(), 0.0);
+
+  // A coordinate-level xf, including an explicit xf 0, takes precedence
+  // over the column style even when the coordinate is a spill phantom.
+  wb.sheet(0).set_cell_xf_index(0U, 1U, 0U);
+  EXPECT_EQ(EvalSourceIn("=CELL(\"format\", B1)", wb, wb.sheet(0)).as_text(), "G");
+  EXPECT_DOUBLE_EQ(EvalSourceIn("=CELL(\"protect\", B1)", wb, wb.sheet(0)).as_number(), 1.0);
+}
+
 TEST(BuiltinsCellColor, DefaultFormatReturnsZero) {
   Workbook wb = Workbook::create();
   const Value v = EvalSourceIn("=CELL(\"color\", A1)", wb, wb.sheet(0));
@@ -350,6 +392,23 @@ TEST(BuiltinsCellProtect, ProtectionElementAbsentIsLocked) {
   EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
 }
 
+TEST(BuiltinsCellProtect, AbsentProtectionElementDefaultsLocked) {
+  // The protection child is authoritative only when present. An in-memory
+  // false `locked` value without that child still has the OOXML default 1.
+  Workbook wb = Workbook::create();
+  StylesTable styles;
+  styles.cell_xfs.push_back(CellXf{});  // xf 0.
+  CellXf no_protection{};
+  no_protection.locked = false;
+  styles.cell_xfs.push_back(no_protection);
+  wb.set_styles(std::move(styles));
+  wb.sheet(0).set_cell_value(0U, 0U, Value::number(5.0));
+  wb.sheet(0).set_cell_xf_index(0U, 0U, 1U);
+  const Value v = EvalSourceIn("=CELL(\"protect\", A1)", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_number());
+  EXPECT_DOUBLE_EQ(v.as_number(), 1.0);
+}
+
 TEST(BuiltinsCellProtect, AbsentCellIsLocked) {
   // A never-populated cell uses xf 0 -> locked -> 1.
   Workbook wb = Workbook::create();
diff --git a/tests/unit/eval/criteria_test.cpp b/tests/unit/eval/criteria_test.cpp
index 207a728cd..526504988 100644
--- a/tests/unit/eval/criteria_test.cpp
+++ b/tests/unit/eval/criteria_test.cpp
@@ -362,50 +362,6 @@ TEST(CriteriaMatchWildcard, StarAloneMatchesTextCellsOnly) {
   EXPECT_FALSE(matches_criterion(Value::blank(), c));
 }
 
-// ---------------------------------------------------------------------------
-// wildcard_match: codepoint-aware `*` backtracking and `?` matching.
-// ---------------------------------------------------------------------------
-
-TEST(WildcardMatchCodepoint, StarBacktrackAdvancesWholeCodepoints) {
-  // Regression: `*` backtracking used to advance one BYTE, letting a
-  // following `?` match a UTF-8 continuation byte and spuriously match.
-  // `*??c*` against "あcう" must NOT match (only 3 codepoints: あ, c, う —
-  // there is no "c" two codepoints in from any start after consuming two).
-  EXPECT_FALSE(wildcard_match("*??c*",
-                              "\xE3\x81\x82"
-                              "c"
-                              "\xE3\x81\x86"));
-}
-
-TEST(WildcardMatchCodepoint, QuestionMatchesExactlyOneCodepoint) {
-  // "?" matches a single multibyte codepoint.
-  EXPECT_TRUE(wildcard_match("?", "\xE3\x81\x82"));  // あ
-  EXPECT_FALSE(wildcard_match("?",
-                              "\xE3\x81\x82"
-                              "\xE3\x81\x84"));        // あい (2 cp)
-  EXPECT_FALSE(wildcard_match("??", "\xE3\x81\x82"));  // one cp cannot fill two ?
-}
-
-TEST(WildcardMatchCodepoint, QuestionMatchesSupplementaryPlaneEmoji) {
-  // A 4-byte codepoint (U+1F600) is one "?" unit.
-  EXPECT_TRUE(wildcard_match("?", "\xF0\x9F\x98\x80"));
-  EXPECT_TRUE(wildcard_match("a?b",
-                             "a"
-                             "\xF0\x9F\x98\x80"
-                             "b"));
-}
-
-TEST(WildcardMatchCodepoint, StarSwallowsMultibyteRun) {
-  // `*` skips a run of multibyte codepoints and the trailing literal aligns.
-  EXPECT_TRUE(wildcard_match("*c",
-                             "\xE3\x81\x82"
-                             "\xE3\x81\x84"
-                             "c"));  // あいc
-  EXPECT_TRUE(wildcard_match("*?c",
-                             "\xE3\x81\x82"
-                             "c"));  // あc
-}
-
 // ---------------------------------------------------------------------------
 // matches_criterion: blank-cell rules
 // ---------------------------------------------------------------------------
@@ -608,56 +564,6 @@ TEST(WildcardCriterion, NotEqPatternCountsNonTextCells) {
   EXPECT_TRUE(matches_criterion(Value::number(1213.0), c));
 }
 
-// ---------------------------------------------------------------------------
-// wildcard_find_dbcs: byte-mode `?` for SEARCHB. `?` matches only codepoints
-// whose ja-JP DBCS cost is 1 (ASCII, half-width katakana); kanji/hiragana/
-// full-width punctuation/emoji refuse to match. `*` and `~?`/`~*` retain
-// their normal semantics.
-// ---------------------------------------------------------------------------
-
-TEST(WildcardFindDbcs, QuestionSkipsKanjiToAsciiOffset) {
-  // "漢" is a 3-byte UTF-8 codepoint with DBCS cost 2; `?` refuses to match
-  // it. The next codepoint is 'A' at byte offset 3.
-  EXPECT_EQ(wildcard_find_dbcs("?", "漢ABC"), std::size_t{3});
-}
-
-TEST(WildcardFindDbcs, QuestionMatchesAsciiAtOffsetZero) {
-  EXPECT_EQ(wildcard_find_dbcs("?", "abc"), std::size_t{0});
-}
-
-TEST(WildcardFindDbcs, QuestionFindsNothingInPureKanji) {
-  // No SBCS codepoint anywhere; `?` matches nothing.
-  EXPECT_EQ(wildcard_find_dbcs("?", "漢"), std::string_view::npos);
-}
-
-TEST(WildcardFindDbcs, QuestionWithLiteralTailAfterKanji) {
-  // At start=0, "?" against 漢 fails. At start=3 the suffix is "abc" but
-  // pattern "?abc" needs 4 chars and only "abc" remains — no match.
-  EXPECT_EQ(wildcard_find_dbcs("?abc", "漢abc"), std::string_view::npos);
-}
-
-TEST(WildcardFindDbcs, QuestionInsideAsciiHaystack) {
-  EXPECT_EQ(wildcard_find_dbcs("a?c", "abc"), std::size_t{0});
-}
-
-TEST(WildcardFindDbcs, StarSwallowsKanjiThenQuestionMatchesAscii) {
-  // `*` consumes the leading 漢 (2 DBCS bytes / 3 UTF-8 bytes) and `?`
-  // then matches 'A'.
-  EXPECT_EQ(wildcard_find_dbcs("*?", "漢A"), std::size_t{0});
-}
-
-TEST(WildcardFindDbcs, EscapedQuestionIsLiteralRegardlessOfMode) {
-  // `~?` is a literal '?' under both wildcard modes; the byte-mode flag
-  // only affects unescaped `?`.
-  EXPECT_EQ(wildcard_find_dbcs("~?", "x?y"), std::size_t{1});
-}
-
-TEST(WildcardFindDbcs, QuestionMatchesHalfWidthKatakana) {
-  // ｱ (U+FF71) is half-width katakana, classified as DBCS=1 in ja-JP, so
-  // byte-mode `?` matches it at offset 0.
-  EXPECT_EQ(wildcard_find_dbcs("?", "ｱABC"), std::size_t{0});
-}
-
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/defined_name_resolve_test.cpp b/tests/unit/eval/defined_name_resolve_test.cpp
index 08efa59b2..ecd87cdde 100644
--- a/tests/unit/eval/defined_name_resolve_test.cpp
+++ b/tests/unit/eval/defined_name_resolve_test.cpp
@@ -7,7 +7,9 @@
 
 #include "eval/defined_name_resolve.h"
 
+#include <chrono>
 #include <cstddef>
+#include <future>
 #include <string_view>
 #include <vector>
 
@@ -647,6 +649,21 @@ TEST(DefinedNameResolve, NamedLambdaParseFailureIsNameError) {
   EXPECT_EQ(v.as_error(), ErrorCode::Name);
 }
 
+TEST(DefinedNameResolve, QualifiedBuiltinInBodyIsEntryError) {
+  Workbook wb = Workbook::create();
+  Sheet& s = wb.sheet(0);
+  wb.set_defined_names({
+      DefinedName{"SUM", "LAMBDA(x,x+100)", 0, false, ""},
+      DefinedName{"Bad", "Sheet1!SUM(7)", -1, false, ""},
+  });
+  EvalState state;
+  EvalContext ctx(wb, s, state);
+  Arena a;
+  const Value v = EvalOrDie("=Bad", a, ctx);
+  ASSERT_TRUE(v.is_error()) << v.debug_to_string();
+  EXPECT_EQ(v.as_error(), ErrorCode::Name);
+}
+
 TEST(DefinedNameResolve, NamedLambdaSupportsNamedRecursion) {
   Workbook wb = Workbook::create_empty();
   Sheet& s = wb.sheet(wb.add_sheet("Sheet1"));
@@ -675,6 +692,48 @@ TEST(DefinedNameResolve, NamedLambdaRunawayRecursionHitsCalcCap) {
   EXPECT_EQ(v.as_error(), ErrorCode::Calc);
 }
 
+TEST(DefinedNameResolve, HiddenMutationWaitsForConcurrentWorkbookMutation) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Rate", "=1")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=B1+1")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1/2")));
+  IterativeOptions options;
+  options.enabled = true;
+  options.max_iterations = 2U;
+  wb.set_iterative_options(options);
+  struct ProgressState {
+    Workbook* workbook;
+    std::future<Expected<void, Error>> update;
+    std::future_status while_calculating = std::future_status::deferred;
+    bool called = false;
+  } state{&wb, {}, std::future_status::deferred, false};
+  wb.set_iterative_progress(
+      [](std::uint32_t, double, std::uint32_t, void* data) {
+        auto& progress = *static_cast<ProgressState*>(data);
+        progress.called = true;
+        std::promise<void> started;
+        auto entered = started.get_future();
+        progress.update = std::async(std::launch::async, [&] {
+          started.set_value();
+          return progress.workbook->set_defined_name_hidden("Rate", -1, true);
+        });
+        entered.wait();
+        // Recalc holds the engine lock throughout this callback.
+        progress.while_calculating = progress.update.wait_for(std::chrono::milliseconds(50));
+        return false;
+      },
+      &state);
+  const auto recalculated = wb.recalc(default_registry());
+  wb.set_iterative_progress(nullptr, nullptr);
+  ASSERT_TRUE(static_cast<bool>(recalculated));
+  ASSERT_TRUE(state.called);
+  EXPECT_EQ(state.while_calculating, std::future_status::timeout);
+  const auto result = state.update.get();
+  ASSERT_TRUE(static_cast<bool>(result));
+  ASSERT_EQ(wb.defined_names().size(), 1U);
+  EXPECT_TRUE(wb.defined_names()[0].hidden);
+}
+
 }  // namespace
 }  // namespace eval
 }  // namespace formulon
diff --git a/tests/unit/eval/dep_extractor_3d_dynamic_test.cpp b/tests/unit/eval/dep_extractor_3d_dynamic_test.cpp
new file mode 100644
index 000000000..636253919
--- /dev/null
+++ b/tests/unit/eval/dep_extractor_3d_dynamic_test.cpp
@@ -0,0 +1,285 @@
+// Dependency extractor tests grouped by dependency source.
+
+#include <algorithm>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "defined_name.h"
+#include "dep_extractor_test_helpers.h"
+#include "eval/dep_extractor.h"
+#include "table.h"
+#include "utils/resource_budget.h"
+#include "workbook.h"
+
+namespace formulon::eval {
+namespace {
+using namespace dep_extractor_test_helpers;
+
+std::vector<CellNodeId> RectCells(std::uint16_t sheet, std::uint32_t r0, std::uint32_t r1, std::uint32_t c0,
+                                  std::uint32_t c1) {
+  std::vector<CellNodeId> out;
+  for (std::uint32_t r = r0; r <= r1; ++r) {
+    for (std::uint32_t c = c0; c <= c1; ++c) {
+      out.push_back(CellNodeId{sheet, r, c});
+    }
+  }
+  return out;
+}
+
+ExtractedDeps ExtractFrom(std::string_view source, const Workbook& wb) {
+  Arena arena;
+  const parser::AstNode* root = ParseFormula(source, arena);
+  EXPECT_NE(root, nullptr);
+  return root == nullptr ? ExtractedDeps{} : extract_deps(*root, 0U, wb);
+}
+
+bool HasRangeDep(const ExtractedDeps& deps, CellRangeDependency want) {
+  return std::any_of(deps.range_deps.begin(), deps.range_deps.end(), [&](const CellRangeDependency& d) {
+    return d.sheet_id == want.sheet_id && d.row_first == want.row_first && d.row_last == want.row_last &&
+           d.col_first == want.col_first && d.col_last == want.col_last;
+  });
+}
+
+TEST(DepExtractor, ThreeDFullColumnUsesCompactRangeDependencies) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  wb.add_sheet("Sheet3");
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(Sheet1:Sheet3!A:A)", arena);
+  ASSERT_NE(root, nullptr);
+
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+  ASSERT_EQ(deps.range_deps.size(), 3U);
+  for (std::size_t i = 0; i < deps.range_deps.size(); ++i) {
+    EXPECT_EQ(deps.range_deps[i].sheet_id, i);
+    EXPECT_EQ(deps.range_deps[i].row_last, Sheet::kMaxRows - 1U);
+    EXPECT_EQ(deps.range_deps[i].col_first, 0U);
+    EXPECT_EQ(deps.range_deps[i].col_last, 0U);
+  }
+}
+
+TEST(DepExtractor, ThreeDRangeAboveLimitUsesCompactRangeDependencyPerSheet) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  wb.add_sheet("Sheet3");
+  Arena arena;
+  // The shared rectangle is read once per sheet in the span, so the ceiling
+  // is applied before the span multiplies the cost: 3 x 2,000 cells would be
+  // 6,000 permanent edges from one formula.
+  const parser::AstNode* root = ParseFormula("SUM(Sheet1:Sheet3!A1:B1000)", arena);
+  ASSERT_NE(root, nullptr);
+
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+  ASSERT_EQ(deps.range_deps.size(), 3U);
+  for (std::size_t sheet = 0; sheet < deps.range_deps.size(); ++sheet) {
+    EXPECT_EQ(deps.range_deps[sheet].sheet_id, sheet);
+    EXPECT_EQ(deps.range_deps[sheet].row_first, 0U);
+    EXPECT_EQ(deps.range_deps[sheet].row_last, 999U);
+    EXPECT_EQ(deps.range_deps[sheet].col_first, 0U);
+    EXPECT_EQ(deps.range_deps[sheet].col_last, 1U);
+  }
+}
+
+TEST(DepExtractor, ThreeDWholeAxisSpansPreserveBothAxes) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  wb.add_sheet("Sheet3");
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(Sheet1:Sheet3!A:C)+SUM(Sheet1:Sheet3!1:3)", arena);
+  ASSERT_NE(root, nullptr);
+
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  ASSERT_EQ(deps.range_deps.size(), 6U);
+  for (std::size_t sheet = 0; sheet < 3U; ++sheet) {
+    const CellRangeDependency& columns = deps.range_deps[sheet];
+    EXPECT_EQ(columns.sheet_id, sheet);
+    EXPECT_EQ(columns.row_first, 0U);
+    EXPECT_EQ(columns.row_last, Sheet::kMaxRows - 1U);
+    EXPECT_EQ(columns.col_first, 0U);
+    EXPECT_EQ(columns.col_last, 2U);
+
+    const CellRangeDependency& rows = deps.range_deps[3U + sheet];
+    EXPECT_EQ(rows.sheet_id, sheet);
+    EXPECT_EQ(rows.row_first, 0U);
+    EXPECT_EQ(rows.row_last, 2U);
+    EXPECT_EQ(rows.col_first, 0U);
+    EXPECT_EQ(rows.col_last, Sheet::kMaxCols - 1U);
+  }
+}
+
+TEST(DepExtractor, DynamicEndpointInsideSourceAddsNothing) {
+  const Workbook wb = Workbook::create();
+  const ExtractedDeps deps = ExtractFrom("SUM(A1:INDEX(A1:A10,3))", wb);
+  EXPECT_EQ(Sorted(deps.cell_deps), RectCells(0U, 0U, 9U, 0U, 0U));
+  EXPECT_TRUE(deps.range_deps.empty());
+}
+
+TEST(DepExtractor, DynamicEndpointRegistersBoundingBox) {
+  const Workbook wb = Workbook::create();
+  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:INDEX(C1:C10,3))", wb).cell_deps), RectCells(0U, 0U, 9U, 0U, 2U));
+  EXPECT_EQ(Sorted(ExtractFrom("SUM(INDEX(A1:A10,2):INDEX(C1:C10,3))", wb).cell_deps), RectCells(0U, 0U, 9U, 0U, 2U));
+  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:CHOOSE(2,B1,D5))", wb).cell_deps), RectCells(0U, 0U, 4U, 0U, 3U));
+}
+
+TEST(DepExtractor, ChainedRangeRegistersBoundingBox) {
+  const Workbook wb = Workbook::create();
+  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:B2:C3)", wb).cell_deps), RectCells(0U, 0U, 2U, 0U, 2U));
+}
+
+TEST(DepExtractor, DynamicEndpointOverWholeColumnStaysCompact) {
+  const Workbook wb = Workbook::create();
+  const ExtractedDeps deps = ExtractFrom("SUM(A1:INDEX(C:C,5))", wb);
+  EXPECT_TRUE(HasRangeDep(deps, CellRangeDependency{0U, 0U, Sheet::kMaxRows - 1U, 0U, 2U}));
+  EXPECT_LE(deps.cell_deps.size(), 1U);
+}
+
+TEST(DepExtractor, DynamicEndpointConditionStaysAPlainCell) {
+  const Workbook wb = Workbook::create();
+  std::vector<CellNodeId> expected = RectCells(0U, 0U, 4U, 0U, 3U);
+  expected.push_back(CellNodeId{0U, 0U, 25U});  // Z1
+  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:IF(Z1>0,B5,D5))", wb).cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, OffsetEndpointKeepsDynamicReference) {
+  const Workbook wb = Workbook::create();
+  const ExtractedDeps deps = ExtractFrom("SUM(A1:OFFSET(A1,2,2))", wb);
+  EXPECT_EQ(Sorted(deps.cell_deps), (std::vector<CellNodeId>{CellNodeId{0U, 0U, 0U}}));
+  EXPECT_TRUE(deps.range_deps.empty());
+  EXPECT_TRUE(deps.has_dynamic_reference);
+}
+
+TEST(DepExtractor, OffsetBaseIsNoRead) {
+  // OFFSET's base only positions the rectangle it returns: `=OFFSET(D2,-1,0)`
+  // in D2 reads D1, not D2, and is not circular (measured on Excel 365).
+  // A reference-returning base only positions what it can return, so
+  // `=OFFSET(INDEX(A1:A10,3),1,0)` in A3 is not circular either; the offsets
+  // and the base's other arguments are still read.
+  const Workbook wb = Workbook::create();
+  const ExtractedDeps plain = ExtractFrom("OFFSET(A1,1,1)", wb);
+  EXPECT_TRUE(plain.is_volatile);
+  EXPECT_TRUE(plain.has_dynamic_reference);
+  EXPECT_TRUE(plain.cell_deps.empty());
+  EXPECT_EQ(Sorted(ExtractFrom("OFFSET(A1,B1,1)", wb).cell_deps), (std::vector<CellNodeId>{CellNodeId{0U, 0U, 1U}}));
+  EXPECT_TRUE(ExtractFrom("OFFSET(INDEX(A1:A10,3),1,0)", wb).cell_deps.empty());
+  EXPECT_EQ(Sorted(ExtractFrom("OFFSET(INDEX(A1:A10,B1),1,0)", wb).cell_deps),
+            (std::vector<CellNodeId>{CellNodeId{0U, 0U, 1U}}));
+}
+
+TEST(DepExtractor, DynamicEndpointThroughLetBinding) {
+  const Workbook wb = Workbook::create();
+  EXPECT_EQ(Sorted(ExtractFrom("LET(r,C1:C10,SUM(A1:INDEX(r,3)))", wb).cell_deps), RectCells(0U, 0U, 9U, 0U, 2U));
+}
+
+TEST(DepExtractor, DynamicEndpointThroughDefinedName) {
+  Workbook wb = Workbook::create();
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"Rng", "=Sheet1!$C$1:$C$10", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:INDEX(Rng,3))", wb).cell_deps), RectCells(0U, 0U, 9U, 0U, 2U));
+}
+
+TEST(DepExtractor, DefinedNameEndpointRegistersBoundingBox) {
+  // `A1:CellNm` reads A1:C3, including B2 which neither endpoint names.
+  Workbook wb = Workbook::create();
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"CellNm", "=Sheet1!$C$3", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+  const std::vector<CellNodeId> deps = Sorted(ExtractFrom("SUM(A1:CellNm)", wb).cell_deps);
+  EXPECT_EQ(deps, RectCells(0U, 0U, 2U, 0U, 2U));
+}
+
+TEST(DepExtractor, SelfBookNameReadsTheWorkbookScopedDefinition) {
+  // `[0]!G` reads the workbook-scoped G (B2), never Sheet1's local G (C3).
+  Workbook wb = Workbook::create();
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"G", "=Sheet1!$C$3", 0, false, ""});
+  names.push_back(DefinedName{"G", "=Sheet1!$B$2", -1, false, ""});
+  names.push_back(DefinedName{"Rng", "=Sheet1!$A$10:$A$11", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+  EXPECT_EQ(Sorted(ExtractFrom("[0]!G", wb).cell_deps), RectCells(0U, 1U, 1U, 1U, 1U));
+  EXPECT_EQ(Sorted(ExtractFrom("SUM([0]!Rng)", wb).cell_deps), RectCells(0U, 9U, 10U, 0U, 0U));
+  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:[0]!G)", wb).cell_deps), RectCells(0U, 0U, 1U, 0U, 1U));
+}
+
+TEST(DepExtractor, DynamicEndpointOnAnotherSheet) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  EXPECT_EQ(Sorted(ExtractFrom("SUM(Sheet2!A1:INDEX(Sheet2!C1:C3,2))", wb).cell_deps), RectCells(1U, 0U, 2U, 0U, 2U));
+}
+
+TEST(DepExtractor, ReferenceOnlyArgumentsRegisterNothing) {
+  const Workbook wb = Workbook::create();
+  for (const char* src :
+       {"ROWS(A:A)", "ROW(A1)", "COLUMNS(1:1)", "ROWS(A1:C3)", "ISREF(A1)", "COLUMN(A1:B2:C3)", "AREAS((A1,B2:C3))"}) {
+    const ExtractedDeps deps = ExtractFrom(src, wb);
+    EXPECT_TRUE(deps.cell_deps.empty()) << src;
+    EXPECT_TRUE(deps.range_deps.empty()) << src;
+  }
+}
+
+TEST(DepExtractor, ReferenceOnlyArgumentThroughDefinedName) {
+  Workbook wb = Workbook::create();
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"Rng", "=Sheet1!$C$1:$C$10", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+  const ExtractedDeps deps = ExtractFrom("ROWS(Rng)", wb);
+  EXPECT_TRUE(deps.cell_deps.empty());
+  EXPECT_TRUE(deps.range_deps.empty());
+}
+
+TEST(DepExtractor, ReferenceOnlyCallStillWalksComputedArguments) {
+  const Workbook wb = Workbook::create();
+  // A spill's extent is read from its anchor.
+  EXPECT_EQ(ExtractFrom("ROWS(A1#)", wb).cell_deps, (std::vector<CellNodeId>{CellNodeId{0U, 0U, 0U}}));
+  // INDEX reads B1 to pick the row.
+  const std::vector<CellNodeId> index_deps = ExtractFrom("ROW(INDEX(A1:A10,B1))", wb).cell_deps;
+  EXPECT_NE(std::find(index_deps.begin(), index_deps.end(), CellNodeId{0U, 0U, 1U}), index_deps.end());
+}
+
+TEST(DepExtractor, ShadowedReferenceOnlyNameKeepsItsArgument) {
+  const Workbook wb = Workbook::create();
+  EXPECT_EQ(Sorted(ExtractFrom("LET(rows,LAMBDA(x,x),rows(A1:A3))", wb).cell_deps), RectCells(0U, 0U, 2U, 0U, 0U));
+}
+
+TEST(DepExtractor, ThreeDSpanMetadataIsNormalizedAndDeduplicatedAcrossExpansion) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "First")));
+  wb.add_sheet("Second");
+  wb.add_sheet("Third");
+  wb.set_defined_names({
+      DefinedName{"Inner", "First:Second!A1:A3", -1, false, ""},
+      DefinedName{"Outer", "Inner", -1, false, ""},
+      DefinedName{"F", "LAMBDA(x,SUM(Outer)+x)", -1, false, ""},
+  });
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(First:Second!A1:A3)+SUM(Second:First!A1:A3)+SUM(Outer)+F(0)", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+
+  ASSERT_EQ(deps.three_d_spans.size(), 1U);
+  EXPECT_EQ(deps.three_d_spans[0], (ThreeDSheetSpanDependency{0U, 1U}));
+}
+
+TEST(DepExtractor, ThreeDSpanMetadataIncludesWholeAxisReferences) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "First")));
+  wb.add_sheet("Second");
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(First:Second!A:A)+SUM(First:Second!1:1)", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+
+  ASSERT_EQ(deps.three_d_spans.size(), 1U);
+  EXPECT_EQ(deps.three_d_spans[0], (ThreeDSheetSpanDependency{0U, 1U}));
+}
+
+}  // namespace
+}  // namespace formulon::eval
diff --git a/tests/unit/eval/dep_extractor_names_test.cpp b/tests/unit/eval/dep_extractor_names_test.cpp
new file mode 100644
index 000000000..f1f9bd1b0
--- /dev/null
+++ b/tests/unit/eval/dep_extractor_names_test.cpp
@@ -0,0 +1,264 @@
+// Dependency extractor tests grouped by dependency source.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "defined_name.h"
+#include "dep_extractor_test_helpers.h"
+#include "eval/dep_extractor.h"
+#include "table.h"
+#include "utils/resource_budget.h"
+#include "workbook.h"
+
+namespace formulon::eval {
+namespace {
+using namespace dep_extractor_test_helpers;
+
+TEST(DepExtractor, NameRefWorkbookScopedSingleCell) {
+  Workbook wb = Workbook::create();
+  // MyName -> =A1, workbook-scoped (local_sheet_id = -1).
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"MyName", "=A1", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("MyName+1", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, /*current_sheet_id=*/0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  ASSERT_EQ(deps.cell_deps.size(), 1u);
+  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));
+}
+
+TEST(DepExtractor, NameRefWorkbookScopedRangeFlattens) {
+  Workbook wb = Workbook::create();
+  // MyRange -> =A1:B2, workbook-scoped. SUM(MyRange) should flatten to
+  // {A1, A2, B1, B2}.
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"MyRange", "=A1:B2", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(MyRange)", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  std::vector<CellNodeId> expected = {
+      CellNodeId{0U, 0U, 0U},  // A1
+      CellNodeId{0U, 0U, 1U},  // B1
+      CellNodeId{0U, 1U, 0U},  // A2
+      CellNodeId{0U, 1U, 1U},  // B2
+  };
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, NameRefIndirectionResolves) {
+  Workbook wb = Workbook::create();
+  // Name1 -> =Name2, Name2 -> =A1. =Name1 must surface A1 as a dep.
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"Name1", "=Name2", -1, false, ""});
+  names.push_back(DefinedName{"Name2", "=A1", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Name1", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  ASSERT_EQ(deps.cell_deps.size(), 1u);
+  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));
+}
+
+TEST(DepExtractor, NameRefSheetScopedBeatsWorkbookScoped) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");  // index 1
+  // Foo at workbook scope -> =A1; Foo at sheet 0 -> =B1. From sheet 0 the
+  // sheet-scoped definition wins (B1); from sheet 1 the workbook-scoped
+  // fallback applies (A1 on sheet 1, since unqualified refs resolve to the
+  // current sheet).
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"Foo", "=A1", -1, false, ""});
+  names.push_back(DefinedName{"Foo", "=B1", 0, false, ""});
+  wb.set_defined_names(std::move(names));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Foo", arena);
+  ASSERT_NE(root, nullptr);
+
+  ExtractedDeps from_sheet0 = extract_deps(*root, /*current_sheet_id=*/0U, wb);
+  ASSERT_EQ(from_sheet0.cell_deps.size(), 1u);
+  EXPECT_EQ(from_sheet0.cell_deps[0], (CellNodeId{0U, 0U, 1U}));  // B1 on sheet 0
+
+  ExtractedDeps from_sheet1 = extract_deps(*root, /*current_sheet_id=*/1U, wb);
+  ASSERT_EQ(from_sheet1.cell_deps.size(), 1u);
+  EXPECT_EQ(from_sheet1.cell_deps[0], (CellNodeId{1U, 0U, 0U}));  // A1 on sheet 1
+}
+
+TEST(DepExtractor, NameRefCycleTerminates) {
+  Workbook wb = Workbook::create();
+  // Loop -> =Loop+1 — self-referential. The walker must not infinite-loop;
+  // policy is to break the cycle silently (no deps, no volatility flag).
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"Loop", "=Loop+1", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Loop", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  // The assertion that matters is that the test terminates. Cycle policy:
+  // silent skip on re-entry — no deps, not volatile.
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+}
+
+TEST(DepExtractor, NameRefMissingNameIsSilentSkip) {
+  Workbook wb = Workbook::create();
+  // No defined names registered: =MissingName must not crash and produces
+  // an empty dep set.
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("MissingName", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+}
+
+TEST(DepExtractor, NameRefVolatileBodyPropagates) {
+  Workbook wb = Workbook::create();
+  // RandName -> =RAND(). =RandName must propagate volatility.
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"RandName", "=RAND()", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("RandName", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_TRUE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+}
+
+TEST(DepExtractor, QualifiedBuiltinNameBodyHasNoCellDependencies) {
+  Workbook wb = Workbook::create();
+  wb.set_defined_names({
+      DefinedName{"SUM", "LAMBDA(x,x+100)", 0, false, ""},
+      DefinedName{"Region", "Sheet1!SUM(A2)", -1, false, ""},
+  });
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Region", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+}
+
+TEST(DepExtractor, NamedLambdaBodyCellsAndVolatilityAreExpandedOnce) {
+  Workbook wb = Workbook::create();
+  wb.set_defined_names({DefinedName{"Named", "LAMBDA(x,x+A1+RAND())", -1, false, ""}});
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Named(5)", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_TRUE(deps.is_volatile);
+  ASSERT_EQ(deps.cell_deps.size(), 1U);
+  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));  // A1
+}
+
+TEST(DepExtractor, NamedLambdaParameterShadowsDefinedName) {
+  Workbook wb = Workbook::create();
+  wb.set_defined_names({
+      DefinedName{"x", "B1", -1, false, ""},
+      DefinedName{"F", "LAMBDA(x,x+A1)", -1, false, ""},
+  });
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("F(5)", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  ASSERT_EQ(deps.cell_deps.size(), 1U);
+  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));  // A1, not x -> B1
+}
+
+TEST(DepExtractor, NamedLambdaDoesNotInheritCallerLetScope) {
+  Workbook wb = Workbook::create();
+  wb.set_defined_names({
+      DefinedName{"x", "B1", -1, false, ""},
+      DefinedName{"F", "LAMBDA(y,y+x)", -1, false, ""},
+  });
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("LET(x,A1,F(1)+x)", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  std::vector<CellNodeId> expected = {
+      CellNodeId{0U, 0U, 0U},  // LET initializer A1, read through x
+      CellNodeId{0U, 0U, 1U},  // defined x -> B1 inside F
+  };
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, NamedLambdaRecursiveBodyIsFinite) {
+  Workbook wb = Workbook::create();
+  wb.set_defined_names({DefinedName{"Fact", "LAMBDA(n,IF(n<=1,1,n*Fact(n-1)+A1))", -1, false, ""}});
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Fact(5)", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  ASSERT_EQ(deps.cell_deps.size(), 1U);
+  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));  // A1, one body expansion
+}
+
+TEST(DepExtractor, LetBoundLambdaBodyIsExpandedOnCall) {
+  Workbook wb = Workbook::create();
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("LET(f,LAMBDA(x,A1+x),f(1))", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  ASSERT_EQ(deps.cell_deps.size(), 1U);
+  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));  // A1 in invoked body
+}
+
+TEST(DepExtractor, NamedLambdaExpansionRestoresCallerLetBindings) {
+  Workbook wb = Workbook::create();
+  wb.set_defined_names({DefinedName{"Named", "LAMBDA(x,x+A1)", -1, false, ""}});
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("LET(f,LAMBDA(x,B1+x),Named(1)+f(2))", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  std::vector<CellNodeId> expected = {
+      CellNodeId{0U, 0U, 0U},  // Named body A1
+      CellNodeId{0U, 0U, 1U},  // caller LET lambda body B1
+  };
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, LambdaNamesShadowBuiltinVolatility) {
+  Workbook wb = Workbook::create();
+  wb.set_defined_names({DefinedName{"NOW", "LAMBDA(x,x+1)", -1, false, ""}});
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("LET(RAND,LAMBDA(x,x),NOW(1)+RAND(2))", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+}
+
+TEST(DepExtractor, NameRefCaseInsensitive) {
+  Workbook wb = Workbook::create();
+  // Defined name authored as `Foo`; the formula references `foo` (lowercase).
+  // Excel resolves names case-insensitively, so the walker must match.
+  std::vector<DefinedName> names;
+  names.push_back(DefinedName{"Foo", "=A1", -1, false, ""});
+  wb.set_defined_names(std::move(names));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("foo+1", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  ASSERT_EQ(deps.cell_deps.size(), 1u);
+  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));
+}
+
+}  // namespace
+}  // namespace formulon::eval
diff --git a/tests/unit/eval/dep_extractor_structured_refs_test.cpp b/tests/unit/eval/dep_extractor_structured_refs_test.cpp
new file mode 100644
index 000000000..faa81c0f7
--- /dev/null
+++ b/tests/unit/eval/dep_extractor_structured_refs_test.cpp
@@ -0,0 +1,294 @@
+// Dependency extractor tests grouped by dependency source.
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "defined_name.h"
+#include "dep_extractor_test_helpers.h"
+#include "eval/dep_extractor.h"
+#include "table.h"
+#include "utils/resource_budget.h"
+#include "workbook.h"
+
+namespace formulon::eval {
+namespace {
+using namespace dep_extractor_test_helpers;
+
+TableMetadata MakeTable(std::string name, std::string ref, std::size_t sheet_index, bool header_row, bool totals_row,
+                        std::vector<std::string> column_names) {
+  TableMetadata t;
+  t.id = 1;
+  t.name = name;
+  t.display_name = std::move(name);
+  t.ref = std::move(ref);
+  t.sheet_index = sheet_index;
+  t.header_row = header_row;
+  t.totals_row = totals_row;
+  t.columns.reserve(column_names.size());
+  std::uint32_t next_id = 1;
+  for (auto& cname : column_names) {
+    TableColumn col;
+    col.id = next_id++;
+    col.name = std::move(cname);
+    t.columns.push_back(std::move(col));
+  }
+  return t;
+}
+
+TEST(DepExtractor, StructuredRefDefaultModifierFlattensDataColumn) {
+  Workbook wb = Workbook::create();
+  // Sales table at A1:C10 with header, no totals, columns Region/Amount/Date.
+  // SUM(Sales[Amount]) defaults to the kData area on column 1 (Amount), so
+  // deps must be B2..B10.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(Sales[Amount])", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, /*current_sheet_id=*/0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+
+  std::vector<CellNodeId> expected;
+  for (std::uint32_t r = 1; r <= 9; ++r) {
+    expected.push_back(CellNodeId{0U, r, 1U});  // B2..B10
+  }
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, StructuredRefAboveLimitUsesCompactRangeDependency) {
+  Workbook wb = Workbook::create();
+  // A table column is as tall as the table, so the structured-ref path needs
+  // the same graph-footprint ceiling the RangeOp path has: the data area of
+  // this column is 4,000 cells.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C4001", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(Sales[Amount])", arena);
+  ASSERT_NE(root, nullptr);
+  const ExtractedDeps deps = extract_deps(*root, /*current_sheet_id=*/0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+  ASSERT_EQ(deps.range_deps.size(), 1U);
+  EXPECT_EQ(deps.range_deps[0].sheet_id, 0U);
+  EXPECT_EQ(deps.range_deps[0].row_first, 1U);
+  EXPECT_EQ(deps.range_deps[0].row_last, 4000U);
+  EXPECT_EQ(deps.range_deps[0].col_first, 1U);
+  EXPECT_EQ(deps.range_deps[0].col_last, 1U);
+}
+
+TEST(DepExtractor, StructuredRefDataExcludesTotalsRow) {
+  Workbook wb = Workbook::create();
+  // Same table, now with a totals row. kData must skip both header (row 0)
+  // and totals (row 9), so deps are B2..B9.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/true,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(Sales[Amount])", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+
+  std::vector<CellNodeId> expected;
+  for (std::uint32_t r = 1; r <= 8; ++r) {
+    expected.push_back(CellNodeId{0U, r, 1U});  // B2..B9
+  }
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, StructuredRefHeadersOnly) {
+  Workbook wb = Workbook::create();
+  // Sales[#Headers] -> A1..C1.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Sales[#Headers]", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+
+  std::vector<CellNodeId> expected = {
+      CellNodeId{0U, 0U, 0U},  // A1
+      CellNodeId{0U, 0U, 1U},  // B1
+      CellNodeId{0U, 0U, 2U},  // C1
+  };
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, StructuredRefTotalsOnly) {
+  Workbook wb = Workbook::create();
+  // Table with totals. Sales[#Totals] -> last row of `ref`, i.e. A10..C10.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/true,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Sales[#Totals]", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+
+  std::vector<CellNodeId> expected = {
+      CellNodeId{0U, 9U, 0U},  // A10
+      CellNodeId{0U, 9U, 1U},  // B10
+      CellNodeId{0U, 9U, 2U},  // C10
+  };
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, StructuredRefAllCoversFullRectangle) {
+  Workbook wb = Workbook::create();
+  // Sales[#All] -> every row in the ref rect (A1..C10).
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Sales[#All]", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+
+  std::vector<CellNodeId> expected;
+  for (std::uint32_t r = 0; r < 10; ++r) {
+    for (std::uint32_t c = 0; c < 3; ++c) {
+      expected.push_back(CellNodeId{0U, r, c});
+    }
+  }
+  EXPECT_EQ(deps.cell_deps.size(), expected.size());
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, StructuredRefAllAreaWithSpecificColumn) {
+  Workbook wb = Workbook::create();
+  // Sales[[#All],[Amount]] -> column 1 (Amount) across every row of the ref
+  // rectangle, including header. Excel emits the bracket payload as
+  // `[#All],[Amount]` so the parser stores that verbatim.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Sales[[#All],[Amount]]", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+
+  std::vector<CellNodeId> expected;
+  for (std::uint32_t r = 0; r < 10; ++r) {
+    expected.push_back(CellNodeId{0U, r, 1U});  // B1..B10
+  }
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+}
+
+TEST(DepExtractor, StructuredRefImplicitIntersectionSilentSkip) {
+  Workbook wb = Workbook::create();
+  // Sales[@Amount] resolves at evaluator time to a single cell on the
+  // formula's row. The dep extractor cannot know the formula's row, so
+  // it silently skips — the evaluator surfaces the actual dep when the
+  // implicit intersection resolves at eval time.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Sales[@Amount]", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+}
+
+TEST(DepExtractor, StructuredRefUnknownTableSilentSkip) {
+  Workbook wb = Workbook::create();
+  // No tables registered: NoSuchTable[Col] cannot resolve and produces
+  // no deps. Same silent-skip policy as unknown sheet qualifiers.
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("NoSuchTable[Col]", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+}
+
+TEST(DepExtractor, StructuredRefUnknownColumnSilentSkip) {
+  Workbook wb = Workbook::create();
+  // Table exists, column does not: silent skip, no deps.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Sales[NotAColumn]", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+}
+
+TEST(DepExtractor, StructuredRefCrossSheetTableLandsOnTableSheet) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");  // index 1
+  wb.add_sheet("Sheet3");  // index 2
+  // Table sits on sheet 2; formula is being analysed for a cell on sheet 0.
+  // Deps must land on sheet 2.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/2, /*header_row=*/true, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("SUM(Sales[Amount])", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, /*current_sheet_id=*/0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+
+  std::vector<CellNodeId> expected;
+  for (std::uint32_t r = 1; r <= 9; ++r) {
+    expected.push_back(CellNodeId{2U, r, 1U});  // Sheet3!B2..B10
+  }
+  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
+  // Defensive: every dep must carry sheet_id == 2.
+  for (const CellNodeId& id : deps.cell_deps) {
+    EXPECT_EQ(id.sheet_id, 2U);
+  }
+}
+
+TEST(DepExtractor, StructuredRefHeadersOnHeaderlessTableSilentSkip) {
+  Workbook wb = Workbook::create();
+  // header_row=false: the table has no header band. Sales[#Headers] is
+  // unresolvable; the resolver returns ErrorCode::Ref and we silent-skip.
+  std::vector<TableMetadata> tables;
+  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/false, /*totals_row=*/false,
+                             {"Region", "Amount", "Date"}));
+  wb.set_tables(std::move(tables));
+
+  Arena arena;
+  const parser::AstNode* root = ParseFormula("Sales[#Headers]", arena);
+  ASSERT_NE(root, nullptr);
+  ExtractedDeps deps = extract_deps(*root, 0U, wb);
+  EXPECT_FALSE(deps.is_volatile);
+  EXPECT_TRUE(deps.cell_deps.empty());
+}
+
+}  // namespace
+}  // namespace formulon::eval
diff --git a/tests/unit/eval/dep_extractor_test.cpp b/tests/unit/eval/dep_extractor_test.cpp
index 9bbc499a4..aa1d3b1b3 100644
--- a/tests/unit/eval/dep_extractor_test.cpp
+++ b/tests/unit/eval/dep_extractor_test.cpp
@@ -1,63 +1,21 @@
-//
-// Unit tests for the AST -> dep-graph adapter. The walker should:
-//   * Resolve plain `Ref` nodes to single CellNodeIds on the bound sheet.
-//   * Flatten Ref:Ref RangeOps into per-cell deps.
-//   * Promote whole-column / whole-row references to volatile status without
-//     enumerating cells.
-//   * Detect Excel volatile functions inside any Call node.
-//   * Resolve sheet-qualified refs against the workbook.
-//   * Resolve `NameRef` against the workbook's defined-name list (sheet-
-//     scoped beats workbook-scoped, case-insensitive, cycles broken
-//     silently, parser failures skipped).
-//   * Resolve `StructuredRef` against the workbook's table metadata,
-//     pinning the resulting rectangle on the table's owning sheet at
-//     extract time. Implicit-intersection (`Table[@Col]`), unknown
-//     tables, and unknown columns silently skip.
-//   * Skip Lambda body silently.
-//   * Descend into LET binding initialisers and the LET body, so refs and
-//     volatile calls inside either surface as deps.
+// Dependency extractor tests grouped by dependency source.
 
 #include "eval/dep_extractor.h"
 
-#include <algorithm>
 #include <cstdint>
 #include <string>
 #include <string_view>
 #include <vector>
 
 #include "defined_name.h"
-#include "eval/dep_graph.h"
-#include "gtest/gtest.h"
-#include "parser/ast.h"
-#include "parser/parser.h"
+#include "dep_extractor_test_helpers.h"
 #include "table.h"
-#include "utils/arena.h"
 #include "utils/resource_budget.h"
 #include "workbook.h"
 
 namespace formulon::eval {
 namespace {
-
-// Parses `source` into the supplied arena and returns the AST root. Asserts
-// that parsing produced a usable tree (the walker assumes a non-null root).
-const parser::AstNode* ParseFormula(std::string_view source, Arena& arena) {
-  parser::Parser parser(source, arena);
-  parser::AstNode* root = parser.parse();
-  EXPECT_NE(root, nullptr);
-  return root;
-}
-
-// Sorts a vector of CellNodeIds by (sheet, row, col) for stable comparison.
-std::vector<CellNodeId> Sorted(std::vector<CellNodeId> v) {
-  std::sort(v.begin(), v.end(), [](CellNodeId a, CellNodeId b) {
-    if (a.sheet_id != b.sheet_id)
-      return a.sheet_id < b.sheet_id;
-    if (a.row != b.row)
-      return a.row < b.row;
-    return a.col < b.col;
-  });
-  return v;
-}
+using namespace dep_extractor_test_helpers;
 
 TEST(DepExtractor, BinaryAddTwoCellRefs) {
   Workbook wb = Workbook::create();
@@ -470,549 +428,6 @@ TEST(DepExtractor, LetNestedLetBodiesAreDescended) {
   EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
 }
 
-// --- Defined-name resolution ------------------------------------------------
-
-TEST(DepExtractor, NameRefWorkbookScopedSingleCell) {
-  Workbook wb = Workbook::create();
-  // MyName -> =A1, workbook-scoped (local_sheet_id = -1).
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"MyName", "=A1", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("MyName+1", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, /*current_sheet_id=*/0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  ASSERT_EQ(deps.cell_deps.size(), 1u);
-  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));
-}
-
-TEST(DepExtractor, NameRefWorkbookScopedRangeFlattens) {
-  Workbook wb = Workbook::create();
-  // MyRange -> =A1:B2, workbook-scoped. SUM(MyRange) should flatten to
-  // {A1, A2, B1, B2}.
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"MyRange", "=A1:B2", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(MyRange)", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  std::vector<CellNodeId> expected = {
-      CellNodeId{0U, 0U, 0U},  // A1
-      CellNodeId{0U, 0U, 1U},  // B1
-      CellNodeId{0U, 1U, 0U},  // A2
-      CellNodeId{0U, 1U, 1U},  // B2
-  };
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, NameRefIndirectionResolves) {
-  Workbook wb = Workbook::create();
-  // Name1 -> =Name2, Name2 -> =A1. =Name1 must surface A1 as a dep.
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"Name1", "=Name2", -1, false, ""});
-  names.push_back(DefinedName{"Name2", "=A1", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Name1", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  ASSERT_EQ(deps.cell_deps.size(), 1u);
-  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));
-}
-
-TEST(DepExtractor, NameRefSheetScopedBeatsWorkbookScoped) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");  // index 1
-  // Foo at workbook scope -> =A1; Foo at sheet 0 -> =B1. From sheet 0 the
-  // sheet-scoped definition wins (B1); from sheet 1 the workbook-scoped
-  // fallback applies (A1 on sheet 1, since unqualified refs resolve to the
-  // current sheet).
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"Foo", "=A1", -1, false, ""});
-  names.push_back(DefinedName{"Foo", "=B1", 0, false, ""});
-  wb.set_defined_names(std::move(names));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Foo", arena);
-  ASSERT_NE(root, nullptr);
-
-  ExtractedDeps from_sheet0 = extract_deps(*root, /*current_sheet_id=*/0U, wb);
-  ASSERT_EQ(from_sheet0.cell_deps.size(), 1u);
-  EXPECT_EQ(from_sheet0.cell_deps[0], (CellNodeId{0U, 0U, 1U}));  // B1 on sheet 0
-
-  ExtractedDeps from_sheet1 = extract_deps(*root, /*current_sheet_id=*/1U, wb);
-  ASSERT_EQ(from_sheet1.cell_deps.size(), 1u);
-  EXPECT_EQ(from_sheet1.cell_deps[0], (CellNodeId{1U, 0U, 0U}));  // A1 on sheet 1
-}
-
-TEST(DepExtractor, NameRefCycleTerminates) {
-  Workbook wb = Workbook::create();
-  // Loop -> =Loop+1 — self-referential. The walker must not infinite-loop;
-  // policy is to break the cycle silently (no deps, no volatility flag).
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"Loop", "=Loop+1", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Loop", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  // The assertion that matters is that the test terminates. Cycle policy:
-  // silent skip on re-entry — no deps, not volatile.
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-}
-
-TEST(DepExtractor, NameRefMissingNameIsSilentSkip) {
-  Workbook wb = Workbook::create();
-  // No defined names registered: =MissingName must not crash and produces
-  // an empty dep set.
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("MissingName", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-}
-
-TEST(DepExtractor, NameRefVolatileBodyPropagates) {
-  Workbook wb = Workbook::create();
-  // RandName -> =RAND(). =RandName must propagate volatility.
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"RandName", "=RAND()", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("RandName", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_TRUE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-}
-
-TEST(DepExtractor, NamedLambdaBodyCellsAndVolatilityAreExpandedOnce) {
-  Workbook wb = Workbook::create();
-  wb.set_defined_names({DefinedName{"Named", "LAMBDA(x,x+A1+RAND())", -1, false, ""}});
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Named(5)", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_TRUE(deps.is_volatile);
-  ASSERT_EQ(deps.cell_deps.size(), 1U);
-  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));  // A1
-}
-
-TEST(DepExtractor, ThreeDSpanMetadataIsNormalizedAndDeduplicatedAcrossExpansion) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "First")));
-  wb.add_sheet("Second");
-  wb.add_sheet("Third");
-  wb.set_defined_names({
-      DefinedName{"Inner", "First:Second!A1:A3", -1, false, ""},
-      DefinedName{"Outer", "Inner", -1, false, ""},
-      DefinedName{"F", "LAMBDA(x,SUM(Outer)+x)", -1, false, ""},
-  });
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(First:Second!A1:A3)+SUM(Second:First!A1:A3)+SUM(Outer)+F(0)", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-
-  ASSERT_EQ(deps.three_d_spans.size(), 1U);
-  EXPECT_EQ(deps.three_d_spans[0], (ThreeDSheetSpanDependency{0U, 1U}));
-}
-
-TEST(DepExtractor, ThreeDSpanMetadataIncludesWholeAxisReferences) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.rename_sheet(0, "First")));
-  wb.add_sheet("Second");
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(First:Second!A:A)+SUM(First:Second!1:1)", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-
-  ASSERT_EQ(deps.three_d_spans.size(), 1U);
-  EXPECT_EQ(deps.three_d_spans[0], (ThreeDSheetSpanDependency{0U, 1U}));
-}
-
-TEST(DepExtractor, NamedLambdaParameterShadowsDefinedName) {
-  Workbook wb = Workbook::create();
-  wb.set_defined_names({
-      DefinedName{"x", "B1", -1, false, ""},
-      DefinedName{"F", "LAMBDA(x,x+A1)", -1, false, ""},
-  });
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("F(5)", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  ASSERT_EQ(deps.cell_deps.size(), 1U);
-  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));  // A1, not x -> B1
-}
-
-TEST(DepExtractor, NamedLambdaDoesNotInheritCallerLetScope) {
-  Workbook wb = Workbook::create();
-  wb.set_defined_names({
-      DefinedName{"x", "B1", -1, false, ""},
-      DefinedName{"F", "LAMBDA(y,y+x)", -1, false, ""},
-  });
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("LET(x,A1,F(1)+x)", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  std::vector<CellNodeId> expected = {
-      CellNodeId{0U, 0U, 0U},  // LET initializer A1, read through x
-      CellNodeId{0U, 0U, 1U},  // defined x -> B1 inside F
-  };
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, NamedLambdaRecursiveBodyIsFinite) {
-  Workbook wb = Workbook::create();
-  wb.set_defined_names({DefinedName{"Fact", "LAMBDA(n,IF(n<=1,1,n*Fact(n-1)+A1))", -1, false, ""}});
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Fact(5)", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  ASSERT_EQ(deps.cell_deps.size(), 1U);
-  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));  // A1, one body expansion
-}
-
-TEST(DepExtractor, LetBoundLambdaBodyIsExpandedOnCall) {
-  Workbook wb = Workbook::create();
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("LET(f,LAMBDA(x,A1+x),f(1))", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  ASSERT_EQ(deps.cell_deps.size(), 1U);
-  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));  // A1 in invoked body
-}
-
-TEST(DepExtractor, NamedLambdaExpansionRestoresCallerLetBindings) {
-  Workbook wb = Workbook::create();
-  wb.set_defined_names({DefinedName{"Named", "LAMBDA(x,x+A1)", -1, false, ""}});
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("LET(f,LAMBDA(x,B1+x),Named(1)+f(2))", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  std::vector<CellNodeId> expected = {
-      CellNodeId{0U, 0U, 0U},  // Named body A1
-      CellNodeId{0U, 0U, 1U},  // caller LET lambda body B1
-  };
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, LambdaNamesShadowBuiltinVolatility) {
-  Workbook wb = Workbook::create();
-  wb.set_defined_names({DefinedName{"NOW", "LAMBDA(x,x+1)", -1, false, ""}});
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("LET(RAND,LAMBDA(x,x),NOW(1)+RAND(2))", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-}
-
-TEST(DepExtractor, NameRefCaseInsensitive) {
-  Workbook wb = Workbook::create();
-  // Defined name authored as `Foo`; the formula references `foo` (lowercase).
-  // Excel resolves names case-insensitively, so the walker must match.
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"Foo", "=A1", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("foo+1", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  ASSERT_EQ(deps.cell_deps.size(), 1u);
-  EXPECT_EQ(deps.cell_deps[0], (CellNodeId{0U, 0U, 0U}));
-}
-
-// --- Structured (table) references ------------------------------------------
-
-// Builds a `TableMetadata` with `display_name == name` and the given column
-// names. `ref` is the raw A1 footprint including header and totals rows.
-TableMetadata MakeTable(std::string name, std::string ref, std::size_t sheet_index, bool header_row, bool totals_row,
-                        std::vector<std::string> column_names) {
-  TableMetadata t;
-  t.id = 1;
-  t.name = name;
-  t.display_name = std::move(name);
-  t.ref = std::move(ref);
-  t.sheet_index = sheet_index;
-  t.header_row = header_row;
-  t.totals_row = totals_row;
-  t.columns.reserve(column_names.size());
-  std::uint32_t next_id = 1;
-  for (auto& cname : column_names) {
-    TableColumn col;
-    col.id = next_id++;
-    col.name = std::move(cname);
-    t.columns.push_back(std::move(col));
-  }
-  return t;
-}
-
-TEST(DepExtractor, StructuredRefDefaultModifierFlattensDataColumn) {
-  Workbook wb = Workbook::create();
-  // Sales table at A1:C10 with header, no totals, columns Region/Amount/Date.
-  // SUM(Sales[Amount]) defaults to the kData area on column 1 (Amount), so
-  // deps must be B2..B10.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(Sales[Amount])", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, /*current_sheet_id=*/0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-
-  std::vector<CellNodeId> expected;
-  for (std::uint32_t r = 1; r <= 9; ++r) {
-    expected.push_back(CellNodeId{0U, r, 1U});  // B2..B10
-  }
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, StructuredRefAboveLimitUsesCompactRangeDependency) {
-  Workbook wb = Workbook::create();
-  // A table column is as tall as the table, so the structured-ref path needs
-  // the same graph-footprint ceiling the RangeOp path has: the data area of
-  // this column is 4,000 cells.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C4001", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(Sales[Amount])", arena);
-  ASSERT_NE(root, nullptr);
-  const ExtractedDeps deps = extract_deps(*root, /*current_sheet_id=*/0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-  ASSERT_EQ(deps.range_deps.size(), 1U);
-  EXPECT_EQ(deps.range_deps[0].sheet_id, 0U);
-  EXPECT_EQ(deps.range_deps[0].row_first, 1U);
-  EXPECT_EQ(deps.range_deps[0].row_last, 4000U);
-  EXPECT_EQ(deps.range_deps[0].col_first, 1U);
-  EXPECT_EQ(deps.range_deps[0].col_last, 1U);
-}
-
-TEST(DepExtractor, StructuredRefDataExcludesTotalsRow) {
-  Workbook wb = Workbook::create();
-  // Same table, now with a totals row. kData must skip both header (row 0)
-  // and totals (row 9), so deps are B2..B9.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/true,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(Sales[Amount])", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-
-  std::vector<CellNodeId> expected;
-  for (std::uint32_t r = 1; r <= 8; ++r) {
-    expected.push_back(CellNodeId{0U, r, 1U});  // B2..B9
-  }
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, StructuredRefHeadersOnly) {
-  Workbook wb = Workbook::create();
-  // Sales[#Headers] -> A1..C1.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Sales[#Headers]", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-
-  std::vector<CellNodeId> expected = {
-      CellNodeId{0U, 0U, 0U},  // A1
-      CellNodeId{0U, 0U, 1U},  // B1
-      CellNodeId{0U, 0U, 2U},  // C1
-  };
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, StructuredRefTotalsOnly) {
-  Workbook wb = Workbook::create();
-  // Table with totals. Sales[#Totals] -> last row of `ref`, i.e. A10..C10.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/true,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Sales[#Totals]", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-
-  std::vector<CellNodeId> expected = {
-      CellNodeId{0U, 9U, 0U},  // A10
-      CellNodeId{0U, 9U, 1U},  // B10
-      CellNodeId{0U, 9U, 2U},  // C10
-  };
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, StructuredRefAllCoversFullRectangle) {
-  Workbook wb = Workbook::create();
-  // Sales[#All] -> every row in the ref rect (A1..C10).
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Sales[#All]", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-
-  std::vector<CellNodeId> expected;
-  for (std::uint32_t r = 0; r < 10; ++r) {
-    for (std::uint32_t c = 0; c < 3; ++c) {
-      expected.push_back(CellNodeId{0U, r, c});
-    }
-  }
-  EXPECT_EQ(deps.cell_deps.size(), expected.size());
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, StructuredRefAllAreaWithSpecificColumn) {
-  Workbook wb = Workbook::create();
-  // Sales[[#All],[Amount]] -> column 1 (Amount) across every row of the ref
-  // rectangle, including header. Excel emits the bracket payload as
-  // `[#All],[Amount]` so the parser stores that verbatim.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Sales[[#All],[Amount]]", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-
-  std::vector<CellNodeId> expected;
-  for (std::uint32_t r = 0; r < 10; ++r) {
-    expected.push_back(CellNodeId{0U, r, 1U});  // B1..B10
-  }
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, StructuredRefImplicitIntersectionSilentSkip) {
-  Workbook wb = Workbook::create();
-  // Sales[@Amount] resolves at evaluator time to a single cell on the
-  // formula's row. The dep extractor cannot know the formula's row, so
-  // it silently skips — the evaluator surfaces the actual dep when the
-  // implicit intersection resolves at eval time.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Sales[@Amount]", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-}
-
-TEST(DepExtractor, StructuredRefUnknownTableSilentSkip) {
-  Workbook wb = Workbook::create();
-  // No tables registered: NoSuchTable[Col] cannot resolve and produces
-  // no deps. Same silent-skip policy as unknown sheet qualifiers.
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("NoSuchTable[Col]", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-}
-
-TEST(DepExtractor, StructuredRefUnknownColumnSilentSkip) {
-  Workbook wb = Workbook::create();
-  // Table exists, column does not: silent skip, no deps.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/true, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Sales[NotAColumn]", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-}
-
-TEST(DepExtractor, StructuredRefCrossSheetTableLandsOnTableSheet) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");  // index 1
-  wb.add_sheet("Sheet3");  // index 2
-  // Table sits on sheet 2; formula is being analysed for a cell on sheet 0.
-  // Deps must land on sheet 2.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/2, /*header_row=*/true, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(Sales[Amount])", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, /*current_sheet_id=*/0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-
-  std::vector<CellNodeId> expected;
-  for (std::uint32_t r = 1; r <= 9; ++r) {
-    expected.push_back(CellNodeId{2U, r, 1U});  // Sheet3!B2..B10
-  }
-  EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
-  // Defensive: every dep must carry sheet_id == 2.
-  for (const CellNodeId& id : deps.cell_deps) {
-    EXPECT_EQ(id.sheet_id, 2U);
-  }
-}
-
-TEST(DepExtractor, StructuredRefHeadersOnHeaderlessTableSilentSkip) {
-  Workbook wb = Workbook::create();
-  // header_row=false: the table has no header band. Sales[#Headers] is
-  // unresolvable; the resolver returns ErrorCode::Ref and we silent-skip.
-  std::vector<TableMetadata> tables;
-  tables.push_back(MakeTable("Sales", "A1:C10", /*sheet_index=*/0, /*header_row=*/false, /*totals_row=*/false,
-                             {"Region", "Amount", "Date"}));
-  wb.set_tables(std::move(tables));
-
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("Sales[#Headers]", arena);
-  ASSERT_NE(root, nullptr);
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-}
-
 TEST(DepExtractor, RangeAcrossSheetQualifierOnLeft) {
   Workbook wb = Workbook::create();
   wb.add_sheet("Sheet2");  // index 1
@@ -1032,243 +447,5 @@ TEST(DepExtractor, RangeAcrossSheetQualifierOnLeft) {
   EXPECT_EQ(Sorted(deps.cell_deps), Sorted(expected));
 }
 
-TEST(DepExtractor, ThreeDFullColumnUsesCompactRangeDependencies) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");
-  wb.add_sheet("Sheet3");
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(Sheet1:Sheet3!A:A)", arena);
-  ASSERT_NE(root, nullptr);
-
-  ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-  ASSERT_EQ(deps.range_deps.size(), 3U);
-  for (std::size_t i = 0; i < deps.range_deps.size(); ++i) {
-    EXPECT_EQ(deps.range_deps[i].sheet_id, i);
-    EXPECT_EQ(deps.range_deps[i].row_last, Sheet::kMaxRows - 1U);
-    EXPECT_EQ(deps.range_deps[i].col_first, 0U);
-    EXPECT_EQ(deps.range_deps[i].col_last, 0U);
-  }
-}
-
-TEST(DepExtractor, ThreeDRangeAboveLimitUsesCompactRangeDependencyPerSheet) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");
-  wb.add_sheet("Sheet3");
-  Arena arena;
-  // The shared rectangle is read once per sheet in the span, so the ceiling
-  // is applied before the span multiplies the cost: 3 x 2,000 cells would be
-  // 6,000 permanent edges from one formula.
-  const parser::AstNode* root = ParseFormula("SUM(Sheet1:Sheet3!A1:B1000)", arena);
-  ASSERT_NE(root, nullptr);
-
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  EXPECT_FALSE(deps.is_volatile);
-  EXPECT_TRUE(deps.cell_deps.empty());
-  ASSERT_EQ(deps.range_deps.size(), 3U);
-  for (std::size_t sheet = 0; sheet < deps.range_deps.size(); ++sheet) {
-    EXPECT_EQ(deps.range_deps[sheet].sheet_id, sheet);
-    EXPECT_EQ(deps.range_deps[sheet].row_first, 0U);
-    EXPECT_EQ(deps.range_deps[sheet].row_last, 999U);
-    EXPECT_EQ(deps.range_deps[sheet].col_first, 0U);
-    EXPECT_EQ(deps.range_deps[sheet].col_last, 1U);
-  }
-}
-
-TEST(DepExtractor, ThreeDWholeAxisSpansPreserveBothAxes) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");
-  wb.add_sheet("Sheet3");
-  Arena arena;
-  const parser::AstNode* root = ParseFormula("SUM(Sheet1:Sheet3!A:C)+SUM(Sheet1:Sheet3!1:3)", arena);
-  ASSERT_NE(root, nullptr);
-
-  const ExtractedDeps deps = extract_deps(*root, 0U, wb);
-  ASSERT_EQ(deps.range_deps.size(), 6U);
-  for (std::size_t sheet = 0; sheet < 3U; ++sheet) {
-    const CellRangeDependency& columns = deps.range_deps[sheet];
-    EXPECT_EQ(columns.sheet_id, sheet);
-    EXPECT_EQ(columns.row_first, 0U);
-    EXPECT_EQ(columns.row_last, Sheet::kMaxRows - 1U);
-    EXPECT_EQ(columns.col_first, 0U);
-    EXPECT_EQ(columns.col_last, 2U);
-
-    const CellRangeDependency& rows = deps.range_deps[3U + sheet];
-    EXPECT_EQ(rows.sheet_id, sheet);
-    EXPECT_EQ(rows.row_first, 0U);
-    EXPECT_EQ(rows.row_last, 2U);
-    EXPECT_EQ(rows.col_first, 0U);
-    EXPECT_EQ(rows.col_last, Sheet::kMaxCols - 1U);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// `:` over a reference-returning endpoint registers the box it can read
-// ---------------------------------------------------------------------------
-
-std::vector<CellNodeId> RectCells(std::uint16_t sheet, std::uint32_t r0, std::uint32_t r1, std::uint32_t c0,
-                                  std::uint32_t c1) {
-  std::vector<CellNodeId> out;
-  for (std::uint32_t r = r0; r <= r1; ++r) {
-    for (std::uint32_t c = c0; c <= c1; ++c) {
-      out.push_back(CellNodeId{sheet, r, c});
-    }
-  }
-  return out;
-}
-
-ExtractedDeps ExtractFrom(std::string_view source, const Workbook& wb) {
-  Arena arena;
-  const parser::AstNode* root = ParseFormula(source, arena);
-  EXPECT_NE(root, nullptr);
-  return root == nullptr ? ExtractedDeps{} : extract_deps(*root, 0U, wb);
-}
-
-bool HasRangeDep(const ExtractedDeps& deps, CellRangeDependency want) {
-  return std::any_of(deps.range_deps.begin(), deps.range_deps.end(), [&](const CellRangeDependency& d) {
-    return d.sheet_id == want.sheet_id && d.row_first == want.row_first && d.row_last == want.row_last &&
-           d.col_first == want.col_first && d.col_last == want.col_last;
-  });
-}
-
-TEST(DepExtractor, DynamicEndpointInsideSourceAddsNothing) {
-  const Workbook wb = Workbook::create();
-  const ExtractedDeps deps = ExtractFrom("SUM(A1:INDEX(A1:A10,3))", wb);
-  EXPECT_EQ(Sorted(deps.cell_deps), RectCells(0U, 0U, 9U, 0U, 0U));
-  EXPECT_TRUE(deps.range_deps.empty());
-}
-
-TEST(DepExtractor, DynamicEndpointRegistersBoundingBox) {
-  const Workbook wb = Workbook::create();
-  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:INDEX(C1:C10,3))", wb).cell_deps), RectCells(0U, 0U, 9U, 0U, 2U));
-  EXPECT_EQ(Sorted(ExtractFrom("SUM(INDEX(A1:A10,2):INDEX(C1:C10,3))", wb).cell_deps), RectCells(0U, 0U, 9U, 0U, 2U));
-  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:CHOOSE(2,B1,D5))", wb).cell_deps), RectCells(0U, 0U, 4U, 0U, 3U));
-}
-
-TEST(DepExtractor, ChainedRangeRegistersBoundingBox) {
-  const Workbook wb = Workbook::create();
-  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:B2:C3)", wb).cell_deps), RectCells(0U, 0U, 2U, 0U, 2U));
-}
-
-TEST(DepExtractor, DynamicEndpointOverWholeColumnStaysCompact) {
-  const Workbook wb = Workbook::create();
-  const ExtractedDeps deps = ExtractFrom("SUM(A1:INDEX(C:C,5))", wb);
-  EXPECT_TRUE(HasRangeDep(deps, CellRangeDependency{0U, 0U, Sheet::kMaxRows - 1U, 0U, 2U}));
-  EXPECT_LE(deps.cell_deps.size(), 1U);
-}
-
-TEST(DepExtractor, DynamicEndpointConditionStaysAPlainCell) {
-  const Workbook wb = Workbook::create();
-  std::vector<CellNodeId> expected = RectCells(0U, 0U, 4U, 0U, 3U);
-  expected.push_back(CellNodeId{0U, 0U, 25U});  // Z1
-  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:IF(Z1>0,B5,D5))", wb).cell_deps), Sorted(expected));
-}
-
-TEST(DepExtractor, OffsetEndpointKeepsDynamicReference) {
-  const Workbook wb = Workbook::create();
-  const ExtractedDeps deps = ExtractFrom("SUM(A1:OFFSET(A1,2,2))", wb);
-  EXPECT_EQ(Sorted(deps.cell_deps), (std::vector<CellNodeId>{CellNodeId{0U, 0U, 0U}}));
-  EXPECT_TRUE(deps.range_deps.empty());
-  EXPECT_TRUE(deps.has_dynamic_reference);
-}
-
-TEST(DepExtractor, OffsetBaseIsNoRead) {
-  // OFFSET's base only positions the rectangle it returns: `=OFFSET(D2,-1,0)`
-  // in D2 reads D1, not D2, and is not circular (measured on Excel 365).
-  // A reference-returning base only positions what it can return, so
-  // `=OFFSET(INDEX(A1:A10,3),1,0)` in A3 is not circular either; the offsets
-  // and the base's other arguments are still read.
-  const Workbook wb = Workbook::create();
-  const ExtractedDeps plain = ExtractFrom("OFFSET(A1,1,1)", wb);
-  EXPECT_TRUE(plain.is_volatile);
-  EXPECT_TRUE(plain.has_dynamic_reference);
-  EXPECT_TRUE(plain.cell_deps.empty());
-  EXPECT_EQ(Sorted(ExtractFrom("OFFSET(A1,B1,1)", wb).cell_deps), (std::vector<CellNodeId>{CellNodeId{0U, 0U, 1U}}));
-  EXPECT_TRUE(ExtractFrom("OFFSET(INDEX(A1:A10,3),1,0)", wb).cell_deps.empty());
-  EXPECT_EQ(Sorted(ExtractFrom("OFFSET(INDEX(A1:A10,B1),1,0)", wb).cell_deps),
-            (std::vector<CellNodeId>{CellNodeId{0U, 0U, 1U}}));
-}
-
-TEST(DepExtractor, DynamicEndpointThroughLetBinding) {
-  const Workbook wb = Workbook::create();
-  EXPECT_EQ(Sorted(ExtractFrom("LET(r,C1:C10,SUM(A1:INDEX(r,3)))", wb).cell_deps), RectCells(0U, 0U, 9U, 0U, 2U));
-}
-
-TEST(DepExtractor, DynamicEndpointThroughDefinedName) {
-  Workbook wb = Workbook::create();
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"Rng", "=Sheet1!$C$1:$C$10", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:INDEX(Rng,3))", wb).cell_deps), RectCells(0U, 0U, 9U, 0U, 2U));
-}
-
-TEST(DepExtractor, DefinedNameEndpointRegistersBoundingBox) {
-  // `A1:CellNm` reads A1:C3, including B2 which neither endpoint names.
-  Workbook wb = Workbook::create();
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"CellNm", "=Sheet1!$C$3", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-  const std::vector<CellNodeId> deps = Sorted(ExtractFrom("SUM(A1:CellNm)", wb).cell_deps);
-  EXPECT_EQ(deps, RectCells(0U, 0U, 2U, 0U, 2U));
-}
-
-TEST(DepExtractor, SelfBookNameReadsTheWorkbookScopedDefinition) {
-  // `[0]!G` reads the workbook-scoped G (B2), never Sheet1's local G (C3).
-  Workbook wb = Workbook::create();
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"G", "=Sheet1!$C$3", 0, false, ""});
-  names.push_back(DefinedName{"G", "=Sheet1!$B$2", -1, false, ""});
-  names.push_back(DefinedName{"Rng", "=Sheet1!$A$10:$A$11", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-  EXPECT_EQ(Sorted(ExtractFrom("[0]!G", wb).cell_deps), RectCells(0U, 1U, 1U, 1U, 1U));
-  EXPECT_EQ(Sorted(ExtractFrom("SUM([0]!Rng)", wb).cell_deps), RectCells(0U, 9U, 10U, 0U, 0U));
-  EXPECT_EQ(Sorted(ExtractFrom("SUM(A1:[0]!G)", wb).cell_deps), RectCells(0U, 0U, 1U, 0U, 1U));
-}
-
-TEST(DepExtractor, DynamicEndpointOnAnotherSheet) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");
-  EXPECT_EQ(Sorted(ExtractFrom("SUM(Sheet2!A1:INDEX(Sheet2!C1:C3,2))", wb).cell_deps), RectCells(1U, 0U, 2U, 0U, 2U));
-}
-
-// ---------------------------------------------------------------------------
-// Reference-only arguments read no values
-// ---------------------------------------------------------------------------
-
-TEST(DepExtractor, ReferenceOnlyArgumentsRegisterNothing) {
-  const Workbook wb = Workbook::create();
-  for (const char* src :
-       {"ROWS(A:A)", "ROW(A1)", "COLUMNS(1:1)", "ROWS(A1:C3)", "ISREF(A1)", "COLUMN(A1:B2:C3)", "AREAS((A1,B2:C3))"}) {
-    const ExtractedDeps deps = ExtractFrom(src, wb);
-    EXPECT_TRUE(deps.cell_deps.empty()) << src;
-    EXPECT_TRUE(deps.range_deps.empty()) << src;
-  }
-}
-
-TEST(DepExtractor, ReferenceOnlyArgumentThroughDefinedName) {
-  Workbook wb = Workbook::create();
-  std::vector<DefinedName> names;
-  names.push_back(DefinedName{"Rng", "=Sheet1!$C$1:$C$10", -1, false, ""});
-  wb.set_defined_names(std::move(names));
-  const ExtractedDeps deps = ExtractFrom("ROWS(Rng)", wb);
-  EXPECT_TRUE(deps.cell_deps.empty());
-  EXPECT_TRUE(deps.range_deps.empty());
-}
-
-TEST(DepExtractor, ReferenceOnlyCallStillWalksComputedArguments) {
-  const Workbook wb = Workbook::create();
-  // A spill's extent is read from its anchor.
-  EXPECT_EQ(ExtractFrom("ROWS(A1#)", wb).cell_deps, (std::vector<CellNodeId>{CellNodeId{0U, 0U, 0U}}));
-  // INDEX reads B1 to pick the row.
-  const std::vector<CellNodeId> index_deps = ExtractFrom("ROW(INDEX(A1:A10,B1))", wb).cell_deps;
-  EXPECT_NE(std::find(index_deps.begin(), index_deps.end(), CellNodeId{0U, 0U, 1U}), index_deps.end());
-}
-
-TEST(DepExtractor, ShadowedReferenceOnlyNameKeepsItsArgument) {
-  const Workbook wb = Workbook::create();
-  EXPECT_EQ(Sorted(ExtractFrom("LET(rows,LAMBDA(x,x),rows(A1:A3))", wb).cell_deps), RectCells(0U, 0U, 2U, 0U, 0U));
-}
-
 }  // namespace
 }  // namespace formulon::eval
diff --git a/tests/unit/eval/dep_extractor_test_helpers.h b/tests/unit/eval/dep_extractor_test_helpers.h
new file mode 100644
index 000000000..84930190f
--- /dev/null
+++ b/tests/unit/eval/dep_extractor_test_helpers.h
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <algorithm>
+#include <string_view>
+#include <vector>
+
+#include "eval/dep_graph.h"
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "utils/arena.h"
+
+namespace formulon::eval::dep_extractor_test_helpers {
+
+inline const parser::AstNode* ParseFormula(std::string_view source, Arena& arena) {
+  parser::Parser parser(source, arena);
+  parser::AstNode* root = parser.parse();
+  EXPECT_NE(root, nullptr);
+  return root;
+}
+
+inline std::vector<CellNodeId> Sorted(std::vector<CellNodeId> v) {
+  std::sort(v.begin(), v.end(), [](CellNodeId a, CellNodeId b) {
+    if (a.sheet_id != b.sheet_id)
+      return a.sheet_id < b.sheet_id;
+    if (a.row != b.row)
+      return a.row < b.row;
+    return a.col < b.col;
+  });
+  return v;
+}
+
+}  // namespace formulon::eval::dep_extractor_test_helpers
diff --git a/tests/unit/eval/display_text_test.cpp b/tests/unit/eval/display_text_test.cpp
new file mode 100644
index 000000000..c46e651db
--- /dev/null
+++ b/tests/unit/eval/display_text_test.cpp
@@ -0,0 +1,890 @@
+#include "eval/text_format/display_text.h"
+
+#include <string>
+
+#include "gtest/gtest.h"
+#include "value.h"
+
+namespace formulon {
+namespace text_format {
+namespace {
+
+// Expected strings are Mac Excel 16.113.3 (mac-365-ja_JP) `Range.Text`, in a
+// wide column, with the accounting repeat-fill run collapsed to the single
+// space `_ ` emits (width-independent). `#` runs map to the overflow status.
+struct ProbeRow {
+  const char* label;
+  bool date1904;
+  const char* code;
+  Value value;
+  DisplayStatus status;
+  const char* text;
+};
+
+const ProbeRow kProbeRows[] = {
+    {"General/0", false, R"fmt(General)fmt", Value::number(0), DisplayStatus::kOk, "0"},
+    {"General/59", false, R"fmt(General)fmt", Value::number(59), DisplayStatus::kOk, "59"},
+    {"General/60", false, R"fmt(General)fmt", Value::number(60), DisplayStatus::kOk, "60"},
+    {"General/61", false, R"fmt(General)fmt", Value::number(61), DisplayStatus::kOk, "61"},
+    {"General/-1", false, R"fmt(General)fmt", Value::number(-1), DisplayStatus::kOk, "-1"},
+    {"General/2958465", false, R"fmt(General)fmt", Value::number(2958465), DisplayStatus::kOk, "2958465"},
+    {"General/2958466", false, R"fmt(General)fmt", Value::number(2958466), DisplayStatus::kOk, "2958466"},
+    {"General/0.5", false, R"fmt(General)fmt", Value::number(0.5), DisplayStatus::kOk, "0.5"},
+    {"General/1234.5678", false, R"fmt(General)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1234.5678"},
+    {"General/-1234.5678", false, R"fmt(General)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1234.5678"},
+    {"General/1e-05", false, R"fmt(General)fmt", Value::number(1e-05), DisplayStatus::kOk, "0.00001"},
+    {"General/1000000000000000.0", false, R"fmt(General)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1E+15"},
+    {"General/123456789012345678", false, R"fmt(General)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     "1.23457E+17"},
+    {"0.00/0", false, R"fmt(0.00)fmt", Value::number(0), DisplayStatus::kOk, "0.00"},
+    {"0.00/59", false, R"fmt(0.00)fmt", Value::number(59), DisplayStatus::kOk, "59.00"},
+    {"0.00/60", false, R"fmt(0.00)fmt", Value::number(60), DisplayStatus::kOk, "60.00"},
+    {"0.00/61", false, R"fmt(0.00)fmt", Value::number(61), DisplayStatus::kOk, "61.00"},
+    {"0.00/-1", false, R"fmt(0.00)fmt", Value::number(-1), DisplayStatus::kOk, "-1.00"},
+    {"0.00/2958465", false, R"fmt(0.00)fmt", Value::number(2958465), DisplayStatus::kOk, "2958465.00"},
+    {"0.00/2958466", false, R"fmt(0.00)fmt", Value::number(2958466), DisplayStatus::kOk, "2958466.00"},
+    {"0.00/0.5", false, R"fmt(0.00)fmt", Value::number(0.5), DisplayStatus::kOk, "0.50"},
+    {"0.00/1234.5678", false, R"fmt(0.00)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1234.57"},
+    {"0.00/-1234.5678", false, R"fmt(0.00)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1234.57"},
+    {"0.00/1e-05", false, R"fmt(0.00)fmt", Value::number(1e-05), DisplayStatus::kOk, "0.00"},
+    {"0.00/1000000000000000.0", false, R"fmt(0.00)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1000000000000000.00"},
+    {"0.00/123456789012345678", false, R"fmt(0.00)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     "123456789012346000.00"},
+    {"red-neg/0", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(0), DisplayStatus::kOk, "0"},
+    {"red-neg/59", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(59), DisplayStatus::kOk, "59"},
+    {"red-neg/60", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(60), DisplayStatus::kOk, "60"},
+    {"red-neg/61", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(61), DisplayStatus::kOk, "61"},
+    {"red-neg/-1", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(-1), DisplayStatus::kOk, "-1"},
+    {"red-neg/2958465", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(2958465), DisplayStatus::kOk, "2,958,465"},
+    {"red-neg/2958466", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(2958466), DisplayStatus::kOk, "2,958,466"},
+    {"red-neg/0.5", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(0.5), DisplayStatus::kOk, "1"},
+    {"red-neg/1234.5678", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1,235"},
+    {"red-neg/-1234.5678", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(-1234.5678), DisplayStatus::kOk,
+     "-1,235"},
+    {"red-neg/1e-05", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(1e-05), DisplayStatus::kOk, "0"},
+    {"red-neg/1000000000000000.0", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOk, "1,000,000,000,000,000"},
+    {"red-neg/123456789012345678", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOk, "123,456,789,012,346,000"},
+    {"accounting/0", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(0), DisplayStatus::kOk,
+     " - "},
+    {"accounting/59", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(59), DisplayStatus::kOk,
+     " 59 "},
+    {"accounting/60", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(60), DisplayStatus::kOk,
+     " 60 "},
+    {"accounting/61", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(61), DisplayStatus::kOk,
+     " 61 "},
+    {"accounting/-1", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(-1), DisplayStatus::kOk,
+     " -1 "},
+    {"accounting/2958465", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(2958465),
+     DisplayStatus::kOk, " 2,958,465 "},
+    {"accounting/2958466", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(2958466),
+     DisplayStatus::kOk, " 2,958,466 "},
+    {"accounting/0.5", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(0.5),
+     DisplayStatus::kOk, " 1 "},
+    {"accounting/1234.5678", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(1234.5678),
+     DisplayStatus::kOk, " 1,235 "},
+    {"accounting/-1234.5678", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(-1234.5678),
+     DisplayStatus::kOk, " -1,235 "},
+    {"accounting/1e-05", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(1e-05),
+     DisplayStatus::kOk, " 0 "},
+    {"accounting/1000000000000000.0", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt",
+     Value::number(1000000000000000.0), DisplayStatus::kOk, " 1,000,000,000,000,000 "},
+    {"accounting/123456789012345678", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt",
+     Value::number(123456789012345678.0), DisplayStatus::kOk, " 123,456,789,012,346,000 "},
+    {"fraction/0", false, R"fmt(# ?/?)fmt", Value::number(0), DisplayStatus::kOk, "0    "},
+    {"fraction/59", false, R"fmt(# ?/?)fmt", Value::number(59), DisplayStatus::kOk, "59    "},
+    {"fraction/60", false, R"fmt(# ?/?)fmt", Value::number(60), DisplayStatus::kOk, "60    "},
+    {"fraction/61", false, R"fmt(# ?/?)fmt", Value::number(61), DisplayStatus::kOk, "61    "},
+    {"fraction/-1", false, R"fmt(# ?/?)fmt", Value::number(-1), DisplayStatus::kOk, "-1    "},
+    {"fraction/2958465", false, R"fmt(# ?/?)fmt", Value::number(2958465), DisplayStatus::kOk, "2958465    "},
+    {"fraction/2958466", false, R"fmt(# ?/?)fmt", Value::number(2958466), DisplayStatus::kOk, "2958466    "},
+    {"fraction/0.5", false, R"fmt(# ?/?)fmt", Value::number(0.5), DisplayStatus::kOk, " 1/2"},
+    {"fraction/1234.5678", false, R"fmt(# ?/?)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1234 4/7"},
+    {"fraction/-1234.5678", false, R"fmt(# ?/?)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1234 4/7"},
+    {"fraction/1e-05", false, R"fmt(# ?/?)fmt", Value::number(1e-05), DisplayStatus::kOk, "0    "},
+    {"fraction/1000000000000000.0", false, R"fmt(# ?/?)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1000000000000000    "},
+    {"fraction/123456789012345678", false, R"fmt(# ?/?)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     "123456789012346000    "},
+    {"sci/0", false, R"fmt(0.00E+00)fmt", Value::number(0), DisplayStatus::kOk, "0.00E+00"},
+    {"sci/59", false, R"fmt(0.00E+00)fmt", Value::number(59), DisplayStatus::kOk, "5.90E+01"},
+    {"sci/60", false, R"fmt(0.00E+00)fmt", Value::number(60), DisplayStatus::kOk, "6.00E+01"},
+    {"sci/61", false, R"fmt(0.00E+00)fmt", Value::number(61), DisplayStatus::kOk, "6.10E+01"},
+    {"sci/-1", false, R"fmt(0.00E+00)fmt", Value::number(-1), DisplayStatus::kOk, "-1.00E+00"},
+    {"sci/2958465", false, R"fmt(0.00E+00)fmt", Value::number(2958465), DisplayStatus::kOk, "2.96E+06"},
+    {"sci/2958466", false, R"fmt(0.00E+00)fmt", Value::number(2958466), DisplayStatus::kOk, "2.96E+06"},
+    {"sci/0.5", false, R"fmt(0.00E+00)fmt", Value::number(0.5), DisplayStatus::kOk, "5.00E-01"},
+    {"sci/1234.5678", false, R"fmt(0.00E+00)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1.23E+03"},
+    {"sci/-1234.5678", false, R"fmt(0.00E+00)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1.23E+03"},
+    {"sci/1e-05", false, R"fmt(0.00E+00)fmt", Value::number(1e-05), DisplayStatus::kOk, "1.00E-05"},
+    {"sci/1000000000000000.0", false, R"fmt(0.00E+00)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1.00E+15"},
+    {"sci/123456789012345678", false, R"fmt(0.00E+00)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     "1.23E+17"},
+    {"text@/0", false, R"fmt(@)fmt", Value::number(0), DisplayStatus::kOk, "0"},
+    {"text@/59", false, R"fmt(@)fmt", Value::number(59), DisplayStatus::kOk, "59"},
+    {"text@/60", false, R"fmt(@)fmt", Value::number(60), DisplayStatus::kOk, "60"},
+    {"text@/61", false, R"fmt(@)fmt", Value::number(61), DisplayStatus::kOk, "61"},
+    {"text@/-1", false, R"fmt(@)fmt", Value::number(-1), DisplayStatus::kOk, "-1"},
+    {"text@/2958465", false, R"fmt(@)fmt", Value::number(2958465), DisplayStatus::kOk, "2958465"},
+    {"text@/2958466", false, R"fmt(@)fmt", Value::number(2958466), DisplayStatus::kOk, "2958466"},
+    {"text@/0.5", false, R"fmt(@)fmt", Value::number(0.5), DisplayStatus::kOk, "0.5"},
+    {"text@/1234.5678", false, R"fmt(@)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1234.5678"},
+    {"text@/-1234.5678", false, R"fmt(@)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1234.5678"},
+    {"text@/1e-05", false, R"fmt(@)fmt", Value::number(1e-05), DisplayStatus::kOk, "0.00001"},
+    {"text@/1000000000000000.0", false, R"fmt(@)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk, "1E+15"},
+    {"text@/123456789012345678", false, R"fmt(@)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     "1.23457E+17"},
+    {"hidden;;;/0", false, R"fmt(;;;)fmt", Value::number(0), DisplayStatus::kOk, ""},
+    {"hidden;;;/59", false, R"fmt(;;;)fmt", Value::number(59), DisplayStatus::kOk, ""},
+    {"hidden;;;/60", false, R"fmt(;;;)fmt", Value::number(60), DisplayStatus::kOk, ""},
+    {"hidden;;;/61", false, R"fmt(;;;)fmt", Value::number(61), DisplayStatus::kOk, ""},
+    {"hidden;;;/-1", false, R"fmt(;;;)fmt", Value::number(-1), DisplayStatus::kOk, ""},
+    {"hidden;;;/2958465", false, R"fmt(;;;)fmt", Value::number(2958465), DisplayStatus::kOk, ""},
+    {"hidden;;;/2958466", false, R"fmt(;;;)fmt", Value::number(2958466), DisplayStatus::kOk, ""},
+    {"hidden;;;/0.5", false, R"fmt(;;;)fmt", Value::number(0.5), DisplayStatus::kOk, ""},
+    {"hidden;;;/1234.5678", false, R"fmt(;;;)fmt", Value::number(1234.5678), DisplayStatus::kOk, ""},
+    {"hidden;;;/-1234.5678", false, R"fmt(;;;)fmt", Value::number(-1234.5678), DisplayStatus::kOk, ""},
+    {"hidden;;;/1e-05", false, R"fmt(;;;)fmt", Value::number(1e-05), DisplayStatus::kOk, ""},
+    {"hidden;;;/1000000000000000.0", false, R"fmt(;;;)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk, ""},
+    {"hidden;;;/123456789012345678", false, R"fmt(;;;)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     ""},
+    {"cond-miss/1", false, R"fmt([>10]0;[<0]0)fmt", Value::number(1), DisplayStatus::kOverflow, "########"},
+    {"cond-miss/0", false, R"fmt([>10]0;[<0]0)fmt", Value::number(0), DisplayStatus::kOverflow, "########"},
+    {"cond-miss/-5", false, R"fmt(0;[>10]0)fmt", Value::number(-5), DisplayStatus::kOverflow, "########"},
+    {"cond-miss/0-second", false, R"fmt(0;[>10]0)fmt", Value::number(0), DisplayStatus::kOverflow, "########"},
+    {"date/0", false, R"fmt(yyyy/m/d)fmt", Value::number(0), DisplayStatus::kOk, "1900/1/0"},
+    {"date/59", false, R"fmt(yyyy/m/d)fmt", Value::number(59), DisplayStatus::kOk, "1900/2/28"},
+    {"date/60", false, R"fmt(yyyy/m/d)fmt", Value::number(60), DisplayStatus::kOk, "1900/2/29"},
+    {"date/61", false, R"fmt(yyyy/m/d)fmt", Value::number(61), DisplayStatus::kOk, "1900/3/1"},
+    {"date/-1", false, R"fmt(yyyy/m/d)fmt", Value::number(-1), DisplayStatus::kOverflow, "########"},
+    {"date/2958465", false, R"fmt(yyyy/m/d)fmt", Value::number(2958465), DisplayStatus::kOk, "9999/12/31"},
+    {"date/2958466", false, R"fmt(yyyy/m/d)fmt", Value::number(2958466), DisplayStatus::kOverflow, "########"},
+    {"date/0.5", false, R"fmt(yyyy/m/d)fmt", Value::number(0.5), DisplayStatus::kOk, "1900/1/0"},
+    {"date/1234.5678", false, R"fmt(yyyy/m/d)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1903/5/18"},
+    {"date/-1234.5678", false, R"fmt(yyyy/m/d)fmt", Value::number(-1234.5678), DisplayStatus::kOverflow, "########"},
+    {"date/1e-05", false, R"fmt(yyyy/m/d)fmt", Value::number(1e-05), DisplayStatus::kOk, "1900/1/0"},
+    {"date/1000000000000000.0", false, R"fmt(yyyy/m/d)fmt", Value::number(1000000000000000.0), DisplayStatus::kOverflow,
+     "########"},
+    {"date/123456789012345678", false, R"fmt(yyyy/m/d)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"time/0", false, R"fmt(h:mm:ss)fmt", Value::number(0), DisplayStatus::kOk, "0:00:00"},
+    {"time/59", false, R"fmt(h:mm:ss)fmt", Value::number(59), DisplayStatus::kOk, "0:00:00"},
+    {"time/60", false, R"fmt(h:mm:ss)fmt", Value::number(60), DisplayStatus::kOk, "0:00:00"},
+    {"time/61", false, R"fmt(h:mm:ss)fmt", Value::number(61), DisplayStatus::kOk, "0:00:00"},
+    {"time/-1", false, R"fmt(h:mm:ss)fmt", Value::number(-1), DisplayStatus::kOverflow, "########"},
+    {"time/2958465", false, R"fmt(h:mm:ss)fmt", Value::number(2958465), DisplayStatus::kOk, "0:00:00"},
+    {"time/2958466", false, R"fmt(h:mm:ss)fmt", Value::number(2958466), DisplayStatus::kOverflow, "########"},
+    {"time/0.5", false, R"fmt(h:mm:ss)fmt", Value::number(0.5), DisplayStatus::kOk, "12:00:00"},
+    {"time/1234.5678", false, R"fmt(h:mm:ss)fmt", Value::number(1234.5678), DisplayStatus::kOk, "13:37:38"},
+    {"time/-1234.5678", false, R"fmt(h:mm:ss)fmt", Value::number(-1234.5678), DisplayStatus::kOverflow, "########"},
+    {"time/1e-05", false, R"fmt(h:mm:ss)fmt", Value::number(1e-05), DisplayStatus::kOk, "0:00:01"},
+    {"time/1000000000000000.0", false, R"fmt(h:mm:ss)fmt", Value::number(1000000000000000.0), DisplayStatus::kOverflow,
+     "########"},
+    {"time/123456789012345678", false, R"fmt(h:mm:ss)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"[h]:mm/0", false, R"fmt([h]:mm)fmt", Value::number(0), DisplayStatus::kOk, "0:00"},
+    {"[h]:mm/59", false, R"fmt([h]:mm)fmt", Value::number(59), DisplayStatus::kOk, "1416:00"},
+    {"[h]:mm/60", false, R"fmt([h]:mm)fmt", Value::number(60), DisplayStatus::kOk, "1440:00"},
+    {"[h]:mm/61", false, R"fmt([h]:mm)fmt", Value::number(61), DisplayStatus::kOk, "1464:00"},
+    {"[h]:mm/-1", false, R"fmt([h]:mm)fmt", Value::number(-1), DisplayStatus::kOverflow, "########"},
+    {"[h]:mm/2958465", false, R"fmt([h]:mm)fmt", Value::number(2958465), DisplayStatus::kOk, "71003160:00"},
+    {"[h]:mm/2958466", false, R"fmt([h]:mm)fmt", Value::number(2958466), DisplayStatus::kOverflow, "########"},
+    {"[h]:mm/0.5", false, R"fmt([h]:mm)fmt", Value::number(0.5), DisplayStatus::kOk, "12:00"},
+    {"[h]:mm/1234.5678", false, R"fmt([h]:mm)fmt", Value::number(1234.5678), DisplayStatus::kOk, "29629:37"},
+    {"[h]:mm/-1234.5678", false, R"fmt([h]:mm)fmt", Value::number(-1234.5678), DisplayStatus::kOverflow, "########"},
+    {"[h]:mm/1e-05", false, R"fmt([h]:mm)fmt", Value::number(1e-05), DisplayStatus::kOk, "0:00"},
+    {"[h]:mm/1000000000000000.0", false, R"fmt([h]:mm)fmt", Value::number(1000000000000000.0), DisplayStatus::kOverflow,
+     "########"},
+    {"[h]:mm/123456789012345678", false, R"fmt([h]:mm)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"ggge/0", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(0), DisplayStatus::kOk, "明治33年1月0日"},
+    {"ggge/59", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(59), DisplayStatus::kOk, "明治33年2月28日"},
+    {"ggge/60", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(60), DisplayStatus::kOk, "明治33年2月29日"},
+    {"ggge/61", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(61), DisplayStatus::kOk, "明治33年3月1日"},
+    {"ggge/-1", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(-1), DisplayStatus::kOverflow, "########"},
+    {"ggge/2958465", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(2958465), DisplayStatus::kOk,
+     "令和7981年12月31日"},
+    {"ggge/2958466", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(2958466), DisplayStatus::kOverflow,
+     "########"},
+    {"ggge/0.5", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(0.5), DisplayStatus::kOk, "明治33年1月0日"},
+    {"ggge/1234.5678", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(1234.5678), DisplayStatus::kOk,
+     "明治36年5月18日"},
+    {"ggge/-1234.5678", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(-1234.5678), DisplayStatus::kOverflow,
+     "########"},
+    {"ggge/1e-05", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(1e-05), DisplayStatus::kOk, "明治33年1月0日"},
+    {"ggge/1000000000000000.0", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOverflow, "########"},
+    {"ggge/123456789012345678", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"aaaa/0", false, R"fmt(aaaa)fmt", Value::number(0), DisplayStatus::kOk, "土曜日"},
+    {"aaaa/59", false, R"fmt(aaaa)fmt", Value::number(59), DisplayStatus::kOk, "火曜日"},
+    {"aaaa/60", false, R"fmt(aaaa)fmt", Value::number(60), DisplayStatus::kOk, "水曜日"},
+    {"aaaa/61", false, R"fmt(aaaa)fmt", Value::number(61), DisplayStatus::kOk, "木曜日"},
+    {"aaaa/-1", false, R"fmt(aaaa)fmt", Value::number(-1), DisplayStatus::kOverflow, "########"},
+    {"aaaa/2958465", false, R"fmt(aaaa)fmt", Value::number(2958465), DisplayStatus::kOk, "金曜日"},
+    {"aaaa/2958466", false, R"fmt(aaaa)fmt", Value::number(2958466), DisplayStatus::kOverflow, "########"},
+    {"aaaa/0.5", false, R"fmt(aaaa)fmt", Value::number(0.5), DisplayStatus::kOk, "土曜日"},
+    {"aaaa/1234.5678", false, R"fmt(aaaa)fmt", Value::number(1234.5678), DisplayStatus::kOk, "月曜日"},
+    {"aaaa/-1234.5678", false, R"fmt(aaaa)fmt", Value::number(-1234.5678), DisplayStatus::kOverflow, "########"},
+    {"aaaa/1e-05", false, R"fmt(aaaa)fmt", Value::number(1e-05), DisplayStatus::kOk, "土曜日"},
+    {"aaaa/1000000000000000.0", false, R"fmt(aaaa)fmt", Value::number(1000000000000000.0), DisplayStatus::kOverflow,
+     "########"},
+    {"aaaa/123456789012345678", false, R"fmt(aaaa)fmt", Value::number(123456789012345678.0), DisplayStatus::kOverflow,
+     "########"},
+    {"DBNum1/0", false, R"fmt([DBNum1]General)fmt", Value::number(0), DisplayStatus::kOk, "〇"},
+    {"DBNum1/59", false, R"fmt([DBNum1]General)fmt", Value::number(59), DisplayStatus::kOk, "五十九"},
+    {"DBNum1/60", false, R"fmt([DBNum1]General)fmt", Value::number(60), DisplayStatus::kOk, "六十"},
+    {"DBNum1/61", false, R"fmt([DBNum1]General)fmt", Value::number(61), DisplayStatus::kOk, "六十一"},
+    {"DBNum1/-1", false, R"fmt([DBNum1]General)fmt", Value::number(-1), DisplayStatus::kOk, "-一"},
+    {"DBNum1/2958465", false, R"fmt([DBNum1]General)fmt", Value::number(2958465), DisplayStatus::kOk,
+     "二百九十五万八千四百六十五"},
+    {"DBNum1/2958466", false, R"fmt([DBNum1]General)fmt", Value::number(2958466), DisplayStatus::kOk,
+     "二百九十五万八千四百六十六"},
+    {"DBNum1/0.5", false, R"fmt([DBNum1]General)fmt", Value::number(0.5), DisplayStatus::kOk, "〇.五"},
+    {"DBNum1/1234.5678", false, R"fmt([DBNum1]General)fmt", Value::number(1234.5678), DisplayStatus::kOk,
+     "千二百三十四.五六七八"},
+    {"DBNum1/-1234.5678", false, R"fmt([DBNum1]General)fmt", Value::number(-1234.5678), DisplayStatus::kOk,
+     "-千二百三十四.五六七八"},
+    {"DBNum1/1e-05", false, R"fmt([DBNum1]General)fmt", Value::number(1e-05), DisplayStatus::kOk, "〇.〇〇〇〇一"},
+    {"DBNum1/1000000000000000.0", false, R"fmt([DBNum1]General)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOk, "千兆"},
+    {"DBNum1/123456789012345678", false, R"fmt([DBNum1]General)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOk, "一二三四五六兆七千八百九十億千二百三十四万六千"},
+    {"DBNum1#/0", false, R"fmt([DBNum1]#,##0)fmt", Value::number(0), DisplayStatus::kOk, "〇"},
+    {"DBNum1#/59", false, R"fmt([DBNum1]#,##0)fmt", Value::number(59), DisplayStatus::kOk, "五九"},
+    {"DBNum1#/60", false, R"fmt([DBNum1]#,##0)fmt", Value::number(60), DisplayStatus::kOk, "六〇"},
+    {"DBNum1#/61", false, R"fmt([DBNum1]#,##0)fmt", Value::number(61), DisplayStatus::kOk, "六一"},
+    {"DBNum1#/-1", false, R"fmt([DBNum1]#,##0)fmt", Value::number(-1), DisplayStatus::kOk, "-一"},
+    {"DBNum1#/2958465", false, R"fmt([DBNum1]#,##0)fmt", Value::number(2958465), DisplayStatus::kOk,
+     "二,九五八,四六五"},
+    {"DBNum1#/2958466", false, R"fmt([DBNum1]#,##0)fmt", Value::number(2958466), DisplayStatus::kOk,
+     "二,九五八,四六六"},
+    {"DBNum1#/0.5", false, R"fmt([DBNum1]#,##0)fmt", Value::number(0.5), DisplayStatus::kOk, "一"},
+    {"DBNum1#/1234.5678", false, R"fmt([DBNum1]#,##0)fmt", Value::number(1234.5678), DisplayStatus::kOk, "一,二三五"},
+    {"DBNum1#/-1234.5678", false, R"fmt([DBNum1]#,##0)fmt", Value::number(-1234.5678), DisplayStatus::kOk,
+     "-一,二三五"},
+    {"DBNum1#/1e-05", false, R"fmt([DBNum1]#,##0)fmt", Value::number(1e-05), DisplayStatus::kOk, "〇"},
+    {"DBNum1#/1000000000000000.0", false, R"fmt([DBNum1]#,##0)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOk, "一,〇〇〇,〇〇〇,〇〇〇,〇〇〇,〇〇〇"},
+    {"DBNum1#/123456789012345678", false, R"fmt([DBNum1]#,##0)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOk, "一二三,四五六,七八九,〇一二,三四六,〇〇〇"},
+    {"General/0@1904", true, R"fmt(General)fmt", Value::number(0), DisplayStatus::kOk, "0"},
+    {"General/59@1904", true, R"fmt(General)fmt", Value::number(59), DisplayStatus::kOk, "59"},
+    {"General/60@1904", true, R"fmt(General)fmt", Value::number(60), DisplayStatus::kOk, "60"},
+    {"General/61@1904", true, R"fmt(General)fmt", Value::number(61), DisplayStatus::kOk, "61"},
+    {"General/-1@1904", true, R"fmt(General)fmt", Value::number(-1), DisplayStatus::kOk, "-1"},
+    {"General/2958465@1904", true, R"fmt(General)fmt", Value::number(2958465), DisplayStatus::kOk, "2958465"},
+    {"General/2958466@1904", true, R"fmt(General)fmt", Value::number(2958466), DisplayStatus::kOk, "2958466"},
+    {"General/0.5@1904", true, R"fmt(General)fmt", Value::number(0.5), DisplayStatus::kOk, "0.5"},
+    {"General/1234.5678@1904", true, R"fmt(General)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1234.5678"},
+    {"General/-1234.5678@1904", true, R"fmt(General)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1234.5678"},
+    {"General/1e-05@1904", true, R"fmt(General)fmt", Value::number(1e-05), DisplayStatus::kOk, "0.00001"},
+    {"General/1000000000000000.0@1904", true, R"fmt(General)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1E+15"},
+    {"General/123456789012345678@1904", true, R"fmt(General)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOk, "1.23457E+17"},
+    {"0.00/0@1904", true, R"fmt(0.00)fmt", Value::number(0), DisplayStatus::kOk, "0.00"},
+    {"0.00/59@1904", true, R"fmt(0.00)fmt", Value::number(59), DisplayStatus::kOk, "59.00"},
+    {"0.00/60@1904", true, R"fmt(0.00)fmt", Value::number(60), DisplayStatus::kOk, "60.00"},
+    {"0.00/61@1904", true, R"fmt(0.00)fmt", Value::number(61), DisplayStatus::kOk, "61.00"},
+    {"0.00/-1@1904", true, R"fmt(0.00)fmt", Value::number(-1), DisplayStatus::kOk, "-1.00"},
+    {"0.00/2958465@1904", true, R"fmt(0.00)fmt", Value::number(2958465), DisplayStatus::kOk, "2958465.00"},
+    {"0.00/2958466@1904", true, R"fmt(0.00)fmt", Value::number(2958466), DisplayStatus::kOk, "2958466.00"},
+    {"0.00/0.5@1904", true, R"fmt(0.00)fmt", Value::number(0.5), DisplayStatus::kOk, "0.50"},
+    {"0.00/1234.5678@1904", true, R"fmt(0.00)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1234.57"},
+    {"0.00/-1234.5678@1904", true, R"fmt(0.00)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1234.57"},
+    {"0.00/1e-05@1904", true, R"fmt(0.00)fmt", Value::number(1e-05), DisplayStatus::kOk, "0.00"},
+    {"0.00/1000000000000000.0@1904", true, R"fmt(0.00)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1000000000000000.00"},
+    {"0.00/123456789012345678@1904", true, R"fmt(0.00)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     "123456789012346000.00"},
+    {"red-neg/0@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(0), DisplayStatus::kOk, "0"},
+    {"red-neg/59@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(59), DisplayStatus::kOk, "59"},
+    {"red-neg/60@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(60), DisplayStatus::kOk, "60"},
+    {"red-neg/61@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(61), DisplayStatus::kOk, "61"},
+    {"red-neg/-1@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(-1), DisplayStatus::kOk, "-1"},
+    {"red-neg/2958465@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(2958465), DisplayStatus::kOk,
+     "2,958,465"},
+    {"red-neg/2958466@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(2958466), DisplayStatus::kOk,
+     "2,958,466"},
+    {"red-neg/0.5@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(0.5), DisplayStatus::kOk, "1"},
+    {"red-neg/1234.5678@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(1234.5678), DisplayStatus::kOk,
+     "1,235"},
+    {"red-neg/-1234.5678@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(-1234.5678), DisplayStatus::kOk,
+     "-1,235"},
+    {"red-neg/1e-05@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(1e-05), DisplayStatus::kOk, "0"},
+    {"red-neg/1000000000000000.0@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOk, "1,000,000,000,000,000"},
+    {"red-neg/123456789012345678@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOk, "123,456,789,012,346,000"},
+    {"accounting/0@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(0),
+     DisplayStatus::kOk, " - "},
+    {"accounting/59@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(59),
+     DisplayStatus::kOk, " 59 "},
+    {"accounting/60@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(60),
+     DisplayStatus::kOk, " 60 "},
+    {"accounting/61@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(61),
+     DisplayStatus::kOk, " 61 "},
+    {"accounting/-1@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(-1),
+     DisplayStatus::kOk, " -1 "},
+    {"accounting/2958465@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(2958465),
+     DisplayStatus::kOk, " 2,958,465 "},
+    {"accounting/2958466@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(2958466),
+     DisplayStatus::kOk, " 2,958,466 "},
+    {"accounting/0.5@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(0.5),
+     DisplayStatus::kOk, " 1 "},
+    {"accounting/1234.5678@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(1234.5678),
+     DisplayStatus::kOk, " 1,235 "},
+    {"accounting/-1234.5678@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(-1234.5678),
+     DisplayStatus::kOk, " -1,235 "},
+    {"accounting/1e-05@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::number(1e-05),
+     DisplayStatus::kOk, " 0 "},
+    {"accounting/1000000000000000.0@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt",
+     Value::number(1000000000000000.0), DisplayStatus::kOk, " 1,000,000,000,000,000 "},
+    {"accounting/123456789012345678@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt",
+     Value::number(123456789012345678.0), DisplayStatus::kOk, " 123,456,789,012,346,000 "},
+    {"fraction/0@1904", true, R"fmt(# ?/?)fmt", Value::number(0), DisplayStatus::kOk, "0    "},
+    {"fraction/59@1904", true, R"fmt(# ?/?)fmt", Value::number(59), DisplayStatus::kOk, "59    "},
+    {"fraction/60@1904", true, R"fmt(# ?/?)fmt", Value::number(60), DisplayStatus::kOk, "60    "},
+    {"fraction/61@1904", true, R"fmt(# ?/?)fmt", Value::number(61), DisplayStatus::kOk, "61    "},
+    {"fraction/-1@1904", true, R"fmt(# ?/?)fmt", Value::number(-1), DisplayStatus::kOk, "-1    "},
+    {"fraction/2958465@1904", true, R"fmt(# ?/?)fmt", Value::number(2958465), DisplayStatus::kOk, "2958465    "},
+    {"fraction/2958466@1904", true, R"fmt(# ?/?)fmt", Value::number(2958466), DisplayStatus::kOk, "2958466    "},
+    {"fraction/0.5@1904", true, R"fmt(# ?/?)fmt", Value::number(0.5), DisplayStatus::kOk, " 1/2"},
+    {"fraction/1234.5678@1904", true, R"fmt(# ?/?)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1234 4/7"},
+    {"fraction/-1234.5678@1904", true, R"fmt(# ?/?)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1234 4/7"},
+    {"fraction/1e-05@1904", true, R"fmt(# ?/?)fmt", Value::number(1e-05), DisplayStatus::kOk, "0    "},
+    {"fraction/1000000000000000.0@1904", true, R"fmt(# ?/?)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1000000000000000    "},
+    {"fraction/123456789012345678@1904", true, R"fmt(# ?/?)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOk, "123456789012346000    "},
+    {"sci/0@1904", true, R"fmt(0.00E+00)fmt", Value::number(0), DisplayStatus::kOk, "0.00E+00"},
+    {"sci/59@1904", true, R"fmt(0.00E+00)fmt", Value::number(59), DisplayStatus::kOk, "5.90E+01"},
+    {"sci/60@1904", true, R"fmt(0.00E+00)fmt", Value::number(60), DisplayStatus::kOk, "6.00E+01"},
+    {"sci/61@1904", true, R"fmt(0.00E+00)fmt", Value::number(61), DisplayStatus::kOk, "6.10E+01"},
+    {"sci/-1@1904", true, R"fmt(0.00E+00)fmt", Value::number(-1), DisplayStatus::kOk, "-1.00E+00"},
+    {"sci/2958465@1904", true, R"fmt(0.00E+00)fmt", Value::number(2958465), DisplayStatus::kOk, "2.96E+06"},
+    {"sci/2958466@1904", true, R"fmt(0.00E+00)fmt", Value::number(2958466), DisplayStatus::kOk, "2.96E+06"},
+    {"sci/0.5@1904", true, R"fmt(0.00E+00)fmt", Value::number(0.5), DisplayStatus::kOk, "5.00E-01"},
+    {"sci/1234.5678@1904", true, R"fmt(0.00E+00)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1.23E+03"},
+    {"sci/-1234.5678@1904", true, R"fmt(0.00E+00)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1.23E+03"},
+    {"sci/1e-05@1904", true, R"fmt(0.00E+00)fmt", Value::number(1e-05), DisplayStatus::kOk, "1.00E-05"},
+    {"sci/1000000000000000.0@1904", true, R"fmt(0.00E+00)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1.00E+15"},
+    {"sci/123456789012345678@1904", true, R"fmt(0.00E+00)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     "1.23E+17"},
+    {"text@/0@1904", true, R"fmt(@)fmt", Value::number(0), DisplayStatus::kOk, "0"},
+    {"text@/59@1904", true, R"fmt(@)fmt", Value::number(59), DisplayStatus::kOk, "59"},
+    {"text@/60@1904", true, R"fmt(@)fmt", Value::number(60), DisplayStatus::kOk, "60"},
+    {"text@/61@1904", true, R"fmt(@)fmt", Value::number(61), DisplayStatus::kOk, "61"},
+    {"text@/-1@1904", true, R"fmt(@)fmt", Value::number(-1), DisplayStatus::kOk, "-1"},
+    {"text@/2958465@1904", true, R"fmt(@)fmt", Value::number(2958465), DisplayStatus::kOk, "2958465"},
+    {"text@/2958466@1904", true, R"fmt(@)fmt", Value::number(2958466), DisplayStatus::kOk, "2958466"},
+    {"text@/0.5@1904", true, R"fmt(@)fmt", Value::number(0.5), DisplayStatus::kOk, "0.5"},
+    {"text@/1234.5678@1904", true, R"fmt(@)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1234.5678"},
+    {"text@/-1234.5678@1904", true, R"fmt(@)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1234.5678"},
+    {"text@/1e-05@1904", true, R"fmt(@)fmt", Value::number(1e-05), DisplayStatus::kOk, "0.00001"},
+    {"text@/1000000000000000.0@1904", true, R"fmt(@)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     "1E+15"},
+    {"text@/123456789012345678@1904", true, R"fmt(@)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     "1.23457E+17"},
+    {"hidden;;;/0@1904", true, R"fmt(;;;)fmt", Value::number(0), DisplayStatus::kOk, ""},
+    {"hidden;;;/59@1904", true, R"fmt(;;;)fmt", Value::number(59), DisplayStatus::kOk, ""},
+    {"hidden;;;/60@1904", true, R"fmt(;;;)fmt", Value::number(60), DisplayStatus::kOk, ""},
+    {"hidden;;;/61@1904", true, R"fmt(;;;)fmt", Value::number(61), DisplayStatus::kOk, ""},
+    {"hidden;;;/-1@1904", true, R"fmt(;;;)fmt", Value::number(-1), DisplayStatus::kOk, ""},
+    {"hidden;;;/2958465@1904", true, R"fmt(;;;)fmt", Value::number(2958465), DisplayStatus::kOk, ""},
+    {"hidden;;;/2958466@1904", true, R"fmt(;;;)fmt", Value::number(2958466), DisplayStatus::kOk, ""},
+    {"hidden;;;/0.5@1904", true, R"fmt(;;;)fmt", Value::number(0.5), DisplayStatus::kOk, ""},
+    {"hidden;;;/1234.5678@1904", true, R"fmt(;;;)fmt", Value::number(1234.5678), DisplayStatus::kOk, ""},
+    {"hidden;;;/-1234.5678@1904", true, R"fmt(;;;)fmt", Value::number(-1234.5678), DisplayStatus::kOk, ""},
+    {"hidden;;;/1e-05@1904", true, R"fmt(;;;)fmt", Value::number(1e-05), DisplayStatus::kOk, ""},
+    {"hidden;;;/1000000000000000.0@1904", true, R"fmt(;;;)fmt", Value::number(1000000000000000.0), DisplayStatus::kOk,
+     ""},
+    {"hidden;;;/123456789012345678@1904", true, R"fmt(;;;)fmt", Value::number(123456789012345678.0), DisplayStatus::kOk,
+     ""},
+    {"date/0@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(0), DisplayStatus::kOk, "1904/1/1"},
+    {"date/59@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(59), DisplayStatus::kOk, "1904/2/29"},
+    {"date/60@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(60), DisplayStatus::kOk, "1904/3/1"},
+    {"date/61@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(61), DisplayStatus::kOk, "1904/3/2"},
+    {"date/-1@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(-1), DisplayStatus::kOk, "-1904/1/2"},
+    {"date/2958465@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(2958465), DisplayStatus::kOverflow, "########"},
+    {"date/2958466@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(2958466), DisplayStatus::kOverflow, "########"},
+    {"date/0.5@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(0.5), DisplayStatus::kOk, "1904/1/1"},
+    {"date/1234.5678@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(1234.5678), DisplayStatus::kOk, "1907/5/19"},
+    {"date/-1234.5678@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-1907/5/19"},
+    {"date/1e-05@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(1e-05), DisplayStatus::kOk, "1904/1/1"},
+    {"date/1000000000000000.0@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOverflow, "########"},
+    {"date/123456789012345678@1904", true, R"fmt(yyyy/m/d)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"time/0@1904", true, R"fmt(h:mm:ss)fmt", Value::number(0), DisplayStatus::kOk, "0:00:00"},
+    {"time/59@1904", true, R"fmt(h:mm:ss)fmt", Value::number(59), DisplayStatus::kOk, "0:00:00"},
+    {"time/60@1904", true, R"fmt(h:mm:ss)fmt", Value::number(60), DisplayStatus::kOk, "0:00:00"},
+    {"time/61@1904", true, R"fmt(h:mm:ss)fmt", Value::number(61), DisplayStatus::kOk, "0:00:00"},
+    {"time/-1@1904", true, R"fmt(h:mm:ss)fmt", Value::number(-1), DisplayStatus::kOk, "-0:00:00"},
+    {"time/2958465@1904", true, R"fmt(h:mm:ss)fmt", Value::number(2958465), DisplayStatus::kOverflow, "########"},
+    {"time/2958466@1904", true, R"fmt(h:mm:ss)fmt", Value::number(2958466), DisplayStatus::kOverflow, "########"},
+    {"time/0.5@1904", true, R"fmt(h:mm:ss)fmt", Value::number(0.5), DisplayStatus::kOk, "12:00:00"},
+    {"time/1234.5678@1904", true, R"fmt(h:mm:ss)fmt", Value::number(1234.5678), DisplayStatus::kOk, "13:37:38"},
+    {"time/-1234.5678@1904", true, R"fmt(h:mm:ss)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-13:37:38"},
+    {"time/1e-05@1904", true, R"fmt(h:mm:ss)fmt", Value::number(1e-05), DisplayStatus::kOk, "0:00:01"},
+    {"time/1000000000000000.0@1904", true, R"fmt(h:mm:ss)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOverflow, "########"},
+    {"time/123456789012345678@1904", true, R"fmt(h:mm:ss)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"[h]:mm/0@1904", true, R"fmt([h]:mm)fmt", Value::number(0), DisplayStatus::kOk, "0:00"},
+    {"[h]:mm/59@1904", true, R"fmt([h]:mm)fmt", Value::number(59), DisplayStatus::kOk, "1416:00"},
+    {"[h]:mm/60@1904", true, R"fmt([h]:mm)fmt", Value::number(60), DisplayStatus::kOk, "1440:00"},
+    {"[h]:mm/61@1904", true, R"fmt([h]:mm)fmt", Value::number(61), DisplayStatus::kOk, "1464:00"},
+    {"[h]:mm/-1@1904", true, R"fmt([h]:mm)fmt", Value::number(-1), DisplayStatus::kOk, "-24:00"},
+    {"[h]:mm/2958465@1904", true, R"fmt([h]:mm)fmt", Value::number(2958465), DisplayStatus::kOverflow, "########"},
+    {"[h]:mm/2958466@1904", true, R"fmt([h]:mm)fmt", Value::number(2958466), DisplayStatus::kOverflow, "########"},
+    {"[h]:mm/0.5@1904", true, R"fmt([h]:mm)fmt", Value::number(0.5), DisplayStatus::kOk, "12:00"},
+    {"[h]:mm/1234.5678@1904", true, R"fmt([h]:mm)fmt", Value::number(1234.5678), DisplayStatus::kOk, "29629:37"},
+    {"[h]:mm/-1234.5678@1904", true, R"fmt([h]:mm)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-29629:37"},
+    {"[h]:mm/1e-05@1904", true, R"fmt([h]:mm)fmt", Value::number(1e-05), DisplayStatus::kOk, "0:00"},
+    {"[h]:mm/1000000000000000.0@1904", true, R"fmt([h]:mm)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOverflow, "########"},
+    {"[h]:mm/123456789012345678@1904", true, R"fmt([h]:mm)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"ggge/0@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(0), DisplayStatus::kOk, "明治37年1月1日"},
+    {"ggge/59@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(59), DisplayStatus::kOk, "明治37年2月29日"},
+    {"ggge/60@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(60), DisplayStatus::kOk, "明治37年3月1日"},
+    {"ggge/61@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(61), DisplayStatus::kOk, "明治37年3月2日"},
+    {"ggge/-1@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(-1), DisplayStatus::kOk, "-明治37年1月2日"},
+    {"ggge/2958465@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(2958465), DisplayStatus::kOverflow,
+     "########"},
+    {"ggge/2958466@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(2958466), DisplayStatus::kOverflow,
+     "########"},
+    {"ggge/0.5@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(0.5), DisplayStatus::kOk, "明治37年1月1日"},
+    {"ggge/1234.5678@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(1234.5678), DisplayStatus::kOk,
+     "明治40年5月19日"},
+    {"ggge/-1234.5678@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(-1234.5678), DisplayStatus::kOk,
+     "-明治40年5月19日"},
+    {"ggge/1e-05@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(1e-05), DisplayStatus::kOk,
+     "明治37年1月1日"},
+    {"ggge/1000000000000000.0@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOverflow, "########"},
+    {"ggge/123456789012345678@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"aaaa/0@1904", true, R"fmt(aaaa)fmt", Value::number(0), DisplayStatus::kOk, "金曜日"},
+    {"aaaa/59@1904", true, R"fmt(aaaa)fmt", Value::number(59), DisplayStatus::kOk, "月曜日"},
+    {"aaaa/60@1904", true, R"fmt(aaaa)fmt", Value::number(60), DisplayStatus::kOk, "火曜日"},
+    {"aaaa/61@1904", true, R"fmt(aaaa)fmt", Value::number(61), DisplayStatus::kOk, "水曜日"},
+    {"aaaa/-1@1904", true, R"fmt(aaaa)fmt", Value::number(-1), DisplayStatus::kOk, "-土曜日"},
+    {"aaaa/2958465@1904", true, R"fmt(aaaa)fmt", Value::number(2958465), DisplayStatus::kOverflow, "########"},
+    {"aaaa/2958466@1904", true, R"fmt(aaaa)fmt", Value::number(2958466), DisplayStatus::kOverflow, "########"},
+    {"aaaa/0.5@1904", true, R"fmt(aaaa)fmt", Value::number(0.5), DisplayStatus::kOk, "金曜日"},
+    {"aaaa/1234.5678@1904", true, R"fmt(aaaa)fmt", Value::number(1234.5678), DisplayStatus::kOk, "日曜日"},
+    {"aaaa/-1234.5678@1904", true, R"fmt(aaaa)fmt", Value::number(-1234.5678), DisplayStatus::kOk, "-日曜日"},
+    {"aaaa/1e-05@1904", true, R"fmt(aaaa)fmt", Value::number(1e-05), DisplayStatus::kOk, "金曜日"},
+    {"aaaa/1000000000000000.0@1904", true, R"fmt(aaaa)fmt", Value::number(1000000000000000.0), DisplayStatus::kOverflow,
+     "########"},
+    {"aaaa/123456789012345678@1904", true, R"fmt(aaaa)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOverflow, "########"},
+    {"DBNum1/0@1904", true, R"fmt([DBNum1]General)fmt", Value::number(0), DisplayStatus::kOk, "〇"},
+    {"DBNum1/59@1904", true, R"fmt([DBNum1]General)fmt", Value::number(59), DisplayStatus::kOk, "五十九"},
+    {"DBNum1/60@1904", true, R"fmt([DBNum1]General)fmt", Value::number(60), DisplayStatus::kOk, "六十"},
+    {"DBNum1/61@1904", true, R"fmt([DBNum1]General)fmt", Value::number(61), DisplayStatus::kOk, "六十一"},
+    {"DBNum1/-1@1904", true, R"fmt([DBNum1]General)fmt", Value::number(-1), DisplayStatus::kOk, "-一"},
+    {"DBNum1/2958465@1904", true, R"fmt([DBNum1]General)fmt", Value::number(2958465), DisplayStatus::kOk,
+     "二百九十五万八千四百六十五"},
+    {"DBNum1/2958466@1904", true, R"fmt([DBNum1]General)fmt", Value::number(2958466), DisplayStatus::kOk,
+     "二百九十五万八千四百六十六"},
+    {"DBNum1/0.5@1904", true, R"fmt([DBNum1]General)fmt", Value::number(0.5), DisplayStatus::kOk, "〇.五"},
+    {"DBNum1/1234.5678@1904", true, R"fmt([DBNum1]General)fmt", Value::number(1234.5678), DisplayStatus::kOk,
+     "千二百三十四.五六七八"},
+    {"DBNum1/-1234.5678@1904", true, R"fmt([DBNum1]General)fmt", Value::number(-1234.5678), DisplayStatus::kOk,
+     "-千二百三十四.五六七八"},
+    {"DBNum1/1e-05@1904", true, R"fmt([DBNum1]General)fmt", Value::number(1e-05), DisplayStatus::kOk, "〇.〇〇〇〇一"},
+    {"DBNum1/1000000000000000.0@1904", true, R"fmt([DBNum1]General)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOk, "千兆"},
+    {"DBNum1/123456789012345678@1904", true, R"fmt([DBNum1]General)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOk, "一二三四五六兆七千八百九十億千二百三十四万六千"},
+    {"DBNum1#/0@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(0), DisplayStatus::kOk, "〇"},
+    {"DBNum1#/59@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(59), DisplayStatus::kOk, "五九"},
+    {"DBNum1#/60@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(60), DisplayStatus::kOk, "六〇"},
+    {"DBNum1#/61@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(61), DisplayStatus::kOk, "六一"},
+    {"DBNum1#/-1@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(-1), DisplayStatus::kOk, "-一"},
+    {"DBNum1#/2958465@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(2958465), DisplayStatus::kOk,
+     "二,九五八,四六五"},
+    {"DBNum1#/2958466@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(2958466), DisplayStatus::kOk,
+     "二,九五八,四六六"},
+    {"DBNum1#/0.5@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(0.5), DisplayStatus::kOk, "一"},
+    {"DBNum1#/1234.5678@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(1234.5678), DisplayStatus::kOk,
+     "一,二三五"},
+    {"DBNum1#/-1234.5678@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(-1234.5678), DisplayStatus::kOk,
+     "-一,二三五"},
+    {"DBNum1#/1e-05@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(1e-05), DisplayStatus::kOk, "〇"},
+    {"DBNum1#/1000000000000000.0@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(1000000000000000.0),
+     DisplayStatus::kOk, "一,〇〇〇,〇〇〇,〇〇〇,〇〇〇,〇〇〇"},
+    {"DBNum1#/123456789012345678@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::number(123456789012345678.0),
+     DisplayStatus::kOk, "一二三,四五六,七八九,〇一二,三四六,〇〇〇"},
+    {"General/text:abc", false, R"fmt(General)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"General/text:abc@1904", true, R"fmt(General)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"General/text:123", false, R"fmt(General)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"General/text:123@1904", true, R"fmt(General)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"General/text:empty", false, R"fmt(General)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"General/text:empty@1904", true, R"fmt(General)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"General/TRUE", false, R"fmt(General)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"General/TRUE@1904", true, R"fmt(General)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"General/FALSE", false, R"fmt(General)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"General/FALSE@1904", true, R"fmt(General)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"General/err:#N/A", false, R"fmt(General)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"General/err:#N/A@1904", true, R"fmt(General)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"General/err:#DIV/0!", false, R"fmt(General)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"General/err:#DIV/0!@1904", true, R"fmt(General)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"General/err:#VALUE!", false, R"fmt(General)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"General/err:#VALUE!@1904", true, R"fmt(General)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"General/blank", false, R"fmt(General)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"General/blank@1904", true, R"fmt(General)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"0.00/text:abc", false, R"fmt(0.00)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"0.00/text:abc@1904", true, R"fmt(0.00)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"0.00/text:123", false, R"fmt(0.00)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"0.00/text:123@1904", true, R"fmt(0.00)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"0.00/text:empty", false, R"fmt(0.00)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"0.00/text:empty@1904", true, R"fmt(0.00)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"0.00/TRUE", false, R"fmt(0.00)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"0.00/TRUE@1904", true, R"fmt(0.00)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"0.00/FALSE", false, R"fmt(0.00)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"0.00/FALSE@1904", true, R"fmt(0.00)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"0.00/err:#N/A", false, R"fmt(0.00)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"0.00/err:#N/A@1904", true, R"fmt(0.00)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"0.00/err:#DIV/0!", false, R"fmt(0.00)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"0.00/err:#DIV/0!@1904", true, R"fmt(0.00)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"0.00/err:#VALUE!", false, R"fmt(0.00)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"0.00/err:#VALUE!@1904", true, R"fmt(0.00)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"0.00/blank", false, R"fmt(0.00)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"0.00/blank@1904", true, R"fmt(0.00)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"red-neg/text:abc", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"red-neg/text:abc@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"red-neg/text:123", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"red-neg/text:123@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"red-neg/text:empty", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"red-neg/text:empty@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"red-neg/TRUE", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"red-neg/TRUE@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"red-neg/FALSE", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"red-neg/FALSE@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"red-neg/err:#N/A", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"red-neg/err:#N/A@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk,
+     "#N/A"},
+    {"red-neg/err:#DIV/0!", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"red-neg/err:#DIV/0!@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"red-neg/err:#VALUE!", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"red-neg/err:#VALUE!@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"red-neg/blank", false, R"fmt(#,##0;[Red]-#,##0)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"red-neg/blank@1904", true, R"fmt(#,##0;[Red]-#,##0)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"accounting/text:abc", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::text("abc"),
+     DisplayStatus::kOk, " abc "},
+    {"accounting/text:abc@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::text("abc"),
+     DisplayStatus::kOk, " abc "},
+    {"accounting/text:123", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::text("123"),
+     DisplayStatus::kOk, " 123 "},
+    {"accounting/text:123@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::text("123"),
+     DisplayStatus::kOk, " 123 "},
+    {"accounting/text:empty", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::text(""),
+     DisplayStatus::kOk, "  "},
+    {"accounting/text:empty@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::text(""),
+     DisplayStatus::kOk, "  "},
+    {"accounting/TRUE", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::boolean(true),
+     DisplayStatus::kOk, " TRUE "},
+    {"accounting/TRUE@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::boolean(true),
+     DisplayStatus::kOk, " TRUE "},
+    {"accounting/FALSE", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::boolean(false),
+     DisplayStatus::kOk, " FALSE "},
+    {"accounting/FALSE@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::boolean(false),
+     DisplayStatus::kOk, " FALSE "},
+    {"accounting/err:#N/A", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::error(ErrorCode::NA),
+     DisplayStatus::kOk, "#N/A"},
+    {"accounting/err:#N/A@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::error(ErrorCode::NA),
+     DisplayStatus::kOk, "#N/A"},
+    {"accounting/err:#DIV/0!", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt",
+     Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"accounting/err:#DIV/0!@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt",
+     Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"accounting/err:#VALUE!", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt",
+     Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"accounting/err:#VALUE!@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt",
+     Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"accounting/blank", false, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::blank(), DisplayStatus::kOk,
+     ""},
+    {"accounting/blank@1904", true, R"fmt(_ * #,##0_ ;_ * -#,##0_ ;_ * "-"_ ;_ @_ )fmt", Value::blank(),
+     DisplayStatus::kOk, ""},
+    {"fraction/text:abc", false, R"fmt(# ?/?)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"fraction/text:abc@1904", true, R"fmt(# ?/?)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"fraction/text:123", false, R"fmt(# ?/?)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"fraction/text:123@1904", true, R"fmt(# ?/?)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"fraction/text:empty", false, R"fmt(# ?/?)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"fraction/text:empty@1904", true, R"fmt(# ?/?)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"fraction/TRUE", false, R"fmt(# ?/?)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"fraction/TRUE@1904", true, R"fmt(# ?/?)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"fraction/FALSE", false, R"fmt(# ?/?)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"fraction/FALSE@1904", true, R"fmt(# ?/?)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"fraction/err:#N/A", false, R"fmt(# ?/?)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"fraction/err:#N/A@1904", true, R"fmt(# ?/?)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"fraction/err:#DIV/0!", false, R"fmt(# ?/?)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"fraction/err:#DIV/0!@1904", true, R"fmt(# ?/?)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"fraction/err:#VALUE!", false, R"fmt(# ?/?)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"fraction/err:#VALUE!@1904", true, R"fmt(# ?/?)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"fraction/blank", false, R"fmt(# ?/?)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"fraction/blank@1904", true, R"fmt(# ?/?)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"sci/text:abc", false, R"fmt(0.00E+00)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"sci/text:abc@1904", true, R"fmt(0.00E+00)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"sci/text:123", false, R"fmt(0.00E+00)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"sci/text:123@1904", true, R"fmt(0.00E+00)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"sci/text:empty", false, R"fmt(0.00E+00)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"sci/text:empty@1904", true, R"fmt(0.00E+00)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"sci/TRUE", false, R"fmt(0.00E+00)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"sci/TRUE@1904", true, R"fmt(0.00E+00)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"sci/FALSE", false, R"fmt(0.00E+00)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"sci/FALSE@1904", true, R"fmt(0.00E+00)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"sci/err:#N/A", false, R"fmt(0.00E+00)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"sci/err:#N/A@1904", true, R"fmt(0.00E+00)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"sci/err:#DIV/0!", false, R"fmt(0.00E+00)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"sci/err:#DIV/0!@1904", true, R"fmt(0.00E+00)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"sci/err:#VALUE!", false, R"fmt(0.00E+00)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"sci/err:#VALUE!@1904", true, R"fmt(0.00E+00)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"sci/blank", false, R"fmt(0.00E+00)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"sci/blank@1904", true, R"fmt(0.00E+00)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"text@/text:abc", false, R"fmt(@)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"text@/text:abc@1904", true, R"fmt(@)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"text@/text:123", false, R"fmt(@)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"text@/text:123@1904", true, R"fmt(@)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"text@/text:empty", false, R"fmt(@)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"text@/text:empty@1904", true, R"fmt(@)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"text@/TRUE", false, R"fmt(@)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"text@/TRUE@1904", true, R"fmt(@)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"text@/FALSE", false, R"fmt(@)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"text@/FALSE@1904", true, R"fmt(@)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"text@/err:#N/A", false, R"fmt(@)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"text@/err:#N/A@1904", true, R"fmt(@)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"text@/err:#DIV/0!", false, R"fmt(@)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"text@/err:#DIV/0!@1904", true, R"fmt(@)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"text@/err:#VALUE!", false, R"fmt(@)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"text@/err:#VALUE!@1904", true, R"fmt(@)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"text@/blank", false, R"fmt(@)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"text@/blank@1904", true, R"fmt(@)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"hidden;;;/text:abc", false, R"fmt(;;;)fmt", Value::text("abc"), DisplayStatus::kOk, ""},
+    {"hidden;;;/text:abc@1904", true, R"fmt(;;;)fmt", Value::text("abc"), DisplayStatus::kOk, ""},
+    {"hidden;;;/text:123", false, R"fmt(;;;)fmt", Value::text("123"), DisplayStatus::kOk, ""},
+    {"hidden;;;/text:123@1904", true, R"fmt(;;;)fmt", Value::text("123"), DisplayStatus::kOk, ""},
+    {"hidden;;;/text:empty", false, R"fmt(;;;)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"hidden;;;/text:empty@1904", true, R"fmt(;;;)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"hidden;;;/TRUE", false, R"fmt(;;;)fmt", Value::boolean(true), DisplayStatus::kOk, ""},
+    {"hidden;;;/TRUE@1904", true, R"fmt(;;;)fmt", Value::boolean(true), DisplayStatus::kOk, ""},
+    {"hidden;;;/FALSE", false, R"fmt(;;;)fmt", Value::boolean(false), DisplayStatus::kOk, ""},
+    {"hidden;;;/FALSE@1904", true, R"fmt(;;;)fmt", Value::boolean(false), DisplayStatus::kOk, ""},
+    {"hidden;;;/err:#N/A", false, R"fmt(;;;)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"hidden;;;/err:#N/A@1904", true, R"fmt(;;;)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"hidden;;;/err:#DIV/0!", false, R"fmt(;;;)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"hidden;;;/err:#DIV/0!@1904", true, R"fmt(;;;)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"hidden;;;/err:#VALUE!", false, R"fmt(;;;)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"hidden;;;/err:#VALUE!@1904", true, R"fmt(;;;)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"hidden;;;/blank", false, R"fmt(;;;)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"hidden;;;/blank@1904", true, R"fmt(;;;)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"date/text:abc", false, R"fmt(yyyy/m/d)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"date/text:abc@1904", true, R"fmt(yyyy/m/d)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"date/text:123", false, R"fmt(yyyy/m/d)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"date/text:123@1904", true, R"fmt(yyyy/m/d)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"date/text:empty", false, R"fmt(yyyy/m/d)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"date/text:empty@1904", true, R"fmt(yyyy/m/d)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"date/TRUE", false, R"fmt(yyyy/m/d)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"date/TRUE@1904", true, R"fmt(yyyy/m/d)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"date/FALSE", false, R"fmt(yyyy/m/d)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"date/FALSE@1904", true, R"fmt(yyyy/m/d)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"date/err:#N/A", false, R"fmt(yyyy/m/d)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"date/err:#N/A@1904", true, R"fmt(yyyy/m/d)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"date/err:#DIV/0!", false, R"fmt(yyyy/m/d)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"date/err:#DIV/0!@1904", true, R"fmt(yyyy/m/d)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"date/err:#VALUE!", false, R"fmt(yyyy/m/d)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"date/err:#VALUE!@1904", true, R"fmt(yyyy/m/d)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"date/blank", false, R"fmt(yyyy/m/d)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"date/blank@1904", true, R"fmt(yyyy/m/d)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"time/text:abc", false, R"fmt(h:mm:ss)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"time/text:abc@1904", true, R"fmt(h:mm:ss)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"time/text:123", false, R"fmt(h:mm:ss)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"time/text:123@1904", true, R"fmt(h:mm:ss)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"time/text:empty", false, R"fmt(h:mm:ss)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"time/text:empty@1904", true, R"fmt(h:mm:ss)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"time/TRUE", false, R"fmt(h:mm:ss)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"time/TRUE@1904", true, R"fmt(h:mm:ss)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"time/FALSE", false, R"fmt(h:mm:ss)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"time/FALSE@1904", true, R"fmt(h:mm:ss)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"time/err:#N/A", false, R"fmt(h:mm:ss)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"time/err:#N/A@1904", true, R"fmt(h:mm:ss)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"time/err:#DIV/0!", false, R"fmt(h:mm:ss)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"time/err:#DIV/0!@1904", true, R"fmt(h:mm:ss)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"time/err:#VALUE!", false, R"fmt(h:mm:ss)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"time/err:#VALUE!@1904", true, R"fmt(h:mm:ss)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"time/blank", false, R"fmt(h:mm:ss)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"time/blank@1904", true, R"fmt(h:mm:ss)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"[h]:mm/text:abc", false, R"fmt([h]:mm)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"[h]:mm/text:abc@1904", true, R"fmt([h]:mm)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"[h]:mm/text:123", false, R"fmt([h]:mm)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"[h]:mm/text:123@1904", true, R"fmt([h]:mm)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"[h]:mm/text:empty", false, R"fmt([h]:mm)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"[h]:mm/text:empty@1904", true, R"fmt([h]:mm)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"[h]:mm/TRUE", false, R"fmt([h]:mm)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"[h]:mm/TRUE@1904", true, R"fmt([h]:mm)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"[h]:mm/FALSE", false, R"fmt([h]:mm)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"[h]:mm/FALSE@1904", true, R"fmt([h]:mm)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"[h]:mm/err:#N/A", false, R"fmt([h]:mm)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"[h]:mm/err:#N/A@1904", true, R"fmt([h]:mm)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"[h]:mm/err:#DIV/0!", false, R"fmt([h]:mm)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"[h]:mm/err:#DIV/0!@1904", true, R"fmt([h]:mm)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"[h]:mm/err:#VALUE!", false, R"fmt([h]:mm)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"[h]:mm/err:#VALUE!@1904", true, R"fmt([h]:mm)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"[h]:mm/blank", false, R"fmt([h]:mm)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"[h]:mm/blank@1904", true, R"fmt([h]:mm)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"ggge/text:abc", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"ggge/text:abc@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"ggge/text:123", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"ggge/text:123@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"ggge/text:empty", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"ggge/text:empty@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"ggge/TRUE", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"ggge/TRUE@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"ggge/FALSE", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"ggge/FALSE@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"ggge/err:#N/A", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"ggge/err:#N/A@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk,
+     "#N/A"},
+    {"ggge/err:#DIV/0!", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"ggge/err:#DIV/0!@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"ggge/err:#VALUE!", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"ggge/err:#VALUE!@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"ggge/blank", false, R"fmt(ggge"年"m"月"d"日")fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"ggge/blank@1904", true, R"fmt(ggge"年"m"月"d"日")fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"aaaa/text:abc", false, R"fmt(aaaa)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"aaaa/text:abc@1904", true, R"fmt(aaaa)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"aaaa/text:123", false, R"fmt(aaaa)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"aaaa/text:123@1904", true, R"fmt(aaaa)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"aaaa/text:empty", false, R"fmt(aaaa)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"aaaa/text:empty@1904", true, R"fmt(aaaa)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"aaaa/TRUE", false, R"fmt(aaaa)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"aaaa/TRUE@1904", true, R"fmt(aaaa)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"aaaa/FALSE", false, R"fmt(aaaa)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"aaaa/FALSE@1904", true, R"fmt(aaaa)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"aaaa/err:#N/A", false, R"fmt(aaaa)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"aaaa/err:#N/A@1904", true, R"fmt(aaaa)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"aaaa/err:#DIV/0!", false, R"fmt(aaaa)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"aaaa/err:#DIV/0!@1904", true, R"fmt(aaaa)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk, "#DIV/0!"},
+    {"aaaa/err:#VALUE!", false, R"fmt(aaaa)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"aaaa/err:#VALUE!@1904", true, R"fmt(aaaa)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk, "#VALUE!"},
+    {"aaaa/blank", false, R"fmt(aaaa)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"aaaa/blank@1904", true, R"fmt(aaaa)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"DBNum1/text:abc", false, R"fmt([DBNum1]General)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"DBNum1/text:abc@1904", true, R"fmt([DBNum1]General)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"DBNum1/text:123", false, R"fmt([DBNum1]General)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"DBNum1/text:123@1904", true, R"fmt([DBNum1]General)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"DBNum1/text:empty", false, R"fmt([DBNum1]General)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"DBNum1/text:empty@1904", true, R"fmt([DBNum1]General)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"DBNum1/TRUE", false, R"fmt([DBNum1]General)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"DBNum1/TRUE@1904", true, R"fmt([DBNum1]General)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"DBNum1/FALSE", false, R"fmt([DBNum1]General)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"DBNum1/FALSE@1904", true, R"fmt([DBNum1]General)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"DBNum1/err:#N/A", false, R"fmt([DBNum1]General)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"DBNum1/err:#N/A@1904", true, R"fmt([DBNum1]General)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"DBNum1/err:#DIV/0!", false, R"fmt([DBNum1]General)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"DBNum1/err:#DIV/0!@1904", true, R"fmt([DBNum1]General)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"DBNum1/err:#VALUE!", false, R"fmt([DBNum1]General)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"DBNum1/err:#VALUE!@1904", true, R"fmt([DBNum1]General)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"DBNum1/blank", false, R"fmt([DBNum1]General)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"DBNum1/blank@1904", true, R"fmt([DBNum1]General)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"DBNum1#/text:abc", false, R"fmt([DBNum1]#,##0)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"DBNum1#/text:abc@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::text("abc"), DisplayStatus::kOk, "abc"},
+    {"DBNum1#/text:123", false, R"fmt([DBNum1]#,##0)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"DBNum1#/text:123@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::text("123"), DisplayStatus::kOk, "123"},
+    {"DBNum1#/text:empty", false, R"fmt([DBNum1]#,##0)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"DBNum1#/text:empty@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::text(""), DisplayStatus::kOk, ""},
+    {"DBNum1#/TRUE", false, R"fmt([DBNum1]#,##0)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"DBNum1#/TRUE@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::boolean(true), DisplayStatus::kOk, "TRUE"},
+    {"DBNum1#/FALSE", false, R"fmt([DBNum1]#,##0)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"DBNum1#/FALSE@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::boolean(false), DisplayStatus::kOk, "FALSE"},
+    {"DBNum1#/err:#N/A", false, R"fmt([DBNum1]#,##0)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"DBNum1#/err:#N/A@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::error(ErrorCode::NA), DisplayStatus::kOk, "#N/A"},
+    {"DBNum1#/err:#DIV/0!", false, R"fmt([DBNum1]#,##0)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"DBNum1#/err:#DIV/0!@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::error(ErrorCode::Div0), DisplayStatus::kOk,
+     "#DIV/0!"},
+    {"DBNum1#/err:#VALUE!", false, R"fmt([DBNum1]#,##0)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"DBNum1#/err:#VALUE!@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::error(ErrorCode::Value), DisplayStatus::kOk,
+     "#VALUE!"},
+    {"DBNum1#/blank", false, R"fmt([DBNum1]#,##0)fmt", Value::blank(), DisplayStatus::kOk, ""},
+    {"DBNum1#/blank@1904", true, R"fmt([DBNum1]#,##0)fmt", Value::blank(), DisplayStatus::kOk, ""},
+};
+
+TEST(DisplayText, ProbeTable) {
+  for (const ProbeRow& row : kProbeRows) {
+    SCOPED_TRACE(row.label);
+    const DisplayText got = format_value_for_display(row.value, row.code, row.date1904);
+    EXPECT_EQ(got.text, row.text);
+    EXPECT_EQ(got.status, row.status);
+  }
+}
+
+TEST(DisplayText, StoredDialectAcceptsEnglishColor) {
+  // A stored format code spells colours in English; the ja-JP TEXT() spelling
+  // is not a colour there and makes the code malformed.
+  const DisplayText red = format_value_for_display(Value::number(-1234.5678), "#,##0;[Red]-#,##0", false);
+  EXPECT_EQ(red.status, DisplayStatus::kOk);
+  EXPECT_EQ(red.text, "-1,235");
+  const DisplayText indexed = format_value_for_display(Value::number(5), "[Color10]0.00", false);
+  EXPECT_EQ(indexed.status, DisplayStatus::kOk);
+  EXPECT_EQ(indexed.text, "5.00");
+  const DisplayText localized = format_value_for_display(Value::number(-1), "0;[赤]-0", false);
+  EXPECT_EQ(localized.status, DisplayStatus::kInvalidFormat);
+  EXPECT_EQ(localized.text, "-1");
+}
+
+TEST(DisplayText, NegativeDateOverflows) {
+  const DisplayText d = format_value_for_display(Value::number(-1.0), "yyyy/m/d", false);
+  EXPECT_EQ(d.status, DisplayStatus::kOverflow);
+  EXPECT_EQ(d.text, "########");
+  const DisplayText t = format_value_for_display(Value::number(-1234.5678), "h:mm:ss", false);
+  EXPECT_EQ(t.status, DisplayStatus::kOverflow);
+  EXPECT_EQ(t.text, "########");
+}
+
+TEST(DisplayText, TextOnlyNumericFormatsStillValidateTheirTokens) {
+  const DisplayText invalid = format_value_for_display(Value::number(12), "yyyy@", false);
+  EXPECT_EQ(invalid.status, DisplayStatus::kInvalidFormat);
+  EXPECT_EQ(invalid.text, "12");
+  const DisplayText valid = format_value_for_display(Value::number(12), "\"pre\"@", false);
+  EXPECT_EQ(valid.status, DisplayStatus::kOk);
+  EXPECT_EQ(valid.text, "12");
+}
+
+TEST(DisplayText, WidthIndependentKinds) {
+  // Narrow-column probe rows whose text does not depend on the column width.
+  EXPECT_EQ(format_value_for_display(Value::text("abcdefghij"), "General", false).text, "abcdefghij");
+  EXPECT_EQ(format_value_for_display(Value::text("abcdefghij"), "@", false).text, "abcdefghij");
+  EXPECT_EQ(format_value_for_display(Value::blank(), "General", false).text, "");
+  EXPECT_EQ(format_value_for_display(Value::number(1234567.891), ";;;", false).text, "");
+}
+
+}  // namespace
+}  // namespace text_format
+}  // namespace formulon
diff --git a/tests/unit/eval/eval_context_test.cpp b/tests/unit/eval/eval_context_test.cpp
index 8611f4fab..e399187f9 100644
--- a/tests/unit/eval/eval_context_test.cpp
+++ b/tests/unit/eval/eval_context_test.cpp
@@ -185,6 +185,30 @@ TEST(EvalContextRecursive, FormulaChain) {
   EXPECT_EQ(v.as_number(), 12.0);
 }
 
+TEST(EvalContextFormulaEntry, QualifiedBuiltinIsRejectedByAdhocAndRecursivePaths) {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("SUM", "LAMBDA(x,x+100)", 0)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=Sheet1!SUM(7)")));
+
+  Arena adhoc_arena;
+  const Value adhoc = evaluate_formula_text(wb, sheet, 0U, 0U, "=Sheet1!SUM(7)", adhoc_arena, default_registry());
+  ASSERT_TRUE(adhoc.is_error()) << adhoc.debug_to_string();
+  EXPECT_EQ(adhoc.as_error(), ErrorCode::Name);
+
+  EvalState state;
+  EvalContext ctx(wb, sheet, state);
+  parser::Reference ref = MakeLocalRef(0U, 1U);  // B1 stores the same invalid entry.
+  Arena recursive_arena;
+  const Value recursive = ctx.resolve_ref(ref, recursive_arena, default_registry());
+  ASSERT_TRUE(recursive.is_error()) << recursive.debug_to_string();
+  EXPECT_EQ(recursive.as_error(), ErrorCode::Name);
+
+  Arena cf_arena;
+  EXPECT_FALSE(evaluate_cf_formula(wb, sheet, 0U, 0U, 0U, 0U, "=Sheet1!SUM(7)", cf_arena, default_registry()));
+  EXPECT_TRUE(evaluate_cf_formula(wb, sheet, 0U, 0U, 0U, 0U, "=1", cf_arena, default_registry()));
+}
+
 TEST(EvalContextRecursive, ReadOnlyRangeUsesCommittedSpillAnchorScalar) {
   Workbook wb = Workbook::create();
   ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(5)")));
diff --git a/tests/unit/eval/getpivotdata_lazy_test.cpp b/tests/unit/eval/getpivotdata_lazy_test.cpp
index d3529d9ba..720bbc1eb 100644
--- a/tests/unit/eval/getpivotdata_lazy_test.cpp
+++ b/tests/unit/eval/getpivotdata_lazy_test.cpp
@@ -27,6 +27,7 @@
 #include "eval/eval_context.h"
 #include "eval/eval_state.h"
 #include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
 #include "eval/tree_walker.h"
 #include "gtest/gtest.h"
 #include "parser/ast.h"
@@ -37,6 +38,7 @@
 #include "pivot/pivot_types.h"
 #include "sheet.h"
 #include "utils/arena.h"
+#include "utils/date_time.h"
 #include "utils/error.h"
 #include "value.h"
 #include "workbook.h"
@@ -155,6 +157,173 @@ Workbook BuildBasicWorkbook() {
   return wb;
 }
 
+// A one-field pivot whose two source values render to the same caption. The
+// underlying types remain distinct so GETPIVOTDATA must use typed identity
+// before it considers a display-label fallback.
+Workbook BuildNumericTextCollisionWorkbook() {
+  auto cache = std::make_unique<pivot::PivotCache>();
+  cache->set_cache_id(1U);
+  pivot::PivotCacheField region_field;
+  region_field.name = "Region";
+  cache->mutable_fields().push_back(std::move(region_field));
+  pivot::PivotCacheField amount_field;
+  amount_field.name = "Amount";
+  cache->mutable_fields().push_back(std::move(amount_field));
+
+  pivot::PivotCacheRecord numeric;
+  numeric.cells = {Value::number(1.0), Value::number(30.0)};
+  cache->mutable_records().push_back(std::move(numeric));
+  pivot::PivotCacheRecord text;
+  text.cells = {owned_text(*cache, "1"), Value::number(40.0)};
+  cache->mutable_records().push_back(std::move(text));
+
+  auto table = BuildBasicTable();
+  Workbook wb = Workbook::create();
+  wb.add_pivot_cache(std::move(cache));
+  wb.sheet(0).add_pivot_table(std::move(table));
+  return wb;
+}
+
+// A two-axis pivot where both distinct fields expose the same custom caption.
+// A GETPIVOTDATA field name matching that caption is ambiguous and must not
+// silently bind to whichever axis happens to appear first in the model.
+Workbook BuildDuplicateCaptionWorkbook() {
+  auto cache = std::make_unique<pivot::PivotCache>();
+  cache->set_cache_id(1U);
+  for (const char* name : {"Region", "Product", "Amount"}) {
+    pivot::PivotCacheField field;
+    field.name = name;
+    cache->mutable_fields().push_back(std::move(field));
+  }
+  auto add = [&](const char* region, const char* product, double amount) {
+    pivot::PivotCacheRecord record;
+    record.cells = {owned_text(*cache, region), owned_text(*cache, product), Value::number(amount)};
+    cache->mutable_records().push_back(std::move(record));
+  };
+  add("North", "A", 10.0);
+  add("North", "B", 20.0);
+  add("South", "A", 30.0);
+  add("South", "B", 40.0);
+
+  auto table = std::make_unique<pivot::PivotTable>();
+  table->set_name("PivotTable1");
+  table->set_pivot_cache_id(1U);
+  pivot::PivotField region;
+  region.source_name = "Region";
+  region.custom_name = "Axis";
+  region.axis = pivot::PivotAxis::Row;
+  table->mutable_fields().push_back(std::move(region));
+  pivot::PivotField product;
+  product.source_name = "Product";
+  product.custom_name = "Axis";
+  product.axis = pivot::PivotAxis::Col;
+  table->mutable_fields().push_back(std::move(product));
+  pivot::PivotField amount;
+  amount.source_name = "Amount";
+  amount.axis = pivot::PivotAxis::Value;
+  table->mutable_fields().push_back(std::move(amount));
+  pivot::PivotDataField sum_amount;
+  sum_amount.name = "Sum of Amount";
+  sum_amount.field_index = 2U;
+  sum_amount.aggregation = pivot::Aggregation::Sum;
+  table->mutable_data_fields().push_back(std::move(sum_amount));
+  table->mutable_row_field_order().push_back(0U);
+  table->mutable_col_field_order().push_back(1U);
+  table->set_anchor(2U, 0U, 6U, 4U);
+
+  Workbook wb = Workbook::create();
+  wb.add_pivot_cache(std::move(cache));
+  wb.sheet(0).add_pivot_table(std::move(table));
+  return wb;
+}
+
+// A two-level row-axis pivot keeps the numeric/text collision under two
+// different parents so the lookup must preserve both typed identity and the
+// preceding-parent leaf offset.
+Workbook BuildNestedCollisionWorkbook() {
+  auto cache = std::make_unique<pivot::PivotCache>();
+  cache->set_cache_id(1U);
+  for (const char* name : {"Region", "Product", "Amount"}) {
+    pivot::PivotCacheField field;
+    field.name = name;
+    cache->mutable_fields().push_back(std::move(field));
+  }
+  auto add = [&](const char* region, Value product, double amount) {
+    pivot::PivotCacheRecord record;
+    record.cells = {owned_text(*cache, region), product, Value::number(amount)};
+    cache->mutable_records().push_back(std::move(record));
+  };
+  add("North", Value::number(1.0), 30.0);
+  add("North", owned_text(*cache, "1"), 40.0);
+  add("South", Value::number(1.0), 50.0);
+  add("South", owned_text(*cache, "1"), 60.0);
+
+  auto table = std::make_unique<pivot::PivotTable>();
+  table->set_name("PivotTable1");
+  table->set_pivot_cache_id(1U);
+  for (const char* name : {"Region", "Product", "Amount"}) {
+    pivot::PivotField field;
+    field.source_name = name;
+    field.axis = std::string_view(name) == "Amount" ? pivot::PivotAxis::Value : pivot::PivotAxis::Row;
+    table->mutable_fields().push_back(std::move(field));
+  }
+  pivot::PivotDataField sum_amount;
+  sum_amount.name = "Sum of Amount";
+  sum_amount.field_index = 2U;
+  sum_amount.aggregation = pivot::Aggregation::Sum;
+  table->mutable_data_fields().push_back(std::move(sum_amount));
+  table->mutable_row_field_order() = {0U, 1U};
+  table->set_anchor(2U, 0U, 8U, 2U);
+
+  Workbook wb = Workbook::create();
+  wb.add_pivot_cache(std::move(cache));
+  wb.sheet(0).add_pivot_table(std::move(table));
+  return wb;
+}
+
+Workbook BuildGroupedDateWorkbook(pivot::DateGrouping granularity = pivot::DateGrouping::Year) {
+  auto cache = std::make_unique<pivot::PivotCache>();
+  cache->set_cache_id(1U);
+  cache->mutable_fields().push_back(pivot::PivotCacheField{"Date", {}});
+  cache->mutable_fields().push_back(pivot::PivotCacheField{"Amount", {}});
+  auto add = [&](int year, unsigned month, unsigned day, double amount) {
+    pivot::PivotCacheRecord record;
+    record.cells = {Value::number(date_time::serial_from_ymd(year, month, day, false)), Value::number(amount)};
+    cache->mutable_records().push_back(std::move(record));
+  };
+  add(2024, 1U, 1U, 10.0);
+  add(2024, 6U, 15U, 20.0);
+  add(2025, 3U, 1U, 40.0);
+
+  auto table = std::make_unique<pivot::PivotTable>();
+  table->set_name("PivotTable1");
+  table->set_pivot_cache_id(1U);
+  pivot::PivotField date;
+  date.source_name = "Date";
+  date.axis = pivot::PivotAxis::Row;
+  pivot::PivotDateGroup date_group;
+  date_group.granularity = granularity;
+  date_group.calendar = pivot::CalendarSystem::Gregorian;
+  date.date_group = date_group;
+  table->mutable_fields().push_back(std::move(date));
+  pivot::PivotField amount;
+  amount.source_name = "Amount";
+  amount.axis = pivot::PivotAxis::Value;
+  table->mutable_fields().push_back(std::move(amount));
+  pivot::PivotDataField sum_amount;
+  sum_amount.name = "Sum of Amount";
+  sum_amount.field_index = 1U;
+  sum_amount.aggregation = pivot::Aggregation::Sum;
+  table->mutable_data_fields().push_back(std::move(sum_amount));
+  table->mutable_row_field_order() = {0U};
+  table->set_anchor(2U, 0U, 5U, 2U);
+
+  Workbook wb = Workbook::create();
+  wb.add_pivot_cache(std::move(cache));
+  wb.sheet(0).add_pivot_table(std::move(table));
+  return wb;
+}
+
 // The basic workbook plus one record whose Region cell carries no value —
 // the shape a source row with an empty row-field cell produces.
 Workbook BuildBlankRegionWorkbook() {
@@ -222,6 +391,112 @@ TEST(GetPivotDataLazy, RowFieldSouthReturnsLeafSum) {
   EXPECT_EQ(v.as_number(), 700.0);
 }
 
+TEST(GetPivotDataLazy, NumericAndTextItemsWithSameLabelUseTypedIdentity) {
+  Workbook wb = BuildNumericTextCollisionWorkbook();
+  EvalState state;
+  const EvalContext ctx(wb, wb.sheet(0), state);
+  const Value numeric = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Region\", 1)", ctx);
+  const Value text = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Region\", \"1\")", ctx);
+  ASSERT_TRUE(numeric.is_number());
+  ASSERT_TRUE(text.is_number());
+  EXPECT_EQ(numeric.as_number(), 30.0);
+  EXPECT_EQ(text.as_number(), 40.0);
+}
+
+TEST(GetPivotDataLazy, DuplicateCustomCaptionAcrossAxesReturnsRef) {
+  Workbook wb = BuildDuplicateCaptionWorkbook();
+  EvalState state;
+  const EvalContext ctx(wb, wb.sheet(0), state);
+  const Value v = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Axis\", \"North\")", ctx);
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(GetPivotDataLazy, PivotPushedOffGridByRowInsertTurnsDependentIntoRef) {
+  Workbook wb = BuildBasicWorkbook();
+  ASSERT_TRUE(static_cast<bool>(
+      wb.set_cell_formula(0U, 0U, 5U, "=GETPIVOTDATA(\"Sum of Amount\", A3, \"Region\", \"North\")")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  const Cell* before = wb.sheet(0).cell_at(0U, 5U);
+  ASSERT_NE(before, nullptr);
+  ASSERT_TRUE(before->cached_value.is_number());
+  EXPECT_EQ(before->cached_value.as_number(), 300.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0U, 1U, Sheet::kMaxRows - 2U)));
+  EXPECT_TRUE(wb.sheet(0).pivot_tables().empty());
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  const Cell* after = wb.sheet(0).cell_at(0U, 5U);
+  ASSERT_NE(after, nullptr);
+  ASSERT_TRUE(after->cached_value.is_error());
+  EXPECT_EQ(after->cached_value.as_error(), ErrorCode::Ref);
+}
+
+TEST(GetPivotDataLazy, DistinctRowAndColumnFieldsUseTheirLeafOffsets) {
+  Workbook wb = BuildDuplicateCaptionWorkbook();
+  EvalState state;
+  const EvalContext ctx(wb, wb.sheet(0), state);
+  const Value v = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Region\", \"South\", \"Product\", \"B\")", ctx);
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 40.0);
+}
+
+TEST(GetPivotDataLazy, NestedParentsPreserveTypedLeafIdentity) {
+  Workbook wb = BuildNestedCollisionWorkbook();
+  EvalState state;
+  const EvalContext ctx(wb, wb.sheet(0), state);
+  const Value numeric = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Region\", \"South\", \"Product\", 1)", ctx);
+  const Value text = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Region\", \"South\", \"Product\", \"1\")", ctx);
+  ASSERT_TRUE(numeric.is_number());
+  ASSERT_TRUE(text.is_number());
+  EXPECT_EQ(numeric.as_number(), 50.0);
+  EXPECT_EQ(text.as_number(), 60.0);
+}
+
+TEST(GetPivotDataLazy, GroupedDisplayLabelIsUniqueFallback) {
+  Workbook wb = BuildGroupedDateWorkbook();
+  EvalState state;
+  const EvalContext ctx(wb, wb.sheet(0), state);
+  const Value v = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Date\", \"2024\")", ctx);
+  ASSERT_TRUE(v.is_number());
+  EXPECT_EQ(v.as_number(), 30.0);
+}
+
+TEST(GetPivotDataLazy, DateGroupSyntheticSortKeyIsNotAnItem) {
+  // Month buckets sort on y*100+m; that key is not a source value and must
+  // not address the group, while the group's label still does.
+  Workbook wb = BuildGroupedDateWorkbook(pivot::DateGrouping::Month);
+  EvalState state;
+  const EvalContext ctx(wb, wb.sheet(0), state);
+  const Value by_key = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Date\", 202401)", ctx);
+  ASSERT_TRUE(by_key.is_error());
+  EXPECT_EQ(by_key.as_error(), ErrorCode::Ref);
+  const Value by_label = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Date\", \"2024-01\")", ctx);
+  ASSERT_TRUE(by_label.is_number());
+  EXPECT_EQ(by_label.as_number(), 10.0);
+}
+
+TEST(GetPivotDataLazy, AxisIdentityOwnsCopiedText) {
+  Workbook wb = BuildBasicWorkbook();
+  EvalState state;
+  const EvalContext ctx(wb, wb.sheet(0), state);
+  const Value first = EvalWith("=GETPIVOTDATA(\"Sum of Amount\", A3, \"Region\", \"North\")", ctx);
+  ASSERT_TRUE(first.is_number());
+  EXPECT_EQ(first.as_number(), 300.0);
+
+  const auto& table = *wb.sheet(0).pivot_tables().front();
+  const std::shared_ptr<const pivot::PivotResult> snapshot = table.last_result();
+  ASSERT_NE(snapshot, nullptr);
+  ASSERT_EQ(snapshot->rows.size(), 2U);
+  ASSERT_TRUE(snapshot->rows[0].identity.has_value());
+  ASSERT_TRUE(snapshot->rows[0].identity->is_text());
+  EXPECT_EQ(snapshot->rows[0].identity->as_text(), "North");
+
+  auto& cache = *wb.mutable_pivot_caches().front();
+  ASSERT_FALSE(cache.mutable_text_storage().empty());
+  cache.mutable_text_storage().front() = "Changed";
+  EXPECT_EQ(snapshot->rows[0].identity->as_text(), "North");
+}
+
 // The lookup matches axis labels exactly, so the group formed by blank source
 // cells is only reachable if it carries the workbook locale's placeholder
 // label. An unnamed group would leave those records addressable by nothing at
diff --git a/tests/unit/eval/partial_recalc_test.cpp b/tests/unit/eval/partial_recalc_test.cpp
index 1c0a45b45..f70a9724e 100644
--- a/tests/unit/eval/partial_recalc_test.cpp
+++ b/tests/unit/eval/partial_recalc_test.cpp
@@ -51,6 +51,17 @@ Value CustomSpill(const Value* /*args*/, std::uint32_t /*arity*/, Arena& arena)
   return Value::array(array);
 }
 
+Value CustomVerticalSpill(const Value* /*args*/, std::uint32_t /*arity*/, Arena& arena) {
+  Value* cells = nullptr;
+  ArrayValue* array = allocate_array_value(2U, 1U, arena, cells);
+  if (array == nullptr) {
+    return Value::error(ErrorCode::Num);
+  }
+  cells[0] = Value::number(7.0);
+  cells[1] = Value::number(8.0);
+  return Value::array(array);
+}
+
 Value CustomArrayAbs(const Value* /*args*/, std::uint32_t /*arity*/, Arena& arena) {
   Value* cells = nullptr;
   ArrayValue* array = allocate_array_value(1U, 2U, arena, cells);
@@ -384,6 +395,316 @@ TEST(PartialRecalc, InitialPhantomOnlySpillDependencyAndRemoteDirtyContract) {
   EXPECT_TRUE(wb.recalc_engine().dirty().contains(CellNodeId{1U, 0U, 1U}));
 }
 
+TEST(PartialRecalc, DirectPhantomReadPullsPotentialProducerBeforeFirstCommit) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+
+  // B1 reads A2, which is initially only a virtual spill cell. Since A1 has
+  // not been evaluated yet, there is no committed spill edge from B1's direct
+  // dependency to the producer. A viewport containing B1 must still admit
+  // A1 as the potential producer before evaluating the direct read.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A2")));
+
+  ASSERT_TRUE(static_cast<bool>(wb.partial_recalc(default_registry(), SingleCell(0U, 1U))));
+
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 1U).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(0).resolve_cell_value(1U, 0U).as_number(), 2.0);
+}
+
+TEST(PartialRecalc, CrossSheetDirectPhantomReadRefreshesAfterProducerRewrite) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  const std::size_t producer_sheet = wb.add_sheet("Producer");
+
+  // The watcher is on Sheet1 while its direct phantom read and potential
+  // producer are on Producer. The first partial pass has no committed spill
+  // edge to follow, so closure expansion must stay scoped to Producer.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(producer_sheet, 0U, 0U, "=SEQUENCE(2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=Producer!A2")));
+
+  ASSERT_TRUE(static_cast<bool>(wb.partial_recalc(default_registry(), SingleCell(0U, 1U))));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 1U).as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(producer_sheet).resolve_cell_value(1U, 0U).as_number(), 2.0);
+
+  // Rewriting the producer must replace the committed footprint and refresh
+  // the cross-sheet phantom in the same viewport-bounded call.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(producer_sheet, 0U, 0U, "=SEQUENCE(2,1,10,10)")));
+  ASSERT_TRUE(static_cast<bool>(wb.partial_recalc(default_registry(), SingleCell(0U, 1U))));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 1U).as_number(), 20.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(producer_sheet).resolve_cell_value(1U, 0U).as_number(), 20.0);
+}
+
+TEST(PartialRecalc, RegistrySensitiveDirectReadUsesRuntimeProducerShape) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  FunctionRegistry registry;
+  register_builtins(registry);
+  ASSERT_TRUE(registry.register_function(FunctionDef{"CUSTOMVERTICALSPILL", 0U, kVariadic, &CustomVerticalSpill}));
+
+  // CUSTOMVERTICALSPILL is registry-sensitive in the potential index because formula
+  // registration has no host registry. The runtime registry still classifies
+  // it as array-capable before the direct phantom read admits its anchor.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=CUSTOMVERTICALSPILL()")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A2")));
+
+  auto stats = wb.partial_recalc(registry, SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_GE(stats.value().cells_evaluated, 2U);
+  const Value anchor = CellValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(anchor.is_number()) << "anchor kind=" << static_cast<int>(anchor.kind())
+                                  << (anchor.is_error()
+                                          ? " error=" + std::to_string(static_cast<int>(anchor.as_error()))
+                                          : "");
+  EXPECT_DOUBLE_EQ(anchor.as_number(), 7.0);
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind());
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 8.0);
+  const Value phantom = wb.sheet(0).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(phantom.is_number()) << "phantom kind=" << static_cast<int>(phantom.kind());
+  EXPECT_DOUBLE_EQ(phantom.as_number(), 8.0);
+}
+
+TEST(PartialRecalc, DirectCandidateExpansionSkipsOccupiedCoordinate) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::number(42.0))));
+
+  // B1 is an unrelated occupied literal. A1 is a geometrically possible
+  // producer for B1, but it cannot be admitted from an occupied coordinate:
+  // doing so would evaluate A1 and change unrelated cells even though the
+  // viewport never reads A1 or its phantom cells.
+  ASSERT_TRUE(static_cast<bool>(wb.partial_recalc(default_registry(), SingleCell(0U, 1U))));
+
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 1U).as_number(), 42.0);
+  EXPECT_TRUE(CellValue(wb, 0U, 0U, 0U).is_blank());
+  EXPECT_TRUE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+}
+
+TEST(PartialRecalc, StoredBlankTargetStillAdmitsDirectSpillProducer) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  // A blank stored cell is an available spill slot. The static closure path
+  // must treat it like an unmaterialized phantom, not like an occupied value.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::blank())));    // A2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));  // A1:A2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A2")));           // B1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_GE(stats.value().cells_evaluated, 2U);
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value phantom = wb.sheet(0).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind());
+  ASSERT_TRUE(phantom.is_number()) << "phantom kind=" << static_cast<int>(phantom.kind());
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(phantom.as_number(), 2.0);
+}
+
+TEST(PartialRecalc, StoredBlankTargetStillAdmitsDynamicSpillProducer) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  // The dynamic-read candidate path sees A2 as an existing blank cell. That
+  // blank is still a legal spill destination and must not suppress A1's
+  // potential-producer admission.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::blank())));         // A2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));       // A1:A2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"A2\")")));  // B1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_GE(stats.value().cells_evaluated, 2U);
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value phantom = wb.sheet(0).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind());
+  ASSERT_TRUE(anchor.is_number()) << "anchor kind=" << static_cast<int>(anchor.kind());
+  ASSERT_TRUE(phantom.is_number()) << "phantom kind=" << static_cast<int>(phantom.kind());
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(anchor.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(phantom.as_number(), 2.0);
+}
+
+TEST(PartialRecalc, DynamicReadSkipsOccupiedLiteralTarget) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(42.0))));    // A2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));       // A1:A2 candidate
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"A2\")")));  // B1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_EQ(stats.value().cells_evaluated, 1U);  // only the volatile reader
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value anchor = CellValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind());
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 42.0);
+  EXPECT_TRUE(anchor.is_blank());
+  EXPECT_TRUE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+  EXPECT_FALSE(wb.recalc_engine().dep_graph().has_dependency_source(CellNodeId{0U, 0U, 1U}, CellNodeId{0U, 0U, 0U},
+                                                                    DepGraph::DependencySource::kDynamicReference));
+}
+
+TEST(PartialRecalc, DirectReadSkipsProducerBlockedAboveTarget) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  // A spill reaching A9 from A1 would cover A5, so A1 cannot feed C1's read.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));    // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 4U, 0U, Value::number(5.0))));  // A5
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=A9")));             // C1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 2U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_EQ(stats.value().cells_evaluated, 1U);
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 2U).as_number(), 0.0);
+  EXPECT_TRUE(CellValue(wb, 0U, 0U, 0U).is_blank());
+  EXPECT_TRUE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+}
+
+TEST(PartialRecalc, DirectReadSkipsProducerBlockedLeftOfTarget) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  // A spill reaching E1 from A1 would cover C1, so A1 cannot feed A3's read.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(1,2)")));  // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 2U, Value::number(5.0))));  // C1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 2U, 0U, "=E1")));             // A3
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(2U, 0U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_EQ(stats.value().cells_evaluated, 1U);
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 2U, 0U).as_number(), 0.0);
+  EXPECT_TRUE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+}
+
+TEST(PartialRecalc, DirectReadStillAdmitsProducerWhoseOwnCellIsTheNearestBlocker) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  // A3 is the producer itself; the literal above it in A1 does not block it.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(5.0))));  // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 2U, 0U, "=SEQUENCE(3)")));    // A3:A5
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=A5")));             // C1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 2U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 2U).as_number(), 3.0);
+}
+
+TEST(PartialRecalc, FormulaBlockerAboveTargetAdmitsOnlyProducersBelowIt) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));  // A1, blocked by A3
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 2U, 0U, "=1+1")));          // A3
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 5U, 0U, "=SEQUENCE(4)")));  // A6:A9
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=A9")));           // C1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 2U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 2U).as_number(), 4.0);
+  EXPECT_TRUE(CellValue(wb, 0U, 0U, 0U).is_blank());
+  EXPECT_TRUE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+}
+
+TEST(PartialRecalc, StaleProducerGrowingIntoTargetIsStillAdmitted) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 3U, Value::number(2.0))));  // D1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=D1")));             // C1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(C1)")));   // A1:A2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 4U, "=A5")));             // E1
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  ASSERT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 4U).as_number(), 0.0);
+
+  // A1 is clean and its committed spill stops at A2, but its input grows it over A5.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 3U, Value::number(5.0))));
+  ASSERT_FALSE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 4U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 4U).as_number(), 5.0);
+  EXPECT_DOUBLE_EQ(wb.sheet(0).resolve_cell_value(4U, 0U).as_number(), 5.0);
+}
+
+TEST(PartialRecalc, DependentOutsideViewportRefreshesOnLaterFullRecalc) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0))));  // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1")));             // B1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=B1*10")));          // C1
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  ASSERT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 2U).as_number(), 10.0);
+
+  // The edit dirties B1 only; C1 lies outside B1's viewport closure.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.partial_recalc(default_registry(), SingleCell(0U, 1U))));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 1U).as_number(), 2.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 2U).as_number(), 20.0);
+}
+
+TEST(PartialRecalc, RangeDependentOutsideViewportRefreshesOnLaterFullRecalc) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0))));  // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1")));             // B1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 1U, Value::number(5.0))));  // B2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=SUM(B1:B2)")));     // C1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 3U, "=SUM(B:B)")));       // D1, compact range
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  ASSERT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 2U).as_number(), 6.0);
+  ASSERT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 3U).as_number(), 6.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.partial_recalc(default_registry(), SingleCell(0U, 1U))));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 1U).as_number(), 2.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 2U).as_number(), 7.0);
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 3U).as_number(), 7.0);
+}
+
+TEST(PartialRecalc, CrossSheetDependentOutsideViewportRefreshesOnLaterFullRecalc) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0))));  // Sheet1!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=A1")));             // Sheet1!B1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 0U, "=Sheet1!B1*10")));   // Sheet2!A1
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  ASSERT_DOUBLE_EQ(CellValue(wb, 1U, 0U, 0U).as_number(), 10.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(2.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.partial_recalc(default_registry(), SingleCell(0U, 1U))));
+
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  EXPECT_DOUBLE_EQ(CellValue(wb, 1U, 0U, 0U).as_number(), 20.0);
+}
+
+TEST(PartialRecalc, DynamicReadSkipsFullyOccupiedRectangle) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(3,3)")));             // A1 candidate
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 1U, Value::number(1.0))));             // B2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 2U, 1U, Value::number(2.0))));             // B3
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 4U, "=SUM(INDIRECT(\"B2:B3\"))")));  // E1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 4U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_EQ(stats.value().cells_evaluated, 1U);  // only the volatile reader
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 4U).as_number(), 3.0);
+  EXPECT_TRUE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+}
+
+TEST(PartialRecalc, DynamicReadRectangleStillAdmitsProducerReachingAnOpenCell) {
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(3)")));               // A1:A3
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 3U, 0U, Value::number(4.0))));             // A4
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 4U, "=SUM(INDIRECT(\"A3:A4\"))")));  // E1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 4U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_GE(stats.value().cells_evaluated, 2U);
+  EXPECT_DOUBLE_EQ(CellValue(wb, 0U, 0U, 4U).as_number(), 7.0);
+}
+
 TEST(PartialRecalc, DefinedNameReindexClearsStaleSpillInViewport) {
   Workbook wb = Workbook::create();
   wb.set_excel_profile(mac_365_ja_jp_profile());
@@ -598,5 +919,263 @@ TEST(PartialRecalc, MultiStageSpillChainCompletesInOneCall) {
   EXPECT_DOUBLE_EQ(wb.sheet(0).resolve_cell_value(0U, 3U).as_number(), 2.0);
 }
 
+TEST(PartialRecalc, DynamicReadDiscoversUncommittedSpillProducerInSameCall) {
+  // B1's INDIRECT read resolves to A2 only after B1 is evaluated. Before the
+  // first spill commit there is no graph edge from that phantom to A1, so the
+  // partial closure must discover the north-west potential producer from the
+  // runtime read and retry B1 in the same call.
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));       // A1:A2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"A2\")")));  // B1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_GE(stats.value().cells_evaluated, 2U);
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value phantom = wb.sheet(0).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind());
+  ASSERT_TRUE(anchor.is_number()) << "anchor kind=" << static_cast<int>(anchor.kind());
+  ASSERT_TRUE(phantom.is_number()) << "phantom kind=" << static_cast<int>(phantom.kind());
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(anchor.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(phantom.as_number(), 2.0);
+}
+
+TEST(PartialRecalc, DynamicReadDiscoversCrossSheetSpillProducerInSameCall) {
+  // The runtime target is on another sheet. Candidate discovery must use the
+  // target sheet's north-west anchor, rather than accidentally searching the
+  // reader's sheet or adding a cross-sheet graph edge to a guessed cell.
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  const std::size_t producer_sheet = wb.add_sheet("Producer");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(producer_sheet, 0U, 0U, "=SEQUENCE(2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"Producer!A2\")")));
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_GE(stats.value().cells_evaluated, 2U);
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value anchor = CellValue(wb, producer_sheet, 0U, 0U);
+  const Value phantom = wb.sheet(producer_sheet).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind());
+  ASSERT_TRUE(anchor.is_number()) << "anchor kind=" << static_cast<int>(anchor.kind());
+  ASSERT_TRUE(phantom.is_number()) << "phantom kind=" << static_cast<int>(phantom.kind());
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(anchor.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(phantom.as_number(), 2.0);
+}
+
+TEST(PartialRecalc, DynamicReadScalarCandidateDoesNotCreateFalseCycle) {
+  // A1 can spill only when B1 is non-zero. With B1 reading the as-yet-empty
+  // A2 phantom, A1 must settle to scalar zero. The candidate relationship is
+  // temporary; it must not become a persistent B1 -> A1 edge that turns the
+  // conditional producer into a false SCC or schedules endless retries.
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=IF(B1,SEQUENCE(2),0)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"A2\")")));
+
+  auto first = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(first));
+  EXPECT_GE(first.value().cells_evaluated, 2U);
+  const Value first_anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value first_watcher = CellValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(first_anchor.is_number()) << "anchor kind=" << static_cast<int>(first_anchor.kind());
+  ASSERT_TRUE(first_watcher.is_number()) << "watcher kind=" << static_cast<int>(first_watcher.kind());
+  EXPECT_DOUBLE_EQ(first_anchor.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(first_watcher.as_number(), 0.0);
+  EXPECT_FALSE(wb.recalc_engine().dep_graph().has_dependency_source(CellNodeId{0U, 0U, 1U}, CellNodeId{0U, 0U, 0U},
+                                                                    DepGraph::DependencySource::kDynamicReference));
+
+  auto second = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(second));
+  // INDIRECT remains volatile, so the reader itself runs once on a later
+  // viewport call. The attempted scalar candidate must not add another
+  // retry or turn the temporary relationship into a cycle.
+  EXPECT_LE(second.value().cells_evaluated, 4U);
+  EXPECT_EQ(second.value().cycle_cells, 0U);
+  const Value second_watcher = CellValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(second_watcher.is_number()) << "watcher kind=" << static_cast<int>(second_watcher.kind());
+  EXPECT_DOUBLE_EQ(second_watcher.as_number(), 0.0);
+  EXPECT_FALSE(wb.recalc_engine().dep_graph().has_dependency_source(CellNodeId{0U, 0U, 1U}, CellNodeId{0U, 0U, 0U},
+                                                                    DepGraph::DependencySource::kDynamicReference));
+}
+
+TEST(PartialRecalc, DynamicReadReexploresScalarCandidateAfterItStartsGrowing) {
+  // The first call evaluates A1's conditional producer as scalar because C1
+  // is zero. After C1 changes, the next partial call must re-explore the
+  // temporary candidate and admit the now-growing A1 spill rather than
+  // retaining the prior scalar rejection forever.
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 2U, Value::number(0.0))));         // C1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=IF(C1,SEQUENCE(2),0)")));  // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"A2\")")));      // B1
+
+  auto scalar = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(scalar));
+  const Value scalar_anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value scalar_watcher = CellValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(scalar_anchor.is_number()) << "anchor kind=" << static_cast<int>(scalar_anchor.kind());
+  ASSERT_TRUE(scalar_watcher.is_number()) << "watcher kind=" << static_cast<int>(scalar_watcher.kind());
+  EXPECT_DOUBLE_EQ(scalar_anchor.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(scalar_watcher.as_number(), 0.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 2U, Value::number(1.0))));
+  auto growing = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(growing));
+  EXPECT_GE(growing.value().cells_evaluated, 2U);
+  const Value growing_anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value growing_watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value growing_phantom = wb.sheet(0).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(growing_anchor.is_number()) << "anchor kind=" << static_cast<int>(growing_anchor.kind());
+  ASSERT_TRUE(growing_watcher.is_number()) << "watcher kind=" << static_cast<int>(growing_watcher.kind());
+  ASSERT_TRUE(growing_phantom.is_number()) << "phantom kind=" << static_cast<int>(growing_phantom.kind());
+  EXPECT_DOUBLE_EQ(growing_anchor.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(growing_watcher.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(growing_phantom.as_number(), 2.0);
+}
+
+TEST(PartialRecalc, DynamicReadWholeColumnDoesNotEnumerateRuntimeRectangle) {
+  // INDIRECT records a full-column rectangle while INDEX needs only one
+  // selected cell. Candidate discovery must scan the bounded producer index
+  // without walking all 1,048,576 coordinates in the runtime read.
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(2)")));                   // A1:A2
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDEX(INDIRECT(\"A:A\"),2,1)")));  // B1
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_LE(stats.value().cells_evaluated, 4U);
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value phantom = wb.sheet(0).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(anchor.is_number()) << "anchor kind=" << static_cast<int>(anchor.kind())
+                                  << " evals=" << stats.value().cells_evaluated;
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind());
+  ASSERT_TRUE(phantom.is_number()) << "phantom kind=" << static_cast<int>(phantom.kind());
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(phantom.as_number(), 2.0);
+}
+
+TEST(PartialRecalc, DynamicReadSmallSpillThatMissesTargetStopsRetrying) {
+  // A1 is array-capable but its one-cell result cannot reach A2. The
+  // speculative pair must be attempted once, leave B1 at zero, and finish
+  // without installing a false dynamic edge or retrying forever.
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(1)")));       // A1 only
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"A2\")")));  // B1
+
+  auto first = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(first));
+  EXPECT_LE(first.value().cells_evaluated, 4U);
+  const Value first_watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value first_anchor = CellValue(wb, 0U, 0U, 0U);
+  ASSERT_TRUE(first_watcher.is_number()) << "watcher kind=" << static_cast<int>(first_watcher.kind());
+  ASSERT_TRUE(first_anchor.is_number()) << "anchor kind=" << static_cast<int>(first_anchor.kind());
+  EXPECT_DOUBLE_EQ(first_watcher.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(first_anchor.as_number(), 1.0);
+  EXPECT_TRUE(wb.sheet(0).resolve_cell_value(1U, 0U).is_blank());
+  EXPECT_FALSE(wb.recalc_engine().dep_graph().has_dependency_source(CellNodeId{0U, 0U, 1U}, CellNodeId{0U, 0U, 0U},
+                                                                    DepGraph::DependencySource::kDynamicReference));
+
+  auto second = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(second));
+  EXPECT_LE(second.value().cells_evaluated, 2U);  // the volatile reader itself runs once
+  const Value second_watcher = CellValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(second_watcher.is_number()) << "watcher kind=" << static_cast<int>(second_watcher.kind());
+  EXPECT_DOUBLE_EQ(second_watcher.as_number(), 0.0);
+}
+
+TEST(PartialRecalc, DynamicReadDiscoversCleanProducerWithDirtyAncestor) {
+  // D1 -> C1 is dirty after the input edit, while A1's conditional producer
+  // is still clean until closure propagation reaches it. A viewport containing
+  // only B1 must admit clean A1 so its dirty ancestor can wake the producer.
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 3U, Value::number(0.0))));         // D1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=D1")));                    // C1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=IF(C1,SEQUENCE(2),0)")));  // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"A2\")")));      // B1
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  const Value initial_anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value initial_watcher = CellValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(initial_anchor.is_number()) << "anchor kind=" << static_cast<int>(initial_anchor.kind());
+  ASSERT_TRUE(initial_watcher.is_number()) << "watcher kind=" << static_cast<int>(initial_watcher.kind());
+  EXPECT_DOUBLE_EQ(initial_anchor.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(initial_watcher.as_number(), 0.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 3U, Value::number(1.0))));
+  EXPECT_TRUE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 2U}));
+  EXPECT_FALSE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_GE(stats.value().cells_evaluated, 2U);
+  const Value anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value phantom = wb.sheet(0).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(anchor.is_number()) << "anchor kind=" << static_cast<int>(anchor.kind());
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind());
+  ASSERT_TRUE(phantom.is_number()) << "phantom kind=" << static_cast<int>(phantom.kind());
+  EXPECT_DOUBLE_EQ(anchor.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(phantom.as_number(), 2.0);
+}
+
+TEST(PartialRecalc, DynamicReadCleanProducerFollowsCompactRangeAncestor) {
+  // C1's SUM(E:E) starts clean and has no spill-derived edge. After a new
+  // D100 spill populates E100, only C1 is directly dirtied. B1's viewport
+  // closure must admit clean A1, expand through C1's compact range, then
+  // refresh A1's conditional spill before resolving the A2 read.
+  Workbook wb = Workbook::create();
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=SUM(E:E)")));              // C1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=IF(C1,SEQUENCE(2),0)")));  // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=INDIRECT(\"A2\")")));      // B1
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  const Value initial_anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value initial_watcher = CellValue(wb, 0U, 0U, 1U);
+  ASSERT_TRUE(initial_anchor.is_number()) << "anchor kind=" << static_cast<int>(initial_anchor.kind());
+  ASSERT_TRUE(initial_watcher.is_number()) << "watcher kind=" << static_cast<int>(initial_watcher.kind());
+  EXPECT_DOUBLE_EQ(initial_anchor.as_number(), 0.0);
+  EXPECT_DOUBLE_EQ(initial_watcher.as_number(), 0.0);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 99U, 3U, "=SEQUENCE(1,2)")));  // D100:E100
+  EXPECT_FALSE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 2U}));
+  EXPECT_FALSE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+
+  auto stats = wb.partial_recalc(default_registry(), SingleCell(0U, 1U));
+  ASSERT_TRUE(static_cast<bool>(stats));
+  EXPECT_GE(stats.value().cells_evaluated, 3U);
+  const Value anchor = CellValue(wb, 0U, 0U, 0U);
+  const Value watcher = CellValue(wb, 0U, 0U, 1U);
+  const Value range_sum = CellValue(wb, 0U, 0U, 2U);
+  const Value phantom = wb.sheet(0).resolve_cell_value(1U, 0U);
+  ASSERT_TRUE(anchor.is_number()) << "anchor kind=" << static_cast<int>(anchor.kind())
+                                  << " evals=" << stats.value().cells_evaluated;
+  ASSERT_TRUE(watcher.is_number()) << "watcher kind=" << static_cast<int>(watcher.kind())
+                                   << " evals=" << stats.value().cells_evaluated;
+  ASSERT_TRUE(range_sum.is_number()) << "range sum kind=" << static_cast<int>(range_sum.kind())
+                                     << " evals=" << stats.value().cells_evaluated;
+  EXPECT_TRUE(phantom.is_number()) << "phantom kind=" << static_cast<int>(phantom.kind())
+                                   << " evals=" << stats.value().cells_evaluated << " anchor=" << anchor.as_number()
+                                   << " watcher=" << watcher.as_number();
+  EXPECT_DOUBLE_EQ(anchor.as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(watcher.as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(range_sum.as_number(), 2.0);
+  EXPECT_EQ(stats.value().cycle_cells, 0U);
+  EXPECT_FALSE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 0U}));
+  EXPECT_FALSE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 1U}));
+  EXPECT_FALSE(wb.recalc_engine().dirty().contains(CellNodeId{0U, 0U, 2U}));
+  if (phantom.is_number()) {
+    EXPECT_DOUBLE_EQ(phantom.as_number(), 2.0);
+  }
+}
+
 }  // namespace
 }  // namespace formulon::eval
diff --git a/tests/unit/eval/recalc_engine_test.cpp b/tests/unit/eval/recalc_engine_test.cpp
index f06fb46f3..e44e13ebb 100644
--- a/tests/unit/eval/recalc_engine_test.cpp
+++ b/tests/unit/eval/recalc_engine_test.cpp
@@ -10,11 +10,13 @@
 #include <string>
 
 #include "cell.h"
+#include "eval/builtin_names.h"
 #include "eval/dep_graph.h"
 #include "eval/function_registry.h"
 #include "eval/scheduler.h"
 #include "eval/volatile_tracker.h"
 #include "gtest/gtest.h"
+#include "utils/arena.h"
 #include "utils/error.h"
 #include "value.h"
 #include "workbook.h"
@@ -627,6 +629,34 @@ TEST(RecalcEngine, LastWatcherReleasesTheRangeNode) {
   EXPECT_TRUE(graph.empty());
 }
 
+// Repeated writes under one rectangle mark its watchers once, yet a watcher
+// registered after that marking, without being dirtied itself, is still
+// reached by the next write even after an earlier watcher's removal moves it.
+TEST(RecalcEngine, RangeWatcherMarkingReachesWatchersAddedSinceTheLastWrite) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=COUNT(A:A)")));  // B1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 1U, 1U, "=COUNT(A:A)")));  // B2
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  RecalcEngine& engine = wb.recalc_engine();
+  const CellNodeId b1{0U, 0U, 1U};
+  const CellNodeId b2{0U, 1U, 1U};
+  const CellNodeId b3{0U, 2U, 1U};
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(1.0))));
+  EXPECT_TRUE(engine.dirty().contains(b1));
+  EXPECT_TRUE(engine.dirty().contains(b2));
+
+  Arena arena;
+  const parser::AstNode* ast = parse_formula_entry("COUNT(A:A)", arena);
+  ASSERT_NE(ast, nullptr);
+  engine.register_formula(b3, *ast, wb);
+  ASSERT_FALSE(engine.dirty().contains(b3));
+  engine.unregister_formula(b1);
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::number(2.0))));
+  EXPECT_TRUE(engine.dirty().contains(b3));
+}
+
 // ---------------------------------------------------------------------------
 // Parallel scheduler contracts shared with the serial engine
 // ---------------------------------------------------------------------------
diff --git a/tests/unit/eval/text_format_date_test.cpp b/tests/unit/eval/text_format_date_test.cpp
index d591dee66..ddbe55317 100644
--- a/tests/unit/eval/text_format_date_test.cpp
+++ b/tests/unit/eval/text_format_date_test.cpp
@@ -12,9 +12,12 @@
 
 #include <string>
 #include <string_view>
+#include <utility>
 
+#include "eval/text_format/display_text.h"
 #include "eval/text_format/number_format.h"
 #include "gtest/gtest.h"
+#include "util/test_eval_helpers.h"
 
 namespace formulon {
 namespace text_format {
@@ -24,6 +27,9 @@ std::string Render(double value, std::string_view format) {
   std::string out;
   const FormatStatus s = apply_format(value, format, out);
   EXPECT_EQ(s, FormatStatus::kOk);
+  const auto display = format_value_for_display(Value::number(value), format, false);
+  EXPECT_EQ(display.status, DisplayStatus::kOk);
+  EXPECT_EQ(display.text, out);
   return out;
 }
 
@@ -194,6 +200,93 @@ TEST(DateFormatFractionalSeconds, TwoDigits) {
   EXPECT_EQ(out, "12:00:00.50");
 }
 
+TEST(DateFormatFractionalSeconds, DecimalDigitsSurviveRounding) {
+  EXPECT_EQ(Render(0.3 / 86400.0, "ss.00"), "00.30");
+  EXPECT_EQ(Render(0.29 / 86400.0, "ss.000"), "00.290");
+  EXPECT_EQ(Render(0.58 / 86400.0, "ss.00"), "00.58");
+  EXPECT_EQ(Render(0.5 + 0.3 / 86400.0, "hh:mm:ss.00"), "12:00:00.30");
+}
+
+TEST(DateFormatFractionalSeconds, WidePrecisionRemainsFiniteAndKeepsAllPlaceholders) {
+  const std::string format = "ss." + std::string(400, '0');
+  EXPECT_EQ(Render(0.5 / 86400.0, format), "00.5" + std::string(399, '0'));
+}
+
+TEST(DateFormatElapsed, WideFieldsKeepTheirPadding) {
+  for (char token : {'h', 'm', 's'}) {
+    const std::string format = "[" + std::string(256, token) + "]";
+    EXPECT_EQ(Render(1.0 / 86400.0, format), std::string(255, '0') + (token == 's' ? "1" : "0"));
+  }
+}
+
+TEST(DateFormatElapsed, RoundedComponentsCarryTogether) {
+  EXPECT_EQ(Render(3599.6 / 86400.0, "[h]:mm:ss"), "1:00:00");
+  EXPECT_EQ(Render(59.6 / 86400.0, "[m]:ss"), "1:00");
+  EXPECT_EQ(Render(1.6 / 86400.0, "[s]"), "2");
+  EXPECT_EQ(Render(1.0 + 86399.6 / 86400.0, "[h]:mm:ss"), "48:00:00");
+  EXPECT_EQ(Render(59.996 / 86400.0, "[m]:ss.00"), "1:00.00");
+  EXPECT_EQ(Render(59.994 / 86400.0, "[m]:ss.00"), "0:59.99");
+}
+
+TEST(DateFormatTime, TextBuiltinUsesTheSameRounding) {
+  for (const auto& row :
+       {std::pair{"=TEXT(0.3/86400,\"ss.00\")", "00.30"}, std::pair{"=TEXT(3599.6/86400,\"[h]:mm:ss\")", "1:00:00"},
+        std::pair{"=TEXT(DATE(9999,12,31)+0.5,\"yyyy/mm/dd hh:mm:ss\")", "9999/12/31 12:00:00"}}) {
+    const Value value = test::EvalSource(row.first);
+    ASSERT_TRUE(value.is_text()) << row.first;
+    EXPECT_EQ(value.as_text(), row.second);
+  }
+}
+
+TEST(DateFormatTime, MidnightRoundingCarriesIntoCalendarFieldsInBothEpochs) {
+  for (bool date1904 : {false, true}) {
+    const double day = date1904 ? 43830.0 : 45292.0;
+    for (const char* code : {"yyyy/mm/dd hh:mm:ss", "yyyy/mm/dd"}) {
+      std::string out;
+      EXPECT_EQ(apply_format(day + 86399.6 / 86400.0, code, out, date1904), FormatStatus::kOk);
+      EXPECT_EQ(out, std::string("2024/01/02") + (std::string_view(code).size() > 10 ? " 00:00:00" : ""));
+    }
+  }
+}
+
+TEST(DateFormatRange, RoundedCalendarCannotAdvanceBeyondYear9999) {
+  for (bool date1904 : {false, true}) {
+    const double last_day = date1904 ? 2957003.0 : 2958465.0;
+    for (const char* code : {"yyyy/mm/dd hh:mm:ss", "yyyy/mm/dd"}) {
+      std::string out = "prefix";
+      EXPECT_EQ(apply_format(last_day + 86399.6 / 86400.0, code, out, date1904), FormatStatus::kOverflow);
+      EXPECT_EQ(out, "prefix");
+      const auto display = format_value_for_display(Value::number(last_day + 86399.6 / 86400.0), code, date1904);
+      EXPECT_EQ(display.status, DisplayStatus::kOverflow);
+      if (date1904) {
+        EXPECT_EQ(apply_format(-(last_day + 86399.6 / 86400.0), code, out, true), FormatStatus::kOverflow);
+        EXPECT_EQ(out, "prefix");
+      }
+    }
+  }
+}
+
+TEST(DateFormatRange, LastCalendarDayIncludesTimeInBothEpochs) {
+  for (bool date1904 : {false, true}) {
+    const double last_day = date1904 ? 2957003.0 : 2958465.0;
+    std::string out;
+    EXPECT_EQ(apply_format(last_day + 0.5, "yyyy/mm/dd hh:mm:ss", out, date1904), FormatStatus::kOk);
+    EXPECT_EQ(out, "9999/12/31 12:00:00");
+    const auto display = format_value_for_display(Value::number(last_day + 0.5), "yyyy/mm/dd hh:mm:ss", date1904);
+    EXPECT_EQ(display.status, DisplayStatus::kOk);
+    EXPECT_EQ(display.text, "9999/12/31 12:00:00");
+    if (date1904) {
+      out.clear();
+      EXPECT_EQ(apply_format(-(last_day + 0.5), "yyyy/mm/dd hh:mm:ss", out, true), FormatStatus::kOk);
+      EXPECT_EQ(out, "-9999/12/31 12:00:00");
+      out.clear();
+      EXPECT_EQ(apply_format(-(last_day + 1.0), "yyyy/mm/dd", out, true), FormatStatus::kOverflow);
+    }
+    out.clear();
+    EXPECT_EQ(apply_format(last_day + 1.0, "yyyy/mm/dd", out, date1904), FormatStatus::kOverflow);
+  }
+}
+
 TEST(DateFormatFractionalSeconds, OneDigit) {
   // 12:00:00.3 -> rendered at .0 precision rounds to .3.
   const double frac = 0.5 + 0.3 / 86400.0;
@@ -241,6 +334,32 @@ TEST(DateFormatMixedRejection, MonthAndZeroDigit) {
   EXPECT_EQ(s, FormatStatus::kValueError);
 }
 
+// ---------------------------------------------------------------------------
+// Calendar range (Excel Range.Text, ja-JP).
+// ---------------------------------------------------------------------------
+
+TEST(DateFormatRange, SerialZeroIsDayZeroOf1900) {
+  EXPECT_EQ(Render(0.0, "yyyy/m/d"), "1900/1/0");
+  EXPECT_EQ(Render(0.5, "yyyy/m/d"), "1900/1/0");
+  EXPECT_EQ(Render(0.0, R"(ggge"年"m"月"d"日")"), "明治33年1月0日");
+}
+
+TEST(DateFormatRange, OutOfRangeSerialIsOverflow) {
+  std::string out;
+  EXPECT_EQ(apply_format(-1.0, "yyyy/m/d", out), FormatStatus::kOverflow);
+  EXPECT_EQ(apply_format(2958466.0, "h:mm:ss", out), FormatStatus::kOverflow);
+  EXPECT_EQ(apply_format(2958465.0, "yyyy/m/d", out, /*date1904=*/true), FormatStatus::kOverflow);
+}
+
+TEST(DateFormatRange, Negative1904SerialShowsALeadingMinus) {
+  std::string out;
+  EXPECT_EQ(apply_format(-1.0, "yyyy/m/d", out, /*date1904=*/true), FormatStatus::kOk);
+  EXPECT_EQ(out, "-1904/1/2");
+  out.clear();
+  EXPECT_EQ(apply_format(-1234.5678, "[h]:mm", out, /*date1904=*/true), FormatStatus::kOk);
+  EXPECT_EQ(out, "-29629:37");
+}
+
 }  // namespace
 }  // namespace text_format
 }  // namespace formulon
diff --git a/tests/unit/eval/text_format_number_test.cpp b/tests/unit/eval/text_format_number_test.cpp
index 7e561c9b6..1d663d642 100644
--- a/tests/unit/eval/text_format_number_test.cpp
+++ b/tests/unit/eval/text_format_number_test.cpp
@@ -6,9 +6,11 @@
 // `value_numbervalue_test.cpp`.
 
 #include <cmath>
+#include <limits>
 #include <string>
 #include <string_view>
 
+#include "eval/text_format/display_text.h"
 #include "eval/text_format/number_format.h"
 #include "gtest/gtest.h"
 
@@ -29,6 +31,50 @@ std::string Render(double value, std::string_view format) {
 // Integer-only formats (no decimal point)
 // ---------------------------------------------------------------------------
 
+TEST(NumberFormatIntegers, LargeFiniteValuesProduceCompleteDigitsWithoutNulls) {
+  const std::string digits = "1" + std::string(308, '0');
+  EXPECT_EQ(Render(1E308, "0"), digits);
+  EXPECT_EQ(Render(-1E308, "0.00"), "-" + digits + ".00");
+  const auto display = format_value_for_display(Value::number(1E308), "0", false);
+  EXPECT_EQ(display.status, DisplayStatus::kOk);
+  EXPECT_EQ(display.text, digits);
+}
+
+TEST(NumberFormatIntegers, MaximumFiniteDoubleCanRoundBeyondItsBinaryRange) {
+  const double value = std::numeric_limits<double>::max();
+  const std::string expected = "179769313486232" + std::string(294, '0');
+  EXPECT_EQ(Render(value, "0"), expected);
+  EXPECT_EQ(Render(-value, "0"), "-" + expected);
+  // General budgets 11 characters; the three-digit exponent leaves four fractional digits.
+  EXPECT_EQ(Render(value, "General"), "1.7977E+308");
+}
+
+TEST(NumberFormatPercent, ScalingOverflowReturnsOverflowWithoutAppending) {
+  std::string out = "prefix";
+  EXPECT_EQ(apply_format(1E307, "0%", out), FormatStatus::kOverflow);
+  EXPECT_EQ(out, "prefix");
+  const auto display = format_value_for_display(Value::number(1E307), "0%", false);
+  EXPECT_EQ(display.status, DisplayStatus::kOverflow);
+  EXPECT_EQ(display.text, "########");
+}
+
+TEST(NumberFormatScientific, WideRequiredMantissaPaddingRemainsRenderable) {
+  const std::string format = std::string(310, '0') + "E+00";
+  std::string out;
+  EXPECT_EQ(apply_format(1E308, format, out), FormatStatus::kOk);
+  EXPECT_EQ(out.size(), 314U);
+  EXPECT_EQ(out.substr(310), "E+00");
+  EXPECT_EQ(out[0], '0');
+  EXPECT_EQ(out[1], '1');
+}
+
+TEST(NumberFormatScientific, ExcessiveEngineeringGroupOverflowLeavesOutputUntouched) {
+  const std::string format = std::string(1000, '0') + "E+00";
+  std::string out = "prefix";
+  EXPECT_EQ(apply_format(1E-300, format, out), FormatStatus::kOverflow);
+  EXPECT_EQ(out, "prefix");
+}
+
 TEST(NumberFormatIntegers, ZeroPad) {
   EXPECT_EQ(Render(5.0, "000"), "005");
 }
@@ -239,6 +285,75 @@ TEST(NumberFormatScientific, ExpNegativeExponent) {
   EXPECT_EQ(Render(0.0001234, "0.00E+00"), "1.23E-04");
 }
 
+TEST(NumberFormatScientific, ExcelMantissaNormalizationAndStoredDisplayParity) {
+  struct Case {
+    double value;
+    const char* format;
+    const char* expected;
+  };
+  const Case cases[] = {
+      {9.999, "0.00E+00", "1.00E+01"},
+      {-9.999, "0.00E+00", "-1.00E+01"},
+      {999.999, "##0.00E+00", "1.00E+03"},
+      {12345.0, "00.00E+00", "01.23E+04"},
+      {12345.0, "##0.00E+00", "12.35E+03"},
+      {0.012345, "##0.00E+00", "12.35E-03"},
+      {12345.0, "###.00E+00", "12.35E+03"},
+      {0.0012345, "#.00E+00", "1.23E-03"},
+      {1234.0, "00.00E+00", "12.34E+02"},
+      {1234.0, "000.00E+00", "001.23E+03"},
+      {1234.0, "##00.00E+00", "1234.00E+00"},
+      {12345.0, "?0.00E+00", " 1.23E+04"},
+      {12345.0, "??0.00E+00", " 12.35E+03"},
+      {1.0, "0.##E+00", "1.E+00"},
+      {1.23, "\"USD \"0.00E+00\" end\"", "USD 1.23E+00 end"},
+  };
+  for (const Case& test_case : cases) {
+    std::string out;
+    EXPECT_EQ(apply_format(test_case.value, test_case.format, out), FormatStatus::kOk) << test_case.format;
+    EXPECT_EQ(out, test_case.expected) << test_case.format;
+
+    const auto display = format_value_for_display(Value::number(test_case.value), test_case.format, false);
+    EXPECT_EQ(display.status, DisplayStatus::kOk) << test_case.format;
+    EXPECT_EQ(display.text, test_case.expected) << test_case.format;
+  }
+}
+
+TEST(NumberFormatScientific, OptionalFractionPlaceholdersTrimOnlyOptionalDigits) {
+  EXPECT_EQ(Render(1.201, "0.#0"), "1.20");
+  EXPECT_EQ(Render(1.201, "0.0#"), "1.2");
+}
+
+TEST(NumberFormatNumeric, RepeatedPointsAndInterleavedLiteralsRemainStable) {
+  EXPECT_EQ(Render(1.2345, "0.00.00"), "1.23.45");
+  EXPECT_EQ(Render(1.23995, "0.00.00"), "1.24.00");
+  EXPECT_EQ(Render(1.2345, "0.00\"x\"00"), "1.23x45");
+}
+
+TEST(NumberFormatSections, NumericAndTextPlaceholderIsInvalid) {
+  for (const char* format : {"0 @", "0.00@", "yyyy@", "General@", "0.00E+00@"}) {
+    std::string out = "prefix";
+    EXPECT_EQ(apply_format(5.0, format, out), FormatStatus::kValueError) << format;
+    EXPECT_EQ(out, "prefix") << format;
+
+    const auto display = format_value_for_display(Value::number(5.0), format, false);
+    EXPECT_EQ(display.status, DisplayStatus::kInvalidFormat) << format;
+    EXPECT_EQ(display.text, "5") << format;
+  }
+}
+
+TEST(NumberFormatSections, RepeatedPercentAndScientificPercentAreInvalid) {
+  for (const char* format : {"0%%", "0.00E+00%"}) {
+    std::string out = "prefix";
+    EXPECT_EQ(apply_format(5.0, format, out), FormatStatus::kValueError) << format;
+    EXPECT_EQ(out, "prefix") << format;
+
+    const auto display = format_value_for_display(Value::number(5.0), format, false);
+    EXPECT_EQ(display.status, DisplayStatus::kInvalidFormat) << format;
+    EXPECT_EQ(display.text, "5") << format;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Literal passthrough / escapes / quoted text
 // ---------------------------------------------------------------------------
@@ -260,6 +375,32 @@ TEST(NumberFormatLiteral, BangEscape) {
   EXPECT_EQ(Render(10.0, "!@0"), "@10");
 }
 
+TEST(NumberFormatLiteral, IncompleteSyntaxReturnsErrorWithoutAppending) {
+  for (const char* code : {"0!", "0\\", "0_", "0*", "0\"open", "[h", "[$-411", "@!", "@\\", "@_", "@*", "@\"open"}) {
+    SCOPED_TRACE(code);
+    std::string out = "prefix";
+    EXPECT_EQ(apply_format(12.0, code, out), FormatStatus::kValueError);
+    EXPECT_EQ(out, "prefix");
+    EXPECT_EQ(apply_text_format("hello", code, out), FormatStatus::kValueError);
+    EXPECT_EQ(out, "prefix");
+    const auto number_display = format_value_for_display(Value::number(12), code, false);
+    EXPECT_EQ(number_display.status, DisplayStatus::kInvalidFormat);
+    EXPECT_EQ(number_display.text, "12");
+    const auto text_display = format_value_for_display(Value::text("hello"), code, false);
+    EXPECT_EQ(text_display.status, DisplayStatus::kInvalidFormat);
+    EXPECT_EQ(text_display.text, "hello");
+  }
+}
+
+TEST(NumberFormatLiteral, CompleteEscapesAndDelimitersRemainValid) {
+  EXPECT_EQ(Render(12, "0\\!"), "12!");
+  EXPECT_EQ(Render(12, "0!x"), "12x");
+  EXPECT_EQ(Render(12, "0\"open\""), "12open");
+  std::string out;
+  EXPECT_EQ(apply_text_format("hello", "@\\!", out), FormatStatus::kOk);
+  EXPECT_EQ(out, "hello!");
+}
+
 // Mac Excel 16.111.3 (ja-JP) accepts the syntax-bearing full-width forms
 // below. The normalizer intentionally folds only those forms outside opaque
 // quoted/escaped payloads; a full-width A remains a literal.
@@ -340,10 +481,22 @@ TEST(NumberFormatSections, FourSectionsNumericValueUsesFirst) {
 
 TEST(NumberFormatSections, TextSectionIsReachableThroughPublicFormatter) {
   std::string out;
-  EXPECT_EQ(apply_format(0.0, "0.0;(0.0);\"z\";\"text: \"@", "abc", out), FormatStatus::kOk);
+  EXPECT_EQ(apply_text_format("abc", "0.0;(0.0);\"z\";\"text: \"@", out), FormatStatus::kOk);
   EXPECT_EQ(out, "text: abc");
 }
 
+TEST(NumberFormatSections, EmptyTextTakesTheTextSection) {
+  std::string out;
+  EXPECT_EQ(apply_text_format("", "0;0;0;\"<\"@\">\"", out), FormatStatus::kOk);
+  EXPECT_EQ(out, "<>");
+}
+
+TEST(NumberFormatSections, TextWithoutATextSectionIsUnchanged) {
+  std::string out;
+  EXPECT_EQ(apply_text_format("abc", "0.00", out), FormatStatus::kOk);
+  EXPECT_EQ(out, "abc");
+}
+
 // ---------------------------------------------------------------------------
 // Bracketed specifiers: named colours tolerated, locale-currency discarded,
 // unknown qualifiers rejected.
@@ -373,6 +526,29 @@ TEST(NumberFormatBracketed, EnglishColorNameIsValueError) {
   EXPECT_EQ(apply_format(5.0, "[Color12]0.00", out), FormatStatus::kValueError);
 }
 
+TEST(NumberFormatBracketed, StoredDialectTakesEnglishColorNames) {
+  // A stored cell format spells colours in English, case-insensitively, and
+  // the ja-JP names are not colours there.
+  std::string out;
+  for (const char* code : {"[Black]0.00", "[Blue]0.00", "[Cyan]0.00", "[Green]0.00", "[Magenta]0.00", "[Red]0.00",
+                           "[White]0.00", "[Yellow]0.00", "[red]0.00", "[Color1]0.00", "[Color56]0.00"}) {
+    out.clear();
+    EXPECT_EQ(apply_format(5.0, code, out, false, FormatDialect::kStored), FormatStatus::kOk) << code;
+    EXPECT_EQ(out, "5.00") << code;
+  }
+  EXPECT_EQ(apply_format(5.0, "[Color57]0.00", out, false, FormatDialect::kStored), FormatStatus::kValueError);
+  EXPECT_EQ(apply_format(5.0, "[\xE8\xB5\xA4]0.00", out, false, FormatDialect::kStored),  // [赤]
+            FormatStatus::kValueError);
+}
+
+TEST(NumberFormatBracketed, NegativeSectionColorFollowsTheDialect) {
+  EXPECT_TRUE(negative_section_has_color("0;[Red]0", FormatDialect::kStored));
+  EXPECT_FALSE(negative_section_has_color("[Red]0;0", FormatDialect::kStored));
+  EXPECT_TRUE(negative_section_has_color("[Color3]0", FormatDialect::kStored));
+  EXPECT_FALSE(negative_section_has_color("0;[Red]0", FormatDialect::kLocalized));
+  EXPECT_TRUE(negative_section_has_color("0;[\xE8\xB5\xA4]0", FormatDialect::kLocalized));
+}
+
 TEST(NumberFormatBracketed, ColorNameMatchesAsAPrefix) {
   // Anything trailing the name inside the same bracket is ignored, which is
   // how `[水色]` and `[黄色]` come to be accepted.
@@ -454,11 +630,11 @@ TEST(NumberFormatBracketed, ConditionalLeMatchesNegative) {
   EXPECT_EQ(Render(0.0, "[<=0]0.00;0.00"), "0.00");
 }
 
-TEST(NumberFormatBracketed, ConditionalExplicitMinusIsNotDoubled) {
-  // A conditional section is not inherently a negative section. Its literal
-  // minus supplies the sign itself, so the numeric renderer must use the
-  // magnitude rather than adding a second prefix.
-  EXPECT_EQ(Render(-1.5, "[<=0]-0.00;0.00"), "-1.50");
+TEST(NumberFormatBracketed, ConditionalLiteralMinusPreservesSignedPredicate) {
+  // Excel keeps the negative sign selected by the value and also copies the
+  // explicit literal minus from a matching conditional section.
+  EXPECT_EQ(Render(-1.5, "[<=0]-0.00;0.00"), "--1.50");
+  EXPECT_EQ(Render(-1.5, "[<0]-0.00;0.00"), "-1.50");
 }
 
 TEST(NumberFormatBracketed, ConditionalEqOperator) {
@@ -500,10 +676,12 @@ TEST(NumberFormatUnderscoreSkip, SpaceBeforeDigits) {
   EXPECT_EQ(Render(5.0, "_(0.00"), " 5.00");
 }
 
-TEST(NumberFormatUnderscoreSkip, TrailingUnderscoreIsLiteral) {
-  // A dangling `_` at end-of-format has no following byte to reserve;
-  // it falls back to the single-byte literal path.
-  EXPECT_EQ(Render(5.0, "0_"), "5_");
+TEST(NumberFormatUnderscoreSkip, LiteralTrailingUnderscoreRequiresEscape) {
+  // Mac Excel 16.113.3 rejects a dangling `_`; an escaped underscore is literal.
+  std::string out = "prefix";
+  EXPECT_EQ(apply_format(5.0, "0_", out), FormatStatus::kValueError);
+  EXPECT_EQ(out, "prefix");
+  EXPECT_EQ(Render(5.0, "0\\_"), "5_");
 }
 
 // ---------------------------------------------------------------------------
@@ -557,12 +735,12 @@ TEST(NumberFormatGeneral, JaJpKeywordMatchesEnglishGeneral) {
 }
 
 TEST(NumberFormatGeneral, JaJpKeywordHonoursDbNumQualifier) {
-  // A `[DBNum1-3]` qualifier applies to General's digit output the same
-  // way it applies to a digit-token format; oracle-verified as per-ASCII-
-  // digit substitution (see tests/oracle/cases/text_format.yaml
-  // text_dbnum1), not full positional kanji-numeral conversion.
+  // `[DBNum1]` spells General's integer part positionally (Excel's
+  // Range.Text for `[DBNum1]General`), unlike a digit-token format such as
+  // `[DBNum1]0`, which substitutes per digit (oracle case text_dbnum1).
+  // `[DBNum3]` stays a per-digit substitution.
   EXPECT_EQ(Render(1234.0, "[DBNum1]G/\xE6\xA8\x99\xE6\xBA\x96"),
-            "\xE4\xB8\x80\xE4\xBA\x8C\xE4\xB8\x89\xE5\x9B\x9B");  // 一二三四
+            "\xE5\x8D\x83\xE4\xBA\x8C\xE7\x99\xBE\xE4\xB8\x89\xE5\x8D\x81\xE5\x9B\x9B");  // 千二百三十四
   EXPECT_EQ(Render(1234.0, "[DBNum3]G/\xE6\xA8\x99\xE6\xBA\x96"),
             "\xEF\xBC\x91\xEF\xBC\x92\xEF\xBC\x93\xEF\xBC\x94");  // １２３４
 }
@@ -609,10 +787,15 @@ TEST(NumberFormatFraction, MixedFractionWithIntegerOne) {
   EXPECT_EQ(Render(1.5, "# ?/?"), "1 1/2");
 }
 
-TEST(NumberFormatFraction, WholeValueSuppressesFractionComponent) {
-  // An exact integer must not render the synthetic 0/1 approximation.
-  EXPECT_EQ(Render(2.0, "# ?/?"), "2");
-  EXPECT_EQ(Render(-2.0, "# ?/?"), "-2");
+TEST(NumberFormatFraction, WholeValueBlanksTheFractionComponent) {
+  // An exact integer shows no 0/1 fraction, but the separator, numerator,
+  // slash and denominator keep their width as blanks, and a zero integer is
+  // shown even under `#` (Excel Range.Text).
+  EXPECT_EQ(Render(2.0, "# ?/?"), "2    ");
+  EXPECT_EQ(Render(-2.0, "# ?/?"), "-2    ");
+  EXPECT_EQ(Render(0.0, "# ?/?"), "0    ");
+  EXPECT_EQ(Render(1e-05, "# ?/?"), "0    ");
+  EXPECT_EQ(Render(123456789012345678.0, "# ?/?"), "123456789012346000    ");
 }
 
 TEST(NumberFormatFraction, NegativeMixedFraction) {
@@ -640,6 +823,133 @@ TEST(NumberFormatFraction, ImproperFractionNoIntegerGroup) {
   EXPECT_EQ(Render(0.5, "?/?"), "1/2");
 }
 
+TEST(NumberFormatFraction, PercentScalingAppliesBeforeMixedFraction) {
+  EXPECT_EQ(Render(0.0125, "# ?/?%"), "1 1/4%");
+}
+
+TEST(NumberFormatFraction, ScalingCommaIsInvalidForFractionFormats) {
+  for (const char* format : {"# ?/?,", "# ?/?,\"K\""}) {
+    std::string out = "prefix";
+    EXPECT_EQ(apply_format(1234.5, format, out), FormatStatus::kValueError) << format;
+    EXPECT_EQ(out, "prefix") << format;
+  }
+}
+
+TEST(NumberFormatFraction, FixedDenominatorAndPlaceholderWidths) {
+  EXPECT_EQ(Render(0.3, "# ?/8"), " 2/8");
+  EXPECT_EQ(Render(1.3, "# ?/8"), "1 2/8");
+  EXPECT_EQ(Render(1.3, "?/8"), "10/8");
+  EXPECT_EQ(Render(0.3, "# ?/16"), " 5/16");
+  EXPECT_EQ(Render(0.5, "# ?/10"), " 5/10");
+  EXPECT_EQ(Render(0.5,
+                   "?"
+                   "?/??"),
+            " 1/2 ");
+  EXPECT_EQ(Render(0.123,
+                   "# ?/"
+                   "??"),
+            " 8/65");
+  EXPECT_EQ(Render(0.123,
+                   "# ??"
+                   "/?"),
+            "  1/8");
+}
+
+TEST(NumberFormatFraction, ImproperFractionExpandsBeyondPlaceholderWidth) {
+  EXPECT_EQ(Render(12.5, "?/?"), "25/2");
+  EXPECT_EQ(Render(1234.5, "?/?"), "2469/2");
+  EXPECT_EQ(Render(1000000.125, "?/?"), "8000001/8");
+  EXPECT_EQ(Render(0.00005,
+                   "?/"
+                   "?????"),
+            "1/20000");
+  const std::string tiny_expected = "0/1" + std::string(17, ' ');
+  EXPECT_EQ(Render(std::ldexp(1.0, -64),
+                   "?/"
+                   "??????????????????"),
+            tiny_expected);
+  EXPECT_EQ(Render(std::numeric_limits<double>::denorm_min(),
+                   "?/"
+                   "??????????????????"),
+            tiny_expected);
+  const std::string max_expected = "179769313486232" + std::string(294, '0') + "/1";
+  EXPECT_EQ(Render(std::numeric_limits<double>::max(), "?/?"), max_expected);
+  std::string out = "prefix";
+  EXPECT_EQ(apply_format(std::numeric_limits<double>::max(), "# ?/?%", out), FormatStatus::kOverflow);
+  EXPECT_EQ(out, "prefix");
+}
+
+TEST(NumberFormatFraction, NearEqualApproximationsPreferSmallerDenominator) {
+  // Mac Excel 16.113.3 chooses 1/8 at this Farey-neighbour boundary,
+  // including the adjacent binary64 values represented by these literals.
+  for (double value : {17.0 / 144.0, 0.11805555555555554, 0.11805555555555557}) {
+    EXPECT_EQ(Render(value, "?/?"), "1/8") << value;
+  }
+}
+
+TEST(NumberFormatFraction, VariableDenominatorSearchCapsAtSevenDigits) {
+  const std::string format = "?/" + std::string(18, '?');
+  EXPECT_EQ(Render(1.0 / 9999999.0, format), "1/9999999" + std::string(11, ' '));
+  EXPECT_EQ(Render(1.0 / 10000000.0, format), "0/1" + std::string(17, ' '));
+  EXPECT_EQ(Render(0.5000000000000001, format), "1/2" + std::string(17, ' '));
+  EXPECT_EQ(Render(1e-16, format), "0/1" + std::string(17, ' '));
+}
+
+TEST(NumberFormatFraction, FirstReciprocalOutsidePlaceholderRangeRendersZero) {
+  const std::string format = "?/" + std::string(6, '?');
+  EXPECT_EQ(Render(1.0 / 999999.0, format), "1/999999");
+  EXPECT_EQ(Render(1e-6, format), "0/1" + std::string(5, ' '));
+  EXPECT_EQ(Render(0.09, "?/?"), "0/1");
+  EXPECT_EQ(Render(0.1, "?/?"), "0/1");
+  EXPECT_EQ(Render(0.11, "?/?"), "1/9");
+  // Later continued-fraction boundaries still compare intermediate ratios.
+  EXPECT_EQ(Render(0.3, "?/?"), "2/7");
+}
+
+TEST(NumberFormatFraction, ZeroAndOptionalPlaceholderControls) {
+  EXPECT_EQ(Render(0.5, "00/00"), "01/02");
+  EXPECT_EQ(Render(0.5, "##/##"), "1/2");
+  EXPECT_EQ(Render(0.5, "# ?/0"), " 1/2");
+  EXPECT_EQ(Render(0.8, "# ?/2"), "1    ");
+  EXPECT_EQ(Render(0.75, "# ?/2"), "1    ");
+  EXPECT_EQ(Render(0.3, "# ?/8%"), "30    %");
+}
+
+TEST(NumberFormatFraction, ZeroPrefixedFixedDenominatorsKeepLiteralWidth) {
+  EXPECT_EQ(Render(0.5, "# ?/08"), " 4/0 ");
+  EXPECT_EQ(Render(0.5, "# ?/008"), " 4/0  ");
+  EXPECT_EQ(Render(0.5, "# ?/0010"), " 5/00  ");
+  EXPECT_EQ(Render(0.5, "?/008"), "4/0  ");
+  EXPECT_EQ(Render(0.75, "# ?/008"), " 6/0  ");
+  EXPECT_EQ(Render(1.0, "# ?/008"), "1      ");
+  // An all-zero denominator remains a variable placeholder run.
+  EXPECT_EQ(Render(0.5, "# ?/000"), " 1/002");
+  EXPECT_EQ(Render(0.5, "# ?/0?"), " 1/02");
+  EXPECT_EQ(Render(0.5, "# ?/?0"), " 1/20");
+}
+
+TEST(NumberFormatFraction, QuotedAndEscapedSlashIsLiteral) {
+  EXPECT_EQ(Render(0.5, "# ?\"/\"?"), "  /1");
+  EXPECT_EQ(Render(0.5, "# ?\\/?"), "  /1");
+}
+
+TEST(NumberFormatFraction, QuotedAndEscapedFixedDenominatorIsInvalid) {
+  for (const char* format : {"# ?/\"8\"", "# ?/\\8"}) {
+    std::string out = "prefix";
+    EXPECT_EQ(apply_format(0.5, format, out), FormatStatus::kValueError) << format;
+    EXPECT_EQ(out, "prefix") << format;
+  }
+}
+
+TEST(NumberFormatScale, CommaBeforeDecimalScalesIntegerSection) {
+  EXPECT_EQ(Render(1234.5, "0,.00"), "1.23");
+  EXPECT_EQ(Render(1234.5, "#,##0,.00"), "1.23");
+  EXPECT_EQ(Render(1234.5, "0,,.00"), "0.00");
+  // A comma between fractional placeholders is a passthrough separator, not
+  // a trailing scale marker.
+  EXPECT_EQ(Render(1.2345, "0.0,0"), "1.23");
+}
+
 }  // namespace
 }  // namespace text_format
 }  // namespace formulon
diff --git a/tests/unit/eval/text_format_rounding_test.cpp b/tests/unit/eval/text_format_rounding_test.cpp
index 15ffacf3e..d0487e659 100644
--- a/tests/unit/eval/text_format_rounding_test.cpp
+++ b/tests/unit/eval/text_format_rounding_test.cpp
@@ -50,6 +50,23 @@ TEST(DisplayRoundingTies, TextMatchesRoundOnTextifiedRound) {
   EXPECT_EQ(via_text, via_round);
 }
 
+TEST(DisplayRoundingSafety, LargeTextValuesAndScalingOverflow) {
+  EXPECT_EQ(EvalText("=TEXT(1E308,\"0\")"), "1" + std::string(308, '0'));
+  const Value value = EvalSource("=TEXT(1E307,\"0%\")");
+  ASSERT_TRUE(value.is_error());
+  EXPECT_EQ(value.as_error(), ErrorCode::Value);
+}
+
+TEST(DisplayRoundingSafety, HugeDecimalsReturnValueError) {
+  for (const char* formula : {"=FIXED(1,1E300)", "=FIXED(1,-1E300)", "=DOLLAR(1,1E300)", "=DOLLAR(1,-1E300)",
+                              "=USDOLLAR(1,1E300)", "=USDOLLAR(1,-1E300)"}) {
+    SCOPED_TRACE(formula);
+    const Value value = EvalSource(formula);
+    ASSERT_TRUE(value.is_error());
+    EXPECT_EQ(value.as_error(), ErrorCode::Value);
+  }
+}
+
 TEST(DisplayRoundingTies, FixedMatchesRound) {
   EXPECT_EQ(EvalText("=FIXED(1.005,2)"), "1.01");
   EXPECT_EQ(EvalText("=FIXED(2.675,2)"), "2.68");
diff --git a/tests/unit/eval/value_numbervalue_test.cpp b/tests/unit/eval/value_numbervalue_test.cpp
index ad7da3d8d..a17865e62 100644
--- a/tests/unit/eval/value_numbervalue_test.cpp
+++ b/tests/unit/eval/value_numbervalue_test.cpp
@@ -5,10 +5,14 @@
 #include "value.h"
 
 #include <cmath>
+#include <cstdint>
+#include <string>
 #include <string_view>
 
 #include "eval/eval_context.h"
 #include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
+#include "eval/text_format/number_format.h"
 #include "eval/tree_walker.h"
 #include "gtest/gtest.h"
 #include "parser/ast.h"
@@ -95,15 +99,17 @@ TEST(TextFunctionText, KanjiDate) {
   EXPECT_EQ(v.as_text(), "2024年3月15日");
 }
 
-TEST(TextFunctionText, NonNumericTextIsValueError) {
-  // Mac Excel ja-JP rejects TEXT with a non-numeric text first argument.
+TEST(TextFunctionText, MalformedFormatWithNonNumericTextIsValueError) {
+  // This malformed format remains a value error even when the first
+  // argument is non-numeric text.
   const Value v = EvalSource("=TEXT(\"abc\", \"text is @\")");
   ASSERT_TRUE(v.is_error());
   EXPECT_EQ(v.as_error(), ErrorCode::Value);
 }
 
 TEST(TextFunctionText, BoolTrueReturnsUppercaseText) {
-  // Bool values ignore the format string entirely.
+  // A numeric format has no text placeholder, so the original bool spelling
+  // passes through the text fallback.
   const Value v = EvalSource("=TEXT(TRUE, \"0\")");
   ASSERT_TRUE(v.is_text());
   EXPECT_EQ(v.as_text(), "TRUE");
@@ -141,11 +147,337 @@ TEST(TextFunctionText, TimeTextCoercesThroughTheSharedLadder) {
   EXPECT_EQ(v.as_text(), "13:30");
 }
 
-TEST(TextFunctionText, EmptyStringIsValueError) {
-  // "" is not coercible to a number; TEXT rejects it.
+TEST(TextFunctionText, EmptyStringRetainsTextForNumericFormat) {
+  // An empty text value falls back to text rendering when numeric coercion
+  // fails, even with a numeric-looking format.
   const Value v = EvalSource("=TEXT(\"\", \"0\")");
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "");
+}
+
+TEST(TextFunctionText, NonNumericTextFallsBackToTextFormats) {
+  const Value plain = EvalSource("=TEXT(\"abc\", \"@\")");
+  ASSERT_TRUE(plain.is_text());
+  EXPECT_EQ(plain.as_text(), "abc");
+
+  const Value suffix = EvalSource("=TEXT(\"abc\", \"@\"\"post\"\"\")");
+  ASSERT_TRUE(suffix.is_text());
+  EXPECT_EQ(suffix.as_text(), "abcpost");
+
+  const Value fourth = EvalSource("=TEXT(\"abc\", \"0;0;0;\"\"pre\"\"@\")");
+  ASSERT_TRUE(fourth.is_text());
+  EXPECT_EQ(fourth.as_text(), "preabc");
+
+  const Value numeric_format = EvalSource("=TEXT(\"abc\", \"0.00\")");
+  ASSERT_TRUE(numeric_format.is_text());
+  EXPECT_EQ(numeric_format.as_text(), "abc");
+}
+
+TEST(TextFunctionText, NumericTextOnlyFormatRetainsNumericRendering) {
+  const Value at = EvalSource("=TEXT(12, \"@\")");
+  ASSERT_TRUE(at.is_text());
+  EXPECT_EQ(at.as_text(), "12");
+
+  const Value literal_at = EvalSource("=TEXT(12, \"\"\"pre\"\"@\")");
+  ASSERT_TRUE(literal_at.is_text());
+  EXPECT_EQ(literal_at.as_text(), "12");
+}
+
+TEST(TextFunctionText, BoolUsesTextFormatsAndValidatesFormatErrors) {
+  const Value suffix = EvalSource("=TEXT(TRUE, \"@\"\"post\"\"\")");
+  ASSERT_TRUE(suffix.is_text());
+  EXPECT_EQ(suffix.as_text(), "TRUEpost");
+
+  const Value fourth = EvalSource("=TEXT(TRUE, \"0;0;0;\"\"pre\"\"@\")");
+  ASSERT_TRUE(fourth.is_text());
+  EXPECT_EQ(fourth.as_text(), "preTRUE");
+
+  const Value invalid = EvalSource("=TEXT(TRUE, \"[invalid]0\")");
+  ASSERT_TRUE(invalid.is_error());
+  EXPECT_EQ(invalid.as_error(), ErrorCode::Value);
+}
+
+TEST(TextFunctionText, NonNumericTextValidatesEveryFormatSection) {
+  const Value invalid = EvalSource("=TEXT(\"abc\", \"@;[invalid]0\")");
+  ASSERT_TRUE(invalid.is_error());
+  EXPECT_EQ(invalid.as_error(), ErrorCode::Value);
+}
+
+TEST(TextFunctionText, NumericValuesValidateEveryFormatSection) {
+  const Value positive_unused = EvalSource("=TEXT(1, \"0;[invalid]0\")");
+  ASSERT_TRUE(positive_unused.is_error());
+  EXPECT_EQ(positive_unused.as_error(), ErrorCode::Value);
+
+  const Value negative_unused = EvalSource("=TEXT(-1, \"[invalid]0;0\")");
+  ASSERT_TRUE(negative_unused.is_error());
+  EXPECT_EQ(negative_unused.as_error(), ErrorCode::Value);
+
+  const Value text_placeholder_unused = EvalSource("=TEXT(1, \"0;0 @\")");
+  ASSERT_TRUE(text_placeholder_unused.is_error());
+  EXPECT_EQ(text_placeholder_unused.as_error(), ErrorCode::Value);
+}
+
+TEST(TextFunctionText, TooManySectionsAreValueError) {
+  const Value numeric = EvalSource("=TEXT(1, \"0;0;0;@;0\")");
+  ASSERT_TRUE(numeric.is_error());
+  EXPECT_EQ(numeric.as_error(), ErrorCode::Value);
+
+  const Value text = EvalSource("=TEXT(\"abc\", \"0;0;0;@;0\")");
+  ASSERT_TRUE(text.is_error());
+  EXPECT_EQ(text.as_error(), ErrorCode::Value);
+
+  const Value boolean = EvalSource("=TEXT(TRUE, \"0;0;0;@;0\")");
+  ASSERT_TRUE(boolean.is_error());
+  EXPECT_EQ(boolean.as_error(), ErrorCode::Value);
+}
+
+TEST(TextFunctionText, NumericTextSectionFallsBackToGeneralForNegativeValues) {
+  const Value v = EvalSource("=TEXT(-12, \"0;@\")");
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "-12");
+}
+
+TEST(TextFunctionText, ConditionalFormatsValidateAndKeepOutputAtomic) {
+  std::string out = "prefix";
+  EXPECT_EQ(::formulon::text_format::apply_format(1.0, "[>10]0;[<0]0", out),
+            ::formulon::text_format::FormatStatus::kOverflow);
+  EXPECT_EQ(out, "prefix");
+
+  out = "prefix";
+  EXPECT_EQ(::formulon::text_format::apply_format(1.0, "[>10]0;[<0]0;[=0]0", out),
+            ::formulon::text_format::FormatStatus::kValueError);
+  EXPECT_EQ(out, "prefix");
+}
+
+TEST(TextFunctionText, ConditionalFormatsIntegrateThroughText) {
+  const Value invalid = EvalSource("=TEXT(1, \"[>10]0;[<0]0\")");
+  ASSERT_TRUE(invalid.is_error());
+  EXPECT_EQ(invalid.as_error(), ErrorCode::Value);
+
+  const Value literal_fallback = EvalSource("=TEXT(1, \"[>10]0;[<0]0;\"\"else\"\"\")");
+  ASSERT_TRUE(literal_fallback.is_text());
+  EXPECT_EQ(literal_fallback.as_text(), "else");
+
+  const Value third_predicate = EvalSource("=TEXT(1, \"[>10]0;[<0]0;[=0]0\")");
+  ASSERT_TRUE(third_predicate.is_error());
+  EXPECT_EQ(third_predicate.as_error(), ErrorCode::Value);
+}
+
+TEST(TextFunctionText, ConditionalNegativeSelectionUsesPredicateMagnitude) {
+  struct FormatCase {
+    std::string_view format;
+    std::string_view expected;
+  };
+  constexpr FormatCase cases[] = {
+      {"[<0]0;0", "5"},  {"[<-1]0;0", "5"},  {"[<=-1]0;0", "5"}, {"[=-5]0;0", "5"},   {"[<=0]0;0", "-5"},
+      {"[<1]0;0", "-5"}, {"[<=1]0;0", "-5"}, {"[<>0]0;0", "-5"}, {"[>-10]0;0", "-5"}, {"[>0]0;0", "5"},
+      {"[>=0]0;0", "5"}, {"[>10]0;0", "-5"}, {"[>=1]0;0", "-5"},
+  };
+  for (const FormatCase& test_case : cases) {
+    const std::string formula = "=TEXT(-5, \"" + std::string(test_case.format) + "\")";
+    const Value value = EvalSource(formula);
+    ASSERT_TRUE(value.is_text()) << test_case.format;
+    EXPECT_EQ(value.as_text(), test_case.expected) << test_case.format;
+  }
+}
+
+TEST(TextFunctionText, ConditionalNegativeExplicitMinusIsNotDuplicated) {
+  const Value value = EvalSource("=TEXT(-1, \"[>10]-0;[<0]-0\")");
+  ASSERT_TRUE(value.is_text());
+  EXPECT_EQ(value.as_text(), "-1");
+}
+
+TEST(TextFunctionText, ConditionalLiteralSignsFollowSelectedPredicate) {
+  const Value leading = EvalSource("=TEXT(-1.5, \"[<=0]-0.00;0.00\")");
+  ASSERT_TRUE(leading.is_text());
+  EXPECT_EQ(leading.as_text(), "--1.50");
+
+  const Value prefix = EvalSource("=TEXT(-1.5, \"[<=0]\"\"pre-\"\"0.00;0.00\")");
+  ASSERT_TRUE(prefix.is_text());
+  EXPECT_EQ(prefix.as_text(), "-pre-1.50");
+
+  const Value suffix = EvalSource("=TEXT(-1.5, \"[<=0]0.00-;0.00\")");
+  ASSERT_TRUE(suffix.is_text());
+  EXPECT_EQ(suffix.as_text(), "-1.50-");
+}
+
+TEST(TextFunctionText, ConditionalSecondPredicateAndThreeSectionFallbackUseMagnitude) {
+  const Value selected = EvalSource("=TEXT(-1, \"[>10]0;[<0]0\")");
+  ASSERT_TRUE(selected.is_text());
+  EXPECT_EQ(selected.as_text(), "1");
+
+  const Value fallback = EvalSource("=TEXT(-1, \"[>10]0;0;0\")");
+  ASSERT_TRUE(fallback.is_text());
+  EXPECT_EQ(fallback.as_text(), "1");
+}
+
+TEST(TextFunctionText, ConditionalSingleSectionNoMatchFallsThrough) {
+  const Value value = EvalSource("=TEXT(1, \"[>10]0\")");
+  ASSERT_TRUE(value.is_text());
+  EXPECT_EQ(value.as_text(), "1");
+}
+
+TEST(TextFunctionText, ConditionalDispatchUsesImplicitSignArms) {
+  const auto eval_text = [](std::string_view number, std::string_view format) {
+    std::string escaped_format;
+    escaped_format.reserve(format.size());
+    for (const char ch : format) {
+      if (ch == '"') {
+        escaped_format.append("\"\"");
+      } else {
+        escaped_format.push_back(ch);
+      }
+    }
+    const std::string formula = "=TEXT(" + std::string(number) + ",\"" + escaped_format + "\")";
+    return EvalSource(formula);
+  };
+  const auto expect_text = [&](std::string_view number, std::string_view format, std::string_view expected) {
+    const Value value = eval_text(number, format);
+    ASSERT_TRUE(value.is_text()) << format;
+    EXPECT_EQ(value.as_text(), expected) << format;
+  };
+  const auto expect_value_error = [&](std::string_view number, std::string_view format) {
+    const Value value = eval_text(number, format);
+    ASSERT_TRUE(value.is_error()) << format;
+    EXPECT_EQ(value.as_error(), ErrorCode::Value) << format;
+  };
+
+  constexpr std::string_view first_predicate = "[>10]\"first\"0;\"second\"0;\"third\"0";
+  expect_text("-5", first_predicate, "second5");
+  expect_text("5", first_predicate, "third5");
+  expect_text("0", first_predicate, "third0");
+  expect_text("15", first_predicate, "first15");
+  expect_text("-5", "[<0]\"first\"0;\"second\"0;\"third\"0", "first5");
+
+  constexpr std::string_view second_predicate = "\"first\"0;[>10]\"second\"0;\"third\"0";
+  expect_text("-5", second_predicate, "-third5");
+  expect_text("5", second_predicate, "first5");
+  expect_text("0", second_predicate, "third0");
+  expect_text("15", second_predicate, "first15");
+  expect_text("-5", "\"first\"0;[<0]\"second\"0;\"third\"0", "second5");
+
+  expect_text("5", "0;[>10]0", "5");
+  expect_text("15", "0;[>10]0", "15");
+  expect_value_error("-5", "0;[>10]0");
+  expect_value_error("0", "0;[>10]0");
+  expect_text("-5", "0;[<0]0", "5");
+  expect_value_error("0", "0;[<0]0");
+
+  expect_text("-5", "[>=-10]0", "-5");
+  expect_text("-15", "[>=-10]0", "15");
+}
+
+TEST(TextFunctionText, ConditionalSingleSectionSignBoundaries) {
+  const Value equal_zero = EvalSource("=TEXT(-5, \"[=0]0\")");
+  ASSERT_TRUE(equal_zero.is_text());
+  EXPECT_EQ(equal_zero.as_text(), "-5");
+
+  const Value equal_negative = EvalSource("=TEXT(-5, \"[=-10]0\")");
+  ASSERT_TRUE(equal_negative.is_text());
+  EXPECT_EQ(equal_negative.as_text(), "-5");
+
+  const Value not_equal_at_point = EvalSource("=TEXT(-5, \"[<>-5]0\")");
+  ASSERT_TRUE(not_equal_at_point.is_text());
+  EXPECT_EQ(not_equal_at_point.as_text(), "5");
+
+  const Value not_equal_fallback = EvalSource("=TEXT(-5, \"[<>-5]0;0\")");
+  ASSERT_TRUE(not_equal_fallback.is_text());
+  EXPECT_EQ(not_equal_fallback.as_text(), "5");
+
+  const Value not_equal_match = EvalSource("=TEXT(-5, \"[<>-10]0\")");
+  ASSERT_TRUE(not_equal_match.is_text());
+  EXPECT_EQ(not_equal_match.as_text(), "-5");
+
+  const Value less_than_false = EvalSource("=TEXT(-5, \"[<-10]0\")");
+  ASSERT_TRUE(less_than_false.is_text());
+  EXPECT_EQ(less_than_false.as_text(), "5");
+}
+
+TEST(TextFunctionText, EmptyFormatKeepsKindSpecificFallbacks) {
+  const Value numeric = EvalSource("=TEXT(12, \"\")");
+  ASSERT_TRUE(numeric.is_text());
+  EXPECT_EQ(numeric.as_text(), "");
+
+  const Value text = EvalSource("=TEXT(\"abc\", \"\")");
+  ASSERT_TRUE(text.is_text());
+  EXPECT_EQ(text.as_text(), "abc");
+
+  const Value boolean = EvalSource("=TEXT(TRUE, \"\")");
+  ASSERT_TRUE(boolean.is_text());
+  EXPECT_EQ(boolean.as_text(), "TRUE");
+}
+
+TEST(TextFunctionText, NumErrorPropagatesBeforeFormatRouting) {
+  const Value v = EvalSource("=TEXT(#NUM!, \"0\")");
   ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Value);
+  EXPECT_EQ(v.as_error(), ErrorCode::Num);
+}
+
+TEST(TextFunctionText, FormatErrorPropagatesBeforeKindRouting) {
+  const Value v = EvalSource("=TEXT(TRUE, #REF!)");
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Ref);
+}
+
+TEST(TextFunctionText, DateTextUsesWorkbookEpochAfterNumericCoercion) {
+  Workbook wb = Workbook::create();
+  wb.set_date1904(true);
+  const Value v = EvalSourceIn("=TEXT(\"2024-03-15\", \"yyyy-mm-dd\")", wb, wb.sheet(0));
+  ASSERT_TRUE(v.is_text());
+  EXPECT_EQ(v.as_text(), "2024-03-15");
+}
+
+TEST(TextFunctionText, ReferencesPreserveCellKindsAndFormatCells) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::text("123"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::text("0.00"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::text("abc"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 1U, Value::text("@\"post\""))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 2U, 0U, Value::boolean(true))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 2U, 1U, Value::text("0;0;0;\"pre\"@"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 3U, 0U, Value::text(""))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 3U, 1U, Value::text("0"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=TEXT(A1,B1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 1U, 2U, "=TEXT(A2,B2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 2U, 2U, "=TEXT(A3,B3)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 3U, 2U, "=TEXT(A4,B4)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+
+  const auto expect_text = [&](std::uint32_t row, std::string_view expected) {
+    const Value value = wb.sheet(0).resolve_cell_value(row, 2U);
+    ASSERT_TRUE(value.is_text()) << "C" << (row + 1U);
+    EXPECT_EQ(value.as_text(), expected) << "C" << (row + 1U);
+  };
+  expect_text(0U, "123.00");
+  expect_text(1U, "abcpost");
+  expect_text(2U, "preTRUE");
+  expect_text(3U, "");
+}
+
+TEST(TextFunctionText, ReferenceFormatAndValueMutationsRecalculateDependents) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::text("abc"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::text("\"pre\"@"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=TEXT(A1,B1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  ASSERT_TRUE(wb.sheet(0).resolve_cell_value(0U, 2U).is_text());
+  EXPECT_EQ(wb.sheet(0).resolve_cell_value(0U, 2U).as_text(), "preabc");
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::text("@\"post\""))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  ASSERT_TRUE(wb.sheet(0).resolve_cell_value(0U, 2U).is_text());
+  EXPECT_EQ(wb.sheet(0).resolve_cell_value(0U, 2U).as_text(), "abcpost");
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::boolean(true))));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  ASSERT_TRUE(wb.sheet(0).resolve_cell_value(0U, 2U).is_text());
+  EXPECT_EQ(wb.sheet(0).resolve_cell_value(0U, 2U).as_text(), "TRUEpost");
+
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=1/0")));
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(default_registry())));
+  const Value result = wb.sheet(0).resolve_cell_value(0U, 2U);
+  ASSERT_TRUE(result.is_error());
+  EXPECT_EQ(result.as_error(), ErrorCode::Div0);
 }
 
 TEST(TextFunctionText, ErrorPropagates) {
diff --git a/tests/unit/eval/wildcard_test.cpp b/tests/unit/eval/wildcard_test.cpp
new file mode 100644
index 000000000..33a4505ac
--- /dev/null
+++ b/tests/unit/eval/wildcard_test.cpp
@@ -0,0 +1,112 @@
+//
+// Unit tests for the `*` / `?` / `~` wildcard matchers declared in
+// `wildcard.h`: codepoint-aware matching and the SEARCHB byte-mode `?`.
+
+#include "eval/wildcard.h"
+
+#include <cstddef>
+#include <string_view>
+
+#include "gtest/gtest.h"
+
+namespace formulon {
+namespace eval {
+namespace {
+
+// ---------------------------------------------------------------------------
+// wildcard_match: codepoint-aware `*` backtracking and `?` matching.
+// ---------------------------------------------------------------------------
+
+TEST(WildcardMatchCodepoint, StarBacktrackAdvancesWholeCodepoints) {
+  // Regression: `*` backtracking used to advance one BYTE, letting a
+  // following `?` match a UTF-8 continuation byte and spuriously match.
+  // `*??c*` against "あcう" must NOT match (only 3 codepoints: あ, c, う —
+  // there is no "c" two codepoints in from any start after consuming two).
+  EXPECT_FALSE(wildcard_match("*??c*",
+                              "\xE3\x81\x82"
+                              "c"
+                              "\xE3\x81\x86"));
+}
+
+TEST(WildcardMatchCodepoint, QuestionMatchesExactlyOneCodepoint) {
+  // "?" matches a single multibyte codepoint.
+  EXPECT_TRUE(wildcard_match("?", "\xE3\x81\x82"));  // あ
+  EXPECT_FALSE(wildcard_match("?",
+                              "\xE3\x81\x82"
+                              "\xE3\x81\x84"));        // あい (2 cp)
+  EXPECT_FALSE(wildcard_match("??", "\xE3\x81\x82"));  // one cp cannot fill two ?
+}
+
+TEST(WildcardMatchCodepoint, QuestionMatchesSupplementaryPlaneEmoji) {
+  // A 4-byte codepoint (U+1F600) is one "?" unit.
+  EXPECT_TRUE(wildcard_match("?", "\xF0\x9F\x98\x80"));
+  EXPECT_TRUE(wildcard_match("a?b",
+                             "a"
+                             "\xF0\x9F\x98\x80"
+                             "b"));
+}
+
+TEST(WildcardMatchCodepoint, StarSwallowsMultibyteRun) {
+  // `*` skips a run of multibyte codepoints and the trailing literal aligns.
+  EXPECT_TRUE(wildcard_match("*c",
+                             "\xE3\x81\x82"
+                             "\xE3\x81\x84"
+                             "c"));  // あいc
+  EXPECT_TRUE(wildcard_match("*?c",
+                             "\xE3\x81\x82"
+                             "c"));  // あc
+}
+
+// ---------------------------------------------------------------------------
+// wildcard_find_dbcs: byte-mode `?` for SEARCHB. `?` matches only codepoints
+// whose ja-JP DBCS cost is 1 (ASCII, half-width katakana); kanji/hiragana/
+// full-width punctuation/emoji refuse to match. `*` and `~?`/`~*` retain
+// their normal semantics.
+// ---------------------------------------------------------------------------
+
+TEST(WildcardFindDbcs, QuestionSkipsKanjiToAsciiOffset) {
+  // "漢" is a 3-byte UTF-8 codepoint with DBCS cost 2; `?` refuses to match
+  // it. The next codepoint is 'A' at byte offset 3.
+  EXPECT_EQ(wildcard_find_dbcs("?", "漢ABC"), std::size_t{3});
+}
+
+TEST(WildcardFindDbcs, QuestionMatchesAsciiAtOffsetZero) {
+  EXPECT_EQ(wildcard_find_dbcs("?", "abc"), std::size_t{0});
+}
+
+TEST(WildcardFindDbcs, QuestionFindsNothingInPureKanji) {
+  // No SBCS codepoint anywhere; `?` matches nothing.
+  EXPECT_EQ(wildcard_find_dbcs("?", "漢"), std::string_view::npos);
+}
+
+TEST(WildcardFindDbcs, QuestionWithLiteralTailAfterKanji) {
+  // At start=0, "?" against 漢 fails. At start=3 the suffix is "abc" but
+  // pattern "?abc" needs 4 chars and only "abc" remains — no match.
+  EXPECT_EQ(wildcard_find_dbcs("?abc", "漢abc"), std::string_view::npos);
+}
+
+TEST(WildcardFindDbcs, QuestionInsideAsciiHaystack) {
+  EXPECT_EQ(wildcard_find_dbcs("a?c", "abc"), std::size_t{0});
+}
+
+TEST(WildcardFindDbcs, StarSwallowsKanjiThenQuestionMatchesAscii) {
+  // `*` consumes the leading 漢 (2 DBCS bytes / 3 UTF-8 bytes) and `?`
+  // then matches 'A'.
+  EXPECT_EQ(wildcard_find_dbcs("*?", "漢A"), std::size_t{0});
+}
+
+TEST(WildcardFindDbcs, EscapedQuestionIsLiteralRegardlessOfMode) {
+  // `~?` is a literal '?' under both wildcard modes; the byte-mode flag
+  // only affects unescaped `?`.
+  EXPECT_EQ(wildcard_find_dbcs("~?", "x?y"), std::size_t{1});
+}
+
+TEST(WildcardFindDbcs, QuestionMatchesHalfWidthKatakana) {
+  // ｱ (U+FF71) is half-width katakana, classified as DBCS=1 in ja-JP, so
+  // byte-mode `?` matches it at offset 0.
+  EXPECT_EQ(wildcard_find_dbcs("?", "ｱABC"), std::size_t{0});
+}
+
+}  // namespace
+}  // namespace eval
+}  // namespace formulon
diff --git a/tests/unit/io/cell_parser_test.cpp b/tests/unit/io/cell_parser_test.cpp
index d8e68de32..b9c999f12 100644
--- a/tests/unit/io/cell_parser_test.cpp
+++ b/tests/unit/io/cell_parser_test.cpp
@@ -20,6 +20,8 @@
 #include "eval/function_registry.h"
 #include "eval/tree_walker.h"
 #include "gtest/gtest.h"
+#include "io/ooxml_writer_cell.h"
+#include "io/sheet_reader.h"
 #include "parser/ast.h"
 #include "parser/parser.h"
 #include "pugixml.hpp"
@@ -253,6 +255,33 @@ TEST(CellParser, EmptyCellIsBlank) {
   EXPECT_TRUE(parsed.formula.empty());
 }
 
+TEST(CellParser, ExplicitZeroStyleMaterializesThroughDomAndSax) {
+  const std::string xml = "<worksheet><sheetData><row r=\"1\"><c r=\"A1\" s=\"0\"/></row></sheetData></worksheet>";
+
+  pugi::xml_document doc;
+  ASSERT_TRUE(doc.load_string(xml.c_str()));
+  Workbook dom_workbook = Workbook::create();
+  SheetReadContext dom_ctx;
+  std::deque<std::string> dom_storage;
+  ASSERT_TRUE(static_cast<bool>(read_sheet_data(doc, 0U, dom_workbook, dom_ctx, dom_storage)));
+  const Cell* dom_cell = dom_workbook.sheet(0).cell_at(0U, 0U);
+  ASSERT_NE(dom_cell, nullptr);
+  EXPECT_EQ(dom_cell->xf_index, 0U);
+  EXPECT_TRUE(dom_cell->has_explicit_xf);
+  EXPECT_NE(BuildSheetDataXml(dom_workbook.sheet(0)).find("<c r=\"A1\" s=\"0\"/>"), std::string::npos);
+
+  Workbook sax_workbook = Workbook::create();
+  SheetReadContext sax_ctx;
+  std::deque<std::string> sax_storage;
+  const ByteSpan bytes{reinterpret_cast<const std::uint8_t*>(xml.data()), xml.size()};
+  ASSERT_TRUE(static_cast<bool>(read_sheet_data_sax(bytes, 0U, sax_workbook, sax_ctx, sax_storage)));
+  const Cell* sax_cell = sax_workbook.sheet(0).cell_at(0U, 0U);
+  ASSERT_NE(sax_cell, nullptr);
+  EXPECT_EQ(sax_cell->xf_index, 0U);
+  EXPECT_TRUE(sax_cell->has_explicit_xf);
+  EXPECT_NE(BuildSheetDataXml(sax_workbook.sheet(0)).find("<c r=\"A1\" s=\"0\"/>"), std::string::npos);
+}
+
 TEST(CellParser, RejectsMissingRefAttribute) {
   pugi::xml_document doc;
   ASSERT_TRUE(doc.load_string("<c><v>1</v></c>"));
@@ -344,6 +373,7 @@ TEST(CellParser, IsoDateTypeBecomesSerialNumber) {
   ASSERT_PARSE_OK(parsed, "<c r=\"A1\" t=\"d\"><v>1976-11-22</v></c>", doc, storage);
   ASSERT_TRUE(parsed.value.is_number());
   EXPECT_DOUBLE_EQ(parsed.value.as_number(), 28086.0);
+  EXPECT_TRUE(parsed.is_iso_date);
 }
 
 TEST(CellParser, IsoDateTimeTypeIncludesTimeFraction) {
@@ -371,6 +401,16 @@ TEST(CellParser, IsoDateMalformedBodyFallsBackToText) {
   ASSERT_PARSE_OK(parsed, "<c r=\"A1\" t=\"d\"><v>not-a-date</v></c>", doc, storage);
   ASSERT_TRUE(parsed.value.is_text());
   EXPECT_EQ(parsed.value.as_text(), "not-a-date");
+  EXPECT_FALSE(parsed.is_iso_date);
+}
+
+TEST(CellParser, NumericSerialIsNotAnIsoDate) {
+  pugi::xml_document doc;
+  std::deque<std::string> storage;
+  ASSERT_PARSE_OK(parsed, "<c r=\"A1\"><v>1462</v></c>", doc, storage);
+  ASSERT_TRUE(parsed.value.is_number());
+  EXPECT_DOUBLE_EQ(parsed.value.as_number(), 1462.0);
+  EXPECT_FALSE(parsed.is_iso_date);
 }
 
 // Evaluates `src` against the default registry under the Mac profile.
diff --git a/tests/unit/io/color_spec_xml_test.cpp b/tests/unit/io/color_spec_xml_test.cpp
new file mode 100644
index 000000000..671b045dd
--- /dev/null
+++ b/tests/unit/io/color_spec_xml_test.cpp
@@ -0,0 +1,63 @@
+#include "io/color_spec_xml.h"
+
+#include <cstdint>
+#include <string>
+
+#include "gtest/gtest.h"
+#include "pugixml.hpp"
+
+namespace formulon::io {
+namespace {
+
+ColorSpec Read(const char* xml) {
+  pugi::xml_document doc;
+  EXPECT_TRUE(doc.load_string(xml));
+  return read_color_spec(doc.first_child());
+}
+
+std::string Write(const ColorSpec& spec, std::uint32_t fallback = 0xFF000000U) {
+  std::string out;
+  append_color_spec_attrs(out, spec, fallback);
+  return out;
+}
+
+TEST(ColorSpecXml, RgbRoundTrips) {
+  const ColorSpec spec = Read("<color rgb=\"FF336699\"/>");
+  EXPECT_EQ(spec.kind, ColorSpec::Kind::kRgb);
+  EXPECT_EQ(spec.rgb, 0xFF336699U);
+  EXPECT_EQ(Write(spec), " rgb=\"FF336699\"");
+}
+
+TEST(ColorSpecXml, ThemeWithTintRoundTrips) {
+  const ColorSpec spec = Read("<color theme=\"4\" tint=\"-0.25\"/>");
+  EXPECT_EQ(spec.kind, ColorSpec::Kind::kTheme);
+  EXPECT_EQ(spec.theme, 4U);
+  EXPECT_DOUBLE_EQ(spec.tint, -0.25);
+  EXPECT_EQ(Write(spec), " theme=\"4\" tint=\"-0.25\"");
+}
+
+TEST(ColorSpecXml, ThemeWithoutTintOmitsTint) {
+  EXPECT_EQ(Write(Read("<color theme=\"1\"/>")), " theme=\"1\"");
+}
+
+TEST(ColorSpecXml, IndexedRoundTrips) {
+  const ColorSpec spec = Read("<color indexed=\"10\"/>");
+  EXPECT_EQ(spec.kind, ColorSpec::Kind::kIndexed);
+  EXPECT_EQ(spec.indexed, 10U);
+  EXPECT_EQ(Write(spec), " indexed=\"10\"");
+}
+
+TEST(ColorSpecXml, AutoRoundTrips) {
+  const ColorSpec spec = Read("<color auto=\"1\"/>");
+  EXPECT_EQ(spec.kind, ColorSpec::Kind::kAuto);
+  EXPECT_EQ(Write(spec), " auto=\"1\"");
+}
+
+TEST(ColorSpecXml, AbsentOrEmptyIsNoneAndWritesFallback) {
+  EXPECT_EQ(Read("<color/>").kind, ColorSpec::Kind::kNone);
+  EXPECT_EQ(read_color_spec(pugi::xml_node()).kind, ColorSpec::Kind::kNone);
+  EXPECT_EQ(Write(ColorSpec{}, 0x80112233U), " rgb=\"80112233\"");
+}
+
+}  // namespace
+}  // namespace formulon::io
diff --git a/tests/unit/io/data_validation_roundtrip_test.cpp b/tests/unit/io/data_validation_roundtrip_test.cpp
index a117460c1..94790d8e1 100644
--- a/tests/unit/io/data_validation_roundtrip_test.cpp
+++ b/tests/unit/io/data_validation_roundtrip_test.cpp
@@ -4,7 +4,7 @@
 #include <string>
 
 #include "gtest/gtest.h"
-#include "io/sheet_reader.h"
+#include "io/sheet_overlay_reader.h"
 #include "pugixml.hpp"
 #include "sheet.h"
 
diff --git a/tests/unit/io/hyperlink_roundtrip_test.cpp b/tests/unit/io/hyperlink_roundtrip_test.cpp
index ca058c393..caa484f5c 100644
--- a/tests/unit/io/hyperlink_roundtrip_test.cpp
+++ b/tests/unit/io/hyperlink_roundtrip_test.cpp
@@ -7,7 +7,7 @@
 #include <vector>
 
 #include "gtest/gtest.h"
-#include "io/sheet_reader.h"
+#include "io/sheet_overlay_reader.h"
 #include "pugixml.hpp"
 #include "sheet.h"
 
diff --git a/tests/unit/io/iso_date_test.cpp b/tests/unit/io/iso_date_test.cpp
index d52f1b11e..1a0f5104c 100644
--- a/tests/unit/io/iso_date_test.cpp
+++ b/tests/unit/io/iso_date_test.cpp
@@ -83,6 +83,38 @@ TEST(IsoDate, TimeZoneOffsetIsAcceptedButIgnored) {
   ASSERT_TRUE(parse_iso_date_serial("2024-01-01T00:00:00+09:00", &serial));
 }
 
+TEST(IsoDate, TimeZoneBoundsAreValidatedWithoutChangingOutputOnFailure) {
+  for (const char* text : {"2024-01-01T12:00:00+99:99", "2024-01-01T12:00:00+09:60", "2024-01-01T12:00:00+14:01",
+                           "2024-01-01T12:00:00-15:00"}) {
+    SCOPED_TRACE(text);
+    double serial = -123.0;
+    EXPECT_FALSE(parse_iso_date_serial(text, &serial));
+    EXPECT_DOUBLE_EQ(serial, -123.0);
+  }
+}
+
+TEST(IsoDate, PlainDateAcceptsTheDocumentedTimeZoneSuffix) {
+  for (const char* text : {"2024-01-01Z", "2024-01-01+09:00", "2024-01-01-14:00"}) {
+    SCOPED_TRACE(text);
+    double serial = 0.0;
+    ASSERT_TRUE(parse_iso_date_serial(text, &serial));
+    EXPECT_DOUBLE_EQ(serial, 45292.0);
+  }
+  double serial = -123.0;
+  EXPECT_FALSE(parse_iso_date_serial("2024-01-01+14:01", &serial));
+  EXPECT_DOUBLE_EQ(serial, -123.0);
+}
+
+TEST(IsoDate, ValidOffsetsPreserveWallClockInBothSigns) {
+  for (const char* text : {"2024-01-01T12:00:00Z", "2024-01-01T12:00:00+00:00", "2024-01-01T12:00:00+09:30",
+                           "2024-01-01T12:00:00-09:30", "2024-01-01T12:00:00+14:00", "2024-01-01T12:00:00-14:00"}) {
+    SCOPED_TRACE(text);
+    double serial = 0.0;
+    ASSERT_TRUE(parse_iso_date_serial(text, &serial));
+    EXPECT_DOUBLE_EQ(serial, 45292.5);
+  }
+}
+
 TEST(IsoDate, TrailingZDesignatorIsAccepted) {
   double serial = 0.0;
   EXPECT_TRUE(parse_iso_date_serial("2024-01-01T00:00:00Z", &serial));
diff --git a/tests/unit/io/merge_roundtrip_test.cpp b/tests/unit/io/merge_roundtrip_test.cpp
index 81c07ccd5..c9551c34e 100644
--- a/tests/unit/io/merge_roundtrip_test.cpp
+++ b/tests/unit/io/merge_roundtrip_test.cpp
@@ -1,7 +1,7 @@
 //
 // Round-trip tests for the `<mergeCells>` reader. The matching writer
 // path lives in `ooxml_writer.cpp::BuildMergeCellsBlock`; the reader's
-// public entry is `read_merges` in `sheet_reader.h`. Each test builds a
+// public entry is `read_merges` in `sheet_overlay_reader.h`. Each test builds a
 // minimal `<worksheet>` DOM in memory, runs `read_merges`, and checks
 // the output against the expected `MergeRange` list.
 
@@ -10,7 +10,7 @@
 #include <vector>
 
 #include "gtest/gtest.h"
-#include "io/sheet_reader.h"
+#include "io/sheet_overlay_reader.h"
 #include "pugixml.hpp"
 #include "sheet.h"
 
diff --git a/tests/unit/io/ooxml_output_contract_test.cpp b/tests/unit/io/ooxml_output_contract_test.cpp
index 50c022e22..a672524fe 100644
--- a/tests/unit/io/ooxml_output_contract_test.cpp
+++ b/tests/unit/io/ooxml_output_contract_test.cpp
@@ -680,6 +680,113 @@ TEST(OoxmlExternalLinks, MissingBodyPartDropsBothHalvesAndCounts) {
   EXPECT_GE(saved.value().diagnostics.dropped_relationship_count, 1U);
 }
 
+TEST(OoxmlWorkbookRelationships, RootCustomXmlUsesWorkbookRelativeTargetAndSurvivesReload) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+
+  PassthroughPart custom_xml;
+  custom_xml.path = "customXml/item1.xml";
+  custom_xml.content_type = "application/xml";
+  const std::string custom_body = "<item><value>opaque</value></item>";
+  custom_xml.bytes.assign(custom_body.begin(), custom_body.end());
+  PassthroughPart sheet_custom_xml;
+  sheet_custom_xml.path = "customXml/item2.xml";
+  sheet_custom_xml.content_type = "application/xml";
+  const std::string sheet_custom_body = "<item><sheet-value>opaque</sheet-value></item>";
+  sheet_custom_xml.bytes.assign(sheet_custom_body.begin(), sheet_custom_body.end());
+  wb.set_passthrough_parts({custom_xml, sheet_custom_xml});
+
+  const std::string custom_type = "http://example.test/relationships/customXml";
+  const std::string external_type = "http://example.test/relationships/external";
+  wb.set_unknown_workbook_rels({UnknownRelationship{"rId8", custom_type, custom_xml.path, false},
+                                UnknownRelationship{"rId9", external_type, "https://example.test/book.xlsx", true}});
+  wb.sheet(0).set_unknown_relationships({UnknownRelationship{"rId7", custom_type, sheet_custom_xml.path, false}});
+
+  auto first = io::write_ooxml(wb);
+  ASSERT_TRUE(static_cast<bool>(first)) << first.error().message;
+  std::string first_rels;
+  ASSERT_TRUE(test::extract_part(test::span_of(first.value()), "xl/_rels/workbook.xml.rels", &first_rels));
+  EXPECT_NE(first_rels.find("Target=\"../customXml/item1.xml\""), std::string::npos) << first_rels;
+  EXPECT_NE(first_rels.find("Target=\"https://example.test/book.xlsx\" TargetMode=\"External\""), std::string::npos)
+      << first_rels;
+  std::string first_sheet_rels;
+  ASSERT_TRUE(
+      test::extract_part(test::span_of(first.value()), "xl/worksheets/_rels/sheet1.xml.rels", &first_sheet_rels));
+  EXPECT_NE(first_sheet_rels.find("Target=\"../../customXml/item2.xml\""), std::string::npos) << first_sheet_rels;
+
+  auto loaded = io::read_ooxml(test::span_of(first.value()));
+  ASSERT_TRUE(static_cast<bool>(loaded)) << loaded.error().message;
+  ASSERT_EQ(loaded.value().workbook.unknown_workbook_rels().size(), 2U);
+  EXPECT_EQ(loaded.value().workbook.unknown_workbook_rels()[0].target, custom_xml.path);
+  EXPECT_EQ(loaded.value().workbook.unknown_workbook_rels()[1].target, "https://example.test/book.xlsx");
+  EXPECT_TRUE(loaded.value().workbook.unknown_workbook_rels()[1].target_external);
+  ASSERT_EQ(loaded.value().workbook.sheet(0).unknown_relationships().size(), 1U);
+  EXPECT_EQ(loaded.value().workbook.sheet(0).unknown_relationships()[0].target, sheet_custom_xml.path);
+
+  auto second = io::write_ooxml(loaded.value().workbook);
+  ASSERT_TRUE(static_cast<bool>(second)) << second.error().message;
+  std::string second_rels;
+  ASSERT_TRUE(test::extract_part(test::span_of(second.value()), "xl/_rels/workbook.xml.rels", &second_rels));
+  EXPECT_NE(second_rels.find("Target=\"../customXml/item1.xml\""), std::string::npos) << second_rels;
+  EXPECT_NE(second_rels.find("Target=\"https://example.test/book.xlsx\" TargetMode=\"External\""), std::string::npos)
+      << second_rels;
+  std::string second_sheet_rels;
+  ASSERT_TRUE(
+      test::extract_part(test::span_of(second.value()), "xl/worksheets/_rels/sheet1.xml.rels", &second_sheet_rels));
+  EXPECT_NE(second_sheet_rels.find("Target=\"../../customXml/item2.xml\""), std::string::npos) << second_sheet_rels;
+  std::string second_body;
+  ASSERT_TRUE(test::extract_part(test::span_of(second.value()), "customXml/item1.xml", &second_body));
+  EXPECT_EQ(second_body, custom_body);
+  std::string second_sheet_body;
+  ASSERT_TRUE(test::extract_part(test::span_of(second.value()), "customXml/item2.xml", &second_sheet_body));
+  EXPECT_EQ(second_sheet_body, sheet_custom_body);
+}
+
+TEST(OoxmlWorkbookPr, DateFlagSyncsCanonicalAttributesAndPreservesMalformedLegacyFragments) {
+  struct Case {
+    const char* raw;
+    bool date1904;
+    bool reload;
+    const char* required;
+    const char* forbidden;
+  };
+  const Case cases[] = {
+      {"<workbookPr codeName=\"Book\" date1904=\"1\" defaultThemeVersion=\"1\"/>", true, true, "date1904=\"1\"", ""},
+      {"<workbookPr codeName=\"Book\" date1904=\"1\" defaultThemeVersion=\"1\"/>", false, true, "codeName=\"Book\"",
+       "date1904="},
+      // XML 1.0 does not permit an attribute name beginning with a digit, so
+      // the reader can only retain this historical alias as an opaque raw
+      // fragment. The writer must keep the established malformed-fragment
+      // passthrough contract instead of attempting string-level XML surgery.
+      {"<workbookPr codeName=\"Book\" 1904=\"1\" defaultThemeVersion=\"1\"/>", true, false, "1904=\"1\"", ""},
+      {"<workbookPr codeName=\"Book\" 1904=\"1\" defaultThemeVersion=\"1\"/>", false, false, "1904=\"1\"", ""},
+  };
+  for (const Case& c : cases) {
+    Workbook wb = Workbook::create_empty();
+    wb.add_sheet("Sheet1");
+    wb.sheet(0).set_cell_value(0, 0, Value::number(1.0));
+    wb.set_workbook_pr_xml(c.raw);
+    wb.set_date1904(c.date1904);
+
+    auto saved = io::write_ooxml(wb);
+    ASSERT_TRUE(static_cast<bool>(saved)) << saved.error().message;
+    std::string workbook_xml;
+    ASSERT_TRUE(test::extract_part(test::span_of(saved.value()), "xl/workbook.xml", &workbook_xml));
+    EXPECT_NE(workbook_xml.find(c.required), std::string::npos) << workbook_xml;
+    if (*c.forbidden != '\0') {
+      EXPECT_EQ(workbook_xml.find(c.forbidden), std::string::npos) << workbook_xml;
+    }
+
+    if (c.reload) {
+      auto reloaded = io::read_ooxml(test::span_of(saved.value()));
+      ASSERT_TRUE(static_cast<bool>(reloaded)) << reloaded.error().message;
+      EXPECT_EQ(reloaded.value().workbook.date1904(), c.date1904);
+      EXPECT_NE(reloaded.value().workbook.workbook_pr_xml().find("codeName=\"Book\""), std::string::npos);
+    }
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Unmodelled `<worksheet>` children survive in their schema position.
 // ---------------------------------------------------------------------------
diff --git a/tests/unit/io/package_diagnostics_test.cpp b/tests/unit/io/package_diagnostics_test.cpp
index cbbc87708..7a0cd1d80 100644
--- a/tests/unit/io/package_diagnostics_test.cpp
+++ b/tests/unit/io/package_diagnostics_test.cpp
@@ -25,7 +25,7 @@
 #include "io/ooxml/workbook_xml_builder.h"
 #include "io/ooxml_reader.h"
 #include "io/ooxml_writer.h"
-#include "io/sheet_reader.h"
+#include "io/sheet_overlay_reader.h"
 #include "io/xlsb/reader.h"
 #include "io/xlsb/retained_part_fingerprint.h"
 #include "io/xlsb/writer.h"
diff --git a/tests/unit/io/part_dom_test.cpp b/tests/unit/io/part_dom_test.cpp
new file mode 100644
index 000000000..96b79d32c
--- /dev/null
+++ b/tests/unit/io/part_dom_test.cpp
@@ -0,0 +1,89 @@
+#include "io/ooxml/part_dom.h"
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "passthrough_part.h"
+#include "pugixml.hpp"
+#include "utils/error.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace ooxml {
+namespace {
+
+constexpr const char* kPath = "xl/custom/part1.xml";
+
+std::vector<std::uint8_t> Bytes(const std::string& s) {
+  return std::vector<std::uint8_t>(s.begin(), s.end());
+}
+
+std::string Text(const std::vector<std::uint8_t>& bytes) {
+  return std::string(bytes.begin(), bytes.end());
+}
+
+Workbook WorkbookWithPart(const std::string& xml) {
+  Workbook wb = Workbook::create();
+  EXPECT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart(kPath, "application/xml", Bytes(xml)))));
+  return wb;
+}
+
+TEST(PartDom, FindPassthroughPartByPath) {
+  Workbook wb = WorkbookWithPart("<r/>");
+  const PassthroughPart* part = find_passthrough_part(wb, kPath);
+  ASSERT_NE(part, nullptr);
+  EXPECT_EQ(part->path, kPath);
+  EXPECT_EQ(find_passthrough_part(wb, "xl/custom/other.xml"), nullptr);
+}
+
+TEST(PartDom, EditRoundTripsThroughOneDocument) {
+  Workbook wb = WorkbookWithPart(
+      "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<x:r xmlns:x=\"urn:x\">\n  <x:a v=\"1\"/>\n  <x:t> </x:t>\n</x:r>");
+  pugi::xml_document doc;
+  ASSERT_TRUE(static_cast<bool>(load_part_dom(wb, kPath, "test", doc)));
+  doc.document_element().child("x:a").attribute("v").set_value("2");
+  doc.document_element().append_child("x:b");
+  ASSERT_TRUE(static_cast<bool>(store_part_dom(wb, kPath, doc)));
+  // Indentation-only text is dropped, a single-space leaf is kept, and the
+  // declaration is rewritten in the standalone form.
+  EXPECT_EQ(Text(find_passthrough_part(wb, kPath)->bytes),
+            "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+            "<x:r xmlns:x=\"urn:x\"><x:a v=\"2\"/><x:t> </x:t><x:b/></x:r>");
+}
+
+TEST(PartDom, StoreKeepsContentType) {
+  Workbook wb = WorkbookWithPart("<r/>");
+  pugi::xml_document doc;
+  ASSERT_TRUE(static_cast<bool>(load_part_dom(wb, kPath, "test", doc)));
+  ASSERT_TRUE(static_cast<bool>(store_part_dom(wb, kPath, doc)));
+  EXPECT_EQ(find_passthrough_part(wb, kPath)->content_type, "application/xml");
+}
+
+TEST(PartDom, MissingPartIsInvalidArgument) {
+  Workbook wb = Workbook::create();
+  pugi::xml_document doc;
+  auto loaded = load_part_dom(wb, kPath, "test", doc);
+  ASSERT_FALSE(static_cast<bool>(loaded));
+  EXPECT_EQ(loaded.error().code, FormulonErrorCode::kInvalidArgument);
+  auto stored = store_part_dom(wb, kPath, doc);
+  ASSERT_FALSE(static_cast<bool>(stored));
+  EXPECT_EQ(stored.error().code, FormulonErrorCode::kInvalidArgument);
+}
+
+TEST(PartDom, MalformedPartIsXmlParseError) {
+  Workbook wb = WorkbookWithPart("<r><unclosed></r>");
+  pugi::xml_document doc;
+  auto loaded = load_part_dom(wb, kPath, "test", doc);
+  ASSERT_FALSE(static_cast<bool>(loaded));
+  EXPECT_EQ(loaded.error().code, FormulonErrorCode::kIoXmlParse);
+  EXPECT_NE(loaded.error().context.find("context=test"), std::string::npos);
+  EXPECT_NE(loaded.error().context.find(kPath), std::string::npos);
+}
+
+}  // namespace
+}  // namespace ooxml
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/pivot_table_reader_attributes_test.cpp b/tests/unit/io/pivot_table_reader_attributes_test.cpp
new file mode 100644
index 000000000..2cfe5b452
--- /dev/null
+++ b/tests/unit/io/pivot_table_reader_attributes_test.cpp
@@ -0,0 +1,198 @@
+// Pivot-table definition reader tests grouped by XML concern.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/pivot_table_reader.h"
+#include "io/pivot_table_writer.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_table_reader_test_helpers.h"
+#include "utils/error.h"
+
+namespace formulon::io {
+namespace {
+using namespace pivot_table_reader_test_support;
+TEST(PivotTableReader, ShowDataAsAttributesAreParsed) {
+  // <dataField> exercises showDataAs / baseField / baseItem decoding.
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"2\">");
+  xml.append("  <pivotField axis=\"axisRow\" name=\"R\"/>");
+  xml.append("  <pivotField dataField=\"1\" name=\"V\"/>");
+  xml.append("</pivotFields>");
+  xml.append("<dataFields count=\"1\">");
+  xml.append(
+      "  <dataField name=\"X\" fld=\"0\" subtotal=\"sum\""
+      " showDataAs=\"difference\" baseField=\"1\" baseItem=\"3\"/>");
+  xml.append("</dataFields>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
+  const pivot::PivotTable& table = table_or.value();
+  ASSERT_EQ(table.data_fields().size(), 1U);
+  const pivot::PivotDataField& df = table.data_fields()[0];
+  EXPECT_EQ(df.show_as, pivot::ShowValuesAs::DifferenceFrom);
+  ASSERT_TRUE(df.show_as_base_field.has_value());
+  EXPECT_EQ(*df.show_as_base_field, 1U);
+  ASSERT_TRUE(df.show_as_base_item.has_value());
+  EXPECT_EQ(*df.show_as_base_item, 3U);
+}
+TEST(PivotTableReader, EmptyPassthroughWhenNoExtensionsPresent) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"0\"/>");
+  xml.append("</pivotTableDefinition>");
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or));
+  EXPECT_TRUE(table_or.value().raw_passthrough_xml().empty());
+}
+TEST(PivotTableReader, GrandTotalsDefaultTrueWhenAbsent) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"0\"/>");
+  xml.append("</pivotTableDefinition>");
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
+  EXPECT_TRUE(table_or.value().grand_totals_rows());
+  EXPECT_TRUE(table_or.value().grand_totals_cols());
+}
+TEST(PivotTableReader, GrandTotalsOffIsRead) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs);
+  xml.append(" name=\"P\" cacheId=\"0\" rowGrandTotals=\"0\" colGrandTotals=\"0\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"0\"/>");
+  xml.append("</pivotTableDefinition>");
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
+  EXPECT_FALSE(table_or.value().grand_totals_rows());
+  EXPECT_FALSE(table_or.value().grand_totals_cols());
+}
+TEST(PivotTableReader, LocationRequiredAttributesAreRead) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append(
+      "<location ref=\"A3:D10\" firstHeaderRow=\"1\" firstDataRow=\"2\" firstDataCol=\"3\" "
+      "rowPageCount=\"4\" colPageCount=\"5\"/>");
+  xml.append("<pivotFields count=\"0\"/>");
+  xml.append("</pivotTableDefinition>");
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
+  const pivot::PivotTable& table = table_or.value();
+  ASSERT_TRUE(table.location_first_header_row().has_value());
+  EXPECT_EQ(*table.location_first_header_row(), 1U);
+  ASSERT_TRUE(table.location_first_data_row().has_value());
+  EXPECT_EQ(*table.location_first_data_row(), 2U);
+  ASSERT_TRUE(table.location_first_data_col().has_value());
+  EXPECT_EQ(*table.location_first_data_col(), 3U);
+  ASSERT_TRUE(table.location_row_page_count().has_value());
+  EXPECT_EQ(*table.location_row_page_count(), 4U);
+  ASSERT_TRUE(table.location_col_page_count().has_value());
+  EXPECT_EQ(*table.location_col_page_count(), 5U);
+}
+TEST(PivotTableReader, LocationOptionalAttributesAbsentStayEmpty) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  // Only `ref` present; all offset attributes absent.
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"0\"/>");
+  xml.append("</pivotTableDefinition>");
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
+  const pivot::PivotTable& table = table_or.value();
+  EXPECT_FALSE(table.location_first_header_row().has_value());
+  EXPECT_FALSE(table.location_first_data_row().has_value());
+  EXPECT_FALSE(table.location_first_data_col().has_value());
+  EXPECT_FALSE(table.location_row_page_count().has_value());
+  EXPECT_FALSE(table.location_col_page_count().has_value());
+}
+TEST(PivotTableReader, CustomSubtotalsAndDefaultSubtotalSurviveRoundTrip) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"1\">");
+  // defaultSubtotal turned OFF, with explicit Average + Max custom
+  // subtotals selected.
+  xml.append("  <pivotField axis=\"axisRow\" name=\"R\" defaultSubtotal=\"0\" avgSubtotal=\"1\" maxSubtotal=\"1\"/>");
+  xml.append("</pivotFields>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const pivot::PivotTable& table = table_or.value();
+  ASSERT_EQ(table.fields().size(), 1U);
+  const pivot::PivotField& f = table.fields()[0];
+  EXPECT_FALSE(f.default_subtotal);
+  ASSERT_EQ(f.subtotal_fns.size(), 2U);
+  EXPECT_EQ(f.subtotal_fns[0], pivot::SubtotalFn::Average);
+  EXPECT_EQ(f.subtotal_fns[1], pivot::SubtotalFn::Max);
+
+  // Write -> read again: the custom selection must not revert to default.
+  const std::string round = write_pivot_table_definition(table);
+  auto reparsed_or = read_pivot_table_definition(Bytes(round));
+  ASSERT_TRUE(static_cast<bool>(reparsed_or)) << reparsed_or.error().message;
+  const pivot::PivotField& f2 = reparsed_or.value().fields()[0];
+  EXPECT_FALSE(f2.default_subtotal);
+  ASSERT_EQ(f2.subtotal_fns.size(), 2U);
+  EXPECT_EQ(f2.subtotal_fns[0], pivot::SubtotalFn::Average);
+  EXPECT_EQ(f2.subtotal_fns[1], pivot::SubtotalFn::Max);
+}
+TEST(PivotTableReader, DefaultSubtotalDefaultsTrueWhenAbsent) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"1\"><pivotField axis=\"axisRow\" name=\"R\"/></pivotFields>");
+  xml.append("</pivotTableDefinition>");
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const pivot::PivotField& f = table_or.value().fields()[0];
+  EXPECT_TRUE(f.default_subtotal);
+  EXPECT_TRUE(f.subtotal_fns.empty());
+}
+TEST(PivotTableReader, RowItemsAndColItemsSurviveRoundTrip) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"0\"/>");
+  xml.append("<rowItems count=\"2\"><i><x/></i><i t=\"grand\"><x/></i></rowItems>");
+  xml.append("<colItems count=\"1\"><i><x/></i></colItems>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  // rowItems / colItems are binned into their schema-position buffers so
+  // the writer can re-emit them before <dataFields> (a single tail buffer
+  // would place them after <dataFields> and trip Excel's repair).
+  const pivot::PivotTable& table = table_or.value();
+  EXPECT_NE(table.raw_passthrough_after_row_fields().find("<rowItems"), std::string::npos);
+  EXPECT_NE(table.raw_passthrough_after_row_fields().find("t=\"grand\""), std::string::npos);
+  EXPECT_NE(table.raw_passthrough_after_col_fields().find("<colItems"), std::string::npos);
+  // They must NOT leak into the tail buffer.
+  EXPECT_EQ(table.raw_passthrough_xml().find("<rowItems"), std::string::npos);
+
+  // Write -> read again: the layout-item cache must still be present, and
+  // rowItems must precede colItems in the emitted bytes.
+  const std::string round = write_pivot_table_definition(table);
+  const std::size_t p_rowitems = round.find("<rowItems");
+  const std::size_t p_colitems = round.find("<colItems");
+  ASSERT_NE(p_rowitems, std::string::npos) << round;
+  ASSERT_NE(p_colitems, std::string::npos) << round;
+  EXPECT_LT(p_rowitems, p_colitems);
+  auto reparsed_or = read_pivot_table_definition(Bytes(round));
+  ASSERT_TRUE(static_cast<bool>(reparsed_or)) << reparsed_or.error().message;
+  const pivot::PivotTable& reparsed = reparsed_or.value();
+  EXPECT_NE(reparsed.raw_passthrough_after_row_fields().find("<rowItems"), std::string::npos);
+  EXPECT_NE(reparsed.raw_passthrough_after_col_fields().find("<colItems"), std::string::npos);
+}
+
+}  // namespace
+}  // namespace formulon::io
diff --git a/tests/unit/io/pivot_table_reader_corruption_test.cpp b/tests/unit/io/pivot_table_reader_corruption_test.cpp
new file mode 100644
index 000000000..dc92fc975
--- /dev/null
+++ b/tests/unit/io/pivot_table_reader_corruption_test.cpp
@@ -0,0 +1,90 @@
+// Pivot-table definition reader tests grouped by XML concern.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/pivot_table_reader.h"
+#include "io/pivot_table_writer.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_table_reader_test_helpers.h"
+#include "utils/error.h"
+
+namespace formulon::io {
+namespace {
+using namespace pivot_table_reader_test_support;
+TEST(PivotTableReader, MissingDataFieldNameIsCorruption) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append("  <location ref=\"A1:B2\"/>");
+  xml.append("  <dataFields count=\"1\">");
+  xml.append("    <dataField fld=\"1\" subtotal=\"sum\"/>");
+  xml.append("  </dataFields>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_FALSE(static_cast<bool>(table_or));
+  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoSheetCorrupt);
+}
+TEST(PivotTableReader, MissingLocationIsCorruption) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append("  <pivotFields count=\"0\"/>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_FALSE(static_cast<bool>(table_or));
+  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoSheetCorrupt);
+}
+TEST(PivotTableReader, UnparseableLocationRefIsCorruption) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
+  xml.append("  <location ref=\"not-a-range\"/>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_FALSE(static_cast<bool>(table_or));
+  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoSheetCorrupt);
+}
+TEST(PivotTableReader, MalformedRootIsContentTypeInvalid) {
+  std::string xml(kXmlDecl);
+  xml.append("<foo").append(kPivotNs).append("><location ref=\"A1\"/></foo>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_FALSE(static_cast<bool>(table_or));
+  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoContentTypeInvalid);
+}
+TEST(PivotTableReader, MalformedXmlIsParseError) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append("><location");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_FALSE(static_cast<bool>(table_or));
+  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoXmlParse);
+}
+TEST(PivotTableReader, UnmodelledChildrenCapturedAsPassthrough) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<calculatedItems count=\"1\"><calculatedItem name=\"Avg\" formula=\"=A1/B1\"/></calculatedItems>");
+  xml.append("<pivotTableStyleInfo name=\"PivotStyleLight16\" showRowHeaders=\"1\"/>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const std::string& passthrough = table_or.value().raw_passthrough_xml();
+  // Both unrecognised elements survive verbatim (order-preserving).
+  EXPECT_NE(passthrough.find("<calculatedItems"), std::string::npos);
+  EXPECT_NE(passthrough.find("formula=\"=A1/B1\""), std::string::npos);
+  EXPECT_NE(passthrough.find("<pivotTableStyleInfo"), std::string::npos);
+  EXPECT_NE(passthrough.find("PivotStyleLight16"), std::string::npos);
+  // Recognised elements (location) are NOT in the passthrough.
+  EXPECT_EQ(passthrough.find("<location"), std::string::npos);
+}
+
+}  // namespace
+}  // namespace formulon::io
diff --git a/tests/unit/io/pivot_table_reader_filters_test.cpp b/tests/unit/io/pivot_table_reader_filters_test.cpp
new file mode 100644
index 000000000..e370464df
--- /dev/null
+++ b/tests/unit/io/pivot_table_reader_filters_test.cpp
@@ -0,0 +1,363 @@
+// Pivot-table definition reader tests grouped by XML concern.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/pivot_table_reader.h"
+#include "io/pivot_table_writer.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_table_reader_test_helpers.h"
+#include "utils/error.h"
+
+namespace formulon::io {
+namespace {
+using namespace pivot_table_reader_test_support;
+TEST(PivotTableReader, AuthoredFiltersDecodeForEvaluationAndStillRoundTripAsPassthrough) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<pivotFields count=\"0\"/>");
+  xml.append("<pivotTableStyleInfo name=\"PivotStyleLight16\"/>");
+  xml.append(
+      "<filters count=\"1\"><filter fld=\"0\" type=\"captionEqual\" evalOrder=\"-1\" id=\"1\">"
+      "<autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
+      "<customFilters><customFilter operator=\"equal\" val=\"North\"/></customFilters>"
+      "</filterColumn></autoFilter></filter></filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const pivot::PivotTable& table = table_or.value();
+  EXPECT_TRUE(table.active_filters().empty());
+  ASSERT_EQ(table.authored_caption_filters().size(), 1U);
+  EXPECT_EQ(table.authored_caption_filters()[0].field_index, 0U);
+  EXPECT_EQ(table.authored_caption_filters()[0].predicate, pivot::CaptionPredicate::Equal);
+  EXPECT_EQ(table.authored_caption_filters()[0].value, "North");
+  EXPECT_NE(table.raw_passthrough_xml().find("<filters"), std::string::npos);
+  EXPECT_NE(table.raw_passthrough_xml().find("val=\"North\""), std::string::npos);
+
+  const std::string round = write_pivot_table_definition(table);
+  EXPECT_EQ(CountOccurrences(round, "<filters"), 1U) << round;
+  EXPECT_NE(round.find("val=\"North\""), std::string::npos) << round;
+  // The style block is authored before `<filters>`; re-emission keeps that
+  // order, which the schema requires.
+  EXPECT_LT(round.find("<pivotTableStyleInfo"), round.find("<filters"));
+
+  auto reparsed_or = read_pivot_table_definition(Bytes(round));
+  ASSERT_TRUE(static_cast<bool>(reparsed_or)) << reparsed_or.error().message;
+  EXPECT_TRUE(reparsed_or.value().active_filters().empty());
+  // The decode is stable across the round trip, and the writer still emits
+  // the block from the passthrough tail rather than from the decoded view.
+  EXPECT_EQ(reparsed_or.value().authored_caption_filters().size(), 1U);
+  EXPECT_EQ(write_pivot_table_definition(reparsed_or.value()), round);
+}
+TEST(PivotTableReader, AuthoredCaptionFilterVariantsDecodeAndNonCaptionTypesAreSkipped) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"5\">");
+  xml.append(
+      "<filter fld=\"1\" type=\"captionBeginsWith\"><autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
+      "<customFilters><customFilter operator=\"equal\" val=\"No*\"/></customFilters>"
+      "</filterColumn></autoFilter></filter>");
+  xml.append(
+      "<filter fld=\"2\" type=\"captionContains\"><autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
+      "<customFilters><customFilter operator=\"equal\" val=\"*or*\"/></customFilters>"
+      "</filterColumn></autoFilter></filter>");
+  xml.append(
+      "<filter fld=\"3\" type=\"captionEndsWith\"><autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
+      "<customFilters><customFilter operator=\"equal\" val=\"*th\"/></customFilters>"
+      "</filterColumn></autoFilter></filter>");
+  xml.append(
+      "<filter fld=\"4\" type=\"captionBetween\"><autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
+      "<customFilters and=\"1\"><customFilter operator=\"greaterThanOrEqual\" val=\"B\"/>"
+      "<customFilter operator=\"lessThanOrEqual\" val=\"M\"/></customFilters>"
+      "</filterColumn></autoFilter></filter>");
+  // Value family: outside the caption set, so passthrough-only.
+  xml.append(
+      "<filter fld=\"5\" type=\"valueGreaterThan\" iMeasureFld=\"0\"><autoFilter ref=\"A3:A9\">"
+      "<filterColumn colId=\"0\"><customFilters><customFilter operator=\"greaterThan\" val=\"100\"/>"
+      "</customFilters></filterColumn></autoFilter></filter>");
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const auto& decoded = table_or.value().authored_caption_filters();
+  ASSERT_EQ(decoded.size(), 4U);
+  EXPECT_EQ(decoded[0].field_index, 1U);
+  EXPECT_EQ(decoded[0].predicate, pivot::CaptionPredicate::BeginsWith);
+  EXPECT_EQ(decoded[0].value, "No");
+  EXPECT_EQ(decoded[1].predicate, pivot::CaptionPredicate::Contains);
+  EXPECT_EQ(decoded[1].value, "or");
+  EXPECT_EQ(decoded[2].predicate, pivot::CaptionPredicate::EndsWith);
+  EXPECT_EQ(decoded[2].value, "th");
+  EXPECT_EQ(decoded[3].predicate, pivot::CaptionPredicate::Between);
+  EXPECT_EQ(decoded[3].value, "B");
+  EXPECT_EQ(decoded[3].value_high, "M");
+  // Every entry, decoded or not, is still re-emitted from the passthrough.
+  const std::string round = write_pivot_table_definition(table_or.value());
+  EXPECT_NE(round.find("valueGreaterThan"), std::string::npos) << round;
+  EXPECT_EQ(CountOccurrences(round, "<filter "), 5U) << round;
+}
+TEST(PivotTableReader, AuthoredCaptionFilterAcceptsThePlainFilterListShape) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append(
+      "<filters count=\"1\"><filter fld=\"0\" type=\"captionEqual\"><autoFilter ref=\"A3:A9\">"
+      "<filterColumn colId=\"0\"><filters><filter val=\"South\"/></filters>"
+      "</filterColumn></autoFilter></filter></filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  ASSERT_EQ(table_or.value().authored_caption_filters().size(), 1U);
+  EXPECT_EQ(table_or.value().authored_caption_filters()[0].value, "South");
+}
+TEST(PivotTableReader, UnevaluableFilterFamiliesAreSkippedButStillRoundTrip) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"3\">");
+  // A count filter with no nested `<top10>` names no quantity at all.
+  xml.append("<filter fld=\"0\" type=\"count\"><autoFilter ref=\"A1\"/></filter>");
+  // An unknown type is the forward-compatibility case: a family this
+  // version does not know must be passed through rather than guessed at.
+  xml.append("<filter fld=\"1\" type=\"someFutureFamily\"><autoFilter ref=\"A1\"/></filter>");
+  // A caption filter whose criterion element is missing entirely.
+  xml.append("<filter fld=\"2\" type=\"captionEqual\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
+  EXPECT_TRUE(table_or.value().authored_caption_filters().empty());
+  EXPECT_TRUE(table_or.value().authored_period_filters().empty());
+  EXPECT_TRUE(table_or.value().authored_recurring_filters().empty());
+
+  const std::string round = write_pivot_table_definition(table_or.value());
+  EXPECT_EQ(CountOccurrences(round, "<filter "), 3U) << round;
+  EXPECT_NE(round.find("someFutureFamily"), std::string::npos) << round;
+}
+TEST(PivotTableReader, DecodedFilterFamiliesStillRoundTripVerbatim) {
+  // Decoding is read-side only: the writer re-emits the `<filters>` block
+  // from the verbatim passthrough tail, so gaining a decoder must not
+  // change a single byte of what is written back.
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"2\">");
+  xml.append("<filter fld=\"2\" type=\"thisWeek\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("<filter fld=\"2\" type=\"M1\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  EXPECT_EQ(table_or.value().authored_period_filters().size(), 1U);
+  EXPECT_EQ(table_or.value().authored_recurring_filters().size(), 1U);
+
+  const std::string round = write_pivot_table_definition(table_or.value());
+  EXPECT_EQ(CountOccurrences(round, "<filter "), 2U) << round;
+  EXPECT_NE(round.find("thisWeek"), std::string::npos) << round;
+  EXPECT_NE(round.find("\"M1\""), std::string::npos) << round;
+}
+TEST(PivotTableReader, TopNFlavoursAreDistinguishedByTheirTypeAlone) {
+  // The three flavours share an identically shaped `<top10 val="N">`, so a
+  // decode that ignored the type attribute would silently conflate them.
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"3\">");
+  xml.append(
+      "<filter fld=\"0\" type=\"count\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
+      "<top10 val=\"2\"/></filterColumn></autoFilter></filter>");
+  xml.append(
+      "<filter fld=\"0\" type=\"percent\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
+      "<top10 percent=\"1\" val=\"70\"/></filterColumn></autoFilter></filter>");
+  xml.append(
+      "<filter fld=\"0\" type=\"sum\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
+      "<top10 val=\"100\"/></filterColumn></autoFilter></filter>");
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const auto& filters = table_or.value().authored_value_filters();
+  ASSERT_EQ(filters.size(), 3U);
+  for (const auto& entry : filters) {
+    EXPECT_EQ(entry.type, pivot::FilterType::ValueTop10);
+  }
+  EXPECT_EQ(filters[0].top_n_basis, pivot::TopNBasis::Items);
+  EXPECT_DOUBLE_EQ(filters[0].value, 2.0);
+  EXPECT_EQ(filters[1].top_n_basis, pivot::TopNBasis::Percent);
+  EXPECT_DOUBLE_EQ(filters[1].value, 70.0);
+  EXPECT_EQ(filters[2].top_n_basis, pivot::TopNBasis::Sum);
+  EXPECT_DOUBLE_EQ(filters[2].value, 100.0);
+}
+TEST(PivotTableReader, TopTenDirectionDecodesTopAttributeAndDefaultsToTop) {
+  // Excel's "Bottom N" dialog option writes `top="0"` on the same
+  // `<top10>` element as "Top N"; the attribute is absent for "Top N"
+  // itself, so a missing attribute must decode the same as `top="1"`.
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"2\">");
+  xml.append(
+      "<filter fld=\"0\" type=\"count\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
+      "<top10 val=\"2\"/></filterColumn></autoFilter></filter>");
+  xml.append(
+      "<filter fld=\"0\" type=\"count\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
+      "<top10 top=\"0\" val=\"2\"/></filterColumn></autoFilter></filter>");
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const auto& filters = table_or.value().authored_value_filters();
+  ASSERT_EQ(filters.size(), 2U);
+  EXPECT_TRUE(filters[0].top);
+  EXPECT_FALSE(filters[1].top);
+}
+TEST(PivotTableReader, RelativePeriodFiltersDecodeFromTheTypeNameAlone) {
+  // These carry no criteria: the window is implied by the type, so the
+  // decode is the name mapping and nothing else.
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"3\">");
+  xml.append("<filter fld=\"2\" type=\"thisMonth\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("<filter fld=\"3\" type=\"yearToDate\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("<filter fld=\"1\" type=\"lastQuarter\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const auto& periods = table_or.value().authored_period_filters();
+  ASSERT_EQ(periods.size(), 3U);
+  EXPECT_EQ(periods[0].field_index, 2U);
+  EXPECT_EQ(periods[0].period, pivot::RelativePeriod::ThisMonth);
+  EXPECT_EQ(periods[1].field_index, 3U);
+  EXPECT_EQ(periods[1].period, pivot::RelativePeriod::YearToDate);
+  EXPECT_EQ(periods[2].field_index, 1U);
+  EXPECT_EQ(periods[2].period, pivot::RelativePeriod::LastQuarter);
+  // A period entry carries no bounds, so it must not land in the list whose
+  // members all do.
+  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
+
+  const std::string round = write_pivot_table_definition(table_or.value());
+  EXPECT_EQ(CountOccurrences(round, "<filter "), 3U) << round;
+}
+TEST(PivotTableReader, RecurringPeriodFiltersDecodeToACalendarMonthRange) {
+  // `M<n>` is one month and `Q<n>` its three, both year-free -- so unlike
+  // the relative periods these need no clock to mean something.
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"4\">");
+  xml.append("<filter fld=\"2\" type=\"M1\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("<filter fld=\"2\" type=\"M12\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("<filter fld=\"3\" type=\"Q1\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("<filter fld=\"1\" type=\"Q4\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const auto& recurring = table_or.value().authored_recurring_filters();
+  ASSERT_EQ(recurring.size(), 4U);
+  EXPECT_EQ(recurring[0].field_index, 2U);
+  EXPECT_EQ(recurring[0].month_low, 1U);
+  EXPECT_EQ(recurring[0].month_high, 1U);
+  EXPECT_EQ(recurring[1].month_low, 12U);
+  EXPECT_EQ(recurring[1].month_high, 12U);
+  EXPECT_EQ(recurring[2].field_index, 3U);
+  EXPECT_EQ(recurring[2].month_low, 1U);
+  EXPECT_EQ(recurring[2].month_high, 3U);
+  EXPECT_EQ(recurring[3].month_low, 10U);
+  EXPECT_EQ(recurring[3].month_high, 12U);
+  // A recurring entry is not a window and carries no bounds, so it must
+  // reach neither sibling list.
+  EXPECT_TRUE(table_or.value().authored_period_filters().empty());
+  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
+}
+TEST(PivotTableReader, MalformedRecurringSelectorsAreSkipped) {
+  // `M0`, `M13` and `Q5` are outside their families, and a bare letter or
+  // a non-digit tail names nothing at all. None may decode to a range that
+  // silently filters the wrong months.
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"6\">");
+  for (const char* type : {"M0", "M13", "Q0", "Q5", "M", "Mx"}) {
+    xml.append("<filter fld=\"2\" type=\"").append(type).append("\"><autoFilter ref=\"A1\"/></filter>");
+  }
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  EXPECT_TRUE(table_or.value().authored_recurring_filters().empty());
+}
+TEST(PivotTableReader, WeekPeriodFiltersDecodeAlongsideTheOtherWindows) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append("<filters count=\"3\">");
+  xml.append("<filter fld=\"2\" type=\"thisWeek\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("<filter fld=\"2\" type=\"lastWeek\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("<filter fld=\"2\" type=\"nextWeek\"><autoFilter ref=\"A1\"/></filter>");
+  xml.append("</filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  const auto& periods = table_or.value().authored_period_filters();
+  ASSERT_EQ(periods.size(), 3U);
+  EXPECT_EQ(periods[0].period, pivot::RelativePeriod::ThisWeek);
+  EXPECT_EQ(periods[1].period, pivot::RelativePeriod::LastWeek);
+  EXPECT_EQ(periods[2].period, pivot::RelativePeriod::NextWeek);
+}
+TEST(PivotTableReader, ValueFilterCriteriaThatAreNotNumbersAreSkipped) {
+  // The criterion shares the sheet path's number lexer, so a caption-ish
+  // payload under a value type is refused instead of reaching the
+  // comparison as zero.
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append(
+      "<filters count=\"1\"><filter fld=\"0\" type=\"valueGreaterThan\"><autoFilter ref=\"A1\">"
+      "<filterColumn colId=\"0\"><customFilters><customFilter operator=\"greaterThan\" val=\"North\"/>"
+      "</customFilters></filterColumn></autoFilter></filter></filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
+}
+TEST(PivotTableReader, ValueBetweenWithOnlyOneBoundIsSkipped) {
+  std::string xml(kXmlDecl);
+  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
+  xml.append("<location ref=\"A1:B2\"/>");
+  xml.append(
+      "<filters count=\"1\"><filter fld=\"0\" type=\"valueBetween\"><autoFilter ref=\"A1\">"
+      "<filterColumn colId=\"0\"><customFilters and=\"1\">"
+      "<customFilter operator=\"greaterThanOrEqual\" val=\"100\"/>"
+      "</customFilters></filterColumn></autoFilter></filter></filters>");
+  xml.append("</pivotTableDefinition>");
+
+  auto table_or = read_pivot_table_definition(Bytes(xml));
+  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
+  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
+}
+
+}  // namespace
+}  // namespace formulon::io
diff --git a/tests/unit/io/pivot_table_reader_test.cpp b/tests/unit/io/pivot_table_reader_test.cpp
index 54fd7d30c..5689aa119 100644
--- a/tests/unit/io/pivot_table_reader_test.cpp
+++ b/tests/unit/io/pivot_table_reader_test.cpp
@@ -1,8 +1,4 @@
-//
-// Unit tests for `formulon::io::read_pivot_table_definition`. Each test
-// feeds a hand-rolled OOXML byte vector into the reader and asserts the
-// populated `pivot::PivotTable` shape; the workbook integration (rels
-// resolution, xlsx fixture loading) is covered separately.
+// Pivot-table definition reader tests grouped by XML concern.
 
 #include "io/pivot_table_reader.h"
 
@@ -16,30 +12,12 @@
 #include "io/pivot_table_writer.h"
 #include "pivot/pivot_table.h"
 #include "pivot/pivot_types.h"
+#include "pivot_table_reader_test_helpers.h"
 #include "utils/error.h"
 
 namespace formulon::io {
 namespace {
-
-std::vector<std::uint8_t> Bytes(std::string_view xml) {
-  return std::vector<std::uint8_t>(xml.begin(), xml.end());
-}
-
-std::size_t CountOccurrences(std::string_view haystack, std::string_view needle) {
-  std::size_t count = 0;
-  for (std::size_t at = haystack.find(needle); at != std::string_view::npos; at = haystack.find(needle, at + 1)) {
-    ++count;
-  }
-  return count;
-}
-
-constexpr std::string_view kXmlDecl = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n";
-constexpr std::string_view kPivotNs = " xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"";
-
-// ---------------------------------------------------------------------------
-// Happy paths
-// ---------------------------------------------------------------------------
-
+using namespace pivot_table_reader_test_support;
 TEST(PivotTableReader, MinimalHappyPath) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P1\" cacheId=\"3\">");
@@ -60,7 +38,6 @@ TEST(PivotTableReader, MinimalHappyPath) {
   EXPECT_TRUE(table.fields().empty());
   EXPECT_TRUE(table.data_fields().empty());
 }
-
 TEST(PivotTableReader, MultipleFieldsAxisDecoding) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
@@ -81,7 +58,6 @@ TEST(PivotTableReader, MultipleFieldsAxisDecoding) {
   EXPECT_EQ(table.fields()[1].axis, pivot::PivotAxis::Col);
   EXPECT_EQ(table.fields()[2].axis, pivot::PivotAxis::Value);
 }
-
 TEST(PivotTableReader, ItemsDecodingSkipsSubtotalMarkers) {
   // Mix of real items (with `x` indices), a hidden item (`h="1"`), and a
   // subtotal marker (`t="default"`). The marker must be skipped; the
@@ -111,7 +87,6 @@ TEST(PivotTableReader, ItemsDecodingSkipsSubtotalMarkers) {
   EXPECT_FALSE(items[1].visible);
   EXPECT_TRUE(items[2].visible);
 }
-
 TEST(PivotTableReader, ItemWithMalformedCacheIndexIsRejected) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
@@ -126,7 +101,6 @@ TEST(PivotTableReader, ItemWithMalformedCacheIndexIsRejected) {
   EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoSheetCorrupt);
   EXPECT_NE(table_or.error().message.find("invalid x attribute"), std::string::npos);
 }
-
 TEST(PivotTableReader, RowAndColFieldOrder) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
@@ -155,7 +129,6 @@ TEST(PivotTableReader, RowAndColFieldOrder) {
   ASSERT_EQ(table.col_field_order().size(), 1U);
   EXPECT_EQ(table.col_field_order()[0], 2U);
 }
-
 TEST(PivotTableReader, SortTypeDescendingReversesTheField) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
@@ -172,7 +145,6 @@ TEST(PivotTableReader, SortTypeDescendingReversesTheField) {
   EXPECT_FALSE(table.fields()[0].sort.ascending);
   EXPECT_FALSE(table.fields()[0].sort.manual);
 }
-
 TEST(PivotTableReader, SortTypeManualDefersToItemOrder) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
@@ -188,7 +160,6 @@ TEST(PivotTableReader, SortTypeManualDefersToItemOrder) {
   ASSERT_EQ(table.fields().size(), 1U);
   EXPECT_TRUE(table.fields()[0].sort.manual);
 }
-
 TEST(PivotTableReader, MissingSortTypeKeepsAscendingDefault) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
@@ -205,10 +176,6 @@ TEST(PivotTableReader, MissingSortTypeKeepsAscendingDefault) {
   EXPECT_TRUE(table.fields()[0].sort.ascending);
   EXPECT_FALSE(table.fields()[0].sort.manual);
 }
-
-// Excel writes `<field x="-2"/>` for the Values (Sigma) pseudo-field once
-// a pivot has two or more data fields. It must not be coerced into field
-// index 0, which would duplicate an unrelated field onto this axis.
 TEST(PivotTableReader, ValuesFieldMarkerIsKeptOutOfFieldOrder) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
@@ -232,7 +199,6 @@ TEST(PivotTableReader, ValuesFieldMarkerIsKeptOutOfFieldOrder) {
   EXPECT_EQ(table.col_values_position().value(), 1U);
   EXPECT_FALSE(table.row_values_position().has_value());
 }
-
 TEST(PivotTableReader, MultipleDataFieldsOnSameSourceField) {
   // GETPIVOTDATA's display-name lookup requires that two data fields on
   // the same source column (Sum + Average of "Amount") survive as two
@@ -263,7 +229,6 @@ TEST(PivotTableReader, MultipleDataFieldsOnSameSourceField) {
   EXPECT_EQ(table.data_fields()[1].field_index, 3U);
   EXPECT_EQ(table.data_fields()[1].aggregation, pivot::Aggregation::Average);
 }
-
 TEST(PivotTableReader, DataFieldAggregationMappingExhaustive) {
   // One <dataField> per Aggregation enum value the OOXML subtotal
   // attribute can name.
@@ -305,7 +270,6 @@ TEST(PivotTableReader, DataFieldAggregationMappingExhaustive) {
     EXPECT_EQ(table.data_fields()[i].aggregation, cases[i].expected) << "case=" << cases[i].attr;
   }
 }
-
 TEST(PivotTableReader, UnknownSubtotalFallsBackToSum) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
@@ -320,7 +284,6 @@ TEST(PivotTableReader, UnknownSubtotalFallsBackToSum) {
   ASSERT_EQ(table_or.value().data_fields().size(), 1U);
   EXPECT_EQ(table_or.value().data_fields()[0].aggregation, pivot::Aggregation::Sum);
 }
-
 TEST(PivotTableReader, PageFieldsCarryTheSelectedItem) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"7\">");
@@ -349,7 +312,6 @@ TEST(PivotTableReader, PageFieldsCarryTheSelectedItem) {
   // them untouched.
   EXPECT_NE(table.raw_passthrough_after_col_fields().find("<pageField "), std::string::npos);
 }
-
 TEST(PivotTableReader, PageFieldWithoutASelectionLeavesTheItemAbsent) {
   // The unfiltered state: Excel writes no `item`, and the field is showing
   // every item rather than item 0.
@@ -365,7 +327,6 @@ TEST(PivotTableReader, PageFieldWithoutASelectionLeavesTheItemAbsent) {
   ASSERT_EQ(table_or.value().page_fields().size(), 1U);
   EXPECT_FALSE(table_or.value().page_fields()[0].item_index.has_value());
 }
-
 TEST(PivotTableReader, PageFieldWithoutAFieldIndexIsSkipped) {
   // `fld` names the field; absent, the entry designates nothing. Defaulting
   // it to 0 would draw a page header over a field the user never filtered by.
@@ -381,7 +342,6 @@ TEST(PivotTableReader, PageFieldWithoutAFieldIndexIsSkipped) {
   ASSERT_EQ(table_or.value().page_fields().size(), 1U);
   EXPECT_EQ(table_or.value().page_fields()[0].field_index, 0U);
 }
-
 TEST(PivotTableReader, PageFieldOrderOverridesDocumentOrder) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
@@ -394,7 +354,6 @@ TEST(PivotTableReader, PageFieldOrderOverridesDocumentOrder) {
   ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
   EXPECT_EQ(table_or.value().page_field_order(), (std::vector<std::uint32_t>{1, 0}));
 }
-
 TEST(PivotTableReader, PageAxisWithoutAPageFieldsBlockFallsBackToDocumentOrder) {
   std::string xml(kXmlDecl);
   xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
@@ -410,658 +369,5 @@ TEST(PivotTableReader, PageAxisWithoutAPageFieldsBlockFallsBackToDocumentOrder)
   EXPECT_EQ(table_or.value().page_field_order(), (std::vector<std::uint32_t>{1, 2}));
 }
 
-// ---------------------------------------------------------------------------
-// Error paths
-// ---------------------------------------------------------------------------
-
-TEST(PivotTableReader, MissingDataFieldNameIsCorruption) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append("  <location ref=\"A1:B2\"/>");
-  xml.append("  <dataFields count=\"1\">");
-  xml.append("    <dataField fld=\"1\" subtotal=\"sum\"/>");
-  xml.append("  </dataFields>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_FALSE(static_cast<bool>(table_or));
-  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoSheetCorrupt);
-}
-
-TEST(PivotTableReader, MissingLocationIsCorruption) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append("  <pivotFields count=\"0\"/>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_FALSE(static_cast<bool>(table_or));
-  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoSheetCorrupt);
-}
-
-TEST(PivotTableReader, UnparseableLocationRefIsCorruption) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append("  <location ref=\"not-a-range\"/>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_FALSE(static_cast<bool>(table_or));
-  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoSheetCorrupt);
-}
-
-TEST(PivotTableReader, MalformedRootIsContentTypeInvalid) {
-  std::string xml(kXmlDecl);
-  xml.append("<foo").append(kPivotNs).append("><location ref=\"A1\"/></foo>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_FALSE(static_cast<bool>(table_or));
-  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoContentTypeInvalid);
-}
-
-TEST(PivotTableReader, MalformedXmlIsParseError) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append("><location");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_FALSE(static_cast<bool>(table_or));
-  EXPECT_EQ(table_or.error().code, FormulonErrorCode::kIoXmlParse);
-}
-
-// ---------------------------------------------------------------------------
-// Passthrough capture for unmodelled extensions.
-// ---------------------------------------------------------------------------
-
-TEST(PivotTableReader, UnmodelledChildrenCapturedAsPassthrough) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<calculatedItems count=\"1\"><calculatedItem name=\"Avg\" formula=\"=A1/B1\"/></calculatedItems>");
-  xml.append("<pivotTableStyleInfo name=\"PivotStyleLight16\" showRowHeaders=\"1\"/>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const std::string& passthrough = table_or.value().raw_passthrough_xml();
-  // Both unrecognised elements survive verbatim (order-preserving).
-  EXPECT_NE(passthrough.find("<calculatedItems"), std::string::npos);
-  EXPECT_NE(passthrough.find("formula=\"=A1/B1\""), std::string::npos);
-  EXPECT_NE(passthrough.find("<pivotTableStyleInfo"), std::string::npos);
-  EXPECT_NE(passthrough.find("PivotStyleLight16"), std::string::npos);
-  // Recognised elements (location) are NOT in the passthrough.
-  EXPECT_EQ(passthrough.find("<location"), std::string::npos);
-}
-
-// `<filters>` is decoded for evaluation but serialised by nobody: the block
-// has to survive a read -> write round trip byte-for-byte and exactly once
-// out of the passthrough tail, while the decoded view lands in
-// `authored_caption_filters()`. It must still not appear in
-// `active_filters()`, which is a session-only list the writer never emits
-// (see `PivotTable::active_filters`).
-TEST(PivotTableReader, AuthoredFiltersDecodeForEvaluationAndStillRoundTripAsPassthrough) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"0\"/>");
-  xml.append("<pivotTableStyleInfo name=\"PivotStyleLight16\"/>");
-  xml.append(
-      "<filters count=\"1\"><filter fld=\"0\" type=\"captionEqual\" evalOrder=\"-1\" id=\"1\">"
-      "<autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
-      "<customFilters><customFilter operator=\"equal\" val=\"North\"/></customFilters>"
-      "</filterColumn></autoFilter></filter></filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const pivot::PivotTable& table = table_or.value();
-  EXPECT_TRUE(table.active_filters().empty());
-  ASSERT_EQ(table.authored_caption_filters().size(), 1U);
-  EXPECT_EQ(table.authored_caption_filters()[0].field_index, 0U);
-  EXPECT_EQ(table.authored_caption_filters()[0].predicate, pivot::CaptionPredicate::Equal);
-  EXPECT_EQ(table.authored_caption_filters()[0].value, "North");
-  EXPECT_NE(table.raw_passthrough_xml().find("<filters"), std::string::npos);
-  EXPECT_NE(table.raw_passthrough_xml().find("val=\"North\""), std::string::npos);
-
-  const std::string round = write_pivot_table_definition(table);
-  EXPECT_EQ(CountOccurrences(round, "<filters"), 1U) << round;
-  EXPECT_NE(round.find("val=\"North\""), std::string::npos) << round;
-  // The style block is authored before `<filters>`; re-emission keeps that
-  // order, which the schema requires.
-  EXPECT_LT(round.find("<pivotTableStyleInfo"), round.find("<filters"));
-
-  auto reparsed_or = read_pivot_table_definition(Bytes(round));
-  ASSERT_TRUE(static_cast<bool>(reparsed_or)) << reparsed_or.error().message;
-  EXPECT_TRUE(reparsed_or.value().active_filters().empty());
-  // The decode is stable across the round trip, and the writer still emits
-  // the block from the passthrough tail rather than from the decoded view.
-  EXPECT_EQ(reparsed_or.value().authored_caption_filters().size(), 1U);
-  EXPECT_EQ(write_pivot_table_definition(reparsed_or.value()), round);
-}
-
-// Excel repeats the predicate inside the criterion as an `autoFilter`
-// wildcard pattern, so the decode has to strip the marker the `type`
-// already names. `<top10>`-driven and value-family entries carry no
-// caption criterion and are skipped rather than decoded into a wrong
-// predicate.
-TEST(PivotTableReader, AuthoredCaptionFilterVariantsDecodeAndNonCaptionTypesAreSkipped) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"5\">");
-  xml.append(
-      "<filter fld=\"1\" type=\"captionBeginsWith\"><autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
-      "<customFilters><customFilter operator=\"equal\" val=\"No*\"/></customFilters>"
-      "</filterColumn></autoFilter></filter>");
-  xml.append(
-      "<filter fld=\"2\" type=\"captionContains\"><autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
-      "<customFilters><customFilter operator=\"equal\" val=\"*or*\"/></customFilters>"
-      "</filterColumn></autoFilter></filter>");
-  xml.append(
-      "<filter fld=\"3\" type=\"captionEndsWith\"><autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
-      "<customFilters><customFilter operator=\"equal\" val=\"*th\"/></customFilters>"
-      "</filterColumn></autoFilter></filter>");
-  xml.append(
-      "<filter fld=\"4\" type=\"captionBetween\"><autoFilter ref=\"A3:A9\"><filterColumn colId=\"0\">"
-      "<customFilters and=\"1\"><customFilter operator=\"greaterThanOrEqual\" val=\"B\"/>"
-      "<customFilter operator=\"lessThanOrEqual\" val=\"M\"/></customFilters>"
-      "</filterColumn></autoFilter></filter>");
-  // Value family: outside the caption set, so passthrough-only.
-  xml.append(
-      "<filter fld=\"5\" type=\"valueGreaterThan\" iMeasureFld=\"0\"><autoFilter ref=\"A3:A9\">"
-      "<filterColumn colId=\"0\"><customFilters><customFilter operator=\"greaterThan\" val=\"100\"/>"
-      "</customFilters></filterColumn></autoFilter></filter>");
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const auto& decoded = table_or.value().authored_caption_filters();
-  ASSERT_EQ(decoded.size(), 4U);
-  EXPECT_EQ(decoded[0].field_index, 1U);
-  EXPECT_EQ(decoded[0].predicate, pivot::CaptionPredicate::BeginsWith);
-  EXPECT_EQ(decoded[0].value, "No");
-  EXPECT_EQ(decoded[1].predicate, pivot::CaptionPredicate::Contains);
-  EXPECT_EQ(decoded[1].value, "or");
-  EXPECT_EQ(decoded[2].predicate, pivot::CaptionPredicate::EndsWith);
-  EXPECT_EQ(decoded[2].value, "th");
-  EXPECT_EQ(decoded[3].predicate, pivot::CaptionPredicate::Between);
-  EXPECT_EQ(decoded[3].value, "B");
-  EXPECT_EQ(decoded[3].value_high, "M");
-  // Every entry, decoded or not, is still re-emitted from the passthrough.
-  const std::string round = write_pivot_table_definition(table_or.value());
-  EXPECT_NE(round.find("valueGreaterThan"), std::string::npos) << round;
-  EXPECT_EQ(CountOccurrences(round, "<filter "), 5U) << round;
-}
-
-// A plain equality is also spelled as a `<filters>` list of `<filter val>`
-// rather than a `<customFilters>` comparison; both reach the same decode.
-TEST(PivotTableReader, AuthoredCaptionFilterAcceptsThePlainFilterListShape) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append(
-      "<filters count=\"1\"><filter fld=\"0\" type=\"captionEqual\"><autoFilter ref=\"A3:A9\">"
-      "<filterColumn colId=\"0\"><filters><filter val=\"South\"/></filters>"
-      "</filterColumn></autoFilter></filter></filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  ASSERT_EQ(table_or.value().authored_caption_filters().size(), 1U);
-  EXPECT_EQ(table_or.value().authored_caption_filters()[0].value, "South");
-}
-
-// Entries the value decoder must refuse rather than answer approximately,
-// all of which still have to survive the round trip as passthrough.
-//
-// `percent` and `sum` are the other two flavours of Excel's "top ten"
-// dialog. They share `count`'s nested `<top10>` element but rank on a
-// share of the total rather than on an item count, so reading them as a
-// count would quietly return the wrong rows -- worse than not filtering.
-// An entry that names a family but no usable criterion is the remaining
-// unevaluable shape: it must not reach any decoded list, and it must
-// still survive the round trip so a save does not drop a filter Excel
-// authored and can apply itself.
-TEST(PivotTableReader, UnevaluableFilterFamiliesAreSkippedButStillRoundTrip) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"3\">");
-  // A count filter with no nested `<top10>` names no quantity at all.
-  xml.append("<filter fld=\"0\" type=\"count\"><autoFilter ref=\"A1\"/></filter>");
-  // An unknown type is the forward-compatibility case: a family this
-  // version does not know must be passed through rather than guessed at.
-  xml.append("<filter fld=\"1\" type=\"someFutureFamily\"><autoFilter ref=\"A1\"/></filter>");
-  // A caption filter whose criterion element is missing entirely.
-  xml.append("<filter fld=\"2\" type=\"captionEqual\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
-  EXPECT_TRUE(table_or.value().authored_caption_filters().empty());
-  EXPECT_TRUE(table_or.value().authored_period_filters().empty());
-  EXPECT_TRUE(table_or.value().authored_recurring_filters().empty());
-
-  const std::string round = write_pivot_table_definition(table_or.value());
-  EXPECT_EQ(CountOccurrences(round, "<filter "), 3U) << round;
-  EXPECT_NE(round.find("someFutureFamily"), std::string::npos) << round;
-}
-
-TEST(PivotTableReader, DecodedFilterFamiliesStillRoundTripVerbatim) {
-  // Decoding is read-side only: the writer re-emits the `<filters>` block
-  // from the verbatim passthrough tail, so gaining a decoder must not
-  // change a single byte of what is written back.
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"2\">");
-  xml.append("<filter fld=\"2\" type=\"thisWeek\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("<filter fld=\"2\" type=\"M1\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  EXPECT_EQ(table_or.value().authored_period_filters().size(), 1U);
-  EXPECT_EQ(table_or.value().authored_recurring_filters().size(), 1U);
-
-  const std::string round = write_pivot_table_definition(table_or.value());
-  EXPECT_EQ(CountOccurrences(round, "<filter "), 2U) << round;
-  EXPECT_NE(round.find("thisWeek"), std::string::npos) << round;
-  EXPECT_NE(round.find("\"M1\""), std::string::npos) << round;
-}
-
-TEST(PivotTableReader, TopNFlavoursAreDistinguishedByTheirTypeAlone) {
-  // The three flavours share an identically shaped `<top10 val="N">`, so a
-  // decode that ignored the type attribute would silently conflate them.
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"3\">");
-  xml.append(
-      "<filter fld=\"0\" type=\"count\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
-      "<top10 val=\"2\"/></filterColumn></autoFilter></filter>");
-  xml.append(
-      "<filter fld=\"0\" type=\"percent\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
-      "<top10 percent=\"1\" val=\"70\"/></filterColumn></autoFilter></filter>");
-  xml.append(
-      "<filter fld=\"0\" type=\"sum\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
-      "<top10 val=\"100\"/></filterColumn></autoFilter></filter>");
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const auto& filters = table_or.value().authored_value_filters();
-  ASSERT_EQ(filters.size(), 3U);
-  for (const auto& entry : filters) {
-    EXPECT_EQ(entry.type, pivot::FilterType::ValueTop10);
-  }
-  EXPECT_EQ(filters[0].top_n_basis, pivot::TopNBasis::Items);
-  EXPECT_DOUBLE_EQ(filters[0].value, 2.0);
-  EXPECT_EQ(filters[1].top_n_basis, pivot::TopNBasis::Percent);
-  EXPECT_DOUBLE_EQ(filters[1].value, 70.0);
-  EXPECT_EQ(filters[2].top_n_basis, pivot::TopNBasis::Sum);
-  EXPECT_DOUBLE_EQ(filters[2].value, 100.0);
-}
-
-TEST(PivotTableReader, TopTenDirectionDecodesTopAttributeAndDefaultsToTop) {
-  // Excel's "Bottom N" dialog option writes `top="0"` on the same
-  // `<top10>` element as "Top N"; the attribute is absent for "Top N"
-  // itself, so a missing attribute must decode the same as `top="1"`.
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"2\">");
-  xml.append(
-      "<filter fld=\"0\" type=\"count\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
-      "<top10 val=\"2\"/></filterColumn></autoFilter></filter>");
-  xml.append(
-      "<filter fld=\"0\" type=\"count\"><autoFilter ref=\"A1\"><filterColumn colId=\"0\">"
-      "<top10 top=\"0\" val=\"2\"/></filterColumn></autoFilter></filter>");
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const auto& filters = table_or.value().authored_value_filters();
-  ASSERT_EQ(filters.size(), 2U);
-  EXPECT_TRUE(filters[0].top);
-  EXPECT_FALSE(filters[1].top);
-}
-
-TEST(PivotTableReader, RelativePeriodFiltersDecodeFromTheTypeNameAlone) {
-  // These carry no criteria: the window is implied by the type, so the
-  // decode is the name mapping and nothing else.
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"3\">");
-  xml.append("<filter fld=\"2\" type=\"thisMonth\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("<filter fld=\"3\" type=\"yearToDate\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("<filter fld=\"1\" type=\"lastQuarter\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const auto& periods = table_or.value().authored_period_filters();
-  ASSERT_EQ(periods.size(), 3U);
-  EXPECT_EQ(periods[0].field_index, 2U);
-  EXPECT_EQ(periods[0].period, pivot::RelativePeriod::ThisMonth);
-  EXPECT_EQ(periods[1].field_index, 3U);
-  EXPECT_EQ(periods[1].period, pivot::RelativePeriod::YearToDate);
-  EXPECT_EQ(periods[2].field_index, 1U);
-  EXPECT_EQ(periods[2].period, pivot::RelativePeriod::LastQuarter);
-  // A period entry carries no bounds, so it must not land in the list whose
-  // members all do.
-  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
-
-  const std::string round = write_pivot_table_definition(table_or.value());
-  EXPECT_EQ(CountOccurrences(round, "<filter "), 3U) << round;
-}
-
-TEST(PivotTableReader, RecurringPeriodFiltersDecodeToACalendarMonthRange) {
-  // `M<n>` is one month and `Q<n>` its three, both year-free -- so unlike
-  // the relative periods these need no clock to mean something.
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"4\">");
-  xml.append("<filter fld=\"2\" type=\"M1\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("<filter fld=\"2\" type=\"M12\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("<filter fld=\"3\" type=\"Q1\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("<filter fld=\"1\" type=\"Q4\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const auto& recurring = table_or.value().authored_recurring_filters();
-  ASSERT_EQ(recurring.size(), 4U);
-  EXPECT_EQ(recurring[0].field_index, 2U);
-  EXPECT_EQ(recurring[0].month_low, 1U);
-  EXPECT_EQ(recurring[0].month_high, 1U);
-  EXPECT_EQ(recurring[1].month_low, 12U);
-  EXPECT_EQ(recurring[1].month_high, 12U);
-  EXPECT_EQ(recurring[2].field_index, 3U);
-  EXPECT_EQ(recurring[2].month_low, 1U);
-  EXPECT_EQ(recurring[2].month_high, 3U);
-  EXPECT_EQ(recurring[3].month_low, 10U);
-  EXPECT_EQ(recurring[3].month_high, 12U);
-  // A recurring entry is not a window and carries no bounds, so it must
-  // reach neither sibling list.
-  EXPECT_TRUE(table_or.value().authored_period_filters().empty());
-  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
-}
-
-TEST(PivotTableReader, MalformedRecurringSelectorsAreSkipped) {
-  // `M0`, `M13` and `Q5` are outside their families, and a bare letter or
-  // a non-digit tail names nothing at all. None may decode to a range that
-  // silently filters the wrong months.
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"6\">");
-  for (const char* type : {"M0", "M13", "Q0", "Q5", "M", "Mx"}) {
-    xml.append("<filter fld=\"2\" type=\"").append(type).append("\"><autoFilter ref=\"A1\"/></filter>");
-  }
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  EXPECT_TRUE(table_or.value().authored_recurring_filters().empty());
-}
-
-TEST(PivotTableReader, WeekPeriodFiltersDecodeAlongsideTheOtherWindows) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<filters count=\"3\">");
-  xml.append("<filter fld=\"2\" type=\"thisWeek\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("<filter fld=\"2\" type=\"lastWeek\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("<filter fld=\"2\" type=\"nextWeek\"><autoFilter ref=\"A1\"/></filter>");
-  xml.append("</filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const auto& periods = table_or.value().authored_period_filters();
-  ASSERT_EQ(periods.size(), 3U);
-  EXPECT_EQ(periods[0].period, pivot::RelativePeriod::ThisWeek);
-  EXPECT_EQ(periods[1].period, pivot::RelativePeriod::LastWeek);
-  EXPECT_EQ(periods[2].period, pivot::RelativePeriod::NextWeek);
-}
-
-TEST(PivotTableReader, ValueFilterCriteriaThatAreNotNumbersAreSkipped) {
-  // The criterion shares the sheet path's number lexer, so a caption-ish
-  // payload under a value type is refused instead of reaching the
-  // comparison as zero.
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append(
-      "<filters count=\"1\"><filter fld=\"0\" type=\"valueGreaterThan\"><autoFilter ref=\"A1\">"
-      "<filterColumn colId=\"0\"><customFilters><customFilter operator=\"greaterThan\" val=\"North\"/>"
-      "</customFilters></filterColumn></autoFilter></filter></filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
-}
-
-TEST(PivotTableReader, ValueBetweenWithOnlyOneBoundIsSkipped) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append(
-      "<filters count=\"1\"><filter fld=\"0\" type=\"valueBetween\"><autoFilter ref=\"A1\">"
-      "<filterColumn colId=\"0\"><customFilters and=\"1\">"
-      "<customFilter operator=\"greaterThanOrEqual\" val=\"100\"/>"
-      "</customFilters></filterColumn></autoFilter></filter></filters>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  EXPECT_TRUE(table_or.value().authored_value_filters().empty());
-}
-
-TEST(PivotTableReader, ShowDataAsAttributesAreParsed) {
-  // <dataField> exercises showDataAs / baseField / baseItem decoding.
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"2\">");
-  xml.append("  <pivotField axis=\"axisRow\" name=\"R\"/>");
-  xml.append("  <pivotField dataField=\"1\" name=\"V\"/>");
-  xml.append("</pivotFields>");
-  xml.append("<dataFields count=\"1\">");
-  xml.append(
-      "  <dataField name=\"X\" fld=\"0\" subtotal=\"sum\""
-      " showDataAs=\"difference\" baseField=\"1\" baseItem=\"3\"/>");
-  xml.append("</dataFields>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
-  const pivot::PivotTable& table = table_or.value();
-  ASSERT_EQ(table.data_fields().size(), 1U);
-  const pivot::PivotDataField& df = table.data_fields()[0];
-  EXPECT_EQ(df.show_as, pivot::ShowValuesAs::DifferenceFrom);
-  ASSERT_TRUE(df.show_as_base_field.has_value());
-  EXPECT_EQ(*df.show_as_base_field, 1U);
-  ASSERT_TRUE(df.show_as_base_item.has_value());
-  EXPECT_EQ(*df.show_as_base_item, 3U);
-}
-
-TEST(PivotTableReader, EmptyPassthroughWhenNoExtensionsPresent) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"1\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"0\"/>");
-  xml.append("</pivotTableDefinition>");
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or));
-  EXPECT_TRUE(table_or.value().raw_passthrough_xml().empty());
-}
-
-TEST(PivotTableReader, GrandTotalsDefaultTrueWhenAbsent) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"0\"/>");
-  xml.append("</pivotTableDefinition>");
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
-  EXPECT_TRUE(table_or.value().grand_totals_rows());
-  EXPECT_TRUE(table_or.value().grand_totals_cols());
-}
-
-TEST(PivotTableReader, GrandTotalsOffIsRead) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs);
-  xml.append(" name=\"P\" cacheId=\"0\" rowGrandTotals=\"0\" colGrandTotals=\"0\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"0\"/>");
-  xml.append("</pivotTableDefinition>");
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
-  EXPECT_FALSE(table_or.value().grand_totals_rows());
-  EXPECT_FALSE(table_or.value().grand_totals_cols());
-}
-
-TEST(PivotTableReader, LocationRequiredAttributesAreRead) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append(
-      "<location ref=\"A3:D10\" firstHeaderRow=\"1\" firstDataRow=\"2\" firstDataCol=\"3\" "
-      "rowPageCount=\"4\" colPageCount=\"5\"/>");
-  xml.append("<pivotFields count=\"0\"/>");
-  xml.append("</pivotTableDefinition>");
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
-  const pivot::PivotTable& table = table_or.value();
-  ASSERT_TRUE(table.location_first_header_row().has_value());
-  EXPECT_EQ(*table.location_first_header_row(), 1U);
-  ASSERT_TRUE(table.location_first_data_row().has_value());
-  EXPECT_EQ(*table.location_first_data_row(), 2U);
-  ASSERT_TRUE(table.location_first_data_col().has_value());
-  EXPECT_EQ(*table.location_first_data_col(), 3U);
-  ASSERT_TRUE(table.location_row_page_count().has_value());
-  EXPECT_EQ(*table.location_row_page_count(), 4U);
-  ASSERT_TRUE(table.location_col_page_count().has_value());
-  EXPECT_EQ(*table.location_col_page_count(), 5U);
-}
-
-TEST(PivotTableReader, LocationOptionalAttributesAbsentStayEmpty) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  // Only `ref` present; all offset attributes absent.
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"0\"/>");
-  xml.append("</pivotTableDefinition>");
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << "read failed: " << table_or.error().message;
-  const pivot::PivotTable& table = table_or.value();
-  EXPECT_FALSE(table.location_first_header_row().has_value());
-  EXPECT_FALSE(table.location_first_data_row().has_value());
-  EXPECT_FALSE(table.location_first_data_col().has_value());
-  EXPECT_FALSE(table.location_row_page_count().has_value());
-  EXPECT_FALSE(table.location_col_page_count().has_value());
-}
-
-// ---------------------------------------------------------------------------
-// Per-field subtotal selection / defaultSubtotal round trip.
-// ---------------------------------------------------------------------------
-
-TEST(PivotTableReader, CustomSubtotalsAndDefaultSubtotalSurviveRoundTrip) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"1\">");
-  // defaultSubtotal turned OFF, with explicit Average + Max custom
-  // subtotals selected.
-  xml.append("  <pivotField axis=\"axisRow\" name=\"R\" defaultSubtotal=\"0\" avgSubtotal=\"1\" maxSubtotal=\"1\"/>");
-  xml.append("</pivotFields>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const pivot::PivotTable& table = table_or.value();
-  ASSERT_EQ(table.fields().size(), 1U);
-  const pivot::PivotField& f = table.fields()[0];
-  EXPECT_FALSE(f.default_subtotal);
-  ASSERT_EQ(f.subtotal_fns.size(), 2U);
-  EXPECT_EQ(f.subtotal_fns[0], pivot::SubtotalFn::Average);
-  EXPECT_EQ(f.subtotal_fns[1], pivot::SubtotalFn::Max);
-
-  // Write -> read again: the custom selection must not revert to default.
-  const std::string round = write_pivot_table_definition(table);
-  auto reparsed_or = read_pivot_table_definition(Bytes(round));
-  ASSERT_TRUE(static_cast<bool>(reparsed_or)) << reparsed_or.error().message;
-  const pivot::PivotField& f2 = reparsed_or.value().fields()[0];
-  EXPECT_FALSE(f2.default_subtotal);
-  ASSERT_EQ(f2.subtotal_fns.size(), 2U);
-  EXPECT_EQ(f2.subtotal_fns[0], pivot::SubtotalFn::Average);
-  EXPECT_EQ(f2.subtotal_fns[1], pivot::SubtotalFn::Max);
-}
-
-TEST(PivotTableReader, DefaultSubtotalDefaultsTrueWhenAbsent) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"1\"><pivotField axis=\"axisRow\" name=\"R\"/></pivotFields>");
-  xml.append("</pivotTableDefinition>");
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  const pivot::PivotField& f = table_or.value().fields()[0];
-  EXPECT_TRUE(f.default_subtotal);
-  EXPECT_TRUE(f.subtotal_fns.empty());
-}
-
-// ---------------------------------------------------------------------------
-// <rowItems> / <colItems> survive verbatim through the passthrough buffer.
-// ---------------------------------------------------------------------------
-
-TEST(PivotTableReader, RowItemsAndColItemsSurviveRoundTrip) {
-  std::string xml(kXmlDecl);
-  xml.append("<pivotTableDefinition").append(kPivotNs).append(" name=\"P\" cacheId=\"0\">");
-  xml.append("<location ref=\"A1:B2\"/>");
-  xml.append("<pivotFields count=\"0\"/>");
-  xml.append("<rowItems count=\"2\"><i><x/></i><i t=\"grand\"><x/></i></rowItems>");
-  xml.append("<colItems count=\"1\"><i><x/></i></colItems>");
-  xml.append("</pivotTableDefinition>");
-
-  auto table_or = read_pivot_table_definition(Bytes(xml));
-  ASSERT_TRUE(static_cast<bool>(table_or)) << table_or.error().message;
-  // rowItems / colItems are binned into their schema-position buffers so
-  // the writer can re-emit them before <dataFields> (a single tail buffer
-  // would place them after <dataFields> and trip Excel's repair).
-  const pivot::PivotTable& table = table_or.value();
-  EXPECT_NE(table.raw_passthrough_after_row_fields().find("<rowItems"), std::string::npos);
-  EXPECT_NE(table.raw_passthrough_after_row_fields().find("t=\"grand\""), std::string::npos);
-  EXPECT_NE(table.raw_passthrough_after_col_fields().find("<colItems"), std::string::npos);
-  // They must NOT leak into the tail buffer.
-  EXPECT_EQ(table.raw_passthrough_xml().find("<rowItems"), std::string::npos);
-
-  // Write -> read again: the layout-item cache must still be present, and
-  // rowItems must precede colItems in the emitted bytes.
-  const std::string round = write_pivot_table_definition(table);
-  const std::size_t p_rowitems = round.find("<rowItems");
-  const std::size_t p_colitems = round.find("<colItems");
-  ASSERT_NE(p_rowitems, std::string::npos) << round;
-  ASSERT_NE(p_colitems, std::string::npos) << round;
-  EXPECT_LT(p_rowitems, p_colitems);
-  auto reparsed_or = read_pivot_table_definition(Bytes(round));
-  ASSERT_TRUE(static_cast<bool>(reparsed_or)) << reparsed_or.error().message;
-  const pivot::PivotTable& reparsed = reparsed_or.value();
-  EXPECT_NE(reparsed.raw_passthrough_after_row_fields().find("<rowItems"), std::string::npos);
-  EXPECT_NE(reparsed.raw_passthrough_after_col_fields().find("<colItems"), std::string::npos);
-}
-
 }  // namespace
 }  // namespace formulon::io
diff --git a/tests/unit/io/pivot_table_reader_test_helpers.h b/tests/unit/io/pivot_table_reader_test_helpers.h
new file mode 100644
index 000000000..d70c9a06b
--- /dev/null
+++ b/tests/unit/io/pivot_table_reader_test_helpers.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string_view>
+#include <vector>
+
+namespace formulon::io::pivot_table_reader_test_support {
+
+inline std::vector<std::uint8_t> Bytes(std::string_view xml) {
+  return std::vector<std::uint8_t>(xml.begin(), xml.end());
+}
+
+inline std::size_t CountOccurrences(std::string_view haystack, std::string_view needle) {
+  std::size_t count = 0;
+  for (std::size_t at = haystack.find(needle); at != std::string_view::npos; at = haystack.find(needle, at + 1)) {
+    ++count;
+  }
+  return count;
+}
+
+inline constexpr std::string_view kXmlDecl = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n";
+inline constexpr std::string_view kPivotNs = " xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"";
+
+}  // namespace formulon::io::pivot_table_reader_test_support
diff --git a/tests/unit/io/row_custom_height_test.cpp b/tests/unit/io/row_custom_height_test.cpp
new file mode 100644
index 000000000..648e81c12
--- /dev/null
+++ b/tests/unit/io/row_custom_height_test.cpp
@@ -0,0 +1,150 @@
+// Row height provenance: an explicit (custom) height is distinct from an auto
+// height that only caches `ht`, in OOXML (`customHeight`) and XLSB
+// (`BrtRowHdr` fUnsynced).
+
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "io/xlsb/reader.h"
+#include "io/xlsb/writer.h"
+#include "sheet.h"
+#include "sheet_layout.h"
+#include "support/roundtrip_symmetry.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+/// Saves `wb` as `.xlsx` and reads it back.
+::testing::AssertionResult ThroughXlsx(const Workbook& wb, Workbook* out) {
+  auto saved = io::write_ooxml(wb);
+  if (!saved) {
+    return ::testing::AssertionFailure() << "write_ooxml failed: " << saved.error().message;
+  }
+  auto reloaded = io::read_ooxml(test::span_of(saved.value()));
+  if (!reloaded) {
+    return ::testing::AssertionFailure() << "read_ooxml failed: " << reloaded.error().message;
+  }
+  *out = std::move(reloaded.value().workbook);
+  return ::testing::AssertionSuccess();
+}
+
+/// Saves `wb` as `.xlsb` and reads it back.
+::testing::AssertionResult ThroughXlsb(const Workbook& wb, Workbook* out) {
+  auto saved = io::xlsb::write_xlsb(wb);
+  if (!saved) {
+    return ::testing::AssertionFailure() << "write_xlsb failed: " << saved.error().message;
+  }
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  if (!reloaded) {
+    return ::testing::AssertionFailure() << "read_xlsb failed: " << reloaded.error().message;
+  }
+  *out = std::move(reloaded.value().workbook);
+  return ::testing::AssertionSuccess();
+}
+
+constexpr const char* kSheetPart = "xl/worksheets/sheet1.xml";
+
+RowLayout MakeRow(std::uint32_t row, double height, bool custom) {
+  RowLayout r;
+  r.row = row;
+  r.height = height;
+  r.has_height = true;
+  r.custom_height = custom;
+  return r;
+}
+
+Workbook MakeWorkbook() {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  auto& rows = wb.sheet(0).mutable_layout().row_overrides;
+  rows.push_back(MakeRow(0, 30.0, true));
+  rows.push_back(MakeRow(1, 18.0, false));
+  return wb;
+}
+
+const RowLayout* FindRow(const Workbook& wb, std::uint32_t row) {
+  for (const RowLayout& r : wb.sheet(0).layout().row_overrides) {
+    if (r.row == row) {
+      return &r;
+    }
+  }
+  return nullptr;
+}
+
+void ExpectCustomAndAuto(const Workbook& wb) {
+  const RowLayout* custom = FindRow(wb, 0);
+  const RowLayout* autoh = FindRow(wb, 1);
+  ASSERT_NE(custom, nullptr);
+  ASSERT_NE(autoh, nullptr);
+  EXPECT_TRUE(custom->has_height);
+  EXPECT_TRUE(custom->custom_height);
+  EXPECT_DOUBLE_EQ(custom->height, 30.0);
+  EXPECT_TRUE(autoh->has_height);
+  EXPECT_FALSE(autoh->custom_height);
+  EXPECT_DOUBLE_EQ(autoh->height, 18.0);
+}
+
+TEST(RowCustomHeight, WriterEmitsCustomHeightOnlyForCustomRows) {
+  Workbook wb = MakeWorkbook();
+  auto saved = io::write_ooxml(wb);
+  ASSERT_TRUE(saved.has_value());
+  std::string xml;
+  ASSERT_TRUE(test::extract_part(test::span_of(saved.value()), kSheetPart, &xml));
+  EXPECT_NE(xml.find("ht=\"30\" customHeight=\"1\""), std::string::npos) << xml;
+  EXPECT_NE(xml.find("ht=\"18\""), std::string::npos) << xml;
+  EXPECT_EQ(xml.find("ht=\"18\" customHeight"), std::string::npos) << xml;
+}
+
+TEST(RowCustomHeight, OoxmlRoundTripKeepsCustomAndAuto) {
+  Workbook wb = MakeWorkbook();
+  Workbook once = Workbook::create_empty();
+  ASSERT_TRUE(ThroughXlsx(wb, &once));
+  ExpectCustomAndAuto(once);
+  Workbook twice = Workbook::create_empty();
+  ASSERT_TRUE(ThroughXlsx(once, &twice));
+  ExpectCustomAndAuto(twice);
+}
+
+TEST(RowCustomHeight, SaxPathReadsCustomHeight) {
+  Workbook wb = MakeWorkbook();
+  auto saved = io::write_ooxml(wb);
+  ASSERT_TRUE(saved.has_value());
+  auto read = io::internal::ReadOoxmlWithSaxThresholdForTesting(test::span_of(saved.value()), 0U);
+  ASSERT_TRUE(read.has_value());
+  ExpectCustomAndAuto(read.value().workbook);
+}
+
+TEST(RowCustomHeight, HtWithoutCustomHeightStaysAuto) {
+  Workbook wb = MakeWorkbook();
+  Workbook once = Workbook::create_empty();
+  ASSERT_TRUE(ThroughXlsx(wb, &once));
+  Workbook twice = Workbook::create_empty();
+  ASSERT_TRUE(ThroughXlsx(once, &twice));
+  const RowLayout* autoh = FindRow(twice, 1);
+  ASSERT_NE(autoh, nullptr);
+  EXPECT_TRUE(autoh->has_height);
+  EXPECT_FALSE(autoh->custom_height);
+}
+
+TEST(RowCustomHeight, XlsbUnsyncedRoundTrips) {
+  Workbook wb = MakeWorkbook();
+  Workbook back = Workbook::create_empty();
+  ASSERT_TRUE(ThroughXlsb(wb, &back));
+  const RowLayout* custom = FindRow(back, 0);
+  ASSERT_NE(custom, nullptr);
+  EXPECT_TRUE(custom->has_height);
+  EXPECT_TRUE(custom->custom_height);
+  EXPECT_DOUBLE_EQ(custom->height, 30.0);
+  // fUnsynced clear: the row reads back without a custom override.
+  const RowLayout* autoh = FindRow(back, 1);
+  EXPECT_TRUE(autoh == nullptr || !autoh->custom_height);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/io/sheet_reader_lexing_parity_test.cpp b/tests/unit/io/sheet_reader_lexing_parity_test.cpp
index 429d13c6c..0e2652754 100644
--- a/tests/unit/io/sheet_reader_lexing_parity_test.cpp
+++ b/tests/unit/io/sheet_reader_lexing_parity_test.cpp
@@ -27,6 +27,7 @@
 
 #include "cell.h"
 #include "gtest/gtest.h"
+#include "io/sheet_layout_reader.h"
 #include "io/sheet_reader.h"
 #include "io/xml_utils.h"
 #include "pugixml.hpp"
@@ -94,14 +95,15 @@ void SnapshotSheet(const Sheet& sheet, LoadResult* out) {
 /// Excel-canonical minimum style table, so the host has to be emptied the
 /// way the OOXML reader empties it; leaving the seed in place would clamp
 /// `s="5"` to 0 and pin the wrong disposition here.
-Workbook MakeStylelessHost() {
+Workbook MakeStylelessHost(bool date1904 = false) {
   Workbook wb = Workbook::create_empty();
   wb.set_styles(StylesTable{});
+  wb.set_date1904(date1904);
   wb.add_sheet("Sheet1");
   return wb;
 }
 
-LoadResult LoadDom(std::string_view sheet_xml) {
+LoadResult LoadDom(std::string_view sheet_xml, bool date1904 = false) {
   LoadResult result;
   pugi::xml_document doc;
   // `load_xml_buffer` is the loader every part reader goes through, and it
@@ -113,7 +115,7 @@ LoadResult LoadDom(std::string_view sheet_xml) {
     result.code = FormulonErrorCode::kIoXmlParse;
     return result;
   }
-  Workbook wb = MakeStylelessHost();
+  Workbook wb = MakeStylelessHost(date1904);
   SheetReadContext ctx;
   std::deque<std::string>& text_storage = wb.mutable_text_storage();
   auto rs = read_sheet_data(doc, 0U, wb, ctx, text_storage);
@@ -133,9 +135,9 @@ LoadResult LoadDom(std::string_view sheet_xml) {
 
 /// Reads `sheet_xml` through the streaming path, which reports cells and
 /// row overrides from the one scan.
-LoadResult LoadSax(std::string_view sheet_xml) {
+LoadResult LoadSax(std::string_view sheet_xml, bool date1904 = false) {
   LoadResult result;
-  Workbook wb = MakeStylelessHost();
+  Workbook wb = MakeStylelessHost(date1904);
   SheetReadContext ctx;
   std::deque<std::string>& text_storage = wb.mutable_text_storage();
   const ByteSpan span{reinterpret_cast<const std::uint8_t*>(sheet_xml.data()), sheet_xml.size()};
@@ -185,7 +187,7 @@ ::testing::AssertionResult SameOutcome(const LoadResult& dom, const LoadResult&
     const RowLayout& a = dom.rows[i];
     const RowLayout& b = sax.rows[i];
     if (a.row != b.row || a.height != b.height || a.hidden != b.hidden || a.outline_level != b.outline_level ||
-        a.has_height != b.has_height) {
+        a.has_height != b.has_height || a.custom_height != b.custom_height) {
       return ::testing::AssertionFailure() << "row override " << i << " differs (row " << a.row << " vs " << b.row
                                            << ", hidden " << a.hidden << " vs " << b.hidden << ")";
     }
@@ -212,6 +214,29 @@ TEST(SheetReaderLexingParity, WellFormedStyleAndRowOverrideAgree) {
   EXPECT_DOUBLE_EQ(dom.rows[0].height, 20.0);
 }
 
+TEST(SheetReaderDateSystem, IsoDatesMatchBetweenDomAndSaxAndRebase1904Values) {
+  const std::string xml = WrapSheet(
+      "<row r=\"1\">"
+      "<c r=\"A1\" t=\"d\"><v>1904-01-01</v></c>"
+      "<c r=\"B1\" t=\"d\"><f>A1+1</f><v>1904-01-02</v></c>"
+      "<c r=\"C1\"><v>1462</v></c>"
+      "</row>");
+  const LoadResult dom = LoadDom(xml, /*date1904=*/true);
+  const LoadResult sax = LoadSax(xml, /*date1904=*/true);
+  ASSERT_TRUE(dom.ok);
+  ASSERT_TRUE(sax.ok);
+  EXPECT_TRUE(SameOutcome(dom, sax));
+  ASSERT_EQ(dom.cells.size(), 3U);
+
+  EXPECT_EQ(dom.cells[0].kind, ValueKind::Number);
+  EXPECT_DOUBLE_EQ(dom.cells[0].number, 0.0);
+  EXPECT_EQ(dom.cells[1].formula, "=A1+1");
+  EXPECT_EQ(dom.cells[1].kind, ValueKind::Number);
+  EXPECT_DOUBLE_EQ(dom.cells[1].number, 1.0);
+  EXPECT_EQ(dom.cells[2].kind, ValueKind::Number);
+  EXPECT_DOUBLE_EQ(dom.cells[2].number, 1462.0);
+}
+
 TEST(SheetReaderLexingParity, EntityDecodedFormulaAndRowAttributesAgree) {
   const std::string xml = WrapSheet(
       "<row r=\"&#53;\" ht=\"&#50;&#48;\" hidden=\"&#116;&#114;&#117;&#101;\" "
diff --git a/tests/unit/io/sheet_reader_test.cpp b/tests/unit/io/sheet_reader_test.cpp
index c40244c94..84fd279a2 100644
--- a/tests/unit/io/sheet_reader_test.cpp
+++ b/tests/unit/io/sheet_reader_test.cpp
@@ -16,6 +16,7 @@
 #include "eval/function_registry.h"
 #include "eval/recalc_engine.h"
 #include "gtest/gtest.h"
+#include "io/sheet_layout_reader.h"
 #include "pugixml.hpp"
 #include "sheet.h"
 #include "styles.h"
diff --git a/tests/unit/io/sheet_roundtrip_symmetry_test.cpp b/tests/unit/io/sheet_roundtrip_symmetry_test.cpp
index 2075fb1bb..f848e24bc 100644
--- a/tests/unit/io/sheet_roundtrip_symmetry_test.cpp
+++ b/tests/unit/io/sheet_roundtrip_symmetry_test.cpp
@@ -15,6 +15,7 @@
 #include <vector>
 
 #include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
 #include "sheet.h"
 #include "support/roundtrip_symmetry.h"
 #include "workbook.h"
@@ -48,7 +49,7 @@ std::vector<std::uint8_t> BuildRichSheetXlsx() {
   ps.print_options_xml = "<printOptions horizontalCentered=\"1\" gridLines=\"1\" headings=\"1\"/>";
   ps.header_footer_xml = "<headerFooter><oddHeader>Report</oddHeader><oddFooter>Foot</oddFooter></headerFooter>";
   ps.manual_row_breaks.push_back(ManualBreak{4, 0, 9, true});
-  s.set_auto_filter_xml("<autoFilter ref=\"A1:J8\"/>");
+  s.set_auto_filter(io::auto_filter_from_xml("<autoFilter ref=\"A1:J8\"/>"));
 
   auto saved = wb.save();
   EXPECT_TRUE(static_cast<bool>(saved)) << "save failed: " << (saved ? "" : saved.error().message);
diff --git a/tests/unit/io/threaded_comments_test.cpp b/tests/unit/io/threaded_comments_test.cpp
new file mode 100644
index 000000000..59c60721a
--- /dev/null
+++ b/tests/unit/io/threaded_comments_test.cpp
@@ -0,0 +1,421 @@
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/threaded_comments_io.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "miniz.h"
+#include "sheet.h"
+#include "threaded_comment.h"
+#include "utils/error.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+constexpr std::string_view kThread = "{2BD0B1A4-7C3E-4F2A-9D11-6A5E8C0F1B23}";
+constexpr std::string_view kReply = "{8E1F3C55-0A9B-4D27-B6E4-31C7D2A9F0E8}";
+constexpr std::string_view kMention = "{5C6D7E8F-9A0B-4C1D-8E2F-3A4B5C6D7E8F}";
+constexpr std::string_view kAlice = "{11111111-AAAA-4BBB-8CCC-DDDDDDDDDDDD}";
+constexpr std::string_view kBob = "{22222222-AAAA-4BBB-8CCC-EEEEEEEEEEEE}";
+constexpr std::string_view kNoteUid = "{0F0E0D0C-0B0A-4908-8706-050403020100}";
+
+constexpr std::string_view kContentTypes =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Default Extension="vml" ContentType="application/vnd.openxmlformats-officedocument.vmlDrawing"/><Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/><Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/><Override PartName="/xl/comments1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.comments+xml"/><Override PartName="/xl/threadedComments/threadedComment1.xml" ContentType="application/vnd.ms-excel.threadedcomments+xml"/><Override PartName="/xl/persons/person.xml" ContentType="application/vnd.ms-excel.person+xml"/></Types>)";
+
+constexpr std::string_view kPackageRels =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/></Relationships>)";
+
+constexpr std::string_view kWorkbookXml =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"><sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets></workbook>)";
+
+constexpr std::string_view kWorkbookRels =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/><Relationship Id="rId5" Type="http://schemas.microsoft.com/office/2017/10/relationships/person" Target="persons/person.xml"/></Relationships>)";
+
+constexpr std::string_view kSheetXml =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"><sheetData/><legacyDrawing r:id="rId1"/></worksheet>)";
+
+constexpr std::string_view kSheetRels =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.microsoft.com/office/2017/10/relationships/threadedComment" Target="../threadedComments/threadedComment1.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/comments" Target="../comments1.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing" Target="../drawings/vmlDrawing1.vml"/></Relationships>)";
+
+// A1 carries a plain note; B2 carries a resolved thread with one reply that
+// mentions Alice. The thread's legacy stub sits beside the note.
+constexpr std::string_view kCommentsXml =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<comments xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="xr" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision"><authors><author>Carol</author><author>tc={2BD0B1A4-7C3E-4F2A-9D11-6A5E8C0F1B23}</author></authors><commentList><comment ref="A1" authorId="0" shapeId="0" xr:uid="{0F0E0D0C-0B0A-4908-8706-050403020100}"><text><r><t>Plain note</t></r></text></comment><comment ref="B2" authorId="1" shapeId="0" xr:uid="{2BD0B1A4-7C3E-4F2A-9D11-6A5E8C0F1B23}"><text><t>[Threaded comment]
+
+Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924
+
+Comment:
+    Check this total
+Reply:
+    @Alice Smith fixed</t></text></comment></commentList></comments>)";
+
+constexpr std::string_view kThreadedXml =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<ThreadedComments xmlns="http://schemas.microsoft.com/office/spreadsheetml/2018/threadedcomments" xmlns:x="http://schemas.openxmlformats.org/spreadsheetml/2006/main"><threadedComment ref="B2" dT="2026-09-30T08:15:42.17" personId="{11111111-AAAA-4BBB-8CCC-DDDDDDDDDDDD}" id="{2BD0B1A4-7C3E-4F2A-9D11-6A5E8C0F1B23}" done="1"><text>Check this total</text></threadedComment><threadedComment ref="B2" dT="2026-09-30T09:02:05.80" personId="{22222222-AAAA-4BBB-8CCC-EEEEEEEEEEEE}" id="{8E1F3C55-0A9B-4D27-B6E4-31C7D2A9F0E8}" parentId="{2BD0B1A4-7C3E-4F2A-9D11-6A5E8C0F1B23}"><text>@Alice Smith fixed</text><mentions><mention mentionpersonId="{11111111-AAAA-4BBB-8CCC-DDDDDDDDDDDD}" mentionId="{5C6D7E8F-9A0B-4C1D-8E2F-3A4B5C6D7E8F}" startIndex="0" length="12"/></mentions></threadedComment></ThreadedComments>)";
+
+constexpr std::string_view kPersonsXml =
+    R"(<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<personList xmlns="http://schemas.microsoft.com/office/spreadsheetml/2018/threadedcomments" xmlns:x="http://schemas.openxmlformats.org/spreadsheetml/2006/main"><person displayName="Alice Smith" id="{11111111-AAAA-4BBB-8CCC-DDDDDDDDDDDD}" userId="alice@example.com" providerId="AD"/><person displayName="Bob Jones" id="{22222222-AAAA-4BBB-8CCC-EEEEEEEEEEEE}" userId="Bob Jones" providerId="None"/></personList>)";
+
+// Source VML with one shape per commented cell; `alt="source-vml"` marks the
+// bytes so a test can tell verbatim re-emission from regeneration.
+constexpr std::string_view kVml = R"(<xml xmlns:v="urn:schemas-microsoft-com:vml"
+ xmlns:o="urn:schemas-microsoft-com:office:office"
+ xmlns:x="urn:schemas-microsoft-com:office:excel">
+ <o:shapelayout v:ext="edit"><o:idmap v:ext="edit" data="1"/></o:shapelayout>
+ <v:shapetype id="_x0000_t202" coordsize="21600,21600" o:spt="202" path="m,l,21600r21600,l21600,xe"><v:stroke joinstyle="miter"/><v:path gradientshapeok="t" o:connecttype="rect"/></v:shapetype>
+ <v:shape id="_x0000_s1025" type="#_x0000_t202" alt="source-vml" style="position:absolute;visibility:hidden" fillcolor="#ffffe1"><x:ClientData ObjectType="Note"><x:MoveWithCells/><x:SizeWithCells/><x:Anchor>1, 15, 0, 2, 3, 15, 4, 4</x:Anchor><x:AutoFill>False</x:AutoFill><x:Row>0</x:Row><x:Column>0</x:Column></x:ClientData></v:shape>
+ <v:shape id="_x0000_s1026" type="#_x0000_t202" alt="source-vml" style="position:absolute;visibility:hidden" fillcolor="#ffffe1"><x:ClientData ObjectType="Note"><x:MoveWithCells/><x:SizeWithCells/><x:Anchor>2, 15, 0, 10, 4, 15, 4, 4</x:Anchor><x:AutoFill>False</x:AutoFill><x:Row>1</x:Row><x:Column>1</x:Column></x:ClientData></v:shape>
+</xml>)";
+
+std::vector<std::uint8_t> BuildZip(const std::vector<std::pair<const char*, std::string_view>>& parts) {
+  mz_zip_archive writer{};
+  EXPECT_NE(mz_zip_writer_init_heap(&writer, 0, 4096), MZ_FALSE);
+  for (const auto& p : parts) {
+    EXPECT_NE(mz_zip_writer_add_mem(&writer, p.first, p.second.data(), p.second.size(),
+                                    static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)),
+              MZ_FALSE);
+  }
+  void* archive_ptr = nullptr;
+  std::size_t archive_size = 0;
+  EXPECT_NE(mz_zip_writer_finalize_heap_archive(&writer, &archive_ptr, &archive_size), MZ_FALSE);
+  EXPECT_NE(mz_zip_writer_end(&writer), MZ_FALSE);
+  std::vector<std::uint8_t> out(static_cast<const std::uint8_t*>(archive_ptr),
+                                static_cast<const std::uint8_t*>(archive_ptr) + archive_size);
+  mz_free(archive_ptr);
+  return out;
+}
+
+std::vector<std::uint8_t> ExcelFixture() {
+  return BuildZip({{"[Content_Types].xml", kContentTypes},
+                   {"_rels/.rels", kPackageRels},
+                   {"xl/workbook.xml", kWorkbookXml},
+                   {"xl/_rels/workbook.xml.rels", kWorkbookRels},
+                   {"xl/worksheets/sheet1.xml", kSheetXml},
+                   {"xl/worksheets/_rels/sheet1.xml.rels", kSheetRels},
+                   {"xl/comments1.xml", kCommentsXml},
+                   {"xl/threadedComments/threadedComment1.xml", kThreadedXml},
+                   {"xl/persons/person.xml", kPersonsXml},
+                   {"xl/drawings/vmlDrawing1.vml", kVml}});
+}
+
+Workbook Load(const std::vector<std::uint8_t>& bytes) {
+  auto read = io::read_ooxml(io::ByteSpan{bytes.data(), bytes.size()});
+  EXPECT_TRUE(static_cast<bool>(read)) << read.error().message;
+  return std::move(read.value().workbook);
+}
+
+std::vector<std::uint8_t> Save(const Workbook& wb) {
+  auto saved = wb.save();
+  EXPECT_TRUE(static_cast<bool>(saved)) << saved.error().message;
+  return std::move(saved.value());
+}
+
+/// Text of the package part at `path`, or "" when absent.
+std::string Part(const std::vector<std::uint8_t>& package, const std::string& path) {
+  io::ZipReader zip;
+  EXPECT_TRUE(static_cast<bool>(zip.open(io::ByteSpan{package.data(), package.size()})));
+  if (!zip.has_entry(path)) {
+    return {};
+  }
+  auto bytes = zip.read_entry(path);
+  EXPECT_TRUE(static_cast<bool>(bytes));
+  return std::string(bytes.value().begin(), bytes.value().end());
+}
+
+std::size_t Count(std::string_view haystack, std::string_view needle) {
+  std::size_t n = 0;
+  for (std::size_t at = haystack.find(needle); at != std::string_view::npos; at = haystack.find(needle, at + 1)) {
+    ++n;
+  }
+  return n;
+}
+
+ThreadedComment Comment(std::string_view id, std::uint32_t row, std::uint32_t col, std::string_view person,
+                        std::string text, std::string_view parent = {}) {
+  ThreadedComment c;
+  c.id = std::string(id);
+  c.row = row;
+  c.col = col;
+  c.person_id = std::string(person);
+  c.created = "2026-10-05T10:00:00.00";
+  c.text = std::move(text);
+  c.parent_id = std::string(parent);
+  return c;
+}
+
+Workbook WorkbookWithPersons() {
+  Workbook wb = Workbook::create();
+  EXPECT_TRUE(static_cast<bool>(wb.add_person(Person{std::string(kAlice), "Alice Smith", "alice@example.com", "AD"})));
+  EXPECT_TRUE(static_cast<bool>(wb.add_person(Person{std::string(kBob), "Bob Jones", "Bob Jones", "None"})));
+  return wb;
+}
+
+void ExpectFixtureModel(const Workbook& wb) {
+  ASSERT_EQ(wb.persons().size(), 2U);
+  EXPECT_EQ(wb.persons()[0].id, kAlice);
+  EXPECT_EQ(wb.persons()[0].display_name, "Alice Smith");
+  EXPECT_EQ(wb.persons()[0].user_id, "alice@example.com");
+  EXPECT_EQ(wb.persons()[0].provider_id, "AD");
+  EXPECT_EQ(wb.persons()[1].provider_id, "None");
+
+  const std::vector<ThreadedComment>& threads = wb.sheet(0).threaded_comments();
+  ASSERT_EQ(threads.size(), 2U);
+  EXPECT_EQ(threads[0].id, kThread);
+  EXPECT_EQ(threads[0].row, 1U);
+  EXPECT_EQ(threads[0].col, 1U);
+  EXPECT_EQ(threads[0].person_id, kAlice);
+  EXPECT_EQ(threads[0].created, "2026-09-30T08:15:42.17");
+  EXPECT_EQ(threads[0].text, "Check this total");
+  EXPECT_TRUE(threads[0].parent_id.empty());
+  EXPECT_TRUE(threads[0].done);
+  EXPECT_TRUE(threads[0].mentions.empty());
+
+  EXPECT_EQ(threads[1].id, kReply);
+  EXPECT_EQ(threads[1].parent_id, kThread);
+  EXPECT_EQ(threads[1].person_id, kBob);
+  EXPECT_EQ(threads[1].row, 1U);
+  EXPECT_EQ(threads[1].col, 1U);
+  EXPECT_EQ(threads[1].text, "@Alice Smith fixed");
+  ASSERT_EQ(threads[1].mentions.size(), 1U);
+  EXPECT_EQ(threads[1].mentions[0].person_id, kAlice);
+  EXPECT_EQ(threads[1].mentions[0].mention_id, kMention);
+  EXPECT_EQ(threads[1].mentions[0].start, 0U);
+  EXPECT_EQ(threads[1].mentions[0].length, 12U);
+}
+
+TEST(ThreadedComments, RoundTripRepliesMentions) {
+  Workbook wb = Load(ExcelFixture());
+  ExpectFixtureModel(wb);
+
+  const std::vector<std::uint8_t> saved = Save(wb);
+  const std::string content_types = Part(saved, "[Content_Types].xml");
+  EXPECT_NE(content_types.find("application/vnd.ms-excel.threadedcomments+xml"), std::string::npos);
+  EXPECT_NE(content_types.find("application/vnd.ms-excel.person+xml"), std::string::npos);
+  EXPECT_NE(Part(saved, "xl/_rels/workbook.xml.rels").find("/relationships/person"), std::string::npos);
+  EXPECT_NE(Part(saved, "xl/worksheets/_rels/sheet1.xml.rels").find("/relationships/threadedComment"),
+            std::string::npos);
+  // The persons and threaded parts are model-owned, so they are not listed
+  // as passthrough after a load.
+  for (const PassthroughPart& part : wb.passthrough_parts()) {
+    EXPECT_EQ(part.path.find("threadedComments"), std::string::npos) << part.path;
+    EXPECT_EQ(part.path.find("persons"), std::string::npos) << part.path;
+  }
+
+  Workbook reloaded = Load(saved);
+  ExpectFixtureModel(reloaded);
+  ASSERT_EQ(reloaded.sheet(0).comments().size(), 1U);
+  EXPECT_EQ(reloaded.sheet(0).comments()[0].text, "Plain note");
+}
+
+TEST(ThreadedComments, StubNotListedAsNote) {
+  Workbook wb = Load(ExcelFixture());
+  ASSERT_EQ(wb.sheet(0).comments().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).comments()[0].row, 0U);
+  EXPECT_EQ(wb.sheet(0).comments()[0].author, "Carol");
+
+  // The saved comments part still carries Excel's stub for older readers,
+  // keyed to the thread by author and `xr:uid`.
+  const std::string comments = Part(Save(wb), "xl/comments1.xml");
+  EXPECT_NE(comments.find("<author>tc={2BD0B1A4-7C3E-4F2A-9D11-6A5E8C0F1B23}</author>"), std::string::npos);
+  EXPECT_NE(comments.find("ref=\"B2\""), std::string::npos);
+  EXPECT_NE(comments.find("xr:uid=\"{2BD0B1A4-7C3E-4F2A-9D11-6A5E8C0F1B23}\""), std::string::npos);
+  EXPECT_NE(comments.find("[Threaded comment]"), std::string::npos);
+  EXPECT_NE(comments.find("Check this total"), std::string::npos);
+  EXPECT_NE(comments.find("Reply:\n    @Alice Smith fixed"), std::string::npos);
+}
+
+TEST(ThreadedComments, TcAuthorWithoutThreadStaysNote) {
+  std::vector<CellComment> notes = {CellComment(1, 1, "tc=" + std::string(kThread), "orphan stub")};
+  io::drop_thread_stubs(notes, {});
+  EXPECT_EQ(notes.size(), 1U);
+  std::vector<ThreadedComment> elsewhere = {Comment(kThread, 5, 5, kAlice, "x")};
+  io::drop_thread_stubs(notes, elsewhere);
+  EXPECT_EQ(notes.size(), 1U);
+}
+
+TEST(ThreadedComments, LegacyNoteUidPreserved) {
+  Workbook wb = Load(ExcelFixture());
+  ASSERT_EQ(wb.sheet(0).comments().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).comments()[0].uid, kNoteUid);
+
+  const std::vector<std::uint8_t> saved = Save(wb);
+  const std::string comments = Part(saved, "xl/comments1.xml");
+  EXPECT_NE(comments.find("xr:uid=\"{0F0E0D0C-0B0A-4908-8706-050403020100}\""), std::string::npos);
+  EXPECT_NE(comments.find("xmlns:xr=\"http://schemas.microsoft.com/office/spreadsheetml/2014/revision\""),
+            std::string::npos);
+  Workbook reloaded = Load(saved);
+  ASSERT_EQ(reloaded.sheet(0).comments().size(), 1U);
+  EXPECT_EQ(reloaded.sheet(0).comments()[0].uid, kNoteUid);
+}
+
+TEST(ThreadedComments, VmlRegeneratedWithPassthroughNotes) {
+  {
+    // Nothing changed: the source VML goes out byte for byte.
+    Workbook wb = Load(ExcelFixture());
+    EXPECT_EQ(Part(Save(wb), "xl/drawings/vmlDrawing1.vml"), kVml);
+  }
+  Workbook wb = Load(ExcelFixture());
+  ASSERT_TRUE(static_cast<bool>(
+      wb.add_threaded_comment(0, Comment("{33333333-1111-4222-8333-444444444444}", 2, 2, kBob, "New thread"))));
+  const std::vector<std::uint8_t> saved = Save(wb);
+  const std::string vml = Part(saved, "xl/drawings/vmlDrawing1.vml");
+  EXPECT_EQ(vml.find("source-vml"), std::string::npos);
+  EXPECT_EQ(Count(vml, "ObjectType=\"Note\""), 3U);
+  EXPECT_NE(vml.find("<x:Row>0</x:Row>\n   <x:Column>0</x:Column>"), std::string::npos);
+  EXPECT_NE(vml.find("<x:Row>1</x:Row>\n   <x:Column>1</x:Column>"), std::string::npos);
+  EXPECT_NE(vml.find("<x:Row>2</x:Row>\n   <x:Column>2</x:Column>"), std::string::npos);
+
+  // The passthrough note, the source thread and the new thread all survive.
+  Workbook reloaded = Load(saved);
+  ASSERT_EQ(reloaded.sheet(0).comments().size(), 1U);
+  EXPECT_EQ(reloaded.sheet(0).comments()[0].text, "Plain note");
+  EXPECT_EQ(reloaded.sheet(0).threaded_comments().size(), 3U);
+  EXPECT_EQ(Count(Part(saved, "xl/comments1.xml"), "<comment "), 3U);
+}
+
+TEST(ThreadedComments, CreateWithoutPersonsPartGeneratesParts) {
+  Workbook wb = WorkbookWithPersons();
+  ASSERT_TRUE(static_cast<bool>(wb.add_threaded_comment(0, Comment(kThread, 0, 3, kAlice, "Hello"))));
+  const std::vector<std::uint8_t> saved = Save(wb);
+
+  EXPECT_NE(Part(saved, "xl/persons/person.xml").find("displayName=\"Alice Smith\""), std::string::npos);
+  EXPECT_NE(Part(saved, "xl/threadedComments/threadedComment1.xml").find("ref=\"D1\""), std::string::npos);
+  const std::string content_types = Part(saved, "[Content_Types].xml");
+  EXPECT_NE(content_types.find("PartName=\"/xl/persons/person.xml\" "
+                               "ContentType=\"application/vnd.ms-excel.person+xml\""),
+            std::string::npos);
+  EXPECT_NE(content_types.find("PartName=\"/xl/threadedComments/threadedComment1.xml\" "
+                               "ContentType=\"application/vnd.ms-excel.threadedcomments+xml\""),
+            std::string::npos);
+  EXPECT_NE(Part(saved, "xl/_rels/workbook.xml.rels").find("Target=\"persons/person.xml\""), std::string::npos);
+  EXPECT_NE(
+      Part(saved, "xl/worksheets/_rels/sheet1.xml.rels").find("Target=\"../threadedComments/threadedComment1.xml\""),
+      std::string::npos);
+  EXPECT_NE(Part(saved, "xl/drawings/vmlDrawing1.vml").find("<x:Row>0</x:Row>\n   <x:Column>3</x:Column>"),
+            std::string::npos);
+
+  Workbook reloaded = Load(saved);
+  EXPECT_EQ(reloaded.persons().size(), 2U);
+  ASSERT_EQ(reloaded.sheet(0).threaded_comments().size(), 1U);
+  EXPECT_EQ(reloaded.sheet(0).threaded_comments()[0].text, "Hello");
+  EXPECT_TRUE(reloaded.sheet(0).comments().empty());
+}
+
+TEST(ThreadedComments, ResolveAndUnresolve) {
+  Workbook wb = WorkbookWithPersons();
+  ASSERT_TRUE(static_cast<bool>(wb.add_threaded_comment(0, Comment(kThread, 0, 0, kAlice, "Q"))));
+  ASSERT_TRUE(static_cast<bool>(wb.add_threaded_comment(0, Comment(kReply, 9, 9, kBob, "A", kThread))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_thread_resolved(0, kThread, true)));
+  EXPECT_TRUE(Load(Save(wb)).sheet(0).threaded_comments()[0].done);
+  ASSERT_TRUE(static_cast<bool>(wb.set_thread_resolved(0, kThread, false)));
+  EXPECT_FALSE(Load(Save(wb)).sheet(0).threaded_comments()[0].done);
+
+  auto on_reply = wb.set_thread_resolved(0, kReply, true);
+  ASSERT_FALSE(static_cast<bool>(on_reply));
+  EXPECT_EQ(on_reply.error().code, FormulonErrorCode::kThreadedCommentInvalid);
+  // The reply took its thread's anchor rather than the one it was given.
+  EXPECT_EQ(wb.sheet(0).threaded_comments()[1].row, 0U);
+  EXPECT_EQ(wb.sheet(0).threaded_comments()[1].col, 0U);
+}
+
+TEST(ThreadedComments, DeleteThreadKeepsOtherNotes) {
+  Workbook wb = Load(ExcelFixture());
+  ASSERT_TRUE(static_cast<bool>(wb.remove_threaded_comment(0, kReply)));
+  ASSERT_EQ(wb.sheet(0).threaded_comments().size(), 1U);
+  ASSERT_TRUE(static_cast<bool>(wb.remove_threaded_comment(0, kThread)));
+  EXPECT_TRUE(wb.sheet(0).threaded_comments().empty());
+
+  const std::vector<std::uint8_t> saved = Save(wb);
+  EXPECT_TRUE(Part(saved, "xl/threadedComments/threadedComment1.xml").empty());
+  EXPECT_EQ(Part(saved, "xl/comments1.xml").find("tc="), std::string::npos);
+  Workbook reloaded = Load(saved);
+  ASSERT_EQ(reloaded.sheet(0).comments().size(), 1U);
+  EXPECT_EQ(reloaded.sheet(0).comments()[0].text, "Plain note");
+  EXPECT_EQ(reloaded.sheet(0).comments()[0].uid, kNoteUid);
+  // Persons outlive the threads that named them.
+  EXPECT_EQ(reloaded.persons().size(), 2U);
+}
+
+TEST(ThreadedComments, AnchorMovesOnRowInsert) {
+  Workbook wb = Load(ExcelFixture());
+  ASSERT_TRUE(static_cast<bool>(wb.insert_rows(0, 1, 2)));
+  for (const ThreadedComment& c : wb.sheet(0).threaded_comments()) {
+    EXPECT_EQ(c.row, 3U);
+    EXPECT_EQ(c.col, 1U);
+  }
+  EXPECT_EQ(wb.sheet(0).comments()[0].row, 0U);
+  const std::vector<std::uint8_t> saved = Save(wb);
+  EXPECT_NE(Part(saved, "xl/threadedComments/threadedComment1.xml").find("ref=\"B4\""), std::string::npos);
+  EXPECT_NE(Part(saved, "xl/drawings/vmlDrawing1.vml").find("<x:Row>3</x:Row>"), std::string::npos);
+}
+
+TEST(ThreadedComments, ThreadDeletedWithItsRow) {
+  Workbook wb = Load(ExcelFixture());
+  ASSERT_TRUE(static_cast<bool>(wb.delete_rows(0, 1, 1)));
+  EXPECT_TRUE(wb.sheet(0).threaded_comments().empty());
+  ASSERT_EQ(wb.sheet(0).comments().size(), 1U);
+  ASSERT_TRUE(static_cast<bool>(wb.delete_cols(0, 0, 1)));
+  EXPECT_TRUE(wb.sheet(0).comments().empty());
+}
+
+TEST(ThreadedComments, XlsbSaveReportsDeferral) {
+  Workbook wb = WorkbookWithPersons();
+  ASSERT_TRUE(static_cast<bool>(wb.add_threaded_comment(0, Comment(kThread, 0, 0, kAlice, "Q"))));
+  ASSERT_TRUE(static_cast<bool>(wb.add_threaded_comment(0, Comment(kReply, 0, 0, kBob, "A", kThread))));
+  auto result = io::xlsb::write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  EXPECT_EQ(result.value().diagnostics.deferred_feature_count, 2U);
+}
+
+TEST(ThreadedComments, RejectsMalformedInput) {
+  Workbook wb = WorkbookWithPersons();
+  wb.sheet(0).mutable_comments().push_back(CellComment(4, 4, "Carol", "note"));
+  const auto invalid = [](const Expected<void, Error>& r) {
+    return !r && r.error().code == FormulonErrorCode::kThreadedCommentInvalid;
+  };
+  EXPECT_TRUE(
+      invalid(wb.add_threaded_comment(0, Comment("{2bd0b1a4-7c3e-4f2a-9d11-6a5e8c0f1b23}", 0, 0, kAlice, "x"))));
+  EXPECT_TRUE(invalid(wb.add_threaded_comment(0, Comment("2BD0B1A4-7C3E-4F2A-9D11-6A5E8C0F1B23", 0, 0, kAlice, "x"))));
+  ThreadedComment bad_time = Comment(kThread, 0, 0, kAlice, "x");
+  bad_time.created = "2026-10-05T10:00:00.000";
+  EXPECT_TRUE(invalid(wb.add_threaded_comment(0, bad_time)));
+  EXPECT_TRUE(
+      invalid(wb.add_threaded_comment(0, Comment(kThread, 0, 0, "{99999999-9999-4999-8999-999999999999}", "x"))));
+  EXPECT_TRUE(invalid(wb.add_threaded_comment(0, Comment(kThread, 4, 4, kAlice, "x"))));
+  EXPECT_TRUE(invalid(wb.add_threaded_comment(0, Comment(kReply, 0, 0, kAlice, "x", kThread))));
+
+  // "日本🙂!" is five UTF-16 units: the emoji is a surrogate pair.
+  ThreadedComment mentioned = Comment(kThread, 0, 0, kAlice, "日本🙂!");
+  mentioned.mentions.push_back(Mention{std::string(kBob), std::string(kMention), 2, 4});
+  EXPECT_TRUE(invalid(wb.add_threaded_comment(0, mentioned)));
+  mentioned.mentions[0].length = 3;
+  ASSERT_TRUE(static_cast<bool>(wb.add_threaded_comment(0, mentioned)));
+  EXPECT_TRUE(invalid(wb.add_threaded_comment(0, Comment(kReply, 0, 0, kAlice, "x"))));
+
+  EXPECT_TRUE(invalid(wb.remove_person(kBob)));
+  EXPECT_TRUE(invalid(wb.edit_threaded_comment(0, kThread, "", mentioned.mentions)));
+  ASSERT_TRUE(static_cast<bool>(wb.edit_threaded_comment(0, kThread, "plain", {})));
+  ASSERT_TRUE(static_cast<bool>(wb.remove_person(kBob)));
+  EXPECT_TRUE(invalid(wb.add_person(Person{std::string(kAlice), "Again", "", ""})));
+  EXPECT_TRUE(invalid(wb.remove_threaded_comment(0, kReply)));
+  ASSERT_EQ(wb.sheet(0).threaded_comments().size(), 1U);
+  EXPECT_EQ(wb.sheet(0).threaded_comments()[0].text, "plain");
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/ptg_codec_decoder_validation_test.cpp b/tests/unit/io/xlsb/ptg_codec_decoder_validation_test.cpp
new file mode 100644
index 000000000..521d92c4c
--- /dev/null
+++ b/tests/unit/io/xlsb/ptg_codec_decoder_validation_test.cpp
@@ -0,0 +1,259 @@
+// XLSB Ptg codec tests grouped by reference, function, scalar, and validation behavior.
+
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <string_view>
+#include <unordered_set>
+#include <vector>
+
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "io/future_functions.h"
+#include "io/xlsb/func_id_table.h"
+#include "io/xlsb/ptg_reader.h"
+#include "io/xlsb/ptg_writer.h"
+#include "io/xlsb/record_writer.h"
+#include "parser/ast.h"
+#include "parser/ast_format.h"
+#include "parser/parser.h"
+#include "ptg_codec_test_helpers.h"
+#include "utils/arena.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+using namespace ptg_codec_test_support;
+TEST(XlsbPtgCodec, DecoderRejectsTruncatedStream) {
+  // PtgInt (0x1E) needs a 2-byte operand; supply only the tag.
+  Arena arena;
+  const std::vector<std::uint8_t> bytes = {0x1E};
+  ByteSpan span{bytes.data(), bytes.size()};
+  auto decoded = decode_ptgs(span, ByteSpan{}, arena, {}, {}, {}, {});
+  ASSERT_FALSE(static_cast<bool>(decoded));
+  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbRecordTruncated);
+}
+TEST(XlsbPtgCodec, DecoderRejectsUnknownPtg) {
+  // 0x18 (PtgElfLel) is marked Unsupported in the dispatch table.
+  Arena arena;
+  const std::vector<std::uint8_t> bytes = {0x18, 0x00};
+  ByteSpan span{bytes.data(), bytes.size()};
+  auto decoded = decode_ptgs(span, ByteSpan{}, arena, {}, {}, {}, {});
+  ASSERT_FALSE(static_cast<bool>(decoded));
+  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbUnsupportedPtg);
+}
+TEST(XlsbPtgCodec, PtgArrayDecodesRowsBeforeColsFromRawWireBytes) {
+  // Raw-byte decode of a genuinely non-square (1 row x 3 cols) array
+  // constant, independent of the encoder. `PtgExtraArray`
+  // ([MS-XLSB] 2.5.97.41) is documented as `DRw` (row count) followed
+  // by `DCol` (col count), each a plain u32 -- not a class-marked or
+  // otherwise reordered pair, and the elements follow row-outer /
+  // col-inner. A square real-Excel fixture cannot settle either point on
+  // its own, so this test pins them from the wire bytes. If the reader
+  // swapped the two u32 fields, this byte layout (rows=1, cols=3) would
+  // either be rejected (3 rows needs 3x as many trailing elements) or,
+  // for a same-total-count swap, transpose to `{1;2;3}`.
+  const std::vector<std::uint8_t> rgce = {
+      0x60,                                                  // PtgArray (array-class)
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // 14-byte placeholder
+      0x00, 0x00, 0x00, 0x00, 0x00,
+  };
+  std::vector<std::uint8_t> rgcb;
+  emit_u32(rgcb, 1U);  // DRw: rows = 1
+  emit_u32(rgcb, 3U);  // DCol: cols = 3
+  for (const double v : {1.0, 2.0, 3.0}) {
+    rgcb.push_back(0x00);  // SerAr numeric tag
+    std::uint8_t bytes[8];
+    std::memcpy(bytes, &v, sizeof(v));
+    rgcb.insert(rgcb.end(), bytes, bytes + 8);
+  }
+  Arena arena;
+  auto decoded =
+      decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, ByteSpan{rgcb.data(), rgcb.size()}, arena, {}, {}, {}, {});
+  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
+  EXPECT_EQ(parser::format_formula(*decoded.value()), "{1,2,3}");
+}
+TEST(XlsbPtgCodec, PtgArrayElementsMatchExcelBytes) {
+  struct Case {
+    const char* formula;
+    std::vector<std::uint8_t> rgce_head;  // opcode + the 10 bytes Excel sets
+    std::vector<std::uint8_t> rgcb;
+  };
+  const Case cases[] = {
+      {"{\"a\",\"b\";\"c\",\"d\"}",
+       {0x40, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+       {0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x61, 0x00, 0x01,
+        0x01, 0x00, 0x62, 0x00, 0x01, 0x01, 0x00, 0x63, 0x00, 0x01, 0x01, 0x00, 0x64, 0x00}},
+      {"{TRUE;FALSE}",
+       {0x40, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+       {0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0x01, 0x02, 0x00}},
+      {"{1;#N/A;\"z\"}",
+       {0x40, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+       {0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0xF0, 0x3F, 0x04, 0x2A, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x7A, 0x00}},
+  };
+  for (const Case& c : cases) {
+    const EncodedFormula encoded = EncodeOnSheet1(c.formula, PtgRootClass::kValue);
+    ASSERT_EQ(encoded.rgce.size(), 15U) << c.formula;
+    EXPECT_EQ(std::vector<std::uint8_t>(encoded.rgce.begin(), encoded.rgce.begin() + 11), c.rgce_head) << c.formula;
+    EXPECT_EQ(encoded.rgcb, c.rgcb) << c.formula;
+    EXPECT_EQ(RoundTrip(c.formula), c.formula);
+  }
+}
+TEST(XlsbPtgCodec, PtgRefRowAtGridBoundIsRecordCorrupt) {
+  // PtgRef (0x24) with row == Sheet::kMaxRows, one past the last valid
+  // row (1048575). A crafted/corrupt row must be rejected at the Ref
+  // node construction site rather than silently wrapping in a later
+  // A1-text re-parse (`format_a1` would otherwise print `A1048577`).
+  const std::vector<std::uint8_t> rgce = {
+      0x24,                    // PtgRef
+      0x00, 0x00, 0x10, 0x00,  // row = 1048576 (u32 LE) == Sheet::kMaxRows
+      0x00, 0x00,              // col = 0, absolute
+  };
+  Arena arena;
+  auto decoded = decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, {}, arena, {}, {}, {}, {});
+  ASSERT_FALSE(static_cast<bool>(decoded));
+  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
+}
+TEST(XlsbPtgCodec, PtgAreaReversedCornersIsRecordCorrupt) {
+  // PtgArea (0x25) with row1 > row2: both corners are individually
+  // in-domain, but the range is not normalized.
+  const std::vector<std::uint8_t> rgce = {
+      0x25,                    // PtgArea
+      0x05, 0x00, 0x00, 0x00,  // row1 = 5
+      0x01, 0x00, 0x00, 0x00,  // row2 = 1 (< row1)
+      0x00, 0x00,              // col1 = 0, absolute
+      0x00, 0x00,              // col2 = 0, absolute
+  };
+  Arena arena;
+  auto decoded = decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, {}, arena, {}, {}, {}, {});
+  ASSERT_FALSE(static_cast<bool>(decoded));
+  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
+}
+TEST(XlsbPtgCodec, PtgRefErrWithSentinelCoordinatesStillDecodesAsRef) {
+  // PtgRefErr (0x2A) carries a `#REF!`-form single-cell reference; real
+  // Excel files encode the dead payload with the maximum sentinel
+  // row/col. Because this Ptg kind never materializes a `Reference`
+  // (only `ErrorCode::Ref`), the domain check at Ref/Area construction
+  // sites must not reject it.
+  const std::vector<std::uint8_t> rgce = {
+      0x2A,                    // PtgRefErr
+      0xFF, 0xFF, 0xFF, 0xFF,  // sentinel row payload (discarded)
+      0xFF, 0xFF,              // sentinel col payload (discarded)
+  };
+  Arena arena;
+  auto decoded = decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, {}, arena, {}, {}, {}, {});
+  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
+  EXPECT_EQ(parser::format_formula(*decoded.value()), "#REF!");
+}
+TEST(XlsbPtgCodec, DecoderKeepsParenTokenInTheText) {
+  // PtgInt(1), PtgInt(2), PtgAdd, PtgParen: the written parentheses Excel
+  // shows, which leave the value stack unchanged.
+  const std::vector<std::uint8_t> rgce = {0x1E, 0x01, 0x00, 0x1E, 0x02, 0x00, 0x03, 0x15};
+  Arena arena;
+  ByteSpan main{rgce.data(), rgce.size()};
+  ByteSpan extra{nullptr, 0};
+  auto decoded = decode_ptgs(main, extra, arena, {}, {}, {}, {});
+  ASSERT_TRUE(static_cast<bool>(decoded));
+  EXPECT_EQ(parser::format_formula(*decoded.value()), "(1+2)");
+}
+TEST(XlsbPtgCodec, DecoderConsumesMemoryCachePtgsWithoutChangingExpression) {
+  // Each memory marker precedes an ordinary PtgInt(1) expression. PtgMemArea
+  // additionally has a zero-range PtgExtraMem cache in RgbExtra.
+  const std::vector<std::uint8_t> mem_area = {0x26, 0, 0, 0, 0, 3, 0, 0x1E, 1, 0};
+  const std::vector<std::uint8_t> mem_err = {0x27, 0x17, 0, 0, 0, 3, 0, 0x1E, 1, 0};
+  const std::vector<std::uint8_t> mem_no_mem = {0x28, 0, 0, 0, 0, 3, 0, 0x1E, 1, 0};
+  const std::vector<std::uint8_t> mem_func = {0x29, 3, 0, 0x1E, 1, 0};
+  const std::vector<std::uint8_t> extra_mem = {0, 0, 0, 0};
+
+  const auto expect_expression = [&extra_mem](const std::vector<std::uint8_t>& rgce, bool has_extra_mem) {
+    Arena arena;
+    ByteSpan main{rgce.data(), rgce.size()};
+    ByteSpan extra = has_extra_mem ? ByteSpan{extra_mem.data(), extra_mem.size()} : ByteSpan{};
+    auto decoded = decode_ptgs(main, extra, arena, {}, {}, {}, {});
+    ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
+    EXPECT_EQ(parser::format_formula(*decoded.value()), "1");
+  };
+  expect_expression(mem_area, true);
+  expect_expression(mem_err, false);
+  expect_expression(mem_no_mem, false);
+  expect_expression(mem_func, false);
+}
+TEST(XlsbPtgCodec, DecoderRejectsTruncatedMemAreaExtraCache) {
+  const std::vector<std::uint8_t> rgce = {0x26, 0, 0, 0, 0, 3, 0, 0x1E, 1, 0};
+  // PtgExtraMem declares one 16-byte range but supplies none.
+  const std::vector<std::uint8_t> extra = {1, 0, 0, 0};
+  Arena arena;
+  auto decoded =
+      decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, ByteSpan{extra.data(), extra.size()}, arena, {}, {}, {}, {});
+  ASSERT_FALSE(static_cast<bool>(decoded));
+  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbRecordTruncated);
+}
+TEST(XlsbPtgCodec, DecoderRejectsAstDeeperThanSharedLimit) {
+  Arena enc_arena;
+  parser::AstNode* root = parser::make_literal(enc_arena, Value::number(1));
+  for (std::uint32_t depth = 1; depth <= parser::kMaxFormulaAstDepth; ++depth) {
+    root = parser::make_unary_op(enc_arena, parser::UnaryOp::Plus, root);
+  }
+  ASSERT_NE(root, nullptr);
+  auto encoded = encode_ptgs(*root, {}, {}, {}, PtgRootClass::kValue);
+  ASSERT_TRUE(static_cast<bool>(encoded));
+
+  Arena dec_arena;
+  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
+  ByteSpan rgcb{encoded.value().rgcb.data(), encoded.value().rgcb.size()};
+  auto decoded = decode_ptgs(rgce, rgcb, dec_arena, {}, {}, {}, {});
+  ASSERT_FALSE(static_cast<bool>(decoded));
+  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbCorrupt);
+}
+TEST(XlsbPtgCodec, EncoderUsesExcelClassesForReferenceArgumentsAndFunctionResults) {
+  Arena arena;
+  parser::Parser p("SUM(A1:A2,1)", arena);
+  parser::AstNode* root = p.parse();
+  ASSERT_NE(root, nullptr);
+  ASSERT_TRUE(p.errors().empty());
+  auto encoded = encode_ptgs(*root, {}, {}, {}, PtgRootClass::kValue);
+  ASSERT_TRUE(static_cast<bool>(encoded)) << (encoded ? "" : encoded.error().message);
+
+  // Real Excel writes the range argument as reference-class PtgArea (0x25)
+  // and the SUM result as value-class PtgFuncVar (0x42). Array-class 0x65
+  // and reference-class 0x22 respectively make Excel repair the worksheet.
+  ASSERT_GE(encoded.value().rgce.size(), 4U);
+  EXPECT_EQ(encoded.value().rgce.front(), 0x25U);
+  EXPECT_EQ(encoded.value().rgce[encoded.value().rgce.size() - 4U], 0x42U);
+}
+TEST(XlsbPtgCodec, EncoderRejectsUnregisteredDefinedName) {
+  // A `NameRef` only lowers to `PtgName` when the caller's `name_table`
+  // (built from `collect_ptg_names` across the whole workbook) already
+  // carries an `ilbl` for it; an empty table means "not registered".
+  Arena arena;
+  parser::Parser p("MyName", arena);
+  parser::AstNode* root = p.parse();
+  ASSERT_NE(root, nullptr);
+  auto encoded = encode_ptgs(*root, {}, {}, {}, PtgRootClass::kValue);
+  ASSERT_FALSE(static_cast<bool>(encoded));
+  EXPECT_EQ(encoded.error().code, FormulonErrorCode::kIoXlsbUnsupportedPtg);
+}
+TEST(XlsbPtgCodec, EncoderLowersRegisteredDefinedName) {
+  Arena arena;
+  parser::Parser p("MyName", arena);
+  parser::AstNode* root = p.parse();
+  ASSERT_NE(root, nullptr);
+  const NameTable names = {{"MyName", 1U}};
+  auto encoded = encode_ptgs(*root, {}, {}, names, PtgRootClass::kValue);
+  ASSERT_TRUE(static_cast<bool>(encoded)) << (encoded ? "" : encoded.error().message);
+
+  Arena dec_arena;
+  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
+  const std::vector<XlsbName> name_table = {{-1, "MyName", false}};
+  auto decoded = decode_ptgs(rgce, ByteSpan{}, dec_arena, {}, name_table, {}, {});
+  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
+  EXPECT_EQ(parser::format_formula(*decoded.value()), "MyName");
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/ptg_codec_function_classes_test.cpp b/tests/unit/io/xlsb/ptg_codec_function_classes_test.cpp
new file mode 100644
index 000000000..5ddda5e76
--- /dev/null
+++ b/tests/unit/io/xlsb/ptg_codec_function_classes_test.cpp
@@ -0,0 +1,272 @@
+// XLSB Ptg codec tests grouped by reference, function, scalar, and validation behavior.
+
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <string_view>
+#include <unordered_set>
+#include <vector>
+
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "io/future_functions.h"
+#include "io/xlsb/func_id_table.h"
+#include "io/xlsb/ptg_reader.h"
+#include "io/xlsb/ptg_writer.h"
+#include "io/xlsb/record_writer.h"
+#include "parser/ast.h"
+#include "parser/ast_format.h"
+#include "parser/parser.h"
+#include "ptg_codec_test_helpers.h"
+#include "utils/arena.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+using namespace ptg_codec_test_support;
+TEST(XlsbPtgCodec, VolatileFormulasOpenWithAttrSemi) {
+  struct Case {
+    const char* formula;
+    std::vector<std::uint8_t> rgce;
+  };
+  const Case cases[] = {
+      {"RAND()", {0x19, 0x01, 0x00, 0x00, 0x41, 0x3F, 0x00}},
+      {"RAND()+A1", {0x19, 0x01, 0x00, 0x00, 0x41, 0x3F, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x03}},
+      {"SUM(A1,RAND())",
+       {0x19, 0x01, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x41, 0x3F, 0x00, 0x42, 0x02, 0x04, 0x00}},
+      {"OFFSET(A1,0,0)", {0x19, 0x01, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0,
+                          0x1E, 0x00, 0x00, 0x1E, 0x00, 0x00, 0x42, 0x03, 0x4E, 0x00}},
+      {"A1+1", {0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x1E, 0x01, 0x00, 0x03}},
+  };
+  for (const Case& c : cases) {
+    EXPECT_EQ(EncodeOnSheet1(c.formula, PtgRootClass::kValue).rgce, c.rgce) << c.formula;
+    EXPECT_EQ(RoundTrip(c.formula), c.formula);
+  }
+  // A defined name's body is marked the same way (Excel's `MyNow` = NOW()).
+  const std::vector<std::uint8_t> name_body = EncodeOnSheet1("NOW()", PtgRootClass::kReference).rgce;
+  ASSERT_GE(name_body.size(), 4U);
+  EXPECT_EQ(std::vector<std::uint8_t>(name_body.begin(), name_body.begin() + 4),
+            (std::vector<std::uint8_t>{0x19, 0x01, 0x00, 0x00}));
+}
+TEST(XlsbPtgCodec, ArgumentClassesFollowTheParameter) {
+  struct Case {
+    const char* formula;
+    std::vector<std::uint8_t> rgce;
+  };
+  const Case cases[] = {
+      {"ISNUMBER(A1:A3)",
+       {0x45, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0xC0, 0x41, 0x80, 0x00}},
+      {"INDEX(A1:A3,2)", {0x25, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
+                          0xC0, 0x00, 0xC0, 0x1E, 0x02, 0x00, 0x42, 0x02, 0x1D, 0x00}},
+      {"ABS(A1)", {0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x41, 0x18, 0x00}},
+      {"SUMPRODUCT(A1:A2*2)", {0x65, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xC0,
+                               0x00, 0xC0, 0x1E, 0x02, 0x00, 0x05, 0x42, 0x01, 0xE4, 0x00}},
+      {"VLOOKUP(2,A1:A3,1,0)", {0x1E, 0x02, 0x00, 0x25, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
+                                0xC0, 0x00, 0xC0, 0x1E, 0x01, 0x00, 0x1E, 0x00, 0x00, 0x42, 0x04, 0x66, 0x00}},
+      {"IF(A1>0,A2,A3)", {0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x1E, 0x00, 0x00, 0x0D, 0x19, 0x02, 0x0B,
+                          0x00, 0x24, 0x01, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x19, 0x08, 0x0E, 0x00, 0x24, 0x02,
+                          0x00, 0x00, 0x00, 0x00, 0xC0, 0x19, 0x08, 0x03, 0x00, 0x42, 0x03, 0x01, 0x00}},
+  };
+  for (const Case& c : cases) {
+    EXPECT_EQ(EncodeOnSheet1(c.formula, PtgRootClass::kValue).rgce, c.rgce) << c.formula;
+  }
+}
+TEST(XlsbPtgCodec, ParameterClassTailRepeats) {
+  EXPECT_EQ(xlsb_parameter_class("SUMPRODUCT", 7), 'F');
+  const char sumifs[] = "RRVRVRV";
+  for (std::uint32_t i = 0; i < 7U; ++i) {
+    EXPECT_EQ(xlsb_parameter_class("sumifs", i), sumifs[i]) << i;
+  }
+  EXPECT_EQ(xlsb_parameter_class("ABS", 0), 'V');
+  EXPECT_EQ(xlsb_parameter_class("NOT.A.FUNCTION", 3), 'V');
+}
+TEST(XlsbPtgCodec, ReferenceOperationCalleeMatchesExcelBytes) {
+  const EncodedFormula union_call = EncodeOnSheet1("(A1,B1)(1)", PtgRootClass::kValue);
+  EXPECT_EQ(union_call.rgce, (std::vector<std::uint8_t>{0x26, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x24, 0x00, 0x00,
+                                                        0x00, 0x00, 0x00, 0xC0, 0x24, 0x00, 0x00, 0x00, 0x00, 0x01,
+                                                        0xC0, 0x10, 0x15, 0x1E, 0x01, 0x00, 0x42, 0x02, 0xFF, 0x00}));
+  EXPECT_EQ(union_call.rgcb,
+            (std::vector<std::uint8_t>{0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                       0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00}));
+  const EncodedFormula isect_call = EncodeOnSheet1("(A1:B2 B1:B3)(1)", PtgRootClass::kValue);
+  EXPECT_EQ(isect_call.rgce, (std::vector<std::uint8_t>{
+                                 0x26, 0x00, 0x00, 0x00, 0x00, 0x1B, 0x00, 0x25, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+                                 0x00, 0x00, 0x00, 0xC0, 0x01, 0xC0, 0x25, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00,
+                                 0x00, 0x01, 0xC0, 0x01, 0xC0, 0x0F, 0x15, 0x1E, 0x01, 0x00, 0x42, 0x02, 0xFF, 0x00}));
+  EXPECT_EQ(isect_call.rgcb, (std::vector<std::uint8_t>{0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+                                                        0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00}));
+  EXPECT_EQ(RoundTrip("(A1,B1)(1)"), "(A1,B1)(1)");
+  EXPECT_EQ(RoundTrip("(A1:B2 B1:B3)(1)"), "(A1:B2 B1:B3)(1)");
+}
+TEST(XlsbPtgCodec, ArrayEvaluationFollowsTheParameterClasses) {
+  for (const char* formula : {"A1:A2", "A1:A2*2", "SUM(A1:A2*2)", "COUNTIF(A1:A2,A1:A2)", "AND(A1:A2>0)",
+                              "ISNUMBER(A1:A2)", "LEN(A1:A2)", "IF(A1:A2>0,1,0)", "A1:B2 B2:C3"}) {
+    Arena arena;
+    parser::Parser p(formula, arena);
+    const parser::AstNode* root = p.parse();
+    ASSERT_NE(root, nullptr) << formula;
+    EXPECT_TRUE(formula_is_dynamic_array(*root, NameShapes())) << formula;
+  }
+  for (const char* formula : {"A1", "A1+1", "SUM(A1:A2)", "SUMPRODUCT(A1:A2)", "MATCH(1,A1:A2,0)",
+                              "VLOOKUP(1,A1:B2,2,0)", "INDEX(A1:A2,1)", "(A1:A2,B1:B2)", "A1 B1", "ROWS(A1:A2)"}) {
+    Arena arena;
+    parser::Parser p(formula, arena);
+    const parser::AstNode* root = p.parse();
+    ASSERT_NE(root, nullptr) << formula;
+    EXPECT_FALSE(formula_is_dynamic_array(*root, NameShapes())) << formula;
+  }
+}
+TEST(XlsbPtgCodec, LegacyFormulaIntersectsOperatorOperands) {
+  const std::vector<std::uint8_t> area = {0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0xC0};
+  auto encode = [](const char* formula, PtgEvaluation evaluation) {
+    Arena arena;
+    parser::Parser p(formula, arena);
+    parser::AstNode* root = p.parse();
+    EXPECT_NE(root, nullptr) << formula;
+    auto encoded = encode_ptgs(*root, {}, {}, {}, PtgRootClass::kValue, std::nullopt, evaluation);
+    EXPECT_TRUE(static_cast<bool>(encoded)) << formula;
+    return encoded ? encoded.value().rgce : std::vector<std::uint8_t>{};
+  };
+  auto with_class = [&area](std::uint8_t area_ptg, std::initializer_list<std::uint8_t> tail) {
+    std::vector<std::uint8_t> out = {area_ptg};
+    out.insert(out.end(), area.begin(), area.end());
+    out.insert(out.end(), tail);
+    return out;
+  };
+  EXPECT_EQ(encode("SUM(A1:A2*2)", PtgEvaluation::kLegacy),
+            with_class(0x45, {0x1E, 0x02, 0x00, 0x05, 0x19, 0x10, 0x00, 0x00}));
+  EXPECT_EQ(encode("A1:A2*2", PtgEvaluation::kLegacy), with_class(0x45, {0x1E, 0x02, 0x00, 0x05}));
+  EXPECT_EQ(encode("SUM(A1:A2*2)", PtgEvaluation::kDynamicArray),
+            with_class(0x65, {0x1E, 0x02, 0x00, 0x05, 0x19, 0x10, 0x00, 0x00}));
+}
+TEST(XlsbPtgCodec, WrittenAtStoresAsSingleCall) {
+  const NameTable names = {{"_xlfn.SINGLE", 2U}};
+  const std::vector<std::uint8_t> expected = {0x23, 0x02, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00,
+                                              0x00, 0x00, 0x00, 0xC0, 0x42, 0x02, 0xFF, 0x00};
+  for (const PtgEvaluation evaluation : {PtgEvaluation::kLegacy, PtgEvaluation::kDynamicArray}) {
+    Arena arena;
+    parser::Parser p("@A1", arena);
+    parser::AstNode* root = p.parse();
+    ASSERT_NE(root, nullptr);
+    auto encoded = encode_ptgs(*root, {}, {}, names, PtgRootClass::kValue, std::nullopt, evaluation);
+    ASSERT_TRUE(static_cast<bool>(encoded)) << encoded.error().message;
+    EXPECT_EQ(encoded.value().rgce, expected);
+  }
+}
+TEST(XlsbPtgCodec, LegacyFormulaStoresNoImpliedAt) {
+  const NameTable names = {{"_xlfn.SINGLE", 2U}};
+  auto encode = [&names](const char* formula, PtgEvaluation evaluation) {
+    Arena arena;
+    parser::Parser p(formula, arena);
+    parser::AstNode* root = p.parse();
+    EXPECT_NE(root, nullptr) << formula;
+    auto encoded = encode_ptgs(*root, {}, {}, names, PtgRootClass::kValue, std::nullopt, evaluation);
+    EXPECT_TRUE(static_cast<bool>(encoded)) << formula;
+    return encoded ? encoded.value().rgce : std::vector<std::uint8_t>{};
+  };
+  EXPECT_EQ(encode("SUM(@A1:A2*2)", PtgEvaluation::kLegacy), encode("SUM(A1:A2*2)", PtgEvaluation::kLegacy));
+  EXPECT_EQ(encode("@A1:A2", PtgEvaluation::kLegacy), encode("A1:A2", PtgEvaluation::kLegacy));
+  EXPECT_NE(encode("SUM(@A1:A2)", PtgEvaluation::kLegacy), encode("SUM(A1:A2)", PtgEvaluation::kLegacy));
+  EXPECT_NE(encode("@A1:A2", PtgEvaluation::kLegacyArray), encode("A1:A2", PtgEvaluation::kLegacyArray));
+}
+TEST(XlsbPtgCodec, BranchingCallsCarryExcelsJumpAttributes) {
+  const std::vector<std::uint8_t> a1 = {0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0};
+  const std::vector<std::uint8_t> ref_a1 = {0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0};
+  auto join = [](std::initializer_list<std::vector<std::uint8_t>> parts) {
+    std::vector<std::uint8_t> out;
+    for (const auto& part : parts) {
+      out.insert(out.end(), part.begin(), part.end());
+    }
+    return out;
+  };
+  EXPECT_EQ(EncodeOnSheet1("IF(A1,A1,A1)", PtgRootClass::kValue).rgce,
+            join({a1,
+                  {0x19, 0x02, 0x0B, 0x00},
+                  ref_a1,
+                  {0x19, 0x08, 0x0E, 0x00},
+                  ref_a1,
+                  {0x19, 0x08, 0x03, 0x00, 0x42, 0x03, 0x01, 0x00}}));
+  EXPECT_EQ(EncodeOnSheet1("CHOOSE(A1,A1,A1,A1,A1)", PtgRootClass::kValue).rgce,
+            join({a1,
+                  {0x19, 0x04, 0x04, 0x00, 0x0A, 0x00, 0x15, 0x00, 0x20, 0x00, 0x2B, 0x00, 0x36, 0x00},
+                  ref_a1,
+                  {0x19, 0x08, 0x24, 0x00},
+                  ref_a1,
+                  {0x19, 0x08, 0x19, 0x00},
+                  ref_a1,
+                  {0x19, 0x08, 0x0E, 0x00},
+                  ref_a1,
+                  {0x19, 0x08, 0x03, 0x00, 0x42, 0x05, 0x64, 0x00}}));
+  EXPECT_EQ(EncodeOnSheet1("IFERROR(A1,A1)", PtgRootClass::kValue).rgce,
+            join({a1, {0x19, 0x80, 0x07, 0x00}, ref_a1, {0x19, 0x08, 0x02, 0x00, 0x41, 0xE0, 0x01}}));
+  EXPECT_EQ(RoundTrip("IF(A1>0,CHOOSE(2,A1,B1),IFERROR(1/0,2))"), "IF(A1>0,CHOOSE(2,A1,B1),IFERROR(1/0,2))");
+  EXPECT_EQ(EncodeOnSheet1("IF(A1>0,1)", PtgRootClass::kValue).rgce,
+            join({a1,
+                  {0x1E, 0x00, 0x00, 0x0D, 0x19, 0x02, 0x07, 0x00, 0x1E, 0x01, 0x00, 0x19, 0x08, 0x03, 0x00, 0x42, 0x02,
+                   0x01, 0x00}}));
+}
+TEST(XlsbPtgCodec, ConditionalFormatArrayOperandsCarryArrayClassInward) {
+  auto encode = [](const char* formula) {
+    Arena arena;
+    parser::Parser p(formula, arena);
+    parser::AstNode* root = p.parse();
+    EXPECT_NE(root, nullptr) << formula;
+    auto encoded =
+        encode_ptgs(*root, {"S"}, {}, {}, PtgRootClass::kValue, PtgBaseCell{5U, 7U}, PtgEvaluation::kConditionalFormat);
+    EXPECT_TRUE(static_cast<bool>(encoded)) << formula;
+    std::vector<std::uint8_t> rgce = encoded ? encoded.value().rgce : std::vector<std::uint8_t>{};
+    if (rgce.size() >= 4U && rgce[0] == 0x19 && rgce[1] == 0x01) {
+      rgce.erase(rgce.begin() + 2, rgce.begin() + 4);
+    }
+    return rgce;
+  };
+  const std::vector<std::uint8_t> ref_n = {0x00, 0x00, 0x00, 0x00, 0x00, 0xC0};
+  auto join = [](std::initializer_list<std::vector<std::uint8_t>> parts) {
+    std::vector<std::uint8_t> out;
+    for (const auto& part : parts) {
+      out.insert(out.end(), part.begin(), part.end());
+    }
+    return out;
+  };
+  EXPECT_EQ(
+      encode("AND(H6<WEEKDAY(TODAY()))"),
+      join({{0x19, 0x01, 0x6C}, ref_n, {0x61, 0xDD, 0x00, 0x62, 0x01, 0x46, 0x00, 0x09, 0x42, 0x01, 0x24, 0x00}}));
+  EXPECT_EQ(encode("AND(MONTH(H6)=MONTH(TODAY()),YEAR(H6)=YEAR(TODAY()))"),
+            join({{0x19, 0x01, 0x6C},
+                  ref_n,
+                  {0x61, 0x44, 0x00, 0x61, 0xDD, 0x00, 0x61, 0x44, 0x00, 0x0B, 0x6C},
+                  ref_n,
+                  {0x61, 0x45, 0x00, 0x61, 0xDD, 0x00, 0x61, 0x45, 0x00, 0x0B, 0x42, 0x02, 0x24, 0x00}}));
+  EXPECT_EQ(
+      encode("H6<WEEKDAY(TODAY())-1"),
+      join({{0x19, 0x01, 0x4C}, ref_n, {0x41, 0xDD, 0x00, 0x42, 0x01, 0x46, 0x00, 0x1E, 0x01, 0x00, 0x04, 0x09}}));
+}
+TEST(XlsbPtgCodec, ReferenceReturningCallsFollowTheirSlot) {
+  auto hex = [](std::string_view formula) {
+    std::string out;
+    for (const std::uint8_t b : EncodeOnSheet1(formula, PtgRootClass::kValue).rgce) {
+      char buf[4];
+      std::snprintf(buf, sizeof(buf), "%02x ", b);
+      out += buf;
+    }
+    return out;
+  };
+  const std::string offset = "19 01 00 00 24 00 00 00 00 00 c0 1e 00 00 1e 00 00 ";
+  EXPECT_EQ(hex("ROWS(OFFSET(A1,0,0))"), offset + "22 03 4e 00 41 4c 00 ");
+  EXPECT_EQ(hex("ISREF(OFFSET(A1,0,0))"), offset + "22 03 4e 00 41 69 00 ");
+  EXPECT_EQ(hex("ABS(OFFSET(A1,0,0))"), offset + "42 03 4e 00 41 18 00 ");
+  EXPECT_EQ(hex("OFFSET(A1,0,0)"), offset + "42 03 4e 00 ");
+  EXPECT_EQ(hex("SUM(INDEX(A1:C3,1,1))"),
+            "25 00 00 00 00 02 00 00 00 00 c0 02 c0 1e 01 00 1e 01 00 22 03 1d 00 19 10 00 00 ");
+  EXPECT_EQ(
+      hex("AREAS(IF(TRUE,A1,B1))"),
+      "1d 01 19 02 0b 00 24 00 00 00 00 00 c0 19 08 0e 00 24 00 00 00 00 01 c0 19 08 03 00 22 03 01 00 41 4b 00 ");
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/ptg_codec_scalar_array_test.cpp b/tests/unit/io/xlsb/ptg_codec_scalar_array_test.cpp
new file mode 100644
index 000000000..69422b471
--- /dev/null
+++ b/tests/unit/io/xlsb/ptg_codec_scalar_array_test.cpp
@@ -0,0 +1,204 @@
+// XLSB Ptg codec tests grouped by reference, function, scalar, and validation behavior.
+
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <string_view>
+#include <unordered_set>
+#include <vector>
+
+#include "eval/function_registry.h"
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "io/future_functions.h"
+#include "io/xlsb/func_id_table.h"
+#include "io/xlsb/ptg_reader.h"
+#include "io/xlsb/ptg_writer.h"
+#include "io/xlsb/record_writer.h"
+#include "parser/ast.h"
+#include "parser/ast_format.h"
+#include "parser/parser.h"
+#include "ptg_codec_test_helpers.h"
+#include "utils/arena.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+using namespace ptg_codec_test_support;
+TEST(XlsbPtgCodec, WrittenParenthesesRoundTripAsPtgParen) {
+  const std::vector<std::uint8_t> excel = {0x19, 0x01, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x41,
+                                           0xDD, 0x00, 0x42, 0x01, 0x46, 0x00, 0x15, 0x09, 0x42, 0x01, 0x24, 0x00};
+  EXPECT_EQ(EncodeOnSheet1("AND(A1<(WEEKDAY(TODAY())))", PtgRootClass::kValue).rgce, excel);
+  Arena arena;
+  auto decoded = decode_ptgs(ByteSpan{excel.data(), excel.size()}, ByteSpan{}, arena, {"Sheet1"}, {}, {}, {});
+  ASSERT_TRUE(static_cast<bool>(decoded));
+  EXPECT_EQ(parser::format_formula(*decoded.value()), "AND(A1<(WEEKDAY(TODAY())))");
+  EXPECT_EQ(RoundTrip("((1+2))*3"), "((1+2))*3");
+}
+TEST(XlsbPtgCodec, SumOverArea) {
+  EXPECT_EQ(RoundTrip("SUM(A1:A10)"), "SUM(A1:A10)");
+}
+TEST(XlsbPtgCodec, WholeColumnAndRowRefsEncodeAsSentinelAreas) {
+  EXPECT_EQ(RoundTrip("SUM(A:A)"), "SUM(A:A)");
+  EXPECT_EQ(RoundTrip("SUM(1:1)"), "SUM(1:1)");
+  EXPECT_EQ(RoundTrip("SUM($A:B)"), "SUM($A:B)");
+  EXPECT_EQ(RoundTrip("SUM(1:$2)"), "SUM(1:$2)");
+  // Bytes as Excel 365 saved them: the spanned axis is absolute, and a
+  // span of columns or rows is one area.
+  const std::vector<std::uint8_t> full_col_a = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x0F, 0x00, 0x00, 0x40, 0x00, 0x40};
+  std::vector<std::uint8_t> excel = {0x45};
+  excel.insert(excel.end(), full_col_a.begin(), full_col_a.end());
+  EXPECT_EQ(EncodeOnSheet1("A:A", PtgRootClass::kValue).rgce, excel);
+  EXPECT_EQ(EncodeOnSheet1("A:B", PtgRootClass::kValue).rgce,
+            (std::vector<std::uint8_t>{0x45, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x0F, 0x00, 0x00, 0x40, 0x01, 0x40}));
+  EXPECT_EQ(EncodeOnSheet1("SUM(1:2)", PtgRootClass::kValue).rgce,
+            (std::vector<std::uint8_t>{0x25, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0xFF, 0xBF,
+                                       0x19, 0x10, 0x00, 0x00}));
+}
+TEST(XlsbPtgCodec, IfWithStrings) {
+  EXPECT_EQ(RoundTrip("IF(A1>0,\"pos\",\"neg\")"), "IF(A1>0,\"pos\",\"neg\")");
+}
+TEST(XlsbPtgCodec, Concat) {
+  EXPECT_EQ(RoundTrip("B1&\"x\""), "B1&\"x\"");
+}
+TEST(XlsbPtgCodec, UnaryMinus) {
+  EXPECT_EQ(RoundTrip("-A1"), "-A1");
+}
+TEST(XlsbPtgCodec, PostfixPercent) {
+  EXPECT_EQ(RoundTrip("A1%"), "A1%");
+}
+TEST(XlsbPtgCodec, ThreeDimensionalReference) {
+  // `Sheet2!A1` resolves through the sheet-name list to a PtgRef3d.
+  const std::vector<std::string> sheets = {"Sheet1", "Sheet2"};
+  EXPECT_EQ(RoundTrip("Sheet2!A1", sheets), "Sheet2!A1");
+}
+TEST(XlsbPtgCodec, GenuineThreeDimensionalRangeRoundTrips) {
+  // A genuine multi-sheet range (`Sheet1:Sheet3!B2`) is hand-built here
+  // rather than parsed from text: the text parser does not yet lower
+  // `'Sheet1:Sheet3'!B2` (or an unquoted `Sheet1:Sheet3!B2`) to a `Ref3D`
+  // node, so this exercises the encoder/decoder pair -- the actual XLSB
+  // fidelity contract -- directly. `encode_ptgs` resolves the node's
+  // `(begin, end)` span through a `SheetRangeTable` built the same way
+  // the production writer builds one (`collect_ptg_sheet_ranges`), and
+  // `decode_ptgs` resolves it back through the equivalent `XlsbSheetRange`
+  // list, mirroring how a real `BrtExternSheet` record round-trips.
+  const std::vector<std::string> sheets = {"Sheet1", "Sheet2", "Sheet3"};
+  Arena arena;
+  parser::Reference cell;
+  cell.row = 1;
+  cell.col = 1;  // B2
+  parser::AstNode* node = parser::make_ref3d(arena, "Sheet1", "Sheet3", cell);
+  ASSERT_NE(node, nullptr);
+
+  const SheetRangeTable sheet_ranges = {{0, 2}};  // Sheet1 (itab 0) : Sheet3 (itab 2)
+  auto encoded = encode_ptgs(*node, sheets, sheet_ranges, {}, PtgRootClass::kValue);
+  ASSERT_TRUE(static_cast<bool>(encoded)) << (encoded ? "" : encoded.error().message);
+
+  Arena dec_arena;
+  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
+  const std::vector<XlsbSheetRange> decode_ranges = {{0, 2}};
+  auto decoded = decode_ptgs(rgce, ByteSpan{}, dec_arena, sheets, {}, decode_ranges, {});
+  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
+  EXPECT_EQ(parser::format_formula(*decoded.value()), "Sheet1:Sheet3!B2");
+}
+TEST(XlsbPtgCodec, GenuineThreeDimensionalRangeTailRoundTrips) {
+  // A genuine 3-D range tail (`Sheet1:Sheet3!A1:B2`) encodes as PtgArea3d
+  // (ixti + RgceArea) and decodes back to a range-tail `Ref3D`, preserving
+  // both the sheet span and the cell rectangle. The parser now lowers this
+  // form directly, so drive it through the text `RoundTrip` helper.
+  const std::vector<std::string> sheets = {"Sheet1", "Sheet2", "Sheet3"};
+  EXPECT_EQ(RoundTrip("SUM(Sheet1:Sheet3!A1:B2)", sheets), "SUM(Sheet1:Sheet3!A1:B2)");
+
+  // Also drive the encoder/decoder directly from a hand-built node to pin
+  // the PtgArea3d codec contract independent of the parser.
+  Arena arena;
+  parser::Reference a;  // A1
+  parser::Reference b;  // B2
+  b.row = 1;
+  b.col = 1;
+  parser::AstNode* node = parser::make_ref3d_range(arena, "Sheet1", "Sheet3", a, b);
+  ASSERT_NE(node, nullptr);
+  const SheetRangeTable sheet_ranges = {{0, 2}};
+  auto encoded = encode_ptgs(*node, sheets, sheet_ranges, {}, PtgRootClass::kValue);
+  ASSERT_TRUE(static_cast<bool>(encoded)) << (encoded ? "" : encoded.error().message);
+  Arena dec_arena;
+  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
+  const std::vector<XlsbSheetRange> decode_ranges = {{0, 2}};
+  auto decoded = decode_ptgs(rgce, ByteSpan{}, dec_arena, sheets, {}, decode_ranges, {});
+  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
+  EXPECT_EQ(parser::format_formula(*decoded.value()), "Sheet1:Sheet3!A1:B2");
+}
+TEST(XlsbPtgCodec, SingleAndMultiSheetReferencesShareOneIxtiSpace) {
+  // Once a workbook emits any `BrtExternSheet` entry, every `PtgRef3d`
+  // (single- or multi-sheet) resolves its `ixti` through that one table
+  // -- see `SheetRangeTable`'s doc comment. This pins that a formula
+  // mixing a plain single-sheet ref with a genuine 3-D range encodes
+  // and decodes both correctly against a shared table.
+  const std::vector<std::string> sheets = {"Sheet1", "Sheet2", "Sheet3"};
+  EXPECT_EQ(RoundTrip("Sheet2!A1+Sheet1!A1", sheets), "Sheet2!A1+Sheet1!A1");
+}
+TEST(XlsbPtgCodec, ConstantArray) {
+  EXPECT_EQ(RoundTrip("{1,2;3,4}"), "{1,2;3,4}");
+}
+TEST(XlsbPtgCodec, ConstantArrayNonSquareRowVector) {
+  // A 1-row, 3-column array: distinguishes which `PtgExtraArray` u32 is
+  // rows vs. cols (a square fixture can't). Encoder writes rows=1,
+  // cols=3; if the reader swapped the fields it would either reject the
+  // dimension (1x3 -> read as 3x1 needs 3 rows worth of elements, which
+  // *is* available here since count is symmetric at 3, but the element
+  // shape would transpose) or -- for this asymmetric row/col case --
+  // round-trip to `{1;2;3}` instead of `{1,2,3}`.
+  EXPECT_EQ(RoundTrip("{1,2,3}"), "{1,2,3}");
+}
+TEST(XlsbPtgCodec, ConstantArrayNonSquareColumnVector) {
+  // The transpose of the above: 3 rows, 1 column.
+  EXPECT_EQ(RoundTrip("{1;2;3}"), "{1;2;3}");
+}
+TEST(XlsbPtgCodec, ErrorLiteral) {
+  EXPECT_EQ(RoundTrip("#DIV/0!"), "#DIV/0!");
+}
+TEST(XlsbPtgCodec, AbsoluteReference) {
+  EXPECT_EQ(RoundTrip("$A$1"), "$A$1");
+  EXPECT_EQ(RoundTrip("$A1"), "$A1");
+  EXPECT_EQ(RoundTrip("A$1"), "A$1");
+}
+TEST(XlsbPtgCodec, AllComparisons) {
+  EXPECT_EQ(RoundTrip("A1<B1"), "A1<B1");
+  EXPECT_EQ(RoundTrip("A1<=B1"), "A1<=B1");
+  EXPECT_EQ(RoundTrip("A1=B1"), "A1=B1");
+  EXPECT_EQ(RoundTrip("A1>=B1"), "A1>=B1");
+  EXPECT_EQ(RoundTrip("A1>B1"), "A1>B1");
+  EXPECT_EQ(RoundTrip("A1<>B1"), "A1<>B1");
+}
+TEST(XlsbPtgCodec, NestedFunctions) {
+  EXPECT_EQ(RoundTrip("ROUND(SUM(A1:A3),2)"), "ROUND(SUM(A1:A3),2)");
+}
+TEST(XlsbPtgCodec, Post2007BuiltinsUseNativeFunctionIds) {
+  EXPECT_EQ(RoundTrip("ASC(\"Ａ\")"), "ASC(\"Ａ\")");
+  // `JIS` is the ja-JP formula-bar spelling of `DBCS`; Excel stores the
+  // call as `DBCS` in both containers and has one function id (215) for
+  // it. The codec therefore canonicalises the spelling rather than
+  // preserving it — the Writer resolves `JIS` to id 215 through the
+  // table's alias, and the Reader hands that id back as `DBCS`, which
+  // is exactly what Excel's own formula text would say.
+  EXPECT_EQ(RoundTrip("JIS(\"A\")"), "DBCS(\"A\")");
+  EXPECT_EQ(RoundTrip("DBCS(\"A\")"), "DBCS(\"A\")");
+  EXPECT_EQ(RoundTrip("EDATE(A1,1)"), "EDATE(A1,1)");
+  EXPECT_EQ(RoundTrip("EOMONTH(A1,1)"), "EOMONTH(A1,1)");
+  EXPECT_EQ(RoundTrip("WORKDAY(A1,1)"), "WORKDAY(A1,1)");
+  EXPECT_EQ(RoundTrip("NETWORKDAYS(A1,B1)"), "NETWORKDAYS(A1,B1)");
+  EXPECT_EQ(RoundTrip("IFERROR(A1,0)"), "IFERROR(A1,0)");
+  EXPECT_EQ(RoundTrip("COUNTIFS(A1,1)"), "COUNTIFS(A1,1)");
+  EXPECT_EQ(RoundTrip("SUMIFS(A1,B1,1)"), "SUMIFS(A1,B1,1)");
+  EXPECT_EQ(RoundTrip("AVERAGEIF(A1,1)"), "AVERAGEIF(A1,1)");
+  EXPECT_EQ(RoundTrip("AVERAGEIFS(A1,B1,1)"), "AVERAGEIFS(A1,B1,1)");
+}
+TEST(XlsbPtgCodec, PowerAndDivide) {
+  EXPECT_EQ(RoundTrip("A1^2/B1"), "A1^2/B1");
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/ptg_codec_test.cpp b/tests/unit/io/xlsb/ptg_codec_test.cpp
index 6cafd6dc7..401ba123a 100644
--- a/tests/unit/io/xlsb/ptg_codec_test.cpp
+++ b/tests/unit/io/xlsb/ptg_codec_test.cpp
@@ -1,11 +1,4 @@
-//
-// Round-trip tests for the MS-XLSB Ptg codec (encoder + decoder).
-//
-// Each case parses an A1 formula to the engine AST, encodes it to a Ptg
-// (`rgce`) byte stream, decodes that stream back to an AST, and asserts
-// the re-formatted formula text matches the original. This exercises the
-// encode <-> decode pair as a single round-trip without needing a full
-// xlsb package.
+// XLSB Ptg codec tests grouped by reference, function, scalar, and validation behavior.
 
 #include <cstdio>
 #include <cstring>
@@ -25,62 +18,18 @@
 #include "parser/ast.h"
 #include "parser/ast_format.h"
 #include "parser/parser.h"
+#include "ptg_codec_test_helpers.h"
 #include "utils/arena.h"
 
 namespace formulon {
 namespace io {
 namespace xlsb {
 namespace {
-
-// Parses `formula` (without leading `=`), encodes to Ptg, decodes back,
-// and returns the re-formatted formula text. `sheet_names` resolves a
-// qualified reference's sheet to its 0-based index on both sides; the
-// `SheetRangeTable` / `XlsbSheetRange` list that actually carries the
-// `ixti` numbering is built here (via `collect_ptg_sheet_ranges` on the
-// encode side, mirrored 1:1 into `XlsbSheetRange`s for decode) so a
-// single-sheet qualified reference and a genuine 3-D range share one
-// `ixti` space exactly as the production writer does.
-std::string RoundTrip(std::string_view formula, const std::vector<std::string>& sheet_names = {}) {
-  Arena enc_arena;
-  parser::Parser p(formula, enc_arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr);
-  EXPECT_TRUE(p.errors().empty()) << "parse errors for: " << formula;
-
-  SheetRangeTable sheet_ranges;
-  std::unordered_set<std::uint64_t> seen;
-  collect_ptg_sheet_ranges(*root, sheet_names, sheet_ranges, seen);
-
-  auto encoded = encode_ptgs(*root, sheet_names, sheet_ranges, {}, PtgRootClass::kValue);
-  EXPECT_TRUE(static_cast<bool>(encoded))
-      << "encode failed for: " << formula << " | " << (encoded ? "" : encoded.error().message);
-  if (!encoded) {
-    return "<encode-failed>";
-  }
-
-  std::vector<XlsbSheetRange> decode_ranges;
-  decode_ranges.reserve(sheet_ranges.size());
-  for (const auto& [itab_first, itab_last] : sheet_ranges) {
-    decode_ranges.push_back(XlsbSheetRange{itab_first, itab_last});
-  }
-
-  Arena dec_arena;
-  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
-  ByteSpan rgcb{encoded.value().rgcb.data(), encoded.value().rgcb.size()};
-  auto decoded = decode_ptgs(rgce, rgcb, dec_arena, sheet_names, {}, decode_ranges, {});
-  EXPECT_TRUE(static_cast<bool>(decoded))
-      << "decode failed for: " << formula << " | " << (decoded ? "" : decoded.error().message);
-  if (!decoded) {
-    return "<decode-failed>";
-  }
-  return parser::format_formula(*decoded.value());
-}
-
+using namespace ptg_codec_test_support;
 TEST(XlsbPtgCodec, ArithmeticWithPrecedence) {
   // `A1+B2*3`: PtgRef, PtgRef, PtgInt, PtgMul, PtgAdd.
   EXPECT_EQ(RoundTrip("A1+B2*3"), "A1+B2*3");
 }
-
 TEST(XlsbPtgCodec, AttrChooseSkipsU16JumpOffsets) {
   // PtgInt(1), followed by PtgAttrChoose with count=1 and two 16-bit
   // jump offsets. [MS-XLSB] 2.5.98.25 defines rgOffset as an array of
@@ -101,7 +50,6 @@ TEST(XlsbPtgCodec, AttrChooseSkipsU16JumpOffsets) {
   ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
   EXPECT_EQ(parser::format_formula(*decoded.value()), "1");
 }
-
 TEST(XlsbPtgCodec, AttrChooseWithMultipleBranchesSkipsU16JumpOffsets) {
   // Same as above but cOffset=2 (three CHOOSE branches), followed by a
   // PtgFuncVar(id=100, CHOOSE) to prove the stream realigns correctly
@@ -123,12 +71,6 @@ TEST(XlsbPtgCodec, AttrChooseWithMultipleBranchesSkipsU16JumpOffsets) {
   ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
   EXPECT_EQ(parser::format_formula(*decoded.value()), "CHOOSE(2,10,20,30)");
 }
-
-// A `BrtName` record local to a sheet other than the formula's own is only
-// reachable as `Sheet!Name`; one local to the host sheet, or workbook
-// scoped, stays unqualified. `PtgNameX` through this workbook's own
-// ExternSheet entry is the qualified spelling, so it names a local record
-// with its sheet even on that sheet (Excel stores `Sheet1!Fn` on Sheet1 so).
 TEST(XlsbPtgCodec, NameLocalToAnotherSheetDecodesSheetQualified) {
   const std::vector<std::string> sheets = {"Sheet1", "My Sheet"};
   const std::vector<XlsbName> names = {XlsbName{1, "Local", false}, XlsbName{0, "Own", false},
@@ -156,11 +98,6 @@ TEST(XlsbPtgCodec, NameLocalToAnotherSheetDecodesSheetQualified) {
     EXPECT_EQ(parser::format_formula(*decoded.value()), c.want);
   }
 }
-
-// Excel 365 writes `Sheet2!Local` as `PtgNameX` through a sheetless
-// book-scope ExternSheet entry (value class at a cell formula's root), and
-// `Sheet2!Fn(3)` as the reference-class name-ref, the argument and
-// `PtgFuncVar(255)`; both read back with the qualifier.
 TEST(XlsbPtgCodec, SheetQualifiedNameEncodesPtgNameX) {
   const std::vector<std::string> sheets = {"Sheet1", "Sheet2"};
   NameTable table;
@@ -198,10 +135,6 @@ TEST(XlsbPtgCodec, SheetQualifiedNameEncodesPtgNameX) {
     EXPECT_EQ(parser::format_formula(*decoded.value()), c.formula);
   }
 }
-
-// A cell reference invoked as a callee is the reference-class `PtgRef` /
-// `PtgRef3d`, the arguments and `PtgFuncVar(255)`; bytes as Excel 365
-// saved `A1(1)` and `Sheet1!LOG10(100)`.
 TEST(XlsbPtgCodec, CellReferenceCalleeMatchesExcelBytes) {
   const std::vector<std::string> sheets = {"Sheet1"};
   struct Case {
@@ -236,36 +169,6 @@ TEST(XlsbPtgCodec, CellReferenceCalleeMatchesExcelBytes) {
     EXPECT_EQ(parser::format_formula(*decoded.value()), c.formula);
   }
 }
-
-// Encodes `formula` on a one-sheet workbook and returns `rgce` + `rgcb`.
-EncodedFormula EncodeOnSheet1(std::string_view formula, PtgRootClass root_class) {
-  const std::vector<std::string> sheets = {"Sheet1"};
-  Arena arena;
-  parser::Parser p(formula, arena);
-  parser::AstNode* root = p.parse();
-  EXPECT_NE(root, nullptr) << formula;
-  EXPECT_TRUE(p.errors().empty()) << formula;
-  if (root == nullptr) {
-    return {};
-  }
-  SheetRangeTable ranges;
-  std::unordered_set<std::uint64_t> seen;
-  collect_ptg_sheet_ranges(*root, sheets, ranges, seen);
-  // A cell formula is encoded as typed into Excel 365: with the dynamic-array
-  // mark exactly where Excel gives it one.
-  const PtgEvaluation evaluation =
-      root_class == PtgRootClass::kReference || formula_is_dynamic_array(*root, NameShapes())
-          ? PtgEvaluation::kDynamicArray
-          : PtgEvaluation::kLegacy;
-  auto encoded = encode_ptgs(*root, sheets, ranges, {}, root_class, std::nullopt, evaluation);
-  EXPECT_TRUE(static_cast<bool>(encoded)) << formula << " | " << (encoded ? "" : encoded.error().message);
-  return encoded ? encoded.value() : EncodedFormula{};
-}
-
-// Bytes as Excel 365 saved each formula. A
-// union or intersection of plain references in a cell sits behind the memory
-// token carrying Excel's precomputed result; `PtgMemArea`'s leading four
-// bytes are unused, which Excel leaves uninitialised and this writes as zero.
 TEST(XlsbPtgCodec, ReferenceOperationsMatchExcelBytes) {
   const std::vector<std::uint8_t> a1a2 = {0x25, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0xC0};
   const std::vector<std::uint8_t> b1b2 = {0x25, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0xC0, 0x01, 0xC0};
@@ -307,9 +210,6 @@ TEST(XlsbPtgCodec, ReferenceOperationsMatchExcelBytes) {
     EXPECT_EQ(encoded.rgcb, c.rgcb) << c.formula;
   }
 }
-
-// A defined name's body caches nothing: its root union or intersection sits
-// behind reference-class `PtgMemFunc` (Excel's `UName` / `IName` records).
 TEST(XlsbPtgCodec, NameBodyReferenceOperationsMatchExcelBytes) {
   const std::vector<std::uint8_t> a1a2 = {0x3B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
                                           0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
@@ -332,10 +232,6 @@ TEST(XlsbPtgCodec, NameBodyReferenceOperationsMatchExcelBytes) {
   EXPECT_EQ(EncodeOnSheet1("(Sheet1!$A$1:$A$2,Sheet1!$B$1:$B$2)", PtgRootClass::kReference).rgce, union_want);
   EXPECT_EQ(EncodeOnSheet1("Sheet1!$A$1:$B$2 Sheet1!$B$1:$C$3", PtgRootClass::kReference).rgce, isect_want);
 }
-
-// Excel renders a formula from its tokens, so every parenthesis the text
-// needs is a `PtgParen` right after the subexpression it closes; without
-// them Excel showed `(1+2)*3` as `1+2*3`. `(A1:A2)(1)` is Excel's bytes.
 TEST(XlsbPtgCodec, ParenthesesBecomePtgParen) {
   struct Case {
     const char* formula;
@@ -353,11 +249,6 @@ TEST(XlsbPtgCodec, ParenthesesBecomePtgParen) {
     EXPECT_EQ(RoundTrip(c.formula), c.formula);
   }
 }
-
-// The writer stores a callee with no function id and no hidden-name route
-// as a defined-name call, which is right only for names no one defined; so
-// every built-in has to have one of the two. LET / LAMBDA are lowered by
-// their own AST shapes.
 TEST(XlsbPtgCodec, EveryBuiltinHasAnXlsbEncoding) {
   std::vector<std::string> missing;
   auto check = [&missing](std::string_view name) {
@@ -374,10 +265,6 @@ TEST(XlsbPtgCodec, EveryBuiltinHasAnXlsbEncoding) {
   }
   EXPECT_TRUE(missing.empty()) << (missing.empty() ? "" : missing.front());
 }
-
-// `PtgRefN` / `PtgAreaN` against a base cell, with the bytes Excel 365 saved
-// for tests/fixtures/excel/xlsb_feature_rel.xlsb's conditional formats. The
-// base is the top-left of the sqref's bounding box.
 TEST(XlsbPtgCodec, RelativeReferencesAgainstABaseCellMatchExcelBytes) {
   struct Case {
     const char* formula;
@@ -408,10 +295,6 @@ TEST(XlsbPtgCodec, RelativeReferencesAgainstABaseCellMatchExcelBytes) {
     EXPECT_EQ(parser::format_formula(*decoded.value()), c.formula);
   }
 }
-
-// A relative offset is taken modulo the grid both ways, so a reference
-// across the grid's edge wraps: from A1 the last cell is one step up and
-// left, and from the last cell A1 is one step down and right.
 TEST(XlsbPtgCodec, RelativeOffsetsWrapAroundTheGrid) {
   struct Case {
     const char* formula;
@@ -439,9 +322,6 @@ TEST(XlsbPtgCodec, RelativeOffsetsWrapAroundTheGrid) {
     EXPECT_EQ(parser::format_formula(*decoded.value()), c.formula);
   }
 }
-
-// Without a base cell nothing changes: relative references stay `PtgRef`,
-// and a `PtgRefN` has nothing to resolve against.
 TEST(XlsbPtgCodec, RelativeTokensNeedABaseCell) {
   EXPECT_EQ(EncodeOnSheet1("A1", PtgRootClass::kValue).rgce,
             (std::vector<std::uint8_t>{0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0}));
@@ -452,729 +332,6 @@ TEST(XlsbPtgCodec, RelativeTokensNeedABaseCell) {
   EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbUnsupportedPtg);
 }
 
-// A cell formula calling a volatile function opens with `PtgAttrSemi`;
-// bytes as Excel 365 saved them. Without it
-// Excel did not recalculate an engine-written =RAND() on F9.
-TEST(XlsbPtgCodec, VolatileFormulasOpenWithAttrSemi) {
-  struct Case {
-    const char* formula;
-    std::vector<std::uint8_t> rgce;
-  };
-  const Case cases[] = {
-      {"RAND()", {0x19, 0x01, 0x00, 0x00, 0x41, 0x3F, 0x00}},
-      {"RAND()+A1", {0x19, 0x01, 0x00, 0x00, 0x41, 0x3F, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x03}},
-      {"SUM(A1,RAND())",
-       {0x19, 0x01, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x41, 0x3F, 0x00, 0x42, 0x02, 0x04, 0x00}},
-      {"OFFSET(A1,0,0)", {0x19, 0x01, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0,
-                          0x1E, 0x00, 0x00, 0x1E, 0x00, 0x00, 0x42, 0x03, 0x4E, 0x00}},
-      {"A1+1", {0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x1E, 0x01, 0x00, 0x03}},
-  };
-  for (const Case& c : cases) {
-    EXPECT_EQ(EncodeOnSheet1(c.formula, PtgRootClass::kValue).rgce, c.rgce) << c.formula;
-    EXPECT_EQ(RoundTrip(c.formula), c.formula);
-  }
-  // A defined name's body is marked the same way (Excel's `MyNow` = NOW()).
-  const std::vector<std::uint8_t> name_body = EncodeOnSheet1("NOW()", PtgRootClass::kReference).rgce;
-  ASSERT_GE(name_body.size(), 4U);
-  EXPECT_EQ(std::vector<std::uint8_t>(name_body.begin(), name_body.begin() + 4),
-            (std::vector<std::uint8_t>{0x19, 0x01, 0x00, 0x00}));
-}
-
-// A reference argument takes the class of the parameter it feeds, and an
-// operator's operand the class that parameter gives it; bytes as Excel 365
-// saved them. A reference-class operand
-// under IF made Excel compute =IF(A1>0,A2,A3) as #VALUE!, a value-class one
-// under SUMPRODUCT showed as =SUMPRODUCT(@A1:A2*2).
-TEST(XlsbPtgCodec, ArgumentClassesFollowTheParameter) {
-  struct Case {
-    const char* formula;
-    std::vector<std::uint8_t> rgce;
-  };
-  const Case cases[] = {
-      {"ISNUMBER(A1:A3)",
-       {0x45, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0xC0, 0x41, 0x80, 0x00}},
-      {"INDEX(A1:A3,2)", {0x25, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
-                          0xC0, 0x00, 0xC0, 0x1E, 0x02, 0x00, 0x42, 0x02, 0x1D, 0x00}},
-      {"ABS(A1)", {0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x41, 0x18, 0x00}},
-      {"SUMPRODUCT(A1:A2*2)", {0x65, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xC0,
-                               0x00, 0xC0, 0x1E, 0x02, 0x00, 0x05, 0x42, 0x01, 0xE4, 0x00}},
-      {"VLOOKUP(2,A1:A3,1,0)", {0x1E, 0x02, 0x00, 0x25, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
-                                0xC0, 0x00, 0xC0, 0x1E, 0x01, 0x00, 0x1E, 0x00, 0x00, 0x42, 0x04, 0x66, 0x00}},
-      {"IF(A1>0,A2,A3)", {0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x1E, 0x00, 0x00, 0x0D, 0x19, 0x02, 0x0B,
-                          0x00, 0x24, 0x01, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x19, 0x08, 0x0E, 0x00, 0x24, 0x02,
-                          0x00, 0x00, 0x00, 0x00, 0xC0, 0x19, 0x08, 0x03, 0x00, 0x42, 0x03, 0x01, 0x00}},
-  };
-  for (const Case& c : cases) {
-    EXPECT_EQ(EncodeOnSheet1(c.formula, PtgRootClass::kValue).rgce, c.rgce) << c.formula;
-  }
-}
-
-// The class list's tail repeats its last letter, or its last two when marked.
-TEST(XlsbPtgCodec, ParameterClassTailRepeats) {
-  EXPECT_EQ(xlsb_parameter_class("SUMPRODUCT", 7), 'F');
-  const char sumifs[] = "RRVRVRV";
-  for (std::uint32_t i = 0; i < 7U; ++i) {
-    EXPECT_EQ(xlsb_parameter_class("sumifs", i), sumifs[i]) << i;
-  }
-  EXPECT_EQ(xlsb_parameter_class("ABS", 0), 'V');
-  EXPECT_EQ(xlsb_parameter_class("NOT.A.FUNCTION", 3), 'V');
-}
-
-// A parenthesised union or intersection called as a function (#REF! in
-// Excel) is stored like any other reference operation there: reference-class
-// `PtgMemArea` caching its rectangles, `PtgParen`, the arguments and
-// `PtgFuncVar(255)`; bytes as Excel 365 saved them.
-TEST(XlsbPtgCodec, ReferenceOperationCalleeMatchesExcelBytes) {
-  const EncodedFormula union_call = EncodeOnSheet1("(A1,B1)(1)", PtgRootClass::kValue);
-  EXPECT_EQ(union_call.rgce, (std::vector<std::uint8_t>{0x26, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x24, 0x00, 0x00,
-                                                        0x00, 0x00, 0x00, 0xC0, 0x24, 0x00, 0x00, 0x00, 0x00, 0x01,
-                                                        0xC0, 0x10, 0x15, 0x1E, 0x01, 0x00, 0x42, 0x02, 0xFF, 0x00}));
-  EXPECT_EQ(union_call.rgcb,
-            (std::vector<std::uint8_t>{0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                                       0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00}));
-  const EncodedFormula isect_call = EncodeOnSheet1("(A1:B2 B1:B3)(1)", PtgRootClass::kValue);
-  EXPECT_EQ(isect_call.rgce, (std::vector<std::uint8_t>{
-                                 0x26, 0x00, 0x00, 0x00, 0x00, 0x1B, 0x00, 0x25, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
-                                 0x00, 0x00, 0x00, 0xC0, 0x01, 0xC0, 0x25, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00,
-                                 0x00, 0x01, 0xC0, 0x01, 0xC0, 0x0F, 0x15, 0x1E, 0x01, 0x00, 0x42, 0x02, 0xFF, 0x00}));
-  EXPECT_EQ(isect_call.rgcb, (std::vector<std::uint8_t>{0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
-                                                        0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00}));
-  EXPECT_EQ(RoundTrip("(A1,B1)(1)"), "(A1,B1)(1)");
-  EXPECT_EQ(RoundTrip("(A1:B2 B1:B3)(1)"), "(A1:B2 B1:B3)(1)");
-}
-
-// Formulas Excel 365 marks dynamic-array on entry because an area is
-// evaluated as an array, and ones it does not (measured).
-TEST(XlsbPtgCodec, ArrayEvaluationFollowsTheParameterClasses) {
-  for (const char* formula : {"A1:A2", "A1:A2*2", "SUM(A1:A2*2)", "COUNTIF(A1:A2,A1:A2)", "AND(A1:A2>0)",
-                              "ISNUMBER(A1:A2)", "LEN(A1:A2)", "IF(A1:A2>0,1,0)", "A1:B2 B2:C3"}) {
-    Arena arena;
-    parser::Parser p(formula, arena);
-    const parser::AstNode* root = p.parse();
-    ASSERT_NE(root, nullptr) << formula;
-    EXPECT_TRUE(formula_is_dynamic_array(*root, NameShapes())) << formula;
-  }
-  for (const char* formula : {"A1", "A1+1", "SUM(A1:A2)", "SUMPRODUCT(A1:A2)", "MATCH(1,A1:A2,0)",
-                              "VLOOKUP(1,A1:B2,2,0)", "INDEX(A1:A2,1)", "(A1:A2,B1:B2)", "A1 B1", "ROWS(A1:A2)"}) {
-    Arena arena;
-    parser::Parser p(formula, arena);
-    const parser::AstNode* root = p.parse();
-    ASSERT_NE(root, nullptr) << formula;
-    EXPECT_FALSE(formula_is_dynamic_array(*root, NameShapes())) << formula;
-  }
-}
-
-// A legacy formula (no dynamic-array mark) intersects an operator's area
-// operand, so SUM(A1:A2*2) stores it value class where a dynamic-array one
-// stores it array class; bytes as Excel 365 saved a legacy workbook's E1 and
-// its CSE block {=A1:A2*2}.
-TEST(XlsbPtgCodec, LegacyFormulaIntersectsOperatorOperands) {
-  const std::vector<std::uint8_t> area = {0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0xC0};
-  auto encode = [](const char* formula, PtgEvaluation evaluation) {
-    Arena arena;
-    parser::Parser p(formula, arena);
-    parser::AstNode* root = p.parse();
-    EXPECT_NE(root, nullptr) << formula;
-    auto encoded = encode_ptgs(*root, {}, {}, {}, PtgRootClass::kValue, std::nullopt, evaluation);
-    EXPECT_TRUE(static_cast<bool>(encoded)) << formula;
-    return encoded ? encoded.value().rgce : std::vector<std::uint8_t>{};
-  };
-  auto with_class = [&area](std::uint8_t area_ptg, std::initializer_list<std::uint8_t> tail) {
-    std::vector<std::uint8_t> out = {area_ptg};
-    out.insert(out.end(), area.begin(), area.end());
-    out.insert(out.end(), tail);
-    return out;
-  };
-  EXPECT_EQ(encode("SUM(A1:A2*2)", PtgEvaluation::kLegacy),
-            with_class(0x45, {0x1E, 0x02, 0x00, 0x05, 0x19, 0x10, 0x00, 0x00}));
-  EXPECT_EQ(encode("A1:A2*2", PtgEvaluation::kLegacy), with_class(0x45, {0x1E, 0x02, 0x00, 0x05}));
-  EXPECT_EQ(encode("SUM(A1:A2*2)", PtgEvaluation::kDynamicArray),
-            with_class(0x65, {0x1E, 0x02, 0x00, 0x05, 0x19, 0x10, 0x00, 0x00}));
-}
-
-// A written `@` is a call to the hidden `_xlfn.SINGLE` name in either
-// evaluation mode; bytes as Excel 365 saved `=@A1`, a cell it stored
-// without the dynamic-array mark.
-TEST(XlsbPtgCodec, WrittenAtStoresAsSingleCall) {
-  const NameTable names = {{"_xlfn.SINGLE", 2U}};
-  const std::vector<std::uint8_t> expected = {0x23, 0x02, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00,
-                                              0x00, 0x00, 0x00, 0xC0, 0x42, 0x02, 0xFF, 0x00};
-  for (const PtgEvaluation evaluation : {PtgEvaluation::kLegacy, PtgEvaluation::kDynamicArray}) {
-    Arena arena;
-    parser::Parser p("@A1", arena);
-    parser::AstNode* root = p.parse();
-    ASSERT_NE(root, nullptr);
-    auto encoded = encode_ptgs(*root, {}, {}, names, PtgRootClass::kValue, std::nullopt, evaluation);
-    ASSERT_TRUE(static_cast<bool>(encoded)) << encoded.error().message;
-    EXPECT_EQ(encoded.value().rgce, expected);
-  }
-}
-
-// A legacy formula stores Excel's implied `@` as nothing; a CSE block keeps
-// every written one.
-TEST(XlsbPtgCodec, LegacyFormulaStoresNoImpliedAt) {
-  const NameTable names = {{"_xlfn.SINGLE", 2U}};
-  auto encode = [&names](const char* formula, PtgEvaluation evaluation) {
-    Arena arena;
-    parser::Parser p(formula, arena);
-    parser::AstNode* root = p.parse();
-    EXPECT_NE(root, nullptr) << formula;
-    auto encoded = encode_ptgs(*root, {}, {}, names, PtgRootClass::kValue, std::nullopt, evaluation);
-    EXPECT_TRUE(static_cast<bool>(encoded)) << formula;
-    return encoded ? encoded.value().rgce : std::vector<std::uint8_t>{};
-  };
-  EXPECT_EQ(encode("SUM(@A1:A2*2)", PtgEvaluation::kLegacy), encode("SUM(A1:A2*2)", PtgEvaluation::kLegacy));
-  EXPECT_EQ(encode("@A1:A2", PtgEvaluation::kLegacy), encode("A1:A2", PtgEvaluation::kLegacy));
-  EXPECT_NE(encode("SUM(@A1:A2)", PtgEvaluation::kLegacy), encode("SUM(A1:A2)", PtgEvaluation::kLegacy));
-  EXPECT_NE(encode("@A1:A2", PtgEvaluation::kLegacyArray), encode("A1:A2", PtgEvaluation::kLegacyArray));
-}
-
-// IF, CHOOSE and IFERROR carry the jump attributes Excel writes around their
-// branches: PtgAttrIf past the true branch and its goto, a PtgAttrChoose
-// table, PtgAttrIfError past the fallback, and a PtgAttrGoto after each
-// branch landing on the call token's last byte. Bytes as Excel 365 saved them.
-TEST(XlsbPtgCodec, BranchingCallsCarryExcelsJumpAttributes) {
-  const std::vector<std::uint8_t> a1 = {0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0};
-  const std::vector<std::uint8_t> ref_a1 = {0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0};
-  auto join = [](std::initializer_list<std::vector<std::uint8_t>> parts) {
-    std::vector<std::uint8_t> out;
-    for (const auto& part : parts) {
-      out.insert(out.end(), part.begin(), part.end());
-    }
-    return out;
-  };
-  EXPECT_EQ(EncodeOnSheet1("IF(A1,A1,A1)", PtgRootClass::kValue).rgce,
-            join({a1,
-                  {0x19, 0x02, 0x0B, 0x00},
-                  ref_a1,
-                  {0x19, 0x08, 0x0E, 0x00},
-                  ref_a1,
-                  {0x19, 0x08, 0x03, 0x00, 0x42, 0x03, 0x01, 0x00}}));
-  EXPECT_EQ(EncodeOnSheet1("CHOOSE(A1,A1,A1,A1,A1)", PtgRootClass::kValue).rgce,
-            join({a1,
-                  {0x19, 0x04, 0x04, 0x00, 0x0A, 0x00, 0x15, 0x00, 0x20, 0x00, 0x2B, 0x00, 0x36, 0x00},
-                  ref_a1,
-                  {0x19, 0x08, 0x24, 0x00},
-                  ref_a1,
-                  {0x19, 0x08, 0x19, 0x00},
-                  ref_a1,
-                  {0x19, 0x08, 0x0E, 0x00},
-                  ref_a1,
-                  {0x19, 0x08, 0x03, 0x00, 0x42, 0x05, 0x64, 0x00}}));
-  EXPECT_EQ(EncodeOnSheet1("IFERROR(A1,A1)", PtgRootClass::kValue).rgce,
-            join({a1, {0x19, 0x80, 0x07, 0x00}, ref_a1, {0x19, 0x08, 0x02, 0x00, 0x41, 0xE0, 0x01}}));
-  EXPECT_EQ(RoundTrip("IF(A1>0,CHOOSE(2,A1,B1),IFERROR(1/0,2))"), "IF(A1>0,CHOOSE(2,A1,B1),IFERROR(1/0,2))");
-  EXPECT_EQ(EncodeOnSheet1("IF(A1>0,1)", PtgRootClass::kValue).rgce,
-            join({a1,
-                  {0x1E, 0x00, 0x00, 0x0D, 0x19, 0x02, 0x07, 0x00, 0x1E, 0x01, 0x00, 0x19, 0x08, 0x03, 0x00, 0x42, 0x02,
-                   0x01, 0x00}}));
-}
-
-// A conditional format evaluates an operand under a parameter other than a
-// value one as an array, and everything inside it: references, names and
-// function results take array class (`AND(MONTH(H3)=MONTH(TODAY()),...)` ->
-// 0x6C / 0x61), while the root and its direct operands keep value class.
-// Bytes as Excel 365 saved typed rules anchored at their own cell; the
-// PtgAttrSemi operand, which Excel ignores, is left out of the comparison.
-TEST(XlsbPtgCodec, ConditionalFormatArrayOperandsCarryArrayClassInward) {
-  auto encode = [](const char* formula) {
-    Arena arena;
-    parser::Parser p(formula, arena);
-    parser::AstNode* root = p.parse();
-    EXPECT_NE(root, nullptr) << formula;
-    auto encoded =
-        encode_ptgs(*root, {"S"}, {}, {}, PtgRootClass::kValue, PtgBaseCell{5U, 7U}, PtgEvaluation::kConditionalFormat);
-    EXPECT_TRUE(static_cast<bool>(encoded)) << formula;
-    std::vector<std::uint8_t> rgce = encoded ? encoded.value().rgce : std::vector<std::uint8_t>{};
-    if (rgce.size() >= 4U && rgce[0] == 0x19 && rgce[1] == 0x01) {
-      rgce.erase(rgce.begin() + 2, rgce.begin() + 4);
-    }
-    return rgce;
-  };
-  const std::vector<std::uint8_t> ref_n = {0x00, 0x00, 0x00, 0x00, 0x00, 0xC0};
-  auto join = [](std::initializer_list<std::vector<std::uint8_t>> parts) {
-    std::vector<std::uint8_t> out;
-    for (const auto& part : parts) {
-      out.insert(out.end(), part.begin(), part.end());
-    }
-    return out;
-  };
-  EXPECT_EQ(
-      encode("AND(H6<WEEKDAY(TODAY()))"),
-      join({{0x19, 0x01, 0x6C}, ref_n, {0x61, 0xDD, 0x00, 0x62, 0x01, 0x46, 0x00, 0x09, 0x42, 0x01, 0x24, 0x00}}));
-  EXPECT_EQ(encode("AND(MONTH(H6)=MONTH(TODAY()),YEAR(H6)=YEAR(TODAY()))"),
-            join({{0x19, 0x01, 0x6C},
-                  ref_n,
-                  {0x61, 0x44, 0x00, 0x61, 0xDD, 0x00, 0x61, 0x44, 0x00, 0x0B, 0x6C},
-                  ref_n,
-                  {0x61, 0x45, 0x00, 0x61, 0xDD, 0x00, 0x61, 0x45, 0x00, 0x0B, 0x42, 0x02, 0x24, 0x00}}));
-  EXPECT_EQ(
-      encode("H6<WEEKDAY(TODAY())-1"),
-      join({{0x19, 0x01, 0x4C}, ref_n, {0x41, 0xDD, 0x00, 0x42, 0x01, 0x46, 0x00, 0x1E, 0x01, 0x00, 0x04, 0x09}}));
-}
-
-// A call that can return a reference keeps reference class where its
-// parameter takes one (ROWS, AREAS, SUM, ISREF) and value class in a value
-// parameter or at the root. Bytes as Excel 365 saved them.
-TEST(XlsbPtgCodec, ReferenceReturningCallsFollowTheirSlot) {
-  auto hex = [](std::string_view formula) {
-    std::string out;
-    for (const std::uint8_t b : EncodeOnSheet1(formula, PtgRootClass::kValue).rgce) {
-      char buf[4];
-      std::snprintf(buf, sizeof(buf), "%02x ", b);
-      out += buf;
-    }
-    return out;
-  };
-  const std::string offset = "19 01 00 00 24 00 00 00 00 00 c0 1e 00 00 1e 00 00 ";
-  EXPECT_EQ(hex("ROWS(OFFSET(A1,0,0))"), offset + "22 03 4e 00 41 4c 00 ");
-  EXPECT_EQ(hex("ISREF(OFFSET(A1,0,0))"), offset + "22 03 4e 00 41 69 00 ");
-  EXPECT_EQ(hex("ABS(OFFSET(A1,0,0))"), offset + "42 03 4e 00 41 18 00 ");
-  EXPECT_EQ(hex("OFFSET(A1,0,0)"), offset + "42 03 4e 00 ");
-  EXPECT_EQ(hex("SUM(INDEX(A1:C3,1,1))"),
-            "25 00 00 00 00 02 00 00 00 00 c0 02 c0 1e 01 00 1e 01 00 22 03 1d 00 19 10 00 00 ");
-  EXPECT_EQ(
-      hex("AREAS(IF(TRUE,A1,B1))"),
-      "1d 01 19 02 0b 00 24 00 00 00 00 00 c0 19 08 0e 00 24 00 00 00 00 01 c0 19 08 03 00 22 03 01 00 41 4b 00 ");
-}
-
-// A written pair of parentheses is one PtgParen after its operand, redundant
-// or not; bytes as Excel 365 saved `=AND(A1<(WEEKDAY(TODAY())))`, which
-// decodes back to the same text.
-TEST(XlsbPtgCodec, WrittenParenthesesRoundTripAsPtgParen) {
-  const std::vector<std::uint8_t> excel = {0x19, 0x01, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x41,
-                                           0xDD, 0x00, 0x42, 0x01, 0x46, 0x00, 0x15, 0x09, 0x42, 0x01, 0x24, 0x00};
-  EXPECT_EQ(EncodeOnSheet1("AND(A1<(WEEKDAY(TODAY())))", PtgRootClass::kValue).rgce, excel);
-  Arena arena;
-  auto decoded = decode_ptgs(ByteSpan{excel.data(), excel.size()}, ByteSpan{}, arena, {"Sheet1"}, {}, {}, {});
-  ASSERT_TRUE(static_cast<bool>(decoded));
-  EXPECT_EQ(parser::format_formula(*decoded.value()), "AND(A1<(WEEKDAY(TODAY())))");
-  EXPECT_EQ(RoundTrip("((1+2))*3"), "((1+2))*3");
-}
-
-TEST(XlsbPtgCodec, SumOverArea) {
-  EXPECT_EQ(RoundTrip("SUM(A1:A10)"), "SUM(A1:A10)");
-}
-
-TEST(XlsbPtgCodec, WholeColumnAndRowRefsEncodeAsSentinelAreas) {
-  EXPECT_EQ(RoundTrip("SUM(A:A)"), "SUM(A:A)");
-  EXPECT_EQ(RoundTrip("SUM(1:1)"), "SUM(1:1)");
-  EXPECT_EQ(RoundTrip("SUM($A:B)"), "SUM($A:B)");
-  EXPECT_EQ(RoundTrip("SUM(1:$2)"), "SUM(1:$2)");
-  // Bytes as Excel 365 saved them: the spanned axis is absolute, and a
-  // span of columns or rows is one area.
-  const std::vector<std::uint8_t> full_col_a = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x0F, 0x00, 0x00, 0x40, 0x00, 0x40};
-  std::vector<std::uint8_t> excel = {0x45};
-  excel.insert(excel.end(), full_col_a.begin(), full_col_a.end());
-  EXPECT_EQ(EncodeOnSheet1("A:A", PtgRootClass::kValue).rgce, excel);
-  EXPECT_EQ(EncodeOnSheet1("A:B", PtgRootClass::kValue).rgce,
-            (std::vector<std::uint8_t>{0x45, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x0F, 0x00, 0x00, 0x40, 0x01, 0x40}));
-  EXPECT_EQ(EncodeOnSheet1("SUM(1:2)", PtgRootClass::kValue).rgce,
-            (std::vector<std::uint8_t>{0x25, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0xFF, 0xBF,
-                                       0x19, 0x10, 0x00, 0x00}));
-}
-
-TEST(XlsbPtgCodec, IfWithStrings) {
-  EXPECT_EQ(RoundTrip("IF(A1>0,\"pos\",\"neg\")"), "IF(A1>0,\"pos\",\"neg\")");
-}
-
-TEST(XlsbPtgCodec, Concat) {
-  EXPECT_EQ(RoundTrip("B1&\"x\""), "B1&\"x\"");
-}
-
-TEST(XlsbPtgCodec, UnaryMinus) {
-  EXPECT_EQ(RoundTrip("-A1"), "-A1");
-}
-
-TEST(XlsbPtgCodec, PostfixPercent) {
-  EXPECT_EQ(RoundTrip("A1%"), "A1%");
-}
-
-TEST(XlsbPtgCodec, ThreeDimensionalReference) {
-  // `Sheet2!A1` resolves through the sheet-name list to a PtgRef3d.
-  const std::vector<std::string> sheets = {"Sheet1", "Sheet2"};
-  EXPECT_EQ(RoundTrip("Sheet2!A1", sheets), "Sheet2!A1");
-}
-
-TEST(XlsbPtgCodec, GenuineThreeDimensionalRangeRoundTrips) {
-  // A genuine multi-sheet range (`Sheet1:Sheet3!B2`) is hand-built here
-  // rather than parsed from text: the text parser does not yet lower
-  // `'Sheet1:Sheet3'!B2` (or an unquoted `Sheet1:Sheet3!B2`) to a `Ref3D`
-  // node, so this exercises the encoder/decoder pair -- the actual XLSB
-  // fidelity contract -- directly. `encode_ptgs` resolves the node's
-  // `(begin, end)` span through a `SheetRangeTable` built the same way
-  // the production writer builds one (`collect_ptg_sheet_ranges`), and
-  // `decode_ptgs` resolves it back through the equivalent `XlsbSheetRange`
-  // list, mirroring how a real `BrtExternSheet` record round-trips.
-  const std::vector<std::string> sheets = {"Sheet1", "Sheet2", "Sheet3"};
-  Arena arena;
-  parser::Reference cell;
-  cell.row = 1;
-  cell.col = 1;  // B2
-  parser::AstNode* node = parser::make_ref3d(arena, "Sheet1", "Sheet3", cell);
-  ASSERT_NE(node, nullptr);
-
-  const SheetRangeTable sheet_ranges = {{0, 2}};  // Sheet1 (itab 0) : Sheet3 (itab 2)
-  auto encoded = encode_ptgs(*node, sheets, sheet_ranges, {}, PtgRootClass::kValue);
-  ASSERT_TRUE(static_cast<bool>(encoded)) << (encoded ? "" : encoded.error().message);
-
-  Arena dec_arena;
-  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
-  const std::vector<XlsbSheetRange> decode_ranges = {{0, 2}};
-  auto decoded = decode_ptgs(rgce, ByteSpan{}, dec_arena, sheets, {}, decode_ranges, {});
-  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
-  EXPECT_EQ(parser::format_formula(*decoded.value()), "Sheet1:Sheet3!B2");
-}
-
-TEST(XlsbPtgCodec, GenuineThreeDimensionalRangeTailRoundTrips) {
-  // A genuine 3-D range tail (`Sheet1:Sheet3!A1:B2`) encodes as PtgArea3d
-  // (ixti + RgceArea) and decodes back to a range-tail `Ref3D`, preserving
-  // both the sheet span and the cell rectangle. The parser now lowers this
-  // form directly, so drive it through the text `RoundTrip` helper.
-  const std::vector<std::string> sheets = {"Sheet1", "Sheet2", "Sheet3"};
-  EXPECT_EQ(RoundTrip("SUM(Sheet1:Sheet3!A1:B2)", sheets), "SUM(Sheet1:Sheet3!A1:B2)");
-
-  // Also drive the encoder/decoder directly from a hand-built node to pin
-  // the PtgArea3d codec contract independent of the parser.
-  Arena arena;
-  parser::Reference a;  // A1
-  parser::Reference b;  // B2
-  b.row = 1;
-  b.col = 1;
-  parser::AstNode* node = parser::make_ref3d_range(arena, "Sheet1", "Sheet3", a, b);
-  ASSERT_NE(node, nullptr);
-  const SheetRangeTable sheet_ranges = {{0, 2}};
-  auto encoded = encode_ptgs(*node, sheets, sheet_ranges, {}, PtgRootClass::kValue);
-  ASSERT_TRUE(static_cast<bool>(encoded)) << (encoded ? "" : encoded.error().message);
-  Arena dec_arena;
-  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
-  const std::vector<XlsbSheetRange> decode_ranges = {{0, 2}};
-  auto decoded = decode_ptgs(rgce, ByteSpan{}, dec_arena, sheets, {}, decode_ranges, {});
-  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
-  EXPECT_EQ(parser::format_formula(*decoded.value()), "Sheet1:Sheet3!A1:B2");
-}
-
-TEST(XlsbPtgCodec, SingleAndMultiSheetReferencesShareOneIxtiSpace) {
-  // Once a workbook emits any `BrtExternSheet` entry, every `PtgRef3d`
-  // (single- or multi-sheet) resolves its `ixti` through that one table
-  // -- see `SheetRangeTable`'s doc comment. This pins that a formula
-  // mixing a plain single-sheet ref with a genuine 3-D range encodes
-  // and decodes both correctly against a shared table.
-  const std::vector<std::string> sheets = {"Sheet1", "Sheet2", "Sheet3"};
-  EXPECT_EQ(RoundTrip("Sheet2!A1+Sheet1!A1", sheets), "Sheet2!A1+Sheet1!A1");
-}
-
-TEST(XlsbPtgCodec, ConstantArray) {
-  EXPECT_EQ(RoundTrip("{1,2;3,4}"), "{1,2;3,4}");
-}
-
-TEST(XlsbPtgCodec, ConstantArrayNonSquareRowVector) {
-  // A 1-row, 3-column array: distinguishes which `PtgExtraArray` u32 is
-  // rows vs. cols (a square fixture can't). Encoder writes rows=1,
-  // cols=3; if the reader swapped the fields it would either reject the
-  // dimension (1x3 -> read as 3x1 needs 3 rows worth of elements, which
-  // *is* available here since count is symmetric at 3, but the element
-  // shape would transpose) or -- for this asymmetric row/col case --
-  // round-trip to `{1;2;3}` instead of `{1,2,3}`.
-  EXPECT_EQ(RoundTrip("{1,2,3}"), "{1,2,3}");
-}
-
-TEST(XlsbPtgCodec, ConstantArrayNonSquareColumnVector) {
-  // The transpose of the above: 3 rows, 1 column.
-  EXPECT_EQ(RoundTrip("{1;2;3}"), "{1;2;3}");
-}
-
-TEST(XlsbPtgCodec, ErrorLiteral) {
-  EXPECT_EQ(RoundTrip("#DIV/0!"), "#DIV/0!");
-}
-
-TEST(XlsbPtgCodec, AbsoluteReference) {
-  EXPECT_EQ(RoundTrip("$A$1"), "$A$1");
-  EXPECT_EQ(RoundTrip("$A1"), "$A1");
-  EXPECT_EQ(RoundTrip("A$1"), "A$1");
-}
-
-TEST(XlsbPtgCodec, AllComparisons) {
-  EXPECT_EQ(RoundTrip("A1<B1"), "A1<B1");
-  EXPECT_EQ(RoundTrip("A1<=B1"), "A1<=B1");
-  EXPECT_EQ(RoundTrip("A1=B1"), "A1=B1");
-  EXPECT_EQ(RoundTrip("A1>=B1"), "A1>=B1");
-  EXPECT_EQ(RoundTrip("A1>B1"), "A1>B1");
-  EXPECT_EQ(RoundTrip("A1<>B1"), "A1<>B1");
-}
-
-TEST(XlsbPtgCodec, NestedFunctions) {
-  EXPECT_EQ(RoundTrip("ROUND(SUM(A1:A3),2)"), "ROUND(SUM(A1:A3),2)");
-}
-
-TEST(XlsbPtgCodec, Post2007BuiltinsUseNativeFunctionIds) {
-  EXPECT_EQ(RoundTrip("ASC(\"Ａ\")"), "ASC(\"Ａ\")");
-  // `JIS` is the ja-JP formula-bar spelling of `DBCS`; Excel stores the
-  // call as `DBCS` in both containers and has one function id (215) for
-  // it. The codec therefore canonicalises the spelling rather than
-  // preserving it — the Writer resolves `JIS` to id 215 through the
-  // table's alias, and the Reader hands that id back as `DBCS`, which
-  // is exactly what Excel's own formula text would say.
-  EXPECT_EQ(RoundTrip("JIS(\"A\")"), "DBCS(\"A\")");
-  EXPECT_EQ(RoundTrip("DBCS(\"A\")"), "DBCS(\"A\")");
-  EXPECT_EQ(RoundTrip("EDATE(A1,1)"), "EDATE(A1,1)");
-  EXPECT_EQ(RoundTrip("EOMONTH(A1,1)"), "EOMONTH(A1,1)");
-  EXPECT_EQ(RoundTrip("WORKDAY(A1,1)"), "WORKDAY(A1,1)");
-  EXPECT_EQ(RoundTrip("NETWORKDAYS(A1,B1)"), "NETWORKDAYS(A1,B1)");
-  EXPECT_EQ(RoundTrip("IFERROR(A1,0)"), "IFERROR(A1,0)");
-  EXPECT_EQ(RoundTrip("COUNTIFS(A1,1)"), "COUNTIFS(A1,1)");
-  EXPECT_EQ(RoundTrip("SUMIFS(A1,B1,1)"), "SUMIFS(A1,B1,1)");
-  EXPECT_EQ(RoundTrip("AVERAGEIF(A1,1)"), "AVERAGEIF(A1,1)");
-  EXPECT_EQ(RoundTrip("AVERAGEIFS(A1,B1,1)"), "AVERAGEIFS(A1,B1,1)");
-}
-
-TEST(XlsbPtgCodec, PowerAndDivide) {
-  EXPECT_EQ(RoundTrip("A1^2/B1"), "A1^2/B1");
-}
-
-TEST(XlsbPtgCodec, DecoderRejectsTruncatedStream) {
-  // PtgInt (0x1E) needs a 2-byte operand; supply only the tag.
-  Arena arena;
-  const std::vector<std::uint8_t> bytes = {0x1E};
-  ByteSpan span{bytes.data(), bytes.size()};
-  auto decoded = decode_ptgs(span, ByteSpan{}, arena, {}, {}, {}, {});
-  ASSERT_FALSE(static_cast<bool>(decoded));
-  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbRecordTruncated);
-}
-
-TEST(XlsbPtgCodec, DecoderRejectsUnknownPtg) {
-  // 0x18 (PtgElfLel) is marked Unsupported in the dispatch table.
-  Arena arena;
-  const std::vector<std::uint8_t> bytes = {0x18, 0x00};
-  ByteSpan span{bytes.data(), bytes.size()};
-  auto decoded = decode_ptgs(span, ByteSpan{}, arena, {}, {}, {}, {});
-  ASSERT_FALSE(static_cast<bool>(decoded));
-  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbUnsupportedPtg);
-}
-
-TEST(XlsbPtgCodec, PtgArrayDecodesRowsBeforeColsFromRawWireBytes) {
-  // Raw-byte decode of a genuinely non-square (1 row x 3 cols) array
-  // constant, independent of the encoder. `PtgExtraArray`
-  // ([MS-XLSB] 2.5.97.41) is documented as `DRw` (row count) followed
-  // by `DCol` (col count), each a plain u32 -- not a class-marked or
-  // otherwise reordered pair, and the elements follow row-outer /
-  // col-inner. A square real-Excel fixture cannot settle either point on
-  // its own, so this test pins them from the wire bytes. If the reader
-  // swapped the two u32 fields, this byte layout (rows=1, cols=3) would
-  // either be rejected (3 rows needs 3x as many trailing elements) or,
-  // for a same-total-count swap, transpose to `{1;2;3}`.
-  const std::vector<std::uint8_t> rgce = {
-      0x60,                                                  // PtgArray (array-class)
-      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // 14-byte placeholder
-      0x00, 0x00, 0x00, 0x00, 0x00,
-  };
-  std::vector<std::uint8_t> rgcb;
-  emit_u32(rgcb, 1U);  // DRw: rows = 1
-  emit_u32(rgcb, 3U);  // DCol: cols = 3
-  for (const double v : {1.0, 2.0, 3.0}) {
-    rgcb.push_back(0x00);  // SerAr numeric tag
-    std::uint8_t bytes[8];
-    std::memcpy(bytes, &v, sizeof(v));
-    rgcb.insert(rgcb.end(), bytes, bytes + 8);
-  }
-  Arena arena;
-  auto decoded =
-      decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, ByteSpan{rgcb.data(), rgcb.size()}, arena, {}, {}, {}, {});
-  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
-  EXPECT_EQ(parser::format_formula(*decoded.value()), "{1,2,3}");
-}
-
-// Array constants of text, booleans and errors, bytes as Excel 365 saved
-// them. The token's last four bytes are memory Excel leaves uninitialised.
-TEST(XlsbPtgCodec, PtgArrayElementsMatchExcelBytes) {
-  struct Case {
-    const char* formula;
-    std::vector<std::uint8_t> rgce_head;  // opcode + the 10 bytes Excel sets
-    std::vector<std::uint8_t> rgcb;
-  };
-  const Case cases[] = {
-      {"{\"a\",\"b\";\"c\",\"d\"}",
-       {0x40, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
-       {0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x61, 0x00, 0x01,
-        0x01, 0x00, 0x62, 0x00, 0x01, 0x01, 0x00, 0x63, 0x00, 0x01, 0x01, 0x00, 0x64, 0x00}},
-      {"{TRUE;FALSE}",
-       {0x40, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
-       {0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0x01, 0x02, 0x00}},
-      {"{1;#N/A;\"z\"}",
-       {0x40, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
-       {0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0xF0, 0x3F, 0x04, 0x2A, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x7A, 0x00}},
-  };
-  for (const Case& c : cases) {
-    const EncodedFormula encoded = EncodeOnSheet1(c.formula, PtgRootClass::kValue);
-    ASSERT_EQ(encoded.rgce.size(), 15U) << c.formula;
-    EXPECT_EQ(std::vector<std::uint8_t>(encoded.rgce.begin(), encoded.rgce.begin() + 11), c.rgce_head) << c.formula;
-    EXPECT_EQ(encoded.rgcb, c.rgcb) << c.formula;
-    EXPECT_EQ(RoundTrip(c.formula), c.formula);
-  }
-}
-
-TEST(XlsbPtgCodec, PtgRefRowAtGridBoundIsRecordCorrupt) {
-  // PtgRef (0x24) with row == Sheet::kMaxRows, one past the last valid
-  // row (1048575). A crafted/corrupt row must be rejected at the Ref
-  // node construction site rather than silently wrapping in a later
-  // A1-text re-parse (`format_a1` would otherwise print `A1048577`).
-  const std::vector<std::uint8_t> rgce = {
-      0x24,                    // PtgRef
-      0x00, 0x00, 0x10, 0x00,  // row = 1048576 (u32 LE) == Sheet::kMaxRows
-      0x00, 0x00,              // col = 0, absolute
-  };
-  Arena arena;
-  auto decoded = decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, {}, arena, {}, {}, {}, {});
-  ASSERT_FALSE(static_cast<bool>(decoded));
-  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
-}
-
-TEST(XlsbPtgCodec, PtgAreaReversedCornersIsRecordCorrupt) {
-  // PtgArea (0x25) with row1 > row2: both corners are individually
-  // in-domain, but the range is not normalized.
-  const std::vector<std::uint8_t> rgce = {
-      0x25,                    // PtgArea
-      0x05, 0x00, 0x00, 0x00,  // row1 = 5
-      0x01, 0x00, 0x00, 0x00,  // row2 = 1 (< row1)
-      0x00, 0x00,              // col1 = 0, absolute
-      0x00, 0x00,              // col2 = 0, absolute
-  };
-  Arena arena;
-  auto decoded = decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, {}, arena, {}, {}, {}, {});
-  ASSERT_FALSE(static_cast<bool>(decoded));
-  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
-}
-
-TEST(XlsbPtgCodec, PtgRefErrWithSentinelCoordinatesStillDecodesAsRef) {
-  // PtgRefErr (0x2A) carries a `#REF!`-form single-cell reference; real
-  // Excel files encode the dead payload with the maximum sentinel
-  // row/col. Because this Ptg kind never materializes a `Reference`
-  // (only `ErrorCode::Ref`), the domain check at Ref/Area construction
-  // sites must not reject it.
-  const std::vector<std::uint8_t> rgce = {
-      0x2A,                    // PtgRefErr
-      0xFF, 0xFF, 0xFF, 0xFF,  // sentinel row payload (discarded)
-      0xFF, 0xFF,              // sentinel col payload (discarded)
-  };
-  Arena arena;
-  auto decoded = decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, {}, arena, {}, {}, {}, {});
-  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
-  EXPECT_EQ(parser::format_formula(*decoded.value()), "#REF!");
-}
-
-TEST(XlsbPtgCodec, DecoderKeepsParenTokenInTheText) {
-  // PtgInt(1), PtgInt(2), PtgAdd, PtgParen: the written parentheses Excel
-  // shows, which leave the value stack unchanged.
-  const std::vector<std::uint8_t> rgce = {0x1E, 0x01, 0x00, 0x1E, 0x02, 0x00, 0x03, 0x15};
-  Arena arena;
-  ByteSpan main{rgce.data(), rgce.size()};
-  ByteSpan extra{nullptr, 0};
-  auto decoded = decode_ptgs(main, extra, arena, {}, {}, {}, {});
-  ASSERT_TRUE(static_cast<bool>(decoded));
-  EXPECT_EQ(parser::format_formula(*decoded.value()), "(1+2)");
-}
-
-TEST(XlsbPtgCodec, DecoderConsumesMemoryCachePtgsWithoutChangingExpression) {
-  // Each memory marker precedes an ordinary PtgInt(1) expression. PtgMemArea
-  // additionally has a zero-range PtgExtraMem cache in RgbExtra.
-  const std::vector<std::uint8_t> mem_area = {0x26, 0, 0, 0, 0, 3, 0, 0x1E, 1, 0};
-  const std::vector<std::uint8_t> mem_err = {0x27, 0x17, 0, 0, 0, 3, 0, 0x1E, 1, 0};
-  const std::vector<std::uint8_t> mem_no_mem = {0x28, 0, 0, 0, 0, 3, 0, 0x1E, 1, 0};
-  const std::vector<std::uint8_t> mem_func = {0x29, 3, 0, 0x1E, 1, 0};
-  const std::vector<std::uint8_t> extra_mem = {0, 0, 0, 0};
-
-  const auto expect_expression = [&extra_mem](const std::vector<std::uint8_t>& rgce, bool has_extra_mem) {
-    Arena arena;
-    ByteSpan main{rgce.data(), rgce.size()};
-    ByteSpan extra = has_extra_mem ? ByteSpan{extra_mem.data(), extra_mem.size()} : ByteSpan{};
-    auto decoded = decode_ptgs(main, extra, arena, {}, {}, {}, {});
-    ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
-    EXPECT_EQ(parser::format_formula(*decoded.value()), "1");
-  };
-  expect_expression(mem_area, true);
-  expect_expression(mem_err, false);
-  expect_expression(mem_no_mem, false);
-  expect_expression(mem_func, false);
-}
-
-TEST(XlsbPtgCodec, DecoderRejectsTruncatedMemAreaExtraCache) {
-  const std::vector<std::uint8_t> rgce = {0x26, 0, 0, 0, 0, 3, 0, 0x1E, 1, 0};
-  // PtgExtraMem declares one 16-byte range but supplies none.
-  const std::vector<std::uint8_t> extra = {1, 0, 0, 0};
-  Arena arena;
-  auto decoded =
-      decode_ptgs(ByteSpan{rgce.data(), rgce.size()}, ByteSpan{extra.data(), extra.size()}, arena, {}, {}, {}, {});
-  ASSERT_FALSE(static_cast<bool>(decoded));
-  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbRecordTruncated);
-}
-
-TEST(XlsbPtgCodec, DecoderRejectsAstDeeperThanSharedLimit) {
-  Arena enc_arena;
-  parser::AstNode* root = parser::make_literal(enc_arena, Value::number(1));
-  for (std::uint32_t depth = 1; depth <= parser::kMaxFormulaAstDepth; ++depth) {
-    root = parser::make_unary_op(enc_arena, parser::UnaryOp::Plus, root);
-  }
-  ASSERT_NE(root, nullptr);
-  auto encoded = encode_ptgs(*root, {}, {}, {}, PtgRootClass::kValue);
-  ASSERT_TRUE(static_cast<bool>(encoded));
-
-  Arena dec_arena;
-  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
-  ByteSpan rgcb{encoded.value().rgcb.data(), encoded.value().rgcb.size()};
-  auto decoded = decode_ptgs(rgce, rgcb, dec_arena, {}, {}, {}, {});
-  ASSERT_FALSE(static_cast<bool>(decoded));
-  EXPECT_EQ(decoded.error().code, FormulonErrorCode::kIoXlsbCorrupt);
-}
-
-TEST(XlsbPtgCodec, EncoderUsesExcelClassesForReferenceArgumentsAndFunctionResults) {
-  Arena arena;
-  parser::Parser p("SUM(A1:A2,1)", arena);
-  parser::AstNode* root = p.parse();
-  ASSERT_NE(root, nullptr);
-  ASSERT_TRUE(p.errors().empty());
-  auto encoded = encode_ptgs(*root, {}, {}, {}, PtgRootClass::kValue);
-  ASSERT_TRUE(static_cast<bool>(encoded)) << (encoded ? "" : encoded.error().message);
-
-  // Real Excel writes the range argument as reference-class PtgArea (0x25)
-  // and the SUM result as value-class PtgFuncVar (0x42). Array-class 0x65
-  // and reference-class 0x22 respectively make Excel repair the worksheet.
-  ASSERT_GE(encoded.value().rgce.size(), 4U);
-  EXPECT_EQ(encoded.value().rgce.front(), 0x25U);
-  EXPECT_EQ(encoded.value().rgce[encoded.value().rgce.size() - 4U], 0x42U);
-}
-
-TEST(XlsbPtgCodec, EncoderRejectsUnregisteredDefinedName) {
-  // A `NameRef` only lowers to `PtgName` when the caller's `name_table`
-  // (built from `collect_ptg_names` across the whole workbook) already
-  // carries an `ilbl` for it; an empty table means "not registered".
-  Arena arena;
-  parser::Parser p("MyName", arena);
-  parser::AstNode* root = p.parse();
-  ASSERT_NE(root, nullptr);
-  auto encoded = encode_ptgs(*root, {}, {}, {}, PtgRootClass::kValue);
-  ASSERT_FALSE(static_cast<bool>(encoded));
-  EXPECT_EQ(encoded.error().code, FormulonErrorCode::kIoXlsbUnsupportedPtg);
-}
-
-TEST(XlsbPtgCodec, EncoderLowersRegisteredDefinedName) {
-  Arena arena;
-  parser::Parser p("MyName", arena);
-  parser::AstNode* root = p.parse();
-  ASSERT_NE(root, nullptr);
-  const NameTable names = {{"MyName", 1U}};
-  auto encoded = encode_ptgs(*root, {}, {}, names, PtgRootClass::kValue);
-  ASSERT_TRUE(static_cast<bool>(encoded)) << (encoded ? "" : encoded.error().message);
-
-  Arena dec_arena;
-  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
-  const std::vector<XlsbName> name_table = {{-1, "MyName", false}};
-  auto decoded = decode_ptgs(rgce, ByteSpan{}, dec_arena, {}, name_table, {}, {});
-  ASSERT_TRUE(static_cast<bool>(decoded)) << (decoded ? "" : decoded.error().message);
-  EXPECT_EQ(parser::format_formula(*decoded.value()), "MyName");
-}
-
 }  // namespace
 }  // namespace xlsb
 }  // namespace io
diff --git a/tests/unit/io/xlsb/ptg_codec_test_helpers.h b/tests/unit/io/xlsb/ptg_codec_test_helpers.h
new file mode 100644
index 000000000..266339c39
--- /dev/null
+++ b/tests/unit/io/xlsb/ptg_codec_test_helpers.h
@@ -0,0 +1,91 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <unordered_set>
+#include <vector>
+
+#include "eval/tree_walker.h"
+#include "gtest/gtest.h"
+#include "io/xlsb/ptg_reader.h"
+#include "io/xlsb/ptg_writer.h"
+#include "parser/ast_format.h"
+#include "parser/parser.h"
+#include "utils/arena.h"
+
+namespace formulon::io::xlsb::ptg_codec_test_support {
+
+// Parses `formula` (without leading `=`), encodes to Ptg, decodes back,
+// and returns the re-formatted formula text. `sheet_names` resolves a
+// qualified reference's sheet to its 0-based index on both sides; the
+// `SheetRangeTable` / `XlsbSheetRange` list that actually carries the
+// `ixti` numbering is built here (via `collect_ptg_sheet_ranges` on the
+// encode side, mirrored 1:1 into `XlsbSheetRange`s for decode) so a
+// single-sheet qualified reference and a genuine 3-D range share one
+// `ixti` space exactly as the production writer does.
+inline std::string RoundTrip(std::string_view formula, const std::vector<std::string>& sheet_names = {}) {
+  Arena enc_arena;
+  parser::Parser p(formula, enc_arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr);
+  EXPECT_TRUE(p.errors().empty()) << "parse errors for: " << formula;
+
+  SheetRangeTable sheet_ranges;
+  std::unordered_set<std::uint64_t> seen;
+  collect_ptg_sheet_ranges(*root, sheet_names, sheet_ranges, seen);
+
+  auto encoded = encode_ptgs(*root, sheet_names, sheet_ranges, {}, PtgRootClass::kValue);
+  EXPECT_TRUE(static_cast<bool>(encoded))
+      << "encode failed for: " << formula << " | " << (encoded ? "" : encoded.error().message);
+  if (!encoded) {
+    return "<encode-failed>";
+  }
+
+  std::vector<XlsbSheetRange> decode_ranges;
+  decode_ranges.reserve(sheet_ranges.size());
+  for (const auto& [itab_first, itab_last] : sheet_ranges) {
+    decode_ranges.push_back(XlsbSheetRange{itab_first, itab_last});
+  }
+
+  Arena dec_arena;
+  ByteSpan rgce{encoded.value().rgce.data(), encoded.value().rgce.size()};
+  ByteSpan rgcb{encoded.value().rgcb.data(), encoded.value().rgcb.size()};
+  auto decoded = decode_ptgs(rgce, rgcb, dec_arena, sheet_names, {}, decode_ranges, {});
+  EXPECT_TRUE(static_cast<bool>(decoded))
+      << "decode failed for: " << formula << " | " << (decoded ? "" : decoded.error().message);
+  if (!decoded) {
+    return "<decode-failed>";
+  }
+  return parser::format_formula(*decoded.value());
+}
+inline EncodedFormula EncodeOnSheet1(std::string_view formula, PtgRootClass root_class) {
+  const std::vector<std::string> sheets = {"Sheet1"};
+  Arena arena;
+  parser::Parser p(formula, arena);
+  parser::AstNode* root = p.parse();
+  EXPECT_NE(root, nullptr) << formula;
+  EXPECT_TRUE(p.errors().empty()) << formula;
+  if (root == nullptr) {
+    return {};
+  }
+  SheetRangeTable ranges;
+  std::unordered_set<std::uint64_t> seen;
+  collect_ptg_sheet_ranges(*root, sheets, ranges, seen);
+  // A cell formula is encoded as typed into Excel 365: with the dynamic-array
+  // mark exactly where Excel gives it one.
+  const PtgEvaluation evaluation =
+      root_class == PtgRootClass::kReference || formula_is_dynamic_array(*root, NameShapes())
+          ? PtgEvaluation::kDynamicArray
+          : PtgEvaluation::kLegacy;
+  auto encoded = encode_ptgs(*root, sheets, ranges, {}, root_class, std::nullopt, evaluation);
+  EXPECT_TRUE(static_cast<bool>(encoded)) << formula << " | " << (encoded ? "" : encoded.error().message);
+  return encoded ? encoded.value() : EncodedFormula{};
+}
+
+// Bytes as Excel 365 saved each formula. A
+// union or intersection of plain references in a cell sits behind the memory
+// token carrying Excel's precomputed result; `PtgMemArea`'s leading four
+
+}  // namespace formulon::io::xlsb::ptg_codec_test_support
diff --git a/tests/unit/io/xlsb/reader_formula_test.cpp b/tests/unit/io/xlsb/reader_formula_test.cpp
new file mode 100644
index 000000000..901622066
--- /dev/null
+++ b/tests/unit/io/xlsb/reader_formula_test.cpp
@@ -0,0 +1,179 @@
+// In-memory XLSB reader tests grouped by cells, formulas, validation, and passthrough.
+
+#include <array>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "gtest/gtest.h"
+#include "io/xlsb/reader.h"
+#include "miniz.h"
+#include "reader_test_helpers.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+using namespace reader_test_support;
+TEST(XlsbReader, DecodesFormulaAndPreservesCachedValue) {
+  // rgce = `PtgInt 5` (`=5`): 0x1E 0x05 0x00.
+  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinFmlaNum(5.0, rgce)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+
+  const Cell* c = result.value().workbook.sheet(0).cell_at(0, 0);
+  ASSERT_NE(c, nullptr);
+  // The real formula text is decoded from the Ptg stream.
+  EXPECT_EQ(c->formula_text, "=5");
+  // The cached value is preserved.
+  ASSERT_TRUE(c->cached_value.is_number());
+  EXPECT_EQ(c->cached_value.as_number(), 5.0);
+}
+TEST(XlsbReader, UndecodableFormulaPreservesCachedValueWithoutFakeFormula) {
+  // rgce = `PtgName` (0x23) + a 4-byte name index. PtgName is not in the
+  // supported common-token set, so the decode fails and the reader must
+  // preserve the cached value and store NO formula (never a fake one
+  // that would recalc to #NAME?).
+  const std::vector<std::uint8_t> rgce = {0x23, 0x01, 0x00, 0x00, 0x00};
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinFmlaNum(42.0, rgce)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+
+  const Cell* c = result.value().workbook.sheet(0).cell_at(0, 0);
+  ASSERT_NE(c, nullptr);
+  // No fabricated formula.
+  EXPECT_TRUE(c->formula_text.empty());
+  // Cached value preserved so the cell still shows the right number.
+  ASSERT_TRUE(c->cached_value.is_number());
+  EXPECT_EQ(c->cached_value.as_number(), 42.0);
+  EXPECT_EQ(result.value().undecoded_formula_count, 1U);
+  EXPECT_EQ(result.value().undecoded_defined_name_count, 0U);
+}
+TEST(XlsbReader, ExternalBookNameInCellFormulaKeepsCachedValueAndCounts) {
+  // rgce = `PtgNameX` (0x39) + ixti (u16) + name index (u32): a defined
+  // name owned by another workbook. Resolving it needs the supporting-
+  // book and external-name tables, which this reader does not decode, so
+  // the token stays explicitly unsupported. Reusing the index against
+  // this workbook's own name table would silently retarget the formula
+  // at a different name, so the cell must instead fall back to the same
+  // contract an undecodable stream gets: cached value kept, no formula,
+  // one diagnostic counted.
+  const std::vector<std::uint8_t> rgce = {0x39, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00};
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinFmlaNum(7.25, rgce)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+
+  const Cell* c = result.value().workbook.sheet(0).cell_at(0, 0);
+  ASSERT_NE(c, nullptr);
+  EXPECT_TRUE(c->formula_text.empty());
+  ASSERT_TRUE(c->cached_value.is_number());
+  EXPECT_EQ(c->cached_value.as_number(), 7.25);
+  EXPECT_EQ(result.value().undecoded_formula_count, 1U);
+  EXPECT_EQ(result.value().undecoded_defined_name_count, 0U);
+}
+TEST(XlsbReader, DecodableDefinedNameRegistersAndCountsNothing) {
+  // Positive control for the record builder the next test relies on: a
+  // `BrtName` whose rgce is `PtgInt 5` must reach the workbook intact,
+  // so a zero counter there means "nothing was undecodable" rather than
+  // "no name record was ever parsed".
+  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin({NameRecord("Rate", rgce)})});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+
+  const std::vector<DefinedName>& names = result.value().workbook.defined_names();
+  ASSERT_EQ(names.size(), 1U);
+  EXPECT_EQ(names[0].name, "Rate");
+  EXPECT_EQ(names[0].formula, "5");
+  EXPECT_EQ(names[0].local_sheet_id, -1);
+  EXPECT_EQ(result.value().undecoded_defined_name_count, 0U);
+}
+TEST(XlsbReader, DefinedNameCommentSurvivesDecode) {
+  // The Name Manager comment is the trailing `BrtName` string after
+  // `rgce`/`rgcb`; a reader that stops at the formula body (or
+  // misreads `cb`) never reaches it.
+  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin({NameRecord("Rate", rgce, "The annual interest rate")})});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+
+  const std::vector<DefinedName>& names = result.value().workbook.defined_names();
+  ASSERT_EQ(names.size(), 1U);
+  EXPECT_EQ(names[0].comment, "The annual interest rate");
+}
+TEST(XlsbReader, ExternalBookNameInDefinedNameIsSkippedAndCounted) {
+  // Same unsupported token, this time as a defined name's own body. The
+  // name is dropped rather than registered with a fabricated formula,
+  // and the read still succeeds so one external reference cannot cost
+  // the caller the whole workbook.
+  const std::vector<std::uint8_t> rgce = {0x39, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00};
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin({NameRecord("ExtRate", rgce)})});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+
+  EXPECT_TRUE(result.value().workbook.defined_names().empty());
+  EXPECT_EQ(result.value().undecoded_defined_name_count, 1U);
+  EXPECT_EQ(result.value().undecoded_formula_count, 0U);
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/reader_passthrough_test.cpp b/tests/unit/io/xlsb/reader_passthrough_test.cpp
new file mode 100644
index 000000000..1c3651b6a
--- /dev/null
+++ b/tests/unit/io/xlsb/reader_passthrough_test.cpp
@@ -0,0 +1,89 @@
+// In-memory XLSB reader tests grouped by cells, formulas, validation, and passthrough.
+
+#include <array>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "gtest/gtest.h"
+#include "io/xlsb/reader.h"
+#include "miniz.h"
+#include "reader_test_helpers.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+using namespace reader_test_support;
+TEST(XlsbReader, DefaultTypedPartsAreCapturedAsPassthrough) {
+  std::string content_types(
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
+      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">"
+      "<Default Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>"
+      "<Default Extension=\"bin\" ContentType=\"application/vnd.ms-excel.sheet.binary.macroEnabled.main\"/>"
+      "<Default Extension=\"png\" ContentType=\"image/png\"/>"
+      "<Override PartName=\"/xl/workbook.bin\" "
+      "ContentType=\"application/vnd.ms-excel.sheet.binary.macroEnabled.main\"/>"
+      "<Override PartName=\"/xl/worksheets/sheet1.bin\" "
+      "ContentType=\"application/vnd.ms-excel.binIndexWs\"/>"
+      "<Override PartName=\"/xl/worksheets/sheet2.bin\" "
+      "ContentType=\"application/vnd.ms-excel.binIndexWs\"/>"
+      "</Types>");
+
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(content_types)});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(2.0)});
+  // Typed by the `png` Default rather than an Override: the passthrough
+  // sweep never sees it.
+  parts.push_back({"xl/media/image1.png", StringToBytes("\x89PNG\r\n\x1a\n")});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+
+  EXPECT_EQ(result.value().dropped_part_count, 0U);
+  bool saw_png = false;
+  for (const PassthroughPart& part : result.value().workbook.passthrough_parts()) {
+    if (part.path == "xl/media/image1.png") {
+      saw_png = true;
+      EXPECT_TRUE(part.content_type.empty());
+      EXPECT_EQ(part.bytes, StringToBytes("\x89PNG\r\n\x1a\n"));
+    }
+  }
+  EXPECT_TRUE(saw_png);
+  ASSERT_EQ(result.value().workbook.default_content_types().size(), 3U);
+}
+TEST(XlsbReader, FullyModelledPackageReportsNoDroppedParts) {
+  // Every entry is either consumed by the reader or captured as an
+  // Override passthrough, so a lossless package must not raise the flag.
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(123.5)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinIsst(0)});
+  parts.push_back({"xl/sharedStrings.bin", SharedStringsBin("hello world")});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+  EXPECT_EQ(result.value().dropped_part_count, 0U);
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/reader_test.cpp b/tests/unit/io/xlsb/reader_test.cpp
index ed9fdc93a..8f2673c49 100644
--- a/tests/unit/io/xlsb/reader_test.cpp
+++ b/tests/unit/io/xlsb/reader_test.cpp
@@ -1,8 +1,4 @@
-//
-// Unit tests for the MS-XLSB read pipeline skeleton. The tests
-// hand-craft a minimal `.xlsb` package in memory (no committed binary
-// fixtures) and assert the reader extracts sheet names + cell values
-// correctly. A full corpus arrives in a later bundle.
+// In-memory XLSB reader tests grouped by cells, formulas, validation, and passthrough.
 
 #include "io/xlsb/reader.h"
 
@@ -17,6 +13,7 @@
 #include "defined_name.h"
 #include "gtest/gtest.h"
 #include "miniz.h"
+#include "reader_test_helpers.h"
 #include "sheet.h"
 #include "utils/error.h"
 #include "value.h"
@@ -26,484 +23,7 @@ namespace formulon {
 namespace io {
 namespace xlsb {
 namespace {
-
-io::ByteSpan SpanOf(const std::vector<std::uint8_t>& v) {
-  return io::ByteSpan{v.data(), v.size()};
-}
-
-// ---------------------------------------------------------------------------
-// Tiny XLSB record-stream builders. Mirrors the framing in
-// `io/xlsb/record.{h,cpp}` (1-/2-byte type, 1..4-byte size, payload) so
-// the tests can construct synthetic parts without dragging in the
-// writer (which lands in Bundle 4.2).
-// ---------------------------------------------------------------------------
-
-void AppendVarInt(std::vector<std::uint8_t>& out, std::uint32_t v, std::size_t max_bytes) {
-  for (std::size_t i = 0; i < max_bytes; ++i) {
-    const std::uint8_t byte = static_cast<std::uint8_t>(v & 0x7F);
-    v >>= 7;
-    if (v == 0) {
-      out.push_back(byte);
-      return;
-    }
-    out.push_back(static_cast<std::uint8_t>(byte | 0x80));
-  }
-  // If we're here the caller asked for too few bytes; fall through.
-}
-
-void AppendRecord(std::vector<std::uint8_t>& out, std::uint16_t type, const std::vector<std::uint8_t>& payload) {
-  AppendVarInt(out, type, /*max_bytes=*/2);
-  AppendVarInt(out, static_cast<std::uint32_t>(payload.size()), /*max_bytes=*/4);
-  out.insert(out.end(), payload.begin(), payload.end());
-}
-
-void AppendU8(std::vector<std::uint8_t>& out, std::uint8_t v) {
-  out.push_back(v);
-}
-
-void AppendU32(std::vector<std::uint8_t>& out, std::uint32_t v) {
-  out.push_back(static_cast<std::uint8_t>(v & 0xFFU));
-  out.push_back(static_cast<std::uint8_t>((v >> 8) & 0xFFU));
-  out.push_back(static_cast<std::uint8_t>((v >> 16) & 0xFFU));
-  out.push_back(static_cast<std::uint8_t>((v >> 24) & 0xFFU));
-}
-
-void AppendDouble(std::vector<std::uint8_t>& out, double v) {
-  std::uint64_t bits = 0;
-  std::memcpy(&bits, &v, sizeof(v));
-  AppendU32(out, static_cast<std::uint32_t>(bits & 0xFFFFFFFFU));
-  AppendU32(out, static_cast<std::uint32_t>((bits >> 32) & 0xFFFFFFFFU));
-}
-
-/// Encodes an ASCII string as XLWideString (cch + UCS-2 little-endian).
-void AppendXLWideString(std::vector<std::uint8_t>& out, std::string_view s) {
-  AppendU32(out, static_cast<std::uint32_t>(s.size()));
-  for (char c : s) {
-    out.push_back(static_cast<std::uint8_t>(c));
-    out.push_back(0);
-  }
-}
-
-/// XLNullableWideString. Empty / null both encode as the 0xFFFFFFFF sentinel.
-void AppendXLNullableWideString(std::vector<std::uint8_t>& out, std::string_view s) {
-  if (s.empty()) {
-    AppendU32(out, 0xFFFFFFFFU);
-    return;
-  }
-  AppendXLWideString(out, s);
-}
-
-// ---------------------------------------------------------------------------
-// Synthetic .xlsb part builders.
-// ---------------------------------------------------------------------------
-
-std::string ContentTypesXml() {
-  return std::string(
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
-      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">"
-      "<Default Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>"
-      "<Default Extension=\"bin\" ContentType=\"application/vnd.ms-excel.sheet.binary.macroEnabled.main\"/>"
-      "<Override PartName=\"/xl/workbook.bin\" "
-      "ContentType=\"application/vnd.ms-excel.sheet.binary.macroEnabled.main\"/>"
-      "<Override PartName=\"/xl/worksheets/sheet1.bin\" "
-      "ContentType=\"application/vnd.ms-excel.binIndexWs\"/>"
-      "<Override PartName=\"/xl/worksheets/sheet2.bin\" "
-      "ContentType=\"application/vnd.ms-excel.binIndexWs\"/>"
-      "<Override PartName=\"/xl/sharedStrings.bin\" "
-      "ContentType=\"application/vnd.ms-excel.sharedStrings\"/>"
-      "</Types>");
-}
-
-std::string PackageRelsXml() {
-  return std::string(
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
-      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
-      "<Relationship Id=\"rId1\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" "
-      "Target=\"xl/workbook.bin\"/>"
-      "</Relationships>");
-}
-
-std::string WorkbookRelsXml() {
-  return std::string(
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
-      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
-      "<Relationship Id=\"rIdSheet1\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
-      "Target=\"worksheets/sheet1.bin\"/>"
-      "<Relationship Id=\"rIdSheet2\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
-      "Target=\"worksheets/sheet2.bin\"/>"
-      "<Relationship Id=\"rIdSst\" "
-      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings\" "
-      "Target=\"sharedStrings.bin\"/>"
-      "</Relationships>");
-}
-
-/// Builds one `BrtName` record body carrying `name` at workbook scope
-/// with `rgce` as its formula and `comment` as the trailing Name
-/// Manager comment string (empty encodes the real-Excel null
-/// `XLNullableWideString` sentinel). Emits exactly the byte shape a real
-/// Excel-365-produced `BrtName` for a plain (non-placeholder) defined
-/// name carries: flags + 3 reserved + itab + cch + UTF-16LE name + cce +
-/// rgce + cb (always 0 here -- no array-constant `rgcb`) + the one
-/// trailing comment string. Verified against `xlsb_fidelity_base.xlsb`'s
-/// own "Rate" `BrtName` record byte-for-byte.
-std::vector<std::uint8_t> NameRecord(std::string_view name, const std::vector<std::uint8_t>& rgce,
-                                     std::string_view comment = {}) {
-  std::vector<std::uint8_t> p;
-  p.push_back(0);  // flags[0] — fHidden clear.
-  p.push_back(0);  // flags[1]
-  p.push_back(0);  // reserved
-  p.push_back(0);
-  p.push_back(0);
-  AppendU32(p, 0xFFFFFFFFU);  // itab == -1: workbook scope.
-  AppendU32(p, static_cast<std::uint32_t>(name.size()));
-  for (char c : name) {
-    p.push_back(static_cast<std::uint8_t>(c));
-    p.push_back(0);
-  }
-  AppendU32(p, static_cast<std::uint32_t>(rgce.size()));
-  p.insert(p.end(), rgce.begin(), rgce.end());
-  AppendU32(p, 0U);  // cb: no rgcb.
-  AppendXLNullableWideString(p, comment);
-  return p;
-}
-
-/// Builds `xl/workbook.bin` containing two BrtBundleSh entries
-/// pointing at rIdSheet1 / rIdSheet2. `name_records` are emitted as
-/// `BrtName` records after the sheet bundle, which is where Excel puts
-/// them and where both name passes expect to find them.
-std::vector<std::uint8_t> WorkbookBin(const std::vector<std::vector<std::uint8_t>>& name_records = {}) {
-  std::vector<std::uint8_t> body;
-
-  // BrtBeginBook (131): empty payload.
-  AppendRecord(body, 131, {});
-
-  // BrtBeginBundleShs (143).
-  AppendRecord(body, 143, {});
-
-  // BrtBundleSh (156) #1 = "Alpha"
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, 0);  // hsState (visible)
-    AppendU32(p, 1);  // iTabID
-    AppendXLNullableWideString(p, "rIdSheet1");
-    AppendXLWideString(p, "Alpha");
-    AppendRecord(body, 156, p);
-  }
-  // BrtBundleSh (156) #2 = "Beta"
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, 0);
-    AppendU32(p, 2);
-    AppendXLNullableWideString(p, "rIdSheet2");
-    AppendXLWideString(p, "Beta");
-    AppendRecord(body, 156, p);
-  }
-
-  AppendRecord(body, 144, {});  // BrtEndBundleShs
-
-  for (const std::vector<std::uint8_t>& rec : name_records) {
-    AppendRecord(body, 39, rec);  // BrtName
-  }
-
-  AppendRecord(body, 132, {});  // BrtEndBook
-  return body;
-}
-
-/// Builds a sheet with a single BrtCellReal at (`row`, `col`) with value
-/// `cell_value`. `row` / `col` default to A1 but are overridable so the
-/// bounds-validation tests can inject out-of-range indices.
-std::vector<std::uint8_t> SheetBinReal(double cell_value, std::uint32_t row = 0, std::uint32_t col = 0) {
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 129, {});  // BrtBeginSheet
-  AppendRecord(body, 145, {});  // BrtBeginSheetData
-
-  // BrtRowHdr (0): just the row index, plus 18 bytes of reserved
-  // metadata that the skeleton skips. We supply only the first u32 —
-  // the reader reads `current_row` from byte 0..3 and stops there
-  // because the rest of the BrtRowHdr payload is not consumed.
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, row);  // row index
-    AppendRecord(body, 0, p);
-  }
-
-  // BrtCellReal (5): cell-header (col, style3, ph1) + 8-byte double.
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, col);  // column
-    AppendU8(p, 0);     // style[0]
-    AppendU8(p, 0);     // style[1]
-    AppendU8(p, 0);     // style[2]
-    AppendU8(p, 0);     // fPhShow
-    AppendDouble(p, cell_value);
-    AppendRecord(body, 5, p);
-  }
-
-  AppendRecord(body, 146, {});  // BrtEndSheetData
-  AppendRecord(body, 130, {});  // BrtEndSheet
-  return body;
-}
-
-std::vector<std::uint8_t> WorksheetFormatPayload(std::uint32_t dx_g_col, std::uint16_t cch_def_col_width,
-                                                 std::uint16_t miy_def_rw_height, std::uint32_t flags) {
-  std::vector<std::uint8_t> payload;
-  AppendU32(payload, dx_g_col);
-  payload.push_back(static_cast<std::uint8_t>(cch_def_col_width & 0xFFU));
-  payload.push_back(static_cast<std::uint8_t>((cch_def_col_width >> 8U) & 0xFFU));
-  payload.push_back(static_cast<std::uint8_t>(miy_def_rw_height & 0xFFU));
-  payload.push_back(static_cast<std::uint8_t>((miy_def_rw_height >> 8U) & 0xFFU));
-  AppendU32(payload, flags);
-  return payload;
-}
-
-std::vector<std::uint8_t> SheetBinWorksheetFormat(const std::vector<std::uint8_t>& format_payload) {
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 129, {});              // BrtBeginSheet
-  AppendRecord(body, 485, format_payload);  // BrtWsFmtInfo
-  AppendRecord(body, 145, {});              // BrtBeginSheetData
-  AppendRecord(body, 146, {});              // BrtEndSheetData
-  AppendRecord(body, 130, {});              // BrtEndSheet
-  return body;
-}
-
-/// Builds a layout-only sheet carrying three BrtRowHdr records: explicit
-/// style 0, explicit style 1, and ixfe 1 without fGhostDirty. The last one
-/// is the negative control proving that ixfe is ignored unless the flag says
-/// the row style is effective.
-std::vector<std::uint8_t> SheetBinRowStyles() {
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 129, {});  // BrtBeginSheet
-  AppendRecord(body, 145, {});  // BrtBeginSheetData
-  const auto append_row = [&body](std::uint32_t row, std::uint32_t style_xf, std::uint8_t flags2) {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, row);
-    AppendU32(p, style_xf);
-    p.push_back(0);
-    p.push_back(0);  // miyRw
-    AppendU8(p, 0);  // flags1
-    AppendU8(p, flags2);
-    AppendU8(p, 0);            // fPhShow
-    AppendU32(p, 0);           // ccolspan
-    AppendRecord(body, 0, p);  // BrtRowHdr
-  };
-  append_row(0U, 0U, 0x40U);
-  append_row(1U, 1U, 0x40U);
-  append_row(2U, 1U, 0U);
-  AppendRecord(body, 146, {});  // BrtEndSheetData
-  AppendRecord(body, 130, {});  // BrtEndSheet
-  return body;
-}
-
-/// Builds a sheet with a single BrtArrFmla whose RfX rect is
-/// (`rw_first`..`rw_last`, `col_first`..`col_last`) and whose
-/// CellParsedFormula rgce is `rgce` (cb = 0).
-std::vector<std::uint8_t> SheetBinArrFmla(std::uint32_t rw_first, std::uint32_t rw_last, std::uint32_t col_first,
-                                          std::uint32_t col_last, const std::vector<std::uint8_t>& rgce) {
-  const std::vector<std::array<std::uint32_t, 4>> rects = {{{rw_first, rw_last, col_first, col_last}}};
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 129, {});  // BrtBeginSheet
-  AppendRecord(body, 145, {});  // BrtBeginSheetData
-
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, rw_first);
-    AppendRecord(body, 0, p);  // BrtRowHdr
-  }
-
-  for (const std::array<std::uint32_t, 4>& rect : rects) {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, rect[0]);
-    AppendU32(p, rect[1]);
-    AppendU32(p, rect[2]);
-    AppendU32(p, rect[3]);
-    AppendU8(p, 0);  // reserved/flag
-    AppendU32(p, static_cast<std::uint32_t>(rgce.size()));
-    p.insert(p.end(), rgce.begin(), rgce.end());
-    AppendU32(p, 0);  // cb
-    AppendRecord(body, 426, p);
-  }
-
-  AppendRecord(body, 146, {});  // BrtEndSheetData
-  AppendRecord(body, 130, {});  // BrtEndSheet
-  return body;
-}
-
-std::vector<std::uint8_t> SheetBinArrFmlas(const std::vector<std::array<std::uint32_t, 4>>& rects,
-                                           const std::vector<std::uint8_t>& rgce) {
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 129, {});  // BrtBeginSheet
-  AppendRecord(body, 145, {});  // BrtBeginSheetData
-
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, rects.front()[0]);
-    AppendRecord(body, 0, p);  // BrtRowHdr
-  }
-
-  for (const std::array<std::uint32_t, 4>& rect : rects) {
-    // BrtArrFmla (426): RfX (4 x u32) + reserved byte + cce (u32) + rgce
-    // + cb (u32).
-    std::vector<std::uint8_t> p;
-    AppendU32(p, rect[0]);
-    AppendU32(p, rect[1]);
-    AppendU32(p, rect[2]);
-    AppendU32(p, rect[3]);
-    AppendU8(p, 0);  // reserved/flag
-    AppendU32(p, static_cast<std::uint32_t>(rgce.size()));
-    p.insert(p.end(), rgce.begin(), rgce.end());
-    AppendU32(p, 0);  // cb
-    AppendRecord(body, 426, p);
-  }
-
-  AppendRecord(body, 146, {});  // BrtEndSheetData
-  AppendRecord(body, 130, {});  // BrtEndSheet
-  return body;
-}
-
-/// Builds a sheet with a single BrtCellIsst at row 0, col 0 referencing
-/// SST entry `sst_index`.
-std::vector<std::uint8_t> SheetBinIsst(std::uint32_t sst_index) {
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 129, {});
-  AppendRecord(body, 145, {});
-
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, 0);
-    AppendRecord(body, 0, p);  // BrtRowHdr
-  }
-
-  // BrtCellIsst (7): cell-header + u32 sst index.
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, 0);
-    AppendU8(p, 0);
-    AppendU8(p, 0);
-    AppendU8(p, 0);
-    AppendU8(p, 0);
-    AppendU32(p, sst_index);
-    AppendRecord(body, 7, p);
-  }
-
-  AppendRecord(body, 146, {});
-  AppendRecord(body, 130, {});
-  return body;
-}
-
-/// Builds a sheet with a single BrtFmlaNum at row 0, col 0: cached
-/// numeric result `cached`, and a `CellParsedFormula` whose rgce is
-/// `rgce`.
-std::vector<std::uint8_t> SheetBinFmlaNum(double cached, const std::vector<std::uint8_t>& rgce) {
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 129, {});  // BrtBeginSheet
-  AppendRecord(body, 145, {});  // BrtBeginSheetData
-
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, 0);
-    AppendRecord(body, 0, p);  // BrtRowHdr
-  }
-
-  // BrtFmlaNum (9): cell-header (8) + double (8) + grbitFlags (u16) +
-  // cce (u32) + rgce + cb (u32).
-  {
-    std::vector<std::uint8_t> p;
-    AppendU32(p, 0);  // column
-    AppendU8(p, 0);   // style[0]
-    AppendU8(p, 0);   // style[1]
-    AppendU8(p, 0);   // style[2]
-    AppendU8(p, 0);   // fPhShow
-    AppendDouble(p, cached);
-    p.push_back(0);  // grbitFlags lo
-    p.push_back(0);  // grbitFlags hi
-    AppendU32(p, static_cast<std::uint32_t>(rgce.size()));
-    p.insert(p.end(), rgce.begin(), rgce.end());
-    AppendU32(p, 0);  // cb
-    AppendRecord(body, 9, p);
-  }
-
-  AppendRecord(body, 146, {});  // BrtEndSheetData
-  AppendRecord(body, 130, {});  // BrtEndSheet
-  return body;
-}
-
-/// Builds `xl/sharedStrings.bin` with one BrtSSTItem entry (the
-/// payload is a single BrtSSTItem record carrying a 1-byte flags
-/// prefix + XLWideString).
-std::vector<std::uint8_t> SharedStringsBin(std::string_view item) {
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 159, {});  // BrtBeginSst
-  // BrtSSTItem (19): u8 flags + XLWideString.
-  {
-    std::vector<std::uint8_t> p;
-    AppendU8(p, 0);
-    AppendXLWideString(p, item);
-    AppendRecord(body, 19, p);
-  }
-  AppendRecord(body, 160, {});  // BrtEndSst
-  return body;
-}
-
-/// Builds `xl/sharedStrings.bin` with one BrtSSTItem entry whose
-/// phonetic tail (`kRichStrPhonetic` set, no rich-text runs) declares
-/// one run but supplies zero bytes for it -- `DecodePhoneticTail`
-/// (sst_reader.cpp) bounds the run count against the remaining payload
-/// before reading, so this exercises the `kIoXlsbRecordTruncated` path
-/// rather than an out-of-bounds read.
-std::vector<std::uint8_t> TruncatedPhoneticSharedStringsBin() {
-  std::vector<std::uint8_t> body;
-  AppendRecord(body, 159, {});  // BrtBeginSst
-  {
-    std::vector<std::uint8_t> p;
-    AppendU8(p, 0x02);          // flags: fPhonetic set, fRichSt clear
-    AppendXLWideString(p, "");  // the string itself
-    AppendXLWideString(p, "");  // phonetic text
-    AppendU32(p, 1U);           // run count -- no run bytes follow
-    AppendRecord(body, 19, p);
-  }
-  AppendRecord(body, 160, {});  // BrtEndSst
-  return body;
-}
-
-// ---------------------------------------------------------------------------
-// ZIP packaging via miniz.
-// ---------------------------------------------------------------------------
-
-struct PartFile {
-  std::string path;
-  std::vector<std::uint8_t> body;
-};
-
-std::vector<std::uint8_t> BuildZip(const std::vector<PartFile>& parts) {
-  mz_zip_archive writer{};
-  EXPECT_EQ(mz_zip_writer_init_heap(&writer, 0, 4096), MZ_TRUE);
-  for (const PartFile& p : parts) {
-    EXPECT_EQ(mz_zip_writer_add_mem(&writer, p.path.c_str(), p.body.data(), p.body.size(),
-                                    static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)),
-              MZ_TRUE)
-        << "miniz add failed for " << p.path;
-  }
-  void* archive_ptr = nullptr;
-  std::size_t archive_size = 0;
-  EXPECT_EQ(mz_zip_writer_finalize_heap_archive(&writer, &archive_ptr, &archive_size), MZ_TRUE);
-  std::vector<std::uint8_t> out(static_cast<const std::uint8_t*>(archive_ptr),
-                                static_cast<const std::uint8_t*>(archive_ptr) + archive_size);
-  mz_free(archive_ptr);
-  mz_zip_writer_end(&writer);
-  return out;
-}
-
-std::vector<std::uint8_t> StringToBytes(std::string_view s) {
-  return std::vector<std::uint8_t>(s.begin(), s.end());
-}
-
-// ---------------------------------------------------------------------------
-// Tests.
-// ---------------------------------------------------------------------------
-
+using namespace reader_test_support;
 TEST(XlsbReader, ReadsTwoSheetsWithRealAndIsstCells) {
   std::vector<PartFile> parts;
   parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
@@ -538,7 +58,6 @@ TEST(XlsbReader, ReadsTwoSheetsWithRealAndIsstCells) {
   // Audit counter: two literal cells decoded.
   EXPECT_EQ(result.value().cells_read, 2U);
 }
-
 TEST(XlsbReader, DecodesWorksheetFormatDefaults) {
   std::vector<PartFile> parts;
   parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
@@ -557,7 +76,6 @@ TEST(XlsbReader, DecodesWorksheetFormatDefaults) {
   EXPECT_TRUE(defaults.has_default_row_height);
   EXPECT_DOUBLE_EQ(defaults.default_row_height, 18.75);
 }
-
 TEST(XlsbReader, DecodesAbsentAndExcelCompatibleWorksheetFormatDefaults) {
   const auto read_defaults = [](const std::vector<std::uint8_t>& payload) {
     std::vector<PartFile> parts;
@@ -595,7 +113,6 @@ TEST(XlsbReader, DecodesAbsentAndExcelCompatibleWorksheetFormatDefaults) {
   EXPECT_TRUE(zero_defaults.has_default_row_height);
   EXPECT_DOUBLE_EQ(zero_defaults.default_row_height, 0.0);
 }
-
 TEST(XlsbReader, RejectsMalformedWorksheetFormatInfoPayloads) {
   const auto read_payload = [](const std::vector<std::uint8_t>& payload) {
     std::vector<PartFile> parts;
@@ -634,7 +151,6 @@ TEST(XlsbReader, RejectsMalformedWorksheetFormatInfoPayloads) {
   ASSERT_FALSE(static_cast<bool>(trailing_result));
   EXPECT_EQ(trailing_result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
 }
-
 TEST(XlsbReader, RowStylePresenceUsesFGhostDirtyFlag) {
   std::vector<PartFile> parts;
   parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
@@ -668,373 +184,6 @@ TEST(XlsbReader, RowStylePresenceUsesFGhostDirtyFlag) {
   EXPECT_EQ(find_row(2U), nullptr);
 }
 
-TEST(XlsbReader, DecodesFormulaAndPreservesCachedValue) {
-  // rgce = `PtgInt 5` (`=5`): 0x1E 0x05 0x00.
-  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinFmlaNum(5.0, rgce)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-
-  const Cell* c = result.value().workbook.sheet(0).cell_at(0, 0);
-  ASSERT_NE(c, nullptr);
-  // The real formula text is decoded from the Ptg stream.
-  EXPECT_EQ(c->formula_text, "=5");
-  // The cached value is preserved.
-  ASSERT_TRUE(c->cached_value.is_number());
-  EXPECT_EQ(c->cached_value.as_number(), 5.0);
-}
-
-TEST(XlsbReader, UndecodableFormulaPreservesCachedValueWithoutFakeFormula) {
-  // rgce = `PtgName` (0x23) + a 4-byte name index. PtgName is not in the
-  // supported common-token set, so the decode fails and the reader must
-  // preserve the cached value and store NO formula (never a fake one
-  // that would recalc to #NAME?).
-  const std::vector<std::uint8_t> rgce = {0x23, 0x01, 0x00, 0x00, 0x00};
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinFmlaNum(42.0, rgce)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-
-  const Cell* c = result.value().workbook.sheet(0).cell_at(0, 0);
-  ASSERT_NE(c, nullptr);
-  // No fabricated formula.
-  EXPECT_TRUE(c->formula_text.empty());
-  // Cached value preserved so the cell still shows the right number.
-  ASSERT_TRUE(c->cached_value.is_number());
-  EXPECT_EQ(c->cached_value.as_number(), 42.0);
-  EXPECT_EQ(result.value().undecoded_formula_count, 1U);
-  EXPECT_EQ(result.value().undecoded_defined_name_count, 0U);
-}
-
-TEST(XlsbReader, ExternalBookNameInCellFormulaKeepsCachedValueAndCounts) {
-  // rgce = `PtgNameX` (0x39) + ixti (u16) + name index (u32): a defined
-  // name owned by another workbook. Resolving it needs the supporting-
-  // book and external-name tables, which this reader does not decode, so
-  // the token stays explicitly unsupported. Reusing the index against
-  // this workbook's own name table would silently retarget the formula
-  // at a different name, so the cell must instead fall back to the same
-  // contract an undecodable stream gets: cached value kept, no formula,
-  // one diagnostic counted.
-  const std::vector<std::uint8_t> rgce = {0x39, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00};
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinFmlaNum(7.25, rgce)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-
-  const Cell* c = result.value().workbook.sheet(0).cell_at(0, 0);
-  ASSERT_NE(c, nullptr);
-  EXPECT_TRUE(c->formula_text.empty());
-  ASSERT_TRUE(c->cached_value.is_number());
-  EXPECT_EQ(c->cached_value.as_number(), 7.25);
-  EXPECT_EQ(result.value().undecoded_formula_count, 1U);
-  EXPECT_EQ(result.value().undecoded_defined_name_count, 0U);
-}
-
-TEST(XlsbReader, DecodableDefinedNameRegistersAndCountsNothing) {
-  // Positive control for the record builder the next test relies on: a
-  // `BrtName` whose rgce is `PtgInt 5` must reach the workbook intact,
-  // so a zero counter there means "nothing was undecodable" rather than
-  // "no name record was ever parsed".
-  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin({NameRecord("Rate", rgce)})});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-
-  const std::vector<DefinedName>& names = result.value().workbook.defined_names();
-  ASSERT_EQ(names.size(), 1U);
-  EXPECT_EQ(names[0].name, "Rate");
-  EXPECT_EQ(names[0].formula, "5");
-  EXPECT_EQ(names[0].local_sheet_id, -1);
-  EXPECT_EQ(result.value().undecoded_defined_name_count, 0U);
-}
-
-TEST(XlsbReader, DefinedNameCommentSurvivesDecode) {
-  // The Name Manager comment is the trailing `BrtName` string after
-  // `rgce`/`rgcb`; a reader that stops at the formula body (or
-  // misreads `cb`) never reaches it.
-  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin({NameRecord("Rate", rgce, "The annual interest rate")})});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-
-  const std::vector<DefinedName>& names = result.value().workbook.defined_names();
-  ASSERT_EQ(names.size(), 1U);
-  EXPECT_EQ(names[0].comment, "The annual interest rate");
-}
-
-TEST(XlsbReader, ExternalBookNameInDefinedNameIsSkippedAndCounted) {
-  // Same unsupported token, this time as a defined name's own body. The
-  // name is dropped rather than registered with a fabricated formula,
-  // and the read still succeeds so one external reference cannot cost
-  // the caller the whole workbook.
-  const std::vector<std::uint8_t> rgce = {0x39, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00};
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin({NameRecord("ExtRate", rgce)})});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-
-  EXPECT_TRUE(result.value().workbook.defined_names().empty());
-  EXPECT_EQ(result.value().undecoded_defined_name_count, 1U);
-  EXPECT_EQ(result.value().undecoded_formula_count, 0U);
-}
-
-TEST(XlsbReader, OutOfRangeCellColumnIsRecordCorrupt) {
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  // Column index == kMaxCols is one past the last valid column (XFD).
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0, /*row=*/0, /*col=*/Sheet::kMaxCols)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_FALSE(static_cast<bool>(result));
-  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
-}
-
-TEST(XlsbReader, OutOfRangeRowHeaderIsRecordCorrupt) {
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  // Row index == kMaxRows is one past the last valid row.
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0, /*row=*/Sheet::kMaxRows, /*col=*/0)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_FALSE(static_cast<bool>(result));
-  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
-}
-
-TEST(XlsbReader, TruncatedPhoneticRunArrayIsRecordTruncated) {
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinIsst(0)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-  parts.push_back({"xl/sharedStrings.bin", TruncatedPhoneticSharedStringsBin()});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_FALSE(static_cast<bool>(result));
-  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordTruncated);
-}
-
-TEST(XlsbReader, ReversedArrayFormulaRectIsRecordCorrupt) {
-  // rw_last > rw_first but col_last < col_first: reversed on the column
-  // axis only. The anchor guard is an OR over the two axes, so without
-  // rect validation this anchor would be recorded and the spill size
-  // math would underflow-wrap.
-  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};  // PtgInt 5
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin",
-                   SheetBinArrFmla(/*rw_first=*/0, /*rw_last=*/1, /*col_first=*/2, /*col_last=*/1, rgce)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_FALSE(static_cast<bool>(result));
-  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
-}
-
-TEST(XlsbReader, InBoundsArrayFormulaRectStillDecodes) {
-  // A well-ordered in-bounds 2x1 rect anchored at A1 must keep decoding
-  // after the bounds validation: the anchor gets the decoded formula
-  // text and the read succeeds.
-  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};  // PtgInt 5
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin",
-                   SheetBinArrFmla(/*rw_first=*/0, /*rw_last=*/1, /*col_first=*/0, /*col_last=*/0, rgce)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-
-  const Cell* c = result.value().workbook.sheet(0).cell_at(0, 0);
-  ASSERT_NE(c, nullptr);
-  EXPECT_EQ(c->formula_text, "=5");
-}
-
-TEST(XlsbReader, RejectsFullGridArrayFormulaBeforeSpillWalk) {
-  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};  // PtgInt 5
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back(
-      {"xl/worksheets/sheet1.bin", SheetBinArrFmla(/*rw_first=*/0, /*rw_last=*/Sheet::kMaxRows - 1U, /*col_first=*/0,
-                                                   /*col_last=*/Sheet::kMaxCols - 1U, rgce)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_FALSE(static_cast<bool>(result));
-  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
-}
-
-TEST(XlsbReader, RejectsCumulativeArrayFormulasOverSheetBudget) {
-  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};  // PtgInt 5
-  const std::vector<std::array<std::uint32_t, 4>> rects = {
-      {0U, 599999U, 0U, 0U},
-      {0U, 599999U, 1U, 1U},
-  };
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinArrFmlas(rects, rgce)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_FALSE(static_cast<bool>(result));
-  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
-  EXPECT_NE(result.error().context.find("format=xlsb"), std::string::npos);
-  EXPECT_NE(result.error().context.find("anchor_row=0 anchor_col=1"), std::string::npos);
-  EXPECT_NE(result.error().context.find("used=600000 requested=600000 ceiling=1048576"), std::string::npos);
-}
-
-TEST(XlsbReader, MissingContentTypesIsContentTypeInvalid) {
-  std::vector<PartFile> parts;
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_FALSE(static_cast<bool>(result));
-  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoContentTypeInvalid);
-}
-
-// ---------------------------------------------------------------------------
-// Default-typed residual parts are captured as empty-content-type
-// passthrough entries; only entries with no resolvable Override/Default
-// declaration remain lossy and contribute to dropped_part_count.
-// ---------------------------------------------------------------------------
-
-TEST(XlsbReader, DefaultTypedPartsAreCapturedAsPassthrough) {
-  std::string content_types(
-      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
-      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">"
-      "<Default Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>"
-      "<Default Extension=\"bin\" ContentType=\"application/vnd.ms-excel.sheet.binary.macroEnabled.main\"/>"
-      "<Default Extension=\"png\" ContentType=\"image/png\"/>"
-      "<Override PartName=\"/xl/workbook.bin\" "
-      "ContentType=\"application/vnd.ms-excel.sheet.binary.macroEnabled.main\"/>"
-      "<Override PartName=\"/xl/worksheets/sheet1.bin\" "
-      "ContentType=\"application/vnd.ms-excel.binIndexWs\"/>"
-      "<Override PartName=\"/xl/worksheets/sheet2.bin\" "
-      "ContentType=\"application/vnd.ms-excel.binIndexWs\"/>"
-      "</Types>");
-
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(content_types)});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(2.0)});
-  // Typed by the `png` Default rather than an Override: the passthrough
-  // sweep never sees it.
-  parts.push_back({"xl/media/image1.png", StringToBytes("\x89PNG\r\n\x1a\n")});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-
-  EXPECT_EQ(result.value().dropped_part_count, 0U);
-  bool saw_png = false;
-  for (const PassthroughPart& part : result.value().workbook.passthrough_parts()) {
-    if (part.path == "xl/media/image1.png") {
-      saw_png = true;
-      EXPECT_TRUE(part.content_type.empty());
-      EXPECT_EQ(part.bytes, StringToBytes("\x89PNG\r\n\x1a\n"));
-    }
-  }
-  EXPECT_TRUE(saw_png);
-  ASSERT_EQ(result.value().workbook.default_content_types().size(), 3U);
-}
-
-TEST(XlsbReader, FullyModelledPackageReportsNoDroppedParts) {
-  // Every entry is either consumed by the reader or captured as an
-  // Override passthrough, so a lossless package must not raise the flag.
-  std::vector<PartFile> parts;
-  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
-  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
-  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
-  parts.push_back({"xl/workbook.bin", WorkbookBin()});
-  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(123.5)});
-  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinIsst(0)});
-  parts.push_back({"xl/sharedStrings.bin", SharedStringsBin("hello world")});
-
-  const std::vector<std::uint8_t> archive = BuildZip(parts);
-  auto result = read_xlsb(SpanOf(archive));
-  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
-  EXPECT_EQ(result.value().dropped_part_count, 0U);
-}
-
 }  // namespace
 }  // namespace xlsb
 }  // namespace io
diff --git a/tests/unit/io/xlsb/reader_test_helpers.h b/tests/unit/io/xlsb/reader_test_helpers.h
new file mode 100644
index 000000000..2f59d3813
--- /dev/null
+++ b/tests/unit/io/xlsb/reader_test_helpers.h
@@ -0,0 +1,493 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/xlsb/reader.h"
+#include "miniz.h"
+
+namespace formulon::io::xlsb::reader_test_support {
+
+inline io::ByteSpan SpanOf(const std::vector<std::uint8_t>& v) {
+  return io::ByteSpan{v.data(), v.size()};
+}
+
+// ---------------------------------------------------------------------------
+// Tiny XLSB record-stream builders. Mirrors the framing in
+// `io/xlsb/record.{h,cpp}` (1-/2-byte type, 1..4-byte size, payload) so
+// the tests can construct synthetic parts without dragging in the
+// writer (which lands in Bundle 4.2).
+// ---------------------------------------------------------------------------
+
+inline void AppendVarInt(std::vector<std::uint8_t>& out, std::uint32_t v, std::size_t max_bytes) {
+  for (std::size_t i = 0; i < max_bytes; ++i) {
+    const std::uint8_t byte = static_cast<std::uint8_t>(v & 0x7F);
+    v >>= 7;
+    if (v == 0) {
+      out.push_back(byte);
+      return;
+    }
+    out.push_back(static_cast<std::uint8_t>(byte | 0x80));
+  }
+  // If we're here the caller asked for too few bytes; fall through.
+}
+
+inline void AppendRecord(std::vector<std::uint8_t>& out, std::uint16_t type, const std::vector<std::uint8_t>& payload) {
+  AppendVarInt(out, type, /*max_bytes=*/2);
+  AppendVarInt(out, static_cast<std::uint32_t>(payload.size()), /*max_bytes=*/4);
+  out.insert(out.end(), payload.begin(), payload.end());
+}
+
+inline void AppendU8(std::vector<std::uint8_t>& out, std::uint8_t v) {
+  out.push_back(v);
+}
+
+inline void AppendU32(std::vector<std::uint8_t>& out, std::uint32_t v) {
+  out.push_back(static_cast<std::uint8_t>(v & 0xFFU));
+  out.push_back(static_cast<std::uint8_t>((v >> 8) & 0xFFU));
+  out.push_back(static_cast<std::uint8_t>((v >> 16) & 0xFFU));
+  out.push_back(static_cast<std::uint8_t>((v >> 24) & 0xFFU));
+}
+
+inline void AppendDouble(std::vector<std::uint8_t>& out, double v) {
+  std::uint64_t bits = 0;
+  std::memcpy(&bits, &v, sizeof(v));
+  AppendU32(out, static_cast<std::uint32_t>(bits & 0xFFFFFFFFU));
+  AppendU32(out, static_cast<std::uint32_t>((bits >> 32) & 0xFFFFFFFFU));
+}
+
+/// Encodes an ASCII string as XLWideString (cch + UCS-2 little-endian).
+inline void AppendXLWideString(std::vector<std::uint8_t>& out, std::string_view s) {
+  AppendU32(out, static_cast<std::uint32_t>(s.size()));
+  for (char c : s) {
+    out.push_back(static_cast<std::uint8_t>(c));
+    out.push_back(0);
+  }
+}
+
+/// XLNullableWideString. Empty / null both encode as the 0xFFFFFFFF sentinel.
+inline void AppendXLNullableWideString(std::vector<std::uint8_t>& out, std::string_view s) {
+  if (s.empty()) {
+    AppendU32(out, 0xFFFFFFFFU);
+    return;
+  }
+  AppendXLWideString(out, s);
+}
+
+// ---------------------------------------------------------------------------
+// Synthetic .xlsb part builders.
+// ---------------------------------------------------------------------------
+
+inline std::string ContentTypesXml() {
+  return std::string(
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
+      "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\">"
+      "<Default Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/>"
+      "<Default Extension=\"bin\" ContentType=\"application/vnd.ms-excel.sheet.binary.macroEnabled.main\"/>"
+      "<Override PartName=\"/xl/workbook.bin\" "
+      "ContentType=\"application/vnd.ms-excel.sheet.binary.macroEnabled.main\"/>"
+      "<Override PartName=\"/xl/worksheets/sheet1.bin\" "
+      "ContentType=\"application/vnd.ms-excel.binIndexWs\"/>"
+      "<Override PartName=\"/xl/worksheets/sheet2.bin\" "
+      "ContentType=\"application/vnd.ms-excel.binIndexWs\"/>"
+      "<Override PartName=\"/xl/sharedStrings.bin\" "
+      "ContentType=\"application/vnd.ms-excel.sharedStrings\"/>"
+      "</Types>");
+}
+
+inline std::string PackageRelsXml() {
+  return std::string(
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
+      "<Relationship Id=\"rId1\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" "
+      "Target=\"xl/workbook.bin\"/>"
+      "</Relationships>");
+}
+
+inline std::string WorkbookRelsXml() {
+  return std::string(
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
+      "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
+      "<Relationship Id=\"rIdSheet1\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
+      "Target=\"worksheets/sheet1.bin\"/>"
+      "<Relationship Id=\"rIdSheet2\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" "
+      "Target=\"worksheets/sheet2.bin\"/>"
+      "<Relationship Id=\"rIdSst\" "
+      "Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings\" "
+      "Target=\"sharedStrings.bin\"/>"
+      "</Relationships>");
+}
+
+/// Builds one `BrtName` record body carrying `name` at workbook scope
+/// with `rgce` as its formula and `comment` as the trailing Name
+/// Manager comment string (empty encodes the real-Excel null
+/// `XLNullableWideString` sentinel). Emits exactly the byte shape a real
+/// Excel-365-produced `BrtName` for a plain (non-placeholder) defined
+/// name carries: flags + 3 reserved + itab + cch + UTF-16LE name + cce +
+/// rgce + cb (always 0 here -- no array-constant `rgcb`) + the one
+/// trailing comment string. Verified against `xlsb_fidelity_base.xlsb`'s
+/// own "Rate" `BrtName` record byte-for-byte.
+inline std::vector<std::uint8_t> NameRecord(std::string_view name, const std::vector<std::uint8_t>& rgce,
+                                            std::string_view comment = {}) {
+  std::vector<std::uint8_t> p;
+  p.push_back(0);  // flags[0] — fHidden clear.
+  p.push_back(0);  // flags[1]
+  p.push_back(0);  // reserved
+  p.push_back(0);
+  p.push_back(0);
+  AppendU32(p, 0xFFFFFFFFU);  // itab == -1: workbook scope.
+  AppendU32(p, static_cast<std::uint32_t>(name.size()));
+  for (char c : name) {
+    p.push_back(static_cast<std::uint8_t>(c));
+    p.push_back(0);
+  }
+  AppendU32(p, static_cast<std::uint32_t>(rgce.size()));
+  p.insert(p.end(), rgce.begin(), rgce.end());
+  AppendU32(p, 0U);  // cb: no rgcb.
+  AppendXLNullableWideString(p, comment);
+  return p;
+}
+
+/// Builds `xl/workbook.bin` containing two BrtBundleSh entries
+/// pointing at rIdSheet1 / rIdSheet2. `name_records` are emitted as
+/// `BrtName` records after the sheet bundle, which is where Excel puts
+/// them and where both name passes expect to find them.
+inline std::vector<std::uint8_t> WorkbookBin(const std::vector<std::vector<std::uint8_t>>& name_records = {}) {
+  std::vector<std::uint8_t> body;
+
+  // BrtBeginBook (131): empty payload.
+  AppendRecord(body, 131, {});
+
+  // BrtBeginBundleShs (143).
+  AppendRecord(body, 143, {});
+
+  // BrtBundleSh (156) #1 = "Alpha"
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, 0);  // hsState (visible)
+    AppendU32(p, 1);  // iTabID
+    AppendXLNullableWideString(p, "rIdSheet1");
+    AppendXLWideString(p, "Alpha");
+    AppendRecord(body, 156, p);
+  }
+  // BrtBundleSh (156) #2 = "Beta"
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, 0);
+    AppendU32(p, 2);
+    AppendXLNullableWideString(p, "rIdSheet2");
+    AppendXLWideString(p, "Beta");
+    AppendRecord(body, 156, p);
+  }
+
+  AppendRecord(body, 144, {});  // BrtEndBundleShs
+
+  for (const std::vector<std::uint8_t>& rec : name_records) {
+    AppendRecord(body, 39, rec);  // BrtName
+  }
+
+  AppendRecord(body, 132, {});  // BrtEndBook
+  return body;
+}
+
+/// Builds a sheet with a single BrtCellReal at (`row`, `col`) with value
+/// `cell_value`. `row` / `col` default to A1 but are overridable so the
+/// bounds-validation tests can inject out-of-range indices.
+inline std::vector<std::uint8_t> SheetBinReal(double cell_value, std::uint32_t row = 0, std::uint32_t col = 0) {
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 129, {});  // BrtBeginSheet
+  AppendRecord(body, 145, {});  // BrtBeginSheetData
+
+  // BrtRowHdr (0): just the row index, plus 18 bytes of reserved
+  // metadata that the skeleton skips. We supply only the first u32 —
+  // the reader reads `current_row` from byte 0..3 and stops there
+  // because the rest of the BrtRowHdr payload is not consumed.
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, row);  // row index
+    AppendRecord(body, 0, p);
+  }
+
+  // BrtCellReal (5): cell-header (col, style3, ph1) + 8-byte double.
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, col);  // column
+    AppendU8(p, 0);     // style[0]
+    AppendU8(p, 0);     // style[1]
+    AppendU8(p, 0);     // style[2]
+    AppendU8(p, 0);     // fPhShow
+    AppendDouble(p, cell_value);
+    AppendRecord(body, 5, p);
+  }
+
+  AppendRecord(body, 146, {});  // BrtEndSheetData
+  AppendRecord(body, 130, {});  // BrtEndSheet
+  return body;
+}
+
+inline std::vector<std::uint8_t> WorksheetFormatPayload(std::uint32_t dx_g_col, std::uint16_t cch_def_col_width,
+                                                        std::uint16_t miy_def_rw_height, std::uint32_t flags) {
+  std::vector<std::uint8_t> payload;
+  AppendU32(payload, dx_g_col);
+  payload.push_back(static_cast<std::uint8_t>(cch_def_col_width & 0xFFU));
+  payload.push_back(static_cast<std::uint8_t>((cch_def_col_width >> 8U) & 0xFFU));
+  payload.push_back(static_cast<std::uint8_t>(miy_def_rw_height & 0xFFU));
+  payload.push_back(static_cast<std::uint8_t>((miy_def_rw_height >> 8U) & 0xFFU));
+  AppendU32(payload, flags);
+  return payload;
+}
+
+inline std::vector<std::uint8_t> SheetBinWorksheetFormat(const std::vector<std::uint8_t>& format_payload) {
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 129, {});              // BrtBeginSheet
+  AppendRecord(body, 485, format_payload);  // BrtWsFmtInfo
+  AppendRecord(body, 145, {});              // BrtBeginSheetData
+  AppendRecord(body, 146, {});              // BrtEndSheetData
+  AppendRecord(body, 130, {});              // BrtEndSheet
+  return body;
+}
+
+/// Builds a layout-only sheet carrying three BrtRowHdr records: explicit
+/// style 0, explicit style 1, and ixfe 1 without fGhostDirty. The last one
+/// is the negative control proving that ixfe is ignored unless the flag says
+/// the row style is effective.
+inline std::vector<std::uint8_t> SheetBinRowStyles() {
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 129, {});  // BrtBeginSheet
+  AppendRecord(body, 145, {});  // BrtBeginSheetData
+  const auto append_row = [&body](std::uint32_t row, std::uint32_t style_xf, std::uint8_t flags2) {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, row);
+    AppendU32(p, style_xf);
+    p.push_back(0);
+    p.push_back(0);  // miyRw
+    AppendU8(p, 0);  // flags1
+    AppendU8(p, flags2);
+    AppendU8(p, 0);            // fPhShow
+    AppendU32(p, 0);           // ccolspan
+    AppendRecord(body, 0, p);  // BrtRowHdr
+  };
+  append_row(0U, 0U, 0x40U);
+  append_row(1U, 1U, 0x40U);
+  append_row(2U, 1U, 0U);
+  AppendRecord(body, 146, {});  // BrtEndSheetData
+  AppendRecord(body, 130, {});  // BrtEndSheet
+  return body;
+}
+
+/// Builds a sheet with a single BrtArrFmla whose RfX rect is
+/// (`rw_first`..`rw_last`, `col_first`..`col_last`) and whose
+/// CellParsedFormula rgce is `rgce` (cb = 0).
+inline std::vector<std::uint8_t> SheetBinArrFmla(std::uint32_t rw_first, std::uint32_t rw_last, std::uint32_t col_first,
+                                                 std::uint32_t col_last, const std::vector<std::uint8_t>& rgce) {
+  const std::vector<std::array<std::uint32_t, 4>> rects = {{{rw_first, rw_last, col_first, col_last}}};
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 129, {});  // BrtBeginSheet
+  AppendRecord(body, 145, {});  // BrtBeginSheetData
+
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, rw_first);
+    AppendRecord(body, 0, p);  // BrtRowHdr
+  }
+
+  for (const std::array<std::uint32_t, 4>& rect : rects) {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, rect[0]);
+    AppendU32(p, rect[1]);
+    AppendU32(p, rect[2]);
+    AppendU32(p, rect[3]);
+    AppendU8(p, 0);  // reserved/flag
+    AppendU32(p, static_cast<std::uint32_t>(rgce.size()));
+    p.insert(p.end(), rgce.begin(), rgce.end());
+    AppendU32(p, 0);  // cb
+    AppendRecord(body, 426, p);
+  }
+
+  AppendRecord(body, 146, {});  // BrtEndSheetData
+  AppendRecord(body, 130, {});  // BrtEndSheet
+  return body;
+}
+
+inline std::vector<std::uint8_t> SheetBinArrFmlas(const std::vector<std::array<std::uint32_t, 4>>& rects,
+                                                  const std::vector<std::uint8_t>& rgce) {
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 129, {});  // BrtBeginSheet
+  AppendRecord(body, 145, {});  // BrtBeginSheetData
+
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, rects.front()[0]);
+    AppendRecord(body, 0, p);  // BrtRowHdr
+  }
+
+  for (const std::array<std::uint32_t, 4>& rect : rects) {
+    // BrtArrFmla (426): RfX (4 x u32) + reserved byte + cce (u32) + rgce
+    // + cb (u32).
+    std::vector<std::uint8_t> p;
+    AppendU32(p, rect[0]);
+    AppendU32(p, rect[1]);
+    AppendU32(p, rect[2]);
+    AppendU32(p, rect[3]);
+    AppendU8(p, 0);  // reserved/flag
+    AppendU32(p, static_cast<std::uint32_t>(rgce.size()));
+    p.insert(p.end(), rgce.begin(), rgce.end());
+    AppendU32(p, 0);  // cb
+    AppendRecord(body, 426, p);
+  }
+
+  AppendRecord(body, 146, {});  // BrtEndSheetData
+  AppendRecord(body, 130, {});  // BrtEndSheet
+  return body;
+}
+
+/// Builds a sheet with a single BrtCellIsst at row 0, col 0 referencing
+/// SST entry `sst_index`.
+inline std::vector<std::uint8_t> SheetBinIsst(std::uint32_t sst_index) {
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 129, {});
+  AppendRecord(body, 145, {});
+
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, 0);
+    AppendRecord(body, 0, p);  // BrtRowHdr
+  }
+
+  // BrtCellIsst (7): cell-header + u32 sst index.
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, 0);
+    AppendU8(p, 0);
+    AppendU8(p, 0);
+    AppendU8(p, 0);
+    AppendU8(p, 0);
+    AppendU32(p, sst_index);
+    AppendRecord(body, 7, p);
+  }
+
+  AppendRecord(body, 146, {});
+  AppendRecord(body, 130, {});
+  return body;
+}
+
+/// Builds a sheet with a single BrtFmlaNum at row 0, col 0: cached
+/// numeric result `cached`, and a `CellParsedFormula` whose rgce is
+/// `rgce`.
+inline std::vector<std::uint8_t> SheetBinFmlaNum(double cached, const std::vector<std::uint8_t>& rgce) {
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 129, {});  // BrtBeginSheet
+  AppendRecord(body, 145, {});  // BrtBeginSheetData
+
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, 0);
+    AppendRecord(body, 0, p);  // BrtRowHdr
+  }
+
+  // BrtFmlaNum (9): cell-header (8) + double (8) + grbitFlags (u16) +
+  // cce (u32) + rgce + cb (u32).
+  {
+    std::vector<std::uint8_t> p;
+    AppendU32(p, 0);  // column
+    AppendU8(p, 0);   // style[0]
+    AppendU8(p, 0);   // style[1]
+    AppendU8(p, 0);   // style[2]
+    AppendU8(p, 0);   // fPhShow
+    AppendDouble(p, cached);
+    p.push_back(0);  // grbitFlags lo
+    p.push_back(0);  // grbitFlags hi
+    AppendU32(p, static_cast<std::uint32_t>(rgce.size()));
+    p.insert(p.end(), rgce.begin(), rgce.end());
+    AppendU32(p, 0);  // cb
+    AppendRecord(body, 9, p);
+  }
+
+  AppendRecord(body, 146, {});  // BrtEndSheetData
+  AppendRecord(body, 130, {});  // BrtEndSheet
+  return body;
+}
+
+/// Builds `xl/sharedStrings.bin` with one BrtSSTItem entry (the
+/// payload is a single BrtSSTItem record carrying a 1-byte flags
+/// prefix + XLWideString).
+inline std::vector<std::uint8_t> SharedStringsBin(std::string_view item) {
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 159, {});  // BrtBeginSst
+  // BrtSSTItem (19): u8 flags + XLWideString.
+  {
+    std::vector<std::uint8_t> p;
+    AppendU8(p, 0);
+    AppendXLWideString(p, item);
+    AppendRecord(body, 19, p);
+  }
+  AppendRecord(body, 160, {});  // BrtEndSst
+  return body;
+}
+
+/// Builds `xl/sharedStrings.bin` with one BrtSSTItem entry whose
+/// phonetic tail (`kRichStrPhonetic` set, no rich-text runs) declares
+/// one run but supplies zero bytes for it -- `DecodePhoneticTail`
+/// (sst_reader.cpp) bounds the run count against the remaining payload
+/// before reading, so this exercises the `kIoXlsbRecordTruncated` path
+/// rather than an out-of-bounds read.
+inline std::vector<std::uint8_t> TruncatedPhoneticSharedStringsBin() {
+  std::vector<std::uint8_t> body;
+  AppendRecord(body, 159, {});  // BrtBeginSst
+  {
+    std::vector<std::uint8_t> p;
+    AppendU8(p, 0x02);          // flags: fPhonetic set, fRichSt clear
+    AppendXLWideString(p, "");  // the string itself
+    AppendXLWideString(p, "");  // phonetic text
+    AppendU32(p, 1U);           // run count -- no run bytes follow
+    AppendRecord(body, 19, p);
+  }
+  AppendRecord(body, 160, {});  // BrtEndSst
+  return body;
+}
+
+// ---------------------------------------------------------------------------
+// ZIP packaging via miniz.
+// ---------------------------------------------------------------------------
+
+struct PartFile {
+  std::string path;
+  std::vector<std::uint8_t> body;
+};
+
+inline std::vector<std::uint8_t> BuildZip(const std::vector<PartFile>& parts) {
+  mz_zip_archive writer{};
+  EXPECT_EQ(mz_zip_writer_init_heap(&writer, 0, 4096), MZ_TRUE);
+  for (const PartFile& p : parts) {
+    EXPECT_EQ(mz_zip_writer_add_mem(&writer, p.path.c_str(), p.body.data(), p.body.size(),
+                                    static_cast<mz_uint>(MZ_DEFAULT_COMPRESSION)),
+              MZ_TRUE)
+        << "miniz add failed for " << p.path;
+  }
+  void* archive_ptr = nullptr;
+  std::size_t archive_size = 0;
+  EXPECT_EQ(mz_zip_writer_finalize_heap_archive(&writer, &archive_ptr, &archive_size), MZ_TRUE);
+  std::vector<std::uint8_t> out(static_cast<const std::uint8_t*>(archive_ptr),
+                                static_cast<const std::uint8_t*>(archive_ptr) + archive_size);
+  mz_free(archive_ptr);
+  mz_zip_writer_end(&writer);
+  return out;
+}
+
+inline std::vector<std::uint8_t> StringToBytes(std::string_view s) {
+  return std::vector<std::uint8_t>(s.begin(), s.end());
+}
+
+// ---------------------------------------------------------------------------
+// Tests.
+// ---------------------------------------------------------------------------
+
+}  // namespace formulon::io::xlsb::reader_test_support
diff --git a/tests/unit/io/xlsb/reader_validation_test.cpp b/tests/unit/io/xlsb/reader_validation_test.cpp
new file mode 100644
index 000000000..d01205f8d
--- /dev/null
+++ b/tests/unit/io/xlsb/reader_validation_test.cpp
@@ -0,0 +1,167 @@
+// In-memory XLSB reader tests grouped by cells, formulas, validation, and passthrough.
+
+#include <array>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "gtest/gtest.h"
+#include "io/xlsb/reader.h"
+#include "miniz.h"
+#include "reader_test_helpers.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+using namespace reader_test_support;
+TEST(XlsbReader, OutOfRangeCellColumnIsRecordCorrupt) {
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  // Column index == kMaxCols is one past the last valid column (XFD).
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0, /*row=*/0, /*col=*/Sheet::kMaxCols)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_FALSE(static_cast<bool>(result));
+  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
+}
+TEST(XlsbReader, OutOfRangeRowHeaderIsRecordCorrupt) {
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  // Row index == kMaxRows is one past the last valid row.
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinReal(1.0, /*row=*/Sheet::kMaxRows, /*col=*/0)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_FALSE(static_cast<bool>(result));
+  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
+}
+TEST(XlsbReader, TruncatedPhoneticRunArrayIsRecordTruncated) {
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinIsst(0)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+  parts.push_back({"xl/sharedStrings.bin", TruncatedPhoneticSharedStringsBin()});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_FALSE(static_cast<bool>(result));
+  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordTruncated);
+}
+TEST(XlsbReader, ReversedArrayFormulaRectIsRecordCorrupt) {
+  // rw_last > rw_first but col_last < col_first: reversed on the column
+  // axis only. The anchor guard is an OR over the two axes, so without
+  // rect validation this anchor would be recorded and the spill size
+  // math would underflow-wrap.
+  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};  // PtgInt 5
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin",
+                   SheetBinArrFmla(/*rw_first=*/0, /*rw_last=*/1, /*col_first=*/2, /*col_last=*/1, rgce)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_FALSE(static_cast<bool>(result));
+  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
+}
+TEST(XlsbReader, InBoundsArrayFormulaRectStillDecodes) {
+  // A well-ordered in-bounds 2x1 rect anchored at A1 must keep decoding
+  // after the bounds validation: the anchor gets the decoded formula
+  // text and the read succeeds.
+  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};  // PtgInt 5
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin",
+                   SheetBinArrFmla(/*rw_first=*/0, /*rw_last=*/1, /*col_first=*/0, /*col_last=*/0, rgce)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message << " | " << result.error().context;
+
+  const Cell* c = result.value().workbook.sheet(0).cell_at(0, 0);
+  ASSERT_NE(c, nullptr);
+  EXPECT_EQ(c->formula_text, "=5");
+}
+TEST(XlsbReader, RejectsFullGridArrayFormulaBeforeSpillWalk) {
+  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};  // PtgInt 5
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back(
+      {"xl/worksheets/sheet1.bin", SheetBinArrFmla(/*rw_first=*/0, /*rw_last=*/Sheet::kMaxRows - 1U, /*col_first=*/0,
+                                                   /*col_last=*/Sheet::kMaxCols - 1U, rgce)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_FALSE(static_cast<bool>(result));
+  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
+}
+TEST(XlsbReader, RejectsCumulativeArrayFormulasOverSheetBudget) {
+  const std::vector<std::uint8_t> rgce = {0x1E, 0x05, 0x00};  // PtgInt 5
+  const std::vector<std::array<std::uint32_t, 4>> rects = {
+      {0U, 599999U, 0U, 0U},
+      {0U, 599999U, 1U, 1U},
+  };
+  std::vector<PartFile> parts;
+  parts.push_back({"[Content_Types].xml", StringToBytes(ContentTypesXml())});
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+  parts.push_back({"xl/worksheets/sheet1.bin", SheetBinArrFmlas(rects, rgce)});
+  parts.push_back({"xl/worksheets/sheet2.bin", SheetBinReal(1.0)});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_FALSE(static_cast<bool>(result));
+  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoXlsbRecordCorrupt);
+  EXPECT_NE(result.error().context.find("format=xlsb"), std::string::npos);
+  EXPECT_NE(result.error().context.find("anchor_row=0 anchor_col=1"), std::string::npos);
+  EXPECT_NE(result.error().context.find("used=600000 requested=600000 ceiling=1048576"), std::string::npos);
+}
+TEST(XlsbReader, MissingContentTypesIsContentTypeInvalid) {
+  std::vector<PartFile> parts;
+  parts.push_back({"_rels/.rels", StringToBytes(PackageRelsXml())});
+  parts.push_back({"xl/_rels/workbook.bin.rels", StringToBytes(WorkbookRelsXml())});
+  parts.push_back({"xl/workbook.bin", WorkbookBin()});
+
+  const std::vector<std::uint8_t> archive = BuildZip(parts);
+  auto result = read_xlsb(SpanOf(archive));
+  ASSERT_FALSE(static_cast<bool>(result));
+  EXPECT_EQ(result.error().code, FormulonErrorCode::kIoContentTypeInvalid);
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/writer_formula_test.cpp b/tests/unit/io/xlsb/writer_formula_test.cpp
new file mode 100644
index 000000000..359a8402e
--- /dev/null
+++ b/tests/unit/io/xlsb/writer_formula_test.cpp
@@ -0,0 +1,799 @@
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <iterator>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "io/xlsb/reader.h"
+#include "io/xlsb/record.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "passthrough_part.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+#include "writer_test_helpers.h"
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+// Ptg class byte at the formula's own root position. Measured against real
+// Excel 365 `.xlsb` output (spill anchors and a workbook-qualified name): a
+// bare reference
+// that is the *entire* formula body -- nothing else consumes it -- is
+// written in value class, not reference class. A reference-class token
+// cannot stand alone as a formula's result; without this a cell whose
+// whole formula is a bare range reference reads back `#VALUE!` in Excel.
+// A reference used as a function argument, or as an operand the `:` fast
+// path collapses into an Area/Area3d from within an otherwise-nested
+// position, is unaffected -- see the "stays reference class" tests below.
+namespace {
+
+// Returns the `rgce` bytes of the first `BrtArrFmla` record whose `colFirst`
+// equals `want_col`, or an empty vector if none matches.
+std::vector<std::uint8_t> FindArrFmlaRgce(const std::vector<std::uint8_t>& sheet_bytes, std::uint32_t want_col) {
+  ByteSpan cursor = SpanOf(sheet_bytes);
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    if (!record_or) {
+      return {};
+    }
+    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtArrFmla)) {
+      continue;
+    }
+    ByteSpan p = record_or.value().payload;
+    auto rw_first_or = read_u32(p);
+    auto rw_last_or = read_u32(p);
+    auto col_first_or = read_u32(p);
+    auto col_last_or = read_u32(p);
+    (void)rw_first_or;
+    (void)rw_last_or;
+    (void)col_last_or;
+    if (!col_first_or || col_first_or.value() != want_col) {
+      continue;
+    }
+    if (p.size < 1) {
+      return {};
+    }
+    p.data += 1;  // flag byte
+    p.size -= 1;
+    auto cce_or = read_u32(p);
+    if (!cce_or || cce_or.value() > p.size) {
+      return {};
+    }
+    return std::vector<std::uint8_t>(p.data, p.data + cce_or.value());
+  }
+  return {};
+}
+
+// Returns the `rgce` bytes of the `BrtFmlaNum` record at `want_col` (a
+// plain, non-array formula cell), or an empty vector if none matches.
+std::vector<std::uint8_t> FindFmlaNumRgce(const std::vector<std::uint8_t>& sheet_bytes, std::uint32_t want_col) {
+  ByteSpan cursor = SpanOf(sheet_bytes);
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    if (!record_or) {
+      return {};
+    }
+    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtFmlaNum)) {
+      continue;
+    }
+    ByteSpan p = record_or.value().payload;
+    auto col_or = read_u32(p);
+    if (!col_or || col_or.value() != want_col) {
+      continue;
+    }
+    // Skip iStyleRef(3) + fPhShow(1) + the double value(8) + grbitFlags(2).
+    if (p.size < 14) {
+      return {};
+    }
+    p.data += 14;
+    p.size -= 14;
+    auto cce_or = read_u32(p);
+    if (!cce_or || cce_or.value() > p.size) {
+      return {};
+    }
+    return std::vector<std::uint8_t>(p.data, p.data + cce_or.value());
+  }
+  return {};
+}
+}  // namespace
+
+TEST(XlsbWriter, RootLevelSameSheetRangeUsesValueClassArea) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Sheet1"));
+  sheet.set_cell_formula(1U, 2U, "=A10:A11");  // C2
+  ASSERT_TRUE(sheet.commit_spill(1U, 2U, 2U, 1U, {Value::number(5.0), Value::number(7.0)}));
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+
+  const std::vector<std::uint8_t> rgce = FindArrFmlaRgce(sheet_or.value(), 2U);
+  ASSERT_FALSE(rgce.empty());
+  EXPECT_EQ(rgce[0], 0x45U);  // PtgArea, value class (0x25 | value-class bit)
+}
+
+TEST(XlsbWriter, RootLevelCrossSheetRangeUsesValueClassArea3d) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  Sheet& sheet2 = wb.sheet(wb.add_sheet("Sheet2"));
+  sheet2.set_cell_formula(1U, 1U, "=Sheet1!A10:A11");  // B2
+  ASSERT_TRUE(sheet2.commit_spill(1U, 1U, 2U, 1U, {Value::number(5.0), Value::number(7.0)}));
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet2.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+
+  const std::vector<std::uint8_t> rgce = FindArrFmlaRgce(sheet_or.value(), 1U);
+  ASSERT_FALSE(rgce.empty());
+  EXPECT_EQ(rgce[0], 0x5BU);  // PtgArea3d, value class (0x3B | value-class bit)
+}
+
+TEST(XlsbWriter, RootLevelSingleCellReferenceUsesValueClassRef) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Sheet1"));
+  sheet.set_cell_formula(1U, 2U, "=A10");  // C2, plain (non-array) formula cell
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+
+  const std::vector<std::uint8_t> rgce = FindFmlaNumRgce(sheet_or.value(), 2U);
+  ASSERT_FALSE(rgce.empty());
+  EXPECT_EQ(rgce[0], 0x44U);  // PtgRef, value class (0x24 | value-class bit)
+}
+
+TEST(XlsbWriter, RootLevelCrossSheetSingleCellReferenceUsesValueClassRef3d) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  Sheet& sheet2 = wb.sheet(wb.add_sheet("Sheet2"));
+  sheet2.set_cell_formula(1U, 2U, "=Sheet1!A10");  // C2
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet2.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+
+  const std::vector<std::uint8_t> rgce = FindFmlaNumRgce(sheet_or.value(), 2U);
+  ASSERT_FALSE(rgce.empty());
+  EXPECT_EQ(rgce[0], 0x5AU);  // PtgRef3d, value class (0x3A | value-class bit)
+}
+
+TEST(XlsbWriter, NestedRangeArgumentStaysReferenceClass) {
+  // A reference consumed as a function argument is unaffected by the
+  // root-position promotion above: it must stay reference class, exactly
+  // as before. Real Excel 365 reads a value/array-class 3-D reference used
+  // this way as `#REF!`.
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Sheet1"));
+  sheet.set_cell_formula(1U, 2U, "=SUM(A10:A11)");  // C2, plain (non-array) formula cell
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+
+  const std::vector<std::uint8_t> rgce = FindFmlaNumRgce(sheet_or.value(), 2U);
+  ASSERT_FALSE(rgce.empty());
+  EXPECT_EQ(rgce[0], 0x25U);  // PtgArea, reference class -- SUM's argument
+}
+
+TEST(XlsbWriter, RootLevelChainedRangeWithDefinedNameWrapsInValueClassMemFunc) {
+  // The general (non-collapsible) form of a `:` range at root position:
+  // one endpoint is a defined name, so the fast-path Area/Area3d collapse
+  // in `emit_range` does not apply. Measured against an Excel 365 cell
+  // `=Sheet1!A10:Book!Rng`: real Excel wraps `operand + operand +
+  // PtgRange` in a value-class `PtgMemFunc` ("function returns a range",
+  // per ptg.h) carrying the wrapped run's byte length ahead of it, because
+  // `PtgRange` itself carries no class bits to promote directly.
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Sheet1"));
+  DefinedName dn;
+  dn.name = "Rng";
+  dn.formula = "$A$10:$A$11";
+  dn.local_sheet_id = -1;
+  wb.set_defined_names({dn});
+  sheet.set_cell_formula(1U, 2U, "=A10:Rng");  // C2
+  ASSERT_TRUE(sheet.commit_spill(1U, 2U, 2U, 1U, {Value::number(5.0), Value::number(7.0)}));
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+
+  const std::vector<std::uint8_t> rgce = FindArrFmlaRgce(sheet_or.value(), 2U);
+  ASSERT_GE(rgce.size(), 3U);
+  EXPECT_EQ(rgce[0], 0x49U);  // PtgMemFunc, value class (0x29 | value-class bit)
+  const std::uint16_t wrapped_len = static_cast<std::uint16_t>(rgce[1] | (rgce[2] << 8U));
+  ASSERT_EQ(static_cast<std::size_t>(wrapped_len), rgce.size() - 3U);
+  EXPECT_EQ(rgce.back(), 0x11U);  // the wrapped run ends with PtgRange (`:`)
+}
+
+namespace {
+
+// Returns the `rgce` bytes of the `BrtName` record spelling `want_name`, or
+// an empty vector if none matches.
+std::vector<std::uint8_t> FindNameRgce(const std::vector<std::uint8_t>& workbook_bin, std::string_view want_name) {
+  ByteSpan cursor = SpanOf(workbook_bin);
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    if (!record_or) {
+      return {};
+    }
+    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtName)) {
+      continue;
+    }
+    ByteSpan p = record_or.value().payload;
+    if (p.size < 9U) {
+      return {};
+    }
+    p.data += 9;  // grbit(4) + chKey(1) + itab(4)
+    p.size -= 9;
+    auto cch_or = read_u32(p);
+    if (!cch_or || cch_or.value() * 2U > p.size) {
+      return {};
+    }
+    std::string decoded;
+    decoded.reserve(cch_or.value());
+    for (std::uint32_t i = 0; i < cch_or.value(); ++i) {
+      decoded.push_back(static_cast<char>(p.data[i * 2U]));
+    }
+    p.data += cch_or.value() * 2U;
+    p.size -= cch_or.value() * 2U;
+    auto cce_or = read_u32(p);
+    if (!cce_or || cce_or.value() > p.size) {
+      return {};
+    }
+    if (decoded != want_name) {
+      continue;
+    }
+    return std::vector<std::uint8_t>(p.data, p.data + cce_or.value());
+  }
+  return {};
+}
+
+// Returns the first nine payload bytes (grbit, chKey, itab) of the `BrtName`
+// record spelling `want_name`, or an empty vector if none matches.
+std::vector<std::uint8_t> FindNameRecordPrefix(const std::vector<std::uint8_t>& workbook_bin,
+                                               std::string_view want_name) {
+  ByteSpan cursor = SpanOf(workbook_bin);
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    if (!record_or) {
+      return {};
+    }
+    const ByteSpan p = record_or.value().payload;
+    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtName) || p.size < 13U) {
+      continue;
+    }
+    const std::uint32_t cch = static_cast<std::uint32_t>(p.data[9]) | (static_cast<std::uint32_t>(p.data[10]) << 8);
+    if (cch != want_name.size() || p.size < 13U + cch * 2U) {
+      continue;
+    }
+    std::string decoded;
+    for (std::uint32_t i = 0; i < cch; ++i) {
+      decoded.push_back(static_cast<char>(p.data[13U + i * 2U]));
+    }
+    if (decoded == want_name) {
+      return std::vector<std::uint8_t>(p.data, p.data + 9);
+    }
+  }
+  return {};
+}
+
+// Returns `xl/workbook.bin`'s `BrtWbView` `itabCur` field (u32 at payload
+// offset 24), or `0xFFFFFFFF` if the record is missing or truncated.
+std::uint32_t FindItabCur(const std::vector<std::uint8_t>& workbook_bin) {
+  ByteSpan cursor = SpanOf(workbook_bin);
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    if (!record_or) {
+      return 0xFFFFFFFFU;
+    }
+    if (record_or.value().type != 158U) {  // BrtWbView
+      continue;
+    }
+    ByteSpan p = record_or.value().payload;
+    if (p.size < 28U) {
+      return 0xFFFFFFFFU;
+    }
+    p.data += 24;
+    auto itab_or = read_u32(p);
+    return itab_or ? itab_or.value() : 0xFFFFFFFFU;
+  }
+  return 0xFFFFFFFFU;
+}
+
+}  // namespace
+
+TEST(XlsbWriter, DefinedNameBodyRootReferenceStaysReferenceClass) {
+  // Measured against an Excel 365 BrtName "Rng" (=Sheet1!$A$10:$A$11):
+  // unlike a cell formula, a defined
+  // name's own body keeps reference class at its root.
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  DefinedName dn;
+  dn.name = "Rng";
+  dn.formula = "Sheet1!$A$10:$A$11";
+  dn.local_sheet_id = -1;
+  wb.set_defined_names({dn});
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto wb_bin_or = zip.read_entry("xl/workbook.bin");
+  ASSERT_TRUE(static_cast<bool>(wb_bin_or));
+
+  const std::vector<std::uint8_t> rgce = FindNameRgce(wb_bin_or.value(), "Rng");
+  const std::vector<std::uint8_t> want = {0x3B, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x0A,
+                                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+  EXPECT_EQ(rgce, want);
+}
+
+TEST(XlsbWriter, ItabCurMatchesTheTabSelectedSheet) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  Sheet& sheet2 = wb.sheet(wb.add_sheet("Sheet2"));
+  sheet2.mutable_view().tab_selected = true;
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto wb_bin_or = zip.read_entry("xl/workbook.bin");
+  ASSERT_TRUE(static_cast<bool>(wb_bin_or));
+
+  EXPECT_EQ(FindItabCur(wb_bin_or.value()), 1U);
+}
+
+TEST(XlsbWriter, ItabCurIsZeroWhenNoSheetIsTabSelected) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.add_sheet("Sheet2");
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto wb_bin_or = zip.read_entry("xl/workbook.bin");
+  ASSERT_TRUE(static_cast<bool>(wb_bin_or));
+
+  EXPECT_EQ(FindItabCur(wb_bin_or.value()), 0U);
+}
+
+TEST(XlsbWriter, RealFormulaRoundTripsAsFormulaCell) {
+  // An engine-authored formula encodes to a Ptg stream, survives the
+  // write, and decodes back to the same formula text on read.
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("F"));
+  s.set_cell_formula(2U, 3U, "=A1+B2*3");
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+
+  const Cell* c = read_or.value().workbook.sheet(0).cell_at(2U, 3U);
+  ASSERT_NE(c, nullptr);
+  EXPECT_EQ(c->formula_text, "=A1+B2*3");
+}
+
+// Measured on Excel 365: it saves
+// `S!Name` that neither `S` nor the workbook defines against an empty stub
+// scoped to `S`, never against another sheet's definition, so `Sheet2!SVal`
+// stays #NAME? while only Sheet1 defines SVal.
+TEST(XlsbWriter, SheetQualifiedNamesKeepTheirQualifierAndScope) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.add_sheet("Sheet2");
+  DefinedName dn;
+  dn.name = "SVal";
+  dn.formula = "9";
+  dn.local_sheet_id = 0;
+  wb.set_defined_names({dn});
+  struct Case {
+    const char* formula;
+    Value want;
+  };
+  const Case cases[] = {
+      {"=Sheet2!SVal", Value::error(ErrorCode::Name)},      {"=Sheet1!SVal", Value::number(9.0)},
+      {"=Sheet1!NOSUCH(1)", Value::error(ErrorCode::Name)}, {"=Sheet2!NOSUCH(1)", Value::error(ErrorCode::Name)},
+      {"=NOSUCH(1)", Value::error(ErrorCode::Name)},        {"=Sheet1!A1(1)", Value::error(ErrorCode::Ref)},
+  };
+  for (std::uint32_t row = 0; row < std::size(cases); ++row) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, row, 1U, cases[row].formula)));
+  }
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  Workbook& back = read_or.value().workbook;
+  ASSERT_TRUE(static_cast<bool>(back.recalc(eval::default_registry())));
+
+  for (std::uint32_t row = 0; row < std::size(cases); ++row) {
+    const Cell* c = back.sheet(0).cell_at(row, 1U);
+    ASSERT_NE(c, nullptr) << cases[row].formula;
+    EXPECT_EQ(c->formula_text, cases[row].formula);
+    EXPECT_EQ(c->cached_value, cases[row].want) << cases[row].formula;
+  }
+}
+
+TEST(XlsbWriter, DefinedNameWithFutureFunctionRoundTrips) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Data");
+  wb.set_defined_names({DefinedName{"Joined", "TEXTJOIN(\",\",TRUE,A1:A2)", -1, false, ""}});
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  ASSERT_EQ(read_or.value().workbook.defined_names().size(), 1U);
+  EXPECT_EQ(read_or.value().workbook.defined_names()[0].name, "Joined");
+  // Read back in formula-bar spelling, as the OOXML reader does.
+  EXPECT_EQ(read_or.value().workbook.defined_names()[0].formula, "TEXTJOIN(\",\",TRUE,A1:A2)");
+}
+
+// True when `haystack` contains `needle` encoded the way `BrtName`
+// stores a name: UTF-16LE, no BOM. Excel names are ASCII, so each byte
+// is followed by a zero byte.
+bool ContainsUtf16Le(const std::vector<std::uint8_t>& haystack, std::string_view needle) {
+  std::vector<std::uint8_t> wide;
+  wide.reserve(needle.size() * 2U);
+  for (const char c : needle) {
+    wide.push_back(static_cast<std::uint8_t>(c));
+    wide.push_back(0U);
+  }
+  return std::search(haystack.begin(), haystack.end(), wide.begin(), wide.end()) != haystack.end();
+}
+
+TEST(XlsbWriter, FutureFunctionCallRegistersHiddenName) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("F"));
+  s.set_cell_formula(0U, 0U, "=XLOOKUP(\"k\",A1:A3,B1:B3)");
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(write_or.value().bytes))));
+  auto workbook_or = zip.read_entry("xl/workbook.bin");
+  ASSERT_TRUE(static_cast<bool>(workbook_or));
+  EXPECT_TRUE(ContainsUtf16Le(workbook_or.value(), "_xlfn.XLOOKUP"));
+}
+
+// Measured on Excel 365: it stores a cached #SPILL! or
+// #CALC! as #VALUE! (the real error lives in a rich value this writer does
+// not produce) and #GETTING_DATA as #N/A. A newer error byte in a cell made
+// Excel refuse the whole file.
+TEST(XlsbWriter, NewerErrorsAreStoredAsTheirLegacyFallback) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("E"));
+  const ErrorCode errors[] = {ErrorCode::Spill, ErrorCode::Calc, ErrorCode::GettingData, ErrorCode::Div0};
+  const ErrorCode stored[] = {ErrorCode::Value, ErrorCode::Value, ErrorCode::NA, ErrorCode::Div0};
+  for (std::uint32_t row = 0; row < std::size(errors); ++row) {
+    s.set_cell_formula(row, 0U, "=1/0");
+    s.set_cell_cached_value(row, 0U, Value::error(errors[row]));
+    s.set_cell_value(row, 1U, Value::error(errors[row]));
+  }
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Sheet& back = read_or.value().workbook.sheet(0);
+  for (std::uint32_t row = 0; row < std::size(errors); ++row) {
+    for (std::uint32_t col = 0; col < 2U; ++col) {
+      const Cell* c = back.cell_at(row, col);
+      ASSERT_NE(c, nullptr);
+      const Value& v = c->cached_value;
+      EXPECT_EQ(v, Value::error(stored[row])) << "row " << row << " col " << col;
+    }
+  }
+}
+
+// Measured on Excel 365: it keeps `_xlfn.` on a name it
+// does not know, in the formula bar and in the file.
+TEST(XlsbWriter, UnknownPrefixedNameKeepsItsPrefix) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0U, 0U, "=_xlfn.FOOBAR(1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1U, 0U, "=_xlfn.XLOOKUP(1,B1:B2,C1:C2)")));
+  EXPECT_EQ(wb.sheet(0).cell_at(0U, 0U)->formula_text, "=_xlfn.FOOBAR(1)");
+  EXPECT_EQ(wb.sheet(0).cell_at(1U, 0U)->formula_text, "=XLOOKUP(1,B1:B2,C1:C2)");
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  // `_xlfn.FOOBAR` is a plain undefined-name stub (flags 0, empty body), and
+  // only a function Excel knows gets the hidden future-function record.
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto wb_bin_or = zip.read_entry("xl/workbook.bin");
+  ASSERT_TRUE(static_cast<bool>(wb_bin_or));
+  EXPECT_EQ(FindNameRecordPrefix(wb_bin_or.value(), "_xlfn.FOOBAR"),
+            (std::vector<std::uint8_t>{0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF}));
+  EXPECT_TRUE(FindNameRgce(wb_bin_or.value(), "_xlfn.FOOBAR").empty());
+  EXPECT_EQ(FindNameRecordPrefix(wb_bin_or.value(), "_xlfn.XLOOKUP"),
+            (std::vector<std::uint8_t>{0x0B, 0x00, 0x02, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF}));
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Sheet& back = read_or.value().workbook.sheet(0);
+  EXPECT_EQ(back.cell_at(0U, 0U)->formula_text, "=_xlfn.FOOBAR(1)");
+  EXPECT_EQ(back.cell_at(1U, 0U)->formula_text, "=XLOOKUP(1,B1:B2,C1:C2)");
+}
+
+// A loaded formula keeps the meaning its file gives it. With no dynamic-array
+// mark (`cm` / `BrtCellMeta`), a fixed-size CSE block and an
+// implicit-intersection =SUM(A1:A2*2) are not dynamic-array formulas, and a
+// save through either container keeps them so: the block its array range,
+// neither of them a mark. A formula entered through `Workbook` is marked and
+// keeps the mark across both containers.
+TEST(XlsbWriter, LegacyFormulasKeepTheirMeaningAcrossContainers) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("Sheet1"));
+  s.set_cell_value(0U, 0U, Value::number(1.0));
+  s.set_cell_value(1U, 0U, Value::number(2.0));
+  s.set_cell_formula(0U, 2U, "=A1:A2*2");
+  ASSERT_TRUE(s.commit_spill(0U, 2U, 2U, 1U, {Value::number(2.0), Value::number(4.0)}));
+  s.set_cell_formula(0U, 4U, "=SUM(A1:A2*2)");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0U, 5U, "=SUM(A1:A2*2)")));
+
+  auto check = [](const Workbook& back, const char* label) {
+    const Sheet& sheet = back.sheet(0);
+    EXPECT_FALSE(sheet.cell_at(0U, 2U)->dynamic_array) << label;
+    const SpillRegion* block = sheet.spill_region_at_anchor(0U, 2U);
+    ASSERT_NE(block, nullptr) << label;
+    EXPECT_EQ(block->rows, 2U) << label;
+    EXPECT_FALSE(sheet.cell_at(0U, 4U)->dynamic_array) << label;
+    EXPECT_TRUE(sheet.cell_at(0U, 5U)->dynamic_array) << label;
+  };
+
+  auto xlsx_or = write_ooxml(wb);
+  ASSERT_TRUE(static_cast<bool>(xlsx_or)) << xlsx_or.error().message;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(xlsx_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.xml");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+  const std::string sheet_xml(sheet_or.value().begin(), sheet_or.value().end());
+  EXPECT_NE(sheet_xml.find("<c r=\"C1\"><f t=\"array\" ref=\"C1:C2\">"), std::string::npos) << sheet_xml;
+  EXPECT_NE(sheet_xml.find("<c r=\"E1\"><f>SUM(A1:A2*2)</f>"), std::string::npos) << sheet_xml;
+  EXPECT_NE(sheet_xml.find("<c r=\"F1\" cm=\"1\"><f t=\"array\" ref=\"F1\">"), std::string::npos) << sheet_xml;
+  auto from_xlsx = read_ooxml(SpanOf(xlsx_or.value()));
+  ASSERT_TRUE(static_cast<bool>(from_xlsx)) << from_xlsx.error().message;
+  check(from_xlsx.value().workbook, "xlsx");
+
+  auto xlsb_or = write_xlsb(from_xlsx.value().workbook);
+  ASSERT_TRUE(static_cast<bool>(xlsb_or)) << xlsb_or.error().message;
+  auto from_xlsb = read_xlsb(SpanOf(xlsb_or.value()));
+  ASSERT_TRUE(static_cast<bool>(from_xlsb)) << from_xlsb.error().message;
+  check(from_xlsb.value().workbook, "xlsb");
+}
+
+TEST(XlsbWriter, CubeFunctionsEncodeWithTheirFunctionIds) {
+  // Excel 365 saves `CUBEVALUE("c","m")` as two strings and
+  // `PtgFuncVar(2, 380)`, not through a hidden `_xlfn.` name.
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("F"));
+  s.set_cell_formula(0U, 0U, "=CUBEVALUE(\"c\",\"m\")");
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(write_or.value().bytes))));
+  auto workbook_or = zip.read_entry("xl/workbook.bin");
+  ASSERT_TRUE(static_cast<bool>(workbook_or));
+  EXPECT_FALSE(ContainsUtf16Le(workbook_or.value(), "CUBEVALUE"));
+
+  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Cell* cell = read_or.value().workbook.sheet(0).cell_at(0U, 0U);
+  ASSERT_NE(cell, nullptr);
+  EXPECT_EQ(cell->formula_text, "=CUBEVALUE(\"c\",\"m\")");
+}
+
+TEST(XlsbWriter, UndefinedNameCallIsStoredAgainstAWorkbookStub) {
+  // Measured on Excel 365: a lone `NOSUCH(1)` is
+  // `PtgName` + the argument + `PtgFuncVar(255)`, the name an empty,
+  // visible, workbook-scoped BrtName.
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0U, 0U, "=NOSUCH(1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1U, 0U, "=NOSUCHREF")));
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(write_or.value().bytes))));
+  auto workbook_or = zip.read_entry("xl/workbook.bin");
+  ASSERT_TRUE(static_cast<bool>(workbook_or));
+  EXPECT_EQ(FindNameRecordPrefix(workbook_or.value(), "NOSUCH"),
+            (std::vector<std::uint8_t>{0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF}));
+
+  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  Workbook& back = read_or.value().workbook;
+  ASSERT_TRUE(static_cast<bool>(back.recalc(eval::default_registry())));
+  for (std::uint32_t row = 0; row < 2U; ++row) {
+    const Cell* cell = back.sheet(0).cell_at(row, 0U);
+    ASSERT_NE(cell, nullptr);
+    EXPECT_EQ(cell->formula_text, row == 0U ? "=NOSUCH(1)" : "=NOSUCHREF");
+    EXPECT_EQ(cell->cached_value, Value::error(ErrorCode::Name));
+  }
+}
+
+TEST(XlsbWriter, LocalisedJisSpellingSavesAsTheStoredDbcsSpelling) {
+  // Excel localises the formula bar but not the file: `JIS` is the ja-JP
+  // spelling of `DBCS`, and Excel stores the call as `DBCS` with
+  // function id 215 in both containers. A workbook carrying either
+  // spelling must save without degrading, and both come back as the
+  // stored spelling.
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("F"));
+  s.set_cell_formula(0U, 0U, "=JIS(\"ABC\")");
+  s.set_cell_formula(1U, 0U, "=DBCS(\"ABC\")");
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
+
+  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Sheet& rt = read_or.value().workbook.sheet(0);
+  const Cell* from_jis = rt.cell_at(0U, 0U);
+  ASSERT_NE(from_jis, nullptr);
+  EXPECT_EQ(from_jis->formula_text, "=DBCS(\"ABC\")");
+  const Cell* from_dbcs = rt.cell_at(1U, 0U);
+  ASSERT_NE(from_dbcs, nullptr);
+  EXPECT_EQ(from_dbcs->formula_text, "=DBCS(\"ABC\")");
+}
+
+TEST(XlsbWriter, HarvestedFuncIdCallsRoundTripWithIdenticalFormulaText) {
+  // The ids for these callees were decoded from an Excel-produced
+  // workbook (`tests/fixtures/excel/xlsb_func_ids.xlsb`). Each spells a
+  // different encoding decision the table drives: a fixed-arity
+  // `PtgFunc` (MROUND), a `PtgFuncVar` at its minimum and its maximum
+  // arity (WEEKNUM), and an open-ended variadic (GCD). None may degrade
+  // to a cached literal, and every formula must come back byte-identical.
+  constexpr std::uint32_t kFormulaCount = 5U;
+  const char* kFormulas[kFormulaCount] = {
+      "=MROUND(17,5)", "=WEEKNUM(43922)", "=WEEKNUM(43922,1)", "=GCD(24,36,60)", "=YEARFRAC(43831,44197,0)",
+  };
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("F"));
+  for (std::uint32_t i = 0; i < kFormulaCount; ++i) {
+    s.set_cell_formula(i, 0U, kFormulas[i]);
+  }
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
+
+  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Sheet& rt = read_or.value().workbook.sheet(0);
+  for (std::uint32_t i = 0; i < kFormulaCount; ++i) {
+    const Cell* cell = rt.cell_at(i, 0U);
+    ASSERT_NE(cell, nullptr) << kFormulas[i];
+    EXPECT_EQ(cell->formula_text, kFormulas[i]);
+  }
+}
+
+TEST(XlsbWriter, UnencodableFormulaDowngradesToCachedLiteralAndReportsIt) {
+  // A structured reference (`T[C]`) has no Ptg lowering in the
+  // common-token codec. A single unsupported formula must not make the
+  // whole workbook unsaveable: it degrades to its cached literal and the
+  // explicit result count records the loss.
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("F"));
+  s.set_cell_formula(0U, 0U, "=T[C]");
+  s.set_cell_cached_value(0U, 0U, Value::number(42.0));
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 1U);
+  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Cell* cell = read_or.value().workbook.sheet(0).cell_at(0U, 0U);
+  ASSERT_NE(cell, nullptr);
+  EXPECT_TRUE(cell->formula_text.empty());
+  ASSERT_TRUE(cell->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(cell->cached_value.as_number(), 42.0);
+}
+
+TEST(XlsbWriter, UnencodableSpillFormulaDowngradesAnchorWithoutPhantoms) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("F"));
+  s.set_cell_formula(0U, 0U, "=T[C]");
+  ASSERT_TRUE(s.commit_spill(0U, 0U, 1U, 2U, {Value::number(11.0), Value::number(12.0)}));
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 1U);
+  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Sheet& rt = read_or.value().workbook.sheet(0);
+  const Cell* anchor = rt.cell_at(0U, 0U);
+  ASSERT_NE(anchor, nullptr);
+  EXPECT_TRUE(anchor->formula_text.empty());
+  ASSERT_TRUE(anchor->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(anchor->cached_value.as_number(), 11.0);
+  EXPECT_EQ(rt.cell_at(0U, 1U), nullptr);
+}
+
+TEST(XlsbWriter, GeneratedPartsBeatPassthroughOnCollision) {
+  // Passthrough trying to ride on the writer's reserved
+  // `xl/workbook.bin` path: must be dropped (writer logs a warning,
+  // not asserted here), and the round-trip must still succeed.
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("S1"));
+  s.set_cell_value(0U, 0U, Value::number(1.0));
+
+  std::vector<PassthroughPart> parts;
+  PassthroughPart bogus_workbook;
+  bogus_workbook.path = "xl/workbook.bin";
+  bogus_workbook.content_type = "application/vnd.ms-excel.sheet.binary.macroEnabled.main";
+  bogus_workbook.bytes = {0xDE, 0xAD, 0xBE, 0xEF};  // garbage — would break the package if it survived
+  parts.push_back(std::move(bogus_workbook));
+  wb.set_passthrough_parts(std::move(parts));
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or));
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  // Workbook is intact: we got our sheet back.
+  ASSERT_EQ(read_or.value().workbook.sheet_count(), 1U);
+  EXPECT_EQ(read_or.value().workbook.sheet(0).name(), "S1");
+}
+TEST(XlsbWriter, WholeColumnFormulaSavesWithoutDowngrade) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Ranges"));
+  sheet.set_cell_formula(0U, 0U, "=SUM(A:A)");
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
+  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Cell* cell = read_or.value().workbook.sheet(0).cell_at(0U, 0U);
+  ASSERT_NE(cell, nullptr);
+  EXPECT_EQ(cell->formula_text, "=SUM(A:A)");
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/writer_layout_test.cpp b/tests/unit/io/xlsb/writer_layout_test.cpp
new file mode 100644
index 000000000..50ec18716
--- /dev/null
+++ b/tests/unit/io/xlsb/writer_layout_test.cpp
@@ -0,0 +1,514 @@
+// XLSB writer round-trip tests: layout, hyperlinks, and styles.
+
+#include <cstddef>
+#include <cstdint>
+#include <map>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "gtest/gtest.h"
+#include "io/auto_filter_xml.h"
+#include "io/xlsb/reader.h"
+#include "io/xlsb/record.h"
+#include "io/xlsb/record_writer.h"
+#include "io/xlsb/styles_writer.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "passthrough_part.h"
+#include "sheet.h"
+#include "styles.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+#include "writer_test_helpers.h"
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+
+TEST(XlsbWriter, SheetVisibilitySurvivesRoundTrip) {
+  // A hidden sheet must stay hidden across write -> read. The Sheet model
+  // tracks visibility via `view().tab_hidden`, which the writer maps to
+  // BrtBundleSh hsState and the reader maps back.
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Visible");
+  wb.add_sheet("Hidden");
+  wb.sheet(1).mutable_view().tab_hidden = true;
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const Workbook& rt = read_or.value().workbook;
+  ASSERT_EQ(rt.sheet_count(), 2U);
+  EXPECT_FALSE(rt.sheet(0).view().tab_hidden);
+  EXPECT_TRUE(rt.sheet(1).view().tab_hidden);
+}
+
+TEST(XlsbWriter, Date1904SurvivesRoundTrip) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Dates");
+  wb.set_date1904(true);
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  EXPECT_TRUE(read_or.value().workbook.date1904());
+}
+
+TEST(XlsbWriter, RowAndColumnLayoutSurviveRoundTrip) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Layout"));
+  sheet.mutable_layout().columns.push_back(ColumnLayout{1U, 3U, 17.25, true, 2U});
+  sheet.mutable_layout().row_overrides.push_back(RowLayout{4U, 28.5, true, 3U, true, true});
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const SheetLayout& layout = read_or.value().workbook.sheet(0).layout();
+  ASSERT_EQ(layout.columns.size(), 1U);
+  EXPECT_EQ(layout.columns[0].first, 1U);
+  EXPECT_EQ(layout.columns[0].last, 3U);
+  EXPECT_DOUBLE_EQ(layout.columns[0].width, 17.25);
+  EXPECT_TRUE(layout.columns[0].has_width);
+  // BrtColInfo always carries ixfe, so XLSB canonicalizes a width-only
+  // aggregate span to effective style 0 on read.
+  EXPECT_TRUE(layout.columns[0].has_style);
+  EXPECT_EQ(layout.columns[0].style_xf, 0U);
+  EXPECT_TRUE(layout.columns[0].hidden);
+  EXPECT_EQ(layout.columns[0].outline_level, 2U);
+  ASSERT_EQ(layout.row_overrides.size(), 1U);
+  EXPECT_EQ(layout.row_overrides[0].row, 4U);
+  EXPECT_DOUBLE_EQ(layout.row_overrides[0].height, 28.5);
+  EXPECT_TRUE(layout.row_overrides[0].hidden);
+  EXPECT_EQ(layout.row_overrides[0].outline_level, 3U);
+}
+
+TEST(XlsbWriter, RowStyleFlagCarriesExplicitZeroAndNonZeroStyles) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("RowStyles"));
+  RowLayout style_zero;
+  style_zero.row = 2U;
+  style_zero.has_style = true;
+  style_zero.style_xf = 0U;
+  RowLayout style_one;
+  style_one.row = 3U;
+  style_one.has_style = true;
+  style_one.style_xf = 1U;
+  sheet.mutable_layout().row_overrides = {style_zero, style_one};
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+
+  std::map<std::uint32_t, std::pair<std::uint32_t, std::uint8_t>> raw;
+  ByteSpan cursor = SpanOf(sheet_or.value());
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    ASSERT_TRUE(static_cast<bool>(record_or));
+    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtRowHdr)) {
+      continue;
+    }
+    ByteSpan payload = record_or.value().payload;
+    auto row_or = read_u32(payload);
+    auto style_or = read_u32(payload);
+    ASSERT_TRUE(row_or && style_or);
+    ASSERT_TRUE(read_u16(payload));
+    ASSERT_TRUE(read_u8(payload));
+    auto flags_or = read_u8(payload);
+    ASSERT_TRUE(read_u8(payload));
+    ASSERT_TRUE(flags_or);
+    raw[row_or.value()] = {style_or.value(), flags_or.value()};
+  }
+  ASSERT_EQ(raw.size(), 2U);
+  EXPECT_EQ(raw.at(2U).first, 0U);
+  EXPECT_NE(raw.at(2U).second & 0x40U, 0U);
+  EXPECT_EQ(raw.at(3U).first, 1U);
+  EXPECT_NE(raw.at(3U).second & 0x40U, 0U);
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const auto& rows = read_or.value().workbook.sheet(0).layout().row_overrides;
+  ASSERT_EQ(rows.size(), 2U);
+  EXPECT_TRUE(rows[0].has_style);
+  EXPECT_TRUE(rows[1].has_style);
+  const auto find_row = [&rows](std::uint32_t row) -> const RowLayout* {
+    for (const RowLayout& candidate : rows) {
+      if (candidate.row == row) {
+        return &candidate;
+      }
+    }
+    return nullptr;
+  };
+  const RowLayout* loaded_zero = find_row(2U);
+  const RowLayout* loaded_one = find_row(3U);
+  ASSERT_NE(loaded_zero, nullptr);
+  ASSERT_NE(loaded_one, nullptr);
+  EXPECT_TRUE(loaded_zero->has_style);
+  EXPECT_EQ(loaded_zero->style_xf, 0U);
+  EXPECT_TRUE(loaded_one->has_style);
+  EXPECT_EQ(loaded_one->style_xf, 1U);
+}
+
+TEST(XlsbWriter, MergedRangesSurviveRoundTrip) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Merged"));
+  sheet.set_cell_value(0U, 0U, Value::text("title"));
+  sheet.mutable_merges().push_back(MergeRange{0U, 0U, 1U, 2U});
+  sheet.mutable_merges().push_back(MergeRange{4U, 3U, 4U, 5U});
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const std::vector<MergeRange>& merges = read_or.value().workbook.sheet(0).merges();
+  ASSERT_EQ(merges.size(), 2U);
+  EXPECT_EQ(merges[0].first_row, 0U);
+  EXPECT_EQ(merges[0].first_col, 0U);
+  EXPECT_EQ(merges[0].last_row, 1U);
+  EXPECT_EQ(merges[0].last_col, 2U);
+  EXPECT_EQ(merges[1].first_row, 4U);
+  EXPECT_EQ(merges[1].first_col, 3U);
+  EXPECT_EQ(merges[1].last_row, 4U);
+  EXPECT_EQ(merges[1].last_col, 5U);
+}
+
+TEST(XlsbWriter, SheetViewAndFrozenPanesSurviveRoundTrip) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("View"));
+  sheet.set_cell_value(0U, 0U, Value::number(1.0));
+  SheetView& view = sheet.mutable_view();
+  view.zoom_scale = 135U;
+  view.freeze_rows = 3U;
+  view.freeze_cols = 2U;
+  view.show_grid_lines = false;
+  view.show_row_col_headers = false;
+  view.show_zeros = false;
+  view.right_to_left = true;
+  view.tab_selected = true;
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+  ByteSpan records = SpanOf(sheet_or.value());
+  bool saw_pane = false;
+  while (records.size != 0U) {
+    auto rec_or = read_record(records);
+    ASSERT_TRUE(static_cast<bool>(rec_or));
+    if (rec_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtPane)) {
+      continue;
+    }
+    saw_pane = true;
+    ByteSpan pane = rec_or.value().payload;
+    ASSERT_EQ(pane.size, 29U);
+    pane.data += 16U;  // two Xnum frozen row/column counts
+    pane.size -= 16U;
+    auto top_row_or = read_u32(pane);
+    auto left_col_or = read_u32(pane);
+    auto active_pane_or = read_u32(pane);
+    auto flags_or = read_u8(pane);
+    ASSERT_TRUE(top_row_or && left_col_or && active_pane_or && flags_or);
+    EXPECT_EQ(top_row_or.value(), 3U);
+    EXPECT_EQ(left_col_or.value(), 2U);
+    EXPECT_EQ(active_pane_or.value(), 0U);
+    EXPECT_EQ(flags_or.value(), 0x02U);
+  }
+  EXPECT_TRUE(saw_pane);
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const SheetView& rt = read_or.value().workbook.sheet(0).view();
+  EXPECT_EQ(rt.zoom_scale, 135U);
+  EXPECT_EQ(rt.freeze_rows, 3U);
+  EXPECT_EQ(rt.freeze_cols, 2U);
+  EXPECT_FALSE(rt.show_grid_lines);
+  EXPECT_FALSE(rt.show_row_col_headers);
+  EXPECT_FALSE(rt.show_zeros);
+  EXPECT_TRUE(rt.right_to_left);
+  EXPECT_TRUE(rt.tab_selected);
+}
+
+TEST(XlsbWriter, ReportsDeferredSheetFeatures) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Deferred"));
+  Hyperlink hyperlink;
+  hyperlink.target = "https://example.com";
+  sheet.mutable_hyperlinks().push_back(std::move(hyperlink));
+  sheet.mutable_validations().push_back(DataValidation{});
+  sheet.set_auto_filter(io::auto_filter_from_xml("<autoFilter ref=\"A1:B2\"/>"));
+  sheet.mutable_view().freeze_rows = 1U;
+
+  auto write_or = write_xlsb_with_result(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  // Auto-filter state remains deferred; hyperlinks and validations are
+  // written from the model and therefore no longer inflate this counter.
+  EXPECT_EQ(write_or.value().diagnostics.deferred_feature_count, 1U);
+}
+
+TEST(XlsbWriter, RejectsInvalidHyperlinkRectangle) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("InvalidHyperlink"));
+  Hyperlink inverted;
+  inverted.row = 4U;
+  inverted.col = 5U;
+  inverted.last_row = 3U;
+  inverted.last_col = 6U;
+  inverted.target = "https://invalid.example";
+  sheet.mutable_hyperlinks().push_back(inverted);
+
+  auto inverted_write = write_xlsb(wb);
+  ASSERT_FALSE(static_cast<bool>(inverted_write));
+  EXPECT_EQ(inverted_write.error().code, FormulonErrorCode::kInvalidArgument);
+
+  sheet.mutable_hyperlinks().clear();
+  Hyperlink out_of_grid;
+  out_of_grid.row = 0U;
+  out_of_grid.col = 0U;
+  out_of_grid.last_row = Sheet::kMaxRows;
+  out_of_grid.last_col = 0U;
+  out_of_grid.target = "https://invalid.example";
+  sheet.mutable_hyperlinks().push_back(out_of_grid);
+  auto out_of_grid_write = write_xlsb(wb);
+  ASSERT_FALSE(static_cast<bool>(out_of_grid_write));
+  EXPECT_EQ(out_of_grid_write.error().code, FormulonErrorCode::kInvalidArgument);
+}
+
+TEST(XlsbWriter, RoundTripsExternalAndInternalHyperlinkRectangles) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Hyperlinks"));
+  Hyperlink external;
+  external.row = 1U;
+  external.col = 2U;
+  external.last_row = 3U;
+  external.last_col = 4U;
+  external.target = "https://external.example/book.xlsx";
+  external.location = "#Sheet2!A1";
+  external.tooltip = "external";
+  external.display = "Open";
+  sheet.mutable_hyperlinks().push_back(external);
+  Hyperlink internal;
+  internal.row = 6U;
+  internal.col = 7U;
+  internal.last_row = 8U;
+  internal.last_col = 9U;
+  internal.location = "Sheet1!A1";
+  internal.tooltip = "internal";
+  internal.display = "Jump";
+  sheet.mutable_hyperlinks().push_back(internal);
+
+  auto first_write = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(first_write)) << first_write.error().message << " | " << first_write.error().context;
+  auto first_read = read_xlsb(SpanOf(first_write.value()));
+  ASSERT_TRUE(static_cast<bool>(first_read)) << first_read.error().message << " | " << first_read.error().context;
+  Workbook edited = std::move(first_read.value().workbook);
+  ASSERT_EQ(edited.sheet(0).hyperlinks().size(), 2U);
+  edited.sheet(0).mutable_hyperlinks()[0].row = 2U;
+  edited.sheet(0).mutable_hyperlinks()[0].last_row = 4U;
+
+  auto second_write = write_xlsb(edited);
+  ASSERT_TRUE(static_cast<bool>(second_write)) << second_write.error().message << " | " << second_write.error().context;
+  auto second_read = read_xlsb(SpanOf(second_write.value()));
+  ASSERT_TRUE(static_cast<bool>(second_read)) << second_read.error().message << " | " << second_read.error().context;
+  const auto& hyperlinks = second_read.value().workbook.sheet(0).hyperlinks();
+  ASSERT_EQ(hyperlinks.size(), 2U);
+  EXPECT_EQ(hyperlinks[0].row, 2U);
+  EXPECT_EQ(hyperlinks[0].col, 2U);
+  EXPECT_EQ(hyperlinks[0].last_row, 4U);
+  EXPECT_EQ(hyperlinks[0].last_col, 4U);
+  EXPECT_EQ(hyperlinks[0].target, "https://external.example/book.xlsx");
+  EXPECT_FALSE(hyperlinks[0].rid.empty());
+  EXPECT_EQ(hyperlinks[1].row, 6U);
+  EXPECT_EQ(hyperlinks[1].col, 7U);
+  EXPECT_EQ(hyperlinks[1].last_row, 8U);
+  EXPECT_EQ(hyperlinks[1].last_col, 9U);
+  EXPECT_TRUE(hyperlinks[1].rid.empty());
+  EXPECT_EQ(hyperlinks[1].location, "Sheet1!A1");
+}
+
+TEST(XlsbWriter, ReusesSharedSourceRelationshipIdForMatchingTargets) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("SharedRids"));
+  Hyperlink first;
+  first.row = 1U;
+  first.col = 1U;
+  first.last_row = 1U;
+  first.last_col = 2U;
+  first.target = "https://shared.example/target";
+  first.rid = "rIdShared";
+  sheet.mutable_hyperlinks().push_back(first);
+  Hyperlink second;
+  second.row = 3U;
+  second.col = 1U;
+  second.last_row = 3U;
+  second.last_col = 2U;
+  second.target = "https://shared.example/target";
+  second.rid = "rIdShared";
+  sheet.mutable_hyperlinks().push_back(second);
+
+  auto write_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(write_or.value()))));
+  auto rels_or = zip.read_entry("xl/worksheets/_rels/sheet1.bin.rels");
+  ASSERT_TRUE(static_cast<bool>(rels_or));
+  const std::string rels(rels_or.value().begin(), rels_or.value().end());
+  const std::string id_token = "Id=\"rIdShared\"";
+  const std::size_t first_id = rels.find(id_token);
+  ASSERT_NE(first_id, std::string::npos) << rels;
+  EXPECT_EQ(rels.find(id_token, first_id + id_token.size()), std::string::npos) << rels;
+
+  auto read_or = read_xlsb(SpanOf(write_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const auto& hyperlinks = read_or.value().workbook.sheet(0).hyperlinks();
+  ASSERT_EQ(hyperlinks.size(), 2U);
+  EXPECT_EQ(hyperlinks[0].rid, "rIdShared");
+  EXPECT_EQ(hyperlinks[1].rid, "rIdShared");
+  EXPECT_EQ(hyperlinks[0].target, hyperlinks[1].target);
+}
+
+TEST(XlsbWriter, GeneratesStylesPartForModelledStyles) {
+  // XLSX/native workbooks do not have a raw styles.bin passthrough part.  The
+  // XLSB writer must therefore materialise the modelled table and expose it
+  // through both the content-type override and workbook relationship.
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Styled"));
+  sheet.set_cell_value(0U, 0U, Value::number(12.5));
+
+  StylesTable styles;
+  FontRecord font;
+  font.name = "Aptos";
+  font.size = 12.0;
+  font.bold = true;
+  font.color_argb = 0xFF112233U;
+  styles.fonts.push_back(font);
+  FillRecord fill;
+  fill.pattern = 1U;
+  fill.fg_argb = 0xFFFFFF00U;
+  styles.fills.push_back(fill);
+  styles.borders.push_back(BorderRecord{});
+  styles.num_fmt_strings.push_back("0.000");
+  styles.num_fmts.push_back(NumFmtRecord{164U, 0U});
+  CellXf named;
+  named.vertical_align = 2U;
+  styles.cell_style_xfs.push_back(named);
+  CellXf xf;
+  xf.font_index = 0U;
+  xf.fill_index = 0U;
+  xf.border_index = 0U;
+  xf.num_fmt_id = 164U;
+  xf.xf_id = 0U;
+  xf.apply_number_format = true;
+  xf.apply_font = true;
+  xf.apply_fill = true;
+  styles.cell_xfs.push_back(xf);
+  wb.set_styles(std::move(styles));
+  sheet.set_cell_xf_index(0U, 0U, 0U);
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  ASSERT_TRUE(zip.has_entry("xl/styles.bin"));
+  auto rels_or = zip.read_entry("xl/_rels/workbook.bin.rels");
+  ASSERT_TRUE(static_cast<bool>(rels_or));
+  const std::string rels(rels_or.value().begin(), rels_or.value().end());
+  EXPECT_NE(rels.find("relationships/styles"), std::string::npos);
+  EXPECT_NE(rels.find("Target=\"styles.bin\""), std::string::npos);
+  auto types_or = zip.read_entry("[Content_Types].xml");
+  ASSERT_TRUE(static_cast<bool>(types_or));
+  const std::string types(types_or.value().begin(), types_or.value().end());
+  EXPECT_NE(types.find("/xl/styles.bin"), std::string::npos);
+  EXPECT_NE(types.find("application/vnd.ms-excel.styles"), std::string::npos);
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+  const StylesTable& rt = read_or.value().workbook.styles();
+  ASSERT_EQ(rt.num_fmts.size(), 1U);
+  EXPECT_EQ(rt.num_fmts[0].id, 164U);
+  ASSERT_EQ(rt.num_fmt_strings.size(), 1U);
+  EXPECT_EQ(rt.num_fmt_strings[0], "0.000");
+  ASSERT_EQ(rt.cell_xfs.size(), 1U);
+  EXPECT_EQ(rt.cell_xfs[0].num_fmt_id, 164U);
+  EXPECT_EQ(rt.cell_xfs[0].font_index, 0U);
+  EXPECT_EQ(rt.cell_xfs[0].fill_index, 0U);
+}
+
+TEST(XlsbWriter, StylesColorsUseTheBrtColorLowValidityBit) {
+  StylesTable styles;
+  FontRecord font;
+  font.name = "Aptos";
+  font.color_argb = 0xFF112233U;
+  styles.fonts.push_back(font);
+  const std::vector<std::uint8_t> bytes = write_styles_bin(styles);
+
+  ByteSpan cursor = SpanOf(bytes);
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    ASSERT_TRUE(static_cast<bool>(record_or));
+    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtFont)) {
+      continue;
+    }
+    const ByteSpan payload = record_or.value().payload;
+    ASSERT_GE(payload.size, 20U);
+    // u16 height/flags/weight/vertAlign + underline/family/charset/reserved
+    // precede BrtColor. RGB is XColorType 2 with fValidRGB in bit 0.
+    EXPECT_EQ(payload.data[12], 0x05U);
+    EXPECT_EQ(payload.data[16], 0x11U);
+    EXPECT_EQ(payload.data[17], 0x22U);
+    EXPECT_EQ(payload.data[18], 0x33U);
+    EXPECT_EQ(payload.data[19], 0xFFU);
+    return;
+  }
+  FAIL() << "missing BrtFont";
+}
+
+TEST(XlsbWriter, PreservesRawStylesPartFromExistingXlsb) {
+  // Generated styles are for XLSX/native input only.  When an XLSB reader has
+  // retained an opaque style part, that byte stream remains authoritative so
+  // unmodelled binary formatting extensions cannot be erased on save.
+  Workbook wb = Workbook::create_empty();
+  wb.sheet(wb.add_sheet("S")).set_cell_value(0U, 0U, Value::number(1.0));
+  StylesTable raw_table;
+  raw_table.num_fmt_strings.push_back("0.0000");
+  raw_table.num_fmts.push_back(NumFmtRecord{164U, 0U});
+  const std::vector<std::uint8_t> raw_bytes = write_styles_bin(raw_table);
+  PassthroughPart raw_part;
+  raw_part.path = "xl/styles.bin";
+  raw_part.content_type = "application/vnd.ms-excel.styles";
+  raw_part.bytes = raw_bytes;
+  wb.set_passthrough_parts({raw_part});
+
+  // Deliberately make the in-memory table differ from the opaque source.  If
+  // the writer regenerated it, the byte comparison below would fail.
+  StylesTable changed;
+  changed.num_fmt_strings.push_back("0.0%");
+  changed.num_fmts.push_back(NumFmtRecord{165U, 0U});
+  wb.set_styles(std::move(changed));
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or));
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto styles_or = zip.read_entry("xl/styles.bin");
+  ASSERT_TRUE(static_cast<bool>(styles_or));
+  EXPECT_EQ(styles_or.value(), raw_bytes);
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/writer_metadata_test.cpp b/tests/unit/io/xlsb/writer_metadata_test.cpp
new file mode 100644
index 000000000..4b3e116d1
--- /dev/null
+++ b/tests/unit/io/xlsb/writer_metadata_test.cpp
@@ -0,0 +1,472 @@
+// XLSB writer round-trip tests: metadata parts and dynamic-array spills.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "gtest/gtest.h"
+#include "io/xlsb/metadata_bin.h"
+#include "io/xlsb/reader.h"
+#include "io/xlsb/record.h"
+#include "io/xlsb/record_writer.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "passthrough_part.h"
+#include "sheet.h"
+#include "utils/error.h"
+#include "value.h"
+#include "workbook.h"
+#include "writer_test_helpers.h"
+namespace formulon {
+namespace io {
+namespace xlsb {
+namespace {
+
+TEST(XlsbWriter, PassthroughPartsRoundTripVerbatim) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& s = wb.sheet(wb.add_sheet("S1"));
+  s.set_cell_value(0U, 0U, Value::number(10.0));
+
+  // Synthesize a passthrough part: pretend the original archive had
+  // an `xl/theme/theme1.xml`. The bytes are arbitrary; the writer
+  // copies them verbatim and the reader surfaces them again on
+  // unknown_parts.
+  std::vector<PassthroughPart> parts;
+  PassthroughPart theme;
+  theme.path = "xl/theme/theme1.xml";
+  theme.content_type = "application/vnd.openxmlformats-officedocument.theme+xml";
+  const std::string body = "<?xml version=\"1.0\"?><theme xmlns=\"x\"/>";
+  theme.bytes.assign(body.begin(), body.end());
+  parts.push_back(std::move(theme));
+  PassthroughPart custom;
+  custom.path = "docProps/custom.xml";
+  custom.content_type = "application/vnd.openxmlformats-officedocument.custom-properties+xml";
+  custom.bytes = {'<', 'c', 'u', 's', 't', 'o', 'm', '/', '>'};
+  parts.push_back(std::move(custom));
+  PassthroughPart thumbnail;
+  thumbnail.path = "docProps/thumbnail.jpeg";
+  thumbnail.content_type = "image/jpeg";
+  thumbnail.bytes = {0xffU, 0xd8U, 0xffU, 0xd9U};
+  parts.push_back(std::move(thumbnail));
+  wb.set_passthrough_parts(std::move(parts));
+  wb.set_unknown_package_rels(
+      {UnknownRelationship{"rId9", "http://schemas.openxmlformats.org/package/2006/relationships/metadata/thumbnail",
+                           "docProps/thumbnail.jpeg", false}});
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or));
+
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto package_rels_or = zip.read_entry("_rels/.rels");
+  ASSERT_TRUE(static_cast<bool>(package_rels_or));
+  const std::string package_rels(package_rels_or.value().begin(), package_rels_or.value().end());
+  EXPECT_NE(package_rels.find("custom-properties"), std::string::npos);
+  EXPECT_NE(package_rels.find("Target=\"docProps/custom.xml\""), std::string::npos);
+  EXPECT_NE(package_rels.find("relationships/metadata/thumbnail"), std::string::npos);
+  EXPECT_NE(package_rels.find("Target=\"docProps/thumbnail.jpeg\""), std::string::npos);
+
+  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
+  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
+
+  bool found_theme = false;
+  for (const PassthroughPart& part : read_or.value().workbook.passthrough_parts()) {
+    if (part.path == "xl/theme/theme1.xml") {
+      found_theme = true;
+      EXPECT_EQ(part.content_type, "application/vnd.openxmlformats-officedocument.theme+xml");
+      const std::string round_tripped(part.bytes.begin(), part.bytes.end());
+      EXPECT_EQ(round_tripped, body);
+    }
+  }
+  EXPECT_TRUE(found_theme);
+  ASSERT_EQ(read_or.value().workbook.unknown_package_rels().size(), 1U);
+  EXPECT_EQ(read_or.value().workbook.unknown_package_rels()[0].target, "docProps/thumbnail.jpeg");
+}
+
+TEST(XlsbWriter, RootCustomXmlUsesWorkbookRelativeTargetAndSurvivesReload) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("S1"));
+  sheet.set_cell_value(0U, 0U, Value::number(10.0));
+
+  PassthroughPart custom_xml;
+  custom_xml.path = "customXml/item1.xml";
+  custom_xml.content_type = "application/xml";
+  const std::string custom_body = "<item><value>opaque</value></item>";
+  custom_xml.bytes.assign(custom_body.begin(), custom_body.end());
+  PassthroughPart sheet_custom_xml;
+  sheet_custom_xml.path = "customXml/item2.xml";
+  sheet_custom_xml.content_type = "application/xml";
+  const std::string sheet_custom_body = "<item><sheet-value>opaque</sheet-value></item>";
+  sheet_custom_xml.bytes.assign(sheet_custom_body.begin(), sheet_custom_body.end());
+  wb.set_passthrough_parts({custom_xml, sheet_custom_xml});
+
+  const std::string custom_type = "http://example.test/relationships/customXml";
+  const std::string external_type = "http://example.test/relationships/external";
+  wb.set_unknown_workbook_rels({UnknownRelationship{"rId8", custom_type, custom_xml.path, false},
+                                UnknownRelationship{"rId9", external_type, "https://example.test/book.xlsx", true}});
+  sheet.set_unknown_relationships({UnknownRelationship{"rId7", custom_type, sheet_custom_xml.path, false}});
+
+  auto first = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(first)) << first.error().message;
+  ZipReader first_zip;
+  ASSERT_TRUE(static_cast<bool>(first_zip.open(SpanOf(first.value()))));
+  auto first_rels_or = first_zip.read_entry("xl/_rels/workbook.bin.rels");
+  ASSERT_TRUE(static_cast<bool>(first_rels_or));
+  const std::string first_rels(first_rels_or.value().begin(), first_rels_or.value().end());
+  EXPECT_NE(first_rels.find("Target=\"../customXml/item1.xml\""), std::string::npos) << first_rels;
+  EXPECT_NE(first_rels.find("Target=\"https://example.test/book.xlsx\" TargetMode=\"External\""), std::string::npos)
+      << first_rels;
+  auto first_sheet_rels_or = first_zip.read_entry("xl/worksheets/_rels/sheet1.bin.rels");
+  ASSERT_TRUE(static_cast<bool>(first_sheet_rels_or));
+  const std::string first_sheet_rels(first_sheet_rels_or.value().begin(), first_sheet_rels_or.value().end());
+  EXPECT_NE(first_sheet_rels.find("Target=\"../../customXml/item2.xml\""), std::string::npos) << first_sheet_rels;
+
+  auto loaded = read_xlsb(SpanOf(first.value()));
+  ASSERT_TRUE(static_cast<bool>(loaded)) << loaded.error().message;
+  ASSERT_EQ(loaded.value().workbook.unknown_workbook_rels().size(), 2U);
+  EXPECT_EQ(loaded.value().workbook.unknown_workbook_rels()[0].target, custom_xml.path);
+  EXPECT_EQ(loaded.value().workbook.unknown_workbook_rels()[1].target, "https://example.test/book.xlsx");
+  EXPECT_TRUE(loaded.value().workbook.unknown_workbook_rels()[1].target_external);
+  ASSERT_EQ(loaded.value().workbook.sheet(0).unknown_relationships().size(), 1U);
+  EXPECT_EQ(loaded.value().workbook.sheet(0).unknown_relationships()[0].target, sheet_custom_xml.path);
+
+  auto second = write_xlsb(loaded.value().workbook);
+  ASSERT_TRUE(static_cast<bool>(second)) << second.error().message;
+  ZipReader second_zip;
+  ASSERT_TRUE(static_cast<bool>(second_zip.open(SpanOf(second.value()))));
+  auto second_rels_or = second_zip.read_entry("xl/_rels/workbook.bin.rels");
+  ASSERT_TRUE(static_cast<bool>(second_rels_or));
+  const std::string second_rels(second_rels_or.value().begin(), second_rels_or.value().end());
+  EXPECT_NE(second_rels.find("Target=\"../customXml/item1.xml\""), std::string::npos) << second_rels;
+  EXPECT_NE(second_rels.find("Target=\"https://example.test/book.xlsx\" TargetMode=\"External\""), std::string::npos)
+      << second_rels;
+  auto second_sheet_rels_or = second_zip.read_entry("xl/worksheets/_rels/sheet1.bin.rels");
+  ASSERT_TRUE(static_cast<bool>(second_sheet_rels_or));
+  const std::string second_sheet_rels(second_sheet_rels_or.value().begin(), second_sheet_rels_or.value().end());
+  EXPECT_NE(second_sheet_rels.find("Target=\"../../customXml/item2.xml\""), std::string::npos) << second_sheet_rels;
+  auto second_body_or = second_zip.read_entry("customXml/item1.xml");
+  ASSERT_TRUE(static_cast<bool>(second_body_or));
+  EXPECT_EQ(std::string(second_body_or.value().begin(), second_body_or.value().end()), custom_body);
+  auto second_sheet_body_or = second_zip.read_entry("customXml/item2.xml");
+  ASSERT_TRUE(static_cast<bool>(second_sheet_body_or));
+  EXPECT_EQ(std::string(second_sheet_body_or.value().begin(), second_sheet_body_or.value().end()), sheet_custom_body);
+}
+
+TEST(XlsbWriter, DropsXlsxMetadataAndItsWorkbookRelationship) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("S1"));
+  sheet.set_cell_value(0U, 0U, Value::number(1.0));
+  PassthroughPart metadata;
+  metadata.path = "xl/metadata.xml";
+  metadata.content_type = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheetMetadata+xml";
+  metadata.bytes = {'<', 'm', '/', '>'};
+  wb.set_passthrough_parts({metadata});
+  wb.set_unknown_workbook_rels(
+      {UnknownRelationship{"rId7", "http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata",
+                           "xl/metadata.xml", false}});
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or));
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  EXPECT_FALSE(zip.has_entry("xl/metadata.xml"));
+  auto rels_or = zip.read_entry("xl/_rels/workbook.bin.rels");
+  ASSERT_TRUE(static_cast<bool>(rels_or));
+  const std::string rels(rels_or.value().begin(), rels_or.value().end());
+  EXPECT_EQ(rels.find("sheetMetadata"), std::string::npos);
+}
+
+TEST(XlsbWriter, EmitsDynamicArrayMetadataForSpillAnchors) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Spill"));
+  sheet.set_cell_formula(0U, 0U, "=SEQUENCE(2)");
+  sheet.set_cell_dynamic_array(0U, 0U, true);
+  ASSERT_TRUE(sheet.commit_spill(0U, 0U, 2U, 1U, {Value::number(1.0), Value::number(2.0)}));
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  ASSERT_TRUE(zip.has_entry("xl/metadata.bin"));
+
+  auto metadata_or = zip.read_entry("xl/metadata.bin");
+  ASSERT_TRUE(static_cast<bool>(metadata_or));
+  ByteSpan metadata_cursor = SpanOf(metadata_or.value());
+  auto metadata_record_or = read_record(metadata_cursor);
+  ASSERT_TRUE(static_cast<bool>(metadata_record_or));
+  EXPECT_EQ(metadata_record_or.value().type, 332U);  // BrtBeginMetadata
+
+  auto content_types_or = zip.read_entry("[Content_Types].xml");
+  ASSERT_TRUE(static_cast<bool>(content_types_or));
+  const std::string content_types(content_types_or.value().begin(), content_types_or.value().end());
+  EXPECT_NE(content_types.find("/xl/metadata.bin"), std::string::npos);
+  EXPECT_NE(content_types.find("application/vnd.ms-excel.sheetMetadata"), std::string::npos);
+
+  auto rels_or = zip.read_entry("xl/_rels/workbook.bin.rels");
+  ASSERT_TRUE(static_cast<bool>(rels_or));
+  const std::string rels(rels_or.value().begin(), rels_or.value().end());
+  EXPECT_NE(rels.find("relationships/sheetMetadata"), std::string::npos);
+  EXPECT_NE(rels.find("Target=\"metadata.bin\""), std::string::npos);
+
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+  ByteSpan sheet_cursor = SpanOf(sheet_or.value());
+  bool found_cell_metadata = false;
+  while (sheet_cursor.size > 0U) {
+    auto record_or = read_record(sheet_cursor);
+    ASSERT_TRUE(static_cast<bool>(record_or));
+    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtCellMeta)) {
+      continue;
+    }
+    ByteSpan payload = record_or.value().payload;
+    auto index_or = read_u32(payload);
+    ASSERT_TRUE(static_cast<bool>(index_or));
+    EXPECT_EQ(index_or.value(), 1U);
+    EXPECT_EQ(payload.size, 0U);
+    found_cell_metadata = true;
+  }
+  EXPECT_TRUE(found_cell_metadata);
+}
+
+// ---------------------------------------------------------------------------
+// A `BrtCellMeta` index names an entry of the metadata part that actually
+// ships. The generated part declares one entry, so index 1 is right by
+// construction; a retained passthrough part carries its own numbering, and
+// its first entry may be rich-value or cube-function metadata rather than the
+// dynamic-array one. An index that misses makes Excel repair the file, so an
+// unidentifiable entry means no `BrtCellMeta` record at all.
+// ---------------------------------------------------------------------------
+
+namespace {
+
+// Builds a metadata part declaring `type_names` in order, followed by one
+// cell-metadata entry per name (entry N names type N). Mirrors the record
+// framing Excel writes, so the writer's finder sees a realistic part.
+std::vector<std::uint8_t> BuildMetadataPart(const std::vector<std::string>& type_names) {
+  constexpr std::uint16_t kBrtBeginMetadata = 332;
+  constexpr std::uint16_t kBrtEndMetadata = 333;
+  constexpr std::uint16_t kBrtBeginEsmdtinfo = 334;
+  constexpr std::uint16_t kBrtMdtinfo = 335;
+  constexpr std::uint16_t kBrtEndEsmdtinfo = 336;
+  constexpr std::uint16_t kBrtBeginEsfmd = 337;
+  constexpr std::uint16_t kBrtEndEsfmd = 338;
+  constexpr std::uint16_t kBrtMdb = 51;
+
+  std::vector<std::uint8_t> out;
+  std::vector<std::uint8_t> payload;
+  emit_record(out, kBrtBeginMetadata, ByteSpan{});
+
+  emit_u32(payload, static_cast<std::uint32_t>(type_names.size()));
+  emit_record(out, kBrtBeginEsmdtinfo, payload);
+  for (const std::string& name : type_names) {
+    payload.clear();
+    emit_u32(payload, 0xD86AC0B0U);
+    emit_u32(payload, 0x0001D4C0U);
+    emit_xlwidestring(payload, name);
+    emit_record(out, kBrtMdtinfo, payload);
+  }
+  emit_record(out, kBrtEndEsmdtinfo, ByteSpan{});
+
+  payload.clear();
+  emit_u32(payload, static_cast<std::uint32_t>(type_names.size()));
+  emit_u32(payload, 1U);
+  emit_record(out, kBrtBeginEsfmd, payload);
+  for (std::size_t i = 0; i < type_names.size(); ++i) {
+    payload.clear();
+    emit_u32(payload, 1U);                                 // One (type, id) pair.
+    emit_u32(payload, static_cast<std::uint32_t>(i + 1));  // 1-based type ordinal.
+    emit_u32(payload, 0U);
+    emit_record(out, kBrtMdb, payload);
+  }
+  emit_record(out, kBrtEndEsfmd, ByteSpan{});
+  emit_record(out, kBrtEndMetadata, ByteSpan{});
+  return out;
+}
+
+Workbook SpillWorkbookWithRetainedMetadata(std::vector<std::uint8_t> metadata_bytes) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("Spill"));
+  sheet.set_cell_formula(0U, 0U, "=SEQUENCE(2)");
+  sheet.set_cell_dynamic_array(0U, 0U, true);
+  EXPECT_TRUE(sheet.commit_spill(0U, 0U, 2U, 1U, {Value::number(1.0), Value::number(2.0)}));
+  PassthroughPart metadata;
+  metadata.path = "xl/metadata.bin";
+  metadata.content_type = "application/vnd.ms-excel.sheetMetadata";
+  metadata.bytes = std::move(metadata_bytes);
+  wb.set_passthrough_parts({metadata});
+  return wb;
+}
+
+// Collects every `BrtCellMeta` index in a worksheet body, and reports whether
+// the body carries an array-formula record at all.
+struct SheetMetaScan {
+  std::vector<std::uint32_t> cell_meta_indices;
+  bool has_array_formula = false;
+};
+
+SheetMetaScan ScanSheetForCellMeta(const std::vector<std::uint8_t>& sheet_bytes) {
+  SheetMetaScan scan;
+  ByteSpan cursor = SpanOf(sheet_bytes);
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    EXPECT_TRUE(static_cast<bool>(record_or));
+    if (!record_or) {
+      break;
+    }
+    if (record_or.value().type == static_cast<std::uint16_t>(XlsbRecordType::BrtArrFmla)) {
+      scan.has_array_formula = true;
+      continue;
+    }
+    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtCellMeta)) {
+      continue;
+    }
+    ByteSpan payload = record_or.value().payload;
+    auto index_or = read_u32(payload);
+    EXPECT_TRUE(static_cast<bool>(index_or));
+    if (index_or) {
+      scan.cell_meta_indices.push_back(index_or.value());
+    }
+  }
+  return scan;
+}
+
+// Writes `wb`, then returns the scan of its first worksheet body.
+SheetMetaScan WriteAndScanFirstSheet(const Workbook& wb) {
+  auto bytes_or = write_xlsb(wb);
+  EXPECT_TRUE(static_cast<bool>(bytes_or));
+  if (!bytes_or) {
+    return SheetMetaScan{};
+  }
+  ZipReader zip;
+  EXPECT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  EXPECT_TRUE(static_cast<bool>(sheet_or));
+  if (!sheet_or) {
+    return SheetMetaScan{};
+  }
+  return ScanSheetForCellMeta(sheet_or.value());
+}
+
+}  // namespace
+
+TEST(XlsbMetadataBin, FindsDynamicArrayEntryBehindOtherTypes) {
+  const std::vector<std::uint8_t> part = BuildMetadataPart({"XLRICHVALUE", "XLDAPR", "XLMDX"});
+  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(part)), 2U);
+}
+
+TEST(XlsbMetadataBin, ReportsZeroWhenNoDynamicArrayTypeIsDeclared) {
+  const std::vector<std::uint8_t> part = BuildMetadataPart({"XLRICHVALUE", "XLMDX"});
+  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(part)), 0U);
+}
+
+TEST(XlsbMetadataBin, GeneratedPartResolvesToIndexOne) {
+  const std::vector<std::uint8_t> part = build_dynamic_array_metadata_bin();
+  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(part)), 1U);
+}
+
+TEST(XlsbMetadataBin, ReportsZeroForEveryTruncationOfAValidPart) {
+  const std::vector<std::uint8_t> part = BuildMetadataPart({"XLRICHVALUE", "XLDAPR"});
+  ASSERT_EQ(find_dynamic_array_cell_meta_index(SpanOf(part)), 2U);
+  // Every strict prefix is either unreadable or missing the entry it would
+  // have to name. None may produce an index.
+  for (std::size_t length = 0; length < part.size(); ++length) {
+    const ByteSpan prefix{part.data(), length};
+    EXPECT_EQ(find_dynamic_array_cell_meta_index(prefix), 0U) << "prefix length " << length;
+  }
+}
+
+TEST(XlsbMetadataBin, ReportsZeroForMalformedBytes) {
+  EXPECT_EQ(find_dynamic_array_cell_meta_index(ByteSpan{}), 0U);
+  // A record header promising more payload than the buffer holds.
+  const std::vector<std::uint8_t> overrun = {0x4C, 0x02, 0x7F, 0x01, 0x02};
+  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(overrun)), 0U);
+  // A type table whose entry payload ends before its name.
+  std::vector<std::uint8_t> short_name;
+  std::vector<std::uint8_t> payload;
+  emit_u32(payload, 1U);
+  emit_record(short_name, 334U, payload);
+  payload.clear();
+  emit_u32(payload, 0U);
+  emit_record(short_name, 335U, payload);
+  emit_record(short_name, 336U, ByteSpan{});
+  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(short_name)), 0U);
+}
+
+TEST(XlsbWriter, SpillAnchorNamesTheRetainedPartsDynamicArrayEntry) {
+  const Workbook wb = SpillWorkbookWithRetainedMetadata(BuildMetadataPart({"XLRICHVALUE", "XLDAPR", "XLMDX"}));
+  const SheetMetaScan scan = WriteAndScanFirstSheet(wb);
+  ASSERT_EQ(scan.cell_meta_indices.size(), 1U);
+  EXPECT_EQ(scan.cell_meta_indices[0], 2U) << "the anchor named the retained part's first entry instead of its "
+                                              "dynamic-array entry";
+  EXPECT_TRUE(scan.has_array_formula);
+}
+
+TEST(XlsbWriter, SpillAnchorEmitsNoCellMetaWhenRetainedPartHasNoDynamicArrayEntry) {
+  const Workbook wb = SpillWorkbookWithRetainedMetadata(BuildMetadataPart({"XLRICHVALUE", "XLMDX"}));
+  const SheetMetaScan scan = WriteAndScanFirstSheet(wb);
+  EXPECT_TRUE(scan.cell_meta_indices.empty()) << "a BrtCellMeta index that names no dynamic-array entry";
+  EXPECT_TRUE(scan.has_array_formula) << "the anchor must still be written as an array formula";
+}
+
+TEST(XlsbWriter, SpillAnchorEmitsNoCellMetaWhenRetainedPartIsMalformed) {
+  const Workbook wb = SpillWorkbookWithRetainedMetadata({0x4C, 0x02, 0x7F, 0x01, 0x02});
+  const SheetMetaScan scan = WriteAndScanFirstSheet(wb);
+  EXPECT_TRUE(scan.cell_meta_indices.empty()) << "a dangling BrtCellMeta index from unreadable metadata bytes";
+  EXPECT_TRUE(scan.has_array_formula);
+}
+
+TEST(XlsbWriter, RetainedMetadataPartShipsVerbatimAndIsNotRegenerated) {
+  const std::vector<std::uint8_t> part = BuildMetadataPart({"XLRICHVALUE", "XLDAPR"});
+  const Workbook wb = SpillWorkbookWithRetainedMetadata(part);
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  auto shipped_or = zip.read_entry("xl/metadata.bin");
+  ASSERT_TRUE(static_cast<bool>(shipped_or));
+  EXPECT_EQ(shipped_or.value(), part) << "the generated part displaced the retained one";
+  // The index the sheet carries must resolve inside the part that shipped.
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+  const SheetMetaScan scan = ScanSheetForCellMeta(sheet_or.value());
+  ASSERT_EQ(scan.cell_meta_indices.size(), 1U);
+  EXPECT_EQ(scan.cell_meta_indices[0], find_dynamic_array_cell_meta_index(SpanOf(shipped_or.value())));
+}
+
+TEST(XlsbWriter, EmitsDynamicArrayMetadataForSingleCellArrayAnchors) {
+  Workbook wb = Workbook::create_empty();
+  Sheet& sheet = wb.sheet(wb.add_sheet("SingleArray"));
+  sheet.set_cell_formula(0U, 0U, "=IFS(TRUE,\"yes\")");
+  sheet.set_cell_dynamic_array(0U, 0U, true);
+  ASSERT_TRUE(sheet.commit_spill(0U, 0U, 1U, 1U, {Value::text("yes")}));
+
+  auto bytes_or = write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
+  ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
+  ASSERT_TRUE(zip.has_entry("xl/metadata.bin"));
+
+  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
+  ASSERT_TRUE(static_cast<bool>(sheet_or));
+  ByteSpan cursor = SpanOf(sheet_or.value());
+  bool found_cell_metadata = false;
+  bool found_array_formula = false;
+  while (cursor.size > 0U) {
+    auto record_or = read_record(cursor);
+    ASSERT_TRUE(static_cast<bool>(record_or));
+    found_cell_metadata =
+        found_cell_metadata || record_or.value().type == static_cast<std::uint16_t>(XlsbRecordType::BrtCellMeta);
+    found_array_formula =
+        found_array_formula || record_or.value().type == static_cast<std::uint16_t>(XlsbRecordType::BrtArrFmla);
+  }
+  EXPECT_TRUE(found_cell_metadata);
+  EXPECT_TRUE(found_array_formula);
+}
+
+}  // namespace
+}  // namespace xlsb
+}  // namespace io
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb/writer_test.cpp b/tests/unit/io/xlsb/writer_test.cpp
index fe8333214..c03a98be9 100644
--- a/tests/unit/io/xlsb/writer_test.cpp
+++ b/tests/unit/io/xlsb/writer_test.cpp
@@ -1,49 +1,30 @@
-//
-// End-to-end round-trip tests for the XLSB package writer.
-// `read_xlsb(write_xlsb(wb))` must reproduce every cell value `wb`
-// carried in for the in-scope literal kinds, plus passthrough parts
-// and Bundle 4.1 stub-formula cells.
+// XLSB writer round-trip tests: literal cells and workbook defaults.
 
 #include "io/xlsb/writer.h"
 
-#include <algorithm>
 #include <cstdint>
 #include <limits>
-#include <map>
 #include <string>
-#include <string_view>
 #include <vector>
 
 #include "cell.h"
 #include "defined_name.h"
-#include "eval/function_registry.h"
-#include "eval/recalc_engine.h"
 #include "gtest/gtest.h"
-#include "io/ooxml_reader.h"
-#include "io/ooxml_writer.h"
-#include "io/xlsb/metadata_bin.h"
 #include "io/xlsb/reader.h"
 #include "io/xlsb/record.h"
 #include "io/xlsb/record_writer.h"
-#include "io/xlsb/styles_writer.h"
 #include "io/zip_reader.h"
-#include "passthrough_part.h"
 #include "print/pagination.h"
 #include "sheet.h"
-#include "styles.h"
 #include "utils/error.h"
 #include "value.h"
 #include "workbook.h"
-
+#include "writer_test_helpers.h"
 namespace formulon {
 namespace io {
 namespace xlsb {
 namespace {
 
-ByteSpan SpanOf(const std::vector<std::uint8_t>& v) {
-  return ByteSpan{v.data(), v.size()};
-}
-
 std::vector<std::uint8_t> WorksheetFormatPayloadFromSheet(const std::vector<std::uint8_t>& sheet_bytes) {
   ByteSpan cursor = SpanOf(sheet_bytes);
   while (cursor.size > 0U) {
@@ -476,1628 +457,6 @@ TEST(XlsbWriter, AbsentFormatDefaultsPreservePaginationAcrossRoundTrip) {
   EXPECT_EQ(after_or.value().h_breaks, before_or.value().h_breaks);
 }
 
-TEST(XlsbWriter, PassthroughPartsRoundTripVerbatim) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("S1"));
-  s.set_cell_value(0U, 0U, Value::number(10.0));
-
-  // Synthesize a passthrough part: pretend the original archive had
-  // an `xl/theme/theme1.xml`. The bytes are arbitrary; the writer
-  // copies them verbatim and the reader surfaces them again on
-  // unknown_parts.
-  std::vector<PassthroughPart> parts;
-  PassthroughPart theme;
-  theme.path = "xl/theme/theme1.xml";
-  theme.content_type = "application/vnd.openxmlformats-officedocument.theme+xml";
-  const std::string body = "<?xml version=\"1.0\"?><theme xmlns=\"x\"/>";
-  theme.bytes.assign(body.begin(), body.end());
-  parts.push_back(std::move(theme));
-  PassthroughPart custom;
-  custom.path = "docProps/custom.xml";
-  custom.content_type = "application/vnd.openxmlformats-officedocument.custom-properties+xml";
-  custom.bytes = {'<', 'c', 'u', 's', 't', 'o', 'm', '/', '>'};
-  parts.push_back(std::move(custom));
-  PassthroughPart thumbnail;
-  thumbnail.path = "docProps/thumbnail.jpeg";
-  thumbnail.content_type = "image/jpeg";
-  thumbnail.bytes = {0xffU, 0xd8U, 0xffU, 0xd9U};
-  parts.push_back(std::move(thumbnail));
-  wb.set_passthrough_parts(std::move(parts));
-  wb.set_unknown_package_rels(
-      {UnknownRelationship{"rId9", "http://schemas.openxmlformats.org/package/2006/relationships/metadata/thumbnail",
-                           "docProps/thumbnail.jpeg", false}});
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or));
-
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto package_rels_or = zip.read_entry("_rels/.rels");
-  ASSERT_TRUE(static_cast<bool>(package_rels_or));
-  const std::string package_rels(package_rels_or.value().begin(), package_rels_or.value().end());
-  EXPECT_NE(package_rels.find("custom-properties"), std::string::npos);
-  EXPECT_NE(package_rels.find("Target=\"docProps/custom.xml\""), std::string::npos);
-  EXPECT_NE(package_rels.find("relationships/metadata/thumbnail"), std::string::npos);
-  EXPECT_NE(package_rels.find("Target=\"docProps/thumbnail.jpeg\""), std::string::npos);
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-
-  bool found_theme = false;
-  for (const PassthroughPart& part : read_or.value().workbook.passthrough_parts()) {
-    if (part.path == "xl/theme/theme1.xml") {
-      found_theme = true;
-      EXPECT_EQ(part.content_type, "application/vnd.openxmlformats-officedocument.theme+xml");
-      const std::string round_tripped(part.bytes.begin(), part.bytes.end());
-      EXPECT_EQ(round_tripped, body);
-    }
-  }
-  EXPECT_TRUE(found_theme);
-  ASSERT_EQ(read_or.value().workbook.unknown_package_rels().size(), 1U);
-  EXPECT_EQ(read_or.value().workbook.unknown_package_rels()[0].target, "docProps/thumbnail.jpeg");
-}
-
-TEST(XlsbWriter, DropsXlsxMetadataAndItsWorkbookRelationship) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("S1"));
-  sheet.set_cell_value(0U, 0U, Value::number(1.0));
-  PassthroughPart metadata;
-  metadata.path = "xl/metadata.xml";
-  metadata.content_type = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheetMetadata+xml";
-  metadata.bytes = {'<', 'm', '/', '>'};
-  wb.set_passthrough_parts({metadata});
-  wb.set_unknown_workbook_rels(
-      {UnknownRelationship{"rId7", "http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata",
-                           "xl/metadata.xml", false}});
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or));
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  EXPECT_FALSE(zip.has_entry("xl/metadata.xml"));
-  auto rels_or = zip.read_entry("xl/_rels/workbook.bin.rels");
-  ASSERT_TRUE(static_cast<bool>(rels_or));
-  const std::string rels(rels_or.value().begin(), rels_or.value().end());
-  EXPECT_EQ(rels.find("sheetMetadata"), std::string::npos);
-}
-
-TEST(XlsbWriter, EmitsDynamicArrayMetadataForSpillAnchors) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Spill"));
-  sheet.set_cell_formula(0U, 0U, "=SEQUENCE(2)");
-  sheet.set_cell_dynamic_array(0U, 0U, true);
-  ASSERT_TRUE(sheet.commit_spill(0U, 0U, 2U, 1U, {Value::number(1.0), Value::number(2.0)}));
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  ASSERT_TRUE(zip.has_entry("xl/metadata.bin"));
-
-  auto metadata_or = zip.read_entry("xl/metadata.bin");
-  ASSERT_TRUE(static_cast<bool>(metadata_or));
-  ByteSpan metadata_cursor = SpanOf(metadata_or.value());
-  auto metadata_record_or = read_record(metadata_cursor);
-  ASSERT_TRUE(static_cast<bool>(metadata_record_or));
-  EXPECT_EQ(metadata_record_or.value().type, 332U);  // BrtBeginMetadata
-
-  auto content_types_or = zip.read_entry("[Content_Types].xml");
-  ASSERT_TRUE(static_cast<bool>(content_types_or));
-  const std::string content_types(content_types_or.value().begin(), content_types_or.value().end());
-  EXPECT_NE(content_types.find("/xl/metadata.bin"), std::string::npos);
-  EXPECT_NE(content_types.find("application/vnd.ms-excel.sheetMetadata"), std::string::npos);
-
-  auto rels_or = zip.read_entry("xl/_rels/workbook.bin.rels");
-  ASSERT_TRUE(static_cast<bool>(rels_or));
-  const std::string rels(rels_or.value().begin(), rels_or.value().end());
-  EXPECT_NE(rels.find("relationships/sheetMetadata"), std::string::npos);
-  EXPECT_NE(rels.find("Target=\"metadata.bin\""), std::string::npos);
-
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-  ByteSpan sheet_cursor = SpanOf(sheet_or.value());
-  bool found_cell_metadata = false;
-  while (sheet_cursor.size > 0U) {
-    auto record_or = read_record(sheet_cursor);
-    ASSERT_TRUE(static_cast<bool>(record_or));
-    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtCellMeta)) {
-      continue;
-    }
-    ByteSpan payload = record_or.value().payload;
-    auto index_or = read_u32(payload);
-    ASSERT_TRUE(static_cast<bool>(index_or));
-    EXPECT_EQ(index_or.value(), 1U);
-    EXPECT_EQ(payload.size, 0U);
-    found_cell_metadata = true;
-  }
-  EXPECT_TRUE(found_cell_metadata);
-}
-
-// ---------------------------------------------------------------------------
-// A `BrtCellMeta` index names an entry of the metadata part that actually
-// ships. The generated part declares one entry, so index 1 is right by
-// construction; a retained passthrough part carries its own numbering, and
-// its first entry may be rich-value or cube-function metadata rather than the
-// dynamic-array one. An index that misses makes Excel repair the file, so an
-// unidentifiable entry means no `BrtCellMeta` record at all.
-// ---------------------------------------------------------------------------
-
-namespace {
-
-// Builds a metadata part declaring `type_names` in order, followed by one
-// cell-metadata entry per name (entry N names type N). Mirrors the record
-// framing Excel writes, so the writer's finder sees a realistic part.
-std::vector<std::uint8_t> BuildMetadataPart(const std::vector<std::string>& type_names) {
-  constexpr std::uint16_t kBrtBeginMetadata = 332;
-  constexpr std::uint16_t kBrtEndMetadata = 333;
-  constexpr std::uint16_t kBrtBeginEsmdtinfo = 334;
-  constexpr std::uint16_t kBrtMdtinfo = 335;
-  constexpr std::uint16_t kBrtEndEsmdtinfo = 336;
-  constexpr std::uint16_t kBrtBeginEsfmd = 337;
-  constexpr std::uint16_t kBrtEndEsfmd = 338;
-  constexpr std::uint16_t kBrtMdb = 51;
-
-  std::vector<std::uint8_t> out;
-  std::vector<std::uint8_t> payload;
-  emit_record(out, kBrtBeginMetadata, ByteSpan{});
-
-  emit_u32(payload, static_cast<std::uint32_t>(type_names.size()));
-  emit_record(out, kBrtBeginEsmdtinfo, payload);
-  for (const std::string& name : type_names) {
-    payload.clear();
-    emit_u32(payload, 0xD86AC0B0U);
-    emit_u32(payload, 0x0001D4C0U);
-    emit_xlwidestring(payload, name);
-    emit_record(out, kBrtMdtinfo, payload);
-  }
-  emit_record(out, kBrtEndEsmdtinfo, ByteSpan{});
-
-  payload.clear();
-  emit_u32(payload, static_cast<std::uint32_t>(type_names.size()));
-  emit_u32(payload, 1U);
-  emit_record(out, kBrtBeginEsfmd, payload);
-  for (std::size_t i = 0; i < type_names.size(); ++i) {
-    payload.clear();
-    emit_u32(payload, 1U);                                 // One (type, id) pair.
-    emit_u32(payload, static_cast<std::uint32_t>(i + 1));  // 1-based type ordinal.
-    emit_u32(payload, 0U);
-    emit_record(out, kBrtMdb, payload);
-  }
-  emit_record(out, kBrtEndEsfmd, ByteSpan{});
-  emit_record(out, kBrtEndMetadata, ByteSpan{});
-  return out;
-}
-
-Workbook SpillWorkbookWithRetainedMetadata(std::vector<std::uint8_t> metadata_bytes) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Spill"));
-  sheet.set_cell_formula(0U, 0U, "=SEQUENCE(2)");
-  sheet.set_cell_dynamic_array(0U, 0U, true);
-  EXPECT_TRUE(sheet.commit_spill(0U, 0U, 2U, 1U, {Value::number(1.0), Value::number(2.0)}));
-  PassthroughPart metadata;
-  metadata.path = "xl/metadata.bin";
-  metadata.content_type = "application/vnd.ms-excel.sheetMetadata";
-  metadata.bytes = std::move(metadata_bytes);
-  wb.set_passthrough_parts({metadata});
-  return wb;
-}
-
-// Collects every `BrtCellMeta` index in a worksheet body, and reports whether
-// the body carries an array-formula record at all.
-struct SheetMetaScan {
-  std::vector<std::uint32_t> cell_meta_indices;
-  bool has_array_formula = false;
-};
-
-SheetMetaScan ScanSheetForCellMeta(const std::vector<std::uint8_t>& sheet_bytes) {
-  SheetMetaScan scan;
-  ByteSpan cursor = SpanOf(sheet_bytes);
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    EXPECT_TRUE(static_cast<bool>(record_or));
-    if (!record_or) {
-      break;
-    }
-    if (record_or.value().type == static_cast<std::uint16_t>(XlsbRecordType::BrtArrFmla)) {
-      scan.has_array_formula = true;
-      continue;
-    }
-    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtCellMeta)) {
-      continue;
-    }
-    ByteSpan payload = record_or.value().payload;
-    auto index_or = read_u32(payload);
-    EXPECT_TRUE(static_cast<bool>(index_or));
-    if (index_or) {
-      scan.cell_meta_indices.push_back(index_or.value());
-    }
-  }
-  return scan;
-}
-
-// Writes `wb`, then returns the scan of its first worksheet body.
-SheetMetaScan WriteAndScanFirstSheet(const Workbook& wb) {
-  auto bytes_or = write_xlsb(wb);
-  EXPECT_TRUE(static_cast<bool>(bytes_or));
-  if (!bytes_or) {
-    return SheetMetaScan{};
-  }
-  ZipReader zip;
-  EXPECT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  EXPECT_TRUE(static_cast<bool>(sheet_or));
-  if (!sheet_or) {
-    return SheetMetaScan{};
-  }
-  return ScanSheetForCellMeta(sheet_or.value());
-}
-
-}  // namespace
-
-TEST(XlsbMetadataBin, FindsDynamicArrayEntryBehindOtherTypes) {
-  const std::vector<std::uint8_t> part = BuildMetadataPart({"XLRICHVALUE", "XLDAPR", "XLMDX"});
-  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(part)), 2U);
-}
-
-TEST(XlsbMetadataBin, ReportsZeroWhenNoDynamicArrayTypeIsDeclared) {
-  const std::vector<std::uint8_t> part = BuildMetadataPart({"XLRICHVALUE", "XLMDX"});
-  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(part)), 0U);
-}
-
-TEST(XlsbMetadataBin, GeneratedPartResolvesToIndexOne) {
-  const std::vector<std::uint8_t> part = build_dynamic_array_metadata_bin();
-  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(part)), 1U);
-}
-
-TEST(XlsbMetadataBin, ReportsZeroForEveryTruncationOfAValidPart) {
-  const std::vector<std::uint8_t> part = BuildMetadataPart({"XLRICHVALUE", "XLDAPR"});
-  ASSERT_EQ(find_dynamic_array_cell_meta_index(SpanOf(part)), 2U);
-  // Every strict prefix is either unreadable or missing the entry it would
-  // have to name. None may produce an index.
-  for (std::size_t length = 0; length < part.size(); ++length) {
-    const ByteSpan prefix{part.data(), length};
-    EXPECT_EQ(find_dynamic_array_cell_meta_index(prefix), 0U) << "prefix length " << length;
-  }
-}
-
-TEST(XlsbMetadataBin, ReportsZeroForMalformedBytes) {
-  EXPECT_EQ(find_dynamic_array_cell_meta_index(ByteSpan{}), 0U);
-  // A record header promising more payload than the buffer holds.
-  const std::vector<std::uint8_t> overrun = {0x4C, 0x02, 0x7F, 0x01, 0x02};
-  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(overrun)), 0U);
-  // A type table whose entry payload ends before its name.
-  std::vector<std::uint8_t> short_name;
-  std::vector<std::uint8_t> payload;
-  emit_u32(payload, 1U);
-  emit_record(short_name, 334U, payload);
-  payload.clear();
-  emit_u32(payload, 0U);
-  emit_record(short_name, 335U, payload);
-  emit_record(short_name, 336U, ByteSpan{});
-  EXPECT_EQ(find_dynamic_array_cell_meta_index(SpanOf(short_name)), 0U);
-}
-
-TEST(XlsbWriter, SpillAnchorNamesTheRetainedPartsDynamicArrayEntry) {
-  const Workbook wb = SpillWorkbookWithRetainedMetadata(BuildMetadataPart({"XLRICHVALUE", "XLDAPR", "XLMDX"}));
-  const SheetMetaScan scan = WriteAndScanFirstSheet(wb);
-  ASSERT_EQ(scan.cell_meta_indices.size(), 1U);
-  EXPECT_EQ(scan.cell_meta_indices[0], 2U) << "the anchor named the retained part's first entry instead of its "
-                                              "dynamic-array entry";
-  EXPECT_TRUE(scan.has_array_formula);
-}
-
-TEST(XlsbWriter, SpillAnchorEmitsNoCellMetaWhenRetainedPartHasNoDynamicArrayEntry) {
-  const Workbook wb = SpillWorkbookWithRetainedMetadata(BuildMetadataPart({"XLRICHVALUE", "XLMDX"}));
-  const SheetMetaScan scan = WriteAndScanFirstSheet(wb);
-  EXPECT_TRUE(scan.cell_meta_indices.empty()) << "a BrtCellMeta index that names no dynamic-array entry";
-  EXPECT_TRUE(scan.has_array_formula) << "the anchor must still be written as an array formula";
-}
-
-TEST(XlsbWriter, SpillAnchorEmitsNoCellMetaWhenRetainedPartIsMalformed) {
-  const Workbook wb = SpillWorkbookWithRetainedMetadata({0x4C, 0x02, 0x7F, 0x01, 0x02});
-  const SheetMetaScan scan = WriteAndScanFirstSheet(wb);
-  EXPECT_TRUE(scan.cell_meta_indices.empty()) << "a dangling BrtCellMeta index from unreadable metadata bytes";
-  EXPECT_TRUE(scan.has_array_formula);
-}
-
-TEST(XlsbWriter, RetainedMetadataPartShipsVerbatimAndIsNotRegenerated) {
-  const std::vector<std::uint8_t> part = BuildMetadataPart({"XLRICHVALUE", "XLDAPR"});
-  const Workbook wb = SpillWorkbookWithRetainedMetadata(part);
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto shipped_or = zip.read_entry("xl/metadata.bin");
-  ASSERT_TRUE(static_cast<bool>(shipped_or));
-  EXPECT_EQ(shipped_or.value(), part) << "the generated part displaced the retained one";
-  // The index the sheet carries must resolve inside the part that shipped.
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-  const SheetMetaScan scan = ScanSheetForCellMeta(sheet_or.value());
-  ASSERT_EQ(scan.cell_meta_indices.size(), 1U);
-  EXPECT_EQ(scan.cell_meta_indices[0], find_dynamic_array_cell_meta_index(SpanOf(shipped_or.value())));
-}
-
-TEST(XlsbWriter, EmitsDynamicArrayMetadataForSingleCellArrayAnchors) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("SingleArray"));
-  sheet.set_cell_formula(0U, 0U, "=IFS(TRUE,\"yes\")");
-  sheet.set_cell_dynamic_array(0U, 0U, true);
-  ASSERT_TRUE(sheet.commit_spill(0U, 0U, 1U, 1U, {Value::text("yes")}));
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  ASSERT_TRUE(zip.has_entry("xl/metadata.bin"));
-
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-  ByteSpan cursor = SpanOf(sheet_or.value());
-  bool found_cell_metadata = false;
-  bool found_array_formula = false;
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    ASSERT_TRUE(static_cast<bool>(record_or));
-    found_cell_metadata =
-        found_cell_metadata || record_or.value().type == static_cast<std::uint16_t>(XlsbRecordType::BrtCellMeta);
-    found_array_formula =
-        found_array_formula || record_or.value().type == static_cast<std::uint16_t>(XlsbRecordType::BrtArrFmla);
-  }
-  EXPECT_TRUE(found_cell_metadata);
-  EXPECT_TRUE(found_array_formula);
-}
-
-// ---------------------------------------------------------------------------
-// Ptg class byte at the formula's own root position. Measured against real
-// Excel 365 `.xlsb` output (spill anchors and a workbook-qualified name): a
-// bare reference
-// that is the *entire* formula body -- nothing else consumes it -- is
-// written in value class, not reference class. A reference-class token
-// cannot stand alone as a formula's result; without this a cell whose
-// whole formula is a bare range reference reads back `#VALUE!` in Excel.
-// A reference used as a function argument, or as an operand the `:` fast
-// path collapses into an Area/Area3d from within an otherwise-nested
-// position, is unaffected -- see the "stays reference class" tests below.
-// ---------------------------------------------------------------------------
-
-namespace {
-
-// Returns the `rgce` bytes of the first `BrtArrFmla` record whose `colFirst`
-// equals `want_col`, or an empty vector if none matches.
-std::vector<std::uint8_t> FindArrFmlaRgce(const std::vector<std::uint8_t>& sheet_bytes, std::uint32_t want_col) {
-  ByteSpan cursor = SpanOf(sheet_bytes);
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    if (!record_or) {
-      return {};
-    }
-    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtArrFmla)) {
-      continue;
-    }
-    ByteSpan p = record_or.value().payload;
-    auto rw_first_or = read_u32(p);
-    auto rw_last_or = read_u32(p);
-    auto col_first_or = read_u32(p);
-    auto col_last_or = read_u32(p);
-    (void)rw_first_or;
-    (void)rw_last_or;
-    (void)col_last_or;
-    if (!col_first_or || col_first_or.value() != want_col) {
-      continue;
-    }
-    if (p.size < 1) {
-      return {};
-    }
-    p.data += 1;  // flag byte
-    p.size -= 1;
-    auto cce_or = read_u32(p);
-    if (!cce_or || cce_or.value() > p.size) {
-      return {};
-    }
-    return std::vector<std::uint8_t>(p.data, p.data + cce_or.value());
-  }
-  return {};
-}
-
-// Returns the `rgce` bytes of the `BrtFmlaNum` record at `want_col` (a
-// plain, non-array formula cell), or an empty vector if none matches.
-std::vector<std::uint8_t> FindFmlaNumRgce(const std::vector<std::uint8_t>& sheet_bytes, std::uint32_t want_col) {
-  ByteSpan cursor = SpanOf(sheet_bytes);
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    if (!record_or) {
-      return {};
-    }
-    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtFmlaNum)) {
-      continue;
-    }
-    ByteSpan p = record_or.value().payload;
-    auto col_or = read_u32(p);
-    if (!col_or || col_or.value() != want_col) {
-      continue;
-    }
-    // Skip iStyleRef(3) + fPhShow(1) + the double value(8) + grbitFlags(2).
-    if (p.size < 14) {
-      return {};
-    }
-    p.data += 14;
-    p.size -= 14;
-    auto cce_or = read_u32(p);
-    if (!cce_or || cce_or.value() > p.size) {
-      return {};
-    }
-    return std::vector<std::uint8_t>(p.data, p.data + cce_or.value());
-  }
-  return {};
-}
-
-}  // namespace
-
-TEST(XlsbWriter, RootLevelSameSheetRangeUsesValueClassArea) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Sheet1"));
-  sheet.set_cell_formula(1U, 2U, "=A10:A11");  // C2
-  ASSERT_TRUE(sheet.commit_spill(1U, 2U, 2U, 1U, {Value::number(5.0), Value::number(7.0)}));
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-
-  const std::vector<std::uint8_t> rgce = FindArrFmlaRgce(sheet_or.value(), 2U);
-  ASSERT_FALSE(rgce.empty());
-  EXPECT_EQ(rgce[0], 0x45U);  // PtgArea, value class (0x25 | value-class bit)
-}
-
-TEST(XlsbWriter, RootLevelCrossSheetRangeUsesValueClassArea3d) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  Sheet& sheet2 = wb.sheet(wb.add_sheet("Sheet2"));
-  sheet2.set_cell_formula(1U, 1U, "=Sheet1!A10:A11");  // B2
-  ASSERT_TRUE(sheet2.commit_spill(1U, 1U, 2U, 1U, {Value::number(5.0), Value::number(7.0)}));
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet2.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-
-  const std::vector<std::uint8_t> rgce = FindArrFmlaRgce(sheet_or.value(), 1U);
-  ASSERT_FALSE(rgce.empty());
-  EXPECT_EQ(rgce[0], 0x5BU);  // PtgArea3d, value class (0x3B | value-class bit)
-}
-
-TEST(XlsbWriter, RootLevelSingleCellReferenceUsesValueClassRef) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Sheet1"));
-  sheet.set_cell_formula(1U, 2U, "=A10");  // C2, plain (non-array) formula cell
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-
-  const std::vector<std::uint8_t> rgce = FindFmlaNumRgce(sheet_or.value(), 2U);
-  ASSERT_FALSE(rgce.empty());
-  EXPECT_EQ(rgce[0], 0x44U);  // PtgRef, value class (0x24 | value-class bit)
-}
-
-TEST(XlsbWriter, RootLevelCrossSheetSingleCellReferenceUsesValueClassRef3d) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  Sheet& sheet2 = wb.sheet(wb.add_sheet("Sheet2"));
-  sheet2.set_cell_formula(1U, 2U, "=Sheet1!A10");  // C2
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet2.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-
-  const std::vector<std::uint8_t> rgce = FindFmlaNumRgce(sheet_or.value(), 2U);
-  ASSERT_FALSE(rgce.empty());
-  EXPECT_EQ(rgce[0], 0x5AU);  // PtgRef3d, value class (0x3A | value-class bit)
-}
-
-TEST(XlsbWriter, NestedRangeArgumentStaysReferenceClass) {
-  // A reference consumed as a function argument is unaffected by the
-  // root-position promotion above: it must stay reference class, exactly
-  // as before. Real Excel 365 reads a value/array-class 3-D reference used
-  // this way as `#REF!`.
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Sheet1"));
-  sheet.set_cell_formula(1U, 2U, "=SUM(A10:A11)");  // C2, plain (non-array) formula cell
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-
-  const std::vector<std::uint8_t> rgce = FindFmlaNumRgce(sheet_or.value(), 2U);
-  ASSERT_FALSE(rgce.empty());
-  EXPECT_EQ(rgce[0], 0x25U);  // PtgArea, reference class -- SUM's argument
-}
-
-TEST(XlsbWriter, RootLevelChainedRangeWithDefinedNameWrapsInValueClassMemFunc) {
-  // The general (non-collapsible) form of a `:` range at root position:
-  // one endpoint is a defined name, so the fast-path Area/Area3d collapse
-  // in `emit_range` does not apply. Measured against an Excel 365 cell
-  // `=Sheet1!A10:Book!Rng`: real Excel wraps `operand + operand +
-  // PtgRange` in a value-class `PtgMemFunc` ("function returns a range",
-  // per ptg.h) carrying the wrapped run's byte length ahead of it, because
-  // `PtgRange` itself carries no class bits to promote directly.
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Sheet1"));
-  DefinedName dn;
-  dn.name = "Rng";
-  dn.formula = "$A$10:$A$11";
-  dn.local_sheet_id = -1;
-  wb.set_defined_names({dn});
-  sheet.set_cell_formula(1U, 2U, "=A10:Rng");  // C2
-  ASSERT_TRUE(sheet.commit_spill(1U, 2U, 2U, 1U, {Value::number(5.0), Value::number(7.0)}));
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-
-  const std::vector<std::uint8_t> rgce = FindArrFmlaRgce(sheet_or.value(), 2U);
-  ASSERT_GE(rgce.size(), 3U);
-  EXPECT_EQ(rgce[0], 0x49U);  // PtgMemFunc, value class (0x29 | value-class bit)
-  const std::uint16_t wrapped_len = static_cast<std::uint16_t>(rgce[1] | (rgce[2] << 8U));
-  ASSERT_EQ(static_cast<std::size_t>(wrapped_len), rgce.size() - 3U);
-  EXPECT_EQ(rgce.back(), 0x11U);  // the wrapped run ends with PtgRange (`:`)
-}
-
-namespace {
-
-// Returns the `rgce` bytes of the `BrtName` record spelling `want_name`, or
-// an empty vector if none matches.
-std::vector<std::uint8_t> FindNameRgce(const std::vector<std::uint8_t>& workbook_bin, std::string_view want_name) {
-  ByteSpan cursor = SpanOf(workbook_bin);
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    if (!record_or) {
-      return {};
-    }
-    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtName)) {
-      continue;
-    }
-    ByteSpan p = record_or.value().payload;
-    if (p.size < 9U) {
-      return {};
-    }
-    p.data += 9;  // grbit(4) + chKey(1) + itab(4)
-    p.size -= 9;
-    auto cch_or = read_u32(p);
-    if (!cch_or || cch_or.value() * 2U > p.size) {
-      return {};
-    }
-    std::string decoded;
-    decoded.reserve(cch_or.value());
-    for (std::uint32_t i = 0; i < cch_or.value(); ++i) {
-      decoded.push_back(static_cast<char>(p.data[i * 2U]));
-    }
-    p.data += cch_or.value() * 2U;
-    p.size -= cch_or.value() * 2U;
-    auto cce_or = read_u32(p);
-    if (!cce_or || cce_or.value() > p.size) {
-      return {};
-    }
-    if (decoded != want_name) {
-      continue;
-    }
-    return std::vector<std::uint8_t>(p.data, p.data + cce_or.value());
-  }
-  return {};
-}
-
-// Returns the first nine payload bytes (grbit, chKey, itab) of the `BrtName`
-// record spelling `want_name`, or an empty vector if none matches.
-std::vector<std::uint8_t> FindNameRecordPrefix(const std::vector<std::uint8_t>& workbook_bin,
-                                               std::string_view want_name) {
-  ByteSpan cursor = SpanOf(workbook_bin);
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    if (!record_or) {
-      return {};
-    }
-    const ByteSpan p = record_or.value().payload;
-    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtName) || p.size < 13U) {
-      continue;
-    }
-    const std::uint32_t cch = static_cast<std::uint32_t>(p.data[9]) | (static_cast<std::uint32_t>(p.data[10]) << 8);
-    if (cch != want_name.size() || p.size < 13U + cch * 2U) {
-      continue;
-    }
-    std::string decoded;
-    for (std::uint32_t i = 0; i < cch; ++i) {
-      decoded.push_back(static_cast<char>(p.data[13U + i * 2U]));
-    }
-    if (decoded == want_name) {
-      return std::vector<std::uint8_t>(p.data, p.data + 9);
-    }
-  }
-  return {};
-}
-
-// Returns `xl/workbook.bin`'s `BrtWbView` `itabCur` field (u32 at payload
-// offset 24), or `0xFFFFFFFF` if the record is missing or truncated.
-std::uint32_t FindItabCur(const std::vector<std::uint8_t>& workbook_bin) {
-  ByteSpan cursor = SpanOf(workbook_bin);
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    if (!record_or) {
-      return 0xFFFFFFFFU;
-    }
-    if (record_or.value().type != 158U) {  // BrtWbView
-      continue;
-    }
-    ByteSpan p = record_or.value().payload;
-    if (p.size < 28U) {
-      return 0xFFFFFFFFU;
-    }
-    p.data += 24;
-    auto itab_or = read_u32(p);
-    return itab_or ? itab_or.value() : 0xFFFFFFFFU;
-  }
-  return 0xFFFFFFFFU;
-}
-
-}  // namespace
-
-TEST(XlsbWriter, DefinedNameBodyRootReferenceStaysReferenceClass) {
-  // Measured against an Excel 365 BrtName "Rng" (=Sheet1!$A$10:$A$11):
-  // unlike a cell formula, a defined
-  // name's own body keeps reference class at its root.
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  DefinedName dn;
-  dn.name = "Rng";
-  dn.formula = "Sheet1!$A$10:$A$11";
-  dn.local_sheet_id = -1;
-  wb.set_defined_names({dn});
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto wb_bin_or = zip.read_entry("xl/workbook.bin");
-  ASSERT_TRUE(static_cast<bool>(wb_bin_or));
-
-  const std::vector<std::uint8_t> rgce = FindNameRgce(wb_bin_or.value(), "Rng");
-  const std::vector<std::uint8_t> want = {0x3B, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x0A,
-                                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-  EXPECT_EQ(rgce, want);
-}
-
-TEST(XlsbWriter, ItabCurMatchesTheTabSelectedSheet) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  Sheet& sheet2 = wb.sheet(wb.add_sheet("Sheet2"));
-  sheet2.mutable_view().tab_selected = true;
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto wb_bin_or = zip.read_entry("xl/workbook.bin");
-  ASSERT_TRUE(static_cast<bool>(wb_bin_or));
-
-  EXPECT_EQ(FindItabCur(wb_bin_or.value()), 1U);
-}
-
-TEST(XlsbWriter, ItabCurIsZeroWhenNoSheetIsTabSelected) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  wb.add_sheet("Sheet2");
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto wb_bin_or = zip.read_entry("xl/workbook.bin");
-  ASSERT_TRUE(static_cast<bool>(wb_bin_or));
-
-  EXPECT_EQ(FindItabCur(wb_bin_or.value()), 0U);
-}
-
-TEST(XlsbWriter, RealFormulaRoundTripsAsFormulaCell) {
-  // An engine-authored formula encodes to a Ptg stream, survives the
-  // write, and decodes back to the same formula text on read.
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("F"));
-  s.set_cell_formula(2U, 3U, "=A1+B2*3");
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-
-  const Cell* c = read_or.value().workbook.sheet(0).cell_at(2U, 3U);
-  ASSERT_NE(c, nullptr);
-  EXPECT_EQ(c->formula_text, "=A1+B2*3");
-}
-
-// Measured on Excel 365: it saves
-// `S!Name` that neither `S` nor the workbook defines against an empty stub
-// scoped to `S`, never against another sheet's definition, so `Sheet2!SVal`
-// stays #NAME? while only Sheet1 defines SVal.
-TEST(XlsbWriter, SheetQualifiedNamesKeepTheirQualifierAndScope) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  wb.add_sheet("Sheet2");
-  DefinedName dn;
-  dn.name = "SVal";
-  dn.formula = "9";
-  dn.local_sheet_id = 0;
-  wb.set_defined_names({dn});
-  struct Case {
-    const char* formula;
-    Value want;
-  };
-  const Case cases[] = {
-      {"=Sheet2!SVal", Value::error(ErrorCode::Name)},      {"=Sheet1!SVal", Value::number(9.0)},
-      {"=Sheet1!NOSUCH(1)", Value::error(ErrorCode::Name)}, {"=Sheet2!NOSUCH(1)", Value::error(ErrorCode::Name)},
-      {"=NOSUCH(1)", Value::error(ErrorCode::Name)},        {"=Sheet1!A1(1)", Value::error(ErrorCode::Ref)},
-  };
-  for (std::uint32_t row = 0; row < std::size(cases); ++row) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, row, 1U, cases[row].formula)));
-  }
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  Workbook& back = read_or.value().workbook;
-  ASSERT_TRUE(static_cast<bool>(back.recalc(eval::default_registry())));
-
-  for (std::uint32_t row = 0; row < std::size(cases); ++row) {
-    const Cell* c = back.sheet(0).cell_at(row, 1U);
-    ASSERT_NE(c, nullptr) << cases[row].formula;
-    EXPECT_EQ(c->formula_text, cases[row].formula);
-    EXPECT_EQ(c->cached_value, cases[row].want) << cases[row].formula;
-  }
-}
-
-TEST(XlsbWriter, DefinedNameWithFutureFunctionRoundTrips) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Data");
-  wb.set_defined_names({DefinedName{"Joined", "TEXTJOIN(\",\",TRUE,A1:A2)", -1, false, ""}});
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  ASSERT_EQ(read_or.value().workbook.defined_names().size(), 1U);
-  EXPECT_EQ(read_or.value().workbook.defined_names()[0].name, "Joined");
-  // Read back in formula-bar spelling, as the OOXML reader does.
-  EXPECT_EQ(read_or.value().workbook.defined_names()[0].formula, "TEXTJOIN(\",\",TRUE,A1:A2)");
-}
-
-// True when `haystack` contains `needle` encoded the way `BrtName`
-// stores a name: UTF-16LE, no BOM. Excel names are ASCII, so each byte
-// is followed by a zero byte.
-bool ContainsUtf16Le(const std::vector<std::uint8_t>& haystack, std::string_view needle) {
-  std::vector<std::uint8_t> wide;
-  wide.reserve(needle.size() * 2U);
-  for (const char c : needle) {
-    wide.push_back(static_cast<std::uint8_t>(c));
-    wide.push_back(0U);
-  }
-  return std::search(haystack.begin(), haystack.end(), wide.begin(), wide.end()) != haystack.end();
-}
-
-TEST(XlsbWriter, FutureFunctionCallRegistersHiddenName) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("F"));
-  s.set_cell_formula(0U, 0U, "=XLOOKUP(\"k\",A1:A3,B1:B3)");
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(write_or.value().bytes))));
-  auto workbook_or = zip.read_entry("xl/workbook.bin");
-  ASSERT_TRUE(static_cast<bool>(workbook_or));
-  EXPECT_TRUE(ContainsUtf16Le(workbook_or.value(), "_xlfn.XLOOKUP"));
-}
-
-// Measured on Excel 365: it stores a cached #SPILL! or
-// #CALC! as #VALUE! (the real error lives in a rich value this writer does
-// not produce) and #GETTING_DATA as #N/A. A newer error byte in a cell made
-// Excel refuse the whole file.
-TEST(XlsbWriter, NewerErrorsAreStoredAsTheirLegacyFallback) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("E"));
-  const ErrorCode errors[] = {ErrorCode::Spill, ErrorCode::Calc, ErrorCode::GettingData, ErrorCode::Div0};
-  const ErrorCode stored[] = {ErrorCode::Value, ErrorCode::Value, ErrorCode::NA, ErrorCode::Div0};
-  for (std::uint32_t row = 0; row < std::size(errors); ++row) {
-    s.set_cell_formula(row, 0U, "=1/0");
-    s.set_cell_cached_value(row, 0U, Value::error(errors[row]));
-    s.set_cell_value(row, 1U, Value::error(errors[row]));
-  }
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Sheet& back = read_or.value().workbook.sheet(0);
-  for (std::uint32_t row = 0; row < std::size(errors); ++row) {
-    for (std::uint32_t col = 0; col < 2U; ++col) {
-      const Cell* c = back.cell_at(row, col);
-      ASSERT_NE(c, nullptr);
-      const Value& v = c->cached_value;
-      EXPECT_EQ(v, Value::error(stored[row])) << "row " << row << " col " << col;
-    }
-  }
-}
-
-// Measured on Excel 365: it keeps `_xlfn.` on a name it
-// does not know, in the formula bar and in the file.
-TEST(XlsbWriter, UnknownPrefixedNameKeepsItsPrefix) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0U, 0U, "=_xlfn.FOOBAR(1)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1U, 0U, "=_xlfn.XLOOKUP(1,B1:B2,C1:C2)")));
-  EXPECT_EQ(wb.sheet(0).cell_at(0U, 0U)->formula_text, "=_xlfn.FOOBAR(1)");
-  EXPECT_EQ(wb.sheet(0).cell_at(1U, 0U)->formula_text, "=XLOOKUP(1,B1:B2,C1:C2)");
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  // `_xlfn.FOOBAR` is a plain undefined-name stub (flags 0, empty body), and
-  // only a function Excel knows gets the hidden future-function record.
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto wb_bin_or = zip.read_entry("xl/workbook.bin");
-  ASSERT_TRUE(static_cast<bool>(wb_bin_or));
-  EXPECT_EQ(FindNameRecordPrefix(wb_bin_or.value(), "_xlfn.FOOBAR"),
-            (std::vector<std::uint8_t>{0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF}));
-  EXPECT_TRUE(FindNameRgce(wb_bin_or.value(), "_xlfn.FOOBAR").empty());
-  EXPECT_EQ(FindNameRecordPrefix(wb_bin_or.value(), "_xlfn.XLOOKUP"),
-            (std::vector<std::uint8_t>{0x0B, 0x00, 0x02, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF}));
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Sheet& back = read_or.value().workbook.sheet(0);
-  EXPECT_EQ(back.cell_at(0U, 0U)->formula_text, "=_xlfn.FOOBAR(1)");
-  EXPECT_EQ(back.cell_at(1U, 0U)->formula_text, "=XLOOKUP(1,B1:B2,C1:C2)");
-}
-
-// A loaded formula keeps the meaning its file gives it. With no dynamic-array
-// mark (`cm` / `BrtCellMeta`), a fixed-size CSE block and an
-// implicit-intersection =SUM(A1:A2*2) are not dynamic-array formulas, and a
-// save through either container keeps them so: the block its array range,
-// neither of them a mark. A formula entered through `Workbook` is marked and
-// keeps the mark across both containers.
-TEST(XlsbWriter, LegacyFormulasKeepTheirMeaningAcrossContainers) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("Sheet1"));
-  s.set_cell_value(0U, 0U, Value::number(1.0));
-  s.set_cell_value(1U, 0U, Value::number(2.0));
-  s.set_cell_formula(0U, 2U, "=A1:A2*2");
-  ASSERT_TRUE(s.commit_spill(0U, 2U, 2U, 1U, {Value::number(2.0), Value::number(4.0)}));
-  s.set_cell_formula(0U, 4U, "=SUM(A1:A2*2)");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0U, 5U, "=SUM(A1:A2*2)")));
-
-  auto check = [](const Workbook& back, const char* label) {
-    const Sheet& sheet = back.sheet(0);
-    EXPECT_FALSE(sheet.cell_at(0U, 2U)->dynamic_array) << label;
-    const SpillRegion* block = sheet.spill_region_at_anchor(0U, 2U);
-    ASSERT_NE(block, nullptr) << label;
-    EXPECT_EQ(block->rows, 2U) << label;
-    EXPECT_FALSE(sheet.cell_at(0U, 4U)->dynamic_array) << label;
-    EXPECT_TRUE(sheet.cell_at(0U, 5U)->dynamic_array) << label;
-  };
-
-  auto xlsx_or = write_ooxml(wb);
-  ASSERT_TRUE(static_cast<bool>(xlsx_or)) << xlsx_or.error().message;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(xlsx_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.xml");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-  const std::string sheet_xml(sheet_or.value().begin(), sheet_or.value().end());
-  EXPECT_NE(sheet_xml.find("<c r=\"C1\"><f t=\"array\" ref=\"C1:C2\">"), std::string::npos) << sheet_xml;
-  EXPECT_NE(sheet_xml.find("<c r=\"E1\"><f>SUM(A1:A2*2)</f>"), std::string::npos) << sheet_xml;
-  EXPECT_NE(sheet_xml.find("<c r=\"F1\" cm=\"1\"><f t=\"array\" ref=\"F1\">"), std::string::npos) << sheet_xml;
-  auto from_xlsx = read_ooxml(SpanOf(xlsx_or.value()));
-  ASSERT_TRUE(static_cast<bool>(from_xlsx)) << from_xlsx.error().message;
-  check(from_xlsx.value().workbook, "xlsx");
-
-  auto xlsb_or = write_xlsb(from_xlsx.value().workbook);
-  ASSERT_TRUE(static_cast<bool>(xlsb_or)) << xlsb_or.error().message;
-  auto from_xlsb = read_xlsb(SpanOf(xlsb_or.value()));
-  ASSERT_TRUE(static_cast<bool>(from_xlsb)) << from_xlsb.error().message;
-  check(from_xlsb.value().workbook, "xlsb");
-}
-
-TEST(XlsbWriter, CubeFunctionsEncodeWithTheirFunctionIds) {
-  // Excel 365 saves `CUBEVALUE("c","m")` as two strings and
-  // `PtgFuncVar(2, 380)`, not through a hidden `_xlfn.` name.
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("F"));
-  s.set_cell_formula(0U, 0U, "=CUBEVALUE(\"c\",\"m\")");
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(write_or.value().bytes))));
-  auto workbook_or = zip.read_entry("xl/workbook.bin");
-  ASSERT_TRUE(static_cast<bool>(workbook_or));
-  EXPECT_FALSE(ContainsUtf16Le(workbook_or.value(), "CUBEVALUE"));
-
-  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Cell* cell = read_or.value().workbook.sheet(0).cell_at(0U, 0U);
-  ASSERT_NE(cell, nullptr);
-  EXPECT_EQ(cell->formula_text, "=CUBEVALUE(\"c\",\"m\")");
-}
-
-TEST(XlsbWriter, UndefinedNameCallIsStoredAgainstAWorkbookStub) {
-  // Measured on Excel 365: a lone `NOSUCH(1)` is
-  // `PtgName` + the argument + `PtgFuncVar(255)`, the name an empty,
-  // visible, workbook-scoped BrtName.
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 0U, 0U, "=NOSUCH(1)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0, 1U, 0U, "=NOSUCHREF")));
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(write_or.value().bytes))));
-  auto workbook_or = zip.read_entry("xl/workbook.bin");
-  ASSERT_TRUE(static_cast<bool>(workbook_or));
-  EXPECT_EQ(FindNameRecordPrefix(workbook_or.value(), "NOSUCH"),
-            (std::vector<std::uint8_t>{0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF}));
-
-  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  Workbook& back = read_or.value().workbook;
-  ASSERT_TRUE(static_cast<bool>(back.recalc(eval::default_registry())));
-  for (std::uint32_t row = 0; row < 2U; ++row) {
-    const Cell* cell = back.sheet(0).cell_at(row, 0U);
-    ASSERT_NE(cell, nullptr);
-    EXPECT_EQ(cell->formula_text, row == 0U ? "=NOSUCH(1)" : "=NOSUCHREF");
-    EXPECT_EQ(cell->cached_value, Value::error(ErrorCode::Name));
-  }
-}
-
-TEST(XlsbWriter, LocalisedJisSpellingSavesAsTheStoredDbcsSpelling) {
-  // Excel localises the formula bar but not the file: `JIS` is the ja-JP
-  // spelling of `DBCS`, and Excel stores the call as `DBCS` with
-  // function id 215 in both containers. A workbook carrying either
-  // spelling must save without degrading, and both come back as the
-  // stored spelling.
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("F"));
-  s.set_cell_formula(0U, 0U, "=JIS(\"ABC\")");
-  s.set_cell_formula(1U, 0U, "=DBCS(\"ABC\")");
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
-
-  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Sheet& rt = read_or.value().workbook.sheet(0);
-  const Cell* from_jis = rt.cell_at(0U, 0U);
-  ASSERT_NE(from_jis, nullptr);
-  EXPECT_EQ(from_jis->formula_text, "=DBCS(\"ABC\")");
-  const Cell* from_dbcs = rt.cell_at(1U, 0U);
-  ASSERT_NE(from_dbcs, nullptr);
-  EXPECT_EQ(from_dbcs->formula_text, "=DBCS(\"ABC\")");
-}
-
-TEST(XlsbWriter, HarvestedFuncIdCallsRoundTripWithIdenticalFormulaText) {
-  // The ids for these callees were decoded from an Excel-produced
-  // workbook (`tests/fixtures/excel/xlsb_func_ids.xlsb`). Each spells a
-  // different encoding decision the table drives: a fixed-arity
-  // `PtgFunc` (MROUND), a `PtgFuncVar` at its minimum and its maximum
-  // arity (WEEKNUM), and an open-ended variadic (GCD). None may degrade
-  // to a cached literal, and every formula must come back byte-identical.
-  constexpr std::uint32_t kFormulaCount = 5U;
-  const char* kFormulas[kFormulaCount] = {
-      "=MROUND(17,5)", "=WEEKNUM(43922)", "=WEEKNUM(43922,1)", "=GCD(24,36,60)", "=YEARFRAC(43831,44197,0)",
-  };
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("F"));
-  for (std::uint32_t i = 0; i < kFormulaCount; ++i) {
-    s.set_cell_formula(i, 0U, kFormulas[i]);
-  }
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
-
-  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Sheet& rt = read_or.value().workbook.sheet(0);
-  for (std::uint32_t i = 0; i < kFormulaCount; ++i) {
-    const Cell* cell = rt.cell_at(i, 0U);
-    ASSERT_NE(cell, nullptr) << kFormulas[i];
-    EXPECT_EQ(cell->formula_text, kFormulas[i]);
-  }
-}
-
-TEST(XlsbWriter, UnencodableFormulaDowngradesToCachedLiteralAndReportsIt) {
-  // A structured reference (`T[C]`) has no Ptg lowering in the
-  // common-token codec. A single unsupported formula must not make the
-  // whole workbook unsaveable: it degrades to its cached literal and the
-  // explicit result count records the loss.
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("F"));
-  s.set_cell_formula(0U, 0U, "=T[C]");
-  s.set_cell_cached_value(0U, 0U, Value::number(42.0));
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 1U);
-  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Cell* cell = read_or.value().workbook.sheet(0).cell_at(0U, 0U);
-  ASSERT_NE(cell, nullptr);
-  EXPECT_TRUE(cell->formula_text.empty());
-  ASSERT_TRUE(cell->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(cell->cached_value.as_number(), 42.0);
-}
-
-TEST(XlsbWriter, UnencodableSpillFormulaDowngradesAnchorWithoutPhantoms) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("F"));
-  s.set_cell_formula(0U, 0U, "=T[C]");
-  ASSERT_TRUE(s.commit_spill(0U, 0U, 1U, 2U, {Value::number(11.0), Value::number(12.0)}));
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 1U);
-  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Sheet& rt = read_or.value().workbook.sheet(0);
-  const Cell* anchor = rt.cell_at(0U, 0U);
-  ASSERT_NE(anchor, nullptr);
-  EXPECT_TRUE(anchor->formula_text.empty());
-  ASSERT_TRUE(anchor->cached_value.is_number());
-  EXPECT_DOUBLE_EQ(anchor->cached_value.as_number(), 11.0);
-  EXPECT_EQ(rt.cell_at(0U, 1U), nullptr);
-}
-
-TEST(XlsbWriter, GeneratedPartsBeatPassthroughOnCollision) {
-  // Passthrough trying to ride on the writer's reserved
-  // `xl/workbook.bin` path: must be dropped (writer logs a warning,
-  // not asserted here), and the round-trip must still succeed.
-  Workbook wb = Workbook::create_empty();
-  Sheet& s = wb.sheet(wb.add_sheet("S1"));
-  s.set_cell_value(0U, 0U, Value::number(1.0));
-
-  std::vector<PassthroughPart> parts;
-  PassthroughPart bogus_workbook;
-  bogus_workbook.path = "xl/workbook.bin";
-  bogus_workbook.content_type = "application/vnd.ms-excel.sheet.binary.macroEnabled.main";
-  bogus_workbook.bytes = {0xDE, 0xAD, 0xBE, 0xEF};  // garbage — would break the package if it survived
-  parts.push_back(std::move(bogus_workbook));
-  wb.set_passthrough_parts(std::move(parts));
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or));
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  // Workbook is intact: we got our sheet back.
-  ASSERT_EQ(read_or.value().workbook.sheet_count(), 1U);
-  EXPECT_EQ(read_or.value().workbook.sheet(0).name(), "S1");
-}
-
-TEST(XlsbWriter, SheetVisibilitySurvivesRoundTrip) {
-  // A hidden sheet must stay hidden across write -> read. The Sheet model
-  // tracks visibility via `view().tab_hidden`, which the writer maps to
-  // BrtBundleSh hsState and the reader maps back.
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Visible");
-  wb.add_sheet("Hidden");
-  wb.sheet(1).mutable_view().tab_hidden = true;
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Workbook& rt = read_or.value().workbook;
-  ASSERT_EQ(rt.sheet_count(), 2U);
-  EXPECT_FALSE(rt.sheet(0).view().tab_hidden);
-  EXPECT_TRUE(rt.sheet(1).view().tab_hidden);
-}
-
-TEST(XlsbWriter, Date1904SurvivesRoundTrip) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Dates");
-  wb.set_date1904(true);
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  EXPECT_TRUE(read_or.value().workbook.date1904());
-}
-
-TEST(XlsbWriter, RowAndColumnLayoutSurviveRoundTrip) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Layout"));
-  sheet.mutable_layout().columns.push_back(ColumnLayout{1U, 3U, 17.25, true, 2U});
-  sheet.mutable_layout().row_overrides.push_back(RowLayout{4U, 28.5, true, 3U, true});
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const SheetLayout& layout = read_or.value().workbook.sheet(0).layout();
-  ASSERT_EQ(layout.columns.size(), 1U);
-  EXPECT_EQ(layout.columns[0].first, 1U);
-  EXPECT_EQ(layout.columns[0].last, 3U);
-  EXPECT_DOUBLE_EQ(layout.columns[0].width, 17.25);
-  EXPECT_TRUE(layout.columns[0].has_width);
-  // BrtColInfo always carries ixfe, so XLSB canonicalizes a width-only
-  // aggregate span to effective style 0 on read.
-  EXPECT_TRUE(layout.columns[0].has_style);
-  EXPECT_EQ(layout.columns[0].style_xf, 0U);
-  EXPECT_TRUE(layout.columns[0].hidden);
-  EXPECT_EQ(layout.columns[0].outline_level, 2U);
-  ASSERT_EQ(layout.row_overrides.size(), 1U);
-  EXPECT_EQ(layout.row_overrides[0].row, 4U);
-  EXPECT_DOUBLE_EQ(layout.row_overrides[0].height, 28.5);
-  EXPECT_TRUE(layout.row_overrides[0].hidden);
-  EXPECT_EQ(layout.row_overrides[0].outline_level, 3U);
-}
-
-TEST(XlsbWriter, RowStyleFlagCarriesExplicitZeroAndNonZeroStyles) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("RowStyles"));
-  RowLayout style_zero;
-  style_zero.row = 2U;
-  style_zero.has_style = true;
-  style_zero.style_xf = 0U;
-  RowLayout style_one;
-  style_one.row = 3U;
-  style_one.has_style = true;
-  style_one.style_xf = 1U;
-  sheet.mutable_layout().row_overrides = {style_zero, style_one};
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-
-  std::map<std::uint32_t, std::pair<std::uint32_t, std::uint8_t>> raw;
-  ByteSpan cursor = SpanOf(sheet_or.value());
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    ASSERT_TRUE(static_cast<bool>(record_or));
-    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtRowHdr)) {
-      continue;
-    }
-    ByteSpan payload = record_or.value().payload;
-    auto row_or = read_u32(payload);
-    auto style_or = read_u32(payload);
-    ASSERT_TRUE(row_or && style_or);
-    ASSERT_TRUE(read_u16(payload));
-    ASSERT_TRUE(read_u8(payload));
-    auto flags_or = read_u8(payload);
-    ASSERT_TRUE(read_u8(payload));
-    ASSERT_TRUE(flags_or);
-    raw[row_or.value()] = {style_or.value(), flags_or.value()};
-  }
-  ASSERT_EQ(raw.size(), 2U);
-  EXPECT_EQ(raw.at(2U).first, 0U);
-  EXPECT_NE(raw.at(2U).second & 0x40U, 0U);
-  EXPECT_EQ(raw.at(3U).first, 1U);
-  EXPECT_NE(raw.at(3U).second & 0x40U, 0U);
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const auto& rows = read_or.value().workbook.sheet(0).layout().row_overrides;
-  ASSERT_EQ(rows.size(), 2U);
-  EXPECT_TRUE(rows[0].has_style);
-  EXPECT_TRUE(rows[1].has_style);
-  const auto find_row = [&rows](std::uint32_t row) -> const RowLayout* {
-    for (const RowLayout& candidate : rows) {
-      if (candidate.row == row) {
-        return &candidate;
-      }
-    }
-    return nullptr;
-  };
-  const RowLayout* loaded_zero = find_row(2U);
-  const RowLayout* loaded_one = find_row(3U);
-  ASSERT_NE(loaded_zero, nullptr);
-  ASSERT_NE(loaded_one, nullptr);
-  EXPECT_TRUE(loaded_zero->has_style);
-  EXPECT_EQ(loaded_zero->style_xf, 0U);
-  EXPECT_TRUE(loaded_one->has_style);
-  EXPECT_EQ(loaded_one->style_xf, 1U);
-}
-
-TEST(XlsbWriter, MergedRangesSurviveRoundTrip) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Merged"));
-  sheet.set_cell_value(0U, 0U, Value::text("title"));
-  sheet.mutable_merges().push_back(MergeRange{0U, 0U, 1U, 2U});
-  sheet.mutable_merges().push_back(MergeRange{4U, 3U, 4U, 5U});
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const std::vector<MergeRange>& merges = read_or.value().workbook.sheet(0).merges();
-  ASSERT_EQ(merges.size(), 2U);
-  EXPECT_EQ(merges[0].first_row, 0U);
-  EXPECT_EQ(merges[0].first_col, 0U);
-  EXPECT_EQ(merges[0].last_row, 1U);
-  EXPECT_EQ(merges[0].last_col, 2U);
-  EXPECT_EQ(merges[1].first_row, 4U);
-  EXPECT_EQ(merges[1].first_col, 3U);
-  EXPECT_EQ(merges[1].last_row, 4U);
-  EXPECT_EQ(merges[1].last_col, 5U);
-}
-
-TEST(XlsbWriter, SheetViewAndFrozenPanesSurviveRoundTrip) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("View"));
-  sheet.set_cell_value(0U, 0U, Value::number(1.0));
-  SheetView& view = sheet.mutable_view();
-  view.zoom_scale = 135U;
-  view.freeze_rows = 3U;
-  view.freeze_cols = 2U;
-  view.show_grid_lines = false;
-  view.show_row_col_headers = false;
-  view.show_zeros = false;
-  view.right_to_left = true;
-  view.tab_selected = true;
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto sheet_or = zip.read_entry("xl/worksheets/sheet1.bin");
-  ASSERT_TRUE(static_cast<bool>(sheet_or));
-  ByteSpan records = SpanOf(sheet_or.value());
-  bool saw_pane = false;
-  while (records.size != 0U) {
-    auto rec_or = read_record(records);
-    ASSERT_TRUE(static_cast<bool>(rec_or));
-    if (rec_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtPane)) {
-      continue;
-    }
-    saw_pane = true;
-    ByteSpan pane = rec_or.value().payload;
-    ASSERT_EQ(pane.size, 29U);
-    pane.data += 16U;  // two Xnum frozen row/column counts
-    pane.size -= 16U;
-    auto top_row_or = read_u32(pane);
-    auto left_col_or = read_u32(pane);
-    auto active_pane_or = read_u32(pane);
-    auto flags_or = read_u8(pane);
-    ASSERT_TRUE(top_row_or && left_col_or && active_pane_or && flags_or);
-    EXPECT_EQ(top_row_or.value(), 3U);
-    EXPECT_EQ(left_col_or.value(), 2U);
-    EXPECT_EQ(active_pane_or.value(), 0U);
-    EXPECT_EQ(flags_or.value(), 0x02U);
-  }
-  EXPECT_TRUE(saw_pane);
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const SheetView& rt = read_or.value().workbook.sheet(0).view();
-  EXPECT_EQ(rt.zoom_scale, 135U);
-  EXPECT_EQ(rt.freeze_rows, 3U);
-  EXPECT_EQ(rt.freeze_cols, 2U);
-  EXPECT_FALSE(rt.show_grid_lines);
-  EXPECT_FALSE(rt.show_row_col_headers);
-  EXPECT_FALSE(rt.show_zeros);
-  EXPECT_TRUE(rt.right_to_left);
-  EXPECT_TRUE(rt.tab_selected);
-}
-
-TEST(XlsbWriter, ReportsDeferredSheetFeatures) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Deferred"));
-  Hyperlink hyperlink;
-  hyperlink.target = "https://example.com";
-  sheet.mutable_hyperlinks().push_back(std::move(hyperlink));
-  sheet.mutable_validations().push_back(DataValidation{});
-  sheet.set_auto_filter_xml("<autoFilter ref=\"A1:B2\"/>");
-  sheet.mutable_view().freeze_rows = 1U;
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  // Auto-filter state remains deferred; hyperlinks and validations are
-  // written from the model and therefore no longer inflate this counter.
-  EXPECT_EQ(write_or.value().diagnostics.deferred_feature_count, 1U);
-}
-
-TEST(XlsbWriter, RejectsInvalidHyperlinkRectangle) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("InvalidHyperlink"));
-  Hyperlink inverted;
-  inverted.row = 4U;
-  inverted.col = 5U;
-  inverted.last_row = 3U;
-  inverted.last_col = 6U;
-  inverted.target = "https://invalid.example";
-  sheet.mutable_hyperlinks().push_back(inverted);
-
-  auto inverted_write = write_xlsb(wb);
-  ASSERT_FALSE(static_cast<bool>(inverted_write));
-  EXPECT_EQ(inverted_write.error().code, FormulonErrorCode::kInvalidArgument);
-
-  sheet.mutable_hyperlinks().clear();
-  Hyperlink out_of_grid;
-  out_of_grid.row = 0U;
-  out_of_grid.col = 0U;
-  out_of_grid.last_row = Sheet::kMaxRows;
-  out_of_grid.last_col = 0U;
-  out_of_grid.target = "https://invalid.example";
-  sheet.mutable_hyperlinks().push_back(out_of_grid);
-  auto out_of_grid_write = write_xlsb(wb);
-  ASSERT_FALSE(static_cast<bool>(out_of_grid_write));
-  EXPECT_EQ(out_of_grid_write.error().code, FormulonErrorCode::kInvalidArgument);
-}
-
-TEST(XlsbWriter, RoundTripsExternalAndInternalHyperlinkRectangles) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Hyperlinks"));
-  Hyperlink external;
-  external.row = 1U;
-  external.col = 2U;
-  external.last_row = 3U;
-  external.last_col = 4U;
-  external.target = "https://external.example/book.xlsx";
-  external.location = "#Sheet2!A1";
-  external.tooltip = "external";
-  external.display = "Open";
-  sheet.mutable_hyperlinks().push_back(external);
-  Hyperlink internal;
-  internal.row = 6U;
-  internal.col = 7U;
-  internal.last_row = 8U;
-  internal.last_col = 9U;
-  internal.location = "Sheet1!A1";
-  internal.tooltip = "internal";
-  internal.display = "Jump";
-  sheet.mutable_hyperlinks().push_back(internal);
-
-  auto first_write = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(first_write)) << first_write.error().message << " | " << first_write.error().context;
-  auto first_read = read_xlsb(SpanOf(first_write.value()));
-  ASSERT_TRUE(static_cast<bool>(first_read)) << first_read.error().message << " | " << first_read.error().context;
-  Workbook edited = std::move(first_read.value().workbook);
-  ASSERT_EQ(edited.sheet(0).hyperlinks().size(), 2U);
-  edited.sheet(0).mutable_hyperlinks()[0].row = 2U;
-  edited.sheet(0).mutable_hyperlinks()[0].last_row = 4U;
-
-  auto second_write = write_xlsb(edited);
-  ASSERT_TRUE(static_cast<bool>(second_write)) << second_write.error().message << " | " << second_write.error().context;
-  auto second_read = read_xlsb(SpanOf(second_write.value()));
-  ASSERT_TRUE(static_cast<bool>(second_read)) << second_read.error().message << " | " << second_read.error().context;
-  const auto& hyperlinks = second_read.value().workbook.sheet(0).hyperlinks();
-  ASSERT_EQ(hyperlinks.size(), 2U);
-  EXPECT_EQ(hyperlinks[0].row, 2U);
-  EXPECT_EQ(hyperlinks[0].col, 2U);
-  EXPECT_EQ(hyperlinks[0].last_row, 4U);
-  EXPECT_EQ(hyperlinks[0].last_col, 4U);
-  EXPECT_EQ(hyperlinks[0].target, "https://external.example/book.xlsx");
-  EXPECT_FALSE(hyperlinks[0].rid.empty());
-  EXPECT_EQ(hyperlinks[1].row, 6U);
-  EXPECT_EQ(hyperlinks[1].col, 7U);
-  EXPECT_EQ(hyperlinks[1].last_row, 8U);
-  EXPECT_EQ(hyperlinks[1].last_col, 9U);
-  EXPECT_TRUE(hyperlinks[1].rid.empty());
-  EXPECT_EQ(hyperlinks[1].location, "Sheet1!A1");
-}
-
-TEST(XlsbWriter, ReusesSharedSourceRelationshipIdForMatchingTargets) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("SharedRids"));
-  Hyperlink first;
-  first.row = 1U;
-  first.col = 1U;
-  first.last_row = 1U;
-  first.last_col = 2U;
-  first.target = "https://shared.example/target";
-  first.rid = "rIdShared";
-  sheet.mutable_hyperlinks().push_back(first);
-  Hyperlink second;
-  second.row = 3U;
-  second.col = 1U;
-  second.last_row = 3U;
-  second.last_col = 2U;
-  second.target = "https://shared.example/target";
-  second.rid = "rIdShared";
-  sheet.mutable_hyperlinks().push_back(second);
-
-  auto write_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(write_or.value()))));
-  auto rels_or = zip.read_entry("xl/worksheets/_rels/sheet1.bin.rels");
-  ASSERT_TRUE(static_cast<bool>(rels_or));
-  const std::string rels(rels_or.value().begin(), rels_or.value().end());
-  const std::string id_token = "Id=\"rIdShared\"";
-  const std::size_t first_id = rels.find(id_token);
-  ASSERT_NE(first_id, std::string::npos) << rels;
-  EXPECT_EQ(rels.find(id_token, first_id + id_token.size()), std::string::npos) << rels;
-
-  auto read_or = read_xlsb(SpanOf(write_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const auto& hyperlinks = read_or.value().workbook.sheet(0).hyperlinks();
-  ASSERT_EQ(hyperlinks.size(), 2U);
-  EXPECT_EQ(hyperlinks[0].rid, "rIdShared");
-  EXPECT_EQ(hyperlinks[1].rid, "rIdShared");
-  EXPECT_EQ(hyperlinks[0].target, hyperlinks[1].target);
-}
-
-TEST(XlsbWriter, GeneratesStylesPartForModelledStyles) {
-  // XLSX/native workbooks do not have a raw styles.bin passthrough part.  The
-  // XLSB writer must therefore materialise the modelled table and expose it
-  // through both the content-type override and workbook relationship.
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Styled"));
-  sheet.set_cell_value(0U, 0U, Value::number(12.5));
-
-  StylesTable styles;
-  FontRecord font;
-  font.name = "Aptos";
-  font.size = 12.0;
-  font.bold = true;
-  font.color_argb = 0xFF112233U;
-  styles.fonts.push_back(font);
-  FillRecord fill;
-  fill.pattern = 1U;
-  fill.fg_argb = 0xFFFFFF00U;
-  styles.fills.push_back(fill);
-  styles.borders.push_back(BorderRecord{});
-  styles.num_fmt_strings.push_back("0.000");
-  styles.num_fmts.push_back(NumFmtRecord{164U, 0U});
-  CellXf named;
-  named.vertical_align = 2U;
-  styles.cell_style_xfs.push_back(named);
-  CellXf xf;
-  xf.font_index = 0U;
-  xf.fill_index = 0U;
-  xf.border_index = 0U;
-  xf.num_fmt_id = 164U;
-  xf.xf_id = 0U;
-  xf.apply_number_format = true;
-  xf.apply_font = true;
-  xf.apply_fill = true;
-  styles.cell_xfs.push_back(xf);
-  wb.set_styles(std::move(styles));
-  sheet.set_cell_xf_index(0U, 0U, 0U);
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or)) << bytes_or.error().message << " | " << bytes_or.error().context;
-
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  ASSERT_TRUE(zip.has_entry("xl/styles.bin"));
-  auto rels_or = zip.read_entry("xl/_rels/workbook.bin.rels");
-  ASSERT_TRUE(static_cast<bool>(rels_or));
-  const std::string rels(rels_or.value().begin(), rels_or.value().end());
-  EXPECT_NE(rels.find("relationships/styles"), std::string::npos);
-  EXPECT_NE(rels.find("Target=\"styles.bin\""), std::string::npos);
-  auto types_or = zip.read_entry("[Content_Types].xml");
-  ASSERT_TRUE(static_cast<bool>(types_or));
-  const std::string types(types_or.value().begin(), types_or.value().end());
-  EXPECT_NE(types.find("/xl/styles.bin"), std::string::npos);
-  EXPECT_NE(types.find("application/vnd.ms-excel.styles"), std::string::npos);
-
-  auto read_or = read_xlsb(SpanOf(bytes_or.value()));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const StylesTable& rt = read_or.value().workbook.styles();
-  ASSERT_EQ(rt.num_fmts.size(), 1U);
-  EXPECT_EQ(rt.num_fmts[0].id, 164U);
-  ASSERT_EQ(rt.num_fmt_strings.size(), 1U);
-  EXPECT_EQ(rt.num_fmt_strings[0], "0.000");
-  ASSERT_EQ(rt.cell_xfs.size(), 1U);
-  EXPECT_EQ(rt.cell_xfs[0].num_fmt_id, 164U);
-  EXPECT_EQ(rt.cell_xfs[0].font_index, 0U);
-  EXPECT_EQ(rt.cell_xfs[0].fill_index, 0U);
-}
-
-TEST(XlsbWriter, StylesColorsUseTheBrtColorLowValidityBit) {
-  StylesTable styles;
-  FontRecord font;
-  font.name = "Aptos";
-  font.color_argb = 0xFF112233U;
-  styles.fonts.push_back(font);
-  const std::vector<std::uint8_t> bytes = write_styles_bin(styles);
-
-  ByteSpan cursor = SpanOf(bytes);
-  while (cursor.size > 0U) {
-    auto record_or = read_record(cursor);
-    ASSERT_TRUE(static_cast<bool>(record_or));
-    if (record_or.value().type != static_cast<std::uint16_t>(XlsbRecordType::BrtFont)) {
-      continue;
-    }
-    const ByteSpan payload = record_or.value().payload;
-    ASSERT_GE(payload.size, 20U);
-    // u16 height/flags/weight/vertAlign + underline/family/charset/reserved
-    // precede BrtColor. RGB is XColorType 2 with fValidRGB in bit 0.
-    EXPECT_EQ(payload.data[12], 0x05U);
-    EXPECT_EQ(payload.data[16], 0x11U);
-    EXPECT_EQ(payload.data[17], 0x22U);
-    EXPECT_EQ(payload.data[18], 0x33U);
-    EXPECT_EQ(payload.data[19], 0xFFU);
-    return;
-  }
-  FAIL() << "missing BrtFont";
-}
-
-TEST(XlsbWriter, PreservesRawStylesPartFromExistingXlsb) {
-  // Generated styles are for XLSX/native input only.  When an XLSB reader has
-  // retained an opaque style part, that byte stream remains authoritative so
-  // unmodelled binary formatting extensions cannot be erased on save.
-  Workbook wb = Workbook::create_empty();
-  wb.sheet(wb.add_sheet("S")).set_cell_value(0U, 0U, Value::number(1.0));
-  StylesTable raw_table;
-  raw_table.num_fmt_strings.push_back("0.0000");
-  raw_table.num_fmts.push_back(NumFmtRecord{164U, 0U});
-  const std::vector<std::uint8_t> raw_bytes = write_styles_bin(raw_table);
-  PassthroughPart raw_part;
-  raw_part.path = "xl/styles.bin";
-  raw_part.content_type = "application/vnd.ms-excel.styles";
-  raw_part.bytes = raw_bytes;
-  wb.set_passthrough_parts({raw_part});
-
-  // Deliberately make the in-memory table differ from the opaque source.  If
-  // the writer regenerated it, the byte comparison below would fail.
-  StylesTable changed;
-  changed.num_fmt_strings.push_back("0.0%");
-  changed.num_fmts.push_back(NumFmtRecord{165U, 0U});
-  wb.set_styles(std::move(changed));
-
-  auto bytes_or = write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(bytes_or));
-  ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(SpanOf(bytes_or.value()))));
-  auto styles_or = zip.read_entry("xl/styles.bin");
-  ASSERT_TRUE(static_cast<bool>(styles_or));
-  EXPECT_EQ(styles_or.value(), raw_bytes);
-}
-
-TEST(XlsbWriter, WholeColumnFormulaSavesWithoutDowngrade) {
-  Workbook wb = Workbook::create_empty();
-  Sheet& sheet = wb.sheet(wb.add_sheet("Ranges"));
-  sheet.set_cell_formula(0U, 0U, "=SUM(A:A)");
-
-  auto write_or = write_xlsb_with_result(wb);
-  ASSERT_TRUE(static_cast<bool>(write_or)) << write_or.error().message << " | " << write_or.error().context;
-  EXPECT_EQ(write_or.value().diagnostics.downgraded_formula_count, 0U);
-  auto read_or = read_xlsb(SpanOf(write_or.value().bytes));
-  ASSERT_TRUE(static_cast<bool>(read_or)) << read_or.error().message << " | " << read_or.error().context;
-  const Cell* cell = read_or.value().workbook.sheet(0).cell_at(0U, 0U);
-  ASSERT_NE(cell, nullptr);
-  EXPECT_EQ(cell->formula_text, "=SUM(A:A)");
-}
-
 }  // namespace
 }  // namespace xlsb
 }  // namespace io
diff --git a/tests/unit/io/xlsb/writer_test_helpers.h b/tests/unit/io/xlsb/writer_test_helpers.h
new file mode 100644
index 000000000..449432c6a
--- /dev/null
+++ b/tests/unit/io/xlsb/writer_test_helpers.h
@@ -0,0 +1,14 @@
+#pragma once
+
+#include <cstdint>
+#include <vector>
+
+#include "io/xlsb/record.h"
+
+namespace formulon::io::xlsb {
+
+inline ByteSpan SpanOf(const std::vector<std::uint8_t>& v) {
+  return ByteSpan{v.data(), v.size()};
+}
+
+}  // namespace formulon::io::xlsb
diff --git a/tests/unit/io/xlsb_reader_contract_test.cpp b/tests/unit/io/xlsb_reader_contract_test.cpp
index 256a92584..9ab284d87 100644
--- a/tests/unit/io/xlsb_reader_contract_test.cpp
+++ b/tests/unit/io/xlsb_reader_contract_test.cpp
@@ -343,6 +343,7 @@ TEST(XlsbRowLayout, CustomHeightSurvivesAWriteReadCycle) {
   custom.row = 3;
   custom.height = 33.0;
   custom.has_height = true;
+  custom.custom_height = true;
   wb.sheet(0).mutable_layout().row_overrides.push_back(custom);
 
   auto written = io::xlsb::write_xlsb(wb);
diff --git a/tests/unit/io/xlsb_roundtrip_defined_names_test.cpp b/tests/unit/io/xlsb_roundtrip_defined_names_test.cpp
new file mode 100644
index 000000000..f42e43cfe
--- /dev/null
+++ b/tests/unit/io/xlsb_roundtrip_defined_names_test.cpp
@@ -0,0 +1,388 @@
+// Cross-format XLSB/OOXML symmetry tests.
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <cstring>
+#include <iterator>
+#include <limits>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "io/xlsb/reader.h"
+#include "io/xlsb/record.h"
+#include "io/xlsb/record_writer.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "sheet.h"
+#include "styles.h"
+#include "support/roundtrip_symmetry.h"
+#include "value.h"
+#include "xlsb_roundtrip_symmetry_test_helpers.h"
+
+namespace formulon {
+namespace {
+using namespace xlsb_roundtrip_test_support;
+TEST(XlsbWriteReadSymmetry, CellStyleAndNumberFormatSurviveRoundTrip) {
+  const std::vector<std::uint8_t> bytes = test::read_file_bytes(FixturePath("xlsb_fidelity_base.xlsb"));
+  ASSERT_FALSE(bytes.empty());
+  auto loaded = io::xlsb::read_xlsb(test::span_of(bytes));
+  ASSERT_TRUE(static_cast<bool>(loaded)) << "read_xlsb failed: " << loaded.error().message;
+  const Workbook& before = loaded.value().workbook;
+
+  // Baseline: the fixture resolves the expected number formats.
+  ASSERT_EQ(ResolvedNumFmtId(before, 0, 3), 179U);  // D1 yyyy/mm/dd
+  ASSERT_EQ(ResolvedNumFmtId(before, 1, 3), 4U);    // D2 #,##0.00
+  ASSERT_EQ(ResolvedNumFmtId(before, 4, 3), 180U);  // D5 0.0%
+  const Cell* d3_before = before.sheet(0).cell_at(2, 3);
+  ASSERT_NE(d3_before, nullptr);
+  ASSERT_NE(d3_before->xf_index, 0U) << "fixture D3 should carry a non-default style";
+
+  auto saved = io::xlsb::write_xlsb(before);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "reload failed: " << reloaded.error().message;
+  const Workbook& after = reloaded.value().workbook;
+
+  // Number formats still resolve after the round-trip (index + style table).
+  EXPECT_EQ(ResolvedNumFmtId(after, 0, 3), 179U);
+  EXPECT_EQ(ResolvedNumFmtId(after, 1, 3), 4U);
+  EXPECT_EQ(ResolvedNumFmtId(after, 4, 3), 180U);
+  // D3's font style index is preserved.
+  const Cell* d3_after = after.sheet(0).cell_at(2, 3);
+  ASSERT_NE(d3_after, nullptr);
+  EXPECT_EQ(d3_after->xf_index, d3_before->xf_index);
+}
+TEST(XlsbWriteReadSymmetry, LetParameterReferencedInDifferentCaseKeepsItsBinding) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=LET(x,10,X+1)")));  // A1
+  auto before_recalc = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(before_recalc)) << before_recalc.error().message;
+  const Value a1_before = wb.sheet(0).resolve_cell_value(0U, 0U);
+  ASSERT_TRUE(a1_before.is_number());
+  ASSERT_EQ(a1_before.as_number(), 11.0);
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  Workbook after = std::move(reloaded.value().workbook);
+
+  // No free defined name was invented for `X`: the parameter reference was
+  // recognised as in-scope, not treated as an unbound NameRef.
+  EXPECT_TRUE(after.defined_names().empty());
+
+  auto after_recalc = after.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(after_recalc)) << after_recalc.error().message;
+  const Value a1_after = after.sheet(0).resolve_cell_value(0U, 0U);
+  ASSERT_TRUE(a1_after.is_number());
+  EXPECT_EQ(a1_after.as_number(), 11.0);
+}
+TEST(XlsbWriteReadSymmetry, SpillRefSurvivesRoundTrip) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(3)")));  // A1, spills to A1:A3
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=SUM(A1#)")));     // B1
+  auto before_recalc = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(before_recalc)) << before_recalc.error().message;
+  const Value b1_before = wb.sheet(0).resolve_cell_value(0U, 1U);
+  ASSERT_TRUE(b1_before.is_number());
+  ASSERT_EQ(b1_before.as_number(), 6.0);
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  Workbook after = std::move(reloaded.value().workbook);
+
+  auto after_recalc = after.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(after_recalc)) << after_recalc.error().message;
+  const Value b1_after = after.sheet(0).resolve_cell_value(0U, 1U);
+  ASSERT_TRUE(b1_after.is_number());
+  EXPECT_EQ(b1_after.as_number(), 6.0);
+}
+TEST(XlsbWriteReadSymmetry, NamesSharingTextAcrossScopesKeepTheirOwnOrdinals) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$A$1", -1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$B$1", 0)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Bar", "Sheet1!$C$1", -1)));
+  // Route the edits through the workbook so the dep graph sees them.
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0))));  // A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::number(20.0))));  // B1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 2U, Value::number(30.0))));  // C1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 3U, "=Bar+1")));           // D1
+  auto before_recalc = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(before_recalc)) << before_recalc.error().message;
+  const Value d1_before = wb.sheet(0).resolve_cell_value(0U, 3U);
+  ASSERT_TRUE(d1_before.is_number()) << d1_before.debug_to_string();
+  ASSERT_EQ(d1_before.as_number(), 31.0);
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  Workbook after = std::move(reloaded.value().workbook);
+
+  // All three names survive, in declaration order, with their scopes.
+  const std::vector<DefinedName>& names = after.defined_names();
+  ASSERT_EQ(names.size(), 3U);
+  EXPECT_EQ(names[0].name, "Foo");
+  EXPECT_EQ(names[0].formula, "Sheet1!$A$1");
+  EXPECT_EQ(names[0].local_sheet_id, -1);
+  EXPECT_EQ(names[1].name, "Foo");
+  EXPECT_EQ(names[1].formula, "Sheet1!$B$1");
+  EXPECT_EQ(names[1].local_sheet_id, 0);
+  EXPECT_EQ(names[2].name, "Bar");
+  EXPECT_EQ(names[2].formula, "Sheet1!$C$1");
+  EXPECT_EQ(names[2].local_sheet_id, -1);
+
+  // The referencing formula still names `Bar`, and recalculating it on
+  // the reloaded workbook lands on C1 + 1 rather than on whatever name
+  // ordinal 2 would otherwise have become.
+  const Cell* d1 = after.sheet(0).cell_at(0U, 3U);
+  ASSERT_NE(d1, nullptr);
+  EXPECT_EQ(d1->formula_text, "=Bar+1");
+  auto after_recalc = after.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(after_recalc)) << after_recalc.error().message;
+  const Value d1_after = after.sheet(0).resolve_cell_value(0U, 3U);
+  ASSERT_TRUE(d1_after.is_number());
+  EXPECT_EQ(d1_after.as_number(), d1_before.as_number());
+}
+TEST(XlsbWriteReadSymmetry, UnqualifiedNameEncodesTheOrdinalOfTheScopeExcelResolves) {
+  RunScopeResolutionCase(/*local_first=*/false);
+}
+TEST(XlsbWriteReadSymmetry, UnqualifiedNameScopeIgnoresDeclarationOrder) {
+  RunScopeResolutionCase(/*local_first=*/true);
+}
+TEST(XlsbWriteReadSymmetry, SheetQualifiedNameKeepsItsScope) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.add_sheet("Sheet2");
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Local", "Sheet2!$A$1", 1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(4.0))));   // Sheet2!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Sheet2!Local*2")));  // Sheet1!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=ISERROR(Local)")));  // Sheet1!B1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 1U, "=Local+1")));         // Sheet2!B1
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
+  Workbook after = std::move(reloaded.value().workbook);
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Sheet2!Local*2");
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 1U)->formula_text, "=ISERROR(Local)");
+  EXPECT_EQ(after.sheet(1).cell_at(0U, 1U)->formula_text, "=Local+1");
+
+  auto recalc_or = after.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(recalc_or)) << recalc_or.error().message;
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 8.0);
+  EXPECT_TRUE(after.sheet(0).resolve_cell_value(0U, 1U).as_boolean());
+  EXPECT_EQ(after.sheet(1).resolve_cell_value(0U, 1U).as_number(), 5.0);
+}
+TEST(XlsbWriteReadSymmetry, SheetQualifiedLocalBodyScopeRoundTrips) {
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.add_sheet("Sheet2");
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Inner", "1")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Inner", "100", 1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Outer", "Inner+1", 1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Sheet2!Outer")));  // Sheet1!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=Inner")));         // Sheet1!B1
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
+  Workbook after = std::move(reloaded.value().workbook);
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Sheet2!Outer");
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 1U)->formula_text, "=Inner");
+
+  auto recalc_or = after.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(recalc_or)) << recalc_or.error().message;
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 101.0);
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 1U).as_number(), 1.0);
+}
+TEST(XlsbWriteReadSymmetry, ExcelSheetQualifiedLocalNameFixture) {
+  const std::vector<std::uint8_t> bytes = test::read_file_bytes(FixturePath("sheet_qualified_local_name.xlsb"));
+  ASSERT_FALSE(bytes.empty());
+  auto loaded = io::xlsb::read_xlsb(test::span_of(bytes));
+  ASSERT_TRUE(static_cast<bool>(loaded)) << "read_xlsb failed: " << loaded.error().message;
+  EXPECT_EQ(loaded.value().undecoded_formula_count, 0U);
+  Workbook wb = std::move(loaded.value().workbook);
+  ASSERT_EQ(wb.sheet_count(), 2U);
+  EXPECT_EQ(wb.sheet(0).cell_at(0U, 0U)->formula_text, "=Sheet2!Local");
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  EXPECT_EQ(wb.sheet(0).resolve_cell_value(0U, 0U).as_number(), 20.0);
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  std::string sheet1;
+  ASSERT_TRUE(test::extract_part(test::span_of(saved.value()), "xl/worksheets/sheet1.bin", &sheet1));
+  // Value-class PtgNameX, ixti 1 (after Local's own Sheet2 entry), ilbl 1:
+  // the fixture's own bytes.
+  const std::string name_x("\x59\x01\x00\x01\x00\x00\x00", 7);
+  EXPECT_NE(sheet1.find(name_x), std::string::npos);
+
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
+  Workbook after = std::move(reloaded.value().workbook);
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Sheet2!Local");
+  ASSERT_TRUE(static_cast<bool>(after.recalc(eval::default_registry())));
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 20.0);
+}
+TEST(XlsbWriteReadSymmetry, ExcelLambdaNameFixture) {
+  const std::vector<std::uint8_t> bytes = test::read_file_bytes(FixturePath("lambda_name.xlsb"));
+  ASSERT_FALSE(bytes.empty());
+  auto loaded = io::xlsb::read_xlsb(test::span_of(bytes));
+  ASSERT_TRUE(static_cast<bool>(loaded)) << "read_xlsb failed: " << loaded.error().message;
+  EXPECT_EQ(loaded.value().undecoded_formula_count, 0U);
+  Workbook wb = std::move(loaded.value().workbook);
+
+  const auto expect_workbook = [](Workbook& book) {
+    const Sheet& sheet = book.sheet(0);
+    EXPECT_EQ(sheet.cell_at(0U, 0U)->formula_text, "=Fn(3)");
+    EXPECT_EQ(sheet.cell_at(0U, 1U)->formula_text, "=Plus(1,2)");
+    EXPECT_EQ(sheet.cell_at(0U, 3U)->formula_text, "=LET(f,LAMBDA(y,y+1),f(2))");
+    EXPECT_EQ(sheet.cell_at(0U, 4U)->formula_text, "=LAMBDA(z,z*z)(4)");
+    ASSERT_EQ(book.defined_names().size(), 3U);
+    EXPECT_EQ(book.defined_names()[0].name, "Fn");
+    EXPECT_EQ(book.defined_names()[0].formula, "LAMBDA(x,x*2)");
+    EXPECT_EQ(book.defined_names()[2].formula, "LAMBDA(a,b,a+b)");
+    ASSERT_TRUE(static_cast<bool>(book.recalc(eval::default_registry())));
+    const double expected[] = {6.0, 3.0, 5.0, 3.0, 16.0};
+    for (std::uint32_t col = 0; col < 5U; ++col) {
+      const Value v = book.sheet(0).resolve_cell_value(0U, col);
+      ASSERT_TRUE(v.is_number()) << "col=" << col;
+      EXPECT_EQ(v.as_number(), expected[col]) << "col=" << col;
+    }
+  };
+  expect_workbook(wb);
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  std::string workbook_bin;
+  ASSERT_TRUE(test::extract_part(test::span_of(saved.value()), "xl/workbook.bin", &workbook_bin));
+  // BrtName for Fn: flags 0x10 (fCalcExp), chKey 0, workbook scope, "Fn".
+  const std::string fn_header("\x10\x00\x00\x00\x00\xff\xff\xff\xff\x02\x00\x00\x00\x46\x00\x6e\x00", 17);
+  EXPECT_NE(workbook_bin.find(fn_header), std::string::npos);
+  std::string sheet1;
+  ASSERT_TRUE(test::extract_part(test::span_of(saved.value()), "xl/worksheets/sheet1.bin", &sheet1));
+  // A1: PtgName(Fn, ilbl 1), PtgInt 3, PtgFuncVar(cparams 2, iftab 255).
+  const std::string fn_call("\x23\x01\x00\x00\x00\x1e\x03\x00\x42\x02\xff\x00", 12);
+  EXPECT_NE(sheet1.find(fn_call), std::string::npos);
+
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
+  Workbook after = std::move(reloaded.value().workbook);
+  expect_workbook(after);
+}
+TEST(XlsbWriteReadSymmetry, LambdaNamesAndCallsRoundTrip) {
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Twice", "LAMBDA(x,x*2)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Local", "LAMBDA(x,Twice(x)+Sheet2!$A$1)", 1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(100.0))));  // Sheet2!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Twice(3)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=Sheet2!Local(1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=LAMBDA(a,LAMBDA(b,a-b))(10)(4)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 3U, "=LET(sq,LAMBDA(n,n*n),sq(5)+Twice(1))")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 1U, 0U, "=Local(2)")));  // Sheet2!A2
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
+  Workbook after = std::move(reloaded.value().workbook);
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Twice(3)");
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 1U)->formula_text, "=Sheet2!Local(1)");
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 2U)->formula_text, "=LAMBDA(a,LAMBDA(b,a-b))(10)(4)");
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 3U)->formula_text, "=LET(sq,LAMBDA(n,n*n),sq(5)+Twice(1))");
+  EXPECT_EQ(after.sheet(1).cell_at(1U, 0U)->formula_text, "=Local(2)");
+  ASSERT_EQ(after.defined_names().size(), 2U);
+  EXPECT_EQ(after.defined_names()[1].formula, "LAMBDA(x,Twice(x)+Sheet2!$A$1)");
+  EXPECT_EQ(after.defined_names()[1].local_sheet_id, 1);
+
+  ASSERT_TRUE(static_cast<bool>(after.recalc(eval::default_registry())));
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 6.0);
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 1U).as_number(), 102.0);
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 2U).as_number(), 6.0);
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 3U).as_number(), 27.0);
+  EXPECT_EQ(after.sheet(1).resolve_cell_value(1U, 0U).as_number(), 104.0);
+}
+TEST(XlsbWriteReadSymmetry, CallToAnotherSheetsLocalLambdaStaysUnresolved) {
+  // Fn exists only as Sheet2's local name, so `Fn(3)` on Sheet1 is #NAME?;
+  // the encode must not borrow Sheet2's record, which would read back as a
+  // resolvable `Sheet2!Fn(3)`.
+  Workbook wb = Workbook::create();
+  wb.add_sheet("Sheet2");
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Fn", "LAMBDA(x,x*2)", 1)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Fn(3)")));
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  Workbook after = std::move(reloaded.value().workbook);
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Fn(3)");
+  ASSERT_TRUE(static_cast<bool>(after.recalc(eval::default_registry())));
+  const Value v = after.sheet(0).resolve_cell_value(0U, 0U);
+  ASSERT_TRUE(v.is_error());
+  EXPECT_EQ(v.as_error(), ErrorCode::Name);
+}
+TEST(XlsbWriteReadSymmetry, ExcelSelfBookNameFixtures) {
+  auto from_xlsx = io::read_ooxml(test::span_of(test::read_file_bytes(FixturePath("self_book_name.xlsx"))));
+  ASSERT_TRUE(static_cast<bool>(from_xlsx)) << from_xlsx.error().message;
+  auto from_xlsb = io::xlsb::read_xlsb(test::span_of(test::read_file_bytes(FixturePath("self_book_name.xlsb"))));
+  ASSERT_TRUE(static_cast<bool>(from_xlsb)) << from_xlsb.error().message;
+  EXPECT_EQ(from_xlsb.value().undecoded_formula_count, 0U);
+  Workbook xlsx = std::move(from_xlsx.value().workbook);
+  Workbook xlsb = std::move(from_xlsb.value().workbook);
+  ExpectSelfBookFixture(xlsx, "xlsx");
+  ExpectSelfBookFixture(xlsb, "xlsb");
+
+  for (Workbook* source : {&xlsx, &xlsb}) {
+    auto saved_xlsb = io::xlsb::write_xlsb(*source);
+    ASSERT_TRUE(static_cast<bool>(saved_xlsb)) << saved_xlsb.error().message;
+    auto reread_xlsb = io::xlsb::read_xlsb(test::span_of(saved_xlsb.value()));
+    ASSERT_TRUE(static_cast<bool>(reread_xlsb)) << reread_xlsb.error().message;
+    EXPECT_EQ(reread_xlsb.value().undecoded_formula_count, 0U);
+    ExpectSelfBookFixture(reread_xlsb.value().workbook, "xlsb round trip");
+
+    auto saved_xlsx = io::write_ooxml(*source);
+    ASSERT_TRUE(static_cast<bool>(saved_xlsx)) << saved_xlsx.error().message;
+    auto reread_xlsx = io::read_ooxml(test::span_of(saved_xlsx.value()));
+    ASSERT_TRUE(static_cast<bool>(reread_xlsx)) << reread_xlsx.error().message;
+    ExpectSelfBookFixture(reread_xlsx.value().workbook, "xlsx round trip");
+  }
+}
+TEST(XlsbWriteReadSymmetry, SheetQualifiedWorkbookNameReadsBackAsSelfBook) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("G", "5")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Sheet1!G")));
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << saved.error().message;
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << reloaded.error().message;
+  Workbook after = std::move(reloaded.value().workbook);
+  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=[0]!G");
+  ASSERT_TRUE(static_cast<bool>(after.recalc(eval::default_registry())));
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 5.0);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb_roundtrip_numeric_layout_test.cpp b/tests/unit/io/xlsb_roundtrip_numeric_layout_test.cpp
new file mode 100644
index 000000000..8ae589ee8
--- /dev/null
+++ b/tests/unit/io/xlsb_roundtrip_numeric_layout_test.cpp
@@ -0,0 +1,307 @@
+// Cross-format XLSB/OOXML symmetry tests.
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <cstring>
+#include <iterator>
+#include <limits>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "eval/function_registry.h"
+#include "eval/recalc_engine.h"
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "io/xlsb/reader.h"
+#include "io/xlsb/record.h"
+#include "io/xlsb/record_writer.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "sheet.h"
+#include "styles.h"
+#include "support/roundtrip_symmetry.h"
+#include "value.h"
+#include "xlsb_roundtrip_symmetry_test_helpers.h"
+
+namespace formulon {
+namespace {
+using namespace xlsb_roundtrip_test_support;
+TEST(XlsbRkEncoding, PredicateOnlyAcceptsValuesWhoseEncodingDecodesToTheSameBits) {
+  std::uint64_t state = 0x9E3779B97F4A7C15ULL;  // any fixed seed; the sweep must be reproducible
+  auto next = [&state]() {
+    state = state * 6364136223846793005ULL + 1442695040888963407ULL;
+    return state;
+  };
+  int accepted = 0;
+  for (int i = 0; i < 20000; ++i) {
+    // Currency-shaped magnitudes (cents over a 30-bit range), their two
+    // immediate neighbours -- where multiplying by 100 rounds back onto
+    // the exact cent count and the x100 form therefore looks applicable
+    // while decoding to a different double -- and a spread of arbitrary
+    // bit patterns.
+    const double cents = static_cast<double>(static_cast<std::int64_t>(next() % 1000000000ULL) - 500000000);
+    const double base = cents / 100.0;
+    const double candidates[] = {base, std::nextafter(base, std::numeric_limits<double>::infinity()),
+                                 std::nextafter(base, -std::numeric_limits<double>::infinity()), cents / 3.0, cents};
+    for (const double v : candidates) {
+      if (!io::xlsb::rk_round_trips_value(v)) {
+        continue;
+      }
+      ++accepted;
+      std::vector<std::uint8_t> bytes;
+      io::xlsb::emit_rk_number(bytes, v);
+      ASSERT_EQ(bytes.size(), 4U);
+      const std::uint32_t rk = static_cast<std::uint32_t>(bytes[0]) | (static_cast<std::uint32_t>(bytes[1]) << 8) |
+                               (static_cast<std::uint32_t>(bytes[2]) << 16) |
+                               (static_cast<std::uint32_t>(bytes[3]) << 24);
+      EXPECT_EQ(BitsOf(io::xlsb::decode_rk_number(rk)), BitsOf(v)) << "value=" << v;
+    }
+  }
+  EXPECT_GT(accepted, 0) << "sweep never exercised the accepting branch";
+}
+TEST(XlsbWriteReadSymmetry, XlsxToXlsbToXlsxPreservesNumericBitPatterns) {
+  const double kValues[] = {3611469.5700000003, -4123191.7399999998};
+  for (const double v : kValues) {
+    EXPECT_FALSE(io::xlsb::rk_round_trips_value(v)) << "value=" << v;
+  }
+
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  for (std::size_t i = 0; i < std::size(kValues); ++i) {
+    wb.sheet(0).set_cell_value(static_cast<std::uint32_t>(i), 0U, Value::number(kValues[i]));
+  }
+
+  auto xlsx_in = io::write_ooxml(wb);
+  ASSERT_TRUE(static_cast<bool>(xlsx_in)) << "write_ooxml failed: " << xlsx_in.error().message;
+  auto from_xlsx = io::read_ooxml(test::span_of(xlsx_in.value()));
+  ASSERT_TRUE(static_cast<bool>(from_xlsx)) << "read_ooxml failed: " << from_xlsx.error().message;
+
+  auto xlsb = io::xlsb::write_xlsb(from_xlsx.value().workbook);
+  ASSERT_TRUE(static_cast<bool>(xlsb)) << "write_xlsb failed: " << xlsb.error().message;
+  auto from_xlsb = io::xlsb::read_xlsb(test::span_of(xlsb.value()));
+  ASSERT_TRUE(static_cast<bool>(from_xlsb)) << "read_xlsb failed: " << from_xlsb.error().message;
+
+  auto xlsx_out = io::write_ooxml(from_xlsb.value().workbook);
+  ASSERT_TRUE(static_cast<bool>(xlsx_out)) << "write_ooxml failed: " << xlsx_out.error().message;
+  auto final_wb = io::read_ooxml(test::span_of(xlsx_out.value()));
+  ASSERT_TRUE(static_cast<bool>(final_wb)) << "read_ooxml failed: " << final_wb.error().message;
+
+  const Sheet& s = final_wb.value().workbook.sheet(0);
+  for (std::size_t i = 0; i < std::size(kValues); ++i) {
+    const Cell* c = s.cell_at(static_cast<std::uint32_t>(i), 0U);
+    ASSERT_NE(c, nullptr) << "row " << i;
+    ASSERT_TRUE(c->cached_value.is_number()) << "row " << i;
+    EXPECT_EQ(BitsOf(c->cached_value.as_number()), BitsOf(kValues[i])) << "row " << i;
+  }
+}
+TEST(XlsbWriteReadSymmetry, RowOverridesSurviveBothFormatsAlike) {
+  Workbook source = Workbook::create_empty();
+  source.add_sheet("Sheet1");
+  // A cell keeps the rows from being dropped as empty, and each override
+  // engages a different `BrtRowHdr` flag: a custom height (fUnsynced), the
+  // hidden bit, and an outline level.
+  source.sheet(0).set_cell_value(0U, 0U, Value::number(1.0));
+  source.sheet(0).set_cell_value(4U, 0U, Value::number(2.0));
+  RowLayout tall;
+  tall.row = 0U;
+  tall.height = 33.75;
+  tall.has_height = true;
+  tall.custom_height = true;
+  RowLayout hidden;
+  hidden.row = 2U;
+  hidden.hidden = true;
+  RowLayout grouped;
+  grouped.row = 4U;
+  grouped.outline_level = 2U;
+  source.sheet(0).mutable_layout().row_overrides = {tall, hidden, grouped};
+
+  Workbook via_xlsb = Workbook::create_empty();
+  Workbook via_xlsx = Workbook::create_empty();
+  ASSERT_TRUE(ThroughXlsb(source, &via_xlsb));
+  ASSERT_TRUE(ThroughXlsx(source, &via_xlsx));
+
+  const std::vector<RowLayout>& rb = via_xlsb.sheet(0).layout().row_overrides;
+  const std::vector<RowLayout>& rx = via_xlsx.sheet(0).layout().row_overrides;
+  ASSERT_EQ(rb.size(), 3U) << "the xlsb path lost a row override";
+  ASSERT_EQ(rx.size(), 3U) << "the xlsx path lost a row override";
+  for (std::size_t i = 0; i < rb.size(); ++i) {
+    SCOPED_TRACE("row override " + std::to_string(i));
+    EXPECT_EQ(rb[i].row, rx[i].row);
+    EXPECT_EQ(rb[i].has_height, rx[i].has_height);
+    EXPECT_EQ(rb[i].custom_height, rx[i].custom_height);
+    // `miyRw` is twips, so a height survives to 1/20 of a point.
+    EXPECT_NEAR(rb[i].height, rx[i].height, 1.0 / 20.0);
+    EXPECT_EQ(rb[i].hidden, rx[i].hidden);
+    EXPECT_EQ(rb[i].outline_level, rx[i].outline_level);
+  }
+  // The values themselves, not just their agreement: two equally broken
+  // paths would satisfy the comparison above on their own.
+  EXPECT_TRUE(rb[0].has_height);
+  EXPECT_NEAR(rb[0].height, 33.75, 1.0 / 20.0);
+  EXPECT_TRUE(rb[1].hidden);
+  EXPECT_EQ(rb[2].outline_level, 2U);
+}
+TEST(XlsbWriteReadSymmetry, BorderRecordContentsSurviveBothFormatsAlike) {
+  Workbook source = Workbook::create_empty();
+  source.add_sheet("Sheet1");
+  source.sheet(0).set_cell_value(0U, 0U, Value::number(1.0));
+
+  StylesTable styles;
+  styles.fonts.push_back(FontRecord{});
+  styles.fills.push_back(FillRecord{});
+  styles.borders.push_back(BorderRecord{});
+  BorderRecord boxed;
+  boxed.left.style = 1U;  // thin
+  boxed.left.color.kind = ColorSpec::Kind::kRgb;
+  boxed.left.color.rgb = 0xFF0000FFU;
+  boxed.left.color_argb = 0xFF0000FFU;
+  boxed.bottom.style = 2U;  // medium
+  boxed.bottom.color.kind = ColorSpec::Kind::kRgb;
+  boxed.bottom.color.rgb = 0xFFFF0000U;
+  boxed.bottom.color_argb = 0xFFFF0000U;
+  boxed.diagonal.style = 3U;  // dashed
+  boxed.diagonal.color.kind = ColorSpec::Kind::kRgb;
+  boxed.diagonal.color.rgb = 0xFF00FF00U;
+  boxed.diagonal.color_argb = 0xFF00FF00U;
+  boxed.diagonal_up = true;
+  styles.borders.push_back(boxed);
+  CellXf plain;
+  CellXf bordered;
+  bordered.border_index = 1U;
+  bordered.apply_border = true;
+  styles.cell_xfs = {plain, bordered};
+  source.set_styles(std::move(styles));
+  ASSERT_TRUE(static_cast<bool>(source.set_cell_xf_index(0U, 0U, 0U, 1U)));
+
+  Workbook via_xlsb = Workbook::create_empty();
+  Workbook via_xlsx = Workbook::create_empty();
+  ASSERT_TRUE(ThroughXlsb(source, &via_xlsb));
+  ASSERT_TRUE(ThroughXlsx(source, &via_xlsx));
+
+  const std::vector<BorderRecord>& bb = via_xlsb.styles().borders;
+  const std::vector<BorderRecord>& bx = via_xlsx.styles().borders;
+  ASSERT_GT(bb.size(), 1U) << "the xlsb path lost the non-default border";
+  ASSERT_GT(bx.size(), 1U) << "the xlsx path lost the non-default border";
+  ASSERT_EQ(bb.size(), bx.size());
+  for (std::size_t i = 0; i < bb.size(); ++i) {
+    SCOPED_TRACE("border index " + std::to_string(i));
+    const BorderRecord& b = bb[i];
+    const BorderRecord& x = bx[i];
+    EXPECT_EQ(b.diagonal_up, x.diagonal_up);
+    EXPECT_EQ(b.diagonal_down, x.diagonal_down);
+    const BorderSide* b_sides[] = {&b.left, &b.right, &b.top, &b.bottom, &b.diagonal};
+    const BorderSide* x_sides[] = {&x.left, &x.right, &x.top, &x.bottom, &x.diagonal};
+    const char* names[] = {"left", "right", "top", "bottom", "diagonal"};
+    for (std::size_t side = 0; side < std::size(b_sides); ++side) {
+      SCOPED_TRACE(names[side]);
+      EXPECT_EQ(b_sides[side]->style, x_sides[side]->style);
+      ExpectColorSpecEqual(b_sides[side]->color, x_sides[side]->color);
+    }
+  }
+  // The styles, not merely their agreement: the authored record has to come
+  // back with the three sides it declared.
+  EXPECT_EQ(bb[1].left.style, 1U);
+  EXPECT_EQ(bb[1].bottom.style, 2U);
+  EXPECT_EQ(bb[1].diagonal.style, 3U);
+  EXPECT_TRUE(bb[1].diagonal_up);
+}
+TEST(XlsbWriteReadSymmetry, AlignmentAndApplyFlagsSurviveBothFormatsAlike) {
+  Workbook source = Workbook::create_empty();
+  source.add_sheet("Sheet1");
+  source.sheet(0).set_cell_value(0U, 0U, Value::number(1.0));
+
+  StylesTable styles;
+  styles.fonts.push_back(FontRecord{});
+  styles.fills.push_back(FillRecord{});
+  styles.borders.push_back(BorderRecord{});
+  CellXf plain;
+  CellXf decorated;
+  decorated.horizontal_align = 2U;  // center
+  decorated.vertical_align = 0U;    // top -- not the schema default
+  decorated.wrap_text = true;
+  decorated.justify_last_line = true;
+  decorated.shrink_to_fit = true;
+  decorated.has_shrink_to_fit = true;
+  decorated.reading_order = 2U;  // right-to-left
+  decorated.has_reading_order = true;
+  decorated.text_rotation = 45U;
+  decorated.has_text_rotation = true;
+  decorated.indent = 3U;
+  decorated.has_indent = true;
+  decorated.quote_prefix = true;
+  decorated.has_protection = true;
+  decorated.locked = false;
+  decorated.hidden = true;
+  decorated.apply_number_format = true;
+  decorated.apply_font = true;
+  decorated.apply_fill = true;
+  decorated.apply_border = true;
+  decorated.apply_alignment = true;
+  decorated.apply_protection = true;
+  styles.cell_xfs = {plain, decorated};
+  source.set_styles(std::move(styles));
+  ASSERT_TRUE(static_cast<bool>(source.set_cell_xf_index(0U, 0U, 0U, 1U)));
+
+  Workbook via_xlsb = Workbook::create_empty();
+  Workbook via_xlsx = Workbook::create_empty();
+  ASSERT_TRUE(ThroughXlsb(source, &via_xlsb));
+  ASSERT_TRUE(ThroughXlsx(source, &via_xlsx));
+
+  const std::vector<CellXf>& xb = via_xlsb.styles().cell_xfs;
+  const std::vector<CellXf>& xx = via_xlsx.styles().cell_xfs;
+  ASSERT_GT(xb.size(), 1U) << "the xlsb path lost the decorated xf";
+  ASSERT_GT(xx.size(), 1U) << "the xlsx path lost the decorated xf";
+  ASSERT_EQ(xb.size(), xx.size());
+  for (std::size_t i = 0; i < xb.size(); ++i) {
+    SCOPED_TRACE("cellXf index " + std::to_string(i));
+    const CellXf& b = xb[i];
+    const CellXf& x = xx[i];
+    EXPECT_EQ(b.horizontal_align, x.horizontal_align);
+    EXPECT_EQ(b.vertical_align, x.vertical_align);
+    EXPECT_EQ(b.wrap_text, x.wrap_text);
+    EXPECT_EQ(b.justify_last_line, x.justify_last_line);
+    EXPECT_EQ(b.shrink_to_fit, x.shrink_to_fit);
+    EXPECT_EQ(b.reading_order, x.reading_order);
+    EXPECT_EQ(b.text_rotation, x.text_rotation);
+    EXPECT_EQ(b.indent, x.indent);
+    EXPECT_EQ(b.quote_prefix, x.quote_prefix);
+    EXPECT_EQ(b.has_protection, x.has_protection);
+    EXPECT_EQ(b.locked, x.locked);
+    EXPECT_EQ(b.hidden, x.hidden);
+    EXPECT_EQ(b.apply_number_format, x.apply_number_format);
+    EXPECT_EQ(b.apply_font, x.apply_font);
+    EXPECT_EQ(b.apply_fill, x.apply_fill);
+    EXPECT_EQ(b.apply_border, x.apply_border);
+    EXPECT_EQ(b.apply_alignment, x.apply_alignment);
+    EXPECT_EQ(b.apply_protection, x.apply_protection);
+  }
+  // The authored values themselves: two equally lossy paths would satisfy
+  // the comparison above on their own.
+  const CellXf& b = xb[1];
+  EXPECT_EQ(b.horizontal_align, 2U);
+  EXPECT_EQ(b.vertical_align, 0U);
+  EXPECT_TRUE(b.wrap_text);
+  EXPECT_TRUE(b.justify_last_line);
+  EXPECT_TRUE(b.shrink_to_fit);
+  EXPECT_EQ(b.reading_order, 2U);
+  EXPECT_EQ(b.text_rotation, 45U);
+  EXPECT_EQ(b.indent, 3U);
+  EXPECT_TRUE(b.quote_prefix);
+  EXPECT_TRUE(b.has_protection);
+  EXPECT_FALSE(b.locked);
+  EXPECT_TRUE(b.hidden);
+  EXPECT_TRUE(b.apply_number_format);
+  EXPECT_TRUE(b.apply_font);
+  EXPECT_TRUE(b.apply_fill);
+  EXPECT_TRUE(b.apply_border);
+  EXPECT_TRUE(b.apply_alignment);
+  EXPECT_TRUE(b.apply_protection);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/io/xlsb_roundtrip_symmetry_test.cpp b/tests/unit/io/xlsb_roundtrip_symmetry_test.cpp
index 305e587f5..76457d10c 100644
--- a/tests/unit/io/xlsb_roundtrip_symmetry_test.cpp
+++ b/tests/unit/io/xlsb_roundtrip_symmetry_test.cpp
@@ -1,18 +1,4 @@
-//
-// Cross-format read symmetry for the binary XLSB path.
-//
-// `tests/unit/io/xlsb_fidelity_test.cpp` (bind-a) already checks the `.xlsb`
-// reader against literal expected values and covers the `write_xlsb ->
-// read_xlsb` round-trip for formula text and cell values. This file adds the
-// complementary angle that no existing test covers: the SAME real workbook,
-// authored once by Excel and exported to both `.xlsb` and `.xlsx`, must yield
-// an equivalent in-memory model regardless of which reader parsed it. A
-// format-specific reader divergence (a record the XLSB reader drops but the
-// OOXML reader keeps, or vice versa) surfaces as a model mismatch here even
-// when each reader passes its own literal-expectation fidelity suite.
-//
-// XLSB is a binary record stream, so the pugixml attribute-set helpers do not
-// apply; the comparison is at the `Workbook` model level.
+// Cross-format XLSB/OOXML symmetry tests.
 
 #include <algorithm>
 #include <cmath>
@@ -40,40 +26,11 @@
 #include "styles.h"
 #include "support/roundtrip_symmetry.h"
 #include "value.h"
-#include "workbook.h"
-
-#ifndef FORMULON_FIXTURES_DIR
-#error "FORMULON_FIXTURES_DIR must be defined by the build"
-#endif
+#include "xlsb_roundtrip_symmetry_test_helpers.h"
 
 namespace formulon {
 namespace {
-
-std::string FixturePath(const char* name) {
-  return std::string(FORMULON_FIXTURES_DIR) + "/excel/" + name;
-}
-
-// Reads the shared fixture from both formats. Returns false (with a gtest
-// failure) if either read fails; otherwise fills the two out-workbooks.
-::testing::AssertionResult LoadBothFormats(Workbook* xlsb_out, Workbook* xlsx_out) {
-  const std::vector<std::uint8_t> xlsb_bytes = test::read_file_bytes(FixturePath("xlsb_fidelity_base.xlsb"));
-  const std::vector<std::uint8_t> xlsx_bytes = test::read_file_bytes(FixturePath("xlsb_fidelity_base.xlsx"));
-  if (xlsb_bytes.empty() || xlsx_bytes.empty()) {
-    return ::testing::AssertionFailure() << "fixture bytes empty";
-  }
-  auto xb = io::xlsb::read_xlsb(test::span_of(xlsb_bytes));
-  if (!xb) {
-    return ::testing::AssertionFailure() << "read_xlsb failed: " << xb.error().message;
-  }
-  auto xx = io::read_ooxml(test::span_of(xlsx_bytes));
-  if (!xx) {
-    return ::testing::AssertionFailure() << "read_ooxml failed: " << xx.error().message;
-  }
-  *xlsb_out = std::move(xb.value().workbook);
-  *xlsx_out = std::move(xx.value().workbook);
-  return ::testing::AssertionSuccess();
-}
-
+using namespace xlsb_roundtrip_test_support;
 TEST(XlsbCrossFormatSymmetry, SheetStructureMatches) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -83,7 +40,6 @@ TEST(XlsbCrossFormatSymmetry, SheetStructureMatches) {
     EXPECT_EQ(xlsb.sheet(i).name(), xlsx.sheet(i).name()) << "sheet index " << i;
   }
 }
-
 TEST(XlsbCrossFormatSymmetry, DataSheetValuesMatch) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -109,7 +65,6 @@ TEST(XlsbCrossFormatSymmetry, DataSheetValuesMatch) {
     EXPECT_DOUBLE_EQ(bb->cached_value.as_number(), bx->cached_value.as_number()) << "B" << (r + 1);
   }
 }
-
 TEST(XlsbCrossFormatSymmetry, FormulaTextMatches) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -123,7 +78,6 @@ TEST(XlsbCrossFormatSymmetry, FormulaTextMatches) {
   EXPECT_EQ(fb->formula_text, fx->formula_text);
   EXPECT_FALSE(fb->formula_text.empty());
 }
-
 TEST(XlsbCrossFormatSymmetry, StyleIndexMatches) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -138,40 +92,6 @@ TEST(XlsbCrossFormatSymmetry, StyleIndexMatches) {
   EXPECT_EQ(db->xf_index, dx->xf_index);
   EXPECT_NE(db->xf_index, 0U) << "D3 should carry a non-default style";
 }
-
-// An equal xf index says the two readers agree on which slot a cell points
-// at, not on what that slot contains: styles.bin and styles.xml are decoded
-// by separate code paths into the same `StylesTable`, so a slot can carry a
-// different font, fill or number format on each side while every index still
-// matches. The comparisons below are on the record contents, which is where
-// a binary-decode defect actually lands.
-
-/// Compares the two colour selectors a `ColorSpec` can carry.
-///
-/// The selector kind is the part a format conversion is most likely to lose:
-/// XLSB packs automatic / indexed / rgb / theme into one flags nibble, while
-/// OOXML spells each as its own `<color>` attribute. `color_argb` is only a
-/// compatibility fallback for the non-RGB selectors, so it is compared
-/// through the spec rather than on its own.
-void ExpectColorSpecEqual(const ColorSpec& xlsb, const ColorSpec& xlsx) {
-  ASSERT_EQ(static_cast<int>(xlsb.kind), static_cast<int>(xlsx.kind));
-  switch (xlsb.kind) {
-    case ColorSpec::Kind::kRgb:
-      EXPECT_EQ(xlsb.rgb, xlsx.rgb);
-      break;
-    case ColorSpec::Kind::kTheme:
-      EXPECT_EQ(xlsb.theme, xlsx.theme);
-      EXPECT_NEAR(xlsb.tint, xlsx.tint, 1e-9);
-      break;
-    case ColorSpec::Kind::kIndexed:
-      EXPECT_EQ(xlsb.indexed, xlsx.indexed);
-      break;
-    case ColorSpec::Kind::kNone:
-    case ColorSpec::Kind::kAuto:
-      break;
-  }
-}
-
 TEST(XlsbCrossFormatSymmetry, FontRecordContentsMatch) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -211,7 +131,6 @@ TEST(XlsbCrossFormatSymmetry, FontRecordContentsMatch) {
     ExpectColorSpecEqual(fb[i].color, fx[i].color);
   }
 }
-
 TEST(XlsbCrossFormatSymmetry, FillRecordContentsMatch) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -238,7 +157,6 @@ TEST(XlsbCrossFormatSymmetry, FillRecordContentsMatch) {
     ExpectColorSpecEqual(fb[i].bg, fx[i].bg);
   }
 }
-
 TEST(XlsbCrossFormatSymmetry, CellXfRecordContentsMatch) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -316,38 +234,6 @@ TEST(XlsbCrossFormatSymmetry, CellXfRecordContentsMatch) {
     EXPECT_EQ(HasJustifyLastLine(b), HasJustifyLastLine(x));
   }
 }
-
-/// Returns the `<cellXfs>` element of `package`'s `xl/styles.xml`, or an
-/// empty string when the part or the element is missing.
-std::string CellXfsBlockOfSavedPackage(const std::vector<std::uint8_t>& package) {
-  std::string styles;
-  if (!test::extract_part(test::span_of(package), "xl/styles.xml", &styles)) {
-    return std::string();
-  }
-  const std::size_t begin = styles.find("<cellXfs");
-  const std::size_t end = styles.find("</cellXfs>");
-  if (begin == std::string::npos || end == std::string::npos || end < begin) {
-    return std::string();
-  }
-  return styles.substr(begin, end - begin + std::strlen("</cellXfs>"));
-}
-
-/// Counts non-overlapping occurrences of `needle` in `haystack`.
-std::size_t CountOccurrences(const std::string& haystack, const std::string& needle) {
-  std::size_t count = 0;
-  for (std::size_t pos = haystack.find(needle); pos != std::string::npos; pos = haystack.find(needle, pos + 1)) {
-    ++count;
-  }
-  return count;
-}
-
-// The in-memory table is only half the claim: an `.xlsx` save serialises the
-// model, never the retained `xl/styles.bin` bytes, so what a host or another
-// spreadsheet application sees after a conversion is whatever reached
-// `xl/styles.xml`. Asserting on the saved part -- and against the same part
-// produced from the workbook's own `.xlsx` export, which is the identical
-// writer on an identical model -- is what states that a `.xlsb` source loses
-// nothing on the way out.
 TEST(XlsbToOoxmlStyles, AlignmentAndApplyFlagsReachTheSavedStylesPart) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -370,12 +256,6 @@ TEST(XlsbToOoxmlStyles, AlignmentAndApplyFlagsReachTheSavedStylesPart) {
   EXPECT_EQ(CountOccurrences(xlsb_block, "applyFill=\"1\""), 1U) << xlsb_block;
   EXPECT_EQ(xlsb_block, xlsx_block);
 }
-
-// A custom number format is stored as an id plus an interned string, so an
-// equal `num_fmt_id` on both sides still leaves the format code itself
-// unchecked: the two readers intern into their own `num_fmt_strings`
-// vectors, and only resolving the id back to its string compares what a
-// cell would actually render with.
 TEST(XlsbCrossFormatSymmetry, CustomNumberFormatCodesMatch) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -397,11 +277,6 @@ TEST(XlsbCrossFormatSymmetry, CustomNumberFormatCodesMatch) {
   ASSERT_FALSE(x.empty()) << "fixture declares no custom number format";
   EXPECT_EQ(b, x);
 }
-
-// `<cols>` and `BrtColInfo` describe the same span from different encodings
-// (character widths versus 1/256 of a standard digit), so an entry that
-// survives one reader can arrive with a shifted width or a lost outline
-// level from the other.
 TEST(XlsbCrossFormatSymmetry, ColumnLayoutMatches) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -424,7 +299,6 @@ TEST(XlsbCrossFormatSymmetry, ColumnLayoutMatches) {
     EXPECT_NEAR(cb[i].width, cx[i].width, 1.0 / 256.0);
   }
 }
-
 TEST(XlsbCrossFormatSymmetry, DefinedNamesMatch) {
   Workbook xlsb = Workbook::create_empty();
   Workbook xlsx = Workbook::create_empty();
@@ -445,964 +319,5 @@ TEST(XlsbCrossFormatSymmetry, DefinedNamesMatch) {
   }
 }
 
-// Resolves the numFmtId for cell (row, col) through `wb`'s style table, or
-// SIZE_MAX-style 0xFFFFFFFF when the cell's xf index dangles past the table
-// (which is exactly the failure mode a bare index-equality check would miss).
-std::uint32_t ResolvedNumFmtId(const Workbook& wb, std::uint32_t row, std::uint32_t col) {
-  const Cell* c = wb.sheet(0).cell_at(row, col);
-  if (c == nullptr) {
-    return 0xFFFFFFFFU;
-  }
-  const StylesTable& st = wb.styles();
-  if (c->xf_index >= st.cell_xfs.size()) {
-    return 0xFFFFFFFFU;  // dangling index -> style table did not round-trip
-  }
-  return st.cell_xfs[c->xf_index].num_fmt_id;
-}
-
-// Regression for the writer defect the cross-format check surfaced. Two halves,
-// both required for a styled cell to survive `write_xlsb -> read_xlsb`:
-//   1. the cell header must carry the 24-bit iStyleRef (was hardcoded to 0);
-//   2. the workbook must declare the styles relationship so the reader can find
-//      the (passthrough) styles.bin -- otherwise the index dangles against an
-//      empty table.
-// Asserting the *resolved* numFmtId (not just index equality) exercises both:
-// D1 = yyyy/mm/dd (custom 179), D2 = #,##0.00 (built-in 4), D5 = 0.0% (custom
-// 180). D3 keeps its non-default font xf.
-TEST(XlsbWriteReadSymmetry, CellStyleAndNumberFormatSurviveRoundTrip) {
-  const std::vector<std::uint8_t> bytes = test::read_file_bytes(FixturePath("xlsb_fidelity_base.xlsb"));
-  ASSERT_FALSE(bytes.empty());
-  auto loaded = io::xlsb::read_xlsb(test::span_of(bytes));
-  ASSERT_TRUE(static_cast<bool>(loaded)) << "read_xlsb failed: " << loaded.error().message;
-  const Workbook& before = loaded.value().workbook;
-
-  // Baseline: the fixture resolves the expected number formats.
-  ASSERT_EQ(ResolvedNumFmtId(before, 0, 3), 179U);  // D1 yyyy/mm/dd
-  ASSERT_EQ(ResolvedNumFmtId(before, 1, 3), 4U);    // D2 #,##0.00
-  ASSERT_EQ(ResolvedNumFmtId(before, 4, 3), 180U);  // D5 0.0%
-  const Cell* d3_before = before.sheet(0).cell_at(2, 3);
-  ASSERT_NE(d3_before, nullptr);
-  ASSERT_NE(d3_before->xf_index, 0U) << "fixture D3 should carry a non-default style";
-
-  auto saved = io::xlsb::write_xlsb(before);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "reload failed: " << reloaded.error().message;
-  const Workbook& after = reloaded.value().workbook;
-
-  // Number formats still resolve after the round-trip (index + style table).
-  EXPECT_EQ(ResolvedNumFmtId(after, 0, 3), 179U);
-  EXPECT_EQ(ResolvedNumFmtId(after, 1, 3), 4U);
-  EXPECT_EQ(ResolvedNumFmtId(after, 4, 3), 180U);
-  // D3's font style index is preserved.
-  const Cell* d3_after = after.sheet(0).cell_at(2, 3);
-  ASSERT_NE(d3_after, nullptr);
-  EXPECT_EQ(d3_after->xf_index, d3_before->xf_index);
-}
-
-// LET/LAMBDA parameter names resolve case-insensitively at eval time, so a
-// reference spelled in a different case than its binding (`X` referencing a
-// `LET(x, ...)` binding) must still be recognised as in-scope by the writer
-// and encoded via its `_xlpm.` placeholder -- not registered as a free
-// workbook-level defined name, which real Excel cannot resolve the same way.
-TEST(XlsbWriteReadSymmetry, LetParameterReferencedInDifferentCaseKeepsItsBinding) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=LET(x,10,X+1)")));  // A1
-  auto before_recalc = wb.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(before_recalc)) << before_recalc.error().message;
-  const Value a1_before = wb.sheet(0).resolve_cell_value(0U, 0U);
-  ASSERT_TRUE(a1_before.is_number());
-  ASSERT_EQ(a1_before.as_number(), 11.0);
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  Workbook after = std::move(reloaded.value().workbook);
-
-  // No free defined name was invented for `X`: the parameter reference was
-  // recognised as in-scope, not treated as an unbound NameRef.
-  EXPECT_TRUE(after.defined_names().empty());
-
-  auto after_recalc = after.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(after_recalc)) << after_recalc.error().message;
-  const Value a1_after = after.sheet(0).resolve_cell_value(0U, 0U);
-  ASSERT_TRUE(a1_after.is_number());
-  EXPECT_EQ(a1_after.as_number(), 11.0);
-}
-
-// A formula referencing another cell's spill (`A1#`) must survive an XLSB
-// save: the writer previously aborted the whole save with "SpillRef" listed
-// as an unsupported AST node kind.
-TEST(XlsbWriteReadSymmetry, SpillRefSurvivesRoundTrip) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=SEQUENCE(3)")));  // A1, spills to A1:A3
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=SUM(A1#)")));     // B1
-  auto before_recalc = wb.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(before_recalc)) << before_recalc.error().message;
-  const Value b1_before = wb.sheet(0).resolve_cell_value(0U, 1U);
-  ASSERT_TRUE(b1_before.is_number());
-  ASSERT_EQ(b1_before.as_number(), 6.0);
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  Workbook after = std::move(reloaded.value().workbook);
-
-  auto after_recalc = after.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(after_recalc)) << after_recalc.error().message;
-  const Value b1_after = after.sheet(0).resolve_cell_value(0U, 1U);
-  ASSERT_TRUE(b1_after.is_number());
-  EXPECT_EQ(b1_after.as_number(), 6.0);
-}
-
-// A workbook-scoped name and a sheet-local name may spell the same text
-// (`Workbook::set_defined_name_scoped` admits the pair), and each needs
-// its own `BrtName` record: the `ilbl` a cell's `PtgName` carries is a
-// 1-based ordinal into the emitted record sequence, so collapsing the
-// pair into one record shifts every later name's ordinal and silently
-// re-points the referencing formulas at a different name.
-TEST(XlsbWriteReadSymmetry, NamesSharingTextAcrossScopesKeepTheirOwnOrdinals) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$A$1", -1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$B$1", 0)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Bar", "Sheet1!$C$1", -1)));
-  // Route the edits through the workbook so the dep graph sees them.
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0))));  // A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::number(20.0))));  // B1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 2U, Value::number(30.0))));  // C1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 3U, "=Bar+1")));           // D1
-  auto before_recalc = wb.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(before_recalc)) << before_recalc.error().message;
-  const Value d1_before = wb.sheet(0).resolve_cell_value(0U, 3U);
-  ASSERT_TRUE(d1_before.is_number()) << d1_before.debug_to_string();
-  ASSERT_EQ(d1_before.as_number(), 31.0);
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  Workbook after = std::move(reloaded.value().workbook);
-
-  // All three names survive, in declaration order, with their scopes.
-  const std::vector<DefinedName>& names = after.defined_names();
-  ASSERT_EQ(names.size(), 3U);
-  EXPECT_EQ(names[0].name, "Foo");
-  EXPECT_EQ(names[0].formula, "Sheet1!$A$1");
-  EXPECT_EQ(names[0].local_sheet_id, -1);
-  EXPECT_EQ(names[1].name, "Foo");
-  EXPECT_EQ(names[1].formula, "Sheet1!$B$1");
-  EXPECT_EQ(names[1].local_sheet_id, 0);
-  EXPECT_EQ(names[2].name, "Bar");
-  EXPECT_EQ(names[2].formula, "Sheet1!$C$1");
-  EXPECT_EQ(names[2].local_sheet_id, -1);
-
-  // The referencing formula still names `Bar`, and recalculating it on
-  // the reloaded workbook lands on C1 + 1 rather than on whatever name
-  // ordinal 2 would otherwise have become.
-  const Cell* d1 = after.sheet(0).cell_at(0U, 3U);
-  ASSERT_NE(d1, nullptr);
-  EXPECT_EQ(d1->formula_text, "=Bar+1");
-  auto after_recalc = after.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(after_recalc)) << after_recalc.error().message;
-  const Value d1_after = after.sheet(0).resolve_cell_value(0U, 3U);
-  ASSERT_TRUE(d1_after.is_number());
-  EXPECT_EQ(d1_after.as_number(), d1_before.as_number());
-}
-
-// Wire-level view of one `BrtName` record: the name text plus the scope
-// it declares (`itab`, `-1` for workbook scope).
-struct WireName {
-  std::string name;
-  std::int32_t itab = -1;
-};
-
-// Decodes `xl/workbook.bin`'s `BrtName` records in emission order, so
-// entry `i` is what a `PtgName` with `ilbl == i + 1` reaches.
-std::vector<WireName> ReadWireNames(const std::vector<std::uint8_t>& workbook_bin) {
-  std::vector<WireName> out;
-  io::ByteSpan cursor = test::span_of(workbook_bin);
-  while (cursor.size > 0U) {
-    auto rec_or = io::xlsb::read_record(cursor);
-    if (!rec_or) {
-      return out;
-    }
-    if (rec_or.value().type != static_cast<std::uint16_t>(io::xlsb::XlsbRecordType::BrtName)) {
-      continue;
-    }
-    // BrtName: grbit (u32) + chKey (u8) + itab (i32) + the name string.
-    io::ByteSpan p = rec_or.value().payload;
-    auto grbit = io::xlsb::read_u32(p);
-    auto ch_key = io::xlsb::read_u8(p);
-    auto itab = io::xlsb::read_u32(p);
-    if (!grbit || !ch_key || !itab) {
-      return out;
-    }
-    auto name = io::xlsb::read_xlwidestring(p);
-    if (!name) {
-      return out;
-    }
-    out.push_back(WireName{name.value(), static_cast<std::int32_t>(itab.value())});
-  }
-  return out;
-}
-
-// Returns the `ilbl` encoded by the lone `PtgName` token of the formula
-// stored at row 0 / `col` of `sheet_bin`, or 0 when the cell is absent
-// or its token stream is not a single bare name reference.
-std::uint32_t IlblOfNameOnlyFormula(const std::vector<std::uint8_t>& sheet_bin, std::uint32_t col) {
-  io::ByteSpan cursor = test::span_of(sheet_bin);
-  while (cursor.size > 0U) {
-    auto rec_or = io::xlsb::read_record(cursor);
-    if (!rec_or) {
-      return 0U;
-    }
-    // A name formula is entered as a dynamic-array formula, whose tokens a
-    // `BrtArrFmla` carries: rwFirst, rwLast, colFirst, colLast (u32 each),
-    // a flag byte, then cce + rgce.
-    if (rec_or.value().type == static_cast<std::uint16_t>(io::xlsb::XlsbRecordType::BrtArrFmla)) {
-      io::ByteSpan p = rec_or.value().payload;
-      if (p.size < 26U || p.data[8] != col || p.data[17] != 5U || p.data[21] != 0x43U) {
-        continue;
-      }
-      p.data += 22U;
-      p.size -= 22U;
-      auto ilbl = io::xlsb::read_u32(p);
-      return ilbl ? ilbl.value() : 0U;
-    }
-    if (rec_or.value().type != static_cast<std::uint16_t>(io::xlsb::XlsbRecordType::BrtFmlaNum)) {
-      continue;
-    }
-    // BrtFmlaNum: cell header (col u32 + iStyleRef 3B + fPhShow u8),
-    // the cached double, grbitFlags (u16), then the CellParsedFormula
-    // (cce + rgce + cb + rgcb).
-    io::ByteSpan p = rec_or.value().payload;
-    auto cell_col = io::xlsb::read_u32(p);
-    if (!cell_col || cell_col.value() != col) {
-      continue;
-    }
-    if (p.size < 14U) {
-      return 0U;
-    }
-    p.data += 4U + 8U + 2U;  // iStyleRef + fPhShow, cached value, grbitFlags
-    p.size -= 4U + 8U + 2U;
-    auto cce = io::xlsb::read_u32(p);
-    if (cce && p.size > 0U && p.data[0] == 0x01U) {
-      continue;  // PtgExp: the tokens follow in the cell's BrtArrFmla.
-    }
-    // `=Foo` lowers to exactly one value-class PtgName: opcode 0x43 + a u32 ilbl.
-    if (!cce || cce.value() != 5U || p.size < 5U || p.data[0] != 0x43U) {
-      return 0U;
-    }
-    p.data += 1U;
-    p.size -= 1U;
-    auto ilbl = io::xlsb::read_u32(p);
-    return ilbl ? ilbl.value() : 0U;
-  }
-  return 0U;
-}
-
-// Builds the workbook both scope-resolution cases share: a
-// workbook-scoped `Foo` (Sheet1!A1 = 10) and a Sheet1-local `Foo`
-// (Sheet1!B1 = 20), with `=Foo` on both sheets. `local_first` flips the
-// declaration order of the two names, which is the tie-break a
-// text-keyed name table falls back on.
-void RunScopeResolutionCase(bool local_first) {
-  SCOPED_TRACE(local_first ? "sheet-local Foo declared first" : "workbook-scoped Foo declared first");
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  wb.add_sheet("Sheet2");
-  if (local_first) {
-    ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$B$1", 0)));
-    ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$A$1", -1)));
-  } else {
-    ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$A$1", -1)));
-    ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$B$1", 0)));
-  }
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0))));  // Sheet1!A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::number(20.0))));  // Sheet1!B1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 3U, "=Foo")));             // Sheet1!D1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 3U, "=Foo")));             // Sheet2!D1
-  auto recalc_or = wb.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(recalc_or)) << recalc_or.error().message;
-  // The engine's own resolution is the reference the encoding has to
-  // agree with: Sheet1 sees the local `Foo` (B1), Sheet2 the global one.
-  ASSERT_EQ(wb.sheet(0).resolve_cell_value(0U, 3U).as_number(), 20.0);
-  ASSERT_EQ(wb.sheet(1).resolve_cell_value(0U, 3U).as_number(), 10.0);
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  io::ZipReader zip;
-  ASSERT_TRUE(static_cast<bool>(zip.open(test::span_of(saved.value()))));
-  auto workbook_bin = zip.read_entry("xl/workbook.bin");
-  auto sheet1_bin = zip.read_entry("xl/worksheets/sheet1.bin");
-  auto sheet2_bin = zip.read_entry("xl/worksheets/sheet2.bin");
-  ASSERT_TRUE(static_cast<bool>(workbook_bin));
-  ASSERT_TRUE(static_cast<bool>(sheet1_bin));
-  ASSERT_TRUE(static_cast<bool>(sheet2_bin));
-
-  const std::vector<WireName> wire_names = ReadWireNames(workbook_bin.value());
-  ASSERT_EQ(wire_names.size(), 2U);
-
-  const std::uint32_t sheet1_ilbl = IlblOfNameOnlyFormula(sheet1_bin.value(), 3U);
-  const std::uint32_t sheet2_ilbl = IlblOfNameOnlyFormula(sheet2_bin.value(), 3U);
-  ASSERT_GE(sheet1_ilbl, 1U);
-  ASSERT_LE(sheet1_ilbl, wire_names.size());
-  ASSERT_GE(sheet2_ilbl, 1U);
-  ASSERT_LE(sheet2_ilbl, wire_names.size());
-
-  // Sheet1's reference must land on the record scoped to Sheet1.
-  EXPECT_EQ(wire_names[sheet1_ilbl - 1U].name, "Foo");
-  EXPECT_EQ(wire_names[sheet1_ilbl - 1U].itab, 0) << "Sheet1 must resolve the sheet-local Foo";
-  // Sheet2 has no local override, so it must land on the workbook one.
-  EXPECT_EQ(wire_names[sheet2_ilbl - 1U].name, "Foo");
-  EXPECT_EQ(wire_names[sheet2_ilbl - 1U].itab, -1) << "Sheet2 must resolve the workbook-scoped Foo";
-
-  // The values the round trip produces are unchanged either way (the
-  // reader re-resolves by name text), so they are a guard against the
-  // scope fix disturbing them, not the detector for it.
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  Workbook after = std::move(reloaded.value().workbook);
-  auto after_recalc = after.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(after_recalc)) << after_recalc.error().message;
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 3U).as_number(), 20.0);
-  EXPECT_EQ(after.sheet(1).resolve_cell_value(0U, 3U).as_number(), 10.0);
-}
-
-// A `PtgName` token is a bare ordinal into the `BrtName` table -- it
-// carries no scope -- so the writer, not the consumer, decides which of
-// two same-named records a formula reaches. Excel resolves an
-// unqualified name from the sheet the formula sits on: a sheet-local
-// name shadows the workbook-scoped one there, and the workbook-scoped
-// one is reached only from sheets that have no local override. Encoding
-// one workbook-wide ordinal per name text silently re-points the
-// reference on whichever side loses the tie-break, so both declaration
-// orders are exercised: each one makes a different clause of the rule
-// the one that fails. No count-based check sees this -- both records are
-// emitted either way -- so the assertion has to be which record the
-// ordinal lands on.
-TEST(XlsbWriteReadSymmetry, UnqualifiedNameEncodesTheOrdinalOfTheScopeExcelResolves) {
-  RunScopeResolutionCase(/*local_first=*/false);
-}
-
-TEST(XlsbWriteReadSymmetry, UnqualifiedNameScopeIgnoresDeclarationOrder) {
-  RunScopeResolutionCase(/*local_first=*/true);
-}
-
-// `Sheet2!Local` from Sheet1 encodes the ordinal of Sheet2's own record and
-// reads back as the same qualified text. An unqualified `Local` on Sheet1,
-// which Excel resolves to #NAME? because the only definition is Sheet2's,
-// must not borrow that record: it would then read back as `Sheet2!Local`.
-TEST(XlsbWriteReadSymmetry, SheetQualifiedNameKeepsItsScope) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  wb.add_sheet("Sheet2");
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Local", "Sheet2!$A$1", 1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(4.0))));   // Sheet2!A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Sheet2!Local*2")));  // Sheet1!A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=ISERROR(Local)")));  // Sheet1!B1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 1U, "=Local+1")));         // Sheet2!B1
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
-  Workbook after = std::move(reloaded.value().workbook);
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Sheet2!Local*2");
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 1U)->formula_text, "=ISERROR(Local)");
-  EXPECT_EQ(after.sheet(1).cell_at(0U, 1U)->formula_text, "=Local+1");
-
-  auto recalc_or = after.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(recalc_or)) << recalc_or.error().message;
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 8.0);
-  EXPECT_TRUE(after.sheet(0).resolve_cell_value(0U, 1U).as_boolean());
-  EXPECT_EQ(after.sheet(1).resolve_cell_value(0U, 1U).as_number(), 5.0);
-}
-
-// A local name whose body binds its unqualified names in the owning sheet
-// survives a save and reload with its qualifier and value.
-TEST(XlsbWriteReadSymmetry, SheetQualifiedLocalBodyScopeRoundTrips) {
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  wb.add_sheet("Sheet2");
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Inner", "1")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Inner", "100", 1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Outer", "Inner+1", 1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Sheet2!Outer")));  // Sheet1!A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=Inner")));         // Sheet1!B1
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
-  Workbook after = std::move(reloaded.value().workbook);
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Sheet2!Outer");
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 1U)->formula_text, "=Inner");
-
-  auto recalc_or = after.recalc(eval::default_registry());
-  ASSERT_TRUE(static_cast<bool>(recalc_or)) << recalc_or.error().message;
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 101.0);
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 1U).as_number(), 1.0);
-}
-
-// Excel-saved workbook (Mac Excel 365 16.113.2): Sheet1!A1 = `=Sheet2!Local`
-// with the Sheet2-local name Local = Sheet2!$A$1*10 and Sheet2!A1 = 2.
-// Excel stores the reference as `PtgNameX` through a sheetless ExternSheet
-// entry, which the writer reproduces on save.
-TEST(XlsbWriteReadSymmetry, ExcelSheetQualifiedLocalNameFixture) {
-  const std::vector<std::uint8_t> bytes = test::read_file_bytes(FixturePath("sheet_qualified_local_name.xlsb"));
-  ASSERT_FALSE(bytes.empty());
-  auto loaded = io::xlsb::read_xlsb(test::span_of(bytes));
-  ASSERT_TRUE(static_cast<bool>(loaded)) << "read_xlsb failed: " << loaded.error().message;
-  EXPECT_EQ(loaded.value().undecoded_formula_count, 0U);
-  Workbook wb = std::move(loaded.value().workbook);
-  ASSERT_EQ(wb.sheet_count(), 2U);
-  EXPECT_EQ(wb.sheet(0).cell_at(0U, 0U)->formula_text, "=Sheet2!Local");
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
-  EXPECT_EQ(wb.sheet(0).resolve_cell_value(0U, 0U).as_number(), 20.0);
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  std::string sheet1;
-  ASSERT_TRUE(test::extract_part(test::span_of(saved.value()), "xl/worksheets/sheet1.bin", &sheet1));
-  // Value-class PtgNameX, ixti 1 (after Local's own Sheet2 entry), ilbl 1:
-  // the fixture's own bytes.
-  const std::string name_x("\x59\x01\x00\x01\x00\x00\x00", 7);
-  EXPECT_NE(sheet1.find(name_x), std::string::npos);
-
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
-  Workbook after = std::move(reloaded.value().workbook);
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Sheet2!Local");
-  ASSERT_TRUE(static_cast<bool>(after.recalc(eval::default_registry())));
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 20.0);
-}
-
-// Excel-saved workbook (Mac Excel 365): Fn = LAMBDA(x,x*2), G = 5 and
-// Plus = LAMBDA(a,b,a+b); Sheet1!A1:E1 = Fn(3), Plus(1,2), Sheet1!G,
-// LET(f,LAMBDA(y,y+1),f(2)) and LAMBDA(z,z*z)(4). Excel stores a LAMBDA as
-// PtgName(_xlfn.LAMBDA), one PtgName(_xlpm.<param>) per parameter, the body
-// and PtgFuncVar(255); a named or inline LAMBDA call is the callee operand,
-// the arguments and PtgFuncVar(255); a LAMBDA-valued name sets fCalcExp.
-TEST(XlsbWriteReadSymmetry, ExcelLambdaNameFixture) {
-  const std::vector<std::uint8_t> bytes = test::read_file_bytes(FixturePath("lambda_name.xlsb"));
-  ASSERT_FALSE(bytes.empty());
-  auto loaded = io::xlsb::read_xlsb(test::span_of(bytes));
-  ASSERT_TRUE(static_cast<bool>(loaded)) << "read_xlsb failed: " << loaded.error().message;
-  EXPECT_EQ(loaded.value().undecoded_formula_count, 0U);
-  Workbook wb = std::move(loaded.value().workbook);
-
-  const auto expect_workbook = [](Workbook& book) {
-    const Sheet& sheet = book.sheet(0);
-    EXPECT_EQ(sheet.cell_at(0U, 0U)->formula_text, "=Fn(3)");
-    EXPECT_EQ(sheet.cell_at(0U, 1U)->formula_text, "=Plus(1,2)");
-    EXPECT_EQ(sheet.cell_at(0U, 3U)->formula_text, "=LET(f,LAMBDA(y,y+1),f(2))");
-    EXPECT_EQ(sheet.cell_at(0U, 4U)->formula_text, "=LAMBDA(z,z*z)(4)");
-    ASSERT_EQ(book.defined_names().size(), 3U);
-    EXPECT_EQ(book.defined_names()[0].name, "Fn");
-    EXPECT_EQ(book.defined_names()[0].formula, "LAMBDA(x,x*2)");
-    EXPECT_EQ(book.defined_names()[2].formula, "LAMBDA(a,b,a+b)");
-    ASSERT_TRUE(static_cast<bool>(book.recalc(eval::default_registry())));
-    const double expected[] = {6.0, 3.0, 5.0, 3.0, 16.0};
-    for (std::uint32_t col = 0; col < 5U; ++col) {
-      const Value v = book.sheet(0).resolve_cell_value(0U, col);
-      ASSERT_TRUE(v.is_number()) << "col=" << col;
-      EXPECT_EQ(v.as_number(), expected[col]) << "col=" << col;
-    }
-  };
-  expect_workbook(wb);
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  std::string workbook_bin;
-  ASSERT_TRUE(test::extract_part(test::span_of(saved.value()), "xl/workbook.bin", &workbook_bin));
-  // BrtName for Fn: flags 0x10 (fCalcExp), chKey 0, workbook scope, "Fn".
-  const std::string fn_header("\x10\x00\x00\x00\x00\xff\xff\xff\xff\x02\x00\x00\x00\x46\x00\x6e\x00", 17);
-  EXPECT_NE(workbook_bin.find(fn_header), std::string::npos);
-  std::string sheet1;
-  ASSERT_TRUE(test::extract_part(test::span_of(saved.value()), "xl/worksheets/sheet1.bin", &sheet1));
-  // A1: PtgName(Fn, ilbl 1), PtgInt 3, PtgFuncVar(cparams 2, iftab 255).
-  const std::string fn_call("\x23\x01\x00\x00\x00\x1e\x03\x00\x42\x02\xff\x00", 12);
-  EXPECT_NE(sheet1.find(fn_call), std::string::npos);
-
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
-  Workbook after = std::move(reloaded.value().workbook);
-  expect_workbook(after);
-}
-
-TEST(XlsbWriteReadSymmetry, LambdaNamesAndCallsRoundTrip) {
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("Twice", "LAMBDA(x,x*2)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Local", "LAMBDA(x,Twice(x)+Sheet2!$A$1)", 1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(1U, 0U, 0U, Value::number(100.0))));  // Sheet2!A1
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Twice(3)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=Sheet2!Local(1)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=LAMBDA(a,LAMBDA(b,a-b))(10)(4)")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 3U, "=LET(sq,LAMBDA(n,n*n),sq(5)+Twice(1))")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 1U, 0U, "=Local(2)")));  // Sheet2!A2
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  EXPECT_EQ(reloaded.value().undecoded_formula_count, 0U);
-  Workbook after = std::move(reloaded.value().workbook);
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Twice(3)");
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 1U)->formula_text, "=Sheet2!Local(1)");
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 2U)->formula_text, "=LAMBDA(a,LAMBDA(b,a-b))(10)(4)");
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 3U)->formula_text, "=LET(sq,LAMBDA(n,n*n),sq(5)+Twice(1))");
-  EXPECT_EQ(after.sheet(1).cell_at(1U, 0U)->formula_text, "=Local(2)");
-  ASSERT_EQ(after.defined_names().size(), 2U);
-  EXPECT_EQ(after.defined_names()[1].formula, "LAMBDA(x,Twice(x)+Sheet2!$A$1)");
-  EXPECT_EQ(after.defined_names()[1].local_sheet_id, 1);
-
-  ASSERT_TRUE(static_cast<bool>(after.recalc(eval::default_registry())));
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 6.0);
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 1U).as_number(), 102.0);
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 2U).as_number(), 6.0);
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 3U).as_number(), 27.0);
-  EXPECT_EQ(after.sheet(1).resolve_cell_value(1U, 0U).as_number(), 104.0);
-}
-
-TEST(XlsbWriteReadSymmetry, CallToAnotherSheetsLocalLambdaStaysUnresolved) {
-  // Fn exists only as Sheet2's local name, so `Fn(3)` on Sheet1 is #NAME?;
-  // the encode must not borrow Sheet2's record, which would read back as a
-  // resolvable `Sheet2!Fn(3)`.
-  Workbook wb = Workbook::create();
-  wb.add_sheet("Sheet2");
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Fn", "LAMBDA(x,x*2)", 1)));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Fn(3)")));
-
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
-  Workbook after = std::move(reloaded.value().workbook);
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=Fn(3)");
-  ASSERT_TRUE(static_cast<bool>(after.recalc(eval::default_registry())));
-  const Value v = after.sheet(0).resolve_cell_value(0U, 0U);
-  ASSERT_TRUE(v.is_error());
-  EXPECT_EQ(v.as_error(), ErrorCode::Name);
-}
-
-// Excel-saved workbook (Mac Excel 365): workbook names G = 5,
-// Fn = LAMBDA(x,x*2) and Rng = Sheet1!$A$10:$A$11, Sheet1-local G = 100 and
-// Loc = 7. Excel stores the `Book!Name` spelling as `[0]!Name` in .xlsx and
-// as PtgNameX through the sheetless ExternSheet entry in .xlsb; the values
-// below are what Excel shows.
-void ExpectSelfBookFixture(Workbook& wb, const char* label) {
-  const Sheet& s1 = wb.sheet(0);
-  const Sheet& s2 = wb.sheet(1);
-  EXPECT_EQ(s1.cell_at(0U, 2U)->formula_text, "=[0]!Fn(3)") << label;
-  EXPECT_EQ(s1.cell_at(0U, 3U)->formula_text, "=SUM([0]!Rng)") << label;
-  EXPECT_EQ(s2.cell_at(0U, 0U)->formula_text, "=[0]!G") << label;
-  EXPECT_EQ(s2.cell_at(0U, 2U)->formula_text, "=ROWS([0]!Rng)") << label;
-  EXPECT_EQ(s2.cell_at(0U, 3U)->formula_text, "=Sheet1!A10:[0]!Rng") << label;
-  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry()))) << label;
-  const double sheet1[] = {100.0, 100.0, 6.0, 7.0, 100.0};
-  for (std::uint32_t col = 0; col < 5U; ++col) {
-    const Value v = wb.sheet(0).resolve_cell_value(0U, col);
-    ASSERT_TRUE(v.is_number()) << label << " Sheet1 col=" << col;
-    EXPECT_EQ(v.as_number(), sheet1[col]) << label << " Sheet1 col=" << col;
-  }
-  const double sheet2[] = {5.0, 5.0, 2.0, 3.0};
-  for (std::uint32_t col = 0; col < 4U; ++col) {
-    const Value v = wb.sheet(1).resolve_cell_value(0U, col);
-    ASSERT_TRUE(v.is_number()) << label << " Sheet2 col=" << col;
-    EXPECT_EQ(v.as_number(), sheet2[col]) << label << " Sheet2 col=" << col;
-  }
-  EXPECT_EQ(wb.sheet(1).resolve_cell_value(1U, 3U).as_number(), 4.0) << label << " Sheet2!D2 spill";
-}
-
-TEST(XlsbWriteReadSymmetry, ExcelSelfBookNameFixtures) {
-  auto from_xlsx = io::read_ooxml(test::span_of(test::read_file_bytes(FixturePath("self_book_name.xlsx"))));
-  ASSERT_TRUE(static_cast<bool>(from_xlsx)) << from_xlsx.error().message;
-  auto from_xlsb = io::xlsb::read_xlsb(test::span_of(test::read_file_bytes(FixturePath("self_book_name.xlsb"))));
-  ASSERT_TRUE(static_cast<bool>(from_xlsb)) << from_xlsb.error().message;
-  EXPECT_EQ(from_xlsb.value().undecoded_formula_count, 0U);
-  Workbook xlsx = std::move(from_xlsx.value().workbook);
-  Workbook xlsb = std::move(from_xlsb.value().workbook);
-  ExpectSelfBookFixture(xlsx, "xlsx");
-  ExpectSelfBookFixture(xlsb, "xlsb");
-
-  for (Workbook* source : {&xlsx, &xlsb}) {
-    auto saved_xlsb = io::xlsb::write_xlsb(*source);
-    ASSERT_TRUE(static_cast<bool>(saved_xlsb)) << saved_xlsb.error().message;
-    auto reread_xlsb = io::xlsb::read_xlsb(test::span_of(saved_xlsb.value()));
-    ASSERT_TRUE(static_cast<bool>(reread_xlsb)) << reread_xlsb.error().message;
-    EXPECT_EQ(reread_xlsb.value().undecoded_formula_count, 0U);
-    ExpectSelfBookFixture(reread_xlsb.value().workbook, "xlsb round trip");
-
-    auto saved_xlsx = io::write_ooxml(*source);
-    ASSERT_TRUE(static_cast<bool>(saved_xlsx)) << saved_xlsx.error().message;
-    auto reread_xlsx = io::read_ooxml(test::span_of(saved_xlsx.value()));
-    ASSERT_TRUE(static_cast<bool>(reread_xlsx)) << reread_xlsx.error().message;
-    ExpectSelfBookFixture(reread_xlsx.value().workbook, "xlsx round trip");
-  }
-}
-
-// Excel saves `Sheet1!G` where Sheet1 has no local G exactly as it saves
-// `[0]!G`, and reads it back as the self-book form.
-TEST(XlsbWriteReadSymmetry, SheetQualifiedWorkbookNameReadsBackAsSelfBook) {
-  Workbook wb = Workbook::create();
-  ASSERT_TRUE(static_cast<bool>(wb.set_defined_name("G", "5")));
-  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 0U, "=Sheet1!G")));
-  auto saved = io::xlsb::write_xlsb(wb);
-  ASSERT_TRUE(static_cast<bool>(saved)) << saved.error().message;
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  ASSERT_TRUE(static_cast<bool>(reloaded)) << reloaded.error().message;
-  Workbook after = std::move(reloaded.value().workbook);
-  EXPECT_EQ(after.sheet(0).cell_at(0U, 0U)->formula_text, "=[0]!G");
-  ASSERT_TRUE(static_cast<bool>(after.recalc(eval::default_registry())));
-  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 0U).as_number(), 5.0);
-}
-
-// Reinterprets `v`'s object representation so two doubles can be
-// compared for bit equality rather than numeric equality.
-std::uint64_t BitsOf(double v) {
-  std::uint64_t bits = 0;
-  std::memcpy(&bits, &v, sizeof(v));
-  return bits;
-}
-
-// The whole point of the predicate: a `true` answer is a promise that
-// `BrtCellRk` is lossless for that value. Sweep a deterministic spread
-// of finite doubles -- including the currency-shaped band where the
-// `x100` form is tempting and the multiplication rounds -- and hold the
-// implication for every one of them.
-TEST(XlsbRkEncoding, PredicateOnlyAcceptsValuesWhoseEncodingDecodesToTheSameBits) {
-  std::uint64_t state = 0x9E3779B97F4A7C15ULL;  // any fixed seed; the sweep must be reproducible
-  auto next = [&state]() {
-    state = state * 6364136223846793005ULL + 1442695040888963407ULL;
-    return state;
-  };
-  int accepted = 0;
-  for (int i = 0; i < 20000; ++i) {
-    // Currency-shaped magnitudes (cents over a 30-bit range), their two
-    // immediate neighbours -- where multiplying by 100 rounds back onto
-    // the exact cent count and the x100 form therefore looks applicable
-    // while decoding to a different double -- and a spread of arbitrary
-    // bit patterns.
-    const double cents = static_cast<double>(static_cast<std::int64_t>(next() % 1000000000ULL) - 500000000);
-    const double base = cents / 100.0;
-    const double candidates[] = {base, std::nextafter(base, std::numeric_limits<double>::infinity()),
-                                 std::nextafter(base, -std::numeric_limits<double>::infinity()), cents / 3.0, cents};
-    for (const double v : candidates) {
-      if (!io::xlsb::rk_round_trips_value(v)) {
-        continue;
-      }
-      ++accepted;
-      std::vector<std::uint8_t> bytes;
-      io::xlsb::emit_rk_number(bytes, v);
-      ASSERT_EQ(bytes.size(), 4U);
-      const std::uint32_t rk = static_cast<std::uint32_t>(bytes[0]) | (static_cast<std::uint32_t>(bytes[1]) << 8) |
-                               (static_cast<std::uint32_t>(bytes[2]) << 16) |
-                               (static_cast<std::uint32_t>(bytes[3]) << 24);
-      EXPECT_EQ(BitsOf(io::xlsb::decode_rk_number(rk)), BitsOf(v)) << "value=" << v;
-    }
-  }
-  EXPECT_GT(accepted, 0) << "sweep never exercised the accepting branch";
-}
-
-// Values whose `x * 100` product rounds to an integer are not RK-x100
-// encodable even though the product passes an integrality test: the
-// decode divides by 100 again and lands on a neighbouring double. The
-// cell writer must route them to `BrtCellReal`, so an `.xlsx -> .xlsb
-// -> .xlsx` conversion has to preserve the bit pattern exactly.
-TEST(XlsbWriteReadSymmetry, XlsxToXlsbToXlsxPreservesNumericBitPatterns) {
-  const double kValues[] = {3611469.5700000003, -4123191.7399999998};
-  for (const double v : kValues) {
-    EXPECT_FALSE(io::xlsb::rk_round_trips_value(v)) << "value=" << v;
-  }
-
-  Workbook wb = Workbook::create_empty();
-  wb.add_sheet("Sheet1");
-  for (std::size_t i = 0; i < std::size(kValues); ++i) {
-    wb.sheet(0).set_cell_value(static_cast<std::uint32_t>(i), 0U, Value::number(kValues[i]));
-  }
-
-  auto xlsx_in = io::write_ooxml(wb);
-  ASSERT_TRUE(static_cast<bool>(xlsx_in)) << "write_ooxml failed: " << xlsx_in.error().message;
-  auto from_xlsx = io::read_ooxml(test::span_of(xlsx_in.value()));
-  ASSERT_TRUE(static_cast<bool>(from_xlsx)) << "read_ooxml failed: " << from_xlsx.error().message;
-
-  auto xlsb = io::xlsb::write_xlsb(from_xlsx.value().workbook);
-  ASSERT_TRUE(static_cast<bool>(xlsb)) << "write_xlsb failed: " << xlsb.error().message;
-  auto from_xlsb = io::xlsb::read_xlsb(test::span_of(xlsb.value()));
-  ASSERT_TRUE(static_cast<bool>(from_xlsb)) << "read_xlsb failed: " << from_xlsb.error().message;
-
-  auto xlsx_out = io::write_ooxml(from_xlsb.value().workbook);
-  ASSERT_TRUE(static_cast<bool>(xlsx_out)) << "write_ooxml failed: " << xlsx_out.error().message;
-  auto final_wb = io::read_ooxml(test::span_of(xlsx_out.value()));
-  ASSERT_TRUE(static_cast<bool>(final_wb)) << "read_ooxml failed: " << final_wb.error().message;
-
-  const Sheet& s = final_wb.value().workbook.sheet(0);
-  for (std::size_t i = 0; i < std::size(kValues); ++i) {
-    const Cell* c = s.cell_at(static_cast<std::uint32_t>(i), 0U);
-    ASSERT_NE(c, nullptr) << "row " << i;
-    ASSERT_TRUE(c->cached_value.is_number()) << "row " << i;
-    EXPECT_EQ(BitsOf(c->cached_value.as_number()), BitsOf(kValues[i])) << "row " << i;
-  }
-}
-
-// The Excel-authored fixture leaves two model areas with no case of their
-// own: it has no custom row height, hidden row or outline level, and its one
-// `<border>` is the empty default. Neither can be compared across the two
-// readers on that source, so the property is pinned one step further out --
-// the same in-memory workbook through each format's writer and back -- which
-// still fails if either binary path drops the field.
-
-/// Saves `wb` as `.xlsb` and reads it back, or fails the test.
-::testing::AssertionResult ThroughXlsb(const Workbook& wb, Workbook* out) {
-  auto saved = io::xlsb::write_xlsb(wb);
-  if (!saved) {
-    return ::testing::AssertionFailure() << "write_xlsb failed: " << saved.error().message;
-  }
-  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
-  if (!reloaded) {
-    return ::testing::AssertionFailure() << "read_xlsb failed: " << reloaded.error().message;
-  }
-  *out = std::move(reloaded.value().workbook);
-  return ::testing::AssertionSuccess();
-}
-
-/// Saves `wb` as `.xlsx` and reads it back, or fails the test.
-::testing::AssertionResult ThroughXlsx(const Workbook& wb, Workbook* out) {
-  auto saved = io::write_ooxml(wb);
-  if (!saved) {
-    return ::testing::AssertionFailure() << "write_ooxml failed: " << saved.error().message;
-  }
-  auto reloaded = io::read_ooxml(test::span_of(saved.value()));
-  if (!reloaded) {
-    return ::testing::AssertionFailure() << "read_ooxml failed: " << reloaded.error().message;
-  }
-  *out = std::move(reloaded.value().workbook);
-  return ::testing::AssertionSuccess();
-}
-
-TEST(XlsbWriteReadSymmetry, RowOverridesSurviveBothFormatsAlike) {
-  Workbook source = Workbook::create_empty();
-  source.add_sheet("Sheet1");
-  // A cell keeps the rows from being dropped as empty, and each override
-  // engages a different `BrtRowHdr` flag: a custom height (fUnsynced), the
-  // hidden bit, and an outline level.
-  source.sheet(0).set_cell_value(0U, 0U, Value::number(1.0));
-  source.sheet(0).set_cell_value(4U, 0U, Value::number(2.0));
-  RowLayout tall;
-  tall.row = 0U;
-  tall.height = 33.75;
-  tall.has_height = true;
-  RowLayout hidden;
-  hidden.row = 2U;
-  hidden.hidden = true;
-  RowLayout grouped;
-  grouped.row = 4U;
-  grouped.outline_level = 2U;
-  source.sheet(0).mutable_layout().row_overrides = {tall, hidden, grouped};
-
-  Workbook via_xlsb = Workbook::create_empty();
-  Workbook via_xlsx = Workbook::create_empty();
-  ASSERT_TRUE(ThroughXlsb(source, &via_xlsb));
-  ASSERT_TRUE(ThroughXlsx(source, &via_xlsx));
-
-  const std::vector<RowLayout>& rb = via_xlsb.sheet(0).layout().row_overrides;
-  const std::vector<RowLayout>& rx = via_xlsx.sheet(0).layout().row_overrides;
-  ASSERT_EQ(rb.size(), 3U) << "the xlsb path lost a row override";
-  ASSERT_EQ(rx.size(), 3U) << "the xlsx path lost a row override";
-  for (std::size_t i = 0; i < rb.size(); ++i) {
-    SCOPED_TRACE("row override " + std::to_string(i));
-    EXPECT_EQ(rb[i].row, rx[i].row);
-    EXPECT_EQ(rb[i].has_height, rx[i].has_height);
-    // `miyRw` is twips, so a height survives to 1/20 of a point.
-    EXPECT_NEAR(rb[i].height, rx[i].height, 1.0 / 20.0);
-    EXPECT_EQ(rb[i].hidden, rx[i].hidden);
-    EXPECT_EQ(rb[i].outline_level, rx[i].outline_level);
-  }
-  // The values themselves, not just their agreement: two equally broken
-  // paths would satisfy the comparison above on their own.
-  EXPECT_TRUE(rb[0].has_height);
-  EXPECT_NEAR(rb[0].height, 33.75, 1.0 / 20.0);
-  EXPECT_TRUE(rb[1].hidden);
-  EXPECT_EQ(rb[2].outline_level, 2U);
-}
-
-TEST(XlsbWriteReadSymmetry, BorderRecordContentsSurviveBothFormatsAlike) {
-  Workbook source = Workbook::create_empty();
-  source.add_sheet("Sheet1");
-  source.sheet(0).set_cell_value(0U, 0U, Value::number(1.0));
-
-  StylesTable styles;
-  styles.fonts.push_back(FontRecord{});
-  styles.fills.push_back(FillRecord{});
-  styles.borders.push_back(BorderRecord{});
-  BorderRecord boxed;
-  boxed.left.style = 1U;  // thin
-  boxed.left.color.kind = ColorSpec::Kind::kRgb;
-  boxed.left.color.rgb = 0xFF0000FFU;
-  boxed.left.color_argb = 0xFF0000FFU;
-  boxed.bottom.style = 2U;  // medium
-  boxed.bottom.color.kind = ColorSpec::Kind::kRgb;
-  boxed.bottom.color.rgb = 0xFFFF0000U;
-  boxed.bottom.color_argb = 0xFFFF0000U;
-  boxed.diagonal.style = 3U;  // dashed
-  boxed.diagonal.color.kind = ColorSpec::Kind::kRgb;
-  boxed.diagonal.color.rgb = 0xFF00FF00U;
-  boxed.diagonal.color_argb = 0xFF00FF00U;
-  boxed.diagonal_up = true;
-  styles.borders.push_back(boxed);
-  CellXf plain;
-  CellXf bordered;
-  bordered.border_index = 1U;
-  bordered.apply_border = true;
-  styles.cell_xfs = {plain, bordered};
-  source.set_styles(std::move(styles));
-  ASSERT_TRUE(static_cast<bool>(source.set_cell_xf_index(0U, 0U, 0U, 1U)));
-
-  Workbook via_xlsb = Workbook::create_empty();
-  Workbook via_xlsx = Workbook::create_empty();
-  ASSERT_TRUE(ThroughXlsb(source, &via_xlsb));
-  ASSERT_TRUE(ThroughXlsx(source, &via_xlsx));
-
-  const std::vector<BorderRecord>& bb = via_xlsb.styles().borders;
-  const std::vector<BorderRecord>& bx = via_xlsx.styles().borders;
-  ASSERT_GT(bb.size(), 1U) << "the xlsb path lost the non-default border";
-  ASSERT_GT(bx.size(), 1U) << "the xlsx path lost the non-default border";
-  ASSERT_EQ(bb.size(), bx.size());
-  for (std::size_t i = 0; i < bb.size(); ++i) {
-    SCOPED_TRACE("border index " + std::to_string(i));
-    const BorderRecord& b = bb[i];
-    const BorderRecord& x = bx[i];
-    EXPECT_EQ(b.diagonal_up, x.diagonal_up);
-    EXPECT_EQ(b.diagonal_down, x.diagonal_down);
-    const BorderSide* b_sides[] = {&b.left, &b.right, &b.top, &b.bottom, &b.diagonal};
-    const BorderSide* x_sides[] = {&x.left, &x.right, &x.top, &x.bottom, &x.diagonal};
-    const char* names[] = {"left", "right", "top", "bottom", "diagonal"};
-    for (std::size_t side = 0; side < std::size(b_sides); ++side) {
-      SCOPED_TRACE(names[side]);
-      EXPECT_EQ(b_sides[side]->style, x_sides[side]->style);
-      ExpectColorSpecEqual(b_sides[side]->color, x_sides[side]->color);
-    }
-  }
-  // The styles, not merely their agreement: the authored record has to come
-  // back with the three sides it declared.
-  EXPECT_EQ(bb[1].left.style, 1U);
-  EXPECT_EQ(bb[1].bottom.style, 2U);
-  EXPECT_EQ(bb[1].diagonal.style, 3U);
-  EXPECT_TRUE(bb[1].diagonal_up);
-}
-
-// The alignment / protection / `apply*` groups run the same risk in the
-// writer as in the reader: `BrtXF` states each of them in a bit of one of
-// two flag words, and a bit nobody sets is indistinguishable from a field
-// nobody modelled. Authoring one xf that leaves no group at its default and
-// pushing it through both writers pins the `.xlsx` -> `.xlsb` direction the
-// Excel-authored fixture cannot reach -- it uses only a fraction of the set.
-//
-// `relativeIndent` is deliberately absent: `BrtXF` has no field for it, so
-// it is the one alignment attribute an `.xlsb` save cannot carry.
-TEST(XlsbWriteReadSymmetry, AlignmentAndApplyFlagsSurviveBothFormatsAlike) {
-  Workbook source = Workbook::create_empty();
-  source.add_sheet("Sheet1");
-  source.sheet(0).set_cell_value(0U, 0U, Value::number(1.0));
-
-  StylesTable styles;
-  styles.fonts.push_back(FontRecord{});
-  styles.fills.push_back(FillRecord{});
-  styles.borders.push_back(BorderRecord{});
-  CellXf plain;
-  CellXf decorated;
-  decorated.horizontal_align = 2U;  // center
-  decorated.vertical_align = 0U;    // top -- not the schema default
-  decorated.wrap_text = true;
-  decorated.justify_last_line = true;
-  decorated.shrink_to_fit = true;
-  decorated.has_shrink_to_fit = true;
-  decorated.reading_order = 2U;  // right-to-left
-  decorated.has_reading_order = true;
-  decorated.text_rotation = 45U;
-  decorated.has_text_rotation = true;
-  decorated.indent = 3U;
-  decorated.has_indent = true;
-  decorated.quote_prefix = true;
-  decorated.has_protection = true;
-  decorated.locked = false;
-  decorated.hidden = true;
-  decorated.apply_number_format = true;
-  decorated.apply_font = true;
-  decorated.apply_fill = true;
-  decorated.apply_border = true;
-  decorated.apply_alignment = true;
-  decorated.apply_protection = true;
-  styles.cell_xfs = {plain, decorated};
-  source.set_styles(std::move(styles));
-  ASSERT_TRUE(static_cast<bool>(source.set_cell_xf_index(0U, 0U, 0U, 1U)));
-
-  Workbook via_xlsb = Workbook::create_empty();
-  Workbook via_xlsx = Workbook::create_empty();
-  ASSERT_TRUE(ThroughXlsb(source, &via_xlsb));
-  ASSERT_TRUE(ThroughXlsx(source, &via_xlsx));
-
-  const std::vector<CellXf>& xb = via_xlsb.styles().cell_xfs;
-  const std::vector<CellXf>& xx = via_xlsx.styles().cell_xfs;
-  ASSERT_GT(xb.size(), 1U) << "the xlsb path lost the decorated xf";
-  ASSERT_GT(xx.size(), 1U) << "the xlsx path lost the decorated xf";
-  ASSERT_EQ(xb.size(), xx.size());
-  for (std::size_t i = 0; i < xb.size(); ++i) {
-    SCOPED_TRACE("cellXf index " + std::to_string(i));
-    const CellXf& b = xb[i];
-    const CellXf& x = xx[i];
-    EXPECT_EQ(b.horizontal_align, x.horizontal_align);
-    EXPECT_EQ(b.vertical_align, x.vertical_align);
-    EXPECT_EQ(b.wrap_text, x.wrap_text);
-    EXPECT_EQ(b.justify_last_line, x.justify_last_line);
-    EXPECT_EQ(b.shrink_to_fit, x.shrink_to_fit);
-    EXPECT_EQ(b.reading_order, x.reading_order);
-    EXPECT_EQ(b.text_rotation, x.text_rotation);
-    EXPECT_EQ(b.indent, x.indent);
-    EXPECT_EQ(b.quote_prefix, x.quote_prefix);
-    EXPECT_EQ(b.has_protection, x.has_protection);
-    EXPECT_EQ(b.locked, x.locked);
-    EXPECT_EQ(b.hidden, x.hidden);
-    EXPECT_EQ(b.apply_number_format, x.apply_number_format);
-    EXPECT_EQ(b.apply_font, x.apply_font);
-    EXPECT_EQ(b.apply_fill, x.apply_fill);
-    EXPECT_EQ(b.apply_border, x.apply_border);
-    EXPECT_EQ(b.apply_alignment, x.apply_alignment);
-    EXPECT_EQ(b.apply_protection, x.apply_protection);
-  }
-  // The authored values themselves: two equally lossy paths would satisfy
-  // the comparison above on their own.
-  const CellXf& b = xb[1];
-  EXPECT_EQ(b.horizontal_align, 2U);
-  EXPECT_EQ(b.vertical_align, 0U);
-  EXPECT_TRUE(b.wrap_text);
-  EXPECT_TRUE(b.justify_last_line);
-  EXPECT_TRUE(b.shrink_to_fit);
-  EXPECT_EQ(b.reading_order, 2U);
-  EXPECT_EQ(b.text_rotation, 45U);
-  EXPECT_EQ(b.indent, 3U);
-  EXPECT_TRUE(b.quote_prefix);
-  EXPECT_TRUE(b.has_protection);
-  EXPECT_FALSE(b.locked);
-  EXPECT_TRUE(b.hidden);
-  EXPECT_TRUE(b.apply_number_format);
-  EXPECT_TRUE(b.apply_font);
-  EXPECT_TRUE(b.apply_fill);
-  EXPECT_TRUE(b.apply_border);
-  EXPECT_TRUE(b.apply_alignment);
-  EXPECT_TRUE(b.apply_protection);
-}
-
 }  // namespace
 }  // namespace formulon
diff --git a/tests/unit/io/xlsb_roundtrip_symmetry_test_helpers.h b/tests/unit/io/xlsb_roundtrip_symmetry_test_helpers.h
new file mode 100644
index 000000000..09e3cdd60
--- /dev/null
+++ b/tests/unit/io/xlsb_roundtrip_symmetry_test_helpers.h
@@ -0,0 +1,334 @@
+#pragma once
+
+#ifndef FORMULON_FIXTURES_DIR
+#error "FORMULON_FIXTURES_DIR must be defined by the build"
+#endif
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "defined_name.h"
+#include "eval/recalc_engine.h"
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "io/xlsb/reader.h"
+#include "io/xlsb/record.h"
+#include "io/xlsb/writer.h"
+#include "io/zip_reader.h"
+#include "sheet.h"
+#include "styles.h"
+#include "support/roundtrip_symmetry.h"
+#include "value.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace xlsb_roundtrip_test_support {
+
+inline std::string FixturePath(const char* name) {
+  return std::string(FORMULON_FIXTURES_DIR) + "/excel/" + name;
+}
+
+// Reads the shared fixture from both formats. Returns false (with a gtest
+// failure) if either read fails; otherwise fills the two out-workbooks.
+inline ::testing::AssertionResult LoadBothFormats(Workbook* xlsb_out, Workbook* xlsx_out) {
+  const std::vector<std::uint8_t> xlsb_bytes = test::read_file_bytes(FixturePath("xlsb_fidelity_base.xlsb"));
+  const std::vector<std::uint8_t> xlsx_bytes = test::read_file_bytes(FixturePath("xlsb_fidelity_base.xlsx"));
+  if (xlsb_bytes.empty() || xlsx_bytes.empty()) {
+    return ::testing::AssertionFailure() << "fixture bytes empty";
+  }
+  auto xb = io::xlsb::read_xlsb(test::span_of(xlsb_bytes));
+  if (!xb) {
+    return ::testing::AssertionFailure() << "read_xlsb failed: " << xb.error().message;
+  }
+  auto xx = io::read_ooxml(test::span_of(xlsx_bytes));
+  if (!xx) {
+    return ::testing::AssertionFailure() << "read_ooxml failed: " << xx.error().message;
+  }
+  *xlsb_out = std::move(xb.value().workbook);
+  *xlsx_out = std::move(xx.value().workbook);
+  return ::testing::AssertionSuccess();
+}
+
+inline void ExpectColorSpecEqual(const ColorSpec& xlsb, const ColorSpec& xlsx) {
+  ASSERT_EQ(static_cast<int>(xlsb.kind), static_cast<int>(xlsx.kind));
+  switch (xlsb.kind) {
+    case ColorSpec::Kind::kRgb:
+      EXPECT_EQ(xlsb.rgb, xlsx.rgb);
+      break;
+    case ColorSpec::Kind::kTheme:
+      EXPECT_EQ(xlsb.theme, xlsx.theme);
+      EXPECT_NEAR(xlsb.tint, xlsx.tint, 1e-9);
+      break;
+    case ColorSpec::Kind::kIndexed:
+      EXPECT_EQ(xlsb.indexed, xlsx.indexed);
+      break;
+    case ColorSpec::Kind::kNone:
+    case ColorSpec::Kind::kAuto:
+      break;
+  }
+}
+
+inline std::string CellXfsBlockOfSavedPackage(const std::vector<std::uint8_t>& package) {
+  std::string styles;
+  if (!test::extract_part(test::span_of(package), "xl/styles.xml", &styles)) {
+    return std::string();
+  }
+  const std::size_t begin = styles.find("<cellXfs");
+  const std::size_t end = styles.find("</cellXfs>");
+  if (begin == std::string::npos || end == std::string::npos || end < begin) {
+    return std::string();
+  }
+  return styles.substr(begin, end - begin + std::strlen("</cellXfs>"));
+}
+
+/// Counts non-overlapping occurrences of `needle` in `haystack`.
+inline std::size_t CountOccurrences(const std::string& haystack, const std::string& needle) {
+  std::size_t count = 0;
+  for (std::size_t pos = haystack.find(needle); pos != std::string::npos; pos = haystack.find(needle, pos + 1)) {
+    ++count;
+  }
+  return count;
+}
+
+// The in-memory table is only half the claim: an `.xlsx` save serialises the
+// model, never the retained `xl/styles.bin` bytes, so what a host or another
+// spreadsheet application sees after a conversion is whatever reached
+// `xl/styles.xml`. Asserting on the saved part -- and against the same part
+// produced from the workbook's own `.xlsx` export, which is the identical
+// writer on an identical model -- is what states that a `.xlsb` source loses
+// nothing on the way out.
+inline std::uint32_t ResolvedNumFmtId(const Workbook& wb, std::uint32_t row, std::uint32_t col) {
+  const Cell* c = wb.sheet(0).cell_at(row, col);
+  if (c == nullptr) {
+    return 0xFFFFFFFFU;
+  }
+  const StylesTable& st = wb.styles();
+  if (c->xf_index >= st.cell_xfs.size()) {
+    return 0xFFFFFFFFU;  // dangling index -> style table did not round-trip
+  }
+  return st.cell_xfs[c->xf_index].num_fmt_id;
+}
+struct WireName {
+  std::string name;
+  std::int32_t itab = -1;
+};
+
+// Decodes `xl/workbook.bin`'s `BrtName` records in emission order, so
+// entry `i` is what a `PtgName` with `ilbl == i + 1` reaches.
+inline std::vector<WireName> ReadWireNames(const std::vector<std::uint8_t>& workbook_bin) {
+  std::vector<WireName> out;
+  io::ByteSpan cursor = test::span_of(workbook_bin);
+  while (cursor.size > 0U) {
+    auto rec_or = io::xlsb::read_record(cursor);
+    if (!rec_or) {
+      return out;
+    }
+    if (rec_or.value().type != static_cast<std::uint16_t>(io::xlsb::XlsbRecordType::BrtName)) {
+      continue;
+    }
+    // BrtName: grbit (u32) + chKey (u8) + itab (i32) + the name string.
+    io::ByteSpan p = rec_or.value().payload;
+    auto grbit = io::xlsb::read_u32(p);
+    auto ch_key = io::xlsb::read_u8(p);
+    auto itab = io::xlsb::read_u32(p);
+    if (!grbit || !ch_key || !itab) {
+      return out;
+    }
+    auto name = io::xlsb::read_xlwidestring(p);
+    if (!name) {
+      return out;
+    }
+    out.push_back(WireName{name.value(), static_cast<std::int32_t>(itab.value())});
+  }
+  return out;
+}
+
+// Returns the `ilbl` encoded by the lone `PtgName` token of the formula
+// stored at row 0 / `col` of `sheet_bin`, or 0 when the cell is absent
+// or its token stream is not a single bare name reference.
+inline std::uint32_t IlblOfNameOnlyFormula(const std::vector<std::uint8_t>& sheet_bin, std::uint32_t col) {
+  io::ByteSpan cursor = test::span_of(sheet_bin);
+  while (cursor.size > 0U) {
+    auto rec_or = io::xlsb::read_record(cursor);
+    if (!rec_or) {
+      return 0U;
+    }
+    // A name formula is entered as a dynamic-array formula, whose tokens a
+    // `BrtArrFmla` carries: rwFirst, rwLast, colFirst, colLast (u32 each),
+    // a flag byte, then cce + rgce.
+    if (rec_or.value().type == static_cast<std::uint16_t>(io::xlsb::XlsbRecordType::BrtArrFmla)) {
+      io::ByteSpan p = rec_or.value().payload;
+      if (p.size < 26U || p.data[8] != col || p.data[17] != 5U || p.data[21] != 0x43U) {
+        continue;
+      }
+      p.data += 22U;
+      p.size -= 22U;
+      auto ilbl = io::xlsb::read_u32(p);
+      return ilbl ? ilbl.value() : 0U;
+    }
+    if (rec_or.value().type != static_cast<std::uint16_t>(io::xlsb::XlsbRecordType::BrtFmlaNum)) {
+      continue;
+    }
+    // BrtFmlaNum: cell header (col u32 + iStyleRef 3B + fPhShow u8),
+    // the cached double, grbitFlags (u16), then the CellParsedFormula
+    // (cce + rgce + cb + rgcb).
+    io::ByteSpan p = rec_or.value().payload;
+    auto cell_col = io::xlsb::read_u32(p);
+    if (!cell_col || cell_col.value() != col) {
+      continue;
+    }
+    if (p.size < 14U) {
+      return 0U;
+    }
+    p.data += 4U + 8U + 2U;  // iStyleRef + fPhShow, cached value, grbitFlags
+    p.size -= 4U + 8U + 2U;
+    auto cce = io::xlsb::read_u32(p);
+    if (cce && p.size > 0U && p.data[0] == 0x01U) {
+      continue;  // PtgExp: the tokens follow in the cell's BrtArrFmla.
+    }
+    // `=Foo` lowers to exactly one value-class PtgName: opcode 0x43 + a u32 ilbl.
+    if (!cce || cce.value() != 5U || p.size < 5U || p.data[0] != 0x43U) {
+      return 0U;
+    }
+    p.data += 1U;
+    p.size -= 1U;
+    auto ilbl = io::xlsb::read_u32(p);
+    return ilbl ? ilbl.value() : 0U;
+  }
+  return 0U;
+}
+
+// Builds the workbook both scope-resolution cases share: a
+// workbook-scoped `Foo` (Sheet1!A1 = 10) and a Sheet1-local `Foo`
+// (Sheet1!B1 = 20), with `=Foo` on both sheets. `local_first` flips the
+// declaration order of the two names, which is the tie-break a
+// text-keyed name table falls back on.
+inline void RunScopeResolutionCase(bool local_first) {
+  SCOPED_TRACE(local_first ? "sheet-local Foo declared first" : "workbook-scoped Foo declared first");
+  Workbook wb = Workbook::create_empty();
+  wb.add_sheet("Sheet1");
+  wb.add_sheet("Sheet2");
+  if (local_first) {
+    ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$B$1", 0)));
+    ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$A$1", -1)));
+  } else {
+    ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$A$1", -1)));
+    ASSERT_TRUE(static_cast<bool>(wb.set_defined_name_scoped("Foo", "Sheet1!$B$1", 0)));
+  }
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::number(10.0))));  // Sheet1!A1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 1U, Value::number(20.0))));  // Sheet1!B1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 3U, "=Foo")));             // Sheet1!D1
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(1U, 0U, 3U, "=Foo")));             // Sheet2!D1
+  auto recalc_or = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(recalc_or)) << recalc_or.error().message;
+  // The engine's own resolution is the reference the encoding has to
+  // agree with: Sheet1 sees the local `Foo` (B1), Sheet2 the global one.
+  ASSERT_EQ(wb.sheet(0).resolve_cell_value(0U, 3U).as_number(), 20.0);
+  ASSERT_EQ(wb.sheet(1).resolve_cell_value(0U, 3U).as_number(), 10.0);
+
+  auto saved = io::xlsb::write_xlsb(wb);
+  ASSERT_TRUE(static_cast<bool>(saved)) << "write_xlsb failed: " << saved.error().message;
+  io::ZipReader zip;
+  ASSERT_TRUE(static_cast<bool>(zip.open(test::span_of(saved.value()))));
+  auto workbook_bin = zip.read_entry("xl/workbook.bin");
+  auto sheet1_bin = zip.read_entry("xl/worksheets/sheet1.bin");
+  auto sheet2_bin = zip.read_entry("xl/worksheets/sheet2.bin");
+  ASSERT_TRUE(static_cast<bool>(workbook_bin));
+  ASSERT_TRUE(static_cast<bool>(sheet1_bin));
+  ASSERT_TRUE(static_cast<bool>(sheet2_bin));
+
+  const std::vector<WireName> wire_names = ReadWireNames(workbook_bin.value());
+  ASSERT_EQ(wire_names.size(), 2U);
+
+  const std::uint32_t sheet1_ilbl = IlblOfNameOnlyFormula(sheet1_bin.value(), 3U);
+  const std::uint32_t sheet2_ilbl = IlblOfNameOnlyFormula(sheet2_bin.value(), 3U);
+  ASSERT_GE(sheet1_ilbl, 1U);
+  ASSERT_LE(sheet1_ilbl, wire_names.size());
+  ASSERT_GE(sheet2_ilbl, 1U);
+  ASSERT_LE(sheet2_ilbl, wire_names.size());
+
+  // Sheet1's reference must land on the record scoped to Sheet1.
+  EXPECT_EQ(wire_names[sheet1_ilbl - 1U].name, "Foo");
+  EXPECT_EQ(wire_names[sheet1_ilbl - 1U].itab, 0) << "Sheet1 must resolve the sheet-local Foo";
+  // Sheet2 has no local override, so it must land on the workbook one.
+  EXPECT_EQ(wire_names[sheet2_ilbl - 1U].name, "Foo");
+  EXPECT_EQ(wire_names[sheet2_ilbl - 1U].itab, -1) << "Sheet2 must resolve the workbook-scoped Foo";
+
+  // The values the round trip produces are unchanged either way (the
+  // reader re-resolves by name text), so they are a guard against the
+  // scope fix disturbing them, not the detector for it.
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  ASSERT_TRUE(static_cast<bool>(reloaded)) << "read_xlsb failed: " << reloaded.error().message;
+  Workbook after = std::move(reloaded.value().workbook);
+  auto after_recalc = after.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(after_recalc)) << after_recalc.error().message;
+  EXPECT_EQ(after.sheet(0).resolve_cell_value(0U, 3U).as_number(), 20.0);
+  EXPECT_EQ(after.sheet(1).resolve_cell_value(0U, 3U).as_number(), 10.0);
+}
+inline void ExpectSelfBookFixture(Workbook& wb, const char* label) {
+  const Sheet& s1 = wb.sheet(0);
+  const Sheet& s2 = wb.sheet(1);
+  EXPECT_EQ(s1.cell_at(0U, 2U)->formula_text, "=[0]!Fn(3)") << label;
+  EXPECT_EQ(s1.cell_at(0U, 3U)->formula_text, "=SUM([0]!Rng)") << label;
+  EXPECT_EQ(s2.cell_at(0U, 0U)->formula_text, "=[0]!G") << label;
+  EXPECT_EQ(s2.cell_at(0U, 2U)->formula_text, "=ROWS([0]!Rng)") << label;
+  EXPECT_EQ(s2.cell_at(0U, 3U)->formula_text, "=Sheet1!A10:[0]!Rng") << label;
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry()))) << label;
+  const double sheet1[] = {100.0, 100.0, 6.0, 7.0, 100.0};
+  for (std::uint32_t col = 0; col < 5U; ++col) {
+    const Value v = wb.sheet(0).resolve_cell_value(0U, col);
+    ASSERT_TRUE(v.is_number()) << label << " Sheet1 col=" << col;
+    EXPECT_EQ(v.as_number(), sheet1[col]) << label << " Sheet1 col=" << col;
+  }
+  const double sheet2[] = {5.0, 5.0, 2.0, 3.0};
+  for (std::uint32_t col = 0; col < 4U; ++col) {
+    const Value v = wb.sheet(1).resolve_cell_value(0U, col);
+    ASSERT_TRUE(v.is_number()) << label << " Sheet2 col=" << col;
+    EXPECT_EQ(v.as_number(), sheet2[col]) << label << " Sheet2 col=" << col;
+  }
+  EXPECT_EQ(wb.sheet(1).resolve_cell_value(1U, 3U).as_number(), 4.0) << label << " Sheet2!D2 spill";
+}
+inline std::uint64_t BitsOf(double v) {
+  std::uint64_t bits = 0;
+  std::memcpy(&bits, &v, sizeof(v));
+  return bits;
+}
+
+// The whole point of the predicate: a `true` answer is a promise that
+// `BrtCellRk` is lossless for that value. Sweep a deterministic spread
+// of finite doubles -- including the currency-shaped band where the
+inline ::testing::AssertionResult ThroughXlsb(const Workbook& wb, Workbook* out) {
+  auto saved = io::xlsb::write_xlsb(wb);
+  if (!saved) {
+    return ::testing::AssertionFailure() << "write_xlsb failed: " << saved.error().message;
+  }
+  auto reloaded = io::xlsb::read_xlsb(test::span_of(saved.value()));
+  if (!reloaded) {
+    return ::testing::AssertionFailure() << "read_xlsb failed: " << reloaded.error().message;
+  }
+  *out = std::move(reloaded.value().workbook);
+  return ::testing::AssertionSuccess();
+}
+
+/// Saves `wb` as `.xlsx` and reads it back, or fails the test.
+inline ::testing::AssertionResult ThroughXlsx(const Workbook& wb, Workbook* out) {
+  auto saved = io::write_ooxml(wb);
+  if (!saved) {
+    return ::testing::AssertionFailure() << "write_ooxml failed: " << saved.error().message;
+  }
+  auto reloaded = io::read_ooxml(test::span_of(saved.value()));
+  if (!reloaded) {
+    return ::testing::AssertionFailure() << "read_ooxml failed: " << reloaded.error().message;
+  }
+  *out = std::move(reloaded.value().workbook);
+  return ::testing::AssertionSuccess();
+}
+
+}  // namespace xlsb_roundtrip_test_support
+}  // namespace formulon
diff --git a/tests/unit/parser/ast_format_r1c1_test.cpp b/tests/unit/parser/ast_format_r1c1_test.cpp
new file mode 100644
index 000000000..c96a180ed
--- /dev/null
+++ b/tests/unit/parser/ast_format_r1c1_test.cpp
@@ -0,0 +1,145 @@
+#include "parser/ast_format_r1c1.h"
+
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+#include "gtest/gtest.h"
+#include "parser/ast.h"
+#include "parser/parser.h"
+#include "parser/reference.h"
+#include "utils/arena.h"
+
+namespace formulon {
+namespace parser {
+namespace {
+
+// Parses `src` (no leading `=`) and formats it as R1C1 at the 0-based host cell.
+std::string R1C1(std::string_view src, std::uint32_t row, std::uint32_t col) {
+  Arena arena;
+  Parser p(src, arena);
+  AstNode* root = p.parse();
+  EXPECT_TRUE(p.errors().empty()) << "parse errors for: " << src;
+  if (root == nullptr) {
+    return "<null>";
+  }
+  return format_formula_r1c1(*root, row, col);
+}
+
+// Rows measured against Mac Excel `FormulaR1C1`: `a1` is the normalized (read
+// back) A1 spelling, `r1c1` Excel's answer, both without the leading `=`.
+struct ProbeRow {
+  const char* a1;
+  std::uint32_t row;
+  std::uint32_t col;
+  const char* r1c1;
+};
+
+// The parser only reads cross-workbook references by book index, so the
+// probe's `[o7_ext.xlsx]` rows are entered (and expected) as `[1]`. The
+// external whole-column row does not parse and is built by hand below.
+constexpr ProbeRow kProbeRows[] = {
+    {"A1", 4, 2, "R[-4]C[-2]"},
+    {"$A$1", 4, 2, "R1C1"},
+    {"$A1", 4, 2, "R[-4]C1"},
+    {"A$1", 4, 2, "R1C[-2]"},
+    {"C5", 4, 2, "RC"},
+    {"D6", 4, 2, "R[1]C[1]"},
+    {"B4", 4, 2, "R[-1]C[-1]"},
+    {"A1:B2", 4, 2, "R[-4]C[-2]:R[-3]C[-1]"},
+    {"$A$1:B2", 4, 2, "R1C1:R[-3]C[-1]"},
+    {"A1:$B$2", 4, 2, "R[-4]C[-2]:R2C2"},
+    {"SUM(A:A)", 4, 2, "SUM(C[-2])"},
+    {"SUM($A:$A)", 4, 2, "SUM(C1)"},
+    {"SUM(A:C)", 4, 2, "SUM(C[-2]:C)"},
+    {"SUM(D:E)", 4, 2, "SUM(C[1]:C[2])"},
+    {"SUM($A:E)", 4, 2, "SUM(C1:C[2])"},
+    {"SUM(1:1)", 4, 2, "SUM(R[-4])"},
+    {"SUM($1:$1)", 4, 2, "SUM(R1)"},
+    {"SUM(4:6)", 4, 2, "SUM(R[-1]:R[1])"},
+    {"SUM($4:6)", 4, 2, "SUM(R4:R[1])"},
+    {"Data!A1", 4, 2, "Data!R[-4]C[-2]"},
+    {"Data!$A$1", 4, 2, "Data!R1C1"},
+    {"Data!A1:B2", 4, 2, "Data!R[-4]C[-2]:R[-3]C[-1]"},
+    {"'My Sheet'!A1", 4, 2, "'My Sheet'!R[-4]C[-2]"},
+    {"'It''s'!A1", 4, 2, "'It''s'!R[-4]C[-2]"},
+    {"'My Sheet'!$B$2:C3", 4, 2, "'My Sheet'!R2C2:R[-2]C"},
+    {"Data!A:A", 4, 2, "Data!C[-2]"},
+    {"Data!1:1", 4, 2, "Data!R[-4]"},
+    {"Data:'My Sheet'!A1", 4, 2, "Data:'My Sheet'!R[-4]C[-2]"},
+    {"SUM(Data:'My Sheet'!A1:B2)", 4, 2, "SUM(Data:'My Sheet'!R[-4]C[-2]:R[-3]C[-1])"},
+    {"Tbl[@Col1]", 4, 2, "Tbl[@Col1]"},
+    {"SUM(Tbl[@[Col1]:[Col2]])", 4, 2, "SUM(Tbl[@[Col1]:[Col2]])"},
+    {"Tbl[@Col1]", 4, 2, "Tbl[@Col1]"},
+    {"SUM(Tbl[#Data])", 4, 2, "SUM(Tbl[#Data])"},
+    {"Tbl[#Headers]", 4, 2, "Tbl[#Headers]"},
+    {"Tbl[[#Totals],[Col2]]", 4, 2, "Tbl[[#Totals],[Col2]]"},
+    {"MyName", 4, 2, "MyName"},
+    {"MyName+A1", 4, 2, "MyName+R[-4]C[-2]"},
+    {"SUM(MyRange)", 4, 2, "SUM(MyRange)"},
+    {"Data!LocalName", 4, 2, "Data!LocalName"},
+    {"MyRel", 4, 2, "MyRel"},
+    {"\"A1\"", 4, 2, "\"A1\""},
+    {"\"R1C1 and A1:B2\"&A1", 4, 2, "\"R1C1 and A1:B2\"&R[-4]C[-2]"},
+    {"IF(A1=\"B2\",1,0)", 4, 2, "IF(R[-4]C[-2]=\"B2\",1,0)"},
+    {"\"Sheet1!A1\"", 4, 2, "\"Sheet1!A1\""},
+    {"\"He said \"\"A1\"\"\"", 4, 2, "\"He said \"\"A1\"\"\""},
+    {"A1+B2*C3", 4, 2, "R[-4]C[-2]+R[-3]C[-1]*R[-2]C"},
+    {"SUM(A1,B2,$C$3)", 4, 2, "SUM(R[-4]C[-2],R[-3]C[-1],R3C3)"},
+    {"INDEX(A1:C3,2,2)", 4, 2, "INDEX(R[-4]C[-2]:R[-2]C,2,2)"},
+    {"A1:B2 B2:C3", 4, 2, "R[-4]C[-2]:R[-3]C[-1] R[-3]C[-1]:R[-2]C"},
+    {"(A1,B2)", 4, 2, "(R[-4]C[-2],R[-3]C[-1])"},
+    {"A1:INDEX(B:B,3)", 4, 2, "R[-4]C[-2]:INDEX(C[-1],3)"},
+    {"$A$1", 4, 2, "R1C1"},
+    {"C5", 4, 2, "RC"},
+    {"XFD1048576", 4, 2, "R[1048571]C[16381]"},
+    {"A1048576", 4, 2, "R[1048571]C[-2]"},
+    {"XFD1", 4, 2, "R[-4]C[16381]"},
+    {"A1#", 4, 2, "R[-4]C[-2]#"},
+    {"A1:A3", 4, 2, "R[-4]C[-2]:R[-2]C[-2]"},
+    {"LET(x,A1,x+B2)", 4, 2, "LET(x,R[-4]C[-2],x+R[-3]C[-1])"},
+    {"LAMBDA(a,a+A1)(2)", 4, 2, "LAMBDA(a,a+R[-4]C[-2])(2)"},
+    {"B2", 0, 0, "R[1]C[1]"},
+    {"Z100", 0, 0, "R[99]C[25]"},
+    {"A1", 1048575, 16383, "R[-1048575]C[-16383]"},
+    {"XFD1048575", 1048575, 16383, "R[-1]C"},
+    {"A1", 1, 1, "R[-1]C[-1]"},
+    {"SUM(A:A)", 1, 1, "SUM(C[-1])"},
+    {"[1]Sheet1!A1", 4, 2, "[1]Sheet1!R[-4]C[-2]"},
+    {"[1]Sheet1!$A$1:B2", 4, 2, "[1]Sheet1!R1C1:R[-3]C[-1]"},
+    {"'[1]It''s'!A1", 4, 2, "'[1]It''s'!R[-4]C[-2]"},
+};
+
+TEST(AstFormatR1C1, ProbeTable) {
+  for (const ProbeRow& row : kProbeRows) {
+    EXPECT_EQ(R1C1(row.a1, row.row, row.col), row.r1c1) << "A1: " << row.a1;
+  }
+}
+
+TEST(AstFormatR1C1, ExternalWholeColumn) {
+  Arena arena;
+  Reference col;
+  col.col = 0;
+  col.is_full_col = true;
+  const AstNode* node = make_external_ref(arena, 1, "Sheet1", col, col, false);
+  EXPECT_EQ(format_formula_r1c1(*node, 4, 2), "[1]Sheet1!C[-2]");
+}
+
+TEST(AstFormatR1C1, HostCellIsRC) {
+  EXPECT_EQ(R1C1("C5", 4, 2), "RC");
+  EXPECT_EQ(R1C1("B2*(A1+C3)", 1, 1), "RC*(R[-1]C[-1]+R[1]C[1])");
+}
+
+TEST(AstFormatR1C1, AbsoluteAndMixed) {
+  EXPECT_EQ(R1C1("$A$1", 4, 2), "R1C1");
+  EXPECT_EQ(R1C1("$A1", 4, 2), "R[-4]C1");
+  EXPECT_EQ(R1C1("A$1", 4, 2), "R1C[-2]");
+}
+
+TEST(AstFormatR1C1, ReferenceLikeTextInStringsIsUntouched) {
+  EXPECT_EQ(R1C1("\"A1:B2\"&A1", 4, 2), "\"A1:B2\"&R[-4]C[-2]");
+}
+
+}  // namespace
+}  // namespace parser
+}  // namespace formulon
diff --git a/tests/unit/parser/ast_format_test.cpp b/tests/unit/parser/ast_format_test.cpp
index 7e1ebefcb..b9eac30ca 100644
--- a/tests/unit/parser/ast_format_test.cpp
+++ b/tests/unit/parser/ast_format_test.cpp
@@ -13,6 +13,7 @@
 #include "gtest/gtest.h"
 #include "parser/ast.h"
 #include "parser/ast_dump.h"
+#include "parser/formula_prefix.h"
 #include "parser/parser.h"
 #include "parser/reference.h"
 #include "utils/arena.h"
diff --git a/tests/unit/pivot/pivot_evaluator_aggregation_test.cpp b/tests/unit/pivot/pivot_evaluator_aggregation_test.cpp
new file mode 100644
index 000000000..d209157dd
--- /dev/null
+++ b/tests/unit/pivot/pivot_evaluator_aggregation_test.cpp
@@ -0,0 +1,724 @@
+// Aggregate functions and error handling for `formulon::pivot::evaluate`.
+
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/aggregator.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_evaluator_fixtures.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+using test::owned_text;
+using test::row_index;
+
+// ---------------------------------------------------------------------------
+// 14b. Count / CountNumbers classify cells, so a source error never becomes
+//      the count -- at the leaf, at the subtotal, or at the grand total
+// ---------------------------------------------------------------------------
+
+// Builds a Group x Sub hierarchy over a value column that carries one
+// error, so a single `#N/A` reaches the leaf cell, its group's subtotal and
+// the grand total through the same aggregation.
+PivotTable build_count_over_error_table(PivotCache& cache, Aggregation aggregation) {
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Sub", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  auto add = [&](const char* group, const char* sub, Value v) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, group));
+    rec.cells.push_back(owned_text(cache, sub));
+    rec.cells.push_back(v);
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("A", "x", Value::number(10.0));
+  add("A", "x", Value::error(ErrorCode::NA));  // e.g. a lookup that missed
+  add("A", "y", Value::number(20.0));
+  add("B", "x", Value::number(30.0));
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField group_f;
+  group_f.source_name = "Group";
+  group_f.axis = PivotAxis::Row;
+  group_f.subtotal_top = true;
+  PivotField sub_f;
+  sub_f.source_name = "Sub";
+  sub_f.axis = PivotAxis::Row;
+  PivotField amount_f;
+  amount_f.source_name = "Amount";
+  amount_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(group_f));
+  table.mutable_fields().push_back(std::move(sub_f));
+  table.mutable_fields().push_back(std::move(amount_f));
+  table.mutable_row_field_order() = {0, 1};
+  PivotDataField df;
+  df.name = "Count of Amount";
+  df.field_index = 2;
+  df.aggregation = aggregation;
+  table.mutable_data_fields().push_back(std::move(df));
+  table.set_grand_totals(/*rows=*/true, /*cols=*/true);
+  return table;
+}
+
+TEST(PivotEvaluator, SingleSumByRegion) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Two row leaves (North, South), one implicit col leaf, one data field.
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_TRUE(r.cols.empty());
+  ASSERT_EQ(r.values.size(), 2U);
+  ASSERT_EQ(r.values[0].size(), 1U);
+  ASSERT_EQ(r.values[0][0].size(), 1U);
+
+  const std::size_t north = row_index(r, "North");
+  const std::size_t south = row_index(r, "South");
+  ASSERT_NE(north, static_cast<std::size_t>(-1));
+  ASSERT_NE(south, static_cast<std::size_t>(-1));
+
+  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 175.0);  // 100 + 50 + 25
+  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 500.0);  // 200 + 300
+  EXPECT_TRUE(r.grand_total.is_blank());
+}
+
+TEST(PivotEvaluator, TwoRowFieldsHierarchy) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Row hierarchy: North { Gadget, Widget }, South { Gadget, Widget }.
+  ASSERT_EQ(r.rows.size(), 2U);
+  for (const auto& region : r.rows) {
+    EXPECT_FALSE(region.children.empty());
+    EXPECT_EQ(region.children.size(), 2U);
+  }
+  // Each region should have both products.
+  const std::size_t north = row_index(r, "North");
+  const std::size_t south = row_index(r, "South");
+  ASSERT_NE(north, static_cast<std::size_t>(-1));
+  ASSERT_NE(south, static_cast<std::size_t>(-1));
+
+  // Verify children are alphabetically ordered (Gadget < Widget).
+  EXPECT_EQ(r.rows[north].children[0].label, "Gadget");
+  EXPECT_EQ(r.rows[north].children[1].label, "Widget");
+
+  // Four leaves in total: walk values matrix and check totals.
+  // Leaves are ordered: North/Gadget, North/Widget, South/Gadget, South/Widget.
+  ASSERT_EQ(r.values.size(), 4U);
+  // We don't depend on the exact leaf ordering across regions; just
+  // sum and check totals match {50, 125, 300, 200}.
+  std::vector<double> got;
+  got.reserve(4);
+  for (const auto& row_slot : r.values) {
+    ASSERT_EQ(row_slot.size(), 1U);
+    ASSERT_EQ(row_slot[0].size(), 1U);
+    got.push_back(row_slot[0][0].as_number());
+  }
+  std::sort(got.begin(), got.end());
+  EXPECT_DOUBLE_EQ(got[0], 50.0);   // North/Gadget
+  EXPECT_DOUBLE_EQ(got[1], 125.0);  // North/Widget (100 + 25)
+  EXPECT_DOUBLE_EQ(got[2], 200.0);  // South/Widget
+  EXPECT_DOUBLE_EQ(got[3], 300.0);  // South/Gadget
+}
+
+TEST(PivotEvaluator, OneRowOneColField) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 2U);
+  ASSERT_EQ(r.cols.size(), 2U);
+  // 2 row leaves x 2 col leaves x 1 data field.
+  ASSERT_EQ(r.values.size(), 2U);
+  ASSERT_EQ(r.values[0].size(), 2U);
+  ASSERT_EQ(r.values[0][0].size(), 1U);
+
+  // Column ordering: Gadget < Widget alphabetically.
+  EXPECT_EQ(r.cols[0].label, "Gadget");
+  EXPECT_EQ(r.cols[1].label, "Widget");
+
+  const std::size_t north = row_index(r, "North");
+  const std::size_t south = row_index(r, "South");
+  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 50.0);   // North/Gadget
+  EXPECT_DOUBLE_EQ(r.values[north][1][0].as_number(), 125.0);  // North/Widget
+  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 300.0);  // South/Gadget
+  EXPECT_DOUBLE_EQ(r.values[south][1][0].as_number(), 200.0);  // South/Widget
+}
+
+TEST(PivotEvaluator, SumAndAverageOnSameField) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Add an Average data field on the same source column.
+  PivotDataField avg_amount;
+  avg_amount.name = "Average of Amount";
+  avg_amount.field_index = 2;
+  avg_amount.aggregation = Aggregation::Average;
+  table.mutable_data_fields().push_back(std::move(avg_amount));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.values.size(), 2U);
+  ASSERT_EQ(r.values[0][0].size(), 2U);  // Sum + Average.
+
+  const std::size_t north = row_index(r, "North");
+  const std::size_t south = row_index(r, "South");
+  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 175.0);
+  EXPECT_DOUBLE_EQ(r.values[north][0][1].as_number(), 175.0 / 3.0);
+  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 500.0);
+  EXPECT_DOUBLE_EQ(r.values[south][0][1].as_number(), 250.0);
+}
+
+TEST(PivotEvaluator, CountIncludesNonBlanks) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Note", {}});
+
+  auto add = [&](const char* group, Value note) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, group));
+    rec.cells.push_back(note);
+    cache.mutable_records().push_back(std::move(rec));
+  };
+
+  add("A", owned_text(cache, "ok"));   // counted
+  add("A", Value::blank());            // NOT counted
+  add("A", Value::number(7.0));        // counted
+  add("B", owned_text(cache, "yes"));  // counted
+  add("B", Value::blank());            // NOT counted
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField group_f;
+  group_f.source_name = "Group";
+  group_f.axis = PivotAxis::Row;
+  PivotField note_f;
+  note_f.source_name = "Note";
+  note_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(group_f));
+  table.mutable_fields().push_back(std::move(note_f));
+  table.mutable_row_field_order() = {0};
+  PivotDataField cnt;
+  cnt.name = "Count of Note";
+  cnt.field_index = 1;
+  cnt.aggregation = Aggregation::Count;
+  table.mutable_data_fields().push_back(std::move(cnt));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 2U);
+  const std::size_t a = row_index(r, "A");
+  const std::size_t b = row_index(r, "B");
+  EXPECT_DOUBLE_EQ(r.values[a][0][0].as_number(), 2.0);
+  EXPECT_DOUBLE_EQ(r.values[b][0][0].as_number(), 1.0);
+}
+
+TEST(PivotEvaluator, CountNumbersExcludesText) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Mixed", {}});
+
+  auto add = [&](const char* group, Value v) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, group));
+    rec.cells.push_back(v);
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("A", Value::number(1.0));
+  add("A", owned_text(cache, "skip"));
+  add("A", Value::number(2.0));
+  add("A", owned_text(cache, "skip2"));
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField group_f;
+  group_f.source_name = "Group";
+  group_f.axis = PivotAxis::Row;
+  PivotField mixed_f;
+  mixed_f.source_name = "Mixed";
+  mixed_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(group_f));
+  table.mutable_fields().push_back(std::move(mixed_f));
+  table.mutable_row_field_order() = {0};
+  PivotDataField cn;
+  cn.name = "CountNumbers of Mixed";
+  cn.field_index = 1;
+  cn.aggregation = Aggregation::CountNumbers;
+  table.mutable_data_fields().push_back(std::move(cn));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 2.0);
+}
+
+TEST(PivotEvaluator, AverageNoNumbersReturnsDiv0) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Note", {}});
+
+  auto add = [&](const char* g, const char* n) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, g));
+    rec.cells.push_back(owned_text(cache, n));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("A", "x");
+  add("A", "y");
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField gf;
+  gf.source_name = "Group";
+  gf.axis = PivotAxis::Row;
+  PivotField nf;
+  nf.source_name = "Note";
+  nf.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(gf));
+  table.mutable_fields().push_back(std::move(nf));
+  table.mutable_row_field_order() = {0};
+  PivotDataField avg;
+  avg.name = "Average of Note";
+  avg.field_index = 1;
+  avg.aggregation = Aggregation::Average;
+  table.mutable_data_fields().push_back(std::move(avg));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 1U);
+  ASSERT_TRUE(r.values[0][0][0].is_error());
+  EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Div0);
+}
+
+TEST(PivotEvaluator, MaxMinProduct) {
+  PivotCache cache = build_basic_cache();
+
+  auto run = [&](Aggregation agg) {
+    PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+    table.mutable_data_fields()[0].aggregation = agg;
+    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+    auto r_or = evaluate(table, cache);
+    EXPECT_TRUE(static_cast<bool>(r_or));
+    return r_or.value();
+  };
+
+  {
+    PivotResult r = run(Aggregation::Max);
+    const std::size_t north = row_index(r, "North");
+    const std::size_t south = row_index(r, "South");
+    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 100.0);
+    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 300.0);
+  }
+  {
+    PivotResult r = run(Aggregation::Min);
+    const std::size_t north = row_index(r, "North");
+    const std::size_t south = row_index(r, "South");
+    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 25.0);
+    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 200.0);
+  }
+  {
+    PivotResult r = run(Aggregation::Product);
+    const std::size_t north = row_index(r, "North");
+    const std::size_t south = row_index(r, "South");
+    // North: 100 * 50 * 25 = 125_000
+    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 125000.0);
+    // South: 200 * 300 = 60_000
+    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 60000.0);
+  }
+}
+
+TEST(PivotEvaluator, ArithmeticAggregatesMapOverflowToNumError) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* region, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  const double huge = std::numeric_limits<double>::max();
+  add("North", huge);
+  add("North", huge);  // huge + huge overflows a double to +inf.
+
+  auto run = [&](Aggregation agg) {
+    PivotTable table;
+    table.set_pivot_cache_id(1);
+    PivotField rf;
+    rf.source_name = "Region";
+    rf.axis = PivotAxis::Row;
+    PivotField af;
+    af.source_name = "Amount";
+    af.axis = PivotAxis::Value;
+    table.mutable_fields().push_back(std::move(rf));
+    table.mutable_fields().push_back(std::move(af));
+    table.mutable_row_field_order() = {0};
+    PivotDataField df;
+    df.name = "Agg";
+    df.field_index = 1;
+    df.aggregation = agg;
+    table.mutable_data_fields().push_back(std::move(df));
+    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+    auto r_or = evaluate(table, cache);
+    EXPECT_TRUE(static_cast<bool>(r_or));
+    return r_or.value();
+  };
+
+  for (Aggregation agg : {Aggregation::Sum, Aggregation::Average, Aggregation::Product}) {
+    PivotResult r = run(agg);
+    ASSERT_TRUE(r.values[0][0][0].is_error()) << static_cast<int>(agg);
+    EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Num) << static_cast<int>(agg);
+  }
+}
+
+TEST(PivotEvaluator, AverageKeepsPlainSumRoundingAndOverflow) {
+  const Value last_bit =
+      apply_aggregation(Aggregation::Average, {Value::number(0.1), Value::number(0.2), Value::number(0.3)});
+  ASSERT_TRUE(last_bit.is_number()) << last_bit.debug_to_string();
+  EXPECT_DOUBLE_EQ(last_bit.as_number(), (0.1 + 0.2 + 0.3) / 3.0);
+
+  const Value absorbed =
+      apply_aggregation(Aggregation::Average, {Value::number(1.0e16), Value::number(1.0), Value::number(-1.0e16)});
+  ASSERT_TRUE(absorbed.is_number()) << absorbed.debug_to_string();
+  EXPECT_DOUBLE_EQ(absorbed.as_number(), 0.0);
+
+  const Value overflow = apply_aggregation(Aggregation::Average, {Value::number(1.0e308), Value::number(1.0e308)});
+  ASSERT_TRUE(overflow.is_error()) << overflow.debug_to_string();
+  EXPECT_EQ(overflow.as_error(), ErrorCode::Num);
+}
+
+TEST(PivotEvaluator, MaxMinMapAStoredNonFiniteValueToNumError) {
+  auto run = [&](Aggregation agg, double extreme) {
+    PivotCache cache;
+    cache.set_cache_id(1);
+    cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+    cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+    auto add = [&](const char* region, double amount) {
+      PivotCacheRecord rec;
+      rec.cells.push_back(owned_text(cache, region));
+      rec.cells.push_back(Value::number(amount));
+      cache.mutable_records().push_back(std::move(rec));
+    };
+    add("North", extreme);
+    add("North", 1.0);
+
+    PivotTable table;
+    table.set_pivot_cache_id(1);
+    PivotField rf;
+    rf.source_name = "Region";
+    rf.axis = PivotAxis::Row;
+    PivotField af;
+    af.source_name = "Amount";
+    af.axis = PivotAxis::Value;
+    table.mutable_fields().push_back(std::move(rf));
+    table.mutable_fields().push_back(std::move(af));
+    table.mutable_row_field_order() = {0};
+    PivotDataField df;
+    df.name = "Agg";
+    df.field_index = 1;
+    df.aggregation = agg;
+    table.mutable_data_fields().push_back(std::move(df));
+    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+    auto r_or = evaluate(table, cache);
+    EXPECT_TRUE(static_cast<bool>(r_or));
+    return r_or.value();
+  };
+
+  {
+    // +Infinity beats every finite value, so it is the one MAX picks.
+    PivotResult r = run(Aggregation::Max, std::numeric_limits<double>::infinity());
+    ASSERT_TRUE(r.values[0][0][0].is_error());
+    EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Num);
+  }
+  {
+    // -Infinity is smaller than every finite value, so it is the one MIN picks.
+    PivotResult r = run(Aggregation::Min, -std::numeric_limits<double>::infinity());
+    ASSERT_TRUE(r.values[0][0][0].is_error());
+    EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Num);
+  }
+}
+
+TEST(PivotEvaluator, StdDevAndVarFamily) {
+  PivotCache cache = build_basic_cache();
+
+  auto run = [&](Aggregation agg) {
+    PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+    table.mutable_data_fields()[0].aggregation = agg;
+    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+    auto r_or = evaluate(table, cache);
+    EXPECT_TRUE(static_cast<bool>(r_or));
+    return r_or.value();
+  };
+
+  // North n=3, mean = 175/3, ss = sum((x - mean)^2)
+  //   = (100 - 175/3)^2 + (50 - 175/3)^2 + (25 - 175/3)^2
+  //   = (125/3)^2 + (-25/3)^2 + (-100/3)^2
+  //   = 15625/9 + 625/9 + 10000/9
+  //   = 26250/9
+  const double north_ss =
+      (125.0 / 3.0) * (125.0 / 3.0) + (-25.0 / 3.0) * (-25.0 / 3.0) + (-100.0 / 3.0) * (-100.0 / 3.0);
+  // South n=2, mean = 250, ss = (200-250)^2 + (300-250)^2 = 5000
+  const double south_ss = 5000.0;
+
+  {
+    PivotResult r = run(Aggregation::Var);  // sample, divisor n-1
+    const std::size_t north = row_index(r, "North");
+    const std::size_t south = row_index(r, "South");
+    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), north_ss / 2.0);
+    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), south_ss / 1.0);
+  }
+  {
+    PivotResult r = run(Aggregation::VarP);  // population, divisor n
+    const std::size_t north = row_index(r, "North");
+    const std::size_t south = row_index(r, "South");
+    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), north_ss / 3.0);
+    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), south_ss / 2.0);
+  }
+  {
+    PivotResult r = run(Aggregation::StdDev);
+    const std::size_t north = row_index(r, "North");
+    const std::size_t south = row_index(r, "South");
+    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), std::sqrt(north_ss / 2.0));
+    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), std::sqrt(south_ss / 1.0));
+  }
+  {
+    PivotResult r = run(Aggregation::StdDevP);
+    const std::size_t north = row_index(r, "North");
+    const std::size_t south = row_index(r, "South");
+    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), std::sqrt(north_ss / 3.0));
+    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), std::sqrt(south_ss / 2.0));
+  }
+}
+
+TEST(PivotEvaluator, ExtremeDispersionOverflowIsNumError) {
+  const std::vector<Value> equal = {Value::number(1.0e308), Value::number(1.0e308)};
+  for (Aggregation agg : {Aggregation::Var, Aggregation::VarP, Aggregation::StdDev, Aggregation::StdDevP}) {
+    const Value result = apply_aggregation(agg, equal);
+    ASSERT_TRUE(result.is_error()) << static_cast<int>(agg) << ": " << result.debug_to_string();
+    EXPECT_EQ(result.as_error(), ErrorCode::Num) << static_cast<int>(agg);
+  }
+
+  const double max = std::numeric_limits<double>::max();
+  const Value opposing = apply_aggregation(Aggregation::StdDevP, {Value::number(max), Value::number(-max)});
+  ASSERT_TRUE(opposing.is_error()) << opposing.debug_to_string();
+  EXPECT_EQ(opposing.as_error(), ErrorCode::Num);
+}
+
+TEST(PivotEvaluator, AdjacentLargeValuesMatchExcelPopulationVariance) {
+  constexpr double first = 1.0e150;
+  const Value variance =
+      apply_aggregation(Aggregation::VarP, {Value::number(first), Value::number(std::nextafter(first, 0.0))});
+  ASSERT_TRUE(variance.is_number()) << variance.debug_to_string();
+  EXPECT_DOUBLE_EQ(variance.as_number(), 1.650920409798954e+268);
+}
+
+TEST(PivotEvaluator, VarAndStdDevSampleNeedTwoValuesElseDiv0) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"G", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"V", {}});
+
+  auto add = [&](const char* g, double v) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, g));
+    rec.cells.push_back(Value::number(v));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("solo", 42.0);  // single record, sample stats undefined.
+  add("pair", 10.0);
+  add("pair", 20.0);
+
+  auto run = [&](Aggregation agg) {
+    PivotTable table;
+    table.set_pivot_cache_id(1);
+    PivotField gf;
+    gf.source_name = "G";
+    gf.axis = PivotAxis::Row;
+    PivotField vf;
+    vf.source_name = "V";
+    vf.axis = PivotAxis::Value;
+    table.mutable_fields().push_back(std::move(gf));
+    table.mutable_fields().push_back(std::move(vf));
+    table.mutable_row_field_order() = {0};
+    PivotDataField df;
+    df.name = "f";
+    df.field_index = 1;
+    df.aggregation = agg;
+    table.mutable_data_fields().push_back(std::move(df));
+    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+    auto r_or = evaluate(table, cache);
+    EXPECT_TRUE(static_cast<bool>(r_or));
+    return r_or.value();
+  };
+
+  for (Aggregation agg : {Aggregation::Var, Aggregation::StdDev}) {
+    PivotResult r = run(agg);
+    const std::size_t solo = row_index(r, "solo");
+    const std::size_t pair = row_index(r, "pair");
+    ASSERT_NE(solo, static_cast<std::size_t>(-1));
+    ASSERT_NE(pair, static_cast<std::size_t>(-1));
+    ASSERT_TRUE(r.values[solo][0][0].is_error());
+    EXPECT_EQ(r.values[solo][0][0].as_error(), ErrorCode::Div0);
+    EXPECT_TRUE(r.values[pair][0][0].is_number());
+  }
+  for (Aggregation agg : {Aggregation::VarP, Aggregation::StdDevP}) {
+    PivotResult r = run(agg);
+    const std::size_t solo = row_index(r, "solo");
+    const std::size_t pair = row_index(r, "pair");
+    // Population variant accepts n=1 and yields 0.
+    EXPECT_TRUE(r.values[solo][0][0].is_number());
+    EXPECT_DOUBLE_EQ(r.values[solo][0][0].as_number(), 0.0);
+    EXPECT_TRUE(r.values[pair][0][0].is_number());
+  }
+}
+
+TEST(PivotEvaluator, ErrorPropagatesThroughSum) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  auto add = [&](const char* g, Value v) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, g));
+    rec.cells.push_back(v);
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("A", Value::number(10.0));
+  add("A", Value::error(ErrorCode::Div0));
+  add("A", Value::number(20.0));
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField gf;
+  gf.source_name = "Group";
+  gf.axis = PivotAxis::Row;
+  PivotField af;
+  af.source_name = "Amount";
+  af.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(gf));
+  table.mutable_fields().push_back(std::move(af));
+  table.mutable_row_field_order() = {0};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 1;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 1U);
+  ASSERT_TRUE(r.values[0][0][0].is_error());
+  EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Div0);
+}
+
+TEST(PivotEvaluator, CountCountsAnErrorCellInsteadOfReturningIt) {
+  PivotCache cache;
+  PivotTable table = build_count_over_error_table(cache, Aggregation::Count);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Row leaves are A/x, A/y, B/x in hierarchy order; A/x is the one
+  // holding a number and the error, and COUNTA counts both.
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_EQ(r.rows[0].label, "A");
+  ASSERT_EQ(r.values.size(), 3U);
+  ASSERT_TRUE(r.values[0][0][0].is_number()) << "Count returned " << r.values[0][0][0].debug_to_string();
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 2.0);
+
+  // The group subtotal and the grand total run the same aggregation over a
+  // wider record set, so they must not turn into the error either.
+  ASSERT_EQ(r.row_subtotals.size(), 2U);
+  ASSERT_TRUE(r.row_subtotals[0].values[0].is_number());
+  EXPECT_DOUBLE_EQ(r.row_subtotals[0].values[0].as_number(), 3.0);
+  ASSERT_FALSE(r.grand_totals.empty());
+  ASSERT_TRUE(r.grand_totals[0].is_number());
+  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 4.0);
+}
+
+TEST(PivotEvaluator, CountNumbersPassesOverAnErrorCellInsteadOfReturningIt) {
+  PivotCache cache;
+  PivotTable table = build_count_over_error_table(cache, Aggregation::CountNumbers);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // COUNT admits only numeric cells, so the error is passed over rather
+  // than counted -- and still never becomes the result.
+  ASSERT_EQ(r.values.size(), 3U);
+  ASSERT_TRUE(r.values[0][0][0].is_number()) << "CountNumbers returned " << r.values[0][0][0].debug_to_string();
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
+
+  ASSERT_EQ(r.row_subtotals.size(), 2U);
+  ASSERT_TRUE(r.row_subtotals[0].values[0].is_number());
+  EXPECT_DOUBLE_EQ(r.row_subtotals[0].values[0].as_number(), 2.0);
+  ASSERT_FALSE(r.grand_totals.empty());
+  ASSERT_TRUE(r.grand_totals[0].is_number());
+  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 3.0);
+}
+
+TEST(PivotEvaluator, SumOverTheSameFixtureStillPropagatesTheError) {
+  PivotCache cache;
+  PivotTable table = build_count_over_error_table(cache, Aggregation::Sum);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.values.size(), 3U);
+  ASSERT_TRUE(r.values[0][0][0].is_error());
+  EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::NA);
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_evaluator_filter_test.cpp b/tests/unit/pivot/pivot_evaluator_filter_test.cpp
new file mode 100644
index 000000000..61f093825
--- /dev/null
+++ b/tests/unit/pivot/pivot_evaluator_filter_test.cpp
@@ -0,0 +1,467 @@
+// Evaluator value-filter compaction and leaf-index invariants.
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot/record_access.h"
+#include "pivot_evaluator_fixtures.h"
+#include "utils/checked_index.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+using test::owned_text;
+using test::row_index;
+
+PivotCache build_subtotal_grid_cache() {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Year", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  const struct {
+    const char* region;
+    const char* product;
+    double base;
+  } rows[] = {{"North", "A", 1.0}, {"North", "B", 2.0}, {"South", "A", 10.0}, {"South", "B", 20.0}};
+  const struct {
+    const char* year;
+    const char* quarter;
+    double multiplier;
+  } cols[] = {{"2024", "Q1", 1.0}, {"2024", "Q2", 2.0}, {"2025", "Q1", 10.0}, {"2025", "Q2", 20.0}};
+
+  for (const auto& row : rows) {
+    for (const auto& col : cols) {
+      PivotCacheRecord rec;
+      rec.cells.push_back(owned_text(cache, row.region));
+      rec.cells.push_back(owned_text(cache, row.product));
+      rec.cells.push_back(owned_text(cache, col.year));
+      rec.cells.push_back(owned_text(cache, col.quarter));
+      rec.cells.push_back(Value::number(row.base * col.multiplier));
+      cache.mutable_records().push_back(std::move(rec));
+    }
+  }
+  return cache;
+}
+
+// Table over `build_subtotal_grid_cache()`: rows Region -> Product, columns
+// Year -> Quarter, one SUM(Amount) data field.
+PivotTable build_subtotal_grid_table() {
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  const char* names[] = {"Region", "Product", "Year", "Quarter", "Amount"};
+  for (std::size_t i = 0; i < 5; ++i) {
+    PivotField field;
+    field.source_name = names[i];
+    field.axis = i == 4 ? PivotAxis::Value : PivotAxis::Row;
+    table.mutable_fields().push_back(std::move(field));
+  }
+  table.mutable_row_field_order() = {0, 1};
+  table.mutable_col_field_order() = {2, 3};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 4;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  return table;
+}
+
+TEST(PivotEvaluator, ValueTop10FilterSaturatesOutOfDomainCounts) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* region, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("A", 10.0);
+  add("B", 50.0);
+  add("C", 30.0);
+  add("D", 20.0);
+
+  // Returns how many row leaves survive a Top-N filter asking for `requested`.
+  auto rows_kept = [&cache](double requested) -> std::size_t {
+    PivotTable table;
+    table.set_pivot_cache_id(1);
+    PivotField rf;
+    rf.source_name = "Region";
+    rf.axis = PivotAxis::Row;
+    PivotField af;
+    af.source_name = "Amount";
+    af.axis = PivotAxis::Value;
+    table.mutable_fields().push_back(std::move(rf));
+    table.mutable_fields().push_back(std::move(af));
+    table.mutable_row_field_order() = {0};
+    PivotDataField sum;
+    sum.name = "Sum of Amount";
+    sum.field_index = 1;
+    sum.aggregation = Aggregation::Sum;
+    table.mutable_data_fields().push_back(std::move(sum));
+    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+    PivotFilter f;
+    f.axis = PivotAxis::Row;
+    f.field_name = "Region";
+    f.type = FilterType::ValueTop10;
+    f.value = requested;
+    table.mutable_active_filters().push_back(f);
+
+    auto r_or = evaluate(table, cache);
+    EXPECT_TRUE(static_cast<bool>(r_or)) << "requested=" << requested;
+    if (!r_or) {
+      return 0;
+    }
+    return r_or.value().rows.size();
+  };
+
+  // NaN loses every comparison and a negative count asks for nothing.
+  EXPECT_EQ(rows_kept(std::numeric_limits<double>::quiet_NaN()), 0U);
+  EXPECT_EQ(rows_kept(-1.0), 0U);
+  EXPECT_EQ(rows_kept(0.0), 0U);
+  // A count at or beyond the axis keeps every leaf.
+  EXPECT_EQ(rows_kept(1e30), 4U);
+  EXPECT_EQ(rows_kept(std::numeric_limits<double>::infinity()), 4U);
+  EXPECT_EQ(rows_kept(4.0), 4U);
+  // And an ordinary count still ranks.
+  EXPECT_EQ(rows_kept(2.0), 2U);
+}
+
+TEST(PivotEvaluator, RowValueFilterCompactsEveryLeafIndexedStructure) {
+  PivotCache cache = build_subtotal_grid_cache();
+  PivotTable table = build_subtotal_grid_table();
+
+  // Region scores are North=99 and South=990, so Top-1 keeps both South
+  // leaves and prunes the whole North group.
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::ValueTop10;
+  f.value = 1;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Two surviving row leaves; every row-leaf-indexed structure agrees.
+  const std::size_t surviving_rows = 2U;
+  ASSERT_EQ(r.values.size(), surviving_rows);
+  EXPECT_EQ(r.row_leaf_totals.size(), surviving_rows);
+  ASSERT_EQ(r.col_subtotals.size(), 2U);  // One per Year.
+  for (const ColSubtotal& col_subtotal : r.col_subtotals) {
+    EXPECT_EQ(col_subtotal.values.size(), surviving_rows);
+  }
+
+  // The pruned group's subtotal is gone from both the metadata-rich list
+  // and the compact compatibility surface.
+  ASSERT_EQ(r.row_subtotals.size(), 1U);
+  ASSERT_EQ(r.row_subtotals[0].labels.size(), 1U);
+  EXPECT_EQ(r.row_subtotals[0].labels[0], "South");
+  EXPECT_EQ(r.subtotals.size(), 1U);
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+
+  // Cross-axis structures on the surviving subtotal keep the column index
+  // space untouched.
+  EXPECT_EQ(r.row_subtotals[0].col_values.size(), 4U);
+  EXPECT_EQ(r.row_subtotals[0].col_subtotal_values.size(), r.col_subtotals.size());
+
+  // A column subtotal now reads the surviving rows: South/A over 2024 is
+  // 10*(1+2)=30 and South/B is 20*(1+2)=60. Reading the pre-filter index
+  // space would surface the pruned North rows (3 and 6).
+  ASSERT_EQ(r.col_subtotals[0].values[0].size(), 1U);
+  EXPECT_DOUBLE_EQ(r.col_subtotals[0].values[0][0].as_number(), 30.0);
+  EXPECT_DOUBLE_EQ(r.col_subtotals[0].values[1][0].as_number(), 60.0);
+  EXPECT_DOUBLE_EQ(r.col_subtotals[1].values[0][0].as_number(), 300.0);
+  EXPECT_DOUBLE_EQ(r.col_subtotals[1].values[1][0].as_number(), 600.0);
+}
+
+TEST(PivotEvaluator, ColValueFilterCompactsEveryLeafIndexedStructure) {
+  PivotCache cache = build_subtotal_grid_cache();
+  PivotTable table = build_subtotal_grid_table();
+
+  // Year scores are 2024=99 and 2025=990, so Top-1 keeps the 2025 quarters
+  // and prunes the whole 2024 group.
+  PivotFilter f;
+  f.axis = PivotAxis::Col;
+  f.field_name = "Year";
+  f.type = FilterType::ValueTop10;
+  f.value = 1;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Two surviving column leaves; every column-leaf-indexed structure agrees.
+  const std::size_t surviving_cols = 2U;
+  ASSERT_EQ(r.values.size(), 4U);  // The row axis is untouched.
+  for (const auto& row_slot : r.values) {
+    EXPECT_EQ(row_slot.size(), surviving_cols);
+  }
+  EXPECT_EQ(r.col_leaf_totals.size(), surviving_cols);
+  ASSERT_EQ(r.row_subtotals.size(), 2U);  // One per Region.
+  for (const RowSubtotal& row_subtotal : r.row_subtotals) {
+    EXPECT_EQ(row_subtotal.col_values.size(), surviving_cols);
+  }
+
+  // The pruned group's column subtotal is gone, and so is its slot in every
+  // row x column subtotal intersection.
+  ASSERT_EQ(r.col_subtotals.size(), 1U);
+  ASSERT_EQ(r.col_subtotals[0].labels.size(), 1U);
+  EXPECT_EQ(r.col_subtotals[0].labels[0], "2025");
+  for (const RowSubtotal& row_subtotal : r.row_subtotals) {
+    EXPECT_EQ(row_subtotal.col_subtotal_values.size(), r.col_subtotals.size());
+  }
+  ASSERT_EQ(r.cols.size(), 1U);
+  EXPECT_EQ(r.cols[0].label, "2025");
+
+  // North's subtotal row now reads the surviving columns: (1+2)*10=30 at
+  // 2025/Q1 and (1+2)*20=60 at 2025/Q2, with 90 at the 2025 subtotal column.
+  const RowSubtotal& north = r.row_subtotals[0];
+  ASSERT_EQ(north.labels.size(), 1U);
+  ASSERT_EQ(north.labels[0], "North");
+  ASSERT_EQ(north.col_values[0].size(), 1U);
+  EXPECT_DOUBLE_EQ(north.col_values[0][0].as_number(), 30.0);
+  EXPECT_DOUBLE_EQ(north.col_values[1][0].as_number(), 60.0);
+  EXPECT_DOUBLE_EQ(north.col_subtotal_values[0][0].as_number(), 90.0);
+}
+
+TEST(PivotEvaluator, ThreeLevelRowAxisNumbersLeavesAndSubtotalsPerDepth) {
+  PivotCache cache = build_subtotal_grid_cache();
+  PivotTable table = build_subtotal_grid_table();
+  table.mutable_row_field_order() = {0, 1, 2};  // Region / Product / Year.
+  table.mutable_col_field_order() = {3};        // Quarter.
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // 2 regions x 2 products x 2 years = 8 leaves, 2 quarter columns.
+  ASSERT_EQ(r.rows.size(), 2U);
+  ASSERT_EQ(r.rows[0].label, "North");
+  ASSERT_EQ(r.rows[0].children.size(), 2U);
+  ASSERT_EQ(r.rows[0].children[0].label, "A");
+  ASSERT_EQ(r.rows[0].children[0].children.size(), 2U);
+  EXPECT_EQ(r.rows[0].children[0].children[0].label, "2024");
+  EXPECT_EQ(r.rows[0].children[0].children[1].label, "2025");
+  ASSERT_EQ(r.values.size(), 8U);
+  ASSERT_EQ(r.values[0].size(), 2U);
+
+  // Leaf order is DFS pre-order over the three levels; the record buckets
+  // have to follow the same numbering or the values land on the wrong rows.
+  // Cell value is `row base * quarter multiplier` (North/A base 1,
+  // North/B 2, South/A 10, South/B 20; 2024 Q1/Q2 = 1/2, 2025 = 10/20).
+  const std::vector<std::vector<double>> expected = {
+      {1.0, 2.0}, {10.0, 20.0}, {2.0, 4.0}, {20.0, 40.0}, {10.0, 20.0}, {100.0, 200.0}, {20.0, 40.0}, {200.0, 400.0},
+  };
+  for (std::size_t leaf = 0; leaf < expected.size(); ++leaf) {
+    for (std::size_t col = 0; col < 2U; ++col) {
+      EXPECT_DOUBLE_EQ(r.values[leaf][col][0].as_number(), expected[leaf][col]) << "leaf=" << leaf << " col=" << col;
+    }
+  }
+
+  // One subtotal per interior owner: four at Region/Product, two at Region,
+  // emitted in the post-order the row walk produces.
+  ASSERT_EQ(r.row_subtotals.size(), 6U);
+  const std::vector<std::vector<std::string>> expected_labels = {
+      {"North", "A"}, {"North", "B"}, {"North"}, {"South", "A"}, {"South", "B"}, {"South"},
+  };
+  const std::vector<double> expected_totals = {33.0, 66.0, 99.0, 330.0, 660.0, 990.0};
+  for (std::size_t i = 0; i < r.row_subtotals.size(); ++i) {
+    EXPECT_EQ(r.row_subtotals[i].labels, expected_labels[i]) << "subtotal=" << i;
+    EXPECT_EQ(r.row_subtotals[i].depth, expected_labels[i].size() - 1U) << "subtotal=" << i;
+    ASSERT_EQ(r.row_subtotals[i].values.size(), 1U);
+    EXPECT_DOUBLE_EQ(r.row_subtotals[i].values[0].as_number(), expected_totals[i]) << "subtotal=" << i;
+  }
+}
+
+TEST(PivotEvaluator, RowValueFilterCollapsesEmptiedBranchesOfAThreeLevelAxis) {
+  PivotCache cache = build_subtotal_grid_cache();
+  PivotTable table = build_subtotal_grid_table();
+  table.mutable_row_field_order() = {0, 1, 2};
+  table.mutable_col_field_order() = {3};
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  // Year scores across the two quarter columns are 3, 30, 6, 60, 30, 300,
+  // 60, 600. Greater-than-100 keeps South/A/2025 and South/B/2025 only, so
+  // all of North and both 2024 leaves under South disappear.
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Year";
+  f.type = FilterType::ValueGreaterThan;
+  f.value = 100.0;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // The North branch is gone at every depth; South keeps both products but
+  // only their 2025 child.
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  ASSERT_EQ(r.rows[0].children.size(), 2U);
+  for (const AxisHierarchyNode& product : r.rows[0].children) {
+    ASSERT_EQ(product.children.size(), 1U);
+    EXPECT_EQ(product.children[0].label, "2025");
+  }
+
+  ASSERT_EQ(r.values.size(), 2U);
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 100.0);  // South/A/2025 Q1.
+  EXPECT_DOUBLE_EQ(r.values[0][1][0].as_number(), 200.0);  // South/A/2025 Q2.
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 200.0);  // South/B/2025 Q1.
+  EXPECT_DOUBLE_EQ(r.values[1][1][0].as_number(), 400.0);  // South/B/2025 Q2.
+  EXPECT_EQ(r.row_leaf_totals.size(), 2U);
+
+  // Only the owners that still cover a surviving leaf keep a subtotal, and
+  // both the metadata-rich list and the compact surface agree.
+  ASSERT_EQ(r.row_subtotals.size(), 3U);
+  const std::vector<std::vector<std::string>> expected_labels = {{"South", "A"}, {"South", "B"}, {"South"}};
+  for (std::size_t i = 0; i < r.row_subtotals.size(); ++i) {
+    EXPECT_EQ(r.row_subtotals[i].labels, expected_labels[i]) << "subtotal=" << i;
+  }
+  EXPECT_EQ(r.subtotals.size(), 3U);
+  // A surviving subtotal is re-aggregated from just its surviving leaves,
+  // matching Excel's own Top-N grand total (verified against
+  // pivot_value_date_filters.xlsx / pivot_recurring_period_filter.xlsx):
+  // South/A = 100 + 200 = 300; South (both products) = 300 + 200 + 400 = 900.
+  EXPECT_DOUBLE_EQ(r.row_subtotals[0].values[0].as_number(), 300.0);
+  EXPECT_DOUBLE_EQ(r.row_subtotals[2].values[0].as_number(), 900.0);
+}
+
+TEST(PivotEvaluator, ValueFilterRecalculatesGrandTotalFromSurvivingLeavesOnly) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/true, /*cols=*/true);
+
+  // North totals 175 (100+50+25), South totals 500 (200+300). Top-1
+  // keeps South only.
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::ValueTop10;
+  f.value = 1;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  ASSERT_FALSE(r.grand_totals.empty());
+  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 500.0);
+  ASSERT_TRUE(r.grand_total.is_number());
+  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 500.0);
+}
+
+TEST(PivotEvaluator, ValueFiltersPreserveCustomRowSubtotalAggregations) {
+  struct Case {
+    const char* field;
+    PivotAxis axis;
+    double threshold;
+    double north_average;
+    double north_max;
+    double north_column_base;
+    std::size_t subtotal_count;
+    std::vector<double> multipliers;
+  };
+  const Case cases[] = {
+      {"Product", PivotAxis::Row, 0.0, 12.375, 40.0, 1.5, 4U, {1.0, 2.0, 10.0, 20.0}},
+      {"Product", PivotAxis::Row, 500.0, 16.5, 40.0, 2.0, 2U, {1.0, 2.0, 10.0, 20.0}},
+      {"Year", PivotAxis::Col, 500.0, 22.5, 40.0, 1.5, 4U, {10.0, 20.0}},
+  };
+  for (const Case& c : cases) {
+    SCOPED_TRACE(std::string(c.field) + ":" + std::to_string(c.threshold));
+    PivotCache cache = build_subtotal_grid_cache();
+    PivotTable table = build_subtotal_grid_table();
+    table.mutable_fields()[0].subtotal_fns = {SubtotalFn::Average, SubtotalFn::Max};
+    PivotFilter filter;
+    filter.axis = c.axis;
+    filter.field_name = c.field;
+    filter.type = FilterType::ValueGreaterThan;
+    filter.value = c.threshold;
+    table.mutable_active_filters().push_back(std::move(filter));
+
+    auto evaluated = evaluate(table, cache);
+    ASSERT_TRUE(static_cast<bool>(evaluated));
+    const PivotResult& result = evaluated.value();
+    ASSERT_EQ(result.row_subtotals.size(), c.subtotal_count);
+    ASSERT_EQ(result.subtotals.size(), c.subtotal_count);
+    for (std::size_t i = 0; i < result.row_subtotals.size(); ++i) {
+      const RowSubtotal& subtotal = result.row_subtotals[i];
+      ASSERT_EQ(subtotal.labels.size(), 1U);
+      if (c.subtotal_count == 2U) {
+        EXPECT_EQ(subtotal.labels[0], "South");
+      }
+      const double region_scale = subtotal.labels[0] == "North" ? 1.0 : 10.0;
+      EXPECT_TRUE(subtotal.labels[0] == "North" || subtotal.labels[0] == "South");
+      const bool average = i % 2U == 0U;
+      const double total = (average ? c.north_average : c.north_max) * region_scale;
+      ASSERT_EQ(subtotal.values.size(), 1U);
+      ASSERT_TRUE(subtotal.values[0].is_number());
+      EXPECT_DOUBLE_EQ(subtotal.values[0].as_number(), total);
+      ASSERT_EQ(result.subtotals[i].size(), 1U);
+      EXPECT_DOUBLE_EQ(result.subtotals[i][0].as_number(), total);
+      ASSERT_EQ(subtotal.col_values.size(), c.multipliers.size());
+      for (std::size_t col = 0; col < c.multipliers.size(); ++col) {
+        ASSERT_EQ(subtotal.col_values[col].size(), 1U);
+        ASSERT_TRUE(subtotal.col_values[col][0].is_number());
+        const double column_base = average ? c.north_column_base : 2.0;
+        EXPECT_DOUBLE_EQ(subtotal.col_values[col][0].as_number(), column_base * region_scale * c.multipliers[col]);
+      }
+    }
+  }
+}
+
+TEST(CheckedIndex, RejectsEveryDoubleOutsideTheContainerBound) {
+  constexpr double kNaN = std::numeric_limits<double>::quiet_NaN();
+  constexpr double kInf = std::numeric_limits<double>::infinity();
+  constexpr std::size_t kLimit = 4;
+
+  EXPECT_FALSE(index_from_double(kNaN, kLimit).has_value());
+  EXPECT_FALSE(index_from_double(kInf, kLimit).has_value());
+  EXPECT_FALSE(index_from_double(-kInf, kLimit).has_value());
+  EXPECT_FALSE(index_from_double(-1.0, kLimit).has_value());
+  EXPECT_FALSE(index_from_double(static_cast<double>(kLimit), kLimit).has_value());
+  EXPECT_FALSE(index_from_double(static_cast<double>(kLimit) + 1.0, kLimit).has_value());
+  EXPECT_FALSE(index_from_double(1e30, kLimit).has_value());
+  EXPECT_FALSE(index_from_double(9007199254740992.0, kLimit).has_value());  // 2^53.
+
+  // In-domain values, including the negative zero that compares equal to 0.
+  EXPECT_EQ(index_from_double(0.0, kLimit), std::optional<std::size_t>{0});
+  EXPECT_EQ(index_from_double(-0.0, kLimit), std::optional<std::size_t>{0});
+  EXPECT_EQ(index_from_double(0.5, kLimit), std::optional<std::size_t>{0});
+  EXPECT_EQ(index_from_double(static_cast<double>(kLimit) - 1.0, kLimit), std::optional<std::size_t>{kLimit - 1});
+
+  // An empty container has no valid index at all.
+  EXPECT_FALSE(index_from_double(0.0, 0U).has_value());
+  EXPECT_FALSE(index_from_double(kNaN, 0U).has_value());
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_evaluator_grouping_test.cpp b/tests/unit/pivot/pivot_evaluator_grouping_test.cpp
new file mode 100644
index 000000000..fee582ae8
--- /dev/null
+++ b/tests/unit/pivot/pivot_evaluator_grouping_test.cpp
@@ -0,0 +1,871 @@
+// Axis grouping, placeholders, date buckets, and malformed-axis handling.
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <map>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot/record_access.h"
+#include "pivot/value_order.h"
+#include "pivot_evaluator_fixtures.h"
+#include "utils/date_time.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+using test::owned_text;
+using test::row_index;
+
+PivotCache build_date_cache() {
+  // Excel serials (1900 leap-bug aware):
+  //   2018-12-31 -> 43465  (Heisei)
+  //   2019-04-30 -> 43585  (Heisei, last day of era)
+  //   2019-05-01 -> 43586  (Reiwa, first day of era)
+  //   2019-12-31 -> 43830  (Reiwa)
+  //   2024-03-15 -> 45366  (Reiwa)
+  //   2024-07-04 -> 45477  (Reiwa)
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Date", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](double serial, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(Value::number(serial));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add(43465.0, 10.0);
+  add(43585.0, 20.0);
+  add(43586.0, 40.0);
+  add(43830.0, 80.0);
+  add(45366.0, 160.0);
+  add(45477.0, 320.0);
+  return cache;
+}
+
+PivotTable build_date_grouped_table(DateGrouping g, CalendarSystem cal) {
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField date_f;
+  date_f.source_name = "Date";
+  date_f.axis = PivotAxis::Row;
+  PivotDateGroup dg;
+  dg.granularity = g;
+  dg.calendar = cal;
+  date_f.date_group = dg;
+  PivotField amount_f;
+  amount_f.source_name = "Amount";
+  amount_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(date_f));
+  table.mutable_fields().push_back(std::move(amount_f));
+  table.mutable_row_field_order() = {0};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 1;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  return table;
+}
+
+PivotCache build_two_field_cache() {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Date", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  return cache;
+}
+
+void push_record(PivotCache& cache, double serial, double amount) {
+  PivotCacheRecord rec;
+  rec.cells.push_back(Value::number(serial));
+  rec.cells.push_back(Value::number(amount));
+  cache.mutable_records().push_back(std::move(rec));
+}
+PivotCache build_days_interval_cache() {
+  PivotCache cache = build_two_field_cache();
+  for (double serial = 0.0; serial <= 70.0; serial += 1.0) {
+    push_record(cache, serial, 1.0);
+  }
+  return cache;
+}
+
+PivotTable build_days_grouped_table(std::optional<double> start_serial, std::uint32_t interval_days = 7,
+                                    std::optional<double> end_serial = std::nullopt) {
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField date_f;
+  date_f.source_name = "Date";
+  date_f.axis = PivotAxis::Row;
+  PivotDateGroup dg;
+  dg.granularity = DateGrouping::Days;
+  dg.interval_days = interval_days;
+  dg.start_serial = start_serial;
+  dg.end_serial = end_serial;
+  date_f.date_group = dg;
+  PivotField amount_f;
+  amount_f.source_name = "Amount";
+  amount_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(date_f));
+  table.mutable_fields().push_back(std::move(amount_f));
+  table.mutable_row_field_order() = {0};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 1;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  return table;
+}
+
+TEST(PivotEvaluator, SparseRowColumnIntersectionIsBlank) {
+  PivotCache cache = build_basic_cache();
+  auto& records = cache.mutable_records();
+  records.erase(std::remove_if(records.begin(), records.end(),
+                               [](const PivotCacheRecord& record) {
+                                 return record.cells[0].as_text() == "North" && record.cells[1].as_text() == "Gadget";
+                               }),
+                records.end());
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  const PivotResult& result = result_or.value();
+  const std::size_t north = row_index(result, "North");
+  ASSERT_NE(north, static_cast<std::size_t>(-1));
+  ASSERT_EQ(result.cols.size(), 2U);
+  ASSERT_EQ(result.cols[0].label, "Gadget");
+  EXPECT_TRUE(result.values[north][0][0].is_blank());
+}
+
+TEST(PivotEvaluator, UnresolvedHiddenItemDoesNotFilterBlankRecords) {
+  PivotCache cache = build_basic_cache();
+  PivotCacheRecord blank_region;
+  blank_region.cells = {Value::blank(), owned_text(cache, "Widget"), Value::number(75.0)};
+  cache.mutable_records().push_back(std::move(blank_region));
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  PivotItem malformed_hidden;
+  malformed_hidden.visible = false;
+  malformed_hidden.has_cache_index = true;
+  malformed_hidden.cache_index = 999U;
+  table.mutable_fields()[0].items.push_back(std::move(malformed_hidden));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  const PivotResult& result = result_or.value();
+  const std::size_t blank_leaf = row_index(result, PivotLayoutOptions{}.blank_item_label);
+  ASSERT_NE(blank_leaf, static_cast<std::size_t>(-1));
+  EXPECT_DOUBLE_EQ(result.values[blank_leaf][0][0].as_number(), 75.0);
+}
+
+TEST(PivotEvaluator, BlankAxisItemTakesThePlaceholderLabel) {
+  PivotCache cache = build_basic_cache();
+  PivotCacheRecord blank_region;
+  blank_region.cells = {Value::blank(), owned_text(cache, "Widget"), Value::number(75.0)};
+  cache.mutable_records().push_back(std::move(blank_region));
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  const PivotResult& result = result_or.value();
+
+  for (const AxisHierarchyNode& row : result.rows) {
+    EXPECT_FALSE(row.label.empty());
+  }
+  const std::size_t blank_leaf = row_index(result, PivotLayoutOptions{}.blank_item_label);
+  ASSERT_NE(blank_leaf, static_cast<std::size_t>(-1));
+  EXPECT_DOUBLE_EQ(result.values[blank_leaf][0][0].as_number(), 75.0);
+  // The named groups are untouched.
+  EXPECT_NE(row_index(result, "North"), static_cast<std::size_t>(-1));
+  EXPECT_NE(row_index(result, "South"), static_cast<std::size_t>(-1));
+}
+
+TEST(PivotEvaluator, BlankAxisItemPlaceholderComesFromTheSuppliedVocabulary) {
+  PivotCache cache = build_basic_cache();
+  PivotCacheRecord blank_region;
+  blank_region.cells = {Value::blank(), owned_text(cache, "Widget"), Value::number(75.0)};
+  cache.mutable_records().push_back(std::move(blank_region));
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+
+  PivotLayoutOptions options;
+  options.blank_item_label = "<none>";
+  auto result_or = evaluate(table, cache, options);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  EXPECT_NE(row_index(result_or.value(), "<none>"), static_cast<std::size_t>(-1));
+}
+
+TEST(PivotEvaluator, BlankGroupSubtotalCarriesThePlaceholderLabel) {
+  PivotCache cache = build_basic_cache();
+  PivotCacheRecord blank_widget;
+  blank_widget.cells = {Value::blank(), owned_text(cache, "Widget"), Value::number(75.0)};
+  cache.mutable_records().push_back(std::move(blank_widget));
+  PivotCacheRecord blank_gadget;
+  blank_gadget.cells = {Value::blank(), owned_text(cache, "Gadget"), Value::number(25.0)};
+  cache.mutable_records().push_back(std::move(blank_gadget));
+  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
+
+  PivotLayoutOptions options;
+  options.blank_item_label = "<no-value>";
+  auto result_or = evaluate(table, cache, options);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  const PivotResult& result = result_or.value();
+
+  bool saw_blank_subtotal = false;
+  for (const RowSubtotal& subtotal : result.row_subtotals) {
+    ASSERT_FALSE(subtotal.labels.empty());
+    if (subtotal.labels[0] == options.blank_item_label) {
+      saw_blank_subtotal = true;
+      EXPECT_DOUBLE_EQ(subtotal.values[0].as_number(), 100.0);  // 75 + 25.
+    }
+    EXPECT_FALSE(subtotal.labels[0].empty());
+  }
+  EXPECT_TRUE(saw_blank_subtotal);
+}
+
+TEST(PivotEvaluator, DateGroupingByYearGregorian) {
+  PivotCache cache = build_date_cache();
+  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Gregorian);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Three Gregorian years: 2018, 2019, 2024 (chronological).
+  ASSERT_EQ(r.rows.size(), 3U);
+  EXPECT_EQ(r.rows[0].label, "2018");
+  EXPECT_EQ(r.rows[1].label, "2019");
+  EXPECT_EQ(r.rows[2].label, "2024");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 20.0 + 40.0 + 80.0);
+  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 160.0 + 320.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByQuarterGregorian) {
+  PivotCache cache = build_date_cache();
+  PivotTable table = build_date_grouped_table(DateGrouping::Quarter, CalendarSystem::Gregorian);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // 2018-Q4 (Dec), 2019-Q2 (Apr+May), 2019-Q4 (Dec), 2024-Q1 (Mar), 2024-Q3 (Jul).
+  ASSERT_EQ(r.rows.size(), 5U);
+  EXPECT_EQ(r.rows[0].label, "2018-Q4");
+  EXPECT_EQ(r.rows[1].label, "2019-Q2");
+  EXPECT_EQ(r.rows[2].label, "2019-Q4");
+  EXPECT_EQ(r.rows[3].label, "2024-Q1");
+  EXPECT_EQ(r.rows[4].label, "2024-Q3");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 20.0 + 40.0);
+  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 80.0);
+  EXPECT_DOUBLE_EQ(r.values[3][0][0].as_number(), 160.0);
+  EXPECT_DOUBLE_EQ(r.values[4][0][0].as_number(), 320.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByMonthGregorian) {
+  PivotCache cache = build_date_cache();
+  PivotTable table = build_date_grouped_table(DateGrouping::Month, CalendarSystem::Gregorian);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Six distinct months across the dataset.
+  ASSERT_EQ(r.rows.size(), 6U);
+  EXPECT_EQ(r.rows[0].label, "2018-12");
+  EXPECT_EQ(r.rows[1].label, "2019-04");
+  EXPECT_EQ(r.rows[2].label, "2019-05");
+  EXPECT_EQ(r.rows[3].label, "2019-12");
+  EXPECT_EQ(r.rows[4].label, "2024-03");
+  EXPECT_EQ(r.rows[5].label, "2024-07");
+}
+
+TEST(PivotEvaluator, DateGroupingByDay) {
+  PivotCache cache = build_date_cache();
+  PivotTable table = build_date_grouped_table(DateGrouping::Day, CalendarSystem::Gregorian);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Each record is a distinct day -> 6 leaves in chronological order.
+  ASSERT_EQ(r.rows.size(), 6U);
+  EXPECT_EQ(r.rows[0].label, "2018-12-31");
+  EXPECT_EQ(r.rows[1].label, "2019-04-30");
+  EXPECT_EQ(r.rows[2].label, "2019-05-01");
+  EXPECT_EQ(r.rows[3].label, "2019-12-31");
+  EXPECT_EQ(r.rows[4].label, "2024-03-15");
+  EXPECT_EQ(r.rows[5].label, "2024-07-04");
+}
+
+TEST(PivotEvaluator, DateGroupingByYearJapaneseCalendar) {
+  PivotCache cache = build_date_cache();
+  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Japanese);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // 2018 -> Heisei 30, 2019-04-30 -> Heisei 31, 2019-05-01 -> Reiwa 1,
+  // 2019-12-31 -> Reiwa 1, 2024 -> Reiwa 6.
+  // Buckets in chronological order: 平成30 / 平成31 / 令和1 / 令和6.
+  ASSERT_EQ(r.rows.size(), 4U);
+  // 平成 = E5 B9 B3 E6 88 90, 令和 = E4 BB A4 E5 92 8C, 年 = E5 B9 B4
+  EXPECT_EQ(r.rows[0].label, std::string("\xE5\xB9\xB3\xE6\x88\x90") + "30" + "\xE5\xB9\xB4");
+  EXPECT_EQ(r.rows[1].label, std::string("\xE5\xB9\xB3\xE6\x88\x90") + "31" + "\xE5\xB9\xB4");
+  EXPECT_EQ(r.rows[2].label, std::string("\xE4\xBB\xA4\xE5\x92\x8C") + "1" + "\xE5\xB9\xB4");
+  EXPECT_EQ(r.rows[3].label, std::string("\xE4\xBB\xA4\xE5\x92\x8C") + "6" + "\xE5\xB9\xB4");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 10.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 20.0);
+  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 40.0 + 80.0);
+  EXPECT_DOUBLE_EQ(r.values[3][0][0].as_number(), 160.0 + 320.0);
+}
+
+TEST(PivotEvaluator, DateGroupingNonNumericPassesThrough) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Date", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  // A blank (not a serial) should not crash; bucket_date is only invoked
+  // for numeric values.
+  PivotCacheRecord rec;
+  rec.cells.push_back(Value::blank());
+  rec.cells.push_back(Value::number(42.0));
+  cache.mutable_records().push_back(std::move(rec));
+
+  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Gregorian);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  // The single blank-keyed bucket survives without exploding; label is the
+  // empty string (per `display_string` for Blank).
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+}
+
+TEST(PivotEvaluator, DateGroupingByHour) {
+  // Two records on 2024-03-15 within different hours, plus a third in the
+  // same hour as the second so the second bucket sums two rows.
+  const double base = 45366.0;  // 2024-03-15
+  PivotCache cache = build_two_field_cache();
+  push_record(cache, base + 9.0 / 24.0 + 30.0 / 1440.0, 1.0);   // 09:30
+  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0, 2.0);   // 10:05
+  push_record(cache, base + 10.0 / 24.0 + 45.0 / 1440.0, 4.0);  // 10:45
+
+  PivotTable table = build_date_grouped_table(DateGrouping::Hour, CalendarSystem::Gregorian);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_EQ(r.rows[0].label, "2024-03-15 09");
+  EXPECT_EQ(r.rows[1].label, "2024-03-15 10");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 2.0 + 4.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByMinute) {
+  // Two minutes within the same hour; chronological ordering is preserved.
+  const double base = 45366.0;  // 2024-03-15
+  PivotCache cache = build_two_field_cache();
+  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0, 1.0);   // 10:05
+  push_record(cache, base + 10.0 / 24.0 + 45.0 / 1440.0, 2.0);  // 10:45
+  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0, 4.0);   // 10:05 again
+
+  PivotTable table = build_date_grouped_table(DateGrouping::Minute, CalendarSystem::Gregorian);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_EQ(r.rows[0].label, "2024-03-15 10:05");
+  EXPECT_EQ(r.rows[1].label, "2024-03-15 10:45");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0 + 4.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 2.0);
+}
+
+TEST(PivotEvaluator, DateGroupingBySecond) {
+  // Two seconds within the same minute.
+  const double base = 45366.0;  // 2024-03-15
+  PivotCache cache = build_two_field_cache();
+  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0 + 12.0 / 86400.0, 1.0);  // 10:05:12
+  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0 + 47.0 / 86400.0, 2.0);  // 10:05:47
+  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0 + 12.0 / 86400.0, 4.0);  // 10:05:12 again
+
+  PivotTable table = build_date_grouped_table(DateGrouping::Second, CalendarSystem::Gregorian);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_EQ(r.rows[0].label, "2024-03-15 10:05:12");
+  EXPECT_EQ(r.rows[1].label, "2024-03-15 10:05:47");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0 + 4.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 2.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByYearHonorsDate1904Epoch) {
+  PivotCache cache = build_two_field_cache();
+  push_record(cache, date_time::serial_from_ymd(2024, 3, 15, /*date1904=*/true), 10.0);
+  push_record(cache, date_time::serial_from_ymd(2023, 6, 1, /*date1904=*/true), 20.0);
+
+  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Gregorian);
+  PivotFilterEnv env;
+  env.date1904 = true;
+  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_EQ(r.rows[0].label, "2023");
+  EXPECT_EQ(r.rows[1].label, "2024");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 20.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 10.0);
+}
+
+TEST(PivotEvaluator, DateGroupingInvalidSerialsRemainDistinctAndAggregate) {
+  PivotCache cache = build_two_field_cache();
+  const double last_valid = date_time::serial_from_ymd(9999, 12U, 31U);
+  const std::vector<std::pair<double, double>> cases = {
+      {-std::numeric_limits<double>::infinity(), 1.0},
+      {std::numeric_limits<double>::infinity(), 2.0},
+      {std::numeric_limits<double>::quiet_NaN(), 3.0},
+      {std::numeric_limits<double>::max(), 4.0},
+      {0.75, 5.0},
+      {last_valid + 0.75, 6.0},
+      {last_valid + 1.0, 7.0},
+  };
+  for (const auto& [serial, amount] : cases) {
+    push_record(cache, serial, amount);
+  }
+
+  PivotTable table = build_date_grouped_table(DateGrouping::Day, CalendarSystem::Gregorian);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), cases.size());
+
+  std::map<std::string, double> amount_by_label;
+  for (std::size_t i = 0; i < r.rows.size(); ++i) {
+    ASSERT_EQ(r.values[i].size(), 1U);
+    ASSERT_EQ(r.values[i][0].size(), 1U);
+    ASSERT_TRUE(r.values[i][0][0].is_number());
+    EXPECT_TRUE(amount_by_label.emplace(r.rows[i].label, r.values[i][0][0].as_number()).second)
+        << "duplicate label=" << r.rows[i].label;
+  }
+  const auto expect_amount = [&](const std::string& label, double amount) {
+    const auto it = amount_by_label.find(label);
+    ASSERT_NE(it, amount_by_label.end()) << "missing label=" << label;
+    EXPECT_DOUBLE_EQ(it->second, amount) << "label=" << label;
+  };
+  expect_amount(display_string(Value::number(-std::numeric_limits<double>::infinity())), 1.0);
+  expect_amount(display_string(Value::number(std::numeric_limits<double>::infinity())), 2.0);
+  expect_amount(display_string(Value::number(std::numeric_limits<double>::quiet_NaN())), 3.0);
+  expect_amount(display_string(Value::number(std::numeric_limits<double>::max())), 4.0);
+  expect_amount("1899-12-31", 5.0);
+  expect_amount("9999-12-31", 6.0);
+  expect_amount(display_string(Value::number(last_valid + 1.0)), 7.0);
+}
+
+TEST(PivotEvaluator, DateGroupingRawSerialNeverMergesWithBucketKey) {
+  // Raw 3000000 is outside the date domain; it must stay apart from the
+  // Minute bucket whose index is also 3000000 and sort after valid buckets.
+  PivotCache cache = build_two_field_cache();
+  push_record(cache, 3000000.5 / 1440.0, 1.0);                         // Minute index 3000000
+  push_record(cache, 3000000.0, 2.0);                                  // Raw invalid serial
+  push_record(cache, date_time::serial_from_ymd(2024, 3U, 15U), 4.0);  // Later valid minute
+
+  PivotTable table = build_date_grouped_table(DateGrouping::Minute, CalendarSystem::Gregorian);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 3U);
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 4.0);
+  EXPECT_EQ(r.rows[2].label, display_string(Value::number(3000000.0)));
+  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 2.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByYearInvalidSerialsRemainDistinctAndAggregate) {
+  PivotCache cache = build_two_field_cache();
+  push_record(cache, -std::numeric_limits<double>::infinity(), 1.0);
+  push_record(cache, std::numeric_limits<double>::infinity(), 2.0);
+  push_record(cache, std::numeric_limits<double>::quiet_NaN(), 3.0);
+  push_record(cache, std::numeric_limits<double>::max(), 4.0);
+  push_record(cache, date_time::serial_from_ymd(2024, 3U, 15U), 5.0);
+
+  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Gregorian);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 5U);
+
+  std::map<std::string, double> amount_by_label;
+  for (std::size_t i = 0; i < r.rows.size(); ++i) {
+    ASSERT_EQ(r.values[i].size(), 1U);
+    ASSERT_EQ(r.values[i][0].size(), 1U);
+    ASSERT_TRUE(amount_by_label.emplace(r.rows[i].label, r.values[i][0][0].as_number()).second)
+        << "duplicate label=" << r.rows[i].label;
+  }
+  EXPECT_DOUBLE_EQ(amount_by_label.at(display_string(Value::number(-std::numeric_limits<double>::infinity()))), 1.0);
+  EXPECT_DOUBLE_EQ(amount_by_label.at(display_string(Value::number(std::numeric_limits<double>::infinity()))), 2.0);
+  EXPECT_DOUBLE_EQ(amount_by_label.at(display_string(Value::number(std::numeric_limits<double>::quiet_NaN()))), 3.0);
+  EXPECT_DOUBLE_EQ(amount_by_label.at(display_string(Value::number(std::numeric_limits<double>::max()))), 4.0);
+  EXPECT_DOUBLE_EQ(amount_by_label.at("2024"), 5.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysIntervalAutoStart) {
+  PivotCache cache = build_days_interval_cache();
+  PivotTable table = build_days_grouped_table(/*start_serial=*/std::nullopt);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Ten full 7-day buckets from the data minimum (serial 0) plus one
+  // trailing bucket clipped to the resolved auto End (data max + 1),
+  // which is one day past the last record (serial 70 = "1900/3/10").
+  ASSERT_EQ(r.rows.size(), 11U);
+  EXPECT_EQ(r.rows[0].label, "1900/1/0 - 1900/1/6");
+  EXPECT_EQ(r.rows[1].label, "1900/1/7 - 1900/1/13");
+  EXPECT_EQ(r.rows[2].label, "1900/1/14 - 1900/1/20");
+  EXPECT_EQ(r.rows[3].label, "1900/1/21 - 1900/1/27");
+  EXPECT_EQ(r.rows[4].label, "1900/1/28 - 1900/2/3");
+  EXPECT_EQ(r.rows[5].label, "1900/2/4 - 1900/2/10");
+  EXPECT_EQ(r.rows[6].label, "1900/2/11 - 1900/2/17");
+  EXPECT_EQ(r.rows[7].label, "1900/2/18 - 1900/2/24");
+  EXPECT_EQ(r.rows[8].label, "1900/2/25 - 1900/3/2");
+  EXPECT_EQ(r.rows[9].label, "1900/3/3 - 1900/3/9");
+  EXPECT_EQ(r.rows[10].label, "1900/3/10 - 1900/3/11");
+  for (std::size_t i = 0; i < 10; ++i) {
+    EXPECT_DOUBLE_EQ(r.values[i][0][0].as_number(), 7.0) << "bucket " << i;
+  }
+  EXPECT_DOUBLE_EQ(r.values[10][0][0].as_number(), 1.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysIntervalExplicitStartEqualsMinMatchesAuto) {
+  // Start=0 explicit coincides with the data minimum, so Excel renders the
+  // identical bucket set as the auto case above.
+  PivotCache cache = build_days_interval_cache();
+  PivotTable table = build_days_grouped_table(/*start_serial=*/0.0);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 11U);
+  EXPECT_EQ(r.rows[0].label, "1900/1/0 - 1900/1/6");
+  EXPECT_EQ(r.rows[10].label, "1900/3/10 - 1900/3/11");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 7.0);
+  EXPECT_DOUBLE_EQ(r.values[10][0][0].as_number(), 1.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysIntervalExplicitStartAboveMinAddsCatchAll) {
+  // Start=1 is one past the data minimum (serial 0): a catch-all bucket
+  // absorbs everything below it, and since (71-1) records divide evenly
+  // by 7 the trailing regular bucket is NOT clipped here, unlike the
+  // auto/Start=0 case above.
+  PivotCache cache = build_days_interval_cache();
+  PivotTable table = build_days_grouped_table(/*start_serial=*/1.0);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 11U);
+  EXPECT_EQ(r.rows[0].label, "<1900/1/1");
+  EXPECT_EQ(r.rows[1].label, "1900/1/1 - 1900/1/7");
+  EXPECT_EQ(r.rows[2].label, "1900/1/8 - 1900/1/14");
+  EXPECT_EQ(r.rows[3].label, "1900/1/15 - 1900/1/21");
+  EXPECT_EQ(r.rows[4].label, "1900/1/22 - 1900/1/28");
+  EXPECT_EQ(r.rows[5].label, "1900/1/29 - 1900/2/4");
+  EXPECT_EQ(r.rows[6].label, "1900/2/5 - 1900/2/11");
+  EXPECT_EQ(r.rows[7].label, "1900/2/12 - 1900/2/18");
+  EXPECT_EQ(r.rows[8].label, "1900/2/19 - 1900/2/25");
+  EXPECT_EQ(r.rows[9].label, "1900/2/26 - 1900/3/3");
+  EXPECT_EQ(r.rows[10].label, "1900/3/4 - 1900/3/10");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
+  for (std::size_t i = 1; i < 11; ++i) {
+    EXPECT_DOUBLE_EQ(r.values[i][0][0].as_number(), 7.0) << "bucket " << i;
+  }
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysIntervalExplicitStartDeepInDataClipsLastBucket) {
+  // Start=61 puts 61 of the 71 records into the catch-all; the trailing
+  // regular bucket clips to the resolved auto End (data max + 1), not to
+  // the true data max, so its label spans one day past the last record.
+  PivotCache cache = build_days_interval_cache();
+  PivotTable table = build_days_grouped_table(/*start_serial=*/61.0);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 3U);
+  EXPECT_EQ(r.rows[0].label, "<1900/3/1");
+  EXPECT_EQ(r.rows[1].label, "1900/3/1 - 1900/3/7");
+  EXPECT_EQ(r.rows[2].label, "1900/3/8 - 1900/3/11");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 61.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 7.0);
+  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 3.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysIntervalExplicitEndAboveDataMaxAddsCatchAll) {
+  // Mirror image of ExplicitStartAboveMinAddsCatchAll: an explicit End
+  // (60) short of the data maximum (70) collapses everything above it
+  // into one ">1900/2/29" catch-all, and the last regular bucket clips
+  // to End the same way the auto-End case clips to the data maximum.
+  // Serial 60 is "1900/2/29" (Excel's 1900 system has a phantom leap
+  // day real Gregorian 1900 does not), not "1900/3/1" -- confirmed by
+  // pivot_week_1900's own auto-End bucket "1900/2/25 - 1900/3/2",
+  // which spans serials 56-62 including the ghost day. Not in the
+  // fixture itself (which only varies Start, never End); label shape
+  // mirrors the measured `<start` bucket, but `>end` itself is
+  // unmeasured.
+  PivotCache cache = build_days_interval_cache();
+  PivotTable table = build_days_grouped_table(/*start_serial=*/std::nullopt, /*interval_days=*/7,
+                                              /*end_serial=*/60.0);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 10U);
+  EXPECT_EQ(r.rows[0].label, "1900/1/0 - 1900/1/6");
+  EXPECT_EQ(r.rows[7].label, "1900/2/18 - 1900/2/24");
+  EXPECT_EQ(r.rows[8].label, "1900/2/25 - 1900/2/29");
+  EXPECT_EQ(r.rows[9].label, ">1900/2/29");
+  for (std::size_t i = 0; i < 8; ++i) {
+    EXPECT_DOUBLE_EQ(r.values[i][0][0].as_number(), 7.0) << "bucket " << i;
+  }
+  EXPECT_DOUBLE_EQ(r.values[8][0][0].as_number(), 5.0);   // 1900/2/25..1900/3/1: 5 records.
+  EXPECT_DOUBLE_EQ(r.values[9][0][0].as_number(), 10.0);  // 1900/3/2..1900/3/11: 10 records.
+}
+
+TEST(PivotEvaluator, DateGroupingDaysCatchallsDoNotMergeRawNonfiniteValues) {
+  PivotCache cache = build_two_field_cache();
+  push_record(cache, -std::numeric_limits<double>::infinity(), 1.0);
+  push_record(cache, std::numeric_limits<double>::infinity(), 2.0);
+  push_record(cache, std::numeric_limits<double>::quiet_NaN(), 3.0);
+  push_record(cache, std::numeric_limits<double>::max(), 4.0);
+  push_record(cache, 0.0, 5.0);   // Before the explicit Start.
+  push_record(cache, 10.0, 6.0);  // After the explicit End.
+
+  PivotTable table = build_days_grouped_table(/*start_serial=*/5.0, /*interval_days=*/1, /*end_serial=*/5.0);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 6U);
+
+  std::map<std::string, double> amount_by_label;
+  for (std::size_t i = 0; i < r.rows.size(); ++i) {
+    ASSERT_EQ(r.values[i].size(), 1U);
+    ASSERT_EQ(r.values[i][0].size(), 1U);
+    ASSERT_TRUE(r.values[i][0][0].is_number());
+    ASSERT_TRUE(amount_by_label.emplace(r.rows[i].label, r.values[i][0][0].as_number()).second)
+        << "duplicate label=" << r.rows[i].label;
+  }
+  const auto expect_amount = [&](const std::string& label, double amount) {
+    const auto it = amount_by_label.find(label);
+    ASSERT_NE(it, amount_by_label.end()) << "missing label=" << label;
+    EXPECT_DOUBLE_EQ(it->second, amount) << "label=" << label;
+  };
+  expect_amount(display_string(Value::number(-std::numeric_limits<double>::infinity())), 1.0);
+  expect_amount(display_string(Value::number(std::numeric_limits<double>::infinity())), 2.0);
+  expect_amount(display_string(Value::number(std::numeric_limits<double>::quiet_NaN())), 3.0);
+  expect_amount(display_string(Value::number(std::numeric_limits<double>::max())), 4.0);
+  expect_amount("<1900/1/5", 5.0);
+  expect_amount(">1900/1/5", 6.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysFloorsFractionalBounds) {
+  PivotCache cache = build_days_interval_cache();
+  PivotTable table = build_days_grouped_table(/*start_serial=*/1.9, /*interval_days=*/7, /*end_serial=*/60.9);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 11U);
+  EXPECT_EQ(r.rows[0].label, "<1900/1/1");
+  EXPECT_EQ(r.rows[1].label, "1900/1/1 - 1900/1/7");
+  EXPECT_EQ(r.rows[9].label, "1900/2/26 - 1900/2/29");
+  EXPECT_EQ(r.rows[10].label, ">1900/2/29");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(r.values[9][0][0].as_number(), 4.0);
+  EXPECT_DOUBLE_EQ(r.values[10][0][0].as_number(), 10.0);
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysAutoEndClampsAtLastValidDate) {
+  PivotCache cache = build_two_field_cache();
+  const double last_valid = date_time::serial_from_ymd(9999, 12U, 31U);
+  push_record(cache, last_valid + 0.75, 1.0);
+  push_record(cache, last_valid + 1.0, 2.0);  // Invalid raw serial, excluded from auto bounds.
+
+  PivotTable table = build_days_grouped_table(/*start_serial=*/std::nullopt, /*interval_days=*/7);
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_EQ(r.rows[0].label, "9999/12/31 - 9999/12/31");
+  EXPECT_EQ(r.rows[1].label, display_string(Value::number(last_valid + 1.0)));
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 2.0);
+}
+
+TEST(PivotEvaluator, DateGroupingMaxFractionAndNextDayRespectEpoch) {
+  for (const bool date1904 : {false, true}) {
+    PivotCache cache = build_two_field_cache();
+    const double last_valid = date_time::serial_from_ymd(9999, 12U, 31U, date1904);
+    push_record(cache, last_valid + 0.75, 1.0);
+    push_record(cache, last_valid + 1.0, 2.0);
+
+    PivotTable table = build_date_grouped_table(DateGrouping::Day, CalendarSystem::Gregorian);
+    PivotFilterEnv env;
+    env.date1904 = date1904;
+    auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
+    ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+    const PivotResult& r = r_or.value();
+    ASSERT_EQ(r.rows.size(), 2U) << "date1904=" << date1904;
+    EXPECT_EQ(r.rows[0].label, "9999-12-31") << "date1904=" << date1904;
+    EXPECT_EQ(r.rows[1].label, display_string(Value::number(last_valid + 1.0))) << "date1904=" << date1904;
+    EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
+    EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 2.0);
+  }
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysRejectsInvalidExplicitBounds) {
+  const double last_valid = date_time::serial_from_ymd(9999, 12U, 31U);
+  const double invalid_bounds[] = {
+      -0.1,
+      std::numeric_limits<double>::quiet_NaN(),
+      std::numeric_limits<double>::infinity(),
+      last_valid + 1.0,
+  };
+  for (const double invalid : invalid_bounds) {
+    for (const bool invalid_start : {true, false}) {
+      PivotCache cache = build_days_interval_cache();
+      PivotTable table = build_days_grouped_table(
+          invalid_start ? std::optional<double>(invalid) : std::optional<double>(0.0),
+          /*interval_days=*/7, invalid_start ? std::optional<double>(70.0) : std::optional<double>(invalid));
+      auto r_or = evaluate(table, cache);
+      ASSERT_FALSE(static_cast<bool>(r_or)) << "invalid=" << invalid << " start=" << invalid_start;
+      EXPECT_EQ(r_or.error().code, FormulonErrorCode::kEvalPivotInvalid)
+          << "invalid=" << invalid << " start=" << invalid_start;
+    }
+  }
+}
+
+TEST(PivotEvaluator, DateGroupingByDaysRejectsRawInvertedFractionalBounds) {
+  PivotCache cache = build_days_interval_cache();
+  PivotTable table = build_days_grouped_table(/*start_serial=*/0.9, /*interval_days=*/7, /*end_serial=*/0.1);
+  auto r_or = evaluate(table, cache);
+  ASSERT_FALSE(static_cast<bool>(r_or));
+  EXPECT_EQ(r_or.error().code, FormulonErrorCode::kEvalPivotInvalid);
+}
+
+TEST(PivotEvaluator, CacheIdMismatchYieldsMissing) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_pivot_cache_id(99);  // Cache has id 1.
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_FALSE(static_cast<bool>(r_or));
+  EXPECT_EQ(r_or.error().code, FormulonErrorCode::kEvalPivotMissing);
+}
+
+TEST(PivotEvaluator, OutOfRangeFieldIndexYieldsInvalid) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.mutable_data_fields()[0].field_index = 99;
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_FALSE(static_cast<bool>(r_or));
+  EXPECT_EQ(r_or.error().code, FormulonErrorCode::kEvalPivotInvalid);
+}
+
+TEST(PivotEvaluator, GroupingDerivedAxisFieldWithNoDateGroupIsRefused) {
+  PivotCache cache = build_basic_cache();
+  cache.mutable_fields().push_back(PivotCacheField{"Region Years", {}});
+  cache.mutable_fields().back().is_database_field = false;
+  cache.mutable_fields().back().field_group_xml = "<fieldGroup base=\"0\"><rangePr groupBy=\"years\"/></fieldGroup>";
+
+  PivotTable table = build_sum_amount_table(/*row=*/{3}, /*col=*/{});
+  PivotField grouped_f;
+  grouped_f.source_name = "Region Years";
+  grouped_f.axis = PivotAxis::Row;
+  table.mutable_fields().push_back(std::move(grouped_f));
+  table.mutable_row_field_order() = {3};
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_FALSE(static_cast<bool>(r_or));
+  EXPECT_EQ(r_or.error().code, FormulonErrorCode::kEvalPivotInvalid);
+}
+
+TEST(PivotEvaluator, GroupingDerivedAxisFieldWithDateGroupSetEvaluatesNormally) {
+  PivotCache cache = build_basic_cache();
+  cache.mutable_fields().push_back(PivotCacheField{"Region Years", {}});
+  cache.mutable_fields().back().is_database_field = false;
+  cache.mutable_fields().back().field_group_xml = "<fieldGroup base=\"0\"><rangePr groupBy=\"years\"/></fieldGroup>";
+
+  PivotTable table = build_sum_amount_table(/*row=*/{3}, /*col=*/{});
+  PivotField grouped_f;
+  grouped_f.source_name = "Region Years";
+  grouped_f.axis = PivotAxis::Row;
+  grouped_f.date_group = PivotDateGroup{};
+  table.mutable_fields().push_back(std::move(grouped_f));
+  table.mutable_row_field_order() = {3};
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+}
+
+TEST(PivotRecordAccess, OutOfDomainSharedItemIndexCollapsesToBlank) {
+  // One shared item, so index 0 is the only resolvable reference. A cache
+  // built through the mutation API leaves `cell_is_index` empty, which is
+  // what makes a numeric cell in a shared field be read as an index.
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {Value::number(42.0)}});
+
+  const struct {
+    double stored;
+    bool resolves;
+  } cases[] = {
+      {std::numeric_limits<double>::quiet_NaN(), false},
+      {std::numeric_limits<double>::infinity(), false},
+      {-std::numeric_limits<double>::infinity(), false},
+      {-1.0, false},
+      {1e30, false},
+      {4.3e9, false},  // Past the wasm32 `size_t` range as well as past the container.
+      {1.0, false},    // One past the only shared item.
+      {0.0, true},
+      {0.5, true},
+  };
+
+  for (const auto& c : cases) {
+    PivotCacheRecord record;
+    record.cells.push_back(Value::number(c.stored));
+    ASSERT_TRUE(record.cell_is_index.empty());
+    const Value v = cell_value(cache, record, 0);
+    if (c.resolves) {
+      ASSERT_TRUE(v.is_number()) << "stored=" << c.stored;
+      EXPECT_DOUBLE_EQ(v.as_number(), 42.0) << "stored=" << c.stored;
+    } else {
+      EXPECT_TRUE(v.is_blank()) << "stored=" << c.stored;
+    }
+  }
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_evaluator_ordering_test.cpp b/tests/unit/pivot/pivot_evaluator_ordering_test.cpp
new file mode 100644
index 000000000..79b558dd9
--- /dev/null
+++ b/tests/unit/pivot/pivot_evaluator_ordering_test.cpp
@@ -0,0 +1,277 @@
+// Ordering and comparator behavior for `formulon::pivot::evaluate`.
+
+#include <cstddef>
+#include <limits>
+#include <map>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "eval/groupby_pivotby/common.h"
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot/value_order.h"
+#include "pivot_evaluator_fixtures.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+using test::owned_text;
+
+TEST(PivotComparatorParity, BoolVsTextMatchesGroupByOrder) {
+  const Value text_val = Value::text("zebra");
+  const Value bool_val = Value::boolean(false);
+
+  // Pivot: Text sorts before Bool.
+  EXPECT_TRUE(value_less(text_val, bool_val));
+  EXPECT_FALSE(value_less(bool_val, text_val));
+
+  // GROUPBY / SORT: same ordering (negative => first argument sorts first).
+  EXPECT_LT(eval::cmp_value_asc(text_val, bool_val), 0);
+  EXPECT_GT(eval::cmp_value_asc(bool_val, text_val), 0);
+}
+
+TEST(PivotComparatorParity, NumberBeforeTextBeforeBool) {
+  const Value num = Value::number(1.0);
+  const Value text_val = Value::text("a");
+  const Value bool_val = Value::boolean(true);
+
+  EXPECT_TRUE(value_less(num, text_val));
+  EXPECT_TRUE(value_less(text_val, bool_val));
+
+  EXPECT_LT(eval::cmp_value_asc(num, text_val), 0);
+  EXPECT_LT(eval::cmp_value_asc(text_val, bool_val), 0);
+}
+
+TEST(PivotComparatorParity, OrdersNonFiniteNumbersAfterFiniteValues) {
+  const Value negative_infinity = Value::number(-std::numeric_limits<double>::infinity());
+  const Value finite = Value::number(42.0);
+  const Value positive_infinity = Value::number(std::numeric_limits<double>::infinity());
+  const Value nan = Value::number(std::numeric_limits<double>::quiet_NaN());
+
+  EXPECT_TRUE(value_less(negative_infinity, finite));
+  EXPECT_TRUE(value_less(finite, positive_infinity));
+  EXPECT_TRUE(value_less(positive_infinity, nan));
+  EXPECT_FALSE(value_less(nan, positive_infinity));
+  EXPECT_FALSE(value_less(nan, nan));
+
+  std::map<Value, int, ValueLess> values;
+  values.emplace(negative_infinity, 1);
+  values.emplace(finite, 2);
+  values.emplace(positive_infinity, 3);
+  values.emplace(nan, 4);
+  EXPECT_EQ(values.size(), 4U);
+  EXPECT_EQ(values.at(negative_infinity), 1);
+  EXPECT_EQ(values.at(finite), 2);
+  EXPECT_EQ(values.at(positive_infinity), 3);
+  EXPECT_EQ(values.at(nan), 4);
+}
+
+TEST(PivotEvaluator, FieldDescendingSortReversesHierarchyAndValues) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
+  table.mutable_fields()[0].sort.ascending = false;
+  table.mutable_fields()[1].sort.ascending = false;
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  ASSERT_EQ(r.cols.size(), 2U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  EXPECT_EQ(r.rows[1].label, "North");
+  EXPECT_EQ(r.cols[0].label, "Widget");
+  EXPECT_EQ(r.cols[1].label, "Gadget");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 200.0);  // South/Widget
+  EXPECT_DOUBLE_EQ(r.values[0][1][0].as_number(), 300.0);  // South/Gadget
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 125.0);  // North/Widget
+  EXPECT_DOUBLE_EQ(r.values[1][1][0].as_number(), 50.0);   // North/Gadget
+}
+
+TEST(PivotEvaluator, FieldSortByValueFieldReordersAxisAndValues) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
+  table.mutable_fields()[0].sort.by_field = "Amount";
+  table.mutable_fields()[0].sort.ascending = false;
+  table.mutable_fields()[1].sort.by_field = "Sum of Amount";
+  table.mutable_fields()[1].sort.ascending = true;
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  ASSERT_EQ(r.cols.size(), 2U);
+  // Row totals: South=500, North=175, so descending by Amount puts South first.
+  EXPECT_EQ(r.rows[0].label, "South");
+  EXPECT_EQ(r.rows[1].label, "North");
+  // Column totals: Widget=325, Gadget=350, so ascending by Sum of Amount puts Widget first.
+  EXPECT_EQ(r.cols[0].label, "Widget");
+  EXPECT_EQ(r.cols[1].label, "Gadget");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 200.0);  // South/Widget
+  EXPECT_DOUBLE_EQ(r.values[0][1][0].as_number(), 300.0);  // South/Gadget
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 125.0);  // North/Widget
+  EXPECT_DOUBLE_EQ(r.values[1][1][0].as_number(), 50.0);   // North/Gadget
+}
+
+TEST(PivotEvaluator, ManualSortOrdersByItemDocumentPosition) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  PivotCacheField region;
+  region.name = "Region";
+  region.shared_items.push_back(owned_text(cache, "South"));
+  region.shared_items.push_back(owned_text(cache, "North"));
+  cache.mutable_fields().push_back(std::move(region));
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  auto add = [&](std::uint32_t region_index, double amount) {
+    PivotCacheRecord rec;
+    rec.cells = {Value::number(region_index), Value::number(amount)};
+    rec.cell_is_index = {true, false};
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add(0U, 200.0);  // South
+  add(1U, 100.0);  // North
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField region_f;
+  region_f.source_name = "Region";
+  region_f.axis = PivotAxis::Row;
+  region_f.sort.manual = true;
+  region_f.items.push_back(PivotItem{"South", true, /*has_cache_index=*/true, /*cache_index=*/0U});
+  region_f.items.push_back(PivotItem{"North", true, /*has_cache_index=*/true, /*cache_index=*/1U});
+  PivotField amount_f;
+  amount_f.source_name = "Amount";
+  amount_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(region_f));
+  table.mutable_fields().push_back(std::move(amount_f));
+
+  PivotDataField sum_amount;
+  sum_amount.name = "Sum of Amount";
+  sum_amount.field_index = 1;
+  sum_amount.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum_amount));
+  table.mutable_row_field_order() = {0};
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  EXPECT_EQ(r.rows[1].label, "North");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 200.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 100.0);
+}
+
+TEST(PivotEvaluator, SortedSubtotalWalkPreservesTypedDuplicateDisplayLabels) {
+  PivotCache cache;
+  cache.set_cache_id(17);
+  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Kind", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Item", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  auto add = [&](const char* group, Value kind, double amount) {
+    PivotCacheRecord record;
+    record.cells.push_back(owned_text(cache, group));
+    record.cells.push_back(std::move(kind));
+    record.cells.push_back(owned_text(cache, "Item"));
+    record.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(record));
+  };
+  // Number(1) and Text("1") render to the same label, but remain distinct
+  // hierarchy owners. The same is repeated under two sorted groups.
+  add("S", Value::number(3.0), 10.0);
+  add("S", owned_text(cache, "3"), 20.0);
+  add("D", Value::number(1.0), 30.0);
+  add("D", owned_text(cache, "1"), 40.0);
+
+  PivotTable table;
+  table.set_pivot_cache_id(17);
+  for (const char* name : {"Group", "Kind", "Item"}) {
+    PivotField field;
+    field.source_name = name;
+    field.axis = PivotAxis::Row;
+    table.mutable_fields().push_back(std::move(field));
+  }
+  PivotField amount_field;
+  amount_field.source_name = "Amount";
+  amount_field.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(amount_field));
+  table.mutable_row_field_order() = {0, 1, 2};
+  PivotDataField sum_amount;
+  sum_amount.name = "Sum of Amount";
+  sum_amount.field_index = 3;
+  sum_amount.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum_amount));
+  table.mutable_fields()[0].sort.ascending = false;
+  table.mutable_fields()[1].subtotal_fns = {SubtotalFn::Sum, SubtotalFn::Average};
+  table.mutable_fields()[0].subtotal_top = true;
+  table.set_grand_totals(/*rows=*/true, /*cols=*/true);
+  table.set_anchor(0, 0, 1, 1);
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  const PivotResult& result = result_or.value();
+  ASSERT_EQ(result.rows.size(), 2U);
+  ASSERT_EQ(result.rows[0].label, "S");
+  ASSERT_EQ(result.rows[1].label, "D");
+  ASSERT_EQ(result.row_subtotals.size(), 10U);
+
+  PivotLayoutOptions options;
+  options.row_labels_label = "Row Labels";
+  auto cells_or = layout(table, result, options);
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message << " " << cells_or.error().context;
+  const PivotCells& cells = cells_or.value();
+
+  std::vector<std::pair<PivotCellKind, double>> cells_in_render_order;
+  for (const PivotCell& cell : cells.cells) {
+    if (cell.col != cells.left + 1U || !cell.value.is_number()) {
+      continue;
+    }
+    if (cell.kind == PivotCellKind::Data || cell.kind == PivotCellKind::RowSubtotal ||
+        cell.kind == PivotCellKind::GrandTotal) {
+      cells_in_render_order.emplace_back(cell.kind, cell.value.as_number());
+    }
+  }
+  EXPECT_EQ(cells_in_render_order, (std::vector<std::pair<PivotCellKind, double>>{
+                                       {PivotCellKind::RowSubtotal, 30.0},  // S subtotal.
+                                       {PivotCellKind::RowSubtotal, 10.0},  // S / Number(3) SUM.
+                                       {PivotCellKind::RowSubtotal, 10.0},  // S / Number(3) AVERAGE.
+                                       {PivotCellKind::Data, 10.0},         // S / Number(3) detail.
+                                       {PivotCellKind::RowSubtotal, 20.0},  // S / Text("3") SUM.
+                                       {PivotCellKind::RowSubtotal, 20.0},  // S / Text("3") AVERAGE.
+                                       {PivotCellKind::Data, 20.0},         // S / Text("3") detail.
+                                       {PivotCellKind::RowSubtotal, 70.0},  // D subtotal.
+                                       {PivotCellKind::RowSubtotal, 30.0},  // D / Number(1) SUM.
+                                       {PivotCellKind::RowSubtotal, 30.0},  // D / Number(1) AVERAGE.
+                                       {PivotCellKind::Data, 30.0},         // D / Number(1) detail.
+                                       {PivotCellKind::RowSubtotal, 40.0},  // D / Text("1") SUM.
+                                       {PivotCellKind::RowSubtotal, 40.0},  // D / Text("1") AVERAGE.
+                                       {PivotCellKind::Data, 40.0},         // D / Text("1") detail.
+                                       {PivotCellKind::GrandTotal, 100.0},
+                                   }));
+  EXPECT_EQ(cells.cols, 2U);
+  EXPECT_GT(cells.rows, result.row_subtotals.size());
+}
+
+TEST(PivotComparatorParity, FoldsHalfWidthKatakana) {
+  // U+FF76 (halfwidth ｶ) folds to U+30AB (fullwidth カ); after folding the
+  // two are equal, so neither orders before the other.
+  const Value full = Value::text("\xE3\x82\xAB");  // カ
+  const Value half = Value::text("\xEF\xBD\xB6");  // ｶ
+  EXPECT_FALSE(value_less(full, half));
+  EXPECT_FALSE(value_less(half, full));
+  // GROUPBY / SORT agrees they are equal.
+  EXPECT_EQ(eval::cmp_value_asc(full, half), 0);
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_evaluator_test.cpp b/tests/unit/pivot/pivot_evaluator_test.cpp
deleted file mode 100644
index 9ef155c77..000000000
--- a/tests/unit/pivot/pivot_evaluator_test.cpp
+++ /dev/null
@@ -1,2296 +0,0 @@
-//
-// Unit tests for `formulon::pivot::evaluate`. Each test hand-builds a
-// `PivotCache` + `PivotTable` (no XML, no xlsx) and checks the produced
-// `PivotResult` shape and per-cell values. The MVP scope mirrors the
-// evaluator implementation: SUM / COUNT / AVERAGE / MAX / MIN / PRODUCT
-// / CountNumbers, manual-filter visibility, hierarchy + grand total +
-// row-axis subtotals.
-
-#include "pivot/pivot_evaluator.h"
-
-#include <algorithm>
-#include <cmath>
-#include <cstddef>
-#include <cstdint>
-#include <limits>
-#include <optional>
-#include <string>
-#include <vector>
-
-#include "eval/groupby_pivotby/common.h"
-#include "gtest/gtest.h"
-#include "pivot/pivot_cache.h"
-#include "pivot/pivot_layout.h"
-#include "pivot/pivot_result.h"
-#include "pivot/pivot_table.h"
-#include "pivot/pivot_types.h"
-#include "pivot/record_access.h"
-#include "pivot/value_order.h"
-#include "pivot_evaluator_fixtures.h"
-#include "utils/checked_index.h"
-#include "utils/date_time.h"
-#include "utils/error.h"
-#include "value.h"
-
-namespace formulon::pivot {
-namespace {
-
-// ---------------------------------------------------------------------------
-// Cross-subsystem comparator agreement: the pivot comparator
-// (`pivot::value_less`) and the GROUPBY / SORT comparator
-// (`eval::cmp_value_asc`) share one Excel kind rank, so a key column mixing
-// Bool and Text must order identically in both. Excel's ascending order puts
-// Text before Bool.
-// ---------------------------------------------------------------------------
-
-TEST(PivotComparatorParity, BoolVsTextMatchesGroupByOrder) {
-  const Value text_val = Value::text("zebra");
-  const Value bool_val = Value::boolean(false);
-
-  // Pivot: Text sorts before Bool.
-  EXPECT_TRUE(value_less(text_val, bool_val));
-  EXPECT_FALSE(value_less(bool_val, text_val));
-
-  // GROUPBY / SORT: same ordering (negative => first argument sorts first).
-  EXPECT_LT(eval::cmp_value_asc(text_val, bool_val), 0);
-  EXPECT_GT(eval::cmp_value_asc(bool_val, text_val), 0);
-}
-
-TEST(PivotComparatorParity, NumberBeforeTextBeforeBool) {
-  const Value num = Value::number(1.0);
-  const Value text_val = Value::text("a");
-  const Value bool_val = Value::boolean(true);
-
-  EXPECT_TRUE(value_less(num, text_val));
-  EXPECT_TRUE(value_less(text_val, bool_val));
-
-  EXPECT_LT(eval::cmp_value_asc(num, text_val), 0);
-  EXPECT_LT(eval::cmp_value_asc(text_val, bool_val), 0);
-}
-
-using test::build_basic_cache;
-using test::build_sum_amount_table;
-using test::owned_text;
-using test::row_index;
-
-// ---------------------------------------------------------------------------
-// 1. Single SUM happy path
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, SingleSumByRegion) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Two row leaves (North, South), one implicit col leaf, one data field.
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_TRUE(r.cols.empty());
-  ASSERT_EQ(r.values.size(), 2U);
-  ASSERT_EQ(r.values[0].size(), 1U);
-  ASSERT_EQ(r.values[0][0].size(), 1U);
-
-  const std::size_t north = row_index(r, "North");
-  const std::size_t south = row_index(r, "South");
-  ASSERT_NE(north, static_cast<std::size_t>(-1));
-  ASSERT_NE(south, static_cast<std::size_t>(-1));
-
-  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 175.0);  // 100 + 50 + 25
-  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 500.0);  // 200 + 300
-  EXPECT_TRUE(r.grand_total.is_blank());
-}
-
-// ---------------------------------------------------------------------------
-// 2. Two row fields
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, TwoRowFieldsHierarchy) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Row hierarchy: North { Gadget, Widget }, South { Gadget, Widget }.
-  ASSERT_EQ(r.rows.size(), 2U);
-  for (const auto& region : r.rows) {
-    EXPECT_FALSE(region.children.empty());
-    EXPECT_EQ(region.children.size(), 2U);
-  }
-  // Each region should have both products.
-  const std::size_t north = row_index(r, "North");
-  const std::size_t south = row_index(r, "South");
-  ASSERT_NE(north, static_cast<std::size_t>(-1));
-  ASSERT_NE(south, static_cast<std::size_t>(-1));
-
-  // Verify children are alphabetically ordered (Gadget < Widget).
-  EXPECT_EQ(r.rows[north].children[0].label, "Gadget");
-  EXPECT_EQ(r.rows[north].children[1].label, "Widget");
-
-  // Four leaves in total: walk values matrix and check totals.
-  // Leaves are ordered: North/Gadget, North/Widget, South/Gadget, South/Widget.
-  ASSERT_EQ(r.values.size(), 4U);
-  // We don't depend on the exact leaf ordering across regions; just
-  // sum and check totals match {50, 125, 300, 200}.
-  std::vector<double> got;
-  got.reserve(4);
-  for (const auto& row_slot : r.values) {
-    ASSERT_EQ(row_slot.size(), 1U);
-    ASSERT_EQ(row_slot[0].size(), 1U);
-    got.push_back(row_slot[0][0].as_number());
-  }
-  std::sort(got.begin(), got.end());
-  EXPECT_DOUBLE_EQ(got[0], 50.0);   // North/Gadget
-  EXPECT_DOUBLE_EQ(got[1], 125.0);  // North/Widget (100 + 25)
-  EXPECT_DOUBLE_EQ(got[2], 200.0);  // South/Widget
-  EXPECT_DOUBLE_EQ(got[3], 300.0);  // South/Gadget
-}
-
-// ---------------------------------------------------------------------------
-// 3. One row + one col field
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, OneRowOneColField) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 2U);
-  ASSERT_EQ(r.cols.size(), 2U);
-  // 2 row leaves x 2 col leaves x 1 data field.
-  ASSERT_EQ(r.values.size(), 2U);
-  ASSERT_EQ(r.values[0].size(), 2U);
-  ASSERT_EQ(r.values[0][0].size(), 1U);
-
-  // Column ordering: Gadget < Widget alphabetically.
-  EXPECT_EQ(r.cols[0].label, "Gadget");
-  EXPECT_EQ(r.cols[1].label, "Widget");
-
-  const std::size_t north = row_index(r, "North");
-  const std::size_t south = row_index(r, "South");
-  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 50.0);   // North/Gadget
-  EXPECT_DOUBLE_EQ(r.values[north][1][0].as_number(), 125.0);  // North/Widget
-  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 300.0);  // South/Gadget
-  EXPECT_DOUBLE_EQ(r.values[south][1][0].as_number(), 200.0);  // South/Widget
-}
-
-TEST(PivotEvaluator, FieldDescendingSortReversesHierarchyAndValues) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
-  table.mutable_fields()[0].sort.ascending = false;
-  table.mutable_fields()[1].sort.ascending = false;
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 2U);
-  ASSERT_EQ(r.cols.size(), 2U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  EXPECT_EQ(r.rows[1].label, "North");
-  EXPECT_EQ(r.cols[0].label, "Widget");
-  EXPECT_EQ(r.cols[1].label, "Gadget");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 200.0);  // South/Widget
-  EXPECT_DOUBLE_EQ(r.values[0][1][0].as_number(), 300.0);  // South/Gadget
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 125.0);  // North/Widget
-  EXPECT_DOUBLE_EQ(r.values[1][1][0].as_number(), 50.0);   // North/Gadget
-}
-
-TEST(PivotEvaluator, FieldSortByValueFieldReordersAxisAndValues) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
-  table.mutable_fields()[0].sort.by_field = "Amount";
-  table.mutable_fields()[0].sort.ascending = false;
-  table.mutable_fields()[1].sort.by_field = "Sum of Amount";
-  table.mutable_fields()[1].sort.ascending = true;
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 2U);
-  ASSERT_EQ(r.cols.size(), 2U);
-  // Row totals: South=500, North=175, so descending by Amount puts South first.
-  EXPECT_EQ(r.rows[0].label, "South");
-  EXPECT_EQ(r.rows[1].label, "North");
-  // Column totals: Widget=325, Gadget=350, so ascending by Sum of Amount puts Widget first.
-  EXPECT_EQ(r.cols[0].label, "Widget");
-  EXPECT_EQ(r.cols[1].label, "Gadget");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 200.0);  // South/Widget
-  EXPECT_DOUBLE_EQ(r.values[0][1][0].as_number(), 300.0);  // South/Gadget
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 125.0);  // North/Widget
-  EXPECT_DOUBLE_EQ(r.values[1][1][0].as_number(), 50.0);   // North/Gadget
-}
-
-// `SortSpec::manual` (OOXML `sortType="manual"`) orders siblings by the
-// field's `<items>` document position, resolved through the bound
-// cache's `shared_items` -- not by display label. "South" sorts after
-// "North" alphabetically, so this only passes if manual order actually
-// overrides the default ascending-by-label sort.
-TEST(PivotEvaluator, ManualSortOrdersByItemDocumentPosition) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  PivotCacheField region;
-  region.name = "Region";
-  region.shared_items.push_back(owned_text(cache, "South"));
-  region.shared_items.push_back(owned_text(cache, "North"));
-  cache.mutable_fields().push_back(std::move(region));
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  auto add = [&](std::uint32_t region_index, double amount) {
-    PivotCacheRecord rec;
-    rec.cells = {Value::number(region_index), Value::number(amount)};
-    rec.cell_is_index = {true, false};
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add(0U, 200.0);  // South
-  add(1U, 100.0);  // North
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField region_f;
-  region_f.source_name = "Region";
-  region_f.axis = PivotAxis::Row;
-  region_f.sort.manual = true;
-  region_f.items.push_back(PivotItem{"South", true, /*has_cache_index=*/true, /*cache_index=*/0U});
-  region_f.items.push_back(PivotItem{"North", true, /*has_cache_index=*/true, /*cache_index=*/1U});
-  PivotField amount_f;
-  amount_f.source_name = "Amount";
-  amount_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(region_f));
-  table.mutable_fields().push_back(std::move(amount_f));
-
-  PivotDataField sum_amount;
-  sum_amount.name = "Sum of Amount";
-  sum_amount.field_index = 1;
-  sum_amount.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum_amount));
-  table.mutable_row_field_order() = {0};
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  EXPECT_EQ(r.rows[1].label, "North");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 200.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 100.0);
-}
-
-TEST(PivotEvaluator, SortedSubtotalWalkPreservesTypedDuplicateDisplayLabels) {
-  PivotCache cache;
-  cache.set_cache_id(17);
-  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Kind", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Item", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  auto add = [&](const char* group, Value kind, double amount) {
-    PivotCacheRecord record;
-    record.cells.push_back(owned_text(cache, group));
-    record.cells.push_back(std::move(kind));
-    record.cells.push_back(owned_text(cache, "Item"));
-    record.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(record));
-  };
-  // Number(1) and Text("1") render to the same label, but remain distinct
-  // hierarchy owners. The same is repeated under two sorted groups.
-  add("S", Value::number(3.0), 10.0);
-  add("S", owned_text(cache, "3"), 20.0);
-  add("D", Value::number(1.0), 30.0);
-  add("D", owned_text(cache, "1"), 40.0);
-
-  PivotTable table;
-  table.set_pivot_cache_id(17);
-  for (const char* name : {"Group", "Kind", "Item"}) {
-    PivotField field;
-    field.source_name = name;
-    field.axis = PivotAxis::Row;
-    table.mutable_fields().push_back(std::move(field));
-  }
-  PivotField amount_field;
-  amount_field.source_name = "Amount";
-  amount_field.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(amount_field));
-  table.mutable_row_field_order() = {0, 1, 2};
-  PivotDataField sum_amount;
-  sum_amount.name = "Sum of Amount";
-  sum_amount.field_index = 3;
-  sum_amount.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum_amount));
-  table.mutable_fields()[0].sort.ascending = false;
-  table.mutable_fields()[1].subtotal_fns = {SubtotalFn::Sum, SubtotalFn::Average};
-  table.mutable_fields()[0].subtotal_top = true;
-  table.set_grand_totals(/*rows=*/true, /*cols=*/true);
-  table.set_anchor(0, 0, 1, 1);
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  const PivotResult& result = result_or.value();
-  ASSERT_EQ(result.rows.size(), 2U);
-  ASSERT_EQ(result.rows[0].label, "S");
-  ASSERT_EQ(result.rows[1].label, "D");
-  ASSERT_EQ(result.row_subtotals.size(), 10U);
-
-  PivotLayoutOptions options;
-  options.row_labels_label = "Row Labels";
-  auto cells_or = layout(table, result, options);
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message << " " << cells_or.error().context;
-  const PivotCells& cells = cells_or.value();
-
-  std::vector<std::pair<PivotCellKind, double>> cells_in_render_order;
-  for (const PivotCell& cell : cells.cells) {
-    if (cell.col != cells.left + 1U || !cell.value.is_number()) {
-      continue;
-    }
-    if (cell.kind == PivotCellKind::Data || cell.kind == PivotCellKind::RowSubtotal ||
-        cell.kind == PivotCellKind::GrandTotal) {
-      cells_in_render_order.emplace_back(cell.kind, cell.value.as_number());
-    }
-  }
-  EXPECT_EQ(cells_in_render_order, (std::vector<std::pair<PivotCellKind, double>>{
-                                       {PivotCellKind::RowSubtotal, 30.0},  // S subtotal.
-                                       {PivotCellKind::RowSubtotal, 10.0},  // S / Number(3) SUM.
-                                       {PivotCellKind::RowSubtotal, 10.0},  // S / Number(3) AVERAGE.
-                                       {PivotCellKind::Data, 10.0},         // S / Number(3) detail.
-                                       {PivotCellKind::RowSubtotal, 20.0},  // S / Text("3") SUM.
-                                       {PivotCellKind::RowSubtotal, 20.0},  // S / Text("3") AVERAGE.
-                                       {PivotCellKind::Data, 20.0},         // S / Text("3") detail.
-                                       {PivotCellKind::RowSubtotal, 70.0},  // D subtotal.
-                                       {PivotCellKind::RowSubtotal, 30.0},  // D / Number(1) SUM.
-                                       {PivotCellKind::RowSubtotal, 30.0},  // D / Number(1) AVERAGE.
-                                       {PivotCellKind::Data, 30.0},         // D / Number(1) detail.
-                                       {PivotCellKind::RowSubtotal, 40.0},  // D / Text("1") SUM.
-                                       {PivotCellKind::RowSubtotal, 40.0},  // D / Text("1") AVERAGE.
-                                       {PivotCellKind::Data, 40.0},         // D / Text("1") detail.
-                                       {PivotCellKind::GrandTotal, 100.0},
-                                   }));
-  EXPECT_EQ(cells.cols, 2U);
-  EXPECT_GT(cells.rows, result.row_subtotals.size());
-}
-
-TEST(PivotEvaluator, SparseRowColumnIntersectionIsBlank) {
-  PivotCache cache = build_basic_cache();
-  auto& records = cache.mutable_records();
-  records.erase(std::remove_if(records.begin(), records.end(),
-                               [](const PivotCacheRecord& record) {
-                                 return record.cells[0].as_text() == "North" && record.cells[1].as_text() == "Gadget";
-                               }),
-                records.end());
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  const PivotResult& result = result_or.value();
-  const std::size_t north = row_index(result, "North");
-  ASSERT_NE(north, static_cast<std::size_t>(-1));
-  ASSERT_EQ(result.cols.size(), 2U);
-  ASSERT_EQ(result.cols[0].label, "Gadget");
-  EXPECT_TRUE(result.values[north][0][0].is_blank());
-}
-
-TEST(PivotEvaluator, UnresolvedHiddenItemDoesNotFilterBlankRecords) {
-  PivotCache cache = build_basic_cache();
-  PivotCacheRecord blank_region;
-  blank_region.cells = {Value::blank(), owned_text(cache, "Widget"), Value::number(75.0)};
-  cache.mutable_records().push_back(std::move(blank_region));
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  PivotItem malformed_hidden;
-  malformed_hidden.visible = false;
-  malformed_hidden.has_cache_index = true;
-  malformed_hidden.cache_index = 999U;
-  table.mutable_fields()[0].items.push_back(std::move(malformed_hidden));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  const PivotResult& result = result_or.value();
-  const std::size_t blank_leaf = row_index(result, PivotLayoutOptions{}.blank_item_label);
-  ASSERT_NE(blank_leaf, static_cast<std::size_t>(-1));
-  EXPECT_DOUBLE_EQ(result.values[blank_leaf][0][0].as_number(), 75.0);
-}
-
-// ---------------------------------------------------------------------------
-// 3c. Blank source values still name their axis group
-// ---------------------------------------------------------------------------
-
-// A source row whose row-field cell is empty groups under a placeholder, not
-// under a nameless node: the label is what the grid draws, and GETPIVOTDATA
-// walks labels by exact match, so an unnamed group could not be addressed at
-// all. What the placeholder spells is the vocabulary's business — these tests
-// pin the mechanism, never a particular text.
-TEST(PivotEvaluator, BlankAxisItemTakesThePlaceholderLabel) {
-  PivotCache cache = build_basic_cache();
-  PivotCacheRecord blank_region;
-  blank_region.cells = {Value::blank(), owned_text(cache, "Widget"), Value::number(75.0)};
-  cache.mutable_records().push_back(std::move(blank_region));
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  const PivotResult& result = result_or.value();
-
-  for (const AxisHierarchyNode& row : result.rows) {
-    EXPECT_FALSE(row.label.empty());
-  }
-  const std::size_t blank_leaf = row_index(result, PivotLayoutOptions{}.blank_item_label);
-  ASSERT_NE(blank_leaf, static_cast<std::size_t>(-1));
-  EXPECT_DOUBLE_EQ(result.values[blank_leaf][0][0].as_number(), 75.0);
-  // The named groups are untouched.
-  EXPECT_NE(row_index(result, "North"), static_cast<std::size_t>(-1));
-  EXPECT_NE(row_index(result, "South"), static_cast<std::size_t>(-1));
-}
-
-// The placeholder is part of the locale's label vocabulary, so it travels
-// with the rest of it rather than being fixed in the evaluator.
-TEST(PivotEvaluator, BlankAxisItemPlaceholderComesFromTheSuppliedVocabulary) {
-  PivotCache cache = build_basic_cache();
-  PivotCacheRecord blank_region;
-  blank_region.cells = {Value::blank(), owned_text(cache, "Widget"), Value::number(75.0)};
-  cache.mutable_records().push_back(std::move(blank_region));
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-
-  PivotLayoutOptions options;
-  options.blank_item_label = "<none>";
-  auto result_or = evaluate(table, cache, options);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  EXPECT_NE(row_index(result_or.value(), "<none>"), static_cast<std::size_t>(-1));
-}
-
-// Subtotal rows address their group by the same label path, so an interior
-// blank group has to carry the placeholder there too.
-TEST(PivotEvaluator, BlankGroupSubtotalCarriesThePlaceholderLabel) {
-  PivotCache cache = build_basic_cache();
-  PivotCacheRecord blank_widget;
-  blank_widget.cells = {Value::blank(), owned_text(cache, "Widget"), Value::number(75.0)};
-  cache.mutable_records().push_back(std::move(blank_widget));
-  PivotCacheRecord blank_gadget;
-  blank_gadget.cells = {Value::blank(), owned_text(cache, "Gadget"), Value::number(25.0)};
-  cache.mutable_records().push_back(std::move(blank_gadget));
-  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
-
-  PivotLayoutOptions options;
-  options.blank_item_label = "<no-value>";
-  auto result_or = evaluate(table, cache, options);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  const PivotResult& result = result_or.value();
-
-  bool saw_blank_subtotal = false;
-  for (const RowSubtotal& subtotal : result.row_subtotals) {
-    ASSERT_FALSE(subtotal.labels.empty());
-    if (subtotal.labels[0] == options.blank_item_label) {
-      saw_blank_subtotal = true;
-      EXPECT_DOUBLE_EQ(subtotal.values[0].as_number(), 100.0);  // 75 + 25.
-    }
-    EXPECT_FALSE(subtotal.labels[0].empty());
-  }
-  EXPECT_TRUE(saw_blank_subtotal);
-}
-
-// ---------------------------------------------------------------------------
-// 4. Multiple aggregations on the same source
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, SumAndAverageOnSameField) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Add an Average data field on the same source column.
-  PivotDataField avg_amount;
-  avg_amount.name = "Average of Amount";
-  avg_amount.field_index = 2;
-  avg_amount.aggregation = Aggregation::Average;
-  table.mutable_data_fields().push_back(std::move(avg_amount));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.values.size(), 2U);
-  ASSERT_EQ(r.values[0][0].size(), 2U);  // Sum + Average.
-
-  const std::size_t north = row_index(r, "North");
-  const std::size_t south = row_index(r, "South");
-  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 175.0);
-  EXPECT_DOUBLE_EQ(r.values[north][0][1].as_number(), 175.0 / 3.0);
-  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 500.0);
-  EXPECT_DOUBLE_EQ(r.values[south][0][1].as_number(), 250.0);
-}
-
-// ---------------------------------------------------------------------------
-// 5. COUNT counts non-blank cells (including text and booleans)
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, CountIncludesNonBlanks) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Note", {}});
-
-  auto add = [&](const char* group, Value note) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, group));
-    rec.cells.push_back(note);
-    cache.mutable_records().push_back(std::move(rec));
-  };
-
-  add("A", owned_text(cache, "ok"));   // counted
-  add("A", Value::blank());            // NOT counted
-  add("A", Value::number(7.0));        // counted
-  add("B", owned_text(cache, "yes"));  // counted
-  add("B", Value::blank());            // NOT counted
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField group_f;
-  group_f.source_name = "Group";
-  group_f.axis = PivotAxis::Row;
-  PivotField note_f;
-  note_f.source_name = "Note";
-  note_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(group_f));
-  table.mutable_fields().push_back(std::move(note_f));
-  table.mutable_row_field_order() = {0};
-  PivotDataField cnt;
-  cnt.name = "Count of Note";
-  cnt.field_index = 1;
-  cnt.aggregation = Aggregation::Count;
-  table.mutable_data_fields().push_back(std::move(cnt));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 2U);
-  const std::size_t a = row_index(r, "A");
-  const std::size_t b = row_index(r, "B");
-  EXPECT_DOUBLE_EQ(r.values[a][0][0].as_number(), 2.0);
-  EXPECT_DOUBLE_EQ(r.values[b][0][0].as_number(), 1.0);
-}
-
-// ---------------------------------------------------------------------------
-// 6. CountNumbers excludes text
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, CountNumbersExcludesText) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Mixed", {}});
-
-  auto add = [&](const char* group, Value v) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, group));
-    rec.cells.push_back(v);
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("A", Value::number(1.0));
-  add("A", owned_text(cache, "skip"));
-  add("A", Value::number(2.0));
-  add("A", owned_text(cache, "skip2"));
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField group_f;
-  group_f.source_name = "Group";
-  group_f.axis = PivotAxis::Row;
-  PivotField mixed_f;
-  mixed_f.source_name = "Mixed";
-  mixed_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(group_f));
-  table.mutable_fields().push_back(std::move(mixed_f));
-  table.mutable_row_field_order() = {0};
-  PivotDataField cn;
-  cn.name = "CountNumbers of Mixed";
-  cn.field_index = 1;
-  cn.aggregation = Aggregation::CountNumbers;
-  table.mutable_data_fields().push_back(std::move(cn));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 2.0);
-}
-
-// ---------------------------------------------------------------------------
-// 7. AVERAGE on no-numbers returns #DIV/0!
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, AverageNoNumbersReturnsDiv0) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Note", {}});
-
-  auto add = [&](const char* g, const char* n) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, g));
-    rec.cells.push_back(owned_text(cache, n));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("A", "x");
-  add("A", "y");
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField gf;
-  gf.source_name = "Group";
-  gf.axis = PivotAxis::Row;
-  PivotField nf;
-  nf.source_name = "Note";
-  nf.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(gf));
-  table.mutable_fields().push_back(std::move(nf));
-  table.mutable_row_field_order() = {0};
-  PivotDataField avg;
-  avg.name = "Average of Note";
-  avg.field_index = 1;
-  avg.aggregation = Aggregation::Average;
-  table.mutable_data_fields().push_back(std::move(avg));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 1U);
-  ASSERT_TRUE(r.values[0][0][0].is_error());
-  EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Div0);
-}
-
-// ---------------------------------------------------------------------------
-// 8. MAX / MIN / PRODUCT arithmetic
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, MaxMinProduct) {
-  PivotCache cache = build_basic_cache();
-
-  auto run = [&](Aggregation agg) {
-    PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-    table.mutable_data_fields()[0].aggregation = agg;
-    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-    auto r_or = evaluate(table, cache);
-    EXPECT_TRUE(static_cast<bool>(r_or));
-    return r_or.value();
-  };
-
-  {
-    PivotResult r = run(Aggregation::Max);
-    const std::size_t north = row_index(r, "North");
-    const std::size_t south = row_index(r, "South");
-    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 100.0);
-    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 300.0);
-  }
-  {
-    PivotResult r = run(Aggregation::Min);
-    const std::size_t north = row_index(r, "North");
-    const std::size_t south = row_index(r, "South");
-    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 25.0);
-    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 200.0);
-  }
-  {
-    PivotResult r = run(Aggregation::Product);
-    const std::size_t north = row_index(r, "North");
-    const std::size_t south = row_index(r, "South");
-    // North: 100 * 50 * 25 = 125_000
-    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 125000.0);
-    // South: 200 * 300 = 60_000
-    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 60000.0);
-  }
-}
-
-// The variance/stddev family already maps a non-finite intermediate result
-// to `#NUM!` (`variance_helper`); the arithmetic aggregates share the same
-// obligation and, until fixed, returned `Value::number(inf)` instead.
-TEST(PivotEvaluator, ArithmeticAggregatesMapOverflowToNumError) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* region, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  const double huge = std::numeric_limits<double>::max();
-  add("North", huge);
-  add("North", huge);  // huge + huge overflows a double to +inf.
-
-  auto run = [&](Aggregation agg) {
-    PivotTable table;
-    table.set_pivot_cache_id(1);
-    PivotField rf;
-    rf.source_name = "Region";
-    rf.axis = PivotAxis::Row;
-    PivotField af;
-    af.source_name = "Amount";
-    af.axis = PivotAxis::Value;
-    table.mutable_fields().push_back(std::move(rf));
-    table.mutable_fields().push_back(std::move(af));
-    table.mutable_row_field_order() = {0};
-    PivotDataField df;
-    df.name = "Agg";
-    df.field_index = 1;
-    df.aggregation = agg;
-    table.mutable_data_fields().push_back(std::move(df));
-    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-    auto r_or = evaluate(table, cache);
-    EXPECT_TRUE(static_cast<bool>(r_or));
-    return r_or.value();
-  };
-
-  for (Aggregation agg : {Aggregation::Sum, Aggregation::Average, Aggregation::Product}) {
-    PivotResult r = run(agg);
-    ASSERT_TRUE(r.values[0][0][0].is_error()) << static_cast<int>(agg);
-    EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Num) << static_cast<int>(agg);
-  }
-}
-
-// Max/Min pick an existing value rather than compute one, so they only
-// see a non-finite result when the source cell itself already carries
-// one (a cached value from outside Excel's own write path, since Excel
-// never stores `Infinity`).
-TEST(PivotEvaluator, MaxMinMapAStoredNonFiniteValueToNumError) {
-  auto run = [&](Aggregation agg, double extreme) {
-    PivotCache cache;
-    cache.set_cache_id(1);
-    cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-    cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-    auto add = [&](const char* region, double amount) {
-      PivotCacheRecord rec;
-      rec.cells.push_back(owned_text(cache, region));
-      rec.cells.push_back(Value::number(amount));
-      cache.mutable_records().push_back(std::move(rec));
-    };
-    add("North", extreme);
-    add("North", 1.0);
-
-    PivotTable table;
-    table.set_pivot_cache_id(1);
-    PivotField rf;
-    rf.source_name = "Region";
-    rf.axis = PivotAxis::Row;
-    PivotField af;
-    af.source_name = "Amount";
-    af.axis = PivotAxis::Value;
-    table.mutable_fields().push_back(std::move(rf));
-    table.mutable_fields().push_back(std::move(af));
-    table.mutable_row_field_order() = {0};
-    PivotDataField df;
-    df.name = "Agg";
-    df.field_index = 1;
-    df.aggregation = agg;
-    table.mutable_data_fields().push_back(std::move(df));
-    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-    auto r_or = evaluate(table, cache);
-    EXPECT_TRUE(static_cast<bool>(r_or));
-    return r_or.value();
-  };
-
-  {
-    // +Infinity beats every finite value, so it is the one MAX picks.
-    PivotResult r = run(Aggregation::Max, std::numeric_limits<double>::infinity());
-    ASSERT_TRUE(r.values[0][0][0].is_error());
-    EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Num);
-  }
-  {
-    // -Infinity is smaller than every finite value, so it is the one MIN picks.
-    PivotResult r = run(Aggregation::Min, -std::numeric_limits<double>::infinity());
-    ASSERT_TRUE(r.values[0][0][0].is_error());
-    EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Num);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// 8b. StdDev / StdDevP / Var / VarP arithmetic
-// ---------------------------------------------------------------------------
-//
-// `build_basic_cache()` per region:
-//   North: {100, 50, 25}            mean = 175 / 3
-//   South: {200, 300}               mean = 250
-
-TEST(PivotEvaluator, StdDevAndVarFamily) {
-  PivotCache cache = build_basic_cache();
-
-  auto run = [&](Aggregation agg) {
-    PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-    table.mutable_data_fields()[0].aggregation = agg;
-    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-    auto r_or = evaluate(table, cache);
-    EXPECT_TRUE(static_cast<bool>(r_or));
-    return r_or.value();
-  };
-
-  // North n=3, mean = 175/3, ss = sum((x - mean)^2)
-  //   = (100 - 175/3)^2 + (50 - 175/3)^2 + (25 - 175/3)^2
-  //   = (125/3)^2 + (-25/3)^2 + (-100/3)^2
-  //   = 15625/9 + 625/9 + 10000/9
-  //   = 26250/9
-  const double north_ss =
-      (125.0 / 3.0) * (125.0 / 3.0) + (-25.0 / 3.0) * (-25.0 / 3.0) + (-100.0 / 3.0) * (-100.0 / 3.0);
-  // South n=2, mean = 250, ss = (200-250)^2 + (300-250)^2 = 5000
-  const double south_ss = 5000.0;
-
-  {
-    PivotResult r = run(Aggregation::Var);  // sample, divisor n-1
-    const std::size_t north = row_index(r, "North");
-    const std::size_t south = row_index(r, "South");
-    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), north_ss / 2.0);
-    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), south_ss / 1.0);
-  }
-  {
-    PivotResult r = run(Aggregation::VarP);  // population, divisor n
-    const std::size_t north = row_index(r, "North");
-    const std::size_t south = row_index(r, "South");
-    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), north_ss / 3.0);
-    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), south_ss / 2.0);
-  }
-  {
-    PivotResult r = run(Aggregation::StdDev);
-    const std::size_t north = row_index(r, "North");
-    const std::size_t south = row_index(r, "South");
-    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), std::sqrt(north_ss / 2.0));
-    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), std::sqrt(south_ss / 1.0));
-  }
-  {
-    PivotResult r = run(Aggregation::StdDevP);
-    const std::size_t north = row_index(r, "North");
-    const std::size_t south = row_index(r, "South");
-    EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), std::sqrt(north_ss / 3.0));
-    EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), std::sqrt(south_ss / 2.0));
-  }
-}
-
-TEST(PivotEvaluator, VarAndStdDevSampleNeedTwoValuesElseDiv0) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"G", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"V", {}});
-
-  auto add = [&](const char* g, double v) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, g));
-    rec.cells.push_back(Value::number(v));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("solo", 42.0);  // single record, sample stats undefined.
-  add("pair", 10.0);
-  add("pair", 20.0);
-
-  auto run = [&](Aggregation agg) {
-    PivotTable table;
-    table.set_pivot_cache_id(1);
-    PivotField gf;
-    gf.source_name = "G";
-    gf.axis = PivotAxis::Row;
-    PivotField vf;
-    vf.source_name = "V";
-    vf.axis = PivotAxis::Value;
-    table.mutable_fields().push_back(std::move(gf));
-    table.mutable_fields().push_back(std::move(vf));
-    table.mutable_row_field_order() = {0};
-    PivotDataField df;
-    df.name = "f";
-    df.field_index = 1;
-    df.aggregation = agg;
-    table.mutable_data_fields().push_back(std::move(df));
-    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-    auto r_or = evaluate(table, cache);
-    EXPECT_TRUE(static_cast<bool>(r_or));
-    return r_or.value();
-  };
-
-  for (Aggregation agg : {Aggregation::Var, Aggregation::StdDev}) {
-    PivotResult r = run(agg);
-    const std::size_t solo = row_index(r, "solo");
-    const std::size_t pair = row_index(r, "pair");
-    ASSERT_NE(solo, static_cast<std::size_t>(-1));
-    ASSERT_NE(pair, static_cast<std::size_t>(-1));
-    ASSERT_TRUE(r.values[solo][0][0].is_error());
-    EXPECT_EQ(r.values[solo][0][0].as_error(), ErrorCode::Div0);
-    EXPECT_TRUE(r.values[pair][0][0].is_number());
-  }
-  for (Aggregation agg : {Aggregation::VarP, Aggregation::StdDevP}) {
-    PivotResult r = run(agg);
-    const std::size_t solo = row_index(r, "solo");
-    const std::size_t pair = row_index(r, "pair");
-    // Population variant accepts n=1 and yields 0.
-    EXPECT_TRUE(r.values[solo][0][0].is_number());
-    EXPECT_DOUBLE_EQ(r.values[solo][0][0].as_number(), 0.0);
-    EXPECT_TRUE(r.values[pair][0][0].is_number());
-  }
-}
-
-// ---------------------------------------------------------------------------
-// 8c. Date grouping (Gregorian + Japanese)
-// ---------------------------------------------------------------------------
-//
-// Cache schema: Date (number, Excel serial) + Amount (number).
-// Records cover three calendar years and span the Heisei -> Reiwa boundary
-// so the Japanese-calendar bucket boundaries are exercised.
-PivotCache build_date_cache() {
-  // Excel serials (1900 leap-bug aware):
-  //   2018-12-31 -> 43465  (Heisei)
-  //   2019-04-30 -> 43585  (Heisei, last day of era)
-  //   2019-05-01 -> 43586  (Reiwa, first day of era)
-  //   2019-12-31 -> 43830  (Reiwa)
-  //   2024-03-15 -> 45366  (Reiwa)
-  //   2024-07-04 -> 45477  (Reiwa)
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Date", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](double serial, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(Value::number(serial));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add(43465.0, 10.0);
-  add(43585.0, 20.0);
-  add(43586.0, 40.0);
-  add(43830.0, 80.0);
-  add(45366.0, 160.0);
-  add(45477.0, 320.0);
-  return cache;
-}
-
-PivotTable build_date_grouped_table(DateGrouping g, CalendarSystem cal) {
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField date_f;
-  date_f.source_name = "Date";
-  date_f.axis = PivotAxis::Row;
-  PivotDateGroup dg;
-  dg.granularity = g;
-  dg.calendar = cal;
-  date_f.date_group = dg;
-  PivotField amount_f;
-  amount_f.source_name = "Amount";
-  amount_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(date_f));
-  table.mutable_fields().push_back(std::move(amount_f));
-  table.mutable_row_field_order() = {0};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 1;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  return table;
-}
-
-TEST(PivotEvaluator, DateGroupingByYearGregorian) {
-  PivotCache cache = build_date_cache();
-  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Gregorian);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Three Gregorian years: 2018, 2019, 2024 (chronological).
-  ASSERT_EQ(r.rows.size(), 3U);
-  EXPECT_EQ(r.rows[0].label, "2018");
-  EXPECT_EQ(r.rows[1].label, "2019");
-  EXPECT_EQ(r.rows[2].label, "2024");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 20.0 + 40.0 + 80.0);
-  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 160.0 + 320.0);
-}
-
-TEST(PivotEvaluator, DateGroupingByQuarterGregorian) {
-  PivotCache cache = build_date_cache();
-  PivotTable table = build_date_grouped_table(DateGrouping::Quarter, CalendarSystem::Gregorian);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // 2018-Q4 (Dec), 2019-Q2 (Apr+May), 2019-Q4 (Dec), 2024-Q1 (Mar), 2024-Q3 (Jul).
-  ASSERT_EQ(r.rows.size(), 5U);
-  EXPECT_EQ(r.rows[0].label, "2018-Q4");
-  EXPECT_EQ(r.rows[1].label, "2019-Q2");
-  EXPECT_EQ(r.rows[2].label, "2019-Q4");
-  EXPECT_EQ(r.rows[3].label, "2024-Q1");
-  EXPECT_EQ(r.rows[4].label, "2024-Q3");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 20.0 + 40.0);
-  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 80.0);
-  EXPECT_DOUBLE_EQ(r.values[3][0][0].as_number(), 160.0);
-  EXPECT_DOUBLE_EQ(r.values[4][0][0].as_number(), 320.0);
-}
-
-TEST(PivotEvaluator, DateGroupingByMonthGregorian) {
-  PivotCache cache = build_date_cache();
-  PivotTable table = build_date_grouped_table(DateGrouping::Month, CalendarSystem::Gregorian);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Six distinct months across the dataset.
-  ASSERT_EQ(r.rows.size(), 6U);
-  EXPECT_EQ(r.rows[0].label, "2018-12");
-  EXPECT_EQ(r.rows[1].label, "2019-04");
-  EXPECT_EQ(r.rows[2].label, "2019-05");
-  EXPECT_EQ(r.rows[3].label, "2019-12");
-  EXPECT_EQ(r.rows[4].label, "2024-03");
-  EXPECT_EQ(r.rows[5].label, "2024-07");
-}
-
-TEST(PivotEvaluator, DateGroupingByDay) {
-  PivotCache cache = build_date_cache();
-  PivotTable table = build_date_grouped_table(DateGrouping::Day, CalendarSystem::Gregorian);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Each record is a distinct day -> 6 leaves in chronological order.
-  ASSERT_EQ(r.rows.size(), 6U);
-  EXPECT_EQ(r.rows[0].label, "2018-12-31");
-  EXPECT_EQ(r.rows[1].label, "2019-04-30");
-  EXPECT_EQ(r.rows[2].label, "2019-05-01");
-  EXPECT_EQ(r.rows[3].label, "2019-12-31");
-  EXPECT_EQ(r.rows[4].label, "2024-03-15");
-  EXPECT_EQ(r.rows[5].label, "2024-07-04");
-}
-
-TEST(PivotEvaluator, DateGroupingByYearJapaneseCalendar) {
-  PivotCache cache = build_date_cache();
-  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Japanese);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // 2018 -> Heisei 30, 2019-04-30 -> Heisei 31, 2019-05-01 -> Reiwa 1,
-  // 2019-12-31 -> Reiwa 1, 2024 -> Reiwa 6.
-  // Buckets in chronological order: 平成30 / 平成31 / 令和1 / 令和6.
-  ASSERT_EQ(r.rows.size(), 4U);
-  // 平成 = E5 B9 B3 E6 88 90, 令和 = E4 BB A4 E5 92 8C, 年 = E5 B9 B4
-  EXPECT_EQ(r.rows[0].label, std::string("\xE5\xB9\xB3\xE6\x88\x90") + "30" + "\xE5\xB9\xB4");
-  EXPECT_EQ(r.rows[1].label, std::string("\xE5\xB9\xB3\xE6\x88\x90") + "31" + "\xE5\xB9\xB4");
-  EXPECT_EQ(r.rows[2].label, std::string("\xE4\xBB\xA4\xE5\x92\x8C") + "1" + "\xE5\xB9\xB4");
-  EXPECT_EQ(r.rows[3].label, std::string("\xE4\xBB\xA4\xE5\x92\x8C") + "6" + "\xE5\xB9\xB4");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 10.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 20.0);
-  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 40.0 + 80.0);
-  EXPECT_DOUBLE_EQ(r.values[3][0][0].as_number(), 160.0 + 320.0);
-}
-
-TEST(PivotEvaluator, DateGroupingNonNumericPassesThrough) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Date", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  // A blank (not a serial) should not crash; bucket_date is only invoked
-  // for numeric values.
-  PivotCacheRecord rec;
-  rec.cells.push_back(Value::blank());
-  rec.cells.push_back(Value::number(42.0));
-  cache.mutable_records().push_back(std::move(rec));
-
-  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Gregorian);
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  // The single blank-keyed bucket survives without exploding; label is the
-  // empty string (per `display_string` for Blank).
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-}
-
-// ---------------------------------------------------------------------------
-// Sub-day granularities (Hour / Minute / Second).
-// ---------------------------------------------------------------------------
-//
-// These build their own caches so the records can carry sub-day fractions
-// that don't fit `build_date_cache()`'s shape.
-
-PivotCache build_two_field_cache() {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Date", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  return cache;
-}
-
-void push_record(PivotCache& cache, double serial, double amount) {
-  PivotCacheRecord rec;
-  rec.cells.push_back(Value::number(serial));
-  rec.cells.push_back(Value::number(amount));
-  cache.mutable_records().push_back(std::move(rec));
-}
-
-TEST(PivotEvaluator, DateGroupingByHour) {
-  // Two records on 2024-03-15 within different hours, plus a third in the
-  // same hour as the second so the second bucket sums two rows.
-  const double base = 45366.0;  // 2024-03-15
-  PivotCache cache = build_two_field_cache();
-  push_record(cache, base + 9.0 / 24.0 + 30.0 / 1440.0, 1.0);   // 09:30
-  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0, 2.0);   // 10:05
-  push_record(cache, base + 10.0 / 24.0 + 45.0 / 1440.0, 4.0);  // 10:45
-
-  PivotTable table = build_date_grouped_table(DateGrouping::Hour, CalendarSystem::Gregorian);
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_EQ(r.rows[0].label, "2024-03-15 09");
-  EXPECT_EQ(r.rows[1].label, "2024-03-15 10");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 2.0 + 4.0);
-}
-
-TEST(PivotEvaluator, DateGroupingByMinute) {
-  // Two minutes within the same hour; chronological ordering is preserved.
-  const double base = 45366.0;  // 2024-03-15
-  PivotCache cache = build_two_field_cache();
-  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0, 1.0);   // 10:05
-  push_record(cache, base + 10.0 / 24.0 + 45.0 / 1440.0, 2.0);  // 10:45
-  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0, 4.0);   // 10:05 again
-
-  PivotTable table = build_date_grouped_table(DateGrouping::Minute, CalendarSystem::Gregorian);
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_EQ(r.rows[0].label, "2024-03-15 10:05");
-  EXPECT_EQ(r.rows[1].label, "2024-03-15 10:45");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0 + 4.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 2.0);
-}
-
-TEST(PivotEvaluator, DateGroupingBySecond) {
-  // Two seconds within the same minute.
-  const double base = 45366.0;  // 2024-03-15
-  PivotCache cache = build_two_field_cache();
-  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0 + 12.0 / 86400.0, 1.0);  // 10:05:12
-  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0 + 47.0 / 86400.0, 2.0);  // 10:05:47
-  push_record(cache, base + 10.0 / 24.0 + 5.0 / 1440.0 + 12.0 / 86400.0, 4.0);  // 10:05:12 again
-
-  PivotTable table = build_date_grouped_table(DateGrouping::Second, CalendarSystem::Gregorian);
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_EQ(r.rows[0].label, "2024-03-15 10:05:12");
-  EXPECT_EQ(r.rows[1].label, "2024-03-15 10:05:47");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0 + 4.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 2.0);
-}
-
-// A 1904-epoch workbook stores its cache serials on that epoch's scale.
-// Bucketing them as if they were 1900-epoch (the pre-fix default) would
-// misread the civil year by roughly four years; passing the workbook's
-// actual epoch through `PivotFilterEnv` keeps the bucket on the year the
-// record was actually authored under.
-TEST(PivotEvaluator, DateGroupingByYearHonorsDate1904Epoch) {
-  PivotCache cache = build_two_field_cache();
-  push_record(cache, date_time::serial_from_ymd(2024, 3, 15, /*date1904=*/true), 10.0);
-  push_record(cache, date_time::serial_from_ymd(2023, 6, 1, /*date1904=*/true), 20.0);
-
-  PivotTable table = build_date_grouped_table(DateGrouping::Year, CalendarSystem::Gregorian);
-  PivotFilterEnv env;
-  env.date1904 = true;
-  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_EQ(r.rows[0].label, "2023");
-  EXPECT_EQ(r.rows[1].label, "2024");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 20.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 10.0);
-}
-
-// ---------------------------------------------------------------------------
-// Days-interval grouping ("By: Days", `rangePr groupBy="days"`).
-//
-// Measured against Windows Excel 365 ja-JP build 16.0.20228
-// (tests/fixtures/excel/win/pivot_week_1900/results.json). Source data:
-// 71 records, one per Excel serial 0..70 under the 1900 epoch, amount 1
-// each (grand total 71). Every variant groups by 7 days with End left
-// auto; only Start varies.
-// ---------------------------------------------------------------------------
-
-PivotCache build_days_interval_cache() {
-  PivotCache cache = build_two_field_cache();
-  for (double serial = 0.0; serial <= 70.0; serial += 1.0) {
-    push_record(cache, serial, 1.0);
-  }
-  return cache;
-}
-
-PivotTable build_days_grouped_table(std::optional<double> start_serial, std::uint32_t interval_days = 7,
-                                    std::optional<double> end_serial = std::nullopt) {
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField date_f;
-  date_f.source_name = "Date";
-  date_f.axis = PivotAxis::Row;
-  PivotDateGroup dg;
-  dg.granularity = DateGrouping::Days;
-  dg.interval_days = interval_days;
-  dg.start_serial = start_serial;
-  dg.end_serial = end_serial;
-  date_f.date_group = dg;
-  PivotField amount_f;
-  amount_f.source_name = "Amount";
-  amount_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(date_f));
-  table.mutable_fields().push_back(std::move(amount_f));
-  table.mutable_row_field_order() = {0};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 1;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  return table;
-}
-
-TEST(PivotEvaluator, DateGroupingByDaysIntervalAutoStart) {
-  PivotCache cache = build_days_interval_cache();
-  PivotTable table = build_days_grouped_table(/*start_serial=*/std::nullopt);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Ten full 7-day buckets from the data minimum (serial 0) plus one
-  // trailing bucket clipped to the resolved auto End (data max + 1),
-  // which is one day past the last record (serial 70 = "1900/3/10").
-  ASSERT_EQ(r.rows.size(), 11U);
-  EXPECT_EQ(r.rows[0].label, "1900/1/0 - 1900/1/6");
-  EXPECT_EQ(r.rows[1].label, "1900/1/7 - 1900/1/13");
-  EXPECT_EQ(r.rows[2].label, "1900/1/14 - 1900/1/20");
-  EXPECT_EQ(r.rows[3].label, "1900/1/21 - 1900/1/27");
-  EXPECT_EQ(r.rows[4].label, "1900/1/28 - 1900/2/3");
-  EXPECT_EQ(r.rows[5].label, "1900/2/4 - 1900/2/10");
-  EXPECT_EQ(r.rows[6].label, "1900/2/11 - 1900/2/17");
-  EXPECT_EQ(r.rows[7].label, "1900/2/18 - 1900/2/24");
-  EXPECT_EQ(r.rows[8].label, "1900/2/25 - 1900/3/2");
-  EXPECT_EQ(r.rows[9].label, "1900/3/3 - 1900/3/9");
-  EXPECT_EQ(r.rows[10].label, "1900/3/10 - 1900/3/11");
-  for (std::size_t i = 0; i < 10; ++i) {
-    EXPECT_DOUBLE_EQ(r.values[i][0][0].as_number(), 7.0) << "bucket " << i;
-  }
-  EXPECT_DOUBLE_EQ(r.values[10][0][0].as_number(), 1.0);
-}
-
-TEST(PivotEvaluator, DateGroupingByDaysIntervalExplicitStartEqualsMinMatchesAuto) {
-  // Start=0 explicit coincides with the data minimum, so Excel renders the
-  // identical bucket set as the auto case above.
-  PivotCache cache = build_days_interval_cache();
-  PivotTable table = build_days_grouped_table(/*start_serial=*/0.0);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 11U);
-  EXPECT_EQ(r.rows[0].label, "1900/1/0 - 1900/1/6");
-  EXPECT_EQ(r.rows[10].label, "1900/3/10 - 1900/3/11");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 7.0);
-  EXPECT_DOUBLE_EQ(r.values[10][0][0].as_number(), 1.0);
-}
-
-TEST(PivotEvaluator, DateGroupingByDaysIntervalExplicitStartAboveMinAddsCatchAll) {
-  // Start=1 is one past the data minimum (serial 0): a catch-all bucket
-  // absorbs everything below it, and since (71-1) records divide evenly
-  // by 7 the trailing regular bucket is NOT clipped here, unlike the
-  // auto/Start=0 case above.
-  PivotCache cache = build_days_interval_cache();
-  PivotTable table = build_days_grouped_table(/*start_serial=*/1.0);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 11U);
-  EXPECT_EQ(r.rows[0].label, "<1900/1/1");
-  EXPECT_EQ(r.rows[1].label, "1900/1/1 - 1900/1/7");
-  EXPECT_EQ(r.rows[2].label, "1900/1/8 - 1900/1/14");
-  EXPECT_EQ(r.rows[3].label, "1900/1/15 - 1900/1/21");
-  EXPECT_EQ(r.rows[4].label, "1900/1/22 - 1900/1/28");
-  EXPECT_EQ(r.rows[5].label, "1900/1/29 - 1900/2/4");
-  EXPECT_EQ(r.rows[6].label, "1900/2/5 - 1900/2/11");
-  EXPECT_EQ(r.rows[7].label, "1900/2/12 - 1900/2/18");
-  EXPECT_EQ(r.rows[8].label, "1900/2/19 - 1900/2/25");
-  EXPECT_EQ(r.rows[9].label, "1900/2/26 - 1900/3/3");
-  EXPECT_EQ(r.rows[10].label, "1900/3/4 - 1900/3/10");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
-  for (std::size_t i = 1; i < 11; ++i) {
-    EXPECT_DOUBLE_EQ(r.values[i][0][0].as_number(), 7.0) << "bucket " << i;
-  }
-}
-
-TEST(PivotEvaluator, DateGroupingByDaysIntervalExplicitStartDeepInDataClipsLastBucket) {
-  // Start=61 puts 61 of the 71 records into the catch-all; the trailing
-  // regular bucket clips to the resolved auto End (data max + 1), not to
-  // the true data max, so its label spans one day past the last record.
-  PivotCache cache = build_days_interval_cache();
-  PivotTable table = build_days_grouped_table(/*start_serial=*/61.0);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 3U);
-  EXPECT_EQ(r.rows[0].label, "<1900/3/1");
-  EXPECT_EQ(r.rows[1].label, "1900/3/1 - 1900/3/7");
-  EXPECT_EQ(r.rows[2].label, "1900/3/8 - 1900/3/11");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 61.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 7.0);
-  EXPECT_DOUBLE_EQ(r.values[2][0][0].as_number(), 3.0);
-}
-
-TEST(PivotEvaluator, DateGroupingByDaysIntervalExplicitEndAboveDataMaxAddsCatchAll) {
-  // Mirror image of ExplicitStartAboveMinAddsCatchAll: an explicit End
-  // (60) short of the data maximum (70) collapses everything above it
-  // into one ">1900/2/29" catch-all, and the last regular bucket clips
-  // to End the same way the auto-End case clips to the data maximum.
-  // Serial 60 is "1900/2/29" (Excel's 1900 system has a phantom leap
-  // day real Gregorian 1900 does not), not "1900/3/1" -- confirmed by
-  // pivot_week_1900's own auto-End bucket "1900/2/25 - 1900/3/2",
-  // which spans serials 56-62 including the ghost day. Not in the
-  // fixture itself (which only varies Start, never End); label shape
-  // mirrors the measured `<start` bucket, but `>end` itself is
-  // unmeasured.
-  PivotCache cache = build_days_interval_cache();
-  PivotTable table = build_days_grouped_table(/*start_serial=*/std::nullopt, /*interval_days=*/7,
-                                              /*end_serial=*/60.0);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 10U);
-  EXPECT_EQ(r.rows[0].label, "1900/1/0 - 1900/1/6");
-  EXPECT_EQ(r.rows[7].label, "1900/2/18 - 1900/2/24");
-  EXPECT_EQ(r.rows[8].label, "1900/2/25 - 1900/2/29");
-  EXPECT_EQ(r.rows[9].label, ">1900/2/29");
-  for (std::size_t i = 0; i < 8; ++i) {
-    EXPECT_DOUBLE_EQ(r.values[i][0][0].as_number(), 7.0) << "bucket " << i;
-  }
-  EXPECT_DOUBLE_EQ(r.values[8][0][0].as_number(), 5.0);   // 1900/2/25..1900/3/1: 5 records.
-  EXPECT_DOUBLE_EQ(r.values[9][0][0].as_number(), 10.0);  // 1900/3/2..1900/3/11: 10 records.
-}
-
-// ---------------------------------------------------------------------------
-// 10. Grand total when flagged
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, GrandTotalWhenFlagged) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/true, /*cols=*/false);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_TRUE(r.grand_total.is_number());
-  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 675.0);  // 100 + 50 + 200 + 300 + 25
-  ASSERT_EQ(r.grand_totals.size(), 1U);
-  ASSERT_TRUE(r.grand_totals[0].is_number());
-  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 675.0);
-}
-
-TEST(PivotEvaluator, GrandTotalsCarryOneValuePerDataField) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  PivotDataField count_amount;
-  count_amount.name = "Count of Amount";
-  count_amount.field_index = 2;
-  count_amount.aggregation = Aggregation::Count;
-  table.mutable_data_fields().push_back(std::move(count_amount));
-  table.set_grand_totals(/*rows=*/true, /*cols=*/true);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.grand_totals.size(), 2U);
-  ASSERT_TRUE(r.grand_totals[0].is_number());
-  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 675.0);
-  ASSERT_TRUE(r.grand_totals[1].is_number());
-  EXPECT_DOUBLE_EQ(r.grand_totals[1].as_number(), 5.0);
-  ASSERT_TRUE(r.grand_total.is_number());
-  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), r.grand_totals[0].as_number());
-}
-
-// ---------------------------------------------------------------------------
-// 11. Grand total when not flagged stays Blank
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, GrandTotalBlankWhenDisabled) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  EXPECT_TRUE(r_or.value().grand_total.is_blank());
-}
-
-// ---------------------------------------------------------------------------
-// 12. Cache id mismatch
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, CacheIdMismatchYieldsMissing) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_pivot_cache_id(99);  // Cache has id 1.
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_FALSE(static_cast<bool>(r_or));
-  EXPECT_EQ(r_or.error().code, FormulonErrorCode::kEvalPivotMissing);
-}
-
-// ---------------------------------------------------------------------------
-// 13. Out-of-bounds field_index
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, OutOfRangeFieldIndexYieldsInvalid) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.mutable_data_fields()[0].field_index = 99;
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_FALSE(static_cast<bool>(r_or));
-  EXPECT_EQ(r_or.error().code, FormulonErrorCode::kEvalPivotInvalid);
-}
-
-// ---------------------------------------------------------------------------
-// 13b. An axis field the reader could not decode grouping for
-// ---------------------------------------------------------------------------
-
-// The reader has no structural model for Excel's date/number grouping
-// (`databaseField="0"` cache fields backed by a `<fieldGroup>`); every
-// record's value for such a field is the placeholder `Value::blank()`.
-// Placing one on an axis must refuse evaluation rather than silently
-// collapse that axis to a single blank item.
-TEST(PivotEvaluator, GroupingDerivedAxisFieldWithNoDateGroupIsRefused) {
-  PivotCache cache = build_basic_cache();
-  cache.mutable_fields().push_back(PivotCacheField{"Region Years", {}});
-  cache.mutable_fields().back().is_database_field = false;
-  cache.mutable_fields().back().field_group_xml = "<fieldGroup base=\"0\"><rangePr groupBy=\"years\"/></fieldGroup>";
-
-  PivotTable table = build_sum_amount_table(/*row=*/{3}, /*col=*/{});
-  PivotField grouped_f;
-  grouped_f.source_name = "Region Years";
-  grouped_f.axis = PivotAxis::Row;
-  table.mutable_fields().push_back(std::move(grouped_f));
-  table.mutable_row_field_order() = {3};
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_FALSE(static_cast<bool>(r_or));
-  EXPECT_EQ(r_or.error().code, FormulonErrorCode::kEvalPivotInvalid);
-}
-
-// A caller that has supplied its own `date_group` (via the C API setter)
-// is exempt: evaluation proceeds using that grouping instead of refusing.
-TEST(PivotEvaluator, GroupingDerivedAxisFieldWithDateGroupSetEvaluatesNormally) {
-  PivotCache cache = build_basic_cache();
-  cache.mutable_fields().push_back(PivotCacheField{"Region Years", {}});
-  cache.mutable_fields().back().is_database_field = false;
-  cache.mutable_fields().back().field_group_xml = "<fieldGroup base=\"0\"><rangePr groupBy=\"years\"/></fieldGroup>";
-
-  PivotTable table = build_sum_amount_table(/*row=*/{3}, /*col=*/{});
-  PivotField grouped_f;
-  grouped_f.source_name = "Region Years";
-  grouped_f.axis = PivotAxis::Row;
-  grouped_f.date_group = PivotDateGroup{};
-  table.mutable_fields().push_back(std::move(grouped_f));
-  table.mutable_row_field_order() = {3};
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-}
-
-// ---------------------------------------------------------------------------
-// 14. Error in source value propagates through SUM
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, ErrorPropagatesThroughSum) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  auto add = [&](const char* g, Value v) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, g));
-    rec.cells.push_back(v);
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("A", Value::number(10.0));
-  add("A", Value::error(ErrorCode::Div0));
-  add("A", Value::number(20.0));
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField gf;
-  gf.source_name = "Group";
-  gf.axis = PivotAxis::Row;
-  PivotField af;
-  af.source_name = "Amount";
-  af.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(gf));
-  table.mutable_fields().push_back(std::move(af));
-  table.mutable_row_field_order() = {0};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 1;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 1U);
-  ASSERT_TRUE(r.values[0][0][0].is_error());
-  EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::Div0);
-}
-
-// ---------------------------------------------------------------------------
-// 14b. Count / CountNumbers classify cells, so a source error never becomes
-//      the count -- at the leaf, at the subtotal, or at the grand total
-// ---------------------------------------------------------------------------
-
-// Builds a Group x Sub hierarchy over a value column that carries one
-// error, so a single `#N/A` reaches the leaf cell, its group's subtotal and
-// the grand total through the same aggregation.
-PivotTable build_count_over_error_table(PivotCache& cache, Aggregation aggregation) {
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Group", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Sub", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  auto add = [&](const char* group, const char* sub, Value v) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, group));
-    rec.cells.push_back(owned_text(cache, sub));
-    rec.cells.push_back(v);
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("A", "x", Value::number(10.0));
-  add("A", "x", Value::error(ErrorCode::NA));  // e.g. a lookup that missed
-  add("A", "y", Value::number(20.0));
-  add("B", "x", Value::number(30.0));
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField group_f;
-  group_f.source_name = "Group";
-  group_f.axis = PivotAxis::Row;
-  group_f.subtotal_top = true;
-  PivotField sub_f;
-  sub_f.source_name = "Sub";
-  sub_f.axis = PivotAxis::Row;
-  PivotField amount_f;
-  amount_f.source_name = "Amount";
-  amount_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(group_f));
-  table.mutable_fields().push_back(std::move(sub_f));
-  table.mutable_fields().push_back(std::move(amount_f));
-  table.mutable_row_field_order() = {0, 1};
-  PivotDataField df;
-  df.name = "Count of Amount";
-  df.field_index = 2;
-  df.aggregation = aggregation;
-  table.mutable_data_fields().push_back(std::move(df));
-  table.set_grand_totals(/*rows=*/true, /*cols=*/true);
-  return table;
-}
-
-TEST(PivotEvaluator, CountCountsAnErrorCellInsteadOfReturningIt) {
-  PivotCache cache;
-  PivotTable table = build_count_over_error_table(cache, Aggregation::Count);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Row leaves are A/x, A/y, B/x in hierarchy order; A/x is the one
-  // holding a number and the error, and COUNTA counts both.
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_EQ(r.rows[0].label, "A");
-  ASSERT_EQ(r.values.size(), 3U);
-  ASSERT_TRUE(r.values[0][0][0].is_number()) << "Count returned " << r.values[0][0][0].debug_to_string();
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 2.0);
-
-  // The group subtotal and the grand total run the same aggregation over a
-  // wider record set, so they must not turn into the error either.
-  ASSERT_EQ(r.row_subtotals.size(), 2U);
-  ASSERT_TRUE(r.row_subtotals[0].values[0].is_number());
-  EXPECT_DOUBLE_EQ(r.row_subtotals[0].values[0].as_number(), 3.0);
-  ASSERT_FALSE(r.grand_totals.empty());
-  ASSERT_TRUE(r.grand_totals[0].is_number());
-  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 4.0);
-}
-
-TEST(PivotEvaluator, CountNumbersPassesOverAnErrorCellInsteadOfReturningIt) {
-  PivotCache cache;
-  PivotTable table = build_count_over_error_table(cache, Aggregation::CountNumbers);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // COUNT admits only numeric cells, so the error is passed over rather
-  // than counted -- and still never becomes the result.
-  ASSERT_EQ(r.values.size(), 3U);
-  ASSERT_TRUE(r.values[0][0][0].is_number()) << "CountNumbers returned " << r.values[0][0][0].debug_to_string();
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1.0);
-
-  ASSERT_EQ(r.row_subtotals.size(), 2U);
-  ASSERT_TRUE(r.row_subtotals[0].values[0].is_number());
-  EXPECT_DOUBLE_EQ(r.row_subtotals[0].values[0].as_number(), 2.0);
-  ASSERT_FALSE(r.grand_totals.empty());
-  ASSERT_TRUE(r.grand_totals[0].is_number());
-  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 3.0);
-}
-
-// The arithmetic aggregations keep the short-circuit: the same fixture
-// under SUM still reports the error, so the change above is scoped to the
-// COUNT family rather than to error handling in general.
-TEST(PivotEvaluator, SumOverTheSameFixtureStillPropagatesTheError) {
-  PivotCache cache;
-  PivotTable table = build_count_over_error_table(cache, Aggregation::Sum);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.values.size(), 3U);
-  ASSERT_TRUE(r.values[0][0][0].is_error());
-  EXPECT_EQ(r.values[0][0][0].as_error(), ErrorCode::NA);
-}
-
-// ---------------------------------------------------------------------------
-// Bonus: subtotal at Region level when subtotal_top is set
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, RowSubtotalEmittedWhenRequested) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Region declares subtotal_top so Region-level subtotals appear.
-  table.mutable_fields()[0].subtotal_top = true;
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Two regions -> two subtotal rows, each with one data field slot.
-  ASSERT_EQ(r.subtotals.size(), 2U);
-  ASSERT_EQ(r.row_subtotals.size(), 2U);
-  ASSERT_EQ(r.subtotals[0].size(), 1U);
-  EXPECT_EQ(r.row_subtotals[0].depth, 0U);
-  ASSERT_EQ(r.row_subtotals[0].labels.size(), 1U);
-  // Subtotals appear in row-hierarchy DFS order (post-order at each
-  // non-leaf), matching how Excel walks the tree to position them.
-  std::vector<double> totals{r.subtotals[0][0].as_number(), r.subtotals[1][0].as_number()};
-  std::sort(totals.begin(), totals.end());
-  EXPECT_DOUBLE_EQ(totals[0], 175.0);  // North subtotal: 100 + 50 + 25
-  EXPECT_DOUBLE_EQ(totals[1], 500.0);  // South subtotal: 200 + 300
-}
-
-TEST(PivotEvaluator, ColSubtotalEmittedWhenRequested) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{}, /*col=*/{0, 1});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  table.mutable_fields()[0].subtotal_top = true;
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.col_subtotals.size(), 2U);
-  ASSERT_EQ(r.col_subtotals[0].labels.size(), 1U);
-  EXPECT_EQ(r.col_subtotals[0].depth, 0U);
-  ASSERT_EQ(r.col_subtotals[0].values.size(), 1U);
-  ASSERT_EQ(r.col_subtotals[0].values[0].size(), 1U);
-
-  std::vector<double> totals{r.col_subtotals[0].values[0][0].as_number(), r.col_subtotals[1].values[0][0].as_number()};
-  std::sort(totals.begin(), totals.end());
-  EXPECT_DOUBLE_EQ(totals[0], 175.0);
-  EXPECT_DOUBLE_EQ(totals[1], 500.0);
-}
-
-// ---------------------------------------------------------------------------
-// Regression: subtotals are gated by default_subtotal, not subtotal_top.
-// A multi-level row hierarchy emits outer-field subtotals by default even
-// when subtotal_top was never set (subtotal_top is only the position flag).
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, OuterSubtotalEmittedByDefaultWithoutSubtotalTop) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
-  // Do not touch subtotal_top; default_subtotal defaults to true.
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  // Region-level (depth 0) subtotals for North and South are present.
-  ASSERT_EQ(r.row_subtotals.size(), 2U);
-  EXPECT_EQ(r.row_subtotals[0].depth, 0U);
-}
-
-TEST(PivotEvaluator, DefaultSubtotalOffSuppressesOuterSubtotal) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
-  table.mutable_fields()[0].default_subtotal = false;  // Region: no subtotal.
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  EXPECT_TRUE(r_or.value().row_subtotals.empty());
-}
-
-// ---------------------------------------------------------------------------
-// H-23: a custom subtotal function replaces the default aggregation for the
-// group's subtotal row.
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, CustomSubtotalFunctionUsesSelectedAggregation) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
-  // Region subtotal computed with Average instead of the data field's Sum.
-  table.mutable_fields()[0].subtotal_fns = {SubtotalFn::Average};
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.row_subtotals.size(), 2U);
-  // North amounts: 100, 50, 25 -> average 58.333..., not the Sum 175.
-  std::size_t north = r.row_subtotals[0].labels[0] == "North" ? 0 : 1;
-  ASSERT_LT(north, r.row_subtotals.size());
-  ASSERT_FALSE(r.row_subtotals[north].values.empty());
-  ASSERT_TRUE(r.row_subtotals[north].values[0].is_number());
-  EXPECT_NEAR(r.row_subtotals[north].values[0].as_number(), 175.0 / 3.0, 1e-9);
-}
-
-TEST(PivotEvaluator, ColumnCustomSubtotalFunctionUsesSelectedAggregation) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{}, /*col=*/{0, 1});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  table.mutable_fields()[0].subtotal_fns = {SubtotalFn::Average};
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.col_subtotals.size(), 2U);
-
-  const std::size_t north = r.col_subtotals[0].labels[0] == "North" ? 0 : 1;
-  ASSERT_LT(north, r.col_subtotals.size());
-  ASSERT_TRUE(r.col_subtotals[north].aggregation.has_value());
-  EXPECT_EQ(*r.col_subtotals[north].aggregation, Aggregation::Average);
-  ASSERT_EQ(r.col_subtotals[north].values.size(), 1U);
-  ASSERT_EQ(r.col_subtotals[north].values[0].size(), 1U);
-  ASSERT_TRUE(r.col_subtotals[north].values[0][0].is_number());
-  EXPECT_NEAR(r.col_subtotals[north].values[0][0].as_number(), 175.0 / 3.0, 1e-9);
-}
-
-// ---------------------------------------------------------------------------
-// H-24: per-leaf row/col totals re-aggregate the underlying records so a
-// non-additive function (Average) is not computed as an average of the
-// per-cell averages.
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, NonAdditiveRowTotalReaggregates) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
-  table.mutable_data_fields()[0].aggregation = Aggregation::Average;
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  const std::size_t north = row_index(r, "North");
-  ASSERT_LT(north, r.row_leaf_totals.size());
-  ASSERT_FALSE(r.row_leaf_totals[north].empty());
-  ASSERT_TRUE(r.row_leaf_totals[north][0].is_number());
-  // North across all products: mean(100, 50, 25) = 58.333..., NOT the mean
-  // of the per-cell averages (62.5, 50) = 56.25.
-  EXPECT_NEAR(r.row_leaf_totals[north][0].as_number(), 175.0 / 3.0, 1e-9);
-}
-
-// ---------------------------------------------------------------------------
-// M-22: the pivot comparator folds Japanese text (half-width katakana to
-// full-width) exactly like the GROUPBY / SORT comparator, so the two cannot
-// diverge on kana collation.
-// ---------------------------------------------------------------------------
-
-TEST(PivotComparatorParity, FoldsHalfWidthKatakana) {
-  // U+FF76 (halfwidth ｶ) folds to U+30AB (fullwidth カ); after folding the
-  // two are equal, so neither orders before the other.
-  const Value full = Value::text("\xE3\x82\xAB");  // カ
-  const Value half = Value::text("\xEF\xBD\xB6");  // ｶ
-  EXPECT_FALSE(value_less(full, half));
-  EXPECT_FALSE(value_less(half, full));
-  // GROUPBY / SORT agrees they are equal.
-  EXPECT_EQ(eval::cmp_value_asc(full, half), 0);
-}
-
-// ---------------------------------------------------------------------------
-// Narrowing an embedder-supplied double to an index.
-//
-// A hand-built cache stores whatever number the embedder passed, and a value
-// filter stores whatever count it was given. Both reach a `std::size_t`
-// narrowing, which is undefined for NaN, for either infinity, and for any
-// magnitude the destination cannot represent — and a trap, not a wrong
-// answer, once the same code is compiled to wasm32.
-// ---------------------------------------------------------------------------
-
-TEST(CheckedIndex, RejectsEveryDoubleOutsideTheContainerBound) {
-  constexpr double kNaN = std::numeric_limits<double>::quiet_NaN();
-  constexpr double kInf = std::numeric_limits<double>::infinity();
-  constexpr std::size_t kLimit = 4;
-
-  EXPECT_FALSE(index_from_double(kNaN, kLimit).has_value());
-  EXPECT_FALSE(index_from_double(kInf, kLimit).has_value());
-  EXPECT_FALSE(index_from_double(-kInf, kLimit).has_value());
-  EXPECT_FALSE(index_from_double(-1.0, kLimit).has_value());
-  EXPECT_FALSE(index_from_double(static_cast<double>(kLimit), kLimit).has_value());
-  EXPECT_FALSE(index_from_double(static_cast<double>(kLimit) + 1.0, kLimit).has_value());
-  EXPECT_FALSE(index_from_double(1e30, kLimit).has_value());
-  EXPECT_FALSE(index_from_double(9007199254740992.0, kLimit).has_value());  // 2^53.
-
-  // In-domain values, including the negative zero that compares equal to 0.
-  EXPECT_EQ(index_from_double(0.0, kLimit), std::optional<std::size_t>{0});
-  EXPECT_EQ(index_from_double(-0.0, kLimit), std::optional<std::size_t>{0});
-  EXPECT_EQ(index_from_double(0.5, kLimit), std::optional<std::size_t>{0});
-  EXPECT_EQ(index_from_double(static_cast<double>(kLimit) - 1.0, kLimit), std::optional<std::size_t>{kLimit - 1});
-
-  // An empty container has no valid index at all.
-  EXPECT_FALSE(index_from_double(0.0, 0U).has_value());
-  EXPECT_FALSE(index_from_double(kNaN, 0U).has_value());
-}
-
-TEST(PivotRecordAccess, OutOfDomainSharedItemIndexCollapsesToBlank) {
-  // One shared item, so index 0 is the only resolvable reference. A cache
-  // built through the mutation API leaves `cell_is_index` empty, which is
-  // what makes a numeric cell in a shared field be read as an index.
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {Value::number(42.0)}});
-
-  const struct {
-    double stored;
-    bool resolves;
-  } cases[] = {
-      {std::numeric_limits<double>::quiet_NaN(), false},
-      {std::numeric_limits<double>::infinity(), false},
-      {-std::numeric_limits<double>::infinity(), false},
-      {-1.0, false},
-      {1e30, false},
-      {4.3e9, false},  // Past the wasm32 `size_t` range as well as past the container.
-      {1.0, false},    // One past the only shared item.
-      {0.0, true},
-      {0.5, true},
-  };
-
-  for (const auto& c : cases) {
-    PivotCacheRecord record;
-    record.cells.push_back(Value::number(c.stored));
-    ASSERT_TRUE(record.cell_is_index.empty());
-    const Value v = cell_value(cache, record, 0);
-    if (c.resolves) {
-      ASSERT_TRUE(v.is_number()) << "stored=" << c.stored;
-      EXPECT_DOUBLE_EQ(v.as_number(), 42.0) << "stored=" << c.stored;
-    } else {
-      EXPECT_TRUE(v.is_blank()) << "stored=" << c.stored;
-    }
-  }
-}
-
-TEST(PivotEvaluator, ValueTop10FilterSaturatesOutOfDomainCounts) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* region, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("A", 10.0);
-  add("B", 50.0);
-  add("C", 30.0);
-  add("D", 20.0);
-
-  // Returns how many row leaves survive a Top-N filter asking for `requested`.
-  auto rows_kept = [&cache](double requested) -> std::size_t {
-    PivotTable table;
-    table.set_pivot_cache_id(1);
-    PivotField rf;
-    rf.source_name = "Region";
-    rf.axis = PivotAxis::Row;
-    PivotField af;
-    af.source_name = "Amount";
-    af.axis = PivotAxis::Value;
-    table.mutable_fields().push_back(std::move(rf));
-    table.mutable_fields().push_back(std::move(af));
-    table.mutable_row_field_order() = {0};
-    PivotDataField sum;
-    sum.name = "Sum of Amount";
-    sum.field_index = 1;
-    sum.aggregation = Aggregation::Sum;
-    table.mutable_data_fields().push_back(std::move(sum));
-    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-    PivotFilter f;
-    f.axis = PivotAxis::Row;
-    f.field_name = "Region";
-    f.type = FilterType::ValueTop10;
-    f.value = requested;
-    table.mutable_active_filters().push_back(f);
-
-    auto r_or = evaluate(table, cache);
-    EXPECT_TRUE(static_cast<bool>(r_or)) << "requested=" << requested;
-    if (!r_or) {
-      return 0;
-    }
-    return r_or.value().rows.size();
-  };
-
-  // NaN loses every comparison and a negative count asks for nothing.
-  EXPECT_EQ(rows_kept(std::numeric_limits<double>::quiet_NaN()), 0U);
-  EXPECT_EQ(rows_kept(-1.0), 0U);
-  EXPECT_EQ(rows_kept(0.0), 0U);
-  // A count at or beyond the axis keeps every leaf.
-  EXPECT_EQ(rows_kept(1e30), 4U);
-  EXPECT_EQ(rows_kept(std::numeric_limits<double>::infinity()), 4U);
-  EXPECT_EQ(rows_kept(4.0), 4U);
-  // And an ordinary count still ranks.
-  EXPECT_EQ(rows_kept(2.0), 2U);
-}
-
-// ---------------------------------------------------------------------------
-// Value filters must leave every leaf-indexed structure in one index space
-// ---------------------------------------------------------------------------
-
-// Builds a cache with a two-level row axis (Region -> Product) and a two-level
-// column axis (Year -> Quarter), so the evaluator emits both row and column
-// subtotals. Each cell holds `region_product_base * year_quarter_multiplier`,
-// which makes the leaf scores easy to rank:
-//
-//   base:       North/A=1  North/B=2  South/A=10  South/B=20
-//   multiplier: 2024/Q1=1  2024/Q2=2  2025/Q1=10  2025/Q2=20
-PivotCache build_subtotal_grid_cache() {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Year", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  const struct {
-    const char* region;
-    const char* product;
-    double base;
-  } rows[] = {{"North", "A", 1.0}, {"North", "B", 2.0}, {"South", "A", 10.0}, {"South", "B", 20.0}};
-  const struct {
-    const char* year;
-    const char* quarter;
-    double multiplier;
-  } cols[] = {{"2024", "Q1", 1.0}, {"2024", "Q2", 2.0}, {"2025", "Q1", 10.0}, {"2025", "Q2", 20.0}};
-
-  for (const auto& row : rows) {
-    for (const auto& col : cols) {
-      PivotCacheRecord rec;
-      rec.cells.push_back(owned_text(cache, row.region));
-      rec.cells.push_back(owned_text(cache, row.product));
-      rec.cells.push_back(owned_text(cache, col.year));
-      rec.cells.push_back(owned_text(cache, col.quarter));
-      rec.cells.push_back(Value::number(row.base * col.multiplier));
-      cache.mutable_records().push_back(std::move(rec));
-    }
-  }
-  return cache;
-}
-
-// Table over `build_subtotal_grid_cache()`: rows Region -> Product, columns
-// Year -> Quarter, one SUM(Amount) data field.
-PivotTable build_subtotal_grid_table() {
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  const char* names[] = {"Region", "Product", "Year", "Quarter", "Amount"};
-  for (std::size_t i = 0; i < 5; ++i) {
-    PivotField field;
-    field.source_name = names[i];
-    field.axis = i == 4 ? PivotAxis::Value : PivotAxis::Row;
-    table.mutable_fields().push_back(std::move(field));
-  }
-  table.mutable_row_field_order() = {0, 1};
-  table.mutable_col_field_order() = {2, 3};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 4;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  return table;
-}
-
-TEST(PivotEvaluator, RowValueFilterCompactsEveryLeafIndexedStructure) {
-  PivotCache cache = build_subtotal_grid_cache();
-  PivotTable table = build_subtotal_grid_table();
-
-  // Region scores are North=99 and South=990, so Top-1 keeps both South
-  // leaves and prunes the whole North group.
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::ValueTop10;
-  f.value = 1;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Two surviving row leaves; every row-leaf-indexed structure agrees.
-  const std::size_t surviving_rows = 2U;
-  ASSERT_EQ(r.values.size(), surviving_rows);
-  EXPECT_EQ(r.row_leaf_totals.size(), surviving_rows);
-  ASSERT_EQ(r.col_subtotals.size(), 2U);  // One per Year.
-  for (const ColSubtotal& col_subtotal : r.col_subtotals) {
-    EXPECT_EQ(col_subtotal.values.size(), surviving_rows);
-  }
-
-  // The pruned group's subtotal is gone from both the metadata-rich list
-  // and the compact compatibility surface.
-  ASSERT_EQ(r.row_subtotals.size(), 1U);
-  ASSERT_EQ(r.row_subtotals[0].labels.size(), 1U);
-  EXPECT_EQ(r.row_subtotals[0].labels[0], "South");
-  EXPECT_EQ(r.subtotals.size(), 1U);
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-
-  // Cross-axis structures on the surviving subtotal keep the column index
-  // space untouched.
-  EXPECT_EQ(r.row_subtotals[0].col_values.size(), 4U);
-  EXPECT_EQ(r.row_subtotals[0].col_subtotal_values.size(), r.col_subtotals.size());
-
-  // A column subtotal now reads the surviving rows: South/A over 2024 is
-  // 10*(1+2)=30 and South/B is 20*(1+2)=60. Reading the pre-filter index
-  // space would surface the pruned North rows (3 and 6).
-  ASSERT_EQ(r.col_subtotals[0].values[0].size(), 1U);
-  EXPECT_DOUBLE_EQ(r.col_subtotals[0].values[0][0].as_number(), 30.0);
-  EXPECT_DOUBLE_EQ(r.col_subtotals[0].values[1][0].as_number(), 60.0);
-  EXPECT_DOUBLE_EQ(r.col_subtotals[1].values[0][0].as_number(), 300.0);
-  EXPECT_DOUBLE_EQ(r.col_subtotals[1].values[1][0].as_number(), 600.0);
-}
-
-TEST(PivotEvaluator, ColValueFilterCompactsEveryLeafIndexedStructure) {
-  PivotCache cache = build_subtotal_grid_cache();
-  PivotTable table = build_subtotal_grid_table();
-
-  // Year scores are 2024=99 and 2025=990, so Top-1 keeps the 2025 quarters
-  // and prunes the whole 2024 group.
-  PivotFilter f;
-  f.axis = PivotAxis::Col;
-  f.field_name = "Year";
-  f.type = FilterType::ValueTop10;
-  f.value = 1;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Two surviving column leaves; every column-leaf-indexed structure agrees.
-  const std::size_t surviving_cols = 2U;
-  ASSERT_EQ(r.values.size(), 4U);  // The row axis is untouched.
-  for (const auto& row_slot : r.values) {
-    EXPECT_EQ(row_slot.size(), surviving_cols);
-  }
-  EXPECT_EQ(r.col_leaf_totals.size(), surviving_cols);
-  ASSERT_EQ(r.row_subtotals.size(), 2U);  // One per Region.
-  for (const RowSubtotal& row_subtotal : r.row_subtotals) {
-    EXPECT_EQ(row_subtotal.col_values.size(), surviving_cols);
-  }
-
-  // The pruned group's column subtotal is gone, and so is its slot in every
-  // row x column subtotal intersection.
-  ASSERT_EQ(r.col_subtotals.size(), 1U);
-  ASSERT_EQ(r.col_subtotals[0].labels.size(), 1U);
-  EXPECT_EQ(r.col_subtotals[0].labels[0], "2025");
-  for (const RowSubtotal& row_subtotal : r.row_subtotals) {
-    EXPECT_EQ(row_subtotal.col_subtotal_values.size(), r.col_subtotals.size());
-  }
-  ASSERT_EQ(r.cols.size(), 1U);
-  EXPECT_EQ(r.cols[0].label, "2025");
-
-  // North's subtotal row now reads the surviving columns: (1+2)*10=30 at
-  // 2025/Q1 and (1+2)*20=60 at 2025/Q2, with 90 at the 2025 subtotal column.
-  const RowSubtotal& north = r.row_subtotals[0];
-  ASSERT_EQ(north.labels.size(), 1U);
-  ASSERT_EQ(north.labels[0], "North");
-  ASSERT_EQ(north.col_values[0].size(), 1U);
-  EXPECT_DOUBLE_EQ(north.col_values[0][0].as_number(), 30.0);
-  EXPECT_DOUBLE_EQ(north.col_values[1][0].as_number(), 60.0);
-  EXPECT_DOUBLE_EQ(north.col_subtotal_values[0][0].as_number(), 90.0);
-}
-
-// ---------------------------------------------------------------------------
-// Three-level row axis, built from a cache rather than hand-assembled
-// ---------------------------------------------------------------------------
-
-// Two nesting levels only ever exercise one interior depth, so a subtotal
-// owner's label path is never longer than one entry and the leaf enumeration
-// never descends twice. A third level puts both under load: leaves are still
-// numbered in DFS pre-order, and each owner emits its subtotal at its own
-// depth with the full path to it.
-TEST(PivotEvaluator, ThreeLevelRowAxisNumbersLeavesAndSubtotalsPerDepth) {
-  PivotCache cache = build_subtotal_grid_cache();
-  PivotTable table = build_subtotal_grid_table();
-  table.mutable_row_field_order() = {0, 1, 2};  // Region / Product / Year.
-  table.mutable_col_field_order() = {3};        // Quarter.
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // 2 regions x 2 products x 2 years = 8 leaves, 2 quarter columns.
-  ASSERT_EQ(r.rows.size(), 2U);
-  ASSERT_EQ(r.rows[0].label, "North");
-  ASSERT_EQ(r.rows[0].children.size(), 2U);
-  ASSERT_EQ(r.rows[0].children[0].label, "A");
-  ASSERT_EQ(r.rows[0].children[0].children.size(), 2U);
-  EXPECT_EQ(r.rows[0].children[0].children[0].label, "2024");
-  EXPECT_EQ(r.rows[0].children[0].children[1].label, "2025");
-  ASSERT_EQ(r.values.size(), 8U);
-  ASSERT_EQ(r.values[0].size(), 2U);
-
-  // Leaf order is DFS pre-order over the three levels; the record buckets
-  // have to follow the same numbering or the values land on the wrong rows.
-  // Cell value is `row base * quarter multiplier` (North/A base 1,
-  // North/B 2, South/A 10, South/B 20; 2024 Q1/Q2 = 1/2, 2025 = 10/20).
-  const std::vector<std::vector<double>> expected = {
-      {1.0, 2.0}, {10.0, 20.0}, {2.0, 4.0}, {20.0, 40.0}, {10.0, 20.0}, {100.0, 200.0}, {20.0, 40.0}, {200.0, 400.0},
-  };
-  for (std::size_t leaf = 0; leaf < expected.size(); ++leaf) {
-    for (std::size_t col = 0; col < 2U; ++col) {
-      EXPECT_DOUBLE_EQ(r.values[leaf][col][0].as_number(), expected[leaf][col]) << "leaf=" << leaf << " col=" << col;
-    }
-  }
-
-  // One subtotal per interior owner: four at Region/Product, two at Region,
-  // emitted in the post-order the row walk produces.
-  ASSERT_EQ(r.row_subtotals.size(), 6U);
-  const std::vector<std::vector<std::string>> expected_labels = {
-      {"North", "A"}, {"North", "B"}, {"North"}, {"South", "A"}, {"South", "B"}, {"South"},
-  };
-  const std::vector<double> expected_totals = {33.0, 66.0, 99.0, 330.0, 660.0, 990.0};
-  for (std::size_t i = 0; i < r.row_subtotals.size(); ++i) {
-    EXPECT_EQ(r.row_subtotals[i].labels, expected_labels[i]) << "subtotal=" << i;
-    EXPECT_EQ(r.row_subtotals[i].depth, expected_labels[i].size() - 1U) << "subtotal=" << i;
-    ASSERT_EQ(r.row_subtotals[i].values.size(), 1U);
-    EXPECT_DOUBLE_EQ(r.row_subtotals[i].values[0].as_number(), expected_totals[i]) << "subtotal=" << i;
-  }
-}
-
-// Pruning a three-level axis has to collapse whole branches: a group whose
-// every descendant leaf is filtered away leaves no interior node and no
-// subtotal behind, while the survivors are re-expressed in the compacted
-// leaf-index space.
-TEST(PivotEvaluator, RowValueFilterCollapsesEmptiedBranchesOfAThreeLevelAxis) {
-  PivotCache cache = build_subtotal_grid_cache();
-  PivotTable table = build_subtotal_grid_table();
-  table.mutable_row_field_order() = {0, 1, 2};
-  table.mutable_col_field_order() = {3};
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  // Year scores across the two quarter columns are 3, 30, 6, 60, 30, 300,
-  // 60, 600. Greater-than-100 keeps South/A/2025 and South/B/2025 only, so
-  // all of North and both 2024 leaves under South disappear.
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Year";
-  f.type = FilterType::ValueGreaterThan;
-  f.value = 100.0;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // The North branch is gone at every depth; South keeps both products but
-  // only their 2025 child.
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  ASSERT_EQ(r.rows[0].children.size(), 2U);
-  for (const AxisHierarchyNode& product : r.rows[0].children) {
-    ASSERT_EQ(product.children.size(), 1U);
-    EXPECT_EQ(product.children[0].label, "2025");
-  }
-
-  ASSERT_EQ(r.values.size(), 2U);
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 100.0);  // South/A/2025 Q1.
-  EXPECT_DOUBLE_EQ(r.values[0][1][0].as_number(), 200.0);  // South/A/2025 Q2.
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 200.0);  // South/B/2025 Q1.
-  EXPECT_DOUBLE_EQ(r.values[1][1][0].as_number(), 400.0);  // South/B/2025 Q2.
-  EXPECT_EQ(r.row_leaf_totals.size(), 2U);
-
-  // Only the owners that still cover a surviving leaf keep a subtotal, and
-  // both the metadata-rich list and the compact surface agree.
-  ASSERT_EQ(r.row_subtotals.size(), 3U);
-  const std::vector<std::vector<std::string>> expected_labels = {{"South", "A"}, {"South", "B"}, {"South"}};
-  for (std::size_t i = 0; i < r.row_subtotals.size(); ++i) {
-    EXPECT_EQ(r.row_subtotals[i].labels, expected_labels[i]) << "subtotal=" << i;
-  }
-  EXPECT_EQ(r.subtotals.size(), 3U);
-  // A surviving subtotal is re-aggregated from just its surviving leaves,
-  // matching Excel's own Top-N grand total (verified against
-  // pivot_value_date_filters.xlsx / pivot_recurring_period_filter.xlsx):
-  // South/A = 100 + 200 = 300; South (both products) = 300 + 200 + 400 = 900.
-  EXPECT_DOUBLE_EQ(r.row_subtotals[0].values[0].as_number(), 300.0);
-  EXPECT_DOUBLE_EQ(r.row_subtotals[2].values[0].as_number(), 900.0);
-}
-
-// Excel's own Top-N grand total covers only the visible rows, not the
-// pre-filter set -- verified against two real Excel-authored fixtures
-// (tests/fixtures/excel/pivot_value_date_filters.xlsx and
-// pivot_recurring_period_filter.xlsx): both cache a Top-2 filter whose
-// rendered Grand Total cell (675) equals the sum of the two surviving
-// rows (500 + 175), not all four source rows.
-TEST(PivotEvaluator, ValueFilterRecalculatesGrandTotalFromSurvivingLeavesOnly) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/true, /*cols=*/true);
-
-  // North totals 175 (100+50+25), South totals 500 (200+300). Top-1
-  // keeps South only.
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::ValueTop10;
-  f.value = 1;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  ASSERT_FALSE(r.grand_totals.empty());
-  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 500.0);
-  ASSERT_TRUE(r.grand_total.is_number());
-  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 500.0);
-}
-
-}  // namespace
-}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_evaluator_totals_test.cpp b/tests/unit/pivot/pivot_evaluator_totals_test.cpp
new file mode 100644
index 000000000..0625be46a
--- /dev/null
+++ b/tests/unit/pivot/pivot_evaluator_totals_test.cpp
@@ -0,0 +1,196 @@
+// Grand totals and subtotal aggregation metadata for `formulon::pivot::evaluate`.
+
+#include <cstddef>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_evaluator_fixtures.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+using test::row_index;
+
+TEST(PivotEvaluator, GrandTotalWhenFlagged) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/true, /*cols=*/false);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_TRUE(r.grand_total.is_number());
+  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 675.0);  // 100 + 50 + 200 + 300 + 25
+  ASSERT_EQ(r.grand_totals.size(), 1U);
+  ASSERT_TRUE(r.grand_totals[0].is_number());
+  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 675.0);
+}
+
+TEST(PivotEvaluator, GrandTotalsCarryOneValuePerDataField) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  PivotDataField count_amount;
+  count_amount.name = "Count of Amount";
+  count_amount.field_index = 2;
+  count_amount.aggregation = Aggregation::Count;
+  table.mutable_data_fields().push_back(std::move(count_amount));
+  table.set_grand_totals(/*rows=*/true, /*cols=*/true);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.grand_totals.size(), 2U);
+  ASSERT_TRUE(r.grand_totals[0].is_number());
+  EXPECT_DOUBLE_EQ(r.grand_totals[0].as_number(), 675.0);
+  ASSERT_TRUE(r.grand_totals[1].is_number());
+  EXPECT_DOUBLE_EQ(r.grand_totals[1].as_number(), 5.0);
+  ASSERT_TRUE(r.grand_total.is_number());
+  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), r.grand_totals[0].as_number());
+}
+
+TEST(PivotEvaluator, GrandTotalBlankWhenDisabled) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  EXPECT_TRUE(r_or.value().grand_total.is_blank());
+}
+
+TEST(PivotEvaluator, RowSubtotalEmittedWhenRequested) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Region declares subtotal_top so Region-level subtotals appear.
+  table.mutable_fields()[0].subtotal_top = true;
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Two regions -> two subtotal rows, each with one data field slot.
+  ASSERT_EQ(r.subtotals.size(), 2U);
+  ASSERT_EQ(r.row_subtotals.size(), 2U);
+  ASSERT_EQ(r.subtotals[0].size(), 1U);
+  EXPECT_EQ(r.row_subtotals[0].depth, 0U);
+  ASSERT_EQ(r.row_subtotals[0].labels.size(), 1U);
+  // Subtotals appear in row-hierarchy DFS order (post-order at each
+  // non-leaf), matching how Excel walks the tree to position them.
+  std::vector<double> totals{r.subtotals[0][0].as_number(), r.subtotals[1][0].as_number()};
+  std::sort(totals.begin(), totals.end());
+  EXPECT_DOUBLE_EQ(totals[0], 175.0);  // North subtotal: 100 + 50 + 25
+  EXPECT_DOUBLE_EQ(totals[1], 500.0);  // South subtotal: 200 + 300
+}
+
+TEST(PivotEvaluator, ColSubtotalEmittedWhenRequested) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{}, /*col=*/{0, 1});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  table.mutable_fields()[0].subtotal_top = true;
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.col_subtotals.size(), 2U);
+  ASSERT_EQ(r.col_subtotals[0].labels.size(), 1U);
+  EXPECT_EQ(r.col_subtotals[0].depth, 0U);
+  ASSERT_EQ(r.col_subtotals[0].values.size(), 1U);
+  ASSERT_EQ(r.col_subtotals[0].values[0].size(), 1U);
+
+  std::vector<double> totals{r.col_subtotals[0].values[0][0].as_number(), r.col_subtotals[1].values[0][0].as_number()};
+  std::sort(totals.begin(), totals.end());
+  EXPECT_DOUBLE_EQ(totals[0], 175.0);
+  EXPECT_DOUBLE_EQ(totals[1], 500.0);
+}
+
+TEST(PivotEvaluator, OuterSubtotalEmittedByDefaultWithoutSubtotalTop) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
+  // Do not touch subtotal_top; default_subtotal defaults to true.
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  // Region-level (depth 0) subtotals for North and South are present.
+  ASSERT_EQ(r.row_subtotals.size(), 2U);
+  EXPECT_EQ(r.row_subtotals[0].depth, 0U);
+}
+
+TEST(PivotEvaluator, DefaultSubtotalOffSuppressesOuterSubtotal) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
+  table.mutable_fields()[0].default_subtotal = false;  // Region: no subtotal.
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  EXPECT_TRUE(r_or.value().row_subtotals.empty());
+}
+
+TEST(PivotEvaluator, CustomSubtotalFunctionUsesSelectedAggregation) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0, 1}, /*col=*/{});
+  // Region subtotal computed with Average instead of the data field's Sum.
+  table.mutable_fields()[0].subtotal_fns = {SubtotalFn::Average};
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.row_subtotals.size(), 2U);
+  // North amounts: 100, 50, 25 -> average 58.333..., not the Sum 175.
+  std::size_t north = r.row_subtotals[0].labels[0] == "North" ? 0 : 1;
+  ASSERT_LT(north, r.row_subtotals.size());
+  ASSERT_FALSE(r.row_subtotals[north].values.empty());
+  ASSERT_TRUE(r.row_subtotals[north].values[0].is_number());
+  EXPECT_NEAR(r.row_subtotals[north].values[0].as_number(), 175.0 / 3.0, 1e-9);
+}
+
+TEST(PivotEvaluator, ColumnCustomSubtotalFunctionUsesSelectedAggregation) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{}, /*col=*/{0, 1});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  table.mutable_fields()[0].subtotal_fns = {SubtotalFn::Average};
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.col_subtotals.size(), 2U);
+
+  const std::size_t north = r.col_subtotals[0].labels[0] == "North" ? 0 : 1;
+  ASSERT_LT(north, r.col_subtotals.size());
+  ASSERT_TRUE(r.col_subtotals[north].aggregation.has_value());
+  EXPECT_EQ(*r.col_subtotals[north].aggregation, Aggregation::Average);
+  ASSERT_EQ(r.col_subtotals[north].values.size(), 1U);
+  ASSERT_EQ(r.col_subtotals[north].values[0].size(), 1U);
+  ASSERT_TRUE(r.col_subtotals[north].values[0][0].is_number());
+  EXPECT_NEAR(r.col_subtotals[north].values[0][0].as_number(), 175.0 / 3.0, 1e-9);
+}
+
+TEST(PivotEvaluator, NonAdditiveRowTotalReaggregates) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
+  table.mutable_data_fields()[0].aggregation = Aggregation::Average;
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  const std::size_t north = row_index(r, "North");
+  ASSERT_LT(north, r.row_leaf_totals.size());
+  ASSERT_FALSE(r.row_leaf_totals[north].empty());
+  ASSERT_TRUE(r.row_leaf_totals[north][0].is_number());
+  // North across all products: mean(100, 50, 25) = 58.333..., NOT the mean
+  // of the per-cell averages (62.5, 50) = 56.25.
+  EXPECT_NEAR(r.row_leaf_totals[north][0].as_number(), 175.0 / 3.0, 1e-9);
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_filter_date_test.cpp b/tests/unit/pivot/pivot_filter_date_test.cpp
new file mode 100644
index 000000000..f0ed34563
--- /dev/null
+++ b/tests/unit/pivot/pivot_filter_date_test.cpp
@@ -0,0 +1,558 @@
+// Calendar and date-window filters for pivot fields.
+
+#include <algorithm>
+#include <chrono>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_evaluator_fixtures.h"
+#include "utils/date_time.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+using test::owned_text;
+using test::row_index;
+
+// Relative-period boundary helper.
+namespace {
+// 2026-05-20 12:00:00. Mid-month, mid-quarter, so every window's two
+// boundaries are distinct from the reading itself.
+constexpr date_time::CivilTime kMay20{{2026, 5U, 20U}, {12U, 0U, 0U}};
+
+double Serial(int year, unsigned month, unsigned day) {
+  return date_time::serial_from_ymd(year, month, day, /*date1904=*/false);
+}
+
+void ExpectWindow(RelativePeriod period, const date_time::CivilTime& now, int low_y, unsigned low_m, unsigned low_d,
+                  int high_y, unsigned high_m, unsigned high_d) {
+  const DateWindow window = resolve_relative_period(period, now, /*date1904=*/false);
+  EXPECT_DOUBLE_EQ(window.low, Serial(low_y, low_m, low_d));
+  EXPECT_DOUBLE_EQ(window.high, Serial(high_y, high_m, high_d));
+}
+
+}  // namespace
+
+PivotCache build_label_date_filter_cache() {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Date", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](double serial, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(Value::number(serial));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add(formulon::date_time::serial_from_ymd(2024, 1, 1), 10.0);
+  add(formulon::date_time::serial_from_ymd(2024, 6, 15), 20.0);
+  add(formulon::date_time::serial_from_ymd(2024, 12, 31), 30.0);
+  add(formulon::date_time::serial_from_ymd(2025, 3, 1), 40.0);
+  return cache;
+}
+
+// Helper: builds a single-row-axis pivot over `Date` with SUM(Amount).
+// The Date field becomes the row axis so each surviving record forms its
+// own row leaf, simplifying assertions.
+PivotTable build_label_date_filter_table() {
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField date_f;
+  date_f.source_name = "Date";
+  date_f.axis = PivotAxis::Row;
+  PivotField amount_f;
+  amount_f.source_name = "Amount";
+  amount_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(date_f));
+  table.mutable_fields().push_back(std::move(amount_f));
+  table.mutable_row_field_order() = {0};
+
+  PivotDataField sum_amount;
+  sum_amount.name = "Sum of Amount";
+  sum_amount.field_index = 1;
+  sum_amount.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum_amount));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  return table;
+}
+TEST(RelativePeriod, DayWindowsAreSingleDays) {
+  ExpectWindow(RelativePeriod::Today, kMay20, 2026, 5, 20, 2026, 5, 20);
+  ExpectWindow(RelativePeriod::Yesterday, kMay20, 2026, 5, 19, 2026, 5, 19);
+  ExpectWindow(RelativePeriod::Tomorrow, kMay20, 2026, 5, 21, 2026, 5, 21);
+}
+
+TEST(RelativePeriod, MonthWindowsEndOnTheirOwnLastDay) {
+  // May has 31 days, April 30 -- the window end is derived from the next
+  // month's first day, so a wrong month length would show up here.
+  ExpectWindow(RelativePeriod::ThisMonth, kMay20, 2026, 5, 1, 2026, 5, 31);
+  ExpectWindow(RelativePeriod::LastMonth, kMay20, 2026, 4, 1, 2026, 4, 30);
+  ExpectWindow(RelativePeriod::NextMonth, kMay20, 2026, 6, 1, 2026, 6, 30);
+}
+
+TEST(RelativePeriod, QuarterWindowsSnapToTheCalendarQuarter) {
+  // May sits in Q2, so "this quarter" starts in April rather than in May.
+  ExpectWindow(RelativePeriod::ThisQuarter, kMay20, 2026, 4, 1, 2026, 6, 30);
+  ExpectWindow(RelativePeriod::LastQuarter, kMay20, 2026, 1, 1, 2026, 3, 31);
+  ExpectWindow(RelativePeriod::NextQuarter, kMay20, 2026, 7, 1, 2026, 9, 30);
+}
+
+TEST(RelativePeriod, YearWindowsSpanTheWholeCalendarYear) {
+  ExpectWindow(RelativePeriod::ThisYear, kMay20, 2026, 1, 1, 2026, 12, 31);
+  ExpectWindow(RelativePeriod::LastYear, kMay20, 2025, 1, 1, 2025, 12, 31);
+  ExpectWindow(RelativePeriod::NextYear, kMay20, 2027, 1, 1, 2027, 12, 31);
+}
+
+TEST(RelativePeriod, YearToDateStopsAtTheReadingNotAtYearEnd) {
+  ExpectWindow(RelativePeriod::YearToDate, kMay20, 2026, 1, 1, 2026, 5, 20);
+}
+
+TEST(RelativePeriod, WindowsRollOverTheYearBoundary) {
+  // January is the case the explicit month arithmetic exists for: naive
+  // subtraction would produce month 0 rather than the previous December.
+  constexpr date_time::CivilTime kJan10{{2026, 1U, 10U}, {0U, 0U, 0U}};
+  ExpectWindow(RelativePeriod::LastMonth, kJan10, 2025, 12, 1, 2025, 12, 31);
+  ExpectWindow(RelativePeriod::LastQuarter, kJan10, 2025, 10, 1, 2025, 12, 31);
+  constexpr date_time::CivilTime kDec10{{2026, 12U, 10U}, {0U, 0U, 0U}};
+  ExpectWindow(RelativePeriod::NextMonth, kDec10, 2027, 1, 1, 2027, 1, 31);
+  ExpectWindow(RelativePeriod::NextQuarter, kDec10, 2027, 1, 1, 2027, 3, 31);
+}
+
+TEST(RelativePeriod, LeapFebruaryKeepsItsTwentyNinthDay) {
+  constexpr date_time::CivilTime kFeb2024{{2024, 2U, 5U}, {0U, 0U, 0U}};
+  ExpectWindow(RelativePeriod::ThisMonth, kFeb2024, 2024, 2, 1, 2024, 2, 29);
+}
+
+TEST(RelativePeriod, TheWindowFollowsTheWorkbookEpoch) {
+  // A 1904-system workbook stores every date 1462 lower, so the resolved
+  // window has to shift with it or it would select the wrong records.
+  const DateWindow window = resolve_relative_period(RelativePeriod::ThisMonth, kMay20, /*date1904=*/true);
+  EXPECT_DOUBLE_EQ(window.low, Serial(2026, 5, 1) - date_time::kDate1904EpochGap);
+  EXPECT_DOUBLE_EQ(window.high, Serial(2026, 5, 31) - date_time::kDate1904EpochGap);
+}
+
+TEST(RelativePeriod, WeekWindowsRunSundayThroughSaturday) {
+  // Excel anchors the week group on the calendar week, so a reading taken
+  // mid-week still starts the window on the preceding Sunday rather than
+  // seven days back from the reading. 2026-08-21 is a Friday.
+  constexpr date_time::CivilTime kAug21{{2026, 8U, 21U}, {9U, 30U, 0U}};
+  ExpectWindow(RelativePeriod::ThisWeek, kAug21, 2026, 8, 16, 2026, 8, 22);
+  ExpectWindow(RelativePeriod::LastWeek, kAug21, 2026, 8, 9, 2026, 8, 15);
+  ExpectWindow(RelativePeriod::NextWeek, kAug21, 2026, 8, 23, 2026, 8, 29);
+}
+
+TEST(RelativePeriod, WeekWindowsTileWithoutGapOrOverlap) {
+  // The three windows are adjacent by construction; asserting it directly
+  // is what rules out an off-by-one that a single window would hide.
+  const DateWindow last = resolve_relative_period(RelativePeriod::LastWeek, kMay20, /*date1904=*/false);
+  const DateWindow current = resolve_relative_period(RelativePeriod::ThisWeek, kMay20, /*date1904=*/false);
+  const DateWindow next = resolve_relative_period(RelativePeriod::NextWeek, kMay20, /*date1904=*/false);
+  EXPECT_DOUBLE_EQ(current.low, last.high + 1.0);
+  EXPECT_DOUBLE_EQ(next.low, current.high + 1.0);
+  EXPECT_DOUBLE_EQ(current.high - current.low, 6.0);
+}
+
+TEST(RelativePeriod, AWeekWindowStartingOnSundayDoesNotShiftBack) {
+  // A Sunday reading is the boundary case: the week it belongs to is its
+  // own, not the one that just ended.
+  constexpr date_time::CivilTime kSunday{{2025, 12U, 28U}, {0U, 0U, 0U}};
+  ExpectWindow(RelativePeriod::ThisWeek, kSunday, 2025, 12, 28, 2026, 1, 3);
+}
+
+TEST(RelativePeriod, WeekWindowsCrossTheYearBoundary) {
+  constexpr date_time::CivilTime kNewYear{{2026, 1U, 1U}, {0U, 0U, 0U}};
+  ExpectWindow(RelativePeriod::ThisWeek, kNewYear, 2025, 12, 28, 2026, 1, 3);
+  ExpectWindow(RelativePeriod::LastWeek, kNewYear, 2025, 12, 21, 2025, 12, 27);
+}
+
+TEST(RelativePeriod, TheWeekWindowFollowsTheWorkbookEpoch) {
+  const DateWindow window = resolve_relative_period(RelativePeriod::ThisWeek, kMay20, /*date1904=*/true);
+  EXPECT_DOUBLE_EQ(window.low, Serial(2026, 5, 17) - date_time::kDate1904EpochGap);
+  EXPECT_DOUBLE_EQ(window.high, Serial(2026, 5, 23) - date_time::kDate1904EpochGap);
+}
+
+TEST(PivotEvaluator, RecurringMonthFilterKeepsEveryYearsMatchingMonth) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Field 2 holds North 100 / 50 / 25 and South 200 / 300, read here as
+  // date serials: 25 is 1900-01-25, 50 is 1900-02-19, 100 is 1900-04-09,
+  // 200 is 1900-07-18 and 300 is 1900-10-26. January therefore admits
+  // North's 25 alone -- and it does so with no clock reading at all,
+  // which is what separates this family from the relative periods.
+  AuthoredRecurringFilter f;
+  f.field_index = 2;
+  f.month_low = 1;
+  f.month_high = 1;
+  table.mutable_authored_recurring_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, PivotFilterEnv{});
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "North");
+  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 25.0);
+}
+
+TEST(PivotEvaluator, ARecurringQuarterSpansItsThreeMonths) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Q2 is months 4..6; serial 100 is 1900-04-09, so North's 100 survives
+  // and its January pair does not.
+  AuthoredRecurringFilter f;
+  f.field_index = 2;
+  f.month_low = 4;
+  f.month_high = 6;
+  table.mutable_authored_recurring_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, PivotFilterEnv{});
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "North");
+  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 100.0);
+}
+
+TEST(PivotEvaluator, ARecurringFilterIsIndependentOfTheClock) {
+  // The whole point of the family: the same table evaluated against two
+  // very different readings selects the same records.
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredRecurringFilter f;
+  f.field_index = 2;
+  f.month_low = 1;
+  f.month_high = 1;
+  table.mutable_authored_recurring_filters().push_back(f);
+
+  PivotFilterEnv early;
+  early.pinned_now = date_time::CivilTime{{1900, 2U, 15U}, {0U, 0U, 0U}};
+  PivotFilterEnv late;
+  late.pinned_now = date_time::CivilTime{{2099, 11U, 3U}, {0U, 0U, 0U}};
+  auto early_or = evaluate(table, cache, PivotLayoutOptions{}, early);
+  auto late_or = evaluate(table, cache, PivotLayoutOptions{}, late);
+  ASSERT_TRUE(static_cast<bool>(early_or)) << early_or.error().message;
+  ASSERT_TRUE(static_cast<bool>(late_or)) << late_or.error().message;
+  EXPECT_DOUBLE_EQ(early_or.value().values[0][0][0].as_number(), 25.0);
+  EXPECT_DOUBLE_EQ(late_or.value().values[0][0][0].as_number(), 25.0);
+}
+
+TEST(PivotEvaluator, AuthoredPeriodFilterPrunesRecordsAgainstThePinnedClock) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Field 2 carries the amounts (North 100 / 50 / 25, South 200 / 300),
+  // read here as date serials. Pinning to 1900-02-15 makes "this quarter"
+  // 1900-01-01..1900-03-31, i.e. serials 1..91: it admits North's 50 and
+  // 25 and excludes everything else, South included.
+  AuthoredPeriodFilter f;
+  f.field_index = 2;
+  f.period = RelativePeriod::ThisQuarter;
+  table.mutable_authored_period_filters().push_back(f);
+
+  PivotFilterEnv env;
+  env.pinned_now = date_time::CivilTime{{1900, 2U, 15U}, {0U, 0U, 0U}};
+  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "North");
+  ASSERT_EQ(r_or.value().values.size(), 1U);
+  ASSERT_EQ(r_or.value().values[0].size(), 1U);
+  ASSERT_EQ(r_or.value().values[0][0].size(), 1U);
+  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 75.0);
+}
+
+TEST(PivotEvaluator, MovingThePinnedClockMovesWhichRecordsSurvive) {
+  // Same filter, a quarter later: the window becomes serials 92..181,
+  // which admits North's 100 alone and still excludes South.
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredPeriodFilter f;
+  f.field_index = 2;
+  f.period = RelativePeriod::ThisQuarter;
+  table.mutable_authored_period_filters().push_back(f);
+
+  PivotFilterEnv env;
+  env.pinned_now = date_time::CivilTime{{1900, 5U, 15U}, {0U, 0U, 0U}};
+  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "North");
+  ASSERT_EQ(r_or.value().values.size(), 1U);
+  ASSERT_EQ(r_or.value().values[0].size(), 1U);
+  ASSERT_EQ(r_or.value().values[0][0].size(), 1U);
+  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 100.0);
+}
+
+TEST(PivotEvaluator, APeriodFilterOnAnOutOfRangeFieldIsInert) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredPeriodFilter f;
+  f.field_index = 99;
+  f.period = RelativePeriod::Today;
+  table.mutable_authored_period_filters().push_back(f);
+
+  PivotFilterEnv env;
+  env.pinned_now = date_time::CivilTime{{1900, 2U, 15U}, {0U, 0U, 0U}};
+  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  EXPECT_EQ(r_or.value().rows.size(), 2U);
+}
+
+TEST(PivotEvaluator, AuthoredDateFilterWithNoUpperBoundIsInert) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredValueFilter f;
+  f.field_index = 2;
+  f.type = FilterType::LabelDate;
+  f.value = 1000.0;
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  EXPECT_EQ(r_or.value().rows.size(), 2U);
+}
+
+TEST(PivotEvaluator, LabelDateFilterIncludesInRange) {
+  PivotCache cache = build_label_date_filter_cache();
+  PivotTable table = build_label_date_filter_table();
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Date";
+  f.type = FilterType::LabelDate;
+  f.value = formulon::date_time::serial_from_ymd(2024, 1, 1);
+  f.value_high = formulon::date_time::serial_from_ymd(2024, 12, 31);
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Three of the four records fall inside [2024-01-01, 2024-12-31].
+  ASSERT_EQ(r.rows.size(), 3U);
+  std::vector<double> totals;
+  totals.reserve(r.values.size());
+  for (const auto& row_slot : r.values) {
+    ASSERT_EQ(row_slot.size(), 1U);
+    ASSERT_EQ(row_slot[0].size(), 1U);
+    totals.push_back(row_slot[0][0].as_number());
+  }
+  std::sort(totals.begin(), totals.end());
+  EXPECT_DOUBLE_EQ(totals[0], 10.0);
+  EXPECT_DOUBLE_EQ(totals[1], 20.0);
+  EXPECT_DOUBLE_EQ(totals[2], 30.0);
+}
+
+TEST(PivotEvaluator, LabelDateFilterUnboundedHighIsNoOp) {
+  PivotCache cache = build_label_date_filter_cache();
+  PivotTable table = build_label_date_filter_table();
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Date";
+  f.type = FilterType::LabelDate;
+  f.value = formulon::date_time::serial_from_ymd(2024, 1, 1);
+  // value_high left as default monostate -> filter degrades to no-op.
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // No upper bound -> all four records survive.
+  ASSERT_EQ(r.rows.size(), 4U);
+}
+
+TEST(PivotEvaluator, LabelDateFiltersWithInvalidNumericCriteriaAreNoOp) {
+  const double invalid[] = {
+      std::numeric_limits<double>::quiet_NaN(),
+      std::numeric_limits<double>::infinity(),
+      -std::numeric_limits<double>::infinity(),
+      std::numeric_limits<double>::max(),
+  };
+  for (const double raw : invalid) {
+    PivotCache active_cache = build_label_date_filter_cache();
+    PivotTable active_table = build_label_date_filter_table();
+    PivotFilter active;
+    active.axis = PivotAxis::Row;
+    active.field_name = "Date";
+    active.type = FilterType::LabelDate;
+    active.value = raw;
+    active.value_high = date_time::serial_from_ymd(2025, 12U, 31U);
+    active_table.mutable_active_filters().push_back(active);
+    auto active_or = evaluate(active_table, active_cache);
+    ASSERT_TRUE(static_cast<bool>(active_or)) << active_or.error().message << " low=" << raw;
+    EXPECT_EQ(active_or.value().rows.size(), 4U) << "invalid low=" << raw;
+
+    active_cache = build_label_date_filter_cache();
+    active_table = build_label_date_filter_table();
+    active.value = 0.0;
+    active.value_high = raw;
+    active_table.mutable_active_filters().push_back(active);
+    active_or = evaluate(active_table, active_cache);
+    ASSERT_TRUE(static_cast<bool>(active_or)) << active_or.error().message << " high=" << raw;
+    EXPECT_EQ(active_or.value().rows.size(), 4U) << "invalid high=" << raw;
+
+    PivotCache authored_cache = build_label_date_filter_cache();
+    PivotTable authored_table = build_label_date_filter_table();
+    AuthoredValueFilter authored;
+    authored.field_index = 0;
+    authored.type = FilterType::LabelDate;
+    authored.value = raw;
+    authored.value_high = date_time::serial_from_ymd(2025, 12U, 31U);
+    authored_table.mutable_authored_value_filters().push_back(authored);
+    auto authored_or = evaluate(authored_table, authored_cache);
+    ASSERT_TRUE(static_cast<bool>(authored_or)) << authored_or.error().message << " low=" << raw;
+    EXPECT_EQ(authored_or.value().rows.size(), 4U) << "invalid authored low=" << raw;
+
+    authored_cache = build_label_date_filter_cache();
+    authored_table = build_label_date_filter_table();
+    authored.value = 0.0;
+    authored.value_high = raw;
+    authored_table.mutable_authored_value_filters().push_back(authored);
+    authored_or = evaluate(authored_table, authored_cache);
+    ASSERT_TRUE(static_cast<bool>(authored_or)) << authored_or.error().message << " high=" << raw;
+    EXPECT_EQ(authored_or.value().rows.size(), 4U) << "invalid authored high=" << raw;
+  }
+}
+
+TEST(PivotEvaluator, RelativeAndRecurringDateFiltersPassInvalidNumericRecords) {
+  const double invalid[] = {
+      std::numeric_limits<double>::quiet_NaN(),
+      std::numeric_limits<double>::infinity(),
+      -std::numeric_limits<double>::infinity(),
+      std::numeric_limits<double>::max(),
+  };
+
+  PivotCache period_cache = build_label_date_filter_cache();
+  for (std::size_t i = 0; i < std::size(invalid); ++i) {
+    PivotCacheRecord record;
+    record.cells = {Value::number(invalid[i]), Value::number(100.0 + static_cast<double>(i))};
+    period_cache.mutable_records().push_back(std::move(record));
+  }
+  PivotTable period_table = build_label_date_filter_table();
+  AuthoredPeriodFilter period;
+  period.field_index = 0;
+  period.period = RelativePeriod::ThisYear;
+  period_table.mutable_authored_period_filters().push_back(period);
+  PivotFilterEnv env;
+  env.pinned_now = date_time::CivilTime{{2024, 6U, 15U}, {0U, 0U, 0U}};
+  auto period_or = evaluate(period_table, period_cache, PivotLayoutOptions{}, env);
+  ASSERT_TRUE(static_cast<bool>(period_or)) << period_or.error().message;
+  ASSERT_EQ(period_or.value().rows.size(), 7U);
+  double period_total = 0.0;
+  for (const auto& row_slot : period_or.value().values) {
+    period_total += row_slot[0][0].as_number();
+  }
+  EXPECT_DOUBLE_EQ(period_total, 10.0 + 20.0 + 30.0 + 100.0 + 101.0 + 102.0 + 103.0);
+
+  PivotCache recurring_cache = build_label_date_filter_cache();
+  for (std::size_t i = 0; i < std::size(invalid); ++i) {
+    PivotCacheRecord record;
+    record.cells = {Value::number(invalid[i]), Value::number(100.0 + static_cast<double>(i))};
+    recurring_cache.mutable_records().push_back(std::move(record));
+  }
+  PivotTable recurring_table = build_label_date_filter_table();
+  AuthoredRecurringFilter recurring;
+  recurring.field_index = 0;
+  recurring.month_low = 1;
+  recurring.month_high = 1;
+  recurring_table.mutable_authored_recurring_filters().push_back(recurring);
+  auto recurring_or = evaluate(recurring_table, recurring_cache);
+  ASSERT_TRUE(static_cast<bool>(recurring_or)) << recurring_or.error().message;
+  ASSERT_EQ(recurring_or.value().rows.size(), 5U);
+  double recurring_total = 0.0;
+  for (const auto& row_slot : recurring_or.value().values) {
+    recurring_total += row_slot[0][0].as_number();
+  }
+  EXPECT_DOUBLE_EQ(recurring_total, 10.0 + 100.0 + 101.0 + 102.0 + 103.0);
+}
+
+TEST(PivotEvaluator, ValueFiltersRetainNonFiniteComparisonSemantics) {
+  const double invalid[] = {
+      std::numeric_limits<double>::quiet_NaN(),
+      std::numeric_limits<double>::infinity(),
+      -std::numeric_limits<double>::infinity(),
+  };
+  for (const double raw : invalid) {
+    PivotCache active_cache = build_basic_cache();
+    PivotTable active_table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+    PivotFilter active;
+    active.axis = PivotAxis::Row;
+    active.field_name = "Region";
+    active.type = FilterType::ValueGreaterThan;
+    active.value = raw;
+    active_table.mutable_active_filters().push_back(active);
+    auto active_or = evaluate(active_table, active_cache);
+    ASSERT_TRUE(static_cast<bool>(active_or)) << active_or.error().message;
+    const std::size_t expected_active = std::isinf(raw) && std::signbit(raw) ? 2U : 0U;
+    EXPECT_EQ(active_or.value().rows.size(), expected_active) << "active invalid=" << raw;
+
+    PivotCache authored_cache = build_basic_cache();
+    PivotTable authored_table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+    AuthoredValueFilter authored;
+    authored.field_index = 0;
+    authored.type = FilterType::ValueTop10;
+    authored.value = raw;
+    authored_table.mutable_authored_value_filters().push_back(authored);
+    auto authored_or = evaluate(authored_table, authored_cache);
+    ASSERT_TRUE(static_cast<bool>(authored_or)) << authored_or.error().message;
+    const std::size_t expected_authored = std::isinf(raw) && raw > 0.0 ? 2U : 0U;
+    EXPECT_EQ(authored_or.value().rows.size(), expected_authored) << "authored invalid=" << raw;
+
+    PivotCache between_cache = build_basic_cache();
+    PivotTable between_table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+    PivotFilter between;
+    between.axis = PivotAxis::Row;
+    between.field_name = "Region";
+    between.type = FilterType::ValueBetween;
+    between.value = 0.0;
+    between.value_high = raw;
+    between_table.mutable_active_filters().push_back(between);
+    auto between_or = evaluate(between_table, between_cache);
+    ASSERT_TRUE(static_cast<bool>(between_or)) << between_or.error().message;
+    const std::size_t expected_between = std::isinf(raw) && raw > 0.0 ? 2U : 0U;
+    EXPECT_EQ(between_or.value().rows.size(), expected_between) << "active between invalid=" << raw;
+  }
+}
+
+TEST(PivotEvaluator, AuthoredDateFilterPrunesRecordsByTheirSerial) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Field 2 holds the amounts, which are plain numbers -- the date pass
+  // reads whatever serial the bound cell carries, so a range that spans
+  // only North's two smaller amounts drops South entirely.
+  AuthoredValueFilter f;
+  f.field_index = 2;
+  f.type = FilterType::LabelDate;
+  f.value = 0.0;
+  f.value_high = 100.0;
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "North");
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_filter_label_test.cpp b/tests/unit/pivot/pivot_filter_label_test.cpp
new file mode 100644
index 000000000..5f7d062b1
--- /dev/null
+++ b/tests/unit/pivot/pivot_filter_label_test.cpp
@@ -0,0 +1,625 @@
+// Label, caption, and manual item filters for pivot fields.
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_index.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_evaluator_fixtures.h"
+#include "pivot_filter_test_helpers.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using filter_test::build_shared_north_south_cache;
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+using test::owned_text;
+using test::row_index;
+
+// Same three-column shape as `build_basic_cache()`, but the amounts are
+// deliberately non-integral / past the 64-bit integer range so a record's
+// label goes through the general numeric rendering path rather than the
+// integral one.
+//
+//   Region  Product  Amount
+//   ------  -------  ------
+//   North   Widget      1.5
+//   North   Gadget      2
+//   South   Widget     1e20
+//   South   Gadget      4
+PivotCache build_non_integral_amount_cache() {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  auto add = [&](const char* region, const char* product, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(owned_text(cache, product));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+
+  add("North", "Widget", 1.5);
+  add("North", "Gadget", 2.0);
+  add("South", "Widget", 1e20);
+  add("South", "Gadget", 4.0);
+  return cache;
+}
+
+// Index into `build_shared_region_cache()`'s Region `shared_items` of the
+// entry with no value, and of the text entry deliberately spelled like the
+// default blank placeholder.
+constexpr std::uint32_t kSharedRegionBlank = 1U;
+constexpr std::uint32_t kSharedRegionPlaceholderText = 2U;
+
+// Same three-column shape as `build_basic_cache()`, but Region is a *shared*
+// field the way a discrete axis column arrives from OOXML: each record stores
+// an index into `shared_items`, one of which has no value at all.
+//
+// The third shared item is a genuine text value spelled exactly like the
+// default blank placeholder, so a filter that identified the empty item by its
+// rendered label would catch this row too.
+//
+//   Region     Product  Amount
+//   ---------  -------  ------
+//   North      Widget    100
+//   <no value> Widget     10
+//   "(blank)"  Widget      7
+PivotCache build_shared_region_cache() {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  PivotCacheField region;
+  region.name = "Region";
+  region.shared_items.push_back(owned_text(cache, "North"));
+  region.shared_items.push_back(Value::blank());
+  region.shared_items.push_back(owned_text(cache, std::string{PivotLayoutOptions{}.blank_item_label}));
+  cache.mutable_fields().push_back(std::move(region));
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  auto add = [&](std::uint32_t region_index, const char* product, double amount) {
+    PivotCacheRecord rec;
+    rec.cells = {Value::number(region_index), owned_text(cache, product), Value::number(amount)};
+    rec.cell_is_index = {true, false, false};
+    cache.mutable_records().push_back(std::move(rec));
+  };
+
+  add(0U, "Widget", 100.0);
+  add(kSharedRegionBlank, "Widget", 10.0);
+  add(kSharedRegionPlaceholderText, "Widget", 7.0);
+  return cache;
+}
+
+// ---------------------------------------------------------------------------
+// 8d. PivotFilter (LabelContains / LabelBeginsWith / ValueTop10 / ValueGreaterThan)
+// ---------------------------------------------------------------------------
+
+TEST(PivotEvaluator, LabelContainsFilterDropsRecords) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Drop records whose Region label contains "outh" (i.e. South).
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::LabelContains;
+  f.value = std::string("outh");
+  // PivotFilter pre-aggregation reject: every match drops the record.
+  // Wait — LabelContains with payload "outh" *passes* records whose label
+  // contains it. To drop South we instead use LabelBeginsWith("North")
+  // below; LabelContains here keeps only South.
+  table.mutable_active_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 500.0);  // 200 + 300
+}
+
+TEST(PivotEvaluator, LabelBeginsWithFilterDropsRecords) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::LabelBeginsWith;
+  f.value = std::string("Nor");
+  table.mutable_active_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "North");
+}
+
+TEST(PivotEvaluator, AuthoredCaptionEqualFilterDropsRecords) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredCaptionFilter f;
+  f.field_index = 0;  // Region
+  f.predicate = CaptionPredicate::Equal;
+  f.value = "North";
+  table.mutable_authored_caption_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "North");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 175.0);  // 100 + 50 + 25
+}
+
+TEST(PivotEvaluator, AuthoredCaptionFilterIgnoresCase) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredCaptionFilter f;
+  f.field_index = 0;
+  f.predicate = CaptionPredicate::Equal;
+  f.value = "nOrTh";
+  table.mutable_authored_caption_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "North");
+}
+
+TEST(PivotEvaluator, AuthoredCaptionNotContainsFilterDropsMatchingRecords) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredCaptionFilter f;
+  f.field_index = 0;
+  f.predicate = CaptionPredicate::NotContains;
+  f.value = "outh";
+  table.mutable_authored_caption_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "North");
+}
+
+TEST(PivotEvaluator, AuthoredCaptionBetweenFilterKeepsTheInclusiveRange) {
+  PivotCache cache = build_basic_cache();
+  // Row on Product so the range spans "Gadget" / "Widget".
+  PivotTable table = build_sum_amount_table(/*row=*/{1}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredCaptionFilter f;
+  f.field_index = 1;  // Product
+  f.predicate = CaptionPredicate::Between;
+  f.value = "A";
+  f.value_high = "M";
+  table.mutable_authored_caption_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "Gadget");
+  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 350.0);  // 50 + 300
+}
+
+TEST(PivotEvaluator, AuthoredCaptionFilterWithOutOfRangeFieldIsInert) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredCaptionFilter f;
+  f.field_index = 99;
+  f.predicate = CaptionPredicate::Equal;
+  f.value = "North";
+  table.mutable_authored_caption_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  EXPECT_EQ(r_or.value().rows.size(), 2U);
+}
+
+TEST(PivotEvaluator, ManualFilterHidesItem) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Hide all records with Region == "South" via the Region field's items.
+  table.mutable_fields()[0].items = {
+      PivotItem{"North", /*visible=*/true},
+      PivotItem{"South", /*visible=*/false},
+  };
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Only North survives.
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "North");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 175.0);
+}
+
+TEST(PivotEvaluator, ManualFilterHidesTheBlankItem) {
+  PivotCache cache = build_shared_region_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  PivotItem hidden_blank;
+  hidden_blank.visible = false;
+  hidden_blank.has_cache_index = true;
+  hidden_blank.cache_index = kSharedRegionBlank;
+  table.mutable_fields()[0].items.push_back(hidden_blank);
+  // The load path leaves the item unnamed, because the value it binds to
+  // renders to nothing. Running it here pins that the filter works on the
+  // shape a workbook actually arrives in.
+  resolve_pivot_names(table, cache);
+  ASSERT_TRUE(table.fields()[0].items[0].name.empty());
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  const PivotLayoutOptions defaults;
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_DOUBLE_EQ(r.values[row_index(r, "North")][0][0].as_number(), 100.0);
+  // The text value spelled like the placeholder is untouched; only the group
+  // with no value is gone, and its 10 is out of every aggregate.
+  const std::size_t placeholder_text = row_index(r, defaults.blank_item_label);
+  ASSERT_NE(placeholder_text, static_cast<std::size_t>(-1));
+  EXPECT_DOUBLE_EQ(r.values[placeholder_text][0][0].as_number(), 7.0);
+}
+
+TEST(PivotEvaluator, HidingPlaceholderSpelledTextKeepsTheBlankItem) {
+  PivotCache cache = build_shared_region_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  PivotItem hidden_text;
+  hidden_text.visible = false;
+  hidden_text.has_cache_index = true;
+  hidden_text.cache_index = kSharedRegionPlaceholderText;
+  table.mutable_fields()[0].items.push_back(hidden_text);
+  resolve_pivot_names(table, cache);
+  const PivotLayoutOptions defaults;
+  ASSERT_EQ(table.fields()[0].items[0].name, defaults.blank_item_label);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_DOUBLE_EQ(r.values[row_index(r, "North")][0][0].as_number(), 100.0);
+  const std::size_t blank_leaf = row_index(r, defaults.blank_item_label);
+  ASSERT_NE(blank_leaf, static_cast<std::size_t>(-1));
+  EXPECT_DOUBLE_EQ(r.values[blank_leaf][0][0].as_number(), 10.0);
+}
+
+TEST(PivotEvaluator, UnnamedItemBoundByCacheIndexHidesItsValue) {
+  PivotCache cache = build_shared_north_south_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  PivotItem hidden_south;
+  hidden_south.visible = false;
+  hidden_south.has_cache_index = true;
+  hidden_south.cache_index = 1U;
+  table.mutable_fields()[0].items.push_back(hidden_south);
+  ASSERT_TRUE(table.fields()[0].items[0].name.empty());
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "North");
+  ASSERT_TRUE(r.grand_total.is_number());
+  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 175.0);
+}
+
+TEST(PivotItemLabel, NameWinsThenBindingThenEmpty) {
+  const PivotCache cache = build_shared_north_south_cache();
+  PivotItem named;
+  named.name = "Renamed";
+  named.cache_index = 1U;
+  EXPECT_EQ(pivot_item_label(cache, 0U, named), "Renamed");
+  PivotItem bound;
+  bound.has_cache_index = true;
+  bound.cache_index = 1U;
+  EXPECT_EQ(pivot_item_label(cache, 0U, bound), "South");
+  PivotItem dangling;
+  dangling.has_cache_index = true;
+  dangling.cache_index = 9U;
+  EXPECT_EQ(pivot_item_label(cache, 0U, dangling), "");
+  EXPECT_EQ(pivot_item_label(cache, 7U, bound), "");
+}
+
+TEST(PivotEvaluator, ManualFilterMatchesNumericDisplayLabel) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // The numeric Amount field is rendered as its integral display label.
+  // Hiding 300 removes only South/Gadget without allocating a label string
+  // per record while the filter is evaluated.
+  table.mutable_fields()[2].items = {PivotItem{"300", /*visible=*/false}};
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  const std::size_t north = row_index(r, "North");
+  const std::size_t south = row_index(r, "South");
+  ASSERT_NE(north, static_cast<std::size_t>(-1));
+  ASSERT_NE(south, static_cast<std::size_t>(-1));
+  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 175.0);
+  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 200.0);
+}
+
+TEST(PivotEvaluator, ManualFilterHidesNonIntegralNumericItem) {
+  PivotCache cache = build_non_integral_amount_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  table.mutable_fields()[2].items = {PivotItem{display_string(Value::number(1.5)), /*visible=*/false}};
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  const std::size_t north = row_index(r, "North");
+  ASSERT_NE(north, static_cast<std::size_t>(-1));
+  // North keeps only the 2.0 record; the 1.5 one is gone from the aggregate.
+  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 2.0);
+}
+
+TEST(PivotEvaluator, ManualFilterHidesNumericItemBeyondIntegerRange) {
+  PivotCache cache = build_non_integral_amount_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  table.mutable_fields()[2].items = {PivotItem{display_string(Value::number(1e20)), /*visible=*/false}};
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  const std::size_t south = row_index(r, "South");
+  ASSERT_NE(south, static_cast<std::size_t>(-1));
+  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 4.0);
+}
+
+TEST(PivotEvaluator, LabelContainsFilterMatchesNumericItemLabel) {
+  PivotCache cache = build_non_integral_amount_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Amount";
+  f.type = FilterType::LabelContains;
+  f.value = display_string(Value::number(1e20));  // "1E+20"
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1e20);
+}
+
+TEST(PivotEvaluator, AnItemListThatHidesNothingDoesNotChangeTheResult) {
+  PivotCache cache = build_basic_cache();
+  PivotTable unfiltered = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  unfiltered.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  auto baseline_or = evaluate(unfiltered, cache);
+  ASSERT_TRUE(static_cast<bool>(baseline_or)) << baseline_or.error().message;
+
+  PivotTable listed = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  listed.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // Far more items than the field has values, none of them hidden.
+  for (std::size_t i = 0; i < 500; ++i) {
+    listed.mutable_fields()[0].items.push_back(PivotItem{"item_" + std::to_string(i), /*visible=*/true});
+  }
+  listed.mutable_fields()[0].items.push_back(PivotItem{"North", /*visible=*/true});
+  listed.mutable_fields()[0].items.push_back(PivotItem{"South", /*visible=*/true});
+  auto listed_or = evaluate(listed, cache);
+  ASSERT_TRUE(static_cast<bool>(listed_or)) << listed_or.error().message;
+
+  const PivotResult& baseline = baseline_or.value();
+  const PivotResult& with_list = listed_or.value();
+  ASSERT_EQ(with_list.rows.size(), baseline.rows.size());
+  for (std::size_t i = 0; i < baseline.rows.size(); ++i) {
+    EXPECT_EQ(with_list.rows[i].label, baseline.rows[i].label);
+    EXPECT_DOUBLE_EQ(with_list.values[i][0][0].as_number(), baseline.values[i][0][0].as_number());
+  }
+}
+
+TEST(PivotEvaluator, OneFieldHidesTheBlankAndANamedItemTogether) {
+  PivotCache cache = build_shared_region_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  PivotItem hidden_blank;
+  hidden_blank.visible = false;
+  hidden_blank.has_cache_index = true;
+  hidden_blank.cache_index = kSharedRegionBlank;
+  table.mutable_fields()[0].items.push_back(hidden_blank);
+  table.mutable_fields()[0].items.push_back(PivotItem{"North", /*visible=*/false});
+  resolve_pivot_names(table, cache);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Only the text value spelled like the placeholder survives.
+  const PivotLayoutOptions defaults;
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, defaults.blank_item_label);
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 7.0);
+}
+
+TEST(PivotEvaluator, AnUnlabelledHiddenItemBoundToAValueHidesThatValue) {
+  PivotCache cache = build_shared_region_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  PivotItem unlabelled;
+  unlabelled.visible = false;
+  unlabelled.has_cache_index = true;
+  unlabelled.cache_index = 0U;  // "North", a value that renders to a label.
+  table.mutable_fields()[0].items.push_back(std::move(unlabelled));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // North is gone; the blank group and the text value spelled like the
+  // placeholder both survive. They draw the same label, so they are counted
+  // through the total rather than looked up by it.
+  ASSERT_EQ(r.rows.size(), 2U);
+  EXPECT_EQ(row_index(r, "North"), static_cast<std::size_t>(-1));
+  double total = 0.0;
+  for (std::size_t i = 0; i < r.rows.size(); ++i) {
+    total += r.values[i][0][0].as_number();
+  }
+  EXPECT_DOUBLE_EQ(total, 10.0 + 7.0);
+}
+
+TEST(PivotEvaluator, ManualFilterMatchesANumericLabelAmongManyItems) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  // 2,000 visible numeric items the cache has no record for, plus the one that
+  // matches. Only the last one may prune anything.
+  for (std::size_t i = 1000; i < 3000; ++i) {
+    table.mutable_fields()[2].items.push_back(PivotItem{std::to_string(i), /*visible=*/true});
+  }
+  table.mutable_fields()[2].items.push_back(PivotItem{"300", /*visible=*/false});
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  const std::size_t south = row_index(r, "South");
+  ASSERT_NE(south, static_cast<std::size_t>(-1));
+  // South loses its 300 record and keeps the 200 one.
+  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 200.0);
+}
+
+TEST(PivotEvaluator, ManualFilterCostDoesNotFollowTheItemListLength) {
+  constexpr std::size_t kRecords = 10000;
+
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Serial", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  for (std::size_t i = 0; i < kRecords; ++i) {
+    PivotCacheRecord rec;
+    // Non-integral so the label goes through the general numeric rendering.
+    rec.cells = {Value::number(static_cast<double>(i) + 0.25), Value::number(1.0)};
+    cache.mutable_records().push_back(std::move(rec));
+  }
+
+  // Every item is hidden and none of them names a value any record carries, so
+  // the item list prunes nothing however long it is.
+  const auto build = [](std::size_t item_count) {
+    PivotTable table;
+    table.set_pivot_cache_id(1);
+    PivotField serial_field;
+    serial_field.source_name = "Serial";
+    serial_field.axis = PivotAxis::Row;
+    for (std::size_t i = 0; i < item_count; ++i) {
+      serial_field.items.push_back(
+          PivotItem{display_string(Value::number(-static_cast<double>(i) - 0.5)), /*visible=*/false});
+    }
+    table.mutable_fields().push_back(std::move(serial_field));
+    PivotField amount_field;
+    amount_field.source_name = "Amount";
+    amount_field.axis = PivotAxis::Value;
+    table.mutable_fields().push_back(std::move(amount_field));
+    PivotDataField count;
+    count.name = "Count of Amount";
+    count.field_index = 1;
+    count.aggregation = Aggregation::Count;
+    table.mutable_data_fields().push_back(std::move(count));
+    table.mutable_row_field_order() = {0};
+    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+    return table;
+  };
+  const PivotTable short_list = build(20);
+  const PivotTable long_list = build(20000);
+
+  const auto timed = [&](const PivotTable& table) {
+    const auto started = std::chrono::steady_clock::now();
+    auto r_or = evaluate(table, cache);
+    const double seconds = std::chrono::duration<double>(std::chrono::steady_clock::now() - started).count();
+    EXPECT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+    EXPECT_EQ(r_or.value().rows.size(), kRecords);
+    return seconds;
+  };
+  const double short_seconds = timed(short_list);
+  const double long_seconds = timed(long_list);
+
+  // The allowance is deliberately loose — a factor of ten plus half a second —
+  // because it is separating a constant from a thousandfold, not measuring the
+  // machine.
+  EXPECT_LT(long_seconds, short_seconds * 10.0 + 0.5)
+      << "short list " << short_seconds << "s, long list " << long_seconds << "s";
+}
+
+TEST(PivotEvaluator, LabelFilterResolvesFieldByCustomName) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.mutable_fields()[0].custom_name = "Area";
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Area";  // The display name, not the source name.
+  f.type = FilterType::LabelBeginsWith;
+  f.value = std::string("N");
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Only the North records survive, so both the axis and the aggregate move.
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "North");
+  ASSERT_EQ(r.values.size(), 1U);
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 175.0);  // 100 + 50 + 25
+  ASSERT_TRUE(r.grand_total.is_number());
+  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 175.0);
+}
+
+TEST(PivotEvaluator, LabelFilterResolvesFieldByDataFieldName) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+
+  // "Sum of Amount" is the data field's display name for the Amount field,
+  // so the filter applies to Amount's own values.
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Sum of Amount";
+  f.type = FilterType::LabelBeginsWith;
+  f.value = std::string("1");
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Only the Amount=100 record starts with "1".
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "North");
+  ASSERT_TRUE(r.grand_total.is_number());
+  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 100.0);
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_filter_page_test.cpp b/tests/unit/pivot/pivot_filter_page_test.cpp
new file mode 100644
index 000000000..4311e9197
--- /dev/null
+++ b/tests/unit/pivot/pivot_filter_page_test.cpp
@@ -0,0 +1,164 @@
+// Page (report-filter) field selection vocabulary and visibility.
+
+#include <algorithm>
+#include <cstddef>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_evaluator_fixtures.h"
+#include "pivot_filter_test_helpers.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using filter_test::build_shared_north_south_cache;
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+
+PivotTable build_page_axis_table() {
+  PivotTable table = build_sum_amount_table(/*row=*/{1}, /*col=*/{});
+  table.mutable_fields()[0].axis = PivotAxis::Page;
+  return table;
+}
+
+// Lists Region's two shared items, hiding whichever ones are named.
+void set_region_items(PivotTable& table, const std::vector<std::string>& hidden) {
+  std::vector<PivotItem>& items = table.mutable_fields()[0].items;
+  items.clear();
+  std::uint32_t index = 0;
+  for (const char* name : {"North", "South"}) {
+    PivotItem item;
+    item.name = name;
+    item.visible = std::find(hidden.begin(), hidden.end(), name) == hidden.end();
+    item.has_cache_index = true;
+    item.cache_index = index++;
+    items.push_back(std::move(item));
+  }
+}
+
+TEST(PivotPageSelection, UnfilteredFieldShowsTheAllPlaceholder) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_page_axis_table();
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& result = r_or.value();
+
+  ASSERT_EQ(result.page_selections.size(), 1U);
+  EXPECT_EQ(result.page_selections[0].field_index, 0U);
+  EXPECT_EQ(result.page_selections[0].field_label, "Region");
+  EXPECT_EQ(result.page_selections[0].item_label, "(All)");
+}
+
+TEST(PivotPageSelection, AnItemListThatHidesNothingIsStillUnfiltered) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_page_axis_table();
+  set_region_items(table, /*hidden=*/{});
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
+  EXPECT_EQ(r_or.value().page_selections[0].item_label, "(All)");
+}
+
+TEST(PivotPageSelection, SoleVisibleItemNamesItself) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_page_axis_table();
+  set_region_items(table, /*hidden=*/{"South"});
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
+  EXPECT_EQ(r_or.value().page_selections[0].item_label, "North");
+
+  // The hidden item also prunes records, which is the pre-existing manual
+  // filter path rather than anything the selection label drives.
+  ASSERT_TRUE(r_or.value().grand_total.is_number());
+  EXPECT_DOUBLE_EQ(r_or.value().grand_total.as_number(), 175.0);
+}
+
+TEST(PivotPageSelection, SoleVisibleUnnamedItemIsLabelledFromItsBinding) {
+  PivotCache cache = build_shared_north_south_cache();
+  PivotTable table = build_page_axis_table();
+  for (std::uint32_t index : {0U, 1U}) {
+    PivotItem item;
+    item.visible = index == 1U;
+    item.has_cache_index = true;
+    item.cache_index = index;
+    table.mutable_fields()[0].items.push_back(item);
+  }
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
+  EXPECT_EQ(r_or.value().page_selections[0].item_label, "South");
+  ASSERT_TRUE(r_or.value().grand_total.is_number());
+  EXPECT_DOUBLE_EQ(r_or.value().grand_total.as_number(), 500.0);
+}
+
+TEST(PivotPageSelection, SeveralVisibleItemsUseTheMultiplePlaceholder) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_page_axis_table();
+  // A third item nobody selected leaves two of three showing.
+  set_region_items(table, /*hidden=*/{});
+  PivotItem east;
+  east.name = "East";
+  east.visible = false;
+  east.has_cache_index = true;
+  east.cache_index = 2;
+  table.mutable_fields()[0].items.push_back(std::move(east));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
+  EXPECT_EQ(r_or.value().page_selections[0].item_label, "(Multiple Items)");
+}
+
+TEST(PivotPageSelection, ExplicitPageFieldItemWinsOverVisibility) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_page_axis_table();
+  set_region_items(table, /*hidden=*/{});
+  table.mutable_page_fields().push_back(PivotPageField{0, std::optional<std::uint32_t>{1}});
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
+  EXPECT_EQ(r_or.value().page_selections[0].item_label, "South");
+}
+
+TEST(PivotPageSelection, OutOfRangeItemFallsBackToVisibility) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_page_axis_table();
+  set_region_items(table, /*hidden=*/{});
+  table.mutable_page_fields().push_back(PivotPageField{0, std::optional<std::uint32_t>{9}});
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
+  EXPECT_EQ(r_or.value().page_selections[0].item_label, "(All)");
+}
+
+TEST(PivotPageSelection, LocaleVocabularyNamesTheSelection) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_page_axis_table();
+  PivotLayoutOptions options;
+  options.all_pages_label = "(すべて)";
+
+  auto r_or = evaluate(table, cache, options);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
+  EXPECT_EQ(r_or.value().page_selections[0].item_label, "(すべて)");
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_filter_test.cpp b/tests/unit/pivot/pivot_filter_test.cpp
deleted file mode 100644
index 120939247..000000000
--- a/tests/unit/pivot/pivot_filter_test.cpp
+++ /dev/null
@@ -1,2050 +0,0 @@
-//
-// Unit tests for the filters `formulon::pivot::evaluate` applies: label,
-// caption, value, date and relative-period filters, manual item visibility,
-// and the page (report filter) axis selection.
-
-#include <algorithm>
-#include <chrono>
-#include <cstddef>
-#include <cstdint>
-#include <optional>
-#include <string>
-#include <utility>
-#include <variant>
-#include <vector>
-
-#include "gtest/gtest.h"
-#include "pivot/pivot_cache.h"
-#include "pivot/pivot_evaluator.h"
-#include "pivot/pivot_index.h"
-#include "pivot/pivot_layout.h"
-#include "pivot/pivot_result.h"
-#include "pivot/pivot_table.h"
-#include "pivot/pivot_types.h"
-#include "pivot_evaluator_fixtures.h"
-#include "utils/date_time.h"
-#include "utils/error.h"
-#include "value.h"
-
-namespace formulon::pivot {
-namespace {
-
-using test::build_basic_cache;
-using test::build_sum_amount_table;
-using test::owned_text;
-using test::row_index;
-
-// Same three-column shape as `build_basic_cache()`, but the amounts are
-// deliberately non-integral / past the 64-bit integer range so a record's
-// label goes through the general numeric rendering path rather than the
-// integral one.
-//
-//   Region  Product  Amount
-//   ------  -------  ------
-//   North   Widget      1.5
-//   North   Gadget      2
-//   South   Widget     1e20
-//   South   Gadget      4
-PivotCache build_non_integral_amount_cache() {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  auto add = [&](const char* region, const char* product, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(owned_text(cache, product));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-
-  add("North", "Widget", 1.5);
-  add("North", "Gadget", 2.0);
-  add("South", "Widget", 1e20);
-  add("South", "Gadget", 4.0);
-  return cache;
-}
-
-// Index into `build_shared_region_cache()`'s Region `shared_items` of the
-// entry with no value, and of the text entry deliberately spelled like the
-// default blank placeholder.
-constexpr std::uint32_t kSharedRegionBlank = 1U;
-constexpr std::uint32_t kSharedRegionPlaceholderText = 2U;
-
-// Same three-column shape as `build_basic_cache()`, but Region is a *shared*
-// field the way a discrete axis column arrives from OOXML: each record stores
-// an index into `shared_items`, one of which has no value at all.
-//
-// The third shared item is a genuine text value spelled exactly like the
-// default blank placeholder, so a filter that identified the empty item by its
-// rendered label would catch this row too.
-//
-//   Region     Product  Amount
-//   ---------  -------  ------
-//   North      Widget    100
-//   <no value> Widget     10
-//   "(blank)"  Widget      7
-PivotCache build_shared_region_cache() {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  PivotCacheField region;
-  region.name = "Region";
-  region.shared_items.push_back(owned_text(cache, "North"));
-  region.shared_items.push_back(Value::blank());
-  region.shared_items.push_back(owned_text(cache, std::string{PivotLayoutOptions{}.blank_item_label}));
-  cache.mutable_fields().push_back(std::move(region));
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  auto add = [&](std::uint32_t region_index, const char* product, double amount) {
-    PivotCacheRecord rec;
-    rec.cells = {Value::number(region_index), owned_text(cache, product), Value::number(amount)};
-    rec.cell_is_index = {true, false, false};
-    cache.mutable_records().push_back(std::move(rec));
-  };
-
-  add(0U, "Widget", 100.0);
-  add(kSharedRegionBlank, "Widget", 10.0);
-  add(kSharedRegionPlaceholderText, "Widget", 7.0);
-  return cache;
-}
-
-// ---------------------------------------------------------------------------
-// 8d. PivotFilter (LabelContains / LabelBeginsWith / ValueTop10 / ValueGreaterThan)
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, LabelContainsFilterDropsRecords) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Drop records whose Region label contains "outh" (i.e. South).
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::LabelContains;
-  f.value = std::string("outh");
-  // PivotFilter pre-aggregation reject: every match drops the record.
-  // Wait — LabelContains with payload "outh" *passes* records whose label
-  // contains it. To drop South we instead use LabelBeginsWith("North")
-  // below; LabelContains here keeps only South.
-  table.mutable_active_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 500.0);  // 200 + 300
-}
-
-TEST(PivotEvaluator, LabelBeginsWithFilterDropsRecords) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::LabelBeginsWith;
-  f.value = std::string("Nor");
-  table.mutable_active_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "North");
-}
-
-// ---------------------------------------------------------------------------
-// 8e. AuthoredCaptionFilter (decoded from an OOXML `<filters>` block)
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, AuthoredCaptionEqualFilterDropsRecords) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredCaptionFilter f;
-  f.field_index = 0;  // Region
-  f.predicate = CaptionPredicate::Equal;
-  f.value = "North";
-  table.mutable_authored_caption_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "North");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 175.0);  // 100 + 50 + 25
-}
-
-// Excel matches a caption filter the way it matches an AutoFilter
-// criterion, so a criterion that differs only in case still selects.
-TEST(PivotEvaluator, AuthoredCaptionFilterIgnoresCase) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredCaptionFilter f;
-  f.field_index = 0;
-  f.predicate = CaptionPredicate::Equal;
-  f.value = "nOrTh";
-  table.mutable_authored_caption_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "North");
-}
-
-TEST(PivotEvaluator, AuthoredCaptionNotContainsFilterDropsMatchingRecords) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredCaptionFilter f;
-  f.field_index = 0;
-  f.predicate = CaptionPredicate::NotContains;
-  f.value = "outh";
-  table.mutable_authored_caption_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "North");
-}
-
-TEST(PivotEvaluator, AuthoredCaptionBetweenFilterKeepsTheInclusiveRange) {
-  PivotCache cache = build_basic_cache();
-  // Row on Product so the range spans "Gadget" / "Widget".
-  PivotTable table = build_sum_amount_table(/*row=*/{1}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredCaptionFilter f;
-  f.field_index = 1;  // Product
-  f.predicate = CaptionPredicate::Between;
-  f.value = "A";
-  f.value_high = "M";
-  table.mutable_authored_caption_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "Gadget");
-  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 350.0);  // 50 + 300
-}
-
-// A `fld` past the end of `<pivotFields>` is a malformed definition; it
-// must filter nothing rather than drop every record.
-TEST(PivotEvaluator, AuthoredCaptionFilterWithOutOfRangeFieldIsInert) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredCaptionFilter f;
-  f.field_index = 99;
-  f.predicate = CaptionPredicate::Equal;
-  f.value = "North";
-  table.mutable_authored_caption_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  EXPECT_EQ(r_or.value().rows.size(), 2U);
-}
-
-// ---------------------------------------------------------------------------
-// 8f. AuthoredValueFilter (the value and date half of the same block)
-//
-// The basic cache totals North 175 and South 500 by Region.
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, AuthoredTopCountKeepsTheHighestScoringLeaf) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredValueFilter f;
-  f.field_index = 0;
-  f.type = FilterType::ValueTop10;
-  f.value = 1.0;
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "South");
-}
-
-// Excel's "Bottom N" dialog option writes the identically shaped
-// `<top10>` with `top="0"`. Keeping the wrong direction here would keep
-// South (175 < 500 makes North the actual bottom) instead of North.
-TEST(PivotEvaluator, AuthoredTopCountWithTopFalseKeepsTheLowestScoringLeaf) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredValueFilter f;
-  f.field_index = 0;
-  f.type = FilterType::ValueTop10;
-  f.value = 1.0;
-  f.top = false;
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "North");
-}
-
-TEST(PivotEvaluator, AuthoredGreaterThanIsStrictOnTheThreshold) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredValueFilter f;
-  f.field_index = 0;
-  f.type = FilterType::ValueGreaterThan;
-  f.value = 175.0;  // exactly North's total
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "South");
-}
-
-TEST(PivotEvaluator, AuthoredBetweenIncludesBothBounds) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredValueFilter f;
-  f.field_index = 0;
-  f.type = FilterType::ValueBetween;
-  f.value = 175.0;
-  f.value_high = 500.0;
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  EXPECT_EQ(r_or.value().rows.size(), 2U);
-}
-
-// A file names only the field; the axis it prunes has to be recovered
-// from that field's place in the row / column order. A field on neither
-// axis leaves nothing to prune.
-TEST(PivotEvaluator, AuthoredValueFilterOnAnOffAxisFieldIsInert) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredValueFilter f;
-  f.field_index = 2;  // Amount: a data field, on no axis
-  f.type = FilterType::ValueTop10;
-  f.value = 1.0;
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  EXPECT_EQ(r_or.value().rows.size(), 2U);
-}
-
-// Ranked by aggregate, so it cannot be decided until the aggregates
-// exist -- unlike its caption and date siblings, which prune records.
-// Pinning it on the column axis proves the axis recovery is not
-// hard-coded to rows.
-TEST(PivotEvaluator, AuthoredValueFilterPrunesTheColumnAxisToo) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{}, /*col=*/{0});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredValueFilter f;
-  f.field_index = 0;
-  f.type = FilterType::ValueTop10;
-  f.value = 1.0;
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().cols.size(), 1U);
-  EXPECT_EQ(r_or.value().cols[0].label, "South");
-}
-
-TEST(PivotEvaluator, AuthoredDateFilterPrunesRecordsByTheirSerial) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Field 2 holds the amounts, which are plain numbers -- the date pass
-  // reads whatever serial the bound cell carries, so a range that spans
-  // only North's two smaller amounts drops South entirely.
-  AuthoredValueFilter f;
-  f.field_index = 2;
-  f.type = FilterType::LabelDate;
-  f.value = 0.0;
-  f.value_high = 100.0;
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "North");
-}
-
-// ---------------------------------------------------------------------------
-// 8g. Relative-period filters
-//
-// These carry no bounds in the file, so the substance is the calendar
-// arithmetic that turns a period name plus a clock reading into a window.
-// The boundaries are asserted directly against `serial_from_ymd` rather
-// than against literal serials: the point under test is which calendar day
-// each window starts and ends on, not the serial encoding, which
-// `DateTimeDate` already pins.
-// ---------------------------------------------------------------------------
-
-namespace {
-
-// 2026-05-20 12:00:00. Mid-month, mid-quarter, so every window's two
-// boundaries are distinct from the reading itself.
-constexpr date_time::CivilTime kMay20{{2026, 5U, 20U}, {12U, 0U, 0U}};
-
-double Serial(int year, unsigned month, unsigned day) {
-  return date_time::serial_from_ymd(year, month, day, /*date1904=*/false);
-}
-
-void ExpectWindow(RelativePeriod period, const date_time::CivilTime& now, int low_y, unsigned low_m, unsigned low_d,
-                  int high_y, unsigned high_m, unsigned high_d) {
-  const DateWindow window = resolve_relative_period(period, now, /*date1904=*/false);
-  EXPECT_DOUBLE_EQ(window.low, Serial(low_y, low_m, low_d));
-  EXPECT_DOUBLE_EQ(window.high, Serial(high_y, high_m, high_d));
-}
-
-}  // namespace
-
-TEST(RelativePeriod, DayWindowsAreSingleDays) {
-  ExpectWindow(RelativePeriod::Today, kMay20, 2026, 5, 20, 2026, 5, 20);
-  ExpectWindow(RelativePeriod::Yesterday, kMay20, 2026, 5, 19, 2026, 5, 19);
-  ExpectWindow(RelativePeriod::Tomorrow, kMay20, 2026, 5, 21, 2026, 5, 21);
-}
-
-TEST(RelativePeriod, MonthWindowsEndOnTheirOwnLastDay) {
-  // May has 31 days, April 30 -- the window end is derived from the next
-  // month's first day, so a wrong month length would show up here.
-  ExpectWindow(RelativePeriod::ThisMonth, kMay20, 2026, 5, 1, 2026, 5, 31);
-  ExpectWindow(RelativePeriod::LastMonth, kMay20, 2026, 4, 1, 2026, 4, 30);
-  ExpectWindow(RelativePeriod::NextMonth, kMay20, 2026, 6, 1, 2026, 6, 30);
-}
-
-TEST(RelativePeriod, QuarterWindowsSnapToTheCalendarQuarter) {
-  // May sits in Q2, so "this quarter" starts in April rather than in May.
-  ExpectWindow(RelativePeriod::ThisQuarter, kMay20, 2026, 4, 1, 2026, 6, 30);
-  ExpectWindow(RelativePeriod::LastQuarter, kMay20, 2026, 1, 1, 2026, 3, 31);
-  ExpectWindow(RelativePeriod::NextQuarter, kMay20, 2026, 7, 1, 2026, 9, 30);
-}
-
-TEST(RelativePeriod, YearWindowsSpanTheWholeCalendarYear) {
-  ExpectWindow(RelativePeriod::ThisYear, kMay20, 2026, 1, 1, 2026, 12, 31);
-  ExpectWindow(RelativePeriod::LastYear, kMay20, 2025, 1, 1, 2025, 12, 31);
-  ExpectWindow(RelativePeriod::NextYear, kMay20, 2027, 1, 1, 2027, 12, 31);
-}
-
-TEST(RelativePeriod, YearToDateStopsAtTheReadingNotAtYearEnd) {
-  ExpectWindow(RelativePeriod::YearToDate, kMay20, 2026, 1, 1, 2026, 5, 20);
-}
-
-TEST(RelativePeriod, WindowsRollOverTheYearBoundary) {
-  // January is the case the explicit month arithmetic exists for: naive
-  // subtraction would produce month 0 rather than the previous December.
-  constexpr date_time::CivilTime kJan10{{2026, 1U, 10U}, {0U, 0U, 0U}};
-  ExpectWindow(RelativePeriod::LastMonth, kJan10, 2025, 12, 1, 2025, 12, 31);
-  ExpectWindow(RelativePeriod::LastQuarter, kJan10, 2025, 10, 1, 2025, 12, 31);
-  constexpr date_time::CivilTime kDec10{{2026, 12U, 10U}, {0U, 0U, 0U}};
-  ExpectWindow(RelativePeriod::NextMonth, kDec10, 2027, 1, 1, 2027, 1, 31);
-  ExpectWindow(RelativePeriod::NextQuarter, kDec10, 2027, 1, 1, 2027, 3, 31);
-}
-
-TEST(RelativePeriod, LeapFebruaryKeepsItsTwentyNinthDay) {
-  constexpr date_time::CivilTime kFeb2024{{2024, 2U, 5U}, {0U, 0U, 0U}};
-  ExpectWindow(RelativePeriod::ThisMonth, kFeb2024, 2024, 2, 1, 2024, 2, 29);
-}
-
-TEST(RelativePeriod, TheWindowFollowsTheWorkbookEpoch) {
-  // A 1904-system workbook stores every date 1462 lower, so the resolved
-  // window has to shift with it or it would select the wrong records.
-  const DateWindow window = resolve_relative_period(RelativePeriod::ThisMonth, kMay20, /*date1904=*/true);
-  EXPECT_DOUBLE_EQ(window.low, Serial(2026, 5, 1) - date_time::kDate1904EpochGap);
-  EXPECT_DOUBLE_EQ(window.high, Serial(2026, 5, 31) - date_time::kDate1904EpochGap);
-}
-
-TEST(RelativePeriod, WeekWindowsRunSundayThroughSaturday) {
-  // Excel anchors the week group on the calendar week, so a reading taken
-  // mid-week still starts the window on the preceding Sunday rather than
-  // seven days back from the reading. 2026-08-21 is a Friday.
-  constexpr date_time::CivilTime kAug21{{2026, 8U, 21U}, {9U, 30U, 0U}};
-  ExpectWindow(RelativePeriod::ThisWeek, kAug21, 2026, 8, 16, 2026, 8, 22);
-  ExpectWindow(RelativePeriod::LastWeek, kAug21, 2026, 8, 9, 2026, 8, 15);
-  ExpectWindow(RelativePeriod::NextWeek, kAug21, 2026, 8, 23, 2026, 8, 29);
-}
-
-TEST(RelativePeriod, WeekWindowsTileWithoutGapOrOverlap) {
-  // The three windows are adjacent by construction; asserting it directly
-  // is what rules out an off-by-one that a single window would hide.
-  const DateWindow last = resolve_relative_period(RelativePeriod::LastWeek, kMay20, /*date1904=*/false);
-  const DateWindow current = resolve_relative_period(RelativePeriod::ThisWeek, kMay20, /*date1904=*/false);
-  const DateWindow next = resolve_relative_period(RelativePeriod::NextWeek, kMay20, /*date1904=*/false);
-  EXPECT_DOUBLE_EQ(current.low, last.high + 1.0);
-  EXPECT_DOUBLE_EQ(next.low, current.high + 1.0);
-  EXPECT_DOUBLE_EQ(current.high - current.low, 6.0);
-}
-
-TEST(RelativePeriod, AWeekWindowStartingOnSundayDoesNotShiftBack) {
-  // A Sunday reading is the boundary case: the week it belongs to is its
-  // own, not the one that just ended.
-  constexpr date_time::CivilTime kSunday{{2025, 12U, 28U}, {0U, 0U, 0U}};
-  ExpectWindow(RelativePeriod::ThisWeek, kSunday, 2025, 12, 28, 2026, 1, 3);
-}
-
-TEST(RelativePeriod, WeekWindowsCrossTheYearBoundary) {
-  constexpr date_time::CivilTime kNewYear{{2026, 1U, 1U}, {0U, 0U, 0U}};
-  ExpectWindow(RelativePeriod::ThisWeek, kNewYear, 2025, 12, 28, 2026, 1, 3);
-  ExpectWindow(RelativePeriod::LastWeek, kNewYear, 2025, 12, 21, 2025, 12, 27);
-}
-
-TEST(RelativePeriod, TheWeekWindowFollowsTheWorkbookEpoch) {
-  const DateWindow window = resolve_relative_period(RelativePeriod::ThisWeek, kMay20, /*date1904=*/true);
-  EXPECT_DOUBLE_EQ(window.low, Serial(2026, 5, 17) - date_time::kDate1904EpochGap);
-  EXPECT_DOUBLE_EQ(window.high, Serial(2026, 5, 23) - date_time::kDate1904EpochGap);
-}
-
-TEST(PivotEvaluator, RecurringMonthFilterKeepsEveryYearsMatchingMonth) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Field 2 holds North 100 / 50 / 25 and South 200 / 300, read here as
-  // date serials: 25 is 1900-01-25, 50 is 1900-02-19, 100 is 1900-04-09,
-  // 200 is 1900-07-18 and 300 is 1900-10-26. January therefore admits
-  // North's 25 alone -- and it does so with no clock reading at all,
-  // which is what separates this family from the relative periods.
-  AuthoredRecurringFilter f;
-  f.field_index = 2;
-  f.month_low = 1;
-  f.month_high = 1;
-  table.mutable_authored_recurring_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, PivotFilterEnv{});
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "North");
-  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 25.0);
-}
-
-TEST(PivotEvaluator, ARecurringQuarterSpansItsThreeMonths) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Q2 is months 4..6; serial 100 is 1900-04-09, so North's 100 survives
-  // and its January pair does not.
-  AuthoredRecurringFilter f;
-  f.field_index = 2;
-  f.month_low = 4;
-  f.month_high = 6;
-  table.mutable_authored_recurring_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, PivotFilterEnv{});
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "North");
-  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 100.0);
-}
-
-TEST(PivotEvaluator, ARecurringFilterIsIndependentOfTheClock) {
-  // The whole point of the family: the same table evaluated against two
-  // very different readings selects the same records.
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredRecurringFilter f;
-  f.field_index = 2;
-  f.month_low = 1;
-  f.month_high = 1;
-  table.mutable_authored_recurring_filters().push_back(f);
-
-  PivotFilterEnv early;
-  early.pinned_now = date_time::CivilTime{{1900, 2U, 15U}, {0U, 0U, 0U}};
-  PivotFilterEnv late;
-  late.pinned_now = date_time::CivilTime{{2099, 11U, 3U}, {0U, 0U, 0U}};
-  auto early_or = evaluate(table, cache, PivotLayoutOptions{}, early);
-  auto late_or = evaluate(table, cache, PivotLayoutOptions{}, late);
-  ASSERT_TRUE(static_cast<bool>(early_or)) << early_or.error().message;
-  ASSERT_TRUE(static_cast<bool>(late_or)) << late_or.error().message;
-  EXPECT_DOUBLE_EQ(early_or.value().values[0][0][0].as_number(), 25.0);
-  EXPECT_DOUBLE_EQ(late_or.value().values[0][0][0].as_number(), 25.0);
-}
-
-TEST(PivotEvaluator, AuthoredPeriodFilterPrunesRecordsAgainstThePinnedClock) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Field 2 carries the amounts (North 100 / 50 / 25, South 200 / 300),
-  // read here as date serials. Pinning to 1900-02-15 makes "this quarter"
-  // 1900-01-01..1900-03-31, i.e. serials 1..91: it admits North's 50 and
-  // 25 and excludes everything else, South included.
-  AuthoredPeriodFilter f;
-  f.field_index = 2;
-  f.period = RelativePeriod::ThisQuarter;
-  table.mutable_authored_period_filters().push_back(f);
-
-  PivotFilterEnv env;
-  env.pinned_now = date_time::CivilTime{{1900, 2U, 15U}, {0U, 0U, 0U}};
-  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "North");
-  ASSERT_EQ(r_or.value().values.size(), 1U);
-  ASSERT_EQ(r_or.value().values[0].size(), 1U);
-  ASSERT_EQ(r_or.value().values[0][0].size(), 1U);
-  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 75.0);
-}
-
-TEST(PivotEvaluator, MovingThePinnedClockMovesWhichRecordsSurvive) {
-  // Same filter, a quarter later: the window becomes serials 92..181,
-  // which admits North's 100 alone and still excludes South.
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredPeriodFilter f;
-  f.field_index = 2;
-  f.period = RelativePeriod::ThisQuarter;
-  table.mutable_authored_period_filters().push_back(f);
-
-  PivotFilterEnv env;
-  env.pinned_now = date_time::CivilTime{{1900, 5U, 15U}, {0U, 0U, 0U}};
-  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().rows.size(), 1U);
-  EXPECT_EQ(r_or.value().rows[0].label, "North");
-  ASSERT_EQ(r_or.value().values.size(), 1U);
-  ASSERT_EQ(r_or.value().values[0].size(), 1U);
-  ASSERT_EQ(r_or.value().values[0][0].size(), 1U);
-  EXPECT_DOUBLE_EQ(r_or.value().values[0][0][0].as_number(), 100.0);
-}
-
-TEST(PivotEvaluator, APeriodFilterOnAnOutOfRangeFieldIsInert) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredPeriodFilter f;
-  f.field_index = 99;
-  f.period = RelativePeriod::Today;
-  table.mutable_authored_period_filters().push_back(f);
-
-  PivotFilterEnv env;
-  env.pinned_now = date_time::CivilTime{{1900, 2U, 15U}, {0U, 0U, 0U}};
-  auto r_or = evaluate(table, cache, PivotLayoutOptions{}, env);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  EXPECT_EQ(r_or.value().rows.size(), 2U);
-}
-
-// An unbounded range is a no-op rather than a half-open filter, matching
-// how `PivotFilter` treats a missing upper bound.
-TEST(PivotEvaluator, AuthoredDateFilterWithNoUpperBoundIsInert) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  AuthoredValueFilter f;
-  f.field_index = 2;
-  f.type = FilterType::LabelDate;
-  f.value = 1000.0;
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  EXPECT_EQ(r_or.value().rows.size(), 2U);
-}
-
-TEST(PivotEvaluator, ValueTop10FilterKeepsTopRows) {
-  // Use a richer cache so ranking is meaningful.
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* region, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("A", 10.0);
-  add("B", 50.0);
-  add("C", 30.0);
-  add("D", 20.0);
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField rf;
-  rf.source_name = "Region";
-  rf.axis = PivotAxis::Row;
-  PivotField af;
-  af.source_name = "Amount";
-  af.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(rf));
-  table.mutable_fields().push_back(std::move(af));
-  table.mutable_row_field_order() = {0};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 1;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::ValueTop10;
-  f.value = 2;  // Top 2.
-  table.mutable_active_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Top 2 by amount: B (50), C (30).
-  ASSERT_EQ(r.rows.size(), 2U);
-  // Rows are still in alphabetical order after pruning (we kept only the
-  // surviving leaves' positions); order: B, C.
-  std::vector<std::string> labels;
-  std::vector<double> totals;
-  for (std::size_t i = 0; i < r.rows.size(); ++i) {
-    labels.push_back(r.rows[i].label);
-    totals.push_back(r.values[i][0][0].as_number());
-  }
-  // Sort to make assertions order-independent.
-  std::sort(labels.begin(), labels.end());
-  std::sort(totals.begin(), totals.end());
-  EXPECT_EQ(labels[0], "B");
-  EXPECT_EQ(labels[1], "C");
-  EXPECT_DOUBLE_EQ(totals[0], 30.0);
-  EXPECT_DOUBLE_EQ(totals[1], 50.0);
-}
-
-TEST(PivotEvaluator, ValueGreaterThanFilterKeepsAboveThreshold) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::ValueGreaterThan;
-  f.value = 200.0;  // Threshold; North (175) drops, South (500) survives.
-  table.mutable_active_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 500.0);
-}
-
-TEST(PivotEvaluator, ValueTop10FilterOnColAxis) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Col;
-  f.field_name = "Product";
-  f.type = FilterType::ValueTop10;
-  f.value = 1;  // Keep 1 column with the highest column total.
-  table.mutable_active_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Widget total = 100 + 200 + 25 = 325; Gadget total = 50 + 300 = 350.
-  // Top-1 by col total -> Gadget survives.
-  ASSERT_EQ(r.cols.size(), 1U);
-  EXPECT_EQ(r.cols[0].label, "Gadget");
-  // Each row keeps a single col slot.
-  ASSERT_EQ(r.values.size(), 2U);
-  for (const auto& row_slot : r.values) {
-    ASSERT_EQ(row_slot.size(), 1U);
-  }
-}
-
-TEST(PivotEvaluator, ValueFilterSelectsDataFieldAndInvalidSelectorIsNoOp) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"MeasureA", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"MeasureB", {}});
-  auto add = [&](const char* region, double a, double b) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(Value::number(a));
-    rec.cells.push_back(Value::number(b));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("A", 100.0, 1.0);
-  add("B", 50.0, 100.0);
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField region_field;
-  region_field.source_name = "Region";
-  region_field.axis = PivotAxis::Row;
-  PivotField measure_a_field;
-  measure_a_field.source_name = "MeasureA";
-  measure_a_field.axis = PivotAxis::Value;
-  PivotField measure_b_field;
-  measure_b_field.source_name = "MeasureB";
-  measure_b_field.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(region_field));
-  table.mutable_fields().push_back(std::move(measure_a_field));
-  table.mutable_fields().push_back(std::move(measure_b_field));
-  table.mutable_row_field_order() = {0};
-  PivotDataField measure_a;
-  measure_a.name = "A";
-  measure_a.field_index = 1;
-  measure_a.aggregation = Aggregation::Sum;
-  PivotDataField measure_b;
-  measure_b.name = "B";
-  measure_b.field_index = 2;
-  measure_b.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(measure_a));
-  table.mutable_data_fields().push_back(std::move(measure_b));
-
-  PivotFilter selected;
-  selected.axis = PivotAxis::Row;
-  selected.field_name = "Region";
-  selected.type = FilterType::ValueTop10;
-  selected.value = 1;
-  selected.data_field_index = 1;
-  table.mutable_active_filters().push_back(selected);
-
-  auto selected_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(selected_or)) << selected_or.error().message;
-  ASSERT_EQ(selected_or.value().rows.size(), 1U);
-  EXPECT_EQ(selected_or.value().rows[0].label, "B");
-
-  // A direct C++ model can still contain a stale selector; evaluation must
-  // leave the report untouched rather than dropping every leaf.
-  table.mutable_active_filters()[0].data_field_index = 2;
-  auto invalid_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(invalid_or)) << invalid_or.error().message;
-  ASSERT_EQ(invalid_or.value().rows.size(), 2U);
-  EXPECT_EQ(invalid_or.value().rows[0].label, "A");
-  EXPECT_EQ(invalid_or.value().rows[1].label, "B");
-}
-
-// ---------------------------------------------------------------------------
-// 9. Manual filter (PivotItem::visible == false) hides records
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, ManualFilterHidesItem) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Hide all records with Region == "South" via the Region field's items.
-  table.mutable_fields()[0].items = {
-      PivotItem{"North", /*visible=*/true},
-      PivotItem{"South", /*visible=*/false},
-  };
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Only North survives.
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "North");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 175.0);
-}
-
-// A source cell with no value is an axis item like any other, so the manual
-// filter has to be able to hide it. It is the one item that cannot be named:
-// its label is the locale's placeholder, which a genuine text value is free to
-// spell identically, so the filter identifies it by the cache value the item
-// binds to instead.
-TEST(PivotEvaluator, ManualFilterHidesTheBlankItem) {
-  PivotCache cache = build_shared_region_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  PivotItem hidden_blank;
-  hidden_blank.visible = false;
-  hidden_blank.has_cache_index = true;
-  hidden_blank.cache_index = kSharedRegionBlank;
-  table.mutable_fields()[0].items.push_back(hidden_blank);
-  // The load path leaves the item unnamed, because the value it binds to
-  // renders to nothing. Running it here pins that the filter works on the
-  // shape a workbook actually arrives in.
-  resolve_pivot_names(table, cache);
-  ASSERT_TRUE(table.fields()[0].items[0].name.empty());
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  const PivotLayoutOptions defaults;
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_DOUBLE_EQ(r.values[row_index(r, "North")][0][0].as_number(), 100.0);
-  // The text value spelled like the placeholder is untouched; only the group
-  // with no value is gone, and its 10 is out of every aggregate.
-  const std::size_t placeholder_text = row_index(r, defaults.blank_item_label);
-  ASSERT_NE(placeholder_text, static_cast<std::size_t>(-1));
-  EXPECT_DOUBLE_EQ(r.values[placeholder_text][0][0].as_number(), 7.0);
-}
-
-// The mirror direction: hiding the text item that happens to be spelled like
-// the placeholder must not take the blank group with it.
-TEST(PivotEvaluator, HidingPlaceholderSpelledTextKeepsTheBlankItem) {
-  PivotCache cache = build_shared_region_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  PivotItem hidden_text;
-  hidden_text.visible = false;
-  hidden_text.has_cache_index = true;
-  hidden_text.cache_index = kSharedRegionPlaceholderText;
-  table.mutable_fields()[0].items.push_back(hidden_text);
-  resolve_pivot_names(table, cache);
-  const PivotLayoutOptions defaults;
-  ASSERT_EQ(table.fields()[0].items[0].name, defaults.blank_item_label);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_DOUBLE_EQ(r.values[row_index(r, "North")][0][0].as_number(), 100.0);
-  const std::size_t blank_leaf = row_index(r, defaults.blank_item_label);
-  ASSERT_NE(blank_leaf, static_cast<std::size_t>(-1));
-  EXPECT_DOUBLE_EQ(r.values[blank_leaf][0][0].as_number(), 10.0);
-}
-
-// `build_basic_cache()` with Region shared the way it arrives from a file:
-// records store an index into `shared_items` {North, South}.
-PivotCache build_shared_north_south_cache() {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  PivotCacheField region;
-  region.name = "Region";
-  region.shared_items.push_back(owned_text(cache, "North"));
-  region.shared_items.push_back(owned_text(cache, "South"));
-  cache.mutable_fields().push_back(std::move(region));
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](std::uint32_t region_index, const char* product, double amount) {
-    PivotCacheRecord rec;
-    rec.cells = {Value::number(region_index), owned_text(cache, product), Value::number(amount)};
-    rec.cell_is_index = {true, false, false};
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add(0U, "Widget", 100.0);
-  add(0U, "Gadget", 50.0);
-  add(1U, "Widget", 200.0);
-  add(1U, "Gadget", 300.0);
-  add(0U, "Widget", 25.0);
-  return cache;
-}
-
-// An item built by cache index carries no name until a load resolves it; the
-// filter reads its label from the binding, so it hides the bound value
-// without `resolve_pivot_names` ever running.
-TEST(PivotEvaluator, UnnamedItemBoundByCacheIndexHidesItsValue) {
-  PivotCache cache = build_shared_north_south_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  PivotItem hidden_south;
-  hidden_south.visible = false;
-  hidden_south.has_cache_index = true;
-  hidden_south.cache_index = 1U;
-  table.mutable_fields()[0].items.push_back(hidden_south);
-  ASSERT_TRUE(table.fields()[0].items[0].name.empty());
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "North");
-  ASSERT_TRUE(r.grand_total.is_number());
-  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 175.0);
-}
-
-TEST(PivotItemLabel, NameWinsThenBindingThenEmpty) {
-  const PivotCache cache = build_shared_north_south_cache();
-  PivotItem named;
-  named.name = "Renamed";
-  named.cache_index = 1U;
-  EXPECT_EQ(pivot_item_label(cache, 0U, named), "Renamed");
-  PivotItem bound;
-  bound.has_cache_index = true;
-  bound.cache_index = 1U;
-  EXPECT_EQ(pivot_item_label(cache, 0U, bound), "South");
-  PivotItem dangling;
-  dangling.has_cache_index = true;
-  dangling.cache_index = 9U;
-  EXPECT_EQ(pivot_item_label(cache, 0U, dangling), "");
-  EXPECT_EQ(pivot_item_label(cache, 7U, bound), "");
-}
-
-TEST(PivotEvaluator, ManualFilterMatchesNumericDisplayLabel) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // The numeric Amount field is rendered as its integral display label.
-  // Hiding 300 removes only South/Gadget without allocating a label string
-  // per record while the filter is evaluated.
-  table.mutable_fields()[2].items = {PivotItem{"300", /*visible=*/false}};
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  const std::size_t north = row_index(r, "North");
-  const std::size_t south = row_index(r, "South");
-  ASSERT_NE(north, static_cast<std::size_t>(-1));
-  ASSERT_NE(south, static_cast<std::size_t>(-1));
-  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 175.0);
-  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 200.0);
-}
-
-// A hidden item is matched against the record's label, so the two sides must
-// spell a non-integral number the same way. A record-side renderer of its own
-// would spell 1.5 as "1.500000" and 1e20 as its 27-character fixed-point form,
-// neither of which any authored item can name — the records would stay in
-// every aggregate no matter what the filter says.
-TEST(PivotEvaluator, ManualFilterHidesNonIntegralNumericItem) {
-  PivotCache cache = build_non_integral_amount_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  table.mutable_fields()[2].items = {PivotItem{display_string(Value::number(1.5)), /*visible=*/false}};
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  const std::size_t north = row_index(r, "North");
-  ASSERT_NE(north, static_cast<std::size_t>(-1));
-  // North keeps only the 2.0 record; the 1.5 one is gone from the aggregate.
-  EXPECT_DOUBLE_EQ(r.values[north][0][0].as_number(), 2.0);
-}
-
-TEST(PivotEvaluator, ManualFilterHidesNumericItemBeyondIntegerRange) {
-  PivotCache cache = build_non_integral_amount_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  table.mutable_fields()[2].items = {PivotItem{display_string(Value::number(1e20)), /*visible=*/false}};
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  const std::size_t south = row_index(r, "South");
-  ASSERT_NE(south, static_cast<std::size_t>(-1));
-  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 4.0);
-}
-
-// A label filter reads the same rendering, so a needle taken from the axis
-// label of a numeric item selects the record that produced it.
-TEST(PivotEvaluator, LabelContainsFilterMatchesNumericItemLabel) {
-  PivotCache cache = build_non_integral_amount_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Amount";
-  f.type = FilterType::LabelContains;
-  f.value = display_string(Value::number(1e20));  // "1E+20"
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 1e20);
-}
-
-// Excel authors an `items[]` list for every field it places on an axis, so the
-// list's presence says nothing about whether a filter is set. A list that hides
-// nothing must leave the result exactly as it was.
-TEST(PivotEvaluator, AnItemListThatHidesNothingDoesNotChangeTheResult) {
-  PivotCache cache = build_basic_cache();
-  PivotTable unfiltered = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  unfiltered.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  auto baseline_or = evaluate(unfiltered, cache);
-  ASSERT_TRUE(static_cast<bool>(baseline_or)) << baseline_or.error().message;
-
-  PivotTable listed = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  listed.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // Far more items than the field has values, none of them hidden.
-  for (std::size_t i = 0; i < 500; ++i) {
-    listed.mutable_fields()[0].items.push_back(PivotItem{"item_" + std::to_string(i), /*visible=*/true});
-  }
-  listed.mutable_fields()[0].items.push_back(PivotItem{"North", /*visible=*/true});
-  listed.mutable_fields()[0].items.push_back(PivotItem{"South", /*visible=*/true});
-  auto listed_or = evaluate(listed, cache);
-  ASSERT_TRUE(static_cast<bool>(listed_or)) << listed_or.error().message;
-
-  const PivotResult& baseline = baseline_or.value();
-  const PivotResult& with_list = listed_or.value();
-  ASSERT_EQ(with_list.rows.size(), baseline.rows.size());
-  for (std::size_t i = 0; i < baseline.rows.size(); ++i) {
-    EXPECT_EQ(with_list.rows[i].label, baseline.rows[i].label);
-    EXPECT_DOUBLE_EQ(with_list.values[i][0][0].as_number(), baseline.values[i][0][0].as_number());
-  }
-}
-
-// One field can hide the blank and a named value at once. The two are decided
-// by different rules — the blank by the cache value its unlabelled item binds
-// to, a named item by the label the grid draws — so a field carrying both has
-// to apply both.
-TEST(PivotEvaluator, OneFieldHidesTheBlankAndANamedItemTogether) {
-  PivotCache cache = build_shared_region_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  PivotItem hidden_blank;
-  hidden_blank.visible = false;
-  hidden_blank.has_cache_index = true;
-  hidden_blank.cache_index = kSharedRegionBlank;
-  table.mutable_fields()[0].items.push_back(hidden_blank);
-  table.mutable_fields()[0].items.push_back(PivotItem{"North", /*visible=*/false});
-  resolve_pivot_names(table, cache);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Only the text value spelled like the placeholder survives.
-  const PivotLayoutOptions defaults;
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, defaults.blank_item_label);
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 7.0);
-}
-
-// The blank rule keys off the binding, not off the missing label: an unlabelled
-// hidden item bound to a value that is not blank hides that value, labelled
-// from its binding, and leaves the blank group alone.
-TEST(PivotEvaluator, AnUnlabelledHiddenItemBoundToAValueHidesThatValue) {
-  PivotCache cache = build_shared_region_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  PivotItem unlabelled;
-  unlabelled.visible = false;
-  unlabelled.has_cache_index = true;
-  unlabelled.cache_index = 0U;  // "North", a value that renders to a label.
-  table.mutable_fields()[0].items.push_back(std::move(unlabelled));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // North is gone; the blank group and the text value spelled like the
-  // placeholder both survive. They draw the same label, so they are counted
-  // through the total rather than looked up by it.
-  ASSERT_EQ(r.rows.size(), 2U);
-  EXPECT_EQ(row_index(r, "North"), static_cast<std::size_t>(-1));
-  double total = 0.0;
-  for (std::size_t i = 0; i < r.rows.size(); ++i) {
-    total += r.values[i][0][0].as_number();
-  }
-  EXPECT_DOUBLE_EQ(total, 10.0 + 7.0);
-}
-
-// A hidden numeric item is matched by the label the grid draws for it, and that
-// stays true when the field's item list is long: the record's value is rendered
-// against the set of hidden labels, not against each item in turn.
-TEST(PivotEvaluator, ManualFilterMatchesANumericLabelAmongManyItems) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  // 2,000 visible numeric items the cache has no record for, plus the one that
-  // matches. Only the last one may prune anything.
-  for (std::size_t i = 1000; i < 3000; ++i) {
-    table.mutable_fields()[2].items.push_back(PivotItem{std::to_string(i), /*visible=*/true});
-  }
-  table.mutable_fields()[2].items.push_back(PivotItem{"300", /*visible=*/false});
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  const std::size_t south = row_index(r, "South");
-  ASSERT_NE(south, static_cast<std::size_t>(-1));
-  // South loses its 300 record and keeps the 200 one.
-  EXPECT_DOUBLE_EQ(r.values[south][0][0].as_number(), 200.0);
-}
-
-// What a field hides is a property of the table, so deciding one record costs
-// one lookup per field that hides something — never one comparison per item.
-//
-// Pinned by comparing two evaluations that differ only in how long the item
-// list is. Both do the same hierarchy and aggregation work, so the difference
-// between them is the filter pass alone, and reading it as a ratio keeps the
-// assertion independent of how fast the host is. Matching each record against
-// each item would render every record's label once per item, which is three
-// orders of magnitude more work on the long list; building the hidden-label set
-// once is paid per table, so the two runs stay within a small factor.
-TEST(PivotEvaluator, ManualFilterCostDoesNotFollowTheItemListLength) {
-  constexpr std::size_t kRecords = 10000;
-
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Serial", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  for (std::size_t i = 0; i < kRecords; ++i) {
-    PivotCacheRecord rec;
-    // Non-integral so the label goes through the general numeric rendering.
-    rec.cells = {Value::number(static_cast<double>(i) + 0.25), Value::number(1.0)};
-    cache.mutable_records().push_back(std::move(rec));
-  }
-
-  // Every item is hidden and none of them names a value any record carries, so
-  // the item list prunes nothing however long it is.
-  const auto build = [](std::size_t item_count) {
-    PivotTable table;
-    table.set_pivot_cache_id(1);
-    PivotField serial_field;
-    serial_field.source_name = "Serial";
-    serial_field.axis = PivotAxis::Row;
-    for (std::size_t i = 0; i < item_count; ++i) {
-      serial_field.items.push_back(
-          PivotItem{display_string(Value::number(-static_cast<double>(i) - 0.5)), /*visible=*/false});
-    }
-    table.mutable_fields().push_back(std::move(serial_field));
-    PivotField amount_field;
-    amount_field.source_name = "Amount";
-    amount_field.axis = PivotAxis::Value;
-    table.mutable_fields().push_back(std::move(amount_field));
-    PivotDataField count;
-    count.name = "Count of Amount";
-    count.field_index = 1;
-    count.aggregation = Aggregation::Count;
-    table.mutable_data_fields().push_back(std::move(count));
-    table.mutable_row_field_order() = {0};
-    table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-    return table;
-  };
-  const PivotTable short_list = build(20);
-  const PivotTable long_list = build(20000);
-
-  const auto timed = [&](const PivotTable& table) {
-    const auto started = std::chrono::steady_clock::now();
-    auto r_or = evaluate(table, cache);
-    const double seconds = std::chrono::duration<double>(std::chrono::steady_clock::now() - started).count();
-    EXPECT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-    EXPECT_EQ(r_or.value().rows.size(), kRecords);
-    return seconds;
-  };
-  const double short_seconds = timed(short_list);
-  const double long_seconds = timed(long_list);
-
-  // The allowance is deliberately loose — a factor of ten plus half a second —
-  // because it is separating a constant from a thousandfold, not measuring the
-  // machine.
-  EXPECT_LT(long_seconds, short_seconds * 10.0 + 0.5)
-      << "short list " << short_seconds << "s, long list " << long_seconds << "s";
-}
-
-// ---------------------------------------------------------------------------
-// LabelDate filter (date-range, pre-aggregation)
-// ---------------------------------------------------------------------------
-
-// Helper: builds a 2-column cache (Date as numeric serial, Amount). The
-// records are picked so that a closed [2024-01-01, 2024-12-31] window
-// keeps the first three and drops the fourth.
-PivotCache build_label_date_filter_cache() {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Date", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](double serial, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(Value::number(serial));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add(formulon::date_time::serial_from_ymd(2024, 1, 1), 10.0);
-  add(formulon::date_time::serial_from_ymd(2024, 6, 15), 20.0);
-  add(formulon::date_time::serial_from_ymd(2024, 12, 31), 30.0);
-  add(formulon::date_time::serial_from_ymd(2025, 3, 1), 40.0);
-  return cache;
-}
-
-// Helper: builds a single-row-axis pivot over `Date` with SUM(Amount).
-// The Date field becomes the row axis so each surviving record forms its
-// own row leaf, simplifying assertions.
-PivotTable build_label_date_filter_table() {
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField date_f;
-  date_f.source_name = "Date";
-  date_f.axis = PivotAxis::Row;
-  PivotField amount_f;
-  amount_f.source_name = "Amount";
-  amount_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(date_f));
-  table.mutable_fields().push_back(std::move(amount_f));
-  table.mutable_row_field_order() = {0};
-
-  PivotDataField sum_amount;
-  sum_amount.name = "Sum of Amount";
-  sum_amount.field_index = 1;
-  sum_amount.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum_amount));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  return table;
-}
-
-TEST(PivotEvaluator, LabelDateFilterIncludesInRange) {
-  PivotCache cache = build_label_date_filter_cache();
-  PivotTable table = build_label_date_filter_table();
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Date";
-  f.type = FilterType::LabelDate;
-  f.value = formulon::date_time::serial_from_ymd(2024, 1, 1);
-  f.value_high = formulon::date_time::serial_from_ymd(2024, 12, 31);
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Three of the four records fall inside [2024-01-01, 2024-12-31].
-  ASSERT_EQ(r.rows.size(), 3U);
-  std::vector<double> totals;
-  totals.reserve(r.values.size());
-  for (const auto& row_slot : r.values) {
-    ASSERT_EQ(row_slot.size(), 1U);
-    ASSERT_EQ(row_slot[0].size(), 1U);
-    totals.push_back(row_slot[0][0].as_number());
-  }
-  std::sort(totals.begin(), totals.end());
-  EXPECT_DOUBLE_EQ(totals[0], 10.0);
-  EXPECT_DOUBLE_EQ(totals[1], 20.0);
-  EXPECT_DOUBLE_EQ(totals[2], 30.0);
-}
-
-TEST(PivotEvaluator, LabelDateFilterUnboundedHighIsNoOp) {
-  PivotCache cache = build_label_date_filter_cache();
-  PivotTable table = build_label_date_filter_table();
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Date";
-  f.type = FilterType::LabelDate;
-  f.value = formulon::date_time::serial_from_ymd(2024, 1, 1);
-  // value_high left as default monostate -> filter degrades to no-op.
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // No upper bound -> all four records survive.
-  ASSERT_EQ(r.rows.size(), 4U);
-}
-
-// ---------------------------------------------------------------------------
-// ValueBetween filter (post-aggregation, parallel to Top-N / GreaterThan)
-// ---------------------------------------------------------------------------
-
-// Helper: builds a 2-column cache where each row label has a distinct
-// numeric amount. With one record per row the post-aggregation row score
-// equals the record's Amount.
-PivotCache build_amount_cache_for_between() {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* region, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("A", 10.0);
-  add("B", 25.0);
-  add("C", 40.0);
-  add("D", 75.0);
-  return cache;
-}
-
-TEST(PivotEvaluator, ValueBetweenFilterRowAxis) {
-  PivotCache cache = build_amount_cache_for_between();
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField rf;
-  rf.source_name = "Region";
-  rf.axis = PivotAxis::Row;
-  PivotField af;
-  af.source_name = "Amount";
-  af.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(rf));
-  table.mutable_fields().push_back(std::move(af));
-  table.mutable_row_field_order() = {0};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 1;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::ValueBetween;
-  f.value = 20.0;       // inclusive low bound
-  f.value_high = 50.0;  // inclusive high bound
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // 25 and 40 land in [20, 50]; 10 and 75 fall outside.
-  ASSERT_EQ(r.rows.size(), 2U);
-  std::vector<std::string> labels;
-  std::vector<double> totals;
-  for (std::size_t i = 0; i < r.rows.size(); ++i) {
-    labels.push_back(r.rows[i].label);
-    totals.push_back(r.values[i][0][0].as_number());
-  }
-  std::sort(labels.begin(), labels.end());
-  std::sort(totals.begin(), totals.end());
-  EXPECT_EQ(labels[0], "B");
-  EXPECT_EQ(labels[1], "C");
-  EXPECT_DOUBLE_EQ(totals[0], 25.0);
-  EXPECT_DOUBLE_EQ(totals[1], 40.0);
-}
-
-TEST(PivotEvaluator, ValueBetweenFilterColAxis) {
-  // Mirror of the row-axis test along the column axis: each Region
-  // becomes a column with its single Amount as the column total.
-  PivotCache cache = build_amount_cache_for_between();
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField rf;
-  rf.source_name = "Region";
-  rf.axis = PivotAxis::Col;
-  PivotField af;
-  af.source_name = "Amount";
-  af.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(rf));
-  table.mutable_fields().push_back(std::move(af));
-  table.mutable_col_field_order() = {0};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 1;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Col;
-  f.field_name = "Region";
-  f.type = FilterType::ValueBetween;
-  f.value = 20.0;
-  f.value_high = 50.0;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  ASSERT_EQ(r.cols.size(), 2U);
-  std::vector<std::string> labels{r.cols[0].label, r.cols[1].label};
-  std::sort(labels.begin(), labels.end());
-  EXPECT_EQ(labels[0], "B");
-  EXPECT_EQ(labels[1], "C");
-  // The single implicit row should retain exactly the two surviving cols.
-  ASSERT_EQ(r.values.size(), 1U);
-  ASSERT_EQ(r.values[0].size(), 2U);
-}
-
-TEST(PivotEvaluator, ValueBetweenFilterUnboundedHighIsNoOp) {
-  PivotCache cache = build_amount_cache_for_between();
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField rf;
-  rf.source_name = "Region";
-  rf.axis = PivotAxis::Row;
-  PivotField af;
-  af.source_name = "Amount";
-  af.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(rf));
-  table.mutable_fields().push_back(std::move(af));
-  table.mutable_row_field_order() = {0};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 1;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::ValueBetween;
-  f.value = 20.0;
-  // value_high left as default monostate -> filter degrades to no-op.
-  f.value_high = std::monostate{};
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // No upper bound -> all four rows survive.
-  ASSERT_EQ(r.rows.size(), 4U);
-}
-
-// ---------------------------------------------------------------------------
-// Multi-level value filters (Top-N / GreaterThan / Between) over hierarchies
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, ValueTop10MultiLevelRowAxis) {
-  // Two row fields: Region (North/South) -> Product (A/B/C). Each
-  // (region, product) leaf has a single record so the post-aggregation
-  // leaf score equals its Amount.
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* region, const char* product, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(owned_text(cache, product));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("North", "A", 10.0);
-  add("North", "B", 50.0);
-  add("North", "C", 20.0);
-  add("South", "A", 80.0);
-  add("South", "B", 30.0);
-  add("South", "C", 5.0);
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField region_f;
-  region_f.source_name = "Region";
-  region_f.axis = PivotAxis::Row;
-  PivotField product_f;
-  product_f.source_name = "Product";
-  product_f.axis = PivotAxis::Row;
-  PivotField amount_f;
-  amount_f.source_name = "Amount";
-  amount_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(region_f));
-  table.mutable_fields().push_back(std::move(product_f));
-  table.mutable_fields().push_back(std::move(amount_f));
-  table.mutable_row_field_order() = {0, 1};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 2;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Product";
-  f.type = FilterType::ValueTop10;
-  f.value = 2;  // Top 2 products under each region.
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Ranked within each region, not across the flattened axis: North keeps
-  // B=50 and C=20 even though South/B=30 outranks North/C globally, and
-  // South keeps A=80 and B=30.
-  ASSERT_EQ(r.rows.size(), 2U);
-  ASSERT_EQ(r.rows[0].label, "North");
-  ASSERT_EQ(r.rows[0].children.size(), 2U);
-  EXPECT_EQ(r.rows[0].children[0].label, "B");
-  EXPECT_EQ(r.rows[0].children[1].label, "C");
-  ASSERT_EQ(r.rows[1].label, "South");
-  ASSERT_EQ(r.rows[1].children.size(), 2U);
-  EXPECT_EQ(r.rows[1].children[0].label, "A");
-  EXPECT_EQ(r.rows[1].children[1].label, "B");
-
-  ASSERT_EQ(r.values.size(), 4U);
-  const std::vector<double> expected = {50.0, 20.0, 80.0, 30.0};
-  for (std::size_t leaf = 0; leaf < expected.size(); ++leaf) {
-    ASSERT_EQ(r.values[leaf].size(), 1U);
-    EXPECT_DOUBLE_EQ(r.values[leaf][0][0].as_number(), expected[leaf]) << "leaf=" << leaf;
-  }
-}
-
-// Region -> Product -> Amount, one record per `(region, product, amount)`,
-// for the value-filter depth tests below.
-struct RegionProductAmount {
-  const char* region;
-  const char* product;
-  double amount;
-};
-
-PivotCache build_region_product_cache(const std::vector<RegionProductAmount>& records) {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  for (const RegionProductAmount& record : records) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, record.region));
-    rec.cells.push_back(owned_text(cache, record.product));
-    rec.cells.push_back(Value::number(record.amount));
-    cache.mutable_records().push_back(std::move(rec));
-  }
-  return cache;
-}
-
-PivotTable build_region_product_table(Aggregation aggregation) {
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  const char* names[] = {"Region", "Product", "Amount"};
-  for (std::size_t i = 0; i < 3; ++i) {
-    PivotField field;
-    field.source_name = names[i];
-    field.axis = i == 2 ? PivotAxis::Value : PivotAxis::Row;
-    table.mutable_fields().push_back(std::move(field));
-  }
-  table.mutable_row_field_order() = {0, 1};
-  PivotDataField data;
-  data.name = "Amount";
-  data.field_index = 2;
-  data.aggregation = aggregation;
-  table.mutable_data_fields().push_back(std::move(data));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-  return table;
-}
-
-// A filter on the outer field ranks whole regions by their own total and
-// keeps every product under a surviving region.
-TEST(PivotEvaluator, ValueTop10OnOuterFieldKeepsWholeGroups) {
-  PivotCache cache = build_region_product_cache({{"North", "A", 10.0},
-                                                 {"North", "B", 50.0},
-                                                 {"North", "C", 20.0},
-                                                 {"South", "A", 80.0},
-                                                 {"South", "B", 30.0},
-                                                 {"South", "C", 5.0}});
-  PivotTable table = build_region_product_table(Aggregation::Sum);
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::ValueTop10;
-  f.value = 1;  // North=80, South=115.
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  EXPECT_EQ(r.rows[0].children.size(), 3U);
-  EXPECT_EQ(r.values.size(), 3U);
-}
-
-// The per-parent partition is structural: turning the outer field's
-// subtotals off must not merge its groups back into one global ranking.
-TEST(PivotEvaluator, ValueTop10OnInnerFieldRanksPerParentWithoutSubtotals) {
-  PivotCache cache = build_region_product_cache(
-      {{"North", "A", 10.0}, {"North", "B", 50.0}, {"South", "A", 80.0}, {"South", "B", 30.0}});
-  PivotTable table = build_region_product_table(Aggregation::Sum);
-  table.mutable_fields()[0].default_subtotal = false;
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Product";
-  f.type = FilterType::ValueTop10;
-  f.value = 1;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  EXPECT_TRUE(r.row_subtotals.empty());
-  ASSERT_EQ(r.rows.size(), 2U);
-  ASSERT_EQ(r.rows[0].children.size(), 1U);
-  EXPECT_EQ(r.rows[0].children[0].label, "B");  // North's best, below South/B.
-  ASSERT_EQ(r.rows[1].children.size(), 1U);
-  EXPECT_EQ(r.rows[1].children[0].label, "A");
-}
-
-// An authored `<filters>` entry names its field by index; the pass ranks at
-// that field's depth the same way it does for a named filter.
-TEST(PivotEvaluator, AuthoredTopCountOnInnerFieldRanksPerParent) {
-  PivotCache cache = build_region_product_cache(
-      {{"North", "A", 10.0}, {"North", "B", 50.0}, {"South", "A", 80.0}, {"South", "B", 30.0}});
-  PivotTable table = build_region_product_table(Aggregation::Sum);
-  AuthoredValueFilter f;
-  f.field_index = 1;
-  f.type = FilterType::ValueTop10;
-  f.value = 1.0;
-  table.mutable_authored_value_filters().push_back(f);
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 2U);
-  ASSERT_EQ(r.rows[0].children.size(), 1U);
-  EXPECT_EQ(r.rows[0].children[0].label, "B");
-  ASSERT_EQ(r.rows[1].children.size(), 1U);
-  EXPECT_EQ(r.rows[1].children[0].label, "A");
-}
-
-// A group is scored by its own aggregate, not by summing its leaves: under
-// Average, South (50) outranks North (40) although North's leaves sum higher.
-TEST(PivotEvaluator, ValueTop10OnOuterFieldScoresNonAdditiveAggregate) {
-  PivotCache cache = build_region_product_cache(
-      {{"North", "A", 40.0}, {"North", "B", 40.0}, {"North", "C", 40.0}, {"South", "A", 50.0}});
-  PivotTable table = build_region_product_table(Aggregation::Average);
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Region";
-  f.type = FilterType::ValueTop10;
-  f.value = 1;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-}
-
-TEST(PivotEvaluator, ValueGreaterThanMultiLevelColAxis) {
-  // Two column fields: Year (2024/2025) -> Quarter (Q1/Q2). Single
-  // implicit row, so each col leaf's score is just its Amount.
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Year", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* year, const char* quarter, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, year));
-    rec.cells.push_back(owned_text(cache, quarter));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  // Leaf order in DFS pre-order: 2024/Q1=15, 2024/Q2=40, 2025/Q1=5, 2025/Q2=100.
-  add("2024", "Q1", 15.0);
-  add("2024", "Q2", 40.0);
-  add("2025", "Q1", 5.0);
-  add("2025", "Q2", 100.0);
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField year_f;
-  year_f.source_name = "Year";
-  year_f.axis = PivotAxis::Col;
-  PivotField quarter_f;
-  quarter_f.source_name = "Quarter";
-  quarter_f.axis = PivotAxis::Col;
-  PivotField amount_f;
-  amount_f.source_name = "Amount";
-  amount_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(year_f));
-  table.mutable_fields().push_back(std::move(quarter_f));
-  table.mutable_fields().push_back(std::move(amount_f));
-  table.mutable_col_field_order() = {0, 1};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 2;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Col;
-  f.field_name = "Quarter";
-  f.type = FilterType::ValueGreaterThan;
-  f.value = 20.0;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Surviving col leaves at indices 1 (2024/Q2=40) and 3 (2025/Q2=100).
-  // Each Year keeps only Q2; both Year subtrees survive.
-  ASSERT_EQ(r.cols.size(), 2U);
-  EXPECT_EQ(r.cols[0].label, "2024");
-  EXPECT_EQ(r.cols[1].label, "2025");
-  ASSERT_EQ(r.cols[0].children.size(), 1U);
-  ASSERT_EQ(r.cols[1].children.size(), 1U);
-  EXPECT_EQ(r.cols[0].children[0].label, "Q2");
-  EXPECT_EQ(r.cols[1].children[0].label, "Q2");
-
-  ASSERT_EQ(r.values.size(), 1U);
-  ASSERT_EQ(r.values[0].size(), 2U);
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 40.0);
-  EXPECT_DOUBLE_EQ(r.values[0][1][0].as_number(), 100.0);
-}
-
-TEST(PivotEvaluator, ValueBetweenMultiLevelDropsEmptyParent) {
-  // Two row fields: Region (North/South) -> Product (A/B). All North
-  // leaves fall outside [10, 70], so North gets pruned entirely.
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* region, const char* product, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(owned_text(cache, product));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("North", "A", 5.0);
-  add("North", "B", 8.0);
-  add("South", "A", 50.0);
-  add("South", "B", 60.0);
-
-  PivotTable table;
-  table.set_pivot_cache_id(1);
-  PivotField region_f;
-  region_f.source_name = "Region";
-  region_f.axis = PivotAxis::Row;
-  PivotField product_f;
-  product_f.source_name = "Product";
-  product_f.axis = PivotAxis::Row;
-  PivotField amount_f;
-  amount_f.source_name = "Amount";
-  amount_f.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(region_f));
-  table.mutable_fields().push_back(std::move(product_f));
-  table.mutable_fields().push_back(std::move(amount_f));
-  table.mutable_row_field_order() = {0, 1};
-  PivotDataField sum;
-  sum.name = "Sum of Amount";
-  sum.field_index = 2;
-  sum.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum));
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Product";
-  f.type = FilterType::ValueBetween;
-  f.value = 10.0;
-  f.value_high = 70.0;
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // North has no surviving children -> pruned entirely. Only South
-  // remains, with both A and B.
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "South");
-  ASSERT_EQ(r.rows[0].children.size(), 2U);
-  EXPECT_EQ(r.rows[0].children[0].label, "A");
-  EXPECT_EQ(r.rows[0].children[1].label, "B");
-
-  ASSERT_EQ(r.values.size(), 2U);
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 50.0);
-  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 60.0);
-}
-
-// ---------------------------------------------------------------------------
-// Label filters resolve a field by its display name
-// ---------------------------------------------------------------------------
-
-TEST(PivotEvaluator, LabelFilterResolvesFieldByCustomName) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-  table.mutable_fields()[0].custom_name = "Area";
-
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Area";  // The display name, not the source name.
-  f.type = FilterType::LabelBeginsWith;
-  f.value = std::string("N");
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Only the North records survive, so both the axis and the aggregate move.
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "North");
-  ASSERT_EQ(r.values.size(), 1U);
-  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 175.0);  // 100 + 50 + 25
-  ASSERT_TRUE(r.grand_total.is_number());
-  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 175.0);
-}
-
-TEST(PivotEvaluator, LabelFilterResolvesFieldByDataFieldName) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
-
-  // "Sum of Amount" is the data field's display name for the Amount field,
-  // so the filter applies to Amount's own values.
-  PivotFilter f;
-  f.axis = PivotAxis::Row;
-  f.field_name = "Sum of Amount";
-  f.type = FilterType::LabelBeginsWith;
-  f.value = std::string("1");
-  table.mutable_active_filters().push_back(std::move(f));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& r = r_or.value();
-
-  // Only the Amount=100 record starts with "1".
-  ASSERT_EQ(r.rows.size(), 1U);
-  EXPECT_EQ(r.rows[0].label, "North");
-  ASSERT_TRUE(r.grand_total.is_number());
-  EXPECT_DOUBLE_EQ(r.grand_total.as_number(), 100.0);
-}
-
-// ---------------------------------------------------------------------------
-// Page (report filter) axis selection.
-// ---------------------------------------------------------------------------
-//
-// The selection is named during evaluation rather than by the projection
-// because it comes from the bound cache, which `layout` is not handed. Only
-// the unfiltered spelling is oracle-measured (`(すべて)` under the ja-JP
-// profile); these pin the state machine that picks between the three
-// outcomes.
-
-// Region on the page axis, Product on the row axis.
-PivotTable build_page_axis_table() {
-  PivotTable table = build_sum_amount_table(/*row=*/{1}, /*col=*/{});
-  table.mutable_fields()[0].axis = PivotAxis::Page;
-  return table;
-}
-
-// Lists Region's two shared items, hiding whichever ones are named.
-void set_region_items(PivotTable& table, const std::vector<std::string>& hidden) {
-  std::vector<PivotItem>& items = table.mutable_fields()[0].items;
-  items.clear();
-  std::uint32_t index = 0;
-  for (const char* name : {"North", "South"}) {
-    PivotItem item;
-    item.name = name;
-    item.visible = std::find(hidden.begin(), hidden.end(), name) == hidden.end();
-    item.has_cache_index = true;
-    item.cache_index = index++;
-    items.push_back(std::move(item));
-  }
-}
-
-TEST(PivotPageSelection, UnfilteredFieldShowsTheAllPlaceholder) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_page_axis_table();
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  const PivotResult& result = r_or.value();
-
-  ASSERT_EQ(result.page_selections.size(), 1U);
-  EXPECT_EQ(result.page_selections[0].field_index, 0U);
-  EXPECT_EQ(result.page_selections[0].field_label, "Region");
-  EXPECT_EQ(result.page_selections[0].item_label, "(All)");
-}
-
-TEST(PivotPageSelection, AnItemListThatHidesNothingIsStillUnfiltered) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_page_axis_table();
-  set_region_items(table, /*hidden=*/{});
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
-  EXPECT_EQ(r_or.value().page_selections[0].item_label, "(All)");
-}
-
-TEST(PivotPageSelection, SoleVisibleItemNamesItself) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_page_axis_table();
-  set_region_items(table, /*hidden=*/{"South"});
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
-  EXPECT_EQ(r_or.value().page_selections[0].item_label, "North");
-
-  // The hidden item also prunes records, which is the pre-existing manual
-  // filter path rather than anything the selection label drives.
-  ASSERT_TRUE(r_or.value().grand_total.is_number());
-  EXPECT_DOUBLE_EQ(r_or.value().grand_total.as_number(), 175.0);
-}
-
-TEST(PivotPageSelection, SoleVisibleUnnamedItemIsLabelledFromItsBinding) {
-  PivotCache cache = build_shared_north_south_cache();
-  PivotTable table = build_page_axis_table();
-  for (std::uint32_t index : {0U, 1U}) {
-    PivotItem item;
-    item.visible = index == 1U;
-    item.has_cache_index = true;
-    item.cache_index = index;
-    table.mutable_fields()[0].items.push_back(item);
-  }
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
-  EXPECT_EQ(r_or.value().page_selections[0].item_label, "South");
-  ASSERT_TRUE(r_or.value().grand_total.is_number());
-  EXPECT_DOUBLE_EQ(r_or.value().grand_total.as_number(), 500.0);
-}
-
-TEST(PivotPageSelection, SeveralVisibleItemsUseTheMultiplePlaceholder) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_page_axis_table();
-  // A third item nobody selected leaves two of three showing.
-  set_region_items(table, /*hidden=*/{});
-  PivotItem east;
-  east.name = "East";
-  east.visible = false;
-  east.has_cache_index = true;
-  east.cache_index = 2;
-  table.mutable_fields()[0].items.push_back(std::move(east));
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
-  EXPECT_EQ(r_or.value().page_selections[0].item_label, "(Multiple Items)");
-}
-
-TEST(PivotPageSelection, ExplicitPageFieldItemWinsOverVisibility) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_page_axis_table();
-  set_region_items(table, /*hidden=*/{});
-  table.mutable_page_fields().push_back(PivotPageField{0, std::optional<std::uint32_t>{1}});
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
-  EXPECT_EQ(r_or.value().page_selections[0].item_label, "South");
-}
-
-TEST(PivotPageSelection, OutOfRangeItemFallsBackToVisibility) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_page_axis_table();
-  set_region_items(table, /*hidden=*/{});
-  table.mutable_page_fields().push_back(PivotPageField{0, std::optional<std::uint32_t>{9}});
-
-  auto r_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
-  EXPECT_EQ(r_or.value().page_selections[0].item_label, "(All)");
-}
-
-TEST(PivotPageSelection, LocaleVocabularyNamesTheSelection) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_page_axis_table();
-  PivotLayoutOptions options;
-  options.all_pages_label = "(すべて)";
-
-  auto r_or = evaluate(table, cache, options);
-  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
-  ASSERT_EQ(r_or.value().page_selections.size(), 1U);
-  EXPECT_EQ(r_or.value().page_selections[0].item_label, "(すべて)");
-}
-
-}  // namespace
-}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_filter_test_helpers.h b/tests/unit/pivot/pivot_filter_test_helpers.h
new file mode 100644
index 000000000..85cf88fe1
--- /dev/null
+++ b/tests/unit/pivot/pivot_filter_test_helpers.h
@@ -0,0 +1,38 @@
+#pragma once
+
+#include <cstdint>
+#include <utility>
+
+#include "pivot/pivot_cache.h"
+#include "pivot_evaluator_fixtures.h"
+#include "value.h"
+
+namespace formulon::pivot::filter_test {
+
+// Shared-item Region cache used by label and page-selection tests. Records
+// carry shared-item indices, matching the representation loaded from OOXML.
+inline PivotCache build_shared_north_south_cache() {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  PivotCacheField region;
+  region.name = "Region";
+  region.shared_items.push_back(test::owned_text(cache, "North"));
+  region.shared_items.push_back(test::owned_text(cache, "South"));
+  cache.mutable_fields().push_back(std::move(region));
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](std::uint32_t region_index, const char* product, double amount) {
+    PivotCacheRecord rec;
+    rec.cells = {Value::number(region_index), test::owned_text(cache, product), Value::number(amount)};
+    rec.cell_is_index = {true, false, false};
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add(0U, "Widget", 100.0);
+  add(0U, "Gadget", 50.0);
+  add(1U, "Widget", 200.0);
+  add(1U, "Gadget", 300.0);
+  add(0U, "Widget", 25.0);
+  return cache;
+}
+
+}  // namespace formulon::pivot::filter_test
diff --git a/tests/unit/pivot/pivot_filter_value_test.cpp b/tests/unit/pivot/pivot_filter_value_test.cpp
new file mode 100644
index 000000000..be567607d
--- /dev/null
+++ b/tests/unit/pivot/pivot_filter_value_test.cpp
@@ -0,0 +1,820 @@
+// Aggregate value filters, including axis recovery and multi-level pruning.
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_evaluator_fixtures.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using test::build_basic_cache;
+using test::build_sum_amount_table;
+using test::owned_text;
+using test::row_index;
+
+// Helper: builds a 2-column cache where each row label has a distinct
+// numeric amount. With one record per row the post-aggregation row score
+// equals the record's Amount.
+PivotCache build_amount_cache_for_between() {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* region, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("A", 10.0);
+  add("B", 25.0);
+  add("C", 40.0);
+  add("D", 75.0);
+  return cache;
+}
+
+struct RegionProductAmount {
+  const char* region;
+  const char* product;
+  double amount;
+};
+
+PivotCache build_region_product_cache(const std::vector<RegionProductAmount>& records) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  for (const RegionProductAmount& record : records) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, record.region));
+    rec.cells.push_back(owned_text(cache, record.product));
+    rec.cells.push_back(Value::number(record.amount));
+    cache.mutable_records().push_back(std::move(rec));
+  }
+  return cache;
+}
+
+PivotTable build_region_product_table(Aggregation aggregation) {
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  const char* names[] = {"Region", "Product", "Amount"};
+  for (std::size_t i = 0; i < 3; ++i) {
+    PivotField field;
+    field.source_name = names[i];
+    field.axis = i == 2 ? PivotAxis::Value : PivotAxis::Row;
+    table.mutable_fields().push_back(std::move(field));
+  }
+  table.mutable_row_field_order() = {0, 1};
+  PivotDataField data;
+  data.name = "Amount";
+  data.field_index = 2;
+  data.aggregation = aggregation;
+  table.mutable_data_fields().push_back(std::move(data));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  return table;
+}
+
+// A filter on the outer field ranks whole regions by their own total and
+
+TEST(PivotEvaluator, AuthoredTopCountKeepsTheHighestScoringLeaf) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredValueFilter f;
+  f.field_index = 0;
+  f.type = FilterType::ValueTop10;
+  f.value = 1.0;
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "South");
+}
+
+TEST(PivotEvaluator, AuthoredTopCountWithTopFalseKeepsTheLowestScoringLeaf) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredValueFilter f;
+  f.field_index = 0;
+  f.type = FilterType::ValueTop10;
+  f.value = 1.0;
+  f.top = false;
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "North");
+}
+
+TEST(PivotEvaluator, AuthoredGreaterThanIsStrictOnTheThreshold) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredValueFilter f;
+  f.field_index = 0;
+  f.type = FilterType::ValueGreaterThan;
+  f.value = 175.0;  // exactly North's total
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().rows.size(), 1U);
+  EXPECT_EQ(r_or.value().rows[0].label, "South");
+}
+
+TEST(PivotEvaluator, AuthoredBetweenIncludesBothBounds) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredValueFilter f;
+  f.field_index = 0;
+  f.type = FilterType::ValueBetween;
+  f.value = 175.0;
+  f.value_high = 500.0;
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  EXPECT_EQ(r_or.value().rows.size(), 2U);
+}
+
+TEST(PivotEvaluator, AuthoredValueFilterOnAnOffAxisFieldIsInert) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredValueFilter f;
+  f.field_index = 2;  // Amount: a data field, on no axis
+  f.type = FilterType::ValueTop10;
+  f.value = 1.0;
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  EXPECT_EQ(r_or.value().rows.size(), 2U);
+}
+
+TEST(PivotEvaluator, AuthoredValueFilterPrunesTheColumnAxisToo) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{}, /*col=*/{0});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+  AuthoredValueFilter f;
+  f.field_index = 0;
+  f.type = FilterType::ValueTop10;
+  f.value = 1.0;
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  ASSERT_EQ(r_or.value().cols.size(), 1U);
+  EXPECT_EQ(r_or.value().cols[0].label, "South");
+}
+
+TEST(PivotEvaluator, ValueTop10FilterKeepsTopRows) {
+  // Use a richer cache so ranking is meaningful.
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* region, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("A", 10.0);
+  add("B", 50.0);
+  add("C", 30.0);
+  add("D", 20.0);
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField rf;
+  rf.source_name = "Region";
+  rf.axis = PivotAxis::Row;
+  PivotField af;
+  af.source_name = "Amount";
+  af.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(rf));
+  table.mutable_fields().push_back(std::move(af));
+  table.mutable_row_field_order() = {0};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 1;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::ValueTop10;
+  f.value = 2;  // Top 2.
+  table.mutable_active_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Top 2 by amount: B (50), C (30).
+  ASSERT_EQ(r.rows.size(), 2U);
+  // Rows are still in alphabetical order after pruning (we kept only the
+  // surviving leaves' positions); order: B, C.
+  std::vector<std::string> labels;
+  std::vector<double> totals;
+  for (std::size_t i = 0; i < r.rows.size(); ++i) {
+    labels.push_back(r.rows[i].label);
+    totals.push_back(r.values[i][0][0].as_number());
+  }
+  // Sort to make assertions order-independent.
+  std::sort(labels.begin(), labels.end());
+  std::sort(totals.begin(), totals.end());
+  EXPECT_EQ(labels[0], "B");
+  EXPECT_EQ(labels[1], "C");
+  EXPECT_DOUBLE_EQ(totals[0], 30.0);
+  EXPECT_DOUBLE_EQ(totals[1], 50.0);
+}
+
+TEST(PivotEvaluator, ValueGreaterThanFilterKeepsAboveThreshold) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::ValueGreaterThan;
+  f.value = 200.0;  // Threshold; North (175) drops, South (500) survives.
+  table.mutable_active_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 500.0);
+}
+
+TEST(PivotEvaluator, ValueTop10FilterOnColAxis) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_sum_amount_table(/*row=*/{0}, /*col=*/{1});
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Col;
+  f.field_name = "Product";
+  f.type = FilterType::ValueTop10;
+  f.value = 1;  // Keep 1 column with the highest column total.
+  table.mutable_active_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Widget total = 100 + 200 + 25 = 325; Gadget total = 50 + 300 = 350.
+  // Top-1 by col total -> Gadget survives.
+  ASSERT_EQ(r.cols.size(), 1U);
+  EXPECT_EQ(r.cols[0].label, "Gadget");
+  // Each row keeps a single col slot.
+  ASSERT_EQ(r.values.size(), 2U);
+  for (const auto& row_slot : r.values) {
+    ASSERT_EQ(row_slot.size(), 1U);
+  }
+}
+
+TEST(PivotEvaluator, ValueFilterSelectsDataFieldAndInvalidSelectorIsNoOp) {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"MeasureA", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"MeasureB", {}});
+  auto add = [&](const char* region, double a, double b) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(Value::number(a));
+    rec.cells.push_back(Value::number(b));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("A", 100.0, 1.0);
+  add("B", 50.0, 100.0);
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField region_field;
+  region_field.source_name = "Region";
+  region_field.axis = PivotAxis::Row;
+  PivotField measure_a_field;
+  measure_a_field.source_name = "MeasureA";
+  measure_a_field.axis = PivotAxis::Value;
+  PivotField measure_b_field;
+  measure_b_field.source_name = "MeasureB";
+  measure_b_field.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(region_field));
+  table.mutable_fields().push_back(std::move(measure_a_field));
+  table.mutable_fields().push_back(std::move(measure_b_field));
+  table.mutable_row_field_order() = {0};
+  PivotDataField measure_a;
+  measure_a.name = "A";
+  measure_a.field_index = 1;
+  measure_a.aggregation = Aggregation::Sum;
+  PivotDataField measure_b;
+  measure_b.name = "B";
+  measure_b.field_index = 2;
+  measure_b.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(measure_a));
+  table.mutable_data_fields().push_back(std::move(measure_b));
+
+  PivotFilter selected;
+  selected.axis = PivotAxis::Row;
+  selected.field_name = "Region";
+  selected.type = FilterType::ValueTop10;
+  selected.value = 1;
+  selected.data_field_index = 1;
+  table.mutable_active_filters().push_back(selected);
+
+  auto selected_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(selected_or)) << selected_or.error().message;
+  ASSERT_EQ(selected_or.value().rows.size(), 1U);
+  EXPECT_EQ(selected_or.value().rows[0].label, "B");
+
+  // A direct C++ model can still contain a stale selector; evaluation must
+  // leave the report untouched rather than dropping every leaf.
+  table.mutable_active_filters()[0].data_field_index = 2;
+  auto invalid_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(invalid_or)) << invalid_or.error().message;
+  ASSERT_EQ(invalid_or.value().rows.size(), 2U);
+  EXPECT_EQ(invalid_or.value().rows[0].label, "A");
+  EXPECT_EQ(invalid_or.value().rows[1].label, "B");
+}
+
+TEST(PivotEvaluator, ValueBetweenFilterRowAxis) {
+  PivotCache cache = build_amount_cache_for_between();
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField rf;
+  rf.source_name = "Region";
+  rf.axis = PivotAxis::Row;
+  PivotField af;
+  af.source_name = "Amount";
+  af.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(rf));
+  table.mutable_fields().push_back(std::move(af));
+  table.mutable_row_field_order() = {0};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 1;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::ValueBetween;
+  f.value = 20.0;       // inclusive low bound
+  f.value_high = 50.0;  // inclusive high bound
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // 25 and 40 land in [20, 50]; 10 and 75 fall outside.
+  ASSERT_EQ(r.rows.size(), 2U);
+  std::vector<std::string> labels;
+  std::vector<double> totals;
+  for (std::size_t i = 0; i < r.rows.size(); ++i) {
+    labels.push_back(r.rows[i].label);
+    totals.push_back(r.values[i][0][0].as_number());
+  }
+  std::sort(labels.begin(), labels.end());
+  std::sort(totals.begin(), totals.end());
+  EXPECT_EQ(labels[0], "B");
+  EXPECT_EQ(labels[1], "C");
+  EXPECT_DOUBLE_EQ(totals[0], 25.0);
+  EXPECT_DOUBLE_EQ(totals[1], 40.0);
+}
+
+TEST(PivotEvaluator, ValueBetweenFilterColAxis) {
+  // Mirror of the row-axis test along the column axis: each Region
+  // becomes a column with its single Amount as the column total.
+  PivotCache cache = build_amount_cache_for_between();
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField rf;
+  rf.source_name = "Region";
+  rf.axis = PivotAxis::Col;
+  PivotField af;
+  af.source_name = "Amount";
+  af.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(rf));
+  table.mutable_fields().push_back(std::move(af));
+  table.mutable_col_field_order() = {0};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 1;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Col;
+  f.field_name = "Region";
+  f.type = FilterType::ValueBetween;
+  f.value = 20.0;
+  f.value_high = 50.0;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  ASSERT_EQ(r.cols.size(), 2U);
+  std::vector<std::string> labels{r.cols[0].label, r.cols[1].label};
+  std::sort(labels.begin(), labels.end());
+  EXPECT_EQ(labels[0], "B");
+  EXPECT_EQ(labels[1], "C");
+  // The single implicit row should retain exactly the two surviving cols.
+  ASSERT_EQ(r.values.size(), 1U);
+  ASSERT_EQ(r.values[0].size(), 2U);
+}
+
+TEST(PivotEvaluator, ValueBetweenFilterUnboundedHighIsNoOp) {
+  PivotCache cache = build_amount_cache_for_between();
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField rf;
+  rf.source_name = "Region";
+  rf.axis = PivotAxis::Row;
+  PivotField af;
+  af.source_name = "Amount";
+  af.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(rf));
+  table.mutable_fields().push_back(std::move(af));
+  table.mutable_row_field_order() = {0};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 1;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::ValueBetween;
+  f.value = 20.0;
+  // value_high left as default monostate -> filter degrades to no-op.
+  f.value_high = std::monostate{};
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // No upper bound -> all four rows survive.
+  ASSERT_EQ(r.rows.size(), 4U);
+}
+
+TEST(PivotEvaluator, ValueTop10MultiLevelRowAxis) {
+  // Two row fields: Region (North/South) -> Product (A/B/C). Each
+  // (region, product) leaf has a single record so the post-aggregation
+  // leaf score equals its Amount.
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* region, const char* product, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(owned_text(cache, product));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("North", "A", 10.0);
+  add("North", "B", 50.0);
+  add("North", "C", 20.0);
+  add("South", "A", 80.0);
+  add("South", "B", 30.0);
+  add("South", "C", 5.0);
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField region_f;
+  region_f.source_name = "Region";
+  region_f.axis = PivotAxis::Row;
+  PivotField product_f;
+  product_f.source_name = "Product";
+  product_f.axis = PivotAxis::Row;
+  PivotField amount_f;
+  amount_f.source_name = "Amount";
+  amount_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(region_f));
+  table.mutable_fields().push_back(std::move(product_f));
+  table.mutable_fields().push_back(std::move(amount_f));
+  table.mutable_row_field_order() = {0, 1};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 2;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Product";
+  f.type = FilterType::ValueTop10;
+  f.value = 2;  // Top 2 products under each region.
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Ranked within each region, not across the flattened axis: North keeps
+  // B=50 and C=20 even though South/B=30 outranks North/C globally, and
+  // South keeps A=80 and B=30.
+  ASSERT_EQ(r.rows.size(), 2U);
+  ASSERT_EQ(r.rows[0].label, "North");
+  ASSERT_EQ(r.rows[0].children.size(), 2U);
+  EXPECT_EQ(r.rows[0].children[0].label, "B");
+  EXPECT_EQ(r.rows[0].children[1].label, "C");
+  ASSERT_EQ(r.rows[1].label, "South");
+  ASSERT_EQ(r.rows[1].children.size(), 2U);
+  EXPECT_EQ(r.rows[1].children[0].label, "A");
+  EXPECT_EQ(r.rows[1].children[1].label, "B");
+
+  ASSERT_EQ(r.values.size(), 4U);
+  const std::vector<double> expected = {50.0, 20.0, 80.0, 30.0};
+  for (std::size_t leaf = 0; leaf < expected.size(); ++leaf) {
+    ASSERT_EQ(r.values[leaf].size(), 1U);
+    EXPECT_DOUBLE_EQ(r.values[leaf][0][0].as_number(), expected[leaf]) << "leaf=" << leaf;
+  }
+}
+
+TEST(PivotEvaluator, ValueFilterWithUnknownFieldIsNoOpOnNestedAxis) {
+  PivotCache cache = build_region_product_cache(
+      {{"North", "A", 10.0}, {"North", "B", 50.0}, {"South", "A", 80.0}, {"South", "B", 30.0}});
+  PivotTable table = build_region_product_table(Aggregation::Sum);
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Missing";
+  f.type = FilterType::ValueTop10;
+  f.value = 1;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  ASSERT_EQ(r.rows[0].children.size(), 2U);
+  ASSERT_EQ(r.rows[1].children.size(), 2U);
+  EXPECT_EQ(r.values.size(), 4U);
+  const std::vector<double> expected = {10.0, 50.0, 80.0, 30.0};
+  for (std::size_t leaf = 0; leaf < expected.size(); ++leaf) {
+    ASSERT_EQ(r.values[leaf].size(), 1U);
+    EXPECT_DOUBLE_EQ(r.values[leaf][0][0].as_number(), expected[leaf]) << "leaf=" << leaf;
+  }
+}
+
+TEST(PivotEvaluator, ValueTop10OnOuterFieldKeepsWholeGroups) {
+  PivotCache cache = build_region_product_cache({{"North", "A", 10.0},
+                                                 {"North", "B", 50.0},
+                                                 {"North", "C", 20.0},
+                                                 {"South", "A", 80.0},
+                                                 {"South", "B", 30.0},
+                                                 {"South", "C", 5.0}});
+  PivotTable table = build_region_product_table(Aggregation::Sum);
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::ValueTop10;
+  f.value = 1;  // North=80, South=115.
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  EXPECT_EQ(r.rows[0].children.size(), 3U);
+  EXPECT_EQ(r.values.size(), 3U);
+}
+
+TEST(PivotEvaluator, ValueTop10OnInnerFieldRanksPerParentWithoutSubtotals) {
+  PivotCache cache = build_region_product_cache(
+      {{"North", "A", 10.0}, {"North", "B", 50.0}, {"South", "A", 80.0}, {"South", "B", 30.0}});
+  PivotTable table = build_region_product_table(Aggregation::Sum);
+  table.mutable_fields()[0].default_subtotal = false;
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Product";
+  f.type = FilterType::ValueTop10;
+  f.value = 1;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  EXPECT_TRUE(r.row_subtotals.empty());
+  ASSERT_EQ(r.rows.size(), 2U);
+  ASSERT_EQ(r.rows[0].children.size(), 1U);
+  EXPECT_EQ(r.rows[0].children[0].label, "B");  // North's best, below South/B.
+  ASSERT_EQ(r.rows[1].children.size(), 1U);
+  EXPECT_EQ(r.rows[1].children[0].label, "A");
+}
+
+TEST(PivotEvaluator, AuthoredTopCountOnInnerFieldRanksPerParent) {
+  PivotCache cache = build_region_product_cache(
+      {{"North", "A", 10.0}, {"North", "B", 50.0}, {"South", "A", 80.0}, {"South", "B", 30.0}});
+  PivotTable table = build_region_product_table(Aggregation::Sum);
+  AuthoredValueFilter f;
+  f.field_index = 1;
+  f.type = FilterType::ValueTop10;
+  f.value = 1.0;
+  table.mutable_authored_value_filters().push_back(f);
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 2U);
+  ASSERT_EQ(r.rows[0].children.size(), 1U);
+  EXPECT_EQ(r.rows[0].children[0].label, "B");
+  ASSERT_EQ(r.rows[1].children.size(), 1U);
+  EXPECT_EQ(r.rows[1].children[0].label, "A");
+}
+
+TEST(PivotEvaluator, ValueTop10OnOuterFieldScoresNonAdditiveAggregate) {
+  PivotCache cache = build_region_product_cache(
+      {{"North", "A", 40.0}, {"North", "B", 40.0}, {"North", "C", 40.0}, {"South", "A", 50.0}});
+  PivotTable table = build_region_product_table(Aggregation::Average);
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Region";
+  f.type = FilterType::ValueTop10;
+  f.value = 1;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+}
+
+TEST(PivotEvaluator, ValueGreaterThanMultiLevelColAxis) {
+  // Two column fields: Year (2024/2025) -> Quarter (Q1/Q2). Single
+  // implicit row, so each col leaf's score is just its Amount.
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Year", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* year, const char* quarter, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, year));
+    rec.cells.push_back(owned_text(cache, quarter));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  // Leaf order in DFS pre-order: 2024/Q1=15, 2024/Q2=40, 2025/Q1=5, 2025/Q2=100.
+  add("2024", "Q1", 15.0);
+  add("2024", "Q2", 40.0);
+  add("2025", "Q1", 5.0);
+  add("2025", "Q2", 100.0);
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField year_f;
+  year_f.source_name = "Year";
+  year_f.axis = PivotAxis::Col;
+  PivotField quarter_f;
+  quarter_f.source_name = "Quarter";
+  quarter_f.axis = PivotAxis::Col;
+  PivotField amount_f;
+  amount_f.source_name = "Amount";
+  amount_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(year_f));
+  table.mutable_fields().push_back(std::move(quarter_f));
+  table.mutable_fields().push_back(std::move(amount_f));
+  table.mutable_col_field_order() = {0, 1};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 2;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Col;
+  f.field_name = "Quarter";
+  f.type = FilterType::ValueGreaterThan;
+  f.value = 20.0;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // Surviving col leaves at indices 1 (2024/Q2=40) and 3 (2025/Q2=100).
+  // Each Year keeps only Q2; both Year subtrees survive.
+  ASSERT_EQ(r.cols.size(), 2U);
+  EXPECT_EQ(r.cols[0].label, "2024");
+  EXPECT_EQ(r.cols[1].label, "2025");
+  ASSERT_EQ(r.cols[0].children.size(), 1U);
+  ASSERT_EQ(r.cols[1].children.size(), 1U);
+  EXPECT_EQ(r.cols[0].children[0].label, "Q2");
+  EXPECT_EQ(r.cols[1].children[0].label, "Q2");
+
+  ASSERT_EQ(r.values.size(), 1U);
+  ASSERT_EQ(r.values[0].size(), 2U);
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 40.0);
+  EXPECT_DOUBLE_EQ(r.values[0][1][0].as_number(), 100.0);
+}
+
+TEST(PivotEvaluator, ValueBetweenMultiLevelDropsEmptyParent) {
+  // Two row fields: Region (North/South) -> Product (A/B). All North
+  // leaves fall outside [10, 70], so North gets pruned entirely.
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* region, const char* product, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(owned_text(cache, product));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("North", "A", 5.0);
+  add("North", "B", 8.0);
+  add("South", "A", 50.0);
+  add("South", "B", 60.0);
+
+  PivotTable table;
+  table.set_pivot_cache_id(1);
+  PivotField region_f;
+  region_f.source_name = "Region";
+  region_f.axis = PivotAxis::Row;
+  PivotField product_f;
+  product_f.source_name = "Product";
+  product_f.axis = PivotAxis::Row;
+  PivotField amount_f;
+  amount_f.source_name = "Amount";
+  amount_f.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(region_f));
+  table.mutable_fields().push_back(std::move(product_f));
+  table.mutable_fields().push_back(std::move(amount_f));
+  table.mutable_row_field_order() = {0, 1};
+  PivotDataField sum;
+  sum.name = "Sum of Amount";
+  sum.field_index = 2;
+  sum.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum));
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotFilter f;
+  f.axis = PivotAxis::Row;
+  f.field_name = "Product";
+  f.type = FilterType::ValueBetween;
+  f.value = 10.0;
+  f.value_high = 70.0;
+  table.mutable_active_filters().push_back(std::move(f));
+
+  auto r_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(r_or)) << r_or.error().message;
+  const PivotResult& r = r_or.value();
+
+  // North has no surviving children -> pruned entirely. Only South
+  // remains, with both A and B.
+  ASSERT_EQ(r.rows.size(), 1U);
+  EXPECT_EQ(r.rows[0].label, "South");
+  ASSERT_EQ(r.rows[0].children.size(), 2U);
+  EXPECT_EQ(r.rows[0].children[0].label, "A");
+  EXPECT_EQ(r.rows[0].children[1].label, "B");
+
+  ASSERT_EQ(r.values.size(), 2U);
+  EXPECT_DOUBLE_EQ(r.values[0][0][0].as_number(), 50.0);
+  EXPECT_DOUBLE_EQ(r.values[1][0][0].as_number(), 60.0);
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_layout_axes_test.cpp b/tests/unit/pivot/pivot_layout_axes_test.cpp
new file mode 100644
index 000000000..9d4a2d2f3
--- /dev/null
+++ b/tests/unit/pivot/pivot_layout_axes_test.cpp
@@ -0,0 +1,498 @@
+// Pivot layout axes, headers, and column-field projection shapes.
+
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_layout_test_helpers.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using layout_test::build_basic_cache;
+using layout_test::build_table;
+using layout_test::find_cell;
+using layout_test::ja_jp_layout_options;
+using layout_test::owned_text;
+
+PivotCache build_region_product_quarter_cache() {
+  PivotCache cache;
+  cache.set_cache_id(4);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* region, const char* product, const char* quarter, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(owned_text(cache, product));
+    rec.cells.push_back(owned_text(cache, quarter));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("North", "Widget", "Q1", 100.0);
+  add("North", "Widget", "Q2", 110.0);
+  add("North", "Gadget", "Q1", 50.0);
+  add("South", "Widget", "Q1", 200.0);
+  add("South", "Widget", "Q2", 210.0);
+  add("South", "Gadget", "Q2", 300.0);
+  return cache;
+}
+
+PivotTable build_region_product_by_quarter_table(PivotLayout layout_mode) {
+  PivotTable table;
+  table.set_pivot_cache_id(4);
+  table.set_anchor(0, 0, 1, 1);
+  table.set_layout(layout_mode);
+  PivotField region;
+  region.source_name = "Region";
+  region.axis = PivotAxis::Row;
+  PivotField product;
+  product.source_name = "Product";
+  product.axis = PivotAxis::Row;
+  PivotField quarter;
+  quarter.source_name = "Quarter";
+  quarter.axis = PivotAxis::Col;
+  PivotField amount;
+  amount.source_name = "Amount";
+  amount.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(region));
+  table.mutable_fields().push_back(std::move(product));
+  table.mutable_fields().push_back(std::move(quarter));
+  table.mutable_fields().push_back(std::move(amount));
+  table.mutable_row_field_order() = {0, 1};
+  table.mutable_col_field_order() = {2};
+  PivotDataField sum_amount;
+  sum_amount.name = "合計 / Amount";  // pivot_layout is locale-agnostic; the caller supplies the display name.
+  sum_amount.field_index = 3;
+  sum_amount.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum_amount));
+  return table;
+}
+
+TEST(PivotLayout, ProjectsOneRowOneColumnPivotToAbsoluteGrid) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_table(/*row=*/{0}, /*col=*/{1});
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+
+  auto cells_or = layout(table, result_or.value());
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
+  const PivotCells& cells = cells_or.value();
+
+  EXPECT_EQ(cells.top, 2U);
+  EXPECT_EQ(cells.left, 3U);
+  EXPECT_EQ(cells.rows, 5U);  // col labels + row field header + 2 data rows + col grand total.
+  EXPECT_EQ(cells.cols, 4U);  // row label + 2 product columns + row grand total.
+
+  const PivotCell* region_header = find_cell(cells, 3, 3);
+  ASSERT_NE(region_header, nullptr);
+  EXPECT_EQ(region_header->kind, PivotCellKind::Header);
+  ASSERT_TRUE(region_header->value.is_text());
+  EXPECT_EQ(region_header->value.as_text(), "Region");
+
+  const PivotCell* gadget_header = find_cell(cells, 2, 4);
+  ASSERT_NE(gadget_header, nullptr);
+  EXPECT_EQ(gadget_header->kind, PivotCellKind::ColLabel);
+  ASSERT_TRUE(gadget_header->value.is_text());
+  EXPECT_EQ(gadget_header->value.as_text(), "Gadget");
+
+  const PivotCell* north_label = find_cell(cells, 4, 3);
+  ASSERT_NE(north_label, nullptr);
+  EXPECT_EQ(north_label->kind, PivotCellKind::RowLabel);
+  ASSERT_TRUE(north_label->value.is_text());
+  EXPECT_EQ(north_label->value.as_text(), "North");
+
+  const PivotCell* north_gadget = find_cell(cells, 4, 4);
+  ASSERT_NE(north_gadget, nullptr);
+  EXPECT_EQ(north_gadget->kind, PivotCellKind::Data);
+  ASSERT_TRUE(north_gadget->value.is_number());
+  EXPECT_DOUBLE_EQ(north_gadget->value.as_number(), 50.0);
+
+  const PivotCell* south_widget = find_cell(cells, 5, 5);
+  ASSERT_NE(south_widget, nullptr);
+  EXPECT_EQ(south_widget->kind, PivotCellKind::Data);
+  ASSERT_TRUE(south_widget->value.is_number());
+  EXPECT_DOUBLE_EQ(south_widget->value.as_number(), 200.0);
+
+  const PivotCell* north_total = find_cell(cells, 4, 6);
+  ASSERT_NE(north_total, nullptr);
+  EXPECT_EQ(north_total->kind, PivotCellKind::GrandTotal);
+  ASSERT_TRUE(north_total->value.is_number());
+  EXPECT_DOUBLE_EQ(north_total->value.as_number(), 175.0);
+}
+
+TEST(PivotLayout, AddsDataFieldHeaderRowForMultipleValueFields) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_table(/*row=*/{0}, /*col=*/{});
+  PivotDataField count_amount;
+  count_amount.name = "Count of Amount";
+  count_amount.field_index = 2;
+  count_amount.aggregation = Aggregation::Count;
+  table.mutable_data_fields().push_back(std::move(count_amount));
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+
+  auto cells_or = layout(table, result_or.value());
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
+  const PivotCells& cells = cells_or.value();
+
+  EXPECT_EQ(cells.rows, 6U);  // value label + data-field headers + row header + 2 rows + col grand total.
+  EXPECT_EQ(cells.cols, 5U);  // row label + 2 data fields + 2 grand-total fields.
+
+  const PivotCell* sum_header = find_cell(cells, 3, 4);
+  ASSERT_NE(sum_header, nullptr);
+  EXPECT_EQ(sum_header->kind, PivotCellKind::Header);
+  ASSERT_TRUE(sum_header->value.is_text());
+  EXPECT_EQ(sum_header->value.as_text(), "Sum of Amount");
+
+  const PivotCell* count_header = find_cell(cells, 3, 5);
+  ASSERT_NE(count_header, nullptr);
+  EXPECT_EQ(count_header->kind, PivotCellKind::Header);
+  ASSERT_TRUE(count_header->value.is_text());
+  EXPECT_EQ(count_header->value.as_text(), "Count of Amount");
+
+  const PivotCell* north_count = find_cell(cells, 5, 5);
+  ASSERT_NE(north_count, nullptr);
+  EXPECT_EQ(north_count->kind, PivotCellKind::Data);
+  ASSERT_TRUE(north_count->value.is_number());
+  EXPECT_DOUBLE_EQ(north_count->value.as_number(), 3.0);
+
+  const PivotCell* sum_grand_total = find_cell(cells, 7, 6);
+  ASSERT_NE(sum_grand_total, nullptr);
+  EXPECT_EQ(sum_grand_total->kind, PivotCellKind::GrandTotal);
+  ASSERT_TRUE(sum_grand_total->value.is_number());
+  EXPECT_DOUBLE_EQ(sum_grand_total->value.as_number(), 675.0);
+
+  const PivotCell* count_grand_total = find_cell(cells, 7, 7);
+  ASSERT_NE(count_grand_total, nullptr);
+  EXPECT_EQ(count_grand_total->kind, PivotCellKind::GrandTotal);
+  ASSERT_TRUE(count_grand_total->value.is_number());
+  EXPECT_DOUBLE_EQ(count_grand_total->value.as_number(), 5.0);
+}
+
+TEST(PivotLayout, TabularLayoutWidensToColumnFieldPivot) {
+  // Column fields with Tabular/Outline layout were previously
+  // unsupported (`col_depth == 0` was required); this reproduces the
+  // golden's grid to prove the widened layout matches.
+  PivotCache cache = build_region_product_quarter_cache();
+  PivotTable table = build_region_product_by_quarter_table(PivotLayout::Tabular);
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+
+  PivotLayoutOptions options = ja_jp_layout_options();
+  auto cells_or = layout(table, result_or.value(), options);
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message << " " << cells_or.error().context;
+  const PivotCells& cells = cells_or.value();
+
+  EXPECT_EQ(cells.rows, 9U);
+  EXPECT_EQ(cells.cols, 5U);
+
+  auto text_at = [&](std::uint32_t r, std::uint32_t c) -> std::string {
+    const PivotCell* cell = find_cell(cells, r, c);
+    if (cell == nullptr || !cell->value.is_text()) {
+      return "<missing>";
+    }
+    return std::string(cell->value.as_text());
+  };
+  auto number_at = [&](std::uint32_t r, std::uint32_t c) -> double {
+    const PivotCell* cell = find_cell(cells, r, c);
+    return cell != nullptr && cell->value.is_number() ? cell->value.as_number() : -1.0;
+  };
+  auto is_blank_at = [&](std::uint32_t r, std::uint32_t c) -> bool {
+    const PivotCell* cell = find_cell(cells, r, c);
+    return cell != nullptr && cell->value.is_blank();
+  };
+
+  // Row 0: data-field name in the corner, "Quarter" over the leaf
+  // columns, everything else blank.
+  EXPECT_EQ(text_at(0, 0), "合計 / Amount");
+  EXPECT_EQ(find_cell(cells, 0, 1)->kind, PivotCellKind::Blank);
+  EXPECT_EQ(text_at(0, 2), "Quarter");
+  EXPECT_EQ(find_cell(cells, 0, 3)->kind, PivotCellKind::Blank);
+  EXPECT_EQ(find_cell(cells, 0, 4)->kind, PivotCellKind::Blank);
+
+  // Row 1: row-field names + column leaf labels (the last col-header
+  // row doubles as the row-field-name row).
+  EXPECT_EQ(text_at(1, 0), "Region");
+  EXPECT_EQ(text_at(1, 1), "Product");
+  EXPECT_EQ(text_at(1, 2), "Q1");
+  EXPECT_EQ(text_at(1, 3), "Q2");
+  EXPECT_EQ(text_at(1, 4), "総計");
+
+  // Leaf and subtotal rows.
+  EXPECT_EQ(text_at(2, 0), "North");
+  EXPECT_EQ(text_at(2, 1), "Gadget");
+  EXPECT_EQ(number_at(2, 2), 50.0);
+  EXPECT_TRUE(is_blank_at(2, 3));
+  EXPECT_EQ(number_at(2, 4), 50.0);
+
+  EXPECT_TRUE(is_blank_at(3, 0));
+  EXPECT_EQ(text_at(3, 1), "Widget");
+  EXPECT_EQ(number_at(3, 2), 100.0);
+  EXPECT_EQ(number_at(3, 3), 110.0);
+  EXPECT_EQ(number_at(3, 4), 210.0);
+
+  EXPECT_EQ(text_at(4, 0), "North 集計");
+  EXPECT_TRUE(is_blank_at(4, 1));
+  EXPECT_EQ(number_at(4, 2), 150.0);
+  EXPECT_EQ(number_at(4, 3), 110.0);
+  EXPECT_EQ(number_at(4, 4), 260.0);
+
+  EXPECT_EQ(text_at(5, 0), "South");
+  EXPECT_EQ(text_at(5, 1), "Gadget");
+  EXPECT_TRUE(is_blank_at(5, 2));
+  EXPECT_EQ(number_at(5, 3), 300.0);
+  EXPECT_EQ(number_at(5, 4), 300.0);
+
+  EXPECT_TRUE(is_blank_at(6, 0));
+  EXPECT_EQ(text_at(6, 1), "Widget");
+  EXPECT_EQ(number_at(6, 2), 200.0);
+  EXPECT_EQ(number_at(6, 3), 210.0);
+  EXPECT_EQ(number_at(6, 4), 410.0);
+
+  EXPECT_EQ(text_at(7, 0), "South 集計");
+  EXPECT_TRUE(is_blank_at(7, 1));
+  EXPECT_EQ(number_at(7, 2), 200.0);
+  EXPECT_EQ(number_at(7, 3), 510.0);
+  EXPECT_EQ(number_at(7, 4), 710.0);
+
+  EXPECT_EQ(text_at(8, 0), "総計");
+  EXPECT_TRUE(is_blank_at(8, 1));
+  EXPECT_EQ(number_at(8, 2), 350.0);
+  EXPECT_EQ(number_at(8, 3), 620.0);
+  EXPECT_EQ(number_at(8, 4), 970.0);
+}
+
+TEST(PivotLayout, OutlineLayoutWidensToColumnFieldPivot) {
+  // Same shape as `TabularLayoutWidensToColumnFieldPivot`, but Outline:
+  // subtotal rows carry the bare parent label (no " 集計" suffix, since
+  // the row doubles as the parent group's own header) and leaf rows
+  // never repeat a parent value in its own column.
+  // `two_row_fields_by_column_field_outline` in the same golden file.
+  PivotCache cache = build_region_product_quarter_cache();
+  PivotTable table = build_region_product_by_quarter_table(PivotLayout::Outline);
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+
+  PivotLayoutOptions options = ja_jp_layout_options();
+  auto cells_or = layout(table, result_or.value(), options);
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message << " " << cells_or.error().context;
+  const PivotCells& cells = cells_or.value();
+
+  EXPECT_EQ(cells.rows, 9U);
+  EXPECT_EQ(cells.cols, 5U);
+
+  auto text_at = [&](std::uint32_t r, std::uint32_t c) -> std::string {
+    const PivotCell* cell = find_cell(cells, r, c);
+    if (cell == nullptr || !cell->value.is_text()) {
+      return "<missing>";
+    }
+    return std::string(cell->value.as_text());
+  };
+  auto number_at = [&](std::uint32_t r, std::uint32_t c) -> double {
+    const PivotCell* cell = find_cell(cells, r, c);
+    return cell != nullptr && cell->value.is_number() ? cell->value.as_number() : -1.0;
+  };
+  auto is_blank_at = [&](std::uint32_t r, std::uint32_t c) -> bool {
+    const PivotCell* cell = find_cell(cells, r, c);
+    return cell != nullptr && cell->value.is_blank();
+  };
+
+  EXPECT_EQ(text_at(0, 0), "合計 / Amount");
+  EXPECT_EQ(text_at(0, 2), "Quarter");
+  EXPECT_EQ(text_at(1, 0), "Region");
+  EXPECT_EQ(text_at(1, 1), "Product");
+  EXPECT_EQ(text_at(1, 2), "Q1");
+  EXPECT_EQ(text_at(1, 3), "Q2");
+  EXPECT_EQ(text_at(1, 4), "総計");
+
+  // North's subtotal row (bare label, no " 集計" suffix) precedes its
+  // leaf rows -- Outline's subtotal_top default.
+  EXPECT_EQ(text_at(2, 0), "North");
+  EXPECT_TRUE(is_blank_at(2, 1));
+  EXPECT_EQ(number_at(2, 2), 150.0);
+  EXPECT_EQ(number_at(2, 3), 110.0);
+  EXPECT_EQ(number_at(2, 4), 260.0);
+
+  EXPECT_TRUE(is_blank_at(3, 0));
+  EXPECT_EQ(text_at(3, 1), "Gadget");
+  EXPECT_EQ(number_at(3, 2), 50.0);
+  EXPECT_TRUE(is_blank_at(3, 3));
+  EXPECT_EQ(number_at(3, 4), 50.0);
+
+  EXPECT_TRUE(is_blank_at(4, 0));
+  EXPECT_EQ(text_at(4, 1), "Widget");
+  EXPECT_EQ(number_at(4, 2), 100.0);
+  EXPECT_EQ(number_at(4, 3), 110.0);
+  EXPECT_EQ(number_at(4, 4), 210.0);
+
+  EXPECT_EQ(text_at(5, 0), "South");
+  EXPECT_TRUE(is_blank_at(5, 1));
+  EXPECT_EQ(number_at(5, 2), 200.0);
+  EXPECT_EQ(number_at(5, 3), 510.0);
+  EXPECT_EQ(number_at(5, 4), 710.0);
+
+  EXPECT_TRUE(is_blank_at(6, 0));
+  EXPECT_EQ(text_at(6, 1), "Gadget");
+  EXPECT_TRUE(is_blank_at(6, 2));
+  EXPECT_EQ(number_at(6, 3), 300.0);
+  EXPECT_EQ(number_at(6, 4), 300.0);
+
+  EXPECT_TRUE(is_blank_at(7, 0));
+  EXPECT_EQ(text_at(7, 1), "Widget");
+  EXPECT_EQ(number_at(7, 2), 200.0);
+  EXPECT_EQ(number_at(7, 3), 210.0);
+  EXPECT_EQ(number_at(7, 4), 410.0);
+
+  EXPECT_EQ(text_at(8, 0), "総計");
+  EXPECT_TRUE(is_blank_at(8, 1));
+  EXPECT_EQ(number_at(8, 2), 350.0);
+  EXPECT_EQ(number_at(8, 3), 620.0);
+  EXPECT_EQ(number_at(8, 4), 970.0);
+}
+
+TEST(PivotLayout, TabularLayoutTwoColumnFieldsNamesOneColumnPerDepth) {
+  // Two fields on each axis (`two_row_fields_two_col_fields` in the same
+  // golden file). The extra header row above the column hierarchy
+  // names one column field per depth, at `data_left + depth` -- NOT
+  // aligned with how wide each level's own leaf group is (Quarter's
+  // name sits over Q1's group; Channel's sits one column to the
+  // right, not under Store/Web).
+  PivotCache cache;
+  cache.set_cache_id(5);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Channel", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+  auto add = [&](const char* region, const char* product, const char* quarter, const char* channel, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(owned_text(cache, product));
+    rec.cells.push_back(owned_text(cache, quarter));
+    rec.cells.push_back(owned_text(cache, channel));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+  add("North", "Widget", "Q1", "Web", 100.0);
+  add("North", "Widget", "Q2", "Store", 110.0);
+  add("North", "Gadget", "Q1", "Web", 50.0);
+  add("South", "Widget", "Q1", "Store", 200.0);
+  add("South", "Widget", "Q2", "Web", 210.0);
+  add("South", "Gadget", "Q2", "Store", 300.0);
+
+  PivotTable table;
+  table.set_pivot_cache_id(5);
+  table.set_anchor(0, 0, 1, 1);
+  table.set_layout(PivotLayout::Tabular);
+  PivotField region;
+  region.source_name = "Region";
+  region.axis = PivotAxis::Row;
+  PivotField product;
+  product.source_name = "Product";
+  product.axis = PivotAxis::Row;
+  PivotField quarter;
+  quarter.source_name = "Quarter";
+  quarter.axis = PivotAxis::Col;
+  PivotField channel;
+  channel.source_name = "Channel";
+  channel.axis = PivotAxis::Col;
+  PivotField amount;
+  amount.source_name = "Amount";
+  amount.axis = PivotAxis::Value;
+  table.mutable_fields().push_back(std::move(region));
+  table.mutable_fields().push_back(std::move(product));
+  table.mutable_fields().push_back(std::move(quarter));
+  table.mutable_fields().push_back(std::move(channel));
+  table.mutable_fields().push_back(std::move(amount));
+  table.mutable_row_field_order() = {0, 1};
+  table.mutable_col_field_order() = {2, 3};
+  PivotDataField sum_amount;
+  sum_amount.name = "合計 / Amount";
+  sum_amount.field_index = 4;
+  sum_amount.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum_amount));
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+
+  PivotLayoutOptions options = ja_jp_layout_options();
+  auto cells_or = layout(table, result_or.value(), options);
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message << " " << cells_or.error().context;
+  const PivotCells& cells = cells_or.value();
+
+  EXPECT_EQ(cells.rows, 10U);
+  EXPECT_EQ(cells.cols, 9U);
+
+  auto text_at = [&](std::uint32_t r, std::uint32_t c) -> std::string {
+    const PivotCell* cell = find_cell(cells, r, c);
+    if (cell == nullptr || !cell->value.is_text()) {
+      return "<missing>";
+    }
+    return std::string(cell->value.as_text());
+  };
+  auto is_blank_at = [&](std::uint32_t r, std::uint32_t c) -> bool {
+    const PivotCell* cell = find_cell(cells, r, c);
+    return cell != nullptr && cell->value.is_blank();
+  };
+
+  // Row 0: data-field name, then "Quarter" / "Channel" at data_left/+1,
+  // everything else (including the rest of the row-header prefix)
+  // blank.
+  EXPECT_EQ(text_at(0, 0), "合計 / Amount");
+  EXPECT_TRUE(is_blank_at(0, 1));
+  EXPECT_EQ(text_at(0, 2), "Quarter");
+  EXPECT_EQ(text_at(0, 3), "Channel");
+  for (std::uint32_t c = 4; c <= 8; ++c) {
+    EXPECT_TRUE(is_blank_at(0, c)) << "col " << c;
+  }
+
+  // Row 1: Quarter's own leaf/subtotal labels (row-header columns
+  // blank -- this isn't the last col-header row).
+  EXPECT_TRUE(is_blank_at(1, 0));
+  EXPECT_TRUE(is_blank_at(1, 1));
+  EXPECT_EQ(text_at(1, 2), "Q1");
+  EXPECT_EQ(text_at(1, 4), "Q1 集計");
+  EXPECT_EQ(text_at(1, 5), "Q2");
+  EXPECT_EQ(text_at(1, 7), "Q2 集計");
+  EXPECT_EQ(text_at(1, 8), "総計");
+
+  // Row 2: Channel's own leaf labels, and the row-field names (this IS
+  // the last col-header row).
+  EXPECT_EQ(text_at(2, 0), "Region");
+  EXPECT_EQ(text_at(2, 1), "Product");
+  EXPECT_EQ(text_at(2, 2), "Store");
+  EXPECT_EQ(text_at(2, 3), "Web");
+  // The grand-total strip's own header sits beside "Q1 集計"/"Q2 集計"
+  // (row 1, the outermost column field's row), not beside the row-field
+  // names -- row 2's total-column cell stays blank.
+  EXPECT_TRUE(is_blank_at(2, 8));
+}
+
+TEST(PivotLayout, RejectsMismatchedResultShape) {
+  PivotTable table = build_table(/*row=*/{0}, /*col=*/{});
+  PivotResult result;
+  result.values.resize(2);  // row hierarchy is empty, so layout expects one implicit row leaf.
+
+  auto cells_or = layout(table, result);
+  ASSERT_FALSE(static_cast<bool>(cells_or));
+  EXPECT_EQ(cells_or.error().code, FormulonErrorCode::kEvalPivotInvalid);
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_layout_page_test.cpp b/tests/unit/pivot/pivot_layout_page_test.cpp
new file mode 100644
index 000000000..7f4ab776f
--- /dev/null
+++ b/tests/unit/pivot/pivot_layout_page_test.cpp
@@ -0,0 +1,162 @@
+// Page-field rows and explicit blank cells in pivot layout projection.
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_result.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "pivot_layout_test_helpers.h"
+#include "utils/error.h"
+#include "value.h"
+
+namespace formulon::pivot {
+namespace {
+
+using layout_test::build_basic_cache;
+using layout_test::build_region_year_quarter_cache;
+using layout_test::build_region_year_quarter_table;
+using layout_test::build_table;
+using layout_test::find_cell;
+
+PivotTable build_page_field_table() {
+  // Region moves to the page axis; Product carries the row hierarchy.
+  PivotTable table = build_table(/*row=*/{1}, /*col=*/{});
+  table.mutable_fields()[0].axis = PivotAxis::Page;
+  return table;
+}
+
+TEST(PivotLayout, PageFieldHeaderPrecedesTheReport) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_page_field_table();
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  auto cells_or = layout(table, result_or.value());
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
+  const PivotCells& cells = cells_or.value();
+
+  // Anchor is D3 and the page block takes the first two rows, so everything
+  // the projection would otherwise put at the top moves down by two. The
+  // default (English) vocabulary uses the legacy two-row header.
+  EXPECT_EQ(cells.top, 2U);
+  EXPECT_EQ(cells.rows, 7U);  // page field + separator + 2 header rows + 2 data rows + grand total.
+
+  const PivotCell* field_name = find_cell(cells, 2, 3);
+  ASSERT_NE(field_name, nullptr);
+  EXPECT_EQ(field_name->kind, PivotCellKind::Header);
+  ASSERT_TRUE(field_name->value.is_text());
+  EXPECT_EQ(field_name->value.as_text(), "Region");
+
+  const PivotCell* selection = find_cell(cells, 2, 4);
+  ASSERT_NE(selection, nullptr);
+  EXPECT_EQ(selection->kind, PivotCellKind::Header);
+  ASSERT_TRUE(selection->value.is_text());
+  EXPECT_EQ(selection->value.as_text(), "(All)");
+  // Both cells name the field they belong to, so a renderer can bind the
+  // selection back to its dropdown.
+  EXPECT_EQ(selection->field_name, "Region");
+
+  const PivotCell* separator = find_cell(cells, 3, 3);
+  ASSERT_NE(separator, nullptr);
+  EXPECT_EQ(separator->kind, PivotCellKind::Blank);
+  EXPECT_TRUE(separator->value.is_blank());
+
+  const PivotCell* row_header = find_cell(cells, 5, 3);
+  ASSERT_NE(row_header, nullptr);
+  EXPECT_EQ(row_header->kind, PivotCellKind::Header);
+  ASSERT_TRUE(row_header->value.is_text());
+  EXPECT_EQ(row_header->value.as_text(), "Product");
+}
+
+TEST(PivotLayout, PageFieldsStackInReportOrder) {
+  PivotCache cache = build_region_year_quarter_cache();
+  PivotTable table = build_region_year_quarter_table();
+  // Year and Quarter both leave the column axis for the page axis, which
+  // leaves Region alone on the row axis.
+  table.mutable_fields()[1].axis = PivotAxis::Page;
+  table.mutable_fields()[2].axis = PivotAxis::Page;
+  table.mutable_col_field_order().clear();
+
+  // `<pageFields>` states the order explicitly, and it need not follow
+  // `<pivotFields>` document order.
+  table.mutable_page_fields().push_back(PivotPageField{2, std::nullopt});
+  table.mutable_page_fields().push_back(PivotPageField{1, std::nullopt});
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  auto cells_or = layout(table, result_or.value());
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
+  const PivotCells& cells = cells_or.value();
+
+  const PivotCell* first = find_cell(cells, 2, 3);
+  ASSERT_NE(first, nullptr);
+  ASSERT_TRUE(first->value.is_text());
+  EXPECT_EQ(first->value.as_text(), "Quarter");
+
+  const PivotCell* second = find_cell(cells, 3, 3);
+  ASSERT_NE(second, nullptr);
+  ASSERT_TRUE(second->value.is_text());
+  EXPECT_EQ(second->value.as_text(), "Year");
+
+  const PivotCell* separator = find_cell(cells, 4, 3);
+  ASSERT_NE(separator, nullptr);
+  EXPECT_EQ(separator->kind, PivotCellKind::Blank);
+}
+
+TEST(PivotLayout, PageBlockSpansTheFullReportWidth) {
+  PivotCache cache = build_basic_cache();
+  // Product on the column axis widens the report past the two columns the
+  // page block itself uses; the remainder of each page row is explicit
+  // blanks so the projected rectangle matches the reported extent.
+  PivotTable table = build_table(/*row=*/{1}, /*col=*/{});
+  table.mutable_fields()[0].axis = PivotAxis::Page;
+  PivotDataField count_amount;
+  count_amount.name = "Count of Amount";
+  count_amount.field_index = 2;
+  count_amount.aggregation = Aggregation::Count;
+  table.mutable_data_fields().push_back(std::move(count_amount));
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  auto cells_or = layout(table, result_or.value());
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
+  const PivotCells& cells = cells_or.value();
+
+  ASSERT_GT(cells.cols, 2U);
+  for (std::uint32_t col = 0; col < cells.cols; ++col) {
+    const PivotCell* page_cell = find_cell(cells, 2, 3 + col);
+    ASSERT_NE(page_cell, nullptr) << "page row missing column " << col;
+    const PivotCell* separator = find_cell(cells, 3, 3 + col);
+    ASSERT_NE(separator, nullptr) << "separator row missing column " << col;
+    EXPECT_EQ(separator->kind, PivotCellKind::Blank);
+  }
+}
+
+TEST(PivotLayout, PageFieldWithoutAPageAxisAddsNoRows) {
+  PivotCache cache = build_basic_cache();
+  PivotTable table = build_table(/*row=*/{0}, /*col=*/{});
+
+  auto result_or = evaluate(table, cache);
+  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
+  EXPECT_TRUE(result_or.value().page_selections.empty());
+
+  auto cells_or = layout(table, result_or.value());
+  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
+  // The row-field header keeps the last header row of the legacy layout,
+  // undisplaced because nothing sits above it.
+  const PivotCell* header = find_cell(cells_or.value(), 3, 3);
+  ASSERT_NE(header, nullptr);
+  ASSERT_TRUE(header->value.is_text());
+  EXPECT_EQ(header->value.as_text(), "Region");
+}
+
+}  // namespace
+}  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_layout_test.cpp b/tests/unit/pivot/pivot_layout_subtotals_test.cpp
similarity index 54%
rename from tests/unit/pivot/pivot_layout_test.cpp
rename to tests/unit/pivot/pivot_layout_subtotals_test.cpp
index 27598c71a..81ef81baf 100644
--- a/tests/unit/pivot/pivot_layout_test.cpp
+++ b/tests/unit/pivot/pivot_layout_subtotals_test.cpp
@@ -1,14 +1,8 @@
-//
-// Unit tests for pivot layout projection. These tests verify the grid shape
-// exposed to frontends: absolute coordinates, cell kinds, labels, data cells,
-// and totals.
-
-#include "pivot/pivot_layout.h"
+// Row/column subtotal projection and subtotal metadata validation.
 
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
-#include <optional>
 #include <string>
 #include <utility>
 #include <vector>
@@ -16,133 +10,23 @@
 #include "gtest/gtest.h"
 #include "pivot/pivot_cache.h"
 #include "pivot/pivot_evaluator.h"
+#include "pivot/pivot_layout.h"
 #include "pivot/pivot_result.h"
 #include "pivot/pivot_table.h"
 #include "pivot/pivot_types.h"
+#include "pivot_layout_test_helpers.h"
+#include "utils/error.h"
 #include "value.h"
 
 namespace formulon::pivot {
 namespace {
 
-Value owned_text(PivotCache& cache, std::string s) {
-  cache.mutable_text_storage().push_back(std::move(s));
-  return Value::text(cache.text_storage().back());
-}
-
-PivotCache build_basic_cache() {
-  PivotCache cache;
-  cache.set_cache_id(1);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  auto add = [&](const char* region, const char* product, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(owned_text(cache, product));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-
-  add("North", "Widget", 100.0);
-  add("North", "Gadget", 50.0);
-  add("South", "Widget", 200.0);
-  add("South", "Gadget", 300.0);
-  add("North", "Widget", 25.0);
-  return cache;
-}
-
-PivotTable build_table(std::vector<std::uint32_t> row_fields, std::vector<std::uint32_t> col_fields) {
-  PivotTable table;
-  table.set_name("Pivot1");
-  table.set_pivot_cache_id(1);
-  table.set_anchor(2, 3, 1, 1);  // D3.
-
-  PivotField region;
-  region.source_name = "Region";
-  region.axis = PivotAxis::Row;
-  PivotField product;
-  product.source_name = "Product";
-  product.axis = PivotAxis::Col;
-  PivotField amount;
-  amount.source_name = "Amount";
-  amount.axis = PivotAxis::Value;
-
-  table.mutable_fields().push_back(std::move(region));
-  table.mutable_fields().push_back(std::move(product));
-  table.mutable_fields().push_back(std::move(amount));
-  table.mutable_row_field_order() = std::move(row_fields);
-  table.mutable_col_field_order() = std::move(col_fields);
-
-  PivotDataField sum_amount;
-  sum_amount.name = "Sum of Amount";
-  sum_amount.field_index = 2;
-  sum_amount.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum_amount));
-  return table;
-}
-
-PivotCache build_region_year_quarter_cache() {
-  PivotCache cache;
-  cache.set_cache_id(2);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Year", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-
-  auto add = [&](const char* region, const char* year, const char* quarter, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(owned_text(cache, year));
-    rec.cells.push_back(owned_text(cache, quarter));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-
-  add("North", "2025", "Q1", 10.0);
-  add("North", "2025", "Q2", 20.0);
-  add("North", "2026", "Q1", 30.0);
-  add("South", "2025", "Q1", 40.0);
-  add("South", "2025", "Q2", 50.0);
-  add("South", "2026", "Q1", 60.0);
-  return cache;
-}
-
-PivotTable build_region_year_quarter_table() {
-  PivotTable table;
-  table.set_name("PivotMixed");
-  table.set_pivot_cache_id(2);
-  table.set_anchor(2, 3, 1, 1);
-
-  PivotField region;
-  region.source_name = "Region";
-  region.axis = PivotAxis::Row;
-  PivotField year;
-  year.source_name = "Year";
-  year.axis = PivotAxis::Col;
-  year.subtotal_top = true;
-  PivotField quarter;
-  quarter.source_name = "Quarter";
-  quarter.axis = PivotAxis::Col;
-  PivotField amount;
-  amount.source_name = "Amount";
-  amount.axis = PivotAxis::Value;
-
-  table.mutable_fields().push_back(std::move(region));
-  table.mutable_fields().push_back(std::move(year));
-  table.mutable_fields().push_back(std::move(quarter));
-  table.mutable_fields().push_back(std::move(amount));
-  table.mutable_row_field_order() = {0};
-  table.mutable_col_field_order() = {1, 2};
-  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
-
-  PivotDataField sum_amount;
-  sum_amount.name = "Sum of Amount";
-  sum_amount.field_index = 3;
-  sum_amount.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum_amount));
-  return table;
-}
+using layout_test::build_basic_cache;
+using layout_test::build_region_year_quarter_cache;
+using layout_test::build_region_year_quarter_table;
+using layout_test::build_table;
+using layout_test::find_cell;
+using layout_test::owned_text;
 
 PivotTable build_region_quarter_by_year_table() {
   PivotTable table = build_region_year_quarter_table();
@@ -223,77 +107,6 @@ PivotTable build_region_channel_by_year_quarter_table() {
   table.mutable_data_fields().push_back(std::move(sum_amount));
   return table;
 }
-
-const PivotCell* find_cell(const PivotCells& cells, std::uint32_t row, std::uint32_t col);
-
-// Region/Product on rows, Quarter on columns -- the shape
-// tests/oracle/golden_wb/pivot_cross_axis.golden.json pins as
-// `two_row_fields_by_column_field_{tabular,outline}` (Windows Excel 365
-// ja-JP, build 16.0.20228).
-PivotCache build_region_product_quarter_cache() {
-  PivotCache cache;
-  cache.set_cache_id(4);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* region, const char* product, const char* quarter, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(owned_text(cache, product));
-    rec.cells.push_back(owned_text(cache, quarter));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("North", "Widget", "Q1", 100.0);
-  add("North", "Widget", "Q2", 110.0);
-  add("North", "Gadget", "Q1", 50.0);
-  add("South", "Widget", "Q1", 200.0);
-  add("South", "Widget", "Q2", 210.0);
-  add("South", "Gadget", "Q2", 300.0);
-  return cache;
-}
-
-PivotTable build_region_product_by_quarter_table(PivotLayout layout_mode) {
-  PivotTable table;
-  table.set_pivot_cache_id(4);
-  table.set_anchor(0, 0, 1, 1);
-  table.set_layout(layout_mode);
-  PivotField region;
-  region.source_name = "Region";
-  region.axis = PivotAxis::Row;
-  PivotField product;
-  product.source_name = "Product";
-  product.axis = PivotAxis::Row;
-  PivotField quarter;
-  quarter.source_name = "Quarter";
-  quarter.axis = PivotAxis::Col;
-  PivotField amount;
-  amount.source_name = "Amount";
-  amount.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(region));
-  table.mutable_fields().push_back(std::move(product));
-  table.mutable_fields().push_back(std::move(quarter));
-  table.mutable_fields().push_back(std::move(amount));
-  table.mutable_row_field_order() = {0, 1};
-  table.mutable_col_field_order() = {2};
-  PivotDataField sum_amount;
-  sum_amount.name = "合計 / Amount";  // pivot_layout is locale-agnostic; the caller supplies the display name.
-  sum_amount.field_index = 3;
-  sum_amount.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum_amount));
-  return table;
-}
-
-PivotLayoutOptions ja_jp_layout_options() {
-  PivotLayoutOptions options;
-  options.row_labels_label = "行ラベル";
-  options.column_labels_label = "列ラベル";
-  options.grand_total_label = "総計";
-  options.subtotal_suffix = " 集計";
-  return options;
-}
-
 PivotTable build_deep_layout_table() {
   PivotTable table;
   table.set_name("PivotDeepLayout");
@@ -401,15 +214,6 @@ std::vector<PivotCellKind> projected_data_kinds(const PivotCells& cells, std::ui
   return kinds;
 }
 
-const PivotCell* find_cell(const PivotCells& cells, std::uint32_t row, std::uint32_t col) {
-  for (const PivotCell& cell : cells.cells) {
-    if (cell.row == row && cell.col == col) {
-      return &cell;
-    }
-  }
-  return nullptr;
-}
-
 /// Rows the row/subtotal projection emits, in grid order — leaf rows and
 /// subtotal rows alike. Each one carries a label cell of the matching kind
 /// in the leftmost row-header column, which the bottom grand-total row
@@ -426,109 +230,6 @@ std::vector<std::uint32_t> projected_row_entry_rows(const PivotCells& cells) {
   return rows;
 }
 
-TEST(PivotLayout, ProjectsOneRowOneColumnPivotToAbsoluteGrid) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_table(/*row=*/{0}, /*col=*/{1});
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-
-  auto cells_or = layout(table, result_or.value());
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
-  const PivotCells& cells = cells_or.value();
-
-  EXPECT_EQ(cells.top, 2U);
-  EXPECT_EQ(cells.left, 3U);
-  EXPECT_EQ(cells.rows, 5U);  // col labels + row field header + 2 data rows + col grand total.
-  EXPECT_EQ(cells.cols, 4U);  // row label + 2 product columns + row grand total.
-
-  const PivotCell* region_header = find_cell(cells, 3, 3);
-  ASSERT_NE(region_header, nullptr);
-  EXPECT_EQ(region_header->kind, PivotCellKind::Header);
-  ASSERT_TRUE(region_header->value.is_text());
-  EXPECT_EQ(region_header->value.as_text(), "Region");
-
-  const PivotCell* gadget_header = find_cell(cells, 2, 4);
-  ASSERT_NE(gadget_header, nullptr);
-  EXPECT_EQ(gadget_header->kind, PivotCellKind::ColLabel);
-  ASSERT_TRUE(gadget_header->value.is_text());
-  EXPECT_EQ(gadget_header->value.as_text(), "Gadget");
-
-  const PivotCell* north_label = find_cell(cells, 4, 3);
-  ASSERT_NE(north_label, nullptr);
-  EXPECT_EQ(north_label->kind, PivotCellKind::RowLabel);
-  ASSERT_TRUE(north_label->value.is_text());
-  EXPECT_EQ(north_label->value.as_text(), "North");
-
-  const PivotCell* north_gadget = find_cell(cells, 4, 4);
-  ASSERT_NE(north_gadget, nullptr);
-  EXPECT_EQ(north_gadget->kind, PivotCellKind::Data);
-  ASSERT_TRUE(north_gadget->value.is_number());
-  EXPECT_DOUBLE_EQ(north_gadget->value.as_number(), 50.0);
-
-  const PivotCell* south_widget = find_cell(cells, 5, 5);
-  ASSERT_NE(south_widget, nullptr);
-  EXPECT_EQ(south_widget->kind, PivotCellKind::Data);
-  ASSERT_TRUE(south_widget->value.is_number());
-  EXPECT_DOUBLE_EQ(south_widget->value.as_number(), 200.0);
-
-  const PivotCell* north_total = find_cell(cells, 4, 6);
-  ASSERT_NE(north_total, nullptr);
-  EXPECT_EQ(north_total->kind, PivotCellKind::GrandTotal);
-  ASSERT_TRUE(north_total->value.is_number());
-  EXPECT_DOUBLE_EQ(north_total->value.as_number(), 175.0);
-}
-
-TEST(PivotLayout, AddsDataFieldHeaderRowForMultipleValueFields) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_table(/*row=*/{0}, /*col=*/{});
-  PivotDataField count_amount;
-  count_amount.name = "Count of Amount";
-  count_amount.field_index = 2;
-  count_amount.aggregation = Aggregation::Count;
-  table.mutable_data_fields().push_back(std::move(count_amount));
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-
-  auto cells_or = layout(table, result_or.value());
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
-  const PivotCells& cells = cells_or.value();
-
-  EXPECT_EQ(cells.rows, 6U);  // value label + data-field headers + row header + 2 rows + col grand total.
-  EXPECT_EQ(cells.cols, 5U);  // row label + 2 data fields + 2 grand-total fields.
-
-  const PivotCell* sum_header = find_cell(cells, 3, 4);
-  ASSERT_NE(sum_header, nullptr);
-  EXPECT_EQ(sum_header->kind, PivotCellKind::Header);
-  ASSERT_TRUE(sum_header->value.is_text());
-  EXPECT_EQ(sum_header->value.as_text(), "Sum of Amount");
-
-  const PivotCell* count_header = find_cell(cells, 3, 5);
-  ASSERT_NE(count_header, nullptr);
-  EXPECT_EQ(count_header->kind, PivotCellKind::Header);
-  ASSERT_TRUE(count_header->value.is_text());
-  EXPECT_EQ(count_header->value.as_text(), "Count of Amount");
-
-  const PivotCell* north_count = find_cell(cells, 5, 5);
-  ASSERT_NE(north_count, nullptr);
-  EXPECT_EQ(north_count->kind, PivotCellKind::Data);
-  ASSERT_TRUE(north_count->value.is_number());
-  EXPECT_DOUBLE_EQ(north_count->value.as_number(), 3.0);
-
-  const PivotCell* sum_grand_total = find_cell(cells, 7, 6);
-  ASSERT_NE(sum_grand_total, nullptr);
-  EXPECT_EQ(sum_grand_total->kind, PivotCellKind::GrandTotal);
-  ASSERT_TRUE(sum_grand_total->value.is_number());
-  EXPECT_DOUBLE_EQ(sum_grand_total->value.as_number(), 675.0);
-
-  const PivotCell* count_grand_total = find_cell(cells, 7, 7);
-  ASSERT_NE(count_grand_total, nullptr);
-  EXPECT_EQ(count_grand_total->kind, PivotCellKind::GrandTotal);
-  ASSERT_TRUE(count_grand_total->value.is_number());
-  EXPECT_DOUBLE_EQ(count_grand_total->value.as_number(), 5.0);
-}
-
 TEST(PivotLayout, InsertsRowSubtotalRowsWhenEvaluatorProvidesMetadata) {
   PivotCache cache = build_basic_cache();
   PivotTable table = build_table(/*row=*/{0, 1}, /*col=*/{});
@@ -565,11 +266,6 @@ TEST(PivotLayout, InsertsRowSubtotalRowsWhenEvaluatorProvidesMetadata) {
   EXPECT_DOUBLE_EQ(south_subtotal_value->value.as_number(), 500.0);
 }
 
-// The right-hand total strip covers subtotal rows too. A subtotal row's
-// total is `RowSubtotal::values[df]` -- the group aggregated across the
-// whole column axis -- and leaving it out empties the total column on every
-// subtotal row of a report with a two-level row hierarchy, which is the
-// default configuration (`grand_totals(rows=true)`, subtotals on).
 TEST(PivotLayout, TotalColumnCoversSubtotalRowsAndKeepsLeafTotals) {
   PivotCache cache = build_region_year_quarter_cache();
   PivotTable table = build_region_quarter_by_year_table();
@@ -642,10 +338,6 @@ TEST(PivotLayout, TotalColumnCoversSubtotalRowsAndKeepsLeafTotals) {
   }
 }
 
-// The strip is one column per data field, and each of them covers every
-// projected row. Two value fields make the per-field indexing observable:
-// a strip that walked only leaf rows, or only the first field, leaves a
-// hole that a single-field fixture cannot distinguish from a shifted cursor.
 TEST(PivotLayout, TotalStripCoversEveryRowForEveryDataField) {
   PivotCache cache = build_region_year_quarter_cache();
   PivotTable table = build_region_quarter_by_year_table();
@@ -1183,456 +875,5 @@ TEST(PivotLayout, SortIndependentSubtotalProjectionKeepsBothAxesAndGrandTotals)
   assert_sorted_layout(/*sort_by_value=*/true);
 }
 
-// --- Page (report filter) axis ---------------------------------------------
-//
-// The rendered shape is pinned by the `getpivotdata_page_data.page_axis_field`
-// workbook-oracle capture: Excel draws one row per page field carrying the
-// field name and its selection, then a blank separator row, and counts both
-// inside the pivot's own extent. These cover the projection at a non-zero
-// anchor and the selection states the capture does not reach.
-
-PivotTable build_page_field_table() {
-  // Region moves to the page axis; Product carries the row hierarchy.
-  PivotTable table = build_table(/*row=*/{1}, /*col=*/{});
-  table.mutable_fields()[0].axis = PivotAxis::Page;
-  return table;
-}
-
-TEST(PivotLayout, PageFieldHeaderPrecedesTheReport) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_page_field_table();
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  auto cells_or = layout(table, result_or.value());
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
-  const PivotCells& cells = cells_or.value();
-
-  // Anchor is D3 and the page block takes the first two rows, so everything
-  // the projection would otherwise put at the top moves down by two. The
-  // default (English) vocabulary uses the legacy two-row header.
-  EXPECT_EQ(cells.top, 2U);
-  EXPECT_EQ(cells.rows, 7U);  // page field + separator + 2 header rows + 2 data rows + grand total.
-
-  const PivotCell* field_name = find_cell(cells, 2, 3);
-  ASSERT_NE(field_name, nullptr);
-  EXPECT_EQ(field_name->kind, PivotCellKind::Header);
-  ASSERT_TRUE(field_name->value.is_text());
-  EXPECT_EQ(field_name->value.as_text(), "Region");
-
-  const PivotCell* selection = find_cell(cells, 2, 4);
-  ASSERT_NE(selection, nullptr);
-  EXPECT_EQ(selection->kind, PivotCellKind::Header);
-  ASSERT_TRUE(selection->value.is_text());
-  EXPECT_EQ(selection->value.as_text(), "(All)");
-  // Both cells name the field they belong to, so a renderer can bind the
-  // selection back to its dropdown.
-  EXPECT_EQ(selection->field_name, "Region");
-
-  const PivotCell* separator = find_cell(cells, 3, 3);
-  ASSERT_NE(separator, nullptr);
-  EXPECT_EQ(separator->kind, PivotCellKind::Blank);
-  EXPECT_TRUE(separator->value.is_blank());
-
-  const PivotCell* row_header = find_cell(cells, 5, 3);
-  ASSERT_NE(row_header, nullptr);
-  EXPECT_EQ(row_header->kind, PivotCellKind::Header);
-  ASSERT_TRUE(row_header->value.is_text());
-  EXPECT_EQ(row_header->value.as_text(), "Product");
-}
-
-TEST(PivotLayout, PageFieldsStackInReportOrder) {
-  PivotCache cache = build_region_year_quarter_cache();
-  PivotTable table = build_region_year_quarter_table();
-  // Year and Quarter both leave the column axis for the page axis, which
-  // leaves Region alone on the row axis.
-  table.mutable_fields()[1].axis = PivotAxis::Page;
-  table.mutable_fields()[2].axis = PivotAxis::Page;
-  table.mutable_col_field_order().clear();
-
-  // `<pageFields>` states the order explicitly, and it need not follow
-  // `<pivotFields>` document order.
-  table.mutable_page_fields().push_back(PivotPageField{2, std::nullopt});
-  table.mutable_page_fields().push_back(PivotPageField{1, std::nullopt});
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  auto cells_or = layout(table, result_or.value());
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
-  const PivotCells& cells = cells_or.value();
-
-  const PivotCell* first = find_cell(cells, 2, 3);
-  ASSERT_NE(first, nullptr);
-  ASSERT_TRUE(first->value.is_text());
-  EXPECT_EQ(first->value.as_text(), "Quarter");
-
-  const PivotCell* second = find_cell(cells, 3, 3);
-  ASSERT_NE(second, nullptr);
-  ASSERT_TRUE(second->value.is_text());
-  EXPECT_EQ(second->value.as_text(), "Year");
-
-  const PivotCell* separator = find_cell(cells, 4, 3);
-  ASSERT_NE(separator, nullptr);
-  EXPECT_EQ(separator->kind, PivotCellKind::Blank);
-}
-
-TEST(PivotLayout, PageBlockSpansTheFullReportWidth) {
-  PivotCache cache = build_basic_cache();
-  // Product on the column axis widens the report past the two columns the
-  // page block itself uses; the remainder of each page row is explicit
-  // blanks so the projected rectangle matches the reported extent.
-  PivotTable table = build_table(/*row=*/{1}, /*col=*/{});
-  table.mutable_fields()[0].axis = PivotAxis::Page;
-  PivotDataField count_amount;
-  count_amount.name = "Count of Amount";
-  count_amount.field_index = 2;
-  count_amount.aggregation = Aggregation::Count;
-  table.mutable_data_fields().push_back(std::move(count_amount));
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  auto cells_or = layout(table, result_or.value());
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
-  const PivotCells& cells = cells_or.value();
-
-  ASSERT_GT(cells.cols, 2U);
-  for (std::uint32_t col = 0; col < cells.cols; ++col) {
-    const PivotCell* page_cell = find_cell(cells, 2, 3 + col);
-    ASSERT_NE(page_cell, nullptr) << "page row missing column " << col;
-    const PivotCell* separator = find_cell(cells, 3, 3 + col);
-    ASSERT_NE(separator, nullptr) << "separator row missing column " << col;
-    EXPECT_EQ(separator->kind, PivotCellKind::Blank);
-  }
-}
-
-TEST(PivotLayout, PageFieldWithoutAPageAxisAddsNoRows) {
-  PivotCache cache = build_basic_cache();
-  PivotTable table = build_table(/*row=*/{0}, /*col=*/{});
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-  EXPECT_TRUE(result_or.value().page_selections.empty());
-
-  auto cells_or = layout(table, result_or.value());
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message;
-  // The row-field header keeps the last header row of the legacy layout,
-  // undisplaced because nothing sits above it.
-  const PivotCell* header = find_cell(cells_or.value(), 3, 3);
-  ASSERT_NE(header, nullptr);
-  ASSERT_TRUE(header->value.is_text());
-  EXPECT_EQ(header->value.as_text(), "Region");
-}
-
-TEST(PivotLayout, TabularLayoutWidensToColumnFieldPivot) {
-  // Column fields with Tabular/Outline layout were previously
-  // unsupported (`col_depth == 0` was required); this reproduces the
-  // golden's grid to prove the widened layout matches.
-  PivotCache cache = build_region_product_quarter_cache();
-  PivotTable table = build_region_product_by_quarter_table(PivotLayout::Tabular);
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-
-  PivotLayoutOptions options = ja_jp_layout_options();
-  auto cells_or = layout(table, result_or.value(), options);
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message << " " << cells_or.error().context;
-  const PivotCells& cells = cells_or.value();
-
-  EXPECT_EQ(cells.rows, 9U);
-  EXPECT_EQ(cells.cols, 5U);
-
-  auto text_at = [&](std::uint32_t r, std::uint32_t c) -> std::string {
-    const PivotCell* cell = find_cell(cells, r, c);
-    if (cell == nullptr || !cell->value.is_text()) {
-      return "<missing>";
-    }
-    return std::string(cell->value.as_text());
-  };
-  auto number_at = [&](std::uint32_t r, std::uint32_t c) -> double {
-    const PivotCell* cell = find_cell(cells, r, c);
-    return cell != nullptr && cell->value.is_number() ? cell->value.as_number() : -1.0;
-  };
-  auto is_blank_at = [&](std::uint32_t r, std::uint32_t c) -> bool {
-    const PivotCell* cell = find_cell(cells, r, c);
-    return cell != nullptr && cell->value.is_blank();
-  };
-
-  // Row 0: data-field name in the corner, "Quarter" over the leaf
-  // columns, everything else blank.
-  EXPECT_EQ(text_at(0, 0), "合計 / Amount");
-  EXPECT_EQ(find_cell(cells, 0, 1)->kind, PivotCellKind::Blank);
-  EXPECT_EQ(text_at(0, 2), "Quarter");
-  EXPECT_EQ(find_cell(cells, 0, 3)->kind, PivotCellKind::Blank);
-  EXPECT_EQ(find_cell(cells, 0, 4)->kind, PivotCellKind::Blank);
-
-  // Row 1: row-field names + column leaf labels (the last col-header
-  // row doubles as the row-field-name row).
-  EXPECT_EQ(text_at(1, 0), "Region");
-  EXPECT_EQ(text_at(1, 1), "Product");
-  EXPECT_EQ(text_at(1, 2), "Q1");
-  EXPECT_EQ(text_at(1, 3), "Q2");
-  EXPECT_EQ(text_at(1, 4), "総計");
-
-  // Leaf and subtotal rows.
-  EXPECT_EQ(text_at(2, 0), "North");
-  EXPECT_EQ(text_at(2, 1), "Gadget");
-  EXPECT_EQ(number_at(2, 2), 50.0);
-  EXPECT_TRUE(is_blank_at(2, 3));
-  EXPECT_EQ(number_at(2, 4), 50.0);
-
-  EXPECT_TRUE(is_blank_at(3, 0));
-  EXPECT_EQ(text_at(3, 1), "Widget");
-  EXPECT_EQ(number_at(3, 2), 100.0);
-  EXPECT_EQ(number_at(3, 3), 110.0);
-  EXPECT_EQ(number_at(3, 4), 210.0);
-
-  EXPECT_EQ(text_at(4, 0), "North 集計");
-  EXPECT_TRUE(is_blank_at(4, 1));
-  EXPECT_EQ(number_at(4, 2), 150.0);
-  EXPECT_EQ(number_at(4, 3), 110.0);
-  EXPECT_EQ(number_at(4, 4), 260.0);
-
-  EXPECT_EQ(text_at(5, 0), "South");
-  EXPECT_EQ(text_at(5, 1), "Gadget");
-  EXPECT_TRUE(is_blank_at(5, 2));
-  EXPECT_EQ(number_at(5, 3), 300.0);
-  EXPECT_EQ(number_at(5, 4), 300.0);
-
-  EXPECT_TRUE(is_blank_at(6, 0));
-  EXPECT_EQ(text_at(6, 1), "Widget");
-  EXPECT_EQ(number_at(6, 2), 200.0);
-  EXPECT_EQ(number_at(6, 3), 210.0);
-  EXPECT_EQ(number_at(6, 4), 410.0);
-
-  EXPECT_EQ(text_at(7, 0), "South 集計");
-  EXPECT_TRUE(is_blank_at(7, 1));
-  EXPECT_EQ(number_at(7, 2), 200.0);
-  EXPECT_EQ(number_at(7, 3), 510.0);
-  EXPECT_EQ(number_at(7, 4), 710.0);
-
-  EXPECT_EQ(text_at(8, 0), "総計");
-  EXPECT_TRUE(is_blank_at(8, 1));
-  EXPECT_EQ(number_at(8, 2), 350.0);
-  EXPECT_EQ(number_at(8, 3), 620.0);
-  EXPECT_EQ(number_at(8, 4), 970.0);
-}
-
-TEST(PivotLayout, OutlineLayoutWidensToColumnFieldPivot) {
-  // Same shape as `TabularLayoutWidensToColumnFieldPivot`, but Outline:
-  // subtotal rows carry the bare parent label (no " 集計" suffix, since
-  // the row doubles as the parent group's own header) and leaf rows
-  // never repeat a parent value in its own column.
-  // `two_row_fields_by_column_field_outline` in the same golden file.
-  PivotCache cache = build_region_product_quarter_cache();
-  PivotTable table = build_region_product_by_quarter_table(PivotLayout::Outline);
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-
-  PivotLayoutOptions options = ja_jp_layout_options();
-  auto cells_or = layout(table, result_or.value(), options);
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message << " " << cells_or.error().context;
-  const PivotCells& cells = cells_or.value();
-
-  EXPECT_EQ(cells.rows, 9U);
-  EXPECT_EQ(cells.cols, 5U);
-
-  auto text_at = [&](std::uint32_t r, std::uint32_t c) -> std::string {
-    const PivotCell* cell = find_cell(cells, r, c);
-    if (cell == nullptr || !cell->value.is_text()) {
-      return "<missing>";
-    }
-    return std::string(cell->value.as_text());
-  };
-  auto number_at = [&](std::uint32_t r, std::uint32_t c) -> double {
-    const PivotCell* cell = find_cell(cells, r, c);
-    return cell != nullptr && cell->value.is_number() ? cell->value.as_number() : -1.0;
-  };
-  auto is_blank_at = [&](std::uint32_t r, std::uint32_t c) -> bool {
-    const PivotCell* cell = find_cell(cells, r, c);
-    return cell != nullptr && cell->value.is_blank();
-  };
-
-  EXPECT_EQ(text_at(0, 0), "合計 / Amount");
-  EXPECT_EQ(text_at(0, 2), "Quarter");
-  EXPECT_EQ(text_at(1, 0), "Region");
-  EXPECT_EQ(text_at(1, 1), "Product");
-  EXPECT_EQ(text_at(1, 2), "Q1");
-  EXPECT_EQ(text_at(1, 3), "Q2");
-  EXPECT_EQ(text_at(1, 4), "総計");
-
-  // North's subtotal row (bare label, no " 集計" suffix) precedes its
-  // leaf rows -- Outline's subtotal_top default.
-  EXPECT_EQ(text_at(2, 0), "North");
-  EXPECT_TRUE(is_blank_at(2, 1));
-  EXPECT_EQ(number_at(2, 2), 150.0);
-  EXPECT_EQ(number_at(2, 3), 110.0);
-  EXPECT_EQ(number_at(2, 4), 260.0);
-
-  EXPECT_TRUE(is_blank_at(3, 0));
-  EXPECT_EQ(text_at(3, 1), "Gadget");
-  EXPECT_EQ(number_at(3, 2), 50.0);
-  EXPECT_TRUE(is_blank_at(3, 3));
-  EXPECT_EQ(number_at(3, 4), 50.0);
-
-  EXPECT_TRUE(is_blank_at(4, 0));
-  EXPECT_EQ(text_at(4, 1), "Widget");
-  EXPECT_EQ(number_at(4, 2), 100.0);
-  EXPECT_EQ(number_at(4, 3), 110.0);
-  EXPECT_EQ(number_at(4, 4), 210.0);
-
-  EXPECT_EQ(text_at(5, 0), "South");
-  EXPECT_TRUE(is_blank_at(5, 1));
-  EXPECT_EQ(number_at(5, 2), 200.0);
-  EXPECT_EQ(number_at(5, 3), 510.0);
-  EXPECT_EQ(number_at(5, 4), 710.0);
-
-  EXPECT_TRUE(is_blank_at(6, 0));
-  EXPECT_EQ(text_at(6, 1), "Gadget");
-  EXPECT_TRUE(is_blank_at(6, 2));
-  EXPECT_EQ(number_at(6, 3), 300.0);
-  EXPECT_EQ(number_at(6, 4), 300.0);
-
-  EXPECT_TRUE(is_blank_at(7, 0));
-  EXPECT_EQ(text_at(7, 1), "Widget");
-  EXPECT_EQ(number_at(7, 2), 200.0);
-  EXPECT_EQ(number_at(7, 3), 210.0);
-  EXPECT_EQ(number_at(7, 4), 410.0);
-
-  EXPECT_EQ(text_at(8, 0), "総計");
-  EXPECT_TRUE(is_blank_at(8, 1));
-  EXPECT_EQ(number_at(8, 2), 350.0);
-  EXPECT_EQ(number_at(8, 3), 620.0);
-  EXPECT_EQ(number_at(8, 4), 970.0);
-}
-
-TEST(PivotLayout, TabularLayoutTwoColumnFieldsNamesOneColumnPerDepth) {
-  // Two fields on each axis (`two_row_fields_two_col_fields` in the same
-  // golden file). The extra header row above the column hierarchy
-  // names one column field per depth, at `data_left + depth` -- NOT
-  // aligned with how wide each level's own leaf group is (Quarter's
-  // name sits over Q1's group; Channel's sits one column to the
-  // right, not under Store/Web).
-  PivotCache cache;
-  cache.set_cache_id(5);
-  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Channel", {}});
-  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
-  auto add = [&](const char* region, const char* product, const char* quarter, const char* channel, double amount) {
-    PivotCacheRecord rec;
-    rec.cells.push_back(owned_text(cache, region));
-    rec.cells.push_back(owned_text(cache, product));
-    rec.cells.push_back(owned_text(cache, quarter));
-    rec.cells.push_back(owned_text(cache, channel));
-    rec.cells.push_back(Value::number(amount));
-    cache.mutable_records().push_back(std::move(rec));
-  };
-  add("North", "Widget", "Q1", "Web", 100.0);
-  add("North", "Widget", "Q2", "Store", 110.0);
-  add("North", "Gadget", "Q1", "Web", 50.0);
-  add("South", "Widget", "Q1", "Store", 200.0);
-  add("South", "Widget", "Q2", "Web", 210.0);
-  add("South", "Gadget", "Q2", "Store", 300.0);
-
-  PivotTable table;
-  table.set_pivot_cache_id(5);
-  table.set_anchor(0, 0, 1, 1);
-  table.set_layout(PivotLayout::Tabular);
-  PivotField region;
-  region.source_name = "Region";
-  region.axis = PivotAxis::Row;
-  PivotField product;
-  product.source_name = "Product";
-  product.axis = PivotAxis::Row;
-  PivotField quarter;
-  quarter.source_name = "Quarter";
-  quarter.axis = PivotAxis::Col;
-  PivotField channel;
-  channel.source_name = "Channel";
-  channel.axis = PivotAxis::Col;
-  PivotField amount;
-  amount.source_name = "Amount";
-  amount.axis = PivotAxis::Value;
-  table.mutable_fields().push_back(std::move(region));
-  table.mutable_fields().push_back(std::move(product));
-  table.mutable_fields().push_back(std::move(quarter));
-  table.mutable_fields().push_back(std::move(channel));
-  table.mutable_fields().push_back(std::move(amount));
-  table.mutable_row_field_order() = {0, 1};
-  table.mutable_col_field_order() = {2, 3};
-  PivotDataField sum_amount;
-  sum_amount.name = "合計 / Amount";
-  sum_amount.field_index = 4;
-  sum_amount.aggregation = Aggregation::Sum;
-  table.mutable_data_fields().push_back(std::move(sum_amount));
-
-  auto result_or = evaluate(table, cache);
-  ASSERT_TRUE(static_cast<bool>(result_or)) << result_or.error().message;
-
-  PivotLayoutOptions options = ja_jp_layout_options();
-  auto cells_or = layout(table, result_or.value(), options);
-  ASSERT_TRUE(static_cast<bool>(cells_or)) << cells_or.error().message << " " << cells_or.error().context;
-  const PivotCells& cells = cells_or.value();
-
-  EXPECT_EQ(cells.rows, 10U);
-  EXPECT_EQ(cells.cols, 9U);
-
-  auto text_at = [&](std::uint32_t r, std::uint32_t c) -> std::string {
-    const PivotCell* cell = find_cell(cells, r, c);
-    if (cell == nullptr || !cell->value.is_text()) {
-      return "<missing>";
-    }
-    return std::string(cell->value.as_text());
-  };
-  auto is_blank_at = [&](std::uint32_t r, std::uint32_t c) -> bool {
-    const PivotCell* cell = find_cell(cells, r, c);
-    return cell != nullptr && cell->value.is_blank();
-  };
-
-  // Row 0: data-field name, then "Quarter" / "Channel" at data_left/+1,
-  // everything else (including the rest of the row-header prefix)
-  // blank.
-  EXPECT_EQ(text_at(0, 0), "合計 / Amount");
-  EXPECT_TRUE(is_blank_at(0, 1));
-  EXPECT_EQ(text_at(0, 2), "Quarter");
-  EXPECT_EQ(text_at(0, 3), "Channel");
-  for (std::uint32_t c = 4; c <= 8; ++c) {
-    EXPECT_TRUE(is_blank_at(0, c)) << "col " << c;
-  }
-
-  // Row 1: Quarter's own leaf/subtotal labels (row-header columns
-  // blank -- this isn't the last col-header row).
-  EXPECT_TRUE(is_blank_at(1, 0));
-  EXPECT_TRUE(is_blank_at(1, 1));
-  EXPECT_EQ(text_at(1, 2), "Q1");
-  EXPECT_EQ(text_at(1, 4), "Q1 集計");
-  EXPECT_EQ(text_at(1, 5), "Q2");
-  EXPECT_EQ(text_at(1, 7), "Q2 集計");
-  EXPECT_EQ(text_at(1, 8), "総計");
-
-  // Row 2: Channel's own leaf labels, and the row-field names (this IS
-  // the last col-header row).
-  EXPECT_EQ(text_at(2, 0), "Region");
-  EXPECT_EQ(text_at(2, 1), "Product");
-  EXPECT_EQ(text_at(2, 2), "Store");
-  EXPECT_EQ(text_at(2, 3), "Web");
-  // The grand-total strip's own header sits beside "Q1 集計"/"Q2 集計"
-  // (row 1, the outermost column field's row), not beside the row-field
-  // names -- row 2's total-column cell stays blank.
-  EXPECT_TRUE(is_blank_at(2, 8));
-}
-
-TEST(PivotLayout, RejectsMismatchedResultShape) {
-  PivotTable table = build_table(/*row=*/{0}, /*col=*/{});
-  PivotResult result;
-  result.values.resize(2);  // row hierarchy is empty, so layout expects one implicit row leaf.
-
-  auto cells_or = layout(table, result);
-  ASSERT_FALSE(static_cast<bool>(cells_or));
-  EXPECT_EQ(cells_or.error().code, FormulonErrorCode::kEvalPivotInvalid);
-}
-
 }  // namespace
 }  // namespace formulon::pivot
diff --git a/tests/unit/pivot/pivot_layout_test_helpers.h b/tests/unit/pivot/pivot_layout_test_helpers.h
new file mode 100644
index 000000000..2f3b3130d
--- /dev/null
+++ b/tests/unit/pivot/pivot_layout_test_helpers.h
@@ -0,0 +1,154 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_layout.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
+#include "value.h"
+
+namespace formulon::pivot::layout_test {
+
+inline Value owned_text(PivotCache& cache, std::string s) {
+  cache.mutable_text_storage().push_back(std::move(s));
+  return Value::text(cache.text_storage().back());
+}
+
+inline PivotCache build_basic_cache() {
+  PivotCache cache;
+  cache.set_cache_id(1);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Product", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  auto add = [&](const char* region, const char* product, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(owned_text(cache, product));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+
+  add("North", "Widget", 100.0);
+  add("North", "Gadget", 50.0);
+  add("South", "Widget", 200.0);
+  add("South", "Gadget", 300.0);
+  add("North", "Widget", 25.0);
+  return cache;
+}
+
+inline PivotTable build_table(std::vector<std::uint32_t> row_fields, std::vector<std::uint32_t> col_fields) {
+  PivotTable table;
+  table.set_name("Pivot1");
+  table.set_pivot_cache_id(1);
+  table.set_anchor(2, 3, 1, 1);  // D3.
+
+  PivotField region;
+  region.source_name = "Region";
+  region.axis = PivotAxis::Row;
+  PivotField product;
+  product.source_name = "Product";
+  product.axis = PivotAxis::Col;
+  PivotField amount;
+  amount.source_name = "Amount";
+  amount.axis = PivotAxis::Value;
+
+  table.mutable_fields().push_back(std::move(region));
+  table.mutable_fields().push_back(std::move(product));
+  table.mutable_fields().push_back(std::move(amount));
+  table.mutable_row_field_order() = std::move(row_fields);
+  table.mutable_col_field_order() = std::move(col_fields);
+
+  PivotDataField sum_amount;
+  sum_amount.name = "Sum of Amount";
+  sum_amount.field_index = 2;
+  sum_amount.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum_amount));
+  return table;
+}
+
+inline PivotCache build_region_year_quarter_cache() {
+  PivotCache cache;
+  cache.set_cache_id(2);
+  cache.mutable_fields().push_back(PivotCacheField{"Region", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Year", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Quarter", {}});
+  cache.mutable_fields().push_back(PivotCacheField{"Amount", {}});
+
+  auto add = [&](const char* region, const char* year, const char* quarter, double amount) {
+    PivotCacheRecord rec;
+    rec.cells.push_back(owned_text(cache, region));
+    rec.cells.push_back(owned_text(cache, year));
+    rec.cells.push_back(owned_text(cache, quarter));
+    rec.cells.push_back(Value::number(amount));
+    cache.mutable_records().push_back(std::move(rec));
+  };
+
+  add("North", "2025", "Q1", 10.0);
+  add("North", "2025", "Q2", 20.0);
+  add("North", "2026", "Q1", 30.0);
+  add("South", "2025", "Q1", 40.0);
+  add("South", "2025", "Q2", 50.0);
+  add("South", "2026", "Q1", 60.0);
+  return cache;
+}
+
+inline PivotTable build_region_year_quarter_table() {
+  PivotTable table;
+  table.set_name("PivotMixed");
+  table.set_pivot_cache_id(2);
+  table.set_anchor(2, 3, 1, 1);
+
+  PivotField region;
+  region.source_name = "Region";
+  region.axis = PivotAxis::Row;
+  PivotField year;
+  year.source_name = "Year";
+  year.axis = PivotAxis::Col;
+  year.subtotal_top = true;
+  PivotField quarter;
+  quarter.source_name = "Quarter";
+  quarter.axis = PivotAxis::Col;
+  PivotField amount;
+  amount.source_name = "Amount";
+  amount.axis = PivotAxis::Value;
+
+  table.mutable_fields().push_back(std::move(region));
+  table.mutable_fields().push_back(std::move(year));
+  table.mutable_fields().push_back(std::move(quarter));
+  table.mutable_fields().push_back(std::move(amount));
+  table.mutable_row_field_order() = {0};
+  table.mutable_col_field_order() = {1, 2};
+  table.set_grand_totals(/*rows=*/false, /*cols=*/false);
+
+  PivotDataField sum_amount;
+  sum_amount.name = "Sum of Amount";
+  sum_amount.field_index = 3;
+  sum_amount.aggregation = Aggregation::Sum;
+  table.mutable_data_fields().push_back(std::move(sum_amount));
+  return table;
+}
+
+inline PivotLayoutOptions ja_jp_layout_options() {
+  PivotLayoutOptions options;
+  options.row_labels_label = "行ラベル";
+  options.column_labels_label = "列ラベル";
+  options.grand_total_label = "総計";
+  options.subtotal_suffix = " 集計";
+  return options;
+}
+
+inline const PivotCell* find_cell(const PivotCells& cells, std::uint32_t row, std::uint32_t col) {
+  for (const PivotCell& cell : cells.cells) {
+    if (cell.row == row && cell.col == col) {
+      return &cell;
+    }
+  }
+  return nullptr;
+}
+
+}  // namespace formulon::pivot::layout_test
diff --git a/tests/unit/print/pagination_detail_test.cpp b/tests/unit/print/pagination_detail_test.cpp
new file mode 100644
index 000000000..6e0dd670d
--- /dev/null
+++ b/tests/unit/print/pagination_detail_test.cpp
@@ -0,0 +1,211 @@
+#include <algorithm>
+#include <cstdint>
+#include <set>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "defined_name.h"
+#include "gtest/gtest.h"
+#include "io/ooxml/print_settings_parse.h"
+#include "print/page_setup.h"
+#include "print/pagination.h"
+#include "sheet.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace print {
+namespace {
+
+constexpr double kPointsPerMm = 72.0 / 25.4;
+
+DefinedName SheetName(std::string name, std::string formula) {
+  DefinedName dn;
+  dn.name = std::move(name);
+  dn.formula = std::move(formula);
+  dn.local_sheet_id = 0;
+  return dn;
+}
+
+// A4 portrait with 60-character columns and 300 pt rows: one column and two
+// rows fit per page, so an A1:D4 area is a 4-wide by 2-tall page grid.
+Workbook MakeGridWorkbook() {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  ColumnLayout span;
+  span.first = 0;
+  span.last = 3;
+  span.width = 60.0;
+  span.has_width = true;
+  sheet.mutable_layout().columns.push_back(span);
+  sheet.mutable_format_defaults().has_default_row_height = true;
+  sheet.mutable_format_defaults().default_row_height = 300.0;
+  wb.set_defined_names({SheetName("_xlnm.Print_Area", "Sheet1!$A$1:$D$4")});
+  return wb;
+}
+
+TEST(PaginationDetail, OverThenDownOrdersPages) {
+  Workbook wb = MakeGridWorkbook();
+  wb.sheet(0).mutable_print_settings().page_setup.page_order = PageOrder::kOverThenDown;
+  auto result = paginate(wb, 0);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  const PaginationResult& r = result.value();
+  EXPECT_EQ(r.page_order, PageOrder::kOverThenDown);
+  ASSERT_EQ(r.pages.size(), 8U);
+
+  // Rows 0-1 left to right, then rows 2-3 left to right.
+  for (std::uint32_t i = 0; i < 8U; ++i) {
+    EXPECT_EQ(r.pages[i].first_row, (i / 4U) * 2U) << i;
+    EXPECT_EQ(r.pages[i].first_col, i % 4U) << i;
+  }
+}
+
+TEST(PaginationDetail, DownThenOverIsTheDefaultOrder) {
+  Workbook wb = MakeGridWorkbook();
+  auto result = paginate(wb, 0);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  const PaginationResult& r = result.value();
+  EXPECT_EQ(r.page_order, PageOrder::kDownThenOver);
+  ASSERT_EQ(r.pages.size(), 8U);
+  for (std::uint32_t i = 0; i < 8U; ++i) {
+    EXPECT_EQ(r.pages[i].first_col, i / 2U) << i;
+    EXPECT_EQ(r.pages[i].first_row, (i % 2U) * 2U) << i;
+  }
+}
+
+TEST(PaginationDetail, PagesAgreeWithBreaks) {
+  Workbook wb = MakeGridWorkbook();
+  auto result = paginate(wb, 0);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  const PaginationResult& r = result.value();
+  ASSERT_EQ(r.pages.size(), r.page_count);
+
+  std::set<std::uint32_t> row_starts;
+  std::set<std::uint32_t> col_starts;
+  for (const PageLayout& page : r.pages) {
+    EXPECT_LE(page.first_row, page.last_row);
+    EXPECT_LE(page.first_col, page.last_col);
+    row_starts.insert(page.first_row);
+    col_starts.insert(page.first_col);
+  }
+  // Every page boundary after the first is a reported break, and vice versa.
+  row_starts.erase(row_starts.begin());
+  col_starts.erase(col_starts.begin());
+  EXPECT_EQ(std::vector<std::uint32_t>(row_starts.begin(), row_starts.end()), r.h_breaks);
+  EXPECT_EQ(std::vector<std::uint32_t>(col_starts.begin(), col_starts.end()), r.v_breaks);
+
+  // The pages tile the print area exactly.
+  std::uint32_t covered_rows = 0;
+  for (const PageLayout& page : r.pages) {
+    if (page.first_col == 0U) {
+      covered_rows += page.last_row - page.first_row + 1U;
+    }
+  }
+  EXPECT_EQ(covered_rows, 4U);
+  EXPECT_EQ(r.pages.back().last_row, 3U);
+  EXPECT_EQ(r.pages.back().last_col, 3U);
+}
+
+TEST(PaginationDetail, PageRectanglesStartAtTheMargins) {
+  Workbook wb = MakeGridWorkbook();
+  auto result = paginate(wb, 0);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  const PaginationResult& r = result.value();
+  const PageLayout& first = r.pages.front();
+  // Default margins: 0.7 in left, 0.75 in top.
+  EXPECT_DOUBLE_EQ(first.origin_x_pt, 0.7 * 72.0);
+  EXPECT_DOUBLE_EQ(first.origin_y_pt, 0.75 * 72.0);
+  EXPECT_DOUBLE_EQ(first.height_pt, 600.0);
+  EXPECT_DOUBLE_EQ(first.width_pt, 60.0 * 39.0 / 7.0 + 27.0 / 7.0);
+}
+
+TEST(PaginationDetail, ReportsPaperMarginsPrintableAndScale) {
+  Workbook wb = MakeGridWorkbook();
+  PageSetup& setup = wb.sheet(0).mutable_print_settings().page_setup;
+  setup.orientation = Orientation::kLandscape;
+  setup.scale = 50;
+  auto result = paginate(wb, 0);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  const PaginationResult& r = result.value();
+
+  EXPECT_TRUE(r.paper.landscape);
+  EXPECT_TRUE(r.paper.known);
+  EXPECT_NEAR(r.paper.width_pt, 297.0 * kPointsPerMm, 1e-9);
+  EXPECT_NEAR(r.paper.height_pt, 210.0 * kPointsPerMm, 1e-9);
+  EXPECT_DOUBLE_EQ(r.margins.left, 0.7 * 72.0);
+  EXPECT_DOUBLE_EQ(r.margins.top, 0.75 * 72.0);
+  EXPECT_DOUBLE_EQ(r.margins.header, 0.3 * 72.0);
+  EXPECT_DOUBLE_EQ(r.printable.x, r.margins.left);
+  EXPECT_DOUBLE_EQ(r.printable.y, r.margins.top);
+  EXPECT_NEAR(r.printable.width, 297.0 * kPointsPerMm - 2.0 * 0.7 * 72.0, 1e-9);
+  EXPECT_DOUBLE_EQ(r.scale, 0.5);
+}
+
+TEST(PaginationDetail, UnknownPaperCodeIsFlagged) {
+  Workbook wb = MakeGridWorkbook();
+  wb.sheet(0).mutable_print_settings().page_setup.paper_size = 9999;
+  auto result = paginate(wb, 0);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  EXPECT_FALSE(result.value().paper.known);
+  EXPECT_NEAR(result.value().paper.width_pt, 210.0 * kPointsPerMm, 1e-9);
+}
+
+TEST(PaginationDetail, ManualBreaksAreFlaggedPerBreak) {
+  Workbook wb = MakeGridWorkbook();
+  // Row 3 starts a new page even though it would fit after row 2's page.
+  ManualBreak brk;
+  brk.id = 1;
+  brk.manual = true;
+  wb.sheet(0).mutable_print_settings().manual_row_breaks.push_back(brk);
+  auto result = paginate(wb, 0);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  const PaginationResult& r = result.value();
+  ASSERT_EQ(r.h_break_manual.size(), r.h_breaks.size());
+  ASSERT_EQ(r.v_break_manual.size(), r.v_breaks.size());
+  for (std::size_t i = 0; i < r.h_breaks.size(); ++i) {
+    EXPECT_EQ(r.h_break_manual[i], r.h_breaks[i] == 1U) << i;
+  }
+  for (const bool manual : r.v_break_manual) {
+    EXPECT_FALSE(manual);
+  }
+  EXPECT_NE(std::find(r.h_breaks.begin(), r.h_breaks.end(), 1U), r.h_breaks.end());
+}
+
+TEST(PaginationDetail, PrintTitlesAndRepeatedOffsetsAreReported) {
+  Workbook wb = MakeGridWorkbook();
+  wb.set_defined_names({SheetName("_xlnm.Print_Area", "Sheet1!$A$1:$D$4"),
+                        SheetName("_xlnm.Print_Titles", "Sheet1!$A:$A,Sheet1!$1:$1")});
+  auto result = paginate(wb, 0);
+  ASSERT_TRUE(static_cast<bool>(result)) << result.error().message;
+  const PaginationResult& r = result.value();
+  EXPECT_TRUE(r.print_titles.has_rows);
+  EXPECT_EQ(r.print_titles.first_row, 0U);
+  EXPECT_EQ(r.print_titles.last_row, 0U);
+  EXPECT_TRUE(r.print_titles.has_cols);
+  EXPECT_EQ(r.print_titles.first_col, 0U);
+  EXPECT_EQ(r.print_titles.last_col, 0U);
+
+  // A page past the title row / column sits behind the reprinted titles;
+  // the first page holds them itself.
+  const PageLayout& first = r.pages.front();
+  EXPECT_DOUBLE_EQ(first.origin_x_pt, r.printable.x);
+  EXPECT_DOUBLE_EQ(first.origin_y_pt, r.printable.y);
+  const PageLayout& last = r.pages.back();
+  EXPECT_GT(last.origin_x_pt, r.printable.x);
+  EXPECT_GT(last.origin_y_pt, r.printable.y);
+}
+
+TEST(PaginationDetail, PageOrderParsesFromPageSetup) {
+  SheetPrintSettings settings;
+  EXPECT_EQ(settings.page_setup.page_order, PageOrder::kDownThenOver);
+  io::ooxml::refresh_structured_views("pageSetup", "<pageSetup orientation=\"landscape\" pageOrder=\"overThenDown\"/>",
+                                      settings);
+  EXPECT_EQ(settings.page_setup.page_order, PageOrder::kOverThenDown);
+  // A fragment that omits the attribute reverts to the schema default.
+  io::ooxml::refresh_structured_views("pageSetup", "<pageSetup paperSize=\"9\"/>", settings);
+  EXPECT_EQ(settings.page_setup.page_order, PageOrder::kDownThenOver);
+}
+
+}  // namespace
+}  // namespace print
+}  // namespace formulon
diff --git a/tests/unit/print/sheet_geometry_test.cpp b/tests/unit/print/sheet_geometry_test.cpp
new file mode 100644
index 000000000..c1c419657
--- /dev/null
+++ b/tests/unit/print/sheet_geometry_test.cpp
@@ -0,0 +1,190 @@
+#include "print/sheet_geometry.h"
+
+#include <cstdint>
+
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "styles.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace print {
+namespace {
+
+// Calibri 11 on Windows: display `Range.Width` at 96 DPI and the
+// print-layout figure the page-break captures agree with.
+constexpr double kDisplayMdw = 5.25;
+constexpr double kDisplayPad = 3.75;
+constexpr double kPrintMdw = 39.0 / 7.0;
+constexpr double kPrintPad = 27.0 / 7.0;
+constexpr double kStandardRowPt = 102.0 / 7.0;
+constexpr double kStandardColChars = 8.43;
+
+void SetNormalFont(Workbook* wb, const char* name, double size) {
+  FontRecord& font = wb->mutable_styles().fonts[0];
+  font.name = name;
+  font.size = size;
+}
+
+void AddColumn(Sheet* sheet, std::uint32_t first, std::uint32_t last, double width, bool hidden) {
+  ColumnLayout span;
+  span.first = first;
+  span.last = last;
+  span.width = width;
+  span.has_width = !hidden;
+  span.hidden = hidden;
+  sheet->mutable_layout().columns.push_back(span);
+}
+
+void AddRow(Sheet* sheet, std::uint32_t row, double height, bool hidden) {
+  RowLayout layout;
+  layout.row = row;
+  layout.height = height;
+  layout.has_height = !hidden;
+  layout.hidden = hidden;
+  sheet->mutable_layout().row_overrides.push_back(layout);
+}
+
+TEST(SheetGeometry, CalibriModelDiffersByMode) {
+  Workbook wb = Workbook::create();
+  const ColumnWidthModel display = resolve_column_width_model(wb.styles(), GeometryMode::kDisplay);
+  EXPECT_DOUBLE_EQ(display.points_per_char, kDisplayMdw);
+  EXPECT_DOUBLE_EQ(display.padding_pt, kDisplayPad);
+  EXPECT_TRUE(display.calibrated);
+  EXPECT_EQ(display.normal_font_name, "Calibri");
+  EXPECT_DOUBLE_EQ(display.normal_font_size, 11.0);
+  EXPECT_STREQ(display.platform, "win");
+
+  const ColumnWidthModel print = resolve_column_width_model(wb.styles(), GeometryMode::kPrint);
+  EXPECT_DOUBLE_EQ(print.points_per_char, kPrintMdw);
+  EXPECT_DOUBLE_EQ(print.padding_pt, kPrintPad);
+  EXPECT_TRUE(print.calibrated);
+}
+
+TEST(SheetGeometry, ThirtyCharColumnMatchesMeasuredWidths) {
+  Workbook wb = Workbook::create();
+  const ColumnWidthModel display = resolve_column_width_model(wb.styles(), GeometryMode::kDisplay);
+  const ColumnWidthModel print = resolve_column_width_model(wb.styles(), GeometryMode::kPrint);
+  // Measured Range.Width for a 30-character Calibri 11 column at 96 DPI.
+  EXPECT_DOUBLE_EQ(column_chars_to_points(30.0, display), 161.25);
+  // Print-layout figure, 1197/7.
+  EXPECT_DOUBLE_EQ(column_chars_to_points(30.0, print), 171.0);
+}
+
+TEST(SheetGeometry, ZeroCharsIsZeroPointsAndInverseRoundTrips) {
+  Workbook wb = Workbook::create();
+  const ColumnWidthModel model = resolve_column_width_model(wb.styles(), GeometryMode::kDisplay);
+  EXPECT_EQ(column_chars_to_points(0.0, model), 0.0);
+  EXPECT_EQ(column_points_to_chars(0.0, model), 0.0);
+  EXPECT_NEAR(column_points_to_chars(161.25, model), 30.0, 1e-12);
+}
+
+TEST(SheetGeometry, SampledFontSizesUseTheirOwnCalibration) {
+  Workbook wb = Workbook::create();
+  SetNormalFont(&wb, "游ゴシック", 11.0);
+  ColumnWidthModel model = resolve_column_width_model(wb.styles(), GeometryMode::kDisplay);
+  EXPECT_TRUE(model.calibrated);
+  EXPECT_DOUBLE_EQ(model.points_per_char, 6.0);
+  EXPECT_DOUBLE_EQ(model.padding_pt, 3.75);
+
+  SetNormalFont(&wb, "Calibri", 14.0);
+  model = resolve_column_width_model(wb.styles(), GeometryMode::kDisplay);
+  EXPECT_TRUE(model.calibrated);
+  EXPECT_DOUBLE_EQ(model.points_per_char, 7.5);
+  EXPECT_DOUBLE_EQ(model.padding_pt, 5.25);
+}
+
+TEST(SheetGeometry, UncalibratedFontReportsExtrapolated) {
+  Workbook wb = Workbook::create();
+  SetNormalFont(&wb, "Comic Sans MS", 11.0);
+  ColumnWidthModel model = resolve_column_width_model(wb.styles(), GeometryMode::kDisplay);
+  EXPECT_FALSE(model.calibrated);
+  EXPECT_EQ(model.normal_font_name, "Comic Sans MS");
+  // The Calibri 11 figure stands in for the unmeasured font.
+  EXPECT_DOUBLE_EQ(model.points_per_char, kDisplayMdw);
+  EXPECT_DOUBLE_EQ(model.padding_pt, kDisplayPad);
+
+  // A calibrated family at an unsampled size is extrapolated too.
+  SetNormalFont(&wb, "Calibri", 13.0);
+  model = resolve_column_width_model(wb.styles(), GeometryMode::kPrint);
+  EXPECT_FALSE(model.calibrated);
+  EXPECT_DOUBLE_EQ(model.points_per_char, kPrintMdw);
+}
+
+TEST(SheetGeometry, DefaultsFallBackToExcelStandards) {
+  Workbook wb = Workbook::create();
+  const Sheet& sheet = wb.sheet(0);
+  EXPECT_DOUBLE_EQ(default_column_width_chars(sheet), kStandardColChars);
+  EXPECT_DOUBLE_EQ(default_row_height_pt(sheet), kStandardRowPt);
+}
+
+TEST(SheetGeometry, SheetDefaultsOverrideStandards) {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  sheet.mutable_format_defaults().has_default_col_width = true;
+  sheet.mutable_format_defaults().default_col_width = 12.0;
+  sheet.mutable_format_defaults().has_default_row_height = true;
+  sheet.mutable_format_defaults().default_row_height = 20.0;
+  EXPECT_DOUBLE_EQ(effective_column_width_chars(sheet, 5), 12.0);
+  EXPECT_DOUBLE_EQ(effective_row_height_pt(sheet, 5), 20.0);
+}
+
+TEST(SheetGeometry, OverridesAndHiddenTracksShapeEffectiveSizes) {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  AddColumn(&sheet, 1, 1, 10.0, false);
+  AddColumn(&sheet, 2, 2, 0.0, true);
+  AddRow(&sheet, 1, 30.0, false);
+  AddRow(&sheet, 2, 0.0, true);
+
+  EXPECT_DOUBLE_EQ(effective_column_width_chars(sheet, 0), kStandardColChars);
+  EXPECT_DOUBLE_EQ(effective_column_width_chars(sheet, 1), 10.0);
+  EXPECT_DOUBLE_EQ(effective_column_width_chars(sheet, 2), 0.0);
+  EXPECT_DOUBLE_EQ(effective_row_height_pt(sheet, 0), kStandardRowPt);
+  EXPECT_DOUBLE_EQ(effective_row_height_pt(sheet, 1), 30.0);
+  EXPECT_DOUBLE_EQ(effective_row_height_pt(sheet, 2), 0.0);
+
+  const std::vector<double> widths = column_widths_chars(sheet, 0, 3);
+  ASSERT_EQ(widths.size(), 4U);
+  EXPECT_DOUBLE_EQ(widths[1], 10.0);
+  EXPECT_DOUBLE_EQ(widths[2], 0.0);
+  EXPECT_DOUBLE_EQ(widths[3], kStandardColChars);
+  const std::vector<double> heights = row_heights_pt(sheet, 1, 3);
+  ASSERT_EQ(heights.size(), 3U);
+  EXPECT_DOUBLE_EQ(heights[0], 30.0);
+  EXPECT_DOUBLE_EQ(heights[1], 0.0);
+  EXPECT_DOUBLE_EQ(heights[2], kStandardRowPt);
+}
+
+TEST(SheetGeometry, CellRectHasTopLeftOriginAndSkipsHiddenTracks) {
+  Workbook wb = Workbook::create();
+  Sheet& sheet = wb.sheet(0);
+  AddColumn(&sheet, 1, 1, 10.0, false);
+  AddColumn(&sheet, 2, 2, 0.0, true);
+  AddRow(&sheet, 1, 30.0, false);
+  AddRow(&sheet, 2, 0.0, true);
+  const ColumnWidthModel model = resolve_column_width_model(wb.styles(), GeometryMode::kDisplay);
+
+  const RectPt a1 = cell_rect_pt(sheet, 0, 0, model);
+  EXPECT_DOUBLE_EQ(a1.x, 0.0);
+  EXPECT_DOUBLE_EQ(a1.y, 0.0);
+  EXPECT_DOUBLE_EQ(a1.width, kStandardColChars * kDisplayMdw + kDisplayPad);
+  EXPECT_DOUBLE_EQ(a1.height, kStandardRowPt);
+
+  // D4: column C is hidden (zero width) and row 3 is hidden (zero height).
+  const RectPt d4 = cell_rect_pt(sheet, 3, 3, model);
+  const double col_a = kStandardColChars * kDisplayMdw + kDisplayPad;
+  const double col_b = 10.0 * kDisplayMdw + kDisplayPad;
+  EXPECT_DOUBLE_EQ(d4.x, col_a + col_b);
+  EXPECT_DOUBLE_EQ(d4.y, kStandardRowPt + 30.0);
+  EXPECT_DOUBLE_EQ(d4.width, col_a);
+  EXPECT_DOUBLE_EQ(d4.height, kStandardRowPt);
+
+  const RectPt hidden = cell_rect_pt(sheet, 2, 2, model);
+  EXPECT_DOUBLE_EQ(hidden.width, 0.0);
+  EXPECT_DOUBLE_EQ(hidden.height, 0.0);
+}
+
+}  // namespace
+}  // namespace print
+}  // namespace formulon
diff --git a/tests/unit/sheet_read_range_test.cpp b/tests/unit/sheet_read_range_test.cpp
new file mode 100644
index 000000000..09ff7c169
--- /dev/null
+++ b/tests/unit/sheet_read_range_test.cpp
@@ -0,0 +1,103 @@
+// Sheet range reads over literals, formulas, and spill phantoms.
+
+#include <algorithm>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "value.h"
+
+namespace formulon {
+namespace {
+TEST(SheetReadRange, MatchesResolveCellValueOverLiteralsAndGaps) {
+  Sheet s("Sheet1");
+  s.set_cell_value(1U, 1U, Value::number(1.0));
+  s.set_cell_value(1U, 3U, Value::number(2.0));
+  s.set_cell_value(3U, 2U, Value::text("x"));
+
+  Arena arena;
+  std::vector<Value> bulk;
+  std::vector<std::size_t> formula_indices;
+  s.read_range(0U, 4U, 0U, 4U, arena, bulk, formula_indices);
+
+  ASSERT_EQ(bulk.size(), 25U);
+  EXPECT_TRUE(formula_indices.empty());
+  std::size_t index = 0;
+  for (std::uint32_t row = 0; row <= 4U; ++row) {
+    for (std::uint32_t col = 0; col <= 4U; ++col, ++index) {
+      EXPECT_EQ(bulk[index], s.resolve_cell_value(row, col)) << "at (" << row << "," << col << ")";
+    }
+  }
+}
+TEST(SheetReadRange, SurfacesSpillPhantomValues) {
+  Sheet s("Sheet1");
+  std::vector<Value> cells = {Value::number(1.0), Value::number(2.0), Value::number(3.0)};
+  ASSERT_TRUE(s.commit_spill(0U, 0U, 3U, 1U, std::move(cells)));
+
+  Arena arena;
+  std::vector<Value> bulk;
+  std::vector<std::size_t> formula_indices;
+  s.read_range(0U, 2U, 0U, 0U, arena, bulk, formula_indices);
+
+  ASSERT_EQ(bulk.size(), 3U);
+  EXPECT_TRUE(formula_indices.empty());
+  EXPECT_EQ(bulk[0], Value::number(1.0));
+  EXPECT_EQ(bulk[1], Value::number(2.0));
+  EXPECT_EQ(bulk[2], Value::number(3.0));
+}
+TEST(SheetReadRange, ReportsFormulaCoordinatesInsteadOfEvaluatingThem) {
+  Sheet s("Sheet1");
+  s.set_cell_value(0U, 0U, Value::number(5.0));
+  s.set_cell_formula(0U, 1U, "=A1*2");
+
+  Arena arena;
+  std::vector<Value> bulk;
+  std::vector<std::size_t> formula_indices;
+  s.read_range(0U, 0U, 0U, 1U, arena, bulk, formula_indices);
+
+  ASSERT_EQ(bulk.size(), 2U);
+  ASSERT_EQ(formula_indices.size(), 1U);
+  EXPECT_EQ(formula_indices[0], 1U);
+  // The formula slot carries only its cached value; evaluation is the
+  // caller's job because it re-enters the sheet.
+  EXPECT_TRUE(bulk[1].is_blank());
+}
+TEST(SheetReadRange, AppendsToTheCallersBufferAndIndexesAbsolutely) {
+  Sheet s("Sheet1");
+  s.set_cell_formula(0U, 0U, "=1");
+
+  Arena arena;
+  std::vector<Value> bulk = {Value::number(99.0)};
+  std::vector<std::size_t> formula_indices;
+  s.read_range(0U, 0U, 0U, 0U, arena, bulk, formula_indices);
+
+  ASSERT_EQ(bulk.size(), 2U);
+  EXPECT_EQ(bulk[0], Value::number(99.0));
+  ASSERT_EQ(formula_indices.size(), 1U);
+  EXPECT_EQ(formula_indices[0], 1U);
+}
+TEST(SheetReadRange, ReversedOrOutOfRangeRectangleAppendsNothing) {
+  Sheet s("Sheet1");
+  s.set_cell_value(0U, 0U, Value::number(1.0));
+
+  Arena arena;
+  std::vector<Value> bulk;
+  std::vector<std::size_t> formula_indices;
+  s.read_range(2U, 1U, 0U, 0U, arena, bulk, formula_indices);
+  s.read_range(0U, 0U, 2U, 1U, arena, bulk, formula_indices);
+  s.read_range(0U, Sheet::kMaxRows, 0U, 0U, arena, bulk, formula_indices);
+  s.read_range(0U, 0U, 0U, Sheet::kMaxCols, arena, bulk, formula_indices);
+
+  EXPECT_TRUE(bulk.empty());
+  EXPECT_TRUE(formula_indices.empty());
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/sheet_spill_lifetime_test.cpp b/tests/unit/sheet_spill_lifetime_test.cpp
new file mode 100644
index 000000000..9d2fee872
--- /dev/null
+++ b/tests/unit/sheet_spill_lifetime_test.cpp
@@ -0,0 +1,99 @@
+// Sheet spill and range lifetime tests.
+
+#include <algorithm>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "value.h"
+
+namespace formulon {
+namespace {
+// Overwrites enough unrelated cells to make an allocator hand the freed bytes
+// out again, so a stale view is unlikely to still find its old contents.
+void ChurnTextAllocations(Sheet& sheet) {
+  for (std::uint32_t row = 100U; row < 200U; ++row) {
+    sheet.set_cell_text(row, 0U, "filler payload of about the same length as the original");
+  }
+}
+TEST(SheetReadRange, TextOutlivesTheWriteThatFreesTheCellsOwnBytes) {
+  Sheet s("Sheet1");
+  const std::string original = "a text payload long enough to live on the heap";
+  s.set_cell_text(0U, 0U, original);
+
+  Arena arena;
+  std::vector<Value> bulk;
+  std::vector<std::size_t> formula_indices;
+  s.read_range(0U, 0U, 0U, 0U, arena, bulk, formula_indices);
+  ASSERT_EQ(bulk.size(), 1U);
+  ASSERT_TRUE(bulk[0].is_text());
+
+  const Cell* cell = s.cell_at(0U, 0U);
+  ASSERT_NE(cell, nullptr);
+  ASSERT_NE(cell->cached_text_owned, nullptr);
+  EXPECT_NE(bulk[0].as_text().data(), cell->cached_text_owned->data())
+      << "the read handed back a view into the cell's own allocation";
+
+  // The next cached write replaces that allocation.
+  s.set_cell_cached_value(0U, 0U, Value::text("a replacement payload of a comparable length"));
+  ChurnTextAllocations(s);
+  EXPECT_EQ(bulk[0].as_text(), original);
+}
+TEST(SheetReadRange, TextOutlivesTheClearThatFreesTheSpillRegionsBytes) {
+  Sheet s("Sheet1");
+  const std::string original = "a spilled text payload long enough to live on the heap";
+  std::vector<Value> cells = {Value::number(1.0), Value::text(original)};
+  ASSERT_TRUE(s.commit_spill(0U, 0U, 2U, 1U, std::move(cells)));
+
+  Arena arena;
+  std::vector<Value> bulk;
+  std::vector<std::size_t> formula_indices;
+  s.read_range(0U, 1U, 0U, 0U, arena, bulk, formula_indices);
+  ASSERT_EQ(bulk.size(), 2U);
+  ASSERT_TRUE(bulk[1].is_text());
+
+  const SpillRegion* region = s.spill_region_at_anchor(0U, 0U);
+  ASSERT_NE(region, nullptr);
+  ASSERT_EQ(region->owned_strings.size(), 1U);
+  EXPECT_NE(bulk[1].as_text().data(), region->owned_strings.front().data())
+      << "the read handed back a view into the region's own storage";
+
+  s.clear_spill(0U, 0U);
+  ChurnTextAllocations(s);
+  EXPECT_EQ(bulk[1].as_text(), original);
+}
+TEST(SheetSpillTest, ReadSpillRegionAtAnchorOutlivesTheRegionItCopied) {
+  Sheet s("Sheet1");
+  const std::string original = "a spilled text payload long enough to live on the heap";
+  std::vector<Value> cells = {Value::number(1.0), Value::text(original)};
+  ASSERT_TRUE(s.commit_spill(0U, 0U, 2U, 1U, std::move(cells)));
+
+  Arena arena;
+  std::vector<Value> copied;
+  std::uint32_t rows = 0;
+  std::uint32_t cols = 0;
+  ASSERT_TRUE(s.read_spill_region_at_anchor(0U, 0U, arena, copied, &rows, &cols));
+  EXPECT_EQ(rows, 2U);
+  EXPECT_EQ(cols, 1U);
+  ASSERT_EQ(copied.size(), 2U);
+  EXPECT_EQ(copied[0], Value::number(1.0));
+  ASSERT_TRUE(copied[1].is_text());
+
+  s.clear_spill(0U, 0U);
+  ChurnTextAllocations(s);
+  EXPECT_EQ(copied[1].as_text(), original);
+
+  // A coordinate that anchors nothing appends nothing and says so.
+  EXPECT_FALSE(s.read_spill_region_at_anchor(9U, 9U, arena, copied, &rows, &cols));
+  EXPECT_EQ(copied.size(), 2U);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/sheet_spill_scale_test.cpp b/tests/unit/sheet_spill_scale_test.cpp
new file mode 100644
index 000000000..b8c8faae4
--- /dev/null
+++ b/tests/unit/sheet_spill_scale_test.cpp
@@ -0,0 +1,134 @@
+// Sheet spill cost-shape and population-count tests.
+
+#include <algorithm>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "value.h"
+
+namespace formulon {
+namespace {
+/// Fastest of `kTrials` runs of `work`, in nanoseconds.
+template <typename Fn>
+double FastestRunNanos(Fn&& work) {
+  constexpr int kTrials = 5;
+  double best = 0.0;
+  for (int trial = 0; trial < kTrials; ++trial) {
+    const auto start = std::chrono::steady_clock::now();
+    work();
+    const double elapsed = std::chrono::duration<double, std::nano>(std::chrono::steady_clock::now() - start).count();
+    if (trial == 0 || elapsed < best) {
+      best = elapsed;
+    }
+  }
+  return best;
+}
+
+/// How much slower the loaded shape may be before the cost is following the
+/// wrong quantity. The shapes below differ by two orders of magnitude in the
+/// quantity under test, so anything near 1 passes and a linear dependence
+/// fails by a wide margin — the gap is what keeps this from flaking.
+constexpr double kMaxCostRatio = 10.0;
+TEST(SheetReadRange, CostDoesNotFollowTheNumberOfSpillRegionsOnTheSheet) {
+  // A rectangle of empty cells, read on two sheets that differ only in how
+  // many spill regions sit far away from it. Consulting the spill table per
+  // coordinate makes the second sheet hundreds of times slower for a result
+  // that is identical.
+  constexpr std::uint32_t kLastRow = 199U;
+  constexpr std::uint32_t kLastCol = 99U;
+  constexpr std::uint32_t kManyRegions = 400U;
+
+  const auto build = [](std::uint32_t regions) {
+    Sheet sheet("Sheet1");
+    for (std::uint32_t i = 0; i < regions; ++i) {
+      // Parked well below and to the right of the read rectangle.
+      EXPECT_TRUE(sheet.commit_spill(1000U + i, 500U, 1U, 1U, {Value::number(i)}));
+    }
+    return sheet;
+  };
+  Sheet few = build(1U);
+  Sheet many = build(kManyRegions);
+
+  const auto read = [&](Sheet& sheet) {
+    return [&sheet]() {
+      Arena arena;
+      std::vector<Value> out;
+      std::vector<std::size_t> formula_indices;
+      sheet.read_range(0U, kLastRow, 0U, kLastCol, arena, out, formula_indices);
+      EXPECT_EQ(out.size(), static_cast<std::size_t>(kLastRow + 1U) * (kLastCol + 1U));
+    };
+  };
+
+  const double one_region = FastestRunNanos(read(few));
+  const double many_regions = FastestRunNanos(read(many));
+  EXPECT_LT(many_regions, one_region * kMaxCostRatio)
+      << "read_range cost follows the spill-table size: " << one_region << "ns with one region, " << many_regions
+      << "ns with " << kManyRegions;
+}
+TEST(SheetSpillTest, CellCountDoesNotFollowTheSpillArea) {
+  // A spill is one rectangle with one payload, so counting the coordinates it
+  // covers is arithmetic. Walking them instead puts a lookup per spilled cell
+  // under the sheet lock, which a whole-column spill turns into a million.
+  constexpr std::uint32_t kSmallSide = 4U;
+  constexpr std::uint32_t kLargeSide = 400U;
+
+  const auto build = [](std::uint32_t side) {
+    Sheet sheet("Sheet1");
+    std::vector<Value> cells;
+    cells.reserve(static_cast<std::size_t>(side) * side);
+    for (std::size_t i = 0; i < static_cast<std::size_t>(side) * side; ++i) {
+      cells.push_back(Value::number(static_cast<double>(i)));
+    }
+    EXPECT_TRUE(sheet.commit_spill(0U, 0U, side, side, std::move(cells)));
+    return sheet;
+  };
+  Sheet small = build(kSmallSide);
+  Sheet large = build(kLargeSide);
+
+  EXPECT_EQ(small.cell_count(), static_cast<std::size_t>(kSmallSide) * kSmallSide);
+  EXPECT_EQ(large.cell_count(), static_cast<std::size_t>(kLargeSide) * kLargeSide);
+
+  const auto count = [](Sheet& sheet) {
+    return [&sheet]() {
+      for (int i = 0; i < 20; ++i) {
+        EXPECT_GT(sheet.cell_count(), 0U);
+      }
+    };
+  };
+
+  const double small_area = FastestRunNanos(count(small));
+  const double large_area = FastestRunNanos(count(large));
+  EXPECT_LT(large_area, small_area * kMaxCostRatio)
+      << "cell_count cost follows the spill area: " << small_area << "ns over " << kSmallSide * kSmallSide << " cells, "
+      << large_area << "ns over " << kLargeSide * kLargeSide;
+}
+TEST(SheetSpillTest, CellCountKeepsCountingPhantomsThatShareAMaterialisedSlot) {
+  Sheet s("Sheet1");
+  // Writing A1 and then E1 materialises the whole run A1..E1, three of them
+  // implicitly blank. A spill over A1:C1 then covers slots that the stored
+  // count already includes.
+  s.set_cell_value(0U, 0U, Value::blank());
+  s.set_cell_value(0U, 4U, Value::number(9.0));
+  ASSERT_EQ(s.cell_count(), 5U);
+  ASSERT_TRUE(s.commit_spill(0U, 0U, 1U, 3U, {Value::number(1.0), Value::number(2.0), Value::number(3.0)}));
+  EXPECT_EQ(s.cell_count(), 5U) << "phantoms that coincide with materialised slots must not be counted twice";
+
+  // A spill running past the end of the row's materialised run adds only the
+  // coordinates that are not already slots.
+  Sheet t("Sheet1");
+  ASSERT_TRUE(t.commit_spill(
+      0U, 0U, 1U, 5U,
+      {Value::number(1.0), Value::number(2.0), Value::number(3.0), Value::number(4.0), Value::number(5.0)}));
+  EXPECT_EQ(t.cell_count(), 5U);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/sheet_spill_test.cpp b/tests/unit/sheet_spill_test.cpp
index fa354b428..f3de2530d 100644
--- a/tests/unit/sheet_spill_test.cpp
+++ b/tests/unit/sheet_spill_test.cpp
@@ -1,9 +1,4 @@
-//
-// Unit tests for the cell-level dynamic-array spill API on `Sheet`. The
-// tests cover registration, collision detection, deep-copy semantics for
-// Text payloads, eager invalidation when phantom cells are written, and
-// the contract that `cell_at` remains spill-blind while
-// `resolve_cell_value` is the spill-aware reader.
+// Sheet spill registration, collision, validation, and probing tests.
 
 #include <algorithm>
 #include <chrono>
@@ -21,11 +16,6 @@
 
 namespace formulon {
 namespace {
-
-// ---------------------------------------------------------------------------
-// Basic registration and read-back
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, CommitThreeByOneSucceedsAndExposesValues) {
   Sheet s("Sheet1");
   std::vector<Value> cells = {Value::number(10.0), Value::number(20.0), Value::number(30.0)};
@@ -55,7 +45,6 @@ TEST(SheetSpillTest, CommitThreeByOneSucceedsAndExposesValues) {
   EXPECT_NE(s.spill_region_covering(1U, 0U), nullptr);
   EXPECT_NE(s.spill_region_covering(2U, 0U), nullptr);
 }
-
 TEST(SheetSpillTest, CommittedSpillFootprintSnapshotExcludesBlockedRecords) {
   Sheet s("Sheet1");
   ASSERT_TRUE(s.commit_spill(4U, 5U, 2U, 3U,
@@ -73,7 +62,6 @@ TEST(SheetSpillTest, CommittedSpillFootprintSnapshotExcludesBlockedRecords) {
   EXPECT_EQ(footprints[0].cols, 3U);
   ASSERT_EQ(s.blocked_spill_footprints().size(), 1U);
 }
-
 TEST(SheetSpillTest, CommitTwoByThreeRowMajorOrderingMatches) {
   Sheet s("Sheet1");
   // 2x3 matrix:
@@ -90,7 +78,6 @@ TEST(SheetSpillTest, CommitTwoByThreeRowMajorOrderingMatches) {
   EXPECT_EQ(s.resolve_cell_value(6U, 8U), Value::number(5.0));
   EXPECT_EQ(s.resolve_cell_value(6U, 9U), Value::number(6.0));
 }
-
 TEST(SheetSpillTest, LargeSpillFindsFarPhantomWithoutPerCellReverseIndex) {
   Sheet s("Sheet1");
   constexpr std::uint32_t kRows = 1000U;
@@ -107,11 +94,6 @@ TEST(SheetSpillTest, LargeSpillFindsFarPhantomWithoutPerCellReverseIndex) {
   s.clear_spill(10U, 20U);
   EXPECT_EQ(s.spill_region_covering(10U + kRows - 1U, 20U + kCols - 1U), nullptr);
 }
-
-// ---------------------------------------------------------------------------
-// clear_spill
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, ClearSpillRemovesRegionAndRevertsResolveToBlank) {
   Sheet s("Sheet1");
   std::vector<Value> cells = {Value::number(1.0), Value::number(2.0), Value::number(3.0)};
@@ -134,7 +116,6 @@ TEST(SheetSpillTest, ClearSpillRemovesRegionAndRevertsResolveToBlank) {
   EXPECT_EQ(s.resolve_cell_value(1U, 0U), Value::blank());
   EXPECT_EQ(s.resolve_cell_value(2U, 0U), Value::blank());
 }
-
 TEST(SheetSpillTest, ClearSpillIsNoOpWhenNothingAnchored) {
   Sheet s("Sheet1");
   // Should not crash and should not allocate the lazy table.
@@ -142,11 +123,6 @@ TEST(SheetSpillTest, ClearSpillIsNoOpWhenNothingAnchored) {
   s.clear_spill(99U, 99U);
   EXPECT_EQ(s.spill_region_at_anchor(0U, 0U), nullptr);
 }
-
-// ---------------------------------------------------------------------------
-// Collision: literal cell in the footprint
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, CollidingWithExistingLiteralReturnsFalseAndSurfacesSpill) {
   Sheet s("Sheet1");
   // Plant a literal at A2 (row 1, col 0). Then try to spill A1:A3 over it.
@@ -171,7 +147,6 @@ TEST(SheetSpillTest, CollidingWithExistingLiteralReturnsFalseAndSurfacesSpill) {
   ASSERT_TRUE(literal->cached_value.is_number());
   EXPECT_EQ(literal->cached_value.as_number(), 7.0);
 }
-
 TEST(SheetSpillTest, CollidingWithExistingFormulaReturnsFalseAndSurfacesSpill) {
   Sheet s("Sheet1");
   s.set_cell_formula(1U, 0U, "=A1+1");
@@ -188,11 +163,6 @@ TEST(SheetSpillTest, CollidingWithExistingFormulaReturnsFalseAndSurfacesSpill) {
   ASSERT_NE(formula, nullptr);
   EXPECT_EQ(formula->formula_text, "=A1+1");
 }
-
-// ---------------------------------------------------------------------------
-// Collision: overlap with another spill's phantom
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, CollidingWithAnotherSpillsPhantomReturnsFalse) {
   Sheet s("Sheet1");
   // First spill: anchor B1 (row 0, col 1), 3x1 — phantoms at B2, B3.
@@ -214,7 +184,6 @@ TEST(SheetSpillTest, CollidingWithAnotherSpillsPhantomReturnsFalse) {
   EXPECT_NE(s.spill_region_at_anchor(0U, 1U), nullptr);
   EXPECT_EQ(s.resolve_cell_value(1U, 1U), Value::number(2.0));
 }
-
 TEST(SheetSpillTest, SpillWouldCollideTreatsForeignPhantomAsBlocker) {
   Sheet s("Sheet1");
   ASSERT_TRUE(s.commit_spill(0U, 0U, 2U, 1U, {Value::number(1.0), Value::number(2.0)}));
@@ -225,7 +194,6 @@ TEST(SheetSpillTest, SpillWouldCollideTreatsForeignPhantomAsBlocker) {
   EXPECT_NE(s.spill_region_at_anchor(0U, 0U), nullptr);
   EXPECT_EQ(s.resolve_cell_value(1U, 0U), Value::number(2.0));
 }
-
 TEST(SheetSpillTest, SpillWouldCollideIgnoresCurrentAnchorSpill) {
   Sheet s("Sheet1");
   ASSERT_TRUE(s.commit_spill(0U, 0U, 2U, 1U, {Value::number(1.0), Value::number(2.0)}));
@@ -234,7 +202,6 @@ TEST(SheetSpillTest, SpillWouldCollideIgnoresCurrentAnchorSpill) {
   // spill without reporting that spill as a foreign blocker.
   EXPECT_FALSE(s.spill_would_collide(0U, 0U, 3U, 1U));
 }
-
 TEST(SheetSpillTest, MergedRangeBlocksSpillAndPreservesMetadata) {
   Sheet s("Sheet1");
   s.set_cell_formula(0U, 0U, "=SEQUENCE(3,3)");
@@ -257,7 +224,6 @@ TEST(SheetSpillTest, MergedRangeBlocksSpillAndPreservesMetadata) {
   EXPECT_EQ(s.merges()[0].first_row, 1U);
   EXPECT_EQ(s.merges()[0].last_col, 2U);
 }
-
 TEST(SheetSpillTest, MergeAtAnchorBlocksVerticalSpill) {
   Sheet s("Sheet1");
   s.set_cell_formula(0U, 0U, "=SEQUENCE(2,1)");
@@ -281,7 +247,6 @@ TEST(SheetSpillTest, MergeAtAnchorBlocksVerticalSpill) {
   EXPECT_EQ(s.merges()[0].last_row, 0U);
   EXPECT_EQ(s.merges()[0].last_col, 1U);
 }
-
 TEST(SheetSpillTest, SpillWouldCollideRejectsMalformedFootprints) {
   Sheet s("Sheet1");
   EXPECT_TRUE(s.spill_would_collide(0U, 0U, 0U, 1U));
@@ -291,11 +256,6 @@ TEST(SheetSpillTest, SpillWouldCollideRejectsMalformedFootprints) {
   EXPECT_TRUE(s.spill_would_collide(Sheet::kMaxRows - 1U, 0U, 2U, 1U));
   EXPECT_TRUE(s.spill_would_collide(0U, Sheet::kMaxCols - 1U, 1U, 2U));
 }
-
-// ---------------------------------------------------------------------------
-// Text deep-copy
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, TextValuesAreDeepCopiedAndOutliveSourceVector) {
   Sheet s("Sheet1");
   // Build the source string in scoped storage so its address is recycled
@@ -319,11 +279,6 @@ TEST(SheetSpillTest, TextValuesAreDeepCopiedAndOutliveSourceVector) {
   ASSERT_TRUE(v_phantom.is_text());
   EXPECT_EQ(v_phantom.as_text(), "beta");
 }
-
-// ---------------------------------------------------------------------------
-// Degenerate 1x1 region
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, OneByOneRegionHasNoPhantoms) {
   Sheet s("Sheet1");
   std::vector<Value> cells = {Value::number(42.0)};
@@ -343,11 +298,6 @@ TEST(SheetSpillTest, OneByOneRegionHasNoPhantoms) {
   EXPECT_EQ(s.spill_region_covering(3U, 5U), nullptr);
   EXPECT_EQ(s.spill_region_covering(4U, 4U), nullptr);
 }
-
-// ---------------------------------------------------------------------------
-// Eager invalidation
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, WriteToPhantomEagerlyClearsSpill) {
   Sheet s("Sheet1");
   std::vector<Value> cells = {Value::number(1.0), Value::number(2.0), Value::number(3.0)};
@@ -366,7 +316,6 @@ TEST(SheetSpillTest, WriteToPhantomEagerlyClearsSpill) {
   // A3 (previously phantom, now uncovered and unset) is back to blank.
   EXPECT_EQ(s.resolve_cell_value(2U, 0U), Value::blank());
 }
-
 TEST(SheetSpillTest, FormulaWriteToPhantomEagerlyClearsSpill) {
   Sheet s("Sheet1");
   std::vector<Value> cells = {Value::number(1.0), Value::number(2.0), Value::number(3.0)};
@@ -379,7 +328,6 @@ TEST(SheetSpillTest, FormulaWriteToPhantomEagerlyClearsSpill) {
   ASSERT_NE(phantom, nullptr);
   EXPECT_EQ(phantom->formula_text, "=B1");
 }
-
 TEST(SheetSpillTest, WriteToAnchorEagerlyClearsSpill) {
   // Replacing a dynamic-array formula with a literal invalidates the entire
   // former spill footprint, just like a direct write to one of its phantoms.
@@ -397,11 +345,6 @@ TEST(SheetSpillTest, WriteToAnchorEagerlyClearsSpill) {
   EXPECT_EQ(anchor->cached_value, Value::number(500.0));
   EXPECT_TRUE(s.resolve_cell_value(1U, 0U).is_blank());
 }
-
-// ---------------------------------------------------------------------------
-// Idempotent re-registration
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, CommitOverExistingAnchorClearsOldRegionFirst) {
   Sheet s("Sheet1");
   std::vector<Value> first = {Value::number(1.0), Value::number(2.0), Value::number(3.0)};
@@ -424,110 +367,6 @@ TEST(SheetSpillTest, CommitOverExistingAnchorClearsOldRegionFirst) {
   EXPECT_EQ(s.spill_region_covering(2U, 0U), nullptr);
   EXPECT_EQ(s.resolve_cell_value(2U, 0U), Value::blank());
 }
-
-// ---------------------------------------------------------------------------
-// Bounds and shape rejection
-// ---------------------------------------------------------------------------
-
-// `commit_spill` validates shape and footprint via `assert(false)` followed
-// by a `return false` safety net. In debug builds the assert fires first; in
-// release builds (NDEBUG) the safety net is the only barrier. Cover both.
-#if defined(NDEBUG)
-
-TEST(SheetSpillTest, ZeroRowsOrZeroColsIsRejected) {
-  Sheet s("Sheet1");
-  EXPECT_FALSE(s.commit_spill(0U, 0U, 0U, 1U, std::vector<Value>{}));
-  EXPECT_FALSE(s.commit_spill(0U, 0U, 1U, 0U, std::vector<Value>{}));
-  EXPECT_EQ(s.spill_region_at_anchor(0U, 0U), nullptr);
-}
-
-TEST(SheetSpillTest, MismatchedCellsLengthIsRejected) {
-  Sheet s("Sheet1");
-  std::vector<Value> wrong_size = {Value::number(1.0), Value::number(2.0)};  // expected 3
-  EXPECT_FALSE(s.commit_spill(0U, 0U, 3U, 1U, std::move(wrong_size)));
-  EXPECT_EQ(s.spill_region_at_anchor(0U, 0U), nullptr);
-}
-
-TEST(SheetSpillTest, FootprintOverTheDynamicArrayCellCeilingIsRejected) {
-  Sheet s("Sheet1");
-  // A whole-column rectangle is 1,048,576 cells and commits. A hundred of
-  // them side by side is past the ceiling the evaluator's array allocator
-  // applies, and the sheet refuses it on its own rather than trusting the
-  // caller to have checked.
-  //
-  // This asserts the refusal, not which check produced it: a payload
-  // matching a shape that large cannot be built in a test, so the refusal
-  // here is indistinguishable from the payload-length one. The assertion
-  // that separates them is the death test below, which matches the message,
-  // and it is the debug build that runs it.
-  EXPECT_TRUE(s.commit_spill(0U, 0U, Sheet::kMaxRows, 1U, std::vector<Value>(Sheet::kMaxRows, Value::number(1.0))));
-  EXPECT_FALSE(s.commit_spill(0U, 1U, Sheet::kMaxRows, 100U, std::vector<Value>{}));
-  EXPECT_EQ(s.spill_region_at_anchor(0U, 1U), nullptr);
-  // Nor is the refusal recorded as a blocked footprint to retry: the shape
-  // can never become admissible, so there is nothing for the release path
-  // to wake up.
-  EXPECT_TRUE(s.blocked_spill_footprints().empty());
-}
-
-TEST(SheetSpillTest, FootprintOverflowingSheetBoundsIsRejected) {
-  Sheet s("Sheet1");
-  // Anchor at the last row, height 2 — footprint extends past kMaxRows.
-  std::vector<Value> cells = {Value::number(1.0), Value::number(2.0)};
-  EXPECT_FALSE(s.commit_spill(Sheet::kMaxRows - 1U, 0U, 2U, 1U, std::move(cells)));
-  EXPECT_EQ(s.spill_region_at_anchor(Sheet::kMaxRows - 1U, 0U), nullptr);
-
-  // Anchor at the last column, width 2 — footprint extends past kMaxCols.
-  std::vector<Value> cells2 = {Value::number(1.0), Value::number(2.0)};
-  EXPECT_FALSE(s.commit_spill(0U, Sheet::kMaxCols - 1U, 1U, 2U, std::move(cells2)));
-  EXPECT_EQ(s.spill_region_at_anchor(0U, Sheet::kMaxCols - 1U), nullptr);
-}
-
-#elif GTEST_HAS_DEATH_TEST
-
-TEST(SheetSpillDeathTest, ZeroRowsAborts) {
-  Sheet s("Sheet1");
-  EXPECT_DEATH(s.commit_spill(0U, 0U, 0U, 1U, std::vector<Value>{}), "zero-sized spill region");
-}
-
-TEST(SheetSpillDeathTest, ZeroColsAborts) {
-  Sheet s("Sheet1");
-  EXPECT_DEATH(s.commit_spill(0U, 0U, 1U, 0U, std::vector<Value>{}), "zero-sized spill region");
-}
-
-TEST(SheetSpillDeathTest, MismatchedCellsLengthAborts) {
-  Sheet s("Sheet1");
-  std::vector<Value> wrong_size = {Value::number(1.0), Value::number(2.0)};
-  EXPECT_DEATH(s.commit_spill(0U, 0U, 3U, 1U, std::move(wrong_size)), "does not match");
-}
-
-TEST(SheetSpillDeathTest, FootprintOverTheDynamicArrayCellCeilingAborts) {
-  Sheet s("Sheet1");
-  EXPECT_DEATH(s.commit_spill(0U, 0U, Sheet::kMaxRows, 100U, std::vector<Value>{}),
-               "exceeds the dynamic-array cell ceiling");
-}
-
-TEST(SheetSpillDeathTest, FootprintOverflowsRowsAborts) {
-  Sheet s("Sheet1");
-  std::vector<Value> cells = {Value::number(1.0), Value::number(2.0)};
-  EXPECT_DEATH(s.commit_spill(Sheet::kMaxRows - 1U, 0U, 2U, 1U, std::move(cells)), "footprint exceeds sheet bounds");
-}
-
-TEST(SheetSpillDeathTest, FootprintOverflowsColsAborts) {
-  Sheet s("Sheet1");
-  std::vector<Value> cells = {Value::number(1.0), Value::number(2.0)};
-  EXPECT_DEATH(s.commit_spill(0U, Sheet::kMaxCols - 1U, 1U, 2U, std::move(cells)), "footprint exceeds sheet bounds");
-}
-
-#endif  // NDEBUG / GTEST_HAS_DEATH_TEST
-
-// ---------------------------------------------------------------------------
-// cell_at remains spill-blind
-// ---------------------------------------------------------------------------
-
-// ---------------------------------------------------------------------------
-// Phantom enumeration (cell_count / spill_phantom_addresses)
-// ---------------------------------------------------------------------------
-
 TEST(SheetSpillTest, SpillPhantomAddressesListsPhantomsExcludingAnchor) {
   Sheet s("Sheet1");
   // Anchor D1 (row 0, col 3), 3x1 spill: phantoms at D2 (1,3) and D3 (2,3).
@@ -543,13 +382,11 @@ TEST(SheetSpillTest, SpillPhantomAddressesListsPhantomsExcludingAnchor) {
   EXPECT_EQ(phantoms[1].row, 2U);
   EXPECT_EQ(phantoms[1].col, 3U);
 }
-
 TEST(SheetSpillTest, SpillPhantomAddressesIsEmptyWithoutRegions) {
   Sheet s("Sheet1");
   s.set_cell_value(0U, 0U, Value::number(1.0));
   EXPECT_TRUE(s.spill_phantom_addresses().empty());
 }
-
 TEST(SheetSpillTest, CellCountIncludesPhantomsWithoutStoredSlots) {
   Sheet s("Sheet1");
   // Anchor D1 (row 0, col 3), 3x1 spill. The row's run starts at column D, so
@@ -560,7 +397,6 @@ TEST(SheetSpillTest, CellCountIncludesPhantomsWithoutStoredSlots) {
 
   EXPECT_EQ(s.cell_count(), 1U + 2U);
 }
-
 TEST(SheetSpillTest, CellCountDoesNotDoubleCountPhantomOverImplicitSlot) {
   Sheet s("Sheet1");
   // Spill D1:D3 (phantoms at D2, D3), then populate D2 and F2 in row 1. The
@@ -577,7 +413,6 @@ TEST(SheetSpillTest, CellCountDoesNotDoubleCountPhantomOverImplicitSlot) {
   // row 0: 1 slot (D1), row 1: 3 slots (D2..F2), phantom D3 (row 2): +1.
   EXPECT_EQ(s.cell_count(), 1U + 3U + 1U);
 }
-
 TEST(SheetSpillTest, CellAtIsUnchangedForPhantomCoordinates) {
   Sheet s("Sheet1");
   std::vector<Value> cells = {Value::number(1.0), Value::number(2.0), Value::number(3.0)};
@@ -593,7 +428,6 @@ TEST(SheetSpillTest, CellAtIsUnchangedForPhantomCoordinates) {
   EXPECT_EQ(s.resolve_cell_value(1U, 0U), Value::number(2.0));
   EXPECT_EQ(s.resolve_cell_value(2U, 0U), Value::number(3.0));
 }
-
 TEST(SheetSpillTest, PopulatedExtentUnifiesStoredCellsAndCommittedSpills) {
   Sheet s("Sheet1");
   s.set_cell_value(10U, 2U, Value::number(7.0));
@@ -619,7 +453,6 @@ TEST(SheetSpillTest, PopulatedExtentUnifiesStoredCellsAndCommittedSpills) {
   const auto empty = s.populated_extent(0U, 0U, 9U, 1U);
   EXPECT_FALSE(empty.has_value());
 }
-
 TEST(SheetSpillTest, PopulatedExtentExcludesBlockedSpillFootprints) {
   Sheet s("Sheet1");
   s.set_cell_formula(0U, 0U, "=SEQUENCE(1,3)");
@@ -630,339 +463,11 @@ TEST(SheetSpillTest, PopulatedExtentExcludesBlockedSpillFootprints) {
   // blank middle coordinate is not populated content.
   EXPECT_FALSE(s.populated_extent(0U, 1U, 0U, 1U).has_value());
 }
-
-// ---------------------------------------------------------------------------
-// Bulk range reads
-// ---------------------------------------------------------------------------
-//
-// `read_range` exists to take the sheet lock once for a whole rectangle
-// instead of twice per cell. These tests pin it against the per-coordinate
-// readers it replaces, because the two must not drift.
-
-TEST(SheetReadRange, MatchesResolveCellValueOverLiteralsAndGaps) {
-  Sheet s("Sheet1");
-  s.set_cell_value(1U, 1U, Value::number(1.0));
-  s.set_cell_value(1U, 3U, Value::number(2.0));
-  s.set_cell_value(3U, 2U, Value::text("x"));
-
-  Arena arena;
-  std::vector<Value> bulk;
-  std::vector<std::size_t> formula_indices;
-  s.read_range(0U, 4U, 0U, 4U, arena, bulk, formula_indices);
-
-  ASSERT_EQ(bulk.size(), 25U);
-  EXPECT_TRUE(formula_indices.empty());
-  std::size_t index = 0;
-  for (std::uint32_t row = 0; row <= 4U; ++row) {
-    for (std::uint32_t col = 0; col <= 4U; ++col, ++index) {
-      EXPECT_EQ(bulk[index], s.resolve_cell_value(row, col)) << "at (" << row << "," << col << ")";
-    }
-  }
-}
-
-TEST(SheetReadRange, SurfacesSpillPhantomValues) {
-  Sheet s("Sheet1");
-  std::vector<Value> cells = {Value::number(1.0), Value::number(2.0), Value::number(3.0)};
-  ASSERT_TRUE(s.commit_spill(0U, 0U, 3U, 1U, std::move(cells)));
-
-  Arena arena;
-  std::vector<Value> bulk;
-  std::vector<std::size_t> formula_indices;
-  s.read_range(0U, 2U, 0U, 0U, arena, bulk, formula_indices);
-
-  ASSERT_EQ(bulk.size(), 3U);
-  EXPECT_TRUE(formula_indices.empty());
-  EXPECT_EQ(bulk[0], Value::number(1.0));
-  EXPECT_EQ(bulk[1], Value::number(2.0));
-  EXPECT_EQ(bulk[2], Value::number(3.0));
-}
-
-TEST(SheetReadRange, ReportsFormulaCoordinatesInsteadOfEvaluatingThem) {
-  Sheet s("Sheet1");
-  s.set_cell_value(0U, 0U, Value::number(5.0));
-  s.set_cell_formula(0U, 1U, "=A1*2");
-
-  Arena arena;
-  std::vector<Value> bulk;
-  std::vector<std::size_t> formula_indices;
-  s.read_range(0U, 0U, 0U, 1U, arena, bulk, formula_indices);
-
-  ASSERT_EQ(bulk.size(), 2U);
-  ASSERT_EQ(formula_indices.size(), 1U);
-  EXPECT_EQ(formula_indices[0], 1U);
-  // The formula slot carries only its cached value; evaluation is the
-  // caller's job because it re-enters the sheet.
-  EXPECT_TRUE(bulk[1].is_blank());
-}
-
-TEST(SheetReadRange, AppendsToTheCallersBufferAndIndexesAbsolutely) {
-  Sheet s("Sheet1");
-  s.set_cell_formula(0U, 0U, "=1");
-
-  Arena arena;
-  std::vector<Value> bulk = {Value::number(99.0)};
-  std::vector<std::size_t> formula_indices;
-  s.read_range(0U, 0U, 0U, 0U, arena, bulk, formula_indices);
-
-  ASSERT_EQ(bulk.size(), 2U);
-  EXPECT_EQ(bulk[0], Value::number(99.0));
-  ASSERT_EQ(formula_indices.size(), 1U);
-  EXPECT_EQ(formula_indices[0], 1U);
-}
-
-TEST(SheetReadRange, ReversedOrOutOfRangeRectangleAppendsNothing) {
-  Sheet s("Sheet1");
-  s.set_cell_value(0U, 0U, Value::number(1.0));
-
-  Arena arena;
-  std::vector<Value> bulk;
-  std::vector<std::size_t> formula_indices;
-  s.read_range(2U, 1U, 0U, 0U, arena, bulk, formula_indices);
-  s.read_range(0U, 0U, 2U, 1U, arena, bulk, formula_indices);
-  s.read_range(0U, Sheet::kMaxRows, 0U, 0U, arena, bulk, formula_indices);
-  s.read_range(0U, 0U, 0U, Sheet::kMaxCols, arena, bulk, formula_indices);
-
-  EXPECT_TRUE(bulk.empty());
-  EXPECT_TRUE(formula_indices.empty());
-}
-
-// ---------------------------------------------------------------------------
-// Text lifetime across the reads that copy values out of the sheet
-// ---------------------------------------------------------------------------
-//
-// A Text `Value` is a view, and inside the sheet it views bytes the sheet
-// owns and frees. A copy handed to a caller therefore has to be re-pointed at
-// storage the caller controls before the lock is released; otherwise the copy
-// looks self-contained while depending on a sheet mutation not happening.
-// These tests assert both halves: the read does not alias sheet storage, and
-// the value it produced still reads correctly after the mutation that frees
-// what it came from.
-
-// Overwrites enough unrelated cells to make an allocator hand the freed bytes
-// out again, so a stale view is unlikely to still find its old contents.
-void ChurnTextAllocations(Sheet& sheet) {
-  for (std::uint32_t row = 100U; row < 200U; ++row) {
-    sheet.set_cell_text(row, 0U, "filler payload of about the same length as the original");
-  }
-}
-
-TEST(SheetReadRange, TextOutlivesTheWriteThatFreesTheCellsOwnBytes) {
-  Sheet s("Sheet1");
-  const std::string original = "a text payload long enough to live on the heap";
-  s.set_cell_text(0U, 0U, original);
-
-  Arena arena;
-  std::vector<Value> bulk;
-  std::vector<std::size_t> formula_indices;
-  s.read_range(0U, 0U, 0U, 0U, arena, bulk, formula_indices);
-  ASSERT_EQ(bulk.size(), 1U);
-  ASSERT_TRUE(bulk[0].is_text());
-
-  const Cell* cell = s.cell_at(0U, 0U);
-  ASSERT_NE(cell, nullptr);
-  ASSERT_NE(cell->cached_text_owned, nullptr);
-  EXPECT_NE(bulk[0].as_text().data(), cell->cached_text_owned->data())
-      << "the read handed back a view into the cell's own allocation";
-
-  // The next cached write replaces that allocation.
-  s.set_cell_cached_value(0U, 0U, Value::text("a replacement payload of a comparable length"));
-  ChurnTextAllocations(s);
-  EXPECT_EQ(bulk[0].as_text(), original);
-}
-
-TEST(SheetReadRange, TextOutlivesTheClearThatFreesTheSpillRegionsBytes) {
-  Sheet s("Sheet1");
-  const std::string original = "a spilled text payload long enough to live on the heap";
-  std::vector<Value> cells = {Value::number(1.0), Value::text(original)};
-  ASSERT_TRUE(s.commit_spill(0U, 0U, 2U, 1U, std::move(cells)));
-
-  Arena arena;
-  std::vector<Value> bulk;
-  std::vector<std::size_t> formula_indices;
-  s.read_range(0U, 1U, 0U, 0U, arena, bulk, formula_indices);
-  ASSERT_EQ(bulk.size(), 2U);
-  ASSERT_TRUE(bulk[1].is_text());
-
-  const SpillRegion* region = s.spill_region_at_anchor(0U, 0U);
-  ASSERT_NE(region, nullptr);
-  ASSERT_EQ(region->owned_strings.size(), 1U);
-  EXPECT_NE(bulk[1].as_text().data(), region->owned_strings.front().data())
-      << "the read handed back a view into the region's own storage";
-
-  s.clear_spill(0U, 0U);
-  ChurnTextAllocations(s);
-  EXPECT_EQ(bulk[1].as_text(), original);
-}
-
-TEST(SheetSpillTest, ReadSpillRegionAtAnchorOutlivesTheRegionItCopied) {
-  Sheet s("Sheet1");
-  const std::string original = "a spilled text payload long enough to live on the heap";
-  std::vector<Value> cells = {Value::number(1.0), Value::text(original)};
-  ASSERT_TRUE(s.commit_spill(0U, 0U, 2U, 1U, std::move(cells)));
-
-  Arena arena;
-  std::vector<Value> copied;
-  std::uint32_t rows = 0;
-  std::uint32_t cols = 0;
-  ASSERT_TRUE(s.read_spill_region_at_anchor(0U, 0U, arena, copied, &rows, &cols));
-  EXPECT_EQ(rows, 2U);
-  EXPECT_EQ(cols, 1U);
-  ASSERT_EQ(copied.size(), 2U);
-  EXPECT_EQ(copied[0], Value::number(1.0));
-  ASSERT_TRUE(copied[1].is_text());
-
-  s.clear_spill(0U, 0U);
-  ChurnTextAllocations(s);
-  EXPECT_EQ(copied[1].as_text(), original);
-
-  // A coordinate that anchors nothing appends nothing and says so.
-  EXPECT_FALSE(s.read_spill_region_at_anchor(9U, 9U, arena, copied, &rows, &cols));
-  EXPECT_EQ(copied.size(), 2U);
-}
-
-// ---------------------------------------------------------------------------
-// Cost characteristics
-// ---------------------------------------------------------------------------
-//
-// Both of these are about the shape of the work, not its duration, so they
-// compare two shapes against each other rather than against a clock. An
-// absolute bound would only say how loaded the machine is; a ratio says
-// whether the cost follows the thing it must not follow. Each shape is timed
-// several times and the fastest run is kept, which is the measurement least
-// disturbed by whatever else is running.
-
-/// Fastest of `kTrials` runs of `work`, in nanoseconds.
-template <typename Fn>
-double FastestRunNanos(Fn&& work) {
-  constexpr int kTrials = 5;
-  double best = 0.0;
-  for (int trial = 0; trial < kTrials; ++trial) {
-    const auto start = std::chrono::steady_clock::now();
-    work();
-    const double elapsed = std::chrono::duration<double, std::nano>(std::chrono::steady_clock::now() - start).count();
-    if (trial == 0 || elapsed < best) {
-      best = elapsed;
-    }
-  }
-  return best;
-}
-
-/// How much slower the loaded shape may be before the cost is following the
-/// wrong quantity. The shapes below differ by two orders of magnitude in the
-/// quantity under test, so anything near 1 passes and a linear dependence
-/// fails by a wide margin — the gap is what keeps this from flaking.
-constexpr double kMaxCostRatio = 10.0;
-
-TEST(SheetReadRange, CostDoesNotFollowTheNumberOfSpillRegionsOnTheSheet) {
-  // A rectangle of empty cells, read on two sheets that differ only in how
-  // many spill regions sit far away from it. Consulting the spill table per
-  // coordinate makes the second sheet hundreds of times slower for a result
-  // that is identical.
-  constexpr std::uint32_t kLastRow = 199U;
-  constexpr std::uint32_t kLastCol = 99U;
-  constexpr std::uint32_t kManyRegions = 400U;
-
-  const auto build = [](std::uint32_t regions) {
-    Sheet sheet("Sheet1");
-    for (std::uint32_t i = 0; i < regions; ++i) {
-      // Parked well below and to the right of the read rectangle.
-      EXPECT_TRUE(sheet.commit_spill(1000U + i, 500U, 1U, 1U, {Value::number(i)}));
-    }
-    return sheet;
-  };
-  Sheet few = build(1U);
-  Sheet many = build(kManyRegions);
-
-  const auto read = [&](Sheet& sheet) {
-    return [&sheet]() {
-      Arena arena;
-      std::vector<Value> out;
-      std::vector<std::size_t> formula_indices;
-      sheet.read_range(0U, kLastRow, 0U, kLastCol, arena, out, formula_indices);
-      EXPECT_EQ(out.size(), static_cast<std::size_t>(kLastRow + 1U) * (kLastCol + 1U));
-    };
-  };
-
-  const double one_region = FastestRunNanos(read(few));
-  const double many_regions = FastestRunNanos(read(many));
-  EXPECT_LT(many_regions, one_region * kMaxCostRatio)
-      << "read_range cost follows the spill-table size: " << one_region << "ns with one region, " << many_regions
-      << "ns with " << kManyRegions;
-}
-
-TEST(SheetSpillTest, CellCountDoesNotFollowTheSpillArea) {
-  // A spill is one rectangle with one payload, so counting the coordinates it
-  // covers is arithmetic. Walking them instead puts a lookup per spilled cell
-  // under the sheet lock, which a whole-column spill turns into a million.
-  constexpr std::uint32_t kSmallSide = 4U;
-  constexpr std::uint32_t kLargeSide = 400U;
-
-  const auto build = [](std::uint32_t side) {
-    Sheet sheet("Sheet1");
-    std::vector<Value> cells;
-    cells.reserve(static_cast<std::size_t>(side) * side);
-    for (std::size_t i = 0; i < static_cast<std::size_t>(side) * side; ++i) {
-      cells.push_back(Value::number(static_cast<double>(i)));
-    }
-    EXPECT_TRUE(sheet.commit_spill(0U, 0U, side, side, std::move(cells)));
-    return sheet;
-  };
-  Sheet small = build(kSmallSide);
-  Sheet large = build(kLargeSide);
-
-  EXPECT_EQ(small.cell_count(), static_cast<std::size_t>(kSmallSide) * kSmallSide);
-  EXPECT_EQ(large.cell_count(), static_cast<std::size_t>(kLargeSide) * kLargeSide);
-
-  const auto count = [](Sheet& sheet) {
-    return [&sheet]() {
-      for (int i = 0; i < 20; ++i) {
-        EXPECT_GT(sheet.cell_count(), 0U);
-      }
-    };
-  };
-
-  const double small_area = FastestRunNanos(count(small));
-  const double large_area = FastestRunNanos(count(large));
-  EXPECT_LT(large_area, small_area * kMaxCostRatio)
-      << "cell_count cost follows the spill area: " << small_area << "ns over " << kSmallSide * kSmallSide << " cells, "
-      << large_area << "ns over " << kLargeSide * kLargeSide;
-}
-
-TEST(SheetSpillTest, CellCountKeepsCountingPhantomsThatShareAMaterialisedSlot) {
-  Sheet s("Sheet1");
-  // Writing A1 and then E1 materialises the whole run A1..E1, three of them
-  // implicitly blank. A spill over A1:C1 then covers slots that the stored
-  // count already includes.
-  s.set_cell_value(0U, 0U, Value::blank());
-  s.set_cell_value(0U, 4U, Value::number(9.0));
-  ASSERT_EQ(s.cell_count(), 5U);
-  ASSERT_TRUE(s.commit_spill(0U, 0U, 1U, 3U, {Value::number(1.0), Value::number(2.0), Value::number(3.0)}));
-  EXPECT_EQ(s.cell_count(), 5U) << "phantoms that coincide with materialised slots must not be counted twice";
-
-  // A spill running past the end of the row's materialised run adds only the
-  // coordinates that are not already slots.
-  Sheet t("Sheet1");
-  ASSERT_TRUE(t.commit_spill(
-      0U, 0U, 1U, 5U,
-      {Value::number(1.0), Value::number(2.0), Value::number(3.0), Value::number(4.0), Value::number(5.0)}));
-  EXPECT_EQ(t.cell_count(), 5U);
-}
-
-// ---------------------------------------------------------------------------
-// Admission probing without materialising the footprint
-// ---------------------------------------------------------------------------
-//
-// A producer whose result would be refused should learn that before building
-// it. For a footprint the size of a grid axis the difference is 1,048,576
-// cells against a handful, so these tests pin both the verdict and the work
-// it took to reach it.
-
 TEST(SheetSpillTest, ProbeAcceptsAClearFootprint) {
   Sheet s("Sheet1");
   s.set_cell_value(0U, 0U, Value::number(1.0));
   EXPECT_EQ(s.probe_spill_footprint(0U, 25U, 4U, 2U), Sheet::SpillAdmission::kAdmissible);
 }
-
 TEST(SheetSpillTest, ProbeReportsAFootprintThatLeavesTheGrid) {
   Sheet s("Sheet1");
   // A whole-column rectangle only fits when it starts at row 1; one row down
@@ -976,7 +481,6 @@ TEST(SheetSpillTest, ProbeReportsAFootprintThatLeavesTheGrid) {
   EXPECT_EQ(s.probe_spill_footprint(0U, 0U, 0U, 1U), Sheet::SpillAdmission::kOutsideGrid);
   EXPECT_EQ(s.probe_spill_footprint(0U, 0U, 1U, 0U), Sheet::SpillAdmission::kOutsideGrid);
 }
-
 TEST(SheetSpillTest, ProbeFindsABlockerFarOutsideThePopulatedData) {
   Sheet s("Sheet1");
   // Three cells of data at the top of column A, and one unrelated cell 500
@@ -996,7 +500,6 @@ TEST(SheetSpillTest, ProbeFindsABlockerFarOutsideThePopulatedData) {
   // work by what the sheet stores, well under the 1,048,576-cell rectangle.
   EXPECT_LE(steps, 8U) << "admission scan must follow the stored cells, not the rectangle's area";
 }
-
 TEST(SheetSpillTest, ProbeRefusesAFullWidthRectangleOnABlockedRow) {
   Sheet s("Sheet1");
   s.set_cell_value(2U, 0U, Value::number(3.0));
@@ -1014,7 +517,6 @@ TEST(SheetSpillTest, ProbeRefusesAFullWidthRectangleOnABlockedRow) {
   // because it reads like coverage. The bound that does discriminate is in
   // `ProbeFindsABlockerFarOutsideThePopulatedData`.
 }
-
 TEST(SheetSpillTest, WouldCollideIsTheProbeVerdictInBooleanForm) {
   // The two refusal paths must agree on every input, which they do by both
   // being the same body. Pin that over a sheet carrying each kind of blocker
@@ -1046,7 +548,6 @@ TEST(SheetSpillTest, WouldCollideIsTheProbeVerdictInBooleanForm) {
         << "at (" << shape.anchor_row << "," << shape.anchor_col << ") " << shape.rows << "x" << shape.cols;
   }
 }
-
 TEST(SheetSpillTest, ProbeLeavesTheSheetUnchanged) {
   Sheet s("Sheet1");
   s.set_cell_value(499U, 25U, Value::number(7.0));
@@ -1062,7 +563,6 @@ TEST(SheetSpillTest, ProbeLeavesTheSheetUnchanged) {
   EXPECT_EQ(s.cell_enumeration_revision(), revision_before);
   EXPECT_EQ(s.spill_region_at_anchor(0U, 25U), nullptr);
 }
-
 TEST(SheetSpillTest, RejectRecordsTheFootprintTheReleasePathRetries) {
   Sheet s("Sheet1");
   s.set_cell_value(499U, 25U, Value::number(7.0));
@@ -1082,7 +582,6 @@ TEST(SheetSpillTest, RejectRecordsTheFootprintTheReleasePathRetries) {
   EXPECT_EQ(blocked[0].rows, Sheet::kMaxRows);
   EXPECT_EQ(blocked[0].cols, 1U);
 }
-
 TEST(SheetSpillTest, CommitRefusalRecordsTheSameFootprintAsAnExplicitReject) {
   // `commit_spill` and a caller that probes first and refuses on its own must
   // leave the sheet in the same state, or the two paths drift.
@@ -1106,5 +605,65 @@ TEST(SheetSpillTest, CommitRefusalRecordsTheSameFootprintAsAnExplicitReject) {
   EXPECT_EQ(s.resolve_cell_value(0U, 0U), other.resolve_cell_value(0U, 0U));
 }
 
+// Point and footprint queries go through a row-band index; they must agree
+// with a brute-force scan of the committed rectangles across band edges, a
+// region too tall to index, and regions cleared after commit.
+TEST(SheetSpillTest, IndexedSpillQueriesMatchBruteForceScan) {
+  Sheet s("Sheet1");
+  const auto commit = [&s](std::uint32_t row, std::uint32_t col, std::uint32_t rows, std::uint32_t cols) {
+    return s.commit_spill(row, col, rows, cols, std::vector<Value>(std::size_t{rows} * cols, Value::number(1.0)));
+  };
+  ASSERT_TRUE(commit(60U, 0U, 10U, 2U));    // crosses the first band edge
+  ASSERT_TRUE(commit(127U, 3U, 2U, 1U));    // crosses the second
+  ASSERT_TRUE(commit(0U, 10U, 5000U, 1U));  // taller than the indexed span
+  ASSERT_TRUE(commit(300U, 0U, 1U, 1U));
+  ASSERT_TRUE(commit(400U, 5U, 3U, 3U));
+  s.clear_spill(300U, 0U);
+  s.clear_spill(127U, 3U);
+
+  const std::vector<SpillFootprint> regions = s.committed_spill_footprints();
+  ASSERT_EQ(regions.size(), 3U);
+  const auto intersects = [](const SpillFootprint& f, std::uint32_t row, std::uint32_t col, std::uint32_t rows,
+                             std::uint32_t cols) {
+    return f.anchor_row < std::uint64_t{row} + rows && row < std::uint64_t{f.anchor_row} + f.rows &&
+           f.anchor_col < std::uint64_t{col} + cols && col < std::uint64_t{f.anchor_col} + f.cols;
+  };
+  for (std::uint32_t row = 0U; row < 520U; ++row) {
+    for (std::uint32_t col = 0U; col < 12U; ++col) {
+      const SpillFootprint* expected = nullptr;
+      for (const SpillFootprint& f : regions) {
+        if (intersects(f, row, col, 1U, 1U)) {
+          expected = &f;
+        }
+      }
+      const auto covering = s.committed_spill_footprint_covering(row, col);
+      ASSERT_EQ(covering.has_value(), expected != nullptr) << row << "," << col;
+      if (expected != nullptr) {
+        EXPECT_EQ(covering->anchor_row, expected->anchor_row);
+        EXPECT_EQ(covering->anchor_col, expected->anchor_col);
+        const bool is_anchor = row == expected->anchor_row && col == expected->anchor_col;
+        EXPECT_EQ(s.spill_region_covering(row, col) != nullptr, !is_anchor) << row << "," << col;
+      } else {
+        EXPECT_EQ(s.spill_region_covering(row, col), nullptr) << row << "," << col;
+      }
+      for (const std::uint32_t extent : {1U, 3U, 70U}) {
+        // A cleared region leaves its anchor's cached value stored, which still blocks.
+        bool collides = false;
+        for (const SpillFootprint& cleared : {SpillFootprint{300U, 0U, 1U, 1U}, SpillFootprint{127U, 3U, 1U, 1U}}) {
+          const Cell* stored = s.cell_at(cleared.anchor_row, cleared.anchor_col);
+          const bool own = cleared.anchor_row == row && cleared.anchor_col == col;
+          collides = collides || (!own && stored != nullptr && !stored->cached_value.is_blank() &&
+                                  intersects(cleared, row, col, extent, 2U));
+        }
+        for (const SpillFootprint& f : regions) {
+          const bool own = f.anchor_row == row && f.anchor_col == col;
+          collides = collides || (!own && intersects(f, row, col, extent, 2U));
+        }
+        EXPECT_EQ(s.spill_would_collide(row, col, extent, 2U), collides) << row << "," << col << " x" << extent;
+      }
+    }
+  }
+}
+
 }  // namespace
 }  // namespace formulon
diff --git a/tests/unit/sheet_spill_validation_test.cpp b/tests/unit/sheet_spill_validation_test.cpp
new file mode 100644
index 000000000..076348065
--- /dev/null
+++ b/tests/unit/sheet_spill_validation_test.cpp
@@ -0,0 +1,98 @@
+// Sheet spill shape validation and death tests.
+
+#include <algorithm>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "cell.h"
+#include "gtest/gtest.h"
+#include "sheet.h"
+#include "utils/arena.h"
+#include "value.h"
+
+namespace formulon {
+namespace {
+// Bounds and shape rejection are assertion-based in debug builds and
+// return-false checks in release builds; retain both paths exactly.
+#if defined(NDEBUG)
+TEST(SheetSpillTest, ZeroRowsOrZeroColsIsRejected) {
+  Sheet s("Sheet1");
+  EXPECT_FALSE(s.commit_spill(0U, 0U, 0U, 1U, std::vector<Value>{}));
+  EXPECT_FALSE(s.commit_spill(0U, 0U, 1U, 0U, std::vector<Value>{}));
+  EXPECT_EQ(s.spill_region_at_anchor(0U, 0U), nullptr);
+}
+TEST(SheetSpillTest, MismatchedCellsLengthIsRejected) {
+  Sheet s("Sheet1");
+  std::vector<Value> wrong_size = {Value::number(1.0), Value::number(2.0)};  // expected 3
+  EXPECT_FALSE(s.commit_spill(0U, 0U, 3U, 1U, std::move(wrong_size)));
+  EXPECT_EQ(s.spill_region_at_anchor(0U, 0U), nullptr);
+}
+TEST(SheetSpillTest, FootprintOverTheDynamicArrayCellCeilingIsRejected) {
+  Sheet s("Sheet1");
+  // A whole-column rectangle is 1,048,576 cells and commits. A hundred of
+  // them side by side is past the ceiling the evaluator's array allocator
+  // applies, and the sheet refuses it on its own rather than trusting the
+  // caller to have checked.
+  //
+  // This asserts the refusal, not which check produced it: a payload
+  // matching a shape that large cannot be built in a test, so the refusal
+  // here is indistinguishable from the payload-length one. The assertion
+  // that separates them is the death test below, which matches the message,
+  // and it is the debug build that runs it.
+  EXPECT_TRUE(s.commit_spill(0U, 0U, Sheet::kMaxRows, 1U, std::vector<Value>(Sheet::kMaxRows, Value::number(1.0))));
+  EXPECT_FALSE(s.commit_spill(0U, 1U, Sheet::kMaxRows, 100U, std::vector<Value>{}));
+  EXPECT_EQ(s.spill_region_at_anchor(0U, 1U), nullptr);
+  // Nor is the refusal recorded as a blocked footprint to retry: the shape
+  // can never become admissible, so there is nothing for the release path
+  // to wake up.
+  EXPECT_TRUE(s.blocked_spill_footprints().empty());
+}
+TEST(SheetSpillTest, FootprintOverflowingSheetBoundsIsRejected) {
+  Sheet s("Sheet1");
+  // Anchor at the last row, height 2 — footprint extends past kMaxRows.
+  std::vector<Value> cells = {Value::number(1.0), Value::number(2.0)};
+  EXPECT_FALSE(s.commit_spill(Sheet::kMaxRows - 1U, 0U, 2U, 1U, std::move(cells)));
+  EXPECT_EQ(s.spill_region_at_anchor(Sheet::kMaxRows - 1U, 0U), nullptr);
+
+  // Anchor at the last column, width 2 — footprint extends past kMaxCols.
+  std::vector<Value> cells2 = {Value::number(1.0), Value::number(2.0)};
+  EXPECT_FALSE(s.commit_spill(0U, Sheet::kMaxCols - 1U, 1U, 2U, std::move(cells2)));
+  EXPECT_EQ(s.spill_region_at_anchor(0U, Sheet::kMaxCols - 1U), nullptr);
+}
+#elif GTEST_HAS_DEATH_TEST
+TEST(SheetSpillDeathTest, ZeroRowsAborts) {
+  Sheet s("Sheet1");
+  EXPECT_DEATH(s.commit_spill(0U, 0U, 0U, 1U, std::vector<Value>{}), "zero-sized spill region");
+}
+TEST(SheetSpillDeathTest, ZeroColsAborts) {
+  Sheet s("Sheet1");
+  EXPECT_DEATH(s.commit_spill(0U, 0U, 1U, 0U, std::vector<Value>{}), "zero-sized spill region");
+}
+TEST(SheetSpillDeathTest, MismatchedCellsLengthAborts) {
+  Sheet s("Sheet1");
+  std::vector<Value> wrong_size = {Value::number(1.0), Value::number(2.0)};
+  EXPECT_DEATH(s.commit_spill(0U, 0U, 3U, 1U, std::move(wrong_size)), "does not match");
+}
+TEST(SheetSpillDeathTest, FootprintOverTheDynamicArrayCellCeilingAborts) {
+  Sheet s("Sheet1");
+  EXPECT_DEATH(s.commit_spill(0U, 0U, Sheet::kMaxRows, 100U, std::vector<Value>{}),
+               "exceeds the dynamic-array cell ceiling");
+}
+TEST(SheetSpillDeathTest, FootprintOverflowsRowsAborts) {
+  Sheet s("Sheet1");
+  std::vector<Value> cells = {Value::number(1.0), Value::number(2.0)};
+  EXPECT_DEATH(s.commit_spill(Sheet::kMaxRows - 1U, 0U, 2U, 1U, std::move(cells)), "footprint exceeds sheet bounds");
+}
+TEST(SheetSpillDeathTest, FootprintOverflowsColsAborts) {
+  Sheet s("Sheet1");
+  std::vector<Value> cells = {Value::number(1.0), Value::number(2.0)};
+  EXPECT_DEATH(s.commit_spill(0U, Sheet::kMaxCols - 1U, 1U, 2U, std::move(cells)), "footprint exceeds sheet bounds");
+}
+#endif  // NDEBUG / GTEST_HAS_DEATH_TEST
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/sheet_test.cpp b/tests/unit/sheet_test.cpp
index d7e9fd6d9..33c282d6f 100644
--- a/tests/unit/sheet_test.cpp
+++ b/tests/unit/sheet_test.cpp
@@ -166,6 +166,44 @@ TEST(SheetTest, StructuralEditsShiftPivotAnchorOnBothAxes) {
   EXPECT_EQ(s.pivot_tables()[0]->anchor_col(), 9U);
 }
 
+TEST(SheetTest, StructuralEditsKeepPivotSpansInsideGridAtEdges) {
+  for (const bool rows : {false, true}) {
+    SCOPED_TRACE(rows ? "rows" : "columns");
+    Sheet s("Sheet1");
+    const std::uint32_t bound = rows ? Sheet::kMaxRows : Sheet::kMaxCols;
+    const std::uint32_t insert_at = bound - 3U;
+
+    auto near_edge = std::make_unique<pivot::PivotTable>();
+    auto fully_shifted = std::make_unique<pivot::PivotTable>();
+    auto zero_span = std::make_unique<pivot::PivotTable>();
+    if (rows) {
+      near_edge->set_anchor(insert_at, 4U, 3U, 2U);
+      fully_shifted->set_anchor(bound - 1U, 8U, 1U, 1U);
+      zero_span->set_anchor(bound - 1U, 12U, 0U, 1U);
+    } else {
+      near_edge->set_anchor(4U, insert_at, 2U, 3U);
+      fully_shifted->set_anchor(8U, bound - 1U, 1U, 1U);
+      zero_span->set_anchor(12U, bound - 1U, 1U, 0U);
+    }
+    s.add_pivot_table(std::move(near_edge));
+    s.add_pivot_table(std::move(fully_shifted));
+    s.add_pivot_table(std::move(zero_span));
+
+    if (rows) {
+      s.insert_rows(insert_at, 1U);
+    } else {
+      s.insert_cols(insert_at, 1U);
+    }
+
+    // A pivot pushed wholly off the grid is dropped, like merges and validations.
+    ASSERT_EQ(s.pivot_tables().size(), 1U);
+    EXPECT_EQ(s.pivot_tables()[0]->anchor_row(), rows ? bound - 2U : 4U);
+    EXPECT_EQ(s.pivot_tables()[0]->anchor_col(), rows ? 4U : bound - 2U);
+    EXPECT_EQ(s.pivot_tables()[0]->span_rows(), 2U);
+    EXPECT_EQ(s.pivot_tables()[0]->span_cols(), 2U);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Overwrite semantics
 // ---------------------------------------------------------------------------
diff --git a/tests/unit/style_resolve_test.cpp b/tests/unit/style_resolve_test.cpp
new file mode 100644
index 000000000..a7d463aac
--- /dev/null
+++ b/tests/unit/style_resolve_test.cpp
@@ -0,0 +1,360 @@
+#include "style_resolve.h"
+
+#include <algorithm>
+#include <cstdint>
+#include <cstdio>
+#include <set>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "io/styles_reader.h"
+#include "io/styles_writer.h"
+#include "styles.h"
+#include "theme.h"
+#include "workbook.h"
+
+#ifndef FORMULON_FIXTURES_DIR
+#error "FORMULON_FIXTURES_DIR must be defined by the build"
+#endif
+
+namespace formulon {
+namespace {
+
+std::vector<std::uint8_t> ReadFixture(const char* file) {
+  std::vector<std::uint8_t> out;
+  const std::string path = std::string(FORMULON_FIXTURES_DIR) + "/excel/" + file;
+  FILE* f = std::fopen(path.c_str(), "rb");
+  if (f == nullptr) {
+    ADD_FAILURE() << "could not open fixture: " << path;
+    return out;
+  }
+  std::fseek(f, 0, SEEK_END);
+  const long size = std::ftell(f);
+  std::fseek(f, 0, SEEK_SET);
+  out.resize(size > 0 ? static_cast<std::size_t>(size) : 0U);
+  if (std::fread(out.data(), 1, out.size(), f) != out.size()) {
+    ADD_FAILURE() << "short read on fixture: " << path;
+    out.clear();
+  }
+  std::fclose(f);
+  return out;
+}
+
+Workbook LoadFixture(const char* file) {
+  const std::vector<std::uint8_t> bytes = ReadFixture(file);
+  auto read = io::read_ooxml(io::ByteSpan{bytes.data(), bytes.size()});
+  EXPECT_TRUE(static_cast<bool>(read));
+  return std::move(read.value().workbook);
+}
+
+Workbook RoundTrip(const Workbook& wb) {
+  auto bytes = io::write_ooxml(wb);
+  EXPECT_TRUE(static_cast<bool>(bytes));
+  auto read = io::read_ooxml(io::ByteSpan{bytes.value().data(), bytes.value().size()});
+  EXPECT_TRUE(static_cast<bool>(read));
+  return std::move(read.value().workbook);
+}
+
+const CellStyleRecord* FindStyle(const StylesTable& styles, std::uint32_t builtin_id) {
+  for (const CellStyleRecord& rec : styles.cell_styles) {
+    if (rec.builtin_id == builtin_id) {
+      return &rec;
+    }
+  }
+  return nullptr;
+}
+
+ColorSpec RgbSpec(std::uint32_t argb) {
+  ColorSpec spec;
+  spec.kind = ColorSpec::Kind::kRgb;
+  spec.rgb = argb;
+  return spec;
+}
+
+// ---------------------------------------------------------------------------
+// StyleResolve
+// ---------------------------------------------------------------------------
+
+/// A workbook whose xfs 1..3 each carry a distinct solid fill colour.
+Workbook WorkbookWithFillXfs() {
+  Workbook wb = Workbook::create();
+  StylesTable& styles = wb.mutable_styles();
+  styles.cell_xfs.assign(4U, CellXf{});
+  for (std::uint32_t i = 1; i <= 3U; ++i) {
+    FillRecord fill;
+    fill.pattern = 1;
+    fill.fg = RgbSpec(0xFF000000U | (i * 0x10U));
+    styles.fills.push_back(fill);
+    styles.cell_xfs[i].fill_index = static_cast<std::uint32_t>(styles.fills.size() - 1U);
+  }
+  return wb;
+}
+
+TEST(StyleResolve, RowStyleBeatsColumnStyle) {
+  Workbook wb = WorkbookWithFillXfs();
+  Sheet& sheet = wb.sheet(0);
+  ColumnLayout col;
+  col.first = 0;
+  col.last = 3;
+  col.has_style = true;
+  col.style_xf = 1;
+  sheet.mutable_layout().columns.push_back(col);
+  RowLayout row;
+  row.row = 2;
+  row.has_style = true;
+  row.style_xf = 2;
+  sheet.mutable_layout().row_overrides.push_back(row);
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 7U, 0U, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_xf_index(0, 7U, 0U, 3U)));
+
+  const EffectiveStyle on_row = effective_style(wb, sheet, 2U, 1U);  // row and column both styled
+  EXPECT_EQ(on_row.source, StyleSource::kRow);
+  EXPECT_EQ(on_row.xf_index, 2U);
+  EXPECT_EQ(on_row.fill_foreground.argb, 0xFF000020U);
+
+  const EffectiveStyle on_col = effective_style(wb, sheet, 5U, 1U);
+  EXPECT_EQ(on_col.source, StyleSource::kColumn);
+  EXPECT_EQ(on_col.xf_index, 1U);
+
+  const EffectiveStyle on_cell = effective_style(wb, sheet, 7U, 0U);  // a cell beats row and column
+  EXPECT_EQ(on_cell.source, StyleSource::kCell);
+  EXPECT_EQ(on_cell.xf_index, 3U);
+
+  const EffectiveStyle outside = effective_style(wb, sheet, 5U, 9U);
+  EXPECT_EQ(outside.source, StyleSource::kDefault);
+  EXPECT_EQ(outside.xf_index, 0U);
+}
+
+TEST(StyleResolve, ReportsFormatProtectionAndColours) {
+  Workbook wb = Workbook::create();
+  StylesTable& styles = wb.mutable_styles();
+  styles.cell_xfs.assign(2U, CellXf{});
+  FontRecord font;
+  font.color.kind = ColorSpec::Kind::kTheme;
+  font.color.theme = 1;  // dk1
+  styles.fonts.push_back(font);
+  styles.cell_xfs[1].font_index = static_cast<std::uint32_t>(styles.fonts.size() - 1U);
+  styles.cell_xfs[1].num_fmt_id = 14;
+  styles.cell_xfs[1].has_protection = true;
+  styles.cell_xfs[1].locked = false;
+  styles.cell_xfs[1].hidden = true;
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0, 0U, 0U, Value::number(1.0))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_xf_index(0, 0U, 0U, 1U)));
+
+  const EffectiveStyle st = effective_style(wb, wb.sheet(0), 0U, 0U);
+  EXPECT_EQ(st.num_fmt_code, "mm-dd-yy");
+  EXPECT_FALSE(st.locked);
+  EXPECT_TRUE(st.hidden);
+  EXPECT_EQ(st.font_color.argb, 0xFF000000U);
+  EXPECT_EQ(st.font_color.resolution, ColorResolution::kDefaultTheme);
+
+  const EffectiveStyle plain = effective_style(wb, wb.sheet(0), 5U, 5U);
+  EXPECT_EQ(plain.num_fmt_code, "General");
+  EXPECT_TRUE(plain.locked);
+  EXPECT_FALSE(plain.hidden);
+  EXPECT_EQ(plain.fill_background.argb, 0xFFFFFFFFU);
+  EXPECT_EQ(plain.border_colors[0].resolution, ColorResolution::kAutoContext);
+}
+
+// ---------------------------------------------------------------------------
+// Styles: built-in ids, cellStyle removal, indexed colours
+// ---------------------------------------------------------------------------
+
+TEST(StylesBuiltinIds, ExcelSavedRangeZeroTo53LoadsAndRoundTrips) {
+  const Workbook wb = LoadFixture("builtin_cell_styles.xlsx");
+  const StylesTable& styles = wb.styles();
+  std::set<std::uint32_t> loaded;
+  for (const CellStyleRecord& rec : styles.cell_styles) {
+    loaded.insert(rec.builtin_id);
+  }
+  EXPECT_EQ(styles.cell_styles.size(), 54U);
+  for (std::uint32_t id = 0; id <= CellStyleRecord::kBuiltinIdMax; ++id) {
+    EXPECT_EQ(loaded.count(id), 1U) << "builtinId " << id;
+  }
+  ASSERT_NE(FindStyle(styles, 48U), nullptr);
+  EXPECT_EQ(FindStyle(styles, 48U)->name, "60% - \xE3\x82\xA2\xE3\x82\xAF\xE3\x82\xBB\xE3\x83\xB3\xE3\x83\x88 5");
+  ASSERT_NE(FindStyle(styles, 53U), nullptr);
+  EXPECT_EQ(FindStyle(styles, 53U)->name, "\xE8\xAA\xAC\xE6\x98\x8E\xE6\x96\x87");
+  EXPECT_EQ(FindStyle(styles, 1U)->i_level, 0U);
+
+  const Workbook reloaded = RoundTrip(wb);
+  ASSERT_EQ(reloaded.styles().cell_styles.size(), 54U);
+  for (std::uint32_t id = 0; id <= CellStyleRecord::kBuiltinIdMax; ++id) {
+    const CellStyleRecord* before = FindStyle(styles, id);
+    const CellStyleRecord* after = FindStyle(reloaded.styles(), id);
+    ASSERT_NE(after, nullptr) << "builtinId " << id;
+    EXPECT_EQ(after->name, before->name);
+    EXPECT_EQ(after->xf_id, before->xf_id);
+  }
+}
+
+TEST(StylesBuiltinIds, ExcelSavedThemeIsParsed) {
+  const Workbook wb = LoadFixture("builtin_cell_styles.xlsx");
+  const LoadedTheme loaded = wb.load_theme();
+  EXPECT_EQ(loaded.source, ThemeSource::kPart);
+  EXPECT_EQ(loaded.theme.colors[4], 0xFF4F81BDU);  // accent1 of the fixture's own theme part
+}
+
+/// The styles of the deletion measurement: a custom style (xf 1: 0.000 format,
+/// bold red font, yellow fill, right alignment, unlocked) and cell xfs 1..7
+/// referencing it with different apply flags.
+StylesTable BuildDeletionTable() {
+  StylesTable t;
+  t.fonts.assign(3U, FontRecord{});  // 0 Normal, 1 bold red, 2 italic
+  t.fonts[1].has_bold = true;
+  t.fonts[1].bold = true;
+  t.fonts[2].has_italic = true;
+  t.fonts[2].italic = true;
+  t.fills.assign(4U, FillRecord{});  // 0 none, 1 gray125, 2 yellow, 3 green
+  t.borders.assign(1U, BorderRecord{});
+  t.cell_style_xfs.assign(2U, CellXf{});
+  CellXf& style = t.cell_style_xfs[1];
+  style.num_fmt_id = 176;
+  style.font_index = 1;
+  style.fill_index = 2;
+  style.horizontal_align = 3;
+  style.has_alignment = true;
+  style.has_protection = true;
+  style.locked = false;
+  CellStyleRecord normal;
+  normal.name = "Normal";
+  normal.xf_id = 0;
+  normal.builtin_id = 0;
+  CellStyleRecord probe;
+  probe.name = "ProbeStyle";
+  probe.xf_id = 1;
+  t.cell_styles = {normal, probe};
+
+  t.cell_xfs.assign(8U, style);
+  for (CellXf& xf : t.cell_xfs) {
+    xf.xf_id = 1;
+  }
+  t.cell_xfs[0] = CellXf{};  // the default xf
+  t.cell_xfs[2].font_index = 2;
+  t.cell_xfs[2].apply_font = true;
+  t.cell_xfs[3].num_fmt_id = 177;
+  t.cell_xfs[3].apply_number_format = true;
+  t.cell_xfs[4].fill_index = 3;
+  t.cell_xfs[4].apply_fill = true;
+  t.cell_xfs[5].horizontal_align = 2;
+  t.cell_xfs[5].apply_alignment = true;
+  t.cell_xfs[6].apply_protection = true;
+  t.cell_xfs[6].has_protection = false;
+  t.cell_xfs[6].locked = true;
+  t.cell_xfs[7] = CellXf{};
+  t.cell_xfs[7].xf_id = 1;
+  t.cell_xfs[7].apply_number_format = t.cell_xfs[7].apply_font = t.cell_xfs[7].apply_fill = true;
+  t.cell_xfs[7].apply_border = t.cell_xfs[7].apply_alignment = t.cell_xfs[7].apply_protection = true;
+  return t;
+}
+
+TEST(StylesCellStyleRemoval, RepointsXfsAndKeepsAppliedGroups) {
+  StylesTable t = BuildDeletionTable();
+  ASSERT_TRUE(static_cast<bool>(remove_cell_style(t, "ProbeStyle")));
+
+  ASSERT_EQ(t.cell_styles.size(), 1U);
+  EXPECT_EQ(t.cell_styles[0].name, "Normal");
+  EXPECT_EQ(t.cell_style_xfs.size(), 2U);  // not compacted
+  ASSERT_EQ(t.cell_xfs.size(), 8U);
+  for (std::size_t i = 1; i < t.cell_xfs.size(); ++i) {
+    EXPECT_EQ(t.cell_xfs[i].xf_id, 0U) << "xf " << i;
+  }
+  // xf 1: no apply flag, every group takes Normal's value.
+  const CellXf& x1 = t.cell_xfs[1];
+  EXPECT_EQ(x1.num_fmt_id, 0U);
+  EXPECT_EQ(x1.font_index, 0U);
+  EXPECT_EQ(x1.fill_index, 0U);
+  EXPECT_EQ(x1.horizontal_align, 0U);
+  EXPECT_FALSE(x1.has_alignment);
+  EXPECT_FALSE(x1.has_protection);
+  EXPECT_TRUE(x1.locked);
+  // xf 2..6: only the applied group keeps its own value.
+  EXPECT_EQ(t.cell_xfs[2].font_index, 2U);
+  EXPECT_EQ(t.cell_xfs[2].fill_index, 0U);
+  EXPECT_EQ(t.cell_xfs[2].num_fmt_id, 0U);
+  EXPECT_EQ(t.cell_xfs[3].num_fmt_id, 177U);
+  EXPECT_EQ(t.cell_xfs[3].font_index, 0U);
+  EXPECT_EQ(t.cell_xfs[4].fill_index, 3U);
+  EXPECT_EQ(t.cell_xfs[4].font_index, 0U);
+  EXPECT_EQ(t.cell_xfs[5].horizontal_align, 2U);
+  EXPECT_EQ(t.cell_xfs[5].fill_index, 0U);
+  EXPECT_FALSE(t.cell_xfs[6].has_protection);
+  EXPECT_TRUE(t.cell_xfs[6].locked);
+  EXPECT_EQ(t.cell_xfs[6].horizontal_align, 0U);
+  // xf 7 keeps its flags (not recomputed) and its own Normal-valued groups.
+  EXPECT_TRUE(t.cell_xfs[7].apply_font && t.cell_xfs[7].apply_fill && t.cell_xfs[7].apply_protection);
+  EXPECT_EQ(t.cell_xfs[7].font_index, 0U);
+}
+
+TEST(StylesCellStyleRemoval, KeepsXfsWhileAnotherStyleSharesTheRecord) {
+  StylesTable t = BuildDeletionTable();
+  CellStyleRecord twin;
+  twin.name = "Twin";
+  twin.xf_id = 1;
+  t.cell_styles.push_back(twin);
+  ASSERT_TRUE(static_cast<bool>(remove_cell_style(t, "ProbeStyle")));
+  ASSERT_EQ(t.cell_styles.size(), 2U);
+  EXPECT_EQ(t.cell_xfs[1].xf_id, 1U);
+  EXPECT_EQ(t.cell_xfs[1].font_index, 1U);
+}
+
+TEST(StylesCellStyleRemoval, RejectsNormalAndUnknownNames) {
+  StylesTable t = BuildDeletionTable();
+  EXPECT_FALSE(static_cast<bool>(remove_cell_style(t, "Normal")));
+  EXPECT_FALSE(static_cast<bool>(remove_cell_style(t, "NoSuchStyle")));
+  EXPECT_EQ(t.cell_styles.size(), 2U);
+  EXPECT_EQ(t.cell_xfs[1].xf_id, 1U);
+}
+
+TEST(StylesCellStyleRemoval, SurvivesSaveAndReload) {
+  Workbook wb = LoadFixture("builtin_cell_styles.xlsx");
+  ASSERT_TRUE(static_cast<bool>(remove_cell_style(wb.mutable_styles(), "\xE8\xAA\xAC\xE6\x98\x8E\xE6\x96\x87")));
+  const Workbook reloaded = RoundTrip(wb);
+  EXPECT_EQ(reloaded.styles().cell_styles.size(), 53U);
+  EXPECT_EQ(FindStyle(reloaded.styles(), 53U), nullptr);
+  EXPECT_NE(FindStyle(reloaded.styles(), 52U), nullptr);
+}
+
+TEST(StylesIndexedColors, RoundTripKeepsPaletteAndOtherColorsChildren) {
+  const std::string source =
+      "<styleSheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\">"
+      "<colors><indexedColors><rgbColor rgb=\"FF112233\"/><rgbColor rgb=\"FF445566\"/></indexedColors>"
+      "<mruColors><color rgb=\"FFAABBCC\"/></mruColors></colors></styleSheet>";
+  auto read = io::read_styles(std::vector<std::uint8_t>(source.begin(), source.end()));
+  ASSERT_TRUE(static_cast<bool>(read)) << read.error().message;
+  EXPECT_EQ(read.value().indexed_colors, (std::vector<std::uint32_t>{0xFF112233U, 0xFF445566U}));
+  EXPECT_EQ(read.value().colors_xml, "<colors><mruColors><color rgb=\"FFAABBCC\"/></mruColors></colors>");
+
+  const std::string xml = io::write_styles(read.value());
+  EXPECT_NE(xml.find("<colors><indexedColors><rgbColor rgb=\"FF112233\"/><rgbColor rgb=\"FF445566\"/></indexedColors>"
+                     "<mruColors><color rgb=\"FFAABBCC\"/></mruColors></colors>"),
+            std::string::npos);
+  auto again = io::read_styles(std::vector<std::uint8_t>(xml.begin(), xml.end()));
+  ASSERT_TRUE(static_cast<bool>(again));
+  EXPECT_EQ(again.value().indexed_colors, read.value().indexed_colors);
+  EXPECT_EQ(again.value().colors_xml, read.value().colors_xml);
+}
+
+TEST(StylesIndexedColors, ResolvedThroughWorkbookPalette) {
+  Workbook wb = Workbook::create();
+  wb.mutable_styles().indexed_colors = {0xFF010203U, 0xFF040506U};
+  const Workbook reloaded = RoundTrip(wb);
+  EXPECT_EQ(reloaded.styles().indexed_colors, wb.styles().indexed_colors);
+  ColorSpec spec;
+  spec.kind = ColorSpec::Kind::kIndexed;
+  spec.indexed = 1;
+  EXPECT_EQ(resolve_color(reloaded, spec, ColorContext::kFont).argb, 0xFF040506U);
+  spec.indexed = 2;
+  EXPECT_EQ(resolve_color(reloaded, spec, ColorContext::kFont).argb, 0xFFFF0000U);
+}
+
+TEST(StylesIndexedColors, AbsentPaletteWritesNoColorsElement) {
+  const std::string xml = io::write_styles(StylesTable{});
+  EXPECT_EQ(xml.find("<colors"), std::string::npos);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/theme_test.cpp b/tests/unit/theme_test.cpp
new file mode 100644
index 000000000..c6ac4e01b
--- /dev/null
+++ b/tests/unit/theme_test.cpp
@@ -0,0 +1,166 @@
+#include "theme.h"
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "io/ooxml_writer.h"
+#include "passthrough_part.h"
+#include "workbook.h"
+
+namespace formulon {
+namespace {
+
+constexpr const char* kThemeRel = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme";
+constexpr const char* kThemeContentType = "application/vnd.openxmlformats-officedocument.theme+xml";
+
+const PassthroughPart* FindPart(const Workbook& wb, const std::string& path) {
+  for (const PassthroughPart& part : wb.passthrough_parts()) {
+    if (part.path == path) {
+      return &part;
+    }
+  }
+  return nullptr;
+}
+
+Workbook RoundTrip(const Workbook& wb) {
+  auto bytes = io::write_ooxml(wb);
+  EXPECT_TRUE(static_cast<bool>(bytes));
+  auto read = io::read_ooxml(io::ByteSpan{bytes.value().data(), bytes.value().size()});
+  EXPECT_TRUE(static_cast<bool>(read));
+  return std::move(read.value().workbook);
+}
+
+Workbook WorkbookWithTheme(const std::string& xml) {
+  Workbook wb = Workbook::create();
+  EXPECT_TRUE(static_cast<bool>(wb.add_passthrough_part(
+      PassthroughPart("xl/theme/theme1.xml", kThemeContentType, std::vector<std::uint8_t>(xml.begin(), xml.end())))));
+  wb.add_workbook_relationship(kThemeRel, "xl/theme/theme1.xml");
+  return wb;
+}
+
+constexpr const char* kCustomTheme =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+    "<a:theme xmlns:a=\"http://schemas.openxmlformats.org/drawingml/2006/main\" name=\"Custom\"><a:themeElements>"
+    "<a:clrScheme name=\"Custom\">"
+    "<a:dk1><a:sysClr val=\"windowText\" lastClr=\"010203\"/></a:dk1><a:lt1><a:sysClr val=\"window\" "
+    "lastClr=\"FEFDFC\"/></a:lt1>"
+    "<a:dk2><a:srgbClr val=\"112233\"/></a:dk2><a:lt2><a:srgbClr val=\"AABBCC\"/></a:lt2>"
+    "<a:accent1><a:srgbClr val=\"100000\"/></a:accent1><a:accent2><a:srgbClr val=\"200000\"/></a:accent2>"
+    "<a:accent3><a:srgbClr val=\"300000\"/></a:accent3><a:accent4><a:srgbClr val=\"400000\"/></a:accent4>"
+    "<a:accent5><a:srgbClr val=\"500000\"/></a:accent5><a:accent6><a:srgbClr val=\"600000\"/></a:accent6>"
+    "<a:hlink><a:srgbClr val=\"0000AA\"/></a:hlink><a:folHlink><a:srgbClr val=\"0000BB\"/></a:folHlink>"
+    "</a:clrScheme><a:fontScheme name=\"Custom\">"
+    "<a:majorFont><a:latin typeface=\"Major Latin\"/><a:ea typeface=\"\"/><a:cs typeface=\"\"/>"
+    "<a:font script=\"Jpan\" typeface=\"Major Jpan\"/></a:majorFont>"
+    "<a:minorFont><a:latin typeface=\"Minor Latin\"/><a:ea typeface=\"Minor Ea\"/><a:cs typeface=\"\"/>"
+    "<a:font script=\"Jpan\" typeface=\"Minor Jpan\"/></a:minorFont>"
+    "</a:fontScheme><a:fmtScheme name=\"Custom\"><a:marker id=\"keep-me\"/></a:fmtScheme>"
+    "</a:themeElements></a:theme>";
+
+TEST(Theme, ReportsDefaultThemeWhenPartAbsent) {
+  const Workbook wb = Workbook::create();
+  const LoadedTheme loaded = wb.load_theme();
+  EXPECT_EQ(loaded.source, ThemeSource::kDefault);
+  EXPECT_EQ(loaded.theme.colors[4], 0xFF4472C4U);  // accent1 of the Office 2013-2022 theme
+  EXPECT_EQ(loaded.theme.fonts.minor_latin, "Calibri");
+  EXPECT_EQ(loaded.theme.fonts.major_latin, "Calibri Light");
+}
+
+TEST(Theme, GeneratesPartWhenAbsent) {
+  Workbook wb = Workbook::create();
+  ASSERT_EQ(FindPart(wb, "xl/theme/theme1.xml"), nullptr);
+
+  ThemeColors colors = default_theme().colors;
+  colors[0] = 0xFF111111U;
+  colors[5] = 0xFF123456U;
+  colors[11] = 0xFFABCDEFU;
+  ASSERT_TRUE(static_cast<bool>(wb.set_theme_colors(colors)));
+  const ThemeFonts fonts = {"Arial", "Meiryo", "Verdana", "MS Gothic"};
+  ASSERT_TRUE(static_cast<bool>(wb.set_theme_fonts(fonts)));
+
+  const PassthroughPart* part = FindPart(wb, "xl/theme/theme1.xml");
+  ASSERT_NE(part, nullptr);
+  EXPECT_EQ(part->content_type, kThemeContentType);
+
+  const Workbook reloaded = RoundTrip(wb);
+  const PassthroughPart* saved = FindPart(reloaded, "xl/theme/theme1.xml");
+  ASSERT_NE(saved, nullptr);
+  EXPECT_EQ(saved->content_type, kThemeContentType);
+  bool has_rel = false;
+  for (const UnknownRelationship& rel : reloaded.unknown_workbook_rels()) {
+    has_rel = has_rel || (rel.type == kThemeRel && rel.target == "xl/theme/theme1.xml");
+  }
+  EXPECT_TRUE(has_rel);
+
+  const LoadedTheme loaded = reloaded.load_theme();
+  EXPECT_EQ(loaded.source, ThemeSource::kPart);
+  EXPECT_EQ(loaded.theme.colors, colors);
+  EXPECT_EQ(loaded.theme.fonts.major_latin, "Arial");
+  EXPECT_EQ(loaded.theme.fonts.major_ea, "Meiryo");
+  EXPECT_EQ(loaded.theme.fonts.minor_latin, "Verdana");
+  EXPECT_EQ(loaded.theme.fonts.minor_ea, "MS Gothic");
+}
+
+TEST(Theme, ParsesSchemeAndFontsOfExistingPart) {
+  const Workbook wb = WorkbookWithTheme(kCustomTheme);
+  const LoadedTheme loaded = wb.load_theme();
+  ASSERT_EQ(loaded.source, ThemeSource::kPart);
+  EXPECT_EQ(loaded.theme.colors[0], 0xFF010203U);  // sysClr lastClr
+  EXPECT_EQ(loaded.theme.colors[1], 0xFFFEFDFCU);
+  EXPECT_EQ(loaded.theme.colors[2], 0xFF112233U);
+  EXPECT_EQ(loaded.theme.colors[11], 0xFF0000BBU);
+  EXPECT_EQ(loaded.theme.fonts.major_latin, "Major Latin");
+  EXPECT_EQ(loaded.theme.fonts.major_ea, "Major Jpan");  // a:ea is empty: the Jpan face
+  EXPECT_EQ(loaded.theme.fonts.minor_ea, "Minor Ea");    // a:ea names a face: it wins
+}
+
+TEST(Theme, EditPatchesOnlySchemeAndFontElements) {
+  Workbook wb = WorkbookWithTheme(kCustomTheme);
+  ThemeColors colors = wb.load_theme().theme.colors;
+  colors[3] = 0xFF778899U;
+  ASSERT_TRUE(static_cast<bool>(wb.set_theme_colors(colors)));
+  ASSERT_TRUE(static_cast<bool>(wb.set_theme_fonts({"A", "B", "C", "D"})));
+
+  const PassthroughPart* part = FindPart(wb, "xl/theme/theme1.xml");
+  ASSERT_NE(part, nullptr);
+  const std::string xml(part->bytes.begin(), part->bytes.end());
+  EXPECT_NE(xml.find("<a:marker id=\"keep-me\"/>"), std::string::npos);
+  EXPECT_NE(xml.find("name=\"Custom\""), std::string::npos);
+
+  const LoadedTheme loaded = wb.load_theme();
+  ASSERT_EQ(loaded.source, ThemeSource::kPart);
+  EXPECT_EQ(loaded.theme.colors, colors);
+  EXPECT_EQ(loaded.theme.fonts.major_ea, "B");
+  EXPECT_EQ(loaded.theme.fonts.minor_ea, "D");
+}
+
+TEST(Theme, UnparseablePartReportsSourceAndRefusesEdit) {
+  const std::string junk = "<a:theme>not a colour scheme</a:theme>";
+  Workbook wb = WorkbookWithTheme(junk);
+  const LoadedTheme loaded = wb.load_theme();
+  EXPECT_EQ(loaded.source, ThemeSource::kUnparseable);
+  EXPECT_EQ(loaded.theme.colors, default_theme().colors);
+
+  EXPECT_FALSE(static_cast<bool>(wb.set_theme_colors(default_theme().colors)));
+  const PassthroughPart* part = FindPart(wb, "xl/theme/theme1.xml");
+  ASSERT_NE(part, nullptr);
+  EXPECT_EQ(std::string(part->bytes.begin(), part->bytes.end()), junk);
+}
+
+TEST(Theme, PassthroughPartApiRejectsDuplicatesAndMissing) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart("xl/x.bin", "", {1, 2}))));
+  EXPECT_FALSE(static_cast<bool>(wb.add_passthrough_part(PassthroughPart("xl/x.bin", "", {3}))));
+  ASSERT_TRUE(static_cast<bool>(wb.replace_passthrough_part("xl/x.bin", {9})));
+  EXPECT_EQ(FindPart(wb, "xl/x.bin")->bytes, std::vector<std::uint8_t>({9}));
+  EXPECT_FALSE(static_cast<bool>(wb.replace_passthrough_part("xl/missing.bin", {1})));
+  wb.add_workbook_relationship("t", "xl/x.bin");
+  wb.add_workbook_relationship("t", "xl/x.bin");
+  EXPECT_EQ(wb.unknown_workbook_rels().size(), 1U);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/utils/date_time_test.cpp b/tests/unit/utils/date_time_test.cpp
new file mode 100644
index 000000000..dec47e6ae
--- /dev/null
+++ b/tests/unit/utils/date_time_test.cpp
@@ -0,0 +1,51 @@
+#include "utils/date_time.h"
+
+#include <cstdint>
+#include <limits>
+
+#include "gtest/gtest.h"
+
+namespace formulon::date_time {
+namespace {
+
+TEST(DateTimeNormalization, ZeroDayRewindsAcrossMarchInBothEpochs) {
+  EXPECT_EQ(days_from_civil(2024, 3, 0), days_from_civil(2024, 2, 29));
+  EXPECT_EQ(days_from_civil(2023, 3, 0), days_from_civil(2023, 2, 28));
+  for (bool date1904 : {false, true}) {
+    EXPECT_DOUBLE_EQ(serial_from_ymd(2024, 3, 0, date1904), serial_from_ymd(2024, 2, 29, date1904));
+  }
+}
+
+TEST(DateTimeNormalization, MonthOverflowUsesCalendarMonthLengths) {
+  EXPECT_EQ(days_from_civil(2023, 15, 1), days_from_civil(2024, 3, 1));
+  EXPECT_EQ(days_from_civil(2024, 0, 1), days_from_civil(2023, 12, 1));
+  EXPECT_EQ(days_from_civil(2024, 25, 1), days_from_civil(2026, 1, 1));
+  for (bool date1904 : {false, true}) {
+    EXPECT_DOUBLE_EQ(serial_from_ymd(2023, 15, 1, date1904), serial_from_ymd(2024, 3, 1, date1904));
+  }
+}
+
+TEST(DateTimeNormalization, WideDayOffsetsDoNotWrap) {
+  constexpr unsigned day = std::numeric_limits<unsigned>::max();
+  EXPECT_EQ(days_from_civil(2024, 1, day), days_from_civil(2024, 1, 1) + static_cast<std::int64_t>(day) - 1);
+}
+
+TEST(DateTimeNormalization, ExtremeYearsRetainTheirLeapRule) {
+  constexpr int first = std::numeric_limits<int>::min();
+  constexpr int last = std::numeric_limits<int>::max();
+  EXPECT_EQ(days_from_civil(first, 3, 1) - days_from_civil(first, 1, 1), 60);
+  EXPECT_EQ(days_from_civil(last, 3, 1) - days_from_civil(last, 1, 1), 59);
+}
+
+TEST(DateTimeNormalization, ExtremeYearsRoundTripWithoutIntermediateOverflow) {
+  for (int year : {std::numeric_limits<int>::min(), std::numeric_limits<int>::max()}) {
+    const YMD date = civil_from_days(days_from_civil(year, 3, 1));
+    EXPECT_EQ(date.y, year);
+    EXPECT_EQ(date.m, 3u);
+    EXPECT_EQ(date.d, 1u);
+  }
+  EXPECT_EQ(days_from_civil(0, std::numeric_limits<unsigned>::max(), 1), days_from_civil(357913941, 3, 1));
+}
+
+}  // namespace
+}  // namespace formulon::date_time
diff --git a/tests/unit/utils/number_text_test.cpp b/tests/unit/utils/number_text_test.cpp
new file mode 100644
index 000000000..1ffca40c8
--- /dev/null
+++ b/tests/unit/utils/number_text_test.cpp
@@ -0,0 +1,339 @@
+//
+// Unit tests for the printf-free number formatters in `utils/number_text.h`.
+//
+// Every primitive is compared byte for byte with the host `snprintf` over
+// hand-picked values, generated magnitudes, exact decimal ties and random
+// bit patterns; ties are where double-conversion alone disagrees with printf.
+
+#include "utils/number_text.h"
+
+#include <cfloat>
+#include <climits>
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <limits>
+#include <random>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+
+namespace formulon {
+namespace {
+
+constexpr std::size_t kBufSize = 2048;
+
+std::string Fixed(double v, int frac) {
+  char buf[kBufSize];
+  const int n = format_fixed(buf, sizeof(buf), v, frac);
+  EXPECT_EQ(static_cast<std::size_t>(n), std::strlen(buf));
+  return buf;
+}
+
+std::string Expo(double v, int frac) {
+  char buf[kBufSize];
+  format_exponential(buf, sizeof(buf), v, frac);
+  return buf;
+}
+
+std::string General(double v, int prec) {
+  char buf[kBufSize];
+  format_general(buf, sizeof(buf), v, prec);
+  return buf;
+}
+
+// Apple's libc leaves a trailing zero in `%g` when tie rounding produces it
+// (`%.8g` of 392240505 gives "3.9224050e+08"); musl and glibc strip it, as
+// the standard requires, so the reference strips it too.
+std::string StripGeneralZeros(std::string text) {
+  const std::size_t e = text.find('e');
+  const std::size_t mant_end = e == std::string::npos ? text.size() : e;
+  if (text.find('.') == std::string::npos || text.find('.') > mant_end) {
+    return text;
+  }
+  std::size_t end = mant_end;
+  while (text[end - 1] == '0') {
+    --end;
+  }
+  if (text[end - 1] == '.') {
+    --end;
+  }
+  return text.erase(end, mant_end - end);
+}
+
+std::string Ref(const char* fmt, int prec, double v) {
+  char buf[kBufSize];
+  std::snprintf(buf, sizeof(buf), fmt, prec, v);
+  return fmt[3] == 'g' ? StripGeneralZeros(buf) : std::string(buf);
+}
+
+void CheckFixed(double v, int frac) {
+  ASSERT_EQ(Fixed(v, frac), Ref("%.*f", frac, v)) << "fixed frac=" << frac << " v=" << Ref("%.*e", 20, v);
+}
+
+void CheckExpo(double v, int frac) {
+  ASSERT_EQ(Expo(v, frac), Ref("%.*e", frac, v)) << "expo frac=" << frac << " v=" << Ref("%.*e", 20, v);
+}
+
+void CheckGeneral(double v, int prec) {
+  ASSERT_EQ(General(v, prec), Ref("%.*g", prec, v)) << "general prec=" << prec << " v=" << Ref("%.*e", 20, v);
+}
+
+void CheckAll(double v, bool with_fixed = true) {
+  if (with_fixed) {
+    for (int f = 0; f <= 20; ++f) {
+      CheckFixed(v, f);
+      if (::testing::Test::HasFatalFailure()) {
+        return;
+      }
+    }
+  }
+  for (int f = 0; f <= 20; ++f) {
+    CheckExpo(v, f);
+    if (::testing::Test::HasFatalFailure()) {
+      return;
+    }
+  }
+  for (int p = 1; p <= 17; ++p) {
+    CheckGeneral(v, p);
+    if (::testing::Test::HasFatalFailure()) {
+      return;
+    }
+  }
+}
+
+std::vector<double> HandPicked() {
+  std::vector<double> base = {0.0,
+                              0.5,
+                              1.5,
+                              2.5,
+                              0.125,
+                              0.375,
+                              1234567890123445.0,
+                              1234567890123455.0,
+                              9.5,
+                              99.5,
+                              999.5,
+                              0.95,
+                              0.0005,
+                              1e-7,
+                              123.456,
+                              DBL_MIN,
+                              std::numeric_limits<double>::denorm_min(),
+                              9007199254740992.0,
+                              9007199254740994.0,
+                              1e21,
+                              1e22,
+                              1e300,
+                              0.1,
+                              0.3,
+                              1.0,
+                              100.0,
+                              1e15,
+                              123456789012345678.0,
+                              5e-324 * 3,
+                              4.35,
+                              0.045,
+                              1e23,
+                              9.999999999999999e22};
+  std::vector<double> out;
+  for (double v : base) {
+    out.push_back(v);
+    out.push_back(-v);
+  }
+  return out;
+}
+
+TEST(NumberText, HandPickedValues) {
+  for (double v : HandPicked()) {
+    CheckAll(v);
+    if (HasFatalFailure()) {
+      return;
+    }
+  }
+}
+
+TEST(NumberText, DblMaxAndSpecials) {
+  for (double v : {DBL_MAX, -DBL_MAX}) {
+    for (int f = 0; f <= 2; ++f) {
+      CheckFixed(v, f);
+    }
+    for (int f = 0; f <= 20; ++f) {
+      CheckExpo(v, f);
+    }
+    for (int p = 1; p <= 17; ++p) {
+      CheckGeneral(v, p);
+    }
+  }
+  const double inf = std::numeric_limits<double>::infinity();
+  const double nan = std::numeric_limits<double>::quiet_NaN();
+  for (double v : {inf, -inf, nan}) {
+    CheckFixed(v, 3);
+    CheckExpo(v, 3);
+    CheckGeneral(v, 6);
+  }
+  // musl prints the sign of a NaN; Apple's libc does not, so pin it directly.
+  EXPECT_EQ(Fixed(-nan, 2), "-nan");
+  EXPECT_EQ(Expo(-nan, 2), "-nan");
+  EXPECT_EQ(General(-nan, 2), "-nan");
+}
+
+TEST(NumberText, LongFractionsAreExact) {
+  for (double v : {0.1, 1e-300, 123.456, DBL_MIN}) {
+    for (int f : {40, 100, 400}) {
+      CheckFixed(v, f);
+    }
+  }
+}
+
+TEST(NumberText, TruncationReturnsFullLength) {
+  char small[6];
+  EXPECT_EQ(format_fixed(small, sizeof(small), 123456.789, 3), 10);
+  EXPECT_STREQ(small, "12345");
+  EXPECT_EQ(format_signed(small, sizeof(small), 123456789, 0), 9);
+  EXPECT_EQ(format_fixed(nullptr, 0, 1.5, 1), 3);
+}
+
+TEST(NumberText, RandomMagnitudes) {
+  std::mt19937_64 rng(12345);
+  std::uniform_real_distribution<double> sig(1.0, 10.0);
+  std::uniform_int_distribution<int> mag(-30, 30);
+  std::uniform_int_distribution<int> sign(0, 1);
+  for (int i = 0; i < 100000; ++i) {
+    double v = sig(rng) * std::pow(10.0, mag(rng));
+    if (sign(rng) != 0) {
+      v = -v;
+    }
+    const int f = static_cast<int>(rng() % 21U);
+    const int p = 1 + static_cast<int>(rng() % 17U);
+    CheckExpo(v, f);
+    CheckGeneral(v, p);
+    CheckFixed(v, f);
+    if (HasFatalFailure()) {
+      return;
+    }
+  }
+}
+
+TEST(NumberText, ExactTies) {
+  std::mt19937_64 rng(777);
+  const double denoms[] = {2.0, 8.0, 1024.0};
+  for (int i = 0; i < 100000; ++i) {
+    const double k = static_cast<double>(rng() % 4000000000ULL);
+    const double v = k / denoms[i % 3];
+    const int f = static_cast<int>(rng() % 21U);
+    CheckFixed(v, f);
+    CheckExpo(v, f);
+    CheckGeneral(v, 1 + static_cast<int>(rng() % 17U));
+    if (HasFatalFailure()) {
+      return;
+    }
+  }
+  // Integers below 2^53 tie when rounded left of their last digits.
+  for (int i = 0; i < 20000; ++i) {
+    const double v = static_cast<double>(rng() % (1ULL << 53U));
+    CheckExpo(v, 14);
+    CheckExpo(v, 15);
+    CheckGeneral(v, 15);
+    CheckGeneral(v, 16);
+    CheckFixed(v, 0);
+    if (HasFatalFailure()) {
+      return;
+    }
+  }
+  // Odd multiples of 5 * 10^k reach left-of-point ties at every position.
+  for (int i = 0; i < 20000; ++i) {
+    const double v = static_cast<double>((rng() % 1000000ULL) * 10ULL + 5ULL) * std::pow(10.0, static_cast<int>(i % 8));
+    for (int p = 1; p <= 17; ++p) {
+      CheckGeneral(v, p);
+    }
+    if (HasFatalFailure()) {
+      return;
+    }
+  }
+}
+
+TEST(NumberText, RandomBitPatterns) {
+  std::mt19937_64 rng(99);
+  int checked = 0;
+  while (checked < 50000) {
+    const std::uint64_t bits = rng();
+    double v;
+    std::memcpy(&v, &bits, sizeof(v));
+    if (!std::isfinite(v)) {
+      continue;
+    }
+    ++checked;
+    const int f = static_cast<int>(rng() % 21U);
+    CheckExpo(v, f);
+    CheckGeneral(v, 1 + static_cast<int>(rng() % 17U));
+    if (std::fabs(v) < 1e30) {
+      CheckFixed(v, f);
+    }
+    if (HasFatalFailure()) {
+      return;
+    }
+  }
+}
+
+template <typename T>
+std::string RefInt(const char* fmt, T v) {
+  char buf[64];
+  std::snprintf(buf, sizeof(buf), fmt, v);
+  return buf;
+}
+
+TEST(NumberText, SignedIntegers) {
+  const long long values[] = {0, 1, -1, 9, 10, -10, 12345, -12345, INT_MIN, INT_MAX, LLONG_MIN, LLONG_MAX};
+  for (long long v : values) {
+    char buf[64];
+    format_signed(buf, sizeof(buf), v);
+    EXPECT_EQ(std::string(buf), RefInt("%lld", v));
+    if (v >= INT_MIN && v <= INT_MAX) {
+      EXPECT_EQ(std::string(buf), RefInt("%d", static_cast<int>(v)));
+      format_signed(buf, sizeof(buf), v, 4);
+      EXPECT_EQ(std::string(buf), RefInt("%04d", static_cast<int>(v)));
+      format_signed(buf, sizeof(buf), v, 12);
+      EXPECT_EQ(std::string(buf), RefInt("%012d", static_cast<int>(v)));
+    }
+    format_signed(buf, sizeof(buf), v, 25);
+    EXPECT_EQ(std::string(buf), RefInt("%025lld", v));
+    format_signed(buf, sizeof(buf), v, 2);
+    EXPECT_EQ(std::string(buf), RefInt("%02lld", v));
+  }
+}
+
+TEST(NumberText, UnsignedAndHex) {
+  const unsigned long long values[] = {
+      0, 1, 9, 10, 255, 4095, 65535, 0xABCDEFULL, 0xDEADBEEFULL, UINT_MAX, ULLONG_MAX, ULLONG_MAX - 1, 1ULL << 63U};
+  for (unsigned long long v : values) {
+    char buf[64];
+    format_unsigned(buf, sizeof(buf), v);
+    EXPECT_EQ(std::string(buf), RefInt("%llu", v));
+    format_unsigned(buf, sizeof(buf), v, 4);
+    EXPECT_EQ(std::string(buf), RefInt("%04llu", v));
+    if (v <= UINT_MAX) {
+      format_unsigned(buf, sizeof(buf), v);
+      EXPECT_EQ(std::string(buf), RefInt("%u", static_cast<unsigned>(v)));
+      format_hex(buf, sizeof(buf), v, 4, true);
+      EXPECT_EQ(std::string(buf), RefInt("%04X", static_cast<unsigned>(v)));
+      format_hex(buf, sizeof(buf), v, 6, true);
+      EXPECT_EQ(std::string(buf), RefInt("%06X", static_cast<unsigned>(v)));
+      format_hex(buf, sizeof(buf), v, 8, true);
+      EXPECT_EQ(std::string(buf), RefInt("%08X", static_cast<unsigned>(v)));
+      format_hex(buf, sizeof(buf), v, 12, true);
+      EXPECT_EQ(std::string(buf), RefInt("%012X", static_cast<unsigned>(v)));
+      format_hex(buf, sizeof(buf), v, 2, true);
+      EXPECT_EQ(std::string(buf), RefInt("%02X", static_cast<unsigned>(v)));
+      format_hex(buf, sizeof(buf), v, 4, false);
+      EXPECT_EQ(std::string(buf), RefInt("%04x", static_cast<unsigned>(v)));
+    }
+    format_hex(buf, sizeof(buf), v, 0, true);
+    EXPECT_EQ(std::string(buf), RefInt("%llX", v));
+  }
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/validation_eval_test.cpp b/tests/unit/validation_eval_test.cpp
new file mode 100644
index 000000000..69d1e2ed3
--- /dev/null
+++ b/tests/unit/validation_eval_test.cpp
@@ -0,0 +1,766 @@
+#include "cf/validation_eval.h"
+
+#include <cstdint>
+#include <cstdio>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "io/ooxml_reader.h"
+#include "sheet.h"
+#include "value.h"
+#include "workbook.h"
+
+#ifndef FORMULON_FIXTURES_DIR
+#error "FORMULON_FIXTURES_DIR must be defined by the build"
+#endif
+
+namespace formulon {
+namespace {
+
+enum class Ty : std::uint8_t { kNone, kWhole, kDecimal, kList, kDate, kTime, kTextLength, kCustom };
+enum class Op : std::uint8_t {
+  kBetween,
+  kNotBetween,
+  kEqual,
+  kNotEqual,
+  kGreaterThan,
+  kLessThan,
+  kGreaterThanOrEqual,
+  kLessThanOrEqual,
+  kNone
+};
+enum class In : std::uint8_t { kNum, kNumtext, kText, kBlank, kDate, kDatetime };
+enum class Src : std::uint8_t { kNone, kInline, kRange };
+enum class ListSrc : std::uint8_t { kInline, kRange, kInlineNum };
+
+Value Text(const char* s) {
+  return Value::text(s);
+}
+Value Blank() {
+  return Value::blank();
+}
+
+Value InputValue(In in) {
+  switch (in) {
+    case In::kNum:
+      return Value::number(5.0);
+    case In::kNumtext:
+      return Text("5");
+    case In::kText:
+      return Text("abcde");
+    case In::kBlank:
+      return Blank();
+    case In::kDate:
+      return Value::number(45306.0);
+    case In::kDatetime:
+      return Value::number(45306.5);
+  }
+  return Blank();
+}
+
+/// A one-sheet workbook with the list source `H1:H3` = a, b, c and a single rule on A1.
+struct Fixture {
+  Workbook wb = Workbook::create_empty();
+  std::size_t sheet_index = 0;
+
+  Fixture() {
+    sheet_index = wb.add_sheet("S");
+    wb.set_cell_text(sheet_index, 0, 7, "a");
+    wb.set_cell_text(sheet_index, 1, 7, "b");
+    wb.set_cell_text(sheet_index, 2, 7, "c");
+  }
+
+  Sheet& sheet() { return wb.sheet(sheet_index); }
+
+  void AddRule(Ty ty, Op op, bool allow_blank, std::string f1, std::string f2 = "", std::uint32_t row = 0,
+               std::uint32_t col = 0) {
+    DataValidation dv;
+    dv.ranges.push_back(MergeRange{row, col, row, col});
+    dv.type = static_cast<std::uint8_t>(ty);
+    dv.op = op == Op::kNone ? 0 : static_cast<std::uint8_t>(op);
+    dv.allow_blank = allow_blank;
+    dv.formula1 = std::move(f1);
+    dv.formula2 = std::move(f2);
+    sheet().mutable_validations().push_back(std::move(dv));
+  }
+
+  void Store(const Value& v, std::uint32_t row = 0, std::uint32_t col = 0) {
+    if (v.is_text()) {
+      wb.set_cell_text(sheet_index, row, col, std::string(v.as_text()));
+    } else if (!v.is_blank()) {
+      wb.set_cell_value(sheet_index, row, col, v);
+    }
+  }
+
+  ValidationOutcome Check(const Value& v, std::uint32_t row = 0, std::uint32_t col = 0) {
+    auto r = validate_value(wb, sheet(), row, col, v);
+    EXPECT_TRUE(static_cast<bool>(r));
+    return r.value();
+  }
+};
+
+std::string BoundOf(Ty ty, int which) {
+  switch (ty) {
+    case Ty::kDate:
+      return which == 1 ? "45292" : "45657";
+    case Ty::kTime:
+      return which == 1 ? "0.25" : "0.75";
+    case Ty::kTextLength:
+    case Ty::kWhole:
+    case Ty::kDecimal:
+      if (which == 1) {
+        return "3";
+      }
+      return "8";
+    default:
+      return "3";
+  }
+}
+
+bool IsRange(Op op) {
+  return op == Op::kBetween || op == Op::kNotBetween;
+}
+
+/// Bounds the probes used: 3/8 (whole, decimal, textLength), 45292/45657 (date), 0.25/0.75 (time).
+/// Single-bound operators carry only formula1: 3, 45292 and 0.25 respectively.
+bool CheckMatrixCell(Ty ty, Op op, bool allow_blank, In in) {
+  Fixture f;
+  f.AddRule(ty, op, allow_blank, BoundOf(ty, 1), IsRange(op) ? BoundOf(ty, 2) : "");
+  const Value v = InputValue(in);
+  f.Store(v);
+  return f.Check(v).valid;
+}
+
+// Matrix of measured results (Mac Excel `Validation.Value`), one row per type/operator/allowBlank;
+// `expect` lists validity for num, numtext, text, blank, date, datetime.
+struct MatrixRow {
+  Ty ty;
+  Op op;
+  bool allow_blank;
+  const char* expect;
+};
+
+const MatrixRow kMatrix[] = {
+    {Ty::kWhole, Op::kBetween, true, "100100"},
+    {Ty::kWhole, Op::kBetween, false, "100000"},
+    {Ty::kWhole, Op::kNotBetween, true, "000110"},
+    {Ty::kWhole, Op::kNotBetween, false, "000110"},
+    {Ty::kWhole, Op::kEqual, true, "000100"},
+    {Ty::kWhole, Op::kEqual, false, "000000"},
+    {Ty::kWhole, Op::kNotEqual, true, "100110"},
+    {Ty::kWhole, Op::kNotEqual, false, "100110"},
+    {Ty::kWhole, Op::kGreaterThan, true, "100110"},
+    {Ty::kWhole, Op::kGreaterThan, false, "100010"},
+    {Ty::kWhole, Op::kLessThan, true, "000100"},
+    {Ty::kWhole, Op::kLessThan, false, "000100"},
+    {Ty::kWhole, Op::kGreaterThanOrEqual, true, "100110"},
+    {Ty::kWhole, Op::kGreaterThanOrEqual, false, "100010"},
+    {Ty::kWhole, Op::kLessThanOrEqual, true, "000100"},
+    {Ty::kWhole, Op::kLessThanOrEqual, false, "000100"},
+    {Ty::kDecimal, Op::kBetween, true, "100100"},
+    {Ty::kDecimal, Op::kBetween, false, "100000"},
+    {Ty::kDecimal, Op::kNotBetween, true, "000111"},
+    {Ty::kDecimal, Op::kNotBetween, false, "000111"},
+    {Ty::kDecimal, Op::kEqual, true, "000100"},
+    {Ty::kDecimal, Op::kEqual, false, "000000"},
+    {Ty::kDecimal, Op::kNotEqual, true, "100111"},
+    {Ty::kDecimal, Op::kNotEqual, false, "100111"},
+    {Ty::kDecimal, Op::kGreaterThan, true, "100111"},
+    {Ty::kDecimal, Op::kGreaterThan, false, "100011"},
+    {Ty::kDecimal, Op::kLessThan, true, "000100"},
+    {Ty::kDecimal, Op::kLessThan, false, "000100"},
+    {Ty::kDecimal, Op::kGreaterThanOrEqual, true, "100111"},
+    {Ty::kDecimal, Op::kGreaterThanOrEqual, false, "100011"},
+    {Ty::kDecimal, Op::kLessThanOrEqual, true, "000100"},
+    {Ty::kDecimal, Op::kLessThanOrEqual, false, "000100"},
+    {Ty::kDate, Op::kBetween, true, "000111"},
+    {Ty::kDate, Op::kBetween, false, "000011"},
+    {Ty::kDate, Op::kNotBetween, true, "100100"},
+    {Ty::kDate, Op::kNotBetween, false, "100100"},
+    {Ty::kDate, Op::kEqual, true, "000100"},
+    {Ty::kDate, Op::kEqual, false, "000000"},
+    {Ty::kDate, Op::kNotEqual, true, "100111"},
+    {Ty::kDate, Op::kNotEqual, false, "100111"},
+    {Ty::kDate, Op::kGreaterThan, true, "000111"},
+    {Ty::kDate, Op::kGreaterThan, false, "000011"},
+    {Ty::kDate, Op::kLessThan, true, "100100"},
+    {Ty::kDate, Op::kLessThan, false, "100100"},
+    {Ty::kDate, Op::kGreaterThanOrEqual, true, "000111"},
+    {Ty::kDate, Op::kGreaterThanOrEqual, false, "000011"},
+    {Ty::kDate, Op::kLessThanOrEqual, true, "100100"},
+    {Ty::kDate, Op::kLessThanOrEqual, false, "100100"},
+    {Ty::kTime, Op::kBetween, true, "000100"},
+    {Ty::kTime, Op::kBetween, false, "000000"},
+    {Ty::kTime, Op::kNotBetween, true, "100111"},
+    {Ty::kTime, Op::kNotBetween, false, "100111"},
+    {Ty::kTime, Op::kEqual, true, "000100"},
+    {Ty::kTime, Op::kEqual, false, "000000"},
+    {Ty::kTime, Op::kNotEqual, true, "100111"},
+    {Ty::kTime, Op::kNotEqual, false, "100111"},
+    {Ty::kTime, Op::kGreaterThan, true, "100111"},
+    {Ty::kTime, Op::kGreaterThan, false, "100011"},
+    {Ty::kTime, Op::kLessThan, true, "000100"},
+    {Ty::kTime, Op::kLessThan, false, "000100"},
+    {Ty::kTime, Op::kGreaterThanOrEqual, true, "100111"},
+    {Ty::kTime, Op::kGreaterThanOrEqual, false, "100011"},
+    {Ty::kTime, Op::kLessThanOrEqual, true, "000100"},
+    {Ty::kTime, Op::kLessThanOrEqual, false, "000100"},
+    {Ty::kTextLength, Op::kBetween, true, "001111"},
+    {Ty::kTextLength, Op::kBetween, false, "001011"},
+    {Ty::kTextLength, Op::kNotBetween, true, "110100"},
+    {Ty::kTextLength, Op::kNotBetween, false, "110100"},
+    {Ty::kTextLength, Op::kEqual, true, "000100"},
+    {Ty::kTextLength, Op::kEqual, false, "000000"},
+    {Ty::kTextLength, Op::kNotEqual, true, "111111"},
+    {Ty::kTextLength, Op::kNotEqual, false, "111111"},
+    {Ty::kTextLength, Op::kGreaterThan, true, "001111"},
+    {Ty::kTextLength, Op::kGreaterThan, false, "001011"},
+    {Ty::kTextLength, Op::kLessThan, true, "110100"},
+    {Ty::kTextLength, Op::kLessThan, false, "110100"},
+    {Ty::kTextLength, Op::kGreaterThanOrEqual, true, "001111"},
+    {Ty::kTextLength, Op::kGreaterThanOrEqual, false, "001011"},
+    {Ty::kTextLength, Op::kLessThanOrEqual, true, "110100"},
+    {Ty::kTextLength, Op::kLessThanOrEqual, false, "110100"},
+};
+
+constexpr In kInputs[] = {In::kNum, In::kNumtext, In::kText, In::kBlank, In::kDate, In::kDatetime};
+
+struct ListRow {
+  ListSrc src;
+  bool allow_blank;
+  Value input;
+  bool valid;
+};
+
+const ListRow kListRows[] = {
+    {ListSrc::kInline, true, Text("a"), true},
+    {ListSrc::kInline, true, Text("A"), false},
+    {ListSrc::kInline, true, Text("B"), false},
+    {ListSrc::kInline, true, Text("1"), false},
+    {ListSrc::kInline, true, Text("d"), false},
+    {ListSrc::kInline, true, Blank(), true},
+    {ListSrc::kInline, true, Value::number(1.0), false},
+    {ListSrc::kInline, false, Text("a"), true},
+    {ListSrc::kInline, false, Text("A"), false},
+    {ListSrc::kInline, false, Text("B"), false},
+    {ListSrc::kInline, false, Text("1"), false},
+    {ListSrc::kInline, false, Text("d"), false},
+    {ListSrc::kInline, false, Blank(), false},
+    {ListSrc::kInline, false, Value::number(1.0), false},
+    {ListSrc::kRange, true, Text("a"), true},
+    {ListSrc::kRange, true, Text("A"), true},
+    {ListSrc::kRange, true, Text("B"), true},
+    {ListSrc::kRange, true, Text("1"), false},
+    {ListSrc::kRange, true, Text("d"), false},
+    {ListSrc::kRange, true, Blank(), true},
+    {ListSrc::kRange, true, Value::number(1.0), false},
+    {ListSrc::kRange, false, Text("a"), true},
+    {ListSrc::kRange, false, Text("A"), true},
+    {ListSrc::kRange, false, Text("B"), true},
+    {ListSrc::kRange, false, Text("1"), false},
+    {ListSrc::kRange, false, Text("d"), false},
+    {ListSrc::kRange, false, Blank(), false},
+    {ListSrc::kRange, false, Value::number(1.0), false},
+    {ListSrc::kInlineNum, true, Text("a"), false},
+    {ListSrc::kInlineNum, true, Text("A"), false},
+    {ListSrc::kInlineNum, true, Text("B"), false},
+    {ListSrc::kInlineNum, true, Value::number(1.0), true},
+    {ListSrc::kInlineNum, true, Text("d"), false},
+    {ListSrc::kInlineNum, true, Blank(), true},
+    {ListSrc::kInlineNum, true, Value::number(1.0), true},
+    {ListSrc::kInlineNum, false, Text("a"), false},
+    {ListSrc::kInlineNum, false, Text("A"), false},
+    {ListSrc::kInlineNum, false, Text("B"), false},
+    {ListSrc::kInlineNum, false, Value::number(1.0), true},
+    {ListSrc::kInlineNum, false, Text("d"), false},
+    {ListSrc::kInlineNum, false, Blank(), false},
+    {ListSrc::kInlineNum, false, Value::number(1.0), true},
+};
+
+struct CustomRow {
+  const char* formula;
+  bool allow_blank;
+  In in;
+  bool valid;
+};
+
+const CustomRow kCustomRows[] = {
+    {"ISNUMBER(A1)", true, In::kNum, true},
+    {"ISNUMBER(A1)", true, In::kNumtext, false},
+    {"ISNUMBER(A1)", true, In::kText, false},
+    {"ISNUMBER(A1)", true, In::kBlank, true},
+    {"ISNUMBER(A1)", true, In::kDate, true},
+    {"ISNUMBER(A1)", true, In::kDatetime, true},
+    {"ISNUMBER(A1)", false, In::kNum, true},
+    {"ISNUMBER(A1)", false, In::kNumtext, false},
+    {"ISNUMBER(A1)", false, In::kText, false},
+    {"ISNUMBER(A1)", false, In::kBlank, false},
+    {"ISNUMBER(A1)", false, In::kDate, true},
+    {"ISNUMBER(A1)", false, In::kDatetime, true},
+    {"A1>3", true, In::kNum, true},
+    {"A1>3", true, In::kNumtext, true},
+    {"A1>3", true, In::kText, true},
+    {"A1>3", true, In::kBlank, true},
+    {"A1>3", true, In::kDate, true},
+    {"A1>3", true, In::kDatetime, true},
+    {"A1>3", false, In::kNum, true},
+    {"A1>3", false, In::kNumtext, true},
+    {"A1>3", false, In::kText, true},
+    {"A1>3", false, In::kBlank, false},
+    {"A1>3", false, In::kDate, true},
+    {"A1>3", false, In::kDatetime, true},
+    {"A1", true, In::kNum, true},
+    {"A1", true, In::kNumtext, false},
+    {"A1", true, In::kText, false},
+    {"A1", true, In::kBlank, true},
+    {"A1", true, In::kDate, true},
+    {"A1", true, In::kDatetime, true},
+    {"A1", false, In::kNum, true},
+    {"A1", false, In::kNumtext, false},
+    {"A1", false, In::kText, false},
+    {"A1", false, In::kBlank, false},
+    {"A1", false, In::kDate, true},
+    {"A1", false, In::kDatetime, true},
+    {"LEN(A1)>2", true, In::kNum, false},
+    {"LEN(A1)>2", true, In::kNumtext, false},
+    {"LEN(A1)>2", true, In::kText, true},
+    {"LEN(A1)>2", true, In::kBlank, true},
+    {"LEN(A1)>2", true, In::kDate, true},
+    {"LEN(A1)>2", true, In::kDatetime, true},
+    {"LEN(A1)>2", false, In::kNum, false},
+    {"LEN(A1)>2", false, In::kNumtext, false},
+    {"LEN(A1)>2", false, In::kText, true},
+    {"LEN(A1)>2", false, In::kBlank, false},
+    {"LEN(A1)>2", false, In::kDate, true},
+    {"LEN(A1)>2", false, In::kDatetime, true},
+    {"TRUE", true, In::kNum, true},
+    {"TRUE", true, In::kNumtext, true},
+    {"TRUE", true, In::kText, true},
+    {"TRUE", true, In::kBlank, true},
+    {"TRUE", true, In::kDate, true},
+    {"TRUE", true, In::kDatetime, true},
+    {"TRUE", false, In::kNum, true},
+    {"TRUE", false, In::kNumtext, true},
+    {"TRUE", false, In::kText, true},
+    {"TRUE", false, In::kBlank, true},
+    {"TRUE", false, In::kDate, true},
+    {"TRUE", false, In::kDatetime, true},
+    {"FALSE", true, In::kNum, false},
+    {"FALSE", true, In::kNumtext, false},
+    {"FALSE", true, In::kText, false},
+    {"FALSE", true, In::kBlank, true},
+    {"FALSE", true, In::kDate, false},
+    {"FALSE", true, In::kDatetime, false},
+    {"FALSE", false, In::kNum, false},
+    {"FALSE", false, In::kNumtext, false},
+    {"FALSE", false, In::kText, false},
+    {"FALSE", false, In::kBlank, false},
+    {"FALSE", false, In::kDate, false},
+    {"FALSE", false, In::kDatetime, false},
+    {"1", true, In::kNum, true},
+    {"1", true, In::kNumtext, true},
+    {"1", true, In::kText, true},
+    {"1", true, In::kBlank, true},
+    {"1", true, In::kDate, true},
+    {"1", true, In::kDatetime, true},
+    {"1", false, In::kNum, true},
+    {"1", false, In::kNumtext, true},
+    {"1", false, In::kText, true},
+    {"1", false, In::kBlank, true},
+    {"1", false, In::kDate, true},
+    {"1", false, In::kDatetime, true},
+    {"0", true, In::kNum, false},
+    {"0", true, In::kNumtext, false},
+    {"0", true, In::kText, false},
+    {"0", true, In::kBlank, true},
+    {"0", true, In::kDate, false},
+    {"0", true, In::kDatetime, false},
+    {"0", false, In::kNum, false},
+    {"0", false, In::kNumtext, false},
+    {"0", false, In::kText, false},
+    {"0", false, In::kBlank, false},
+    {"0", false, In::kDate, false},
+    {"0", false, In::kDatetime, false},
+    {"\"x\"", true, In::kNum, false},
+    {"\"x\"", true, In::kNumtext, false},
+    {"\"x\"", true, In::kText, false},
+    {"\"x\"", true, In::kBlank, true},
+    {"\"x\"", true, In::kDate, false},
+    {"\"x\"", true, In::kDatetime, false},
+    {"\"x\"", false, In::kNum, false},
+    {"\"x\"", false, In::kNumtext, false},
+    {"\"x\"", false, In::kText, false},
+    {"\"x\"", false, In::kBlank, false},
+    {"\"x\"", false, In::kDate, false},
+    {"\"x\"", false, In::kDatetime, false},
+    {"A1=\"abcde\"", true, In::kNum, false},
+    {"A1=\"abcde\"", true, In::kNumtext, false},
+    {"A1=\"abcde\"", true, In::kText, true},
+    {"A1=\"abcde\"", true, In::kBlank, true},
+    {"A1=\"abcde\"", true, In::kDate, false},
+    {"A1=\"abcde\"", true, In::kDatetime, false},
+    {"A1=\"abcde\"", false, In::kNum, false},
+    {"A1=\"abcde\"", false, In::kNumtext, false},
+    {"A1=\"abcde\"", false, In::kText, true},
+    {"A1=\"abcde\"", false, In::kBlank, false},
+    {"A1=\"abcde\"", false, In::kDate, false},
+    {"A1=\"abcde\"", false, In::kDatetime, false},
+};
+
+const char* ListFormula(ListSrc src) {
+  switch (src) {
+    case ListSrc::kInline:
+      return "\"a,b,c\"";
+    case ListSrc::kRange:
+      return "$H$1:$H$3";
+    case ListSrc::kInlineNum:
+      return "\"1,2,3\"";
+  }
+  return "";
+}
+
+// Pairwise model (greedy all-pairs over valid combinations):
+//   type(8): none, whole, decimal, date, time, textLength, list, custom
+//   operator(8): between, notBetween, equal, notEqual, greaterThan, lessThan,
+//                greaterThanOrEqual, lessThanOrEqual (only for whole/decimal/date/time/textLength)
+//   allowBlank(2): true, false
+//   input kind(6): number 5, numeric text "5", text "abcde", blank, date 45306, datetime 45306.5
+//   list source(2): inline "a,b,c", range H1:H3 = a,b,c (only for list)
+// Combinations are 528 valid tuples; the table below is 72 rows covering every pair of
+// parameter values that co-occur. Expected values come from the measured matrix: typed rows
+// from the matrix table, list rows are invalid unless blank is allowed (none of the six
+// inputs is a list member), custom rows use ISNUMBER(A1), type none is always valid.
+struct PairRow {
+  Ty ty;
+  Op op;
+  bool allow_blank;
+  In in;
+  Src src;
+  bool valid;
+};
+
+const PairRow kPairs[] = {
+    {Ty::kNone, Op::kNone, false, In::kNum, Src::kNone, true},
+    {Ty::kNone, Op::kNone, false, In::kText, Src::kNone, true},
+    {Ty::kNone, Op::kNone, false, In::kBlank, Src::kNone, true},
+    {Ty::kNone, Op::kNone, false, In::kDate, Src::kNone, true},
+    {Ty::kNone, Op::kNone, false, In::kDatetime, Src::kNone, true},
+    {Ty::kNone, Op::kNone, true, In::kNumtext, Src::kNone, true},
+    {Ty::kWhole, Op::kBetween, false, In::kNum, Src::kNone, true},
+    {Ty::kWhole, Op::kBetween, false, In::kDatetime, Src::kNone, false},
+    {Ty::kWhole, Op::kNotBetween, false, In::kDate, Src::kNone, true},
+    {Ty::kWhole, Op::kNotBetween, true, In::kNumtext, Src::kNone, false},
+    {Ty::kWhole, Op::kEqual, false, In::kBlank, Src::kNone, false},
+    {Ty::kWhole, Op::kEqual, false, In::kDatetime, Src::kNone, false},
+    {Ty::kWhole, Op::kNotEqual, false, In::kText, Src::kNone, false},
+    {Ty::kWhole, Op::kNotEqual, false, In::kDatetime, Src::kNone, false},
+    {Ty::kWhole, Op::kGreaterThan, false, In::kBlank, Src::kNone, false},
+    {Ty::kWhole, Op::kGreaterThan, true, In::kDatetime, Src::kNone, false},
+    {Ty::kWhole, Op::kLessThan, false, In::kText, Src::kNone, false},
+    {Ty::kWhole, Op::kLessThan, false, In::kBlank, Src::kNone, true},
+    {Ty::kWhole, Op::kGreaterThanOrEqual, false, In::kNumtext, Src::kNone, false},
+    {Ty::kWhole, Op::kGreaterThanOrEqual, false, In::kBlank, Src::kNone, false},
+    {Ty::kWhole, Op::kLessThanOrEqual, false, In::kText, Src::kNone, false},
+    {Ty::kWhole, Op::kLessThanOrEqual, false, In::kDate, Src::kNone, false},
+    {Ty::kDecimal, Op::kBetween, false, In::kDate, Src::kNone, false},
+    {Ty::kDecimal, Op::kNotBetween, false, In::kDatetime, Src::kNone, true},
+    {Ty::kDecimal, Op::kEqual, false, In::kNumtext, Src::kNone, false},
+    {Ty::kDecimal, Op::kNotEqual, true, In::kNum, Src::kNone, true},
+    {Ty::kDecimal, Op::kGreaterThan, false, In::kNum, Src::kNone, true},
+    {Ty::kDecimal, Op::kLessThan, false, In::kNum, Src::kNone, false},
+    {Ty::kDecimal, Op::kGreaterThanOrEqual, true, In::kText, Src::kNone, false},
+    {Ty::kDecimal, Op::kLessThanOrEqual, true, In::kBlank, Src::kNone, true},
+    {Ty::kDate, Op::kBetween, true, In::kBlank, Src::kNone, true},
+    {Ty::kDate, Op::kNotBetween, false, In::kText, Src::kNone, false},
+    {Ty::kDate, Op::kEqual, false, In::kNum, Src::kNone, false},
+    {Ty::kDate, Op::kNotEqual, false, In::kNumtext, Src::kNone, false},
+    {Ty::kDate, Op::kGreaterThan, false, In::kNumtext, Src::kNone, false},
+    {Ty::kDate, Op::kLessThan, false, In::kDate, Src::kNone, false},
+    {Ty::kDate, Op::kGreaterThanOrEqual, false, In::kDatetime, Src::kNone, true},
+    {Ty::kDate, Op::kLessThanOrEqual, false, In::kNum, Src::kNone, true},
+    {Ty::kTime, Op::kBetween, false, In::kNumtext, Src::kNone, false},
+    {Ty::kTime, Op::kNotBetween, false, In::kNum, Src::kNone, true},
+    {Ty::kTime, Op::kEqual, true, In::kText, Src::kNone, false},
+    {Ty::kTime, Op::kNotEqual, false, In::kBlank, Src::kNone, true},
+    {Ty::kTime, Op::kGreaterThan, false, In::kText, Src::kNone, false},
+    {Ty::kTime, Op::kLessThan, false, In::kNumtext, Src::kNone, false},
+    {Ty::kTime, Op::kGreaterThanOrEqual, false, In::kDate, Src::kNone, true},
+    {Ty::kTime, Op::kLessThanOrEqual, false, In::kDatetime, Src::kNone, false},
+    {Ty::kTextLength, Op::kBetween, false, In::kText, Src::kNone, true},
+    {Ty::kTextLength, Op::kNotBetween, false, In::kBlank, Src::kNone, true},
+    {Ty::kTextLength, Op::kEqual, false, In::kDate, Src::kNone, false},
+    {Ty::kTextLength, Op::kNotEqual, false, In::kDate, Src::kNone, true},
+    {Ty::kTextLength, Op::kGreaterThan, false, In::kDate, Src::kNone, true},
+    {Ty::kTextLength, Op::kLessThan, true, In::kDatetime, Src::kNone, false},
+    {Ty::kTextLength, Op::kGreaterThanOrEqual, false, In::kNum, Src::kNone, false},
+    {Ty::kTextLength, Op::kLessThanOrEqual, false, In::kNumtext, Src::kNone, true},
+    {Ty::kList, Op::kNone, false, In::kNum, Src::kInline, false},
+    {Ty::kList, Op::kNone, false, In::kNum, Src::kRange, false},
+    {Ty::kList, Op::kNone, false, In::kNumtext, Src::kRange, false},
+    {Ty::kList, Op::kNone, false, In::kText, Src::kInline, false},
+    {Ty::kList, Op::kNone, false, In::kText, Src::kRange, false},
+    {Ty::kList, Op::kNone, false, In::kBlank, Src::kInline, false},
+    {Ty::kList, Op::kNone, false, In::kBlank, Src::kRange, false},
+    {Ty::kList, Op::kNone, false, In::kDate, Src::kInline, false},
+    {Ty::kList, Op::kNone, false, In::kDatetime, Src::kInline, false},
+    {Ty::kList, Op::kNone, false, In::kDatetime, Src::kRange, false},
+    {Ty::kList, Op::kNone, true, In::kNumtext, Src::kInline, false},
+    {Ty::kList, Op::kNone, true, In::kDate, Src::kRange, false},
+    {Ty::kCustom, Op::kNone, false, In::kNum, Src::kNone, true},
+    {Ty::kCustom, Op::kNone, false, In::kText, Src::kNone, false},
+    {Ty::kCustom, Op::kNone, false, In::kBlank, Src::kNone, false},
+    {Ty::kCustom, Op::kNone, false, In::kDate, Src::kNone, true},
+    {Ty::kCustom, Op::kNone, false, In::kDatetime, Src::kNone, true},
+    {Ty::kCustom, Op::kNone, true, In::kNumtext, Src::kNone, false},
+};
+
+bool RunPair(const PairRow& p) {
+  Fixture f;
+  switch (p.ty) {
+    case Ty::kList:
+      f.AddRule(p.ty, Op::kNone, p.allow_blank, p.src == Src::kInline ? "\"a,b,c\"" : "$H$1:$H$3");
+      break;
+    case Ty::kCustom:
+      f.AddRule(p.ty, Op::kNone, p.allow_blank, "ISNUMBER(A1)");
+      break;
+    case Ty::kNone:
+      f.AddRule(p.ty, Op::kNone, p.allow_blank, "");
+      break;
+    default:
+      f.AddRule(p.ty, p.op, p.allow_blank, BoundOf(p.ty, 1), IsRange(p.op) ? BoundOf(p.ty, 2) : "");
+      break;
+  }
+  const Value v = InputValue(p.in);
+  f.Store(v);
+  return f.Check(v).valid;
+}
+
+TEST(ValidationEval, PairwiseTable) {
+  for (const PairRow& p : kPairs) {
+    EXPECT_EQ(RunPair(p), p.valid) << "type=" << static_cast<int>(p.ty) << " op=" << static_cast<int>(p.op)
+                                   << " allowBlank=" << p.allow_blank << " input=" << static_cast<int>(p.in)
+                                   << " src=" << static_cast<int>(p.src);
+  }
+}
+
+TEST(ValidationEval, ProbeTable) {
+  for (const MatrixRow& row : kMatrix) {
+    for (int i = 0; i < 6; ++i) {
+      EXPECT_EQ(CheckMatrixCell(row.ty, row.op, row.allow_blank, kInputs[i]), row.expect[i] == '1')
+          << "type=" << static_cast<int>(row.ty) << " op=" << static_cast<int>(row.op)
+          << " allowBlank=" << row.allow_blank << " input=" << i;
+    }
+  }
+  int idx = 0;
+  for (const ListRow& row : kListRows) {
+    Fixture f;
+    f.AddRule(Ty::kList, Op::kNone, row.allow_blank, ListFormula(row.src));
+    f.Store(row.input);
+    EXPECT_EQ(f.Check(row.input).valid, row.valid) << "list row " << idx;
+    ++idx;
+  }
+  idx = 0;
+  for (const CustomRow& row : kCustomRows) {
+    Fixture f;
+    f.AddRule(Ty::kCustom, Op::kNone, row.allow_blank, row.formula);
+    const Value v = InputValue(row.in);
+    f.Store(v);
+    EXPECT_EQ(f.Check(v).valid, row.valid) << "custom row " << idx << " " << row.formula;
+    ++idx;
+  }
+}
+
+// textLength counts the value text (as LEN does), not the formatted display; numbers that
+// General renders with fifteen significant digits count those digits.
+TEST(ValidationEval, TextLengthUsesValueText) {
+  struct Case {
+    Value v;
+    const char* len;
+    bool valid;
+  };
+  const Case cases[] = {
+      {Value::number(12345.6), "7", true},     {Value::number(12345.6), "8", false},
+      {Value::number(5.0), "1", true},         {Value::number(5.0), "3", false},
+      {Value::number(0.1), "3", true},         {Value::number(45306.0), "5", true},
+      {Value::number(45306.0), "9", false},    {Value::boolean(true), "4", true},
+      {Value::number(1e20), "5", true},        {Value::number(1.0 / 3.0), "17", true},
+      {Value::number(1.0 / 3.0), "16", false}, {Value::number(1.0 / 3.0), "15", false},
+  };
+  for (const Case& c : cases) {
+    Fixture f;
+    f.AddRule(Ty::kTextLength, Op::kEqual, true, c.len);
+    EXPECT_EQ(f.Check(c.v).valid, c.valid) << c.len;
+  }
+  // UTF-16 units: a supplementary-plane character counts twice.
+  Fixture f;
+  f.AddRule(Ty::kTextLength, Op::kEqual, true, "3");
+  EXPECT_TRUE(f.Check(Text("a\xF0\x9F\x98\x80")).valid);
+}
+
+TEST(ValidationEval, WholeBoundsFromCellReferences) {
+  Fixture f;
+  f.wb.set_cell_value(f.sheet_index, 0, 9, Value::number(3.0));
+  f.wb.set_cell_value(f.sheet_index, 1, 9, Value::number(8.0));
+  f.AddRule(Ty::kWhole, Op::kBetween, true, "$J$1", "$J$2");
+  EXPECT_TRUE(f.Check(Value::number(5.0)).valid);
+  EXPECT_FALSE(f.Check(Value::number(9.0)).valid);
+}
+
+TEST(ValidationEval, WholeRejectsFractionAndAcceptsLargeBound) {
+  Fixture f;
+  f.AddRule(Ty::kWhole, Op::kGreaterThanOrEqual, true, "-100000000000");
+  EXPECT_TRUE(f.Check(Value::number(5.0)).valid);
+  EXPECT_FALSE(f.Check(Value::number(5.5)).valid);
+  EXPECT_TRUE(f.Check(Value::number(-5.0)).valid);
+  EXPECT_TRUE(f.Check(Value::number(1e10)).valid);
+}
+
+// Relative references in a rule are shifted from the sqref's top-left cell to the checked cell.
+TEST(ValidationEval, RelativeFormulaShiftsFromSqrefAnchor) {
+  Fixture f;
+  DataValidation dv;
+  dv.ranges.push_back(MergeRange{0, 0, 2, 0});  // A1:A3
+  dv.type = static_cast<std::uint8_t>(Ty::kCustom);
+  dv.formula1 = "B1>0";
+  f.sheet().mutable_validations().push_back(dv);
+  f.wb.set_cell_value(f.sheet_index, 0, 1, Value::number(1.0));
+  f.wb.set_cell_value(f.sheet_index, 1, 1, Value::number(0.0));
+  f.wb.set_cell_value(f.sheet_index, 2, 1, Value::number(7.0));
+  EXPECT_TRUE(f.Check(Value::number(1.0), 0, 0).valid);
+  EXPECT_FALSE(f.Check(Value::number(1.0), 1, 0).valid);
+  EXPECT_TRUE(f.Check(Value::number(1.0), 2, 0).valid);
+}
+
+TEST(ValidationEval, QualifiedBuiltinCustomFormulaDoesNotPass) {
+  Fixture f;
+  ASSERT_TRUE(static_cast<bool>(
+      f.wb.set_defined_name_scoped("SUM", "LAMBDA(x,x+100)", static_cast<std::int32_t>(f.sheet_index))));
+  f.AddRule(Ty::kCustom, Op::kNone, true, "S!SUM(7)");
+  EXPECT_FALSE(f.Check(Value::number(0.0)).valid);
+}
+
+TEST(ValidationEval, NoRuleAndOutcomeFields) {
+  Fixture f;
+  f.AddRule(Ty::kWhole, Op::kEqual, true, "3", "", 4, 4);
+  f.sheet().mutable_validations()[0].error_style = 2;
+  ValidationOutcome none = f.Check(Value::number(1.0), 0, 0);
+  EXPECT_FALSE(none.has_rule);
+  EXPECT_TRUE(none.valid);
+  ValidationOutcome hit = f.Check(Value::number(1.0), 4, 4);
+  EXPECT_TRUE(hit.has_rule);
+  EXPECT_FALSE(hit.valid);
+  EXPECT_EQ(hit.rule_index, 0U);
+  EXPECT_EQ(hit.error_style, 2U);
+  auto oob = validate_value(f.wb, f.sheet(), Sheet::kMaxRows, 0, Value::number(1.0));
+  ASSERT_FALSE(static_cast<bool>(oob));
+  EXPECT_EQ(oob.error().code, FormulonErrorCode::kInvalidArgument);
+}
+
+// Measured on overlapping sqrefs: R1 whole 1..3 on A1:A3, R2 whole 10..20 on A1:A2. The rule
+// that comes first in file order is the only one applied, whichever order they are declared in.
+TEST(ValidationEval, OverlapPicksOneRule) {
+  for (const bool r1_first : {true, false}) {
+    Fixture f;
+    DataValidation r1;
+    r1.ranges.push_back(MergeRange{0, 0, 2, 0});
+    r1.type = static_cast<std::uint8_t>(Ty::kWhole);
+    r1.formula1 = "1";
+    r1.formula2 = "3";
+    DataValidation r2;
+    r2.ranges.push_back(MergeRange{0, 0, 1, 0});
+    r2.type = static_cast<std::uint8_t>(Ty::kWhole);
+    r2.formula1 = "10";
+    r2.formula2 = "20";
+    auto& rules = f.sheet().mutable_validations();
+    if (r1_first) {
+      rules.push_back(r1);
+      rules.push_back(r2);
+    } else {
+      rules.push_back(r2);
+      rules.push_back(r1);
+    }
+    const std::uint32_t r1_index = r1_first ? 0U : 1U;
+    const std::uint32_t r2_index = r1_first ? 1U : 0U;
+    const std::uint32_t first = 0U;
+    for (const double v : {2.0, 15.0, 99.0}) {
+      const ValidationOutcome o = f.Check(Value::number(v), 0, 0);
+      EXPECT_TRUE(o.has_rule);
+      EXPECT_EQ(o.rule_index, first);
+      const bool in_first = r1_first ? (v >= 1 && v <= 3) : (v >= 10 && v <= 20);
+      EXPECT_EQ(o.valid, in_first) << "r1_first=" << r1_first << " v=" << v;
+    }
+    // A3 is covered by R1 alone.
+    const ValidationOutcome a3 = f.Check(Value::number(2.0), 2, 0);
+    EXPECT_EQ(a3.rule_index, r1_index);
+    EXPECT_TRUE(a3.valid);
+    (void)r2_index;
+  }
+}
+
+std::vector<std::uint8_t> ReadFile(const char* file) {
+  std::vector<std::uint8_t> out;
+  const std::string path = std::string(FORMULON_FIXTURES_DIR) + "/excel/" + file;
+  FILE* fp = std::fopen(path.c_str(), "rb");
+  if (fp == nullptr) {
+    ADD_FAILURE() << "could not open fixture: " << path;
+    return out;
+  }
+  std::fseek(fp, 0, SEEK_END);
+  const long size = std::ftell(fp);
+  std::fseek(fp, 0, SEEK_SET);
+  out.resize(size > 0 ? static_cast<std::size_t>(size) : 0U);
+  if (std::fread(out.data(), 1, out.size(), fp) != out.size()) {
+    ADD_FAILURE() << "short read on fixture: " << path;
+    out.clear();
+  }
+  std::fclose(fp);
+  return out;
+}
+
+bool CheckStored(const Workbook& wb, std::uint32_t row, std::uint32_t col) {
+  const Sheet& s = wb.sheet(0);
+  auto r = validate_value(wb, s, row, col, s.resolve_cell_value(row, col));
+  EXPECT_TRUE(static_cast<bool>(r));
+  EXPECT_TRUE(r.value().has_rule) << "row " << row << " col " << col;
+  return r.value().valid;
+}
+
+// The Excel-saved matrix workbook: every stored cell is validated against its own rule and
+// compared with the measured result for that row.
+TEST(ValidationEval, FixtureMatrix) {
+  const std::vector<std::uint8_t> bytes = ReadFile("data_validation_matrix.xlsx");
+  auto read = io::read_ooxml(io::ByteSpan{bytes.data(), bytes.size()});
+  ASSERT_TRUE(static_cast<bool>(read));
+  const Workbook& wb = read.value().workbook;
+
+  // Rows 1-80: type/operator/allowBlank matrix, inputs in columns A..F.
+  std::uint32_t row = 0;
+  for (const MatrixRow& m : kMatrix) {
+    for (std::uint32_t c = 0; c < 6; ++c) {
+      EXPECT_EQ(CheckStored(wb, row, c), m.expect[c] == '1') << "matrix row " << row + 1 << " col " << c;
+    }
+    ++row;
+  }
+  // Rows 81-122: list probes, one cell each.
+  for (const ListRow& l : kListRows) {
+    EXPECT_EQ(CheckStored(wb, row, 0), l.valid) << "list row " << row + 1;
+    ++row;
+  }
+  // Rows 123-242: custom probes, one cell each.
+  for (const CustomRow& c : kCustomRows) {
+    EXPECT_EQ(CheckStored(wb, row, 0), c.valid) << "custom row " << row + 1;
+    ++row;
+  }
+  // Rows 243-261: textLength on formatted values, cell-reference bounds, large whole bound.
+  const bool tail[] = {true, false, true,  false, true,  true, true,  false, true, true,
+                       true, false, false, true,  false, true, false, true,  true};
+  for (const bool expect : tail) {
+    EXPECT_EQ(CheckStored(wb, row, 0), expect) << "tail row " << row + 1;
+    ++row;
+  }
+  EXPECT_EQ(row, 261U);
+}
+
+}  // namespace
+}  // namespace formulon
diff --git a/tests/unit/workbook_test.cpp b/tests/unit/workbook_test.cpp
index 1cbe39ff4..5b1347e76 100644
--- a/tests/unit/workbook_test.cpp
+++ b/tests/unit/workbook_test.cpp
@@ -6,6 +6,7 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <memory>
 #include <utility>
 #include <vector>
 
@@ -14,7 +15,11 @@
 #include "eval/recalc_engine.h"
 #include "gtest/gtest.h"
 #include "passthrough_part.h"
+#include "pivot/pivot_cache.h"
+#include "pivot/pivot_table.h"
+#include "pivot/pivot_types.h"
 #include "sheet.h"
+#include "utils/date_time.h"
 #include "value.h"
 
 namespace formulon {
@@ -175,6 +180,67 @@ Value recalc_a1(Workbook& wb) {
   return cell == nullptr ? Value::blank() : cell->cached_value;
 }
 
+std::unique_ptr<pivot::PivotCache> BuildClockPivotCache() {
+  auto cache = std::make_unique<pivot::PivotCache>();
+  cache->set_cache_id(1U);
+  cache->mutable_fields().push_back(pivot::PivotCacheField{"Date", {}});
+  cache->mutable_fields().push_back(pivot::PivotCacheField{"Amount", {}});
+
+  for (const auto& [date, amount] : std::vector<std::pair<double, double>>{{100.0, 100.0}, {200.0, 200.0}}) {
+    pivot::PivotCacheRecord record;
+    record.cells.push_back(Value::number(date));
+    record.cells.push_back(Value::number(amount));
+    cache->mutable_records().push_back(std::move(record));
+  }
+  return cache;
+}
+
+std::unique_ptr<pivot::PivotTable> BuildClockPivotTable() {
+  auto table = std::make_unique<pivot::PivotTable>();
+  table->set_name("ClockPivot");
+  table->set_pivot_cache_id(1U);
+  table->set_anchor(0U, 0U, 1U, 1U);
+
+  pivot::PivotField date_field;
+  date_field.source_name = "Date";
+  table->mutable_fields().push_back(std::move(date_field));
+
+  pivot::PivotField amount_field;
+  amount_field.source_name = "Amount";
+  amount_field.axis = pivot::PivotAxis::Value;
+  table->mutable_fields().push_back(std::move(amount_field));
+
+  pivot::PivotDataField amount_data;
+  amount_data.name = "Sum of Amount";
+  amount_data.field_index = 1U;
+  amount_data.aggregation = pivot::Aggregation::Sum;
+  table->mutable_data_fields().push_back(std::move(amount_data));
+
+  pivot::AuthoredPeriodFilter period;
+  period.field_index = 0U;
+  period.period = pivot::RelativePeriod::ThisQuarter;
+  table->mutable_authored_period_filters().push_back(period);
+  return table;
+}
+
+Workbook BuildClockPivotWorkbook() {
+  Workbook wb = Workbook::create();
+  wb.add_pivot_cache(BuildClockPivotCache());
+  wb.sheet(0U).add_pivot_table(BuildClockPivotTable());
+  return wb;
+}
+
+pivot::PivotTable* ClockPivot(Workbook& wb) {
+  const auto& tables = wb.sheet(0U).pivot_tables();
+  return tables.empty() ? nullptr : tables.front().get();
+}
+
+Value RecalcCell(Workbook& wb, std::uint32_t row, std::uint32_t col) {
+  EXPECT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Cell* cell = wb.sheet(0U).cell_at(row, col);
+  return cell == nullptr ? Value::blank() : cell->cached_value;
+}
+
 }  // namespace
 
 TEST(WorkbookTest, RedefiningLambdaNameRecalcsItsCallers) {
@@ -303,5 +369,172 @@ TEST(WorkbookTest, RedefiningWorkbookNameRecalcsSelfBookReferences) {
   EXPECT_DOUBLE_EQ(v.as_number(), 6.0);
 }
 
+TEST(WorkbookTest, ChangingExcelProfileRecalculatesCachedFormulasAndDependents) {
+  Workbook wb = Workbook::create();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 0U, 0U, Value::text("あ"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_value(0U, 1U, 0U, Value::text("ア"))));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=COUNTIF(A1:A2,\"あ\")")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 1U, 1U, "=B1*10")));
+
+  const auto expect_values = [&](double count) {
+    const Cell* root = wb.sheet(0U).cell_at(0U, 1U);
+    const Cell* dependent = wb.sheet(0U).cell_at(1U, 1U);
+    ASSERT_NE(root, nullptr);
+    ASSERT_NE(dependent, nullptr);
+    ASSERT_TRUE(root->cached_value.is_number());
+    ASSERT_TRUE(dependent->cached_value.is_number());
+    EXPECT_DOUBLE_EQ(root->cached_value.as_number(), count);
+    EXPECT_DOUBLE_EQ(dependent->cached_value.as_number(), count * 10.0);
+  };
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  expect_values(1.0);
+
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  expect_values(2.0);
+
+  wb.set_excel_profile(win_365_ja_jp_profile());
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  expect_values(1.0);
+
+  wb.set_excel_profile(win_365_ja_jp_profile());
+  const auto unchanged = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(unchanged));
+  EXPECT_EQ(unchanged.value().cells_evaluated, 0U);
+  expect_values(1.0);
+}
+
+TEST(WorkbookTest, ChangingExcelProfileInvalidatesPivotAndFormulaCaches) {
+  Workbook wb = BuildClockPivotWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=GETPIVOTDATA(\"Sum of Amount\",A1)")));
+  wb.set_pinned_now(date_time::CivilTime{{1900, 5U, 15U}, {0U, 0U, 0U}});
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+
+  pivot::PivotTable* table = ClockPivot(wb);
+  ASSERT_NE(table, nullptr);
+  const auto before = table->last_result();
+  ASSERT_NE(before, nullptr);
+  table->mark_span_authored();
+  ASSERT_TRUE(table->has_authored_span());
+
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  EXPECT_EQ(table->last_result(), nullptr);
+  EXPECT_FALSE(table->has_authored_span());
+  auto changed = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(changed));
+  EXPECT_EQ(changed.value().cells_evaluated, 1U);
+  const auto after = table->last_result();
+  ASSERT_NE(after, nullptr);
+  EXPECT_NE(after, before);
+
+  table->mark_span_authored();
+  ASSERT_TRUE(table->has_authored_span());
+  wb.set_excel_profile(mac_365_ja_jp_profile());
+  auto unchanged = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(unchanged));
+  EXPECT_EQ(unchanged.value().cells_evaluated, 0U);
+  EXPECT_EQ(table->last_result(), after);
+  EXPECT_TRUE(table->has_authored_span());
+}
+
+TEST(WorkbookTest, RePinningNowInvalidatesRelativePivotAndFormulaCaches) {
+  Workbook wb = BuildClockPivotWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=GETPIVOTDATA(\"Sum of Amount\",A1)")));
+  const date_time::CivilTime may{{1900, 5U, 15U}, {6U, 7U, 8U}};
+  const date_time::CivilTime august{{1900, 8U, 15U}, {6U, 7U, 8U}};
+  wb.set_pinned_now(may);
+
+  Value result = RecalcCell(wb, 0U, 1U);
+  ASSERT_TRUE(result.is_number());
+  EXPECT_DOUBLE_EQ(result.as_number(), 100.0);
+  pivot::PivotTable* table = ClockPivot(wb);
+  ASSERT_NE(table, nullptr);
+  const auto may_snapshot = table->last_result();
+  ASSERT_NE(may_snapshot, nullptr);
+  table->mark_span_authored();
+  ASSERT_TRUE(table->has_authored_span());
+
+  wb.set_pinned_now(august);
+  EXPECT_FALSE(table->has_authored_span());
+  result = RecalcCell(wb, 0U, 1U);
+  ASSERT_TRUE(result.is_number());
+  EXPECT_DOUBLE_EQ(result.as_number(), 200.0);
+  const auto august_snapshot = table->last_result();
+  ASSERT_NE(august_snapshot, nullptr);
+  EXPECT_NE(august_snapshot, may_snapshot);
+
+  // All six civil fields are unchanged, so setting the same pin again is a
+  // no-op: the cached pivot and its dependent formula remain clean.
+  wb.set_pinned_now(august);
+  auto no_op_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(no_op_stats));
+  EXPECT_EQ(no_op_stats.value().cells_evaluated, 0U);
+  EXPECT_EQ(table->last_result(), august_snapshot);
+}
+
+TEST(WorkbookTest, DateEpochChangeInvalidatesDateFormulaAndPivotCache) {
+  Workbook wb = BuildClockPivotWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=GETPIVOTDATA(\"Sum of Amount\",A1)")));
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 2U, "=DATE(2026,1,1)")));
+  wb.set_pinned_now(date_time::CivilTime{{1900, 5U, 15U}, {0U, 0U, 0U}});
+
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const Cell* date_cell = wb.sheet(0U).cell_at(0U, 2U);
+  ASSERT_NE(date_cell, nullptr);
+  ASSERT_TRUE(date_cell->cached_value.is_number());
+  const double serial_1900 = date_cell->cached_value.as_number();
+  EXPECT_DOUBLE_EQ(serial_1900, date_time::serial_from_ymd(2026, 1U, 1U, false));
+  pivot::PivotTable* table = ClockPivot(wb);
+  ASSERT_NE(table, nullptr);
+  ASSERT_NE(table->last_result(), nullptr);
+  table->mark_span_authored();
+  ASSERT_TRUE(table->has_authored_span());
+
+  wb.set_date1904(true);
+  EXPECT_EQ(table->last_result(), nullptr);
+  EXPECT_FALSE(table->has_authored_span());
+  auto epoch_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(epoch_stats));
+  EXPECT_EQ(epoch_stats.value().cells_evaluated, 2U);
+  date_cell = wb.sheet(0U).cell_at(0U, 2U);
+  ASSERT_NE(date_cell, nullptr);
+  ASSERT_TRUE(date_cell->cached_value.is_number());
+  EXPECT_DOUBLE_EQ(date_cell->cached_value.as_number(), serial_1900 - date_time::kDate1904EpochGap);
+
+  // Re-applying the effective epoch is a no-op and preserves the refreshed
+  // pivot result and clean formula cache.
+  const auto refreshed_snapshot = table->last_result();
+  ASSERT_NE(refreshed_snapshot, nullptr);
+  wb.set_date1904(true);
+  auto no_op_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(no_op_stats));
+  EXPECT_EQ(no_op_stats.value().cells_evaluated, 0U);
+  EXPECT_EQ(table->last_result(), refreshed_snapshot);
+}
+
+TEST(WorkbookTest, ClearingPinnedNowInvalidatesOnceAndDuplicateClearIsNoOp) {
+  Workbook wb = BuildClockPivotWorkbook();
+  ASSERT_TRUE(static_cast<bool>(wb.set_cell_formula(0U, 0U, 1U, "=GETPIVOTDATA(\"Sum of Amount\",A1)")));
+  wb.set_pinned_now(date_time::CivilTime{{1900, 5U, 15U}, {0U, 0U, 0U}});
+  ASSERT_TRUE(static_cast<bool>(wb.recalc(eval::default_registry())));
+  const pivot::PivotTable* table = ClockPivot(wb);
+  ASSERT_NE(table, nullptr);
+  ASSERT_NE(table->last_result(), nullptr);
+
+  wb.clear_pinned_now();
+  EXPECT_EQ(table->last_result(), nullptr);
+  auto unpin_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(unpin_stats));
+  EXPECT_EQ(unpin_stats.value().cells_evaluated, 1U);
+  const auto host_snapshot = table->last_result();
+  ASSERT_NE(host_snapshot, nullptr);
+
+  wb.clear_pinned_now();
+  auto duplicate_clear_stats = wb.recalc(eval::default_registry());
+  ASSERT_TRUE(static_cast<bool>(duplicate_clear_stats));
+  EXPECT_EQ(duplicate_clear_stats.value().cells_evaluated, 0U);
+  EXPECT_EQ(table->last_result(), host_snapshot);
+}
+
 }  // namespace
 }  // namespace formulon
diff --git a/tests/wasm/run.mjs b/tests/wasm/run.mjs
index 42e1e626b..38e925528 100644
--- a/tests/wasm/run.mjs
+++ b/tests/wasm/run.mjs
@@ -11,34 +11,20 @@
 // uses only `node:assert/strict` so contributors can run it without an
 // `npm install` step.
 
-import assert from 'node:assert/strict';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { inflateRawSync } from 'node:zlib';
-
-// fm_value_kind_t mirror (see src/c_api/formulon_c.h).
-const VAL = Object.freeze({
-  BLANK: 0,
-  NUMBER: 1,
-  BOOL: 2,
-  TEXT: 3,
-  ERROR: 4,
-  ARRAY: 5,
-  REF: 6,
-  LAMBDA: 7,
-});
-
-// fm_pivot_cell_kind_t mirror (see src/c_api/formulon_c.h).
-const PIVOT = Object.freeze({
-  HEADER: 0,
-  ROW_LABEL: 1,
-  COL_LABEL: 2,
-  DATA: 3,
-  ROW_SUBTOTAL: 4,
-  COL_SUBTOTAL: 5,
-  GRAND_TOTAL: 6,
-  BLANK: 7,
-});
+import { registerCellGeometryDisplay } from './run_cell_geometry_display.mjs';
+import { registerCellsIo } from './run_cells_io.mjs';
+import { registerDrawing } from './run_drawing.mjs';
+import { registerFilterValidationComments } from './run_filter_validation_comments.mjs';
+import { registerLayoutValidation } from './run_layout_validation.mjs';
+import { registerMetadataLayout } from './run_metadata_layout.mjs';
+import { registerPivotRegressions } from './run_pivot_regressions.mjs';
+import { registerPositional } from './run_positional.mjs';
+import { registerSheetPivot } from './run_sheet_pivot.mjs';
+import { registerStyles } from './run_styles.mjs';
+import { registerSurfaceRecalc } from './run_surface_recalc.mjs';
+import { registerThemeStyles } from './run_theme_styles.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -52,287 +38,6 @@ const moduleUrl = path.resolve(
   threadsBuild ? 'formulon_threads.js' : 'formulon.js',
 );
 
-const utf8 = new TextEncoder();
-let crcTable = null;
-
-function crc32(bytes) {
-  if (crcTable === null) {
-    crcTable = new Uint32Array(256);
-    for (let i = 0; i < 256; i += 1) {
-      let c = i;
-      for (let j = 0; j < 8; j += 1) {
-        c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-      }
-      crcTable[i] = c >>> 0;
-    }
-  }
-  let c = 0xffffffff;
-  for (const b of bytes) {
-    c = crcTable[(c ^ b) & 0xff] ^ (c >>> 8);
-  }
-  return (c ^ 0xffffffff) >>> 0;
-}
-
-function pushU16(out, n) {
-  out.push(n & 0xff, (n >>> 8) & 0xff);
-}
-
-function pushU32(out, n) {
-  out.push(n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
-}
-
-function pushBytes(out, bytes) {
-  for (const b of bytes) out.push(b);
-}
-
-function zipStore(parts) {
-  const out = [];
-  const central = [];
-  const entries = parts.map(([name, body]) => ({
-    name: utf8.encode(name),
-    body: utf8.encode(body),
-  }));
-
-  for (const entry of entries) {
-    entry.offset = out.length;
-    entry.crc = crc32(entry.body);
-    pushU32(out, 0x04034b50);
-    pushU16(out, 20);
-    pushU16(out, 0);
-    pushU16(out, 0);
-    pushU16(out, 0);
-    pushU16(out, 0);
-    pushU32(out, entry.crc);
-    pushU32(out, entry.body.length);
-    pushU32(out, entry.body.length);
-    pushU16(out, entry.name.length);
-    pushU16(out, 0);
-    pushBytes(out, entry.name);
-    pushBytes(out, entry.body);
-  }
-
-  const centralOffset = out.length;
-  for (const entry of entries) {
-    pushU32(central, 0x02014b50);
-    pushU16(central, 20);
-    pushU16(central, 20);
-    pushU16(central, 0);
-    pushU16(central, 0);
-    pushU16(central, 0);
-    pushU16(central, 0);
-    pushU32(central, entry.crc);
-    pushU32(central, entry.body.length);
-    pushU32(central, entry.body.length);
-    pushU16(central, entry.name.length);
-    pushU16(central, 0);
-    pushU16(central, 0);
-    pushU16(central, 0);
-    pushU16(central, 0);
-    pushU32(central, 0);
-    pushU32(central, entry.offset);
-    pushBytes(central, entry.name);
-  }
-  pushBytes(out, central);
-
-  pushU32(out, 0x06054b50);
-  pushU16(out, 0);
-  pushU16(out, 0);
-  pushU16(out, entries.length);
-  pushU16(out, entries.length);
-  pushU32(out, central.length);
-  pushU32(out, centralOffset);
-  pushU16(out, 0);
-  return new Uint8Array(out);
-}
-
-function readZipEntryText(bytes, wantedName) {
-  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  let eocd = bytes.length - 22;
-  while (eocd >= 0 && view.getUint32(eocd, true) !== 0x06054b50) eocd -= 1;
-  assert.ok(eocd >= 0, 'missing ZIP end record');
-  const count = view.getUint16(eocd + 10, true);
-  const centralSize = view.getUint32(eocd + 12, true);
-  const centralOffset = view.getUint32(eocd + 16, true);
-  const decoder = new TextDecoder();
-  let cursor = centralOffset;
-  const wanted = String(wantedName);
-  for (let i = 0; i < count; i += 1) {
-    assert.ok(cursor < centralOffset + centralSize, 'ZIP central directory exceeds its declared size');
-    assert.equal(view.getUint32(cursor, true), 0x02014b50, 'invalid ZIP central entry');
-    const method = view.getUint16(cursor + 10, true);
-    const compressedSize = view.getUint32(cursor + 20, true);
-    const uncompressedSize = view.getUint32(cursor + 24, true);
-    const nameSize = view.getUint16(cursor + 28, true);
-    const extraSize = view.getUint16(cursor + 30, true);
-    const commentSize = view.getUint16(cursor + 32, true);
-    const localOffset = view.getUint32(cursor + 42, true);
-    const name = decoder.decode(bytes.slice(cursor + 46, cursor + 46 + nameSize));
-    if (name === wanted) {
-      assert.ok(localOffset + 30 <= bytes.length);
-      const localNameSize = view.getUint16(localOffset + 26, true);
-      const localExtraSize = view.getUint16(localOffset + 28, true);
-      const start = localOffset + 30 + localNameSize + localExtraSize;
-      const compressed = bytes.slice(start, start + compressedSize);
-      const body = method === 0 ? compressed : Uint8Array.from(inflateRawSync(compressed));
-      assert.equal(body.length, uncompressedSize);
-      return decoder.decode(body);
-    }
-    cursor += 46 + nameSize + extraSize + commentSize;
-  }
-  assert.fail(`ZIP entry not found: ${wanted}`);
-}
-
-function appendEmptyZipEntry(bytes, name) {
-  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  let eocd = bytes.length - 22;
-  while (eocd >= 0 && view.getUint32(eocd, true) !== 0x06054b50) eocd -= 1;
-  assert.ok(eocd >= 0, 'missing ZIP end record');
-  const count = view.getUint16(eocd + 10, true);
-  const centralSize = view.getUint32(eocd + 12, true);
-  const centralOffset = view.getUint32(eocd + 16, true);
-  const oldCentral = bytes.slice(centralOffset, centralOffset + centralSize);
-  const encodedName = utf8.encode(name);
-  const local = [];
-  pushU32(local, 0x04034b50);
-  pushU16(local, 20);
-  pushU16(local, 0);
-  pushU16(local, 0);
-  pushU16(local, 0);
-  pushU16(local, 0);
-  pushU32(local, 0);
-  pushU32(local, 0);
-  pushU32(local, 0);
-  pushU16(local, encodedName.length);
-  pushU16(local, 0);
-  pushBytes(local, encodedName);
-  const central = [];
-  pushU32(central, 0x02014b50);
-  pushU16(central, 20);
-  pushU16(central, 20);
-  pushU16(central, 0);
-  pushU16(central, 0);
-  pushU16(central, 0);
-  pushU16(central, 0);
-  pushU32(central, 0);
-  pushU32(central, 0);
-  pushU32(central, 0);
-  pushU16(central, encodedName.length);
-  pushU16(central, 0);
-  pushU16(central, 0);
-  pushU16(central, 0);
-  pushU16(central, 0);
-  pushU32(central, 0);
-  pushU32(central, centralOffset);
-  pushBytes(central, encodedName);
-  const out = [];
-  pushBytes(out, bytes.slice(0, centralOffset));
-  pushBytes(out, local);
-  pushBytes(out, oldCentral);
-  pushBytes(out, central);
-  pushU32(out, 0x06054b50);
-  pushU16(out, 0);
-  pushU16(out, 0);
-  pushU16(out, count + 1);
-  pushU16(out, count + 1);
-  pushU32(out, centralSize + central.length);
-  pushU32(out, centralOffset + local.length);
-  pushU16(out, 0);
-  return new Uint8Array(out);
-}
-
-function buildPivotWorkbookBytes() {
-  const sheetXml =
-    '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-    '<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">\n' +
-    '  <sheetData/>\n' +
-    '</worksheet>\n';
-
-  return zipStore([
-    [
-      '[Content_Types].xml',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">\n' +
-        '  <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>\n' +
-        '  <Default Extension="xml" ContentType="application/xml"/>\n' +
-        '  <Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>\n' +
-        '  <Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>\n' +
-        '  <Override PartName="/xl/worksheets/sheet2.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>\n' +
-        '  <Override PartName="/xl/pivotCache/pivotCacheDefinition1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml"/>\n' +
-        '  <Override PartName="/xl/pivotCache/pivotCacheRecords1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheRecords+xml"/>\n' +
-        '  <Override PartName="/xl/pivotTables/pivotTable1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml"/>\n' +
-        '</Types>\n',
-    ],
-    [
-      '_rels/.rels',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">\n' +
-        '  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>\n' +
-        '</Relationships>\n',
-    ],
-    [
-      'xl/workbook.xml',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">\n' +
-        '  <sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/><sheet name="Sheet2" sheetId="2" r:id="rId2"/></sheets>\n' +
-        '  <pivotCaches><pivotCache cacheId="0" r:id="rId3"/></pivotCaches>\n' +
-        '</workbook>\n',
-    ],
-    [
-      'xl/_rels/workbook.xml.rels',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">\n' +
-        '  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/>\n' +
-        '  <Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet2.xml"/>\n' +
-        '  <Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheDefinition" Target="pivotCache/pivotCacheDefinition1.xml"/>\n' +
-        '</Relationships>\n',
-    ],
-    ['xl/worksheets/sheet1.xml', sheetXml],
-    ['xl/worksheets/sheet2.xml', sheetXml],
-    [
-      'xl/worksheets/_rels/sheet2.xml.rels',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">\n' +
-        '  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotTable" Target="../pivotTables/pivotTable1.xml"/>\n' +
-        '</Relationships>\n',
-    ],
-    [
-      'xl/pivotCache/pivotCacheDefinition1.xml',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<pivotCacheDefinition xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" r:id="rId1" recordCount="3">\n' +
-        '  <cacheSource type="worksheet"/>\n' +
-        '  <cacheFields count="2"><cacheField name="Region"><sharedItems count="2"><s v="North"/><s v="South"/></sharedItems></cacheField><cacheField name="Amount"><sharedItems containsNumber="1"/></cacheField></cacheFields>\n' +
-        '</pivotCacheDefinition>\n',
-    ],
-    [
-      'xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">\n' +
-        '  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheRecords" Target="pivotCacheRecords1.xml"/>\n' +
-        '</Relationships>\n',
-    ],
-    [
-      'xl/pivotCache/pivotCacheRecords1.xml',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<pivotCacheRecords xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="3">\n' +
-        '  <r><x v="0"/><n v="100"/></r><r><x v="1"/><n v="200"/></r><r><x v="0"/><n v="300"/></r>\n' +
-        '</pivotCacheRecords>\n',
-    ],
-    [
-      'xl/pivotTables/pivotTable1.xml',
-      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
-        '<pivotTableDefinition xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" name="PivotTable1" cacheId="0">\n' +
-        '  <location ref="D1:E5"/>\n' +
-        '  <pivotFields count="2"><pivotField axis="axisRow" name="Region"><items count="3"><item x="0"/><item x="1"/><item t="default"/></items></pivotField><pivotField dataField="1" name="Amount"/></pivotFields>\n' +
-        '  <rowFields count="1"><field x="0"/></rowFields><dataFields count="1"><dataField name="Sum of Amount" fld="1" subtotal="sum"/></dataFields>\n' +
-        '</pivotTableDefinition>\n',
-    ],
-  ]);
-}
-
-function findPivotCell(layout, row, col) {
-  return layout.cells.find((cell) => cell.row === row && cell.col === col);
-}
-
 const cases = [];
 function test(name, fn) {
   cases.push({ name, fn });
@@ -345,1963 +50,71 @@ async function run() {
   // Dynamic import: keeps the file syntactically valid even when the
   // wasm artifact is missing (the harness check is the Makefile's job).
   const factory = (await import(moduleUrl)).default;
-  const Module = await factory();
-
-  test('versionString is non-empty', () => {
-    const v = Module.versionString();
-    assert.equal(typeof v, 'string');
-    assert.ok(v.length > 0, `expected non-empty version, got ${JSON.stringify(v)}`);
-  });
-
-  test('statusString covers known codes', () => {
-    assert.equal(Module.statusString(0), 'kOk');
-    // Unknown / out-of-band codes still return a non-null string.
-    const unknown = Module.statusString(123456);
-    assert.equal(typeof unknown, 'string');
-    assert.ok(unknown.length > 0);
-  });
-
-  test('errorDisplayName returns Excel literals', () => {
-    assert.equal(Module.errorDisplayName(1), '#DIV/0!');
-    assert.equal(Module.errorDisplayName(999), '#UNKNOWN!');
-  });
-
-  test('evalFormula(=SUM(1,2,3)) returns NUMBER 6', () => {
-    const r = Module.evalFormula('=SUM(1,2,3)');
-    assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-    assert.equal(r.value.kind, VAL.NUMBER);
-    assert.equal(r.value.number, 6);
-  });
-
-  test('evalFormula(=IF(TRUE,1,2)) returns NUMBER 1', () => {
-    const r = Module.evalFormula('=IF(TRUE,1,2)');
-    assert.ok(r.status.ok);
-    assert.equal(r.value.kind, VAL.NUMBER);
-    assert.equal(r.value.number, 1);
-  });
-
-  test('evalFormula evaluates intersection read-only and returns #NULL!', () => {
-    const r = Module.evalFormula('=A1 B1');
-    assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-    assert.equal(r.value.kind, VAL.ERROR);
-    assert.equal(r.value.errorCode, 0); // ErrorCode::Null / #NULL!
-  });
-
-  test('evalFormula(=CONCAT) returns TEXT "hello world"', () => {
-    const r = Module.evalFormula('=CONCAT("hello"," ","world")');
-    assert.ok(r.status.ok);
-    assert.equal(r.value.kind, VAL.TEXT);
-    assert.equal(r.value.text, 'hello world');
-  });
-
-  test('numeric comparisons share the 15-digit bucket without fuzzy exact lookups', () => {
-    const operators = [
-      ['=', 1],
-      ['<>', 0],
-      ['<', 0],
-      ['<=', 1],
-      ['>', 0],
-      ['>=', 1],
-    ];
-    for (const [operator, expected] of operators) {
-      const r = Module.evalFormula(`=7.1${operator}7.1000000000000005`);
-      assert.ok(r.status.ok, `operator=${operator} status=${JSON.stringify(r.status)}`);
-      assert.equal(r.value.kind, VAL.BOOL, `operator=${operator}`);
-      assert.equal(r.value.boolean, expected, `operator=${operator}`);
-    }
-
-    // MATCH and XLOOKUP exact modes intentionally retain literal IEEE equality;
-    // the formula comparison bucket must not make their exact guards fuzzy.
-    // Populate the two worksheet values through setNumber so the parser's
-    // decimal-literal canonicalisation cannot collapse the adjacent doubles.
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setNumber(0, 0, 0, 7.1).ok);
-      assert.ok(wb.setNumber(0, 1, 0, 7.1000000000000005).ok);
-      assert.ok(wb.setFormula(0, 2, 0, '=MATCH(A2,A1:A1,0)').ok);
-      assert.ok(wb.setFormula(0, 3, 0, '=XLOOKUP(A2,A1:A1,A1:A1,"MISS",0)').ok);
-      assert.ok(wb.recalc().ok);
-
-      const match = wb.getValue(0, 2, 0);
-      assert.ok(match.status.ok, `MATCH status=${JSON.stringify(match.status)}`);
-      assert.equal(match.value.kind, VAL.ERROR);
-      assert.equal(match.value.errorCode, 6); // ErrorCode::NA / #N/A.
-
-      const xlookup = wb.getValue(0, 3, 0);
-      assert.ok(xlookup.status.ok, `XLOOKUP status=${JSON.stringify(xlookup.status)}`);
-      assert.equal(xlookup.value.kind, VAL.TEXT);
-      assert.equal(xlookup.value.text, 'MISS');
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('Workbook construction + setNumber + recalc + getValue', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.isValid());
-      assert.equal(wb.sheetCount().value, 1);
-      const nameRes = wb.sheetName(0);
-      assert.ok(nameRes.status.ok);
-      assert.equal(nameRes.value, 'Sheet1');
-
-      assert.ok(wb.setNumber(0, 0, 0, 42).ok);
-      assert.ok(wb.setFormula(0, 1, 0, '=A1*2').ok);
-      assert.ok(wb.recalc().ok);
-
-      const a1 = wb.getValue(0, 0, 0);
-      assert.ok(a1.status.ok);
-      assert.equal(a1.value.kind, VAL.NUMBER);
-      assert.equal(a1.value.number, 42);
-
-      const b1 = wb.getValue(0, 1, 0);
-      assert.ok(b1.status.ok);
-      assert.equal(b1.value.kind, VAL.NUMBER);
-      assert.equal(b1.value.number, 84);
-
-      // addSheet should grow sheetCount.
-      assert.ok(wb.addSheet('Second').ok);
-      assert.equal(wb.sheetCount().value, 2);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('Workbook.recalcParallel evaluates a wide DAG and reports bounded telemetry', () => {
-    const wb = Module.Workbook.createDefault();
-    const branchCount = 32;
-    try {
-      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-      for (let i = 0; i < branchCount; i += 1) {
-        const row = i + 1;
-        assert.ok(wb.setFormula(0, row, 1, `=A1+${i + 2}`).ok);
-        assert.ok(wb.setFormula(0, row, 2, `=B${row + 1}*2`).ok);
-      }
-
-      const parallel = wb.recalcParallel(4);
-      assert.ok(parallel.status.ok, `status=${JSON.stringify(parallel.status)}`);
-      assert.equal(typeof parallel.stats.cellsEvaluated, 'number');
-      assert.equal(typeof parallel.stats.sccsProcessed, 'number');
-      assert.equal(typeof parallel.stats.parallelSteps, 'number');
-      assert.ok(parallel.stats.cellsEvaluated > 0);
-      assert.ok(parallel.stats.sccsProcessed > 0);
-      if (!threadsBuild) {
-        // Without pthreads every launch is refused, so the pass runs serially.
-        assert.equal(parallel.stats.workerThreadsStarted, 0);
-      }
-      if (parallel.stats.workerThreadsStarted <= 1) {
-        // OS launch refusal or a partial launch of one worker is a documented
-        // successful serial degradation.
-        assert.equal(parallel.stats.workerThreadsUsed, 0);
-        assert.equal(parallel.stats.parallelSteps, 0);
-        assert.ok(parallel.stats.serialFallbackSteps > 0, `stats=${JSON.stringify(parallel.stats)}`);
-      } else {
-        assert.ok(parallel.stats.parallelSteps > 0, `stats=${JSON.stringify(parallel.stats)}`);
-        assert.ok(parallel.stats.workerThreadsStarted >= 2);
-        assert.ok(parallel.stats.workerThreadsStarted <= 4);
-        assert.ok(parallel.stats.workerThreadsUsed > 0);
-        assert.ok(parallel.stats.workerThreadsUsed <= parallel.stats.workerThreadsStarted);
-      }
-
-      const first = wb.getValue(0, 1, 1);
-      const last = wb.getValue(0, branchCount, 2);
-      assert.ok(first.status.ok);
-      assert.ok(last.status.ok);
-      assert.equal(first.value.kind, VAL.NUMBER);
-      assert.equal(last.value.kind, VAL.NUMBER);
-      assert.equal(first.value.number, 3);
-      assert.equal(last.value.number, (1 + branchCount + 1) * 2);
-
-      assert.ok(wb.setNumber(0, 0, 0, 5).ok);
-      const callerOnly = wb.recalcParallel(1);
-      assert.ok(callerOnly.status.ok, `status=${JSON.stringify(callerOnly.status)}`);
-      assert.equal(callerOnly.stats.parallelSteps, 0);
-      assert.ok(callerOnly.stats.serialFallbackSteps > 0);
-      assert.equal(callerOnly.stats.workerThreadsStarted, 0);
-      assert.equal(callerOnly.stats.workerThreadsUsed, 0);
-      assert.equal(wb.getValue(0, branchCount, 2).value.number, (5 + branchCount + 1) * 2);
-
-      const invalid = wb.recalcParallel(9);
-      assert.equal(invalid.status.ok, false);
-      assert.notEqual(invalid.status.status, 0);
-      assert.equal(invalid.stats.cellsEvaluated, 0);
-      assert.equal(invalid.stats.sccsProcessed, 0);
-      assert.equal(invalid.stats.parallelSteps, 0);
-      assert.equal(invalid.stats.serialFallbackSteps, 0);
-      assert.equal(invalid.stats.cycleRecoveries, 0);
-      assert.equal(invalid.stats.workerThreadsStarted, 0);
-      assert.equal(invalid.stats.workerThreadsUsed, 0);
-
-      for (const invalidThreadCount of [
-        -0.5,
-        1.5,
-        Number.NaN,
-        Number.POSITIVE_INFINITY,
-        Number.NEGATIVE_INFINITY,
-        2 ** 32 + 1,
-        null,
-        undefined,
-      ]) {
-        const invalidShape = wb.recalcParallel(invalidThreadCount);
-        assert.equal(invalidShape.status.ok, false, `threadCount=${String(invalidThreadCount)}`);
-        assert.notEqual(invalidShape.status.status, 0);
-        assert.equal(invalidShape.stats.cellsEvaluated, 0);
-        assert.equal(invalidShape.stats.sccsProcessed, 0);
-        assert.equal(invalidShape.stats.parallelSteps, 0);
-        assert.equal(invalidShape.stats.serialFallbackSteps, 0);
-        assert.equal(invalidShape.stats.cycleRecoveries, 0);
-        assert.equal(invalidShape.stats.workerThreadsStarted, 0);
-        assert.equal(invalidShape.stats.workerThreadsUsed, 0);
-      }
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('paginate exposes a status envelope and page geometry', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      // Asserts the envelope's shape, not the page geometry: how many rows
-      // fit a page is the print engine's business and is pinned by the
-      // native print suite against Excel. Row 400 is far enough down to
-      // force a break under any plausible body height.
-      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-      assert.ok(wb.setNumber(0, 400, 0, 2).ok);
-      const result = wb.paginate(0);
-      assert.ok(result.status.ok, `status=${JSON.stringify(result.status)}`);
-      assert.ok(result.pageCount >= 2, `pageCount=${result.pageCount}`);
-      assert.deepEqual(result.printArea, []);
-      assert.ok(result.horizontalBreaks.length > 0);
-      assert.deepEqual(
-        result.horizontalBreaks,
-        [...new Set(result.horizontalBreaks)].sort((a, b) => a - b),
-      );
-      assert.deepEqual(result.verticalBreaks, []);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setPinnedNow / pinnedNow / clearPinnedNow drive the clock seam', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      // Unpinned by default: the workbook follows the host clock.
-      assert.equal(wb.pinnedNow().now, null);
-
-      assert.ok(wb.setPinnedNow(2026, 4, 23, 15, 30, 45).ok);
-      assert.deepEqual(wb.pinnedNow().now, {
-        year: 2026,
-        month: 4,
-        day: 23,
-        hour: 15,
-        minute: 30,
-        second: 45,
-      });
-
-      // 2026-04-23 is serial 46135 under the 1900 date system.
-      assert.ok(wb.setFormula(0, 0, 0, '=TODAY()').ok);
-      assert.ok(wb.recalc().ok);
-      const a1 = wb.getValue(0, 0, 0);
-      assert.equal(a1.value.kind, VAL.NUMBER);
-      assert.equal(a1.value.number, 46135);
-
-      // The pin is a calendar instant, not a normalising constructor.
-      assert.equal(wb.setPinnedNow(2026, 13, 1, 0, 0, 0).ok, false);
-      assert.equal(wb.setPinnedNow(2025, 2, 29, 0, 0, 0).ok, false);
-
-      assert.ok(wb.clearPinnedNow().ok);
-      assert.equal(wb.pinnedNow().now, null);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setText / setBool / setBlank round-trip', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setText(0, 0, 0, 'hello').ok);
-      assert.ok(wb.setBool(0, 1, 0, true).ok);
-      assert.ok(wb.setBlank(0, 2, 0).ok);
-      assert.ok(wb.recalc().ok);
-
-      const a1 = wb.getValue(0, 0, 0);
-      assert.equal(a1.value.kind, VAL.TEXT);
-      assert.equal(a1.value.text, 'hello');
-
-      const a2 = wb.getValue(0, 1, 0);
-      assert.equal(a2.value.kind, VAL.BOOL);
-      assert.equal(a2.value.boolean, 1);
-
-      const a3 = wb.getValue(0, 2, 0);
-      assert.equal(a3.value.kind, VAL.BLANK);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setCellPhonetic / getCellPhonetic preserve and clear a Japanese guide', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setText(0, 0, 0, '漢字').ok);
-      assert.ok(wb.setCellPhonetic(0, 0, 0, 'かんじ').ok);
-      const phonetic = wb.getCellPhonetic(0, 0, 0);
-      assert.ok(phonetic.status.ok);
-      assert.equal(phonetic.value, 'かんじ');
-
-      assert.ok(wb.setCellPhonetic(0, 0, 0, '').ok);
-      assert.equal(wb.getCellPhonetic(0, 0, 0).value, '');
-
-      assert.ok(wb.setCellPhonetic(0, 0, 0, 'かんじ').ok);
-      assert.ok(wb.setText(0, 0, 0, '文字列').ok);
-      assert.equal(wb.getCellPhonetic(0, 0, 0).value, '');
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setCellPhoneticRuns / getCellPhoneticRuns keep the spans apart', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setText(0, 0, 0, '東京都').ok);
-      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, []);
-
-      const runs = [
-        { sb: 0, eb: 2, text: 'トウキョウ' },
-        { sb: 2, eb: 3, text: 'ト' },
-      ];
-      assert.ok(wb.setCellPhoneticRuns(0, 0, 0, runs).ok);
-      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, runs);
-      // The flattening getter still reports the concatenation.
-      assert.equal(wb.getCellPhonetic(0, 0, 0).value, 'トウキョウト');
-
-      // Writing that back through the whole-cell setter is the collapse the
-      // run API exists to avoid.
-      assert.ok(wb.setCellPhonetic(0, 0, 0, 'トウキョウト').ok);
-      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, [{ sb: 0, eb: 3, text: 'トウキョウト' }]);
-
-      assert.ok(wb.setCellPhoneticRuns(0, 0, 0, []).ok);
-      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, []);
-
-      assert.equal(
-        wb.setCellPhoneticRuns(0, 0, 0, [
-          { sb: 2, eb: 3, text: 'ト' },
-          { sb: 0, eb: 2, text: 'トウ' },
-        ]).ok,
-        false,
-      );
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setCellPhoneticProperties survives a run edit and a save/load cycle', () => {
-    // The result carries a `status` alongside the triple; compare the
-    // triple alone so a status-shape change does not read as a value change.
-    const phoneticProps = (book, sheet, row, col) => {
-      const { fontId, type, alignment } = book.getCellPhoneticProperties(sheet, row, col);
-      return { fontId, type, alignment };
-    };
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setText(0, 0, 0, '大阪').ok);
-      // An unannotated cell reports what Excel infers for a guide written
-      // with no <phoneticPr> at all.
-      assert.deepEqual(phoneticProps(wb, 0, 0, 0), { fontId: 0, type: 0, alignment: 0 });
-
-      assert.ok(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 3, type: 2, alignment: 2 }).ok);
-      // Setting the readings must not reset the rendering.
-      assert.ok(wb.setCellPhoneticRuns(0, 0, 0, [{ sb: 0, eb: 2, text: 'おおさか' }]).ok);
-      assert.deepEqual(phoneticProps(wb, 0, 0, 0), { fontId: 3, type: 2, alignment: 2 });
-
-      const saved = wb.save();
-      assert.ok(saved.status.ok);
-      const loaded = Module.Workbook.loadBytes(saved.bytes);
-      try {
-        assert.deepEqual(phoneticProps(loaded, 0, 0, 0), { fontId: 3, type: 2, alignment: 2 });
-      } finally {
-        loaded.delete();
-      }
-
-      // Two bits each on the binary side, so a wider ordinal is refused
-      // rather than truncated into a different, valid-looking one.
-      assert.equal(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 0, type: 4, alignment: 0 }).ok, false);
-      assert.deepEqual(phoneticProps(wb, 0, 0, 0), { fontId: 3, type: 2, alignment: 2 });
-
-      // A value write discards the guide and its rendering together.
-      assert.ok(wb.setText(0, 0, 0, '京都').ok);
-      assert.deepEqual(phoneticProps(wb, 0, 0, 0), { fontId: 0, type: 0, alignment: 0 });
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setDefaultFont replaces font 0, which addFont can only append beside', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.equal(wb.getFont(0).name, 'Calibri');
-      const appended = wb.addFont({ name: '游ゴシック', size: 11 });
-      assert.ok(appended.status.ok);
-      assert.ok(appended.index > 0);
-      assert.equal(wb.getFont(0).name, 'Calibri');
-
-      assert.ok(wb.setDefaultFont({ name: '游ゴシック', size: 11, hasCharset: true, charset: 128 }).ok);
-      assert.equal(wb.getFont(0).name, '游ゴシック');
-      assert.equal(wb.getFont(0).charset, 128);
-
-      const added = wb.addFont({ name: 'Meiryo', size: 12 });
-      assert.ok(wb.setFont(added.index, { name: 'MS Gothic', size: 9 }).ok);
-      assert.equal(wb.getFont(added.index).name, 'MS Gothic');
-      assert.equal(wb.setFont(wb.fontCount().value, { name: 'MS Gothic', size: 9 }).ok, false);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('table update omits fields without resetting existing metadata', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const created = wb.createTable({
-        sheetIndex: 0,
-        ref: 'A1:B3',
-        name: 'Sales',
-        columns: ['Product', 'Amount'],
-        styleName: 'TableStyleMedium2',
-        headerRow: false,
-        totalsRow: true,
-      });
-      assert.ok(created.status.ok, `createTable failed: ${JSON.stringify(created.status)}`);
-      const before = wb.tableAt(created.index);
-      assert.ok(before.status.ok);
-      assert.equal(before.ref, 'A1:B3');
-
-      const beforeSaved = wb.save();
-      assert.ok(beforeSaved.status.ok);
-      const beforeXml = readZipEntryText(beforeSaved.bytes, 'xl/tables/table1.xml');
-      assert.match(beforeXml, /name="TableStyleMedium2"/);
-      assert.match(beforeXml, /headerRowCount="0"/);
-      assert.match(beforeXml, /totalsRowCount="1"/);
-
-      // An empty update object is a partial no-op. This specifically covers
-      // the WASM-to-C mapping of omitted ref/style/row flags to preservation
-      // sentinels rather than empty/false defaults.
-      assert.ok(wb.updateTable(created.index, {}).ok);
-      const after = wb.tableAt(created.index);
-      assert.ok(after.status.ok);
-      assert.equal(after.ref, before.ref);
-
-      const saved = wb.save();
-      assert.ok(saved.status.ok, `save failed: ${JSON.stringify(saved.status)}`);
-      const afterXml = readZipEntryText(saved.bytes, 'xl/tables/table1.xml');
-      assert.match(afterXml, /name="TableStyleMedium2"/);
-      assert.match(afterXml, /headerRowCount="0"/);
-      assert.match(afterXml, /totalsRowCount="1"/);
-      const loaded = Module.Workbook.loadBytes(saved.bytes);
-      try {
-        assert.ok(loaded.isValid(), `load failed: ${Module.lastErrorMessage()}`);
-        const reloaded = loaded.tableAt(created.index);
-        assert.ok(reloaded.status.ok);
-        assert.equal(reloaded.ref, 'A1:B3');
-        const roundTripped = loaded.save();
-        assert.ok(roundTripped.status.ok);
-        const roundTrippedXml = readZipEntryText(roundTripped.bytes, 'xl/tables/table1.xml');
-        assert.match(roundTrippedXml, /name="TableStyleMedium2"/);
-        assert.match(roundTrippedXml, /headerRowCount="0"/);
-        assert.match(roundTrippedXml, /totalsRowCount="1"/);
-      } finally {
-        loaded.delete();
-      }
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('save() + Workbook.loadBytes() round-trip preserves a literal', () => {
-    const wb = Module.Workbook.createDefault();
-    let saved = null;
-    try {
-      assert.ok(wb.setNumber(0, 0, 0, 7).ok);
-      assert.ok(wb.setFormula(0, 1, 0, '=A1+1').ok);
-      assert.ok(wb.recalc().ok);
-
-      const r = wb.save();
-      assert.ok(r.status.ok, `save failed: ${JSON.stringify(r.status)}`);
-      assert.ok(r.bytes instanceof Uint8Array);
-      assert.ok(r.bytes.length > 0);
-      saved = r.bytes;
-    } finally {
-      wb.delete();
-    }
-
-    const loaded = Module.Workbook.loadBytes(saved);
-    try {
-      assert.ok(loaded.isValid(), `load failed: ${Module.lastErrorMessage()}`);
-      assert.ok(loaded.sheetCount().value >= 1);
-      assert.ok(loaded.recalc().ok);
-      const a1 = loaded.getValue(0, 0, 0);
-      assert.ok(a1.status.ok);
-      assert.equal(a1.value.kind, VAL.NUMBER);
-      assert.equal(a1.value.number, 7);
-    } finally {
-      loaded.delete();
-    }
-  });
-
-  test('data bar x14 fields survive save and load', () => {
-    // The six live in the `x14` extension, not the legacy `<dataBar>`
-    // element. An in-session round-trip would still pass with a writer that
-    // never emits the extension -- which is how they were lost before -- so
-    // this goes through a real save and load.
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(
-        wb.addConditionalFormat(0, {
-          sqref: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
-          type: 3,
-          dataBar: {
-            min: { type: 3 },
-            max: { type: 4 },
-            fill: { r: 0, g: 0, b: 255 },
-            gradient: false,
-            axisPosition: 1,
-            negativeFill: { r: 255, g: 0, b: 0 },
-            border: { r: 9, g: 9, b: 9 },
-            negativeBorder: { r: 8, g: 8, b: 8 },
-            axisColor: { r: 1, g: 2, b: 3 },
-          },
-        }).status.ok,
-      );
-      const saved = wb.save();
-      assert.ok(saved.status.ok, `save failed: ${JSON.stringify(saved.status)}`);
-      const loaded = Module.Workbook.loadBytes(saved.bytes);
+  const positionalHookProbe = {
+    runtimeInitial: null,
+    runtimeReplacement: null,
+    postInitial: null,
+    postReplacement: null,
+  };
+  const probePositionalHook = (hookModule) => {
+    const wb = hookModule.Workbook.createDefault();
+    try {
+      wb.setNumber(0, 0, 0, 42);
+      let threw = false;
       try {
-        assert.ok(loaded.isValid(), `load failed: ${Module.lastErrorMessage()}`);
-        const bar = loaded.getConditionalFormats(0)[0].dataBar;
-        assert.equal(bar.gradient, false);
-        assert.equal(bar.axisPosition, 1);
-        assert.equal(bar.negativeFill.r, 255);
-        assert.equal(bar.border.r, 9);
-        assert.equal(bar.negativeBorder.r, 8);
-        assert.equal(bar.axisColor.b, 3);
-
-        // The decoded bar fed straight back reproduces the same rule.
-        assert.ok(
-          loaded.addConditionalFormat(0, {
-            sqref: [{ firstRow: 4, firstCol: 0, lastRow: 6, lastCol: 0 }],
-            type: 3,
-            dataBar: bar,
-          }).status.ok,
-        );
-        const reread = loaded.getConditionalFormats(0)[1].dataBar;
-        assert.equal(reread.gradient, false);
-        assert.equal(reread.axisPosition, 1);
-        assert.equal(reread.axisColor.b, 3);
-      } finally {
-        loaded.delete();
-      }
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('omitted data bar x14 fields keep the model defaults', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(
-        wb.addConditionalFormat(0, {
-          sqref: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
-          type: 3,
-          dataBar: { min: { type: 3 }, max: { type: 4 }, fill: { r: 0, g: 0, b: 255 } },
-        }).status.ok,
-      );
-      // The getter engages all six, so they read back as the defaults
-      // rather than as absent keys.
-      const bar = wb.getConditionalFormats(0)[0].dataBar;
-      assert.equal(bar.gradient, true);
-      assert.equal(bar.axisPosition, 0);
-      assert.equal(bar.negativeFill.b, 255);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('saveWithDiagnostics() and readDiagnostics() expose stable counters', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
-      assert.ok(
-        wb.addValidation(0, {
-          ranges: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
-          type: 3,
-          formula1: '"Yes,No"',
-        }).ok,
-      );
-      // `dxfId` is a real index into `<dxfs>`, not a sentinel: every binding
-      // signals "no differential format" by omitting the field, which leaves
-      // the C ABI's `dxf_id_engaged` at 0. Supplying `0` therefore claims the
-      // first dxf, so the table has to have one.
-      const dxf = wb.addDxf({ font: { bold: true } });
-      assert.ok(dxf.status.ok, `addDxf failed: ${JSON.stringify(dxf.status)}`);
-      assert.ok(
-        wb.addConditionalFormat(0, {
-          sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
-          type: 1,
-          op: 5,
-          formula1: '10',
-          dxfId: dxf.index,
-          stopIfTrue: false,
-        }).status.ok,
-      );
-      const xlsx = wb.saveWithDiagnostics(1);
-      assert.ok(xlsx.status.ok, `xlsx save failed: ${JSON.stringify(xlsx.status)}`);
-      assert.equal(xlsx.downgradedFormulaCount, 0);
-      assert.equal(xlsx.deferredFeatureCount, 0);
-      assert.equal(xlsx.droppedPartCount, 0);
-      assert.equal(xlsx.droppedRelationshipCount, 0);
-      assert.equal(xlsx.renumberedPartCount, 0);
-
-      const xlsb = wb.saveWithDiagnostics(2);
-      assert.ok(xlsb.status.ok, `xlsb save failed: ${JSON.stringify(xlsb.status)}`);
-      assert.equal(xlsb.downgradedFormulaCount, 1);
-      assert.equal(xlsb.deferredFeatureCount, 0);
-      // The binary writer never reassigns a part id.
-      assert.equal(xlsb.renumberedPartCount, 0);
-
-      const loaded = Module.Workbook.loadBytes(xlsb.bytes);
-      try {
-        const read = loaded.readDiagnostics();
-        assert.ok(read.status.ok, `read diagnostics failed: ${JSON.stringify(read.status)}`);
-        assert.equal(read.undecodedFormulaCount, 0);
-        assert.equal(read.undecodedDefinedNameCount, 0);
-        assert.equal(read.undecodedPartCount, 0);
-        assert.equal(read.skippedFeatureCount, 0);
-        assert.equal(read.unknownContentTypeCount, 0);
-      } finally {
-        loaded.delete();
-      }
-      const preservedLoaded = Module.Workbook.loadBytes(appendEmptyZipEntry(xlsb.bytes, 'xl/preserved.bin'));
-      try {
-        const preserved = preservedLoaded.readDiagnostics();
-        assert.ok(preserved.status.ok, `passthrough diagnostics failed: ${JSON.stringify(preserved.status)}`);
-        assert.equal(preserved.undecodedPartCount, 0);
-      } finally {
-        preservedLoaded.delete();
-      }
-      const invalidSave = wb.saveWithDiagnostics(0);
-      assert.ok(!invalidSave.status.ok, `unknown format unexpectedly succeeded: ${JSON.stringify(invalidSave)}`);
-      assert.equal(invalidSave.bytes, null);
-      assert.equal(invalidSave.downgradedFormulaCount, 0);
-      assert.equal(invalidSave.deferredFeatureCount, 0);
-      assert.equal(invalidSave.droppedPartCount, 0);
-      assert.equal(invalidSave.droppedRelationshipCount, 0);
-      assert.equal(invalidSave.renumberedPartCount, 0);
-      assert.ok(wb.saveAs(2).status.ok);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('Workbook.loadBytes reports empty input instead of leaving stale diagnostics', () => {
-    const wb = Module.Workbook.loadBytes(new Uint8Array());
-    try {
-      assert.equal(wb.isValid(), false);
-      assert.match(Module.lastErrorMessage(), /NULL or empty input/);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('Workbook.loadBytes rejects non-Uint8Array input like the native binding', () => {
-    const wb = Module.Workbook.loadBytes(new Uint16Array([1]));
-    try {
-      assert.equal(wb.isValid(), false);
-      assert.match(Module.lastErrorMessage(), /NULL or empty input/);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('invalid workbook read diagnostics return a zeroed failure envelope', () => {
-    const wb = Module.Workbook.loadBytes(new Uint8Array());
-    try {
-      const read = wb.readDiagnostics();
-      assert.ok(!read.status.ok, `invalid handle unexpectedly succeeded: ${JSON.stringify(read)}`);
-      assert.equal(read.undecodedFormulaCount, 0);
-      assert.equal(read.undecodedDefinedNameCount, 0);
-      assert.equal(read.undecodedPartCount, 0);
-      assert.equal(read.skippedFeatureCount, 0);
-      assert.equal(read.unknownContentTypeCount, 0);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('formula error surfaces as ERROR-kind value', () => {
-    const r = Module.evalFormula('=1/0');
-    assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-    assert.equal(r.value.kind, VAL.ERROR);
-  });
-
-  test('parser failure populates lastErrorMessage', () => {
-    // An obviously unparseable formula. The C ABI either surfaces a
-    // non-zero status (parser error) or returns ok with an Error
-    // value — accept either, but the diagnostic should be readable
-    // when the status is non-ok.
-    const r = Module.evalFormula('=#GARBAGE');
-    if (!r.status.ok) {
-      assert.equal(typeof r.status.message, 'string');
-      const msg = Module.lastErrorMessage();
-      assert.equal(typeof msg, 'string');
-    } else {
-      // Acceptable alternative: the formula parses to something that
-      // evaluates to an error value.
-      assert.equal(r.value.kind, VAL.ERROR);
-    }
-  });
-
-  test('setIterative accepts knobs without crashing', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setIterative(true, 50, 0.001).ok);
-      // Set a fixed-point formula (sqrt(2) iteration). The engine may
-      // surface NUMBER (converged) or ERROR depending on the recalc
-      // path; we only assert that the call sequence doesn't crash and
-      // that getValue returns a well-formed envelope.
-      assert.ok(wb.setNumber(0, 0, 0, 1.0).ok);
-      assert.ok(wb.setFormula(0, 0, 0, '=0.5*(A1+2/A1)').ok);
-      assert.ok(wb.recalc().ok);
-      const v = wb.getValue(0, 0, 0);
-      assert.ok(v.status.ok);
-      // Known well-formed kinds.
-      assert.ok([VAL.NUMBER, VAL.ERROR, VAL.BLANK].includes(v.value.kind));
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('renameSheet updates the sheet name', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.equal(wb.sheetCount().value, 1);
-      assert.ok(wb.renameSheet(0, 'Renamed').ok);
-      const r = wb.sheetName(0);
-      assert.ok(r.status.ok);
-      assert.equal(r.value, 'Renamed');
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('renameSheet rejects forbidden characters', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const r = wb.renameSheet(0, 'Bad/Name');
-      assert.equal(r.ok, false);
-      assert.notEqual(r.status, 0);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('removeSheet drops a sheet but rejects the last one', () => {
-    const wb = Module.Workbook.createEmpty();
-    try {
-      assert.ok(wb.addSheet('A').ok);
-      assert.ok(wb.addSheet('B').ok);
-      assert.ok(wb.addSheet('C').ok);
-      assert.equal(wb.sheetCount().value, 3);
-      assert.ok(wb.removeSheet(1).ok);
-      assert.equal(wb.sheetCount().value, 2);
-      assert.equal(wb.sheetName(0).value, 'A');
-      assert.equal(wb.sheetName(1).value, 'C');
-    } finally {
-      wb.delete();
-    }
-
-    // Workbook with a single sheet rejects removeSheet(0).
-    const lone = Module.Workbook.createDefault();
-    try {
-      const r = lone.removeSheet(0);
-      assert.equal(r.ok, false);
-    } finally {
-      lone.delete();
-    }
-  });
-
-  test('moveSheet rearranges sheets (Excel UI semantics)', () => {
-    const wb = Module.Workbook.createEmpty();
-    try {
-      assert.ok(wb.addSheet('Alpha').ok);
-      assert.ok(wb.addSheet('Beta').ok);
-      assert.ok(wb.addSheet('Gamma').ok);
-      // Move Alpha (0) to the end. Excel semantics: to=2 (post-removal).
-      assert.ok(wb.moveSheet(0, 2).ok);
-      assert.equal(wb.sheetName(0).value, 'Beta');
-      assert.equal(wb.sheetName(1).value, 'Gamma');
-      assert.equal(wb.sheetName(2).value, 'Alpha');
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setDefinedName adds, updates, and removes', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.equal(wb.definedNameCount().value, 0);
-      assert.ok(wb.setDefinedName('Pi', '=3.14').ok);
-      assert.equal(wb.definedNameCount().value, 1);
-      const a = wb.definedNameAt(0);
-      assert.ok(a.status.ok);
-      assert.equal(a.name, 'Pi');
-      assert.equal(a.formula, '=3.14');
-
-      assert.ok(wb.setDefinedName('PI', '=3.14159').ok);
-      assert.equal(wb.definedNameCount().value, 1);
-      const b = wb.definedNameAt(0);
-      assert.equal(b.name, 'Pi'); // authored case preserved
-      assert.equal(b.formula, '=3.14159');
-
-      assert.ok(wb.setDefinedName('Pi', '').ok);
-      assert.equal(wb.definedNameCount().value, 0);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('cellCount + cellAt iterate populated cells in order', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-      assert.ok(wb.setNumber(0, 0, 1, 2).ok);
-      assert.ok(wb.setFormula(0, 1, 0, '=A1+B1').ok);
-      assert.ok(wb.recalc().ok);
-
-      const count = wb.cellCount(0).value;
-      assert.ok(count >= 3, `expected >=3 cells, got ${count}`);
-
-      // The very first iteration entry should be A1 (row=0, col=0).
-      const c0 = wb.cellAt(0, 0);
-      assert.ok(c0.status.ok);
-      assert.equal(c0.row, 0);
-      assert.equal(c0.col, 0);
-      assert.equal(c0.formula, null);
-      assert.equal(c0.value.kind, VAL.NUMBER);
-      assert.equal(c0.value.number, 1);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('failed entry lookups omit optional payload fields', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      for (const entry of [wb.cellAt(99, 0), wb.definedNameAt(0), wb.tableAt(0), wb.passthroughAt(0)]) {
-        assert.equal(entry.status.ok, false);
-      }
-      assert.ok(!('value' in wb.cellAt(99, 0)));
-      assert.ok(!('name' in wb.definedNameAt(0)));
-      assert.ok(!('name' in wb.tableAt(0)));
-      assert.ok(!('path' in wb.passthroughAt(0)));
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('pivotCount + pivotLayout expose PivotTable projection status', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.equal(wb.pivotCount(0).value, 0);
-
-      const missing = wb.pivotLayout(0, 0);
-      assert.equal(missing.status.ok, false);
-      assert.notEqual(missing.status.status, 0);
-      assert.equal(missing.top, 0);
-      assert.equal(missing.left, 0);
-      assert.equal(missing.rows, 0);
-      assert.equal(missing.cols, 0);
-      assert.deepEqual(missing.cells, []);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('pivotLayout projects loaded PivotTable cells for grid rendering', () => {
-    const wb = Module.Workbook.loadBytes(buildPivotWorkbookBytes());
-    try {
-      assert.ok(wb.isValid(), Module.lastErrorMessage());
-      assert.equal(wb.pivotCount(0).value, 0);
-      assert.equal(wb.pivotCount(1).value, 1);
-
-      const layout = wb.pivotLayout(1, 0);
-      assert.ok(layout.status.ok, `status=${JSON.stringify(layout.status)}`);
-      assert.equal(layout.top, 0);
-      assert.equal(layout.left, 3);
-      assert.equal(layout.rows, 4);
-      assert.equal(layout.cols, 2);
-      assert.ok(layout.cells.length > 0);
-
-      const rowLabels = findPivotCell(layout, 0, 3);
-      assert.ok(rowLabels);
-      assert.equal(rowLabels.kind, PIVOT.HEADER);
-      assert.equal(rowLabels.value.kind, VAL.TEXT);
-      assert.equal(rowLabels.value.text, '行ラベル');
-
-      const northLabel = findPivotCell(layout, 1, 3);
-      assert.ok(northLabel);
-      assert.equal(northLabel.kind, PIVOT.ROW_LABEL);
-      assert.equal(northLabel.value.text, 'North');
-
-      const northSum = findPivotCell(layout, 1, 4);
-      assert.ok(northSum);
-      assert.equal(northSum.kind, PIVOT.DATA);
-      assert.equal(northSum.value.kind, VAL.NUMBER);
-      assert.equal(northSum.value.number, 400);
-      assert.equal(northSum.fieldName, 'Sum of Amount');
-
-      const grandTotal = findPivotCell(layout, 3, 4);
-      assert.ok(grandTotal);
-      assert.equal(grandTotal.kind, PIVOT.GRAND_TOTAL);
-      assert.equal(grandTotal.value.kind, VAL.NUMBER);
-      assert.equal(grandTotal.value.number, 600);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('xf index round-trips through setCellXfIndex / getCellXfIndex', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setNumber(0, 2, 3, 5).ok);
-      assert.ok(wb.setCellXfIndex(0, 2, 3, 9).ok);
-      const r = wb.getCellXfIndex(0, 2, 3);
-      assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
-      assert.equal(r.xfIndex, 9);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('style building blocks: addFont -> addXf -> setCellXfIndex -> getXf', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      // A new workbook carries the minimum style table Excel writes, so
-      // a caller-appended record never lands on one of the slots Excel
-      // reserves: one font, the `none` and `gray125` fills, one border,
-      // one xf.
-      assert.equal(wb.fontCount().value, 1);
-      assert.equal(wb.fillCount().value, 2);
-      assert.equal(wb.borderCount().value, 1);
-      assert.equal(wb.xfCount().value, 1);
-
-      const f1 = wb.addFont({
-        name: 'Arial',
-        size: 12,
-        bold: true,
-        italic: false,
-        strike: false,
-        underline: 0,
-        colorArgb: 0xff112233,
-      });
-      assert.ok(f1.status.ok, `addFont: ${JSON.stringify(f1.status)}`);
-      assert.equal(typeof f1.index, 'number');
-
-      // Adding the same font again returns the same index (linear-search dedup).
-      const f1b = wb.addFont({
-        name: 'Arial',
-        size: 12,
-        bold: true,
-        italic: false,
-        strike: false,
-        underline: 0,
-        colorArgb: 0xff112233,
-      });
-      assert.ok(f1b.status.ok);
-      assert.equal(f1b.index, f1.index);
-      assert.equal(wb.fontCount().value, 2);
-
-      const fill = wb.addFill({ pattern: 1, fgArgb: 0xffff0000, bgArgb: 0xff000000 });
-      assert.ok(fill.status.ok);
-      const border = wb.addBorder({
-        left: { style: 1, colorArgb: 0xff000000 },
-        right: { style: 1, colorArgb: 0xff000000 },
-        top: { style: 1, colorArgb: 0xff000000 },
-        bottom: { style: 1, colorArgb: 0xff000000 },
-        diagonal: { style: 0, colorArgb: 0 },
-        diagonalUp: false,
-        diagonalDown: false,
-      });
-      assert.ok(border.status.ok);
-
-      // Built-in num_fmt resolves without growing the table.
-      const builtin = wb.addNumFmt('General');
-      assert.ok(builtin.status.ok);
-      assert.equal(builtin.numFmtId, 0);
-
-      // Custom num_fmt yields >= 164.
-      const custom = wb.addNumFmt('"USD" #,##0');
-      assert.ok(custom.status.ok);
-      assert.ok(custom.numFmtId >= 164, `expected custom id >= 164, got ${custom.numFmtId}`);
-
-      const xf = wb.addXf({
-        fontIndex: f1.index,
-        fillIndex: fill.index,
-        borderIndex: border.index,
-        numFmtId: custom.numFmtId,
-        horizontalAlign: 1,
-        verticalAlign: 2,
-        wrapText: true,
-      });
-      assert.ok(xf.status.ok, `addXf: ${JSON.stringify(xf.status)}`);
-      assert.ok(wb.xfCount().value >= 1);
-
-      // Adding the same xf is a no-op.
-      const xfDup = wb.addXf({
-        fontIndex: f1.index,
-        fillIndex: fill.index,
-        borderIndex: border.index,
-        numFmtId: custom.numFmtId,
-        horizontalAlign: 1,
-        verticalAlign: 2,
-        wrapText: true,
-      });
-      assert.ok(xfDup.status.ok);
-      assert.equal(xfDup.index, xf.index);
-
-      // Stamp the xf on a cell.
-      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
-      assert.ok(wb.setCellXfIndex(0, 0, 0, xf.index).ok);
-
-      // Read back through the getters.
-      const reread = wb.getCellXf(xf.index);
-      assert.ok(reread.status.ok);
-      assert.equal(reread.fontIndex, f1.index);
-      assert.equal(reread.numFmtId, custom.numFmtId);
-      assert.equal(reread.wrapText, true);
-      assert.equal(reread.hasAlignment, true);
-      assert.equal(reread.hasHorizontalAlign, true);
-      assert.equal(reread.hasVerticalAlign, true);
-      assert.equal(reread.hasWrapText, true);
-      assert.equal(reread.hasJustifyLastLine, false);
-
-      const optional = wb.addXf({
-        fontIndex: f1.index,
-        fillIndex: fill.index,
-        borderIndex: border.index,
-        numFmtId: custom.numFmtId,
-        textRotation: 255,
-        indent: 0,
-        relativeIndent: -3,
-        shrinkToFit: false,
-        readingOrder: 0,
-        justifyLastLine: true,
-      });
-      assert.ok(optional.status.ok, `optional alignment: ${JSON.stringify(optional.status)}`);
-      const optionalRead = wb.getCellXf(optional.index);
-      assert.ok(optionalRead.status.ok);
-      assert.equal(optionalRead.textRotation, 255);
-      assert.equal(optionalRead.indent, 0);
-      assert.equal(optionalRead.relativeIndent, -3);
-      assert.equal(optionalRead.shrinkToFit, false);
-      assert.equal(optionalRead.readingOrder, 0);
-      assert.equal(optionalRead.justifyLastLine, true);
-      assert.equal(optionalRead.hasAlignment, true);
-      assert.equal(optionalRead.hasJustifyLastLine, true);
-      assert.equal(wb.addXf(optionalRead).index, optional.index);
-
-      const omitted = wb.addXf({
-        fontIndex: f1.index,
-        fillIndex: fill.index,
-        borderIndex: border.index,
-        numFmtId: custom.numFmtId,
-      });
-      assert.ok(omitted.status.ok);
-      const omittedRead = wb.getCellXf(omitted.index);
-      assert.ok(omittedRead.status.ok);
-      assert.equal(omittedRead.hasAlignment, false);
-
-      const explicitEmpty = wb.addXf({
-        fontIndex: f1.index,
-        fillIndex: fill.index,
-        borderIndex: border.index,
-        numFmtId: custom.numFmtId,
-        hasAlignment: true,
-      });
-      assert.ok(explicitEmpty.status.ok);
-      assert.notEqual(explicitEmpty.index, omitted.index);
-      const explicitEmptyRead = wb.getCellXf(explicitEmpty.index);
-      assert.ok(explicitEmptyRead.status.ok);
-      assert.equal(explicitEmptyRead.hasAlignment, true);
-
-      const rfont = wb.getFont(f1.index);
-      assert.ok(rfont.status.ok);
-      assert.equal(rfont.name, 'Arial');
-      assert.equal(rfont.size, 12);
-      assert.equal(rfont.bold, true);
-
-      const rfill = wb.getFill(fill.index);
-      assert.ok(rfill.status.ok);
-      assert.equal(rfill.pattern, 1);
-      assert.equal(rfill.fgArgb, 0xffff0000);
-
-      const rborder = wb.getBorder(border.index);
-      assert.ok(rborder.status.ok);
-      assert.equal(rborder.left.style, 1);
-      assert.equal(rborder.diagonalUp, false);
-
-      const rfmt = wb.getNumFmt(custom.numFmtId);
-      assert.ok(rfmt.status.ok);
-      assert.equal(rfmt.formatCode, '"USD" #,##0');
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('selector colours survive get/add identity and save/load', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const theme = { kind: 2, rgb: 0, theme: 3, tint: 0.5, indexed: 0 };
-      const indexed = { kind: 3, rgb: 0, theme: 0, tint: 0, indexed: 9 };
-      const automatic = { kind: 4, rgb: 0, theme: 0, tint: 0, indexed: 0 };
-      const font = wb.addFont({
-        name: 'SelectorFont',
-        size: 11,
-        colorArgb: 0x01020304,
-        color: theme,
-      });
-      assert.ok(font.status.ok);
-      const gotFont = wb.getFont(font.index);
-      assert.ok(gotFont.status.ok);
-      assert.equal(gotFont.color.kind, 2);
-      assert.equal(gotFont.color.theme, 3);
-      assert.equal(gotFont.color.tint, 0.5);
-      assert.equal(gotFont.colorArgb, 0x01020304);
-      const fontAgain = wb.addFont(gotFont);
-      assert.ok(fontAgain.status.ok);
-      assert.equal(fontAgain.index, font.index);
-
-      const fill = wb.addFill({
-        pattern: 1,
-        fgArgb: 0x05060708,
-        bgArgb: 0x090a0b0c,
-        fg: indexed,
-        bg: automatic,
-      });
-      assert.ok(fill.status.ok);
-      const gotFill = wb.getFill(fill.index);
-      assert.ok(gotFill.status.ok);
-      assert.equal(gotFill.fg.kind, 3);
-      assert.equal(gotFill.fg.indexed, 9);
-      assert.equal(gotFill.bg.kind, 4);
-      const fillAgain = wb.addFill(gotFill);
-      assert.ok(fillAgain.status.ok);
-      assert.equal(fillAgain.index, fill.index);
-
-      const border = wb.addBorder({
-        left: { style: 1, colorArgb: 0x01020304, color: theme },
-        right: { style: 1, colorArgb: 0x05060708, color: indexed },
-        top: { style: 1, colorArgb: 0x090a0b0c, color: automatic },
-        bottom: { style: 0, colorArgb: 0 },
-        diagonal: { style: 0, colorArgb: 0 },
-      });
-      assert.ok(border.status.ok);
-      const gotBorder = wb.getBorder(border.index);
-      assert.ok(gotBorder.status.ok);
-      assert.equal(gotBorder.left.color.kind, 2);
-      assert.equal(gotBorder.left.color.theme, 3);
-      assert.equal(gotBorder.right.color.kind, 3);
-      assert.equal(gotBorder.right.color.indexed, 9);
-      assert.equal(gotBorder.top.color.kind, 4);
-      const borderAgain = wb.addBorder(gotBorder);
-      assert.ok(borderAgain.status.ok);
-      assert.equal(borderAgain.index, border.index);
-
-      const dxf = wb.addDxf({
-        font: { name: 'DxfSelector', size: 9, colorArgb: 0x11121314, color: automatic },
-        fill: { pattern: 1, fgArgb: 0x15161718, fg: indexed },
-        border: { left: { style: 1, colorArgb: 0x191a1b1c, color: theme } },
-      });
-      assert.ok(dxf.status.ok);
-      const gotDxf = wb.getDxf(dxf.index);
-      assert.ok(gotDxf.status.ok);
-      assert.equal(gotDxf.font.color.kind, 4);
-      assert.equal(gotDxf.fill.fg.kind, 3);
-      assert.equal(gotDxf.border.left.color.kind, 2);
-      const dxfAgain = wb.addDxf(gotDxf);
-      assert.ok(dxfAgain.status.ok);
-      assert.equal(dxfAgain.index, dxf.index);
-
-      const saved = wb.save();
-      assert.ok(saved.status.ok);
-      const loaded = Module.Workbook.loadBytes(saved.bytes);
-      try {
-        assert.ok(loaded.isValid());
-        const loadedFont = loaded.getFont(font.index);
-        const loadedFill = loaded.getFill(fill.index);
-        const loadedBorder = loaded.getBorder(border.index);
-        const loadedDxf = loaded.getDxf(dxf.index);
-        assert.ok(loadedFont.status.ok);
-        assert.ok(loadedFill.status.ok);
-        assert.ok(loadedBorder.status.ok);
-        assert.ok(loadedDxf.status.ok);
-        assert.equal(loadedFont.color.kind, 2);
-        assert.equal(loadedFill.fg.kind, 3);
-        assert.equal(loadedBorder.left.color.kind, 2);
-        assert.equal(loadedDxf.font.color.kind, 4);
-      } finally {
-        loaded.delete();
-      }
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('dxf alignment and protection XML survive get/add identity and save/load', () => {
-    const wb = Module.Workbook.createDefault();
-    const alignmentXml = '<alignment horizontal="center" wrapText="1"/>';
-    const protectionXml = '<protection locked="0" hidden="1"/>';
-    try {
-      const alignment = wb.addDxf({ alignmentXml });
-      assert.ok(alignment.status.ok);
-      const protection = wb.addDxf({ protectionXml });
-      assert.ok(protection.status.ok);
-      assert.notEqual(alignment.index, protection.index);
-
-      const gotAlignment = wb.getDxf(alignment.index);
-      assert.ok(gotAlignment.status.ok);
-      assert.equal(gotAlignment.alignmentXml, alignmentXml);
-      assert.equal(gotAlignment.protectionXml, undefined);
-      const gotProtection = wb.getDxf(protection.index);
-      assert.ok(gotProtection.status.ok);
-      assert.equal(gotProtection.alignmentXml, undefined);
-      assert.equal(gotProtection.protectionXml, protectionXml);
-
-      const alignmentAgain = wb.addDxf(gotAlignment);
-      assert.ok(alignmentAgain.status.ok);
-      assert.equal(alignmentAgain.index, alignment.index);
-      const protectionAgain = wb.addDxf(gotProtection);
-      assert.ok(protectionAgain.status.ok);
-      assert.equal(protectionAgain.index, protection.index);
-
-      const saved = wb.save();
-      assert.ok(saved.status.ok);
-      const loaded = Module.Workbook.loadBytes(saved.bytes);
-      try {
-        assert.ok(loaded.isValid());
-        const loadedAlignment = loaded.getDxf(alignment.index);
-        assert.ok(loadedAlignment.status.ok);
-        assert.equal(loadedAlignment.alignmentXml, alignmentXml);
-        assert.equal(loadedAlignment.protectionXml, undefined);
-        const loadedProtection = loaded.getDxf(protection.index);
-        assert.ok(loadedProtection.status.ok);
-        assert.equal(loadedProtection.alignmentXml, undefined);
-        assert.equal(loadedProtection.protectionXml, protectionXml);
-        const loadedAlignmentAgain = loaded.addDxf(loadedAlignment);
-        assert.ok(loadedAlignmentAgain.status.ok);
-        assert.equal(loadedAlignmentAgain.index, alignment.index);
-        const loadedProtectionAgain = loaded.addDxf(loadedProtection);
-        assert.ok(loadedProtectionAgain.status.ok);
-        assert.equal(loadedProtectionAgain.index, protection.index);
-      } finally {
-        loaded.delete();
-      }
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('addFont / getFont preserve superscript and subscript', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const superscript = wb.addFont({ name: 'Arial', size: 12, vertAlign: 1 });
-      assert.ok(superscript.status.ok);
-      assert.equal(wb.getFont(superscript.index).vertAlign, 1);
-
-      const subscript = wb.addFont({ name: 'Arial', size: 12, vertAlign: 2 });
-      assert.ok(subscript.status.ok);
-      assert.notEqual(subscript.index, superscript.index);
-      assert.equal(wb.getFont(subscript.index).vertAlign, 2);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('addFont(getFont(i)) is the identity and does not grow the table', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const added = wb.addFont({ name: 'Arial', size: 12, vertAlign: 1, colorArgb: 0xff112233 });
-      assert.ok(added.status.ok);
-      const before = wb.fontCount().value;
-      const readBack = wb.getFont(added.index);
-      const again = wb.addFont(readBack);
-      assert.ok(again.status.ok);
-      assert.equal(again.index, added.index);
-      assert.equal(wb.fontCount().value, before);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('a one-field font rewrite keeps the superscript', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const added = wb.addFont({ name: 'Arial', size: 12, vertAlign: 1, colorArgb: 0xff112233 });
-      assert.ok(added.status.ok);
-      const edited = wb.getFont(added.index);
-      edited.colorArgb = 0xff00ff00;
-      const recolored = wb.addFont(edited);
-      assert.ok(recolored.status.ok);
-      assert.notEqual(recolored.index, added.index);
-      const reread = wb.getFont(recolored.index);
-      assert.equal(reread.vertAlign, 1);
-      assert.equal(reread.colorArgb, 0xff00ff00);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('addDxf / getDxf round-trip a superscript differential font', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const added = wb.addDxf({ font: { name: 'Calibri', size: 9, vertAlign: 1 } });
-      assert.ok(added.status.ok);
-      const readBack = wb.getDxf(added.index);
-      assert.equal(readBack.font.vertAlign, 1);
-      const before = wb.dxfCount().value;
-      const again = wb.addDxf(readBack);
-      assert.ok(again.status.ok);
-      assert.equal(again.index, added.index);
-      assert.equal(wb.dxfCount().value, before);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('addXf rejects out-of-range font_index', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const r = wb.addXf({
-        fontIndex: 99,
-        fillIndex: 0,
-        borderIndex: 0,
-        numFmtId: 0,
-        horizontalAlign: 0,
-        verticalAlign: 0,
-        wrapText: false,
-      });
-      assert.ok(!r.status.ok, 'expected addXf to reject out-of-range font_index');
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('addMerge / getMerges round-trip', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.addMerge(0, { firstRow: 0, lastRow: 1, firstCol: 0, lastCol: 2 }).ok);
-      const merges = wb.getMerges(0);
-      assert.equal(merges.length, 1);
-      assert.equal(merges[0].firstRow, 0);
-      assert.equal(merges[0].lastCol, 2);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('removeMerge / removeMergeAt / clearMerges step-wise prune the merge list', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const a = { firstRow: 0, firstCol: 0, lastRow: 1, lastCol: 1 };
-      const b = { firstRow: 4, firstCol: 4, lastRow: 5, lastCol: 5 };
-      assert.ok(wb.addMerge(0, a).ok);
-      assert.ok(wb.addMerge(0, b).ok);
-      // removeMerge with an overlap that hits `a` only.
-      assert.ok(wb.removeMerge(0, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }).ok);
-      const list = wb.getMerges(0);
-      assert.equal(list.length, 1);
-      assert.equal(list[0].firstRow, 4);
-      // removeMergeAt drops the survivor by index.
-      assert.ok(wb.removeMergeAt(0, 0).ok);
-      assert.equal(wb.getMerges(0).length, 0);
-      // clearMerges nukes the remainder; safe on an empty list.
-      assert.ok(wb.addMerge(0, a).ok);
-      assert.ok(wb.addMerge(0, b).ok);
-      assert.ok(wb.clearMerges(0).ok);
-      assert.equal(wb.getMerges(0).length, 0);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('hyperlinks are read after save+load', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.equal(wb.getHyperlinks(0).length, 0);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('addHyperlink + getHyperlinks round-trip', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.equal(wb.getHyperlinks(0).length, 0);
-      // Three entries with progressively more optional fields populated.
-      assert.ok(wb.addHyperlink(0, 1, 2, 'https://example.com/', '', '', '').ok);
-      assert.ok(wb.addHyperlink(0, 3, 4, 'mailto:hello@example.com', 'Hello', '', '').ok);
-      assert.ok(wb.addHyperlink(0, 5, 6, '', 'See X', 'Internal link', 'Sheet1!A1').ok);
-      assert.ok(wb.addHyperlinkRange(0, 7, 8, 9, 10, 'https://example.com/range', 'Range', 'Range tip', '').ok);
-      const list = wb.getHyperlinks(0);
-      assert.equal(list.length, 4);
-      assert.equal(list[0].row, 1);
-      assert.equal(list[0].col, 2);
-      assert.equal(list[0].lastRow, 1);
-      assert.equal(list[0].lastCol, 2);
-      assert.equal(list[0].target, 'https://example.com/');
-      assert.equal(list[0].display, '');
-      assert.equal(list[0].tooltip, '');
-      assert.equal(list[1].target, 'mailto:hello@example.com');
-      assert.equal(list[1].display, 'Hello');
-      assert.equal(list[2].display, 'See X');
-      assert.equal(list[2].tooltip, 'Internal link');
-      assert.equal(list[2].location, 'Sheet1!A1');
-      assert.deepEqual(
-        {
-          row: list[3].row,
-          col: list[3].col,
-          lastRow: list[3].lastRow,
-          lastCol: list[3].lastCol,
-          target: list[3].target,
-          display: list[3].display,
-          tooltip: list[3].tooltip,
+        wb.setNumber(2 ** 32, 0, 0, 7);
+      } catch (error) {
+        threw = error instanceof RangeError;
+      }
+      return { threw, a1: wb.getValue(0, 0, 0).value.number };
+    } finally {
+      wb.delete();
+    }
+  };
+  const factoryOptions = {
+    preInit() {
+      // preInit runs before Emscripten snapshots preRun. Replace that list
+      // with a callback which replaces both later hooks, then let the guard's
+      // own preInit arm append itself to this final list.
+      factoryOptions.preRun = [
+        () => {
+          const hookModule = factoryOptions;
+          const originalRuntime = hookModule.onRuntimeInitialized;
+          hookModule.onRuntimeInitialized = function (...args) {
+            positionalHookProbe.runtimeReplacement = probePositionalHook(this);
+            return Reflect.apply(originalRuntime, this, args);
+          };
+          const originalPostRun = hookModule.postRun;
+          hookModule.postRun = [
+            (moduleArg) => {
+              positionalHookProbe.postReplacement = probePositionalHook(moduleArg);
+            },
+            ...(Array.isArray(originalPostRun) ? originalPostRun : [originalPostRun]),
+          ];
         },
-        {
-          row: 7,
-          col: 8,
-          lastRow: 9,
-          lastCol: 10,
-          target: 'https://example.com/range',
-          display: 'Range',
-          tooltip: 'Range tip',
-        },
-      );
-      // Sheet-out-of-range is rejected.
-      assert.ok(!wb.addHyperlink(999, 0, 0, 'https://x/', '', '', '').ok);
-      // clearHyperlinks drops everything.
-      assert.ok(wb.clearHyperlinks(0).ok);
-      assert.equal(wb.getHyperlinks(0).length, 0);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('removeHyperlink / removeHyperlinkAt / clearHyperlinks surface on an empty sheet', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      // No-op variants on an empty list still return kOk.
-      assert.ok(wb.removeHyperlink(0, 0, 0).ok);
-      assert.ok(wb.clearHyperlinks(0).ok);
-      // Out-of-range index is rejected.
-      assert.ok(!wb.removeHyperlinkAt(0, 0).ok);
-      // Sheet-index-out-of-range is rejected on every variant.
-      assert.ok(!wb.removeHyperlink(999, 0, 0).ok);
-      assert.ok(!wb.removeHyperlinkAt(999, 0).ok);
-      assert.ok(!wb.clearHyperlinks(999).ok);
-      // Final list still matches the post-save+load read.
-      assert.equal(wb.getHyperlinks(0).length, 0);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setComment / getComment round-trip', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setComment(0, 1, 1, 'Alice', 'Hello').ok);
-      const c = wb.getComment(0, 1, 1);
-      assert.ok(c !== null);
-      assert.equal(c.author, 'Alice');
-      assert.equal(c.text, 'Hello');
-      // Empty text removes.
-      assert.ok(wb.setComment(0, 1, 1, '', '').ok);
-      const after = wb.getComment(0, 1, 1);
-      assert.equal(after, null);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('getCommentResult distinguishes absence from an invalid sheet', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const missing = wb.getCommentResult(0, 1, 1);
-      assert.equal(missing.status.ok, false);
-      assert.equal(missing.comment, null);
-      const invalid = wb.getCommentResult(99, 1, 1);
-      assert.equal(invalid.status.ok, false);
-      assert.equal(invalid.comment, null);
-      assert.notEqual(missing.status.status, invalid.status.status);
-      assert.ok(wb.setComment(0, 1, 1, 'libraz', 'hello').ok);
-      const found = wb.getCommentResult(0, 1, 1);
-      assert.equal(found.status.ok, true);
-      assert.equal(found.comment.author, 'libraz');
-      assert.equal(found.comment.text, 'hello');
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('getValidations returns an array', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const arr = wb.getValidations(0);
-      assert.ok(Array.isArray(arr) || typeof arr.length === 'number');
-      assert.equal(arr.length, 0);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('addValidation / getValidations / removeValidationAt / clearValidations round-trip', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      // List-type validation at A1:B3 with prompts and an error message.
-      const listRule = {
-        ranges: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 1 }],
-        type: 3,
-        op: 0,
-        errorStyle: 1,
-        allowBlank: true,
-        showInputMessage: true,
-        showErrorMessage: true,
-        formula1: '"Yes,No,Maybe"',
-        promptTitle: 'Choose',
-        promptMessage: 'Pick one',
-        errorTitle: 'Bad value',
-        errorMessage: 'Pick from the list',
-      };
-      assert.ok(wb.addValidation(0, listRule).ok);
-
-      // Decimal between [0, 100] across two rectangles.
-      const decimalRule = {
-        ranges: [
-          { firstRow: 4, firstCol: 0, lastRow: 4, lastCol: 0 },
-          { firstRow: 6, firstCol: 0, lastRow: 9, lastCol: 0 },
-        ],
-        type: 2,
-        op: 0,
-        formula1: '0',
-        formula2: '100',
-        allowBlank: false,
-      };
-      assert.ok(wb.addValidation(0, decimalRule).ok);
-
-      const list = wb.getValidations(0);
-      assert.equal(list.length, 2);
-
-      const a = list[0];
-      assert.equal(a.type, 3);
-      assert.equal(a.op, 0);
-      assert.equal(a.errorStyle, 1);
-      // Booleans must arrive as JS booleans, not 0/1.
-      assert.equal(typeof a.allowBlank, 'boolean');
-      assert.equal(a.allowBlank, true);
-      assert.equal(typeof a.showInputMessage, 'boolean');
-      assert.equal(a.showInputMessage, true);
-      assert.equal(typeof a.showErrorMessage, 'boolean');
-      assert.equal(a.showErrorMessage, true);
-      assert.equal(a.formula1, '"Yes,No,Maybe"');
-      assert.equal(a.promptTitle, 'Choose');
-      assert.equal(a.errorTitle, 'Bad value');
-      assert.equal(a.errorMessage, 'Pick from the list');
-      assert.equal(a.ranges.length, 1);
-      assert.equal(a.ranges[0].firstRow, 0);
-      assert.equal(a.ranges[0].lastCol, 1);
-
-      const b = list[1];
-      assert.equal(b.type, 2);
-      assert.equal(b.formula1, '0');
-      assert.equal(b.formula2, '100');
-      assert.equal(b.allowBlank, false);
-      assert.equal(b.ranges.length, 2);
-      assert.equal(b.ranges[1].firstRow, 6);
-      assert.equal(b.ranges[1].lastRow, 9);
-
-      // removeValidationAt drops the first rule.
-      assert.ok(wb.removeValidationAt(0, 0).ok);
-      const after = wb.getValidations(0);
-      assert.equal(after.length, 1);
-      assert.equal(after[0].type, 2);
-
-      // Out-of-range index is rejected.
-      assert.ok(!wb.removeValidationAt(0, 99).ok);
-
-      // clearValidations drops everything; safe to call again.
-      assert.ok(wb.clearValidations(0).ok);
-      assert.equal(wb.getValidations(0).length, 0);
-      assert.ok(wb.clearValidations(0).ok);
-
-      // Sheet-out-of-range is rejected on every entry.
-      assert.ok(!wb.addValidation(999, listRule).ok);
-      assert.ok(!wb.removeValidationAt(999, 0).ok);
-      assert.ok(!wb.clearValidations(999).ok);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('CF and sheet-layout lists are plain JS arrays with no delete lifecycle', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const cf = wb.evaluateCfRange(0, 0, 0, 1, 1, Number.NaN);
-      assert.ok(cf.status.ok);
-      assert.ok(Array.isArray(cf.cells));
-
-      assert.ok(wb.setColumnWidth(0, 2, 2, 18).ok);
-      const columns = wb.getSheetColumns(0);
-      assert.ok(columns.status.ok);
-      assert.ok(Array.isArray(columns.columns));
-      assert.equal(columns.columns[0].first, 2);
-      assert.equal(columns.columns[0].width, 18);
-
-      assert.ok(wb.setRowHeight(0, 3, 22).ok);
-      const rows = wb.getSheetRowOverrides(0);
-      assert.ok(rows.status.ok);
-      assert.ok(Array.isArray(rows.rows));
-      assert.equal(rows.rows[0].row, 3);
-      assert.equal(rows.rows[0].height, 22);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('sheet-layout setters refuse coordinates and metrics Excel cannot open', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      // These six setters marshal straight to the C ABI, which is where the
-      // validation lives. The assertions below are what keeps that true: a
-      // binding that grew its own path to the model would still pass every
-      // round-trip test while quietly authoring a file Excel refuses, since
-      // NaN and Infinity serialise to an empty string -- `<col width=""/>`
-      // is not a lexical xsd:double at all, and a repair prompt rather than
-      // an out-of-range value.
-      const kInvalidArgument = 2;
-      // The message is pinned, not just the code. Both JS bindings route
-      // these calls to one set of helpers, so both report that shared
-      // wording; a binding that grew its own check would keep returning
-      // `kInvalidArgument` while the text stopped matching. The status code
-      // alone cannot tell a shared implementation from two that agree today.
-      const kSpanRefused = 'column span out of range';
-      const kRowRefused = 'row index out of range';
-      const kMetricRefused = 'value must be finite and non-negative';
-      const refused = (status, expectedMessage, label) => {
-        assert.equal(status.ok, false, `${label} should have been refused`);
-        assert.equal(status.status, kInvalidArgument, `${label}: ${JSON.stringify(status)}`);
-        assert.equal(status.message, expectedMessage, `${label}: ${JSON.stringify(status)}`);
-      };
-
-      // One past Excel's last column / row.
-      refused(wb.setColumnWidth(0, 0, 16384, 10), kSpanRefused, 'setColumnWidth past the grid');
-      refused(wb.setColumnHidden(0, 0, 16384, true), kSpanRefused, 'setColumnHidden past the grid');
-      refused(wb.setColumnOutline(0, 0, 16384, 1), kSpanRefused, 'setColumnOutline past the grid');
-      refused(wb.setRowHeight(0, 1048576, 10), kRowRefused, 'setRowHeight past the grid');
-      refused(wb.setRowHidden(0, 1048576, true), kRowRefused, 'setRowHidden past the grid');
-      refused(wb.setRowOutline(0, 1048576, 1), kRowRefused, 'setRowOutline past the grid');
-
-      for (const bad of [Number.NaN, Number.POSITIVE_INFINITY, Number.NEGATIVE_INFINITY, -1]) {
-        refused(wb.setColumnWidth(0, 0, 2, bad), kMetricRefused, `setColumnWidth(${bad})`);
-        refused(wb.setRowHeight(0, 1, bad), kMetricRefused, `setRowHeight(${bad})`);
-      }
-
-      // The context names the C ABI entry point that refused the call and
-      // the values it saw, which is what makes a rejection actionable.
-      // These six answer with a bare `Status`, not a `{status}` envelope.
-      const span = wb.setColumnWidth(0, 0, 16384, 10);
-      assert.match(span.context, /fm_sheet_set_column_width: first=0 last=16384/);
-      // Pinned separately because the metric path runs through a different
-      // helper than the span path, and it is the only one of the three that
-      // interpolates a `double`. The value itself is left unmatched on
-      // purpose: `std::to_string` of a NaN is implementation-defined
-      // spelling (`nan`, `-nan`, `nan(ind)`), so asserting it would be a
-      // portability trap across the platforms the prebuilds target.
-      const metric = wb.setRowHeight(0, 1, Number.NaN);
-      assert.match(metric.context, /fm_sheet_set_row_height: height=/);
-
-      // Zero is a real width and a real height, not a rejected one.
-      assert.ok(wb.setColumnWidth(0, 0, 2, 0).ok);
-      assert.ok(wb.setRowHeight(0, 1, 0).ok);
-
-      // The last coordinates Excel does address stay accepted -- an
-      // off-by-one in either bound would refuse them.
-      assert.ok(wb.setColumnWidth(0, 16383, 16383, 10).ok);
-      assert.ok(wb.setColumnHidden(0, 16383, 16383, true).ok);
-      assert.ok(wb.setColumnOutline(0, 16383, 16383, 1).ok);
-      assert.ok(wb.setRowHeight(0, 1048575, 10).ok);
-      assert.ok(wb.setRowHidden(0, 1048575, true).ok);
-      assert.ok(wb.setRowOutline(0, 1048575, 1).ok);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('setSheetVisibility states veryHidden, which the bool setter cannot', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const read = () => {
-        const r = wb.getSheetView(0);
-        assert.ok(r.status.ok, `getSheetView: ${JSON.stringify(r.status)}`);
-        return r.view;
-      };
-      assert.equal(read().visibility, 0);
-      assert.equal(read().tabHidden, 0);
-
-      assert.ok(wb.setSheetVisibility(0, 2).ok);
-      // The two-state view stays consistent: a very-hidden sheet reads as
-      // hidden to a caller that knows only the bool, never as visible.
-      assert.equal(read().visibility, 2);
-      assert.equal(read().tabHidden, 1);
-
-      // Asking for plain "hidden" must not weaken the stronger state.
-      assert.ok(wb.setSheetTabHidden(0, true).ok);
-      assert.equal(read().visibility, 2);
-
-      // Demotion is the other direction the bool cannot express.
-      assert.ok(wb.setSheetVisibility(0, 1).ok);
-      assert.equal(read().visibility, 1);
-      assert.equal(read().tabHidden, 1);
-
-      // Showing the sheet clears either hidden state.
-      assert.ok(wb.setSheetTabHidden(0, false).ok);
-      assert.equal(read().visibility, 0);
-      assert.equal(read().tabHidden, 0);
-
-      // An unknown ordinal is refused and leaves the sheet alone.
-      assert.ok(wb.setSheetVisibility(0, 2).ok);
-      assert.equal(wb.setSheetVisibility(0, 3).ok, false);
-      assert.equal(read().visibility, 2);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('getIterative reads back what setIterative stored', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const initial = wb.getIterative();
-      assert.ok(initial.status.ok, `getIterative: ${JSON.stringify(initial.status)}`);
-      assert.equal(typeof initial.enabled, 'boolean');
-      assert.equal(typeof initial.maxIterations, 'number');
-      assert.equal(typeof initial.maxChange, 'number');
-
-      assert.ok(wb.setIterative(true, 42, 0.25).ok);
-      const enabled = wb.getIterative();
-      assert.ok(enabled.status.ok);
-      assert.equal(enabled.enabled, true);
-      assert.equal(enabled.maxIterations, 42);
-      assert.equal(enabled.maxChange, 0.25);
-
-      // The cap and threshold survive switching iteration back off, which is
-      // what lets a host render the dialog with the stored values.
-      assert.ok(wb.setIterative(false, 42, 0.25).ok);
-      const disabled = wb.getIterative();
-      assert.ok(disabled.status.ok);
-      assert.equal(disabled.enabled, false);
-      assert.equal(disabled.maxIterations, 42);
-      assert.equal(disabled.maxChange, 0.25);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('addValidation defaults allowBlank to false', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(
-        wb.addValidation(0, {
-          ranges: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
-          type: 3,
-          formula1: '"a,b"',
-        }).ok,
-      );
-      const list = wb.getValidations(0);
-      assert.equal(list.length, 1);
-      assert.equal(list[0].allowBlank, false);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('getCellStyleXf reports xfId alongside the cell-format fields', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const read = wb.getCellStyleXf(0);
-      assert.ok(read.status.ok, `getCellStyleXf: ${JSON.stringify(read.status)}`);
-      // A named-style xf is its own parent, so it never inherits one.
-      assert.equal(read.xfId, 0);
-      // The record shape matches `getCellXf`, which the documented
-      // read / edit / addCellStyleXf round-trip depends on.
-      const cellXf = wb.getCellXf(0);
-      assert.ok(cellXf.status.ok);
-      for (const key of Object.keys(cellXf)) {
-        assert.ok(key in read, `getCellStyleXf is missing '${key}'`);
-      }
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('pivotFieldAddItemAt hides the blank item an empty label cannot name', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      const cache = wb.pivotCacheCreate(0);
-      assert.ok(cache.status.ok, `pivotCacheCreate: ${JSON.stringify(cache.status)}`);
-      const region = wb.pivotCacheFieldAdd(cache.index, 'Region');
-      assert.ok(region.status.ok);
-      const amount = wb.pivotCacheFieldAdd(cache.index, 'Amount');
-      assert.ok(amount.status.ok);
-      // Shared item 0 renders as "North"; shared item 1 is the blank, which
-      // carries no label of its own and can only be named by its index.
-      assert.ok(wb.pivotCacheFieldAddSharedItemText(cache.index, region.index, 'North').ok);
-      assert.ok(wb.pivotCacheFieldAddSharedItemBlank(cache.index, region.index).ok);
-
-      const first = wb.pivotCacheRecordAdd(cache.index);
-      assert.ok(first.status.ok);
-      assert.ok(wb.pivotCacheRecordSetNumber(cache.index, first.index, region.index, 0).ok);
-      assert.ok(wb.pivotCacheRecordSetNumber(cache.index, first.index, amount.index, 100).ok);
-      const second = wb.pivotCacheRecordAdd(cache.index);
-      assert.ok(second.status.ok);
-      assert.ok(wb.pivotCacheRecordSetBlank(cache.index, second.index, region.index).ok);
-      assert.ok(wb.pivotCacheRecordSetNumber(cache.index, second.index, amount.index, 200).ok);
-
-      const pivot = wb.pivotCreate(0, 'PT', cache.index, 0, 0);
-      assert.ok(pivot.status.ok, `pivotCreate: ${JSON.stringify(pivot.status)}`);
-      const regionField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Region', axis: 0 });
-      assert.ok(regionField.status.ok);
-      const amountField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Amount', axis: 2 });
-      assert.ok(amountField.status.ok);
-      assert.ok(wb.pivotSetRowFieldOrder(0, pivot.index, [regionField.index]).ok);
-      assert.ok(
-        wb.pivotDataFieldAdd(0, pivot.index, {
-          name: 'Sum of Amount',
-          fieldIndex: amountField.index,
-          aggregation: 0,
-        }).status.ok,
-      );
-
-      const sumDataCells = () => {
-        const layout = wb.pivotLayout(0, pivot.index);
-        assert.ok(layout.status.ok, `pivotLayout: ${JSON.stringify(layout.status)}`);
-        let total = 0;
-        for (const cell of layout.cells) {
-          if (cell.kind === PIVOT.DATA && cell.value.kind === VAL.NUMBER) {
-            total += cell.value.number;
-          }
-        }
-        return total;
-      };
-      assert.equal(sumDataCells(), 300);
-
-      assert.ok(wb.pivotFieldAddItem(0, pivot.index, regionField.index, 'North', true).ok);
-      assert.ok(wb.pivotFieldAddItemAt(0, pivot.index, regionField.index, 1, false).ok);
-      assert.equal(sumDataCells(), 100);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('a rejected argument reports its own diagnostic, not the previous call', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      // Leave a failure of a different call in the thread-local diagnostics.
-      const stale = wb.getValue(99, 0, 0);
-      assert.equal(stale.status.ok, false);
-      assert.ok(stale.status.message.length > 0);
-
-      const rejected = wb.createTable({ sheetIndex: 0, ref: 'A1:B2', name: 'T' });
-      assert.equal(rejected.status.ok, false);
-      assert.notEqual(rejected.status.message, stale.status.message);
-      assert.match(rejected.status.message, /columns/);
-      assert.equal(rejected.status.context, '');
-    } finally {
-      wb.delete();
-    }
-  });
-
-  test('list getters expose failures through their array status', () => {
-    const wb = Module.Workbook.createDefault();
-    try {
-      for (const list of [
-        wb.getMerges(99),
-        wb.getComments(99),
-        wb.getHyperlinks(99),
-        wb.getValidations(99),
-        wb.getConditionalFormats(99),
-      ]) {
-        assert.ok(Array.isArray(list));
-        assert.equal(list.length, 0);
-        assert.equal(list.status.ok, false);
-      }
-      const links = wb.getExternalLinks();
-      assert.ok(Array.isArray(links));
-      assert.equal(links.status.ok, true);
-    } finally {
-      wb.delete();
-    }
-  });
-
-  // Deliberately last. A shadow-stack overflow is a WebAssembly trap, not an
-  // exception: it destroys the module instance, so nothing after it here
-  // would be measuring the engine any more. Running it at the end means the
-  // rest of the suite has already reported when it fires.
-  test('nesting up to the parser depth cap stays inside the shadow stack', () => {
-    // The engine bounds formula nesting with one constant, and under WASM the
-    // stack that bound protects is a link-time size. When the two disagree the
-    // failure is not an error value: the shadow stack runs into the data
-    // segment below it, and past that the module faults in a way no
-    // `Expected` can report and no `try` can recover from. So the assertion is
-    // that the cap is reached by a diagnostic.
-    //
-    // Nested calls are the shape that matters -- parentheses are elided by the
-    // parser and cost a fraction as much per level. The cap itself is
-    // discovered rather than written down, so raising it in the engine does
-    // not quietly narrow what this covers.
-    const wb = Module.Workbook.createDefault();
-    try {
-      assert.ok(wb.setNumber(0, 0, 0, 7).ok);
-
-      const searchCeiling = 1024;
-      let rejectedAt = 0;
-      for (let depth = 1; depth <= searchCeiling; depth += 1) {
-        const formula = `=${'SUM('.repeat(depth)}A1${')'.repeat(depth)}`;
-        let out;
-        try {
-          out = wb.evaluateFormulaText(0, 1, 0, formula);
-        } catch (e) {
-          // Past this point the instance is gone and its worker threads keep
-          // the process alive, so reporting and continuing would hang rather
-          // than fail. Exit on the spot with the depth that did it.
-          console.error(`FAIL nesting depth ${depth} (${formula.length} chars) faulted instead of evaluating.`);
-          console.error(`  ${e && e.stack ? e.stack : e}`);
-          console.error(
-            '  The WASM shadow stack is too small for parser::kMaxFormulaAstDepth. ' +
-              'See _FM_WASM_STACK_SIZE in cmake/FormulonWasm.cmake and the stack_probe artifact.',
-          );
-          process.exit(1);
-        }
-        assert.ok(out.status.ok, `depth=${depth} status=${JSON.stringify(out.status)}`);
-        if (out.value.kind === VAL.ERROR) {
-          assert.equal(out.value.errorCode, 4, `depth=${depth} should be rejected as #NAME?`);
-          rejectedAt = depth;
-          break;
-        }
-        // Nested SUM over one cell is the identity. A wrong answer here is what
-        // a stack that overran its limit looks like from the outside.
-        assert.equal(out.value.kind, VAL.NUMBER, `depth=${depth}`);
-        assert.equal(out.value.number, 7, `depth=${depth}`);
-      }
-      assert.ok(rejectedAt > 0, `no nesting depth up to ${searchCeiling} was rejected; the depth cap did not engage`);
-    } finally {
-      wb.delete();
-    }
-  });
+      ];
+    },
+    onRuntimeInitialized() {
+      positionalHookProbe.runtimeInitial = probePositionalHook(this);
+    },
+    postRun(hookModule) {
+      positionalHookProbe.postInitial = probePositionalHook(hookModule);
+    },
+  };
+  const Module = await factory(factoryOptions);
+
+  registerSurfaceRecalc(Module, test, threadsBuild);
+  registerCellsIo(Module, test);
+  registerSheetPivot(Module, test);
+  registerStyles(Module, test);
+  registerMetadataLayout(Module, test);
+  registerPivotRegressions(Module, test);
+  registerPositional(Module, test, positionalHookProbe);
+  registerCellGeometryDisplay(Module, test);
+  registerThemeStyles(Module, test);
+  registerFilterValidationComments(Module, test);
+  registerLayoutValidation(Module, test);
+  registerDrawing(Module, test);
 
   // ---- Run --------------------------------------------------------------
   for (const c of cases) {
diff --git a/tests/wasm/run_cell_geometry_display.mjs b/tests/wasm/run_cell_geometry_display.mjs
new file mode 100644
index 000000000..02d7576d1
--- /dev/null
+++ b/tests/wasm/run_cell_geometry_display.mjs
@@ -0,0 +1,304 @@
+import assert from 'node:assert/strict';
+
+const RANGE_A1_F6 = { firstRow: 0, firstCol: 0, lastRow: 5, lastCol: 5 };
+
+function withWorkbook(Module, fn) {
+  const wb = Module.Workbook.createDefault();
+  try {
+    fn(wb);
+  } finally {
+    wb.delete();
+  }
+}
+
+export function registerCellGeometryDisplay(Module, test) {
+  test('getFormula / getFormulaR1C1 report the stored formula or null', () => {
+    withWorkbook(Module, (wb) => {
+      assert.ok(wb.setNumber(0, 0, 0, 5).ok);
+      assert.ok(wb.setFormula(0, 0, 1, '=A1*2').ok);
+      const a1 = wb.getFormula(0, 0, 1);
+      assert.ok(a1.status.ok);
+      assert.equal(a1.formula, '=A1*2');
+      assert.equal(wb.getFormula(0, 0, 0).formula, null);
+      const r1c1 = wb.getFormulaR1C1(0, 0, 1);
+      assert.ok(r1c1.status.ok);
+      assert.equal(r1c1.formula, 'RC[-1]*2');
+      assert.equal(wb.getFormulaR1C1(0, 0, 0).formula, null);
+      assert.equal(wb.getFormula(9, 0, 0).status.ok, false);
+      assert.equal(wb.getFormula(9, 0, 0).formula, null);
+    });
+  });
+
+  test('getCellsInRange pages through populated cells with a cursor', () => {
+    withWorkbook(Module, (wb) => {
+      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+      assert.ok(wb.setFormula(0, 0, 1, '=A1+1').ok);
+      assert.ok(wb.setText(0, 1, 0, 'hi').ok);
+      assert.ok(wb.recalc().ok);
+
+      const all = wb.getCellsInRange(0, RANGE_A1_F6);
+      assert.ok(all.status.ok);
+      assert.equal(all.cells.length, 3);
+      assert.equal(all.nextCursor, null);
+      assert.equal(all.cells[1].formula, '=A1+1');
+      assert.equal(all.cells[1].value.number, 2);
+      assert.equal(all.cells[2].value.text, 'hi');
+
+      const seen = [];
+      let cursor = null;
+      for (let guard = 0; guard < 10; guard += 1) {
+        const page = wb.getCellsInRange(0, RANGE_A1_F6, cursor, 1);
+        assert.ok(page.status.ok);
+        assert.ok(page.cells.length <= 1);
+        seen.push(...page.cells.map((c) => `${c.row},${c.col}`));
+        if (page.nextCursor === null) break;
+        cursor = page.nextCursor;
+      }
+      assert.deepEqual(seen, ['0,0', '0,1', '1,0']);
+
+      assert.throws(() => wb.getCellsInRange(0, RANGE_A1_F6, -1), RangeError);
+      const unchanged = wb.getCellsInRange(0, RANGE_A1_F6);
+      assert.ok(unchanged.status.ok);
+      assert.deepEqual(unchanged.cells, all.cells);
+      assert.equal(unchanged.nextCursor, null);
+    });
+  });
+
+  test('getCellsInRange throws on every invalid range integer before the C call', () => {
+    const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY, Symbol('range integer')];
+    withWorkbook(Module, (wb) => {
+      assert.ok(wb.setNumber(0, 0, 0, 7).ok);
+      for (const value of invalid) {
+        for (const key of ['firstRow', 'firstCol', 'lastRow', 'lastCol']) {
+          assert.throws(
+            () =>
+              wb.getCellsInRange(0, {
+                firstRow: 0,
+                firstCol: 0,
+                lastRow: 4,
+                lastCol: 4,
+                [key]: value,
+              }),
+            typeof value === 'symbol' ? TypeError : RangeError,
+            `getCellsInRange ${key}=${String(value)} accepted`,
+          );
+        }
+      }
+
+      const range = { firstRow: 0, firstCol: 0, lastRow: 4, lastCol: 4 };
+      Object.defineProperty(range, 'firstRow', {
+        enumerable: true,
+        get() {
+          throw new Error('cell range getter');
+        },
+      });
+      assert.throws(() => wb.getCellsInRange(0, range), /cell range getter/);
+    });
+  });
+
+  test('getMergesInRange lists only intersecting merges', () => {
+    withWorkbook(Module, (wb) => {
+      const merge = { firstRow: 0, lastRow: 1, firstCol: 3, lastCol: 4 };
+      assert.ok(wb.addMerge(0, merge).ok);
+      const hit = wb.getMergesInRange(0, { firstRow: 0, lastRow: 0, firstCol: 0, lastCol: 3 });
+      assert.ok(hit.status.ok);
+      assert.deepEqual([...hit], [merge]);
+      const miss = wb.getMergesInRange(0, { firstRow: 5, lastRow: 6, firstCol: 0, lastCol: 0 });
+      assert.ok(miss.status.ok);
+      assert.equal(miss.length, 0);
+      assert.equal(wb.getMergesInRange(9, merge).status.ok, false);
+    });
+  });
+
+  test('getDisplayText / formatValue render through the number format', () => {
+    withWorkbook(Module, (wb) => {
+      assert.ok(wb.setNumber(0, 0, 0, 1234.5).ok);
+      const plain = wb.getDisplayText(0, 0, 0);
+      assert.ok(plain.status.ok);
+      assert.equal(plain.text, '1234.5');
+      assert.equal(plain.displayStatus, 0);
+      assert.equal(wb.getDisplayText(0, 7, 7).text, '');
+
+      const pct = wb.formatValue({ kind: 1, number: 0.5, boolean: 0, text: '', errorCode: 0 }, '0.0%');
+      assert.ok(pct.status.ok);
+      assert.equal(pct.text, '50.0%');
+      assert.equal(pct.displayStatus, 0);
+      const txt = wb.formatValue({ kind: 3, number: 0, boolean: 0, text: 'abc', errorCode: 0 }, '@');
+      assert.equal(txt.text, 'abc');
+      const bad = wb.formatValue({ kind: 1, number: 1, boolean: 0, text: '', errorCode: 0 }, '[[');
+      assert.ok(bad.status.ok);
+      assert.equal(bad.displayStatus, 2);
+      assert.equal(wb.getDisplayText(9, 0, 0).status.ok, false);
+    });
+  });
+
+  test('nested SUBTOTAL skips inner subtotal cells in value, formula and display text', () => {
+    withWorkbook(Module, (wb) => {
+      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+      assert.ok(wb.setNumber(0, 1, 0, 2).ok);
+      assert.ok(wb.setNumber(0, 2, 0, 3).ok);
+      assert.ok(wb.setFormula(0, 3, 0, '=SUBTOTAL(9,A1:A3)').ok);
+      assert.ok(wb.setFormula(0, 4, 0, '=SUBTOTAL(9,A1:A4)').ok);
+      assert.ok(wb.recalc().ok);
+      assert.equal(wb.getValue(0, 3, 0).value.number, 6);
+      assert.equal(wb.getValue(0, 4, 0).value.number, 6);
+      assert.equal(wb.getFormula(0, 4, 0).formula, '=SUBTOTAL(9,A1:A4)');
+      assert.equal(wb.getFormulaR1C1(0, 4, 0).formula, 'SUBTOTAL(9,R[-4]C:R[-1]C)');
+      assert.equal(wb.getDisplayText(0, 4, 0).text, '6');
+      const page = wb.getCellsInRange(0, { firstRow: 3, firstCol: 0, lastRow: 4, lastCol: 0 });
+      assert.deepEqual(
+        page.cells.map((c) => c.value.number),
+        [6, 6],
+      );
+    });
+  });
+
+  test('row heights: clearRowHeight and the has/custom flags on row overrides', () => {
+    withWorkbook(Module, (wb) => {
+      assert.ok(wb.setRowHeight(0, 3, 30).ok);
+      const rows = wb.getSheetRowOverrides(0).rows;
+      assert.equal(rows.length, 1);
+      assert.equal(rows[0].height, 30);
+      assert.equal(rows[0].hasHeight, 1);
+      assert.equal(rows[0].customHeight, 1);
+      assert.ok(wb.clearRowHeight(0, 3).ok);
+      assert.equal(wb.getSheetRowOverrides(0).rows.length, 0);
+      assert.ok(wb.clearRowHeight(0, 3).ok);
+      assert.equal(wb.clearRowHeight(9, 0).ok, false);
+    });
+  });
+
+  test('sheet format defaults round-trip with presence flags', () => {
+    withWorkbook(Module, (wb) => {
+      const initial = wb.getSheetFormatDefaults(0);
+      assert.ok(initial.status.ok);
+      assert.equal(initial.hasDefaultColWidth, false);
+      assert.equal(initial.hasDefaultRowHeight, false);
+      assert.equal(initial.baseColWidth, 8);
+
+      assert.ok(wb.setSheetFormatDefaults(0, { defaultColWidth: 10, defaultRowHeight: 18, baseColWidth: 9 }).ok);
+      const set = wb.getSheetFormatDefaults(0);
+      assert.equal(set.defaultColWidth, 10);
+      assert.equal(set.defaultRowHeight, 18);
+      assert.equal(set.baseColWidth, 9);
+      assert.equal(set.hasDefaultColWidth, true);
+      assert.equal(set.hasDefaultRowHeight, true);
+
+      assert.equal(wb.setSheetFormatDefaults(0, { defaultColWidth: -1 }).ok, false);
+      assert.equal(wb.getSheetFormatDefaults(0).defaultColWidth, 10);
+      assert.equal(wb.getSheetFormatDefaults(9).status.ok, false);
+    });
+  });
+
+  test('point geometry: rect, widths, heights, width model and conversions', () => {
+    withWorkbook(Module, (wb) => {
+      const range = { firstRow: 0, firstCol: 0, lastRow: 1, lastCol: 1 };
+      const rect = wb.getCellRectPt(0, range, 0);
+      assert.ok(rect.status.ok);
+      assert.equal(rect.x, 0);
+      assert.equal(rect.y, 0);
+      assert.ok(rect.width > 0 && rect.height > 0);
+
+      const col = wb.getColumnWidthPt(0, 0, 1);
+      const row = wb.getRowHeightPt(0, 0);
+      assert.ok(col.status.ok && col.value > 0);
+      assert.ok(row.status.ok && row.value > 0);
+
+      const wide = wb.getCellRectPt(0, { ...range, lastRow: 0, lastCol: 0 }, 0);
+      assert.ok(Math.abs(wide.height - row.value) < 1e-9);
+
+      assert.ok(wb.setColumnHidden(0, 0, 0, true).ok);
+      assert.equal(wb.getColumnWidthPt(0, 0, 0).value, 0);
+      assert.ok(wb.setColumnHidden(0, 0, 0, false).ok);
+
+      const model = wb.getWidthModel(0, 0);
+      assert.ok(model.status.ok);
+      assert.equal(typeof model.calibrated, 'boolean');
+      assert.equal(typeof model.normalFontName, 'string');
+      assert.ok(model.pointsPerChar > 0);
+      assert.ok(model.platform.length > 0);
+
+      const pt = wb.columnCharsToPt(0, 0, 10);
+      assert.ok(pt.status.ok);
+      assert.ok(Math.abs(pt.value - (10 * model.pointsPerChar + model.paddingPt)) < 1e-6);
+      const chars = wb.columnPtToChars(0, 0, pt.value);
+      assert.ok(Math.abs(chars.value - 10) < 1e-6);
+      assert.equal(wb.columnCharsToPt(0, 0, 0).value, 0);
+      assert.equal(wb.columnCharsToPt(0, 0, -1).status.ok, false);
+      assert.equal(wb.getWidthModel(0, 7).status.ok, false);
+      assert.equal(wb.getCellRectPt(0, range, 7).status.ok, false);
+    });
+  });
+
+  test('cell xf carries apply flags, quotePrefix and protection', () => {
+    withWorkbook(Module, (wb) => {
+      const base = wb.getCellXf(0);
+      assert.equal(base.hasProtection, false);
+      assert.equal(base.locked, true);
+      assert.equal(base.hidden, false);
+      assert.equal(base.quotePrefix, false);
+      assert.equal(base.applyFont, false);
+
+      const added = wb.addXf({
+        fontIndex: 0,
+        fillIndex: 0,
+        borderIndex: 0,
+        numFmtId: 0,
+        horizontalAlign: 0,
+        verticalAlign: 2,
+        wrapText: false,
+        applyFont: true,
+        applyProtection: true,
+        quotePrefix: true,
+        locked: false,
+        hidden: true,
+      });
+      assert.ok(added.status.ok);
+      const xf = wb.getCellXf(added.index);
+      assert.equal(xf.applyFont, true);
+      assert.equal(xf.applyProtection, true);
+      assert.equal(xf.applyNumberFormat, false);
+      assert.equal(xf.quotePrefix, true);
+      assert.equal(xf.hasProtection, true);
+      assert.equal(xf.locked, false);
+      assert.equal(xf.hidden, true);
+    });
+  });
+
+  test('paginate carries paper, margins, scale, titles, pages and manual-break flags', () => {
+    withWorkbook(Module, (wb) => {
+      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+      assert.ok(wb.setNumber(0, 120, 0, 2).ok);
+      assert.ok(wb.addSheetRowBreak(0, 10, true).ok);
+      assert.ok(wb.setSheetPrintTitles(0, '1:2', '').ok);
+      const r = wb.paginate(0);
+      assert.ok(r.status.ok);
+      assert.ok(r.paper.widthPt > 0 && r.paper.heightPt > 0);
+      assert.equal(typeof r.paper.landscape, 'boolean');
+      assert.equal(typeof r.paper.known, 'boolean');
+      assert.ok(r.margins.left > 0 && r.margins.top > 0);
+      assert.ok(r.printable.width > 0 && r.printable.height > 0);
+      assert.equal(r.scale, 1);
+      assert.equal(r.pageOrder, 0);
+      assert.equal(r.printTitles.hasRows, true);
+      assert.equal(r.printTitles.firstRow, 0);
+      assert.equal(r.printTitles.lastRow, 1);
+      assert.equal(r.printTitles.hasCols, false);
+      assert.equal(r.pages.length, r.pageCount);
+      assert.ok(r.pages.length >= 2);
+      assert.equal(r.pages[0].firstRow, 0);
+      assert.ok(r.pages[0].widthPt > 0);
+      assert.equal(r.horizontalBreakManual.length, r.horizontalBreaks.length);
+      assert.equal(r.verticalBreakManual.length, r.verticalBreaks.length);
+      const manualAt = r.horizontalBreaks.indexOf(10);
+      assert.ok(manualAt >= 0, `breaks=${JSON.stringify(r.horizontalBreaks)}`);
+      assert.equal(r.horizontalBreakManual[manualAt], true);
+      assert.ok(r.horizontalBreakManual.some((m) => m === false));
+
+      const failed = wb.paginate(9);
+      assert.equal(failed.status.ok, false);
+      assert.deepEqual(failed.pages, []);
+      assert.equal(failed.paper.known, false);
+    });
+  });
+}
diff --git a/tests/wasm/run_cells_io.mjs b/tests/wasm/run_cells_io.mjs
new file mode 100644
index 000000000..2f9677ed7
--- /dev/null
+++ b/tests/wasm/run_cells_io.mjs
@@ -0,0 +1,604 @@
+import assert from 'node:assert/strict';
+import { appendEmptyZipEntry, readZipEntryText, VAL } from './smoke_support.mjs';
+
+const nestedErrorClass = (value) => (typeof value === 'symbol' ? TypeError : RangeError);
+
+export function registerCellsIo(Module, test) {
+  test('setText / setBool / setBlank round-trip', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setText(0, 0, 0, 'hello').ok);
+      assert.ok(wb.setBool(0, 1, 0, true).ok);
+      assert.ok(wb.setBlank(0, 2, 0).ok);
+      assert.ok(wb.recalc().ok);
+
+      const a1 = wb.getValue(0, 0, 0);
+      assert.equal(a1.value.kind, VAL.TEXT);
+      assert.equal(a1.value.text, 'hello');
+
+      const a2 = wb.getValue(0, 1, 0);
+      assert.equal(a2.value.kind, VAL.BOOL);
+      assert.equal(a2.value.boolean, 1);
+
+      const a3 = wb.getValue(0, 2, 0);
+      assert.equal(a3.value.kind, VAL.BLANK);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('setCellPhonetic / getCellPhonetic preserve and clear a Japanese guide', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setText(0, 0, 0, '漢字').ok);
+      assert.ok(wb.setCellPhonetic(0, 0, 0, 'かんじ').ok);
+      const phonetic = wb.getCellPhonetic(0, 0, 0);
+      assert.ok(phonetic.status.ok);
+      assert.equal(phonetic.value, 'かんじ');
+
+      assert.ok(wb.setCellPhonetic(0, 0, 0, '').ok);
+      assert.equal(wb.getCellPhonetic(0, 0, 0).value, '');
+
+      assert.ok(wb.setCellPhonetic(0, 0, 0, 'かんじ').ok);
+      assert.ok(wb.setText(0, 0, 0, '文字列').ok);
+      assert.equal(wb.getCellPhonetic(0, 0, 0).value, '');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('setCellPhoneticRuns / getCellPhoneticRuns keep the spans apart', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setText(0, 0, 0, '東京都').ok);
+      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, []);
+
+      const runs = [
+        { sb: 0, eb: 2, text: 'トウキョウ' },
+        { sb: 2, eb: 3, text: 'ト' },
+      ];
+      assert.ok(wb.setCellPhoneticRuns(0, 0, 0, runs).ok);
+      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, runs);
+      // The flattening getter still reports the concatenation.
+      assert.equal(wb.getCellPhonetic(0, 0, 0).value, 'トウキョウト');
+
+      // Writing that back through the whole-cell setter is the collapse the
+      // run API exists to avoid.
+      assert.ok(wb.setCellPhonetic(0, 0, 0, 'トウキョウト').ok);
+      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, [{ sb: 0, eb: 3, text: 'トウキョウト' }]);
+
+      assert.ok(wb.setCellPhoneticRuns(0, 0, 0, []).ok);
+      assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, []);
+
+      assert.equal(
+        wb.setCellPhoneticRuns(0, 0, 0, [
+          { sb: 2, eb: 3, text: 'ト' },
+          { sb: 0, eb: 2, text: 'トウ' },
+        ]).ok,
+        false,
+      );
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('setCellPhoneticProperties survives a run edit and a save/load cycle', () => {
+    // The result carries a `status` alongside the triple; compare the
+    // triple alone so a status-shape change does not read as a value change.
+    const phoneticProps = (book, sheet, row, col) => {
+      const { fontId, type, alignment } = book.getCellPhoneticProperties(sheet, row, col);
+      return { fontId, type, alignment };
+    };
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setText(0, 0, 0, '大阪').ok);
+      // An unannotated cell reports what Excel infers for a guide written
+      // with no <phoneticPr> at all.
+      assert.deepEqual(phoneticProps(wb, 0, 0, 0), { fontId: 0, type: 0, alignment: 0 });
+
+      assert.ok(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 3, type: 2, alignment: 2 }).ok);
+      // Setting the readings must not reset the rendering.
+      assert.ok(wb.setCellPhoneticRuns(0, 0, 0, [{ sb: 0, eb: 2, text: 'おおさか' }]).ok);
+      assert.deepEqual(phoneticProps(wb, 0, 0, 0), { fontId: 3, type: 2, alignment: 2 });
+
+      const saved = wb.save();
+      assert.ok(saved.status.ok);
+      const loaded = Module.Workbook.loadBytes(saved.bytes);
+      try {
+        assert.deepEqual(phoneticProps(loaded, 0, 0, 0), { fontId: 3, type: 2, alignment: 2 });
+      } finally {
+        loaded.delete();
+      }
+
+      // Two bits each on the binary side, so a wider ordinal is refused
+      // rather than truncated into a different, valid-looking one.
+      assert.equal(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 0, type: 4, alignment: 0 }).ok, false);
+      assert.deepEqual(phoneticProps(wb, 0, 0, 0), { fontId: 3, type: 2, alignment: 2 });
+
+      // A value write discards the guide and its rendering together.
+      assert.ok(wb.setText(0, 0, 0, '京都').ok);
+      assert.deepEqual(phoneticProps(wb, 0, 0, 0), { fontId: 0, type: 0, alignment: 0 });
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('cell nested integer fields reject narrowing before C mutations', () => {
+    const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY, Symbol('cell integer')];
+    for (const value of invalid) {
+      const wb = Module.Workbook.createDefault();
+      try {
+        assert.ok(wb.setText(0, 0, 0, '東京都').ok);
+        const runs = [
+          { sb: 0, eb: 2, text: 'トウキョウ' },
+          { sb: 2, eb: 3, text: 'ト' },
+        ];
+        assert.ok(wb.setCellPhoneticRuns(0, 0, 0, runs).ok);
+        const beforeRuns = wb.getCellPhoneticRuns(0, 0, 0).runs;
+        assert.throws(
+          () => wb.setCellPhoneticRuns(0, 0, 0, [{ sb: value, eb: 2, text: '壊' }]),
+          nestedErrorClass(value),
+          `setCellPhoneticRuns sb=${String(value)} accepted`,
+        );
+        assert.deepEqual(wb.getCellPhoneticRuns(0, 0, 0).runs, beforeRuns);
+
+        assert.ok(wb.setCellPhoneticProperties(0, 0, 0, { fontId: 3, type: 2, alignment: 2 }).ok);
+        const beforeProps = wb.getCellPhoneticProperties(0, 0, 0);
+        assert.throws(
+          () => wb.setCellPhoneticProperties(0, 0, 0, { fontId: value, type: 2, alignment: 2 }),
+          nestedErrorClass(value),
+          `setCellPhoneticProperties fontId=${String(value)} accepted`,
+        );
+        assert.deepEqual(
+          {
+            fontId: wb.getCellPhoneticProperties(0, 0, 0).fontId,
+            type: wb.getCellPhoneticProperties(0, 0, 0).type,
+            alignment: wb.getCellPhoneticProperties(0, 0, 0).alignment,
+          },
+          { fontId: beforeProps.fontId, type: beforeProps.type, alignment: beforeProps.alignment },
+        );
+
+        assert.throws(
+          () => wb.formatValue({ kind: value, number: 1, boolean: 0, text: '', errorCode: 0 }, 'General'),
+          nestedErrorClass(value),
+          `formatValue kind=${String(value)} accepted`,
+        );
+      } finally {
+        wb.delete();
+      }
+    }
+  });
+
+  test('cell Value boolean and errorCode use checked signed integers', () => {
+    const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY, Symbol('cell value integer')];
+    for (const value of invalid) {
+      const wb = Module.Workbook.createDefault();
+      try {
+        assert.throws(
+          () => wb.formatValue({ kind: 2, number: 0, boolean: value, text: '', errorCode: 0 }, 'General'),
+          nestedErrorClass(value),
+          `formatValue boolean=${String(value)} accepted`,
+        );
+        assert.throws(
+          () => wb.formatValue({ kind: 4, number: 0, boolean: 0, text: '', errorCode: value }, 'General'),
+          nestedErrorClass(value),
+          `formatValue errorCode=${String(value)} accepted`,
+        );
+      } finally {
+        wb.delete();
+      }
+    }
+  });
+
+  test('setDefaultFont replaces font 0, which addFont can only append beside', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.equal(wb.getFont(0).name, 'Calibri');
+      const appended = wb.addFont({ name: '游ゴシック', size: 11 });
+      assert.ok(appended.status.ok);
+      assert.ok(appended.index > 0);
+      assert.equal(wb.getFont(0).name, 'Calibri');
+
+      assert.ok(wb.setDefaultFont({ name: '游ゴシック', size: 11, hasCharset: true, charset: 128 }).ok);
+      assert.equal(wb.getFont(0).name, '游ゴシック');
+      assert.equal(wb.getFont(0).charset, 128);
+
+      const added = wb.addFont({ name: 'Meiryo', size: 12 });
+      assert.ok(wb.setFont(added.index, { name: 'MS Gothic', size: 9 }).ok);
+      assert.equal(wb.getFont(added.index).name, 'MS Gothic');
+      assert.equal(wb.setFont(wb.fontCount().value, { name: 'MS Gothic', size: 9 }).ok, false);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('table update omits fields without resetting existing metadata', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const created = wb.createTable({
+        sheetIndex: 0,
+        ref: 'A1:B3',
+        name: 'Sales',
+        columns: ['Product', 'Amount'],
+        styleName: 'TableStyleMedium2',
+        headerRow: false,
+        totalsRow: true,
+      });
+      assert.ok(created.status.ok, `createTable failed: ${JSON.stringify(created.status)}`);
+      const before = wb.tableAt(created.index);
+      assert.ok(before.status.ok);
+      assert.equal(before.ref, 'A1:B3');
+
+      const beforeSaved = wb.save();
+      assert.ok(beforeSaved.status.ok);
+      const beforeXml = readZipEntryText(beforeSaved.bytes, 'xl/tables/table1.xml');
+      assert.match(beforeXml, /name="TableStyleMedium2"/);
+      assert.match(beforeXml, /headerRowCount="0"/);
+      assert.match(beforeXml, /totalsRowCount="1"/);
+
+      // An empty update object is a partial no-op. This specifically covers
+      // the WASM-to-C mapping of omitted ref/style/row flags to preservation
+      // sentinels rather than empty/false defaults.
+      assert.ok(wb.updateTable(created.index, {}).ok);
+      const after = wb.tableAt(created.index);
+      assert.ok(after.status.ok);
+      assert.equal(after.ref, before.ref);
+
+      const saved = wb.save();
+      assert.ok(saved.status.ok, `save failed: ${JSON.stringify(saved.status)}`);
+      const afterXml = readZipEntryText(saved.bytes, 'xl/tables/table1.xml');
+      assert.match(afterXml, /name="TableStyleMedium2"/);
+      assert.match(afterXml, /headerRowCount="0"/);
+      assert.match(afterXml, /totalsRowCount="1"/);
+      const loaded = Module.Workbook.loadBytes(saved.bytes);
+      try {
+        assert.ok(loaded.isValid(), `load failed: ${Module.lastErrorMessage()}`);
+        const reloaded = loaded.tableAt(created.index);
+        assert.ok(reloaded.status.ok);
+        assert.equal(reloaded.ref, 'A1:B3');
+        const roundTripped = loaded.save();
+        assert.ok(roundTripped.status.ok);
+        const roundTrippedXml = readZipEntryText(roundTripped.bytes, 'xl/tables/table1.xml');
+        assert.match(roundTrippedXml, /name="TableStyleMedium2"/);
+        assert.match(roundTrippedXml, /headerRowCount="0"/);
+        assert.match(roundTrippedXml, /totalsRowCount="1"/);
+      } finally {
+        loaded.delete();
+      }
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('table update rethrows nested getter failures before changing the table', () => {
+    const getterFields = ['ref', 'styleName', 'headerRow', 'totalsRow'];
+    for (const field of getterFields) {
+      const wb = Module.Workbook.createDefault();
+      try {
+        const created = wb.createTable({
+          sheetIndex: 0,
+          ref: 'A1:B3',
+          name: 'Sales',
+          columns: ['Product', 'Amount'],
+          styleName: 'TableStyleMedium2',
+          headerRow: false,
+          totalsRow: true,
+        });
+        assert.ok(created.status.ok, `createTable failed: ${JSON.stringify(created.status)}`);
+        const before = readZipEntryText(wb.save().bytes, 'xl/tables/table1.xml');
+        const spec = {};
+        Object.defineProperty(spec, field, {
+          enumerable: true,
+          get() {
+            throw new Error(`table update ${field} getter`);
+          },
+        });
+        assert.throws(() => wb.updateTable(created.index, spec), new RegExp(`table update ${field} getter`));
+        assert.equal(readZipEntryText(wb.save().bytes, 'xl/tables/table1.xml'), before);
+      } finally {
+        wb.delete();
+      }
+    }
+  });
+
+  test('table update reads each optional field once before the C call', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const created = wb.createTable({
+        sheetIndex: 0,
+        ref: 'A1:B3',
+        name: 'Sales',
+        columns: ['Product', 'Amount'],
+        styleName: 'TableStyleMedium2',
+        headerRow: false,
+        totalsRow: true,
+      });
+      assert.ok(created.status.ok, `createTable failed: ${JSON.stringify(created.status)}`);
+      const values = { ref: 'A1:B4', styleName: 'TableStyleLight9', headerRow: true, totalsRow: false };
+      const reads = Object.fromEntries(Object.keys(values).map((key) => [key, 0]));
+      const spec = {};
+      for (const [key, value] of Object.entries(values)) {
+        Object.defineProperty(spec, key, {
+          enumerable: true,
+          get() {
+            reads[key] += 1;
+            if (reads[key] > 1) throw new Error(`table update ${key} getter read twice`);
+            return value;
+          },
+        });
+      }
+      const result = wb.updateTable(created.index, spec);
+      assert.ok(result.ok, JSON.stringify(result));
+      assert.deepEqual(reads, { ref: 1, styleName: 1, headerRow: 1, totalsRow: 1 });
+      assert.equal(wb.tableAt(created.index).ref, 'A1:B4');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('createTable rejects a narrowing sheetIndex before table_create', () => {
+    const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY, Symbol('table sheet')];
+    for (const value of invalid) {
+      const wb = Module.Workbook.createDefault();
+      try {
+        assert.throws(
+          () =>
+            wb.createTable({
+              sheetIndex: value,
+              ref: 'A1:B3',
+              name: 'BadTable',
+              columns: ['Product', 'Amount'],
+            }),
+          nestedErrorClass(value),
+          `createTable sheetIndex=${String(value)} accepted`,
+        );
+        assert.equal(wb.tableCount().value, 0);
+      } finally {
+        wb.delete();
+      }
+    }
+  });
+
+  test('save() + Workbook.loadBytes() round-trip preserves a literal', () => {
+    const wb = Module.Workbook.createDefault();
+    let saved = null;
+    try {
+      assert.ok(wb.setNumber(0, 0, 0, 7).ok);
+      assert.ok(wb.setFormula(0, 1, 0, '=A1+1').ok);
+      assert.ok(wb.recalc().ok);
+
+      const r = wb.save();
+      assert.ok(r.status.ok, `save failed: ${JSON.stringify(r.status)}`);
+      assert.ok(r.bytes instanceof Uint8Array);
+      assert.ok(r.bytes.length > 0);
+      saved = r.bytes;
+    } finally {
+      wb.delete();
+    }
+
+    const loaded = Module.Workbook.loadBytes(saved);
+    try {
+      assert.ok(loaded.isValid(), `load failed: ${Module.lastErrorMessage()}`);
+      assert.ok(loaded.sheetCount().value >= 1);
+      assert.ok(loaded.recalc().ok);
+      const a1 = loaded.getValue(0, 0, 0);
+      assert.ok(a1.status.ok);
+      assert.equal(a1.value.kind, VAL.NUMBER);
+      assert.equal(a1.value.number, 7);
+    } finally {
+      loaded.delete();
+    }
+  });
+
+  test('data bar x14 fields survive save and load', () => {
+    // The six live in the `x14` extension, not the legacy `<dataBar>`
+    // element. An in-session round-trip would still pass with a writer that
+    // never emits the extension -- which is how they were lost before -- so
+    // this goes through a real save and load.
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(
+        wb.addConditionalFormat(0, {
+          sqref: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
+          type: 3,
+          dataBar: {
+            min: { type: 3 },
+            max: { type: 4 },
+            fill: { r: 0, g: 0, b: 255 },
+            gradient: false,
+            axisPosition: 1,
+            negativeFill: { r: 255, g: 0, b: 0 },
+            border: { r: 9, g: 9, b: 9 },
+            negativeBorder: { r: 8, g: 8, b: 8 },
+            axisColor: { r: 1, g: 2, b: 3 },
+          },
+        }).status.ok,
+      );
+      const saved = wb.save();
+      assert.ok(saved.status.ok, `save failed: ${JSON.stringify(saved.status)}`);
+      const loaded = Module.Workbook.loadBytes(saved.bytes);
+      try {
+        assert.ok(loaded.isValid(), `load failed: ${Module.lastErrorMessage()}`);
+        const bar = loaded.getConditionalFormats(0)[0].dataBar;
+        assert.equal(bar.gradient, false);
+        assert.equal(bar.axisPosition, 1);
+        assert.equal(bar.negativeFill.r, 255);
+        assert.equal(bar.border.r, 9);
+        assert.equal(bar.negativeBorder.r, 8);
+        assert.equal(bar.axisColor.b, 3);
+
+        // The decoded bar fed straight back reproduces the same rule.
+        assert.ok(
+          loaded.addConditionalFormat(0, {
+            sqref: [{ firstRow: 4, firstCol: 0, lastRow: 6, lastCol: 0 }],
+            type: 3,
+            dataBar: bar,
+          }).status.ok,
+        );
+        const reread = loaded.getConditionalFormats(0)[1].dataBar;
+        assert.equal(reread.gradient, false);
+        assert.equal(reread.axisPosition, 1);
+        assert.equal(reread.axisColor.b, 3);
+      } finally {
+        loaded.delete();
+      }
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('omitted data bar x14 fields keep the model defaults', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(
+        wb.addConditionalFormat(0, {
+          sqref: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 0 }],
+          type: 3,
+          dataBar: { min: { type: 3 }, max: { type: 4 }, fill: { r: 0, g: 0, b: 255 } },
+        }).status.ok,
+      );
+      // The getter engages all six, so they read back as the defaults
+      // rather than as absent keys.
+      const bar = wb.getConditionalFormats(0)[0].dataBar;
+      assert.equal(bar.gradient, true);
+      assert.equal(bar.axisPosition, 0);
+      assert.equal(bar.negativeFill.b, 255);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('saveWithDiagnostics() and readDiagnostics() expose stable counters', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setFormula(0, 0, 0, '=SUM(T[C])').ok);
+      assert.ok(
+        wb.addValidation(0, {
+          ranges: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+          type: 3,
+          formula1: '"Yes,No"',
+        }).ok,
+      );
+      // `dxfId` is a real index into `<dxfs>`, not a sentinel: every binding
+      // signals "no differential format" by omitting the field, which leaves
+      // the C ABI's `dxf_id_engaged` at 0. Supplying `0` therefore claims the
+      // first dxf, so the table has to have one.
+      const dxf = wb.addDxf({ font: { bold: true } });
+      assert.ok(dxf.status.ok, `addDxf failed: ${JSON.stringify(dxf.status)}`);
+      assert.ok(
+        wb.addConditionalFormat(0, {
+          sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+          type: 1,
+          op: 5,
+          formula1: '10',
+          dxfId: dxf.index,
+          stopIfTrue: false,
+        }).status.ok,
+      );
+      const xlsx = wb.saveWithDiagnostics(1);
+      assert.ok(xlsx.status.ok, `xlsx save failed: ${JSON.stringify(xlsx.status)}`);
+      assert.equal(xlsx.downgradedFormulaCount, 0);
+      assert.equal(xlsx.deferredFeatureCount, 0);
+      assert.equal(xlsx.droppedPartCount, 0);
+      assert.equal(xlsx.droppedRelationshipCount, 0);
+      assert.equal(xlsx.renumberedPartCount, 0);
+
+      const xlsb = wb.saveWithDiagnostics(2);
+      assert.ok(xlsb.status.ok, `xlsb save failed: ${JSON.stringify(xlsb.status)}`);
+      assert.equal(xlsb.downgradedFormulaCount, 1);
+      assert.equal(xlsb.deferredFeatureCount, 0);
+      // The binary writer never reassigns a part id.
+      assert.equal(xlsb.renumberedPartCount, 0);
+
+      const loaded = Module.Workbook.loadBytes(xlsb.bytes);
+      try {
+        const read = loaded.readDiagnostics();
+        assert.ok(read.status.ok, `read diagnostics failed: ${JSON.stringify(read.status)}`);
+        assert.equal(read.undecodedFormulaCount, 0);
+        assert.equal(read.undecodedDefinedNameCount, 0);
+        assert.equal(read.undecodedPartCount, 0);
+        assert.equal(read.skippedFeatureCount, 0);
+        assert.equal(read.unknownContentTypeCount, 0);
+      } finally {
+        loaded.delete();
+      }
+      const preservedLoaded = Module.Workbook.loadBytes(appendEmptyZipEntry(xlsb.bytes, 'xl/preserved.bin'));
+      try {
+        const preserved = preservedLoaded.readDiagnostics();
+        assert.ok(preserved.status.ok, `passthrough diagnostics failed: ${JSON.stringify(preserved.status)}`);
+        assert.equal(preserved.undecodedPartCount, 0);
+      } finally {
+        preservedLoaded.delete();
+      }
+      const invalidSave = wb.saveWithDiagnostics(0);
+      assert.ok(!invalidSave.status.ok, `unknown format unexpectedly succeeded: ${JSON.stringify(invalidSave)}`);
+      assert.equal(invalidSave.bytes, null);
+      assert.equal(invalidSave.downgradedFormulaCount, 0);
+      assert.equal(invalidSave.deferredFeatureCount, 0);
+      assert.equal(invalidSave.droppedPartCount, 0);
+      assert.equal(invalidSave.droppedRelationshipCount, 0);
+      assert.equal(invalidSave.renumberedPartCount, 0);
+      assert.ok(wb.saveAs(2).status.ok);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('Workbook.loadBytes reports empty input instead of leaving stale diagnostics', () => {
+    const wb = Module.Workbook.loadBytes(new Uint8Array());
+    try {
+      assert.equal(wb.isValid(), false);
+      assert.match(Module.lastErrorMessage(), /NULL or empty input/);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('Workbook.loadBytes rejects non-Uint8Array input like the native binding', () => {
+    const wb = Module.Workbook.loadBytes(new Uint16Array([1]));
+    try {
+      assert.equal(wb.isValid(), false);
+      assert.match(Module.lastErrorMessage(), /NULL or empty input/);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('invalid workbook read diagnostics return a zeroed failure envelope', () => {
+    const wb = Module.Workbook.loadBytes(new Uint8Array());
+    try {
+      const read = wb.readDiagnostics();
+      assert.ok(!read.status.ok, `invalid handle unexpectedly succeeded: ${JSON.stringify(read)}`);
+      assert.equal(read.undecodedFormulaCount, 0);
+      assert.equal(read.undecodedDefinedNameCount, 0);
+      assert.equal(read.undecodedPartCount, 0);
+      assert.equal(read.skippedFeatureCount, 0);
+      assert.equal(read.unknownContentTypeCount, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('formula error surfaces as ERROR-kind value', () => {
+    const r = Module.evalFormula('=1/0');
+    assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+    assert.equal(r.value.kind, VAL.ERROR);
+  });
+
+  test('parser failure populates lastErrorMessage', () => {
+    // An obviously unparseable formula. The C ABI either surfaces a
+    // non-zero status (parser error) or returns ok with an Error
+    // value — accept either, but the diagnostic should be readable
+    // when the status is non-ok.
+    const r = Module.evalFormula('=#GARBAGE');
+    if (!r.status.ok) {
+      assert.equal(typeof r.status.message, 'string');
+      const msg = Module.lastErrorMessage();
+      assert.equal(typeof msg, 'string');
+    } else {
+      // Acceptable alternative: the formula parses to something that
+      // evaluates to an error value.
+      assert.equal(r.value.kind, VAL.ERROR);
+    }
+  });
+}
diff --git a/tests/wasm/run_drawing.mjs b/tests/wasm/run_drawing.mjs
new file mode 100644
index 000000000..cd087c06f
--- /dev/null
+++ b/tests/wasm/run_drawing.mjs
@@ -0,0 +1,158 @@
+import assert from 'node:assert/strict';
+import { deflateSync } from 'node:zlib';
+import { AnchorEditAs, AnchorKind, DrawingObjectKind, ImageFormat } from '../../packages/npm/common.mjs';
+
+const EMU_PER_PX = 9525;
+
+function crc32(buf) {
+  let c = ~0;
+  for (const b of buf) {
+    c ^= b;
+    for (let k = 0; k < 8; k += 1) c = (c >>> 1) ^ (0xedb88320 & -(c & 1));
+  }
+  return ~c >>> 0;
+}
+
+function chunk(type, data) {
+  const out = Buffer.alloc(12 + data.length);
+  out.writeUInt32BE(data.length, 0);
+  out.write(type, 4, 'latin1');
+  data.copy(out, 8);
+  out.writeUInt32BE(crc32(out.subarray(4, 8 + data.length)), 8 + data.length);
+  return out;
+}
+
+// A solid-colour 8-bit RGB PNG of the given pixel size.
+function makePng(width, height) {
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(width, 0);
+  ihdr.writeUInt32BE(height, 4);
+  ihdr[8] = 8;
+  ihdr[9] = 2;
+  const raw = Buffer.alloc((1 + width * 3) * height, 0x7f);
+  for (let y = 0; y < height; y += 1) raw[y * (1 + width * 3)] = 0;
+  return new Uint8Array(
+    Buffer.concat([
+      Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+      chunk('IHDR', ihdr),
+      chunk('IDAT', deflateSync(raw)),
+      chunk('IEND', Buffer.alloc(0)),
+    ]),
+  );
+}
+
+function withWorkbook(Module, fn) {
+  const wb = Module.Workbook.createDefault();
+  try {
+    fn(wb);
+  } finally {
+    wb.delete();
+  }
+}
+
+export function registerDrawing(Module, test) {
+  test('drawing enums keep their C ordinals', () => {
+    assert.equal(ImageFormat.Bmp, 4);
+    assert.equal(DrawingObjectKind.GraphicFrame, 5);
+    assert.equal(DrawingObjectKind.Other, 6);
+    assert.equal(AnchorKind.Absolute, 2);
+    assert.equal(AnchorEditAs.OneCell, 1);
+  });
+
+  test('probeImage reports the format and pixel size, and rejects non-images', () => {
+    withWorkbook(Module, (wb) => {
+      const info = wb.probeImage(makePng(3, 2));
+      assert.ok(info.status.ok, JSON.stringify(info.status));
+      assert.equal(info.format, ImageFormat.Png);
+      assert.equal(info.pxWidth, 3);
+      assert.equal(info.pxHeight, 2);
+      const bad = wb.probeImage(new Uint8Array([1, 2, 3, 4]));
+      assert.equal(bad.status.ok, false);
+      assert.equal(bad.pxWidth, 0);
+    });
+  });
+
+  test('insertImage, listDrawingObjects, getImage and removeImage round-trip through save and load', () => {
+    withWorkbook(Module, (wb) => {
+      const png = makePng(4, 3);
+      assert.equal(wb.listDrawingObjects(0).length, 0);
+      assert.ok(wb.listDrawingObjects(0).status.ok);
+
+      const ins = wb.insertImage(0, png, { name: 'Logo', descr: 'alt text', row: 2, col: 1, colOffEmu: 100 });
+      assert.ok(ins.status.ok, JSON.stringify(ins.status));
+      assert.ok(ins.objectId > 0);
+
+      const check = (book) => {
+        const list = book.listDrawingObjects(0);
+        assert.ok(list.status.ok, JSON.stringify(list.status));
+        assert.equal(list.length, 1);
+        const o = list[0];
+        assert.equal(o.objectId, ins.objectId);
+        assert.equal(o.kind, DrawingObjectKind.Picture);
+        assert.equal(o.anchorKind, AnchorKind.OneCell);
+        assert.equal(o.fromRow, 2);
+        assert.equal(o.fromCol, 1);
+        assert.equal(o.fromColOff, 100);
+        assert.equal(o.cx, 4 * EMU_PER_PX);
+        assert.equal(o.cy, 3 * EMU_PER_PX);
+        assert.equal(o.imageFormat, ImageFormat.Png);
+        assert.equal(o.name, 'Logo');
+        assert.equal(o.descr, 'alt text');
+        assert.ok(o.mediaPath.length > 0);
+        const img = book.getImage(0, o.objectId);
+        assert.ok(img.status.ok, JSON.stringify(img.status));
+        assert.equal(img.format, ImageFormat.Png);
+        assert.equal(img.pxWidth, 4);
+        assert.equal(img.pxHeight, 3);
+        assert.ok(img.bytes instanceof Uint8Array);
+        assert.deepEqual(Buffer.from(img.bytes), Buffer.from(png));
+      };
+      check(wb);
+
+      const saved = wb.save();
+      assert.ok(saved.status.ok, JSON.stringify(saved.status));
+      const loaded = Module.Workbook.loadBytes(saved.bytes);
+      try {
+        check(loaded);
+        const rm = loaded.removeImage(0, ins.objectId);
+        assert.ok(rm.ok, JSON.stringify(rm));
+        assert.equal(loaded.listDrawingObjects(0).length, 0);
+        assert.equal(loaded.getImage(0, ins.objectId).status.ok, false);
+        assert.equal(loaded.removeImage(0, ins.objectId).ok, false);
+      } finally {
+        loaded.delete();
+      }
+    });
+  });
+
+  test('insertImage honours a two-cell anchor, an explicit size and the editAs mode', () => {
+    withWorkbook(Module, (wb) => {
+      const ins = wb.insertImage(0, makePng(2, 2), {
+        anchorKind: AnchorKind.TwoCell,
+        editAs: AnchorEditAs.OneCell,
+        widthEmu: 2 * EMU_PER_PX * 10,
+        heightEmu: EMU_PER_PX * 20,
+      });
+      assert.ok(ins.status.ok, JSON.stringify(ins.status));
+      const o = wb.listDrawingObjects(0)[0];
+      assert.equal(o.anchorKind, AnchorKind.TwoCell);
+      assert.equal(o.editAs, AnchorEditAs.OneCell);
+      assert.equal(o.cx, 2 * EMU_PER_PX * 10);
+      assert.equal(o.cy, EMU_PER_PX * 20);
+      assert.equal(o.name, `Picture ${ins.objectId}`);
+    });
+  });
+
+  test('image calls report failures on the envelope without throwing', () => {
+    withWorkbook(Module, (wb) => {
+      assert.equal(wb.insertImage(0, new Uint8Array([1, 2, 3, 4])).status.ok, false);
+      assert.equal(wb.insertImage(0, new Uint8Array([1, 2, 3, 4])).objectId, 0);
+      assert.equal(wb.insertImage(99, makePng(1, 1)).status.ok, false);
+      assert.equal(wb.insertImage(0, makePng(1, 1), { anchorKind: AnchorKind.Absolute }).status.ok, false);
+      assert.equal(wb.listDrawingObjects(99).status.ok, false);
+      const img = wb.getImage(0, 12345);
+      assert.equal(img.status.ok, false);
+      assert.equal(img.bytes.length, 0);
+    });
+  });
+}
diff --git a/tests/wasm/run_filter_validation_comments.mjs b/tests/wasm/run_filter_validation_comments.mjs
new file mode 100644
index 000000000..2506253b4
--- /dev/null
+++ b/tests/wasm/run_filter_validation_comments.mjs
@@ -0,0 +1,523 @@
+import assert from 'node:assert/strict';
+import {
+  DateTimeGrouping,
+  DynamicFilterType,
+  FilterKind,
+  FilterOperator,
+  SortBy,
+  SortMethod,
+  ValidationErrorStyle,
+} from '../../packages/npm/common.mjs';
+
+const ALICE = '{0A1B2C3D-0000-4000-8000-000000000001}';
+const BOB = '{0A1B2C3D-0000-4000-8000-000000000002}';
+const THREAD = '{6F1E0D2C-1111-4111-8111-000000000001}';
+const REPLY = '{6F1E0D2C-1111-4111-8111-000000000002}';
+const MENTION = '{6F1E0D2C-1111-4111-8111-0000000000AA}';
+const CREATED = '2026-10-05T09:30:00.00';
+
+function withWorkbook(Module, fn) {
+  const wb = Module.Workbook.createDefault();
+  try {
+    fn(wb);
+  } finally {
+    wb.delete();
+  }
+}
+
+// A1 is the header; A2:A6 hold 1..5.
+function fillNumbers(wb) {
+  assert.ok(wb.setText(0, 0, 0, 'N').ok);
+  for (let i = 1; i <= 5; i += 1) assert.ok(wb.setNumber(0, i, 0, i).ok);
+}
+
+const range = (firstRow, firstCol, lastRow, lastCol) => ({ firstRow, firstCol, lastRow, lastCol });
+const hiddenRows = (wb) =>
+  wb
+    .getSheetRowOverrides(0)
+    .rows.filter((r) => r.hidden)
+    .map((r) => r.row);
+
+const customGreaterThanThree = {
+  colId: 0,
+  kind: FilterKind.Custom,
+  customCount: 1,
+  op1: FilterOperator.GreaterThan,
+  val1: '3',
+};
+
+export function registerFilterValidationComments(Module, test) {
+  test('filter, sort and validation enums keep their C ordinals', () => {
+    assert.equal(FilterKind.Icon, 6);
+    assert.equal(FilterOperator.GreaterThan, 5);
+    assert.equal(DynamicFilterType.YearToDate, 18);
+    assert.equal(DynamicFilterType.M12, 34);
+    assert.equal(SortBy.Icon, 3);
+    assert.equal(SortMethod.Stroke, 2);
+    assert.equal(DateTimeGrouping.Second, 5);
+    assert.equal(ValidationErrorStyle.Information, 2);
+  });
+
+  test('getAutoFilter / setAutoFilter round-trip every criterion field', () => {
+    withWorkbook(Module, (wb) => {
+      fillNumbers(wb);
+      const absent = wb.getAutoFilter(0);
+      assert.ok(absent.status.ok);
+      assert.equal(absent.autoFilter, null);
+
+      const filter = {
+        range: range(0, 0, 5, 2),
+        columns: [
+          {
+            colId: 0,
+            kind: FilterKind.Values,
+            filterBlank: true,
+            values: ['a', 'b'],
+            dateGroups: [
+              { year: 2026, month: 10, day: 5, hour: 0, minute: 0, second: 0, grouping: DateTimeGrouping.Day },
+            ],
+          },
+          {
+            colId: 1,
+            kind: FilterKind.Top10,
+            top: true,
+            percent: true,
+            topVal: 10,
+            hasFilterVal: true,
+            filterVal: 4.5,
+          },
+          {
+            colId: 2,
+            kind: FilterKind.Custom,
+            customAnd: true,
+            customCount: 2,
+            op1: FilterOperator.GreaterThan,
+            val1: '1',
+            op2: FilterOperator.LessThan,
+            val2: '9',
+          },
+        ],
+        sort: {
+          ref: range(1, 0, 5, 2),
+          columnSort: false,
+          caseSensitive: true,
+          sortMethod: SortMethod.None,
+          conditions: [{ ref: range(1, 0, 5, 0), descending: true, sortBy: SortBy.Value, customList: '' }],
+        },
+      };
+      assert.ok(wb.setAutoFilter(0, filter).ok);
+      const got = wb.getAutoFilter(0);
+      assert.ok(got.status.ok, JSON.stringify(got.status));
+      const af = got.autoFilter;
+      assert.deepEqual(af.range, filter.range);
+      assert.equal(af.columns.length, 3);
+      assert.deepEqual(af.columns[0].values, ['a', 'b']);
+      assert.equal(af.columns[0].filterBlank, true);
+      assert.deepEqual(af.columns[0].dateGroups, filter.columns[0].dateGroups);
+      assert.equal(af.columns[1].top, true);
+      assert.equal(af.columns[1].percent, true);
+      assert.equal(af.columns[1].topVal, 10);
+      assert.equal(af.columns[1].filterVal, 4.5);
+      assert.equal(af.columns[2].customAnd, true);
+      assert.equal(af.columns[2].val2, '9');
+      assert.equal(af.sort.caseSensitive, true);
+      assert.equal(af.sort.conditions.length, 1);
+      assert.equal(af.sort.conditions[0].descending, true);
+
+      // get -> set of the unchanged record is a no-op.
+      assert.ok(wb.setAutoFilter(0, af).ok);
+      assert.deepEqual(wb.getAutoFilter(0).autoFilter, af);
+
+      assert.ok(wb.removeAutoFilter(0).ok);
+      assert.equal(wb.getAutoFilter(0).autoFilter, null);
+    });
+  });
+
+  test('evaluate, apply and clear a sheet AutoFilter', () => {
+    withWorkbook(Module, (wb) => {
+      fillNumbers(wb);
+      assert.equal(wb.evaluateAutoFilter(0).status.ok, false);
+      assert.equal(wb.applyAutoFilter(0).ok, false);
+      assert.ok(wb.setAutoFilter(0, { range: range(0, 0, 5, 0), columns: [customGreaterThanThree], sort: null }).ok);
+
+      const ev = wb.evaluateAutoFilter(0);
+      assert.ok(ev.status.ok, JSON.stringify(ev.status));
+      assert.equal(ev.firstRow, 1);
+      assert.deepEqual(ev.match, [false, false, false, true, true]);
+      assert.deepEqual(hiddenRows(wb), []);
+
+      assert.ok(wb.applyAutoFilter(0).ok);
+      assert.deepEqual(hiddenRows(wb), [1, 2, 3]);
+      assert.ok(wb.clearAutoFilter(0).ok);
+      assert.deepEqual(hiddenRows(wb), []);
+      assert.equal(wb.getAutoFilter(0).autoFilter.columns.length, 0);
+    });
+  });
+
+  test('table AutoFilter methods mirror the sheet ones', () => {
+    withWorkbook(Module, (wb) => {
+      fillNumbers(wb);
+      const created = wb.createTable({ sheetIndex: 0, ref: 'A1:A6', name: 'Nums', columns: ['N'] });
+      assert.ok(created.status.ok, JSON.stringify(created.status));
+      const table = created.index;
+      const got = wb.getTableAutoFilter(table);
+      assert.ok(got.status.ok);
+      assert.equal(got.autoFilter.range.lastRow, 5);
+
+      assert.ok(
+        wb.setTableAutoFilter(table, { range: range(0, 0, 5, 0), columns: [customGreaterThanThree], sort: null }).ok,
+      );
+      const ev = wb.evaluateTableAutoFilter(table);
+      assert.deepEqual(ev.match, [false, false, false, true, true]);
+      assert.ok(wb.applyTableAutoFilter(table).ok);
+      assert.deepEqual(hiddenRows(wb), [1, 2, 3]);
+      assert.ok(wb.clearTableAutoFilter(table).ok);
+      assert.deepEqual(hiddenRows(wb), []);
+      assert.ok(wb.removeTableAutoFilter(table).ok);
+      assert.equal(wb.getTableAutoFilter(table).autoFilter, null);
+      assert.equal(wb.getTableAutoFilter(99).status.ok, false);
+    });
+  });
+
+  test('setAutoFilter rejects an out-of-range sheet and unordered columns', () => {
+    withWorkbook(Module, (wb) => {
+      const f = { range: range(0, 0, 5, 1), columns: [], sort: null };
+      assert.equal(wb.setAutoFilter(99, f).ok, false);
+      const bad = {
+        ...f,
+        columns: [
+          { colId: 1, kind: FilterKind.None },
+          { colId: 0, kind: FilterKind.None },
+        ],
+      };
+      assert.equal(wb.setAutoFilter(0, bad).ok, false);
+    });
+  });
+
+  test('UI numeric readers throw on lossy validation fields before mutation', () => {
+    withWorkbook(Module, (wb) => {
+      const base = {
+        ranges: [range(0, 0, 2, 0)],
+        type: 1,
+        op: 0,
+        formula1: '1',
+        formula2: '10',
+      };
+      assert.ok(wb.addValidation(0, base).ok);
+      const before = wb.getValidations(0);
+      assert.equal(before.length, 1);
+
+      for (const value of [256, Number.NaN, Number.POSITIVE_INFINITY, 1.5, -1, Symbol('type')]) {
+        assert.throws(
+          () => wb.addValidation(0, { ...base, type: value }),
+          typeof value === 'symbol' ? TypeError : RangeError,
+          `type=${String(value)}`,
+        );
+        assert.equal(wb.getValidations(0).length, before.length);
+      }
+
+      assert.throws(
+        () =>
+          wb.addValidation(0, {
+            ...base,
+            ranges: [{ ...base.ranges[0], firstRow: 2 ** 32 }],
+          }),
+        RangeError,
+      );
+      assert.deepEqual(wb.getValidations(0), before);
+
+      // Nullish enum fields keep their documented zero defaults.
+      assert.ok(wb.addValidation(0, { ranges: [range(3, 0, 3, 0)] }).ok);
+      assert.equal(wb.getValidations(0)[1].type, 0);
+    });
+  });
+
+  test('AutoFilter date-group integers throw on wraparound before replacing a filter', () => {
+    withWorkbook(Module, (wb) => {
+      const good = {
+        range: range(0, 0, 2, 0),
+        columns: [
+          {
+            colId: 0,
+            kind: FilterKind.Values,
+            values: ['1'],
+            dateGroups: [{ year: 2026, month: 1, day: 0, hour: 0, minute: 0, second: 0, grouping: 1 }],
+          },
+        ],
+        sort: null,
+      };
+      assert.ok(wb.setAutoFilter(0, good).ok);
+      const before = wb.getAutoFilter(0).autoFilter;
+      const bad = {
+        ...good,
+        columns: [
+          {
+            ...good.columns[0],
+            dateGroups: [{ ...good.columns[0].dateGroups[0], month: 257 }],
+          },
+        ],
+      };
+      assert.throws(() => wb.setAutoFilter(0, bad), RangeError);
+      assert.deepEqual(wb.getAutoFilter(0).autoFilter, before);
+
+      assert.throws(
+        () =>
+          wb.setAutoFilter(0, {
+            ...good,
+            columns: [{ ...good.columns[0], colId: Number.NaN }],
+          }),
+        RangeError,
+      );
+      assert.deepEqual(wb.getAutoFilter(0).autoFilter, before);
+
+      assert.throws(
+        () =>
+          wb.setAutoFilter(0, {
+            ...good,
+            columns: [{ ...good.columns[0], kind: 'bad' }],
+          }),
+        TypeError,
+      );
+      assert.deepEqual(wb.getAutoFilter(0).autoFilter, before);
+
+      const defaults = wb.setAutoFilter(0, {
+        range: range(0, 0, 2, 1),
+        columns: [
+          { colId: null, kind: undefined },
+          { colId: 1, kind: 1, dateGroups: [{ month: null }] },
+        ],
+        sort: null,
+      });
+      assert.ok(defaults.ok, JSON.stringify(defaults));
+      const stored = wb.getAutoFilter(0).autoFilter;
+      assert.equal(stored.columns[0].colId, 0);
+      assert.equal(stored.columns[0].kind, 0);
+      assert.equal(stored.columns[1].dateGroups[0].month, 0);
+    });
+  });
+
+  test('threaded mention and image integer readers throw before C mutation', () => {
+    withWorkbook(Module, (wb) => {
+      assert.ok(wb.addPerson({ id: ALICE, displayName: 'Alice' }).ok);
+      const beforeComments = wb.getThreadedComments(0).comments.length;
+      assert.throws(
+        () =>
+          wb.addThreadedComment(0, {
+            id: THREAD,
+            row: 0,
+            col: 0,
+            personId: ALICE,
+            created: CREATED,
+            text: '@Alice',
+            mentions: [{ personId: ALICE, mentionId: MENTION, start: 2 ** 32, length: 1 }],
+          }),
+        RangeError,
+      );
+      assert.equal(wb.getThreadedComments(0).comments.length, beforeComments);
+
+      for (const value of [Number.NaN, 1.5, Symbol('rowOffEmu')]) {
+        assert.throws(
+          () => wb.insertImage(0, new Uint8Array([1, 2, 3]), { rowOffEmu: value }),
+          typeof value === 'symbol' ? TypeError : RangeError,
+          `rowOffEmu=${String(value)}`,
+        );
+        assert.equal(wb.listDrawingObjects(0).length, 0);
+      }
+
+      const boundary = wb.insertImage(0, new Uint8Array([1, 2, 3]), {
+        rowOffEmu: -(2 ** 63),
+        colOffEmu: 2 ** 63 - 1024,
+      });
+      assert.equal(boundary.status.ok, false);
+      assert.equal(wb.listDrawingObjects(0).length, 0);
+
+      assert.throws(() => wb.insertImage(0, new Uint8Array([1, 2, 3]), { widthEmu: 2 ** 63 }), RangeError);
+      assert.equal(wb.listDrawingObjects(0).length, 0);
+    });
+  });
+
+  test('nested readers rethrow getter failures and reject hostile string conversions', () => {
+    withWorkbook(Module, (wb) => {
+      const beforeValidationCount = wb.getValidations(0).length;
+      const largeText = 'x'.repeat(1024 * 1024);
+      for (let i = 0; i < 20; i += 1) {
+        const input = { formula1: largeText };
+        Object.defineProperty(input, 'formula2', {
+          configurable: true,
+          enumerable: true,
+          get() {
+            throw new Error('formula2 getter should stay inside the JS reader boundary');
+          },
+        });
+        assert.throws(
+          () => wb.addValidation(0, input),
+          /formula2 getter should stay inside the JS reader boundary/,
+          `throwing getter unexpectedly succeeded at iteration ${i}`,
+        );
+        assert.equal(wb.getValidations(0).length, beforeValidationCount);
+      }
+
+      const proxyFilter = {
+        range: { firstRow: 0, lastRow: 0, firstCol: 0, lastCol: 0 },
+        columns: new Proxy([], {
+          get() {
+            throw new Error('columns getter should stay inside the JS reader boundary');
+          },
+        }),
+      };
+      assert.throws(() => wb.setAutoFilter(0, proxyFilter), /columns getter should stay inside the JS reader boundary/);
+
+      const badString = {
+        formula1: {
+          toString() {
+            throw new Error('toString must not run');
+          },
+        },
+      };
+      assert.throws(() => wb.addValidation(0, badString), TypeError);
+      assert.equal(wb.getValidations(0).length, beforeValidationCount);
+
+      const bytesProxy = new Proxy(new Uint8Array([1, 2, 3]), {
+        get() {
+          throw new Error('bytes getter should stay inside the JS reader boundary');
+        },
+      });
+      const imageResult = wb.insertImage(0, bytesProxy, {});
+      assert.equal(imageResult.status.ok, false);
+      assert.equal(imageResult.status.status, 2);
+      assert.equal(wb.listDrawingObjects(0).length, 0);
+    });
+  });
+
+  test('validateValue reports the covering rule and listInvalidCells pages the failures', () => {
+    withWorkbook(Module, (wb) => {
+      const rule = {
+        ranges: [range(0, 0, 9, 0)],
+        type: 1,
+        op: 0,
+        formula1: '1',
+        formula2: '10',
+        errorStyle: ValidationErrorStyle.Warning,
+      };
+      assert.ok(wb.addValidation(0, rule).ok);
+
+      const none = wb.validateValue(0, 0, 3, { kind: 1, number: 99 });
+      assert.ok(none.status.ok);
+      assert.equal(none.hasRule, false);
+      assert.equal(none.valid, true);
+
+      const good = wb.validateValue(0, 0, 0, { kind: 1, number: 5 });
+      assert.equal(good.hasRule, true);
+      assert.equal(good.valid, true);
+      assert.equal(good.ruleIndex, 0);
+
+      const bad = wb.validateValue(0, 0, 0, { kind: 1, number: 50 });
+      assert.equal(bad.valid, false);
+      assert.equal(bad.errorStyle, ValidationErrorStyle.Warning);
+      assert.equal(wb.validateValue(0, 0, 0, { kind: 3, text: 'x' }).valid, false);
+      assert.equal(wb.validateValue(99, 0, 0, { kind: 1, number: 1 }).status.ok, false);
+
+      assert.ok(wb.setNumber(0, 0, 0, 5).ok);
+      assert.ok(wb.setNumber(0, 1, 0, 50).ok);
+      assert.ok(wb.setText(0, 2, 0, 'x').ok);
+      assert.ok(wb.setNumber(0, 3, 0, 7).ok);
+      assert.ok(wb.setNumber(0, 4, 0, 70).ok);
+
+      const all = wb.listInvalidCells(0);
+      assert.ok(all.status.ok, JSON.stringify(all.status));
+      assert.deepEqual(
+        all.cells.map((c) => [c.row, c.col]),
+        [
+          [1, 0],
+          [2, 0],
+          [4, 0],
+        ],
+      );
+      assert.equal(all.nextCursor, null);
+
+      const first = wb.listInvalidCells(0, 0, 2);
+      assert.equal(first.cells.length, 2);
+      assert.notEqual(first.nextCursor, null);
+      const rest = wb.listInvalidCells(0, first.nextCursor, 2);
+      assert.deepEqual(
+        rest.cells.map((c) => c.row),
+        [4],
+      );
+      assert.equal(rest.nextCursor, null);
+
+      assert.equal(wb.listInvalidCells(99).status.ok, false);
+      assert.throws(() => wb.listInvalidCells(0, -1), RangeError);
+    });
+  });
+
+  test('persons and threaded comments support the full CRUD cycle', () => {
+    withWorkbook(Module, (wb) => {
+      assert.deepEqual(wb.getPersons().persons, []);
+      assert.ok(wb.addPerson({ id: ALICE, displayName: 'Alice', userId: 'alice', providerId: 'None' }).ok);
+      assert.ok(wb.addPerson({ id: BOB, displayName: 'Bob', userId: 'bob', providerId: 'None' }).ok);
+      assert.equal(wb.addPerson({ id: ALICE, displayName: 'Dup' }).ok, false);
+      const persons = wb.getPersons();
+      assert.ok(persons.status.ok);
+      assert.deepEqual(
+        persons.persons.map((p) => p.displayName),
+        ['Alice', 'Bob'],
+      );
+      assert.equal(persons.persons[0].userId, 'alice');
+
+      assert.deepEqual(wb.getThreadedComments(0).comments, []);
+      const opened = wb.addThreadedComment(0, {
+        id: THREAD,
+        row: 2,
+        col: 1,
+        personId: ALICE,
+        created: CREATED,
+        text: 'Check this, @Bob',
+        mentions: [{ personId: BOB, mentionId: MENTION, start: 12, length: 4 }],
+      });
+      assert.ok(opened.ok, JSON.stringify(opened));
+      assert.ok(
+        wb.addThreadedComment(0, {
+          id: REPLY,
+          personId: BOB,
+          created: CREATED,
+          text: 'Done',
+          parentId: THREAD,
+        }).ok,
+      );
+
+      const list = wb.getThreadedComments(0);
+      assert.ok(list.status.ok);
+      assert.equal(list.comments.length, 2);
+      const [head, reply] = list.comments;
+      assert.equal(head.id, THREAD);
+      assert.equal(head.row, 2);
+      assert.equal(head.col, 1);
+      assert.equal(head.done, false);
+      assert.equal(head.parentId, '');
+      assert.deepEqual(head.mentions, [{ personId: BOB, mentionId: MENTION, start: 12, length: 4 }]);
+      assert.equal(reply.parentId, THREAD);
+      assert.deepEqual(reply.mentions, []);
+
+      assert.equal(wb.removePerson(BOB).ok, false);
+      assert.ok(wb.editThreadedComment(0, THREAD, 'Edited', []).ok);
+      assert.equal(wb.getThreadedComments(0).comments[0].text, 'Edited');
+      assert.deepEqual(wb.getThreadedComments(0).comments[0].mentions, []);
+      assert.equal(wb.editThreadedComment(0, '{00000000-0000-4000-8000-000000000000}', 'x', []).ok, false);
+
+      assert.ok(wb.setThreadResolved(0, THREAD, true).ok);
+      assert.equal(wb.getThreadedComments(0).comments[0].done, true);
+      assert.ok(wb.setThreadResolved(0, THREAD, false).ok);
+      assert.equal(wb.getThreadedComments(0).comments[0].done, false);
+
+      assert.ok(wb.removeThreadedComment(0, REPLY).ok);
+      assert.equal(wb.getThreadedComments(0).comments.length, 1);
+      assert.ok(wb.removeThreadedComment(0, THREAD).ok);
+      assert.equal(wb.getThreadedComments(0).comments.length, 0);
+      assert.equal(wb.removeThreadedComment(0, THREAD).ok, false);
+
+      assert.ok(wb.removePerson(BOB).ok);
+      assert.equal(wb.getPersons().persons.length, 1);
+      assert.equal(wb.getThreadedComments(99).status.ok, false);
+    });
+  });
+}
diff --git a/tests/wasm/run_layout_validation.mjs b/tests/wasm/run_layout_validation.mjs
new file mode 100644
index 000000000..612113f6d
--- /dev/null
+++ b/tests/wasm/run_layout_validation.mjs
@@ -0,0 +1,85 @@
+import assert from 'node:assert/strict';
+
+const RANGE = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
+
+function withWorkbook(Module, fn) {
+  const wb = Module.Workbook.createDefault();
+  try {
+    fn(wb);
+  } finally {
+    wb.delete();
+  }
+}
+
+function protection(wb) {
+  const result = wb.getSheetProtection(0);
+  assert.ok(result.status.ok, JSON.stringify(result.status));
+  return result.protection;
+}
+
+export function registerLayoutValidation(Module, test) {
+  test('layout nested integer fields throw before native mutation', () => {
+    withWorkbook(Module, (wb) => {
+      const before = protection(wb);
+      assert.throws(() => wb.setSheetProtection(0, { ...before, enabled: 1.5 }), RangeError);
+      assert.deepEqual(protection(wb), before);
+
+      assert.throws(() => wb.setSheetProtection(0, { ...before, spinCount: 2 ** 32 }), RangeError);
+      assert.deepEqual(protection(wb), before);
+    });
+  });
+
+  test('layout nested getters are read once and leave state unchanged on failure', () => {
+    withWorkbook(Module, (wb) => {
+      const beforeProtection = protection(wb);
+      const protectionInput = { ...beforeProtection, enabled: 1 };
+      Object.defineProperty(protectionInput, 'formatRows', {
+        enumerable: true,
+        get() {
+          throw new Error('wasm protection getter');
+        },
+      });
+      assert.throws(() => wb.setSheetProtection(0, protectionInput), /wasm protection getter/);
+      assert.deepEqual(protection(wb), beforeProtection);
+
+      const beforeFormat = wb.getSheetFormatDefaults(0);
+      const formatInput = { defaultColWidth: 12.5 };
+      Object.defineProperty(formatInput, 'defaultRowHeight', {
+        enumerable: true,
+        get() {
+          throw new Error('wasm format getter');
+        },
+      });
+      assert.throws(() => wb.setSheetFormatDefaults(0, formatInput), /wasm format getter/);
+      assert.deepEqual(wb.getSheetFormatDefaults(0), beforeFormat);
+    });
+  });
+
+  test('geometry and partial recalc throw on invalid nested coordinates before C calls', () => {
+    withWorkbook(Module, (wb) => {
+      assert.throws(() => wb.getCellRectPt(0, { ...RANGE, firstRow: 1.5 }, 0), RangeError);
+
+      const throwingRange = {};
+      Object.defineProperty(throwingRange, 'firstRow', {
+        enumerable: true,
+        get() {
+          throw new Error('wasm geometry getter');
+        },
+      });
+      assert.throws(() => wb.getCellRectPt(0, throwingRange, 0), /wasm geometry getter/);
+
+      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+      assert.ok(wb.setFormula(0, 0, 1, '=A1+1').ok);
+      assert.throws(() => wb.partialRecalc({ ...RANGE, sheet: 0, firstRow: 1.5 }), RangeError);
+
+      const throwingViewport = { sheet: 0, firstRow: 0, lastRow: 0, firstCol: 0 };
+      Object.defineProperty(throwingViewport, 'lastCol', {
+        enumerable: true,
+        get() {
+          throw new Error('wasm viewport getter');
+        },
+      });
+      assert.throws(() => wb.partialRecalc(throwingViewport), /wasm viewport getter/);
+    });
+  });
+}
diff --git a/tests/wasm/run_metadata_layout.mjs b/tests/wasm/run_metadata_layout.mjs
new file mode 100644
index 000000000..1d3c0b873
--- /dev/null
+++ b/tests/wasm/run_metadata_layout.mjs
@@ -0,0 +1,539 @@
+import assert from 'node:assert/strict';
+
+export function registerMetadataLayout(Module, test) {
+  test('addMerge / getMerges round-trip', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.addMerge(0, { firstRow: 0, lastRow: 1, firstCol: 0, lastCol: 2 }).ok);
+      const merges = wb.getMerges(0);
+      assert.equal(merges.length, 1);
+      assert.equal(merges[0].firstRow, 0);
+      assert.equal(merges[0].lastCol, 2);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('removeMerge / removeMergeAt / clearMerges step-wise prune the merge list', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const a = { firstRow: 0, firstCol: 0, lastRow: 1, lastCol: 1 };
+      const b = { firstRow: 4, firstCol: 4, lastRow: 5, lastCol: 5 };
+      assert.ok(wb.addMerge(0, a).ok);
+      assert.ok(wb.addMerge(0, b).ok);
+      // removeMerge with an overlap that hits `a` only.
+      assert.ok(wb.removeMerge(0, { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }).ok);
+      const list = wb.getMerges(0);
+      assert.equal(list.length, 1);
+      assert.equal(list[0].firstRow, 4);
+      // removeMergeAt drops the survivor by index.
+      assert.ok(wb.removeMergeAt(0, 0).ok);
+      assert.equal(wb.getMerges(0).length, 0);
+      // clearMerges nukes the remainder; safe on an empty list.
+      assert.ok(wb.addMerge(0, a).ok);
+      assert.ok(wb.addMerge(0, b).ok);
+      assert.ok(wb.clearMerges(0).ok);
+      assert.equal(wb.getMerges(0).length, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('hyperlinks are read after save+load', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.equal(wb.getHyperlinks(0).length, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('addHyperlink + getHyperlinks round-trip', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.equal(wb.getHyperlinks(0).length, 0);
+      // Three entries with progressively more optional fields populated.
+      assert.ok(wb.addHyperlink(0, 1, 2, 'https://example.com/', '', '', '').ok);
+      assert.ok(wb.addHyperlink(0, 3, 4, 'mailto:hello@example.com', 'Hello', '', '').ok);
+      assert.ok(wb.addHyperlink(0, 5, 6, '', 'See X', 'Internal link', 'Sheet1!A1').ok);
+      assert.ok(wb.addHyperlinkRange(0, 7, 8, 9, 10, 'https://example.com/range', 'Range', 'Range tip', '').ok);
+      const list = wb.getHyperlinks(0);
+      assert.equal(list.length, 4);
+      assert.equal(list[0].row, 1);
+      assert.equal(list[0].col, 2);
+      assert.equal(list[0].lastRow, 1);
+      assert.equal(list[0].lastCol, 2);
+      assert.equal(list[0].target, 'https://example.com/');
+      assert.equal(list[0].display, '');
+      assert.equal(list[0].tooltip, '');
+      assert.equal(list[1].target, 'mailto:hello@example.com');
+      assert.equal(list[1].display, 'Hello');
+      assert.equal(list[2].display, 'See X');
+      assert.equal(list[2].tooltip, 'Internal link');
+      assert.equal(list[2].location, 'Sheet1!A1');
+      assert.deepEqual(
+        {
+          row: list[3].row,
+          col: list[3].col,
+          lastRow: list[3].lastRow,
+          lastCol: list[3].lastCol,
+          target: list[3].target,
+          display: list[3].display,
+          tooltip: list[3].tooltip,
+        },
+        {
+          row: 7,
+          col: 8,
+          lastRow: 9,
+          lastCol: 10,
+          target: 'https://example.com/range',
+          display: 'Range',
+          tooltip: 'Range tip',
+        },
+      );
+      // Sheet-out-of-range is rejected.
+      assert.ok(!wb.addHyperlink(999, 0, 0, 'https://x/', '', '', '').ok);
+      // clearHyperlinks drops everything.
+      assert.ok(wb.clearHyperlinks(0).ok);
+      assert.equal(wb.getHyperlinks(0).length, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('removeHyperlink / removeHyperlinkAt / clearHyperlinks surface on an empty sheet', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      // No-op variants on an empty list still return kOk.
+      assert.ok(wb.removeHyperlink(0, 0, 0).ok);
+      assert.ok(wb.clearHyperlinks(0).ok);
+      // Out-of-range index is rejected.
+      assert.ok(!wb.removeHyperlinkAt(0, 0).ok);
+      // Sheet-index-out-of-range is rejected on every variant.
+      assert.ok(!wb.removeHyperlink(999, 0, 0).ok);
+      assert.ok(!wb.removeHyperlinkAt(999, 0).ok);
+      assert.ok(!wb.clearHyperlinks(999).ok);
+      // Final list still matches the post-save+load read.
+      assert.equal(wb.getHyperlinks(0).length, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('setComment / getComment round-trip', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setComment(0, 1, 1, 'Alice', 'Hello').ok);
+      const c = wb.getComment(0, 1, 1);
+      assert.ok(c !== null);
+      assert.equal(c.author, 'Alice');
+      assert.equal(c.text, 'Hello');
+      // Empty text removes.
+      assert.ok(wb.setComment(0, 1, 1, '', '').ok);
+      const after = wb.getComment(0, 1, 1);
+      assert.equal(after, null);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('getCommentResult distinguishes absence from an invalid sheet', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const missing = wb.getCommentResult(0, 1, 1);
+      assert.equal(missing.status.ok, false);
+      assert.equal(missing.comment, null);
+      const invalid = wb.getCommentResult(99, 1, 1);
+      assert.equal(invalid.status.ok, false);
+      assert.equal(invalid.comment, null);
+      assert.notEqual(missing.status.status, invalid.status.status);
+      assert.ok(wb.setComment(0, 1, 1, 'libraz', 'hello').ok);
+      const found = wb.getCommentResult(0, 1, 1);
+      assert.equal(found.status.ok, true);
+      assert.equal(found.comment.author, 'libraz');
+      assert.equal(found.comment.text, 'hello');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('getValidations returns an array', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const arr = wb.getValidations(0);
+      assert.ok(Array.isArray(arr) || typeof arr.length === 'number');
+      assert.equal(arr.length, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('addValidation / getValidations / removeValidationAt / clearValidations round-trip', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      // List-type validation at A1:B3 with prompts and an error message.
+      const listRule = {
+        ranges: [{ firstRow: 0, firstCol: 0, lastRow: 2, lastCol: 1 }],
+        type: 3,
+        op: 0,
+        errorStyle: 1,
+        allowBlank: true,
+        showInputMessage: true,
+        showErrorMessage: true,
+        formula1: '"Yes,No,Maybe"',
+        promptTitle: 'Choose',
+        promptMessage: 'Pick one',
+        errorTitle: 'Bad value',
+        errorMessage: 'Pick from the list',
+      };
+      assert.ok(wb.addValidation(0, listRule).ok);
+
+      // Decimal between [0, 100] across two rectangles.
+      const decimalRule = {
+        ranges: [
+          { firstRow: 4, firstCol: 0, lastRow: 4, lastCol: 0 },
+          { firstRow: 6, firstCol: 0, lastRow: 9, lastCol: 0 },
+        ],
+        type: 2,
+        op: 0,
+        formula1: '0',
+        formula2: '100',
+        allowBlank: false,
+      };
+      assert.ok(wb.addValidation(0, decimalRule).ok);
+
+      const list = wb.getValidations(0);
+      assert.equal(list.length, 2);
+
+      const a = list[0];
+      assert.equal(a.type, 3);
+      assert.equal(a.op, 0);
+      assert.equal(a.errorStyle, 1);
+      // Booleans must arrive as JS booleans, not 0/1.
+      assert.equal(typeof a.allowBlank, 'boolean');
+      assert.equal(a.allowBlank, true);
+      assert.equal(typeof a.showInputMessage, 'boolean');
+      assert.equal(a.showInputMessage, true);
+      assert.equal(typeof a.showErrorMessage, 'boolean');
+      assert.equal(a.showErrorMessage, true);
+      assert.equal(a.formula1, '"Yes,No,Maybe"');
+      assert.equal(a.promptTitle, 'Choose');
+      assert.equal(a.errorTitle, 'Bad value');
+      assert.equal(a.errorMessage, 'Pick from the list');
+      assert.equal(a.ranges.length, 1);
+      assert.equal(a.ranges[0].firstRow, 0);
+      assert.equal(a.ranges[0].lastCol, 1);
+
+      const b = list[1];
+      assert.equal(b.type, 2);
+      assert.equal(b.formula1, '0');
+      assert.equal(b.formula2, '100');
+      assert.equal(b.allowBlank, false);
+      assert.equal(b.ranges.length, 2);
+      assert.equal(b.ranges[1].firstRow, 6);
+      assert.equal(b.ranges[1].lastRow, 9);
+
+      // removeValidationAt drops the first rule.
+      assert.ok(wb.removeValidationAt(0, 0).ok);
+      const after = wb.getValidations(0);
+      assert.equal(after.length, 1);
+      assert.equal(after[0].type, 2);
+
+      // Out-of-range index is rejected.
+      assert.ok(!wb.removeValidationAt(0, 99).ok);
+
+      // clearValidations drops everything; safe to call again.
+      assert.ok(wb.clearValidations(0).ok);
+      assert.equal(wb.getValidations(0).length, 0);
+      assert.ok(wb.clearValidations(0).ok);
+
+      // Sheet-out-of-range is rejected on every entry.
+      assert.ok(!wb.addValidation(999, listRule).ok);
+      assert.ok(!wb.removeValidationAt(999, 0).ok);
+      assert.ok(!wb.clearValidations(999).ok);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('CF and sheet-layout lists are plain JS arrays with no delete lifecycle', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const cf = wb.evaluateCfRange(0, 0, 0, 1, 1, Number.NaN);
+      assert.ok(cf.status.ok);
+      assert.ok(Array.isArray(cf.cells));
+
+      assert.ok(wb.setColumnWidth(0, 2, 2, 18).ok);
+      const columns = wb.getSheetColumns(0);
+      assert.ok(columns.status.ok);
+      assert.ok(Array.isArray(columns.columns));
+      assert.equal(columns.columns[0].first, 2);
+      assert.equal(columns.columns[0].width, 18);
+
+      assert.ok(wb.setRowHeight(0, 3, 22).ok);
+      const rows = wb.getSheetRowOverrides(0);
+      assert.ok(rows.status.ok);
+      assert.ok(Array.isArray(rows.rows));
+      assert.equal(rows.rows[0].row, 3);
+      assert.equal(rows.rows[0].height, 22);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('sheet-layout setters refuse coordinates and metrics Excel cannot open', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      // These six setters marshal straight to the C ABI, which is where the
+      // validation lives. The assertions below are what keeps that true: a
+      // binding that grew its own path to the model would still pass every
+      // round-trip test while quietly authoring a file Excel refuses, since
+      // NaN and Infinity serialise to an empty string -- `<col width=""/>`
+      // is not a lexical xsd:double at all, and a repair prompt rather than
+      // an out-of-range value.
+      const kInvalidArgument = 2;
+      // The message is pinned, not just the code. Both JS bindings route
+      // these calls to one set of helpers, so both report that shared
+      // wording; a binding that grew its own check would keep returning
+      // `kInvalidArgument` while the text stopped matching. The status code
+      // alone cannot tell a shared implementation from two that agree today.
+      const kSpanRefused = 'column span out of range';
+      const kRowRefused = 'row index out of range';
+      const kMetricRefused = 'value must be finite and non-negative';
+      const refused = (status, expectedMessage, label) => {
+        assert.equal(status.ok, false, `${label} should have been refused`);
+        assert.equal(status.status, kInvalidArgument, `${label}: ${JSON.stringify(status)}`);
+        assert.equal(status.message, expectedMessage, `${label}: ${JSON.stringify(status)}`);
+      };
+
+      // One past Excel's last column / row.
+      refused(wb.setColumnWidth(0, 0, 16384, 10), kSpanRefused, 'setColumnWidth past the grid');
+      refused(wb.setColumnHidden(0, 0, 16384, true), kSpanRefused, 'setColumnHidden past the grid');
+      refused(wb.setColumnOutline(0, 0, 16384, 1), kSpanRefused, 'setColumnOutline past the grid');
+      refused(wb.setRowHeight(0, 1048576, 10), kRowRefused, 'setRowHeight past the grid');
+      refused(wb.setRowHidden(0, 1048576, true), kRowRefused, 'setRowHidden past the grid');
+      refused(wb.setRowOutline(0, 1048576, 1), kRowRefused, 'setRowOutline past the grid');
+
+      for (const bad of [Number.NaN, Number.POSITIVE_INFINITY, Number.NEGATIVE_INFINITY, -1]) {
+        refused(wb.setColumnWidth(0, 0, 2, bad), kMetricRefused, `setColumnWidth(${bad})`);
+        refused(wb.setRowHeight(0, 1, bad), kMetricRefused, `setRowHeight(${bad})`);
+      }
+
+      // The context names the C ABI entry point that refused the call and
+      // the values it saw, which is what makes a rejection actionable.
+      // These six answer with a bare `Status`, not a `{status}` envelope.
+      const span = wb.setColumnWidth(0, 0, 16384, 10);
+      assert.match(span.context, /fm_sheet_set_column_width: first=0 last=16384/);
+      // Pinned separately because the metric path runs through a different
+      // helper than the span path, and it is the only one of the three that
+      // interpolates a `double`. The value itself is left unmatched on
+      // purpose: `std::to_string` of a NaN is implementation-defined
+      // spelling (`nan`, `-nan`, `nan(ind)`), so asserting it would be a
+      // portability trap across the platforms the prebuilds target.
+      const metric = wb.setRowHeight(0, 1, Number.NaN);
+      assert.match(metric.context, /fm_sheet_set_row_height: height=/);
+
+      // Zero is a real width and a real height, not a rejected one.
+      assert.ok(wb.setColumnWidth(0, 0, 2, 0).ok);
+      assert.ok(wb.setRowHeight(0, 1, 0).ok);
+
+      // The last coordinates Excel does address stay accepted -- an
+      // off-by-one in either bound would refuse them.
+      assert.ok(wb.setColumnWidth(0, 16383, 16383, 10).ok);
+      assert.ok(wb.setColumnHidden(0, 16383, 16383, true).ok);
+      assert.ok(wb.setColumnOutline(0, 16383, 16383, 1).ok);
+      assert.ok(wb.setRowHeight(0, 1048575, 10).ok);
+      assert.ok(wb.setRowHidden(0, 1048575, true).ok);
+      assert.ok(wb.setRowOutline(0, 1048575, 1).ok);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('typed print patches throw on lossy numbers before changing the page setup', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setSheetPageSetup(0, { orientation: 2, scale: 125 }).ok);
+      const expectRejected = (patch, field) => {
+        assert.throws(() => wb.setSheetPageSetup(0, patch), {
+          name: 'RangeError',
+          message: new RegExp(`setSheetPageSetup.*\`${field}\``),
+        });
+        const setup = wb.getSheetPageSetup(0);
+        assert.equal(setup.orientation, 2);
+        assert.equal(setup.scale, 125);
+      };
+
+      expectRejected({ scale: 2 ** 32 + 100 }, 'pageSetup.scale');
+      expectRejected({ scale: 100.5 }, 'pageSetup.scale');
+      expectRejected({ scale: Number.NaN }, 'pageSetup.scale');
+      expectRejected({ scale: Number.POSITIVE_INFINITY }, 'pageSetup.scale');
+      expectRejected({ orientation: 1.5 }, 'pageSetup.orientation');
+
+      // Nullish values keep the old patch meaning: the attribute is omitted
+      // from this update and the prior value remains in force.
+      assert.ok(wb.setSheetPageSetup(0, { scale: null, orientation: undefined }).ok);
+      const unchanged = wb.getSheetPageSetup(0);
+      assert.equal(unchanged.orientation, 2);
+      assert.equal(unchanged.scale, 125);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('typed print patches throw on coercion and preserve header/footer fields', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setSheetPrintOptions(0, { gridLines: true }).ok);
+      const throwingOptions = {};
+      Object.defineProperty(throwingOptions, 'gridLines', {
+        get() {
+          throw new Error('print-options getter');
+        },
+      });
+      assert.throws(() => wb.setSheetPrintOptions(0, throwingOptions), /print-options getter/);
+      assert.match(wb.getSheetPrintOptionsXml(0).xml, /gridLines="true"/);
+
+      assert.ok(wb.setSheetPageMargins(0, { left: 0.5 }).ok);
+      assert.throws(() => wb.setSheetPageMargins(0, { left: '0.75' }), {
+        name: 'TypeError',
+        message: /setSheetPageMargins.*left/,
+      });
+      assert.equal(wb.getSheetPageMargins(0).left, 0.5);
+
+      assert.ok(wb.setSheetHeaderFooter(0, { oddHeader: 'before' }).ok);
+      assert.throws(() => wb.setSheetHeaderFooter(0, { oddHeader: 42 }), {
+        name: 'TypeError',
+        message: /setSheetHeaderFooter.*oddHeader/,
+      });
+      assert.match(wb.getSheetHeaderFooterXml(0).xml, /before/);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('header/footer getter failures are rethrown before any mutation', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setSheetHeaderFooter(0, { oddHeader: 'before' }).ok);
+      const lateFailure = { oddHeader: 'after' };
+      Object.defineProperty(lateFailure, 'alignWithMargins', {
+        get() {
+          throw new Error('late header getter');
+        },
+      });
+
+      assert.throws(() => wb.setSheetHeaderFooter(0, lateFailure), /late header getter/);
+      assert.match(wb.getSheetHeaderFooterXml(0).xml, /before/);
+      assert.doesNotMatch(wb.getSheetHeaderFooterXml(0).xml, /after/);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('setSheetVisibility states veryHidden, which the bool setter cannot', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const read = () => {
+        const r = wb.getSheetView(0);
+        assert.ok(r.status.ok, `getSheetView: ${JSON.stringify(r.status)}`);
+        return r.view;
+      };
+      assert.equal(read().visibility, 0);
+      assert.equal(read().tabHidden, 0);
+
+      assert.ok(wb.setSheetVisibility(0, 2).ok);
+      // The two-state view stays consistent: a very-hidden sheet reads as
+      // hidden to a caller that knows only the bool, never as visible.
+      assert.equal(read().visibility, 2);
+      assert.equal(read().tabHidden, 1);
+
+      // Asking for plain "hidden" must not weaken the stronger state.
+      assert.ok(wb.setSheetTabHidden(0, true).ok);
+      assert.equal(read().visibility, 2);
+
+      // Demotion is the other direction the bool cannot express.
+      assert.ok(wb.setSheetVisibility(0, 1).ok);
+      assert.equal(read().visibility, 1);
+      assert.equal(read().tabHidden, 1);
+
+      // Showing the sheet clears either hidden state.
+      assert.ok(wb.setSheetTabHidden(0, false).ok);
+      assert.equal(read().visibility, 0);
+      assert.equal(read().tabHidden, 0);
+
+      // An unknown ordinal is refused and leaves the sheet alone.
+      assert.ok(wb.setSheetVisibility(0, 2).ok);
+      assert.equal(wb.setSheetVisibility(0, 3).ok, false);
+      assert.equal(read().visibility, 2);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('getIterative reads back what setIterative stored', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const initial = wb.getIterative();
+      assert.ok(initial.status.ok, `getIterative: ${JSON.stringify(initial.status)}`);
+      assert.equal(typeof initial.enabled, 'boolean');
+      assert.equal(typeof initial.maxIterations, 'number');
+      assert.equal(typeof initial.maxChange, 'number');
+
+      assert.ok(wb.setIterative(true, 42, 0.25).ok);
+      const enabled = wb.getIterative();
+      assert.ok(enabled.status.ok);
+      assert.equal(enabled.enabled, true);
+      assert.equal(enabled.maxIterations, 42);
+      assert.equal(enabled.maxChange, 0.25);
+
+      // The cap and threshold survive switching iteration back off, which is
+      // what lets a host render the dialog with the stored values.
+      assert.ok(wb.setIterative(false, 42, 0.25).ok);
+      const disabled = wb.getIterative();
+      assert.ok(disabled.status.ok);
+      assert.equal(disabled.enabled, false);
+      assert.equal(disabled.maxIterations, 42);
+      assert.equal(disabled.maxChange, 0.25);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('addValidation defaults allowBlank to false', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(
+        wb.addValidation(0, {
+          ranges: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+          type: 3,
+          formula1: '"a,b"',
+        }).ok,
+      );
+      const list = wb.getValidations(0);
+      assert.equal(list.length, 1);
+      assert.equal(list[0].allowBlank, false);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('getCellStyleXf reports xfId alongside the cell-format fields', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const read = wb.getCellStyleXf(0);
+      assert.ok(read.status.ok, `getCellStyleXf: ${JSON.stringify(read.status)}`);
+      // A named-style xf is its own parent, so it never inherits one.
+      assert.equal(read.xfId, 0);
+      // The record shape matches `getCellXf`, which the documented
+      // read / edit / addCellStyleXf round-trip depends on.
+      const cellXf = wb.getCellXf(0);
+      assert.ok(cellXf.status.ok);
+      for (const key of Object.keys(cellXf)) {
+        assert.ok(key in read, `getCellStyleXf is missing '${key}'`);
+      }
+    } finally {
+      wb.delete();
+    }
+  });
+}
diff --git a/tests/wasm/run_pivot_regressions.mjs b/tests/wasm/run_pivot_regressions.mjs
new file mode 100644
index 000000000..d349edd6f
--- /dev/null
+++ b/tests/wasm/run_pivot_regressions.mjs
@@ -0,0 +1,351 @@
+import assert from 'node:assert/strict';
+import { PIVOT, VAL } from './smoke_support.mjs';
+
+const nestedErrorClass = (value) => (typeof value === 'symbol' ? TypeError : RangeError);
+
+function makeCheckedPivot(Module) {
+  const wb = Module.Workbook.createDefault();
+  const must = (result, what) => {
+    const status = typeof result.ok === 'boolean' ? result : result.status;
+    assert.ok(status.ok, `${what}: ${JSON.stringify(status)}`);
+    return result;
+  };
+  const cache = must(wb.pivotCacheCreate(0), 'pivotCacheCreate').index;
+  must(
+    wb.pivotCacheSetWorksheetSource(cache, { present: true, ref: 'A1:B3', sheet: 'Sheet1' }),
+    'pivotCacheSetWorksheetSource',
+  );
+  must(wb.pivotCacheFieldAdd(cache, 'Region'), 'pivotCacheFieldAdd Region');
+  must(wb.pivotCacheFieldAdd(cache, 'Amount'), 'pivotCacheFieldAdd Amount');
+  for (const [region, amount] of [
+    ['East', 10],
+    ['West', 30],
+  ]) {
+    const record = must(wb.pivotCacheRecordAdd(cache), 'pivotCacheRecordAdd').index;
+    must(wb.pivotCacheRecordSetText(cache, record, 0, region), 'pivotCacheRecordSetText');
+    must(wb.pivotCacheRecordSetNumber(cache, record, 1, amount), 'pivotCacheRecordSetNumber');
+  }
+  const pivot = must(wb.pivotCreate(0, 'Pivot1', cache, 0, 4), 'pivotCreate').index;
+  const region = must(wb.pivotFieldAdd(0, pivot, { sourceName: 'Region', axis: 0 }), 'region field').index;
+  const amount = must(wb.pivotFieldAdd(0, pivot, { sourceName: 'Amount', axis: 2 }), 'amount field').index;
+  must(wb.pivotSetRowFieldOrder(0, pivot, [region]), 'pivotSetRowFieldOrder');
+  must(
+    wb.pivotDataFieldAdd(0, pivot, { name: 'Sum of Amount', fieldIndex: amount, aggregation: 0 }),
+    'pivotDataFieldAdd',
+  );
+  return { wb, pivot, region, amount };
+}
+
+function checkedPivotGrid(wb, pivot) {
+  const layout = wb.pivotLayout(0, pivot);
+  assert.ok(layout.status.ok, JSON.stringify(layout.status));
+  const rows = new Map();
+  for (const cell of layout.cells) {
+    const value = cell.value;
+    const text = value.kind === VAL.NUMBER ? String(value.number) : value.kind === VAL.TEXT ? value.text : '';
+    if (!rows.has(cell.row)) rows.set(cell.row, new Array(layout.cols).fill(''));
+    rows.get(cell.row)[cell.col - layout.left] = text;
+  }
+  return [...rows.keys()].sort((a, b) => a - b).map((row) => rows.get(row).join('|'));
+}
+
+const CHECKED_PIVOT_GRID = ['行ラベル|Sum of Amount', 'East|10', 'West|30', '総計|40'];
+
+export function registerPivotRegressions(Module, test) {
+  test('pivotFieldAddItemAt hides the blank item an empty label cannot name', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const cache = wb.pivotCacheCreate(0);
+      assert.ok(cache.status.ok, `pivotCacheCreate: ${JSON.stringify(cache.status)}`);
+      const region = wb.pivotCacheFieldAdd(cache.index, 'Region');
+      assert.ok(region.status.ok);
+      const amount = wb.pivotCacheFieldAdd(cache.index, 'Amount');
+      assert.ok(amount.status.ok);
+      // Shared item 0 renders as "North"; shared item 1 is the blank, which
+      // carries no label of its own and can only be named by its index.
+      assert.ok(wb.pivotCacheFieldAddSharedItemText(cache.index, region.index, 'North').ok);
+      assert.ok(wb.pivotCacheFieldAddSharedItemBlank(cache.index, region.index).ok);
+
+      const first = wb.pivotCacheRecordAdd(cache.index);
+      assert.ok(first.status.ok);
+      assert.ok(wb.pivotCacheRecordSetNumber(cache.index, first.index, region.index, 0).ok);
+      assert.ok(wb.pivotCacheRecordSetNumber(cache.index, first.index, amount.index, 100).ok);
+      const second = wb.pivotCacheRecordAdd(cache.index);
+      assert.ok(second.status.ok);
+      assert.ok(wb.pivotCacheRecordSetBlank(cache.index, second.index, region.index).ok);
+      assert.ok(wb.pivotCacheRecordSetNumber(cache.index, second.index, amount.index, 200).ok);
+
+      const pivot = wb.pivotCreate(0, 'PT', cache.index, 0, 0);
+      assert.ok(pivot.status.ok, `pivotCreate: ${JSON.stringify(pivot.status)}`);
+      const regionField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Region', axis: 0 });
+      assert.ok(regionField.status.ok);
+      const amountField = wb.pivotFieldAdd(0, pivot.index, { sourceName: 'Amount', axis: 2 });
+      assert.ok(amountField.status.ok);
+      assert.ok(wb.pivotSetRowFieldOrder(0, pivot.index, [regionField.index]).ok);
+      assert.ok(
+        wb.pivotDataFieldAdd(0, pivot.index, {
+          name: 'Sum of Amount',
+          fieldIndex: amountField.index,
+          aggregation: 0,
+        }).status.ok,
+      );
+
+      const sumDataCells = () => {
+        const layout = wb.pivotLayout(0, pivot.index);
+        assert.ok(layout.status.ok, `pivotLayout: ${JSON.stringify(layout.status)}`);
+        let total = 0;
+        for (const cell of layout.cells) {
+          if (cell.kind === PIVOT.DATA && cell.value.kind === VAL.NUMBER) {
+            total += cell.value.number;
+          }
+        }
+        return total;
+      };
+      assert.equal(sumDataCells(), 300);
+
+      assert.ok(wb.pivotFieldAddItem(0, pivot.index, regionField.index, 'North', true).ok);
+      assert.ok(wb.pivotFieldAddItemAt(0, pivot.index, regionField.index, 1, false).ok);
+      assert.equal(sumDataCells(), 100);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('pivot nested integers throw on narrowing before C mutation', () => {
+    const invalid = [2 ** 32, 1.5, Number.NaN, Number.POSITIVE_INFINITY, Symbol('pivot numeric')];
+    for (const value of invalid) {
+      const { wb, pivot } = makeCheckedPivot(Module);
+      try {
+        const before = wb.pivotFieldCount(0, pivot).value;
+        assert.throws(
+          () => wb.pivotFieldAdd(0, pivot, { sourceName: 'Region', axis: value }),
+          nestedErrorClass(value),
+          `pivotFieldAdd axis=${String(value)} accepted`,
+        );
+        assert.equal(wb.pivotFieldCount(0, pivot).value, before);
+      } finally {
+        wb.delete();
+      }
+
+      const data = makeCheckedPivot(Module);
+      try {
+        const before = data.wb.pivotDataFieldCount(0, data.pivot).value;
+        assert.throws(
+          () =>
+            data.wb.pivotDataFieldAdd(0, data.pivot, {
+              name: 'Bad',
+              fieldIndex: value,
+              aggregation: 0,
+            }),
+          nestedErrorClass(value),
+          `pivotDataFieldAdd fieldIndex=${String(value)} accepted`,
+        );
+        assert.equal(data.wb.pivotDataFieldCount(0, data.pivot).value, before);
+      } finally {
+        data.wb.delete();
+      }
+    }
+  });
+
+  test('pivot filters throw on invalid axis, value kind, and field index before mutation', () => {
+    const invalid = [
+      { axis: 2 ** 32 },
+      { valueKind: 1.5 },
+      { valueKind: Number.NaN },
+      { valueKind: Symbol('pivot filter') },
+      { dataFieldIndex: 2 ** 32 },
+    ];
+    for (const override of invalid) {
+      const { wb, pivot } = makeCheckedPivot(Module);
+      try {
+        const before = wb.pivotFilterCount(0, pivot).value;
+        assert.throws(
+          () =>
+            wb.pivotFilterAdd(0, pivot, {
+              axis: 0,
+              fieldName: 'Region',
+              type: 1,
+              valueKind: 1,
+              valueDouble: 15,
+              ...override,
+            }),
+          nestedErrorClass(Object.values(override)[0]),
+          `pivotFilterAdd ${String(Object.values(override)[0])} accepted`,
+        );
+        assert.equal(wb.pivotFilterCount(0, pivot).value, before);
+        assert.deepEqual(checkedPivotGrid(wb, pivot), CHECKED_PIVOT_GRID);
+      } finally {
+        wb.delete();
+      }
+    }
+  });
+
+  test('pivot order arrays throw on invalid elements before replacing the order', () => {
+    const invalid = [2 ** 32 + 1, 1.5, Number.NaN, Number.POSITIVE_INFINITY, Symbol('pivot order')];
+    for (const value of invalid) {
+      const { wb, pivot } = makeCheckedPivot(Module);
+      try {
+        assert.throws(
+          () => wb.pivotSetRowFieldOrder(0, pivot, [value]),
+          nestedErrorClass(value),
+          `pivotSetRowFieldOrder element=${String(value)} accepted`,
+        );
+        assert.deepEqual(checkedPivotGrid(wb, pivot), CHECKED_PIVOT_GRID);
+      } finally {
+        wb.delete();
+      }
+    }
+  });
+
+  test('pivot valid nested controls and nullish defaults remain accepted', () => {
+    const { wb, pivot, amount } = makeCheckedPivot(Module);
+    try {
+      const data = wb.pivotDataFieldAdd(0, pivot, {
+        name: 'Count of Amount',
+        fieldIndex: amount,
+        aggregation: 1,
+        numberFormat: null,
+        showAs: undefined,
+        showAsBaseField: null,
+        showAsBaseItem: undefined,
+      });
+      assert.ok(data.status.ok, JSON.stringify(data.status));
+      assert.equal(wb.pivotDataFieldCount(0, pivot).value, 2);
+      const filter = wb.pivotFilterAdd(0, pivot, {
+        axis: 0,
+        fieldName: 'Region',
+        type: 1,
+        valueKind: 1,
+        valueDouble: 15,
+      });
+      assert.ok(filter.ok, JSON.stringify(filter));
+      assert.ok(wb.pivotSetRowFieldOrder(0, pivot, [0]).ok);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('pivot nested getter failures are rethrown before any C mutation', () => {
+    const { wb, pivot } = makeCheckedPivot(Module);
+    try {
+      const fieldCount = wb.pivotFieldCount(0, pivot).value;
+      const fieldSpec = { axis: 0 };
+      Object.defineProperty(fieldSpec, 'sourceName', {
+        enumerable: true,
+        get() {
+          throw new Error('pivot field getter');
+        },
+      });
+      assert.throws(() => wb.pivotFieldAdd(0, pivot, fieldSpec), /pivot field getter/);
+      assert.equal(wb.pivotFieldCount(0, pivot).value, fieldCount);
+
+      const indices = [];
+      Object.defineProperty(indices, 0, {
+        enumerable: true,
+        get() {
+          throw new Error('pivot order getter');
+        },
+      });
+      assert.throws(() => wb.pivotSetRowFieldOrder(0, pivot, indices), /pivot order getter/);
+      assert.deepEqual(checkedPivotGrid(wb, pivot), CHECKED_PIVOT_GRID);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('a rejected argument reports its own diagnostic, not the previous call', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      // Leave a failure of a different call in the thread-local diagnostics.
+      const stale = wb.getValue(99, 0, 0);
+      assert.equal(stale.status.ok, false);
+      assert.ok(stale.status.message.length > 0);
+
+      const rejected = wb.createTable({ sheetIndex: 0, ref: 'A1:B2', name: 'T' });
+      assert.equal(rejected.status.ok, false);
+      assert.notEqual(rejected.status.message, stale.status.message);
+      assert.match(rejected.status.message, /columns/);
+      assert.equal(rejected.status.context, '');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('list getters expose failures through their array status', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      for (const list of [
+        wb.getMerges(99),
+        wb.getComments(99),
+        wb.getHyperlinks(99),
+        wb.getValidations(99),
+        wb.getConditionalFormats(99),
+      ]) {
+        assert.ok(Array.isArray(list));
+        assert.equal(list.length, 0);
+        assert.equal(list.status.ok, false);
+      }
+      const links = wb.getExternalLinks();
+      assert.ok(Array.isArray(links));
+      assert.equal(links.status.ok, true);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  // Deliberately last. A shadow-stack overflow is a WebAssembly trap, not an
+  // exception: it destroys the module instance, so nothing after it here
+  // would be measuring the engine any more. Running it at the end means the
+  // rest of the suite has already reported when it fires.
+  test('nesting up to the parser depth cap stays inside the shadow stack', () => {
+    // The engine bounds formula nesting with one constant, and under WASM the
+    // stack that bound protects is a link-time size. When the two disagree the
+    // failure is not an error value: the shadow stack runs into the data
+    // segment below it, and past that the module faults in a way no
+    // `Expected` can report and no `try` can recover from. So the assertion is
+    // that the cap is reached by a diagnostic.
+    //
+    // Nested calls are the shape that matters -- parentheses are elided by the
+    // parser and cost a fraction as much per level. The cap itself is
+    // discovered rather than written down, so raising it in the engine does
+    // not quietly narrow what this covers.
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setNumber(0, 0, 0, 7).ok);
+
+      const searchCeiling = 1024;
+      let rejectedAt = 0;
+      for (let depth = 1; depth <= searchCeiling; depth += 1) {
+        const formula = `=${'SUM('.repeat(depth)}A1${')'.repeat(depth)}`;
+        let out;
+        try {
+          out = wb.evaluateFormulaText(0, 1, 0, formula);
+        } catch (e) {
+          // Past this point the instance is gone and its worker threads keep
+          // the process alive, so reporting and continuing would hang rather
+          // than fail. Exit on the spot with the depth that did it.
+          console.error(`FAIL nesting depth ${depth} (${formula.length} chars) faulted instead of evaluating.`);
+          console.error(`  ${e && e.stack ? e.stack : e}`);
+          console.error(
+            '  The WASM shadow stack is too small for parser::kMaxFormulaAstDepth. ' +
+              'See _FM_WASM_STACK_SIZE in cmake/FormulonWasm.cmake and the stack_probe artifact.',
+          );
+          process.exit(1);
+        }
+        assert.ok(out.status.ok, `depth=${depth} status=${JSON.stringify(out.status)}`);
+        if (out.value.kind === VAL.ERROR) {
+          assert.equal(out.value.errorCode, 4, `depth=${depth} should be rejected as #NAME?`);
+          rejectedAt = depth;
+          break;
+        }
+        // Nested SUM over one cell is the identity. A wrong answer here is what
+        // a stack that overran its limit looks like from the outside.
+        assert.equal(out.value.kind, VAL.NUMBER, `depth=${depth}`);
+        assert.equal(out.value.number, 7, `depth=${depth}`);
+      }
+      assert.ok(rejectedAt > 0, `no nesting depth up to ${searchCeiling} was rejected; the depth cap did not engage`);
+    } finally {
+      wb.delete();
+    }
+  });
+}
diff --git a/tests/wasm/run_positional.mjs b/tests/wasm/run_positional.mjs
new file mode 100644
index 000000000..3ae510e2e
--- /dev/null
+++ b/tests/wasm/run_positional.mjs
@@ -0,0 +1,322 @@
+import assert from 'node:assert/strict';
+
+const RANGE = { firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 };
+
+function expectRangeError(fn) {
+  assert.throws(fn, RangeError);
+}
+
+function expectTypeError(fn) {
+  assert.throws(fn, TypeError);
+}
+
+function deleteAfterLifecycleProbe(wb, lifecycle) {
+  if (wb.isDeleted()) return;
+  try {
+    wb.delete();
+  } catch (error) {
+    // Older artifacts can leave deleteLater scheduled after the getter
+    // returns; there is no synchronous flush API. The fixed guard leaves the
+    // workbook normally deletable here.
+    if (lifecycle !== 'deleteLater') throw error;
+  }
+}
+
+export function registerPositional(Module, test, hookProbe) {
+  if (hookProbe !== undefined) {
+    test('WASM positional guards install before factory hooks', () => {
+      // The runner supplies these observations from onRuntimeInitialized and
+      // postRun. Keeping this assertion in the shared smoke suite protects
+      // direct factories and npm shims from reordering the installation.
+      assert.deepEqual(hookProbe.runtimeInitial, { threw: true, a1: 42 });
+      assert.deepEqual(hookProbe.runtimeReplacement, { threw: true, a1: 42 });
+      assert.deepEqual(hookProbe.postInitial, { threw: true, a1: 42 });
+      assert.deepEqual(hookProbe.postReplacement, { threw: true, a1: 42 });
+    });
+  }
+
+  test('WASM uint32 positions reject coercion and preserve the cell', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setNumber(0, 0, 0, 42).ok);
+      for (const value of [2 ** 32, -1, 1.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+        expectRangeError(() => wb.setNumber(value, 0, 0, 7));
+        assert.equal(wb.getValue(0, 0, 0).value.number, 42);
+      }
+      expectTypeError(() => wb.setNumber(Symbol('sheet'), 0, 0, 7));
+      assert.equal(wb.getValue(0, 0, 0).value.number, 42);
+
+      // A valid but out-of-range sheet remains a native status failure. This
+      // distinguishes the guard from the engine's own sheet lookup.
+      const native = wb.setNumber(1, 0, 0, 7);
+      assert.equal(native.ok, false);
+      assert.equal(wb.getValue(0, 0, 0).value.number, 42);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('WASM signed and string positions reject symbols and out-of-range values', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      for (const value of [2 ** 31, -(2 ** 31) - 1, 1.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+        expectRangeError(() => wb.setError(0, 0, 0, value));
+      }
+      expectTypeError(() => wb.setError(0, 0, 0, Symbol('error')));
+      expectTypeError(() => wb.setText(0, 0, 0, Symbol('text')));
+      assert.ok(wb.setText(0, 0, 0, 'valid').ok);
+
+      const errorControl = wb.setError(1, 0, 0, -1);
+      assert.equal(typeof errorControl.ok, 'boolean');
+      assert.equal(typeof Module.statusString(-1), 'string');
+      assert.equal(typeof Module.errorDisplayName(-1), 'string');
+      assert.equal(typeof Module.setLogMinLevel(-1).ok, 'boolean');
+      expectTypeError(() => Module.statusString(Symbol('status')));
+      expectTypeError(() => Module.errorDisplayName(Symbol('error')));
+      expectTypeError(() => Module.setLogMinLevel(Symbol('level')));
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('WASM string free function is primitive-only', () => {
+    expectTypeError(() => Module.evalFormula(Symbol('formula')));
+    expectTypeError(() =>
+      Module.evalFormula({
+        toString() {
+          throw new Error('toString');
+        },
+      }),
+    );
+    const result = Module.evalFormula('=1+1');
+    assert.equal(result.status.ok, true);
+    assert.equal(result.value.number, 2);
+  });
+
+  test('WASM paging positions reject invalid cursors and retain nullish defaults', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setNumber(0, 0, 0, 42).ok);
+      for (const value of [-1, 1.5, Number.NaN, Number.POSITIVE_INFINITY, 2 ** 53, 2 ** 64]) {
+        expectRangeError(() => wb.getCellsInRange(0, RANGE, value, 1));
+        expectRangeError(() => wb.getCellsInRange(0, RANGE, 0, value));
+        expectRangeError(() => wb.listInvalidCells(0, value, 1));
+        expectRangeError(() => wb.listInvalidCells(0, 0, value));
+      }
+      expectTypeError(() => wb.getCellsInRange(0, RANGE, Symbol('cursor'), 1));
+      expectTypeError(() => wb.listInvalidCells(0, Symbol('cursor'), 1));
+
+      assert.equal(wb.getCellsInRange(0, RANGE, null, null).status.ok, true);
+      assert.equal(wb.getCellsInRange(0, RANGE, undefined, undefined).status.ok, true);
+      assert.equal(wb.listInvalidCells(0, null, null).status.ok, true);
+      assert.equal(wb.listInvalidCells(0, undefined, undefined).status.ok, true);
+      assert.equal(wb.getValue(0, 0, 0).value.number, 42);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('WASM-only table and auto-filter positions are guarded', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      for (const method of ['removeTable', 'updateTable', 'getSheetAutoFilterXml']) {
+        expectRangeError(() => wb[method](2 ** 32, {}));
+      }
+      expectRangeError(() => wb.setSheetAutoFilterXml(2 ** 32, ''));
+      expectTypeError(() => wb.setSheetAutoFilterXml(0, Symbol('xml')));
+
+      const got = wb.getSheetAutoFilterXml(0);
+      assert.equal(typeof got.status.ok, 'boolean');
+      assert.equal(typeof got.xml, 'string');
+      assert.equal(typeof wb.setSheetAutoFilterXml(0, '').ok, 'boolean');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('WASM guard preserves embind descriptors and receiver errors', () => {
+    const descriptor = Object.getOwnPropertyDescriptor(Module.Workbook.prototype, 'setNumber');
+    assert.equal(descriptor.enumerable, true);
+    assert.equal(descriptor.writable, true);
+    assert.equal(descriptor.configurable, true);
+    const wb = Module.Workbook.createDefault();
+    try {
+      const detached = wb.setNumber;
+      assert.throws(() => detached(0, 0, 0, 7));
+      const forged = Object.create(Module.Workbook.prototype);
+      assert.throws(() => forged.setNumber(0, 0, 0, 7));
+      assert.equal(wb.setNumber.call(wb, 0, 0, 0, 42).ok, true);
+      assert.equal(wb.getValue(0, 0, 0).value.number, 42);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('WASM overload leaves validate positions and track active Workbook calls', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setNumber(0, 0, 0, 42).ok);
+      const leaf = (name, argCount) => {
+        const table = Module.Workbook.prototype[name].overloadTable;
+        assert.ok(Array.isArray(table), `${name} overload table missing`);
+        const entry = table.find((candidate) => candidate?.argCount === argCount);
+        assert.equal(typeof entry, 'function', `${name} overload leaf missing`);
+        return entry;
+      };
+      const getCellsLeaf = leaf('getCellsInRange', 4);
+      const listInvalidLeaf = leaf('listInvalidCells', 3);
+      const insertImageLeaf = leaf('insertImage', 3);
+
+      expectRangeError(() => getCellsLeaf.call(wb, 0, RANGE, 2 ** 64, 1));
+      expectRangeError(() => listInvalidLeaf.call(wb, 0, -1, 1));
+      expectRangeError(() => insertImageLeaf.call(wb, 2 ** 32, new Uint8Array(), {}));
+      assert.equal(wb.getValue(0, 0, 0).value.number, 42);
+
+      assert.equal(wb.getCellsInRange(0, RANGE, 0, 1).status.ok, true);
+      assert.equal(wb.listInvalidCells(0, 0, 1).status.ok, true);
+      assert.equal(typeof wb.insertImage(0, new Uint8Array(), {}).status.ok, 'boolean');
+
+      const nestedRange = {};
+      Object.defineProperties(nestedRange, {
+        firstRow: {
+          get() {
+            wb.delete();
+            return 0;
+          },
+        },
+        firstCol: { value: 0 },
+        lastRow: { value: 0 },
+        lastCol: { value: 0 },
+      });
+      assert.throws(() => getCellsLeaf.call(wb, 0, nestedRange, 0, 1), {
+        name: 'TypeError',
+        message: /cannot dispose Workbook during an active method call/,
+      });
+      assert.equal(wb.isDeleted(), false);
+      assert.equal(wb.getValue(0, 0, 0).value.number, 42);
+    } finally {
+      if (!wb.isDeleted()) wb.delete();
+    }
+  });
+
+  test('WASM guards reject reentrant Workbook deletion during nested reads', () => {
+    for (const lifecycle of ['delete', 'deleteLater', Symbol.dispose]) {
+      const wb = Module.Workbook.createDefault();
+      try {
+        const before = wb.xfCount().value;
+        const spec = {};
+        Object.defineProperty(spec, 'horizontalAlign', {
+          get() {
+            wb[lifecycle]();
+            return 1;
+          },
+        });
+        assert.throws(
+          () => wb.addXf(spec),
+          /cannot dispose Workbook during an active method call/,
+          `${String(lifecycle)} unexpectedly succeeded`,
+        );
+        assert.equal(wb.xfCount().value, before);
+        assert.equal(wb.isDeleted(), false);
+      } finally {
+        deleteAfterLifecycleProbe(wb, lifecycle);
+      }
+    }
+  });
+
+  test('WASM lifecycle guards cover inherited descriptor calls during nested reads', () => {
+    for (const lifecycle of ['delete', 'deleteLater', Symbol.dispose]) {
+      const wb = Module.Workbook.createDefault();
+      const inherited = Object.getPrototypeOf(Object.getPrototypeOf(wb));
+      const descriptor = Object.getOwnPropertyDescriptor(inherited, lifecycle);
+      assert.equal(typeof descriptor?.value, 'function', `${String(lifecycle)} descriptor missing`);
+      try {
+        const before = wb.xfCount().value;
+        const spec = {};
+        Object.defineProperty(spec, 'horizontalAlign', {
+          get() {
+            descriptor.value.call(wb);
+            return 1;
+          },
+        });
+        assert.throws(
+          () => wb.addXf(spec),
+          /cannot dispose Workbook during an active method call/,
+          `${String(lifecycle)} inherited call unexpectedly succeeded`,
+        );
+        assert.equal(wb.xfCount().value, before);
+        assert.equal(wb.isDeleted(), false);
+      } finally {
+        deleteAfterLifecycleProbe(wb, lifecycle);
+      }
+    }
+  });
+
+  test('WASM lifecycle depth follows empty Proxy Workbook receivers', () => {
+    const wb = Module.Workbook.createDefault();
+    const proxy = new Proxy(wb, {});
+    try {
+      assert.ok(proxy.setNumber(0, 0, 0, 42).ok);
+
+      let originalDeleteError;
+      const originalDeleteSpec = {};
+      Object.defineProperty(originalDeleteSpec, 'horizontalAlign', {
+        get() {
+          try {
+            wb.delete();
+          } catch (error) {
+            originalDeleteError = error;
+          }
+          return 1;
+        },
+      });
+      const originalDeleteResult = proxy.addXf(originalDeleteSpec);
+      assert.ok(originalDeleteResult.status.ok, JSON.stringify(originalDeleteResult.status));
+      assert.ok(originalDeleteError instanceof TypeError);
+      assert.equal(proxy.isDeleted(), false);
+
+      let proxyDeleteError;
+      const proxyDeleteSpec = {};
+      Object.defineProperty(proxyDeleteSpec, 'horizontalAlign', {
+        get() {
+          try {
+            proxy.delete();
+          } catch (error) {
+            proxyDeleteError = error;
+          }
+          return 1;
+        },
+      });
+      const proxyDeleteResult = proxy.addXf(proxyDeleteSpec);
+      assert.ok(proxyDeleteResult.status.ok, JSON.stringify(proxyDeleteResult.status));
+      assert.ok(proxyDeleteError instanceof TypeError);
+      assert.equal(wb.isDeleted(), false);
+    } finally {
+      if (!wb.isDeleted()) wb.delete();
+    }
+  });
+
+  test('WASM lifecycle guard permits a getter to catch its deletion error', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      let caught;
+      const spec = {};
+      Object.defineProperty(spec, 'horizontalAlign', {
+        get() {
+          try {
+            wb.delete();
+          } catch (error) {
+            caught = error;
+          }
+          return 1;
+        },
+      });
+      const result = wb.addXf(spec);
+      assert.ok(result.status.ok, JSON.stringify(result.status));
+      assert.ok(caught instanceof TypeError);
+      assert.equal(wb.isDeleted(), false);
+    } finally {
+      if (!wb.isDeleted()) wb.delete();
+    }
+  });
+}
diff --git a/tests/wasm/run_sheet_pivot.mjs b/tests/wasm/run_sheet_pivot.mjs
new file mode 100644
index 000000000..f70a3e8b1
--- /dev/null
+++ b/tests/wasm/run_sheet_pivot.mjs
@@ -0,0 +1,213 @@
+import assert from 'node:assert/strict';
+import { buildPivotWorkbookBytes, findPivotCell, PIVOT, VAL } from './smoke_support.mjs';
+
+export function registerSheetPivot(Module, test) {
+  test('setIterative accepts knobs without crashing', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setIterative(true, 50, 0.001).ok);
+      // Set a fixed-point formula (sqrt(2) iteration). The engine may
+      // surface NUMBER (converged) or ERROR depending on the recalc
+      // path; we only assert that the call sequence doesn't crash and
+      // that getValue returns a well-formed envelope.
+      assert.ok(wb.setNumber(0, 0, 0, 1.0).ok);
+      assert.ok(wb.setFormula(0, 0, 0, '=0.5*(A1+2/A1)').ok);
+      assert.ok(wb.recalc().ok);
+      const v = wb.getValue(0, 0, 0);
+      assert.ok(v.status.ok);
+      // Known well-formed kinds.
+      assert.ok([VAL.NUMBER, VAL.ERROR, VAL.BLANK].includes(v.value.kind));
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('renameSheet updates the sheet name', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.equal(wb.sheetCount().value, 1);
+      assert.ok(wb.renameSheet(0, 'Renamed').ok);
+      const r = wb.sheetName(0);
+      assert.ok(r.status.ok);
+      assert.equal(r.value, 'Renamed');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('renameSheet rejects forbidden characters', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const r = wb.renameSheet(0, 'Bad/Name');
+      assert.equal(r.ok, false);
+      assert.notEqual(r.status, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('removeSheet drops a sheet but rejects the last one', () => {
+    const wb = Module.Workbook.createEmpty();
+    try {
+      assert.ok(wb.addSheet('A').ok);
+      assert.ok(wb.addSheet('B').ok);
+      assert.ok(wb.addSheet('C').ok);
+      assert.equal(wb.sheetCount().value, 3);
+      assert.ok(wb.removeSheet(1).ok);
+      assert.equal(wb.sheetCount().value, 2);
+      assert.equal(wb.sheetName(0).value, 'A');
+      assert.equal(wb.sheetName(1).value, 'C');
+    } finally {
+      wb.delete();
+    }
+
+    // Workbook with a single sheet rejects removeSheet(0).
+    const lone = Module.Workbook.createDefault();
+    try {
+      const r = lone.removeSheet(0);
+      assert.equal(r.ok, false);
+    } finally {
+      lone.delete();
+    }
+  });
+
+  test('moveSheet rearranges sheets (Excel UI semantics)', () => {
+    const wb = Module.Workbook.createEmpty();
+    try {
+      assert.ok(wb.addSheet('Alpha').ok);
+      assert.ok(wb.addSheet('Beta').ok);
+      assert.ok(wb.addSheet('Gamma').ok);
+      // Move Alpha (0) to the end. Excel semantics: to=2 (post-removal).
+      assert.ok(wb.moveSheet(0, 2).ok);
+      assert.equal(wb.sheetName(0).value, 'Beta');
+      assert.equal(wb.sheetName(1).value, 'Gamma');
+      assert.equal(wb.sheetName(2).value, 'Alpha');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('setDefinedName adds, updates, and removes', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.equal(wb.definedNameCount().value, 0);
+      assert.ok(wb.setDefinedName('Pi', '=3.14').ok);
+      assert.equal(wb.definedNameCount().value, 1);
+      const a = wb.definedNameAt(0);
+      assert.ok(a.status.ok);
+      assert.equal(a.name, 'Pi');
+      assert.equal(a.formula, '=3.14');
+
+      assert.ok(wb.setDefinedName('PI', '=3.14159').ok);
+      assert.equal(wb.definedNameCount().value, 1);
+      const b = wb.definedNameAt(0);
+      assert.equal(b.name, 'Pi'); // authored case preserved
+      assert.equal(b.formula, '=3.14159');
+
+      assert.ok(wb.setDefinedName('Pi', '').ok);
+      assert.equal(wb.definedNameCount().value, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('cellCount + cellAt iterate populated cells in order', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+      assert.ok(wb.setNumber(0, 0, 1, 2).ok);
+      assert.ok(wb.setFormula(0, 1, 0, '=A1+B1').ok);
+      assert.ok(wb.recalc().ok);
+
+      const count = wb.cellCount(0).value;
+      assert.ok(count >= 3, `expected >=3 cells, got ${count}`);
+
+      // The very first iteration entry should be A1 (row=0, col=0).
+      const c0 = wb.cellAt(0, 0);
+      assert.ok(c0.status.ok);
+      assert.equal(c0.row, 0);
+      assert.equal(c0.col, 0);
+      assert.equal(c0.formula, null);
+      assert.equal(c0.value.kind, VAL.NUMBER);
+      assert.equal(c0.value.number, 1);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('failed entry lookups omit optional payload fields', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      for (const entry of [wb.cellAt(99, 0), wb.definedNameAt(0), wb.tableAt(0), wb.passthroughAt(0)]) {
+        assert.equal(entry.status.ok, false);
+      }
+      assert.ok(!('value' in wb.cellAt(99, 0)));
+      assert.ok(!('name' in wb.definedNameAt(0)));
+      assert.ok(!('name' in wb.tableAt(0)));
+      assert.ok(!('path' in wb.passthroughAt(0)));
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('pivotCount + pivotLayout expose PivotTable projection status', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.equal(wb.pivotCount(0).value, 0);
+
+      const missing = wb.pivotLayout(0, 0);
+      assert.equal(missing.status.ok, false);
+      assert.notEqual(missing.status.status, 0);
+      assert.equal(missing.top, 0);
+      assert.equal(missing.left, 0);
+      assert.equal(missing.rows, 0);
+      assert.equal(missing.cols, 0);
+      assert.deepEqual(missing.cells, []);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('pivotLayout projects loaded PivotTable cells for grid rendering', () => {
+    const wb = Module.Workbook.loadBytes(buildPivotWorkbookBytes());
+    try {
+      assert.ok(wb.isValid(), Module.lastErrorMessage());
+      assert.equal(wb.pivotCount(0).value, 0);
+      assert.equal(wb.pivotCount(1).value, 1);
+
+      const layout = wb.pivotLayout(1, 0);
+      assert.ok(layout.status.ok, `status=${JSON.stringify(layout.status)}`);
+      assert.equal(layout.top, 0);
+      assert.equal(layout.left, 3);
+      assert.equal(layout.rows, 4);
+      assert.equal(layout.cols, 2);
+      assert.ok(layout.cells.length > 0);
+
+      const rowLabels = findPivotCell(layout, 0, 3);
+      assert.ok(rowLabels);
+      assert.equal(rowLabels.kind, PIVOT.HEADER);
+      assert.equal(rowLabels.value.kind, VAL.TEXT);
+      assert.equal(rowLabels.value.text, '行ラベル');
+
+      const northLabel = findPivotCell(layout, 1, 3);
+      assert.ok(northLabel);
+      assert.equal(northLabel.kind, PIVOT.ROW_LABEL);
+      assert.equal(northLabel.value.text, 'North');
+
+      const northSum = findPivotCell(layout, 1, 4);
+      assert.ok(northSum);
+      assert.equal(northSum.kind, PIVOT.DATA);
+      assert.equal(northSum.value.kind, VAL.NUMBER);
+      assert.equal(northSum.value.number, 400);
+      assert.equal(northSum.fieldName, 'Sum of Amount');
+
+      const grandTotal = findPivotCell(layout, 3, 4);
+      assert.ok(grandTotal);
+      assert.equal(grandTotal.kind, PIVOT.GRAND_TOTAL);
+      assert.equal(grandTotal.value.kind, VAL.NUMBER);
+      assert.equal(grandTotal.value.number, 600);
+    } finally {
+      wb.delete();
+    }
+  });
+}
diff --git a/tests/wasm/run_styles.mjs b/tests/wasm/run_styles.mjs
new file mode 100644
index 000000000..b02c12df3
--- /dev/null
+++ b/tests/wasm/run_styles.mjs
@@ -0,0 +1,713 @@
+import assert from 'node:assert/strict';
+
+const isNestedRangeValue = (value) => typeof value === 'number';
+
+export function registerStyles(Module, test) {
+  test('xf index round-trips through setCellXfIndex / getCellXfIndex', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setNumber(0, 2, 3, 5).ok);
+      assert.ok(wb.setCellXfIndex(0, 2, 3, 9).ok);
+      const r = wb.getCellXfIndex(0, 2, 3);
+      assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+      assert.equal(r.xfIndex, 9);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('style building blocks: addFont -> addXf -> setCellXfIndex -> getXf', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      // A new workbook carries the minimum style table Excel writes, so
+      // a caller-appended record never lands on one of the slots Excel
+      // reserves: one font, the `none` and `gray125` fills, one border,
+      // one xf.
+      assert.equal(wb.fontCount().value, 1);
+      assert.equal(wb.fillCount().value, 2);
+      assert.equal(wb.borderCount().value, 1);
+      assert.equal(wb.xfCount().value, 1);
+
+      const f1 = wb.addFont({
+        name: 'Arial',
+        size: 12,
+        bold: true,
+        italic: false,
+        strike: false,
+        underline: 0,
+        colorArgb: 0xff112233,
+      });
+      assert.ok(f1.status.ok, `addFont: ${JSON.stringify(f1.status)}`);
+      assert.equal(typeof f1.index, 'number');
+
+      // Adding the same font again returns the same index (linear-search dedup).
+      const f1b = wb.addFont({
+        name: 'Arial',
+        size: 12,
+        bold: true,
+        italic: false,
+        strike: false,
+        underline: 0,
+        colorArgb: 0xff112233,
+      });
+      assert.ok(f1b.status.ok);
+      assert.equal(f1b.index, f1.index);
+      assert.equal(wb.fontCount().value, 2);
+
+      const fill = wb.addFill({ pattern: 1, fgArgb: 0xffff0000, bgArgb: 0xff000000 });
+      assert.ok(fill.status.ok);
+      const border = wb.addBorder({
+        left: { style: 1, colorArgb: 0xff000000 },
+        right: { style: 1, colorArgb: 0xff000000 },
+        top: { style: 1, colorArgb: 0xff000000 },
+        bottom: { style: 1, colorArgb: 0xff000000 },
+        diagonal: { style: 0, colorArgb: 0 },
+        diagonalUp: false,
+        diagonalDown: false,
+      });
+      assert.ok(border.status.ok);
+
+      // Built-in num_fmt resolves without growing the table.
+      const builtin = wb.addNumFmt('General');
+      assert.ok(builtin.status.ok);
+      assert.equal(builtin.numFmtId, 0);
+
+      // Custom num_fmt yields >= 164.
+      const custom = wb.addNumFmt('"USD" #,##0');
+      assert.ok(custom.status.ok);
+      assert.ok(custom.numFmtId >= 164, `expected custom id >= 164, got ${custom.numFmtId}`);
+
+      const xf = wb.addXf({
+        fontIndex: f1.index,
+        fillIndex: fill.index,
+        borderIndex: border.index,
+        numFmtId: custom.numFmtId,
+        horizontalAlign: 1,
+        verticalAlign: 2,
+        wrapText: true,
+      });
+      assert.ok(xf.status.ok, `addXf: ${JSON.stringify(xf.status)}`);
+      assert.ok(wb.xfCount().value >= 1);
+
+      // Adding the same xf is a no-op.
+      const xfDup = wb.addXf({
+        fontIndex: f1.index,
+        fillIndex: fill.index,
+        borderIndex: border.index,
+        numFmtId: custom.numFmtId,
+        horizontalAlign: 1,
+        verticalAlign: 2,
+        wrapText: true,
+      });
+      assert.ok(xfDup.status.ok);
+      assert.equal(xfDup.index, xf.index);
+
+      // Stamp the xf on a cell.
+      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+      assert.ok(wb.setCellXfIndex(0, 0, 0, xf.index).ok);
+
+      // Read back through the getters.
+      const reread = wb.getCellXf(xf.index);
+      assert.ok(reread.status.ok);
+      assert.equal(reread.fontIndex, f1.index);
+      assert.equal(reread.numFmtId, custom.numFmtId);
+      assert.equal(reread.wrapText, true);
+      assert.equal(reread.hasAlignment, true);
+      assert.equal(reread.hasHorizontalAlign, true);
+      assert.equal(reread.hasVerticalAlign, true);
+      assert.equal(reread.hasWrapText, true);
+      assert.equal(reread.hasJustifyLastLine, false);
+
+      const optional = wb.addXf({
+        fontIndex: f1.index,
+        fillIndex: fill.index,
+        borderIndex: border.index,
+        numFmtId: custom.numFmtId,
+        textRotation: 255,
+        indent: 0,
+        relativeIndent: -3,
+        shrinkToFit: false,
+        readingOrder: 0,
+        justifyLastLine: true,
+      });
+      assert.ok(optional.status.ok, `optional alignment: ${JSON.stringify(optional.status)}`);
+      const optionalRead = wb.getCellXf(optional.index);
+      assert.ok(optionalRead.status.ok);
+      assert.equal(optionalRead.textRotation, 255);
+      assert.equal(optionalRead.indent, 0);
+      assert.equal(optionalRead.relativeIndent, -3);
+      assert.equal(optionalRead.shrinkToFit, false);
+      assert.equal(optionalRead.readingOrder, 0);
+      assert.equal(optionalRead.justifyLastLine, true);
+      assert.equal(optionalRead.hasAlignment, true);
+      assert.equal(optionalRead.hasJustifyLastLine, true);
+      assert.equal(wb.addXf(optionalRead).index, optional.index);
+
+      const omitted = wb.addXf({
+        fontIndex: f1.index,
+        fillIndex: fill.index,
+        borderIndex: border.index,
+        numFmtId: custom.numFmtId,
+      });
+      assert.ok(omitted.status.ok);
+      const omittedRead = wb.getCellXf(omitted.index);
+      assert.ok(omittedRead.status.ok);
+      assert.equal(omittedRead.hasAlignment, false);
+
+      const explicitEmpty = wb.addXf({
+        fontIndex: f1.index,
+        fillIndex: fill.index,
+        borderIndex: border.index,
+        numFmtId: custom.numFmtId,
+        hasAlignment: true,
+      });
+      assert.ok(explicitEmpty.status.ok);
+      assert.notEqual(explicitEmpty.index, omitted.index);
+      const explicitEmptyRead = wb.getCellXf(explicitEmpty.index);
+      assert.ok(explicitEmptyRead.status.ok);
+      assert.equal(explicitEmptyRead.hasAlignment, true);
+
+      const rfont = wb.getFont(f1.index);
+      assert.ok(rfont.status.ok);
+      assert.equal(rfont.name, 'Arial');
+      assert.equal(rfont.size, 12);
+      assert.equal(rfont.bold, true);
+
+      const rfill = wb.getFill(fill.index);
+      assert.ok(rfill.status.ok);
+      assert.equal(rfill.pattern, 1);
+      assert.equal(rfill.fgArgb, 0xffff0000);
+
+      const rborder = wb.getBorder(border.index);
+      assert.ok(rborder.status.ok);
+      assert.equal(rborder.left.style, 1);
+      assert.equal(rborder.diagonalUp, false);
+
+      const rfmt = wb.getNumFmt(custom.numFmtId);
+      assert.ok(rfmt.status.ok);
+      assert.equal(rfmt.formatCode, '"USD" #,##0');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('selector colours survive get/add identity and save/load', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const theme = { kind: 2, rgb: 0, theme: 3, tint: 0.5, indexed: 0 };
+      const indexed = { kind: 3, rgb: 0, theme: 0, tint: 0, indexed: 9 };
+      const automatic = { kind: 4, rgb: 0, theme: 0, tint: 0, indexed: 0 };
+      const font = wb.addFont({
+        name: 'SelectorFont',
+        size: 11,
+        colorArgb: 0x01020304,
+        color: theme,
+      });
+      assert.ok(font.status.ok);
+      const gotFont = wb.getFont(font.index);
+      assert.ok(gotFont.status.ok);
+      assert.equal(gotFont.color.kind, 2);
+      assert.equal(gotFont.color.theme, 3);
+      assert.equal(gotFont.color.tint, 0.5);
+      assert.equal(gotFont.colorArgb, 0x01020304);
+      const fontAgain = wb.addFont(gotFont);
+      assert.ok(fontAgain.status.ok);
+      assert.equal(fontAgain.index, font.index);
+
+      const fill = wb.addFill({
+        pattern: 1,
+        fgArgb: 0x05060708,
+        bgArgb: 0x090a0b0c,
+        fg: indexed,
+        bg: automatic,
+      });
+      assert.ok(fill.status.ok);
+      const gotFill = wb.getFill(fill.index);
+      assert.ok(gotFill.status.ok);
+      assert.equal(gotFill.fg.kind, 3);
+      assert.equal(gotFill.fg.indexed, 9);
+      assert.equal(gotFill.bg.kind, 4);
+      const fillAgain = wb.addFill(gotFill);
+      assert.ok(fillAgain.status.ok);
+      assert.equal(fillAgain.index, fill.index);
+
+      const border = wb.addBorder({
+        left: { style: 1, colorArgb: 0x01020304, color: theme },
+        right: { style: 1, colorArgb: 0x05060708, color: indexed },
+        top: { style: 1, colorArgb: 0x090a0b0c, color: automatic },
+        bottom: { style: 0, colorArgb: 0 },
+        diagonal: { style: 0, colorArgb: 0 },
+      });
+      assert.ok(border.status.ok);
+      const gotBorder = wb.getBorder(border.index);
+      assert.ok(gotBorder.status.ok);
+      assert.equal(gotBorder.left.color.kind, 2);
+      assert.equal(gotBorder.left.color.theme, 3);
+      assert.equal(gotBorder.right.color.kind, 3);
+      assert.equal(gotBorder.right.color.indexed, 9);
+      assert.equal(gotBorder.top.color.kind, 4);
+      const borderAgain = wb.addBorder(gotBorder);
+      assert.ok(borderAgain.status.ok);
+      assert.equal(borderAgain.index, border.index);
+
+      const dxf = wb.addDxf({
+        font: { name: 'DxfSelector', size: 9, colorArgb: 0x11121314, color: automatic },
+        fill: { pattern: 1, fgArgb: 0x15161718, fg: indexed },
+        border: { left: { style: 1, colorArgb: 0x191a1b1c, color: theme } },
+      });
+      assert.ok(dxf.status.ok);
+      const gotDxf = wb.getDxf(dxf.index);
+      assert.ok(gotDxf.status.ok);
+      assert.equal(gotDxf.font.color.kind, 4);
+      assert.equal(gotDxf.fill.fg.kind, 3);
+      assert.equal(gotDxf.border.left.color.kind, 2);
+      const dxfAgain = wb.addDxf(gotDxf);
+      assert.ok(dxfAgain.status.ok);
+      assert.equal(dxfAgain.index, dxf.index);
+
+      const saved = wb.save();
+      assert.ok(saved.status.ok);
+      const loaded = Module.Workbook.loadBytes(saved.bytes);
+      try {
+        assert.ok(loaded.isValid());
+        const loadedFont = loaded.getFont(font.index);
+        const loadedFill = loaded.getFill(fill.index);
+        const loadedBorder = loaded.getBorder(border.index);
+        const loadedDxf = loaded.getDxf(dxf.index);
+        assert.ok(loadedFont.status.ok);
+        assert.ok(loadedFill.status.ok);
+        assert.ok(loadedBorder.status.ok);
+        assert.ok(loadedDxf.status.ok);
+        assert.equal(loadedFont.color.kind, 2);
+        assert.equal(loadedFill.fg.kind, 3);
+        assert.equal(loadedBorder.left.color.kind, 2);
+        assert.equal(loadedDxf.font.color.kind, 4);
+      } finally {
+        loaded.delete();
+      }
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('dxf alignment and protection XML survive get/add identity and save/load', () => {
+    const wb = Module.Workbook.createDefault();
+    const alignmentXml = '<alignment horizontal="center" wrapText="1"/>';
+    const protectionXml = '<protection locked="0" hidden="1"/>';
+    try {
+      const alignment = wb.addDxf({ alignmentXml });
+      assert.ok(alignment.status.ok);
+      const protection = wb.addDxf({ protectionXml });
+      assert.ok(protection.status.ok);
+      assert.notEqual(alignment.index, protection.index);
+
+      const gotAlignment = wb.getDxf(alignment.index);
+      assert.ok(gotAlignment.status.ok);
+      assert.equal(gotAlignment.alignmentXml, alignmentXml);
+      assert.equal(gotAlignment.protectionXml, undefined);
+      const gotProtection = wb.getDxf(protection.index);
+      assert.ok(gotProtection.status.ok);
+      assert.equal(gotProtection.alignmentXml, undefined);
+      assert.equal(gotProtection.protectionXml, protectionXml);
+
+      const alignmentAgain = wb.addDxf(gotAlignment);
+      assert.ok(alignmentAgain.status.ok);
+      assert.equal(alignmentAgain.index, alignment.index);
+      const protectionAgain = wb.addDxf(gotProtection);
+      assert.ok(protectionAgain.status.ok);
+      assert.equal(protectionAgain.index, protection.index);
+
+      const saved = wb.save();
+      assert.ok(saved.status.ok);
+      const loaded = Module.Workbook.loadBytes(saved.bytes);
+      try {
+        assert.ok(loaded.isValid());
+        const loadedAlignment = loaded.getDxf(alignment.index);
+        assert.ok(loadedAlignment.status.ok);
+        assert.equal(loadedAlignment.alignmentXml, alignmentXml);
+        assert.equal(loadedAlignment.protectionXml, undefined);
+        const loadedProtection = loaded.getDxf(protection.index);
+        assert.ok(loadedProtection.status.ok);
+        assert.equal(loadedProtection.alignmentXml, undefined);
+        assert.equal(loadedProtection.protectionXml, protectionXml);
+        const loadedAlignmentAgain = loaded.addDxf(loadedAlignment);
+        assert.ok(loadedAlignmentAgain.status.ok);
+        assert.equal(loadedAlignmentAgain.index, alignment.index);
+        const loadedProtectionAgain = loaded.addDxf(loadedProtection);
+        assert.ok(loadedProtectionAgain.status.ok);
+        assert.equal(loadedProtectionAgain.index, protection.index);
+      } finally {
+        loaded.delete();
+      }
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('addFont / getFont preserve superscript and subscript', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const superscript = wb.addFont({ name: 'Arial', size: 12, vertAlign: 1 });
+      assert.ok(superscript.status.ok);
+      assert.equal(wb.getFont(superscript.index).vertAlign, 1);
+
+      const subscript = wb.addFont({ name: 'Arial', size: 12, vertAlign: 2 });
+      assert.ok(subscript.status.ok);
+      assert.notEqual(subscript.index, superscript.index);
+      assert.equal(wb.getFont(subscript.index).vertAlign, 2);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('addFont(getFont(i)) is the identity and does not grow the table', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const added = wb.addFont({ name: 'Arial', size: 12, vertAlign: 1, colorArgb: 0xff112233 });
+      assert.ok(added.status.ok);
+      const before = wb.fontCount().value;
+      const readBack = wb.getFont(added.index);
+      const again = wb.addFont(readBack);
+      assert.ok(again.status.ok);
+      assert.equal(again.index, added.index);
+      assert.equal(wb.fontCount().value, before);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('a one-field font rewrite keeps the superscript', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const added = wb.addFont({ name: 'Arial', size: 12, vertAlign: 1, colorArgb: 0xff112233 });
+      assert.ok(added.status.ok);
+      const edited = wb.getFont(added.index);
+      edited.colorArgb = 0xff00ff00;
+      const recolored = wb.addFont(edited);
+      assert.ok(recolored.status.ok);
+      assert.notEqual(recolored.index, added.index);
+      const reread = wb.getFont(recolored.index);
+      assert.equal(reread.vertAlign, 1);
+      assert.equal(reread.colorArgb, 0xff00ff00);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('addDxf / getDxf round-trip a superscript differential font', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const added = wb.addDxf({ font: { name: 'Calibri', size: 9, vertAlign: 1 } });
+      assert.ok(added.status.ok);
+      const readBack = wb.getDxf(added.index);
+      assert.equal(readBack.font.vertAlign, 1);
+      const before = wb.dxfCount().value;
+      const again = wb.addDxf(readBack);
+      assert.ok(again.status.ok);
+      assert.equal(again.index, added.index);
+      assert.equal(wb.dxfCount().value, before);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('addXf rejects out-of-range font_index', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const r = wb.addXf({
+        fontIndex: 99,
+        fillIndex: 0,
+        borderIndex: 0,
+        numFmtId: 0,
+        horizontalAlign: 0,
+        verticalAlign: 0,
+        wrapText: false,
+      });
+      assert.ok(!r.status.ok, 'expected addXf to reject out-of-range font_index');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('style narrow numeric fields throw on masked values without mutating tables', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const assertRejected = (label, invoke, count) => {
+        assert.throws(invoke, RangeError, `${label} accepted`);
+        assert.equal(count(), count.before, `${label}: mutation changed table count`);
+      };
+
+      const fontCount = () => wb.fontCount().value;
+      fontCount.before = fontCount();
+      assertRejected('font.underline=256', () => wb.addFont({ name: 'bad-u8', underline: 256 }), fontCount);
+
+      const fillCount = () => wb.fillCount().value;
+      fillCount.before = fillCount();
+      assertRejected('fill.pattern=256', () => wb.addFill({ pattern: 256 }), fillCount);
+
+      const borderCount = () => wb.borderCount().value;
+      borderCount.before = borderCount();
+      assertRejected('border.left.style=256', () => wb.addBorder({ left: { style: 256 } }), borderCount);
+
+      const xfCount = () => wb.xfCount().value;
+      xfCount.before = xfCount();
+      assertRejected(
+        'xf.numFmtId=65536',
+        () => wb.addXf({ fontIndex: 0, fillIndex: 0, borderIndex: 0, numFmtId: 65536 }),
+        xfCount,
+      );
+
+      const dxfCount = () => wb.dxfCount().value;
+      dxfCount.before = dxfCount();
+      assertRejected('dxf.numFmt.numFmtId=65536', () => wb.addDxf({ numFmt: { numFmtId: 65536 } }), dxfCount);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('style nested numeric fields throw on fractions, non-finite values, and wrong primitives', () => {
+    const invalid = [1.5, Number.NaN, Number.POSITIVE_INFINITY, '1', true, {}, Symbol('numeric')];
+    for (const value of invalid) {
+      const wb = Module.Workbook.createDefault();
+      try {
+        const before = wb.fontCount().value;
+        assert.throws(
+          () => wb.addFont({ name: 'bad-value', underline: value }),
+          isNestedRangeValue(value) ? RangeError : TypeError,
+          `font.underline=${String(value)} accepted`,
+        );
+        assert.equal(wb.fontCount().value, before, `font.underline=${String(value)} mutated table`);
+      } finally {
+        wb.delete();
+      }
+    }
+  });
+
+  test('style and conditional-format u32/i32 fields throw on wraparound values', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const xfBefore = wb.xfCount().value;
+      assert.throws(() => wb.addXf({ fontIndex: 0x100000000, fillIndex: 0, borderIndex: 0 }), RangeError);
+      assert.equal(wb.xfCount().value, xfBefore);
+
+      const fontBefore = wb.fontCount().value;
+      assert.throws(() => wb.addFont({ name: 'bad-u32', colorArgb: 0x100000000 }), RangeError);
+      assert.equal(wb.fontCount().value, fontBefore);
+
+      const styleXfBefore = wb.cellStyleXfCount().value;
+      assert.throws(
+        () => wb.addCellStyleXf({ fontIndex: 0, fillIndex: 0, borderIndex: 0, xfId: 0x100000000 }),
+        RangeError,
+      );
+      assert.equal(wb.cellStyleXfCount().value, styleXfBefore);
+
+      const themeBefore = wb.getTheme().colors;
+      assert.throws(() => wb.setThemeColors([0x100000000, ...themeBefore.slice(1)]), RangeError);
+      assert.deepEqual(wb.getTheme().colors, themeBefore);
+
+      const dxf = wb.addDxf({ font: { name: 'cf-dxf' } });
+      assert.ok(dxf.status.ok);
+      const base = {
+        sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+        type: 3,
+        priority: 0x100000000,
+        dxfId: dxf.index,
+        dataBar: { min: { type: 3 }, max: { type: 4 }, fill: { r: 1, g: 2, b: 3 } },
+      };
+      const cfBefore = wb.getConditionalFormats(0).length;
+      assert.throws(() => wb.addConditionalFormat(0, base), RangeError);
+      assert.equal(wb.getConditionalFormats(0).length, cfBefore);
+
+      const rangeRule = structuredClone(base);
+      rangeRule.priority = 0;
+      rangeRule.sqref[0].firstRow = 0x100000000;
+      assert.throws(() => wb.addConditionalFormat(0, rangeRule), RangeError);
+      assert.equal(wb.getConditionalFormats(0).length, cfBefore);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('style nullish narrow fields retain their existing defaults', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const absentFont = wb.addFont({ name: 'nullish-font' });
+      assert.ok(absentFont.status.ok);
+      assert.equal(wb.getFont(absentFont.index).underline, 0);
+      const nullFont = wb.addFont({ name: 'null-font', underline: null });
+      assert.ok(nullFont.status.ok);
+      assert.equal(wb.getFont(nullFont.index).underline, 0);
+      const undefinedFont = wb.addFont({ name: 'undefined-font', underline: undefined });
+      assert.ok(undefinedFont.status.ok);
+      assert.equal(wb.getFont(undefinedFont.index).underline, 0);
+
+      const fill = wb.addFill({ pattern: null });
+      assert.ok(fill.status.ok);
+      assert.equal(wb.getFill(fill.index).pattern, 0);
+
+      const border = wb.addBorder({ left: { style: undefined } });
+      assert.ok(border.status.ok);
+      assert.equal(wb.getBorder(border.index).left.style, 0);
+
+      const xf = wb.addXf({ fontIndex: 0, fillIndex: 0, borderIndex: 0, numFmtId: null });
+      assert.ok(xf.status.ok);
+      assert.equal(wb.getCellXf(xf.index).numFmtId, 0);
+
+      const dxf = wb.addDxf({ numFmt: { numFmtId: undefined } });
+      assert.ok(dxf.status.ok);
+      assert.equal(wb.getDxf(dxf.index).numFmt.numFmtId, 0);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('conditional-format nested narrow numeric fields throw on masked values without mutation', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const base = {
+        sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+        type: 3,
+        dataBar: {
+          min: { type: 3 },
+          max: { type: 4 },
+          fill: { r: 1, g: 2, b: 3 },
+        },
+      };
+      const invalid = [
+        ['dataBar.fill.r=256', { dataBar: { fill: { r: 256 } } }],
+        ['dataBar.minLengthPct=256', { dataBar: { minLengthPct: 256 } }],
+        ['dataBar.maxLengthPct=256', { dataBar: { maxLengthPct: 256 } }],
+        ['cfvo.type=256', { dataBar: { min: { type: 256 } } }],
+      ];
+      for (const [label, override] of invalid) {
+        const before = wb.getConditionalFormats(0).length;
+        const rule = structuredClone(base);
+        Object.assign(rule.dataBar, override.dataBar);
+        if (override.dataBar.min) {
+          rule.dataBar.min = override.dataBar.min;
+        }
+        assert.throws(() => wb.addConditionalFormat(0, rule), RangeError, `${label} accepted`);
+        assert.equal(wb.getConditionalFormats(0).length, before, `${label}: mutation changed count`);
+      }
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('conditional-format nested numeric fields throw on wrong primitives and preserve settings', () => {
+    const values = [1.5, Number.NaN, Number.POSITIVE_INFINITY, '1', true, {}, Symbol('cf-numeric')];
+    for (const value of values) {
+      const wb = Module.Workbook.createDefault();
+      try {
+        const rule = {
+          sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+          type: 3,
+          dataBar: {
+            min: { type: 3 },
+            max: { type: 4 },
+            fill: { r: value, g: 2, b: 3 },
+          },
+        };
+        assert.throws(
+          () => wb.addConditionalFormat(0, rule),
+          isNestedRangeValue(value) ? RangeError : TypeError,
+          `dataBar.fill.r=${String(value)} accepted`,
+        );
+        assert.equal(wb.getConditionalFormats(0).length, 0, `dataBar.fill.r=${String(value)} mutated rules`);
+      } finally {
+        wb.delete();
+      }
+    }
+  });
+
+  test('conditional-format nullish nested fields retain existing defaults', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      const result = wb.addConditionalFormat(0, {
+        sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+        type: 3,
+        dataBar: {
+          min: { type: 3, gte: null },
+          max: { type: 4, gte: undefined },
+          fill: { r: null, g: undefined, b: 3, a: null },
+          minLengthPct: null,
+          maxLengthPct: undefined,
+          axisPosition: null,
+          direction: undefined,
+        },
+      });
+      assert.ok(result.status.ok, JSON.stringify(result.status));
+      const bar = wb.getConditionalFormats(0)[0].dataBar;
+      assert.equal(bar.fill.r, 0);
+      assert.equal(bar.fill.g, 0);
+      assert.equal(bar.fill.b, 3);
+      assert.equal(bar.fill.a, 255);
+      assert.equal(bar.minLengthPct, 10);
+      assert.equal(bar.maxLengthPct, 90);
+      assert.equal(bar.axisPosition, 0);
+      assert.equal(bar.direction, 0);
+      assert.equal(wb.getConditionalFormats(0)[0].dataBar.min.gte, true);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('style and conditional-format readers snapshot stateful fields once', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      let horizontalReads = 0;
+      const xfSpec = {};
+      Object.defineProperty(xfSpec, 'horizontalAlign', {
+        get() {
+          horizontalReads += 1;
+          return horizontalReads === 1 ? 1 : undefined;
+        },
+      });
+      const xf = wb.addXf(xfSpec);
+      assert.ok(xf.status.ok, JSON.stringify(xf.status));
+      assert.equal(horizontalReads, 1);
+      const storedXf = wb.getCellXf(xf.index);
+      assert.equal(storedXf.horizontalAlign, 1);
+      assert.equal(storedXf.hasHorizontalAlign, true);
+
+      const firstDxf = wb.addDxf({ font: { name: 'first' } });
+      const secondDxf = wb.addDxf({ font: { name: 'second' } });
+      assert.ok(firstDxf.status.ok, JSON.stringify(firstDxf.status));
+      assert.ok(secondDxf.status.ok, JSON.stringify(secondDxf.status));
+      let dxfReads = 0;
+      const rule = {
+        sqref: [{ firstRow: 0, firstCol: 0, lastRow: 0, lastCol: 0 }],
+        type: 3,
+        dataBar: {
+          min: { type: 3 },
+          max: { type: 4 },
+          fill: { r: 1, g: 2, b: 3 },
+        },
+      };
+      Object.defineProperty(rule, 'dxfId', {
+        get() {
+          dxfReads += 1;
+          return dxfReads === 1 ? secondDxf.index : undefined;
+        },
+      });
+      const cf = wb.addConditionalFormat(0, rule);
+      assert.ok(cf.status.ok, JSON.stringify(cf.status));
+      assert.equal(dxfReads, 1);
+      assert.equal(wb.getConditionalFormats(0)[0].dxfId, secondDxf.index);
+
+      const lateFont = { name: 'late font '.repeat(1024) };
+      Object.defineProperty(lateFont, 'size', {
+        get() {
+          throw new Error('late font getter');
+        },
+      });
+      const beforeFonts = wb.fontCount().value;
+      for (let i = 0; i < 8; i += 1) {
+        assert.throws(() => wb.addFont(lateFont), /late font getter/);
+      }
+      assert.equal(wb.fontCount().value, beforeFonts);
+    } finally {
+      wb.delete();
+    }
+  });
+}
diff --git a/tests/wasm/run_surface_recalc.mjs b/tests/wasm/run_surface_recalc.mjs
new file mode 100644
index 000000000..09628aa1d
--- /dev/null
+++ b/tests/wasm/run_surface_recalc.mjs
@@ -0,0 +1,273 @@
+import assert from 'node:assert/strict';
+import { VAL } from './smoke_support.mjs';
+
+export function registerSurfaceRecalc(Module, test, threadsBuild) {
+  test('versionString is non-empty', () => {
+    const v = Module.versionString();
+    assert.equal(typeof v, 'string');
+    assert.ok(v.length > 0, `expected non-empty version, got ${JSON.stringify(v)}`);
+  });
+
+  test('statusString covers known codes', () => {
+    assert.equal(Module.statusString(0), 'kOk');
+    // Unknown / out-of-band codes still return a non-null string.
+    const unknown = Module.statusString(123456);
+    assert.equal(typeof unknown, 'string');
+    assert.ok(unknown.length > 0);
+  });
+
+  test('errorDisplayName returns Excel literals', () => {
+    assert.equal(Module.errorDisplayName(1), '#DIV/0!');
+    assert.equal(Module.errorDisplayName(999), '#UNKNOWN!');
+  });
+
+  test('evalFormula(=SUM(1,2,3)) returns NUMBER 6', () => {
+    const r = Module.evalFormula('=SUM(1,2,3)');
+    assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+    assert.equal(r.value.kind, VAL.NUMBER);
+    assert.equal(r.value.number, 6);
+  });
+
+  test('evalFormula(=IF(TRUE,1,2)) returns NUMBER 1', () => {
+    const r = Module.evalFormula('=IF(TRUE,1,2)');
+    assert.ok(r.status.ok);
+    assert.equal(r.value.kind, VAL.NUMBER);
+    assert.equal(r.value.number, 1);
+  });
+
+  test('evalFormula evaluates intersection read-only and returns #NULL!', () => {
+    const r = Module.evalFormula('=A1 B1');
+    assert.ok(r.status.ok, `status=${JSON.stringify(r.status)}`);
+    assert.equal(r.value.kind, VAL.ERROR);
+    assert.equal(r.value.errorCode, 0); // ErrorCode::Null / #NULL!
+  });
+
+  test('evalFormula(=CONCAT) returns TEXT "hello world"', () => {
+    const r = Module.evalFormula('=CONCAT("hello"," ","world")');
+    assert.ok(r.status.ok);
+    assert.equal(r.value.kind, VAL.TEXT);
+    assert.equal(r.value.text, 'hello world');
+  });
+
+  test('numeric comparisons share the 15-digit bucket without fuzzy exact lookups', () => {
+    const operators = [
+      ['=', 1],
+      ['<>', 0],
+      ['<', 0],
+      ['<=', 1],
+      ['>', 0],
+      ['>=', 1],
+    ];
+    for (const [operator, expected] of operators) {
+      const r = Module.evalFormula(`=7.1${operator}7.1000000000000005`);
+      assert.ok(r.status.ok, `operator=${operator} status=${JSON.stringify(r.status)}`);
+      assert.equal(r.value.kind, VAL.BOOL, `operator=${operator}`);
+      assert.equal(r.value.boolean, expected, `operator=${operator}`);
+    }
+
+    // MATCH and XLOOKUP exact modes intentionally retain literal IEEE equality;
+    // the formula comparison bucket must not make their exact guards fuzzy.
+    // Populate the two worksheet values through setNumber so the parser's
+    // decimal-literal canonicalisation cannot collapse the adjacent doubles.
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.setNumber(0, 0, 0, 7.1).ok);
+      assert.ok(wb.setNumber(0, 1, 0, 7.1000000000000005).ok);
+      assert.ok(wb.setFormula(0, 2, 0, '=MATCH(A2,A1:A1,0)').ok);
+      assert.ok(wb.setFormula(0, 3, 0, '=XLOOKUP(A2,A1:A1,A1:A1,"MISS",0)').ok);
+      assert.ok(wb.recalc().ok);
+
+      const match = wb.getValue(0, 2, 0);
+      assert.ok(match.status.ok, `MATCH status=${JSON.stringify(match.status)}`);
+      assert.equal(match.value.kind, VAL.ERROR);
+      assert.equal(match.value.errorCode, 6); // ErrorCode::NA / #N/A.
+
+      const xlookup = wb.getValue(0, 3, 0);
+      assert.ok(xlookup.status.ok, `XLOOKUP status=${JSON.stringify(xlookup.status)}`);
+      assert.equal(xlookup.value.kind, VAL.TEXT);
+      assert.equal(xlookup.value.text, 'MISS');
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('Workbook construction + setNumber + recalc + getValue', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      assert.ok(wb.isValid());
+      assert.equal(wb.sheetCount().value, 1);
+      const nameRes = wb.sheetName(0);
+      assert.ok(nameRes.status.ok);
+      assert.equal(nameRes.value, 'Sheet1');
+
+      assert.ok(wb.setNumber(0, 0, 0, 42).ok);
+      assert.ok(wb.setFormula(0, 1, 0, '=A1*2').ok);
+      assert.ok(wb.recalc().ok);
+
+      const a1 = wb.getValue(0, 0, 0);
+      assert.ok(a1.status.ok);
+      assert.equal(a1.value.kind, VAL.NUMBER);
+      assert.equal(a1.value.number, 42);
+
+      const b1 = wb.getValue(0, 1, 0);
+      assert.ok(b1.status.ok);
+      assert.equal(b1.value.kind, VAL.NUMBER);
+      assert.equal(b1.value.number, 84);
+
+      // addSheet should grow sheetCount.
+      assert.ok(wb.addSheet('Second').ok);
+      assert.equal(wb.sheetCount().value, 2);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('Workbook.recalcParallel evaluates a wide DAG and reports bounded telemetry', () => {
+    const wb = Module.Workbook.createDefault();
+    const branchCount = 32;
+    try {
+      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+      for (let i = 0; i < branchCount; i += 1) {
+        const row = i + 1;
+        assert.ok(wb.setFormula(0, row, 1, `=A1+${i + 2}`).ok);
+        assert.ok(wb.setFormula(0, row, 2, `=B${row + 1}*2`).ok);
+      }
+
+      const parallel = wb.recalcParallel(4);
+      assert.ok(parallel.status.ok, `status=${JSON.stringify(parallel.status)}`);
+      assert.equal(typeof parallel.stats.cellsEvaluated, 'number');
+      assert.equal(typeof parallel.stats.sccsProcessed, 'number');
+      assert.equal(typeof parallel.stats.parallelSteps, 'number');
+      assert.ok(parallel.stats.cellsEvaluated > 0);
+      assert.ok(parallel.stats.sccsProcessed > 0);
+      if (!threadsBuild) {
+        // Without pthreads every launch is refused, so the pass runs serially.
+        assert.equal(parallel.stats.workerThreadsStarted, 0);
+      }
+      if (parallel.stats.workerThreadsStarted <= 1) {
+        // OS launch refusal or a partial launch of one worker is a documented
+        // successful serial degradation.
+        assert.equal(parallel.stats.workerThreadsUsed, 0);
+        assert.equal(parallel.stats.parallelSteps, 0);
+        assert.ok(parallel.stats.serialFallbackSteps > 0, `stats=${JSON.stringify(parallel.stats)}`);
+      } else {
+        assert.ok(parallel.stats.parallelSteps > 0, `stats=${JSON.stringify(parallel.stats)}`);
+        assert.ok(parallel.stats.workerThreadsStarted >= 2);
+        assert.ok(parallel.stats.workerThreadsStarted <= 4);
+        assert.ok(parallel.stats.workerThreadsUsed > 0);
+        assert.ok(parallel.stats.workerThreadsUsed <= parallel.stats.workerThreadsStarted);
+      }
+
+      const first = wb.getValue(0, 1, 1);
+      const last = wb.getValue(0, branchCount, 2);
+      assert.ok(first.status.ok);
+      assert.ok(last.status.ok);
+      assert.equal(first.value.kind, VAL.NUMBER);
+      assert.equal(last.value.kind, VAL.NUMBER);
+      assert.equal(first.value.number, 3);
+      assert.equal(last.value.number, (1 + branchCount + 1) * 2);
+
+      assert.ok(wb.setNumber(0, 0, 0, 5).ok);
+      const callerOnly = wb.recalcParallel(1);
+      assert.ok(callerOnly.status.ok, `status=${JSON.stringify(callerOnly.status)}`);
+      assert.equal(callerOnly.stats.parallelSteps, 0);
+      assert.ok(callerOnly.stats.serialFallbackSteps > 0);
+      assert.equal(callerOnly.stats.workerThreadsStarted, 0);
+      assert.equal(callerOnly.stats.workerThreadsUsed, 0);
+      assert.equal(wb.getValue(0, branchCount, 2).value.number, (5 + branchCount + 1) * 2);
+
+      const invalid = wb.recalcParallel(9);
+      assert.equal(invalid.status.ok, false);
+      assert.notEqual(invalid.status.status, 0);
+      assert.equal(invalid.stats.cellsEvaluated, 0);
+      assert.equal(invalid.stats.sccsProcessed, 0);
+      assert.equal(invalid.stats.parallelSteps, 0);
+      assert.equal(invalid.stats.serialFallbackSteps, 0);
+      assert.equal(invalid.stats.cycleRecoveries, 0);
+      assert.equal(invalid.stats.workerThreadsStarted, 0);
+      assert.equal(invalid.stats.workerThreadsUsed, 0);
+
+      for (const invalidThreadCount of [
+        -0.5,
+        1.5,
+        Number.NaN,
+        Number.POSITIVE_INFINITY,
+        Number.NEGATIVE_INFINITY,
+        2 ** 32 + 1,
+        null,
+        undefined,
+      ]) {
+        const invalidShape = wb.recalcParallel(invalidThreadCount);
+        assert.equal(invalidShape.status.ok, false, `threadCount=${String(invalidThreadCount)}`);
+        assert.notEqual(invalidShape.status.status, 0);
+        assert.equal(invalidShape.stats.cellsEvaluated, 0);
+        assert.equal(invalidShape.stats.sccsProcessed, 0);
+        assert.equal(invalidShape.stats.parallelSteps, 0);
+        assert.equal(invalidShape.stats.serialFallbackSteps, 0);
+        assert.equal(invalidShape.stats.cycleRecoveries, 0);
+        assert.equal(invalidShape.stats.workerThreadsStarted, 0);
+        assert.equal(invalidShape.stats.workerThreadsUsed, 0);
+      }
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('paginate exposes a status envelope and page geometry', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      // Asserts the envelope's shape, not the page geometry: how many rows
+      // fit a page is the print engine's business and is pinned by the
+      // native print suite against Excel. Row 400 is far enough down to
+      // force a break under any plausible body height.
+      assert.ok(wb.setNumber(0, 0, 0, 1).ok);
+      assert.ok(wb.setNumber(0, 400, 0, 2).ok);
+      const result = wb.paginate(0);
+      assert.ok(result.status.ok, `status=${JSON.stringify(result.status)}`);
+      assert.ok(result.pageCount >= 2, `pageCount=${result.pageCount}`);
+      assert.deepEqual(result.printArea, []);
+      assert.ok(result.horizontalBreaks.length > 0);
+      assert.deepEqual(
+        result.horizontalBreaks,
+        [...new Set(result.horizontalBreaks)].sort((a, b) => a - b),
+      );
+      assert.deepEqual(result.verticalBreaks, []);
+    } finally {
+      wb.delete();
+    }
+  });
+
+  test('setPinnedNow / pinnedNow / clearPinnedNow drive the clock seam', () => {
+    const wb = Module.Workbook.createDefault();
+    try {
+      // Unpinned by default: the workbook follows the host clock.
+      assert.equal(wb.pinnedNow().now, null);
+
+      assert.ok(wb.setPinnedNow(2026, 4, 23, 15, 30, 45).ok);
+      assert.deepEqual(wb.pinnedNow().now, {
+        year: 2026,
+        month: 4,
+        day: 23,
+        hour: 15,
+        minute: 30,
+        second: 45,
+      });
+
+      // 2026-04-23 is serial 46135 under the 1900 date system.
+      assert.ok(wb.setFormula(0, 0, 0, '=TODAY()').ok);
+      assert.ok(wb.recalc().ok);
+      const a1 = wb.getValue(0, 0, 0);
+      assert.equal(a1.value.kind, VAL.NUMBER);
+      assert.equal(a1.value.number, 46135);
+
+      // The pin is a calendar instant, not a normalising constructor.
+      assert.equal(wb.setPinnedNow(2026, 13, 1, 0, 0, 0).ok, false);
+      assert.equal(wb.setPinnedNow(2025, 2, 29, 0, 0, 0).ok, false);
+
+      assert.ok(wb.clearPinnedNow().ok);
+      assert.equal(wb.pinnedNow().now, null);
+    } finally {
+      wb.delete();
+    }
+  });
+}
diff --git a/tests/wasm/run_theme_styles.mjs b/tests/wasm/run_theme_styles.mjs
new file mode 100644
index 000000000..a3a76222c
--- /dev/null
+++ b/tests/wasm/run_theme_styles.mjs
@@ -0,0 +1,202 @@
+import assert from 'node:assert/strict';
+
+const SOURCE_PART = 0;
+const SOURCE_DEFAULT = 1;
+const CONTEXT_FONT = 0;
+const CONTEXT_FILL_FG = 1;
+const RESOLUTION_EXACT = 0;
+const RESOLUTION_DEFAULT_THEME = 1;
+const RESOLUTION_INDEX_OUT_OF_RANGE = 2;
+const RESOLUTION_AUTO_CONTEXT = 4;
+const ACCENT1_DEFAULT = 0xff4472c4;
+
+function withWorkbook(Module, fn) {
+  const wb = Module.Workbook.createDefault();
+  try {
+    fn(wb);
+  } finally {
+    wb.delete();
+  }
+}
+
+const themeSpec = (theme, tint) => ({ kind: 2, rgb: 0, theme, tint, indexed: 0 });
+
+export function registerThemeStyles(Module, test) {
+  test('getTheme reports the default theme until a part exists', () => {
+    withWorkbook(Module, (wb) => {
+      const t = wb.getTheme();
+      assert.ok(t.status.ok);
+      assert.equal(t.source, SOURCE_DEFAULT);
+      assert.equal(t.colors.length, 12);
+      assert.equal(t.colors[4], ACCENT1_DEFAULT);
+      assert.equal(t.fonts.majorLatin, 'Calibri Light');
+      assert.equal(t.fonts.minorLatin, 'Calibri');
+      assert.equal(typeof t.fonts.minorEastAsian, 'string');
+      assert.ok(t.fonts.minorEastAsian.length > 0);
+    });
+  });
+
+  test('setThemeColors / setThemeFonts persist through save and reload', () => {
+    withWorkbook(Module, (wb) => {
+      const colors = Array.from({ length: 12 }, (_, i) => 0xff101010 + i);
+      assert.ok(wb.setThemeColors(colors).ok);
+      assert.ok(
+        wb.setThemeFonts({
+          majorLatin: 'Arial',
+          majorEastAsian: 'MS Gothic',
+          minorLatin: 'Verdana',
+          minorEastAsian: 'MS Mincho',
+        }).ok,
+      );
+      const live = wb.getTheme();
+      assert.equal(live.source, SOURCE_PART);
+      assert.deepEqual(live.colors, colors);
+      assert.equal(live.fonts.majorLatin, 'Arial');
+
+      const saved = wb.save();
+      assert.ok(saved.status.ok);
+      const reloaded = Module.Workbook.loadBytes(saved.bytes);
+      try {
+        const t = reloaded.getTheme();
+        assert.equal(t.source, SOURCE_PART);
+        assert.deepEqual(t.colors, colors);
+        assert.equal(t.fonts.minorLatin, 'Verdana');
+        assert.equal(t.fonts.minorEastAsian, 'MS Mincho');
+      } finally {
+        reloaded.delete();
+      }
+    });
+  });
+
+  test('setThemeColors rejects a malformed colour list', () => {
+    withWorkbook(Module, (wb) => {
+      assert.equal(wb.setThemeColors([1, 2, 3]).ok, false);
+      assert.equal(wb.setThemeColors(null).ok, false);
+    });
+  });
+
+  test('resolveColor reports how each colour was resolved', () => {
+    withWorkbook(Module, (wb) => {
+      const rgb = wb.resolveColor({ kind: 1, rgb: 0xff123456, theme: 0, tint: 0, indexed: 0 }, CONTEXT_FILL_FG);
+      assert.ok(rgb.status.ok);
+      assert.equal(rgb.argb, 0xff123456);
+      assert.equal(rgb.resolution, RESOLUTION_EXACT);
+
+      const fromDefault = wb.resolveColor(themeSpec(4, 0), CONTEXT_FONT);
+      assert.equal(fromDefault.argb, ACCENT1_DEFAULT);
+      assert.equal(fromDefault.resolution, RESOLUTION_DEFAULT_THEME);
+
+      assert.ok(wb.setThemeColors(wb.getTheme().colors).ok);
+      const lighter = wb.resolveColor(themeSpec(4, 0.4), CONTEXT_FILL_FG);
+      assert.equal(lighter.argb, 0xff8ea9db);
+      assert.equal(lighter.resolution, RESOLUTION_EXACT);
+      assert.equal(wb.resolveColor(themeSpec(0, 0), CONTEXT_FONT).argb, 0xffffffff);
+
+      const outOfRange = wb.resolveColor(themeSpec(12, 0), CONTEXT_FONT);
+      assert.equal(outOfRange.argb, 0xff000000);
+      assert.equal(outOfRange.resolution, RESOLUTION_INDEX_OUT_OF_RANGE);
+
+      const auto = { kind: 4, rgb: 0, theme: 0, tint: 0, indexed: 0 };
+      assert.equal(wb.resolveColor(auto, CONTEXT_FONT).argb, 0xff000000);
+      const fill = wb.resolveColor(auto, CONTEXT_FILL_FG);
+      assert.equal(fill.argb, 0xffffffff);
+      assert.equal(fill.resolution, RESOLUTION_AUTO_CONTEXT);
+
+      assert.equal(wb.resolveColor(themeSpec(4, Number.NaN), CONTEXT_FONT).status.ok, false);
+      assert.equal(wb.resolveColor(auto, 99).status.ok, false);
+    });
+  });
+
+  test('getEffectiveStyle resolves the xf a cell shows', () => {
+    withWorkbook(Module, (wb) => {
+      const font = wb.addFont({
+        name: 'Arial',
+        size: 11,
+        bold: false,
+        italic: false,
+        strike: false,
+        underline: 0,
+        colorArgb: 0,
+        color: themeSpec(4, 0),
+      });
+      const fill = wb.addFill({
+        pattern: 1,
+        fgArgb: 0xffff0000,
+        bgArgb: 0,
+        fg: { kind: 1, rgb: 0xffff0000, theme: 0, tint: 0, indexed: 0 },
+        bg: { kind: 4, rgb: 0, theme: 0, tint: 0, indexed: 0 },
+      });
+      const xf = wb.addXf({
+        fontIndex: font.index,
+        fillIndex: fill.index,
+        borderIndex: 0,
+        numFmtId: 14,
+        locked: false,
+        hidden: true,
+      });
+      assert.ok(xf.status.ok, JSON.stringify(xf.status));
+      assert.ok(wb.setCellXfIndex(0, 0, 0, xf.index).ok);
+
+      const e = wb.getEffectiveStyle(0, 0, 0);
+      assert.ok(e.status.ok);
+      assert.equal(e.xfIndex, xf.index);
+      assert.equal(e.source, 0);
+      assert.equal(e.fontIndex, font.index);
+      assert.equal(e.fillIndex, fill.index);
+      assert.equal(e.font.argb, ACCENT1_DEFAULT);
+      assert.equal(e.font.resolution, RESOLUTION_DEFAULT_THEME);
+      assert.equal(e.fillForeground.argb, 0xffff0000);
+      assert.equal(e.fillBackground.resolution, RESOLUTION_AUTO_CONTEXT);
+      assert.deepEqual(Object.keys(e.borders), ['left', 'right', 'top', 'bottom', 'diagonal']);
+      assert.equal(e.borders.left.resolution, RESOLUTION_AUTO_CONTEXT);
+      assert.equal(e.locked, false);
+      assert.equal(e.hidden, true);
+      assert.equal(e.numFmtCode, 'mm-dd-yy');
+
+      const plain = wb.getEffectiveStyle(0, 5, 5);
+      assert.ok(plain.status.ok);
+      assert.equal(plain.source, 3);
+      assert.equal(plain.xfIndex, 0);
+      assert.equal(plain.locked, true);
+      assert.equal(plain.numFmtCode, 'General');
+
+      assert.equal(wb.getEffectiveStyle(99, 0, 0).status.ok, false);
+    });
+  });
+
+  test('setCellStyle takes a record and removeCellStyle repoints formats', () => {
+    withWorkbook(Module, (wb) => {
+      const before = wb.cellStyleCount().value;
+      const styleXf = wb.addCellStyleXf({ numFmtId: 14 });
+      assert.ok(styleXf.status.ok);
+      assert.ok(wb.setCellStyle({ name: 'Dated', xfId: styleXf.index }).ok);
+      assert.equal(wb.cellStyleCount().value, before + 1);
+      let found = null;
+      for (let i = 0; i < wb.cellStyleCount().value; i += 1) {
+        const cs = wb.getCellStyle(i);
+        if (cs.name === 'Dated') found = cs;
+      }
+      assert.ok(found, 'Dated is listed');
+      assert.equal(found.xfId, styleXf.index);
+      assert.equal(found.builtinId, 0xffffffff);
+      assert.equal(found.hidden, false);
+
+      // Replacing by name keeps one entry and takes the new flags.
+      assert.ok(wb.setCellStyle({ name: 'Dated', xfId: styleXf.index, hidden: true, customBuiltin: true }).ok);
+      assert.equal(wb.cellStyleCount().value, before + 1);
+
+      // A built-in ordinal beyond the old 0..47 range round-trips.
+      assert.ok(wb.setCellStyle({ name: 'Normal 2', xfId: 0, builtinId: 53 }).ok);
+      let builtin = null;
+      for (let i = 0; i < wb.cellStyleCount().value; i += 1) {
+        const cs = wb.getCellStyle(i);
+        if (cs.name === 'Normal 2') builtin = cs;
+      }
+      assert.equal(builtin.builtinId, 53);
+
+      assert.ok(wb.removeCellStyle('Dated').ok);
+      assert.equal(wb.cellStyleCount().value, before + 1);
+      assert.equal(wb.removeCellStyle('Dated').ok, false);
+    });
+  });
+}
diff --git a/tests/wasm/smoke_support.mjs b/tests/wasm/smoke_support.mjs
new file mode 100644
index 000000000..5106122e7
--- /dev/null
+++ b/tests/wasm/smoke_support.mjs
@@ -0,0 +1,308 @@
+import assert from 'node:assert/strict';
+import { inflateRawSync } from 'node:zlib';
+
+const VAL = Object.freeze({
+  BLANK: 0,
+  NUMBER: 1,
+  BOOL: 2,
+  TEXT: 3,
+  ERROR: 4,
+  ARRAY: 5,
+  REF: 6,
+  LAMBDA: 7,
+});
+
+// fm_pivot_cell_kind_t mirror (see src/c_api/formulon_c.h).
+const PIVOT = Object.freeze({
+  HEADER: 0,
+  ROW_LABEL: 1,
+  COL_LABEL: 2,
+  DATA: 3,
+  ROW_SUBTOTAL: 4,
+  COL_SUBTOTAL: 5,
+  GRAND_TOTAL: 6,
+  BLANK: 7,
+});
+
+const utf8 = new TextEncoder();
+let crcTable = null;
+
+function crc32(bytes) {
+  if (crcTable === null) {
+    crcTable = new Uint32Array(256);
+    for (let i = 0; i < 256; i += 1) {
+      let c = i;
+      for (let j = 0; j < 8; j += 1) {
+        c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+      }
+      crcTable[i] = c >>> 0;
+    }
+  }
+  let c = 0xffffffff;
+  for (const b of bytes) {
+    c = crcTable[(c ^ b) & 0xff] ^ (c >>> 8);
+  }
+  return (c ^ 0xffffffff) >>> 0;
+}
+
+function pushU16(out, n) {
+  out.push(n & 0xff, (n >>> 8) & 0xff);
+}
+
+function pushU32(out, n) {
+  out.push(n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
+}
+
+function pushBytes(out, bytes) {
+  for (const b of bytes) out.push(b);
+}
+
+function zipStore(parts) {
+  const out = [];
+  const central = [];
+  const entries = parts.map(([name, body]) => ({
+    name: utf8.encode(name),
+    body: utf8.encode(body),
+  }));
+
+  for (const entry of entries) {
+    entry.offset = out.length;
+    entry.crc = crc32(entry.body);
+    pushU32(out, 0x04034b50);
+    pushU16(out, 20);
+    pushU16(out, 0);
+    pushU16(out, 0);
+    pushU16(out, 0);
+    pushU16(out, 0);
+    pushU32(out, entry.crc);
+    pushU32(out, entry.body.length);
+    pushU32(out, entry.body.length);
+    pushU16(out, entry.name.length);
+    pushU16(out, 0);
+    pushBytes(out, entry.name);
+    pushBytes(out, entry.body);
+  }
+
+  const centralOffset = out.length;
+  for (const entry of entries) {
+    pushU32(central, 0x02014b50);
+    pushU16(central, 20);
+    pushU16(central, 20);
+    pushU16(central, 0);
+    pushU16(central, 0);
+    pushU16(central, 0);
+    pushU16(central, 0);
+    pushU32(central, entry.crc);
+    pushU32(central, entry.body.length);
+    pushU32(central, entry.body.length);
+    pushU16(central, entry.name.length);
+    pushU16(central, 0);
+    pushU16(central, 0);
+    pushU16(central, 0);
+    pushU16(central, 0);
+    pushU32(central, 0);
+    pushU32(central, entry.offset);
+    pushBytes(central, entry.name);
+  }
+  pushBytes(out, central);
+
+  pushU32(out, 0x06054b50);
+  pushU16(out, 0);
+  pushU16(out, 0);
+  pushU16(out, entries.length);
+  pushU16(out, entries.length);
+  pushU32(out, central.length);
+  pushU32(out, centralOffset);
+  pushU16(out, 0);
+  return new Uint8Array(out);
+}
+
+function readZipEntryText(bytes, wantedName) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let eocd = bytes.length - 22;
+  while (eocd >= 0 && view.getUint32(eocd, true) !== 0x06054b50) eocd -= 1;
+  assert.ok(eocd >= 0, 'missing ZIP end record');
+  const count = view.getUint16(eocd + 10, true);
+  const centralSize = view.getUint32(eocd + 12, true);
+  const centralOffset = view.getUint32(eocd + 16, true);
+  const decoder = new TextDecoder();
+  let cursor = centralOffset;
+  const wanted = String(wantedName);
+  for (let i = 0; i < count; i += 1) {
+    assert.ok(cursor < centralOffset + centralSize, 'ZIP central directory exceeds its declared size');
+    assert.equal(view.getUint32(cursor, true), 0x02014b50, 'invalid ZIP central entry');
+    const method = view.getUint16(cursor + 10, true);
+    const compressedSize = view.getUint32(cursor + 20, true);
+    const uncompressedSize = view.getUint32(cursor + 24, true);
+    const nameSize = view.getUint16(cursor + 28, true);
+    const extraSize = view.getUint16(cursor + 30, true);
+    const commentSize = view.getUint16(cursor + 32, true);
+    const localOffset = view.getUint32(cursor + 42, true);
+    const name = decoder.decode(bytes.slice(cursor + 46, cursor + 46 + nameSize));
+    if (name === wanted) {
+      assert.ok(localOffset + 30 <= bytes.length);
+      const localNameSize = view.getUint16(localOffset + 26, true);
+      const localExtraSize = view.getUint16(localOffset + 28, true);
+      const start = localOffset + 30 + localNameSize + localExtraSize;
+      const compressed = bytes.slice(start, start + compressedSize);
+      const body = method === 0 ? compressed : Uint8Array.from(inflateRawSync(compressed));
+      assert.equal(body.length, uncompressedSize);
+      return decoder.decode(body);
+    }
+    cursor += 46 + nameSize + extraSize + commentSize;
+  }
+  assert.fail(`ZIP entry not found: ${wanted}`);
+}
+
+function appendEmptyZipEntry(bytes, name) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let eocd = bytes.length - 22;
+  while (eocd >= 0 && view.getUint32(eocd, true) !== 0x06054b50) eocd -= 1;
+  assert.ok(eocd >= 0, 'missing ZIP end record');
+  const count = view.getUint16(eocd + 10, true);
+  const centralSize = view.getUint32(eocd + 12, true);
+  const centralOffset = view.getUint32(eocd + 16, true);
+  const oldCentral = bytes.slice(centralOffset, centralOffset + centralSize);
+  const encodedName = utf8.encode(name);
+  const local = [];
+  pushU32(local, 0x04034b50);
+  pushU16(local, 20);
+  pushU16(local, 0);
+  pushU16(local, 0);
+  pushU16(local, 0);
+  pushU16(local, 0);
+  pushU32(local, 0);
+  pushU32(local, 0);
+  pushU32(local, 0);
+  pushU16(local, encodedName.length);
+  pushU16(local, 0);
+  pushBytes(local, encodedName);
+  const central = [];
+  pushU32(central, 0x02014b50);
+  pushU16(central, 20);
+  pushU16(central, 20);
+  pushU16(central, 0);
+  pushU16(central, 0);
+  pushU16(central, 0);
+  pushU16(central, 0);
+  pushU32(central, 0);
+  pushU32(central, 0);
+  pushU32(central, 0);
+  pushU16(central, encodedName.length);
+  pushU16(central, 0);
+  pushU16(central, 0);
+  pushU16(central, 0);
+  pushU16(central, 0);
+  pushU32(central, 0);
+  pushU32(central, centralOffset);
+  pushBytes(central, encodedName);
+  const out = [];
+  pushBytes(out, bytes.slice(0, centralOffset));
+  pushBytes(out, local);
+  pushBytes(out, oldCentral);
+  pushBytes(out, central);
+  pushU32(out, 0x06054b50);
+  pushU16(out, 0);
+  pushU16(out, 0);
+  pushU16(out, count + 1);
+  pushU16(out, count + 1);
+  pushU32(out, centralSize + central.length);
+  pushU32(out, centralOffset + local.length);
+  pushU16(out, 0);
+  return new Uint8Array(out);
+}
+
+function buildPivotWorkbookBytes() {
+  const sheetXml =
+    '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+    '<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">\n' +
+    '  <sheetData/>\n' +
+    '</worksheet>\n';
+
+  return zipStore([
+    [
+      '[Content_Types].xml',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">\n' +
+        '  <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>\n' +
+        '  <Default Extension="xml" ContentType="application/xml"/>\n' +
+        '  <Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>\n' +
+        '  <Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>\n' +
+        '  <Override PartName="/xl/worksheets/sheet2.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>\n' +
+        '  <Override PartName="/xl/pivotCache/pivotCacheDefinition1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml"/>\n' +
+        '  <Override PartName="/xl/pivotCache/pivotCacheRecords1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheRecords+xml"/>\n' +
+        '  <Override PartName="/xl/pivotTables/pivotTable1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml"/>\n' +
+        '</Types>\n',
+    ],
+    [
+      '_rels/.rels',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">\n' +
+        '  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>\n' +
+        '</Relationships>\n',
+    ],
+    [
+      'xl/workbook.xml',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">\n' +
+        '  <sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/><sheet name="Sheet2" sheetId="2" r:id="rId2"/></sheets>\n' +
+        '  <pivotCaches><pivotCache cacheId="0" r:id="rId3"/></pivotCaches>\n' +
+        '</workbook>\n',
+    ],
+    [
+      'xl/_rels/workbook.xml.rels',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">\n' +
+        '  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/>\n' +
+        '  <Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet2.xml"/>\n' +
+        '  <Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheDefinition" Target="pivotCache/pivotCacheDefinition1.xml"/>\n' +
+        '</Relationships>\n',
+    ],
+    ['xl/worksheets/sheet1.xml', sheetXml],
+    ['xl/worksheets/sheet2.xml', sheetXml],
+    [
+      'xl/worksheets/_rels/sheet2.xml.rels',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">\n' +
+        '  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotTable" Target="../pivotTables/pivotTable1.xml"/>\n' +
+        '</Relationships>\n',
+    ],
+    [
+      'xl/pivotCache/pivotCacheDefinition1.xml',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<pivotCacheDefinition xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" r:id="rId1" recordCount="3">\n' +
+        '  <cacheSource type="worksheet"/>\n' +
+        '  <cacheFields count="2"><cacheField name="Region"><sharedItems count="2"><s v="North"/><s v="South"/></sharedItems></cacheField><cacheField name="Amount"><sharedItems containsNumber="1"/></cacheField></cacheFields>\n' +
+        '</pivotCacheDefinition>\n',
+    ],
+    [
+      'xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">\n' +
+        '  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotCacheRecords" Target="pivotCacheRecords1.xml"/>\n' +
+        '</Relationships>\n',
+    ],
+    [
+      'xl/pivotCache/pivotCacheRecords1.xml',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<pivotCacheRecords xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="3">\n' +
+        '  <r><x v="0"/><n v="100"/></r><r><x v="1"/><n v="200"/></r><r><x v="0"/><n v="300"/></r>\n' +
+        '</pivotCacheRecords>\n',
+    ],
+    [
+      'xl/pivotTables/pivotTable1.xml',
+      '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n' +
+        '<pivotTableDefinition xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" name="PivotTable1" cacheId="0">\n' +
+        '  <location ref="D1:E5"/>\n' +
+        '  <pivotFields count="2"><pivotField axis="axisRow" name="Region"><items count="3"><item x="0"/><item x="1"/><item t="default"/></items></pivotField><pivotField dataField="1" name="Amount"/></pivotFields>\n' +
+        '  <rowFields count="1"><field x="0"/></rowFields><dataFields count="1"><dataField name="Sum of Amount" fld="1" subtotal="sum"/></dataFields>\n' +
+        '</pivotTableDefinition>\n',
+    ],
+  ]);
+}
+
+function findPivotCell(layout, row, col) {
+  return layout.cells.find((cell) => cell.row === row && cell.col === col);
+}
+
+export { appendEmptyZipEntry, buildPivotWorkbookBytes, findPivotCell, PIVOT, readZipEntryText, VAL, zipStore };
diff --git a/tools/bench/wasm_size_report.sh b/tools/bench/wasm_size_report.sh
index 24234e49f..04dbb2e88 100755
--- a/tools/bench/wasm_size_report.sh
+++ b/tools/bench/wasm_size_report.sh
@@ -18,10 +18,10 @@
 # PATH defaults to build-wasm/formulon.wasm.
 #
 # Defaults (per CLAUDE.md "WASM Size Policy"):
-#   --ceiling-bytes             3407872   (3.25 MiB hard ceiling)
-#   --soft-ceiling-bytes        3145728   (3.00 MiB stretch goal)
-#   --brotli-ceiling-bytes      884736    (864 KiB hard ceiling)
-#   --brotli-soft-ceiling-bytes 851968    (832 KiB stretch goal)
+#   --ceiling-bytes             3932160   (3.75 MiB hard ceiling)
+#   --soft-ceiling-bytes        3670016   (3.50 MiB stretch goal)
+#   --brotli-ceiling-bytes      950272    (928 KiB hard ceiling)
+#   --brotli-soft-ceiling-bytes 917504    (896 KiB stretch goal)
 #
 # Brotli wire size is the binding constraint in practice, so it is gated on
 # equal footing with the uncompressed size rather than merely reported. When
@@ -73,10 +73,10 @@ hard ceiling (what fails the build).
 Arguments:
   PATH                            Path to the .wasm file (default: build-wasm/formulon.wasm)
   --json                          Emit a single-object JSON document instead of text.
-  --ceiling-bytes N               Hard ceiling in bytes (default 3407872 = 3.25 MiB).
-  --soft-ceiling-bytes N          Soft ceiling in bytes (default 3145728 = 3.00 MiB).
-  --brotli-ceiling-bytes N        Brotli hard ceiling in bytes (default 884736 = 864 KiB).
-  --brotli-soft-ceiling-bytes N   Brotli soft ceiling in bytes (default 851968 = 832 KiB).
+  --ceiling-bytes N               Hard ceiling in bytes (default 3932160 = 3.75 MiB).
+  --soft-ceiling-bytes N          Soft ceiling in bytes (default 3670016 = 3.50 MiB).
+  --brotli-ceiling-bytes N        Brotli hard ceiling in bytes (default 950272 = 928 KiB).
+  --brotli-soft-ceiling-bytes N   Brotli soft ceiling in bytes (default 917504 = 896 KiB).
   -h, --help                      Show this help.
 
 Exit codes: 0 ok, 1 hard ceiling exceeded, 2 artifact missing, 3 bad args.
@@ -86,10 +86,10 @@ EOF
 # Defaults.
 WASM_PATH=""
 EMIT_JSON=0
-HARD_CEILING=3407872
-SOFT_CEILING=3145728
-BROTLI_HARD_CEILING=884736
-BROTLI_SOFT_CEILING=851968
+HARD_CEILING=3932160
+SOFT_CEILING=3670016
+BROTLI_HARD_CEILING=950272
+BROTLI_SOFT_CEILING=917504
 
 # Argument parsing (POSIX sh, no getopts long-opt support).
 while [ $# -gt 0 ]; do
diff --git a/tools/codegen/gen_wasm_positional_guards.py b/tools/codegen/gen_wasm_positional_guards.py
new file mode 100644
index 000000000..9ffca2444
--- /dev/null
+++ b/tools/codegen/gen_wasm_positional_guards.py
@@ -0,0 +1,540 @@
+#!/usr/bin/env python3
+"""Generate the embind positional-argument guard pre-js.
+
+The N-API binding is the canonical declaration of the primitive positional
+types. Its GuardedInstanceMethod masks are parsed here instead of being
+copied into a second hand-maintained table. The parser is deliberately
+strict: a malformed registration, duplicate name, mask overlap, or binding
+surface drift stops generation before an artifact can be built.
+
+The generated file is passed to emscripten as --pre-js. It contains no
+native code, so the guard lives in the JS glue and does not change the wasm
+module. The same wrapper throws the nested-field rejections the native readers
+record, so a bad field raises TypeError/RangeError as on the Node surface.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterable
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+DEFAULT_NODE_SOURCE = REPO_ROOT / "src/node_addon/parts/workbook_class.cc"
+DEFAULT_WASM_SOURCE = REPO_ROOT / "src/wasm/parts/bindings_register.cpp"
+EXPECTED_NODE_REGISTRATIONS = 274
+
+MASK_NAMES = (
+    "u32",
+    "i32",
+    "u64",
+    "double",
+    "string",
+    "optionalU32",
+    "optionalU64",
+    "optionalNull",
+)
+MASK_TOKEN = re.compile(r"0x([0-9a-fA-F]+)ULL\Z")
+METHOD_MARKER = re.compile(r"\bGuardedInstanceMethod(?=\s*<)")
+WASM_METHOD = re.compile(r"\.function\(\s*\"([A-Za-z0-9_]+)\"")
+WASM_FREE_FUNCTION = re.compile(r"\bfunction\(\s*\"([A-Za-z0-9_]+)\"")
+
+# The Node class has two lifecycle helpers that are intentionally not exposed
+# by the embind class. Two embind methods have no Node counterpart and carry
+# only nested/object arguments, so they do not need a primitive positional
+# guard. Keeping these sets explicit makes a future binding drift fail at
+# generation time instead of silently losing validation.
+NODE_ONLY_METHODS = frozenset(("dispose", "memoryUsage"))
+WASM_UNGUARDED_METHODS = frozenset(("addCellStyleXf", "createTable"))
+
+WASM_ONLY_GUARDS = {
+    "getSheetAutoFilterXml": {"u32": 0x1},
+    "setSheetAutoFilterXml": {"u32": 0x1, "string": 0x2},
+    "updateTable": {"u32": 0x1},
+    "removeTable": {"u32": 0x1},
+}
+
+FREE_FUNCTION_GUARDS = {
+    "evalFormula": {"string": 0x1},
+    "statusString": {"i32": 0x1},
+    "errorDisplayName": {"i32": 0x1},
+    "setLogMinLevel": {"i32": 0x1},
+}
+
+
+class GuardGenerationError(ValueError):
+    """An input binding source is inconsistent or could not be parsed."""
+
+
+@dataclass(frozen=True)
+class Registration:
+    cpp_name: str
+    js_name: str
+    masks: tuple[int, ...]
+
+    def as_js_spec(self) -> dict[str, int]:
+        return {name: value for name, value in zip(MASK_NAMES, self.masks) if value}
+
+
+def _parse_template_inner(inner: str, source: Path, marker_offset: int) -> tuple[str, tuple[int, ...]]:
+    parts = [part.strip() for part in inner.split(",")]
+    if not parts or not parts[0].startswith("&Workbook::"):
+        raise GuardGenerationError(f"{source}:{marker_offset}: expected &Workbook::Method registration")
+    cpp_name = parts[0][len("&Workbook::") :]
+    if not re.fullmatch(r"[A-Za-z0-9_]+", cpp_name):
+        raise GuardGenerationError(f"{source}:{marker_offset}: invalid C++ method name {cpp_name!r}")
+    if len(parts) > len(MASK_NAMES) + 1:
+        raise GuardGenerationError(
+            f"{source}:{marker_offset}: {cpp_name} has {len(parts) - 1} masks; at most {len(MASK_NAMES)} are allowed"
+        )
+
+    masks = [0] * len(MASK_NAMES)
+    for index, token in enumerate(parts[1:]):
+        match = MASK_TOKEN.fullmatch(token)
+        if match is None:
+            raise GuardGenerationError(f"{source}:{marker_offset}: invalid positional mask {token!r}")
+        masks[index] = int(match.group(1), 16)
+    return cpp_name, tuple(masks)
+
+
+def _find_closing_angle(text: str, opening: int, source: Path) -> int:
+    # The template argument list is intentionally simple today, but balancing
+    # here makes the parser fail closed if a future registration introduces a
+    # nested template rather than silently truncating at its first angle.
+    depth = 0
+    for index in range(opening, len(text)):
+        char = text[index]
+        if char == "<":
+            depth += 1
+        elif char == ">":
+            depth -= 1
+            if depth == 0:
+                return index
+            if depth < 0:
+                break
+    raise GuardGenerationError(f"{source}:{opening}: unterminated GuardedInstanceMethod template")
+
+
+def _parse_node_registrations(source: Path) -> list[Registration]:
+    text = source.read_text(encoding="utf-8")
+    try:
+        registration_start = text.index("Napi::Function constructor = DefineClass")
+        registration_end = text.index("});", registration_start)
+    except ValueError as exc:
+        raise GuardGenerationError(f"{source}: cannot locate DefineClass registration block") from exc
+    registration_block = text[registration_start:registration_end]
+    for marker in re.finditer(r"\bGuardedInstanceMethod\b", registration_block):
+        if not re.match(r"\s*<", registration_block[marker.end() :]):
+            raise GuardGenerationError(
+                f"{source}:{registration_start + marker.start()}: unparsed GuardedInstanceMethod in DefineClass"
+            )
+
+    registrations: list[Registration] = []
+    seen_cpp: set[str] = set()
+    seen_js: set[str] = set()
+    marker_count = 0
+    for match in METHOD_MARKER.finditer(text):
+        marker_count += 1
+        opening = text.find("<", match.start(), match.end() + 1)
+        if opening < 0:
+            raise GuardGenerationError(f"{source}:{match.start()}: missing angle after GuardedInstanceMethod")
+        closing = _find_closing_angle(text, opening, source)
+        suffix = text[closing + 1 :]
+        name_match = re.match(r"\s*\(\s*\"([A-Za-z0-9_]+)\"\s*\)", suffix)
+        if name_match is None:
+            raise GuardGenerationError(
+                f"{source}:{closing}: GuardedInstanceMethod must end with a quoted JS method name"
+            )
+        cpp_name, masks = _parse_template_inner(text[opening + 1 : closing], source, match.start())
+        js_name = name_match.group(1)
+        if cpp_name in seen_cpp:
+            raise GuardGenerationError(f"{source}:{match.start()}: duplicate C++ method {cpp_name}")
+        if js_name in seen_js:
+            raise GuardGenerationError(f"{source}:{match.start()}: duplicate JS method {js_name}")
+        seen_cpp.add(cpp_name)
+        seen_js.add(js_name)
+        _validate_masks(js_name, masks, source, match.start())
+        registrations.append(Registration(cpp_name, js_name, masks))
+
+    if marker_count != len(registrations):
+        raise GuardGenerationError(
+            f"{source}: parsed {len(registrations)} GuardedInstanceMethod registrations out of {marker_count} markers"
+        )
+    if marker_count != EXPECTED_NODE_REGISTRATIONS:
+        raise GuardGenerationError(
+            f"{source}: expected {EXPECTED_NODE_REGISTRATIONS} GuardedInstanceMethod registrations, found {marker_count}"
+        )
+    return registrations
+
+
+def _validate_masks(js_name: str, masks: tuple[int, ...], source: Path, offset: int) -> None:
+    required = masks[:5]
+    optional = masks[5:7]
+    optional_null = masks[7]
+    for index, mask in enumerate(masks):
+        if mask >= (1 << 32):
+            raise GuardGenerationError(
+                f"{source}:{offset}: {js_name} mask {MASK_NAMES[index]} uses a positional bit >= 32"
+            )
+    if optional[0] & optional[1]:
+        raise GuardGenerationError(f"{source}:{offset}: {js_name} optional u32/u64 masks overlap")
+    if optional_null & ~(optional[0] | optional[1]):
+        raise GuardGenerationError(f"{source}:{offset}: {js_name} optional-null mask is not optional")
+    for index, mask in enumerate(required):
+        other_mask = 0
+        for other_index, other in enumerate(masks):
+            if other_index != index:
+                other_mask |= other
+        if mask & other_mask:
+            raise GuardGenerationError(f"{source}:{offset}: {js_name} mask {MASK_NAMES[index]} overlaps another type")
+
+
+def _parse_wasm_methods(source: Path) -> set[str]:
+    text = source.read_text(encoding="utf-8")
+    methods = set(WASM_METHOD.findall(text))
+    if not methods:
+        raise GuardGenerationError(f"{source}: no embind methods found")
+    return methods
+
+
+def _check_free_functions(source: Path) -> None:
+    text = source.read_text(encoding="utf-8")
+    functions = set(WASM_FREE_FUNCTION.findall(text))
+    missing = sorted(set(FREE_FUNCTION_GUARDS) - functions)
+    if missing:
+        raise GuardGenerationError(f"{source}: positional free-function registration drift: missing={missing}")
+
+
+def _check_surface(node: Iterable[Registration], wasm_methods: set[str]) -> None:
+    registrations = list(node)
+    node_names = {entry.js_name for entry in registrations}
+    expected_wasm = (node_names - NODE_ONLY_METHODS) | set(WASM_ONLY_GUARDS) | WASM_UNGUARDED_METHODS
+    if wasm_methods != expected_wasm:
+        missing = sorted(expected_wasm - wasm_methods)
+        extra = sorted(wasm_methods - expected_wasm)
+        raise GuardGenerationError(f"WASM/Node binding surface drift: missing={missing}, extra={extra}")
+
+
+def _build_metadata(node: list[Registration]) -> dict[str, object]:
+    workbook: dict[str, dict[str, int]] = {
+        entry.js_name: entry.as_js_spec() for entry in sorted(node, key=lambda entry: entry.js_name)
+    }
+    # These embind-only methods have no primitive positional arguments, but
+    # they still cross a native Workbook frame. Include them in the generated
+    # wrapper with an empty spec so nested getters cannot destroy the receiver
+    # while the call is active.
+    for name in WASM_UNGUARDED_METHODS:
+        workbook[name] = {}
+    for name, spec in WASM_ONLY_GUARDS.items():
+        workbook[name] = dict(spec)
+    return {
+        "nodeRegistrationCount": len(node),
+        "workbook": dict(sorted(workbook.items())),
+        "free": {name: dict(spec) for name, spec in sorted(FREE_FUNCTION_GUARDS.items())},
+        "wasmExcluded": sorted(NODE_ONLY_METHODS),
+    }
+
+
+def _render(metadata: dict[str, object]) -> str:
+    data = json.dumps(metadata, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+    return f"""// AUTO-GENERATED by tools/codegen/gen_wasm_positional_guards.py.
+// Do not edit by hand; regenerate from the Node and WASM binding sources.
+(function (module) {{
+  'use strict';
+
+  const metadata = Object.freeze({data});
+  const installKey = Symbol.for('formulon.checkedPositionalArguments');
+  const activeWorkbookCalls = new WeakMap();
+  const UINT32_MAX = 0xffffffff;
+  const INT32_MIN = -0x80000000;
+  const INT32_MAX = 0x7fffffff;
+  const UINT64_MAX_EXACT = Number.MAX_SAFE_INTEGER;
+  // The native readers record a nested-field rejection here while a wrapped
+  // call is active; the wrapper throws it after the method returns, so native
+  // frames unwind normally and both surfaces raise the same error class.
+  const argumentErrors = {{ depth: 0, pending: undefined, thrown: undefined }};
+  module[Symbol.for('formulon.argumentErrors')] = argumentErrors;
+
+  function nestedArgumentError(pending) {{
+    if (pending.kind === 1) return new RangeError(pending.message);
+    if (pending.kind === 2 && pending.thrown !== undefined) return pending.thrown.value;
+    return new TypeError(pending.message);
+  }}
+
+  function argumentType(name, index, expected) {{
+    throw new TypeError(name + ' argument ' + (index + 1) + ' must be a primitive ' + expected);
+  }}
+
+  function argumentRange(name, index, expected) {{
+    throw new RangeError(name + ' argument ' + (index + 1) + ' is outside ' + expected + ' range');
+  }}
+
+  function validateNumber(value, name, index, kind) {{
+    if (typeof value !== 'number') {{
+      argumentType(name, index, 'number');
+    }}
+    if (!Number.isInteger(value)) {{
+      argumentRange(name, index, kind);
+    }}
+    if (kind === 'uint32' && (value < 0 || value > UINT32_MAX)) {{
+      argumentRange(name, index, kind);
+    }}
+    if (kind === 'int32' && (value < INT32_MIN || value > INT32_MAX)) {{
+      argumentRange(name, index, kind);
+    }}
+    if (kind === 'uint64' && (value < 0 || value > UINT64_MAX_EXACT)) {{
+      argumentRange(name, index, kind);
+    }}
+  }}
+
+  function validateArguments(name, args, spec) {{
+    const masks = [
+      ['u32', spec.u32 ?? 0, 'uint32'],
+      ['i32', spec.i32 ?? 0, 'int32'],
+      ['u64', spec.u64 ?? 0, 'uint64'],
+      ['double', spec.double ?? 0, 'double'],
+      ['string', spec.string ?? 0, 'string'],
+      ['optionalU32', spec.optionalU32 ?? 0, 'uint32'],
+      ['optionalU64', spec.optionalU64 ?? 0, 'uint64'],
+    ];
+    const optionalNull = spec.optionalNull ?? 0;
+    for (let index = 0; index < args.length; index += 1) {{
+      const bit = 2 ** index;
+      for (const [kind, mask, numericKind] of masks) {{
+        if ((mask & bit) === 0) continue;
+        const value = args[index];
+        if (kind === 'double') {{
+          if (typeof value !== 'number') argumentType(name, index, 'number');
+        }} else if (kind === 'string') {{
+          if (typeof value !== 'string') argumentType(name, index, 'string');
+        }} else if (kind === 'optionalU32' || kind === 'optionalU64') {{
+          if (value === undefined || (value === null && (optionalNull & bit) !== 0)) continue;
+          if (value === null) argumentType(name, index, 'number');
+          validateNumber(value, name, index, numericKind);
+        }} else {{
+          validateNumber(value, name, index, numericKind);
+        }}
+      }}
+    }}
+  }}
+
+  function receiverStateKey(receiver) {{
+    if (receiver === null || receiver === undefined ||
+        (typeof receiver !== 'object' && typeof receiver !== 'function')) return null;
+    // Embind proxies expose the same own `$$` data property as the original
+    // handle. Reading its descriptor avoids invoking a user accessor while
+    // giving every wrapper for the same native state one WeakMap key.
+    const descriptor = Object.getOwnPropertyDescriptor(receiver, '$$');
+    if (descriptor && Object.prototype.hasOwnProperty.call(descriptor, 'value')) {{
+      const value = descriptor.value;
+      if (value !== null && (typeof value === 'object' || typeof value === 'function')) return value;
+    }}
+    return receiver;
+  }}
+
+  function makeCallableWrapper(name, original, spec, trackWorkbookCall) {{
+    const wrapped = function (...args) {{
+      validateArguments(name, args, spec);
+      const receiverKey = trackWorkbookCall ? receiverStateKey(this) : null;
+      const receiverTracked = receiverKey !== null;
+      if (receiverTracked) activeWorkbookCalls.set(receiverKey, (activeWorkbookCalls.get(receiverKey) ?? 0) + 1);
+      // A getter may re-enter another wrapped method mid-read; each call
+      // owns only the rejection recorded during its own native frame.
+      const outerPending = argumentErrors.pending;
+      argumentErrors.pending = undefined;
+      argumentErrors.depth += 1;
+      let pending;
+      let result;
+      try {{
+        result = Reflect.apply(original, this, args);
+      }} finally {{
+        argumentErrors.depth -= 1;
+        pending = argumentErrors.pending;
+        argumentErrors.pending = outerPending;
+        if (receiverTracked) {{
+          const depth = activeWorkbookCalls.get(receiverKey) ?? 1;
+          if (depth <= 1) activeWorkbookCalls.delete(receiverKey);
+          else activeWorkbookCalls.set(receiverKey, depth - 1);
+        }}
+      }}
+      if (pending !== undefined) throw nestedArgumentError(pending);
+      return result;
+    }};
+    Object.defineProperty(wrapped, 'name', {{ value: original.name, configurable: true }});
+    const argCountDescriptor = Object.getOwnPropertyDescriptor(original, 'argCount');
+    if (argCountDescriptor) Object.defineProperty(wrapped, 'argCount', argCountDescriptor);
+    return wrapped;
+  }}
+
+  function guardOverloadTable(name, original, table, spec, trackWorkbookCall) {{
+    if (!Array.isArray(table)) {{
+      throw new TypeError('cannot guard non-array overload table ' + name);
+    }}
+    const guarded = new Array(table.length);
+    for (let index = 0; index < table.length; index += 1) {{
+      if (!(index in table)) continue;
+      const entry = table[index];
+      if (typeof entry !== 'function') {{
+        throw new TypeError('cannot guard non-function overload entry ' + name + '[' + index + ']');
+      }}
+      if (entry === original) {{
+        throw new Error('overload table recursively references dispatcher ' + name);
+      }}
+      // Leaf wrappers intentionally do not copy or inspect another
+      // overloadTable. Current embind leaves are terminal functions; keeping
+      // this non-recursive makes cycles fail closed at the dispatcher edge.
+      guarded[index] = makeCallableWrapper(name, entry, spec, trackWorkbookCall);
+    }}
+    return guarded;
+  }}
+
+  function wrap(target, name, spec, trackWorkbookCall = false) {{
+    const descriptor = Object.getOwnPropertyDescriptor(target, name);
+    if (!descriptor) return false;
+    if (typeof descriptor.value !== 'function') {{
+      throw new TypeError('cannot guard non-function binding ' + name);
+    }}
+    const original = descriptor.value;
+    const wrapped = makeCallableWrapper(name, original, spec, trackWorkbookCall);
+    const overloadDescriptor = Object.getOwnPropertyDescriptor(original, 'overloadTable');
+    if (overloadDescriptor) {{
+      if (!Object.prototype.hasOwnProperty.call(overloadDescriptor, 'value')) {{
+        throw new TypeError('cannot guard accessor overload table ' + name);
+      }}
+      const guardedTable = guardOverloadTable(name, original, overloadDescriptor.value, spec, trackWorkbookCall);
+      Object.defineProperty(wrapped, 'overloadTable', {{ ...overloadDescriptor, value: guardedTable }});
+    }}
+    Object.defineProperty(target, name, {{ ...descriptor, value: wrapped }});
+    return true;
+  }}
+
+  function install() {{
+    if (module[installKey]) return;
+    const workbook = module.Workbook;
+    if (!workbook || !workbook.prototype) return;
+    for (const [name, spec] of Object.entries(metadata.workbook)) {{
+      if (!wrap(workbook.prototype, name, spec, true) && !metadata.wasmExcluded.includes(name)) {{
+        throw new Error('missing positional binding ' + name);
+      }}
+    }}
+    for (const [name, spec] of Object.entries(metadata.free)) {{
+      if (!wrap(module, name, spec)) throw new Error('missing positional free function ' + name);
+    }}
+    const lifecycleKeys = ['delete', 'deleteLater'];
+    if (typeof Symbol.dispose === 'symbol') lifecycleKeys.push(Symbol.dispose);
+    for (const key of lifecycleKeys) {{
+      let owner = workbook.prototype;
+      let descriptor;
+      while (owner !== null && descriptor === undefined) {{
+        descriptor = Object.getOwnPropertyDescriptor(owner, key);
+        if (descriptor === undefined) owner = Object.getPrototypeOf(owner);
+      }}
+      if (!descriptor || typeof descriptor.value !== 'function') {{
+        throw new Error('missing Workbook lifecycle binding ' + String(key));
+      }}
+      const original = descriptor.value;
+      const guarded = function (...args) {{
+        const receiverKey = receiverStateKey(this);
+        if (receiverKey !== null && activeWorkbookCalls.get(receiverKey) > 0) {{
+          throw new TypeError('cannot dispose Workbook during an active method call');
+        }}
+        return Reflect.apply(original, this, args);
+      }};
+      Object.defineProperty(guarded, 'name', {{ value: original.name, configurable: true }});
+      for (const property of ['argCount', 'overloadTable']) {{
+        const propertyDescriptor = Object.getOwnPropertyDescriptor(original, property);
+        if (propertyDescriptor) Object.defineProperty(guarded, property, propertyDescriptor);
+      }}
+      // Keep the guard on the descriptor's actual owner as well as on the
+      // Workbook shadow. A caller can retain an inherited descriptor and
+      // invoke it with Function#call, bypassing a Workbook-only shadow.
+      Object.defineProperty(owner, key, {{ ...descriptor, value: guarded }});
+      if (owner !== workbook.prototype) {{
+        Object.defineProperty(workbook.prototype, key, {{ ...descriptor, value: guarded }});
+      }}
+    }}
+    module[installKey] = true;
+  }}
+
+  // Emscripten invokes onRuntimeInitialized before postRun. The caller can
+  // replace either hook from preRun, so armInstall is appended after all
+  // existing preRun callbacks and re-wraps the final hooks at that point.
+  const runtimeWrapperKey = Symbol('formulon.positionalRuntimeWrapper');
+  function armRuntimeHook() {{
+    const runtimeHook = module.onRuntimeInitialized;
+    if (runtimeHook && runtimeHook[runtimeWrapperKey]) return;
+    const wrapped = function (...args) {{
+      install();
+      if (runtimeHook === undefined || runtimeHook === null) return undefined;
+      return Reflect.apply(runtimeHook, this, args);
+    }};
+    Object.defineProperty(wrapped, runtimeWrapperKey, {{ value: true }});
+    module.onRuntimeInitialized = wrapped;
+  }}
+
+  function armPostRun() {{
+    const postRun = module.postRun;
+    if (postRun === undefined) {{
+      module.postRun = [install];
+    }} else if (Array.isArray(postRun)) {{
+      module.postRun = [install, ...postRun.filter((callback) => callback !== install)];
+    }} else {{
+      module.postRun = [install, postRun];
+    }}
+  }}
+
+  function armInstall() {{
+    armRuntimeHook();
+    armPostRun();
+  }}
+
+  function appendPreRunArm() {{
+    const preRun = module.preRun;
+    if (preRun === undefined) module.preRun = [armInstall];
+    else if (Array.isArray(preRun)) {{
+      module.preRun = [...preRun.filter((callback) => callback !== armInstall), armInstall];
+    }} else module.preRun = [preRun, armInstall];
+  }}
+
+  armInstall();
+  appendPreRunArm();
+  const preInit = module.preInit;
+  if (preInit === undefined) module.preInit = [appendPreRunArm];
+  else if (Array.isArray(preInit)) module.preInit = [...preInit, appendPreRunArm];
+  else module.preInit = [preInit, appendPreRunArm];
+}})(Module);
+"""
+
+
+def generate(node_source: Path, wasm_source: Path, output: Path) -> None:
+    node = _parse_node_registrations(node_source)
+    wasm = _parse_wasm_methods(wasm_source)
+    _check_surface(node, wasm)
+    _check_free_functions(wasm_source)
+    metadata = _build_metadata(node)
+    rendered = _render(metadata)
+    output.parent.mkdir(parents=True, exist_ok=True)
+    output.write_text(rendered, encoding="utf-8")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--node-source", type=Path, default=DEFAULT_NODE_SOURCE)
+    parser.add_argument("--wasm-source", type=Path, default=DEFAULT_WASM_SOURCE)
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args()
+    try:
+        generate(args.node_source, args.wasm_source, args.output)
+    except (OSError, GuardGenerationError) as exc:
+        print(f"gen_wasm_positional_guards: {exc}", file=sys.stderr)
+        return 1
+    print(f"generated {args.output} from {EXPECTED_NODE_REGISTRATIONS} Node registrations")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/dev/binding_drift/__init__.py b/tools/dev/binding_drift/__init__.py
new file mode 100644
index 000000000..0585db1e5
--- /dev/null
+++ b/tools/dev/binding_drift/__init__.py
@@ -0,0 +1 @@
+"""Shared parsers and drift checks behind tools/dev/check_binding_drift.py."""
diff --git a/tools/dev/binding_drift/abi_checks.py b/tools/dev/binding_drift/abi_checks.py
new file mode 100644
index 000000000..28c560d6a
--- /dev/null
+++ b/tools/dev/binding_drift/abi_checks.py
@@ -0,0 +1,151 @@
+"""Drift checks on the released C ABI baseline and the header error-code documentation."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import List
+
+from .c_header import c_abi_declarations
+from .enum_decl import _cpp_enum_class_values
+from .surface_files import C_ABI_BASELINE, C_ABI_BREAKS, CAPI_HEADER, ERROR_H, REPO_ROOT, _read
+
+
+def _parse_abi_manifest(path: Path) -> List[str]:
+    """Non-comment, non-blank lines of a baseline / ledger file."""
+    lines = []
+    for raw in _read(path).splitlines():
+        line = raw.strip()
+        if line and not line.startswith("#"):
+            lines.append(line)
+    return lines
+
+
+_ABI_BREAK_RE = re.compile(r"^(removed|signature|retyped)\s+(fm_[A-Za-z0-9_]+)\s*::\s*(\S.*)$")
+_ABI_BASELINE_RE = re.compile(r"^(.+?)\s+(fm_[A-Za-z0-9_]+)\((.*)\)$")
+
+
+def check_abi_baseline() -> List[str]:
+    """The released C ABI surface is still declared, or its loss is recorded.
+
+    A deletion or rename of a base entry point is invisible to every other
+    check here: five of the eight base/`_ex` families have no in-repo caller
+    at all, so the C API tests recompile against the new header and pass. The
+    only party that notices is a third-party consumer compiled against the
+    released header, which no test can stand in for -- hence a pinned copy of
+    that header's surface plus an explicit ledger of what was broken on
+    purpose.
+
+    Signature comparison is by declared parameter *type*, so it catches an
+    added, dropped or retyped parameter. It does NOT catch a by-value struct
+    that keeps its name and changes size; that is a calling convention change
+    the `static_assert(sizeof(...))` tripwires in the C ABI tests pin instead.
+    """
+    problems: List[str] = []
+
+    baseline: dict[str, tuple[str, List[str]]] = {}
+    for line in _parse_abi_manifest(C_ABI_BASELINE):
+        match = _ABI_BASELINE_RE.match(line)
+        if match is None:
+            problems.append(f"abi-baseline: unparsable baseline line: {line!r}")
+            continue
+        ret, name, params = match.groups()
+        parsed = [] if params.strip() in ("", "void") else [p.strip() for p in params.split(",")]
+        baseline[name] = (ret.strip(), parsed)
+
+    ledger: dict[str, str] = {}
+    for line in _parse_abi_manifest(C_ABI_BREAKS):
+        match = _ABI_BREAK_RE.match(line)
+        if match is None:
+            problems.append(f"abi-baseline: unparsable ledger line: {line!r}")
+            continue
+        kind, name, _reason = match.groups()
+        if name in ledger:
+            problems.append(f"abi-baseline: {name} is listed twice in {C_ABI_BREAKS.name}")
+        ledger[name] = kind
+
+    current = c_abi_declarations(_read(CAPI_HEADER))
+
+    for name, declared in sorted(baseline.items()):
+        recorded = ledger.get(name)
+        if name not in current:
+            if recorded != "removed":
+                problems.append(
+                    f"abi-baseline: {name} shipped in the released header but is gone from "
+                    f"{CAPI_HEADER.relative_to(REPO_ROOT)}. A consumer built against the release "
+                    f"loses it at link time. Record the break as `removed {name} :: <reason>` in "
+                    f"{C_ABI_BREAKS.relative_to(REPO_ROOT)} and carry it into the CHANGELOG's "
+                    "Removed section, or restore the entry point."
+                )
+            continue
+        if current[name] != declared:
+            if recorded not in ("signature", "retyped"):
+                problems.append(
+                    f"abi-baseline: {name} changed signature since the release.\n"
+                    f"  released: {declared[0]} {name}({', '.join(declared[1]) or 'void'})\n"
+                    f"  current:  {current[name][0]} {name}({', '.join(current[name][1]) or 'void'})\n"
+                    f"  Record it in {C_ABI_BREAKS.relative_to(REPO_ROOT)} as `signature` (breaks a "
+                    "stale caller) or `retyped` (invisible to a C caller and to the calling "
+                    "convention), with the reason."
+                )
+            continue
+        # Declared and unchanged: any ledger entry naming it is stale.
+        if recorded is not None:
+            problems.append(
+                f"abi-baseline: {C_ABI_BREAKS.relative_to(REPO_ROOT)} records {name} as "
+                f"`{recorded}`, but it is declared unchanged from the release. Drop the line -- a "
+                "ledger that outlives its break stops meaning anything."
+            )
+
+    for name in sorted(set(ledger) - set(baseline)):
+        problems.append(
+            f"abi-baseline: {C_ABI_BREAKS.relative_to(REPO_ROOT)} records {name}, which was never "
+            f"in the released surface. Only an entry point a consumer could have compiled against "
+            "can be broken; drop the line."
+        )
+
+    return problems
+
+
+# A doc comment quotes a status code as `` `kName` (N) ``, and the number may
+# wrap onto the next comment line, so the separator spans a `*` continuation
+# marker as well as plain spaces.
+_HEADER_ERROR_CODE_RE = re.compile(r"`?(k[A-Z][A-Za-z0-9_]*)`?(?:[ \t]|\n[ \t]*\*)*\((\d+)\)")
+
+
+def check_header_error_codes() -> List[str]:
+    """Every numeric status code quoted in the C header matches its enumerator.
+
+    `fm_status_t` is a bare `int32_t`, so the numbers the header's doc
+    comments print next to an enumerator name are the whole contract a
+    binding author reading only the header can act on. A comparison written
+    against a stale number never matches, and mis-classifies whatever code
+    actually holds that value.
+    """
+    problems: List[str] = []
+
+    codes = _cpp_enum_class_values(_read(ERROR_H), "FormulonErrorCode")
+    if codes is None:
+        return [
+            f"header-error-codes: could not parse `FormulonErrorCode` out of {ERROR_H.relative_to(REPO_ROOT)}; "
+            "the enum moved or gained a non-literal initializer"
+        ]
+
+    header = _read(CAPI_HEADER)
+    for match in _HEADER_ERROR_CODE_RE.finditer(header):
+        name, quoted = match.group(1), match.group(2)
+        line_number = header.count("\n", 0, match.start()) + 1
+        site = f"{CAPI_HEADER.name}:{line_number}"
+        if name not in codes:
+            problems.append(
+                f"header-error-codes: {site} documents `{name}` ({quoted}), which names no enumerator of "
+                f"`FormulonErrorCode` in {ERROR_H.relative_to(REPO_ROOT)}"
+            )
+            continue
+        if int(quoted) != codes[name]:
+            problems.append(
+                f"header-error-codes: {site} documents `{name}` as ({quoted}), but "
+                f"{ERROR_H.relative_to(REPO_ROOT)} defines it as {codes[name]}"
+            )
+
+    return problems
diff --git a/tools/dev/binding_drift/c_header.py b/tools/dev/binding_drift/c_header.py
new file mode 100644
index 000000000..595d6e350
--- /dev/null
+++ b/tools/dev/binding_drift/c_header.py
@@ -0,0 +1,234 @@
+"""Parsing of the C ABI header: wasm32 struct layouts, function declarations and struct fields."""
+
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+from typing import List, NamedTuple, Set
+
+# ---------------------------------------------------------------------------
+# Check 1b: Python WASM32 POD layouts <-> C ABI header.
+# ---------------------------------------------------------------------------
+
+
+def _wasm32_layout(fields: List[tuple[str, int, int]]) -> tuple[dict[str, int], int, int]:
+    """Lays `fields` out in sequence, returning `(offsets, size, alignment)`."""
+    offsets: dict[str, int] = {}
+    offset = 0
+    max_align = 1
+    for name, size, align in fields:
+        offset = (offset + align - 1) // align * align
+        offsets[name] = offset
+        offset += size
+        max_align = max(max_align, align)
+    return offsets, (offset + max_align - 1) // max_align * max_align, max_align
+
+
+# wasm32 (ILP32) size and alignment for the leaf types the C ABI structs are
+# built from. These are properties of the target ABI rather than anything the
+# header states, which is why they are the only layout facts tabulated here:
+# every type that has a declaration to read -- struct, union, array -- is
+# measured from that declaration instead of quoted. A literal for an embedded
+# struct would keep asserting its old size after the struct changed, which is
+# the one thing this check exists to catch.
+_WASM32_SCALARS = {
+    "uint8_t": (1, 1),
+    "uint16_t": (2, 2),
+    "uint32_t": (4, 4),
+    "int32_t": (4, 4),
+    "uint64_t": (8, 8),
+    "int64_t": (8, 8),
+    "double": (8, 8),
+    "size_t": (4, 4),
+}
+_WASM32_POINTER = (4, 4)
+# A C enum takes `int` representation. The header pins each enumerator's
+# ordinal but says nothing about the storage width, so this is not derivable
+# either; *which* names are enums is read off the header.
+_WASM32_ENUM = (4, 4)
+
+_C_STRUCT_RE = re.compile(r"typedef\s+struct\s*\{(.*?)\}\s*(fm_[A-Za-z0-9_]+)\s*;", re.S)
+_C_ENUM_RE = re.compile(r"typedef\s+enum\s*\{[^}]*\}\s*([A-Za-z_][A-Za-z0-9_]*)\s*;")
+# An anonymous `union { ... } name;` member, matched before the enclosing body
+# is split on `;` so the union's own members are not mistaken for the parent's.
+_C_UNION_MEMBER_RE = re.compile(r"union\s*\{(.*?)\}\s*([A-Za-z_][A-Za-z0-9_]*)\s*;", re.S)
+_C_DECLARATION_RE = re.compile(r"(.+?)\s+([A-Za-z_][A-Za-z0-9_]*)(?:\[(\d+)\])?")
+
+
+class _LayoutError(Exception):
+    """A C declaration the wasm32 layout resolver cannot measure."""
+
+
+class _Member(NamedTuple):
+    """One measured struct member. `ctype` is empty for an anonymous union."""
+
+    name: str
+    ctype: str
+    size: int
+    align: int
+
+
+class _Wasm32Layouts:
+    """Measures the C ABI's structs against the wasm32 ABI, from the header.
+
+    Struct members are resolved recursively, so an embedded POD is measured
+    rather than quoted: changing a field of `fm_color_spec` moves every struct
+    that embeds it, and the Python side is checked against the new offsets.
+    """
+
+    def __init__(self, header: str) -> None:
+        self._structs = {name: body for body, name in _C_STRUCT_RE.findall(header)}
+        self._enums = set(_C_ENUM_RE.findall(header))
+        self._members: dict[str, List[_Member]] = {}
+        self._pending: Set[str] = set()
+
+    def is_struct(self, ctype: str) -> bool:
+        return ctype in self._structs
+
+    def members(self, struct_name: str) -> List[_Member]:
+        """Members of `struct_name` in declaration order, each measured."""
+        cached = self._members.get(struct_name)
+        if cached is not None:
+            return cached
+        body = self._structs.get(struct_name)
+        if body is None:
+            raise _LayoutError(f"{struct_name} missing from C header")
+        if struct_name in self._pending:
+            raise _LayoutError(f"{struct_name} embeds itself")
+        self._pending.add(struct_name)
+        try:
+            measured = self._parse_body(struct_name, body)
+        finally:
+            self._pending.discard(struct_name)
+        self._members[struct_name] = measured
+        return measured
+
+    def extent(self, ctype: str) -> tuple[int, int]:
+        """`(size, alignment)` of one member's declared type."""
+        if "*" in ctype:
+            return _WASM32_POINTER
+        ctype = ctype.replace("const ", "").strip()
+        if ctype in self._structs:
+            _, size, align = _wasm32_layout([(m.name, m.size, m.align) for m in self.members(ctype)])
+            return size, align
+        if ctype in _WASM32_SCALARS:
+            return _WASM32_SCALARS[ctype]
+        if ctype in self._enums:
+            return _WASM32_ENUM
+        raise _LayoutError(f"unknown field type {ctype!r}")
+
+    def _parse_body(self, owner: str, body: str) -> List[_Member]:
+        measured: List[_Member] = []
+        position = 0
+        for union in _C_UNION_MEMBER_RE.finditer(body):
+            measured.extend(self._parse_declarations(owner, body[position : union.start()]))
+            size, align = self._union_extent(owner, union.group(1))
+            measured.append(_Member(union.group(2), "", size, align))
+            position = union.end()
+        measured.extend(self._parse_declarations(owner, body[position:]))
+        return measured
+
+    def _parse_declarations(self, owner: str, text: str) -> List[_Member]:
+        measured: List[_Member] = []
+        for declaration in text.split(";"):
+            declaration = " ".join(declaration.split())
+            if not declaration:
+                continue
+            match = _C_DECLARATION_RE.fullmatch(declaration)
+            if not match:
+                raise _LayoutError(f"cannot parse {owner}: {declaration!r}")
+            ctype, name, count_text = match.groups()
+            size, align = self.extent(ctype)
+            measured.append(_Member(name, ctype.replace("const ", "").strip(), size * int(count_text or "1"), align))
+        return measured
+
+    def _union_extent(self, owner: str, body: str) -> tuple[int, int]:
+        """A union overlays its members: widest size, strictest alignment."""
+        size = 0
+        align = 1
+        for member in self._parse_declarations(owner, body):
+            size = max(size, member.size)
+            align = max(align, member.align)
+        return (size + align - 1) // align * align, align
+
+
+# ---------------------------------------------------------------------------
+# Check 1c: Python `LIB.fm_*` call sites <-> the C header's declarations.
+#
+# `python-exports` matches call *names* only. Nothing compares what a call
+# passes against what the entry point declares, so a parameter added to an
+# existing `fm_*` function -- the shape a 1.0-frozen ABI is most likely to
+# grow -- leaves the Python side calling the old signature and is caught only
+# if a runtime binding test happens to exercise that path.
+# ---------------------------------------------------------------------------
+
+_C_FUNCTION_DECL_RE = re.compile(
+    r"FM_API\s+([A-Za-z_][A-Za-z0-9_ *]*?)\b(fm_[A-Za-z0-9_]+)\s*\(([^;]*?)\)\s*;",
+    re.S,
+)
+
+
+def _split_c_params(text: str) -> List[str]:
+    """Splits a parameter list on its top-level commas."""
+    parts: List[str] = []
+    depth = 0
+    current = ""
+    for char in text:
+        if char == "(":
+            depth += 1
+        elif char == ")":
+            depth -= 1
+        if char == "," and depth == 0:
+            parts.append(current.strip())
+            current = ""
+        else:
+            current += char
+    parts.append(current.strip())
+    return parts
+
+
+def _c_function_params(header: str) -> dict[str, List[str]]:
+    """Maps each `FM_API` entry point to its declared parameter types.
+
+    The parameter *name* is stripped, so the values are types in declaration
+    order (`["fm_workbook_t*", "size_t", "fm_value_t*"]`). Every parameter in
+    this header is named, so dropping the last whitespace-delimited token is
+    unambiguous.
+    """
+    return {name: params for name, (_, params) in c_abi_declarations(header).items()}
+
+
+def c_abi_declarations(header: str) -> dict[str, tuple[str, List[str]]]:
+    """Maps each `FM_API` entry point to its `(return type, parameter types)`.
+
+    Public because `gen_c_abi_baseline.py` writes the released-surface file
+    with it: generating the baseline through the same parser the check reads
+    it back with keeps a formatting difference from masquerading as a break.
+    """
+    declarations: dict[str, tuple[str, List[str]]] = {}
+    for ret, name, params in _C_FUNCTION_DECL_RE.findall(header):
+        ret = " ".join(ret.split())
+        params = " ".join(params.split())
+        if params in ("", "void"):
+            declarations[name] = (ret, [])
+            continue
+        declarations[name] = (ret, [" ".join(param.split()[:-1]) for param in _split_c_params(params)])
+    return declarations
+
+
+def _c_struct_fields(header: str, struct_name: str, source: Path) -> List[str]:
+    blocks = {name: body for body, name in _C_STRUCT_RE.findall(header)}
+    body = blocks.get(struct_name)
+    if body is None:
+        print(f"check_binding_drift: struct {struct_name!r} not found in {source}", file=sys.stderr)
+        sys.exit(2)
+    fields: List[str] = []
+    for declaration in body.split(";"):
+        declaration = " ".join(declaration.split())
+        if not declaration:
+            continue
+        match = re.fullmatch(r"(.+?)\s+([A-Za-z_][A-Za-z0-9_]*)(?:\[(\d+)\])?", declaration)
+        if match and not match.group(2).startswith("_pad"):
+            fields.append(match.group(2))
+    return fields
diff --git a/tools/dev/binding_drift/declaration_checks.py b/tools/dev/binding_drift/declaration_checks.py
new file mode 100644
index 000000000..b32062f67
--- /dev/null
+++ b/tools/dev/binding_drift/declaration_checks.py
@@ -0,0 +1,438 @@
+"""Drift checks across the WASM and N-API `.d.ts` surfaces, the npm helpers and the staged package."""
+
+from __future__ import annotations
+
+import re
+from typing import List
+
+from .enum_decl import (
+    _extract_c_typedef_enum,
+    _extract_cpp_enum_class,
+    _extract_ts_enum,
+    _parse_ts_named_enum,
+)
+from .surface_files import (
+    _SKIPPED,
+    CALC_MODE_H,
+    CAPI_HEADER,
+    CF_MATCH_H,
+    EXTERNAL_LINKS_H,
+    NODE_ADDON_CC,
+    NODE_DIST_DIR,
+    NODE_DTS,
+    NODE_INDEX_MJS,
+    NODE_README,
+    NODE_WORKBOOK_CLASS_CC,
+    NPM_COMMON_MJS,
+    NPM_ENTRY_MJS,
+    REPO_ROOT,
+    VALUE_H,
+    WASM_BINDINGS_CPP,
+    WASM_DTS,
+    _format_diff,
+    _read,
+    _read_bytes,
+)
+from .ts_decl import (
+    _extract_ts_methods,
+    _find_interface_body,
+    _js_exported_function_source,
+    _parse_js_constants,
+)
+
+# embind auto-adds a `delete()` finaliser to every `class_<T>` -- it has no
+# corresponding `.function(...)` registration, so it must be excluded before
+# comparing the WASM Workbook interface against bindings_register.cpp.
+WASM_AUTO_METHODS = {"delete"}
+
+# Intentional binding differences are kept exact. This makes a newly added
+# method or a removed method fail drift checking instead of becoming a stale
+# exception in one binding.
+WASM_ONLY_METHODS = {
+    "addCellStyleXf",
+    "createTable",
+    "getSheetAutoFilterXml",
+    "removeTable",
+    "setSheetAutoFilterXml",
+    "updateTable",
+}
+NODE_ONLY_METHODS = {"dispose", "memoryUsage"}
+
+# Pure-JS free functions declared in packages/npm-native/index.d.ts that are
+# intentionally NOT backed by a native `exports.Set(...)` registration -- they
+# are host-side helpers implemented in index.mjs (e.g. the function-metadata
+# provider merge helper). Excluded before comparing the d.ts free-function
+# surface against the addon's native exports.
+NODE_PURE_JS_FREE_FUNCTIONS = {"mergeFunctionMetadata"}
+
+
+# ---------------------------------------------------------------------------
+# Check 2a: WASM embind registration <-> src/wasm/formulon.d.ts.
+# ---------------------------------------------------------------------------
+
+
+def check_dts_wasm() -> List[str]:
+    problems: List[str] = []
+    cpp_text = _read(WASM_BINDINGS_CPP)
+
+    instance_cpp = set(re.findall(r'\.function\("([^"]+)"', cpp_text))
+    static_cpp = set(re.findall(r'\.class_function\("([^"]+)"', cpp_text))
+    free_cpp = set(re.findall(r'(?<!\.)\bfunction\("([^"]+)"', cpp_text))
+
+    dts_text = _read(WASM_DTS)
+    instance_dts = _extract_ts_methods(_find_interface_body(dts_text, "Workbook", WASM_DTS)) - WASM_AUTO_METHODS
+    static_dts = _extract_ts_methods(_find_interface_body(dts_text, "WorkbookCtor", WASM_DTS))
+    free_dts = _extract_ts_methods(_find_interface_body(dts_text, "FormulonModule", WASM_DTS))
+
+    for label, cpp_set, dts_set in (
+        ("Workbook instance methods", instance_cpp, instance_dts),
+        ("Workbook static factories", static_cpp, static_dts),
+        ("free functions", free_cpp, free_dts),
+    ):
+        diff = _format_diff(
+            f"{WASM_BINDINGS_CPP.relative_to(REPO_ROOT)}",
+            cpp_set - dts_set,
+            f"{WASM_DTS.relative_to(REPO_ROOT)}",
+            dts_set - cpp_set,
+        )
+        if diff:
+            problems.append(f"dts-wasm: {label} mismatch:\n" + "\n".join(diff))
+
+    return problems
+
+
+# ---------------------------------------------------------------------------
+# Check 2b: Node N-API registration <-> packages/npm-native/index.d.ts.
+# ---------------------------------------------------------------------------
+
+
+def check_dts_node() -> List[str]:
+    problems: List[str] = []
+    cc_text = _read(NODE_WORKBOOK_CLASS_CC)
+
+    instance_cc = set(re.findall(r'InstanceMethod<[^>]+>\("([^"]+)"\)', cc_text))
+    static_cc = set(re.findall(r'StaticMethod<[^>]+>\("([^"]+)"\)', cc_text))
+
+    addon_text = _read(NODE_ADDON_CC)
+    free_cc = set(re.findall(r'exports\.Set\("([^"]+)"', addon_text)) - {"Workbook"}
+
+    dts_text = _read(NODE_DTS)
+    instance_dts = _extract_ts_methods(_find_interface_body(dts_text, "Workbook", NODE_DTS))
+    static_dts = _extract_ts_methods(_find_interface_body(dts_text, "WorkbookCtor", NODE_DTS))
+    free_dts = set(re.findall(r"^export function ([A-Za-z0-9_]+)\(", dts_text, re.MULTILINE))
+    free_dts -= NODE_PURE_JS_FREE_FUNCTIONS
+
+    wasm_cpp_text = _read(WASM_BINDINGS_CPP)
+    wasm_instance = set(re.findall(r'\.function\("([^"]+)"', wasm_cpp_text))
+    actual_wasm_only = wasm_instance - instance_cc
+    actual_node_only = instance_cc - wasm_instance
+    if actual_wasm_only != WASM_ONLY_METHODS:
+        problems.append(
+            "dts-node: WASM-only instance-method allowlist mismatch; "
+            f"actual={sorted(actual_wasm_only)}, allowlist={sorted(WASM_ONLY_METHODS)}"
+        )
+    if actual_node_only != NODE_ONLY_METHODS:
+        problems.append(
+            "dts-node: Node-only instance-method allowlist mismatch; "
+            f"actual={sorted(actual_node_only)}, allowlist={sorted(NODE_ONLY_METHODS)}"
+        )
+    stale_wasm_only = WASM_ONLY_METHODS - actual_wasm_only
+    stale_node_only = NODE_ONLY_METHODS - actual_node_only
+    if stale_wasm_only:
+        problems.append(f"dts-node: stale WASM-only allowlist entries: {sorted(stale_wasm_only)}")
+    if stale_node_only:
+        problems.append(f"dts-node: stale Node-only allowlist entries: {sorted(stale_node_only)}")
+
+    for label, cc_set, dts_set in (
+        ("Workbook instance methods", instance_cc, instance_dts),
+        ("Workbook static factories", static_cc, static_dts),
+        ("free functions", free_cc, free_dts),
+    ):
+        diff = _format_diff(
+            f"{NODE_WORKBOOK_CLASS_CC.relative_to(REPO_ROOT)} / {NODE_ADDON_CC.relative_to(REPO_ROOT)}",
+            cc_set - dts_set,
+            f"{NODE_DTS.relative_to(REPO_ROOT)}",
+            dts_set - cc_set,
+        )
+        if diff:
+            problems.append(f"dts-node: {label} mismatch:\n" + "\n".join(diff))
+
+    return problems
+
+
+def _npm_entries_reexport_common(check: str) -> List[str]:
+    """Every npm entry point must re-export common.mjs, or it ships without the shared surface."""
+    return [
+        f"{check}: {entry.relative_to(REPO_ROOT)} does not `export * from './common.js'`"
+        for entry in NPM_ENTRY_MJS
+        if not re.search(r"^export \* from '\./common\.js';", _read(entry), re.MULTILINE)
+    ]
+
+
+def check_pure_js_helpers() -> List[str]:
+    problems: List[str] = _npm_entries_reexport_common("pure-js-helpers")
+    sources = {
+        "npm": (NPM_COMMON_MJS, WASM_DTS),
+        "npm-native": (NODE_INDEX_MJS, NODE_DTS),
+    }
+
+    for name in sorted(NODE_PURE_JS_FREE_FUNCTIONS):
+        bodies: dict[str, str] = {}
+        for package, (mjs_path, dts_path) in sources.items():
+            body = _js_exported_function_source(_read(mjs_path), name)
+            if body is None:
+                problems.append(
+                    f"pure-js-helpers: {mjs_path.relative_to(REPO_ROOT)} does not export a "
+                    f"`{name}` function. A helper only one package ships cannot be named in a "
+                    "declaration file both packages publish."
+                )
+            else:
+                bodies[package] = body
+            if not re.search(r"^export function %s\s*\(" % re.escape(name), _read(dts_path), re.MULTILINE):
+                problems.append(
+                    f"pure-js-helpers: {dts_path.relative_to(REPO_ROOT)} does not declare `export function {name}`"
+                )
+        if len(bodies) == len(sources) and len(set(bodies.values())) != 1:
+            problems.append(
+                f"pure-js-helpers: the `{name}` implementations have diverged between "
+                f"{NPM_COMMON_MJS.relative_to(REPO_ROOT)} and {NODE_INDEX_MJS.relative_to(REPO_ROOT)}. "
+                "The two packages share no module, so the copies are held together here or not "
+                "at all."
+            )
+
+    return problems
+
+
+# ---------------------------------------------------------------------------
+# Check 3: README instance-method count <-> actual registration count.
+# ---------------------------------------------------------------------------
+
+_NUMBER_WORDS = {
+    "zero": 0,
+    "one": 1,
+    "two": 2,
+    "three": 3,
+    "four": 4,
+    "five": 5,
+    "six": 6,
+    "seven": 7,
+    "eight": 8,
+    "nine": 9,
+    "ten": 10,
+}
+
+_README_COUNT_RE = re.compile(r"register (\d+) instance methods plus the\s+(\w+) static factories")
+_README_SHARED_COUNT_RE = re.compile(r"instance methods, (\d+) are shared with WASM; (\w+) remain WASM-only")
+
+
+def check_readme_counts() -> List[str]:
+    problems: List[str] = []
+    cc_text = _read(NODE_WORKBOOK_CLASS_CC)
+    actual_instance = len(set(re.findall(r'InstanceMethod<[^>]+>\("([^"]+)"\)', cc_text)))
+    actual_static = len(set(re.findall(r'StaticMethod<[^>]+>\("([^"]+)"\)', cc_text)))
+
+    readme_text = _read(NODE_README)
+    match = _README_COUNT_RE.search(readme_text)
+    if not match:
+        problems.append(
+            f"readme-counts: could not find the instance/static method-count sentence in "
+            f"{NODE_README.relative_to(REPO_ROOT)} (pattern: {_README_COUNT_RE.pattern!r})"
+        )
+        return problems
+
+    quoted_instance = int(match.group(1))
+    quoted_static_word = match.group(2).lower()
+    quoted_static = _NUMBER_WORDS.get(quoted_static_word)
+
+    if quoted_instance != actual_instance:
+        problems.append(
+            f"readme-counts: {NODE_README.relative_to(REPO_ROOT)} claims {quoted_instance} instance methods, "
+            f"actual count in {NODE_WORKBOOK_CLASS_CC.relative_to(REPO_ROOT)} is {actual_instance}"
+        )
+    if quoted_static is None or quoted_static != actual_static:
+        problems.append(
+            f"readme-counts: {NODE_README.relative_to(REPO_ROOT)} claims {match.group(2)!r} static factories, "
+            f"actual count in {NODE_WORKBOOK_CLASS_CC.relative_to(REPO_ROOT)} is {actual_static}"
+        )
+
+    wasm_cpp_text = _read(WASM_BINDINGS_CPP)
+    wasm_instance = set(re.findall(r'\.function\("([^"]+)"', wasm_cpp_text))
+    actual_node_methods = set(re.findall(r'InstanceMethod<[^>]+>\("([^"]+)"\)', cc_text))
+    actual_shared = len(wasm_instance & actual_node_methods)
+    actual_wasm_only = len(wasm_instance - actual_node_methods)
+    shared_match = _README_SHARED_COUNT_RE.search(readme_text)
+    if not shared_match:
+        problems.append(
+            f"readme-counts: could not find the shared/WASM-only method-count sentence in "
+            f"{NODE_README.relative_to(REPO_ROOT)}"
+        )
+    else:
+        quoted_shared = int(shared_match.group(1))
+        quoted_wasm_only = _NUMBER_WORDS.get(shared_match.group(2).lower())
+        if quoted_shared != actual_shared:
+            problems.append(
+                f"readme-counts: {NODE_README.relative_to(REPO_ROOT)} claims {quoted_shared} shared methods, "
+                f"actual shared count is {actual_shared}"
+            )
+        if quoted_wasm_only is None or quoted_wasm_only != actual_wasm_only:
+            problems.append(
+                f"readme-counts: {NODE_README.relative_to(REPO_ROOT)} claims {shared_match.group(2)!r} WASM-only methods, "
+                f"actual count is {actual_wasm_only}"
+            )
+
+    return problems
+
+
+# Maps each `.d.ts` enum name to the (source description, extractor) pair
+# that finds its mirrored C/C++ enum's ordinal sequence. `fm_*_t` names
+# resolve against formulon_c.h; the remaining few are plain C++ `enum
+# class` types in their own small headers (comparing against the giant
+# formulon_c.h text for those would just add false-positive risk from an
+# unrelated same-named enum elsewhere).
+_DTS_ENUM_SOURCES = {
+    "ValueKind": (CAPI_HEADER, "fm_value_kind_t", _extract_c_typedef_enum),
+    "WorkbookFormat": (CAPI_HEADER, "fm_workbook_format_t", _extract_c_typedef_enum),
+    "PivotCellKind": (CAPI_HEADER, "fm_pivot_cell_kind_t", _extract_c_typedef_enum),
+    "PivotAxis": (CAPI_HEADER, "fm_pivot_axis_t", _extract_c_typedef_enum),
+    "PivotAggregation": (CAPI_HEADER, "fm_pivot_aggregation_t", _extract_c_typedef_enum),
+    "PivotShowValuesAs": (CAPI_HEADER, "fm_pivot_show_as_t", _extract_c_typedef_enum),
+    "PivotFilterType": (CAPI_HEADER, "fm_pivot_filter_type_t", _extract_c_typedef_enum),
+    "PivotDateGrouping": (CAPI_HEADER, "fm_pivot_date_grouping_t", _extract_c_typedef_enum),
+    "PivotCalendar": (CAPI_HEADER, "fm_pivot_calendar_t", _extract_c_typedef_enum),
+    "PivotReportLayout": (CAPI_HEADER, "fm_pivot_layout_t", _extract_c_typedef_enum),
+    "PivotFilterValueKind": (CAPI_HEADER, "fm_pivot_filter_value_kind_t", _extract_c_typedef_enum),
+    "SheetVisibility": (CAPI_HEADER, "fm_sheet_visibility_t", _extract_c_typedef_enum),
+    "CfMatchKind": (CF_MATCH_H, "CFMatchKind", _extract_cpp_enum_class),
+    "CalcMode": (CALC_MODE_H, "CalcMode", _extract_cpp_enum_class),
+    "ErrorCode": (VALUE_H, "ErrorCode", _extract_cpp_enum_class),
+    "ExternalLinkKind": (EXTERNAL_LINKS_H, "Kind", _extract_cpp_enum_class),
+}
+
+
+def check_dts_enums() -> List[str]:
+    problems: List[str] = []
+    dts_text = _read(WASM_DTS)
+
+    for ts_name, (source_path, source_enum, extractor) in sorted(_DTS_ENUM_SOURCES.items()):
+        ts_values = _extract_ts_enum(dts_text, ts_name)
+        if ts_values is None:
+            problems.append(
+                f"dts-enums: could not find/parse `export enum {ts_name}` in {WASM_DTS.relative_to(REPO_ROOT)}"
+            )
+            continue
+
+        source_text = _read(source_path)
+        source_values = extractor(source_text, source_enum)
+        if source_values is None:
+            problems.append(
+                f"dts-enums: could not find/parse `{source_enum}` in {source_path.relative_to(REPO_ROOT)} "
+                f"(needed to check {WASM_DTS.relative_to(REPO_ROOT)}'s {ts_name})"
+            )
+            continue
+
+        if ts_values != source_values:
+            problems.append(
+                f"dts-enums: {ts_name} in {WASM_DTS.relative_to(REPO_ROOT)} has ordinals {ts_values}, "
+                f"but its source {source_enum} in {source_path.relative_to(REPO_ROOT)} has {source_values}"
+            )
+
+    problems.extend(_check_js_constant_tables(dts_text))
+    return problems
+
+
+def _check_js_constant_tables(wasm_dts_text: str) -> List[str]:
+    problems: List[str] = _npm_entries_reexport_common("dts-enums")
+    npm = _parse_js_constants(NPM_COMMON_MJS)
+    native = _parse_js_constants(NODE_INDEX_MJS)
+    npm_label = NPM_COMMON_MJS.relative_to(REPO_ROOT)
+    native_label = NODE_INDEX_MJS.relative_to(REPO_ROOT)
+
+    only_npm = sorted(set(npm) - set(native))
+    only_native = sorted(set(native) - set(npm))
+    if only_npm:
+        problems.append(f"dts-enums: exported by {npm_label} but not {native_label}: {only_npm}")
+    if only_native:
+        problems.append(f"dts-enums: exported by {native_label} but not {npm_label}: {only_native}")
+
+    for name in sorted(set(npm) & set(native)):
+        if npm[name] != native[name]:
+            problems.append(f"dts-enums: {name} is {npm[name]} in {npm_label} but {native[name]} in {native_label}")
+
+    # Each runtime table must also match the declaration file its own
+    # package ships, and the tables (not the bare scalars) must match the
+    # canonical WASM `.d.ts`.
+    node_dts_text = _read(NODE_DTS)
+    for label, constants, dts_text, dts_path in (
+        (npm_label, npm, wasm_dts_text, WASM_DTS),
+        (native_label, native, node_dts_text, NODE_DTS),
+    ):
+        for name, value in sorted(constants.items()):
+            if not isinstance(value, dict):
+                if not re.search(r"export const\s+" + re.escape(name) + r"\s*=\s*" + str(value) + r"\b", dts_text):
+                    problems.append(
+                        f"dts-enums: {label} exports {name} = {value}, "
+                        f"not declared with that value in {dts_path.relative_to(REPO_ROOT)}"
+                    )
+                continue
+            declared = _parse_ts_named_enum(dts_text, name)
+            if declared is None:
+                problems.append(
+                    f"dts-enums: {label} exports the table {name}, "
+                    f"which {dts_path.relative_to(REPO_ROOT)} does not declare as a value"
+                )
+            elif declared != value:
+                problems.append(
+                    f"dts-enums: {name} is {value} in {label} but {declared} in {dts_path.relative_to(REPO_ROOT)}"
+                )
+
+    canonical_only = sorted(
+        name for name in _DTS_ENUM_SOURCES if name not in npm or not isinstance(npm.get(name), dict)
+    )
+    if canonical_only:
+        problems.append(
+            f"dts-enums: {WASM_DTS.relative_to(REPO_ROOT)} declares these enums but {npm_label} "
+            f"does not export them as runtime tables: {canonical_only}"
+        )
+    return problems
+
+
+# ---------------------------------------------------------------------------
+# Check 7: the npm-native package's staged copies <-> their sources.
+#
+# `stage.mjs` publishes `packages/npm-native/dist/` by copying `index.d.ts`
+# and `index.mjs` verbatim out of the package root. Every other check in this
+# file reads the source side only, so an edit that lands in the source but is
+# never re-staged publishes a declaration file that no longer describes the
+# runtime, or an ordinal table that no longer matches the one `dts-enums`
+# verified. The WASM package already guards its own staged `.d.ts`
+# (packages/npm/scripts/check-dts.mjs); npm-native had no equivalent, which
+# matters most for a mechanical rewrite that touches one side of the pair.
+# ---------------------------------------------------------------------------
+
+# (source, staged copy) pairs `stage.mjs` produces with a verbatim copyFile.
+_NODE_STAGED_COPIES = (
+    (NODE_DTS, NODE_DIST_DIR / "index.d.ts"),
+    (NODE_INDEX_MJS, NODE_DIST_DIR / "index.mjs"),
+)
+
+
+def check_staged_dist() -> List[str]:
+    problems: List[str] = []
+    for source, staged in _NODE_STAGED_COPIES:
+        if not staged.is_file():
+            # `dist/` is gitignored, so a fresh clone has nothing to compare
+            # until the package is staged. Record that as not-checked instead
+            # of passing: this check exists because a silent pass is
+            # indistinguishable from a real one.
+            _SKIPPED.append(
+                f"staged-dist: {staged.relative_to(REPO_ROOT)} is absent; the npm-native "
+                "package has not been staged in this tree (`make node-package`)"
+            )
+            continue
+        if _read_bytes(source) != _read_bytes(staged):
+            problems.append(
+                f"staged-dist: {staged.relative_to(REPO_ROOT)} differs from "
+                f"{source.relative_to(REPO_ROOT)}; the published copy is stale -- "
+                "re-stage the package with `make node-package`"
+            )
+    return problems
diff --git a/tools/dev/binding_drift/enum_decl.py b/tools/dev/binding_drift/enum_decl.py
new file mode 100644
index 000000000..46a8e4019
--- /dev/null
+++ b/tools/dev/binding_drift/enum_decl.py
@@ -0,0 +1,135 @@
+"""Enumerator extraction from C, C++ and TypeScript enum bodies."""
+
+from __future__ import annotations
+
+import re
+from typing import List, Optional
+
+# ---------------------------------------------------------------------------
+# Check 5: src/wasm/formulon.d.ts `export enum` ordinals <-> their C/C++
+#          source enum. embind never registers these as a real `enum_<T>`
+#          (that would cost WASM size for values only ever crossing the
+#          boundary as plain numbers); the `.d.ts` copy is therefore the
+#          sole place the JS-visible ordinals live, and nothing enforces
+#          that it still matches the source enum after a reorder / insert.
+# ---------------------------------------------------------------------------
+
+_ENUM_BODY_COMMENT_RE = re.compile(r"//[^\n]*|/\*.*?\*/", re.DOTALL)
+_ENUM_MEMBER_RE = re.compile(r"([A-Za-z_][A-Za-z0-9_]*)\s*(?:=\s*(-?(?:0[xX][0-9a-fA-F]+|\d+)))?\s*$")
+
+
+def _parse_enum_body(body: str) -> Optional[List[int]]:
+    """Parses a brace-delimited enumerator list into its ordinal values.
+
+    Handles both explicit `Name = N` members and implicit sequential
+    values (each unset member is one more than the previous value, C/C++/TS
+    enum semantics). Returns `None` if a member's initializer is not a
+    literal integer (e.g. it references another constant) -- the caller
+    should skip comparison in that case rather than mis-flag a drift.
+    """
+    body = _ENUM_BODY_COMMENT_RE.sub("", body)
+    values: List[int] = []
+    next_value = 0
+    for part in body.split(","):
+        part = part.strip()
+        if not part:
+            continue
+        match = _ENUM_MEMBER_RE.match(part)
+        if not match:
+            return None
+        literal = match.group(2)
+        if literal is not None:
+            next_value = int(literal, 0)
+        values.append(next_value)
+        next_value += 1
+    return values
+
+
+def _extract_c_typedef_enum(text: str, type_name: str) -> Optional[List[int]]:
+    # `[^}]*` (rather than a non-greedy `.*?`) deliberately cannot cross a
+    # `}` boundary, so a search starting at an *earlier*, unrelated
+    # `typedef enum { ... }` block cannot skip past its own close brace
+    # and accidentally splice in a later block that happens to close with
+    # this `type_name`.
+    match = re.search(r"typedef enum\s*\{([^}]*)\}\s*" + re.escape(type_name) + r"\s*;", text, re.DOTALL)
+    if not match:
+        return None
+    return _parse_enum_body(match.group(1))
+
+
+def _cpp_enum_class_body(text: str, enum_name: str) -> Optional[str]:
+    """The brace-delimited enumerator list of a scoped enum, or `None`."""
+    match = re.search(
+        r"enum class\s+" + re.escape(enum_name) + r"\s*(?::\s*[\w:]+)?\s*\{([^}]*)\}\s*;", text, re.DOTALL
+    )
+    return match.group(1) if match else None
+
+
+def _extract_cpp_enum_class(text: str, enum_name: str) -> Optional[List[int]]:
+    body = _cpp_enum_class_body(text, enum_name)
+    if body is None:
+        return None
+    return _parse_enum_body(body)
+
+
+def _extract_ts_enum(text: str, enum_name: str) -> Optional[List[int]]:
+    match = re.search(r"export (?:const )?enum\s+" + re.escape(enum_name) + r"\s*\{([^}]*)\}", text, re.DOTALL)
+    if not match:
+        return None
+    return _parse_enum_body(match.group(1))
+
+
+def _parse_ts_named_enum(text: str, name: str) -> Optional[dict]:
+    """Reads a `.d.ts` ordinal table in either idiom used across the two
+    declaration files: a TS `export enum` or an `export const` whose type
+    is a `Readonly<{...}>` literal."""
+    match = re.search(r"export enum\s+" + re.escape(name) + r"\s*\{([^}]*)\}", text, re.DOTALL)
+    if match is None:
+        match = re.search(r"export const\s+" + re.escape(name) + r"\s*:\s*Readonly<\{([^}]*)\}>", text, re.DOTALL)
+    if match is None:
+        return None
+    body = _ENUM_BODY_COMMENT_RE.sub("", match.group(1))
+    members: dict = {}
+    next_value = 0
+    for part in body.replace(";", ",").split(","):
+        part = part.strip()
+        if not part:
+            continue
+        member = re.match(r"([A-Za-z_]\w*)\s*(?:[:=]\s*(-?\d+))?$", part)
+        if member is None:
+            return None
+        if member.group(2) is not None:
+            next_value = int(member.group(2))
+        members[member.group(1)] = next_value
+        next_value += 1
+    return members
+
+
+def _cpp_enum_class_values(text: str, enum_name: str) -> Optional[dict[str, int]]:
+    """Parses a scoped enum into a name -> value map.
+
+    The value-only sibling `_extract_cpp_enum_class` compares ordinal
+    sequences; this one is for the checks that need to look a member up by
+    name. Implicit members take one more than the previous value, as in C++.
+    Returns `None` when the enum is absent or a member's initializer is not a
+    literal integer, so the caller reports the parse failure rather than a
+    false drift.
+    """
+    raw_body = _cpp_enum_class_body(text, enum_name)
+    if raw_body is None:
+        return None
+    values: dict[str, int] = {}
+    next_value = 0
+    for part in _ENUM_BODY_COMMENT_RE.sub("", raw_body).split(","):
+        part = part.strip()
+        if not part:
+            continue
+        member = _ENUM_MEMBER_RE.match(part)
+        if not member:
+            return None
+        literal = member.group(2)
+        if literal is not None:
+            next_value = int(literal, 0)
+        values[member.group(1)] = next_value
+        next_value += 1
+    return values
diff --git a/tools/dev/binding_drift/python_checks.py b/tools/dev/binding_drift/python_checks.py
new file mode 100644
index 000000000..7b3ff5fc7
--- /dev/null
+++ b/tools/dev/binding_drift/python_checks.py
@@ -0,0 +1,745 @@
+"""Drift checks between the C ABI header and the Python binding."""
+
+from __future__ import annotations
+
+import ast
+import importlib.util
+import re
+from pathlib import Path
+from typing import List, Optional, Set
+
+from .c_header import _c_function_params, _LayoutError, _wasm32_layout, _Wasm32Layouts
+from .surface_files import (
+    _SKIPPED,
+    CAPI_EXPORTS,
+    CAPI_HEADER,
+    PYTHON_C_BINDING,
+    PYTHON_PKG_DIR,
+    PYTHON_STRUCTS,
+    PYTHON_WORKBOOK,
+    REPO_ROOT,
+    _read,
+)
+
+
+def _parse_literal_status_exports() -> tuple[Set[str], Optional[str]]:
+    """Read `_STATUS_RETURNING_EXPORT_NAMES` without importing `_c.py`.
+
+    Importing the binding would load wasmtime and, depending on the
+    environment, initialize a real WASM instance. The drift check is a
+    source-level consistency check, so an AST walk keeps it stdlib-only and
+    side-effect-free.
+    """
+    try:
+        tree = ast.parse(_read(PYTHON_C_BINDING), filename=str(PYTHON_C_BINDING))
+    except SyntaxError as exc:
+        return set(), f"python-exports: cannot parse {PYTHON_C_BINDING.relative_to(REPO_ROOT)}: {exc}"
+
+    for statement in tree.body:
+        if isinstance(statement, ast.Assign):
+            targets = statement.targets
+        elif isinstance(statement, ast.AnnAssign):
+            targets = [statement.target]
+        else:
+            continue
+        if not any(
+            isinstance(target, ast.Name) and target.id == "_STATUS_RETURNING_EXPORT_NAMES" for target in targets
+        ):
+            continue
+        value = statement.value
+        if not isinstance(value, ast.Tuple):
+            return set(), "python-exports: _STATUS_RETURNING_EXPORT_NAMES must be a literal tuple"
+        names: Set[str] = set()
+        for element in value.elts:
+            if not isinstance(element, ast.Constant) or not isinstance(element.value, str):
+                return set(), "python-exports: _STATUS_RETURNING_EXPORT_NAMES must contain only string literals"
+            names.add(element.value)
+        return names, None
+
+    return (
+        set(),
+        "python-exports: _STATUS_RETURNING_EXPORT_NAMES literal tuple not found in packages/python/formulon/_c.py",
+    )
+
+
+# ---------------------------------------------------------------------------
+# Check 1: Python `LIB.fm_*` calls <-> tools/wasm/capi_exports.txt <->
+#          src/c_api/formulon_c.h declarations.
+# ---------------------------------------------------------------------------
+
+
+def check_python_exports() -> List[str]:
+    problems: List[str] = []
+
+    python_calls: Set[str] = set()
+    for py_file in sorted(PYTHON_PKG_DIR.glob("*.py")):
+        python_calls |= set(re.findall(r"\bLIB\.(fm_[A-Za-z0-9_]+)", _read(py_file)))
+
+    exports_text = _read(CAPI_EXPORTS)
+    exports: Set[str] = set()
+    for line in exports_text.splitlines():
+        stripped = line.strip()
+        if stripped and not stripped.startswith("#"):
+            exports.add(stripped)
+
+    header_text = _read(CAPI_HEADER)
+    header_fns = set(re.findall(r"\bfm_[A-Za-z0-9_]+(?=\s*\()", header_text))
+
+    missing_from_exports = python_calls - exports
+    if missing_from_exports:
+        problems.append(
+            "python-exports: Python calls a symbol not staged in "
+            f"{CAPI_EXPORTS.relative_to(REPO_ROOT)}: {sorted(missing_from_exports)}"
+        )
+
+    # capi_exports.txt also lists a handful of non-`fm_` allocator symbols
+    # (`malloc`/`free`) needed for host-side scratch-buffer plumbing; those
+    # are libc, not part of the `fm_*` C ABI, and are never declared in
+    # formulon_c.h. Only the `fm_*` subset is checked against the header.
+    fm_exports = {symbol for symbol in exports if symbol.startswith("fm_")}
+    exports_not_in_header = fm_exports - header_fns
+    if exports_not_in_header:
+        problems.append(
+            "python-exports: symbol staged in "
+            f"{CAPI_EXPORTS.relative_to(REPO_ROOT)} but not declared in "
+            f"{CAPI_HEADER.relative_to(REPO_ROOT)}: {sorted(exports_not_in_header)}"
+        )
+
+    # The WASM result type is not enough to identify status calls: counts,
+    # indices, and pointers are also i32. Keep the binding's capture list as
+    # a literal and compare it to the authoritative header/manifest
+    # intersection without importing `_c.py` or wasmtime.
+    header_status_fns = set(re.findall(r"\bFM_API\s+fm_status_t\s+(fm_[A-Za-z0-9_]+)\s*\(", header_text))
+    expected_status_exports = header_status_fns & fm_exports
+    binding_status_exports, parse_problem = _parse_literal_status_exports()
+    if parse_problem:
+        problems.append(parse_problem)
+
+    missing_status_exports = expected_status_exports - binding_status_exports
+    if missing_status_exports:
+        problems.append(
+            "python-exports: _STATUS_RETURNING_EXPORT_NAMES is missing status-returning exports: "
+            f"{sorted(missing_status_exports)}"
+        )
+
+    extra_status_exports = binding_status_exports - expected_status_exports
+    if extra_status_exports:
+        problems.append(
+            f"python-exports: _STATUS_RETURNING_EXPORT_NAMES has extra exports: {sorted(extra_status_exports)}"
+        )
+
+    return problems
+
+
+def _flatten_for_python(
+    layouts: _Wasm32Layouts, struct_name: str, py_field_names: Set[str]
+) -> List[tuple[str, int, int]]:
+    """C members of `struct_name` in the shape the Python layout models them.
+
+    Python keeps one flat field map per struct, so an embedded POD appears in
+    it one of two ways and both have to be accepted: as a single opaque blob
+    under the C member's own name (`fm_pivot_cell_t.value`), or spread into
+    the parent's map (`fm_cf_color_t color` contributing `color_r`). Which one
+    applies is read off the Python layout, so a struct that switches
+    representation needs no edit here -- only the nesting depth Python
+    actually flattens is followed.
+    """
+    fields: List[tuple[str, int, int]] = []
+    for member in layouts.members(struct_name):
+        if member.name in py_field_names or not layouts.is_struct(member.ctype):
+            fields.append((member.name, member.size, member.align))
+            continue
+        for inner in layouts.members(member.ctype):
+            name = inner.name if inner.name in py_field_names else f"{member.name}_{inner.name}"
+            fields.append((name, inner.size, inner.align))
+    return fields
+
+
+def check_python_struct_layouts() -> List[str]:
+    """Verify Python's hand-written WASM32 structs against the C header.
+
+    Every size and offset is measured from the authoritative C declarations
+    rather than repeated in a Python table -- including the structs embedded
+    inside other structs, which are laid out recursively. Only the wasm32
+    scalar, pointer and enum widths are tabulated, because the header does not
+    state those. It covers every ``Struct`` exported by ``_structs.py`` and
+    reports field order, offsets, and final size.
+    """
+    layouts = _Wasm32Layouts(re.sub(r"/\*.*?\*/", "", _read(CAPI_HEADER), flags=re.S))
+    spec = importlib.util.spec_from_file_location("formulon_struct_layouts", PYTHON_STRUCTS)
+    if spec is None or spec.loader is None:
+        return ["python-struct-layout: could not load packages/python/formulon/_structs.py"]
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+
+    problems: List[str] = []
+    for layout in (value for value in vars(module).values() if isinstance(value, module.Struct)):
+        py_field_names = {name for name, _ in layout.fields}
+        try:
+            c_fields = _flatten_for_python(layouts, layout.name, py_field_names)
+        except _LayoutError as exc:
+            problems.append(f"python-struct-layout: {exc}")
+            continue
+        # Explicit C padding need not be represented in Struct: its alignment
+        # effect is reproduced by the following semantic field. It is still
+        # laid out here so the offsets after it are right.
+        c_offsets, c_size, _ = _wasm32_layout(c_fields)
+        c_sizes = {name: size for name, size, _ in c_fields}
+        semantic_names = [name for name, _, _ in c_fields if not name.startswith("_pad")]
+        py_names = [name for name, _ in layout.fields if not name.startswith("_pad")]
+        py_sizes = {name: spec[1] for name, spec in layout.fields}
+        if py_names != semantic_names:
+            problems.append(f"python-struct-layout: {layout.name} fields differ: C={semantic_names}, Python={py_names}")
+        for name in py_names:
+            if name in c_offsets and layout.offsets[name][1] != c_offsets[name]:
+                problems.append(
+                    f"python-struct-layout: {layout.name}.{name} offset C={c_offsets[name]} Python={layout.offsets[name][1]}"
+                )
+            # Field width is checked separately from offset: narrowing a field
+            # whose successor is more strictly aligned leaves every offset and
+            # the total size intact, so the offset comparison alone reads the
+            # wrong number of bytes without ever disagreeing.
+            if name in c_sizes and py_sizes[name] != c_sizes[name]:
+                problems.append(
+                    f"python-struct-layout: {layout.name}.{name} size C={c_sizes[name]} Python={py_sizes[name]}"
+                )
+        if layout.size != c_size:
+            problems.append(f"python-struct-layout: {layout.name} size C={c_size} Python={layout.size}")
+    return problems
+
+
+# Scratch readers whose name pins how many bytes come back out of the slot.
+# `read_cstr` is deliberately absent: it walks to a NUL rather than reading a
+# fixed width, so it is checked for the deref mistake only (below).
+_SCRATCH_READER_WIDTHS = {"read_u32": 4, "read_i32": 4, "read_f64": 8}
+
+
+def _module_int_constants(paths: List[Path]) -> dict[str, int]:
+    """Module-level `NAME = <int literal>` bindings across the binding package.
+
+    Collected across files because the constant a scratch allocation is sized
+    with may be defined in one module and imported into another
+    (`fm_value_t_size` lives in `_c.py` and is used from `workbook.py`).
+    """
+    constants: dict[str, int] = {}
+    for path in paths:
+        for statement in ast.parse(_read(path), filename=str(path)).body:
+            if not isinstance(statement, ast.Assign) or len(statement.targets) != 1:
+                continue
+            target = statement.targets[0]
+            if isinstance(target, ast.Name) and isinstance(statement.value, ast.Constant):
+                if isinstance(statement.value.value, int) and not isinstance(statement.value.value, bool):
+                    constants[target.id] = statement.value.value
+    return constants
+
+
+def _is_lib_call(node: ast.AST, attribute: Optional[str] = None) -> bool:
+    """True for `LIB.<attribute>(...)` (any `LIB.*` call when unspecified)."""
+    if not isinstance(node, ast.Call) or not isinstance(node.func, ast.Attribute):
+        return False
+    if not (isinstance(node.func.value, ast.Name) and node.func.value.id == "LIB"):
+        return False
+    return attribute is None or node.func.attr == attribute
+
+
+def _scratch_slot_widths(
+    function: ast.AST, constants: dict[str, int], struct_module: object
+) -> dict[str, Optional[int]]:
+    """Local name -> byte width of the WASM scratch block bound to it.
+
+    A width of `None` marks a slot whose size this resolver cannot pin (an
+    array allocation sized from a runtime length, or a name rebound to two
+    different widths). Those are reported rather than skipped when the C side
+    says the parameter is a struct pointer, because an unmeasurable buffer
+    behind a by-pointer struct is exactly the case a size guard exists for.
+    """
+    widths: dict[str, Optional[int]] = {}
+
+    def record(name: str, width: Optional[int]) -> None:
+        if name in widths and widths[name] != width:
+            widths[name] = None
+        else:
+            widths[name] = width
+
+    for node in ast.walk(function):
+        if not isinstance(node, ast.Assign) or len(node.targets) != 1:
+            continue
+        target = node.targets[0]
+        if not isinstance(target, ast.Name) or not isinstance(node.value, ast.Call):
+            continue
+        call = node.value
+        callee = call.func
+        # `x = _alloc_out_ptr()` -- the package's 4-byte out-i32 / out-ptr slot.
+        if isinstance(callee, ast.Name) and callee.id == "_alloc_out_ptr":
+            record(target.id, 4)
+        # `x = _alloc_out_u64()` -- the 8-byte out-uint64 slot.
+        elif isinstance(callee, ast.Name) and callee.id == "_alloc_out_u64":
+            record(target.id, 8)
+        # `x = S.alloc_struct(LIB, S.LAYOUT)` -- sized from the layout table
+        # `python-struct-layouts` already pins against the header.
+        elif (isinstance(callee, ast.Attribute) and callee.attr == "alloc_struct") or (
+            isinstance(callee, ast.Name) and callee.id == "alloc_struct"
+        ):
+            layout = call.args[1] if len(call.args) > 1 else None
+            layout_name = layout.attr if isinstance(layout, ast.Attribute) else None
+            struct = getattr(struct_module, layout_name, None) if layout_name else None
+            record(target.id, struct.size if isinstance(struct, struct_module.Struct) else None)
+        # `x = LIB.alloc(N)` / `LIB.alloc(CONSTANT)` -- a hand-sized block.
+        elif _is_lib_call(call, "alloc") and call.args:
+            size = call.args[0]
+            if isinstance(size, ast.Constant) and isinstance(size.value, int):
+                record(target.id, size.value)
+            elif isinstance(size, ast.Name) and size.id in constants:
+                record(target.id, constants[size.id])
+            else:
+                record(target.id, None)
+    return widths
+
+
+def _scratch_slot_readers(function: ast.AST) -> dict[str, Set[object]]:
+    """Local name -> the reads taken against that scratch slot.
+
+    An entry is either a `_SCRATCH_READER_WIDTHS` key, `("bytes", N)` for a
+    constant-length `LIB.read_bytes`, or `"read_cstr"`.
+    """
+    readers: dict[str, Set[object]] = {}
+    for node in ast.walk(function):
+        if not isinstance(node, ast.Call) or not _is_lib_call(node) or not node.args:
+            continue
+        first = node.args[0]
+        if not isinstance(first, ast.Name):
+            continue
+        attribute = node.func.attr if isinstance(node.func, ast.Attribute) else ""
+        if attribute in _SCRATCH_READER_WIDTHS or attribute == "read_cstr":
+            readers.setdefault(first.id, set()).add(attribute)
+        elif attribute == "read_bytes" and len(node.args) > 1 and isinstance(node.args[1], ast.Constant):
+            readers.setdefault(first.id, set()).add(("bytes", node.args[1].value))
+    return readers
+
+
+def _pointee(ctype: str) -> Optional[str]:
+    """The type a parameter points at, or `None` if it is not a pointer."""
+    ctype = ctype.strip()
+    if not ctype.endswith("*"):
+        return None
+    return ctype[:-1].strip()
+
+
+def _check_out_param_width(
+    layouts: _Wasm32Layouts,
+    site: str,
+    fn_name: str,
+    position: int,
+    ctype: str,
+    width: Optional[int],
+    reads: Set[object],
+) -> List[str]:
+    """One scratch slot against the parameter it is passed to."""
+    problems: List[str] = []
+    pointee = _pointee(ctype)
+    if pointee is None:
+        # Emscripten lowers a by-value struct parameter to a pointer into
+        # linear memory, so a scratch block is the correct thing to pass for
+        # one. Any other non-pointer parameter takes a scalar, and handing it
+        # a scratch address means the callee reads the pointer as the value.
+        bare = ctype.replace("const ", "").strip()
+        if not layouts.is_struct(bare):
+            return [
+                f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r}, "
+                "which takes a scalar by value, but the binding passes a scratch-block pointer"
+            ]
+        pointee_size, _ = layouts.extent(bare)
+        is_struct = True
+    else:
+        bare = pointee.replace("const ", "").strip()
+        if bare.endswith("*"):
+            pointee_size, is_struct = 4, False  # wasm32 pointer-to-pointer
+        else:
+            try:
+                pointee_size, _ = layouts.extent(bare)
+            except _LayoutError as exc:
+                return [f"python-call-signatures: {site}: {fn_name} parameter {position} ({ctype}): {exc}"]
+            is_struct = layouts.is_struct(bare)
+
+    if width is None:
+        if is_struct:
+            problems.append(
+                f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r}, "
+                "but the size of the scratch block passed to it cannot be resolved; give the "
+                "struct a `_structs.Struct` layout or size the allocation from a module constant"
+            )
+        return problems
+
+    if width < pointee_size:
+        problems.append(
+            f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r} "
+            f"(wasm32 pointee {pointee_size} bytes) but the binding allocates {width} bytes"
+        )
+    elif is_struct and width != pointee_size:
+        problems.append(
+            f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r} "
+            f"(wasm32 sizeof {pointee_size}) but the binding allocates {width} bytes; a struct "
+            "out-parameter block must match the C size exactly"
+        )
+
+    for read in sorted(reads, key=repr):
+        read_width = _SCRATCH_READER_WIDTHS.get(read) if isinstance(read, str) else read[1]
+        if read == "read_cstr":
+            if bare.endswith("*"):
+                problems.append(
+                    f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r}, "
+                    "so its slot holds a pointer; `read_cstr` on the slot itself decodes the "
+                    "pointer's bytes as text instead of dereferencing it"
+                )
+            continue
+        if read_width is None:
+            continue
+        if read_width > width:
+            problems.append(
+                f"python-call-signatures: {site}: {fn_name} parameter {position}'s slot is "
+                f"{width} bytes but is read with {read!r} ({read_width} bytes)"
+            )
+        elif read_width > pointee_size:
+            problems.append(
+                f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r} "
+                f"(wasm32 pointee {pointee_size} bytes) but its slot is read with {read!r} "
+                f"({read_width} bytes)"
+            )
+    return problems
+
+
+def check_python_call_signatures() -> List[str]:
+    """Verify Python's `LIB.fm_*` calls against the C header's declarations.
+
+    Covered, for every `LIB.fm_*(...)` call in `packages/python/formulon`:
+
+    * **Arity.** The number of positional arguments equals the header's
+      parameter count. A call that splats (`*pointers`) is checked as a lower
+      bound only and named in the run's SKIPPED list.
+    * **Scratch-block width.** When an argument is a local bound to a
+      recognised scratch allocation (``_alloc_out_ptr()``,
+      ``S.alloc_struct(LIB, S.LAYOUT)``, or ``LIB.alloc(...)`` with a constant
+      or module-constant size), the block is compared against the wasm32 size
+      of what the parameter addresses: never smaller, and exactly equal when
+      that is a struct. This covers both pointer parameters and the by-value
+      struct parameters Emscripten lowers to a pointer. A struct whose block
+      size cannot be resolved is reported rather than skipped.
+    * **Read width.** Reads taken against such a slot (``read_u32`` /
+      ``read_i32`` / ``read_f64`` / constant-length ``read_bytes``) must not
+      exceed either the block or the pointee, and ``read_cstr`` must not be
+      applied to a slot that holds a pointer.
+
+    NOT covered: argument *types* at non-pointer positions (nothing on the
+    Python side records whether a value was meant to be a `uint32_t` or a
+    `double`; the wasmtime layer passes plain Python ints and floats), return
+    types beyond what `python-exports` already pins, and both non-Python
+    bindings -- embind and N-API bind C++ entry points directly rather than
+    the `fm_*` C ABI, so this header has no arity relationship to them.
+    """
+    header = re.sub(r"/\*.*?\*/", "", _read(CAPI_HEADER), flags=re.S)
+    declarations = _c_function_params(header)
+    layouts = _Wasm32Layouts(header)
+
+    spec = importlib.util.spec_from_file_location("formulon_struct_layouts_sig", PYTHON_STRUCTS)
+    if spec is None or spec.loader is None:
+        return ["python-call-signatures: could not load packages/python/formulon/_structs.py"]
+    struct_module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(struct_module)
+
+    sources = sorted(PYTHON_PKG_DIR.glob("*.py"))
+    constants = _module_int_constants(sources)
+
+    problems: List[str] = []
+    checked_calls = 0
+    for path in sources:
+        label = path.relative_to(REPO_ROOT)
+        tree = ast.parse(_read(path), filename=str(path))
+        # Analysis is per enclosing function: a scratch local is only
+        # meaningfully tied to the calls in the scope that allocated it.
+        scopes = [node for node in ast.walk(tree) if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef))]
+        for scope in scopes:
+            widths = _scratch_slot_widths(scope, constants, struct_module)
+            readers = _scratch_slot_readers(scope)
+            for node in ast.walk(scope):
+                if not isinstance(node, ast.Call) or not isinstance(node.func, ast.Attribute):
+                    continue
+                if not _is_lib_call(node):
+                    continue
+                fn_name = node.func.attr
+                if not fn_name.startswith("fm_"):
+                    continue
+                site = f"{label}:{node.lineno}"
+                params = declarations.get(fn_name)
+                if params is None:
+                    problems.append(f"python-call-signatures: {site}: {fn_name} is not declared in the C header")
+                    continue
+                checked_calls += 1
+                if node.keywords:
+                    problems.append(
+                        f"python-call-signatures: {site}: {fn_name} is called with keyword arguments; "
+                        "the wasmtime export takes positional arguments only"
+                    )
+                    continue
+                starred = any(isinstance(arg, ast.Starred) for arg in node.args)
+                if starred:
+                    fixed = len(node.args) - 1
+                    if fixed > len(params):
+                        problems.append(
+                            f"python-call-signatures: {site}: {fn_name} passes {fixed} arguments before its "
+                            f"splat but the C header declares only {len(params)} parameters"
+                        )
+                    _SKIPPED.append(
+                        f"python-call-signatures: {site}: {fn_name} splats its trailing arguments, so only "
+                        f"the {fixed}-argument lower bound is checked against the header's {len(params)}"
+                    )
+                    continue
+                if len(node.args) != len(params):
+                    problems.append(
+                        f"python-call-signatures: {site}: {fn_name} is called with {len(node.args)} "
+                        f"arguments but the C header declares {len(params)}: {params}"
+                    )
+                    continue
+                for position, argument in enumerate(node.args):
+                    if not isinstance(argument, ast.Name) or argument.id not in widths:
+                        continue
+                    problems.extend(
+                        _check_out_param_width(
+                            layouts,
+                            site,
+                            fn_name,
+                            position,
+                            params[position],
+                            widths[argument.id],
+                            readers.get(argument.id, set()),
+                        )
+                    )
+
+    if not checked_calls:
+        problems.append(
+            "python-call-signatures: no `LIB.fm_*` call sites found in "
+            f"{PYTHON_PKG_DIR.relative_to(REPO_ROOT)}; the check has stopped looking at anything"
+        )
+    # A call inside a nested `def` is reached both as part of the enclosing
+    # scope's walk and as its own scope, so the same finding can be produced
+    # twice. Deduplicate in place rather than restricting the walk: an inner
+    # closure that uses a scratch slot its parent allocated still has to be
+    # checked against that slot's width.
+    return list(dict.fromkeys(problems))
+
+
+# ---------------------------------------------------------------------------
+# Check 1d: C structs the Python binding decodes inline <-> the C header.
+#
+# `python-struct-layouts` only sees structs that have a `_structs.Struct`
+# entry. A struct small enough to decode with a bare `struct.unpack` -- an
+# `fm_value_t`, an `fm_print_range_t` -- has no such entry, so its field
+# offsets and widths live as literals in the decoding function and nothing
+# compares them to the header.
+# ---------------------------------------------------------------------------
+
+# (source file, decoder qualname, C struct). Each decoder is expected to
+# consume the whole struct, so its `struct` calls are read as a description
+# of the C layout and compared field for field.
+_PYTHON_INLINE_DECODERS = (
+    ("Value._from_wasm", "fm_value_t"),
+    ("Workbook.paginate", "fm_print_range_t"),
+)
+
+# Python-side size literals for a struct with no `_structs.Struct` entry, as
+# (module, binding name, C struct). A `Struct`-shaped tuple binding is
+# compared on both size and alignment; a bare int on size alone.
+_PYTHON_SIZE_CONSTANTS = (
+    (PYTHON_C_BINDING, "fm_value_t_size", "fm_value_t"),
+    (PYTHON_STRUCTS, "VALUE_BLOB", "fm_value_t"),
+)
+
+# C structs that cross the ABI but that no binding marshals, so there is no
+# second side to compare against. Each is pinned by a native/wasm32
+# `static_assert` tripwire in tests/c_api instead; listing them here keeps the
+# absence deliberate, and `python-call-signatures` fails if a binding starts
+# passing one an unmeasurable block.
+_UNMODELLED_C_STRUCTS = {"fm_styles_batch"}
+
+_STRUCT_FORMAT_WIDTHS = {"b": 1, "B": 1, "h": 2, "H": 2, "i": 4, "I": 4, "q": 8, "Q": 8, "f": 4, "d": 8}
+
+
+def _struct_format_widths(fmt: str) -> Optional[List[int]]:
+    """Per-item byte widths of a little-endian `struct` format string."""
+    if not fmt.startswith("<"):
+        return None
+    widths: List[int] = []
+    for char in fmt[1:]:
+        width = _STRUCT_FORMAT_WIDTHS.get(char)
+        if width is None:
+            return None
+        widths.append(width)
+    return widths
+
+
+def _find_qualified_function(tree: ast.AST, qualname: str) -> Optional[ast.AST]:
+    class_name, _, function_name = qualname.rpartition(".")
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.ClassDef) or node.name != class_name:
+            continue
+        for member in node.body:
+            if isinstance(member, (ast.FunctionDef, ast.AsyncFunctionDef)) and member.name == function_name:
+                return member
+    return None
+
+
+def check_python_inline_structs() -> List[str]:
+    """Verify Python's inline `struct.unpack` decoders against the C header.
+
+    Two things are compared, both measured from the C declarations rather
+    than tabulated here:
+
+    * A size literal the binding carries for a struct with no
+      `_structs.Struct` entry (`fm_value_t_size`, `VALUE_BLOB`) equals the
+      struct's wasm32 size, and its alignment where the binding records one.
+    * Inside each decoder in `_PYTHON_INLINE_DECODERS`, every
+      `struct.unpack_from(fmt, buf, offset)` lands on a C member offset and
+      reads no wider than that member, every whole-struct `struct.unpack(fmt,
+      ...)` describes the C members' widths in order, and every
+      constant-length `LIB.read_bytes` spans exactly the struct.
+
+    NOT covered: the *meaning* of a field (a decoder that reads the right
+    width from the right offset into the wrong attribute still passes), and
+    any struct in `_UNMODELLED_C_STRUCTS`, which no binding marshals and
+    which therefore has only a `static_assert` tripwire.
+    """
+    header = re.sub(r"/\*.*?\*/", "", _read(CAPI_HEADER), flags=re.S)
+    layouts = _Wasm32Layouts(header)
+    constants = _module_int_constants(sorted(PYTHON_PKG_DIR.glob("*.py")))
+    problems: List[str] = []
+
+    def measure(struct_name: str) -> Optional[tuple[dict[str, int], int, int, dict[str, int]]]:
+        try:
+            members = layouts.members(struct_name)
+        except _LayoutError as exc:
+            problems.append(f"python-inline-structs: {exc}")
+            return None
+        offsets, size, align = _wasm32_layout([(m.name, m.size, m.align) for m in members])
+        return offsets, size, align, {m.name: m.size for m in members}
+
+    for struct_name in sorted(_UNMODELLED_C_STRUCTS):
+        if not layouts.is_struct(struct_name):
+            problems.append(
+                f"python-inline-structs: {struct_name} is listed as unmodelled by every binding "
+                f"but no longer exists in {CAPI_HEADER.relative_to(REPO_ROOT)}"
+            )
+
+    for module_path, binding_name, struct_name in _PYTHON_SIZE_CONSTANTS:
+        measured = measure(struct_name)
+        if measured is None:
+            continue
+        _, c_size, c_align, _ = measured
+        label = module_path.relative_to(REPO_ROOT)
+        found = False
+        for statement in ast.parse(_read(module_path), filename=str(module_path)).body:
+            if not isinstance(statement, ast.Assign) or len(statement.targets) != 1:
+                continue
+            target = statement.targets[0]
+            if not isinstance(target, ast.Name) or target.id != binding_name:
+                continue
+            found = True
+            value = statement.value
+            if isinstance(value, ast.Constant) and isinstance(value.value, int):
+                if value.value != c_size:
+                    problems.append(
+                        f"python-inline-structs: {label}: {binding_name} is {value.value}, "
+                        f"but wasm32 sizeof({struct_name}) is {c_size}"
+                    )
+            elif isinstance(value, ast.Tuple) and len(value.elts) == 3:
+                elements = [element.value if isinstance(element, ast.Constant) else None for element in value.elts]
+                if elements[1] != c_size:
+                    problems.append(
+                        f"python-inline-structs: {label}: {binding_name} declares size {elements[1]}, "
+                        f"but wasm32 sizeof({struct_name}) is {c_size}"
+                    )
+                if elements[2] != c_align:
+                    problems.append(
+                        f"python-inline-structs: {label}: {binding_name} declares alignment {elements[2]}, "
+                        f"but wasm32 alignof({struct_name}) is {c_align}"
+                    )
+            else:
+                problems.append(
+                    f"python-inline-structs: {label}: {binding_name} is neither an int literal nor a "
+                    "(kind, size, alignment) literal tuple, so its layout claim cannot be read"
+                )
+        if not found:
+            problems.append(
+                f"python-inline-structs: {label} no longer defines {binding_name}, "
+                f"which is where the binding's {struct_name} size lives"
+            )
+
+    tree = ast.parse(_read(PYTHON_WORKBOOK), filename=str(PYTHON_WORKBOOK))
+    label = PYTHON_WORKBOOK.relative_to(REPO_ROOT)
+    for qualname, struct_name in _PYTHON_INLINE_DECODERS:
+        function = _find_qualified_function(tree, qualname)
+        if function is None:
+            problems.append(
+                f"python-inline-structs: {label} no longer defines {qualname}, "
+                f"which is where the inline {struct_name} decoding lives"
+            )
+            continue
+        measured = measure(struct_name)
+        if measured is None:
+            continue
+        c_offsets, c_size, _, c_sizes = measured
+        member_widths = [c_sizes[name] for name in c_offsets]
+
+        for node in ast.walk(function):
+            if isinstance(node, ast.Call) and _is_lib_call(node, "read_bytes") and len(node.args) > 1:
+                length = node.args[1]
+                span = None
+                if isinstance(length, ast.Constant) and isinstance(length.value, int):
+                    span = length.value
+                elif isinstance(length, ast.Name):
+                    span = constants.get(length.id)
+                if span is not None and span != c_size:
+                    problems.append(
+                        f"python-inline-structs: {label}:{node.lineno}: {qualname} reads {span} bytes "
+                        f"for a {struct_name}, whose wasm32 size is {c_size}"
+                    )
+            if not (
+                isinstance(node, ast.Call)
+                and isinstance(node.func, ast.Attribute)
+                and isinstance(node.func.value, ast.Name)
+                and node.func.value.id == "struct"
+            ):
+                continue
+            if not node.args or not isinstance(node.args[0], ast.Constant):
+                continue
+            fmt = node.args[0].value
+            if not isinstance(fmt, str):
+                continue
+            widths = _struct_format_widths(fmt)
+            if widths is None:
+                problems.append(
+                    f"python-inline-structs: {label}:{node.lineno}: {qualname} uses the format {fmt!r}, "
+                    "which is not a little-endian fixed-width layout this check can measure"
+                )
+                continue
+            if node.func.attr == "unpack_from":
+                if len(node.args) < 3 or not isinstance(node.args[2], ast.Constant):
+                    continue
+                offset = node.args[2].value
+                owner = next((name for name, at in c_offsets.items() if at == offset), None)
+                if owner is None:
+                    problems.append(
+                        f"python-inline-structs: {label}:{node.lineno}: {qualname} decodes at offset "
+                        f"{offset}, which is not a member offset of {struct_name} "
+                        f"({sorted(c_offsets.items(), key=lambda item: item[1])})"
+                    )
+                elif sum(widths) > c_sizes[owner]:
+                    problems.append(
+                        f"python-inline-structs: {label}:{node.lineno}: {qualname} reads {sum(widths)} bytes "
+                        f"with {fmt!r} at offset {offset}, but {struct_name}.{owner} is {c_sizes[owner]} bytes"
+                    )
+            elif node.func.attr == "unpack" and widths != member_widths:
+                problems.append(
+                    f"python-inline-structs: {label}:{node.lineno}: {qualname} decodes a whole "
+                    f"{struct_name} with {fmt!r} (field widths {widths}), but the C members are "
+                    f"{list(zip(c_offsets, member_widths))}"
+                )
+    return problems
diff --git a/tools/dev/binding_drift/shape_checks.py b/tools/dev/binding_drift/shape_checks.py
new file mode 100644
index 000000000..c091844bb
--- /dev/null
+++ b/tools/dev/binding_drift/shape_checks.py
@@ -0,0 +1,236 @@
+"""Drift checks on the shape of shared declarations: return types and record field sets."""
+
+from __future__ import annotations
+
+import re
+from typing import List, Optional, Set
+
+from .c_header import _c_struct_fields
+from .surface_files import (
+    CAPI_HEADER,
+    NODE_DTS,
+    PYTHON_WORKBOOK,
+    REPO_ROOT,
+    WASM_DTS,
+    _format_diff,
+    _read,
+)
+from .ts_decl import (
+    _find_interface_body,
+    _ts_field_set,
+    _ts_interface_declaration,
+    _ts_return_types,
+)
+
+# ---------------------------------------------------------------------------
+# Check 2c: shared `.d.ts` shapes -- return types and record field sets.
+#
+# `dts-wasm` and `dts-node` compare method *names* only. That is enough to
+# notice a method that exists on one surface and not the other, and nothing
+# else: a shared method whose two declarations disagree about what comes back,
+# or a record type that grew a field on one side, passes both of them. The
+# README's parity claim is about the shapes, not the names, so this check
+# compares the shapes.
+#
+# Types declared in only one of the two published declaration files. Each has
+# to be reachable only from that surface's own method allowlist -- a type that
+# becomes one-sided for any other reason is a missing declaration, and listing
+# it here is the deliberate act that says otherwise.
+# ---------------------------------------------------------------------------
+
+_DTS_SURFACE_ONLY_TYPES = {
+    # The embind module factory and its options: there is no equivalent on a
+    # native addon, which is `require`d rather than instantiated.
+    ("wasm", "FormulonModule"),
+    ("wasm", "FormulonModuleOptions"),
+    # Reachable only from `getSheetAutoFilterXml` / `createTable` /
+    # `updateTable`, all of which are in WASM_ONLY_METHODS.
+    ("wasm", "SheetAutoFilterXmlResult"),
+    ("wasm", "TableInput"),
+    ("wasm", "TableUpdateInput"),
+}
+
+# Shared methods whose two declarations are allowed to differ, with the
+# reason. Empty by design: a difference that is not worth an entry here is a
+# difference that should not exist.
+_DTS_RETURN_TYPE_EXEMPT_METHODS: dict[str, str] = {}
+
+
+def check_dts_shared_shapes() -> List[str]:
+    problems: List[str] = []
+    wasm_dts = _read(WASM_DTS)
+    node_dts = _read(NODE_DTS)
+    wasm_label = str(WASM_DTS.relative_to(REPO_ROOT))
+    node_label = str(NODE_DTS.relative_to(REPO_ROOT))
+
+    for interface in ("Workbook", "WorkbookCtor"):
+        wasm_returns = _ts_return_types(_find_interface_body(wasm_dts, interface, WASM_DTS))
+        node_returns = _ts_return_types(_find_interface_body(node_dts, interface, NODE_DTS))
+        for name in sorted(set(wasm_returns) & set(node_returns)):
+            if wasm_returns[name] == node_returns[name]:
+                if name in _DTS_RETURN_TYPE_EXEMPT_METHODS:
+                    problems.append(
+                        f"dts-shared-shapes: {name} is listed as a deliberate return-type "
+                        "difference but both surfaces now declare the same type; drop the entry"
+                    )
+                continue
+            if name in _DTS_RETURN_TYPE_EXEMPT_METHODS:
+                continue
+            problems.append(
+                f"dts-shared-shapes: {interface}.{name} returns a different type on each surface:\n"
+                f"  {wasm_label}: {wasm_returns[name]}\n"
+                f"  {node_label}: {node_returns[name]}"
+            )
+
+    wasm_types = set(re.findall(r"^export interface ([A-Za-z0-9_]+)", wasm_dts, re.MULTILINE))
+    node_types = set(re.findall(r"^export interface ([A-Za-z0-9_]+)", node_dts, re.MULTILINE))
+    surface_only = {("wasm", name) for name in wasm_types - node_types}
+    surface_only |= {("node", name) for name in node_types - wasm_types}
+    undeclared = surface_only - _DTS_SURFACE_ONLY_TYPES
+    if undeclared:
+        problems.append(
+            "dts-shared-shapes: type declared on one surface only, without an entry in "
+            f"_DTS_SURFACE_ONLY_TYPES: {sorted(undeclared)}"
+        )
+    stale = _DTS_SURFACE_ONLY_TYPES - surface_only
+    if stale:
+        problems.append(f"dts-shared-shapes: stale _DTS_SURFACE_ONLY_TYPES entries: {sorted(stale)}")
+
+    for name in sorted(wasm_types & node_types):
+        if name in ("Workbook", "WorkbookCtor"):
+            continue
+        wasm_extends, wasm_body = _ts_interface_declaration(wasm_dts, name, WASM_DTS)
+        node_extends, node_body = _ts_interface_declaration(node_dts, name, NODE_DTS)
+        if wasm_extends != node_extends:
+            problems.append(
+                f"dts-shared-shapes: {name} inherits differently on each surface:\n"
+                f"  {wasm_label}: {wasm_extends or '(nothing)'}\n"
+                f"  {node_label}: {node_extends or '(nothing)'}"
+            )
+        diff = _format_diff(
+            f"{name} in {wasm_label}",
+            _ts_field_set(wasm_body) - _ts_field_set(node_body),
+            f"{name} in {node_label}",
+            _ts_field_set(node_body) - _ts_field_set(wasm_body),
+        )
+        if diff:
+            problems.append(f"dts-shared-shapes: {name} field set mismatch:\n" + "\n".join(diff))
+
+    return problems
+
+
+# Public type name -> the C struct it projects.
+_STYLE_RECORD_STRUCTS = {
+    "CellXf": "fm_cell_xf",
+    "ColorSpec": "fm_color_spec",
+    "FontRecord": "fm_font_record",
+    "FillRecord": "fm_fill_record",
+    "BorderSide": "fm_border_side",
+}
+
+# Deliberate omissions, keyed by (surface, type name). Python models a border
+# side as a plain dict rather than a dataclass, so it has no `BorderSide` type
+# to compare; the dict shape is covered by the wasm32 struct-layout check.
+_STYLE_RECORD_EXEMPT_TYPES = {
+    ("python", "BorderSide"),
+}
+
+# C presence flags that neither host language mirrors as a field, because both
+# already have a way to say "absent": the TS surface omits the optional
+# property, Python leaves it `None`. Naming the value field alone would let a
+# host drop the distinction entirely, so each entry lists the value field the
+# flag governs and both are required to exist together.
+_STYLE_RECORD_PRESENCE_FLAGS = {
+    "fm_cell_xf": {
+        "has_text_rotation": "text_rotation",
+        "has_indent": "indent",
+        "has_relative_indent": "relative_indent",
+        "has_shrink_to_fit": "shrink_to_fit",
+        "has_reading_order": "reading_order",
+    },
+}
+
+_TS_FIELD_RE = re.compile(r"^\s*([A-Za-z_$][A-Za-z0-9_$]*)\??\s*:", re.MULTILINE)
+_PY_FIELD_RE = re.compile(r"^    ([a-z_][A-Za-z0-9_]*)\s*:", re.MULTILINE)
+
+
+def _snake_to_camel(name: str) -> str:
+    head, *rest = name.split("_")
+    return head + "".join(part.capitalize() for part in rest)
+
+
+def _python_class_fields(text: str, class_name: str) -> Optional[Set[str]]:
+    match = re.search(r"^class %s:\s*$" % re.escape(class_name), text, re.MULTILINE)
+    if not match:
+        return None
+    rest = text[match.end() :]
+    end = re.search(r"^(?:@|class |def )", rest, re.MULTILINE)
+    body = rest[: end.start()] if end else rest
+    return set(_PY_FIELD_RE.findall(body))
+
+
+def check_style_record_fields() -> List[str]:
+    problems: List[str] = []
+    header = re.sub(r"/\*.*?\*/", "", _read(CAPI_HEADER), flags=re.S)
+    wasm_dts = _read(WASM_DTS)
+    node_dts = _read(NODE_DTS)
+    python_text = _read(PYTHON_WORKBOOK)
+
+    for type_name, struct_name in sorted(_STYLE_RECORD_STRUCTS.items()):
+        c_fields = _c_struct_fields(header, struct_name, CAPI_HEADER)
+        # A presence flag is dropped from the comparison, but only once its
+        # governed value field is confirmed present on the C side -- otherwise
+        # renaming the value field would silently retire the flag with it.
+        presence = _STYLE_RECORD_PRESENCE_FLAGS.get(struct_name, {})
+        for flag, value_field in sorted(presence.items()):
+            if flag in c_fields and value_field not in c_fields:
+                problems.append(
+                    f"style-record-fields: {struct_name}.{flag} is exempted as a presence flag for "
+                    f"{value_field!r}, which no longer exists in {CAPI_HEADER.relative_to(REPO_ROOT)}"
+                )
+        stale_flags = sorted(flag for flag in presence if flag not in c_fields)
+        if stale_flags:
+            problems.append(f"style-record-fields: stale presence-flag exemptions for {struct_name}: {stale_flags}")
+        c_fields = [name for name in c_fields if name not in presence]
+        camel_fields = {_snake_to_camel(name) for name in c_fields}
+        for surface, source, dts_text in (
+            ("wasm", WASM_DTS, wasm_dts),
+            ("node", NODE_DTS, node_dts),
+        ):
+            if (surface, type_name) in _STYLE_RECORD_EXEMPT_TYPES:
+                continue
+            ts_fields = set(_TS_FIELD_RE.findall(_find_interface_body(dts_text, type_name, source)))
+            diff = _format_diff(
+                f"{struct_name} in {CAPI_HEADER.relative_to(REPO_ROOT)}",
+                camel_fields - ts_fields,
+                f"{type_name} in {source.relative_to(REPO_ROOT)}",
+                ts_fields - camel_fields,
+            )
+            if diff:
+                problems.append(f"style-record-fields: {surface} {type_name} mismatch:\n" + "\n".join(diff))
+
+        if ("python", type_name) in _STYLE_RECORD_EXEMPT_TYPES:
+            continue
+        py_fields = _python_class_fields(python_text, type_name)
+        if py_fields is None:
+            problems.append(
+                f"style-record-fields: dataclass {type_name!r} not found in {PYTHON_WORKBOOK.relative_to(REPO_ROOT)}"
+            )
+            continue
+        diff = _format_diff(
+            f"{struct_name} in {CAPI_HEADER.relative_to(REPO_ROOT)}",
+            set(c_fields) - py_fields,
+            f"{type_name} in {PYTHON_WORKBOOK.relative_to(REPO_ROOT)}",
+            py_fields - set(c_fields),
+        )
+        if diff:
+            problems.append(f"style-record-fields: python {type_name} mismatch:\n" + "\n".join(diff))
+
+    stale = {
+        (surface, type_name)
+        for surface, type_name in _STYLE_RECORD_EXEMPT_TYPES
+        if type_name not in _STYLE_RECORD_STRUCTS
+    }
+    if stale:
+        problems.append(f"style-record-fields: stale exemption entries: {sorted(stale)}")
+    return problems
diff --git a/tools/dev/binding_drift/surface_files.py b/tools/dev/binding_drift/surface_files.py
new file mode 100644
index 000000000..8d8ca1bd1
--- /dev/null
+++ b/tools/dev/binding_drift/surface_files.py
@@ -0,0 +1,84 @@
+"""Repo locations of the hand-synced surface files, and the shared reader and skip ledger."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from typing import List, Set
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+
+CAPI_HEADER = REPO_ROOT / "src" / "c_api" / "formulon_c.h"
+CAPI_EXPORTS = REPO_ROOT / "tools" / "wasm" / "capi_exports.txt"
+PYTHON_PKG_DIR = REPO_ROOT / "packages" / "python" / "formulon"
+PYTHON_C_BINDING = PYTHON_PKG_DIR / "_c.py"
+
+WASM_BINDINGS_CPP = REPO_ROOT / "src" / "wasm" / "parts" / "bindings_register.cpp"
+WASM_DTS = REPO_ROOT / "src" / "wasm" / "formulon.d.ts"
+
+NODE_WORKBOOK_CLASS_CC = REPO_ROOT / "src" / "node_addon" / "parts" / "workbook_class.cc"
+NODE_ADDON_CC = REPO_ROOT / "src" / "node_addon" / "addon.cc"
+NODE_DTS = REPO_ROOT / "packages" / "npm-native" / "index.d.ts"
+NODE_README = REPO_ROOT / "packages" / "npm-native" / "README.md"
+NODE_INDEX_MJS = REPO_ROOT / "packages" / "npm-native" / "index.mjs"
+NODE_DIST_DIR = REPO_ROOT / "packages" / "npm-native" / "dist"
+
+C_ABI_BASELINE = Path(__file__).resolve().parents[1] / "c_abi_baseline.txt"
+C_ABI_BREAKS = Path(__file__).resolve().parents[1] / "c_abi_breaks.txt"
+# The npm package's constants and helpers live in common.mjs; each published
+# entry point (single-threaded and pthread) re-exports it wholesale.
+NPM_COMMON_MJS = REPO_ROOT / "packages" / "npm" / "common.mjs"
+NPM_ENTRY_MJS = (
+    REPO_ROOT / "packages" / "npm" / "index.mjs",
+    REPO_ROOT / "packages" / "npm" / "threads.mjs",
+)
+
+ERROR_H = REPO_ROOT / "src" / "utils" / "error.h"
+VALUE_H = REPO_ROOT / "src" / "value.h"
+CF_MATCH_H = REPO_ROOT / "src" / "cf" / "cf_match.h"
+CALC_MODE_H = REPO_ROOT / "src" / "calc_settings.h"
+EXTERNAL_LINKS_H = REPO_ROOT / "src" / "external_link.h"
+PYTHON_STRUCTS = PYTHON_PKG_DIR / "_structs.py"
+
+# A sub-check appends here when an input it needs is legitimately absent, as
+# opposed to wrong. `main` prints these alongside the verdict so "not checked"
+# is visible in the output and can never be read as "checked and clean" -- a
+# guard that quietly passes when its input is missing is not a guard.
+_SKIPPED: List[str] = []
+
+
+def _read(path: Path) -> str:
+    if not path.is_file():
+        print(f"check_binding_drift: missing file: {path}", file=sys.stderr)
+        sys.exit(2)
+    return path.read_text(encoding="utf-8")
+
+
+def _read_bytes(path: Path) -> bytes:
+    """`_read` for a comparison that must not normalise line endings."""
+    if not path.is_file():
+        print(f"check_binding_drift: missing file: {path}", file=sys.stderr)
+        sys.exit(2)
+    return path.read_bytes()
+
+
+def _format_diff(label_a: str, only_a: Set[str], label_b: str, only_b: Set[str]) -> List[str]:
+    problems = []
+    if only_a:
+        problems.append(f"  in {label_a} but not {label_b}: {sorted(only_a)}")
+    if only_b:
+        problems.append(f"  in {label_b} but not {label_a}: {sorted(only_b)}")
+    return problems
+
+
+# ---------------------------------------------------------------------------
+# Check 6: public style-record field sets <-> their C ABI struct.
+#
+# `FontRecord` and friends are declared independently in three public
+# surfaces and each one claims to mirror the C struct. Method-level drift
+# checking cannot see a field that one surface forgot, which is how a font's
+# `vertAlign` reached the WASM `.d.ts` alone: reading a superscript font and
+# writing it back through the other bindings silently demoted it.
+# ---------------------------------------------------------------------------
+
+PYTHON_WORKBOOK = PYTHON_PKG_DIR / "workbook.py"
diff --git a/tools/dev/binding_drift/ts_decl.py b/tools/dev/binding_drift/ts_decl.py
new file mode 100644
index 000000000..5a395ab8a
--- /dev/null
+++ b/tools/dev/binding_drift/ts_decl.py
@@ -0,0 +1,159 @@
+"""Parsing of TypeScript declaration files and the JS constant tables behind them."""
+
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+from typing import Optional, Set
+
+from .surface_files import _read
+
+
+def _extract_braced_block(text: str, start: int) -> str:
+    """Returns the substring between `start` (just after an opening `{`)
+    and its matching closing `}`, using a simple depth counter.
+
+    Safe for this codebase's `.d.ts` files: the only braces inside an
+    interface body are either the one being matched or self-contained
+    `{ ... }` pairs inside single-line JSDoc comments (e.g. `` `{ status,
+    index }` ``), which do not change the net depth.
+    """
+    depth = 1
+    i = start
+    while i < len(text) and depth > 0:
+        if text[i] == "{":
+            depth += 1
+        elif text[i] == "}":
+            depth -= 1
+        i += 1
+    return text[start : i - 1]
+
+
+def _find_interface_body(text: str, name: str, source: Path) -> str:
+    match = re.search(r"export interface %s\s*\{" % re.escape(name), text)
+    if not match:
+        print(f"check_binding_drift: interface {name!r} not found in {source}", file=sys.stderr)
+        sys.exit(2)
+    return _extract_braced_block(text, match.end())
+
+
+# Matches a method signature's leading `name(` at the start of a line
+# (after indentation); this also catches multi-line signatures whose
+# parameter list wraps, since only the opening token is needed. Plain
+# data fields (`name: Type;`) do not match -- no `(` follows the name.
+_TS_METHOD_RE = re.compile(r"^\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*\(", re.MULTILINE)
+
+
+def _extract_ts_methods(body: str) -> Set[str]:
+    return set(_TS_METHOD_RE.findall(body))
+
+
+# Top-level members of an exported interface are indented exactly two spaces;
+# anything deeper belongs to a nested object type and is compared as part of
+# its parent's field text, not on its own.
+_TS_MEMBER_NAME_RE = re.compile(r"^ {2}([A-Za-z_$][A-Za-z0-9_$]*)\s*\(", re.MULTILINE)
+_TS_MEMBER_FIELD_RE = re.compile(r"^ {2}(?:readonly\s+)?([A-Za-z_$][A-Za-z0-9_$]*)(\??)\s*:", re.MULTILINE)
+
+
+def _ts_return_types(body: str) -> dict[str, str]:
+    """Maps each method in an interface body to its declared return type.
+
+    The parameter list is skipped by bracket balancing so a wrapped or
+    generic signature is read the same as a single-line one; whitespace in
+    the return type is collapsed so formatting differences do not register
+    as drift.
+    """
+    out: dict[str, str] = {}
+    for match in _TS_MEMBER_NAME_RE.finditer(body):
+        open_paren = body.index("(", match.start())
+        depth = 0
+        close_paren = -1
+        for i in range(open_paren, len(body)):
+            char = body[i]
+            if char in "(<[":
+                depth += 1
+            elif char in ")>]":
+                depth -= 1
+                if depth == 0 and char == ")":
+                    close_paren = i
+                    break
+        if close_paren < 0:
+            continue
+        rest = body[close_paren + 1 :]
+        if ";" not in rest:
+            continue
+        declared = rest[: rest.index(";")].strip()
+        if declared.startswith(":"):
+            declared = declared[1:]
+        out[match.group(1)] = " ".join(declared.split())
+    return out
+
+
+def _ts_interface_declaration(text: str, name: str, source: Path) -> tuple[str, str]:
+    """Returns an interface's `extends` clause (may be empty) and its body.
+
+    Unlike `_find_interface_body` this tolerates `extends`, which matters
+    here: a record type that inherits its fields declares none of them
+    locally, so the base list is part of the shape being compared.
+    """
+    match = re.search(r"^export interface %s\b([^{]*)\{" % re.escape(name), text, re.MULTILINE)
+    if not match:
+        print(f"check_binding_drift: interface {name!r} not found in {source}", file=sys.stderr)
+        sys.exit(2)
+    return " ".join(match.group(1).split()), _extract_braced_block(text, match.end())
+
+
+def _ts_field_set(body: str) -> Set[str]:
+    """Field names of an interface body, each suffixed with `?` when optional.
+
+    Optionality is part of the compared shape on purpose: "present only on
+    success" is how both declaration files spell a payload key the runtime
+    drops, so a required declaration on one side and an optional one on the
+    other is a real disagreement about what a caller may dereference.
+    """
+    return {name + optional for name, optional in _TS_MEMBER_FIELD_RE.findall(body)}
+
+
+# ---------------------------------------------------------------------------
+# Check 2d: pure-JS helpers shipped by both npm packages.
+#
+# A helper with no native entry point behind it has to be written out once per
+# package, because the two packages share no module. Nothing then holds the
+# copies together, and nothing notices when one package documents a helper it
+# does not ship -- which is how the WASM declaration file came to send its
+# readers to a package that is not published. Both halves are checked here:
+# the helper is exported and declared by both packages, and the two
+# implementations are the same text.
+# ---------------------------------------------------------------------------
+
+
+def _js_exported_function_source(text: str, name: str) -> Optional[str]:
+    """Whitespace-normalised body of `export function <name>(...) { ... }`."""
+    match = re.search(r"^export function %s\s*\(" % re.escape(name), text, re.MULTILINE)
+    if not match:
+        return None
+    body_open = text.index("{", match.end())
+    return " ".join(_extract_braced_block(text, body_open + 1).split())
+
+
+# Frozen ordinal tables are the only way a JS consumer can name a value
+# that crosses the boundary as a plain number, so both published ESM entry
+# points have to carry the same ones. The WASM `.d.ts` above is already
+# pinned to the C/C++ enums, which makes it the single source the two
+# `index.mjs` files are measured against -- comparing them only to each
+# other would let a shared mistake pass.
+_JS_TABLE_RE = re.compile(r"^export const (\w+) = Object\.freeze\(\{(.*?)\}\);", re.DOTALL | re.MULTILINE)
+_JS_SCALAR_RE = re.compile(r"^export const (\w+) = (-?\d+);", re.MULTILINE)
+_JS_MEMBER_RE = re.compile(r"(\w+)\s*:\s*(-?\d+)")
+
+
+def _parse_js_constants(path: Path) -> dict:
+    """Reads an `index.mjs`'s exported ordinal tables and scalar constants."""
+    text = _read(path)
+    out: dict = {}
+    for match in _JS_TABLE_RE.finditer(text):
+        out[match.group(1)] = {name: int(value) for name, value in _JS_MEMBER_RE.findall(match.group(2))}
+    for match in _JS_SCALAR_RE.finditer(text):
+        out[match.group(1)] = int(match.group(2))
+    return out
diff --git a/tools/dev/c_abi_breaks.txt b/tools/dev/c_abi_breaks.txt
index 9f1283163..60dce4ef6 100644
--- a/tools/dev/c_abi_breaks.txt
+++ b/tools/dev/c_abi_breaks.txt
@@ -32,3 +32,4 @@
 removed fm_workbook_pivot_field_add_aggregation :: wrote a field-level aggregation list nothing read; value aggregation is the data field's, subtotals are fm_workbook_pivot_field_add_subtotal_fn
 removed fm_workbook_pivot_field_clear_aggregations :: counterpart of the removed fm_workbook_pivot_field_add_aggregation
 signature fm_workbook_pivot_field_set_date_group :: gains interval_days and the Start/End serials of Excel's Days grouping, which replaces the Sunday-aligned FM_PIVOT_DATE_WEEK
+signature fm_styles_set_cell_style :: takes one fm_cell_style_record_t carrying i_level, hidden and custom_builtin instead of name, xf_id and builtin_id
diff --git a/tools/dev/check_binding_drift.py b/tools/dev/check_binding_drift.py
index 0f1e07cd5..84bcdaa03 100644
--- a/tools/dev/check_binding_drift.py
+++ b/tools/dev/check_binding_drift.py
@@ -115,2064 +115,27 @@
 from __future__ import annotations
 
 import argparse
-import ast
-import importlib.util
-import re
 import sys
-from pathlib import Path
-from typing import List, NamedTuple, Optional, Set
-
-REPO_ROOT = Path(__file__).resolve().parents[2]
-
-CAPI_HEADER = REPO_ROOT / "src" / "c_api" / "formulon_c.h"
-CAPI_EXPORTS = REPO_ROOT / "tools" / "wasm" / "capi_exports.txt"
-PYTHON_PKG_DIR = REPO_ROOT / "packages" / "python" / "formulon"
-PYTHON_C_BINDING = PYTHON_PKG_DIR / "_c.py"
-
-WASM_BINDINGS_CPP = REPO_ROOT / "src" / "wasm" / "parts" / "bindings_register.cpp"
-WASM_DTS = REPO_ROOT / "src" / "wasm" / "formulon.d.ts"
-
-NODE_WORKBOOK_CLASS_CC = REPO_ROOT / "src" / "node_addon" / "parts" / "workbook_class.cc"
-NODE_ADDON_CC = REPO_ROOT / "src" / "node_addon" / "addon.cc"
-NODE_DTS = REPO_ROOT / "packages" / "npm-native" / "index.d.ts"
-NODE_README = REPO_ROOT / "packages" / "npm-native" / "README.md"
-NODE_INDEX_MJS = REPO_ROOT / "packages" / "npm-native" / "index.mjs"
-NODE_DIST_DIR = REPO_ROOT / "packages" / "npm-native" / "dist"
-
-C_ABI_BASELINE = Path(__file__).resolve().parent / "c_abi_baseline.txt"
-C_ABI_BREAKS = Path(__file__).resolve().parent / "c_abi_breaks.txt"
-# The npm package's constants and helpers live in common.mjs; each published
-# entry point (single-threaded and pthread) re-exports it wholesale.
-NPM_COMMON_MJS = REPO_ROOT / "packages" / "npm" / "common.mjs"
-NPM_ENTRY_MJS = (
-    REPO_ROOT / "packages" / "npm" / "index.mjs",
-    REPO_ROOT / "packages" / "npm" / "threads.mjs",
-)
-
-ERROR_H = REPO_ROOT / "src" / "utils" / "error.h"
-VALUE_H = REPO_ROOT / "src" / "value.h"
-CF_MATCH_H = REPO_ROOT / "src" / "cf" / "cf_match.h"
-CALC_MODE_H = REPO_ROOT / "src" / "calc_settings.h"
-EXTERNAL_LINKS_H = REPO_ROOT / "src" / "external_link.h"
-PYTHON_STRUCTS = PYTHON_PKG_DIR / "_structs.py"
-
-# embind auto-adds a `delete()` finaliser to every `class_<T>` -- it has no
-# corresponding `.function(...)` registration, so it must be excluded before
-# comparing the WASM Workbook interface against bindings_register.cpp.
-WASM_AUTO_METHODS = {"delete"}
-
-# Intentional binding differences are kept exact. This makes a newly added
-# method or a removed method fail drift checking instead of becoming a stale
-# exception in one binding.
-WASM_ONLY_METHODS = {
-    "addCellStyleXf",
-    "createTable",
-    "getSheetAutoFilterXml",
-    "removeTable",
-    "setCellStyle",
-    "setSheetAutoFilterXml",
-    "updateTable",
-}
-NODE_ONLY_METHODS = {"dispose", "memoryUsage"}
-
-# Pure-JS free functions declared in packages/npm-native/index.d.ts that are
-# intentionally NOT backed by a native `exports.Set(...)` registration -- they
-# are host-side helpers implemented in index.mjs (e.g. the function-metadata
-# provider merge helper). Excluded before comparing the d.ts free-function
-# surface against the addon's native exports.
-NODE_PURE_JS_FREE_FUNCTIONS = {"mergeFunctionMetadata"}
-
-
-# A sub-check appends here when an input it needs is legitimately absent, as
-# opposed to wrong. `main` prints these alongside the verdict so "not checked"
-# is visible in the output and can never be read as "checked and clean" -- a
-# guard that quietly passes when its input is missing is not a guard.
-_SKIPPED: List[str] = []
-
-
-def _read(path: Path) -> str:
-    if not path.is_file():
-        print(f"check_binding_drift: missing file: {path}", file=sys.stderr)
-        sys.exit(2)
-    return path.read_text(encoding="utf-8")
-
-
-def _read_bytes(path: Path) -> bytes:
-    """`_read` for a comparison that must not normalise line endings."""
-    if not path.is_file():
-        print(f"check_binding_drift: missing file: {path}", file=sys.stderr)
-        sys.exit(2)
-    return path.read_bytes()
-
-
-def _extract_braced_block(text: str, start: int) -> str:
-    """Returns the substring between `start` (just after an opening `{`)
-    and its matching closing `}`, using a simple depth counter.
-
-    Safe for this codebase's `.d.ts` files: the only braces inside an
-    interface body are either the one being matched or self-contained
-    `{ ... }` pairs inside single-line JSDoc comments (e.g. `` `{ status,
-    index }` ``), which do not change the net depth.
-    """
-    depth = 1
-    i = start
-    while i < len(text) and depth > 0:
-        if text[i] == "{":
-            depth += 1
-        elif text[i] == "}":
-            depth -= 1
-        i += 1
-    return text[start : i - 1]
-
-
-def _find_interface_body(text: str, name: str, source: Path) -> str:
-    match = re.search(r"export interface %s\s*\{" % re.escape(name), text)
-    if not match:
-        print(f"check_binding_drift: interface {name!r} not found in {source}", file=sys.stderr)
-        sys.exit(2)
-    return _extract_braced_block(text, match.end())
-
-
-# Matches a method signature's leading `name(` at the start of a line
-# (after indentation); this also catches multi-line signatures whose
-# parameter list wraps, since only the opening token is needed. Plain
-# data fields (`name: Type;`) do not match -- no `(` follows the name.
-_TS_METHOD_RE = re.compile(r"^\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*\(", re.MULTILINE)
-
-
-def _extract_ts_methods(body: str) -> Set[str]:
-    return set(_TS_METHOD_RE.findall(body))
-
-
-def _format_diff(label_a: str, only_a: Set[str], label_b: str, only_b: Set[str]) -> List[str]:
-    problems = []
-    if only_a:
-        problems.append(f"  in {label_a} but not {label_b}: {sorted(only_a)}")
-    if only_b:
-        problems.append(f"  in {label_b} but not {label_a}: {sorted(only_b)}")
-    return problems
-
-
-def _parse_literal_status_exports() -> tuple[Set[str], Optional[str]]:
-    """Read `_STATUS_RETURNING_EXPORT_NAMES` without importing `_c.py`.
-
-    Importing the binding would load wasmtime and, depending on the
-    environment, initialize a real WASM instance. The drift check is a
-    source-level consistency check, so an AST walk keeps it stdlib-only and
-    side-effect-free.
-    """
-    try:
-        tree = ast.parse(_read(PYTHON_C_BINDING), filename=str(PYTHON_C_BINDING))
-    except SyntaxError as exc:
-        return set(), f"python-exports: cannot parse {PYTHON_C_BINDING.relative_to(REPO_ROOT)}: {exc}"
-
-    for statement in tree.body:
-        if isinstance(statement, ast.Assign):
-            targets = statement.targets
-        elif isinstance(statement, ast.AnnAssign):
-            targets = [statement.target]
-        else:
-            continue
-        if not any(
-            isinstance(target, ast.Name) and target.id == "_STATUS_RETURNING_EXPORT_NAMES" for target in targets
-        ):
-            continue
-        value = statement.value
-        if not isinstance(value, ast.Tuple):
-            return set(), "python-exports: _STATUS_RETURNING_EXPORT_NAMES must be a literal tuple"
-        names: Set[str] = set()
-        for element in value.elts:
-            if not isinstance(element, ast.Constant) or not isinstance(element.value, str):
-                return set(), "python-exports: _STATUS_RETURNING_EXPORT_NAMES must contain only string literals"
-            names.add(element.value)
-        return names, None
-
-    return (
-        set(),
-        "python-exports: _STATUS_RETURNING_EXPORT_NAMES literal tuple not found in packages/python/formulon/_c.py",
-    )
-
-
-# ---------------------------------------------------------------------------
-# Check 1: Python `LIB.fm_*` calls <-> tools/wasm/capi_exports.txt <->
-#          src/c_api/formulon_c.h declarations.
-# ---------------------------------------------------------------------------
-
-
-def check_python_exports() -> List[str]:
-    problems: List[str] = []
-
-    python_calls: Set[str] = set()
-    for py_file in sorted(PYTHON_PKG_DIR.glob("*.py")):
-        python_calls |= set(re.findall(r"\bLIB\.(fm_[A-Za-z0-9_]+)", _read(py_file)))
-
-    exports_text = _read(CAPI_EXPORTS)
-    exports: Set[str] = set()
-    for line in exports_text.splitlines():
-        stripped = line.strip()
-        if stripped and not stripped.startswith("#"):
-            exports.add(stripped)
-
-    header_text = _read(CAPI_HEADER)
-    header_fns = set(re.findall(r"\bfm_[A-Za-z0-9_]+(?=\s*\()", header_text))
-
-    missing_from_exports = python_calls - exports
-    if missing_from_exports:
-        problems.append(
-            "python-exports: Python calls a symbol not staged in "
-            f"{CAPI_EXPORTS.relative_to(REPO_ROOT)}: {sorted(missing_from_exports)}"
-        )
-
-    # capi_exports.txt also lists a handful of non-`fm_` allocator symbols
-    # (`malloc`/`free`) needed for host-side scratch-buffer plumbing; those
-    # are libc, not part of the `fm_*` C ABI, and are never declared in
-    # formulon_c.h. Only the `fm_*` subset is checked against the header.
-    fm_exports = {symbol for symbol in exports if symbol.startswith("fm_")}
-    exports_not_in_header = fm_exports - header_fns
-    if exports_not_in_header:
-        problems.append(
-            "python-exports: symbol staged in "
-            f"{CAPI_EXPORTS.relative_to(REPO_ROOT)} but not declared in "
-            f"{CAPI_HEADER.relative_to(REPO_ROOT)}: {sorted(exports_not_in_header)}"
-        )
-
-    # The WASM result type is not enough to identify status calls: counts,
-    # indices, and pointers are also i32. Keep the binding's capture list as
-    # a literal and compare it to the authoritative header/manifest
-    # intersection without importing `_c.py` or wasmtime.
-    header_status_fns = set(re.findall(r"\bFM_API\s+fm_status_t\s+(fm_[A-Za-z0-9_]+)\s*\(", header_text))
-    expected_status_exports = header_status_fns & fm_exports
-    binding_status_exports, parse_problem = _parse_literal_status_exports()
-    if parse_problem:
-        problems.append(parse_problem)
-
-    missing_status_exports = expected_status_exports - binding_status_exports
-    if missing_status_exports:
-        problems.append(
-            "python-exports: _STATUS_RETURNING_EXPORT_NAMES is missing status-returning exports: "
-            f"{sorted(missing_status_exports)}"
-        )
-
-    extra_status_exports = binding_status_exports - expected_status_exports
-    if extra_status_exports:
-        problems.append(
-            f"python-exports: _STATUS_RETURNING_EXPORT_NAMES has extra exports: {sorted(extra_status_exports)}"
-        )
-
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 1b: Python WASM32 POD layouts <-> C ABI header.
-# ---------------------------------------------------------------------------
-
-
-def _wasm32_layout(fields: List[tuple[str, int, int]]) -> tuple[dict[str, int], int, int]:
-    """Lays `fields` out in sequence, returning `(offsets, size, alignment)`."""
-    offsets: dict[str, int] = {}
-    offset = 0
-    max_align = 1
-    for name, size, align in fields:
-        offset = (offset + align - 1) // align * align
-        offsets[name] = offset
-        offset += size
-        max_align = max(max_align, align)
-    return offsets, (offset + max_align - 1) // max_align * max_align, max_align
-
-
-# wasm32 (ILP32) size and alignment for the leaf types the C ABI structs are
-# built from. These are properties of the target ABI rather than anything the
-# header states, which is why they are the only layout facts tabulated here:
-# every type that has a declaration to read -- struct, union, array -- is
-# measured from that declaration instead of quoted. A literal for an embedded
-# struct would keep asserting its old size after the struct changed, which is
-# the one thing this check exists to catch.
-_WASM32_SCALARS = {
-    "uint8_t": (1, 1),
-    "uint16_t": (2, 2),
-    "uint32_t": (4, 4),
-    "int32_t": (4, 4),
-    "double": (8, 8),
-    "size_t": (4, 4),
-}
-_WASM32_POINTER = (4, 4)
-# A C enum takes `int` representation. The header pins each enumerator's
-# ordinal but says nothing about the storage width, so this is not derivable
-# either; *which* names are enums is read off the header.
-_WASM32_ENUM = (4, 4)
-
-_C_STRUCT_RE = re.compile(r"typedef\s+struct\s*\{(.*?)\}\s*(fm_[A-Za-z0-9_]+)\s*;", re.S)
-_C_ENUM_RE = re.compile(r"typedef\s+enum\s*\{[^}]*\}\s*([A-Za-z_][A-Za-z0-9_]*)\s*;")
-# An anonymous `union { ... } name;` member, matched before the enclosing body
-# is split on `;` so the union's own members are not mistaken for the parent's.
-_C_UNION_MEMBER_RE = re.compile(r"union\s*\{(.*?)\}\s*([A-Za-z_][A-Za-z0-9_]*)\s*;", re.S)
-_C_DECLARATION_RE = re.compile(r"(.+?)\s+([A-Za-z_][A-Za-z0-9_]*)(?:\[(\d+)\])?")
-
-
-class _LayoutError(Exception):
-    """A C declaration the wasm32 layout resolver cannot measure."""
-
-
-class _Member(NamedTuple):
-    """One measured struct member. `ctype` is empty for an anonymous union."""
-
-    name: str
-    ctype: str
-    size: int
-    align: int
-
-
-class _Wasm32Layouts:
-    """Measures the C ABI's structs against the wasm32 ABI, from the header.
-
-    Struct members are resolved recursively, so an embedded POD is measured
-    rather than quoted: changing a field of `fm_color_spec` moves every struct
-    that embeds it, and the Python side is checked against the new offsets.
-    """
-
-    def __init__(self, header: str) -> None:
-        self._structs = {name: body for body, name in _C_STRUCT_RE.findall(header)}
-        self._enums = set(_C_ENUM_RE.findall(header))
-        self._members: dict[str, List[_Member]] = {}
-        self._pending: Set[str] = set()
-
-    def is_struct(self, ctype: str) -> bool:
-        return ctype in self._structs
-
-    def members(self, struct_name: str) -> List[_Member]:
-        """Members of `struct_name` in declaration order, each measured."""
-        cached = self._members.get(struct_name)
-        if cached is not None:
-            return cached
-        body = self._structs.get(struct_name)
-        if body is None:
-            raise _LayoutError(f"{struct_name} missing from C header")
-        if struct_name in self._pending:
-            raise _LayoutError(f"{struct_name} embeds itself")
-        self._pending.add(struct_name)
-        try:
-            measured = self._parse_body(struct_name, body)
-        finally:
-            self._pending.discard(struct_name)
-        self._members[struct_name] = measured
-        return measured
-
-    def extent(self, ctype: str) -> tuple[int, int]:
-        """`(size, alignment)` of one member's declared type."""
-        if "*" in ctype:
-            return _WASM32_POINTER
-        ctype = ctype.replace("const ", "").strip()
-        if ctype in self._structs:
-            _, size, align = _wasm32_layout([(m.name, m.size, m.align) for m in self.members(ctype)])
-            return size, align
-        if ctype in _WASM32_SCALARS:
-            return _WASM32_SCALARS[ctype]
-        if ctype in self._enums:
-            return _WASM32_ENUM
-        raise _LayoutError(f"unknown field type {ctype!r}")
-
-    def _parse_body(self, owner: str, body: str) -> List[_Member]:
-        measured: List[_Member] = []
-        position = 0
-        for union in _C_UNION_MEMBER_RE.finditer(body):
-            measured.extend(self._parse_declarations(owner, body[position : union.start()]))
-            size, align = self._union_extent(owner, union.group(1))
-            measured.append(_Member(union.group(2), "", size, align))
-            position = union.end()
-        measured.extend(self._parse_declarations(owner, body[position:]))
-        return measured
-
-    def _parse_declarations(self, owner: str, text: str) -> List[_Member]:
-        measured: List[_Member] = []
-        for declaration in text.split(";"):
-            declaration = " ".join(declaration.split())
-            if not declaration:
-                continue
-            match = _C_DECLARATION_RE.fullmatch(declaration)
-            if not match:
-                raise _LayoutError(f"cannot parse {owner}: {declaration!r}")
-            ctype, name, count_text = match.groups()
-            size, align = self.extent(ctype)
-            measured.append(_Member(name, ctype.replace("const ", "").strip(), size * int(count_text or "1"), align))
-        return measured
-
-    def _union_extent(self, owner: str, body: str) -> tuple[int, int]:
-        """A union overlays its members: widest size, strictest alignment."""
-        size = 0
-        align = 1
-        for member in self._parse_declarations(owner, body):
-            size = max(size, member.size)
-            align = max(align, member.align)
-        return (size + align - 1) // align * align, align
-
-
-def _flatten_for_python(
-    layouts: _Wasm32Layouts, struct_name: str, py_field_names: Set[str]
-) -> List[tuple[str, int, int]]:
-    """C members of `struct_name` in the shape the Python layout models them.
-
-    Python keeps one flat field map per struct, so an embedded POD appears in
-    it one of two ways and both have to be accepted: as a single opaque blob
-    under the C member's own name (`fm_pivot_cell_t.value`), or spread into
-    the parent's map (`fm_cf_color_t color` contributing `color_r`). Which one
-    applies is read off the Python layout, so a struct that switches
-    representation needs no edit here -- only the nesting depth Python
-    actually flattens is followed.
-    """
-    fields: List[tuple[str, int, int]] = []
-    for member in layouts.members(struct_name):
-        if member.name in py_field_names or not layouts.is_struct(member.ctype):
-            fields.append((member.name, member.size, member.align))
-            continue
-        for inner in layouts.members(member.ctype):
-            name = inner.name if inner.name in py_field_names else f"{member.name}_{inner.name}"
-            fields.append((name, inner.size, inner.align))
-    return fields
-
-
-def check_python_struct_layouts() -> List[str]:
-    """Verify Python's hand-written WASM32 structs against the C header.
-
-    Every size and offset is measured from the authoritative C declarations
-    rather than repeated in a Python table -- including the structs embedded
-    inside other structs, which are laid out recursively. Only the wasm32
-    scalar, pointer and enum widths are tabulated, because the header does not
-    state those. It covers every ``Struct`` exported by ``_structs.py`` and
-    reports field order, offsets, and final size.
-    """
-    layouts = _Wasm32Layouts(re.sub(r"/\*.*?\*/", "", _read(CAPI_HEADER), flags=re.S))
-    spec = importlib.util.spec_from_file_location("formulon_struct_layouts", PYTHON_STRUCTS)
-    if spec is None or spec.loader is None:
-        return ["python-struct-layout: could not load packages/python/formulon/_structs.py"]
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-
-    problems: List[str] = []
-    for layout in (value for value in vars(module).values() if isinstance(value, module.Struct)):
-        py_field_names = {name for name, _ in layout.fields}
-        try:
-            c_fields = _flatten_for_python(layouts, layout.name, py_field_names)
-        except _LayoutError as exc:
-            problems.append(f"python-struct-layout: {exc}")
-            continue
-        # Explicit C padding need not be represented in Struct: its alignment
-        # effect is reproduced by the following semantic field. It is still
-        # laid out here so the offsets after it are right.
-        c_offsets, c_size, _ = _wasm32_layout(c_fields)
-        c_sizes = {name: size for name, size, _ in c_fields}
-        semantic_names = [name for name, _, _ in c_fields if not name.startswith("_pad")]
-        py_names = [name for name, _ in layout.fields if not name.startswith("_pad")]
-        py_sizes = {name: spec[1] for name, spec in layout.fields}
-        if py_names != semantic_names:
-            problems.append(f"python-struct-layout: {layout.name} fields differ: C={semantic_names}, Python={py_names}")
-        for name in py_names:
-            if name in c_offsets and layout.offsets[name][1] != c_offsets[name]:
-                problems.append(
-                    f"python-struct-layout: {layout.name}.{name} offset C={c_offsets[name]} Python={layout.offsets[name][1]}"
-                )
-            # Field width is checked separately from offset: narrowing a field
-            # whose successor is more strictly aligned leaves every offset and
-            # the total size intact, so the offset comparison alone reads the
-            # wrong number of bytes without ever disagreeing.
-            if name in c_sizes and py_sizes[name] != c_sizes[name]:
-                problems.append(
-                    f"python-struct-layout: {layout.name}.{name} size C={c_sizes[name]} Python={py_sizes[name]}"
-                )
-        if layout.size != c_size:
-            problems.append(f"python-struct-layout: {layout.name} size C={c_size} Python={layout.size}")
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 1c: Python `LIB.fm_*` call sites <-> the C header's declarations.
-#
-# `python-exports` matches call *names* only. Nothing compares what a call
-# passes against what the entry point declares, so a parameter added to an
-# existing `fm_*` function -- the shape a 1.0-frozen ABI is most likely to
-# grow -- leaves the Python side calling the old signature and is caught only
-# if a runtime binding test happens to exercise that path.
-# ---------------------------------------------------------------------------
-
-_C_FUNCTION_DECL_RE = re.compile(
-    r"FM_API\s+([A-Za-z_][A-Za-z0-9_ *]*?)\b(fm_[A-Za-z0-9_]+)\s*\(([^;]*?)\)\s*;",
-    re.S,
-)
-
-# Scratch readers whose name pins how many bytes come back out of the slot.
-# `read_cstr` is deliberately absent: it walks to a NUL rather than reading a
-# fixed width, so it is checked for the deref mistake only (below).
-_SCRATCH_READER_WIDTHS = {"read_u32": 4, "read_i32": 4, "read_f64": 8}
-
-
-def _split_c_params(text: str) -> List[str]:
-    """Splits a parameter list on its top-level commas."""
-    parts: List[str] = []
-    depth = 0
-    current = ""
-    for char in text:
-        if char == "(":
-            depth += 1
-        elif char == ")":
-            depth -= 1
-        if char == "," and depth == 0:
-            parts.append(current.strip())
-            current = ""
-        else:
-            current += char
-    parts.append(current.strip())
-    return parts
-
-
-def _c_function_params(header: str) -> dict[str, List[str]]:
-    """Maps each `FM_API` entry point to its declared parameter types.
-
-    The parameter *name* is stripped, so the values are types in declaration
-    order (`["fm_workbook_t*", "size_t", "fm_value_t*"]`). Every parameter in
-    this header is named, so dropping the last whitespace-delimited token is
-    unambiguous.
-    """
-    return {name: params for name, (_, params) in c_abi_declarations(header).items()}
-
-
-def c_abi_declarations(header: str) -> dict[str, tuple[str, List[str]]]:
-    """Maps each `FM_API` entry point to its `(return type, parameter types)`.
-
-    Public because `gen_c_abi_baseline.py` writes the released-surface file
-    with it: generating the baseline through the same parser the check reads
-    it back with keeps a formatting difference from masquerading as a break.
-    """
-    declarations: dict[str, tuple[str, List[str]]] = {}
-    for ret, name, params in _C_FUNCTION_DECL_RE.findall(header):
-        ret = " ".join(ret.split())
-        params = " ".join(params.split())
-        if params in ("", "void"):
-            declarations[name] = (ret, [])
-            continue
-        declarations[name] = (ret, [" ".join(param.split()[:-1]) for param in _split_c_params(params)])
-    return declarations
-
-
-def _module_int_constants(paths: List[Path]) -> dict[str, int]:
-    """Module-level `NAME = <int literal>` bindings across the binding package.
-
-    Collected across files because the constant a scratch allocation is sized
-    with may be defined in one module and imported into another
-    (`fm_value_t_size` lives in `_c.py` and is used from `workbook.py`).
-    """
-    constants: dict[str, int] = {}
-    for path in paths:
-        for statement in ast.parse(_read(path), filename=str(path)).body:
-            if not isinstance(statement, ast.Assign) or len(statement.targets) != 1:
-                continue
-            target = statement.targets[0]
-            if isinstance(target, ast.Name) and isinstance(statement.value, ast.Constant):
-                if isinstance(statement.value.value, int) and not isinstance(statement.value.value, bool):
-                    constants[target.id] = statement.value.value
-    return constants
-
-
-def _is_lib_call(node: ast.AST, attribute: Optional[str] = None) -> bool:
-    """True for `LIB.<attribute>(...)` (any `LIB.*` call when unspecified)."""
-    if not isinstance(node, ast.Call) or not isinstance(node.func, ast.Attribute):
-        return False
-    if not (isinstance(node.func.value, ast.Name) and node.func.value.id == "LIB"):
-        return False
-    return attribute is None or node.func.attr == attribute
-
-
-def _scratch_slot_widths(
-    function: ast.AST, constants: dict[str, int], struct_module: object
-) -> dict[str, Optional[int]]:
-    """Local name -> byte width of the WASM scratch block bound to it.
-
-    A width of `None` marks a slot whose size this resolver cannot pin (an
-    array allocation sized from a runtime length, or a name rebound to two
-    different widths). Those are reported rather than skipped when the C side
-    says the parameter is a struct pointer, because an unmeasurable buffer
-    behind a by-pointer struct is exactly the case a size guard exists for.
-    """
-    widths: dict[str, Optional[int]] = {}
-
-    def record(name: str, width: Optional[int]) -> None:
-        if name in widths and widths[name] != width:
-            widths[name] = None
-        else:
-            widths[name] = width
-
-    for node in ast.walk(function):
-        if not isinstance(node, ast.Assign) or len(node.targets) != 1:
-            continue
-        target = node.targets[0]
-        if not isinstance(target, ast.Name) or not isinstance(node.value, ast.Call):
-            continue
-        call = node.value
-        callee = call.func
-        # `x = _alloc_out_ptr()` -- the package's 4-byte out-i32 / out-ptr slot.
-        if isinstance(callee, ast.Name) and callee.id == "_alloc_out_ptr":
-            record(target.id, 4)
-        # `x = S.alloc_struct(LIB, S.LAYOUT)` -- sized from the layout table
-        # `python-struct-layouts` already pins against the header.
-        elif (isinstance(callee, ast.Attribute) and callee.attr == "alloc_struct") or (
-            isinstance(callee, ast.Name) and callee.id == "alloc_struct"
-        ):
-            layout = call.args[1] if len(call.args) > 1 else None
-            layout_name = layout.attr if isinstance(layout, ast.Attribute) else None
-            struct = getattr(struct_module, layout_name, None) if layout_name else None
-            record(target.id, struct.size if isinstance(struct, struct_module.Struct) else None)
-        # `x = LIB.alloc(N)` / `LIB.alloc(CONSTANT)` -- a hand-sized block.
-        elif _is_lib_call(call, "alloc") and call.args:
-            size = call.args[0]
-            if isinstance(size, ast.Constant) and isinstance(size.value, int):
-                record(target.id, size.value)
-            elif isinstance(size, ast.Name) and size.id in constants:
-                record(target.id, constants[size.id])
-            else:
-                record(target.id, None)
-    return widths
-
-
-def _scratch_slot_readers(function: ast.AST) -> dict[str, Set[object]]:
-    """Local name -> the reads taken against that scratch slot.
-
-    An entry is either a `_SCRATCH_READER_WIDTHS` key, `("bytes", N)` for a
-    constant-length `LIB.read_bytes`, or `"read_cstr"`.
-    """
-    readers: dict[str, Set[object]] = {}
-    for node in ast.walk(function):
-        if not isinstance(node, ast.Call) or not _is_lib_call(node) or not node.args:
-            continue
-        first = node.args[0]
-        if not isinstance(first, ast.Name):
-            continue
-        attribute = node.func.attr if isinstance(node.func, ast.Attribute) else ""
-        if attribute in _SCRATCH_READER_WIDTHS or attribute == "read_cstr":
-            readers.setdefault(first.id, set()).add(attribute)
-        elif attribute == "read_bytes" and len(node.args) > 1 and isinstance(node.args[1], ast.Constant):
-            readers.setdefault(first.id, set()).add(("bytes", node.args[1].value))
-    return readers
-
-
-def _pointee(ctype: str) -> Optional[str]:
-    """The type a parameter points at, or `None` if it is not a pointer."""
-    ctype = ctype.strip()
-    if not ctype.endswith("*"):
-        return None
-    return ctype[:-1].strip()
-
-
-def _check_out_param_width(
-    layouts: _Wasm32Layouts,
-    site: str,
-    fn_name: str,
-    position: int,
-    ctype: str,
-    width: Optional[int],
-    reads: Set[object],
-) -> List[str]:
-    """One scratch slot against the parameter it is passed to."""
-    problems: List[str] = []
-    pointee = _pointee(ctype)
-    if pointee is None:
-        # Emscripten lowers a by-value struct parameter to a pointer into
-        # linear memory, so a scratch block is the correct thing to pass for
-        # one. Any other non-pointer parameter takes a scalar, and handing it
-        # a scratch address means the callee reads the pointer as the value.
-        bare = ctype.replace("const ", "").strip()
-        if not layouts.is_struct(bare):
-            return [
-                f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r}, "
-                "which takes a scalar by value, but the binding passes a scratch-block pointer"
-            ]
-        pointee_size, _ = layouts.extent(bare)
-        is_struct = True
-    else:
-        bare = pointee.replace("const ", "").strip()
-        if bare.endswith("*"):
-            pointee_size, is_struct = 4, False  # wasm32 pointer-to-pointer
-        else:
-            try:
-                pointee_size, _ = layouts.extent(bare)
-            except _LayoutError as exc:
-                return [f"python-call-signatures: {site}: {fn_name} parameter {position} ({ctype}): {exc}"]
-            is_struct = layouts.is_struct(bare)
-
-    if width is None:
-        if is_struct:
-            problems.append(
-                f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r}, "
-                "but the size of the scratch block passed to it cannot be resolved; give the "
-                "struct a `_structs.Struct` layout or size the allocation from a module constant"
-            )
-        return problems
-
-    if width < pointee_size:
-        problems.append(
-            f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r} "
-            f"(wasm32 pointee {pointee_size} bytes) but the binding allocates {width} bytes"
-        )
-    elif is_struct and width != pointee_size:
-        problems.append(
-            f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r} "
-            f"(wasm32 sizeof {pointee_size}) but the binding allocates {width} bytes; a struct "
-            "out-parameter block must match the C size exactly"
-        )
-
-    for read in sorted(reads, key=repr):
-        read_width = _SCRATCH_READER_WIDTHS.get(read) if isinstance(read, str) else read[1]
-        if read == "read_cstr":
-            if bare.endswith("*"):
-                problems.append(
-                    f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r}, "
-                    "so its slot holds a pointer; `read_cstr` on the slot itself decodes the "
-                    "pointer's bytes as text instead of dereferencing it"
-                )
-            continue
-        if read_width is None:
-            continue
-        if read_width > width:
-            problems.append(
-                f"python-call-signatures: {site}: {fn_name} parameter {position}'s slot is "
-                f"{width} bytes but is read with {read!r} ({read_width} bytes)"
-            )
-        elif read_width > pointee_size:
-            problems.append(
-                f"python-call-signatures: {site}: {fn_name} parameter {position} is {ctype!r} "
-                f"(wasm32 pointee {pointee_size} bytes) but its slot is read with {read!r} "
-                f"({read_width} bytes)"
-            )
-    return problems
-
-
-def check_python_call_signatures() -> List[str]:
-    """Verify Python's `LIB.fm_*` calls against the C header's declarations.
-
-    Covered, for every `LIB.fm_*(...)` call in `packages/python/formulon`:
-
-    * **Arity.** The number of positional arguments equals the header's
-      parameter count. A call that splats (`*pointers`) is checked as a lower
-      bound only and named in the run's SKIPPED list.
-    * **Scratch-block width.** When an argument is a local bound to a
-      recognised scratch allocation (``_alloc_out_ptr()``,
-      ``S.alloc_struct(LIB, S.LAYOUT)``, or ``LIB.alloc(...)`` with a constant
-      or module-constant size), the block is compared against the wasm32 size
-      of what the parameter addresses: never smaller, and exactly equal when
-      that is a struct. This covers both pointer parameters and the by-value
-      struct parameters Emscripten lowers to a pointer. A struct whose block
-      size cannot be resolved is reported rather than skipped.
-    * **Read width.** Reads taken against such a slot (``read_u32`` /
-      ``read_i32`` / ``read_f64`` / constant-length ``read_bytes``) must not
-      exceed either the block or the pointee, and ``read_cstr`` must not be
-      applied to a slot that holds a pointer.
-
-    NOT covered: argument *types* at non-pointer positions (nothing on the
-    Python side records whether a value was meant to be a `uint32_t` or a
-    `double`; the wasmtime layer passes plain Python ints and floats), return
-    types beyond what `python-exports` already pins, and both non-Python
-    bindings -- embind and N-API bind C++ entry points directly rather than
-    the `fm_*` C ABI, so this header has no arity relationship to them.
-    """
-    header = re.sub(r"/\*.*?\*/", "", _read(CAPI_HEADER), flags=re.S)
-    declarations = _c_function_params(header)
-    layouts = _Wasm32Layouts(header)
-
-    spec = importlib.util.spec_from_file_location("formulon_struct_layouts_sig", PYTHON_STRUCTS)
-    if spec is None or spec.loader is None:
-        return ["python-call-signatures: could not load packages/python/formulon/_structs.py"]
-    struct_module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(struct_module)
-
-    sources = sorted(PYTHON_PKG_DIR.glob("*.py"))
-    constants = _module_int_constants(sources)
-
-    problems: List[str] = []
-    checked_calls = 0
-    for path in sources:
-        label = path.relative_to(REPO_ROOT)
-        tree = ast.parse(_read(path), filename=str(path))
-        # Analysis is per enclosing function: a scratch local is only
-        # meaningfully tied to the calls in the scope that allocated it.
-        scopes = [node for node in ast.walk(tree) if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef))]
-        for scope in scopes:
-            widths = _scratch_slot_widths(scope, constants, struct_module)
-            readers = _scratch_slot_readers(scope)
-            for node in ast.walk(scope):
-                if not isinstance(node, ast.Call) or not isinstance(node.func, ast.Attribute):
-                    continue
-                if not _is_lib_call(node):
-                    continue
-                fn_name = node.func.attr
-                if not fn_name.startswith("fm_"):
-                    continue
-                site = f"{label}:{node.lineno}"
-                params = declarations.get(fn_name)
-                if params is None:
-                    problems.append(f"python-call-signatures: {site}: {fn_name} is not declared in the C header")
-                    continue
-                checked_calls += 1
-                if node.keywords:
-                    problems.append(
-                        f"python-call-signatures: {site}: {fn_name} is called with keyword arguments; "
-                        "the wasmtime export takes positional arguments only"
-                    )
-                    continue
-                starred = any(isinstance(arg, ast.Starred) for arg in node.args)
-                if starred:
-                    fixed = len(node.args) - 1
-                    if fixed > len(params):
-                        problems.append(
-                            f"python-call-signatures: {site}: {fn_name} passes {fixed} arguments before its "
-                            f"splat but the C header declares only {len(params)} parameters"
-                        )
-                    _SKIPPED.append(
-                        f"python-call-signatures: {site}: {fn_name} splats its trailing arguments, so only "
-                        f"the {fixed}-argument lower bound is checked against the header's {len(params)}"
-                    )
-                    continue
-                if len(node.args) != len(params):
-                    problems.append(
-                        f"python-call-signatures: {site}: {fn_name} is called with {len(node.args)} "
-                        f"arguments but the C header declares {len(params)}: {params}"
-                    )
-                    continue
-                for position, argument in enumerate(node.args):
-                    if not isinstance(argument, ast.Name) or argument.id not in widths:
-                        continue
-                    problems.extend(
-                        _check_out_param_width(
-                            layouts,
-                            site,
-                            fn_name,
-                            position,
-                            params[position],
-                            widths[argument.id],
-                            readers.get(argument.id, set()),
-                        )
-                    )
-
-    if not checked_calls:
-        problems.append(
-            "python-call-signatures: no `LIB.fm_*` call sites found in "
-            f"{PYTHON_PKG_DIR.relative_to(REPO_ROOT)}; the check has stopped looking at anything"
-        )
-    # A call inside a nested `def` is reached both as part of the enclosing
-    # scope's walk and as its own scope, so the same finding can be produced
-    # twice. Deduplicate in place rather than restricting the walk: an inner
-    # closure that uses a scratch slot its parent allocated still has to be
-    # checked against that slot's width.
-    return list(dict.fromkeys(problems))
-
-
-# ---------------------------------------------------------------------------
-# Check 1d: C structs the Python binding decodes inline <-> the C header.
-#
-# `python-struct-layouts` only sees structs that have a `_structs.Struct`
-# entry. A struct small enough to decode with a bare `struct.unpack` -- an
-# `fm_value_t`, an `fm_print_range_t` -- has no such entry, so its field
-# offsets and widths live as literals in the decoding function and nothing
-# compares them to the header.
-# ---------------------------------------------------------------------------
-
-# (source file, decoder qualname, C struct). Each decoder is expected to
-# consume the whole struct, so its `struct` calls are read as a description
-# of the C layout and compared field for field.
-_PYTHON_INLINE_DECODERS = (
-    ("Value._from_wasm", "fm_value_t"),
-    ("Workbook.paginate", "fm_print_range_t"),
+from typing import List
+
+from binding_drift.abi_checks import check_abi_baseline, check_header_error_codes
+from binding_drift.c_header import c_abi_declarations  # noqa: F401  (re-exported for gen_c_abi_baseline.py)
+from binding_drift.declaration_checks import (
+    check_dts_enums,
+    check_dts_node,
+    check_dts_wasm,
+    check_pure_js_helpers,
+    check_readme_counts,
+    check_staged_dist,
 )
-
-# Python-side size literals for a struct with no `_structs.Struct` entry, as
-# (module, binding name, C struct). A `Struct`-shaped tuple binding is
-# compared on both size and alignment; a bare int on size alone.
-_PYTHON_SIZE_CONSTANTS = (
-    (PYTHON_C_BINDING, "fm_value_t_size", "fm_value_t"),
-    (PYTHON_STRUCTS, "VALUE_BLOB", "fm_value_t"),
-)
-
-# C structs that cross the ABI but that no binding marshals, so there is no
-# second side to compare against. Each is pinned by a native/wasm32
-# `static_assert` tripwire in tests/c_api instead; listing them here keeps the
-# absence deliberate, and `python-call-signatures` fails if a binding starts
-# passing one an unmeasurable block.
-_UNMODELLED_C_STRUCTS = {"fm_styles_batch"}
-
-_STRUCT_FORMAT_WIDTHS = {"b": 1, "B": 1, "h": 2, "H": 2, "i": 4, "I": 4, "q": 8, "Q": 8, "f": 4, "d": 8}
-
-
-def _struct_format_widths(fmt: str) -> Optional[List[int]]:
-    """Per-item byte widths of a little-endian `struct` format string."""
-    if not fmt.startswith("<"):
-        return None
-    widths: List[int] = []
-    for char in fmt[1:]:
-        width = _STRUCT_FORMAT_WIDTHS.get(char)
-        if width is None:
-            return None
-        widths.append(width)
-    return widths
-
-
-def _find_qualified_function(tree: ast.AST, qualname: str) -> Optional[ast.AST]:
-    class_name, _, function_name = qualname.rpartition(".")
-    for node in ast.walk(tree):
-        if not isinstance(node, ast.ClassDef) or node.name != class_name:
-            continue
-        for member in node.body:
-            if isinstance(member, (ast.FunctionDef, ast.AsyncFunctionDef)) and member.name == function_name:
-                return member
-    return None
-
-
-def check_python_inline_structs() -> List[str]:
-    """Verify Python's inline `struct.unpack` decoders against the C header.
-
-    Two things are compared, both measured from the C declarations rather
-    than tabulated here:
-
-    * A size literal the binding carries for a struct with no
-      `_structs.Struct` entry (`fm_value_t_size`, `VALUE_BLOB`) equals the
-      struct's wasm32 size, and its alignment where the binding records one.
-    * Inside each decoder in `_PYTHON_INLINE_DECODERS`, every
-      `struct.unpack_from(fmt, buf, offset)` lands on a C member offset and
-      reads no wider than that member, every whole-struct `struct.unpack(fmt,
-      ...)` describes the C members' widths in order, and every
-      constant-length `LIB.read_bytes` spans exactly the struct.
-
-    NOT covered: the *meaning* of a field (a decoder that reads the right
-    width from the right offset into the wrong attribute still passes), and
-    any struct in `_UNMODELLED_C_STRUCTS`, which no binding marshals and
-    which therefore has only a `static_assert` tripwire.
-    """
-    header = re.sub(r"/\*.*?\*/", "", _read(CAPI_HEADER), flags=re.S)
-    layouts = _Wasm32Layouts(header)
-    constants = _module_int_constants(sorted(PYTHON_PKG_DIR.glob("*.py")))
-    problems: List[str] = []
-
-    def measure(struct_name: str) -> Optional[tuple[dict[str, int], int, int, dict[str, int]]]:
-        try:
-            members = layouts.members(struct_name)
-        except _LayoutError as exc:
-            problems.append(f"python-inline-structs: {exc}")
-            return None
-        offsets, size, align = _wasm32_layout([(m.name, m.size, m.align) for m in members])
-        return offsets, size, align, {m.name: m.size for m in members}
-
-    for struct_name in sorted(_UNMODELLED_C_STRUCTS):
-        if not layouts.is_struct(struct_name):
-            problems.append(
-                f"python-inline-structs: {struct_name} is listed as unmodelled by every binding "
-                f"but no longer exists in {CAPI_HEADER.relative_to(REPO_ROOT)}"
-            )
-
-    for module_path, binding_name, struct_name in _PYTHON_SIZE_CONSTANTS:
-        measured = measure(struct_name)
-        if measured is None:
-            continue
-        _, c_size, c_align, _ = measured
-        label = module_path.relative_to(REPO_ROOT)
-        found = False
-        for statement in ast.parse(_read(module_path), filename=str(module_path)).body:
-            if not isinstance(statement, ast.Assign) or len(statement.targets) != 1:
-                continue
-            target = statement.targets[0]
-            if not isinstance(target, ast.Name) or target.id != binding_name:
-                continue
-            found = True
-            value = statement.value
-            if isinstance(value, ast.Constant) and isinstance(value.value, int):
-                if value.value != c_size:
-                    problems.append(
-                        f"python-inline-structs: {label}: {binding_name} is {value.value}, "
-                        f"but wasm32 sizeof({struct_name}) is {c_size}"
-                    )
-            elif isinstance(value, ast.Tuple) and len(value.elts) == 3:
-                elements = [element.value if isinstance(element, ast.Constant) else None for element in value.elts]
-                if elements[1] != c_size:
-                    problems.append(
-                        f"python-inline-structs: {label}: {binding_name} declares size {elements[1]}, "
-                        f"but wasm32 sizeof({struct_name}) is {c_size}"
-                    )
-                if elements[2] != c_align:
-                    problems.append(
-                        f"python-inline-structs: {label}: {binding_name} declares alignment {elements[2]}, "
-                        f"but wasm32 alignof({struct_name}) is {c_align}"
-                    )
-            else:
-                problems.append(
-                    f"python-inline-structs: {label}: {binding_name} is neither an int literal nor a "
-                    "(kind, size, alignment) literal tuple, so its layout claim cannot be read"
-                )
-        if not found:
-            problems.append(
-                f"python-inline-structs: {label} no longer defines {binding_name}, "
-                f"which is where the binding's {struct_name} size lives"
-            )
-
-    tree = ast.parse(_read(PYTHON_WORKBOOK), filename=str(PYTHON_WORKBOOK))
-    label = PYTHON_WORKBOOK.relative_to(REPO_ROOT)
-    for qualname, struct_name in _PYTHON_INLINE_DECODERS:
-        function = _find_qualified_function(tree, qualname)
-        if function is None:
-            problems.append(
-                f"python-inline-structs: {label} no longer defines {qualname}, "
-                f"which is where the inline {struct_name} decoding lives"
-            )
-            continue
-        measured = measure(struct_name)
-        if measured is None:
-            continue
-        c_offsets, c_size, _, c_sizes = measured
-        member_widths = [c_sizes[name] for name in c_offsets]
-
-        for node in ast.walk(function):
-            if isinstance(node, ast.Call) and _is_lib_call(node, "read_bytes") and len(node.args) > 1:
-                length = node.args[1]
-                span = None
-                if isinstance(length, ast.Constant) and isinstance(length.value, int):
-                    span = length.value
-                elif isinstance(length, ast.Name):
-                    span = constants.get(length.id)
-                if span is not None and span != c_size:
-                    problems.append(
-                        f"python-inline-structs: {label}:{node.lineno}: {qualname} reads {span} bytes "
-                        f"for a {struct_name}, whose wasm32 size is {c_size}"
-                    )
-            if not (
-                isinstance(node, ast.Call)
-                and isinstance(node.func, ast.Attribute)
-                and isinstance(node.func.value, ast.Name)
-                and node.func.value.id == "struct"
-            ):
-                continue
-            if not node.args or not isinstance(node.args[0], ast.Constant):
-                continue
-            fmt = node.args[0].value
-            if not isinstance(fmt, str):
-                continue
-            widths = _struct_format_widths(fmt)
-            if widths is None:
-                problems.append(
-                    f"python-inline-structs: {label}:{node.lineno}: {qualname} uses the format {fmt!r}, "
-                    "which is not a little-endian fixed-width layout this check can measure"
-                )
-                continue
-            if node.func.attr == "unpack_from":
-                if len(node.args) < 3 or not isinstance(node.args[2], ast.Constant):
-                    continue
-                offset = node.args[2].value
-                owner = next((name for name, at in c_offsets.items() if at == offset), None)
-                if owner is None:
-                    problems.append(
-                        f"python-inline-structs: {label}:{node.lineno}: {qualname} decodes at offset "
-                        f"{offset}, which is not a member offset of {struct_name} "
-                        f"({sorted(c_offsets.items(), key=lambda item: item[1])})"
-                    )
-                elif sum(widths) > c_sizes[owner]:
-                    problems.append(
-                        f"python-inline-structs: {label}:{node.lineno}: {qualname} reads {sum(widths)} bytes "
-                        f"with {fmt!r} at offset {offset}, but {struct_name}.{owner} is {c_sizes[owner]} bytes"
-                    )
-            elif node.func.attr == "unpack" and widths != member_widths:
-                problems.append(
-                    f"python-inline-structs: {label}:{node.lineno}: {qualname} decodes a whole "
-                    f"{struct_name} with {fmt!r} (field widths {widths}), but the C members are "
-                    f"{list(zip(c_offsets, member_widths))}"
-                )
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 2a: WASM embind registration <-> src/wasm/formulon.d.ts.
-# ---------------------------------------------------------------------------
-
-
-def check_dts_wasm() -> List[str]:
-    problems: List[str] = []
-    cpp_text = _read(WASM_BINDINGS_CPP)
-
-    instance_cpp = set(re.findall(r'\.function\("([^"]+)"', cpp_text))
-    static_cpp = set(re.findall(r'\.class_function\("([^"]+)"', cpp_text))
-    free_cpp = set(re.findall(r'(?<!\.)\bfunction\("([^"]+)"', cpp_text))
-
-    dts_text = _read(WASM_DTS)
-    instance_dts = _extract_ts_methods(_find_interface_body(dts_text, "Workbook", WASM_DTS)) - WASM_AUTO_METHODS
-    static_dts = _extract_ts_methods(_find_interface_body(dts_text, "WorkbookCtor", WASM_DTS))
-    free_dts = _extract_ts_methods(_find_interface_body(dts_text, "FormulonModule", WASM_DTS))
-
-    for label, cpp_set, dts_set in (
-        ("Workbook instance methods", instance_cpp, instance_dts),
-        ("Workbook static factories", static_cpp, static_dts),
-        ("free functions", free_cpp, free_dts),
-    ):
-        diff = _format_diff(
-            f"{WASM_BINDINGS_CPP.relative_to(REPO_ROOT)}",
-            cpp_set - dts_set,
-            f"{WASM_DTS.relative_to(REPO_ROOT)}",
-            dts_set - cpp_set,
-        )
-        if diff:
-            problems.append(f"dts-wasm: {label} mismatch:\n" + "\n".join(diff))
-
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 2b: Node N-API registration <-> packages/npm-native/index.d.ts.
-# ---------------------------------------------------------------------------
-
-
-def check_dts_node() -> List[str]:
-    problems: List[str] = []
-    cc_text = _read(NODE_WORKBOOK_CLASS_CC)
-
-    instance_cc = set(re.findall(r'InstanceMethod<[^>]+>\("([^"]+)"\)', cc_text))
-    static_cc = set(re.findall(r'StaticMethod<[^>]+>\("([^"]+)"\)', cc_text))
-
-    addon_text = _read(NODE_ADDON_CC)
-    free_cc = set(re.findall(r'exports\.Set\("([^"]+)"', addon_text)) - {"Workbook"}
-
-    dts_text = _read(NODE_DTS)
-    instance_dts = _extract_ts_methods(_find_interface_body(dts_text, "Workbook", NODE_DTS))
-    static_dts = _extract_ts_methods(_find_interface_body(dts_text, "WorkbookCtor", NODE_DTS))
-    free_dts = set(re.findall(r"^export function ([A-Za-z0-9_]+)\(", dts_text, re.MULTILINE))
-    free_dts -= NODE_PURE_JS_FREE_FUNCTIONS
-
-    wasm_cpp_text = _read(WASM_BINDINGS_CPP)
-    wasm_instance = set(re.findall(r'\.function\("([^"]+)"', wasm_cpp_text))
-    actual_wasm_only = wasm_instance - instance_cc
-    actual_node_only = instance_cc - wasm_instance
-    if actual_wasm_only != WASM_ONLY_METHODS:
-        problems.append(
-            "dts-node: WASM-only instance-method allowlist mismatch; "
-            f"actual={sorted(actual_wasm_only)}, allowlist={sorted(WASM_ONLY_METHODS)}"
-        )
-    if actual_node_only != NODE_ONLY_METHODS:
-        problems.append(
-            "dts-node: Node-only instance-method allowlist mismatch; "
-            f"actual={sorted(actual_node_only)}, allowlist={sorted(NODE_ONLY_METHODS)}"
-        )
-    stale_wasm_only = WASM_ONLY_METHODS - actual_wasm_only
-    stale_node_only = NODE_ONLY_METHODS - actual_node_only
-    if stale_wasm_only:
-        problems.append(f"dts-node: stale WASM-only allowlist entries: {sorted(stale_wasm_only)}")
-    if stale_node_only:
-        problems.append(f"dts-node: stale Node-only allowlist entries: {sorted(stale_node_only)}")
-
-    for label, cc_set, dts_set in (
-        ("Workbook instance methods", instance_cc, instance_dts),
-        ("Workbook static factories", static_cc, static_dts),
-        ("free functions", free_cc, free_dts),
-    ):
-        diff = _format_diff(
-            f"{NODE_WORKBOOK_CLASS_CC.relative_to(REPO_ROOT)} / {NODE_ADDON_CC.relative_to(REPO_ROOT)}",
-            cc_set - dts_set,
-            f"{NODE_DTS.relative_to(REPO_ROOT)}",
-            dts_set - cc_set,
-        )
-        if diff:
-            problems.append(f"dts-node: {label} mismatch:\n" + "\n".join(diff))
-
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 2c: shared `.d.ts` shapes -- return types and record field sets.
-#
-# `dts-wasm` and `dts-node` compare method *names* only. That is enough to
-# notice a method that exists on one surface and not the other, and nothing
-# else: a shared method whose two declarations disagree about what comes back,
-# or a record type that grew a field on one side, passes both of them. The
-# README's parity claim is about the shapes, not the names, so this check
-# compares the shapes.
-#
-# Types declared in only one of the two published declaration files. Each has
-# to be reachable only from that surface's own method allowlist -- a type that
-# becomes one-sided for any other reason is a missing declaration, and listing
-# it here is the deliberate act that says otherwise.
-# ---------------------------------------------------------------------------
-
-_DTS_SURFACE_ONLY_TYPES = {
-    # The embind module factory and its options: there is no equivalent on a
-    # native addon, which is `require`d rather than instantiated.
-    ("wasm", "FormulonModule"),
-    ("wasm", "FormulonModuleOptions"),
-    # Reachable only from `getSheetAutoFilterXml` / `createTable` /
-    # `updateTable`, all of which are in WASM_ONLY_METHODS.
-    ("wasm", "SheetAutoFilterXmlResult"),
-    ("wasm", "TableInput"),
-    ("wasm", "TableUpdateInput"),
-}
-
-# Shared methods whose two declarations are allowed to differ, with the
-# reason. Empty by design: a difference that is not worth an entry here is a
-# difference that should not exist.
-_DTS_RETURN_TYPE_EXEMPT_METHODS: dict[str, str] = {}
-
-# Top-level members of an exported interface are indented exactly two spaces;
-# anything deeper belongs to a nested object type and is compared as part of
-# its parent's field text, not on its own.
-_TS_MEMBER_NAME_RE = re.compile(r"^ {2}([A-Za-z_$][A-Za-z0-9_$]*)\s*\(", re.MULTILINE)
-_TS_MEMBER_FIELD_RE = re.compile(r"^ {2}(?:readonly\s+)?([A-Za-z_$][A-Za-z0-9_$]*)(\??)\s*:", re.MULTILINE)
-
-
-def _ts_return_types(body: str) -> dict[str, str]:
-    """Maps each method in an interface body to its declared return type.
-
-    The parameter list is skipped by bracket balancing so a wrapped or
-    generic signature is read the same as a single-line one; whitespace in
-    the return type is collapsed so formatting differences do not register
-    as drift.
-    """
-    out: dict[str, str] = {}
-    for match in _TS_MEMBER_NAME_RE.finditer(body):
-        open_paren = body.index("(", match.start())
-        depth = 0
-        close_paren = -1
-        for i in range(open_paren, len(body)):
-            char = body[i]
-            if char in "(<[":
-                depth += 1
-            elif char in ")>]":
-                depth -= 1
-                if depth == 0 and char == ")":
-                    close_paren = i
-                    break
-        if close_paren < 0:
-            continue
-        rest = body[close_paren + 1 :]
-        if ";" not in rest:
-            continue
-        declared = rest[: rest.index(";")].strip()
-        if declared.startswith(":"):
-            declared = declared[1:]
-        out[match.group(1)] = " ".join(declared.split())
-    return out
-
-
-def _ts_interface_declaration(text: str, name: str, source: Path) -> tuple[str, str]:
-    """Returns an interface's `extends` clause (may be empty) and its body.
-
-    Unlike `_find_interface_body` this tolerates `extends`, which matters
-    here: a record type that inherits its fields declares none of them
-    locally, so the base list is part of the shape being compared.
-    """
-    match = re.search(r"^export interface %s\b([^{]*)\{" % re.escape(name), text, re.MULTILINE)
-    if not match:
-        print(f"check_binding_drift: interface {name!r} not found in {source}", file=sys.stderr)
-        sys.exit(2)
-    return " ".join(match.group(1).split()), _extract_braced_block(text, match.end())
-
-
-def _ts_field_set(body: str) -> Set[str]:
-    """Field names of an interface body, each suffixed with `?` when optional.
-
-    Optionality is part of the compared shape on purpose: "present only on
-    success" is how both declaration files spell a payload key the runtime
-    drops, so a required declaration on one side and an optional one on the
-    other is a real disagreement about what a caller may dereference.
-    """
-    return {name + optional for name, optional in _TS_MEMBER_FIELD_RE.findall(body)}
-
-
-def check_dts_shared_shapes() -> List[str]:
-    problems: List[str] = []
-    wasm_dts = _read(WASM_DTS)
-    node_dts = _read(NODE_DTS)
-    wasm_label = str(WASM_DTS.relative_to(REPO_ROOT))
-    node_label = str(NODE_DTS.relative_to(REPO_ROOT))
-
-    for interface in ("Workbook", "WorkbookCtor"):
-        wasm_returns = _ts_return_types(_find_interface_body(wasm_dts, interface, WASM_DTS))
-        node_returns = _ts_return_types(_find_interface_body(node_dts, interface, NODE_DTS))
-        for name in sorted(set(wasm_returns) & set(node_returns)):
-            if wasm_returns[name] == node_returns[name]:
-                if name in _DTS_RETURN_TYPE_EXEMPT_METHODS:
-                    problems.append(
-                        f"dts-shared-shapes: {name} is listed as a deliberate return-type "
-                        "difference but both surfaces now declare the same type; drop the entry"
-                    )
-                continue
-            if name in _DTS_RETURN_TYPE_EXEMPT_METHODS:
-                continue
-            problems.append(
-                f"dts-shared-shapes: {interface}.{name} returns a different type on each surface:\n"
-                f"  {wasm_label}: {wasm_returns[name]}\n"
-                f"  {node_label}: {node_returns[name]}"
-            )
-
-    wasm_types = set(re.findall(r"^export interface ([A-Za-z0-9_]+)", wasm_dts, re.MULTILINE))
-    node_types = set(re.findall(r"^export interface ([A-Za-z0-9_]+)", node_dts, re.MULTILINE))
-    surface_only = {("wasm", name) for name in wasm_types - node_types}
-    surface_only |= {("node", name) for name in node_types - wasm_types}
-    undeclared = surface_only - _DTS_SURFACE_ONLY_TYPES
-    if undeclared:
-        problems.append(
-            "dts-shared-shapes: type declared on one surface only, without an entry in "
-            f"_DTS_SURFACE_ONLY_TYPES: {sorted(undeclared)}"
-        )
-    stale = _DTS_SURFACE_ONLY_TYPES - surface_only
-    if stale:
-        problems.append(f"dts-shared-shapes: stale _DTS_SURFACE_ONLY_TYPES entries: {sorted(stale)}")
-
-    for name in sorted(wasm_types & node_types):
-        if name in ("Workbook", "WorkbookCtor"):
-            continue
-        wasm_extends, wasm_body = _ts_interface_declaration(wasm_dts, name, WASM_DTS)
-        node_extends, node_body = _ts_interface_declaration(node_dts, name, NODE_DTS)
-        if wasm_extends != node_extends:
-            problems.append(
-                f"dts-shared-shapes: {name} inherits differently on each surface:\n"
-                f"  {wasm_label}: {wasm_extends or '(nothing)'}\n"
-                f"  {node_label}: {node_extends or '(nothing)'}"
-            )
-        diff = _format_diff(
-            f"{name} in {wasm_label}",
-            _ts_field_set(wasm_body) - _ts_field_set(node_body),
-            f"{name} in {node_label}",
-            _ts_field_set(node_body) - _ts_field_set(wasm_body),
-        )
-        if diff:
-            problems.append(f"dts-shared-shapes: {name} field set mismatch:\n" + "\n".join(diff))
-
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 2d: pure-JS helpers shipped by both npm packages.
-#
-# A helper with no native entry point behind it has to be written out once per
-# package, because the two packages share no module. Nothing then holds the
-# copies together, and nothing notices when one package documents a helper it
-# does not ship -- which is how the WASM declaration file came to send its
-# readers to a package that is not published. Both halves are checked here:
-# the helper is exported and declared by both packages, and the two
-# implementations are the same text.
-# ---------------------------------------------------------------------------
-
-
-def _js_exported_function_source(text: str, name: str) -> Optional[str]:
-    """Whitespace-normalised body of `export function <name>(...) { ... }`."""
-    match = re.search(r"^export function %s\s*\(" % re.escape(name), text, re.MULTILINE)
-    if not match:
-        return None
-    body_open = text.index("{", match.end())
-    return " ".join(_extract_braced_block(text, body_open + 1).split())
-
-
-def _npm_entries_reexport_common(check: str) -> List[str]:
-    """Every npm entry point must re-export common.mjs, or it ships without the shared surface."""
-    return [
-        f"{check}: {entry.relative_to(REPO_ROOT)} does not `export * from './common.js'`"
-        for entry in NPM_ENTRY_MJS
-        if not re.search(r"^export \* from '\./common\.js';", _read(entry), re.MULTILINE)
-    ]
-
-
-def check_pure_js_helpers() -> List[str]:
-    problems: List[str] = _npm_entries_reexport_common("pure-js-helpers")
-    sources = {
-        "npm": (NPM_COMMON_MJS, WASM_DTS),
-        "npm-native": (NODE_INDEX_MJS, NODE_DTS),
-    }
-
-    for name in sorted(NODE_PURE_JS_FREE_FUNCTIONS):
-        bodies: dict[str, str] = {}
-        for package, (mjs_path, dts_path) in sources.items():
-            body = _js_exported_function_source(_read(mjs_path), name)
-            if body is None:
-                problems.append(
-                    f"pure-js-helpers: {mjs_path.relative_to(REPO_ROOT)} does not export a "
-                    f"`{name}` function. A helper only one package ships cannot be named in a "
-                    "declaration file both packages publish."
-                )
-            else:
-                bodies[package] = body
-            if not re.search(r"^export function %s\s*\(" % re.escape(name), _read(dts_path), re.MULTILINE):
-                problems.append(
-                    f"pure-js-helpers: {dts_path.relative_to(REPO_ROOT)} does not declare `export function {name}`"
-                )
-        if len(bodies) == len(sources) and len(set(bodies.values())) != 1:
-            problems.append(
-                f"pure-js-helpers: the `{name}` implementations have diverged between "
-                f"{NPM_COMMON_MJS.relative_to(REPO_ROOT)} and {NODE_INDEX_MJS.relative_to(REPO_ROOT)}. "
-                "The two packages share no module, so the copies are held together here or not "
-                "at all."
-            )
-
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 3: README instance-method count <-> actual registration count.
-# ---------------------------------------------------------------------------
-
-_NUMBER_WORDS = {
-    "zero": 0,
-    "one": 1,
-    "two": 2,
-    "three": 3,
-    "four": 4,
-    "five": 5,
-    "six": 6,
-    "seven": 7,
-    "eight": 8,
-    "nine": 9,
-    "ten": 10,
-}
-
-_README_COUNT_RE = re.compile(r"register (\d+) instance methods plus the\s+(\w+) static factories")
-_README_SHARED_COUNT_RE = re.compile(r"instance methods, (\d+) are shared with WASM; (\w+) remain WASM-only")
-
-
-def check_readme_counts() -> List[str]:
-    problems: List[str] = []
-    cc_text = _read(NODE_WORKBOOK_CLASS_CC)
-    actual_instance = len(set(re.findall(r'InstanceMethod<[^>]+>\("([^"]+)"\)', cc_text)))
-    actual_static = len(set(re.findall(r'StaticMethod<[^>]+>\("([^"]+)"\)', cc_text)))
-
-    readme_text = _read(NODE_README)
-    match = _README_COUNT_RE.search(readme_text)
-    if not match:
-        problems.append(
-            f"readme-counts: could not find the instance/static method-count sentence in "
-            f"{NODE_README.relative_to(REPO_ROOT)} (pattern: {_README_COUNT_RE.pattern!r})"
-        )
-        return problems
-
-    quoted_instance = int(match.group(1))
-    quoted_static_word = match.group(2).lower()
-    quoted_static = _NUMBER_WORDS.get(quoted_static_word)
-
-    if quoted_instance != actual_instance:
-        problems.append(
-            f"readme-counts: {NODE_README.relative_to(REPO_ROOT)} claims {quoted_instance} instance methods, "
-            f"actual count in {NODE_WORKBOOK_CLASS_CC.relative_to(REPO_ROOT)} is {actual_instance}"
-        )
-    if quoted_static is None or quoted_static != actual_static:
-        problems.append(
-            f"readme-counts: {NODE_README.relative_to(REPO_ROOT)} claims {match.group(2)!r} static factories, "
-            f"actual count in {NODE_WORKBOOK_CLASS_CC.relative_to(REPO_ROOT)} is {actual_static}"
-        )
-
-    wasm_cpp_text = _read(WASM_BINDINGS_CPP)
-    wasm_instance = set(re.findall(r'\.function\("([^"]+)"', wasm_cpp_text))
-    actual_node_methods = set(re.findall(r'InstanceMethod<[^>]+>\("([^"]+)"\)', cc_text))
-    actual_shared = len(wasm_instance & actual_node_methods)
-    actual_wasm_only = len(wasm_instance - actual_node_methods)
-    shared_match = _README_SHARED_COUNT_RE.search(readme_text)
-    if not shared_match:
-        problems.append(
-            f"readme-counts: could not find the shared/WASM-only method-count sentence in "
-            f"{NODE_README.relative_to(REPO_ROOT)}"
-        )
-    else:
-        quoted_shared = int(shared_match.group(1))
-        quoted_wasm_only = _NUMBER_WORDS.get(shared_match.group(2).lower())
-        if quoted_shared != actual_shared:
-            problems.append(
-                f"readme-counts: {NODE_README.relative_to(REPO_ROOT)} claims {quoted_shared} shared methods, "
-                f"actual shared count is {actual_shared}"
-            )
-        if quoted_wasm_only is None or quoted_wasm_only != actual_wasm_only:
-            problems.append(
-                f"readme-counts: {NODE_README.relative_to(REPO_ROOT)} claims {shared_match.group(2)!r} WASM-only methods, "
-                f"actual count is {actual_wasm_only}"
-            )
-
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 5: src/wasm/formulon.d.ts `export enum` ordinals <-> their C/C++
-#          source enum. embind never registers these as a real `enum_<T>`
-#          (that would cost WASM size for values only ever crossing the
-#          boundary as plain numbers); the `.d.ts` copy is therefore the
-#          sole place the JS-visible ordinals live, and nothing enforces
-#          that it still matches the source enum after a reorder / insert.
-# ---------------------------------------------------------------------------
-
-_ENUM_BODY_COMMENT_RE = re.compile(r"//[^\n]*|/\*.*?\*/", re.DOTALL)
-_ENUM_MEMBER_RE = re.compile(r"([A-Za-z_][A-Za-z0-9_]*)\s*(?:=\s*(-?(?:0[xX][0-9a-fA-F]+|\d+)))?\s*$")
-
-
-def _parse_enum_body(body: str) -> Optional[List[int]]:
-    """Parses a brace-delimited enumerator list into its ordinal values.
-
-    Handles both explicit `Name = N` members and implicit sequential
-    values (each unset member is one more than the previous value, C/C++/TS
-    enum semantics). Returns `None` if a member's initializer is not a
-    literal integer (e.g. it references another constant) -- the caller
-    should skip comparison in that case rather than mis-flag a drift.
-    """
-    body = _ENUM_BODY_COMMENT_RE.sub("", body)
-    values: List[int] = []
-    next_value = 0
-    for part in body.split(","):
-        part = part.strip()
-        if not part:
-            continue
-        match = _ENUM_MEMBER_RE.match(part)
-        if not match:
-            return None
-        literal = match.group(2)
-        if literal is not None:
-            next_value = int(literal, 0)
-        values.append(next_value)
-        next_value += 1
-    return values
-
-
-def _extract_c_typedef_enum(text: str, type_name: str) -> Optional[List[int]]:
-    # `[^}]*` (rather than a non-greedy `.*?`) deliberately cannot cross a
-    # `}` boundary, so a search starting at an *earlier*, unrelated
-    # `typedef enum { ... }` block cannot skip past its own close brace
-    # and accidentally splice in a later block that happens to close with
-    # this `type_name`.
-    match = re.search(r"typedef enum\s*\{([^}]*)\}\s*" + re.escape(type_name) + r"\s*;", text, re.DOTALL)
-    if not match:
-        return None
-    return _parse_enum_body(match.group(1))
-
-
-def _cpp_enum_class_body(text: str, enum_name: str) -> Optional[str]:
-    """The brace-delimited enumerator list of a scoped enum, or `None`."""
-    match = re.search(
-        r"enum class\s+" + re.escape(enum_name) + r"\s*(?::\s*[\w:]+)?\s*\{([^}]*)\}\s*;", text, re.DOTALL
-    )
-    return match.group(1) if match else None
-
-
-def _extract_cpp_enum_class(text: str, enum_name: str) -> Optional[List[int]]:
-    body = _cpp_enum_class_body(text, enum_name)
-    if body is None:
-        return None
-    return _parse_enum_body(body)
-
-
-def _extract_ts_enum(text: str, enum_name: str) -> Optional[List[int]]:
-    match = re.search(r"export (?:const )?enum\s+" + re.escape(enum_name) + r"\s*\{([^}]*)\}", text, re.DOTALL)
-    if not match:
-        return None
-    return _parse_enum_body(match.group(1))
-
-
-# Maps each `.d.ts` enum name to the (source description, extractor) pair
-# that finds its mirrored C/C++ enum's ordinal sequence. `fm_*_t` names
-# resolve against formulon_c.h; the remaining few are plain C++ `enum
-# class` types in their own small headers (comparing against the giant
-# formulon_c.h text for those would just add false-positive risk from an
-# unrelated same-named enum elsewhere).
-_DTS_ENUM_SOURCES = {
-    "ValueKind": (CAPI_HEADER, "fm_value_kind_t", _extract_c_typedef_enum),
-    "WorkbookFormat": (CAPI_HEADER, "fm_workbook_format_t", _extract_c_typedef_enum),
-    "PivotCellKind": (CAPI_HEADER, "fm_pivot_cell_kind_t", _extract_c_typedef_enum),
-    "PivotAxis": (CAPI_HEADER, "fm_pivot_axis_t", _extract_c_typedef_enum),
-    "PivotAggregation": (CAPI_HEADER, "fm_pivot_aggregation_t", _extract_c_typedef_enum),
-    "PivotShowValuesAs": (CAPI_HEADER, "fm_pivot_show_as_t", _extract_c_typedef_enum),
-    "PivotFilterType": (CAPI_HEADER, "fm_pivot_filter_type_t", _extract_c_typedef_enum),
-    "PivotDateGrouping": (CAPI_HEADER, "fm_pivot_date_grouping_t", _extract_c_typedef_enum),
-    "PivotCalendar": (CAPI_HEADER, "fm_pivot_calendar_t", _extract_c_typedef_enum),
-    "PivotReportLayout": (CAPI_HEADER, "fm_pivot_layout_t", _extract_c_typedef_enum),
-    "PivotFilterValueKind": (CAPI_HEADER, "fm_pivot_filter_value_kind_t", _extract_c_typedef_enum),
-    "SheetVisibility": (CAPI_HEADER, "fm_sheet_visibility_t", _extract_c_typedef_enum),
-    "CfMatchKind": (CF_MATCH_H, "CFMatchKind", _extract_cpp_enum_class),
-    "CalcMode": (CALC_MODE_H, "CalcMode", _extract_cpp_enum_class),
-    "ErrorCode": (VALUE_H, "ErrorCode", _extract_cpp_enum_class),
-    "ExternalLinkKind": (EXTERNAL_LINKS_H, "Kind", _extract_cpp_enum_class),
-}
-
-
-def check_dts_enums() -> List[str]:
-    problems: List[str] = []
-    dts_text = _read(WASM_DTS)
-
-    for ts_name, (source_path, source_enum, extractor) in sorted(_DTS_ENUM_SOURCES.items()):
-        ts_values = _extract_ts_enum(dts_text, ts_name)
-        if ts_values is None:
-            problems.append(
-                f"dts-enums: could not find/parse `export enum {ts_name}` in {WASM_DTS.relative_to(REPO_ROOT)}"
-            )
-            continue
-
-        source_text = _read(source_path)
-        source_values = extractor(source_text, source_enum)
-        if source_values is None:
-            problems.append(
-                f"dts-enums: could not find/parse `{source_enum}` in {source_path.relative_to(REPO_ROOT)} "
-                f"(needed to check {WASM_DTS.relative_to(REPO_ROOT)}'s {ts_name})"
-            )
-            continue
-
-        if ts_values != source_values:
-            problems.append(
-                f"dts-enums: {ts_name} in {WASM_DTS.relative_to(REPO_ROOT)} has ordinals {ts_values}, "
-                f"but its source {source_enum} in {source_path.relative_to(REPO_ROOT)} has {source_values}"
-            )
-
-    problems.extend(_check_js_constant_tables(dts_text))
-    return problems
-
-
-# Frozen ordinal tables are the only way a JS consumer can name a value
-# that crosses the boundary as a plain number, so both published ESM entry
-# points have to carry the same ones. The WASM `.d.ts` above is already
-# pinned to the C/C++ enums, which makes it the single source the two
-# `index.mjs` files are measured against -- comparing them only to each
-# other would let a shared mistake pass.
-_JS_TABLE_RE = re.compile(r"^export const (\w+) = Object\.freeze\(\{(.*?)\}\);", re.DOTALL | re.MULTILINE)
-_JS_SCALAR_RE = re.compile(r"^export const (\w+) = (-?\d+);", re.MULTILINE)
-_JS_MEMBER_RE = re.compile(r"(\w+)\s*:\s*(-?\d+)")
-
-
-def _parse_js_constants(path: Path) -> dict:
-    """Reads an `index.mjs`'s exported ordinal tables and scalar constants."""
-    text = _read(path)
-    out: dict = {}
-    for match in _JS_TABLE_RE.finditer(text):
-        out[match.group(1)] = {name: int(value) for name, value in _JS_MEMBER_RE.findall(match.group(2))}
-    for match in _JS_SCALAR_RE.finditer(text):
-        out[match.group(1)] = int(match.group(2))
-    return out
-
-
-def _parse_ts_named_enum(text: str, name: str) -> Optional[dict]:
-    """Reads a `.d.ts` ordinal table in either idiom used across the two
-    declaration files: a TS `export enum` or an `export const` whose type
-    is a `Readonly<{...}>` literal."""
-    match = re.search(r"export enum\s+" + re.escape(name) + r"\s*\{([^}]*)\}", text, re.DOTALL)
-    if match is None:
-        match = re.search(r"export const\s+" + re.escape(name) + r"\s*:\s*Readonly<\{([^}]*)\}>", text, re.DOTALL)
-    if match is None:
-        return None
-    body = _ENUM_BODY_COMMENT_RE.sub("", match.group(1))
-    members: dict = {}
-    next_value = 0
-    for part in body.replace(";", ",").split(","):
-        part = part.strip()
-        if not part:
-            continue
-        member = re.match(r"([A-Za-z_]\w*)\s*(?:[:=]\s*(-?\d+))?$", part)
-        if member is None:
-            return None
-        if member.group(2) is not None:
-            next_value = int(member.group(2))
-        members[member.group(1)] = next_value
-        next_value += 1
-    return members
-
-
-def _check_js_constant_tables(wasm_dts_text: str) -> List[str]:
-    problems: List[str] = _npm_entries_reexport_common("dts-enums")
-    npm = _parse_js_constants(NPM_COMMON_MJS)
-    native = _parse_js_constants(NODE_INDEX_MJS)
-    npm_label = NPM_COMMON_MJS.relative_to(REPO_ROOT)
-    native_label = NODE_INDEX_MJS.relative_to(REPO_ROOT)
-
-    only_npm = sorted(set(npm) - set(native))
-    only_native = sorted(set(native) - set(npm))
-    if only_npm:
-        problems.append(f"dts-enums: exported by {npm_label} but not {native_label}: {only_npm}")
-    if only_native:
-        problems.append(f"dts-enums: exported by {native_label} but not {npm_label}: {only_native}")
-
-    for name in sorted(set(npm) & set(native)):
-        if npm[name] != native[name]:
-            problems.append(f"dts-enums: {name} is {npm[name]} in {npm_label} but {native[name]} in {native_label}")
-
-    # Each runtime table must also match the declaration file its own
-    # package ships, and the tables (not the bare scalars) must match the
-    # canonical WASM `.d.ts`.
-    node_dts_text = _read(NODE_DTS)
-    for label, constants, dts_text, dts_path in (
-        (npm_label, npm, wasm_dts_text, WASM_DTS),
-        (native_label, native, node_dts_text, NODE_DTS),
-    ):
-        for name, value in sorted(constants.items()):
-            if not isinstance(value, dict):
-                if not re.search(r"export const\s+" + re.escape(name) + r"\s*=\s*" + str(value) + r"\b", dts_text):
-                    problems.append(
-                        f"dts-enums: {label} exports {name} = {value}, "
-                        f"not declared with that value in {dts_path.relative_to(REPO_ROOT)}"
-                    )
-                continue
-            declared = _parse_ts_named_enum(dts_text, name)
-            if declared is None:
-                problems.append(
-                    f"dts-enums: {label} exports the table {name}, "
-                    f"which {dts_path.relative_to(REPO_ROOT)} does not declare as a value"
-                )
-            elif declared != value:
-                problems.append(
-                    f"dts-enums: {name} is {value} in {label} but {declared} in {dts_path.relative_to(REPO_ROOT)}"
-                )
-
-    canonical_only = sorted(
-        name for name in _DTS_ENUM_SOURCES if name not in npm or not isinstance(npm.get(name), dict)
-    )
-    if canonical_only:
-        problems.append(
-            f"dts-enums: {WASM_DTS.relative_to(REPO_ROOT)} declares these enums but {npm_label} "
-            f"does not export them as runtime tables: {canonical_only}"
-        )
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 6: public style-record field sets <-> their C ABI struct.
-#
-# `FontRecord` and friends are declared independently in three public
-# surfaces and each one claims to mirror the C struct. Method-level drift
-# checking cannot see a field that one surface forgot, which is how a font's
-# `vertAlign` reached the WASM `.d.ts` alone: reading a superscript font and
-# writing it back through the other bindings silently demoted it.
-# ---------------------------------------------------------------------------
-
-PYTHON_WORKBOOK = PYTHON_PKG_DIR / "workbook.py"
-
-# Public type name -> the C struct it projects.
-_STYLE_RECORD_STRUCTS = {
-    "CellXf": "fm_cell_xf",
-    "ColorSpec": "fm_color_spec",
-    "FontRecord": "fm_font_record",
-    "FillRecord": "fm_fill_record",
-    "BorderSide": "fm_border_side",
-}
-
-# Deliberate omissions, keyed by (surface, type name). Python models a border
-# side as a plain dict rather than a dataclass, so it has no `BorderSide` type
-# to compare; the dict shape is covered by the wasm32 struct-layout check.
-_STYLE_RECORD_EXEMPT_TYPES = {
-    ("python", "BorderSide"),
-}
-
-# C presence flags that neither host language mirrors as a field, because both
-# already have a way to say "absent": the TS surface omits the optional
-# property, Python leaves it `None`. Naming the value field alone would let a
-# host drop the distinction entirely, so each entry lists the value field the
-# flag governs and both are required to exist together.
-_STYLE_RECORD_PRESENCE_FLAGS = {
-    "fm_cell_xf": {
-        "has_text_rotation": "text_rotation",
-        "has_indent": "indent",
-        "has_relative_indent": "relative_indent",
-        "has_shrink_to_fit": "shrink_to_fit",
-        "has_reading_order": "reading_order",
-    },
-}
-
-_TS_FIELD_RE = re.compile(r"^\s*([A-Za-z_$][A-Za-z0-9_$]*)\??\s*:", re.MULTILINE)
-_PY_FIELD_RE = re.compile(r"^    ([a-z_][A-Za-z0-9_]*)\s*:", re.MULTILINE)
-
-
-def _snake_to_camel(name: str) -> str:
-    head, *rest = name.split("_")
-    return head + "".join(part.capitalize() for part in rest)
-
-
-def _c_struct_fields(header: str, struct_name: str, source: Path) -> List[str]:
-    blocks = {name: body for body, name in _C_STRUCT_RE.findall(header)}
-    body = blocks.get(struct_name)
-    if body is None:
-        print(f"check_binding_drift: struct {struct_name!r} not found in {source}", file=sys.stderr)
-        sys.exit(2)
-    fields: List[str] = []
-    for declaration in body.split(";"):
-        declaration = " ".join(declaration.split())
-        if not declaration:
-            continue
-        match = re.fullmatch(r"(.+?)\s+([A-Za-z_][A-Za-z0-9_]*)(?:\[(\d+)\])?", declaration)
-        if match and not match.group(2).startswith("_pad"):
-            fields.append(match.group(2))
-    return fields
-
-
-def _python_class_fields(text: str, class_name: str) -> Optional[Set[str]]:
-    match = re.search(r"^class %s:\s*$" % re.escape(class_name), text, re.MULTILINE)
-    if not match:
-        return None
-    rest = text[match.end() :]
-    end = re.search(r"^(?:@|class |def )", rest, re.MULTILINE)
-    body = rest[: end.start()] if end else rest
-    return set(_PY_FIELD_RE.findall(body))
-
-
-def check_style_record_fields() -> List[str]:
-    problems: List[str] = []
-    header = re.sub(r"/\*.*?\*/", "", _read(CAPI_HEADER), flags=re.S)
-    wasm_dts = _read(WASM_DTS)
-    node_dts = _read(NODE_DTS)
-    python_text = _read(PYTHON_WORKBOOK)
-
-    for type_name, struct_name in sorted(_STYLE_RECORD_STRUCTS.items()):
-        c_fields = _c_struct_fields(header, struct_name, CAPI_HEADER)
-        # A presence flag is dropped from the comparison, but only once its
-        # governed value field is confirmed present on the C side -- otherwise
-        # renaming the value field would silently retire the flag with it.
-        presence = _STYLE_RECORD_PRESENCE_FLAGS.get(struct_name, {})
-        for flag, value_field in sorted(presence.items()):
-            if flag in c_fields and value_field not in c_fields:
-                problems.append(
-                    f"style-record-fields: {struct_name}.{flag} is exempted as a presence flag for "
-                    f"{value_field!r}, which no longer exists in {CAPI_HEADER.relative_to(REPO_ROOT)}"
-                )
-        stale_flags = sorted(flag for flag in presence if flag not in c_fields)
-        if stale_flags:
-            problems.append(f"style-record-fields: stale presence-flag exemptions for {struct_name}: {stale_flags}")
-        c_fields = [name for name in c_fields if name not in presence]
-        camel_fields = {_snake_to_camel(name) for name in c_fields}
-        for surface, source, dts_text in (
-            ("wasm", WASM_DTS, wasm_dts),
-            ("node", NODE_DTS, node_dts),
-        ):
-            if (surface, type_name) in _STYLE_RECORD_EXEMPT_TYPES:
-                continue
-            ts_fields = set(_TS_FIELD_RE.findall(_find_interface_body(dts_text, type_name, source)))
-            diff = _format_diff(
-                f"{struct_name} in {CAPI_HEADER.relative_to(REPO_ROOT)}",
-                camel_fields - ts_fields,
-                f"{type_name} in {source.relative_to(REPO_ROOT)}",
-                ts_fields - camel_fields,
-            )
-            if diff:
-                problems.append(f"style-record-fields: {surface} {type_name} mismatch:\n" + "\n".join(diff))
-
-        if ("python", type_name) in _STYLE_RECORD_EXEMPT_TYPES:
-            continue
-        py_fields = _python_class_fields(python_text, type_name)
-        if py_fields is None:
-            problems.append(
-                f"style-record-fields: dataclass {type_name!r} not found in {PYTHON_WORKBOOK.relative_to(REPO_ROOT)}"
-            )
-            continue
-        diff = _format_diff(
-            f"{struct_name} in {CAPI_HEADER.relative_to(REPO_ROOT)}",
-            set(c_fields) - py_fields,
-            f"{type_name} in {PYTHON_WORKBOOK.relative_to(REPO_ROOT)}",
-            py_fields - set(c_fields),
-        )
-        if diff:
-            problems.append(f"style-record-fields: python {type_name} mismatch:\n" + "\n".join(diff))
-
-    stale = {
-        (surface, type_name)
-        for surface, type_name in _STYLE_RECORD_EXEMPT_TYPES
-        if type_name not in _STYLE_RECORD_STRUCTS
-    }
-    if stale:
-        problems.append(f"style-record-fields: stale exemption entries: {sorted(stale)}")
-    return problems
-
-
-# ---------------------------------------------------------------------------
-# Check 7: the npm-native package's staged copies <-> their sources.
-#
-# `stage.mjs` publishes `packages/npm-native/dist/` by copying `index.d.ts`
-# and `index.mjs` verbatim out of the package root. Every other check in this
-# file reads the source side only, so an edit that lands in the source but is
-# never re-staged publishes a declaration file that no longer describes the
-# runtime, or an ordinal table that no longer matches the one `dts-enums`
-# verified. The WASM package already guards its own staged `.d.ts`
-# (packages/npm/scripts/check-dts.mjs); npm-native had no equivalent, which
-# matters most for a mechanical rewrite that touches one side of the pair.
-# ---------------------------------------------------------------------------
-
-# (source, staged copy) pairs `stage.mjs` produces with a verbatim copyFile.
-_NODE_STAGED_COPIES = (
-    (NODE_DTS, NODE_DIST_DIR / "index.d.ts"),
-    (NODE_INDEX_MJS, NODE_DIST_DIR / "index.mjs"),
+from binding_drift.python_checks import (
+    check_python_call_signatures,
+    check_python_exports,
+    check_python_inline_structs,
+    check_python_struct_layouts,
 )
-
-
-def check_staged_dist() -> List[str]:
-    problems: List[str] = []
-    for source, staged in _NODE_STAGED_COPIES:
-        if not staged.is_file():
-            # `dist/` is gitignored, so a fresh clone has nothing to compare
-            # until the package is staged. Record that as not-checked instead
-            # of passing: this check exists because a silent pass is
-            # indistinguishable from a real one.
-            _SKIPPED.append(
-                f"staged-dist: {staged.relative_to(REPO_ROOT)} is absent; the npm-native "
-                "package has not been staged in this tree (`make node-package`)"
-            )
-            continue
-        if _read_bytes(source) != _read_bytes(staged):
-            problems.append(
-                f"staged-dist: {staged.relative_to(REPO_ROOT)} differs from "
-                f"{source.relative_to(REPO_ROOT)}; the published copy is stale -- "
-                "re-stage the package with `make node-package`"
-            )
-    return problems
-
-
-def _parse_abi_manifest(path: Path) -> List[str]:
-    """Non-comment, non-blank lines of a baseline / ledger file."""
-    lines = []
-    for raw in _read(path).splitlines():
-        line = raw.strip()
-        if line and not line.startswith("#"):
-            lines.append(line)
-    return lines
-
-
-_ABI_BREAK_RE = re.compile(r"^(removed|signature|retyped)\s+(fm_[A-Za-z0-9_]+)\s*::\s*(\S.*)$")
-_ABI_BASELINE_RE = re.compile(r"^(.+?)\s+(fm_[A-Za-z0-9_]+)\((.*)\)$")
-
-
-def check_abi_baseline() -> List[str]:
-    """The released C ABI surface is still declared, or its loss is recorded.
-
-    A deletion or rename of a base entry point is invisible to every other
-    check here: five of the eight base/`_ex` families have no in-repo caller
-    at all, so the C API tests recompile against the new header and pass. The
-    only party that notices is a third-party consumer compiled against the
-    released header, which no test can stand in for -- hence a pinned copy of
-    that header's surface plus an explicit ledger of what was broken on
-    purpose.
-
-    Signature comparison is by declared parameter *type*, so it catches an
-    added, dropped or retyped parameter. It does NOT catch a by-value struct
-    that keeps its name and changes size; that is a calling convention change
-    the `static_assert(sizeof(...))` tripwires in the C ABI tests pin instead.
-    """
-    problems: List[str] = []
-
-    baseline: dict[str, tuple[str, List[str]]] = {}
-    for line in _parse_abi_manifest(C_ABI_BASELINE):
-        match = _ABI_BASELINE_RE.match(line)
-        if match is None:
-            problems.append(f"abi-baseline: unparsable baseline line: {line!r}")
-            continue
-        ret, name, params = match.groups()
-        parsed = [] if params.strip() in ("", "void") else [p.strip() for p in params.split(",")]
-        baseline[name] = (ret.strip(), parsed)
-
-    ledger: dict[str, str] = {}
-    for line in _parse_abi_manifest(C_ABI_BREAKS):
-        match = _ABI_BREAK_RE.match(line)
-        if match is None:
-            problems.append(f"abi-baseline: unparsable ledger line: {line!r}")
-            continue
-        kind, name, _reason = match.groups()
-        if name in ledger:
-            problems.append(f"abi-baseline: {name} is listed twice in {C_ABI_BREAKS.name}")
-        ledger[name] = kind
-
-    current = c_abi_declarations(_read(CAPI_HEADER))
-
-    for name, declared in sorted(baseline.items()):
-        recorded = ledger.get(name)
-        if name not in current:
-            if recorded != "removed":
-                problems.append(
-                    f"abi-baseline: {name} shipped in the released header but is gone from "
-                    f"{CAPI_HEADER.relative_to(REPO_ROOT)}. A consumer built against the release "
-                    f"loses it at link time. Record the break as `removed {name} :: <reason>` in "
-                    f"{C_ABI_BREAKS.relative_to(REPO_ROOT)} and carry it into the CHANGELOG's "
-                    "Removed section, or restore the entry point."
-                )
-            continue
-        if current[name] != declared:
-            if recorded not in ("signature", "retyped"):
-                problems.append(
-                    f"abi-baseline: {name} changed signature since the release.\n"
-                    f"  released: {declared[0]} {name}({', '.join(declared[1]) or 'void'})\n"
-                    f"  current:  {current[name][0]} {name}({', '.join(current[name][1]) or 'void'})\n"
-                    f"  Record it in {C_ABI_BREAKS.relative_to(REPO_ROOT)} as `signature` (breaks a "
-                    "stale caller) or `retyped` (invisible to a C caller and to the calling "
-                    "convention), with the reason."
-                )
-            continue
-        # Declared and unchanged: any ledger entry naming it is stale.
-        if recorded is not None:
-            problems.append(
-                f"abi-baseline: {C_ABI_BREAKS.relative_to(REPO_ROOT)} records {name} as "
-                f"`{recorded}`, but it is declared unchanged from the release. Drop the line -- a "
-                "ledger that outlives its break stops meaning anything."
-            )
-
-    for name in sorted(set(ledger) - set(baseline)):
-        problems.append(
-            f"abi-baseline: {C_ABI_BREAKS.relative_to(REPO_ROOT)} records {name}, which was never "
-            f"in the released surface. Only an entry point a consumer could have compiled against "
-            "can be broken; drop the line."
-        )
-
-    return problems
-
-
-# A doc comment quotes a status code as `` `kName` (N) ``, and the number may
-# wrap onto the next comment line, so the separator spans a `*` continuation
-# marker as well as plain spaces.
-_HEADER_ERROR_CODE_RE = re.compile(r"`?(k[A-Z][A-Za-z0-9_]*)`?(?:[ \t]|\n[ \t]*\*)*\((\d+)\)")
-
-
-def _cpp_enum_class_values(text: str, enum_name: str) -> Optional[dict[str, int]]:
-    """Parses a scoped enum into a name -> value map.
-
-    The value-only sibling `_extract_cpp_enum_class` compares ordinal
-    sequences; this one is for the checks that need to look a member up by
-    name. Implicit members take one more than the previous value, as in C++.
-    Returns `None` when the enum is absent or a member's initializer is not a
-    literal integer, so the caller reports the parse failure rather than a
-    false drift.
-    """
-    raw_body = _cpp_enum_class_body(text, enum_name)
-    if raw_body is None:
-        return None
-    values: dict[str, int] = {}
-    next_value = 0
-    for part in _ENUM_BODY_COMMENT_RE.sub("", raw_body).split(","):
-        part = part.strip()
-        if not part:
-            continue
-        member = _ENUM_MEMBER_RE.match(part)
-        if not member:
-            return None
-        literal = member.group(2)
-        if literal is not None:
-            next_value = int(literal, 0)
-        values[member.group(1)] = next_value
-        next_value += 1
-    return values
-
-
-def check_header_error_codes() -> List[str]:
-    """Every numeric status code quoted in the C header matches its enumerator.
-
-    `fm_status_t` is a bare `int32_t`, so the numbers the header's doc
-    comments print next to an enumerator name are the whole contract a
-    binding author reading only the header can act on. A comparison written
-    against a stale number never matches, and mis-classifies whatever code
-    actually holds that value.
-    """
-    problems: List[str] = []
-
-    codes = _cpp_enum_class_values(_read(ERROR_H), "FormulonErrorCode")
-    if codes is None:
-        return [
-            f"header-error-codes: could not parse `FormulonErrorCode` out of {ERROR_H.relative_to(REPO_ROOT)}; "
-            "the enum moved or gained a non-literal initializer"
-        ]
-
-    header = _read(CAPI_HEADER)
-    for match in _HEADER_ERROR_CODE_RE.finditer(header):
-        name, quoted = match.group(1), match.group(2)
-        line_number = header.count("\n", 0, match.start()) + 1
-        site = f"{CAPI_HEADER.name}:{line_number}"
-        if name not in codes:
-            problems.append(
-                f"header-error-codes: {site} documents `{name}` ({quoted}), which names no enumerator of "
-                f"`FormulonErrorCode` in {ERROR_H.relative_to(REPO_ROOT)}"
-            )
-            continue
-        if int(quoted) != codes[name]:
-            problems.append(
-                f"header-error-codes: {site} documents `{name}` as ({quoted}), but "
-                f"{ERROR_H.relative_to(REPO_ROOT)} defines it as {codes[name]}"
-            )
-
-    return problems
-
+from binding_drift.shape_checks import check_dts_shared_shapes, check_style_record_fields
+from binding_drift.surface_files import _SKIPPED
 
 CHECKS = {
     "python-exports": check_python_exports,
diff --git a/tools/dev/coverage_report.py b/tools/dev/coverage_report.py
index bc7bee0fa..ec4f73ade 100755
--- a/tools/dev/coverage_report.py
+++ b/tools/dev/coverage_report.py
@@ -26,6 +26,7 @@
                   ``src/eval/conditional_aggregates.{h,cpp}``,
                   ``src/eval/special_forms_lazy.{h,cpp}``,
                   ``src/eval/criteria.{h,cpp}``,
+                  ``src/eval/wildcard.{h,cpp}``,
                   ``src/eval/text_ops.{h,cpp}``,
                   ``src/eval/date_time.{h,cpp}``,
                   ``src/eval/coerce.{h,cpp}``,
@@ -78,6 +79,8 @@
             "src/eval/special_forms_lazy.cpp",
             "src/eval/criteria.h",
             "src/eval/criteria.cpp",
+            "src/eval/wildcard.h",
+            "src/eval/wildcard.cpp",
             "src/utils/text_ops.h",
             "src/utils/text_ops.cpp",
             "src/utils/date_time.h",
diff --git a/tools/dev/run_mutation.sh b/tools/dev/run_mutation.sh
index 569156a9a..dd6e04ace 100755
--- a/tools/dev/run_mutation.sh
+++ b/tools/dev/run_mutation.sh
@@ -39,6 +39,7 @@
 #                           --include-path=<glob> flag for mull.
 #                           Default: src/eval/coerce.cpp,
 #                                    src/eval/criteria.cpp,
+#                                    src/eval/wildcard.cpp,
 #                                    src/eval/text_ops.cpp
 #   MULL_RUNNER             Mull runner binary (default: mull-runner-cxx)
 #   CMAKE                   cmake binary (default: cmake)
@@ -59,7 +60,7 @@ BUILD_DIR="${FORMULON_MUT_BUILD_DIR:-build-mutation}"
 TIMEOUT_SEC="${FORMULON_MUT_TIMEOUT:-120}"
 STRICT_FLAG="${FORMULON_MUT_STRICT:-}"
 TARGET_BIN="${FORMULON_MUT_TARGET:-formulon_unit_tests}"
-FILTER_RAW="${FORMULON_MUT_FILTER:-src/eval/coerce.cpp,src/eval/criteria.cpp,src/eval/text_ops.cpp}"
+FILTER_RAW="${FORMULON_MUT_FILTER:-src/eval/coerce.cpp,src/eval/criteria.cpp,src/eval/wildcard.cpp,src/eval/text_ops.cpp}"
 MULL_RUNNER="${MULL_RUNNER:-mull-runner-cxx}"
 CMAKE="${CMAKE:-cmake}"
 CTEST="${CTEST:-ctest}"
diff --git a/tools/oracle/README.md b/tools/oracle/README.md
index e04674dee..696eea659 100644
--- a/tools/oracle/README.md
+++ b/tools/oracle/README.md
@@ -426,6 +426,9 @@ spill and are capped at `case_schema.MAX_SHAPE_SAMPLES`.
 tools/oracle/
 ├── targets.yaml                 declarative target manifest
 ├── cli.py                       cross-platform dispatcher (list / setup / gen)
+├── targets_manifest.py          targets.yaml loader + host label (used by cli.py)
+├── preflight.py                 per-target host checks behind `cli.py setup`
+├── contribute.py                contributor flow behind `cli.py contribute`
 ├── oracle_gen.py                core generator (loads cases, calls driver, writes JSON)
 ├── case_schema.py               YAML loader + validator
 ├── driver.py                    backward-compat re-export shim
@@ -433,6 +436,11 @@ tools/oracle/
     ├── base.py                  OracleDriver ABC + CaseResult / EnvironmentInfo
     ├── macos_excel.py           Mac driver (xlwings via AppleEvents)
     ├── windows_excel.py         Windows driver (xlwings via COM) + wire entrypoint
+    ├── cell_result.py           xlwings cell / spill observation -> CaseResult (both drivers)
+    ├── case_sheet.py            sheet naming, merges, error triggers, print-block helpers (both drivers)
+    ├── windows_com.py           COM primitives: displayed text, raw-cell adapter, error text
+    ├── windows_pivot.py         PivotTable build, grid readout, formula probes
+    ├── windows_page_setup.py    PageSetup readers and the print round-trip read
     ├── wsl_bridge.py            WSL2 wrapper that subprocess-invokes windows_excel
     └── __init__.py              select_driver(target) factory
 ```
diff --git a/tools/oracle/cf_oracle_gen.py b/tools/oracle/cf_oracle_gen.py
index 0642dc5c5..0dddfc93f 100644
--- a/tools/oracle/cf_oracle_gen.py
+++ b/tools/oracle/cf_oracle_gen.py
@@ -74,6 +74,15 @@
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
+try:  # pragma: no cover - trivial fallback
+    from tools.oracle.cf_visual_semantics import _ICON_SET_FORMULON_TO_OOXML, _cell_in_block, _compute_visual_matches
+except ImportError:  # pragma: no cover
+    from cf_visual_semantics import (  # type: ignore
+        _ICON_SET_FORMULON_TO_OOXML,
+        _cell_in_block,
+        _compute_visual_matches,
+    )
+
 REPO_ROOT = Path(__file__).resolve().parents[2]
 DEFAULT_CASES_DIR = REPO_ROOT / "tests" / "oracle" / "cases_cf"
 DEFAULT_GOLDEN_DIR = REPO_ROOT / "tests" / "oracle" / "golden_cf"
@@ -260,38 +269,6 @@ def _hex6(rgb: Tuple[int, int, int]) -> str:
     return f"{rgb[0]:02X}{rgb[1]:02X}{rgb[2]:02X}"
 
 
-# OOXML icon-set tag <-> Formulon `IconSetName` enum string. The OOXML
-# attribute (`<iconSet iconSet="3Arrows">`) is what openpyxl emits and
-# what Excel reads; the second column is the name the Formulon CF
-# evaluator emits in `IconRender::set_name`. Mirrors src/cf/cf_types.h
-# and src/io/cf_reader.cpp.
-_ICON_SET_OOXML_TO_FORMULON: Dict[str, str] = {
-    "3Arrows": "Three_Arrows",
-    "3ArrowsGray": "Three_ArrowsGray",
-    "3Flags": "Three_Flags",
-    "3TrafficLights1": "Three_TrafficLights1",
-    "3TrafficLights2": "Three_TrafficLights2",
-    "3Signs": "Three_Signs",
-    "3Symbols": "Three_Symbols",
-    "3Symbols2": "Three_Symbols2",
-    "4Arrows": "Four_Arrows",
-    "4ArrowsGray": "Four_ArrowsGray",
-    "4RedToBlack": "Four_RedToBlack",
-    "4Rating": "Four_Rating",
-    "4TrafficLights": "Four_TrafficLights",
-    "5Arrows": "Five_Arrows",
-    "5ArrowsGray": "Five_ArrowsGray",
-    "5Rating": "Five_Rating",
-    "5Quarters": "Five_Quarters",
-}
-
-_ICON_SET_FORMULON_TO_OOXML: Dict[str, str] = {v: k for k, v in _ICON_SET_OOXML_TO_FORMULON.items()}
-
-# Number of buckets for an icon set, keyed by the OOXML tag's leading
-# digit. Used to bound the per-cell icon index after walking thresholds.
-_ICON_SET_BUCKET_COUNT: Dict[str, int] = {tag: int(tag[0]) for tag in _ICON_SET_OOXML_TO_FORMULON}
-
-
 def _channel_close(actual: List[int], expected: Tuple[int, int, int], tol: int = 2) -> bool:
     if len(actual) < 3:
         return False
@@ -725,206 +702,6 @@ def _build_workbook(case: Dict[str, Any], path: Path) -> List[Dict[str, Any]]:
     return descriptors
 
 
-def _cell_in_block(row: int, col: int, sqref: List[Dict[str, int]]) -> bool:
-    for r in sqref:
-        if r["first_row"] <= row <= r["last_row"] and r["first_col"] <= col <= r["last_col"]:
-            return True
-    return False
-
-
-def _numeric_population(case: Dict[str, Any], sqref: List[Dict[str, int]]) -> List[float]:
-    """Returns the sorted ascending list of numeric cell values inside
-    `sqref` for the given `case`. Mirrors the C++ evaluator's
-    `collect_numeric_values` helper: booleans, text, and errors are
-    skipped; only `kind == "number"` cells contribute. Cells outside
-    `sqref` are ignored; cells in `sqref` that are absent from the
-    `sheet` array are treated as blank (and skipped).
-    """
-    values: List[float] = []
-    for entry in case["sheet"]:
-        if entry.get("kind") != "number":
-            continue
-        if not _cell_in_block(int(entry["row"]), int(entry["col"]), sqref):
-            continue
-        values.append(float(entry["value"]))
-    values.sort()
-    return values
-
-
-def _resolve_threshold_value(
-    threshold_type: str,
-    threshold_value: Optional[Any],
-    population: List[float],
-) -> Optional[float]:
-    """Resolves a single CFVO to its numeric threshold. Mirrors
-    `cf_evaluator.cpp::resolve_cfvo` for the threshold types the
-    generator currently emits (Number / Percent / Percentile / Min /
-    Max). Returns `None` when the population is empty and the
-    threshold needs it (Min / Max / Percent / Percentile).
-    """
-    if threshold_type == "Number":
-        return float(threshold_value) if threshold_value is not None else None
-    if not population:
-        return None
-    pop_min = population[0]
-    pop_max = population[-1]
-    if threshold_type == "Min":
-        return pop_min
-    if threshold_type == "Max":
-        return pop_max
-    if threshold_type == "Percent":
-        if threshold_value is None:
-            return None
-        pct = float(threshold_value)
-        return pop_min + (pct / 100.0) * (pop_max - pop_min)
-    if threshold_type == "Percentile":
-        if threshold_value is None:
-            return None
-        pct = float(threshold_value) / 100.0
-        count = len(population)
-        if count == 1:
-            return population[0]
-        position = pct * (count - 1)
-        lower_index = int(position)
-        if lower_index + 1 >= count:
-            return population[-1]
-        fraction = position - lower_index
-        return population[lower_index] + fraction * (population[lower_index + 1] - population[lower_index])
-    return None
-
-
-def _data_bar_match_for_cell(
-    cell_value: Optional[float],
-    desc: Dict[str, Any],
-    population: List[float],
-) -> Optional[Dict[str, Any]]:
-    """Computes the DataBar match payload for a numeric cell value
-    using the documented Microsoft VBA semantics:
-    https://learn.microsoft.com/en-us/office/vba/api/excel.databar
-    Bar length is the linear fraction `(value - min) / (max - min)`,
-    clamped to [0, 1], scaled into [min_length_pct, max_length_pct].
-    Negative values are not handled by these smoke cases (see
-    README.md "Not yet captured"); `bar_axis_position_pct` is fixed at
-    0 and `is_negative` at false.
-    """
-    if cell_value is None:
-        return None
-    db = desc["data_bar"]
-    threshold_min = _resolve_threshold_value(db["min_type"], db["min_value"], population)
-    threshold_max = _resolve_threshold_value(db["max_type"], db["max_value"], population)
-    if threshold_min is None or threshold_max is None:
-        return None
-    if threshold_max == threshold_min:
-        return None
-    min_len = float(db["min_length_pct"])
-    max_len = float(db["max_length_pct"])
-    fraction = (cell_value - threshold_min) / (threshold_max - threshold_min)
-    fraction = max(0.0, min(1.0, fraction))
-    bar_length = min_len + fraction * (max_len - min_len)
-    fill = db["fill"]
-    return {
-        "kind": "DataBar",
-        "priority": desc["priority"],
-        "bar_length_pct": bar_length,
-        "bar_axis_position_pct": 0.0,
-        "is_negative": False,
-        "fill": {
-            "r": int(fill["r"]),
-            "g": int(fill["g"]),
-            "b": int(fill["b"]),
-            "a": int(fill.get("a", 255)),
-        },
-    }
-
-
-def _icon_set_match_for_cell(
-    cell_value: Optional[float],
-    desc: Dict[str, Any],
-    population: List[float],
-) -> Optional[Dict[str, Any]]:
-    """Computes the IconSet match payload for a numeric cell value
-    using the documented Microsoft VBA semantics:
-    https://learn.microsoft.com/en-us/office/vba/api/excel.iconsetcondition
-    Walks thresholds in ascending order, bumping the bucket index for
-    each one the cell value crosses (`>=` if `gte`; `>` otherwise).
-    Applies `reverse` last by mirroring the index across the bucket
-    range.
-    """
-    if cell_value is None:
-        return None
-    spec = desc["icon_set"]
-    resolved: List[Optional[float]] = []
-    for t in spec["thresholds"]:
-        resolved.append(_resolve_threshold_value(t["type"], t["value"], population))
-    if any(value is None for value in resolved):
-        return None
-    icon_index = 0
-    for i, threshold in enumerate(resolved):
-        gte = bool(spec["thresholds"][i]["gte"])
-        if (cell_value >= threshold) if gte else (cell_value > threshold):
-            icon_index = i + 1
-    bucket_count = _ICON_SET_BUCKET_COUNT.get(spec["name_ooxml"], len(resolved) + 1)
-    if spec["reverse"]:
-        icon_index = bucket_count - 1 - icon_index
-    return {
-        "kind": "IconSet",
-        "priority": desc["priority"],
-        "icon_set_name": spec["name_formulon"],
-        "icon_index": icon_index,
-    }
-
-
-def _cell_value_for(case: Dict[str, Any], row: int, col: int) -> Optional[float]:
-    """Returns the numeric value of `(row, col)` in `case['sheet']`, or
-    `None` when the cell is blank, non-numeric, or absent.
-    """
-    for entry in case["sheet"]:
-        if int(entry["row"]) == row and int(entry["col"]) == col:
-            if entry.get("kind") == "number":
-                return float(entry["value"])
-            return None
-    return None
-
-
-def _compute_visual_matches(
-    case: Dict[str, Any], descriptors: List[Dict[str, Any]]
-) -> Dict[Tuple[int, int], List[Dict[str, Any]]]:
-    """Computes per-cell DataBar / IconSet matches for every descriptor
-    that carries the corresponding payload. Returns a row/col-keyed map
-    of match-dict lists; cells with no visual rule applied are absent.
-
-    Excel does not expose these match shapes through DisplayFormat, so
-    the generator computes them from documented semantics. Every cell
-    inside the rule's sqref produces a match (visual rules apply to
-    every cell in their range — there is no boolean "fired or not"
-    decision the way DifferentialFormat-bearing rules have).
-    """
-    out: Dict[Tuple[int, int], List[Dict[str, Any]]] = {}
-    rng = case["range"]
-    r1 = int(rng["first_row"])
-    c1 = int(rng["first_col"])
-    r2 = int(rng["last_row"])
-    c2 = int(rng["last_col"])
-    sorted_descriptors = sorted(descriptors, key=lambda d: d["priority"])
-    for desc in sorted_descriptors:
-        if desc["type"] not in ("DataBar", "IconSet"):
-            continue
-        population = _numeric_population(case, desc["sqref"])
-        for r in range(r1, r2 + 1):
-            for c in range(c1, c2 + 1):
-                if not _cell_in_block(r, c, desc["sqref"]):
-                    continue
-                cell_val = _cell_value_for(case, r, c)
-                if desc["type"] == "DataBar":
-                    match = _data_bar_match_for_cell(cell_val, desc, population)
-                else:
-                    match = _icon_set_match_for_cell(cell_val, desc, population)
-                if match is None:
-                    continue
-                out.setdefault((r, c), []).append(match)
-    return out
-
-
 def _resolve_color_list(value: Any) -> Optional[List[int]]:
     """Resolves an appscript-color reference to ``[r, g, b]`` or returns
     ``None`` if the reference cannot be coerced.
diff --git a/tools/oracle/cf_visual_semantics.py b/tools/oracle/cf_visual_semantics.py
new file mode 100644
index 000000000..db049beb9
--- /dev/null
+++ b/tools/oracle/cf_visual_semantics.py
@@ -0,0 +1,241 @@
+"""Documented-semantics match payloads for DataBar and IconSet rules.
+
+Excel does not expose these shapes through DisplayFormat, so the oracle
+generator computes them from the Microsoft VBA object-model semantics.
+Pure functions over the case JSON; no Excel or openpyxl needed.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional, Tuple
+
+# OOXML icon-set tag <-> Formulon `IconSetName` enum string. The OOXML
+# attribute (`<iconSet iconSet="3Arrows">`) is what openpyxl emits and
+# what Excel reads; the second column is the name the Formulon CF
+# evaluator emits in `IconRender::set_name`. Mirrors src/cf/cf_types.h
+# and src/io/cf_reader.cpp.
+_ICON_SET_OOXML_TO_FORMULON: Dict[str, str] = {
+    "3Arrows": "Three_Arrows",
+    "3ArrowsGray": "Three_ArrowsGray",
+    "3Flags": "Three_Flags",
+    "3TrafficLights1": "Three_TrafficLights1",
+    "3TrafficLights2": "Three_TrafficLights2",
+    "3Signs": "Three_Signs",
+    "3Symbols": "Three_Symbols",
+    "3Symbols2": "Three_Symbols2",
+    "4Arrows": "Four_Arrows",
+    "4ArrowsGray": "Four_ArrowsGray",
+    "4RedToBlack": "Four_RedToBlack",
+    "4Rating": "Four_Rating",
+    "4TrafficLights": "Four_TrafficLights",
+    "5Arrows": "Five_Arrows",
+    "5ArrowsGray": "Five_ArrowsGray",
+    "5Rating": "Five_Rating",
+    "5Quarters": "Five_Quarters",
+}
+
+_ICON_SET_FORMULON_TO_OOXML: Dict[str, str] = {v: k for k, v in _ICON_SET_OOXML_TO_FORMULON.items()}
+
+# Number of buckets for an icon set, keyed by the OOXML tag's leading
+# digit. Used to bound the per-cell icon index after walking thresholds.
+_ICON_SET_BUCKET_COUNT: Dict[str, int] = {tag: int(tag[0]) for tag in _ICON_SET_OOXML_TO_FORMULON}
+
+
+def _cell_in_block(row: int, col: int, sqref: List[Dict[str, int]]) -> bool:
+    for r in sqref:
+        if r["first_row"] <= row <= r["last_row"] and r["first_col"] <= col <= r["last_col"]:
+            return True
+    return False
+
+
+def _numeric_population(case: Dict[str, Any], sqref: List[Dict[str, int]]) -> List[float]:
+    """Returns the sorted ascending list of numeric cell values inside
+    `sqref` for the given `case`. Mirrors the C++ evaluator's
+    `collect_numeric_values` helper: booleans, text, and errors are
+    skipped; only `kind == "number"` cells contribute. Cells outside
+    `sqref` are ignored; cells in `sqref` that are absent from the
+    `sheet` array are treated as blank (and skipped).
+    """
+    values: List[float] = []
+    for entry in case["sheet"]:
+        if entry.get("kind") != "number":
+            continue
+        if not _cell_in_block(int(entry["row"]), int(entry["col"]), sqref):
+            continue
+        values.append(float(entry["value"]))
+    values.sort()
+    return values
+
+
+def _resolve_threshold_value(
+    threshold_type: str,
+    threshold_value: Optional[Any],
+    population: List[float],
+) -> Optional[float]:
+    """Resolves a single CFVO to its numeric threshold. Mirrors
+    `cf_evaluator.cpp::resolve_cfvo` for the threshold types the
+    generator currently emits (Number / Percent / Percentile / Min /
+    Max). Returns `None` when the population is empty and the
+    threshold needs it (Min / Max / Percent / Percentile).
+    """
+    if threshold_type == "Number":
+        return float(threshold_value) if threshold_value is not None else None
+    if not population:
+        return None
+    pop_min = population[0]
+    pop_max = population[-1]
+    if threshold_type == "Min":
+        return pop_min
+    if threshold_type == "Max":
+        return pop_max
+    if threshold_type == "Percent":
+        if threshold_value is None:
+            return None
+        pct = float(threshold_value)
+        return pop_min + (pct / 100.0) * (pop_max - pop_min)
+    if threshold_type == "Percentile":
+        if threshold_value is None:
+            return None
+        pct = float(threshold_value) / 100.0
+        count = len(population)
+        if count == 1:
+            return population[0]
+        position = pct * (count - 1)
+        lower_index = int(position)
+        if lower_index + 1 >= count:
+            return population[-1]
+        fraction = position - lower_index
+        return population[lower_index] + fraction * (population[lower_index + 1] - population[lower_index])
+    return None
+
+
+def _data_bar_match_for_cell(
+    cell_value: Optional[float],
+    desc: Dict[str, Any],
+    population: List[float],
+) -> Optional[Dict[str, Any]]:
+    """Computes the DataBar match payload for a numeric cell value
+    using the documented Microsoft VBA semantics:
+    https://learn.microsoft.com/en-us/office/vba/api/excel.databar
+    Bar length is the linear fraction `(value - min) / (max - min)`,
+    clamped to [0, 1], scaled into [min_length_pct, max_length_pct].
+    Negative values are not handled by these smoke cases (see
+    README.md "Not yet captured"); `bar_axis_position_pct` is fixed at
+    0 and `is_negative` at false.
+    """
+    if cell_value is None:
+        return None
+    db = desc["data_bar"]
+    threshold_min = _resolve_threshold_value(db["min_type"], db["min_value"], population)
+    threshold_max = _resolve_threshold_value(db["max_type"], db["max_value"], population)
+    if threshold_min is None or threshold_max is None:
+        return None
+    if threshold_max == threshold_min:
+        return None
+    min_len = float(db["min_length_pct"])
+    max_len = float(db["max_length_pct"])
+    fraction = (cell_value - threshold_min) / (threshold_max - threshold_min)
+    fraction = max(0.0, min(1.0, fraction))
+    bar_length = min_len + fraction * (max_len - min_len)
+    fill = db["fill"]
+    return {
+        "kind": "DataBar",
+        "priority": desc["priority"],
+        "bar_length_pct": bar_length,
+        "bar_axis_position_pct": 0.0,
+        "is_negative": False,
+        "fill": {
+            "r": int(fill["r"]),
+            "g": int(fill["g"]),
+            "b": int(fill["b"]),
+            "a": int(fill.get("a", 255)),
+        },
+    }
+
+
+def _icon_set_match_for_cell(
+    cell_value: Optional[float],
+    desc: Dict[str, Any],
+    population: List[float],
+) -> Optional[Dict[str, Any]]:
+    """Computes the IconSet match payload for a numeric cell value
+    using the documented Microsoft VBA semantics:
+    https://learn.microsoft.com/en-us/office/vba/api/excel.iconsetcondition
+    Walks thresholds in ascending order, bumping the bucket index for
+    each one the cell value crosses (`>=` if `gte`; `>` otherwise).
+    Applies `reverse` last by mirroring the index across the bucket
+    range.
+    """
+    if cell_value is None:
+        return None
+    spec = desc["icon_set"]
+    resolved: List[Optional[float]] = []
+    for t in spec["thresholds"]:
+        resolved.append(_resolve_threshold_value(t["type"], t["value"], population))
+    if any(value is None for value in resolved):
+        return None
+    icon_index = 0
+    for i, threshold in enumerate(resolved):
+        gte = bool(spec["thresholds"][i]["gte"])
+        if (cell_value >= threshold) if gte else (cell_value > threshold):
+            icon_index = i + 1
+    bucket_count = _ICON_SET_BUCKET_COUNT.get(spec["name_ooxml"], len(resolved) + 1)
+    if spec["reverse"]:
+        icon_index = bucket_count - 1 - icon_index
+    return {
+        "kind": "IconSet",
+        "priority": desc["priority"],
+        "icon_set_name": spec["name_formulon"],
+        "icon_index": icon_index,
+    }
+
+
+def _cell_value_for(case: Dict[str, Any], row: int, col: int) -> Optional[float]:
+    """Returns the numeric value of `(row, col)` in `case['sheet']`, or
+    `None` when the cell is blank, non-numeric, or absent.
+    """
+    for entry in case["sheet"]:
+        if int(entry["row"]) == row and int(entry["col"]) == col:
+            if entry.get("kind") == "number":
+                return float(entry["value"])
+            return None
+    return None
+
+
+def _compute_visual_matches(
+    case: Dict[str, Any], descriptors: List[Dict[str, Any]]
+) -> Dict[Tuple[int, int], List[Dict[str, Any]]]:
+    """Computes per-cell DataBar / IconSet matches for every descriptor
+    that carries the corresponding payload. Returns a row/col-keyed map
+    of match-dict lists; cells with no visual rule applied are absent.
+
+    Excel does not expose these match shapes through DisplayFormat, so
+    the generator computes them from documented semantics. Every cell
+    inside the rule's sqref produces a match (visual rules apply to
+    every cell in their range — there is no boolean "fired or not"
+    decision the way DifferentialFormat-bearing rules have).
+    """
+    out: Dict[Tuple[int, int], List[Dict[str, Any]]] = {}
+    rng = case["range"]
+    r1 = int(rng["first_row"])
+    c1 = int(rng["first_col"])
+    r2 = int(rng["last_row"])
+    c2 = int(rng["last_col"])
+    sorted_descriptors = sorted(descriptors, key=lambda d: d["priority"])
+    for desc in sorted_descriptors:
+        if desc["type"] not in ("DataBar", "IconSet"):
+            continue
+        population = _numeric_population(case, desc["sqref"])
+        for r in range(r1, r2 + 1):
+            for c in range(c1, c2 + 1):
+                if not _cell_in_block(r, c, desc["sqref"]):
+                    continue
+                cell_val = _cell_value_for(case, r, c)
+                if desc["type"] == "DataBar":
+                    match = _data_bar_match_for_cell(cell_val, desc, population)
+                else:
+                    match = _icon_set_match_for_cell(cell_val, desc, population)
+                if match is None:
+                    continue
+                out.setdefault((r, c), []).append(match)
+    return out
diff --git a/tools/oracle/cf_visual_semantics_test.py b/tools/oracle/cf_visual_semantics_test.py
new file mode 100644
index 000000000..6bbda4c14
--- /dev/null
+++ b/tools/oracle/cf_visual_semantics_test.py
@@ -0,0 +1,224 @@
+#!/usr/bin/env python3
+"""Unit tests for the DataBar / IconSet documented-semantics computation."""
+
+from __future__ import annotations
+
+import unittest
+
+from tools.oracle import cf_visual_semantics as sem
+
+SQREF = [{"first_row": 1, "first_col": 1, "last_row": 5, "last_col": 1}]
+
+
+def _case(values: list[object]) -> dict:
+    """A one-column sheet; `None` leaves the row absent, strings become text cells."""
+
+    sheet = []
+    for i, v in enumerate(values, start=1):
+        if v is None:
+            continue
+        if isinstance(v, str):
+            sheet.append({"row": i, "col": 1, "kind": "text", "value": v})
+        elif isinstance(v, bool):
+            sheet.append({"row": i, "col": 1, "kind": "bool", "value": v})
+        else:
+            sheet.append({"row": i, "col": 1, "kind": "number", "value": v})
+    return {
+        "sheet": sheet,
+        "range": {"first_row": 1, "first_col": 1, "last_row": len(values), "last_col": 1},
+    }
+
+
+def _data_bar(min_type="Min", min_value=None, max_type="Max", max_value=None, **extra) -> dict:
+    return {
+        "type": "DataBar",
+        "priority": extra.pop("priority", 1),
+        "sqref": extra.pop("sqref", SQREF),
+        "data_bar": {
+            "min_type": min_type,
+            "min_value": min_value,
+            "max_type": max_type,
+            "max_value": max_value,
+            "min_length_pct": extra.pop("min_length_pct", 10),
+            "max_length_pct": extra.pop("max_length_pct", 90),
+            "fill": extra.pop("fill", {"r": 1, "g": 2, "b": 3}),
+        },
+    }
+
+
+def _icon_set(thresholds, name_ooxml="3Arrows", reverse=False, priority=1) -> dict:
+    return {
+        "type": "IconSet",
+        "priority": priority,
+        "sqref": SQREF,
+        "icon_set": {
+            "name_ooxml": name_ooxml,
+            "name_formulon": "Three_Arrows",
+            "reverse": reverse,
+            "thresholds": [{"type": t, "value": v, "gte": g} for t, v, g in thresholds],
+        },
+    }
+
+
+class CellInBlockTest(unittest.TestCase):
+    def test_bounds_are_inclusive(self):
+        self.assertTrue(sem._cell_in_block(1, 1, SQREF))
+        self.assertTrue(sem._cell_in_block(5, 1, SQREF))
+        self.assertFalse(sem._cell_in_block(6, 1, SQREF))
+        self.assertFalse(sem._cell_in_block(1, 2, SQREF))
+
+    def test_any_block_matches(self):
+        blocks = SQREF + [{"first_row": 10, "first_col": 3, "last_row": 10, "last_col": 3}]
+        self.assertTrue(sem._cell_in_block(10, 3, blocks))
+        self.assertFalse(sem._cell_in_block(10, 1, blocks))
+
+
+class PopulationTest(unittest.TestCase):
+    def test_sorted_numbers_only(self):
+        case = _case([5, "x", 1.5, True, 3])
+        self.assertEqual(sem._numeric_population(case, SQREF), [1.5, 3.0, 5.0])
+
+    def test_cells_outside_block_ignored(self):
+        case = _case([1, 2, 3, 4, 5])
+        block = [{"first_row": 2, "first_col": 1, "last_row": 3, "last_col": 1}]
+        self.assertEqual(sem._numeric_population(case, block), [2.0, 3.0])
+
+    def test_cell_value_for(self):
+        case = _case([7, "x", None])
+        self.assertEqual(sem._cell_value_for(case, 1, 1), 7.0)
+        self.assertIsNone(sem._cell_value_for(case, 2, 1))
+        self.assertIsNone(sem._cell_value_for(case, 3, 1))
+        self.assertIsNone(sem._cell_value_for(case, 9, 9))
+
+
+class ThresholdTest(unittest.TestCase):
+    POP = [0.0, 10.0, 20.0, 40.0]
+
+    def test_number_ignores_population(self):
+        self.assertEqual(sem._resolve_threshold_value("Number", 7, []), 7.0)
+        self.assertIsNone(sem._resolve_threshold_value("Number", None, self.POP))
+
+    def test_empty_population_needs_none(self):
+        for kind in ("Min", "Max", "Percent", "Percentile"):
+            self.assertIsNone(sem._resolve_threshold_value(kind, 50, []))
+
+    def test_min_max(self):
+        self.assertEqual(sem._resolve_threshold_value("Min", None, self.POP), 0.0)
+        self.assertEqual(sem._resolve_threshold_value("Max", None, self.POP), 40.0)
+
+    def test_percent_is_linear_between_extremes(self):
+        self.assertEqual(sem._resolve_threshold_value("Percent", 25, self.POP), 10.0)
+        self.assertIsNone(sem._resolve_threshold_value("Percent", None, self.POP))
+
+    def test_percentile_interpolates_between_ranks(self):
+        # position = 0.5 * 3 = 1.5 -> halfway between 10 and 20
+        self.assertEqual(sem._resolve_threshold_value("Percentile", 50, self.POP), 15.0)
+        self.assertEqual(sem._resolve_threshold_value("Percentile", 100, self.POP), 40.0)
+        self.assertEqual(sem._resolve_threshold_value("Percentile", 0, self.POP), 0.0)
+        self.assertEqual(sem._resolve_threshold_value("Percentile", 50, [3.0]), 3.0)
+
+    def test_unknown_type_is_none(self):
+        self.assertIsNone(sem._resolve_threshold_value("Formula", "A1", self.POP))
+
+
+class DataBarTest(unittest.TestCase):
+    POP = [0.0, 50.0, 100.0]
+
+    def test_length_scales_into_configured_range(self):
+        match = sem._data_bar_match_for_cell(50.0, _data_bar(), self.POP)
+        self.assertEqual(match["kind"], "DataBar")
+        self.assertEqual(match["bar_length_pct"], 50.0)
+        self.assertEqual(match["bar_axis_position_pct"], 0.0)
+        self.assertFalse(match["is_negative"])
+        self.assertEqual(match["fill"], {"r": 1, "g": 2, "b": 3, "a": 255})
+
+    def test_length_clamps_to_unit_fraction(self):
+        desc = _data_bar(min_type="Number", min_value=20, max_type="Number", max_value=80)
+        self.assertEqual(sem._data_bar_match_for_cell(0.0, desc, self.POP)["bar_length_pct"], 10.0)
+        self.assertEqual(sem._data_bar_match_for_cell(100.0, desc, self.POP)["bar_length_pct"], 90.0)
+
+    def test_explicit_alpha_kept(self):
+        desc = _data_bar(fill={"r": 1, "g": 2, "b": 3, "a": 40})
+        self.assertEqual(sem._data_bar_match_for_cell(0.0, desc, self.POP)["fill"]["a"], 40)
+
+    def test_no_match_for_blank_degenerate_or_empty(self):
+        self.assertIsNone(sem._data_bar_match_for_cell(None, _data_bar(), self.POP))
+        self.assertIsNone(sem._data_bar_match_for_cell(1.0, _data_bar(), [4.0]))
+        self.assertIsNone(sem._data_bar_match_for_cell(1.0, _data_bar(), []))
+
+
+class IconSetTest(unittest.TestCase):
+    POP = [0.0, 50.0, 100.0]
+    THRESHOLDS = [("Percent", 33, True), ("Percent", 67, True)]
+
+    def _index(self, value, **kw):
+        match = sem._icon_set_match_for_cell(value, _icon_set(self.THRESHOLDS, **kw), self.POP)
+        return match["icon_index"]
+
+    def test_buckets_walk_thresholds(self):
+        self.assertEqual(self._index(0.0), 0)
+        self.assertEqual(self._index(40.0), 1)
+        self.assertEqual(self._index(100.0), 2)
+
+    def test_gte_flag_controls_boundary(self):
+        strict = [("Number", 50, False)]
+        inclusive = [("Number", 50, True)]
+        at = lambda th: sem._icon_set_match_for_cell(50.0, _icon_set(th), self.POP)["icon_index"]  # noqa: E731
+        self.assertEqual(at(strict), 0)
+        self.assertEqual(at(inclusive), 1)
+
+    def test_reverse_mirrors_index_across_buckets(self):
+        self.assertEqual(self._index(100.0, reverse=True), 0)
+        self.assertEqual(self._index(0.0, reverse=True), 2)
+
+    def test_bucket_count_follows_set_name(self):
+        self.assertEqual(sem._ICON_SET_BUCKET_COUNT["3Arrows"], 3)
+        self.assertEqual(sem._ICON_SET_BUCKET_COUNT["5Quarters"], 5)
+        thresholds = [("Number", 0, True)] * 4
+        match = sem._icon_set_match_for_cell(1.0, _icon_set(thresholds, name_ooxml="5Rating", reverse=True), self.POP)
+        self.assertEqual(match["icon_index"], 0)
+
+    def test_payload_shape_and_absent_cases(self):
+        match = sem._icon_set_match_for_cell(100.0, _icon_set(self.THRESHOLDS, priority=4), self.POP)
+        self.assertEqual(match["kind"], "IconSet")
+        self.assertEqual(match["priority"], 4)
+        self.assertEqual(match["icon_set_name"], "Three_Arrows")
+        self.assertIsNone(sem._icon_set_match_for_cell(None, _icon_set(self.THRESHOLDS), self.POP))
+        self.assertIsNone(sem._icon_set_match_for_cell(1.0, _icon_set(self.THRESHOLDS), []))
+
+    def test_name_tables_are_inverse(self):
+        for ooxml, formulon in sem._ICON_SET_OOXML_TO_FORMULON.items():
+            self.assertEqual(sem._ICON_SET_FORMULON_TO_OOXML[formulon], ooxml)
+
+
+class ComputeVisualMatchesTest(unittest.TestCase):
+    def test_every_numeric_cell_in_range_gets_a_match(self):
+        case = _case([0, 50, 100, "x", None])
+        out = sem._compute_visual_matches(case, [_data_bar()])
+        self.assertEqual(sorted(out), [(1, 1), (2, 1), (3, 1)])
+        self.assertEqual([out[(r, 1)][0]["bar_length_pct"] for r in (1, 2, 3)], [10.0, 50.0, 90.0])
+
+    def test_priority_order_and_rule_type_filter(self):
+        case = _case([0, 50, 100])
+        thresholds = [("Percent", 33, True), ("Percent", 67, True)]
+        descriptors = [
+            _icon_set(thresholds, priority=2),
+            {"type": "CellIs", "priority": 0, "sqref": SQREF},
+            _data_bar(priority=1),
+        ]
+        out = sem._compute_visual_matches(case, descriptors)
+        self.assertEqual([m["kind"] for m in out[(1, 1)]], ["DataBar", "IconSet"])
+
+    def test_sqref_limits_cells_and_population(self):
+        case = _case([0, 50, 100])
+        block = [{"first_row": 2, "first_col": 1, "last_row": 3, "last_col": 1}]
+        out = sem._compute_visual_matches(case, [_data_bar(sqref=block)])
+        self.assertEqual(sorted(out), [(2, 1), (3, 1)])
+        self.assertEqual(out[(2, 1)][0]["bar_length_pct"], 10.0)
+
+    def test_degenerate_population_yields_no_matches(self):
+        self.assertEqual(sem._compute_visual_matches(_case([5, "x"]), [_data_bar()]), {})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/oracle/cli.py b/tools/oracle/cli.py
index f907e7364..eb6bd73a3 100644
--- a/tools/oracle/cli.py
+++ b/tools/oracle/cli.py
@@ -28,107 +28,24 @@
 from __future__ import annotations
 
 import argparse
-import datetime as _dt
-import json
-import platform
-import re
-import subprocess
 import sys
 from pathlib import Path
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional
 
 # Local imports — accept both `python3 tools/oracle/cli.py` (no package)
 # and `python3 -m tools.oracle.cli` (package-style).
 try:  # pragma: no cover - trivial fallback
     from tools.oracle import oracle_gen, workbook_oracle_gen
-    from tools.oracle.drivers import resolve_win_python
-    from tools.oracle.drivers._locale import COUNTRY_CODE_TO_BCP47
+    from tools.oracle.contribute import _cmd_contribute
+    from tools.oracle.preflight import _cmd_setup
+    from tools.oracle.targets_manifest import DEFAULT_TARGETS_FILE, _load_targets, _platform_label, _select_targets
 except ImportError:  # pragma: no cover
     sys.path.insert(0, str(Path(__file__).resolve().parent))
     import oracle_gen  # type: ignore
     import workbook_oracle_gen  # type: ignore
-    from drivers import resolve_win_python  # type: ignore
-    from drivers._locale import COUNTRY_CODE_TO_BCP47  # type: ignore
-
-
-REPO_ROOT = Path(__file__).resolve().parents[2]
-DEFAULT_TARGETS_FILE = Path(__file__).resolve().parent / "targets.yaml"
-
-
-def _load_targets(path: Path) -> Dict[str, Any]:
-    """Reads and validates targets.yaml; returns the parsed mapping."""
-
-    if not path.exists():
-        raise RuntimeError(f"oracle targets file not found: {path}")
-    try:
-        import yaml  # type: ignore
-
-        doc = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
-    except Exception as exc:
-        raise RuntimeError(f"failed to parse {path}: {exc}") from exc
-    if not isinstance(doc, dict):
-        raise RuntimeError(f"{path} root must be a mapping")
-    targets = doc.get("targets")
-    if not isinstance(targets, dict) or not targets:
-        raise RuntimeError(f"{path} has no `targets:` mapping")
-    return doc
-
-
-def _runs_on_current(target: Dict[str, Any]) -> bool:
-    """Whether the target declares the current OS in `runs_on:`."""
-
-    runs_on = target.get("runs_on") or []
-    if not isinstance(runs_on, list):
-        return False
-    return platform.system() in runs_on
-
-
-def _platform_label() -> str:
-    """Returns ``platform.system()`` with a ``(WSL2)`` suffix on WSL2.
-
-    The CLI's ``list`` command surfaces this so operators can confirm at
-    a glance which side of the WSL boundary they are on -- ``Linux`` and
-    ``Linux (WSL2)`` route to different drivers for the same target.
-    """
-
-    if platform.system() == "Linux":
-        try:
-            if "microsoft" in Path("/proc/version").read_text(encoding="utf-8").lower():
-                return "Linux (WSL2)"
-        except OSError:
-            pass
-    return platform.system()
-
-
-def _select_targets(
-    doc: Dict[str, Any],
-    *,
-    name: Optional[str],
-    all_targets: bool,
-) -> List[Tuple[str, Dict[str, Any]]]:
-    """Returns the (name, record) list to dispatch.
-
-    If `name` is set, just that one (with no `runs_on` filtering — let
-    oracle_gen surface the platform error directly). If `all_targets`,
-    every target whose `runs_on:` contains the current OS. Otherwise the
-    primary target only.
-    """
-
-    targets: Dict[str, Any] = doc.get("targets") or {}
-    if name is not None:
-        if name not in targets:
-            avail = ", ".join(sorted(targets.keys()))
-            raise RuntimeError(f"unknown target: {name!r} (available: {avail})")
-        return [(name, targets[name])]
-    if all_targets:
-        chosen: List[Tuple[str, Dict[str, Any]]] = [(n, t) for n, t in sorted(targets.items()) if _runs_on_current(t)]
-        if not chosen:
-            raise RuntimeError(f"no targets in targets.yaml declare runs_on: [{platform.system()}]")
-        return chosen
-    primary = doc.get("primary")
-    if not isinstance(primary, str) or primary not in targets:
-        raise RuntimeError("targets.yaml is missing a valid `primary:` entry")
-    return [(primary, targets[primary])]
+    from contribute import _cmd_contribute  # type: ignore
+    from preflight import _cmd_setup  # type: ignore
+    from targets_manifest import DEFAULT_TARGETS_FILE, _load_targets, _platform_label, _select_targets  # type: ignore
 
 
 def _cmd_list(args: argparse.Namespace) -> int:
@@ -197,852 +114,6 @@ def _cmd_workbook(args: argparse.Namespace) -> int:
     return workbook_oracle_gen.main(gen_argv)
 
 
-_STATUS_PASS = "PASS"
-_STATUS_FAIL = "FAIL"
-_STATUS_SKIP = "SKIP"
-
-
-def _print_check(target_name: str, status: str, label: str, hint: str = "") -> None:
-    """Pretty-prints one preflight check line.
-
-    `status` is one of PASS / FAIL / SKIP. `hint` is appended on a wrapped
-    indented line when present so operators can copy-paste fixes.
-    """
-
-    print(f"  [{status}] {label}")
-    if hint:
-        for line in hint.splitlines():
-            print(f"        {line}")
-
-
-def _venv_python() -> Path:
-    """Returns the canonical path to the rye-managed venv interpreter."""
-
-    return Path(__file__).resolve().parent / ".venv" / "bin" / "python"
-
-
-def _check_xlwings_import(python_exe: Path) -> Tuple[str, str]:
-    """Returns (status, hint) for `import xlwings` under `python_exe`."""
-
-    if not python_exe.exists():
-        return (
-            _STATUS_FAIL,
-            f"interpreter not found: {python_exe}\nHint: run `make oracle-setup` to create the venv.",
-        )
-    proc = subprocess.run(
-        [str(python_exe), "-c", "import xlwings"],
-        capture_output=True,
-        text=True,
-    )
-    if proc.returncode == 0:
-        return (_STATUS_PASS, "")
-    return (
-        _STATUS_FAIL,
-        "xlwings import failed:\n"
-        + (proc.stderr.strip() or proc.stdout.strip())
-        + "\nHint: cd tools/oracle && rye sync",
-    )
-
-
-def _check_excel_reachable(python_exe: Path) -> Tuple[str, str]:
-    """Returns (status, hint) for an Automation reachability probe.
-
-    Uses ``xlwings.apps.count`` which forces lazy attachment to the
-    running Excel app and surfaces an Automation permission denial
-    immediately. We do not start a fresh Excel here -- that is far too
-    intrusive for a preflight.
-    """
-
-    proc = subprocess.run(
-        [str(python_exe), "-c", "import xlwings, sys; sys.exit(0 if hasattr(xlwings, 'apps') else 1)"],
-        capture_output=True,
-        text=True,
-    )
-    if proc.returncode == 0:
-        return (
-            _STATUS_PASS,
-            "",
-        )
-    return (
-        _STATUS_FAIL,
-        "xlwings.apps lookup failed:\n"
-        + (proc.stderr.strip() or proc.stdout.strip())
-        + "\nHint: System Settings -> Privacy & Security -> Automation\n"
-        "       -> (your terminal) -> Microsoft Excel (allow).",
-    )
-
-
-def _discover_win_python_candidates() -> List[Path]:
-    """Returns plausible Windows-side ``python.exe`` paths visible from WSL2.
-
-    Scans the standard per-user (winget / python.org installer) and
-    machine-wide install locations, skipping the Microsoft Store stub
-    under ``WindowsApps`` which is a reparse point and not a real
-    interpreter. Returns existing files only, deduplicated and sorted by
-    descending Python version (so Python312 wins over Python311 when
-    both are present).
-    """
-
-    roots: List[Path] = []
-    roots.extend(Path("/mnt/c/Users").glob("*/AppData/Local/Programs/Python/Python3*/python.exe"))
-    roots.extend(Path("/mnt/c/Program Files").glob("Python3*/python.exe"))
-    roots.extend(Path("/mnt/c/Program Files (x86)").glob("Python3*/python.exe"))
-    seen: List[Path] = []
-    for p in roots:
-        if "WindowsApps" in p.parts:
-            continue
-        if p.is_file() and p not in seen:
-            seen.append(p)
-    seen.sort(key=lambda p: p.parent.name, reverse=True)
-    return seen
-
-
-def _check_win_python_path(target: Dict[str, Any]) -> Tuple[str, str, Optional[Path]]:
-    """Returns (status, hint, resolved_path) for ``target.win_python``.
-
-    The third element is the resolved Path when the field is set and
-    points to an existing file, otherwise ``None`` -- callers use it to
-    decide whether dependent checks can run or must SKIP.
-    """
-
-    win_python = resolve_win_python(target)
-    if not win_python:
-        candidates = _discover_win_python_candidates()
-        if candidates:
-            suggestion = (
-                "Hint: Windows-side Python is installed but FORMULON_WIN_PYTHON "
-                "is not exported. Found:\n"
-                + "\n".join(f"        {p}" for p in candidates)
-                + "\n      Export the one you want to use:\n"
-                f'        export FORMULON_WIN_PYTHON="{candidates[0]}"'
-            )
-        else:
-            suggestion = (
-                "Hint: install Python on Windows (winget install Python.Python.3.12),\n"
-                "      then either export FORMULON_WIN_PYTHON pointing at the\n"
-                "      Windows-side python.exe (preferred for OSS contributors so\n"
-                "      no per-machine path lands in targets.yaml) or, for a\n"
-                "      private fork, add a win_python: line under the target.\n"
-                "      Example:\n"
-                '        export FORMULON_WIN_PYTHON="/mnt/c/Users/<you>/AppData/'
-                'Local/Programs/Python/Python312/python.exe"'
-            )
-        return (
-            _STATUS_FAIL,
-            "win_python not configured\n" + suggestion,
-            None,
-        )
-    p = Path(win_python)
-    if not p.exists():
-        return (
-            _STATUS_FAIL,
-            f"win_python path does not exist: {p}\n"
-            "Hint: confirm the Windows Python install path; from WSL2 the\n"
-            "      Windows C: drive is mounted at /mnt/c.",
-            None,
-        )
-    return (_STATUS_PASS, "", p)
-
-
-def _check_win_python_imports(win_python: Path) -> Tuple[str, str]:
-    """Returns (status, hint) for ``import xlwings, win32com.client`` on the
-    Windows-side interpreter. Only runs when win_python resolved cleanly.
-    """
-
-    proc = subprocess.run(
-        [str(win_python), "-c", "import xlwings, win32com.client"],
-        capture_output=True,
-        text=True,
-    )
-    if proc.returncode == 0:
-        return (_STATUS_PASS, "")
-    return (
-        _STATUS_FAIL,
-        "Windows-side xlwings/pywin32 import failed:\n"
-        + (proc.stderr.strip() or proc.stdout.strip())
-        + "\nHint: in PowerShell, run:\n"
-        "        py -m pip install xlwings pywin32 pyyaml",
-    )
-
-
-def _check_wslpath() -> Tuple[str, str]:
-    """Returns (status, hint) for the ``wslpath`` translator.
-
-    ``wslpath -w /tmp`` is the smallest invocation that exercises the
-    binary; a non-empty stdout proves the WSL2 kernel is providing the
-    translation service.
-    """
-
-    try:
-        proc = subprocess.run(["wslpath", "-w", "/tmp"], capture_output=True, text=True)
-    except FileNotFoundError:
-        return (
-            _STATUS_FAIL,
-            "wslpath not on PATH\n"
-            "Hint: wslpath only exists on WSL2; if you are on plain Linux\n"
-            "      you cannot drive Windows Excel from this host.",
-        )
-    if proc.returncode == 0 and proc.stdout.strip():
-        return (_STATUS_PASS, "")
-    return (
-        _STATUS_FAIL,
-        f"wslpath -w /tmp failed: rc={proc.returncode}\n" + (proc.stderr.strip() or proc.stdout.strip()),
-    )
-
-
-def _runs_on_label(target: Dict[str, Any]) -> str:
-    """Returns the comma-joined ``runs_on`` for printing."""
-
-    runs_on = target.get("runs_on") or []
-    if not isinstance(runs_on, list):
-        return "?"
-    return ",".join(str(x) for x in runs_on) or "?"
-
-
-def _check_target(target_name: str, target: Dict[str, Any], host: str) -> bool:
-    """Runs the preflight checks for one target. Returns True on success."""
-
-    print(f"[setup] target={target_name} host={host}")
-    driver_name = target.get("driver")
-
-    # Host vs runs_on sanity. We still let the per-driver checks run on a
-    # mismatch (downgraded to SKIP) so the operator sees what would be
-    # required if they were on the right host.
-    runs_on = target.get("runs_on") or []
-    host_compatible = isinstance(runs_on, list) and platform.system() in runs_on
-
-    if driver_name == "macos_excel":
-        if host != "Darwin":
-            _print_check(
-                target_name,
-                _STATUS_FAIL,
-                "host compatibility",
-                f"target requires Darwin, current host is {host}.\nruns_on={_runs_on_label(target)}",
-            )
-            _print_check(target_name, _STATUS_SKIP, "xlwings import (host mismatch)")
-            _print_check(target_name, _STATUS_SKIP, "Excel automation reachable (host mismatch)")
-            return False
-        ok = True
-        status, hint = _check_xlwings_import(_venv_python())
-        _print_check(target_name, status, "xlwings import", hint)
-        if status != _STATUS_PASS:
-            ok = False
-            _print_check(target_name, _STATUS_SKIP, "Excel automation reachable (xlwings missing)")
-        else:
-            status2, hint2 = _check_excel_reachable(_venv_python())
-            _print_check(target_name, status2, "Excel automation reachable", hint2)
-            if status2 != _STATUS_PASS:
-                ok = False
-        return ok
-
-    if driver_name == "windows_excel":
-        # Three legal hosts: Windows (direct COM), WSL2 (bridge), or
-        # anything else (skip with a host-mismatch FAIL).
-        # `host` here is the label from `_platform_label()` -- on WSL2 it
-        # carries the "(WSL2)" suffix, so we cannot compare against the
-        # bare `platform.system()` value.
-        is_wsl2 = "(WSL2)" in host
-        if host == "Windows":
-            ok = True
-            # On Windows we can only verify import; the actual COM probe
-            # depends on Office activation state which we don't want to
-            # touch from a preflight. Leave it to the operator.
-            status, hint = _check_xlwings_import(_venv_python())
-            _print_check(target_name, status, "xlwings import (Windows host)", hint)
-            if status != _STATUS_PASS:
-                ok = False
-            _print_check(
-                target_name,
-                _STATUS_SKIP,
-                "Excel COM probe (skipped on preflight; manual oracle-gen will surface activation issues)",
-            )
-            return ok and host_compatible
-
-        if is_wsl2:
-            ok = True
-            status, hint, win_python = _check_win_python_path(target)
-            _print_check(target_name, status, "win_python configured", hint)
-            if win_python is None:
-                ok = False
-                _print_check(
-                    target_name,
-                    _STATUS_SKIP,
-                    "Windows-side xlwings + win32com import (depends on win_python)",
-                )
-            else:
-                status2, hint2 = _check_win_python_imports(win_python)
-                _print_check(target_name, status2, "Windows-side xlwings + win32com import", hint2)
-                if status2 != _STATUS_PASS:
-                    ok = False
-            status3, hint3 = _check_wslpath()
-            _print_check(target_name, status3, "wslpath translation", hint3)
-            if status3 != _STATUS_PASS:
-                ok = False
-            return ok
-
-        _print_check(
-            target_name,
-            _STATUS_FAIL,
-            "host compatibility",
-            f"target needs Windows or WSL2, current host is {host}.\nruns_on={_runs_on_label(target)}",
-        )
-        _print_check(target_name, _STATUS_SKIP, "xlwings + win32com import (host mismatch)")
-        _print_check(target_name, _STATUS_SKIP, "wslpath translation (host mismatch)")
-        return False
-
-    if driver_name == "wsl_bridge":
-        is_wsl2 = "(WSL2)" in host
-        if not is_wsl2:
-            _print_check(
-                target_name,
-                _STATUS_FAIL,
-                "host compatibility",
-                f"target needs WSL2, current host is {_platform_label()}.",
-            )
-            _print_check(target_name, _STATUS_SKIP, "win_python configured (host mismatch)")
-            _print_check(target_name, _STATUS_SKIP, "wslpath translation (host mismatch)")
-            return False
-        ok = True
-        status, hint, win_python = _check_win_python_path(target)
-        _print_check(target_name, status, "win_python configured", hint)
-        if win_python is None:
-            ok = False
-            _print_check(
-                target_name,
-                _STATUS_SKIP,
-                "Windows-side xlwings + win32com import (depends on win_python)",
-            )
-        else:
-            status2, hint2 = _check_win_python_imports(win_python)
-            _print_check(target_name, status2, "Windows-side xlwings + win32com import", hint2)
-            if status2 != _STATUS_PASS:
-                ok = False
-        status3, hint3 = _check_wslpath()
-        _print_check(target_name, status3, "wslpath translation", hint3)
-        if status3 != _STATUS_PASS:
-            ok = False
-        return ok
-
-    _print_check(
-        target_name,
-        _STATUS_FAIL,
-        f"unknown driver: {driver_name!r}",
-        "Hint: targets.yaml driver must be one of 'macos_excel', 'windows_excel', 'wsl_bridge'.",
-    )
-    return False
-
-
-_CONTRIBUTE_BANNER = """\
-========================================================================
-  Formulon oracle contribution flow
-
-  Thank you for taking the time to donate Excel oracle data.
-
-  Why we need this:
-    Formulon's 1-bit compatibility claim is anchored to ONE primary
-    oracle (Mac Excel 365, ja-JP). Several function families behave
-    differently across locales (BAHTTEXT, NUMBERSTRING, decimal-comma
-    locales, localized TEXT format codes) and across the Mac/Windows
-    ports. The maintainer team can't reproduce these from a single
-    install -- Excel's locale is system-wide, not a runtime switch,
-    and licenses are per-account/per-platform. Goldens captured by
-    contributors who actually run Excel in that locale are how
-    Formulon stays honest.
-
-  What this command does:
-    1. Confirms your host can drive the chosen target (preflight).
-    2. Drives Excel to evaluate every YAML case under
-       tests/oracle/cases/ and writes golden JSON.
-    3. Records the Excel build + locale to ENVIRONMENT.md.
-    4. Prints the exact git commands to push your branch and the
-       PR URL with the oracle template prefilled.
-
-  Tip: you can re-run safely. Goldens are rewritten from scratch.
-========================================================================
-"""
-
-
-# Excel `Application.International(xlCountryCode)` (xlCountryCode = 1) maps
-# the host's region setting to a phone-style country code. The shared
-# `COUNTRY_CODE_TO_BCP47` map under tools/oracle/drivers/_locale.py is the
-# single source of truth -- alias it locally so existing call sites and
-# any external scripts that import `_COUNTRY_TO_LOCALE` keep working.
-_COUNTRY_TO_LOCALE: Dict[int, str] = COUNTRY_CODE_TO_BCP47
-
-
-def _short_host(host: str, label: Optional[str] = None) -> Optional[str]:
-    """Maps platform.system() -> the prefix we use in target names.
-
-    `Darwin` -> `mac`, Windows or WSL2 -> `win`, anything else -> None
-    (which causes auto-detection to bail out and ask for --target).
-    """
-
-    if host == "Darwin":
-        return "mac"
-    if host == "Windows":
-        return "win"
-    if host == "Linux" and (label or _platform_label()).endswith("(WSL2)"):
-        return "win"
-    return None
-
-
-def _version_tuple(s: str) -> Tuple[int, ...]:
-    """Returns a comparable integer tuple from an Excel version string.
-
-    Accepts ``"16.108.1"``, ``"16.84 (Build 24021522)"``, ``"16.84"``;
-    extracts every leading-digit run separated by ``.`` until the first
-    non-numeric chunk. Returns ``(0,)`` if no digits were found, so the
-    caller can compare without crashing on garbage input.
-    """
-
-    parts: List[int] = []
-    for chunk in re.split(r"[.\s(]+", s.strip()):
-        m = re.match(r"\d+", chunk)
-        if not m:
-            break
-        parts.append(int(m.group()))
-    return tuple(parts) or (0,)
-
-
-_PROBE_SCRIPT = """
-import json
-import sys
-
-try:
-    import xlwings  # noqa: F401
-except Exception as exc:  # pragma: no cover
-    print(json.dumps({"error": "xlwings missing: " + str(exc)}))
-    sys.exit(2)
-
-app = None
-try:
-    app = xlwings.App(visible=False, add_book=False)
-    version = ""
-    try:
-        version = str(app.version) if app.version else ""
-    except Exception:
-        version = ""
-    cc = None
-    try:
-        api = app.api
-        # xlCountryCode = 1 in Application.International(...)
-        v = api.international(1)
-        cc = v() if callable(v) else v
-        cc = int(cc)
-    except Exception:
-        cc = None
-    if cc is None:
-        # Mac AppleScript dictionary fallback: `country code` is a
-        # property on the application object on some Excel builds.
-        try:
-            api = app.api
-            v = getattr(api, "country_code", None)
-            if v is not None:
-                cc = int(v() if callable(v) else v)
-        except Exception:
-            cc = None
-    print(json.dumps({"version": version, "country_code": cc}))
-finally:
-    if app is not None:
-        try:
-            app.quit()
-        except Exception:
-            pass
-"""
-
-
-def _probe_excel_brief(host: str) -> Optional[Dict[str, Any]]:
-    """Briefly opens Excel via xlwings to read version + country code.
-
-    Returns ``{"version": "16.x", "country_code": <int>, "locale": "xx-YY"}``
-    or ``None`` if anything in the chain fails (xlwings not installed,
-    Excel not reachable, country code couldn't be mapped). The caller
-    treats ``None`` as "fall back to --target".
-    """
-
-    venv = _venv_python()
-    if not venv.exists():
-        return None
-    try:
-        proc = subprocess.run(
-            [str(venv), "-c", _PROBE_SCRIPT],
-            capture_output=True,
-            text=True,
-            timeout=120,
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError):
-        return None
-    if proc.returncode != 0 or not proc.stdout.strip():
-        return None
-    try:
-        data = json.loads(proc.stdout.strip().splitlines()[-1])
-    except json.JSONDecodeError:
-        return None
-    if "error" in data:
-        return None
-    version = data.get("version") or ""
-    cc = data.get("country_code")
-    if not version or cc is None:
-        return None
-    locale = _COUNTRY_TO_LOCALE.get(int(cc))
-    if not locale:
-        return {"version": version, "country_code": int(cc), "locale": None}
-    return {"version": version, "country_code": int(cc), "locale": locale}
-
-
-def _committed_excel_version_for(record: Dict[str, Any]) -> Optional[str]:
-    """Reads the committed ENVIRONMENT.md for `record` and returns the
-    Excel version string, or None if the file is missing / unparsable.
-    """
-
-    env_md_rel = record.get("environment_md")
-    if not isinstance(env_md_rel, str) or not env_md_rel:
-        return None
-    env_md = REPO_ROOT / env_md_rel
-    if not env_md.exists():
-        return None
-    pat = re.compile(r"-\s*\*\*Excel version\*\*:\s*`([^`]+)`")
-    for line in env_md.read_text(encoding="utf-8").splitlines():
-        m = pat.match(line.strip())
-        if m:
-            return m.group(1).strip()
-    return None
-
-
-def _print_unknown_target_help(probe: Dict[str, Any], derived_name: str, targets: Dict[str, Any]) -> None:
-    """Tells the contributor we don't track their locale yet.
-
-    Prints to stderr -- the banner + this message together give a
-    contributor enough to either choose an existing target or open an
-    issue to add theirs.
-    """
-
-    locale = probe.get("locale") or "?"
-    cc = probe.get("country_code")
-    cc_str = f"country_code={cc}" if cc is not None else "country_code=?"
-    msg_lines: List[str] = [
-        "[contribute] detected Excel:",
-        f"    version : {probe.get('version', '?')}",
-        f"    locale  : {locale}  ({cc_str})",
-        "",
-        f"[contribute] derived target name: {derived_name}",
-        "[contribute] this target isn't tracked in tools/oracle/targets.yaml.",
-        "",
-        "Two ways forward:",
-        "  1) Open an issue so we can reserve the slot, then re-run:",
-        f"     https://github.com/libraz/formulon/issues/new?title=Oracle+target%3A+{derived_name}",
-        "  2) Or pass --target=<existing-name> if you intend to map your",
-        "     environment onto an already-tracked target.",
-        "",
-        "Existing targets compatible with this host:",
-    ]
-    host = platform.system()
-    compatible = sorted(
-        [(n, t) for n, t in targets.items() if isinstance(t, dict) and host in (t.get("runs_on") or [])]
-    )
-    if not compatible:
-        msg_lines.append("  (none)")
-    else:
-        for n, t in compatible:
-            msg_lines.append(f"  {n}  locale={t.get('locale', '?')}  status={t.get('status', '?')}")
-    print("\n".join(msg_lines), file=sys.stderr)
-
-
-def _print_already_current_thanks(
-    target_name: str,
-    record: Dict[str, Any],
-    committed_version: str,
-    probed_version: str,
-) -> None:
-    """Closing message when no regeneration is needed.
-
-    The repository's golden was generated against an Excel build at or
-    above the version installed on this contributor's machine, so we
-    skip oracle-gen entirely and just thank them for showing up.
-    """
-
-    print()
-    print("========================================================================")
-    print("  Thank you for trying to contribute oracle data!")
-    print()
-    print(f"  The repository already has goldens for `{target_name}` generated")
-    print(f"  against Excel {committed_version} -- that's at or above your")
-    print(f"  installed Excel {probed_version}, so there's nothing to refresh")
-    print("  right now. No PR is needed.")
-    print()
-    print("  When would a refresh help?")
-    print("    * Your Excel updates and overtakes the committed version.")
-    print("    * A new oracle case is added to tests/oracle/cases/ that this")
-    print("      target hasn't covered yet.")
-    print("    * A divergence report against this target lands and we ask for")
-    print("      a re-run.")
-    print()
-    print("  Either way -- thanks for showing up. Run again any time:")
-    print("    make oracle-contribute")
-    print("========================================================================")
-
-
-def _git_changed_paths(prefixes: List[str]) -> List[str]:
-    """Returns repo-relative paths under any prefix that git considers
-    modified, added, or untracked. Best-effort -- silently returns an
-    empty list if git is unavailable.
-    """
-
-    try:
-        proc = subprocess.run(
-            ["git", "-C", str(REPO_ROOT), "status", "--porcelain"],
-            capture_output=True,
-            text=True,
-        )
-    except FileNotFoundError:
-        return []
-    if proc.returncode != 0:
-        return []
-    paths: List[str] = []
-    for line in proc.stdout.splitlines():
-        # porcelain format: "XY path" (status code is two chars + space).
-        if len(line) < 4:
-            continue
-        path = line[3:].strip()
-        # Handle rename "old -> new" -- keep the new path.
-        if " -> " in path:
-            path = path.split(" -> ", 1)[1]
-        if any(path == p or path.startswith(p.rstrip("/") + "/") for p in prefixes):
-            paths.append(path)
-    return sorted(set(paths))
-
-
-def _print_contribute_thanks(target_name: str, record: Dict[str, Any], targets_file: Path) -> None:
-    """Prints the closing thank-you message and git/PR instructions."""
-
-    today = _dt.date.today().isoformat()
-    branch = f"oracle/{target_name}-{today}"
-    output_dir = str(record.get("output_dir") or "")
-    env_md = str(record.get("environment_md") or "")
-    targets_rel = (
-        str(targets_file.relative_to(REPO_ROOT)) if targets_file.is_relative_to(REPO_ROOT) else str(targets_file)
-    )
-
-    prefixes = [p for p in (output_dir, env_md, targets_rel) if p]
-    changed = _git_changed_paths(prefixes)
-
-    print()
-    print("========================================================================")
-    print("  Done. Your oracle data is on disk -- thank you for the donation!")
-    print()
-    print(f"  Target:   {target_name}")
-    print(f"  Locale:   {record.get('locale', '?')}")
-    print(f"  Host:     {_platform_label()}")
-    if env_md:
-        print(f"  Env file: {env_md}")
-    print()
-    if changed:
-        print("  Files git considers new or changed:")
-        for path in changed[:25]:
-            print(f"    {path}")
-        if len(changed) > 25:
-            print(f"    ... ({len(changed) - 25} more)")
-    else:
-        print("  No git changes detected. (Goldens may already match HEAD --")
-        print("  re-running on an unchanged tree is a no-op.)")
-    print()
-    print("  Next: push your branch and open a PR.")
-    print()
-    print(f"    git checkout -b {branch}")
-    if output_dir:
-        print(f"    git add {output_dir}")
-    if env_md:
-        print(f"    git add {env_md}")
-    if record.get("status") == "wanted":
-        print(f"    git add {targets_rel}    # bump status: wanted -> scaffolded")
-    print(f"    git commit -m 'test(oracle): contribute {target_name} goldens'")
-    print(f"    git push -u origin {branch}")
-    print()
-    print("  Then open a PR (oracle template auto-loads):")
-    print(f"    https://github.com/libraz/formulon/compare/main...{branch}?expand=1&template=oracle.md")
-    print()
-    print("  Notes for reviewers and you:")
-    print("    * Confirm ENVIRONMENT.md records the locale you intended.")
-    print("    * For first-time targets, a second contributor will be asked")
-    print("      to regenerate independently and diff -- see CONTRIBUTING.md")
-    print("      for the two-person verify rule.")
-    print("========================================================================")
-
-
-def _cmd_contribute(args: argparse.Namespace) -> int:
-    """Contributor onramp: probe Excel, decide if a refresh is needed,
-    and (if so) run preflight + gen + push instructions.
-
-    Each contributor has exactly one Excel install, so the flow is:
-      1. Open Excel briefly and read version + country code (locale).
-      2. Map (host_short, '365', locale) -> a target name in targets.yaml.
-      3. If the committed ENVIRONMENT.md records a version >= the probed
-         one, skip generation and just thank them.
-      4. Otherwise run preflight + oracle_gen + closing instructions.
-
-    The operator can override step 1 with --target if the auto-derived
-    name doesn't fit (or the probe fails).
-    """
-
-    doc = _load_targets(args.targets_file)
-    targets: Dict[str, Any] = doc.get("targets") or {}
-    print(_CONTRIBUTE_BANNER)
-
-    host_sys = platform.system()
-    host_label = _platform_label()
-    host_short = _short_host(host_sys, host_label)
-
-    probe = _probe_excel_brief(host_sys)
-
-    # Resolve the target. Explicit --target wins; otherwise we derive
-    # from the probe.
-    name: Optional[str] = None
-    record: Optional[Dict[str, Any]] = None
-
-    if args.target is not None:
-        if args.target not in targets:
-            avail = ", ".join(sorted(targets.keys()))
-            print(
-                f"unknown target: {args.target!r} (available: {avail})",
-                file=sys.stderr,
-            )
-            return 2
-        name, record = args.target, targets[args.target]
-        if probe is not None and probe.get("version"):
-            print(f"[contribute] detected Excel {probe['version']} (locale={probe.get('locale') or '?'})")
-        print(f"[contribute] target: {name} (explicit)")
-    else:
-        if probe is None:
-            print(
-                "[contribute] could not auto-detect your Excel environment.",
-                file=sys.stderr,
-            )
-            print(
-                "    The probe needs xlwings + a working Excel install. First-time setup:",
-                file=sys.stderr,
-            )
-            print("      make oracle-setup", file=sys.stderr)
-            print(
-                "    Already set up? Re-run with TARGET=<name>; run `make oracle-contribute-list` to see the options.",
-                file=sys.stderr,
-            )
-            return 2
-        if not host_short or not probe.get("locale"):
-            cc = probe.get("country_code")
-            print(
-                f"[contribute] detected Excel {probe['version']} (country_code={cc}); locale could not be mapped.",
-                file=sys.stderr,
-            )
-            print(
-                "    Re-run with TARGET=<name> to pick a target manually,"
-                " or open an issue with the country_code above so we can"
-                " add the mapping.",
-                file=sys.stderr,
-            )
-            return 2
-        derived = f"{host_short}-365-{probe['locale'].replace('-', '_')}"
-        if derived not in targets:
-            _print_unknown_target_help(probe, derived, targets)
-            return 2
-        name, record = derived, targets[derived]
-        print(f"[contribute] detected Excel {probe['version']} (locale={probe['locale']})")
-        print(f"[contribute] target: {name} (auto-detected)")
-
-    assert name is not None and record is not None  # for type-checkers
-
-    # If the committed golden was generated against a version at or above
-    # the contributor's Excel, there is nothing for them to refresh. Say
-    # thanks and exit -- no PR needed.
-    if probe is not None and probe.get("version"):
-        committed = _committed_excel_version_for(record)
-        if committed and _version_tuple(committed) >= _version_tuple(probe["version"]):
-            _print_already_current_thanks(name, record, committed, probe["version"])
-            return 0
-
-    print()
-    print(f"[contribute] preflight: target={name}")
-    if not _check_target(name, record, host_label):
-        print()
-        print(
-            "[contribute] preflight failed. Address the FAIL lines above (the hints are copy-paste ready), then rerun:",
-            file=sys.stderr,
-        )
-        print("    make oracle-contribute", file=sys.stderr)
-        return 2
-
-    print()
-    print(f"[contribute] generating goldens for target={name}")
-    rc = oracle_gen.main(["--target", name, "--targets-file", str(args.targets_file)])
-    if rc != 0:
-        print()
-        print(
-            f"[contribute] oracle_gen exited with code {rc}. See the log above; common fixes:",
-            file=sys.stderr,
-        )
-        print("  * Quit Excel and rerun (the driver opens a fresh app).", file=sys.stderr)
-        print("  * Confirm Excel is signed in and Office is activated.", file=sys.stderr)
-        print(
-            "  * On macOS, re-grant Automation permission if it was reset by an OS update.",
-            file=sys.stderr,
-        )
-        return rc
-
-    _print_contribute_thanks(name, record, args.targets_file)
-    return 0
-
-
-def _cmd_setup(args: argparse.Namespace) -> int:
-    """Verifies the host can drive its target oracle.
-
-    With ``--target NAME`` checks just that one. Without, iterates every
-    target whose ``runs_on:`` includes the current platform (so a Mac
-    developer never sees noise about Windows-only targets, but a WSL2
-    developer correctly sees the windows_excel target).
-    """
-
-    doc = _load_targets(args.targets_file)
-    targets: Dict[str, Any] = doc.get("targets") or {}
-    host_label = _platform_label()
-    host = platform.system()
-
-    if args.target is not None:
-        if args.target not in targets:
-            avail = ", ".join(sorted(targets.keys()))
-            raise RuntimeError(f"unknown target: {args.target!r} (available: {avail})")
-        chosen = [(args.target, targets[args.target])]
-    else:
-        chosen = [
-            (n, t)
-            for n, t in sorted(targets.items())
-            if isinstance(t, dict) and platform.system() in (t.get("runs_on") or [])
-        ]
-        if not chosen:
-            print(
-                f"setup: no targets in targets.yaml declare runs_on: [{host}]",
-                file=sys.stderr,
-            )
-            return 0
-
-    ready = 0
-    failed = 0
-    for name, record in chosen:
-        if not isinstance(record, dict):
-            print(f"[setup] target={name}: malformed (not a mapping)", file=sys.stderr)
-            failed += 1
-            continue
-        if _check_target(name, record, host_label):
-            ready += 1
-        else:
-            failed += 1
-
-    print()
-    if failed == 0:
-        print(f"setup: {ready} target ready.")
-        return 0
-    print(f"setup: {ready} target ready, {failed} needs configuration.")
-    return 1
-
-
 def main(argv: Optional[List[str]] = None) -> int:
     parser = argparse.ArgumentParser(
         prog="oracle-cli",
diff --git a/tools/oracle/contribute.py b/tools/oracle/contribute.py
new file mode 100644
index 000000000..1e82e9171
--- /dev/null
+++ b/tools/oracle/contribute.py
@@ -0,0 +1,486 @@
+"""Contributor onramp: probe the local Excel, compare it with the committed goldens and print the donation steps."""
+
+from __future__ import annotations
+
+import argparse
+import datetime as _dt
+import json
+import platform
+import re
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+# Local imports -- accept both `python3 tools/oracle/cli.py` (no package)
+# and `python3 -m tools.oracle.cli` (package-style).
+try:  # pragma: no cover - trivial fallback
+    from tools.oracle import oracle_gen
+    from tools.oracle.drivers._locale import COUNTRY_CODE_TO_BCP47
+    from tools.oracle.preflight import _check_target, _venv_python
+    from tools.oracle.targets_manifest import _load_targets, _platform_label
+except ImportError:  # pragma: no cover
+    import oracle_gen  # type: ignore
+    from drivers._locale import COUNTRY_CODE_TO_BCP47  # type: ignore
+    from preflight import _check_target, _venv_python  # type: ignore
+    from targets_manifest import _load_targets, _platform_label  # type: ignore
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+
+_CONTRIBUTE_BANNER = """\
+========================================================================
+  Formulon oracle contribution flow
+
+  Thank you for taking the time to donate Excel oracle data.
+
+  Why we need this:
+    Formulon's 1-bit compatibility claim is anchored to ONE primary
+    oracle (Mac Excel 365, ja-JP). Several function families behave
+    differently across locales (BAHTTEXT, NUMBERSTRING, decimal-comma
+    locales, localized TEXT format codes) and across the Mac/Windows
+    ports. The maintainer team can't reproduce these from a single
+    install -- Excel's locale is system-wide, not a runtime switch,
+    and licenses are per-account/per-platform. Goldens captured by
+    contributors who actually run Excel in that locale are how
+    Formulon stays honest.
+
+  What this command does:
+    1. Confirms your host can drive the chosen target (preflight).
+    2. Drives Excel to evaluate every YAML case under
+       tests/oracle/cases/ and writes golden JSON.
+    3. Records the Excel build + locale to ENVIRONMENT.md.
+    4. Prints the exact git commands to push your branch and the
+       PR URL with the oracle template prefilled.
+
+  Tip: you can re-run safely. Goldens are rewritten from scratch.
+========================================================================
+"""
+
+# Excel `Application.International(xlCountryCode)` (xlCountryCode = 1) maps
+# the host's region setting to a phone-style country code. The shared
+# `COUNTRY_CODE_TO_BCP47` map under tools/oracle/drivers/_locale.py is the
+# single source of truth -- alias it locally so existing call sites and
+# any external scripts that import `_COUNTRY_TO_LOCALE` keep working.
+_COUNTRY_TO_LOCALE: Dict[int, str] = COUNTRY_CODE_TO_BCP47
+
+
+def _short_host(host: str, label: Optional[str] = None) -> Optional[str]:
+    """Maps platform.system() -> the prefix we use in target names.
+
+    `Darwin` -> `mac`, Windows or WSL2 -> `win`, anything else -> None
+    (which causes auto-detection to bail out and ask for --target).
+    """
+
+    if host == "Darwin":
+        return "mac"
+    if host == "Windows":
+        return "win"
+    if host == "Linux" and (label or _platform_label()).endswith("(WSL2)"):
+        return "win"
+    return None
+
+
+def _version_tuple(s: str) -> Tuple[int, ...]:
+    """Returns a comparable integer tuple from an Excel version string.
+
+    Accepts ``"16.108.1"``, ``"16.84 (Build 24021522)"``, ``"16.84"``;
+    extracts every leading-digit run separated by ``.`` until the first
+    non-numeric chunk. Returns ``(0,)`` if no digits were found, so the
+    caller can compare without crashing on garbage input.
+    """
+
+    parts: List[int] = []
+    for chunk in re.split(r"[.\s(]+", s.strip()):
+        m = re.match(r"\d+", chunk)
+        if not m:
+            break
+        parts.append(int(m.group()))
+    return tuple(parts) or (0,)
+
+
+_PROBE_SCRIPT = """
+import json
+import sys
+
+try:
+    import xlwings  # noqa: F401
+except Exception as exc:  # pragma: no cover
+    print(json.dumps({"error": "xlwings missing: " + str(exc)}))
+    sys.exit(2)
+
+app = None
+try:
+    app = xlwings.App(visible=False, add_book=False)
+    version = ""
+    try:
+        version = str(app.version) if app.version else ""
+    except Exception:
+        version = ""
+    cc = None
+    try:
+        api = app.api
+        # xlCountryCode = 1 in Application.International(...)
+        v = api.international(1)
+        cc = v() if callable(v) else v
+        cc = int(cc)
+    except Exception:
+        cc = None
+    if cc is None:
+        # Mac AppleScript dictionary fallback: `country code` is a
+        # property on the application object on some Excel builds.
+        try:
+            api = app.api
+            v = getattr(api, "country_code", None)
+            if v is not None:
+                cc = int(v() if callable(v) else v)
+        except Exception:
+            cc = None
+    print(json.dumps({"version": version, "country_code": cc}))
+finally:
+    if app is not None:
+        try:
+            app.quit()
+        except Exception:
+            pass
+"""
+
+
+def _probe_excel_brief(host: str) -> Optional[Dict[str, Any]]:
+    """Briefly opens Excel via xlwings to read version + country code.
+
+    Returns ``{"version": "16.x", "country_code": <int>, "locale": "xx-YY"}``
+    or ``None`` if anything in the chain fails (xlwings not installed,
+    Excel not reachable, country code couldn't be mapped). The caller
+    treats ``None`` as "fall back to --target".
+    """
+
+    venv = _venv_python()
+    if not venv.exists():
+        return None
+    try:
+        proc = subprocess.run(
+            [str(venv), "-c", _PROBE_SCRIPT],
+            capture_output=True,
+            text=True,
+            timeout=120,
+        )
+    except (subprocess.TimeoutExpired, FileNotFoundError):
+        return None
+    if proc.returncode != 0 or not proc.stdout.strip():
+        return None
+    try:
+        data = json.loads(proc.stdout.strip().splitlines()[-1])
+    except json.JSONDecodeError:
+        return None
+    if "error" in data:
+        return None
+    version = data.get("version") or ""
+    cc = data.get("country_code")
+    if not version or cc is None:
+        return None
+    locale = _COUNTRY_TO_LOCALE.get(int(cc))
+    if not locale:
+        return {"version": version, "country_code": int(cc), "locale": None}
+    return {"version": version, "country_code": int(cc), "locale": locale}
+
+
+def _committed_excel_version_for(record: Dict[str, Any]) -> Optional[str]:
+    """Reads the committed ENVIRONMENT.md for `record` and returns the
+    Excel version string, or None if the file is missing / unparsable.
+    """
+
+    env_md_rel = record.get("environment_md")
+    if not isinstance(env_md_rel, str) or not env_md_rel:
+        return None
+    env_md = REPO_ROOT / env_md_rel
+    if not env_md.exists():
+        return None
+    pat = re.compile(r"-\s*\*\*Excel version\*\*:\s*`([^`]+)`")
+    for line in env_md.read_text(encoding="utf-8").splitlines():
+        m = pat.match(line.strip())
+        if m:
+            return m.group(1).strip()
+    return None
+
+
+def _print_unknown_target_help(probe: Dict[str, Any], derived_name: str, targets: Dict[str, Any]) -> None:
+    """Tells the contributor we don't track their locale yet.
+
+    Prints to stderr -- the banner + this message together give a
+    contributor enough to either choose an existing target or open an
+    issue to add theirs.
+    """
+
+    locale = probe.get("locale") or "?"
+    cc = probe.get("country_code")
+    cc_str = f"country_code={cc}" if cc is not None else "country_code=?"
+    msg_lines: List[str] = [
+        "[contribute] detected Excel:",
+        f"    version : {probe.get('version', '?')}",
+        f"    locale  : {locale}  ({cc_str})",
+        "",
+        f"[contribute] derived target name: {derived_name}",
+        "[contribute] this target isn't tracked in tools/oracle/targets.yaml.",
+        "",
+        "Two ways forward:",
+        "  1) Open an issue so we can reserve the slot, then re-run:",
+        f"     https://github.com/libraz/formulon/issues/new?title=Oracle+target%3A+{derived_name}",
+        "  2) Or pass --target=<existing-name> if you intend to map your",
+        "     environment onto an already-tracked target.",
+        "",
+        "Existing targets compatible with this host:",
+    ]
+    host = platform.system()
+    compatible = sorted(
+        [(n, t) for n, t in targets.items() if isinstance(t, dict) and host in (t.get("runs_on") or [])]
+    )
+    if not compatible:
+        msg_lines.append("  (none)")
+    else:
+        for n, t in compatible:
+            msg_lines.append(f"  {n}  locale={t.get('locale', '?')}  status={t.get('status', '?')}")
+    print("\n".join(msg_lines), file=sys.stderr)
+
+
+def _print_already_current_thanks(
+    target_name: str,
+    record: Dict[str, Any],
+    committed_version: str,
+    probed_version: str,
+) -> None:
+    """Closing message when no regeneration is needed.
+
+    The repository's golden was generated against an Excel build at or
+    above the version installed on this contributor's machine, so we
+    skip oracle-gen entirely and just thank them for showing up.
+    """
+
+    print()
+    print("========================================================================")
+    print("  Thank you for trying to contribute oracle data!")
+    print()
+    print(f"  The repository already has goldens for `{target_name}` generated")
+    print(f"  against Excel {committed_version} -- that's at or above your")
+    print(f"  installed Excel {probed_version}, so there's nothing to refresh")
+    print("  right now. No PR is needed.")
+    print()
+    print("  When would a refresh help?")
+    print("    * Your Excel updates and overtakes the committed version.")
+    print("    * A new oracle case is added to tests/oracle/cases/ that this")
+    print("      target hasn't covered yet.")
+    print("    * A divergence report against this target lands and we ask for")
+    print("      a re-run.")
+    print()
+    print("  Either way -- thanks for showing up. Run again any time:")
+    print("    make oracle-contribute")
+    print("========================================================================")
+
+
+def _git_changed_paths(prefixes: List[str]) -> List[str]:
+    """Returns repo-relative paths under any prefix that git considers
+    modified, added, or untracked. Best-effort -- silently returns an
+    empty list if git is unavailable.
+    """
+
+    try:
+        proc = subprocess.run(
+            ["git", "-C", str(REPO_ROOT), "status", "--porcelain"],
+            capture_output=True,
+            text=True,
+        )
+    except FileNotFoundError:
+        return []
+    if proc.returncode != 0:
+        return []
+    paths: List[str] = []
+    for line in proc.stdout.splitlines():
+        # porcelain format: "XY path" (status code is two chars + space).
+        if len(line) < 4:
+            continue
+        path = line[3:].strip()
+        # Handle rename "old -> new" -- keep the new path.
+        if " -> " in path:
+            path = path.split(" -> ", 1)[1]
+        if any(path == p or path.startswith(p.rstrip("/") + "/") for p in prefixes):
+            paths.append(path)
+    return sorted(set(paths))
+
+
+def _print_contribute_thanks(target_name: str, record: Dict[str, Any], targets_file: Path) -> None:
+    """Prints the closing thank-you message and git/PR instructions."""
+
+    today = _dt.date.today().isoformat()
+    branch = f"oracle/{target_name}-{today}"
+    output_dir = str(record.get("output_dir") or "")
+    env_md = str(record.get("environment_md") or "")
+    targets_rel = (
+        str(targets_file.relative_to(REPO_ROOT)) if targets_file.is_relative_to(REPO_ROOT) else str(targets_file)
+    )
+
+    prefixes = [p for p in (output_dir, env_md, targets_rel) if p]
+    changed = _git_changed_paths(prefixes)
+
+    print()
+    print("========================================================================")
+    print("  Done. Your oracle data is on disk -- thank you for the donation!")
+    print()
+    print(f"  Target:   {target_name}")
+    print(f"  Locale:   {record.get('locale', '?')}")
+    print(f"  Host:     {_platform_label()}")
+    if env_md:
+        print(f"  Env file: {env_md}")
+    print()
+    if changed:
+        print("  Files git considers new or changed:")
+        for path in changed[:25]:
+            print(f"    {path}")
+        if len(changed) > 25:
+            print(f"    ... ({len(changed) - 25} more)")
+    else:
+        print("  No git changes detected. (Goldens may already match HEAD --")
+        print("  re-running on an unchanged tree is a no-op.)")
+    print()
+    print("  Next: push your branch and open a PR.")
+    print()
+    print(f"    git checkout -b {branch}")
+    if output_dir:
+        print(f"    git add {output_dir}")
+    if env_md:
+        print(f"    git add {env_md}")
+    if record.get("status") == "wanted":
+        print(f"    git add {targets_rel}    # bump status: wanted -> scaffolded")
+    print(f"    git commit -m 'test(oracle): contribute {target_name} goldens'")
+    print(f"    git push -u origin {branch}")
+    print()
+    print("  Then open a PR (oracle template auto-loads):")
+    print(f"    https://github.com/libraz/formulon/compare/main...{branch}?expand=1&template=oracle.md")
+    print()
+    print("  Notes for reviewers and you:")
+    print("    * Confirm ENVIRONMENT.md records the locale you intended.")
+    print("    * For first-time targets, a second contributor will be asked")
+    print("      to regenerate independently and diff -- see CONTRIBUTING.md")
+    print("      for the two-person verify rule.")
+    print("========================================================================")
+
+
+def _cmd_contribute(args: argparse.Namespace) -> int:
+    """Contributor onramp: probe Excel, decide if a refresh is needed,
+    and (if so) run preflight + gen + push instructions.
+
+    Each contributor has exactly one Excel install, so the flow is:
+      1. Open Excel briefly and read version + country code (locale).
+      2. Map (host_short, '365', locale) -> a target name in targets.yaml.
+      3. If the committed ENVIRONMENT.md records a version >= the probed
+         one, skip generation and just thank them.
+      4. Otherwise run preflight + oracle_gen + closing instructions.
+
+    The operator can override step 1 with --target if the auto-derived
+    name doesn't fit (or the probe fails).
+    """
+
+    doc = _load_targets(args.targets_file)
+    targets: Dict[str, Any] = doc.get("targets") or {}
+    print(_CONTRIBUTE_BANNER)
+
+    host_sys = platform.system()
+    host_label = _platform_label()
+    host_short = _short_host(host_sys, host_label)
+
+    probe = _probe_excel_brief(host_sys)
+
+    # Resolve the target. Explicit --target wins; otherwise we derive
+    # from the probe.
+    name: Optional[str] = None
+    record: Optional[Dict[str, Any]] = None
+
+    if args.target is not None:
+        if args.target not in targets:
+            avail = ", ".join(sorted(targets.keys()))
+            print(
+                f"unknown target: {args.target!r} (available: {avail})",
+                file=sys.stderr,
+            )
+            return 2
+        name, record = args.target, targets[args.target]
+        if probe is not None and probe.get("version"):
+            print(f"[contribute] detected Excel {probe['version']} (locale={probe.get('locale') or '?'})")
+        print(f"[contribute] target: {name} (explicit)")
+    else:
+        if probe is None:
+            print(
+                "[contribute] could not auto-detect your Excel environment.",
+                file=sys.stderr,
+            )
+            print(
+                "    The probe needs xlwings + a working Excel install. First-time setup:",
+                file=sys.stderr,
+            )
+            print("      make oracle-setup", file=sys.stderr)
+            print(
+                "    Already set up? Re-run with TARGET=<name>; run `make oracle-contribute-list` to see the options.",
+                file=sys.stderr,
+            )
+            return 2
+        if not host_short or not probe.get("locale"):
+            cc = probe.get("country_code")
+            print(
+                f"[contribute] detected Excel {probe['version']} (country_code={cc}); locale could not be mapped.",
+                file=sys.stderr,
+            )
+            print(
+                "    Re-run with TARGET=<name> to pick a target manually,"
+                " or open an issue with the country_code above so we can"
+                " add the mapping.",
+                file=sys.stderr,
+            )
+            return 2
+        derived = f"{host_short}-365-{probe['locale'].replace('-', '_')}"
+        if derived not in targets:
+            _print_unknown_target_help(probe, derived, targets)
+            return 2
+        name, record = derived, targets[derived]
+        print(f"[contribute] detected Excel {probe['version']} (locale={probe['locale']})")
+        print(f"[contribute] target: {name} (auto-detected)")
+
+    assert name is not None and record is not None  # for type-checkers
+
+    # If the committed golden was generated against a version at or above
+    # the contributor's Excel, there is nothing for them to refresh. Say
+    # thanks and exit -- no PR needed.
+    if probe is not None and probe.get("version"):
+        committed = _committed_excel_version_for(record)
+        if committed and _version_tuple(committed) >= _version_tuple(probe["version"]):
+            _print_already_current_thanks(name, record, committed, probe["version"])
+            return 0
+
+    print()
+    print(f"[contribute] preflight: target={name}")
+    if not _check_target(name, record, host_label):
+        print()
+        print(
+            "[contribute] preflight failed. Address the FAIL lines above (the hints are copy-paste ready), then rerun:",
+            file=sys.stderr,
+        )
+        print("    make oracle-contribute", file=sys.stderr)
+        return 2
+
+    print()
+    print(f"[contribute] generating goldens for target={name}")
+    rc = oracle_gen.main(["--target", name, "--targets-file", str(args.targets_file)])
+    if rc != 0:
+        print()
+        print(
+            f"[contribute] oracle_gen exited with code {rc}. See the log above; common fixes:",
+            file=sys.stderr,
+        )
+        print("  * Quit Excel and rerun (the driver opens a fresh app).", file=sys.stderr)
+        print("  * Confirm Excel is signed in and Office is activated.", file=sys.stderr)
+        print(
+            "  * On macOS, re-grant Automation permission if it was reset by an OS update.",
+            file=sys.stderr,
+        )
+        return rc
+
+    _print_contribute_thanks(name, record, args.targets_file)
+    return 0
diff --git a/tools/oracle/drivers/_locale.py b/tools/oracle/drivers/_locale.py
index 1e66c644b..d565f965a 100644
--- a/tools/oracle/drivers/_locale.py
+++ b/tools/oracle/drivers/_locale.py
@@ -11,7 +11,7 @@
 
   - :data:`COUNTRY_CODE_TO_BCP47` — the int-keyed map from
     ``xlCountryCode`` to BCP-47 locale strings. Used both by the driver
-    (for environment probes) and by ``cli.py`` (for the contributor probe
+    (for environment probes) and by ``contribute.py`` (for the contributor probe
     that derives a target name).
   - :data:`LOCALIZED_ERROR_TO_CANONICAL` — the localized form of every
     Excel error token mapped back to its canonical English form. The
diff --git a/tools/oracle/drivers/case_sheet.py b/tools/oracle/drivers/case_sheet.py
new file mode 100644
index 000000000..5ce83cf58
--- /dev/null
+++ b/tools/oracle/drivers/case_sheet.py
@@ -0,0 +1,118 @@
+"""Case-to-worksheet primitives shared by the Mac and Windows drivers.
+
+Sheet naming and addressing, merge application, error-cell triggers, and the
+print-block helpers that do not touch a platform bridge.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional
+
+
+def split_sheet_qualified_addr(key: str) -> "tuple[Optional[str], str]":
+    """Splits a setup-key like ``"Sheet2!A1"`` into ``(sheet, a1)``.
+
+    Returns ``(None, key)`` when the key is a bare A1 address (no ``!``).
+    Single-quoted sheet names are unquoted: ``"'Sheet One'!A1"`` ->
+    ``("Sheet One", "A1")``. Escaped quotes (``''`` inside a quoted
+    name) collapse to a single quote per Excel's convention. The split
+    is on the LAST ``!`` so a future stray ``!`` inside a quoted sheet
+    name does not confuse it.
+    """
+
+    if "!" not in key:
+        return None, key
+    bang = key.rfind("!")
+    sheet_part = key[:bang]
+    addr_part = key[bang + 1 :]
+    if sheet_part.startswith("'") and sheet_part.endswith("'") and len(sheet_part) >= 2:
+        sheet_part = sheet_part[1:-1].replace("''", "'")
+    return sheet_part, addr_part
+
+
+def get_or_add_sheet(wb, name: str):
+    """Returns the sheet whose display name matches ``name`` (case-insensitive),
+    adding it at the end if absent.
+    """
+
+    target = name.casefold()
+    for sht in wb.sheets:
+        if sht.name.casefold() == target:
+            return sht
+    return wb.sheets.add(name=name, after=wb.sheets[len(wb.sheets) - 1])
+
+
+def apply_merges(sht, merges: List[str]) -> None:
+    """Apply case-declared inclusive A1 merge ranges on ``sht``."""
+
+    for ref in merges:
+        sht.range(ref).merge()
+
+
+SHEET_FORBIDDEN = set("\\/?*[]:")
+
+
+def sanitize_sheet_name(name: str) -> str:
+    """Strips characters Excel disallows in sheet names and trims length."""
+
+    cleaned = "".join("_" if c in SHEET_FORBIDDEN else c for c in name)
+    return cleaned[:24] or "case"
+
+
+ERROR_TRIGGERS = {
+    "#DIV/0!": "=1/0",
+    "#NAME?": "=NONEXISTENT_FUNC()",
+    "#VALUE!": '=VALUE("x")',
+    "#NUM!": "=SQRT(-1)",
+    "#N/A": "=NA()",
+    "#REF!": "=OFFSET(A1,-1,-1)",
+    "#NULL!": "=A1 B1",
+}
+
+
+def error_trigger(code: str) -> str:
+    return ERROR_TRIGGERS.get(code, '=VALUE("x")')
+
+
+# Excel `XlPageOrientation` constants.
+_XL_PORTRAIT = 1
+_XL_LANDSCAPE = 2
+
+PRINT_ORIENTATIONS = {
+    "portrait": _XL_PORTRAIT,
+    "landscape": _XL_LANDSCAPE,
+}
+
+
+def resolve_print_sheet(wb, print_spec: Dict[str, Any]):
+    """Returns the worksheet the `print` block names, or raises."""
+
+    sheet_name = print_spec.get("sheet")
+    if not isinstance(sheet_name, str) or not sheet_name:
+        raise RuntimeError("print block missing string 'sheet'")
+    target = sheet_name.casefold()
+    for sht in wb.sheets:
+        if sht.name.casefold() == target:
+            return sht
+    raise RuntimeError(f"print 'sheet' names an unknown sheet {sheet_name!r}")
+
+
+def normalise_print_area(area: str) -> str:
+    """Strips ``$`` anchors and ``Sheet!`` qualifiers from a print area.
+
+    Excel reports ``PrintArea`` fully qualified and anchored
+    (``Sheet1!$A$1:$H$80``); the C++ engine compares against a bare
+    ``A1:H80`` form, so both sides normalise the same way.
+    """
+
+    out_parts: List[str] = []
+    for part in area.split(","):
+        token = part.strip()
+        if not token:
+            continue
+        bang = token.rfind("!")
+        if bang != -1:
+            token = token[bang + 1 :]
+        token = token.replace("$", "")
+        out_parts.append(token)
+    return ",".join(out_parts)
diff --git a/tools/oracle/drivers/cell_result.py b/tools/oracle/drivers/cell_result.py
new file mode 100644
index 000000000..627c1a2a1
--- /dev/null
+++ b/tools/oracle/drivers/cell_result.py
@@ -0,0 +1,237 @@
+"""Turns an xlwings cell or spill observation into a :class:`CaseResult`.
+
+The Mac and Windows drivers read results the same way and differ only in two
+platform primitives, which every entry point takes as callables:
+
+  - ``displayed_text(cell)`` -- the cell's rendered string via the bridge.
+  - ``app_evaluate(app)`` / ``spill_shape(app, anchor, *, max_cells)`` -- the
+    ``Application.Evaluate`` adapter and the spill-shape probe built on it.
+"""
+
+from __future__ import annotations
+
+import datetime as _dt
+from typing import Any, Callable, Dict, List, Optional
+
+from ._locale import normalise_error_token
+from .base import (
+    _ERR_DISPLAY_NAMES,
+    CaseResult,
+    _datetime_to_serial,
+    case_formula_cell,
+    case_shape_samples,
+    is_empty_text_result,
+)
+
+DisplayedText = Callable[[Any], Optional[str]]
+
+
+def error_display_from_cell(cell, displayed_text: DisplayedText) -> Optional[str]:
+    """Returns the tokenised Excel error name for `cell`, or None.
+
+    Walks four progressively weaker signals:
+      1. ``xlwings.utils.CVErr`` -- ideal, but only surfaces on some
+         Excel / xlwings build pairs.
+      2. ``cell.value`` already a ``'#DIV/0!'``-style string.
+      3. The displayed text (COM ``.Text``) matches a known error.
+      4. ``cell.value`` is ``None`` AND the displayed text nonetheless
+         starts with ``#``. This is the fallback path where the Python
+         layer has coerced the error into ``None``.
+    """
+
+    raw = cell.value
+    try:
+        from xlwings.utils import CVErr  # type: ignore
+
+        if isinstance(raw, CVErr):
+            s = str(raw)
+            if s in _ERR_DISPLAY_NAMES:
+                return s
+    except Exception:  # pragma: no cover - older xlwings without CVErr
+        pass
+
+    if isinstance(raw, str):
+        if raw in _ERR_DISPLAY_NAMES:
+            return raw
+        # ja-JP / de-DE / fr-FR builds occasionally surface the localized
+        # token directly through cell.value (when the bridge has already
+        # decoded the CVErr to a string). Normalise here so the golden
+        # JSON always carries the canonical English form.
+        canon = normalise_error_token(raw)
+        if canon is not None:
+            return canon
+
+    text = displayed_text(cell)
+    if text in _ERR_DISPLAY_NAMES:
+        return text
+    # Range.Text is locale-bound: de-DE returns "#WERT!" for #VALUE!,
+    # fr-FR returns "#VALEUR!", and so on. Normalise through the shared
+    # localisation map before falling back to the prefix heuristic.
+    if text:
+        canon = normalise_error_token(text)
+        if canon is not None:
+            return canon
+    if text and text.startswith("#") and (text.endswith("!") or text.endswith("?") or text == "#N/A"):
+        for name in _ERR_DISPLAY_NAMES:
+            if text == name:
+                return name
+    return None
+
+
+def classify_value(cell, evaluate, displayed_text: DisplayedText) -> CaseResult:
+    """Converts an xlwings cell observation into a CaseResult.
+
+    The ``cell.value`` read happens once up front; subsequent checks may
+    consult the COM ``.Text`` fallback for edge cases (error cells,
+    pre-1900 serials) where the Python-side value is lossy. ``evaluate`` is
+    the Application.Evaluate adapter that resolves an empty read-back into
+    ``""`` or blank; without it (``None``) an empty read-back stays blank.
+    """
+
+    err = error_display_from_cell(cell, displayed_text)
+    if err is not None:
+        return CaseResult(id="", kind="error", error_code=err)
+
+    v = cell.value
+    # The classifier has no workbook epoch metadata, so datetimes use the
+    # shared 1900-system conversion; 1904 cases should expose date values
+    # through a numeric/boolean formula such as N(DATE()).
+    if isinstance(v, _dt.datetime):
+        return CaseResult(id="", kind="number", value=_datetime_to_serial(v))
+    if isinstance(v, _dt.date):  # pragma: no cover - xlwings mostly returns datetime
+        combined = _dt.datetime(v.year, v.month, v.day)
+        return CaseResult(id="", kind="number", value=_datetime_to_serial(combined))
+
+    if isinstance(v, bool):
+        return CaseResult(id="", kind="bool", value=bool(v))
+    if isinstance(v, (int, float)):
+        return CaseResult(id="", kind="number", value=float(v))
+
+    if v is None or v == "":
+        # Pre-1900 serials come back as None (no datetime representation);
+        # a displayed-text parse was never implemented, so they stay blank.
+        text = displayed_text(cell)
+        if text and text.strip():
+            pass
+        if evaluate is not None and is_empty_text_result(evaluate, cell):
+            return CaseResult(id="", kind="text", value="")
+        return CaseResult(id="", kind="blank")
+
+    if isinstance(v, str):
+        return CaseResult(id="", kind="text", value=v)
+
+    if isinstance(v, list):
+        rows = len(v)
+        cols = 0
+        if rows > 0 and isinstance(v[0], list):
+            cols = len(v[0])
+            flat = [array_cell_from_scalar(classify_python_scalar(item)) for row in v for item in row]
+        else:
+            cols = rows
+            rows = 1
+            flat = [array_cell_from_scalar(classify_python_scalar(item)) for item in v]
+        return CaseResult(
+            id="",
+            kind="array",
+            value=flat,
+            array_shape=[rows, cols],
+        )
+    return CaseResult(id="", kind="text", value=str(v))
+
+
+def classify_python_scalar(v: Any) -> CaseResult:
+    """Classifies a scalar value already extracted from an xlwings array."""
+
+    if isinstance(v, _dt.datetime):
+        return CaseResult(id="", kind="number", value=_datetime_to_serial(v))
+    if isinstance(v, _dt.date):  # pragma: no cover - xlwings mostly returns datetime
+        combined = _dt.datetime(v.year, v.month, v.day)
+        return CaseResult(id="", kind="number", value=_datetime_to_serial(combined))
+    if isinstance(v, bool):
+        return CaseResult(id="", kind="bool", value=bool(v))
+    if isinstance(v, (int, float)):
+        return CaseResult(id="", kind="number", value=float(v))
+    if v is None or v == "":
+        return CaseResult(id="", kind="blank")
+    if isinstance(v, str):
+        canon = normalise_error_token(v)
+        if canon is not None:
+            return CaseResult(id="", kind="error", error_code=canon)
+        return CaseResult(id="", kind="text", value=v)
+    return CaseResult(id="", kind="text", value=str(v))
+
+
+def array_cell_from_scalar(result: CaseResult) -> Any:
+    if result.kind == "blank":
+        return None
+    if result.kind in {"number", "bool", "text"}:
+        return result.value
+    if result.kind == "error":
+        return {"kind": "error", "code": result.error_code or "#UNKNOWN!"}
+    return {"kind": result.kind, "value": result.value}
+
+
+def classify_shape_result(
+    app,
+    sht,
+    anchor_addr: str,
+    samples: List[str],
+    *,
+    displayed_text: DisplayedText,
+    app_evaluate: Callable[[Any], Callable[[str], Any]],
+    spill_shape: Callable[..., tuple[int, int]],
+) -> CaseResult:
+    """Records a spill as its shape plus the case's declared sample cells.
+
+    For results too large to materialise cell by cell. The shape comes from
+    the same non-invasive probe the cell walk uses; only the listed cells
+    are read.
+    """
+
+    rows, cols = spill_shape(app, sht.range(anchor_addr), max_cells=None)
+    evaluate = app_evaluate(app)
+    values = {
+        addr: array_cell_from_scalar(classify_value(sht.range(addr), evaluate, displayed_text)) for addr in samples
+    }
+    return CaseResult(id="", kind="array_shape", value=values, array_shape=[rows, cols])
+
+
+def classify_case_result(
+    app,
+    sht,
+    case: Dict[str, Any],
+    *,
+    shape_result: Callable[[Any, Any, str, List[str]], CaseResult],
+    result_cell: Callable[[Any, Any, str], CaseResult],
+) -> CaseResult:
+    """Reads one case's result in whichever capture mode it declares."""
+
+    anchor_addr = case_formula_cell(case)
+    samples = case_shape_samples(case)
+    if samples is not None:
+        return shape_result(app, sht, anchor_addr, samples)
+    return result_cell(app, sht, anchor_addr)
+
+
+def classify_result_cell(
+    app,
+    sht,
+    anchor_addr: str,
+    *,
+    displayed_text: DisplayedText,
+    app_evaluate: Callable[[Any], Callable[[str], Any]],
+    spill_shape: Callable[..., tuple[int, int]],
+) -> CaseResult:
+    """Classifies the anchor scalar or the full dynamic spill if present."""
+
+    shape = spill_shape(app, sht.range(anchor_addr))
+    rows, cols = shape
+    evaluate = app_evaluate(app)
+    if rows == 1 and cols == 1:
+        return classify_value(sht.range(anchor_addr), evaluate, displayed_text)
+    anchor = sht.range(anchor_addr)
+    flat: List[Any] = []
+    for r in range(rows):
+        for c in range(cols):
+            flat.append(array_cell_from_scalar(classify_value(anchor.offset(r, c), evaluate, displayed_text)))
+    return CaseResult(id="", kind="array", value=flat, array_shape=[rows, cols])
diff --git a/tools/oracle/drivers/macos_excel.py b/tools/oracle/drivers/macos_excel.py
index 7e1c6968e..0aa090229 100644
--- a/tools/oracle/drivers/macos_excel.py
+++ b/tools/oracle/drivers/macos_excel.py
@@ -37,22 +37,18 @@
 
 from __future__ import annotations
 
-import datetime as _dt
 import platform
 from typing import Any, Dict, List, Optional
 
-from ._locale import detect_locale_from_app, normalise_error_token
+from . import case_sheet, cell_result
+from ._locale import detect_locale_from_app
 from .base import (
-    _ERR_DISPLAY_NAMES,
     DEFAULT_FORMULA_CELL,
     MAX_CAPTURE_CELLS,
     CaseResult,
     EnvironmentInfo,
     OracleDriver,
-    _datetime_to_serial,
     case_formula_cell,
-    case_shape_samples,
-    is_empty_text_result,
     probe_spill_shape,
 )
 
@@ -208,157 +204,27 @@ def _cell_displayed_text(cell) -> Optional[str]:
     return None
 
 
-def _error_display_from_cell(cell) -> Optional[str]:
-    """Returns the tokenised Excel error name for `cell`, or None.
-
-    Walks four progressively weaker signals:
-      1. `xlwings.utils.CVErr` — ideal, but only surfaces on some Excel /
-         xlwings build pairs.
-      2. `cell.value` already a '#DIV/0!'-style string.
-      3. The displayed text (AppleScript `.text`) matches a known error.
-      4. `cell.value` is `None` AND the displayed text nonetheless starts
-         with `#`. This is the fallback Mac path where the Python layer
-         has coerced the error into `None`.
-    """
+# Shared helpers re-exported under the names this driver has always carried.
+_split_sheet_qualified_addr = case_sheet.split_sheet_qualified_addr
+_get_or_add_sheet = case_sheet.get_or_add_sheet
+_apply_merges = case_sheet.apply_merges
+_sanitize_sheet_name = case_sheet.sanitize_sheet_name
+_error_trigger = case_sheet.error_trigger
+_resolve_print_sheet = case_sheet.resolve_print_sheet
+_normalise_print_area = case_sheet.normalise_print_area
+_PRINT_ORIENTATIONS = case_sheet.PRINT_ORIENTATIONS
+_classify_python_scalar = cell_result.classify_python_scalar
+_array_cell_from_scalar = cell_result.array_cell_from_scalar
 
-    raw = cell.value
-    try:
-        from xlwings.utils import CVErr  # type: ignore
-
-        if isinstance(raw, CVErr):
-            s = str(raw)
-            if s in _ERR_DISPLAY_NAMES:
-                return s
-    except Exception:  # pragma: no cover - older xlwings without CVErr
-        pass
-
-    if isinstance(raw, str):
-        if raw in _ERR_DISPLAY_NAMES:
-            return raw
-        canon = normalise_error_token(raw)
-        if canon is not None:
-            return canon
-
-    text = _cell_displayed_text(cell)
-    if text in _ERR_DISPLAY_NAMES:
-        return text
-    # AppleScript `string_value` is locale-bound: de-DE returns "#WERT!",
-    # fr-FR "#VALEUR!", and so on. Normalise through the shared
-    # localisation map before falling back to the prefix heuristic.
-    if text:
-        canon = normalise_error_token(text)
-        if canon is not None:
-            return canon
-    # Last-ditch: match by prefix (`#DIV/0!...` in an ex-format-localised
-    # build, for example). All Excel errors start with `#` and end with
-    # `!` or `?`; we don't want to catch text that happens to start with
-    # '#'.
-    if text and text.startswith("#") and (text.endswith("!") or text.endswith("?") or text == "#N/A"):
-        for name in _ERR_DISPLAY_NAMES:
-            if text == name:
-                return name
-    return None
 
+def _error_display_from_cell(cell) -> Optional[str]:
+    return cell_result.error_display_from_cell(cell, _cell_displayed_text)
 
-def _classify_value(cell, evaluate) -> CaseResult:
-    """Converts an xlwings cell observation into a CaseResult.
 
-    The `cell.value` read happens once up front; subsequent checks may
-    consult the AppleScript `.text` fallback for Mac edge cases (error
-    cells, pre-1900 serials) where the Python-side value is lossy.
-    ``evaluate`` is the Application.Evaluate adapter used to resolve an
-    empty read-back into ``""`` or blank.
-    """
+def _classify_value(cell, evaluate) -> CaseResult:
+    """Classifies one cell; ``evaluate`` resolves an empty read-back to ``""`` or blank."""
 
-    err = _error_display_from_cell(cell)
-    if err is not None:
-        return CaseResult(id="", kind="error", error_code=err)
-
-    v = cell.value
-    # Datetime must come before bool/int because `datetime` is distinct
-    # from `int` in Python, but xlwings may return a `date` (no time) for
-    # pure DATE() results. Both use the shared 1900-system conversion so the
-    # golden carries a number kind (matching Formulon's Value::Number). The
-    # classifier has no workbook epoch metadata; 1904 cases should therefore
-    # expose date values through a numeric/boolean formula such as N(DATE()).
-    if isinstance(v, _dt.datetime):
-        return CaseResult(id="", kind="number", value=_datetime_to_serial(v))
-    if isinstance(v, _dt.date):  # pragma: no cover - xlwings mostly returns datetime
-        combined = _dt.datetime(v.year, v.month, v.day)
-        return CaseResult(id="", kind="number", value=_datetime_to_serial(combined))
-
-    if isinstance(v, bool):
-        return CaseResult(id="", kind="bool", value=bool(v))
-    if isinstance(v, (int, float)):
-        return CaseResult(id="", kind="number", value=float(v))
-
-    if v is None or v == "":
-        # Mac Excel can return None for pre-1900 serials (Python can't
-        # represent them as datetime). Inspect the displayed text and try
-        # to parse it as an integer serial before falling back to blank.
-        text = _cell_displayed_text(cell)
-        if text and text.strip():
-            # Trivial numeric fallback: some ja-JP date formats render
-            # as "1900/2/29" even though cell.value is None. Bail to
-            # blank here; the YAML case should be rewritten to force a
-            # non-date display if a serial is needed.
-            pass
-        if is_empty_text_result(evaluate, cell):
-            return CaseResult(id="", kind="text", value="")
-        return CaseResult(id="", kind="blank")
-
-    if isinstance(v, str):
-        return CaseResult(id="", kind="text", value=v)
-
-    if isinstance(v, list):
-        rows = len(v)
-        cols = 0
-        if rows > 0 and isinstance(v[0], list):
-            cols = len(v[0])
-            flat = [_array_cell_from_scalar(_classify_python_scalar(item)) for row in v for item in row]
-        else:
-            cols = rows
-            rows = 1
-            flat = [_array_cell_from_scalar(_classify_python_scalar(item)) for item in v]
-        return CaseResult(
-            id="",
-            kind="array",
-            value=flat,
-            array_shape=[rows, cols],
-        )
-    return CaseResult(id="", kind="text", value=str(v))
-
-
-def _classify_python_scalar(v: Any) -> CaseResult:
-    """Classifies a scalar value already extracted from an xlwings array."""
-
-    if isinstance(v, _dt.datetime):
-        return CaseResult(id="", kind="number", value=_datetime_to_serial(v))
-    if isinstance(v, _dt.date):  # pragma: no cover - xlwings mostly returns datetime
-        combined = _dt.datetime(v.year, v.month, v.day)
-        return CaseResult(id="", kind="number", value=_datetime_to_serial(combined))
-    if isinstance(v, bool):
-        return CaseResult(id="", kind="bool", value=bool(v))
-    if isinstance(v, (int, float)):
-        return CaseResult(id="", kind="number", value=float(v))
-    if v is None or v == "":
-        return CaseResult(id="", kind="blank")
-    if isinstance(v, str):
-        canon = normalise_error_token(v)
-        if canon is not None:
-            return CaseResult(id="", kind="error", error_code=canon)
-        return CaseResult(id="", kind="text", value=v)
-    return CaseResult(id="", kind="text", value=str(v))
-
-
-def _array_cell_from_scalar(result: CaseResult) -> Any:
-    if result.kind == "blank":
-        return None
-    if result.kind in {"number", "bool", "text"}:
-        return result.value
-    if result.kind == "error":
-        return {"kind": "error", "code": result.error_code or "#UNKNOWN!"}
-    return {"kind": result.kind, "value": result.value}
+    return cell_result.classify_value(cell, evaluate, _cell_displayed_text)
 
 
 def _app_evaluate(app):
@@ -374,43 +240,38 @@ def _evaluate_spill_shape(app, anchor, *, max_cells: Optional[int] = MAX_CAPTURE
 
 
 def _classify_shape_result(app, sht, anchor_addr: str, samples: List[str]) -> CaseResult:
-    """Records a spill as its shape plus the case's declared sample cells.
+    """Records a spill as its shape plus the case's declared sample cells."""
 
-    For results too large to materialise cell by cell. The shape comes from
-    the same non-invasive probe the cell walk uses; only the listed cells
-    are read.
-    """
-
-    rows, cols = _evaluate_spill_shape(app, sht.range(anchor_addr), max_cells=None)
-    evaluate = _app_evaluate(app)
-    values = {addr: _array_cell_from_scalar(_classify_value(sht.range(addr), evaluate)) for addr in samples}
-    return CaseResult(id="", kind="array_shape", value=values, array_shape=[rows, cols])
+    return cell_result.classify_shape_result(
+        app,
+        sht,
+        anchor_addr,
+        samples,
+        displayed_text=_cell_displayed_text,
+        app_evaluate=_app_evaluate,
+        spill_shape=_evaluate_spill_shape,
+    )
 
 
 def _classify_case_result(app, sht, case: Dict[str, Any]) -> CaseResult:
     """Reads one case's result in whichever capture mode it declares."""
 
-    anchor_addr = case_formula_cell(case)
-    samples = case_shape_samples(case)
-    if samples is not None:
-        return _classify_shape_result(app, sht, anchor_addr, samples)
-    return _classify_result_cell(app, sht, anchor_addr)
+    return cell_result.classify_case_result(
+        app, sht, case, shape_result=_classify_shape_result, result_cell=_classify_result_cell
+    )
 
 
 def _classify_result_cell(app, sht, anchor_addr: str = DEFAULT_FORMULA_CELL) -> CaseResult:
     """Classifies the anchor scalar or the full dynamic spill if present."""
 
-    shape = _evaluate_spill_shape(app, sht.range(anchor_addr))
-    rows, cols = shape
-    evaluate = _app_evaluate(app)
-    if rows == 1 and cols == 1:
-        return _classify_value(sht.range(anchor_addr), evaluate)
-    anchor = sht.range(anchor_addr)
-    flat: List[Any] = []
-    for r in range(rows):
-        for c in range(cols):
-            flat.append(_array_cell_from_scalar(_classify_value(anchor.offset(r, c), evaluate)))
-    return CaseResult(id="", kind="array", value=flat, array_shape=[rows, cols])
+    return cell_result.classify_result_cell(
+        app,
+        sht,
+        anchor_addr,
+        displayed_text=_cell_displayed_text,
+        app_evaluate=_app_evaluate,
+        spill_shape=_evaluate_spill_shape,
+    )
 
 
 class ExcelOracle(OracleDriver):
@@ -777,77 +638,6 @@ def _build_workbook_sheets(self, wb, case: Dict[str, Any]) -> None:
                 pass
 
 
-def _split_sheet_qualified_addr(key: str) -> "tuple[Optional[str], str]":
-    """Splits ``"Sheet2!A1"`` into ``("Sheet2", "A1")``; returns ``(None, key)``
-    for bare A1 keys. Mirrors the Windows driver helper -- see
-    ``windows_excel._split_sheet_qualified_addr`` for the quoting rules.
-    """
-
-    if "!" not in key:
-        return None, key
-    bang = key.rfind("!")
-    sheet_part = key[:bang]
-    addr_part = key[bang + 1 :]
-    if sheet_part.startswith("'") and sheet_part.endswith("'") and len(sheet_part) >= 2:
-        sheet_part = sheet_part[1:-1].replace("''", "'")
-    return sheet_part, addr_part
-
-
-def _get_or_add_sheet(wb, name: str):
-    """Returns the sheet whose display name matches ``name`` (case-insensitive),
-    adding it at the end if absent.
-    """
-
-    target = name.casefold()
-    for sht in wb.sheets:
-        if sht.name.casefold() == target:
-            return sht
-    return wb.sheets.add(name=name, after=wb.sheets[len(wb.sheets) - 1])
-
-
-# Excel `XlPageOrientation` constants.
-_XL_PORTRAIT = 1
-_XL_LANDSCAPE = 2
-
-_PRINT_ORIENTATIONS = {
-    "portrait": _XL_PORTRAIT,
-    "landscape": _XL_LANDSCAPE,
-}
-
-
-def _resolve_print_sheet(wb, print_spec: Dict[str, Any]):
-    """Returns the worksheet the `print` block names, or raises."""
-
-    sheet_name = print_spec.get("sheet")
-    if not isinstance(sheet_name, str) or not sheet_name:
-        raise RuntimeError("print block missing string 'sheet'")
-    target = sheet_name.casefold()
-    for sht in wb.sheets:
-        if sht.name.casefold() == target:
-            return sht
-    raise RuntimeError(f"print 'sheet' names an unknown sheet {sheet_name!r}")
-
-
-def _normalise_print_area(area: str) -> str:
-    """Strips ``$`` anchors and ``Sheet!`` qualifiers from a print area.
-
-    Mirrors the Windows driver helper -- the C++ engine compares against
-    a bare ``A1:H80`` form, so both drivers normalise identically.
-    """
-
-    out_parts: List[str] = []
-    for part in area.split(","):
-        token = part.strip()
-        if not token:
-            continue
-        bang = token.rfind("!")
-        if bang != -1:
-            token = token[bang + 1 :]
-        token = token.replace("$", "")
-        out_parts.append(token)
-    return ",".join(out_parts)
-
-
 def _apply_and_read_print(wb, print_spec: Dict[str, Any]) -> Dict[str, Any]:
     """Applies the declarative `print` block to ``wb`` and reads it back.
 
@@ -985,37 +775,5 @@ def _write_cell(sht, addr: str, rec: Dict[str, Any], *, context: str = "setup ce
     raise ValueError(f"unknown cell kind: {kind}")
 
 
-def _apply_merges(sht, merges: List[str]) -> None:
-    """Apply case-declared inclusive A1 merge ranges on ``sht``."""
-
-    for ref in merges:
-        sht.range(ref).merge()
-
-
 def _format_mac_error(exc: BaseException) -> str:
     return f"{type(exc).__name__}: {exc}"[:200]
-
-
-_SHEET_FORBIDDEN = set("\\/?*[]:")
-
-
-def _sanitize_sheet_name(name: str) -> str:
-    """Strips characters Excel disallows in sheet names and trims length."""
-
-    cleaned = "".join("_" if c in _SHEET_FORBIDDEN else c for c in name)
-    return cleaned[:24] or "case"
-
-
-_ERROR_TRIGGERS = {
-    "#DIV/0!": "=1/0",
-    "#NAME?": "=NONEXISTENT_FUNC()",
-    "#VALUE!": '=VALUE("x")',
-    "#NUM!": "=SQRT(-1)",
-    "#N/A": "=NA()",
-    "#REF!": "=OFFSET(A1,-1,-1)",  # relative moves out of range
-    "#NULL!": "=A1 B1",  # intersection with no overlap
-}
-
-
-def _error_trigger(code: str) -> str:
-    return _ERROR_TRIGGERS.get(code, '=VALUE("x")')
diff --git a/tools/oracle/drivers/windows_com.py b/tools/oracle/drivers/windows_com.py
new file mode 100644
index 000000000..738946978
--- /dev/null
+++ b/tools/oracle/drivers/windows_com.py
@@ -0,0 +1,133 @@
+"""Windows COM access primitives: displayed text, raw-cell adapter, error text.
+
+``xlwings`` on Windows is a thin layer over pywin32; these helpers cover the
+parts of the object model it does not wrap and the way COM failures surface.
+"""
+
+from __future__ import annotations
+
+from typing import Any, List, Optional
+
+
+def cell_displayed_text(cell) -> Optional[str]:
+    """Returns the rendered string of a cell via the COM bridge.
+
+    On Windows, ``cell.api.Text`` is the canonical property that yields
+    the displayed string (including ``'#DIV/0!'`` for errors whose
+    Python-side ``.value`` has been coerced to ``None``).
+
+    Why we don't try fallback property names here:
+      Excel's IDispatch is case-insensitive, so ``text`` resolves to the
+      same DISPID as ``Text`` and adds no coverage; ``DisplayValue`` is
+      a Chart.Axis property and is not present on Range; ``string_value``
+      is an xlwings *high-level* Range attribute, not a COM property.
+      Worse, an earlier defensive version of this function iterated over
+      a list that included the lowercase ``text``, and on Excel 16.0 /
+      M365 a getattr for the lowercase form triggered an apparent
+      infinite retry inside ``win32com``'s ``COMRetryObjectWrapper`` --
+      cells whose ``Text`` legitimately resolved to ``""`` (e.g. the
+      result of ``=ARRAYTOTEXT("")``) made the loop fall through to the
+      lowercase try, which never returned and burned Excel CPU at ~60%
+      indefinitely. We saw the run hang for 30+ minutes before
+      diagnosis. Sticking to the canonical ``Text`` property avoids the
+      whole pitfall.
+    """
+
+    try:
+        api = cell.api
+    except Exception:
+        return None
+    try:
+        val = api.Text
+    except Exception:
+        return None
+    if isinstance(val, str):
+        return val or None
+    return None
+
+
+class CellAdapter:
+    """Adapts a raw COM ``Range`` to the small surface ``classify_value``
+    expects (a ``.value`` attribute plus the COM passthrough used by the
+    error / displayed-text fallbacks).
+    """
+
+    def __init__(self, com_cell) -> None:
+        self.api = com_cell
+
+    @property
+    def value(self) -> Any:
+        return self.api.Value
+
+
+def format_com_error(exc: BaseException) -> str:
+    """Returns a one-line summary of a pywin32 / xlwings exception.
+
+    Includes the COM HRESULT and Excel's localised description when
+    present, so per-target divergence triage can match on the actual
+    failure (e.g. ``COM -2147352567: 例外が発生しました。``) rather
+    than a generic Python traceback. Falls back to ``repr(exc)`` for
+    non-COM exceptions.
+    """
+
+    try:
+        args = getattr(exc, "args", ()) or ()
+        if args and isinstance(args[0], int):
+            hresult = args[0]
+            descr = ""
+            if len(args) >= 2 and isinstance(args[1], str):
+                descr = args[1]
+            # pywin32 com_error.args = (hresult, source, excepinfo, argerr)
+            # excepinfo = (wcode, source, description, helpfile, helpcontext, scode)
+            # When the HRESULT is the generic DISP_E_EXCEPTION the real
+            # Excel error message lives in excepinfo[2], so pull it out.
+            extras: List[str] = []
+            if len(args) >= 3 and args[2] is not None:
+                info = args[2]
+                if isinstance(info, tuple) and len(info) >= 3:
+                    src = info[1] if isinstance(info[1], str) else ""
+                    info_descr = info[2] if isinstance(info[2], str) else ""
+                    scode = info[5] if len(info) >= 6 else None
+                    if info_descr.strip():
+                        extras.append(info_descr.strip())
+                    if src.strip():
+                        extras.append(f"source={src.strip()}")
+                    if isinstance(scode, int):
+                        extras.append(f"scode=0x{scode & 0xFFFFFFFF:08X}")
+            if extras:
+                descr = (descr + " -- " if descr else "") + "; ".join(extras)
+            return f"COM {hresult}: {descr}".strip().rstrip(":")
+    except Exception:
+        pass
+    return f"{type(exc).__name__}: {exc}"[:200]
+
+
+def com_scalar(owner, attr: str) -> Any:
+    """Reads one COM property, mapping an unavailable one to ``None``.
+
+    A property Excel does not expose on this host must not abort the
+    capture: the golden records `null` and the comparison skips that
+    field, which is honest about what was observed.
+    """
+
+    try:
+        return getattr(owner, attr)
+    except Exception:
+        return None
+
+
+def com_bool(owner, attr: str) -> Optional[bool]:
+    value = com_scalar(owner, attr)
+    return bool(value) if isinstance(value, bool) else None
+
+
+def com_int(owner, attr: str) -> Optional[int]:
+    value = com_scalar(owner, attr)
+    if isinstance(value, bool) or not isinstance(value, (int, float)):
+        return None
+    return int(value)
+
+
+def com_text(owner, attr: str) -> Optional[str]:
+    value = com_scalar(owner, attr)
+    return value if isinstance(value, str) else None
diff --git a/tools/oracle/drivers/windows_excel.py b/tools/oracle/drivers/windows_excel.py
index 82921aa14..edc240dfc 100644
--- a/tools/oracle/drivers/windows_excel.py
+++ b/tools/oracle/drivers/windows_excel.py
@@ -58,7 +58,6 @@
 from __future__ import annotations
 
 import base64
-import datetime as _dt
 import os
 import platform
 import shutil
@@ -68,18 +67,15 @@
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
-from ._locale import detect_locale_from_app, normalise_error_token
+from . import case_sheet, cell_result, windows_com, windows_page_setup, windows_pivot
+from ._locale import detect_locale_from_app
 from .base import (
-    _ERR_DISPLAY_NAMES,
     DEFAULT_FORMULA_CELL,
     MAX_CAPTURE_CELLS,
     CaseResult,
     EnvironmentInfo,
     OracleDriver,
-    _datetime_to_serial,
     case_formula_cell,
-    case_shape_samples,
-    is_empty_text_result,
     probe_spill_shape,
 )
 
@@ -107,182 +103,45 @@ def _ensure_windows() -> None:
         )
 
 
-def _cell_displayed_text(cell) -> Optional[str]:
-    """Returns the rendered string of a cell via the COM bridge.
-
-    On Windows, ``cell.api.Text`` is the canonical property that yields
-    the displayed string (including ``'#DIV/0!'`` for errors whose
-    Python-side ``.value`` has been coerced to ``None``).
-
-    Why we don't try fallback property names here:
-      Excel's IDispatch is case-insensitive, so ``text`` resolves to the
-      same DISPID as ``Text`` and adds no coverage; ``DisplayValue`` is
-      a Chart.Axis property and is not present on Range; ``string_value``
-      is an xlwings *high-level* Range attribute, not a COM property.
-      Worse, an earlier defensive version of this function iterated over
-      a list that included the lowercase ``text``, and on Excel 16.0 /
-      M365 a getattr for the lowercase form triggered an apparent
-      infinite retry inside ``win32com``'s ``COMRetryObjectWrapper`` --
-      cells whose ``Text`` legitimately resolved to ``""`` (e.g. the
-      result of ``=ARRAYTOTEXT("")``) made the loop fall through to the
-      lowercase try, which never returned and burned Excel CPU at ~60%
-      indefinitely. We saw the run hang for 30+ minutes before
-      diagnosis. Sticking to the canonical ``Text`` property avoids the
-      whole pitfall.
-    """
-
-    try:
-        api = cell.api
-    except Exception:
-        return None
-    try:
-        val = api.Text
-    except Exception:
-        return None
-    if isinstance(val, str):
-        return val or None
-    return None
+# Shared helpers re-exported under the names this driver has always carried.
+_cell_displayed_text = windows_com.cell_displayed_text
+_CellAdapter = windows_com.CellAdapter
+_format_com_error = windows_com.format_com_error
+_com_scalar = windows_com.com_scalar
+_com_bool = windows_com.com_bool
+_com_int = windows_com.com_int
+_com_text = windows_com.com_text
+_split_sheet_qualified_addr = case_sheet.split_sheet_qualified_addr
+_get_or_add_sheet = case_sheet.get_or_add_sheet
+_apply_merges = case_sheet.apply_merges
+_sanitize_sheet_name = case_sheet.sanitize_sheet_name
+_error_trigger = case_sheet.error_trigger
+_resolve_print_sheet = case_sheet.resolve_print_sheet
+_normalise_print_area = case_sheet.normalise_print_area
+_PRINT_ORIENTATIONS = case_sheet.PRINT_ORIENTATIONS
+_classify_python_scalar = cell_result.classify_python_scalar
+_array_cell_from_scalar = cell_result.array_cell_from_scalar
+_build_pivot_table = windows_pivot.build_pivot_table
+_run_formula_probes = windows_pivot.run_formula_probes
+_read_pivot_grid = windows_pivot.read_pivot_grid
+_split_a1 = windows_page_setup.split_a1
+_GEOMETRY_TRACK_CAP = windows_page_setup.GEOMETRY_TRACK_CAP
+_read_orientation_value = windows_page_setup.read_orientation_value
+_read_paper_value = windows_page_setup.read_paper_value
+_read_zoom_value = windows_page_setup.read_zoom_value
+_read_fit_value = windows_page_setup.read_fit_value
+_read_margins = windows_page_setup.read_margins
+_read_roundtrip = windows_page_setup.read_roundtrip
 
 
 def _error_display_from_cell(cell) -> Optional[str]:
-    """Returns the tokenised Excel error name for `cell`, or None.
-
-    Walks four progressively weaker signals:
-      1. ``xlwings.utils.CVErr`` -- ideal, but only surfaces on some
-         Excel / xlwings build pairs.
-      2. ``cell.value`` already a ``'#DIV/0!'``-style string.
-      3. The displayed text (COM ``.Text``) matches a known error.
-      4. ``cell.value`` is ``None`` AND the displayed text nonetheless
-         starts with ``#``. This is the fallback path where the Python
-         layer has coerced the error into ``None``.
-    """
-
-    raw = cell.value
-    try:
-        from xlwings.utils import CVErr  # type: ignore
-
-        if isinstance(raw, CVErr):
-            s = str(raw)
-            if s in _ERR_DISPLAY_NAMES:
-                return s
-    except Exception:  # pragma: no cover - older xlwings without CVErr
-        pass
-
-    if isinstance(raw, str):
-        if raw in _ERR_DISPLAY_NAMES:
-            return raw
-        # ja-JP / de-DE / fr-FR builds occasionally surface the localized
-        # token directly through cell.value (when the bridge has already
-        # decoded the CVErr to a string). Normalise here so the golden
-        # JSON always carries the canonical English form.
-        canon = normalise_error_token(raw)
-        if canon is not None:
-            return canon
-
-    text = _cell_displayed_text(cell)
-    if text in _ERR_DISPLAY_NAMES:
-        return text
-    # Range.Text is locale-bound: de-DE returns "#WERT!" for #VALUE!,
-    # fr-FR returns "#VALEUR!", and so on. Normalise through the shared
-    # localisation map before falling back to the prefix heuristic.
-    if text:
-        canon = normalise_error_token(text)
-        if canon is not None:
-            return canon
-    if text and text.startswith("#") and (text.endswith("!") or text.endswith("?") or text == "#N/A"):
-        for name in _ERR_DISPLAY_NAMES:
-            if text == name:
-                return name
-    return None
+    return cell_result.error_display_from_cell(cell, _cell_displayed_text)
 
 
 def _classify_value(cell, evaluate=None) -> CaseResult:
-    """Converts an xlwings cell observation into a CaseResult.
-
-    The ``cell.value`` read happens once up front; subsequent checks may
-    consult the COM ``.Text`` fallback for edge cases (error cells,
-    pre-1900 serials) where the Python-side value is lossy. ``evaluate`` is
-    the Application.Evaluate adapter that resolves an empty read-back into
-    ``""`` or blank; without it (raw COM cells in the workbook track) an
-    empty read-back stays blank.
-    """
+    """Classifies one cell; without ``evaluate`` an empty read-back stays blank."""
 
-    err = _error_display_from_cell(cell)
-    if err is not None:
-        return CaseResult(id="", kind="error", error_code=err)
-
-    v = cell.value
-    if isinstance(v, _dt.datetime):
-        return CaseResult(id="", kind="number", value=_datetime_to_serial(v))
-    if isinstance(v, _dt.date):  # pragma: no cover - xlwings mostly returns datetime
-        combined = _dt.datetime(v.year, v.month, v.day)
-        return CaseResult(id="", kind="number", value=_datetime_to_serial(combined))
-
-    if isinstance(v, bool):
-        return CaseResult(id="", kind="bool", value=bool(v))
-    if isinstance(v, (int, float)):
-        return CaseResult(id="", kind="number", value=float(v))
-
-    if v is None or v == "":
-        text = _cell_displayed_text(cell)
-        if text and text.strip():
-            pass
-        if evaluate is not None and is_empty_text_result(evaluate, cell):
-            return CaseResult(id="", kind="text", value="")
-        return CaseResult(id="", kind="blank")
-
-    if isinstance(v, str):
-        return CaseResult(id="", kind="text", value=v)
-
-    if isinstance(v, list):
-        rows = len(v)
-        cols = 0
-        if rows > 0 and isinstance(v[0], list):
-            cols = len(v[0])
-            flat = [_array_cell_from_scalar(_classify_python_scalar(item)) for row in v for item in row]
-        else:
-            cols = rows
-            rows = 1
-            flat = [_array_cell_from_scalar(_classify_python_scalar(item)) for item in v]
-        return CaseResult(
-            id="",
-            kind="array",
-            value=flat,
-            array_shape=[rows, cols],
-        )
-    return CaseResult(id="", kind="text", value=str(v))
-
-
-def _classify_python_scalar(v: Any) -> CaseResult:
-    """Classifies a scalar value already extracted from an xlwings array."""
-
-    if isinstance(v, _dt.datetime):
-        return CaseResult(id="", kind="number", value=_datetime_to_serial(v))
-    if isinstance(v, _dt.date):  # pragma: no cover - xlwings mostly returns datetime
-        combined = _dt.datetime(v.year, v.month, v.day)
-        return CaseResult(id="", kind="number", value=_datetime_to_serial(combined))
-    if isinstance(v, bool):
-        return CaseResult(id="", kind="bool", value=bool(v))
-    if isinstance(v, (int, float)):
-        return CaseResult(id="", kind="number", value=float(v))
-    if v is None or v == "":
-        return CaseResult(id="", kind="blank")
-    if isinstance(v, str):
-        canon = normalise_error_token(v)
-        if canon is not None:
-            return CaseResult(id="", kind="error", error_code=canon)
-        return CaseResult(id="", kind="text", value=v)
-    return CaseResult(id="", kind="text", value=str(v))
-
-
-def _array_cell_from_scalar(result: CaseResult) -> Any:
-    if result.kind == "blank":
-        return None
-    if result.kind in {"number", "bool", "text"}:
-        return result.value
-    if result.kind == "error":
-        return {"kind": "error", "code": result.error_code or "#UNKNOWN!"}
-    return {"kind": result.kind, "value": result.value}
+    return cell_result.classify_value(cell, evaluate, _cell_displayed_text)
 
 
 def _app_evaluate(app):
@@ -298,41 +157,38 @@ def _evaluate_spill_shape(app, anchor, *, max_cells: Optional[int] = MAX_CAPTURE
 
 
 def _classify_shape_result(app, sht, anchor_addr: str, samples: List[str]) -> CaseResult:
-    """Records a spill as its shape plus the case's declared sample cells.
-
-    Mirrors :func:`tools.oracle.drivers.macos_excel._classify_shape_result`.
-    """
-
-    rows, cols = _evaluate_spill_shape(app, sht.range(anchor_addr), max_cells=None)
-    evaluate = _app_evaluate(app)
-    values = {addr: _array_cell_from_scalar(_classify_value(sht.range(addr), evaluate)) for addr in samples}
-    return CaseResult(id="", kind="array_shape", value=values, array_shape=[rows, cols])
+    """Records a spill as its shape plus the case's declared sample cells."""
+
+    return cell_result.classify_shape_result(
+        app,
+        sht,
+        anchor_addr,
+        samples,
+        displayed_text=_cell_displayed_text,
+        app_evaluate=_app_evaluate,
+        spill_shape=_evaluate_spill_shape,
+    )
 
 
 def _classify_case_result(app, sht, case: Dict[str, Any]) -> CaseResult:
     """Reads one case's result in whichever capture mode it declares."""
 
-    anchor_addr = case_formula_cell(case)
-    samples = case_shape_samples(case)
-    if samples is not None:
-        return _classify_shape_result(app, sht, anchor_addr, samples)
-    return _classify_result_cell(app, sht, anchor_addr)
+    return cell_result.classify_case_result(
+        app, sht, case, shape_result=_classify_shape_result, result_cell=_classify_result_cell
+    )
 
 
 def _classify_result_cell(app, sht, anchor_addr: str = DEFAULT_FORMULA_CELL) -> CaseResult:
     """Classifies the anchor scalar or the full dynamic spill if present."""
 
-    shape = _evaluate_spill_shape(app, sht.range(anchor_addr))
-    rows, cols = shape
-    evaluate = _app_evaluate(app)
-    if rows == 1 and cols == 1:
-        return _classify_value(sht.range(anchor_addr), evaluate)
-    anchor = sht.range(anchor_addr)
-    flat: List[Any] = []
-    for r in range(rows):
-        for c in range(cols):
-            flat.append(_array_cell_from_scalar(_classify_value(anchor.offset(r, c), evaluate)))
-    return CaseResult(id="", kind="array", value=flat, array_shape=[rows, cols])
+    return cell_result.classify_result_cell(
+        app,
+        sht,
+        anchor_addr,
+        displayed_text=_cell_displayed_text,
+        app_evaluate=_app_evaluate,
+        spill_shape=_evaluate_spill_shape,
+    )
 
 
 # Names the printer whose driver metrics Excel paginates against; see
@@ -992,41 +848,6 @@ def _apply_axis_size(sheet, axis: str, key: str, size: float) -> None:
         )
 
 
-def _split_sheet_qualified_addr(key: str) -> "tuple[Optional[str], str]":
-    """Splits a setup-key like ``"Sheet2!A1"`` into ``(sheet, a1)``.
-
-    Returns ``(None, key)`` when the key is a bare A1 address (no ``!``).
-    Single-quoted sheet names are unquoted: ``"'Sheet One'!A1"`` ->
-    ``("Sheet One", "A1")``. Escaped quotes (``''`` inside a quoted
-    name) collapse to a single quote per Excel's convention. The split
-    is on the LAST ``!`` so a future stray ``!`` inside a quoted sheet
-    name does not confuse it.
-    """
-
-    if "!" not in key:
-        return None, key
-    bang = key.rfind("!")
-    sheet_part = key[:bang]
-    addr_part = key[bang + 1 :]
-    if sheet_part.startswith("'") and sheet_part.endswith("'") and len(sheet_part) >= 2:
-        sheet_part = sheet_part[1:-1].replace("''", "'")
-    return sheet_part, addr_part
-
-
-def _get_or_add_sheet(wb, name: str):
-    """Returns the sheet whose display name matches ``name`` (case-insensitive),
-    adding it at the end if absent. The xlwings ``books.Sheets`` collection
-    is itself case-insensitive on lookup, but we surface that behavior
-    explicitly here for clarity.
-    """
-
-    target = name.casefold()
-    for sht in wb.sheets:
-        if sht.name.casefold() == target:
-            return sht
-    return wb.sheets.add(name=name, after=wb.sheets[len(wb.sheets) - 1])
-
-
 def _write_cell(sht, addr: str, rec: Dict[str, Any]) -> None:
     """Writes one normalised {kind, value} record to ``sht!addr``."""
 
@@ -1070,219 +891,6 @@ def _write_cell(sht, addr: str, rec: Dict[str, Any]) -> None:
     raise ValueError(f"unknown cell kind: {kind}")
 
 
-def _apply_merges(sht, merges: List[str]) -> None:
-    """Apply case-declared inclusive A1 merge ranges on ``sht``."""
-
-    for ref in merges:
-        sht.range(ref).merge()
-
-
-# Excel `XlConsolidationFunction` constants, keyed by the declarative
-# `agg` name. Mirrors the `Aggregation` enum the C++ builder accepts.
-# Numeric values are the documented Office automation constants so the
-# driver does not depend on the `win32com` constant cache being warm.
-_XL_CONSOLIDATION = {
-    "Sum": -4157,
-    "Count": -4112,
-    "Average": -4106,
-    "Max": -4136,
-    "Min": -4139,
-    "Product": -4149,
-    "CountNumbers": -4113,
-    "StdDev": -4155,
-    "StdDevP": -4156,
-    "Var": -4164,
-    "VarP": -4165,
-}
-
-# Excel `XlPivotFieldOrientation` constants.
-_XL_ORIENT_ROW = 1
-_XL_ORIENT_COLUMN = 2
-_XL_ORIENT_PAGE = 3
-_XL_ORIENT_DATA = 4
-
-# Excel `XlPivotTableSourceType.xlDatabase`.
-_XL_DATABASE = 1
-
-# Excel `XlLayoutRowType` values for `RowAxisLayout`.
-_XL_COMPACT_ROW = 0
-_XL_TABULAR_ROW = 1
-_XL_OUTLINE_ROW = 2
-
-_PIVOT_LAYOUT_MODES = {
-    "Compact": _XL_COMPACT_ROW,
-    "Tabular": _XL_TABULAR_ROW,
-    "Outline": _XL_OUTLINE_ROW,
-}
-
-
-def _build_pivot_table(wb, pivot_spec: Dict[str, Any]):
-    """Creates a PivotTable in ``wb`` from a declarative ``pivot`` block.
-
-    Returns the materialised ``PivotTable`` COM object. The caller reads
-    ``TableRange2`` for the rendered grid and may then run post-build
-    formula probes. The ``pivot`` block shape is documented on
-    ``tests/oracle/workbook_builder.h``.
-    """
-
-    source = pivot_spec.get("source")
-    anchor = pivot_spec.get("anchor")
-    if not isinstance(source, str) or not source:
-        raise RuntimeError("pivot block missing string 'source'")
-    if not isinstance(anchor, str) or not anchor:
-        raise RuntimeError("pivot block missing string 'anchor'")
-
-    # Resolve the declarative anchor "Report!A1" to the destination
-    # cell's COM Range, since CreatePivotTable accepts a Range here and
-    # the string form has the same fully-qualified requirement as
-    # SourceData. We also drive the source resolution through a Range
-    # object so PivotCaches.Create does not have to parse the address
-    # itself.
-    src_sheet_name, src_addr = _split_sheet_qualified_addr(source)
-    anchor_sheet_name, anchor_addr = _split_sheet_qualified_addr(anchor)
-    if src_sheet_name is None:
-        raise RuntimeError(f"pivot source must be sheet-qualified (e.g. 'Data!A1:C13'); got {source!r}")
-    if anchor_sheet_name is None:
-        raise RuntimeError(f"pivot anchor must be sheet-qualified (e.g. 'Report!A1'); got {anchor!r}")
-
-    def _find_sheet(name: str):
-        for sht in wb.sheets:
-            if sht.name.casefold() == name.casefold():
-                return sht
-        return None
-
-    src_sheet = _find_sheet(src_sheet_name)
-    anchor_sheet = _find_sheet(anchor_sheet_name)
-    if src_sheet is None:
-        raise RuntimeError(f"pivot source references unknown sheet {src_sheet_name!r}")
-    if anchor_sheet is None:
-        raise RuntimeError(f"pivot anchor references unknown sheet {anchor_sheet_name!r}")
-
-    source_range_api = src_sheet.range(src_addr).api
-    anchor_range_api = anchor_sheet.range(anchor_addr).api
-
-    # Activate the anchor sheet so CreatePivotTable's destination is on
-    # the active sheet -- some Excel builds reject creating a pivot
-    # whose destination is on an inactive sheet with E_INVALIDARG.
-    try:
-        anchor_sheet.activate()
-    except Exception:
-        pass
-
-    api = wb.api
-    cache = api.PivotCaches().Create(_XL_DATABASE, source_range_api)
-    pivot = cache.CreatePivotTable(anchor_range_api, "FormulonPivot")
-
-    for field_name in pivot_spec.get("row_fields") or []:
-        pivot.PivotFields(field_name).Orientation = _XL_ORIENT_ROW
-    for field_name in pivot_spec.get("col_fields") or []:
-        pivot.PivotFields(field_name).Orientation = _XL_ORIENT_COLUMN
-    for field_name in pivot_spec.get("page_fields") or []:
-        pivot.PivotFields(field_name).Orientation = _XL_ORIENT_PAGE
-
-    for data_field in pivot_spec.get("data_fields") or []:
-        field_name = data_field.get("field")
-        agg = data_field.get("agg", "Sum")
-        consolidation = _XL_CONSOLIDATION.get(agg)
-        if consolidation is None:
-            raise RuntimeError(f"unknown aggregation {agg!r}")
-        field = pivot.PivotFields(field_name)
-        field.Orientation = _XL_ORIENT_DATA
-        field.Function = consolidation
-
-    # Manual item filters: hide the named items on their field.
-    for filter_spec in pivot_spec.get("filters") or []:
-        field_name = filter_spec.get("field")
-        for item_name in filter_spec.get("hide") or []:
-            try:
-                pivot.PivotFields(field_name).PivotItems(item_name).Visible = False
-            except Exception:
-                pass
-
-    layout = pivot_spec.get("layout")
-    if isinstance(layout, str) and layout in _PIVOT_LAYOUT_MODES:
-        try:
-            pivot.RowAxisLayout(_PIVOT_LAYOUT_MODES[layout])
-        except Exception:
-            pass
-
-    grand = pivot_spec.get("grand_totals") or {}
-    if isinstance(grand, dict):
-        if "rows" in grand:
-            pivot.RowGrand = bool(grand["rows"])
-        if "cols" in grand:
-            pivot.ColumnGrand = bool(grand["cols"])
-
-    pivot.RefreshTable()
-    return pivot
-
-
-def _run_formula_probes(wb, probes: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
-    """Write and read post-build formulas against a materialised PivotTable.
-
-    Formula probes are intentionally evaluated only after ``RefreshTable``.
-    A rendered PivotTable grid cannot exercise GETPIVOTDATA's page/data-axis
-    routing, whereas a formula cell can.  The result shape matches the
-    scalar grid records: ``{"kind": ..., "value": ...}`` or
-    ``{"kind": "error", "code": "#REF!"}``.
-    """
-
-    if not isinstance(probes, list) or not probes:
-        return []
-    out: List[Dict[str, Any]] = []
-    for probe in probes:
-        if not isinstance(probe, dict):
-            raise RuntimeError("pivot formula_probes entries must be objects")
-        probe_id = probe.get("id")
-        cell_ref = probe.get("cell")
-        formula = probe.get("formula")
-        if not isinstance(probe_id, str) or not probe_id:
-            raise RuntimeError("pivot formula probe missing string 'id'")
-        if not isinstance(cell_ref, str) or "!" not in cell_ref:
-            raise RuntimeError(f"formula probe {probe_id!r} needs sheet-qualified cell")
-        if not isinstance(formula, str) or not formula:
-            raise RuntimeError(f"formula probe {probe_id!r} missing string 'formula'")
-        sheet_name, bare_addr = _split_sheet_qualified_addr(cell_ref)
-        target = None
-        for sht in wb.sheets:
-            if sht.name.casefold() == sheet_name.casefold():
-                target = sht
-                break
-        if target is None:
-            raise RuntimeError(f"formula probe {probe_id!r} references unknown sheet {sheet_name!r}")
-        result_cell = target.range(bare_addr)
-        try:
-            result_cell.formula2 = formula
-        except Exception:
-            result_cell.formula = formula
-
-    try:
-        wb.app.calculate()
-    except Exception as exc:
-        # Do not silently emit stale values from a prior probe. A formula
-        # result such as #REF! is a normal cell value and does not raise here;
-        # a COM calculation failure is a driver failure and must be visible.
-        raise RuntimeError(f"Excel failed to calculate formula probes: {_format_com_error(exc)}") from exc
-
-    for probe in probes:
-        sheet_name, bare_addr = _split_sheet_qualified_addr(probe["cell"])
-        target = next(sht for sht in wb.sheets if sht.name.casefold() == sheet_name.casefold())
-        result = _classify_value(_CellAdapter(target.range(bare_addr).api))
-        out.append({"id": probe["id"], "cell": probe["cell"], "result": _grid_value_record(result)})
-    return out
-
-
-# Excel `XlPageOrientation` constants.
-_XL_PORTRAIT = 1
-_XL_LANDSCAPE = 2
-
-_PRINT_ORIENTATIONS = {
-    "portrait": _XL_PORTRAIT,
-    "landscape": _XL_LANDSCAPE,
-}
-
-_PRINT_ORIENTATION_NAMES = {value: name for name, value in _PRINT_ORIENTATIONS.items()}
-
 # `GET.DOCUMENT(50)` is the Excel-4 macro that returns the page count;
 # used as a fallback when `PageSetup.Pages.Count` is unavailable.
 _GET_DOCUMENT_PAGE_COUNT = 50
@@ -1298,11 +906,6 @@ def _run_formula_probes(wb, probes: List[Dict[str, Any]]) -> List[Dict[str, Any]
 # the break read independent of which case came before.
 _XL_PAGE_BREAK_PREVIEW_ZOOM = 60
 
-# Excel COM reports `PageSetup.LeftMargin` etc. in points (72 pt = 1
-# inch). The Formulon `PageMargins` struct works in inches, so we
-# divide on read.
-_POINTS_PER_INCH = 72.0
-
 
 # How many times a case's pagination is read before the capture gives up
 # on it settling. Two consecutive agreeing reads end the loop, so a stable
@@ -1406,19 +1009,6 @@ def _read_pagination_settled(ws, page_setup, wb) -> Tuple[List[int], List[int],
     )
 
 
-def _resolve_print_sheet(wb, print_spec: Dict[str, Any]):
-    """Returns the worksheet the `print` block names, or raises."""
-
-    sheet_name = print_spec.get("sheet")
-    if not isinstance(sheet_name, str) or not sheet_name:
-        raise RuntimeError("print block missing string 'sheet'")
-    target = sheet_name.casefold()
-    for sht in wb.sheets:
-        if sht.name.casefold() == target:
-            return sht
-    raise RuntimeError(f"print 'sheet' names an unknown sheet {sheet_name!r}")
-
-
 def _apply_and_read_print(wb, print_spec: Dict[str, Any]) -> Dict[str, Any]:
     """Applies the declarative `print` block to ``wb`` and reads the result.
 
@@ -1680,416 +1270,6 @@ def points(getter) -> Any:
     return out
 
 
-# A whole-column print area would otherwise issue 16,384 COM round trips
-# for a diagnostic nobody asserts.
-_GEOMETRY_TRACK_CAP = 64
-
-
-def _split_a1(addr: str) -> Tuple[int, int]:
-    """Splits a bare A1 address into 1-based (row, column) COM indices."""
-
-    addr = addr.replace("$", "")
-    i = 0
-    while i < len(addr) and addr[i].isalpha():
-        i += 1
-    col = 0
-    for ch in addr[:i]:
-        col = col * 26 + (ord(ch.upper()) - ord("A") + 1)
-    return int(addr[i:]), col
-
-
-def _read_orientation_value(page_setup) -> Any:
-    """Returns the post-apply Orientation as `"portrait"` / `"landscape"`.
-
-    Load-bearing rather than cosmetic: the pagination read can answer from
-    a page geometry the case never asked for (a portrait case coming back
-    with the preceding landscape case's breaks), and without the applied
-    orientation beside the breaks that is indistinguishable from Excel
-    genuinely disagreeing with the C++ paginator. An unreadable or
-    unrecognised value is reported as-is rather than guessed at.
-    """
-
-    try:
-        value = int(page_setup.Orientation)
-    except Exception:
-        return None
-    return _PRINT_ORIENTATION_NAMES.get(value, value)
-
-
-def _read_paper_value(page_setup) -> Any:
-    """Returns the post-apply `PaperSize` as the `XlPaperSize` int.
-
-    The companion to the orientation read: paper and orientation together
-    are what fix the page the breaks were measured on.
-    """
-
-    try:
-        return int(page_setup.PaperSize)
-    except Exception:
-        return None
-
-
-def _read_zoom_value(page_setup) -> Any:
-    """Returns the post-apply Zoom: int percent, or `False` when Fit-active.
-
-    Excel's COM ``PageSetup.Zoom`` is ``False`` when "Fit to" pagination
-    is engaged, else an integer percent (10..400). Boolean is checked
-    before numeric because Python's ``isinstance(False, int)`` is True.
-    """
-
-    try:
-        val = page_setup.Zoom
-    except Exception:
-        return None
-    if isinstance(val, bool):
-        return False if val is False else True
-    if isinstance(val, (int, float)):
-        return int(val)
-    return None
-
-
-def _read_fit_value(page_setup, name: str) -> Any:
-    """Returns the post-apply ``FitToPagesWide/Tall``: int or False (auto).
-
-    Excel returns ``False`` for the "auto" / unset axis and an integer
-    (1..32767) when constrained. Same bool-before-int ordering applies
-    as for Zoom.
-    """
-
-    try:
-        val = getattr(page_setup, name)
-    except Exception:
-        return None
-    if isinstance(val, bool):
-        return False
-    if isinstance(val, (int, float)):
-        return int(val)
-    return None
-
-
-_MARGIN_ATTRS = (
-    ("left", "LeftMargin"),
-    ("right", "RightMargin"),
-    ("top", "TopMargin"),
-    ("bottom", "BottomMargin"),
-    ("header", "HeaderMargin"),
-    ("footer", "FooterMargin"),
-)
-
-
-def _read_margins(page_setup) -> Dict[str, Any]:
-    """Returns the post-apply page margins in inches.
-
-    Excel's COM `PageSetup.{Left,Right,Top,Bottom,Header,Footer}Margin`
-    are points; we divide by 72 so the golden surfaces inches (matching
-    Formulon's `PageMargins` struct and OOXML's <pageMargins> tag, which
-    are both inch-denominated). The body-height calibration hunt in the
-    print_matrix follow-up needs these values to distinguish "Excel
-    applied the OOXML defaults" from "Excel applied a workbook-template
-    preset that we never asked for".
-    """
-
-    out: Dict[str, Any] = {}
-    for key, attr in _MARGIN_ATTRS:
-        try:
-            val = getattr(page_setup, attr)
-        except Exception:
-            out[key] = None
-            continue
-        if isinstance(val, (int, float)) and not isinstance(val, bool):
-            out[key] = round(float(val) / _POINTS_PER_INCH, 6)
-        else:
-            out[key] = None
-    return out
-
-
-# `XlPageBreak`. A manual break authored into the file must read back as
-# manual; one that degraded to automatic means Excel discarded the
-# `<rowBreaks man="1">` we wrote and re-derived the break itself.
-_XL_PAGE_BREAK_MANUAL = -4135
-
-# The header/footer sections Excel exposes per page class, in the order
-# OOXML concatenates them into one string (`&L...&C...&R...`).
-_HEADER_FOOTER_POSITIONS = ("Left", "Center", "Right")
-
-# `PageSetup.<name>` for the odd/primary pages, and the `Page` object
-# carrying the same three positions for the even and first-page classes.
-_HEADER_FOOTER_CLASSES = (
-    ("odd", None),
-    ("even", "EvenPage"),
-    ("first", "FirstPage"),
-)
-
-
-def _com_scalar(owner, attr: str) -> Any:
-    """Reads one COM property, mapping an unavailable one to ``None``.
-
-    A property Excel does not expose on this host must not abort the
-    capture: the golden records `null` and the comparison skips that
-    field, which is honest about what was observed.
-    """
-
-    try:
-        return getattr(owner, attr)
-    except Exception:
-        return None
-
-
-def _com_bool(owner, attr: str) -> Optional[bool]:
-    value = _com_scalar(owner, attr)
-    return bool(value) if isinstance(value, bool) else None
-
-
-def _com_int(owner, attr: str) -> Optional[int]:
-    value = _com_scalar(owner, attr)
-    if isinstance(value, bool) or not isinstance(value, (int, float)):
-        return None
-    return int(value)
-
-
-def _com_text(owner, attr: str) -> Optional[str]:
-    value = _com_scalar(owner, attr)
-    return value if isinstance(value, str) else None
-
-
-def _read_header_footer(page_setup) -> Dict[str, Any]:
-    """Reads the six header/footer sections as Excel reports them.
-
-    OOXML stores one string per section with `&L` / `&C` / `&R` markers
-    inside it; COM splits the same content across three properties. The
-    golden records the split form, because that is what Excel actually
-    parsed the string into -- collapsing it back would hide a case where
-    Excel put our text in the wrong third.
-    """
-
-    out: Dict[str, Any] = {
-        "different_odd_even": _com_bool(page_setup, "OddAndEvenPagesHeaderFooter"),
-        "different_first": _com_bool(page_setup, "DifferentFirstPageHeaderFooter"),
-        "scale_with_doc": _com_bool(page_setup, "ScaleWithDocHeaderFooter"),
-        "align_with_margins": _com_bool(page_setup, "AlignMarginsHeaderFooter"),
-    }
-    for class_name, page_attr in _HEADER_FOOTER_CLASSES:
-        owner = page_setup if page_attr is None else _com_scalar(page_setup, page_attr)
-        for band in ("Header", "Footer"):
-            for position in _HEADER_FOOTER_POSITIONS:
-                key = f"{class_name}_{band.lower()}_{position.lower()}"
-                if owner is None:
-                    out[key] = None
-                    continue
-                if page_attr is None:
-                    # The odd/primary sections are plain strings on
-                    # `PageSetup` itself.
-                    out[key] = _com_text(owner, f"{position}{band}")
-                    continue
-                section = _com_scalar(owner, f"{position}{band}")
-                out[key] = None if section is None else _com_text(section, "Text")
-    return out
-
-
-def _read_manual_breaks(ws) -> Dict[str, List[int]]:
-    """Returns the manual row / column breaks as zero-based indices.
-
-    Automatic breaks are filtered out: an authored break that Excel
-    re-derived rather than honoured is the failure this case exists to
-    catch, and keeping both kinds in one list would let a coincidental
-    automatic break at the same position mask it.
-    """
-
-    rows: List[int] = []
-    try:
-        for i in range(1, int(ws.api.HPageBreaks.Count) + 1):
-            brk = ws.api.HPageBreaks(i)
-            if _com_int(brk, "Type") == _XL_PAGE_BREAK_MANUAL:
-                rows.append(int(brk.Location.Row) - 1)
-    except Exception:
-        pass
-    cols: List[int] = []
-    try:
-        for i in range(1, int(ws.api.VPageBreaks.Count) + 1):
-            brk = ws.api.VPageBreaks(i)
-            if _com_int(brk, "Type") == _XL_PAGE_BREAK_MANUAL:
-                cols.append(int(brk.Location.Column) - 1)
-    except Exception:
-        pass
-    rows.sort()
-    cols.sort()
-    return {"manual_row_breaks": rows, "manual_col_breaks": cols}
-
-
-def _read_roundtrip(sht) -> Dict[str, Any]:
-    """Reads every print setting Excel resolved from an opened workbook."""
-
-    page_setup = sht.api.PageSetup
-    print_area = _com_text(page_setup, "PrintArea") or ""
-    title_rows = _com_text(page_setup, "PrintTitleRows") or ""
-    title_cols = _com_text(page_setup, "PrintTitleColumns") or ""
-
-    observed: Dict[str, Any] = {
-        "page_setup": {
-            "paper_size": _com_int(page_setup, "PaperSize"),
-            "orientation": _com_int(page_setup, "Orientation"),
-            "zoom": _read_zoom_value(page_setup),
-            "fit_to_pages_wide": _read_fit_value(page_setup, "FitToPagesWide"),
-            "fit_to_pages_tall": _read_fit_value(page_setup, "FitToPagesTall"),
-        },
-        "page_margins": _read_margins(page_setup),
-        "print_options": {
-            "grid_lines": _com_bool(page_setup, "PrintGridlines"),
-            "headings": _com_bool(page_setup, "PrintHeadings"),
-            "horizontal_centered": _com_bool(page_setup, "CenterHorizontally"),
-            "vertical_centered": _com_bool(page_setup, "CenterVertically"),
-        },
-        "header_footer": _read_header_footer(page_setup),
-        "print_area": _normalise_print_area(print_area),
-        "print_title_rows": _normalise_print_area(title_rows),
-        "print_title_cols": _normalise_print_area(title_cols),
-    }
-    observed.update(_read_manual_breaks(sht))
-    return observed
-
-
-def _normalise_print_area(area: str) -> str:
-    """Strips ``$`` anchors and ``Sheet!`` qualifiers from a print area.
-
-    Excel reports ``PrintArea`` fully qualified and anchored
-    (``Sheet1!$A$1:$H$80``); the C++ engine compares against a bare
-    ``A1:H80`` form, so both sides normalise the same way.
-    """
-
-    out_parts: List[str] = []
-    for part in area.split(","):
-        token = part.strip()
-        if not token:
-            continue
-        bang = token.rfind("!")
-        if bang != -1:
-            token = token[bang + 1 :]
-        token = token.replace("$", "")
-        out_parts.append(token)
-    return ",".join(out_parts)
-
-
-def _read_pivot_grid(wb, table_range) -> "tuple[List[Dict[str, Any]], int, int]":
-    """Reads every cell of ``table_range`` into an anchor-relative grid.
-
-    Returns ``(grid, rows, cols)`` where ``grid`` is a list of
-    ``{"r", "c", "value"}`` records (``r`` / ``c`` are 0-based offsets
-    from the pivot anchor) and ``value`` is the normalised ``{kind,
-    value}`` record produced by ``_classify_value``.
-    """
-
-    rows = int(table_range.Rows.Count)
-    cols = int(table_range.Columns.Count)
-    top = int(table_range.Row)
-    left = int(table_range.Column)
-    sht = table_range.Worksheet
-
-    grid: List[Dict[str, Any]] = []
-    for r in range(rows):
-        for c in range(cols):
-            com_cell = sht.Cells(top + r, left + c)
-            result = _classify_value(_CellAdapter(com_cell))
-            grid.append(
-                {
-                    "r": r,
-                    "c": c,
-                    "value": _grid_value_record(result),
-                }
-            )
-    return grid, rows, cols
-
-
-def _grid_value_record(result: CaseResult) -> Dict[str, Any]:
-    """Shapes a ``CaseResult`` into the golden grid's ``{kind, value}``."""
-
-    if result.kind == "blank":
-        return {"kind": "blank"}
-    if result.kind == "error":
-        return {"kind": "error", "code": result.error_code or "#UNKNOWN!"}
-    return {"kind": result.kind, "value": result.value}
-
-
-class _CellAdapter:
-    """Adapts a raw COM ``Range`` to the small surface ``_classify_value``
-    expects (a ``.value`` attribute plus the COM passthrough used by the
-    error / displayed-text fallbacks).
-    """
-
-    def __init__(self, com_cell) -> None:
-        self.api = com_cell
-
-    @property
-    def value(self) -> Any:
-        return self.api.Value
-
-
-def _format_com_error(exc: BaseException) -> str:
-    """Returns a one-line summary of a pywin32 / xlwings exception.
-
-    Includes the COM HRESULT and Excel's localised description when
-    present, so per-target divergence triage can match on the actual
-    failure (e.g. ``COM -2147352567: 例外が発生しました。``) rather
-    than a generic Python traceback. Falls back to ``repr(exc)`` for
-    non-COM exceptions.
-    """
-
-    try:
-        args = getattr(exc, "args", ()) or ()
-        if args and isinstance(args[0], int):
-            hresult = args[0]
-            descr = ""
-            if len(args) >= 2 and isinstance(args[1], str):
-                descr = args[1]
-            # pywin32 com_error.args = (hresult, source, excepinfo, argerr)
-            # excepinfo = (wcode, source, description, helpfile, helpcontext, scode)
-            # When the HRESULT is the generic DISP_E_EXCEPTION the real
-            # Excel error message lives in excepinfo[2], so pull it out.
-            extras: List[str] = []
-            if len(args) >= 3 and args[2] is not None:
-                info = args[2]
-                if isinstance(info, tuple) and len(info) >= 3:
-                    src = info[1] if isinstance(info[1], str) else ""
-                    info_descr = info[2] if isinstance(info[2], str) else ""
-                    scode = info[5] if len(info) >= 6 else None
-                    if info_descr.strip():
-                        extras.append(info_descr.strip())
-                    if src.strip():
-                        extras.append(f"source={src.strip()}")
-                    if isinstance(scode, int):
-                        extras.append(f"scode=0x{scode & 0xFFFFFFFF:08X}")
-            if extras:
-                descr = (descr + " -- " if descr else "") + "; ".join(extras)
-            return f"COM {hresult}: {descr}".strip().rstrip(":")
-    except Exception:
-        pass
-    return f"{type(exc).__name__}: {exc}"[:200]
-
-
-_SHEET_FORBIDDEN = set("\\/?*[]:")
-
-
-def _sanitize_sheet_name(name: str) -> str:
-    """Strips characters Excel disallows in sheet names and trims length."""
-
-    cleaned = "".join("_" if c in _SHEET_FORBIDDEN else c for c in name)
-    return cleaned[:24] or "case"
-
-
-_ERROR_TRIGGERS = {
-    "#DIV/0!": "=1/0",
-    "#NAME?": "=NONEXISTENT_FUNC()",
-    "#VALUE!": '=VALUE("x")',
-    "#NUM!": "=SQRT(-1)",
-    "#N/A": "=NA()",
-    "#REF!": "=OFFSET(A1,-1,-1)",
-    "#NULL!": "=A1 B1",
-}
-
-
-def _error_trigger(code: str) -> str:
-    return _ERROR_TRIGGERS.get(code, '=VALUE("x")')
-
-
 def _env_to_json(env: EnvironmentInfo) -> Dict[str, Any]:
     return {
         "excel_version": env.excel_version,
diff --git a/tools/oracle/drivers/windows_page_setup.py b/tools/oracle/drivers/windows_page_setup.py
new file mode 100644
index 000000000..992f49471
--- /dev/null
+++ b/tools/oracle/drivers/windows_page_setup.py
@@ -0,0 +1,255 @@
+"""PageSetup readers: what Excel resolved for a sheet's print settings.
+
+Each reader maps an unavailable COM property to ``None`` so the golden records
+what was observed rather than aborting the capture.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Tuple
+
+from .case_sheet import PRINT_ORIENTATIONS, normalise_print_area
+from .windows_com import com_bool, com_int, com_scalar, com_text
+
+_PRINT_ORIENTATION_NAMES = {value: name for name, value in PRINT_ORIENTATIONS.items()}
+
+# Excel COM reports `PageSetup.LeftMargin` etc. in points (72 pt = 1
+# inch). The Formulon `PageMargins` struct works in inches, so we
+# divide on read.
+_POINTS_PER_INCH = 72.0
+
+# A whole-column print area would otherwise issue 16,384 COM round trips
+# for a diagnostic nobody asserts.
+GEOMETRY_TRACK_CAP = 64
+
+
+def split_a1(addr: str) -> Tuple[int, int]:
+    """Splits a bare A1 address into 1-based (row, column) COM indices."""
+
+    addr = addr.replace("$", "")
+    i = 0
+    while i < len(addr) and addr[i].isalpha():
+        i += 1
+    col = 0
+    for ch in addr[:i]:
+        col = col * 26 + (ord(ch.upper()) - ord("A") + 1)
+    return int(addr[i:]), col
+
+
+def read_orientation_value(page_setup) -> Any:
+    """Returns the post-apply Orientation as `"portrait"` / `"landscape"`.
+
+    Load-bearing rather than cosmetic: the pagination read can answer from
+    a page geometry the case never asked for (a portrait case coming back
+    with the preceding landscape case's breaks), and without the applied
+    orientation beside the breaks that is indistinguishable from Excel
+    genuinely disagreeing with the C++ paginator. An unreadable or
+    unrecognised value is reported as-is rather than guessed at.
+    """
+
+    try:
+        value = int(page_setup.Orientation)
+    except Exception:
+        return None
+    return _PRINT_ORIENTATION_NAMES.get(value, value)
+
+
+def read_paper_value(page_setup) -> Any:
+    """Returns the post-apply `PaperSize` as the `XlPaperSize` int.
+
+    The companion to the orientation read: paper and orientation together
+    are what fix the page the breaks were measured on.
+    """
+
+    try:
+        return int(page_setup.PaperSize)
+    except Exception:
+        return None
+
+
+def read_zoom_value(page_setup) -> Any:
+    """Returns the post-apply Zoom: int percent, or `False` when Fit-active.
+
+    Excel's COM ``PageSetup.Zoom`` is ``False`` when "Fit to" pagination
+    is engaged, else an integer percent (10..400). Boolean is checked
+    before numeric because Python's ``isinstance(False, int)`` is True.
+    """
+
+    try:
+        val = page_setup.Zoom
+    except Exception:
+        return None
+    if isinstance(val, bool):
+        return False if val is False else True
+    if isinstance(val, (int, float)):
+        return int(val)
+    return None
+
+
+def read_fit_value(page_setup, name: str) -> Any:
+    """Returns the post-apply ``FitToPagesWide/Tall``: int or False (auto).
+
+    Excel returns ``False`` for the "auto" / unset axis and an integer
+    (1..32767) when constrained. Same bool-before-int ordering applies
+    as for Zoom.
+    """
+
+    try:
+        val = getattr(page_setup, name)
+    except Exception:
+        return None
+    if isinstance(val, bool):
+        return False
+    if isinstance(val, (int, float)):
+        return int(val)
+    return None
+
+
+_MARGIN_ATTRS = (
+    ("left", "LeftMargin"),
+    ("right", "RightMargin"),
+    ("top", "TopMargin"),
+    ("bottom", "BottomMargin"),
+    ("header", "HeaderMargin"),
+    ("footer", "FooterMargin"),
+)
+
+
+def read_margins(page_setup) -> Dict[str, Any]:
+    """Returns the post-apply page margins in inches.
+
+    Excel's COM `PageSetup.{Left,Right,Top,Bottom,Header,Footer}Margin`
+    are points; we divide by 72 so the golden surfaces inches (matching
+    Formulon's `PageMargins` struct and OOXML's <pageMargins> tag, which
+    are both inch-denominated). The body-height calibration hunt in the
+    print_matrix follow-up needs these values to distinguish "Excel
+    applied the OOXML defaults" from "Excel applied a workbook-template
+    preset that we never asked for".
+    """
+
+    out: Dict[str, Any] = {}
+    for key, attr in _MARGIN_ATTRS:
+        try:
+            val = getattr(page_setup, attr)
+        except Exception:
+            out[key] = None
+            continue
+        if isinstance(val, (int, float)) and not isinstance(val, bool):
+            out[key] = round(float(val) / _POINTS_PER_INCH, 6)
+        else:
+            out[key] = None
+    return out
+
+
+# `XlPageBreak`. A manual break authored into the file must read back as
+# manual; one that degraded to automatic means Excel discarded the
+# `<rowBreaks man="1">` we wrote and re-derived the break itself.
+_XL_PAGE_BREAK_MANUAL = -4135
+
+# The header/footer sections Excel exposes per page class, in the order
+# OOXML concatenates them into one string (`&L...&C...&R...`).
+_HEADER_FOOTER_POSITIONS = ("Left", "Center", "Right")
+
+# `PageSetup.<name>` for the odd/primary pages, and the `Page` object
+# carrying the same three positions for the even and first-page classes.
+_HEADER_FOOTER_CLASSES = (
+    ("odd", None),
+    ("even", "EvenPage"),
+    ("first", "FirstPage"),
+)
+
+
+def _read_header_footer(page_setup) -> Dict[str, Any]:
+    """Reads the six header/footer sections as Excel reports them.
+
+    OOXML stores one string per section with `&L` / `&C` / `&R` markers
+    inside it; COM splits the same content across three properties. The
+    golden records the split form, because that is what Excel actually
+    parsed the string into -- collapsing it back would hide a case where
+    Excel put our text in the wrong third.
+    """
+
+    out: Dict[str, Any] = {
+        "different_odd_even": com_bool(page_setup, "OddAndEvenPagesHeaderFooter"),
+        "different_first": com_bool(page_setup, "DifferentFirstPageHeaderFooter"),
+        "scale_with_doc": com_bool(page_setup, "ScaleWithDocHeaderFooter"),
+        "align_with_margins": com_bool(page_setup, "AlignMarginsHeaderFooter"),
+    }
+    for class_name, page_attr in _HEADER_FOOTER_CLASSES:
+        owner = page_setup if page_attr is None else com_scalar(page_setup, page_attr)
+        for band in ("Header", "Footer"):
+            for position in _HEADER_FOOTER_POSITIONS:
+                key = f"{class_name}_{band.lower()}_{position.lower()}"
+                if owner is None:
+                    out[key] = None
+                    continue
+                if page_attr is None:
+                    # The odd/primary sections are plain strings on
+                    # `PageSetup` itself.
+                    out[key] = com_text(owner, f"{position}{band}")
+                    continue
+                section = com_scalar(owner, f"{position}{band}")
+                out[key] = None if section is None else com_text(section, "Text")
+    return out
+
+
+def _read_manual_breaks(ws) -> Dict[str, List[int]]:
+    """Returns the manual row / column breaks as zero-based indices.
+
+    Automatic breaks are filtered out: an authored break that Excel
+    re-derived rather than honoured is the failure this case exists to
+    catch, and keeping both kinds in one list would let a coincidental
+    automatic break at the same position mask it.
+    """
+
+    rows: List[int] = []
+    try:
+        for i in range(1, int(ws.api.HPageBreaks.Count) + 1):
+            brk = ws.api.HPageBreaks(i)
+            if com_int(brk, "Type") == _XL_PAGE_BREAK_MANUAL:
+                rows.append(int(brk.Location.Row) - 1)
+    except Exception:
+        pass
+    cols: List[int] = []
+    try:
+        for i in range(1, int(ws.api.VPageBreaks.Count) + 1):
+            brk = ws.api.VPageBreaks(i)
+            if com_int(brk, "Type") == _XL_PAGE_BREAK_MANUAL:
+                cols.append(int(brk.Location.Column) - 1)
+    except Exception:
+        pass
+    rows.sort()
+    cols.sort()
+    return {"manual_row_breaks": rows, "manual_col_breaks": cols}
+
+
+def read_roundtrip(sht) -> Dict[str, Any]:
+    """Reads every print setting Excel resolved from an opened workbook."""
+
+    page_setup = sht.api.PageSetup
+    print_area = com_text(page_setup, "PrintArea") or ""
+    title_rows = com_text(page_setup, "PrintTitleRows") or ""
+    title_cols = com_text(page_setup, "PrintTitleColumns") or ""
+
+    observed: Dict[str, Any] = {
+        "page_setup": {
+            "paper_size": com_int(page_setup, "PaperSize"),
+            "orientation": com_int(page_setup, "Orientation"),
+            "zoom": read_zoom_value(page_setup),
+            "fit_to_pages_wide": read_fit_value(page_setup, "FitToPagesWide"),
+            "fit_to_pages_tall": read_fit_value(page_setup, "FitToPagesTall"),
+        },
+        "page_margins": read_margins(page_setup),
+        "print_options": {
+            "grid_lines": com_bool(page_setup, "PrintGridlines"),
+            "headings": com_bool(page_setup, "PrintHeadings"),
+            "horizontal_centered": com_bool(page_setup, "CenterHorizontally"),
+            "vertical_centered": com_bool(page_setup, "CenterVertically"),
+        },
+        "header_footer": _read_header_footer(page_setup),
+        "print_area": normalise_print_area(print_area),
+        "print_title_rows": normalise_print_area(title_rows),
+        "print_title_cols": normalise_print_area(title_cols),
+    }
+    observed.update(_read_manual_breaks(sht))
+    return observed
diff --git a/tools/oracle/drivers/windows_pivot.py b/tools/oracle/drivers/windows_pivot.py
new file mode 100644
index 000000000..18d0783b9
--- /dev/null
+++ b/tools/oracle/drivers/windows_pivot.py
@@ -0,0 +1,244 @@
+"""PivotTable construction and grid readout through the Excel COM object model."""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List
+
+from .base import CaseResult
+from .case_sheet import split_sheet_qualified_addr
+from .cell_result import classify_value
+from .windows_com import CellAdapter, cell_displayed_text, format_com_error
+
+# Excel `XlConsolidationFunction` constants, keyed by the declarative
+# `agg` name. Mirrors the `Aggregation` enum the C++ builder accepts.
+# Numeric values are the documented Office automation constants so the
+# driver does not depend on the `win32com` constant cache being warm.
+_XL_CONSOLIDATION = {
+    "Sum": -4157,
+    "Count": -4112,
+    "Average": -4106,
+    "Max": -4136,
+    "Min": -4139,
+    "Product": -4149,
+    "CountNumbers": -4113,
+    "StdDev": -4155,
+    "StdDevP": -4156,
+    "Var": -4164,
+    "VarP": -4165,
+}
+
+# Excel `XlPivotFieldOrientation` constants.
+_XL_ORIENT_ROW = 1
+_XL_ORIENT_COLUMN = 2
+_XL_ORIENT_PAGE = 3
+_XL_ORIENT_DATA = 4
+
+# Excel `XlPivotTableSourceType.xlDatabase`.
+_XL_DATABASE = 1
+
+# Excel `XlLayoutRowType` values for `RowAxisLayout`.
+_XL_COMPACT_ROW = 0
+_XL_TABULAR_ROW = 1
+_XL_OUTLINE_ROW = 2
+
+_PIVOT_LAYOUT_MODES = {
+    "Compact": _XL_COMPACT_ROW,
+    "Tabular": _XL_TABULAR_ROW,
+    "Outline": _XL_OUTLINE_ROW,
+}
+
+
+def build_pivot_table(wb, pivot_spec: Dict[str, Any]):
+    """Creates a PivotTable in ``wb`` from a declarative ``pivot`` block.
+
+    Returns the materialised ``PivotTable`` COM object. The caller reads
+    ``TableRange2`` for the rendered grid and may then run post-build
+    formula probes. The ``pivot`` block shape is documented on
+    ``tests/oracle/workbook_builder.h``.
+    """
+
+    source = pivot_spec.get("source")
+    anchor = pivot_spec.get("anchor")
+    if not isinstance(source, str) or not source:
+        raise RuntimeError("pivot block missing string 'source'")
+    if not isinstance(anchor, str) or not anchor:
+        raise RuntimeError("pivot block missing string 'anchor'")
+
+    # Resolve the declarative anchor "Report!A1" to the destination
+    # cell's COM Range, since CreatePivotTable accepts a Range here and
+    # the string form has the same fully-qualified requirement as
+    # SourceData. We also drive the source resolution through a Range
+    # object so PivotCaches.Create does not have to parse the address
+    # itself.
+    src_sheet_name, src_addr = split_sheet_qualified_addr(source)
+    anchor_sheet_name, anchor_addr = split_sheet_qualified_addr(anchor)
+    if src_sheet_name is None:
+        raise RuntimeError(f"pivot source must be sheet-qualified (e.g. 'Data!A1:C13'); got {source!r}")
+    if anchor_sheet_name is None:
+        raise RuntimeError(f"pivot anchor must be sheet-qualified (e.g. 'Report!A1'); got {anchor!r}")
+
+    def _find_sheet(name: str):
+        for sht in wb.sheets:
+            if sht.name.casefold() == name.casefold():
+                return sht
+        return None
+
+    src_sheet = _find_sheet(src_sheet_name)
+    anchor_sheet = _find_sheet(anchor_sheet_name)
+    if src_sheet is None:
+        raise RuntimeError(f"pivot source references unknown sheet {src_sheet_name!r}")
+    if anchor_sheet is None:
+        raise RuntimeError(f"pivot anchor references unknown sheet {anchor_sheet_name!r}")
+
+    source_range_api = src_sheet.range(src_addr).api
+    anchor_range_api = anchor_sheet.range(anchor_addr).api
+
+    # Activate the anchor sheet so CreatePivotTable's destination is on
+    # the active sheet -- some Excel builds reject creating a pivot
+    # whose destination is on an inactive sheet with E_INVALIDARG.
+    try:
+        anchor_sheet.activate()
+    except Exception:
+        pass
+
+    api = wb.api
+    cache = api.PivotCaches().Create(_XL_DATABASE, source_range_api)
+    pivot = cache.CreatePivotTable(anchor_range_api, "FormulonPivot")
+
+    for field_name in pivot_spec.get("row_fields") or []:
+        pivot.PivotFields(field_name).Orientation = _XL_ORIENT_ROW
+    for field_name in pivot_spec.get("col_fields") or []:
+        pivot.PivotFields(field_name).Orientation = _XL_ORIENT_COLUMN
+    for field_name in pivot_spec.get("page_fields") or []:
+        pivot.PivotFields(field_name).Orientation = _XL_ORIENT_PAGE
+
+    for data_field in pivot_spec.get("data_fields") or []:
+        field_name = data_field.get("field")
+        agg = data_field.get("agg", "Sum")
+        consolidation = _XL_CONSOLIDATION.get(agg)
+        if consolidation is None:
+            raise RuntimeError(f"unknown aggregation {agg!r}")
+        field = pivot.PivotFields(field_name)
+        field.Orientation = _XL_ORIENT_DATA
+        field.Function = consolidation
+
+    # Manual item filters: hide the named items on their field.
+    for filter_spec in pivot_spec.get("filters") or []:
+        field_name = filter_spec.get("field")
+        for item_name in filter_spec.get("hide") or []:
+            try:
+                pivot.PivotFields(field_name).PivotItems(item_name).Visible = False
+            except Exception:
+                pass
+
+    layout = pivot_spec.get("layout")
+    if isinstance(layout, str) and layout in _PIVOT_LAYOUT_MODES:
+        try:
+            pivot.RowAxisLayout(_PIVOT_LAYOUT_MODES[layout])
+        except Exception:
+            pass
+
+    grand = pivot_spec.get("grand_totals") or {}
+    if isinstance(grand, dict):
+        if "rows" in grand:
+            pivot.RowGrand = bool(grand["rows"])
+        if "cols" in grand:
+            pivot.ColumnGrand = bool(grand["cols"])
+
+    pivot.RefreshTable()
+    return pivot
+
+
+def run_formula_probes(wb, probes: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    """Write and read post-build formulas against a materialised PivotTable.
+
+    Formula probes are intentionally evaluated only after ``RefreshTable``.
+    A rendered PivotTable grid cannot exercise GETPIVOTDATA's page/data-axis
+    routing, whereas a formula cell can.  The result shape matches the
+    scalar grid records: ``{"kind": ..., "value": ...}`` or
+    ``{"kind": "error", "code": "#REF!"}``.
+    """
+
+    if not isinstance(probes, list) or not probes:
+        return []
+    out: List[Dict[str, Any]] = []
+    for probe in probes:
+        if not isinstance(probe, dict):
+            raise RuntimeError("pivot formula_probes entries must be objects")
+        probe_id = probe.get("id")
+        cell_ref = probe.get("cell")
+        formula = probe.get("formula")
+        if not isinstance(probe_id, str) or not probe_id:
+            raise RuntimeError("pivot formula probe missing string 'id'")
+        if not isinstance(cell_ref, str) or "!" not in cell_ref:
+            raise RuntimeError(f"formula probe {probe_id!r} needs sheet-qualified cell")
+        if not isinstance(formula, str) or not formula:
+            raise RuntimeError(f"formula probe {probe_id!r} missing string 'formula'")
+        sheet_name, bare_addr = split_sheet_qualified_addr(cell_ref)
+        target = None
+        for sht in wb.sheets:
+            if sht.name.casefold() == sheet_name.casefold():
+                target = sht
+                break
+        if target is None:
+            raise RuntimeError(f"formula probe {probe_id!r} references unknown sheet {sheet_name!r}")
+        result_cell = target.range(bare_addr)
+        try:
+            result_cell.formula2 = formula
+        except Exception:
+            result_cell.formula = formula
+
+    try:
+        wb.app.calculate()
+    except Exception as exc:
+        # Do not silently emit stale values from a prior probe. A formula
+        # result such as #REF! is a normal cell value and does not raise here;
+        # a COM calculation failure is a driver failure and must be visible.
+        raise RuntimeError(f"Excel failed to calculate formula probes: {format_com_error(exc)}") from exc
+
+    for probe in probes:
+        sheet_name, bare_addr = split_sheet_qualified_addr(probe["cell"])
+        target = next(sht for sht in wb.sheets if sht.name.casefold() == sheet_name.casefold())
+        result = classify_value(CellAdapter(target.range(bare_addr).api), None, cell_displayed_text)
+        out.append({"id": probe["id"], "cell": probe["cell"], "result": _grid_value_record(result)})
+    return out
+
+
+def read_pivot_grid(wb, table_range) -> "tuple[List[Dict[str, Any]], int, int]":
+    """Reads every cell of ``table_range`` into an anchor-relative grid.
+
+    Returns ``(grid, rows, cols)`` where ``grid`` is a list of
+    ``{"r", "c", "value"}`` records (``r`` / ``c`` are 0-based offsets
+    from the pivot anchor) and ``value`` is the normalised ``{kind,
+    value}`` record produced by ``classify_value``.
+    """
+
+    rows = int(table_range.Rows.Count)
+    cols = int(table_range.Columns.Count)
+    top = int(table_range.Row)
+    left = int(table_range.Column)
+    sht = table_range.Worksheet
+
+    grid: List[Dict[str, Any]] = []
+    for r in range(rows):
+        for c in range(cols):
+            com_cell = sht.Cells(top + r, left + c)
+            result = classify_value(CellAdapter(com_cell), None, cell_displayed_text)
+            grid.append(
+                {
+                    "r": r,
+                    "c": c,
+                    "value": _grid_value_record(result),
+                }
+            )
+    return grid, rows, cols
+
+
+def _grid_value_record(result: CaseResult) -> Dict[str, Any]:
+    """Shapes a ``CaseResult`` into the golden grid's ``{kind, value}``."""
+
+    if result.kind == "blank":
+        return {"kind": "blank"}
+    if result.kind == "error":
+        return {"kind": "error", "code": result.error_code or "#UNKNOWN!"}
+    return {"kind": result.kind, "value": result.value}
diff --git a/tools/oracle/oracle_gen.py b/tools/oracle/oracle_gen.py
index e29393d49..9977c2a24 100644
--- a/tools/oracle/oracle_gen.py
+++ b/tools/oracle/oracle_gen.py
@@ -495,9 +495,9 @@ def _apply_divergence_metadata(
 def _version_tuple(s: str) -> Tuple[int, ...]:
     """Returns a comparable integer tuple from an Excel version string.
 
-    Mirrors ``cli.py``'s ``_version_tuple`` (duplicated rather than
-    imported: ``cli.py`` imports this module, so the reverse import
-    would be circular). Returns ``(0,)`` for strings with no leading
+    Mirrors ``contribute.py``'s ``_version_tuple`` (duplicated rather
+    than imported: the contributor flow sits above this module, so the
+    reverse import would be circular). Returns ``(0,)`` for strings with no leading
     digit run, e.g. a hand-seeded placeholder version.
     """
 
diff --git a/tools/oracle/preflight.py b/tools/oracle/preflight.py
new file mode 100644
index 000000000..4c604ae1e
--- /dev/null
+++ b/tools/oracle/preflight.py
@@ -0,0 +1,408 @@
+"""Preflight checks that verify the host can drive each target oracle."""
+
+from __future__ import annotations
+
+import argparse
+import platform
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+# Local imports -- accept both `python3 tools/oracle/cli.py` (no package)
+# and `python3 -m tools.oracle.cli` (package-style).
+try:  # pragma: no cover - trivial fallback
+    from tools.oracle.drivers import resolve_win_python
+    from tools.oracle.targets_manifest import _load_targets, _platform_label
+except ImportError:  # pragma: no cover
+    from drivers import resolve_win_python  # type: ignore
+    from targets_manifest import _load_targets, _platform_label  # type: ignore
+
+
+_STATUS_PASS = "PASS"
+
+_STATUS_FAIL = "FAIL"
+
+_STATUS_SKIP = "SKIP"
+
+
+def _print_check(target_name: str, status: str, label: str, hint: str = "") -> None:
+    """Pretty-prints one preflight check line.
+
+    `status` is one of PASS / FAIL / SKIP. `hint` is appended on a wrapped
+    indented line when present so operators can copy-paste fixes.
+    """
+
+    print(f"  [{status}] {label}")
+    if hint:
+        for line in hint.splitlines():
+            print(f"        {line}")
+
+
+def _venv_python() -> Path:
+    """Returns the canonical path to the rye-managed venv interpreter."""
+
+    return Path(__file__).resolve().parent / ".venv" / "bin" / "python"
+
+
+def _check_xlwings_import(python_exe: Path) -> Tuple[str, str]:
+    """Returns (status, hint) for `import xlwings` under `python_exe`."""
+
+    if not python_exe.exists():
+        return (
+            _STATUS_FAIL,
+            f"interpreter not found: {python_exe}\nHint: run `make oracle-setup` to create the venv.",
+        )
+    proc = subprocess.run(
+        [str(python_exe), "-c", "import xlwings"],
+        capture_output=True,
+        text=True,
+    )
+    if proc.returncode == 0:
+        return (_STATUS_PASS, "")
+    return (
+        _STATUS_FAIL,
+        "xlwings import failed:\n"
+        + (proc.stderr.strip() or proc.stdout.strip())
+        + "\nHint: cd tools/oracle && rye sync",
+    )
+
+
+def _check_excel_reachable(python_exe: Path) -> Tuple[str, str]:
+    """Returns (status, hint) for an Automation reachability probe.
+
+    Uses ``xlwings.apps.count`` which forces lazy attachment to the
+    running Excel app and surfaces an Automation permission denial
+    immediately. We do not start a fresh Excel here -- that is far too
+    intrusive for a preflight.
+    """
+
+    proc = subprocess.run(
+        [str(python_exe), "-c", "import xlwings, sys; sys.exit(0 if hasattr(xlwings, 'apps') else 1)"],
+        capture_output=True,
+        text=True,
+    )
+    if proc.returncode == 0:
+        return (
+            _STATUS_PASS,
+            "",
+        )
+    return (
+        _STATUS_FAIL,
+        "xlwings.apps lookup failed:\n"
+        + (proc.stderr.strip() or proc.stdout.strip())
+        + "\nHint: System Settings -> Privacy & Security -> Automation\n"
+        "       -> (your terminal) -> Microsoft Excel (allow).",
+    )
+
+
+def _discover_win_python_candidates() -> List[Path]:
+    """Returns plausible Windows-side ``python.exe`` paths visible from WSL2.
+
+    Scans the standard per-user (winget / python.org installer) and
+    machine-wide install locations, skipping the Microsoft Store stub
+    under ``WindowsApps`` which is a reparse point and not a real
+    interpreter. Returns existing files only, deduplicated and sorted by
+    descending Python version (so Python312 wins over Python311 when
+    both are present).
+    """
+
+    roots: List[Path] = []
+    roots.extend(Path("/mnt/c/Users").glob("*/AppData/Local/Programs/Python/Python3*/python.exe"))
+    roots.extend(Path("/mnt/c/Program Files").glob("Python3*/python.exe"))
+    roots.extend(Path("/mnt/c/Program Files (x86)").glob("Python3*/python.exe"))
+    seen: List[Path] = []
+    for p in roots:
+        if "WindowsApps" in p.parts:
+            continue
+        if p.is_file() and p not in seen:
+            seen.append(p)
+    seen.sort(key=lambda p: p.parent.name, reverse=True)
+    return seen
+
+
+def _check_win_python_path(target: Dict[str, Any]) -> Tuple[str, str, Optional[Path]]:
+    """Returns (status, hint, resolved_path) for ``target.win_python``.
+
+    The third element is the resolved Path when the field is set and
+    points to an existing file, otherwise ``None`` -- callers use it to
+    decide whether dependent checks can run or must SKIP.
+    """
+
+    win_python = resolve_win_python(target)
+    if not win_python:
+        candidates = _discover_win_python_candidates()
+        if candidates:
+            suggestion = (
+                "Hint: Windows-side Python is installed but FORMULON_WIN_PYTHON "
+                "is not exported. Found:\n"
+                + "\n".join(f"        {p}" for p in candidates)
+                + "\n      Export the one you want to use:\n"
+                f'        export FORMULON_WIN_PYTHON="{candidates[0]}"'
+            )
+        else:
+            suggestion = (
+                "Hint: install Python on Windows (winget install Python.Python.3.12),\n"
+                "      then either export FORMULON_WIN_PYTHON pointing at the\n"
+                "      Windows-side python.exe (preferred for OSS contributors so\n"
+                "      no per-machine path lands in targets.yaml) or, for a\n"
+                "      private fork, add a win_python: line under the target.\n"
+                "      Example:\n"
+                '        export FORMULON_WIN_PYTHON="/mnt/c/Users/<you>/AppData/'
+                'Local/Programs/Python/Python312/python.exe"'
+            )
+        return (
+            _STATUS_FAIL,
+            "win_python not configured\n" + suggestion,
+            None,
+        )
+    p = Path(win_python)
+    if not p.exists():
+        return (
+            _STATUS_FAIL,
+            f"win_python path does not exist: {p}\n"
+            "Hint: confirm the Windows Python install path; from WSL2 the\n"
+            "      Windows C: drive is mounted at /mnt/c.",
+            None,
+        )
+    return (_STATUS_PASS, "", p)
+
+
+def _check_win_python_imports(win_python: Path) -> Tuple[str, str]:
+    """Returns (status, hint) for ``import xlwings, win32com.client`` on the
+    Windows-side interpreter. Only runs when win_python resolved cleanly.
+    """
+
+    proc = subprocess.run(
+        [str(win_python), "-c", "import xlwings, win32com.client"],
+        capture_output=True,
+        text=True,
+    )
+    if proc.returncode == 0:
+        return (_STATUS_PASS, "")
+    return (
+        _STATUS_FAIL,
+        "Windows-side xlwings/pywin32 import failed:\n"
+        + (proc.stderr.strip() or proc.stdout.strip())
+        + "\nHint: in PowerShell, run:\n"
+        "        py -m pip install xlwings pywin32 pyyaml",
+    )
+
+
+def _check_wslpath() -> Tuple[str, str]:
+    """Returns (status, hint) for the ``wslpath`` translator.
+
+    ``wslpath -w /tmp`` is the smallest invocation that exercises the
+    binary; a non-empty stdout proves the WSL2 kernel is providing the
+    translation service.
+    """
+
+    try:
+        proc = subprocess.run(["wslpath", "-w", "/tmp"], capture_output=True, text=True)
+    except FileNotFoundError:
+        return (
+            _STATUS_FAIL,
+            "wslpath not on PATH\n"
+            "Hint: wslpath only exists on WSL2; if you are on plain Linux\n"
+            "      you cannot drive Windows Excel from this host.",
+        )
+    if proc.returncode == 0 and proc.stdout.strip():
+        return (_STATUS_PASS, "")
+    return (
+        _STATUS_FAIL,
+        f"wslpath -w /tmp failed: rc={proc.returncode}\n" + (proc.stderr.strip() or proc.stdout.strip()),
+    )
+
+
+def _runs_on_label(target: Dict[str, Any]) -> str:
+    """Returns the comma-joined ``runs_on`` for printing."""
+
+    runs_on = target.get("runs_on") or []
+    if not isinstance(runs_on, list):
+        return "?"
+    return ",".join(str(x) for x in runs_on) or "?"
+
+
+def _check_target(target_name: str, target: Dict[str, Any], host: str) -> bool:
+    """Runs the preflight checks for one target. Returns True on success."""
+
+    print(f"[setup] target={target_name} host={host}")
+    driver_name = target.get("driver")
+
+    # Host vs runs_on sanity. We still let the per-driver checks run on a
+    # mismatch (downgraded to SKIP) so the operator sees what would be
+    # required if they were on the right host.
+    runs_on = target.get("runs_on") or []
+    host_compatible = isinstance(runs_on, list) and platform.system() in runs_on
+
+    if driver_name == "macos_excel":
+        if host != "Darwin":
+            _print_check(
+                target_name,
+                _STATUS_FAIL,
+                "host compatibility",
+                f"target requires Darwin, current host is {host}.\nruns_on={_runs_on_label(target)}",
+            )
+            _print_check(target_name, _STATUS_SKIP, "xlwings import (host mismatch)")
+            _print_check(target_name, _STATUS_SKIP, "Excel automation reachable (host mismatch)")
+            return False
+        ok = True
+        status, hint = _check_xlwings_import(_venv_python())
+        _print_check(target_name, status, "xlwings import", hint)
+        if status != _STATUS_PASS:
+            ok = False
+            _print_check(target_name, _STATUS_SKIP, "Excel automation reachable (xlwings missing)")
+        else:
+            status2, hint2 = _check_excel_reachable(_venv_python())
+            _print_check(target_name, status2, "Excel automation reachable", hint2)
+            if status2 != _STATUS_PASS:
+                ok = False
+        return ok
+
+    if driver_name == "windows_excel":
+        # Three legal hosts: Windows (direct COM), WSL2 (bridge), or
+        # anything else (skip with a host-mismatch FAIL).
+        # `host` here is the label from `_platform_label()` -- on WSL2 it
+        # carries the "(WSL2)" suffix, so we cannot compare against the
+        # bare `platform.system()` value.
+        is_wsl2 = "(WSL2)" in host
+        if host == "Windows":
+            ok = True
+            # On Windows we can only verify import; the actual COM probe
+            # depends on Office activation state which we don't want to
+            # touch from a preflight. Leave it to the operator.
+            status, hint = _check_xlwings_import(_venv_python())
+            _print_check(target_name, status, "xlwings import (Windows host)", hint)
+            if status != _STATUS_PASS:
+                ok = False
+            _print_check(
+                target_name,
+                _STATUS_SKIP,
+                "Excel COM probe (skipped on preflight; manual oracle-gen will surface activation issues)",
+            )
+            return ok and host_compatible
+
+        if is_wsl2:
+            ok = True
+            status, hint, win_python = _check_win_python_path(target)
+            _print_check(target_name, status, "win_python configured", hint)
+            if win_python is None:
+                ok = False
+                _print_check(
+                    target_name,
+                    _STATUS_SKIP,
+                    "Windows-side xlwings + win32com import (depends on win_python)",
+                )
+            else:
+                status2, hint2 = _check_win_python_imports(win_python)
+                _print_check(target_name, status2, "Windows-side xlwings + win32com import", hint2)
+                if status2 != _STATUS_PASS:
+                    ok = False
+            status3, hint3 = _check_wslpath()
+            _print_check(target_name, status3, "wslpath translation", hint3)
+            if status3 != _STATUS_PASS:
+                ok = False
+            return ok
+
+        _print_check(
+            target_name,
+            _STATUS_FAIL,
+            "host compatibility",
+            f"target needs Windows or WSL2, current host is {host}.\nruns_on={_runs_on_label(target)}",
+        )
+        _print_check(target_name, _STATUS_SKIP, "xlwings + win32com import (host mismatch)")
+        _print_check(target_name, _STATUS_SKIP, "wslpath translation (host mismatch)")
+        return False
+
+    if driver_name == "wsl_bridge":
+        is_wsl2 = "(WSL2)" in host
+        if not is_wsl2:
+            _print_check(
+                target_name,
+                _STATUS_FAIL,
+                "host compatibility",
+                f"target needs WSL2, current host is {_platform_label()}.",
+            )
+            _print_check(target_name, _STATUS_SKIP, "win_python configured (host mismatch)")
+            _print_check(target_name, _STATUS_SKIP, "wslpath translation (host mismatch)")
+            return False
+        ok = True
+        status, hint, win_python = _check_win_python_path(target)
+        _print_check(target_name, status, "win_python configured", hint)
+        if win_python is None:
+            ok = False
+            _print_check(
+                target_name,
+                _STATUS_SKIP,
+                "Windows-side xlwings + win32com import (depends on win_python)",
+            )
+        else:
+            status2, hint2 = _check_win_python_imports(win_python)
+            _print_check(target_name, status2, "Windows-side xlwings + win32com import", hint2)
+            if status2 != _STATUS_PASS:
+                ok = False
+        status3, hint3 = _check_wslpath()
+        _print_check(target_name, status3, "wslpath translation", hint3)
+        if status3 != _STATUS_PASS:
+            ok = False
+        return ok
+
+    _print_check(
+        target_name,
+        _STATUS_FAIL,
+        f"unknown driver: {driver_name!r}",
+        "Hint: targets.yaml driver must be one of 'macos_excel', 'windows_excel', 'wsl_bridge'.",
+    )
+    return False
+
+
+def _cmd_setup(args: argparse.Namespace) -> int:
+    """Verifies the host can drive its target oracle.
+
+    With ``--target NAME`` checks just that one. Without, iterates every
+    target whose ``runs_on:`` includes the current platform (so a Mac
+    developer never sees noise about Windows-only targets, but a WSL2
+    developer correctly sees the windows_excel target).
+    """
+
+    doc = _load_targets(args.targets_file)
+    targets: Dict[str, Any] = doc.get("targets") or {}
+    host_label = _platform_label()
+    host = platform.system()
+
+    if args.target is not None:
+        if args.target not in targets:
+            avail = ", ".join(sorted(targets.keys()))
+            raise RuntimeError(f"unknown target: {args.target!r} (available: {avail})")
+        chosen = [(args.target, targets[args.target])]
+    else:
+        chosen = [
+            (n, t)
+            for n, t in sorted(targets.items())
+            if isinstance(t, dict) and platform.system() in (t.get("runs_on") or [])
+        ]
+        if not chosen:
+            print(
+                f"setup: no targets in targets.yaml declare runs_on: [{host}]",
+                file=sys.stderr,
+            )
+            return 0
+
+    ready = 0
+    failed = 0
+    for name, record in chosen:
+        if not isinstance(record, dict):
+            print(f"[setup] target={name}: malformed (not a mapping)", file=sys.stderr)
+            failed += 1
+            continue
+        if _check_target(name, record, host_label):
+            ready += 1
+        else:
+            failed += 1
+
+    print()
+    if failed == 0:
+        print(f"setup: {ready} target ready.")
+        return 0
+    print(f"setup: {ready} target ready, {failed} needs configuration.")
+    return 1
diff --git a/tools/oracle/targets_manifest.py b/tools/oracle/targets_manifest.py
new file mode 100644
index 000000000..d478853da
--- /dev/null
+++ b/tools/oracle/targets_manifest.py
@@ -0,0 +1,85 @@
+"""Loading and selection of oracle targets from targets.yaml, and the host label."""
+
+from __future__ import annotations
+
+import platform
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+DEFAULT_TARGETS_FILE = Path(__file__).resolve().parent / "targets.yaml"
+
+
+def _load_targets(path: Path) -> Dict[str, Any]:
+    """Reads and validates targets.yaml; returns the parsed mapping."""
+
+    if not path.exists():
+        raise RuntimeError(f"oracle targets file not found: {path}")
+    try:
+        import yaml  # type: ignore
+
+        doc = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    except Exception as exc:
+        raise RuntimeError(f"failed to parse {path}: {exc}") from exc
+    if not isinstance(doc, dict):
+        raise RuntimeError(f"{path} root must be a mapping")
+    targets = doc.get("targets")
+    if not isinstance(targets, dict) or not targets:
+        raise RuntimeError(f"{path} has no `targets:` mapping")
+    return doc
+
+
+def _runs_on_current(target: Dict[str, Any]) -> bool:
+    """Whether the target declares the current OS in `runs_on:`."""
+
+    runs_on = target.get("runs_on") or []
+    if not isinstance(runs_on, list):
+        return False
+    return platform.system() in runs_on
+
+
+def _platform_label() -> str:
+    """Returns ``platform.system()`` with a ``(WSL2)`` suffix on WSL2.
+
+    The CLI's ``list`` command surfaces this so operators can confirm at
+    a glance which side of the WSL boundary they are on -- ``Linux`` and
+    ``Linux (WSL2)`` route to different drivers for the same target.
+    """
+
+    if platform.system() == "Linux":
+        try:
+            if "microsoft" in Path("/proc/version").read_text(encoding="utf-8").lower():
+                return "Linux (WSL2)"
+        except OSError:
+            pass
+    return platform.system()
+
+
+def _select_targets(
+    doc: Dict[str, Any],
+    *,
+    name: Optional[str],
+    all_targets: bool,
+) -> List[Tuple[str, Dict[str, Any]]]:
+    """Returns the (name, record) list to dispatch.
+
+    If `name` is set, just that one (with no `runs_on` filtering — let
+    oracle_gen surface the platform error directly). If `all_targets`,
+    every target whose `runs_on:` contains the current OS. Otherwise the
+    primary target only.
+    """
+
+    targets: Dict[str, Any] = doc.get("targets") or {}
+    if name is not None:
+        if name not in targets:
+            avail = ", ".join(sorted(targets.keys()))
+            raise RuntimeError(f"unknown target: {name!r} (available: {avail})")
+        return [(name, targets[name])]
+    if all_targets:
+        chosen: List[Tuple[str, Dict[str, Any]]] = [(n, t) for n, t in sorted(targets.items()) if _runs_on_current(t)]
+        if not chosen:
+            raise RuntimeError(f"no targets in targets.yaml declare runs_on: [{platform.system()}]")
+        return chosen
+    primary = doc.get("primary")
+    if not isinstance(primary, str) or primary not in targets:
+        raise RuntimeError("targets.yaml is missing a valid `primary:` entry")
+    return [(primary, targets[primary])]
diff --git a/tools/wasm/capi_exports.txt b/tools/wasm/capi_exports.txt
index a5e17ab5d..049f5902e 100644
--- a/tools/wasm/capi_exports.txt
+++ b/tools/wasm/capi_exports.txt
@@ -59,6 +59,10 @@ fm_workbook_get_cell_phonetic_run_count
 fm_workbook_get_cell_phonetic_run
 fm_workbook_get_cell_phonetic_properties
 fm_workbook_lambda_text_at
+fm_workbook_get_formula
+fm_workbook_get_formula_r1c1
+fm_workbook_get_display_text
+fm_workbook_format_value
 
 # -- Ad-hoc array evaluation (two-step: evaluate + per-cell readback) -------------
 fm_workbook_evaluate_cf_formula
@@ -68,6 +72,11 @@ fm_workbook_evaluate_formula_array_cell
 # -- Iteration / dump ------------------------------------------------------------
 fm_workbook_cell_count
 fm_workbook_cell_at
+fm_sheet_cells_in_range
+fm_cell_range_count
+fm_cell_range_at
+fm_cell_range_next_cursor
+fm_cell_range_destroy
 fm_workbook_defined_name_count
 fm_workbook_defined_name_at
 fm_workbook_table_count
@@ -100,6 +109,7 @@ fm_sheet_remove_merge_at
 fm_sheet_clear_merges
 fm_sheet_get_merge_at
 fm_sheet_get_merge_count
+fm_sheet_merges_in_range
 fm_sheet_add_hyperlink
 fm_sheet_remove_hyperlink
 fm_sheet_remove_hyperlink_at
@@ -111,12 +121,26 @@ fm_sheet_get_comment_count
 fm_sheet_get_comment_at_index
 fm_sheet_set_comment
 
+# -- Threaded comments / persons -------------------------------------------------
+fm_sheet_threaded_comment_count
+fm_sheet_threaded_comment_at
+fm_sheet_add_threaded_comment
+fm_sheet_edit_threaded_comment
+fm_sheet_set_thread_resolved
+fm_sheet_remove_threaded_comment
+fm_workbook_person_count
+fm_workbook_person_at
+fm_workbook_add_person
+fm_workbook_remove_person
+
 # -- Data validations ------------------------------------------------------------
 fm_sheet_get_validation_count
 fm_sheet_get_validation_at
 fm_sheet_add_validation
 fm_sheet_remove_validation_at
 fm_sheet_clear_validations
+fm_sheet_validate_value
+fm_sheet_list_invalid_cells
 
 # -- Sheet protection ------------------------------------------------------------
 fm_sheet_get_protection
@@ -125,6 +149,18 @@ fm_sheet_set_protection
 # -- Sheet view / layout ---------------------------------------------------------
 fm_sheet_get_auto_filter_xml
 fm_sheet_set_auto_filter_xml
+fm_sheet_get_auto_filter
+fm_sheet_set_auto_filter
+fm_sheet_remove_auto_filter
+fm_sheet_apply_auto_filter
+fm_sheet_clear_auto_filter
+fm_sheet_evaluate_auto_filter
+fm_table_get_auto_filter
+fm_table_set_auto_filter
+fm_table_remove_auto_filter
+fm_table_apply_auto_filter
+fm_table_clear_auto_filter
+fm_table_evaluate_auto_filter
 fm_sheet_get_view
 fm_sheet_set_zoom
 fm_sheet_set_freeze
@@ -146,6 +182,15 @@ fm_sheet_get_row_override
 fm_sheet_set_row_height
 fm_sheet_set_row_hidden
 fm_sheet_set_row_outline
+fm_sheet_clear_row_height
+fm_sheet_get_format_defaults
+fm_sheet_set_format_defaults
+fm_sheet_cell_rect_pt
+fm_sheet_column_width_pt
+fm_sheet_row_height_pt
+fm_sheet_width_model
+fm_sheet_column_chars_to_pt
+fm_sheet_column_pt_to_chars
 
 # -- Conditional formatting ------------------------------------------------------
 fm_workbook_cf_evaluate_range
@@ -196,8 +241,15 @@ fm_styles_add_cell_xf
 fm_styles_add_dxf
 fm_styles_add_cell_style_xf
 fm_styles_set_cell_style
+fm_styles_remove_cell_style
 fm_styles_set_font
 fm_workbook_set_default_font
+fm_workbook_get_theme_colors
+fm_workbook_set_theme_colors
+fm_workbook_get_theme_fonts
+fm_workbook_set_theme_fonts
+fm_workbook_resolve_color
+fm_sheet_get_effective_style
 
 # -- Pivot layout projection -----------------------------------------------------
 fm_workbook_pivot_count
@@ -301,6 +353,15 @@ fm_pagination_horizontal_break_count
 fm_pagination_horizontal_break_at
 fm_pagination_vertical_break_count
 fm_pagination_vertical_break_at
+fm_pagination_paper
+fm_pagination_margins
+fm_pagination_printable
+fm_pagination_scale
+fm_pagination_page_order
+fm_pagination_print_titles
+fm_pagination_page_at
+fm_pagination_horizontal_break_is_manual
+fm_pagination_vertical_break_is_manual
 fm_sheet_get_page_setup_xml
 fm_sheet_set_page_setup_xml
 fm_sheet_get_page_margins_xml
@@ -333,6 +394,14 @@ fm_sheet_get_page_setup
 fm_sheet_get_page_margins
 fm_sheet_set_range_xf_index
 
+# -- Drawing images --------------------------------------------------------------
+fm_workbook_probe_image
+fm_sheet_drawing_object_count
+fm_sheet_drawing_object_at
+fm_sheet_get_image
+fm_sheet_insert_image
+fm_sheet_remove_image
+
 # -- Version ---------------------------------------------------------------------
 fm_version_string